# incident

plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.122.133.153
country_id: 3865483
description:
Jan  8 22:01:16 host2 dovecot[717960]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info@jrdc.lk>, method=PLAIN, rip=190.122.133.153, lip=66.85.158.91, TLS, session=<2v7S7uJHdtu+eoWZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.240.96.50
country_id: 3469034
description:
Jan  8 22:01:33 host2 dovecot[717960]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info>, method=PLAIN, rip=191.240.96.50, lip=66.85.158.91, TLS, session=<L+/a7+JHD9C/8GAy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.124.182.54
country_id: 3175395
description:
Jan  8 22:01:34 host2 dovecot[717960]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=185.124.182.54, lip=66.85.158.91, TLS, session=<Po4q8OJHecC5fLY2>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.169.219
country_id: 3175395
description:
Jan  8 22:01:24 host2 dovecot[717960]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=185.15.169.219, lip=66.85.158.91, TLS, session=<WA+H7+JH89i5D6nb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 181.16.212.116
country_id: 3865483
description:
Jan  8 22:01:26 host2 dovecot[717960]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=181.16.212.116, lip=66.85.158.91, TLS, session=<gLmX7+JHFby1ENR0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.233.64.153
country_id: 3469034
description:
Jan  8 22:01:39 host2 dovecot[717960]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info>, method=PLAIN, rip=170.233.64.153, lip=66.85.158.91, TLS, session=<MUE08OJHvbSq6UCZ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.214.218.61
country_id: 2802361
description:
2026-01-08 22:04:17 dovecot_login authenticator failed for H=(ADMIN) [181.214.218.61]:12951: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.83.40.172
country_id: 6252001
description:
Jan  8 22:05:47 host2 dovecot[717960]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=20.83.40.172, lip=66.85.158.92, TLS, session=<2P04AONHAIcUUyis>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.168.89.98
country_id: 798544
description:
Jan  8 22:05:35 host2 sshd[746725]: Disconnected from invalid user admin 83.168.89.98 port 47470 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
country_id: 3932488
description:
2026-01-08 22:07:29 dovecot_login authenticator failed for H=([190.117.96.174]) [190.117.96.174]:57580: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.31.154
country_id: 1269750
description:
2026-01-08 22:07:53 dovecot_login authenticator failed for H=([125.20.249.154]) [103.251.31.154]:49030: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.227.252.2
country_id: 1269750
description:
2026-01-08 22:08:11 dovecot_login authenticator failed for H=(abts-tn-dynamic-2.252.227.110.airtelbroadband.in) [110.227.252.2]:57914: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.237.115.206
country_id: 732800
description:
2026-01-08 22:08:47 dovecot_login authenticator failed for H=(151.237.115.206.pronet.bg) [151.237.115.206]:60807: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 77.74.229.158
country_id: 2510769
description:
Jan  8 22:08:19 host2 sshd[748802]: Disconnected from invalid user user1 77.74.229.158 port 36154 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.184.114
country_id: 1269750
description:
2026-01-08 22:08:38 dovecot_login authenticator failed for H=([152.52.238.86]) [182.95.184.114]:50726: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.97.62
country_id: 1269750
description:
2026-01-08 22:08:25 dovecot_login authenticator failed for H=(nsg-corporate-209.240.186.122.airtel.in) [27.123.97.62]:54668: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 77.74.229.158
country_id: 2510769
description:
Jan  8 22:10:01 host2 sshd[758980]: Disconnected from invalid user admin1 77.74.229.158 port 48716 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.32.33.161
country_id: 3686110
description:
Jan  8 22:10:09 host2 sshd[759640]: Disconnected from invalid user ubuntu 179.32.33.161 port 50370 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 220.247.223.56
country_id: 1227603
description:
Jan  8 22:09:18 host2 sshd[754201]: Disconnected from invalid user admin 220.247.223.56 port 33372 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-08 22:09:29 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (psiourly) [87.103.126.54]:63995: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.172.153.100
country_id: 3508796
description:
Jan  8 22:10:28 host2 sshd[762143]: Disconnected from invalid user ubuntu 45.172.153.100 port 33382 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 179.32.33.161
country_id: 3686110
description:
Jan  8 22:10:47 host2 sshd[762793]: Disconnected from invalid user user1 179.32.33.161 port 35502 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.168.89.98
country_id: 798544
description:
Jan  8 22:11:54 host2 sshd[763541]: Disconnected from invalid user user 83.168.89.98 port 49584 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.156.2
country_id: 1269750
description:
2026-01-08 22:12:15 dovecot_login authenticator failed for H=([125.19.156.2]) [125.19.156.2]:47640: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.32.33.161
country_id: 3686110
description:
Jan  8 22:11:24 host2 sshd[763228]: Disconnected from invalid user ubuntu 179.32.33.161 port 48856 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 93.127.126.162
country_id: 690791
description:
Jan  8 22:12:16 host2 sshd[763818]: Disconnected from invalid user ubuntu 93.127.126.162 port 51324 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.83.135.122
country_id: 6251999
description:
2026-01-08 22:12:14 dovecot_login authenticator failed for H=([24.83.135.122]) [24.83.135.122]:58984: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.102.50
country_id: 1269750
description:
2026-01-08 22:12:05 dovecot_login authenticator failed for H=([27.123.102.50]) [27.123.102.50]:56044: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.168.89.98
country_id: 798544
description:
Jan  8 22:14:05 host2 sshd[765686]: Disconnected from invalid user user1 83.168.89.98 port 44222 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.52.217.71
country_id: 3686110
description:
2026-01-08 22:14:48 dovecot_login authenticator failed for H=(static-ip-cr18152021771.cable.net.co) [181.52.217.71]:58894: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.17.233.246
country_id: 1269750
description:
2026-01-08 22:15:02 dovecot_login authenticator failed for H=([125.17.233.246]) [125.17.233.246]:45940: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.249.84.242
country_id: 1733045
description:
Jan  8 22:15:27 host2 sshd[766777]: Disconnected from invalid user user1 103.249.84.242 port 47942 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.183.224.170
country_id: 1880251
description:
Jan  8 22:17:10 host2 sshd[767882]: Disconnected from invalid user ubuntu 68.183.224.170 port 56874 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.53
country_id: 6252001
description:
Jan  8 22:17:44 host2 dovecot[717960]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=167.94.146.53, lip=66.85.158.92, TLS: Connection closed, session=<byP4KuNHHFqnXpI1>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 68.183.224.170
country_id: 1880251
description:
Jan  8 22:17:48 host2 sshd[768285]: Disconnected from invalid user user1 68.183.224.170 port 37116 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.241.102
country_id: 1269750
description:
2026-01-08 22:17:49 dovecot_login authenticator failed for H=([125.19.175.152]) [182.78.241.102]:38860: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.249.84.242
country_id: 1733045
description:
Jan  8 22:17:23 host2 sshd[768080]: Disconnected from invalid user deploy 103.249.84.242 port 58226 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.47.46.174
country_id: 1522867
description:
2026-01-08 22:18:59 dovecot_login authenticator failed for H=([92.47.46.174]) [92.47.46.174]:59162: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.183.224.170
country_id: 1880251
description:
Jan  8 22:18:22 host2 sshd[768857]: Disconnected from invalid user user1 68.183.224.170 port 35406 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.162.102
country_id: 1269750
description:
2026-01-08 22:19:16 dovecot_login authenticator failed for H=([125.19.162.102]) [125.19.162.102]:51338: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.27.253.6
country_id: 1168579
description:
2026-01-08 22:20:50 dovecot_login authenticator failed for H=(58-27-253-6.wateen.net) [58.27.253.6]:22205: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 129.80.228.231
country_id: 6252001
description:
2026-01-08 22:21:00 dovecot_login authenticator failed for H=([129.80.228.231]) [129.80.228.231]:47566: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.235.225.181
country_id: 6252001
description:
2026-01-08 22:22:47 dovecot_plain authenticator failed for H=c-71-235-225-181.hsd1.ct.comcast.net (gasycarde) [71.235.225.181]:56010: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.152
country_id: 1269750
description:
2026-01-08 22:27:58 dovecot_login authenticator failed for H=(nsg-corporate-152.227.187.122.airtel.in) [122.187.227.152]:46111: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.178.203.226
country_id: 6252001
description:
2026-01-08 22:30:10 dovecot_login authenticator failed for H=pool-71-178-203-226.washdc.fios.verizon.net [71.178.203.226]:59418: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.2
country_id: 1269750
description:
2026-01-08 22:30:13 dovecot_login authenticator failed for H=([125.19.173.202]) [152.52.236.2]:41550: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.125.230.33
country_id: 2562770
description:
2026-01-08 22:29:30 dovecot_login authenticator failed for H=(ADMIN) [176.125.230.33]:53298: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.243.30
country_id: 1269750
description:
2026-01-08 22:29:59 dovecot_login authenticator failed for H=([125.16.185.97]) [152.52.243.30]:55346: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.246.178
country_id: 1269750
description:
2026-01-08 22:30:32 dovecot_login authenticator failed for H=([152.52.246.178]) [152.52.246.178]:42264: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.158
country_id: 1269750
description:
2026-01-08 22:30:46 dovecot_login authenticator failed for H=([125.19.175.68]) [152.52.236.158]:36564: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.55.189.211
country_id: 6252001
description:
2026-01-08 22:30:58 dovecot_login authenticator failed for H=(wllk99-129-211.dsl.netins.net) [67.55.189.211]:37729: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.123.118
country_id: 1269750
description:
2026-01-08 22:31:33 dovecot_login authenticator failed for H=([122.184.123.118]) [122.184.123.118]:55250: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.224.62.206
country_id: 2464461
description:
2026-01-08 22:32:54 dovecot_login authenticator failed for H=([41.224.62.206]) [41.224.62.206]:60970: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.231.25.64
country_id: 3686110
description:
2026-01-08 22:35:38 dovecot_login authenticator failed for H=(1522312565.colombiatel.co) [152.231.25.64]:55731: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.233.140.250
country_id: 3469034
description:
2026-01-08 22:36:05 dovecot_login authenticator failed for H=([181.233.140.250]) [181.233.140.250]:38735: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.44.133.238
country_id: 3469034
description:
2026-01-08 22:37:28 dovecot_login authenticator failed for H=(189-44-133-238.customer.tdatabrasil.net.br) [189.44.133.238]:42370: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.124.135.48
country_id: 3144096
description:
2026-01-08 22:37:46 dovecot_login authenticator failed for H=([188.124.135.48]) [188.124.135.48]:49533: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.226.118.0
country_id: 3469034
description:
2026-01-08 22:38:05 dovecot_login authenticator failed for H=([38.226.118.9]) [38.226.118.0]:57360: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.156.2
country_id: 1269750
description:
2026-01-08 22:40:57 dovecot_login authenticator failed for H=([125.19.156.2]) [125.19.156.2]:60762: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  8 22:41:21 host2 sshd[786820]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.54.70.40
country_id: 3686110
description:
2026-01-08 22:41:27 dovecot_login authenticator failed for H=(static-ip-1815407040.cable.net.co) [181.54.70.40]:36748: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  8 22:42:47 host2 sshd[787871]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.192.170
country_id: 6252001
description:
Jan  8 22:45:54 host2 dovecot[717960]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.65.192.170, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<K+W2j+NHFpIUQcCq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.118
country_id: 1149361
description:
2026-01-08 22:50:48 dovecot_login authenticator failed for H=([149.54.62.118]) [149.54.62.118]:53558: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.90.30.233
country_id: 1269750
description:
2026-01-08 22:51:07 dovecot_login authenticator failed for H=([59.90.30.233]) [59.90.30.233]:54486: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 77.87.40.114
country_id: 690791
description:
Jan  8 22:52:46 host2 sshd[795133]: Disconnected from invalid user test 77.87.40.114 port 35688 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.213.34.107
country_id: 298795
description:
2026-01-08 22:52:50 dovecot_login authenticator failed for H=(ADMIN) [188.213.34.107]:37633: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 206.217.131.233
country_id: 6252001
description:
Jan  8 22:54:52 host2 sshd[797603]: Disconnected from invalid user user1 206.217.131.233 port 39850 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.202.54
country_id: 1269750
description:
2026-01-08 22:55:09 dovecot_login authenticator failed for H=(nsg-corporate-54.202.186.122.airtel.in) [122.186.202.54]:42718: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.123.45.2
country_id: 1269750
description:
2026-01-08 22:55:27 dovecot_login authenticator failed for H=([103.123.45.2]) [103.123.45.2]:52212: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 206.217.131.233
country_id: 6252001
description:
Jan  8 22:57:22 host2 sshd[799675]: Received disconnect from 206.217.131.233 port 39592:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 77.87.40.114
country_id: 690791
description:
Jan  8 22:57:47 host2 sshd[799917]: Disconnected from invalid user ubuntu 77.87.40.114 port 52860 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 77.87.40.114
country_id: 690791
description:
Jan  8 22:58:15 host2 sshd[800387]: Disconnected from invalid user admin1 77.87.40.114 port 35944 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 31.222.12.85
country_id: 798544
description:
Jan  8 22:59:27 host2 dovecot[717960]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=31.222.12.85, lip=66.85.158.91, TLS, session=<SAwpv+NH5skf3gxV>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 206.217.131.233
country_id: 6252001
description:
Jan  8 22:59:29 host2 sshd[801513]: Disconnected from invalid user admin 206.217.131.233 port 56326 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.51.209
country_id: 953987
description:
Jan  8 22:59:48 host2 dovecot[717960]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=102.129.51.209, lip=66.85.158.91, TLS, session=<xSdNwONHZIZmgTPR>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  8 23:07:05 host2 sshd[808027]: Disconnected from invalid user admin 2.57.121.112 port 28171 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.88.10.10
country_id: 2328926
description:
2026-01-08 23:07:18 dovecot_plain authenticator failed for H=(penegly) [102.88.10.10]:54962: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.90.128.97
country_id: 6252001
description:
2026-01-08 23:09:30 dovecot_login authenticator failed for H=(syn-172-090-128-097.res.spectrum.com) [172.90.128.97]:51602: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.161.93.53
country_id: 1269750
description:
2026-01-08 23:09:43 dovecot_login authenticator failed for H=([103.161.93.53]) [103.161.93.53]:64054: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-08 23:10:10 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (irdaeousts) [87.103.126.54]:10110: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.16.52.51
country_id: 2921044
description:
[2025-12-26 17:26:14 +0530] info [webmaild] 178.16.52.51 - training@v-deploy.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.227.136.237
country_id: 6252001
description:
2026-01-08 23:14:55 dovecot_login authenticator failed for H=(syn-072-227-136-237.res.spectrum.com) [72.227.136.237]:36874: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.72
country_id: 2186224
description:
2026-01-08 23:15:15 dovecot_login authenticator failed for H=([121.73.163.72]) [121.73.163.72]:40078: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 203.55.131.4
country_id: 6252001
description:
Jan  8 23:17:21 host2 dovecot[717960]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=203.55.131.4, lip=66.85.158.91, TLS, session=</bE2AORHDpDLN4ME>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.85.202
country_id: 337996
description:
2026-01-08 23:17:44 dovecot_login authenticator failed for H=([196.191.212.236]) [213.55.85.202]:4688: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.90.122.14
country_id: 3042058
description:
2026-01-08 23:17:53 dovecot_login authenticator failed for H=(ADMIN) [91.90.122.14]:39617: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.22.218
country_id: 290557
description:
2026-01-08 23:18:04 dovecot_login authenticator failed for H=([5.32.22.218]) [5.32.22.218]:41691: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.44.140.151
country_id: 690791
description:
Jan  8 23:18:40 host2 dovecot[717960]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=194.44.140.151, lip=66.85.158.91, TLS, session=<8wXaA+RHAsXCLIyX>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.103.21.88
country_id: 690791
description:
Jan  8 23:18:59 host2 dovecot[717960]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=176.103.21.88, lip=66.85.158.91, TLS, session=<54f8BORHd5KwZxVY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.207.176.58
country_id: 192950
description:
2026-01-08 23:20:40 dovecot_login authenticator failed for H=([196.207.176.58]) [196.207.176.58]:52841: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.51.34.229
country_id: 2510769
description:
2026-01-08 23:21:03 dovecot_login authenticator failed for H=(229.34.51.212.dynamic.reverse-mundo-r.com) [212.51.34.229]:41051: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.127.86
country_id: 1269750
description:
2026-01-08 23:21:32 dovecot_login authenticator failed for H=([27.123.119.191]) [122.184.127.86]:34756: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.72.184.60
country_id: 6252001
description:
2026-01-08 23:21:36 dovecot_login authenticator failed for H=24-72-184-24-72-184-60.cpe.sparklight.net [24.72.184.60]:53254: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.40.215.162
country_id: 3469034
description:
2026-01-08 23:21:48 dovecot_login authenticator failed for H=187-40-215-162.user.veloxzone.com.br [187.40.215.162]:33566: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.250.51.2
country_id: 1168579
description:
2026-01-08 23:22:09 dovecot_login authenticator failed for H=([160.250.51.2]) [160.250.51.2]:58888: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.162.194.94
country_id: 1733045
description:
2026-01-08 23:21:23 dovecot_login authenticator failed for H=([51.162.194.94]) [51.162.194.94]:47318: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9703
name: Dovecot is Starting Up.
description:
Jan  8 23:32:49 host2 dovecot[821692]: master: Dovecot v2.3.21.1 (d492236fa0) starting up for lmtp, imap, pop3 (core dumps disabled)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.20.69
country_id: 6252001
description:
Jan  8 23:35:26 host2 dovecot[821886]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.20.69, lip=66.85.158.91, session=<aLfZQORH0rtBMRRF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.255.8.122
country_id: 2623032
description:
Jan  8 23:38:32 host2 dovecot[821886]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=194.255.8.122, lip=66.85.158.91, TLS, session=<kVDxSuRHC8TC/wh6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.159.234.92
country_id: 2635167
description:
2026-01-08 23:38:41 dovecot_login authenticator failed for H=(ADMIN) [98.159.234.92]:20637: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.27.83
country_id: 1643084
description:
2026-01-08 23:38:51 dovecot_login authenticator failed for H=(ip-arana.net.id.as132673) [103.90.27.83]:39496: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.127.150
country_id: 1269750
description:
2026-01-08 23:39:31 dovecot_login authenticator failed for H=(nsg-corporate-177.246.185.122.airtel.in) [122.184.127.150]:38254: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.122.133.144
country_id: 3865483
description:
Jan  8 23:38:55 host2 dovecot[821886]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=190.122.133.144, lip=66.85.158.91, TLS, session=<OxUlTORHYrO+eoWQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.83.130.80
country_id: 1269750
description:
2026-01-08 23:39:14 dovecot_login authenticator failed for H=(80.130.83.103.static.rapidnet.in) [103.83.130.80]:52738: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.22
country_id: 1269750
description:
2026-01-08 23:39:15 dovecot_login authenticator failed for H=([182.95.20.31]) [182.95.228.22]:54934: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.217
country_id: 1819730
description:
2026-01-08 23:44:15 dovecot_login authenticator failed for H=217.42.246.220.static.netvigator.com [220.246.42.217]:62384: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.10
country_id: 1269750
description:
2026-01-08 23:44:26 dovecot_login authenticator failed for H=([182.95.20.28]) [182.95.228.10]:38870: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.166.50.15
country_id: 453733
description:
2026-01-08 23:44:44 dovecot_login authenticator failed for H=15-50-166-83.dyn.estpak.ee [83.166.50.15]:53061: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.119.50
country_id: 1269750
description:
2026-01-08 23:44:58 dovecot_login authenticator failed for H=(aes-static-089.153.22.125.airtel.in) [182.95.119.50]:33786: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.236.228.202
country_id: 6252001
description:
Jan  8 23:45:58 host2 dovecot[821886]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=172.236.228.202, lip=66.85.158.91, session=<huSHZuRHQj+s7OTK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.202.101
country_id: 6252001
description:
2026-01-08 23:49:29 dovecot_login authenticator failed for H=([165.154.202.101]) [165.154.202.101]:37540: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.157.80.73
country_id: 2077456
description:
2026-01-08 23:50:02 dovecot_login authenticator failed for H=([120.157.80.73]) [120.157.80.73]:39746: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 191.6.25.239
country_id: 3469034
description:
Jan  8 23:54:02 host2 sshd[837282]: Disconnected from invalid user user1 191.6.25.239 port 39983 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 191.6.25.239
country_id: 3469034
description:
Jan  9 00:00:00 host2 sshd[842126]: Disconnected from invalid user ubuntu 191.6.25.239 port 42971 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.196.42.114
country_id: 2077456
description:
2026-01-09 00:02:37 dovecot_login authenticator failed for H=(203-196-42-114.static.dsl.net.au) [203.196.42.114]:44832: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.46.115.24
country_id: 6290252
description:
2026-01-09 00:02:10 dovecot_login authenticator failed for H=(ADMIN) [37.46.115.24]:47668: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.46.192.20
country_id: 2510769
description:
2026-01-09 00:03:39 dovecot_login authenticator failed for H=([193.46.192.20]) [193.46.192.20]:59221: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.214.49.11
country_id: 3144096
description:
2026-01-09 00:02:53 dovecot_login authenticator failed for H=(cm-84.214.49.11.get.no) [84.214.49.11]:36205: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 191.6.25.239
country_id: 3469034
description:
Jan  9 00:03:10 host2 sshd[845041]: Disconnected from invalid user ubuntu 191.6.25.239 port 62175 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2026-01-09 00:04:11 dovecot_login authenticator failed for H=c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:46560: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 191.6.25.239
country_id: 3469034
description:
Jan  9 00:04:47 host2 sshd[846068]: Disconnected from invalid user admin1 191.6.25.239 port 42057 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.226
country_id: 6252001
description:
Jan  9 00:05:31 host2 pure-ftpd[846882]: (?@205.210.31.226) [INFO] New connection from 205.210.31.226


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.79.237.54
country_id: 1643084
description:
2026-01-09 00:07:44 dovecot_login authenticator failed for H=([103.79.237.54]) [103.79.237.54]:57722: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.124.221.2
country_id: 2750405
description:
2026-01-09 00:07:56 dovecot_login authenticator failed for H=ip-213-124-221-2.ip.prioritytelecom.net [213.124.221.2]:57288: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.177.212
country_id: 6252001
description:
Jan  9 00:09:07 host2 dovecot[821886]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.65.177.212, lip=66.85.158.92, TLS handshaking: Connection closed, session=<9yVUueRHPtAUQbHU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.145.142.243
country_id: 1269750
description:
2026-01-09 00:15:25 dovecot_login authenticator failed for H=([203.145.142.243]) [203.145.142.243]:50570: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.226.118.0
country_id: 3469034
description:
2026-01-09 00:15:27 dovecot_login authenticator failed for H=([38.226.118.9]) [38.226.118.0]:58762: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.74.188.179
country_id: 3469034
description:
Jan  9 00:15:35 host2 sshd[853966]: Disconnected from invalid user ubuntu 177.74.188.179 port 45878 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.159.186
country_id: 1269750
description:
2026-01-09 00:15:09 dovecot_login authenticator failed for H=([125.19.159.186]) [125.19.159.186]:49636: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 136.119.213.208
country_id: 6252001
description:
Jan  9 00:16:43 host2 sshd[854686]: Disconnected from invalid user ubuntu 136.119.213.208 port 37456 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.123
country_id: 2186224
description:
2026-01-09 00:18:25 dovecot_login authenticator failed for H=([121.73.163.123]) [121.73.163.123]:49092: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.119
country_id: 6252001
description:
Jan  9 00:18:00 host2 dovecot[821886]: pop3-login: Disconnected: Connection closed (no auth attempts in 16 secs): user=<>, rip=66.132.153.119, lip=66.85.158.92, TLS handshaking: Connection closed, session=<ObUc2eRHTghChJl3>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.173.10.98
country_id: 6252001
description:
Jan  9 00:20:11 host2 sshd[857240]: Disconnected from invalid user ubuntu 107.173.10.98 port 35312 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 177.74.188.179
country_id: 3469034
description:
Jan  9 00:20:18 host2 sshd[857373]: Disconnected from invalid user deploy 177.74.188.179 port 43244 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.74.188.179
country_id: 3469034
description:
Jan  9 00:20:55 host2 sshd[857923]: Disconnected from invalid user ubuntu 177.74.188.179 port 54570 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  9 00:22:33 host2 sshd[859087]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.173.10.98
country_id: 6252001
description:
Jan  9 00:22:00 host2 sshd[858736]: Disconnected from invalid user ubuntu 107.173.10.98 port 64670 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.211.152.28
country_id: 3469034
description:
Jan  9 00:22:49 host2 sshd[859264]: Disconnected from invalid user ubuntu 102.211.152.28 port 33780 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.201.90
country_id: 1733045
description:
2026-01-09 00:22:59 dovecot_login authenticator failed for H=([49.125.201.90]) [49.125.201.90]:57934: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  9 00:23:59 host2 sshd[859991]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 136.119.213.208
country_id: 6252001
description:
Jan  9 00:24:37 host2 sshd[860392]: Disconnected from invalid user test 136.119.213.208 port 48094 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 102.211.152.28
country_id: 3469034
description:
Jan  9 00:24:03 host2 sshd[860069]: Disconnected from invalid user ubuntu 102.211.152.28 port 41662 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.211.152.28
country_id: 3469034
description:
Jan  9 00:25:08 host2 sshd[860953]: Disconnected from invalid user deploy 102.211.152.28 port 57550 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.173.10.98
country_id: 6252001
description:
Jan  9 00:26:55 host2 sshd[862518]: Disconnected from invalid user test 107.173.10.98 port 12926 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.16.81.175
country_id: 2077456
description:
2026-01-09 00:29:09 dovecot_login authenticator failed for H=(ADMIN) [154.16.81.175]:19179: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 107.173.10.98
country_id: 6252001
description:
Jan  9 00:29:23 host2 sshd[864260]: Disconnected from invalid user admin1 107.173.10.98 port 10428 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.186.193.149
country_id: 1643084
description:
2026-01-09 00:29:47 dovecot_login authenticator failed for H=([103.186.193.149]) [103.186.193.149]:55288: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.64.150
country_id: 1269750
description:
2026-01-09 00:30:07 dovecot_login authenticator failed for H=([125.23.229.42]) [182.78.64.150]:38554: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.85.196
country_id: 294640
description:
2026-01-09 00:36:45 dovecot_login authenticator failed for H=(31-154-85-196.orange.net.il) [2.55.85.196]:47104: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.209.148.60
country_id: 2661886
description:
2026-01-09 00:37:30 dovecot_login authenticator failed for H=82-209-148-60.cust.bredband2.com [82.209.148.60]:52094: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.154
country_id: 3144096
description:
2026-01-09 00:37:58 dovecot_login authenticator failed for H=(cm-84.213.189.154.get.no) [84.213.189.154]:43059: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.210.118
country_id: 1269750
description:
2026-01-09 00:38:21 dovecot_login authenticator failed for H=([125.17.48.129]) [152.52.210.118]:39250: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.168.50
country_id: 2186224
description:
2026-01-09 00:38:29 dovecot_login authenticator failed for H=([121.73.168.50]) [121.73.168.50]:56986: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.176.157.57
country_id: 6252001
description:
2026-01-09 00:38:35 dovecot_plain authenticator failed for H=c-73-176-157-57.hsd1.il.comcast.net (bialetra) [73.176.157.57]:33296: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.23.242.223
country_id: 953987
description:
2026-01-09 00:38:46 dovecot_login authenticator failed for H=([102.23.242.223]) [102.23.242.223]:49470: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.200.93.86
country_id: 290557
description:
2026-01-09 00:40:24 dovecot_login authenticator failed for H=([87.200.93.86]) [87.200.93.86]:58619: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.201.54.90
country_id: 3469034
description:
2026-01-09 00:40:39 dovecot_login authenticator failed for H=(187-51-252-236.customer.tdatabrasil.net.br) [186.201.54.90]:54856: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.241.119.254
country_id: 6252001
description:
2026-01-09 00:50:50 dovecot_login authenticator failed for H=(ADMIN) [151.241.119.254]:35698: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.241.119.254
country_id: 6252001
description:
2026-01-09 00:51:05 dovecot_login authenticator failed for H=(ADMIN) [151.241.119.254]:44593: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.247.195
country_id: 6252001
description:
Jan  9 00:52:57 host2 dovecot[821886]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=184.105.247.195, lip=66.85.158.92, TLS handshaking: Connection closed, session=<9kUTVuVHoPi4affD>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 52.165.82.26
country_id: 6252001
description:
Jan  9 00:55:00 host2 dovecot[821886]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=52.165.82.26, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<FEJkXeVHnOQ0pVIa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.79.195
country_id: 337996
description:
2026-01-09 00:56:21 dovecot_login authenticator failed for H=([213.55.79.199]) [213.55.79.195]:34320: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.250.19.91
country_id: 1269750
description:
2026-01-09 00:56:02 dovecot_login authenticator failed for H=(static.ill.117.250.19.91.bsnl.co.in) [117.250.19.91]:54018: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.224.169.28
country_id: 6252001
description:
2026-01-09 00:56:20 dovecot_plain authenticator failed for H=c-71-224-169-28.hsd1.pa.comcast.net (inter) [71.224.169.28]:42086: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.90.34.90
country_id: 2328926
description:
2026-01-09 01:07:17 dovecot_login authenticator failed for H=([102.90.34.90]) [102.90.34.90]:39689: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.124.202
country_id: 1269750
description:
2026-01-09 01:07:30 dovecot_login authenticator failed for H=([27.123.91.151]) [182.95.124.202]:47058: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.253.160.10
country_id: 174982
description:
2026-01-09 01:10:20 dovecot_login authenticator failed for H=(ADMIN) [185.253.160.10]:17498: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  9 01:11:03 host2 sshd[898477]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.63
country_id: 2186224
description:
2026-01-09 01:12:03 dovecot_login authenticator failed for H=([121.73.169.63]) [121.73.169.63]:42134: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.16.97.90
country_id: 3469034
description:
2026-01-09 01:12:26 dovecot_login authenticator failed for H=mvx-187-16-97-90.mundivox.com [187.16.97.90]:49456: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.180
country_id: 2542007
description:
2026-01-09 01:13:38 dovecot_plain authenticator failed for H=(horystoka) [102.53.15.180]:56269: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.230.158
country_id: 1269750
description:
2026-01-09 01:14:19 dovecot_login authenticator failed for H=(dsl-del-065.26.246.61.airtelbroadband.in) [182.95.230.158]:39874: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.248.243.181
country_id: 2542007
description:
2026-01-09 01:15:14 dovecot_plain authenticator failed for H=(discoggal) [41.248.243.181]:51970: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.211.220.203
country_id: 2661886
description:
2026-01-09 01:19:55 dovecot_login authenticator failed for H=31-211-220-203.customers.ownit.se [31.211.220.203]:59224: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.235.140.163
country_id: 2017370
description:
2026-01-09 01:20:33 dovecot_login authenticator failed for H=(37-235-140-163.dynamic.customer.lanta.me) [37.235.140.163]:35684: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.243.174
country_id: 732800
description:
2026-01-09 01:22:52 dovecot_plain authenticator failed for H=(spelames) [92.62.243.174]:37350: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.231
country_id: 6252001
description:
Jan  9 01:25:40 host2 dovecot[821886]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=91.230.168.231, lip=66.85.158.92, TLS handshaking: Connection closed, session=<0nwXy+VHV8tb5qjn>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.97
country_id: 6252001
description:
Jan  9 01:25:51 host2 dovecot[821886]: imap-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=91.230.168.97, lip=66.85.158.92, TLS: Connection closed, session=<SHq1y+VHDYJb5qhh>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.98
country_id: 6252001
description:
Jan  9 01:26:08 host2 dovecot[821886]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=91.230.168.98, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<5jzEzOVH6btb5qhi>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.231
country_id: 6252001
description:
Jan  9 01:26:11 host2 dovecot[821886]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.230.168.231, lip=66.85.158.92, TLS: Connection closed, session=<JKjyzOVHa45b5qjn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.216.213.53
country_id: 933860
description:
Jan  9 01:29:27 host2 dovecot[821886]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=41.216.213.53, lip=66.85.158.91, TLS, session=<pkh21+VHaK0p2NU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.235.7.231
country_id: 3077311
description:
Jan  9 01:29:44 host2 dovecot[821886]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=109.235.7.231, lip=66.85.158.91, TLS, session=<FJGo2OVHNZZt6wfn>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.17.124.75
country_id: 1269750
description:
2026-01-09 01:33:00 dovecot_login authenticator failed for H=(abts-kk-static-182.209.166.122.airtelbroadband.in) [125.17.124.75]:51572: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.0.90.82
country_id: 2077456
description:
2026-01-09 01:33:24 dovecot_login authenticator failed for H=210.0.90.82.static.nexnet.net.au [210.0.90.82]:57282: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.89.14
country_id: 1269750
description:
2026-01-09 01:33:45 dovecot_login authenticator failed for H=([128.185.247.210]) [182.79.89.14]:50232: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.188.143.166
country_id: 1819730
description:
2026-01-09 01:34:03 dovecot_login authenticator failed for H=([180.188.143.166]) [180.188.143.166]:45377: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 159.223.105.135
country_id: 6252001
description:
Jan  9 01:34:26 host2 dovecot[821886]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=159.223.105.135, lip=66.85.158.92, TLS, session=<P1ly6uVHIo2f32mH>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.181.196.96
country_id: 3469034
description:
2026-01-09 01:35:52 dovecot_login authenticator failed for H=(96.196.181.45.datasysteminfor.com.br) [45.181.196.96]:38852: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.235.248.73
country_id: 3469034
description:
2026-01-09 01:36:24 dovecot_login authenticator failed for H=([186.235.248.73]) [186.235.248.73]:57874: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.206.54
country_id: 1269750
description:
2026-01-09 01:38:05 dovecot_login authenticator failed for H=([125.19.206.54]) [125.19.206.54]:48786: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.214.122.107
country_id: 357994
description:
2026-01-09 01:37:29 dovecot_login authenticator failed for H=(ADMIN) [188.214.122.107]:1066: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.195.15.194
country_id: 3469034
description:
2026-01-09 01:37:54 dovecot_login authenticator failed for H=([200.195.15.194]) [200.195.15.194]:37614: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.45
country_id: 6252001
description:
Jan  9 01:38:19 host2 dovecot[821886]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.45, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<aeBO+OVHF8PG6xgt>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.20.69
country_id: 6252001
description:
Jan  9 01:40:07 host2 dovecot[821886]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.20.69, lip=66.85.158.92, session=<jlG9/uVHwH5BMRRF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.227.25.115
country_id: 6252001
description:
2026-01-09 01:41:57 dovecot_plain authenticator failed for H=c-98-227-25-115.hsd1.il.comcast.net (bormingle) [98.227.25.115]:38358: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.22.242.162
country_id: 1880251
description:
Jan  9 01:42:05 host2 pure-ftpd[922187]: (?@165.22.242.162) [INFO] New connection from 165.22.242.162


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.202.58
country_id: 1269750
description:
2026-01-09 01:43:06 dovecot_login authenticator failed for H=(nsg-corporate-58.202.186.122.airtel.in) [122.186.202.58]:47290: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.27.83
country_id: 1643084
description:
2026-01-09 01:43:34 dovecot_login authenticator failed for H=(ip-arana.net.id.as132673) [103.90.27.83]:51778: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.209.108.42
country_id: 6254930
description:
2026-01-09 01:53:02 dovecot_plain authenticator failed for H=(noggraus) [185.209.108.42]:56310: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.224
country_id: 6252001
description:
Jan  9 01:53:48 host2 dovecot[821886]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.224, lip=66.85.158.92, session=<01S1L+ZHHbxAPpzg>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.222
country_id: 6252001
description:
Jan  9 01:54:00 host2 dovecot[821886]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.222, lip=66.85.158.92, TLS: Connection closed, session=<7vRrMOZHls5APpze>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.222
country_id: 6252001
description:
Jan  9 01:54:10 host2 dovecot[821886]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=64.62.156.222, lip=66.85.158.92, session=<oBYHMeZHJBpAPpze>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.17
country_id: 798549
description:
Jan  9 01:57:23 host2 dovecot[821886]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 1 secs): user=<>, rip=85.217.149.17, lip=66.85.158.92, TLS, session=<D02APOZHfp9V2ZUR>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.51.166
country_id: 1269750
description:
2026-01-09 01:57:53 dovecot_login authenticator failed for H=([182.95.51.166]) [182.95.51.166]:40394: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.212
country_id: 1819730
description:
2026-01-09 01:58:03 dovecot_login authenticator failed for H=212.42.246.220.static.netvigator.com [220.246.42.212]:55944: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.16.164.76
country_id: 2661886
description:
2026-01-09 01:58:04 dovecot_login authenticator failed for H=ip076.net-81-16-164.koping.net [81.16.164.76]:54246: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.106.196.150
country_id: 1880251
description:
2026-01-09 01:58:14 dovecot_login authenticator failed for H=(bb128-106-196-150.singnet.com.sg) [128.106.196.150]:52227: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.190.155.43
country_id: 6252001
description:
2026-01-09 01:58:22 dovecot_plain authenticator failed for H=(misre) [76.190.155.43]:45669: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.2.194.66
country_id: 2963597
description:
2026-01-09 02:00:55 dovecot_login authenticator failed for H=(ADMIN) [155.2.194.66]:9195: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.2.194.66
country_id: 2963597
description:
2026-01-09 02:01:09 dovecot_login authenticator failed for H=(ADMIN) [155.2.194.66]:35738: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  9 02:03:25 host2 sshd[939350]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  9 02:04:51 host2 sshd[940332]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.254.162
country_id: 1269750
description:
2026-01-09 02:04:59 dovecot_login authenticator failed for H=([152.52.204.27]) [128.185.254.162]:43312: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.238.210.226
country_id: 3469034
description:
2026-01-09 02:05:33 dovecot_login authenticator failed for H=([186.238.210.226]) [186.238.210.226]:43274: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.138.69
country_id: 1819730
description:
2026-01-09 02:07:30 dovecot_login authenticator failed for H=069.138.48.116.static.netvigator.com [116.48.138.69]:56087: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.176.126
country_id: 1269750
description:
2026-01-09 02:07:55 dovecot_login authenticator failed for H=([128.185.18.217]) [122.185.176.126]:55172: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.198.98
country_id: 1819730
description:
2026-01-09 02:07:19 dovecot_login authenticator failed for H=(m121-202-198-98.smartone.com) [121.202.198.98]:40035: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.124.218
country_id: 337996
description:
2026-01-09 02:08:32 dovecot_login authenticator failed for H=([196.189.124.218]) [196.189.124.218]:41540: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.196.144.25
country_id: 6252001
description:
2026-01-09 02:09:50 dovecot_plain authenticator failed for H=c-73-196-144-25.hsd1.nj.comcast.net (kilimered) [73.196.144.25]:44906: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.136.164.157
country_id: 6252001
description:
2026-01-09 02:10:10 dovecot_login authenticator failed for H=c-76-136-164-157.hsd1.il.comcast.net [76.136.164.157]:34520: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.238.210.226
country_id: 3469034
description:
2026-01-09 02:10:36 dovecot_login authenticator failed for H=(186-201-12-209.customer.tdatabrasil.net.br) [186.238.210.226]:33229: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan  9 02:16:22 host2 sshd[949581]: Disconnected from invalid user user 2.57.121.25 port 37042 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.125.228.23
country_id: 2589581
description:
2026-01-09 02:17:31 dovecot_login authenticator failed for H=(ADMIN) [176.125.228.23]:38076: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.40.62.72
country_id: 2635167
description:
2026-01-09 02:17:47 dovecot_login authenticator failed for H=92.40.62.72.threembb.co.uk [92.40.62.72]:54558: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.146.233.200
country_id: 1269750
description:
2026-01-09 02:18:37 dovecot_login authenticator failed for H=([103.146.233.200]) [103.146.233.200]:47813: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.239.160.152
country_id: 3996063
description:
2026-01-09 02:19:51 dovecot_login authenticator failed for H=([177.239.160.152]) [177.239.160.152]:54262: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.119.118
country_id: 1269750
description:
2026-01-09 02:20:04 dovecot_login authenticator failed for H=([125.18.210.161]) [182.95.119.118]:56316: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.111.6.121
country_id: 1269750
description:
2026-01-09 02:22:50 dovecot_login authenticator failed for H=([103.111.6.121]) [103.111.6.121]:38707: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.235.35.123
country_id: 1269750
description:
2026-01-09 02:23:01 dovecot_login authenticator failed for H=([20.235.35.123]) [20.235.35.123]:48334: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.242.74
country_id: 1269750
description:
2026-01-09 02:23:41 dovecot_login authenticator failed for H=([128.185.242.74]) [128.185.242.74]:54238: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.54
country_id: 1149361
description:
2026-01-09 02:24:21 dovecot_login authenticator failed for H=([149.54.62.54]) [149.54.62.54]:51674: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.209
country_id: 6252001
description:
Jan  9 02:32:30 host2 dovecot[821886]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.209, lip=66.85.158.92, TLS handshaking: Connection closed, session=<ZX4VuuZH17BBMQHR>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.202
country_id: 6252001
description:
Jan  9 02:32:51 host2 dovecot[821886]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.202, lip=66.85.158.92, TLS handshaking: Connection closed, session=<X7tWu+ZHHFhBMQHK>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 185.242.226.19
country_id: 6252001
description:
Jan  9 02:33:25 host2 pure-ftpd[964580]: (?@185.242.226.19) [INFO] New connection from 185.242.226.19


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 185.242.226.19
country_id: 6252001
description:
Jan  9 02:34:56 host2 pure-ftpd[965787]: (?@185.242.226.19) [INFO] New connection from 185.242.226.19


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 185.242.226.19
country_id: 6252001
description:
Jan  9 02:35:40 host2 pure-ftpd[966564]: (?@185.242.226.19) [INFO] New connection from 185.242.226.19


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 185.242.226.19
country_id: 6252001
description:
Jan  9 02:35:45 host2 pure-ftpd[966636]: (?@185.242.226.19) [INFO] New connection from 185.242.226.19


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.124.202
country_id: 1269750
description:
2026-01-09 02:37:03 dovecot_login authenticator failed for H=([27.123.91.151]) [182.95.124.202]:49912: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.102.49.208
country_id: 2510769
description:
2026-01-09 02:37:49 dovecot_login authenticator failed for H=(ADMIN) [212.102.49.208]:43669: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 185.242.226.19
country_id: 6252001
description:
Jan  9 02:39:21 host2 pure-ftpd[969348]: (?@185.242.226.19) [INFO] New connection from 185.242.226.19


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 185.242.226.19
country_id: 6252001
description:
Jan  9 02:39:26 host2 pure-ftpd[969413]: (?@185.242.226.19) [INFO] New connection from 185.242.226.19


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.146.149
country_id: 3996063
description:
2026-01-09 02:40:09 dovecot_login authenticator failed for H=([177.236.146.149]) [177.236.146.149]:58532: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.35.225.197
country_id: 3996063
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 38.35.225.197 - lezzarot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarot (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
country_id: 3932488
description:
2026-01-09 02:40:56 dovecot_login authenticator failed for H=([190.117.96.174]) [190.117.96.174]:39926: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.103
country_id: 6252001
description:
Jan  9 02:48:34 host2 dovecot[821886]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.235.24.103, lip=66.85.158.92, session=<aSWR8+ZHsv3G6xhn>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.221.254.250
country_id: 783754
description:
2026-01-09 02:56:30 dovecot_login authenticator failed for H=([185.221.254.250]) [185.221.254.250]:60122: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.26.153.84
country_id: 1819730
description:
2026-01-09 02:56:58 dovecot_login authenticator failed for H=([118.26.153.84]) [118.26.153.84]:19708: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.253.162.14
country_id: 146669
description:
2026-01-09 02:58:18 dovecot_login authenticator failed for H=(ADMIN) [185.253.162.14]:49402: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.245.250.137
country_id: 3469034
description:
Jan  9 02:59:07 host2 dovecot[821886]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=170.245.250.137, lip=66.85.158.91, TLS, session=<Ns04GOdHy42q9fqJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.26.179.101
country_id: 3175395
description:
Jan  9 02:59:25 host2 dovecot[821886]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=217.26.179.101, lip=66.85.158.91, TLS, session=<cZBhGedHoozZGrNl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.208.58
country_id: 1036973
description:
2026-01-09 03:02:07 dovecot_login authenticator failed for H=([197.219.208.58]) [197.219.208.58]:60650: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.202.197.108
country_id: 6252001
description:
2026-01-09 03:02:23 dovecot_plain authenticator failed for H=(irlin) [50.202.197.108]:54548: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.84.54
country_id: 1269750
description:
2026-01-09 03:02:43 dovecot_login authenticator failed for H=([182.79.151.121]) [27.123.84.54]:52860: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.204
country_id: 6252001
description:
Jan  9 03:11:29 host2 dovecot[821886]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.204, lip=66.85.158.91, session=<R/CHRedHnaNAPpzM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.104.78
country_id: 1269750
description:
2026-01-09 03:11:40 dovecot_login authenticator failed for H=([182.95.22.223]) [27.123.104.78]:57176: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.202
country_id: 6252001
description:
Jan  9 03:11:41 host2 dovecot[821886]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.202, lip=66.85.158.91, TLS: Connection closed, session=<MZpBRudHQIxAPpzK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.173
country_id: 6252001
description:
Jan  9 03:11:55 host2 dovecot[821886]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.173, lip=66.85.158.91, TLS handshaking: Connection closed, session=<4cQTR+dH+6hBMQGt>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.172.98
country_id: 1269750
description:
2026-01-09 03:11:16 dovecot_login authenticator failed for H=([27.123.119.146]) [122.187.172.98]:57614: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.185.170
country_id: 1269750
description:
2026-01-09 03:18:30 dovecot_login authenticator failed for H=([182.95.26.55]) [182.95.185.170]:55200: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.115.144.103
country_id: 3469034
description:
2026-01-09 03:18:58 dovecot_login authenticator failed for H=(191.34.253.17.dynamic.adsl.gvt.net.br) [187.115.144.103]:58614: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.121.61.198
country_id: 3017382
description:
2026-01-09 03:20:06 dovecot_login authenticator failed for H=ip198.ip-91-121-61.eu (ADMIN) [91.121.61.198]:52560: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.122
country_id: 1269750
description:
2026-01-09 03:20:39 dovecot_login authenticator failed for H=([182.95.176.122]) [182.95.176.122]:50452: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.207.176.58
country_id: 192950
description:
2026-01-09 03:20:51 dovecot_login authenticator failed for H=([196.207.176.58]) [196.207.176.58]:38177: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.233.110
country_id: 99237
description:
2026-01-09 03:20:33 dovecot_plain authenticator failed for H=(subbling) [65.20.233.110]:55607: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.15.40.27
country_id: 1643084
description:
[2026-01-09 03:23:40 +0530] info [cpaneld] 157.15.40.27 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.70.157.25
country_id: 6252001
description:
2026-01-09 03:23:46 dovecot_login authenticator failed for H=([152.70.157.25]) [152.70.157.25]:42682: 535 Incorrect authentication data (set_id=admin@jrdc.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.145.94
country_id: 3996063
description:
2026-01-09 03:23:57 dovecot_login authenticator failed for H=([177.236.145.94]) [177.236.145.94]:46497: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.199.59.18
country_id: 2750405
description:
2026-01-09 03:29:09 dovecot_plain authenticator failed for H=(amile) [128.199.59.18]:54394: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.230.122
country_id: 1269750
description:
2026-01-09 03:31:04 dovecot_login authenticator failed for H=([59.145.116.161]) [182.95.230.122]:58568: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  9 03:31:18 host2 sshd[1013169]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
country_id: 1643084
description:
2026-01-09 03:34:17 dovecot_login authenticator failed for H=(ip-103-29-185-162.pascalwave.com) [103.29.185.162]:45316: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.250.201.1
country_id: 2245662
description:
2026-01-09 03:34:31 dovecot_login authenticator failed for H=([196.250.201.125]) [196.250.201.1]:12546: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.124.218.64
country_id: 3865483
description:
Jan  9 03:35:25 host2 dovecot[821886]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 23 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=186.124.218.64, lip=66.85.158.91, TLS, session=<IEq+medHo6G6fNpA>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.64.94
country_id: 3469034
description:
2026-01-09 03:35:30 dovecot_login authenticator failed for H=([189.108.156.41]) [187.8.64.94]:38558: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.96.141
country_id: 3469034
description:
Jan  9 03:35:45 host2 dovecot[821886]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=177.44.96.141, lip=66.85.158.91, TLS, session=<YFopm+dHLtGxLGCN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.153.184
country_id: 3144096
description:
2026-01-09 03:35:48 dovecot_login authenticator failed for H=(cm-178.232.153.184.get.no) [178.232.153.184]:38037: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.30.14.221
country_id: 6252001
description:
2026-01-09 03:36:06 dovecot_login authenticator failed for H=pool-108-30-14-221.nycmny.fios.verizon.net [108.30.14.221]:41944: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.76
country_id: 6252001
description:
Jan  9 03:36:58 host2 dovecot[821886]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=147.185.132.76, lip=66.85.158.92, TLS, session=<HtifoOdHfPqTuYRM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.8.48.178
country_id: 1605651
description:
2026-01-09 03:36:29 dovecot_login authenticator failed for H=ppp-58-8-48-178.revip2.asianet.co.th [58.8.48.178]:53526: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.64.106.41
country_id: 6252001
description:
Jan  9 03:39:45 host2 dovecot[821886]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (disconnected before auth was ready, waited 0 secs): user=<>, rip=20.64.106.41, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<VXmTqudHjJoUQGop>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.101.31.61
country_id: 3017382
description:
2026-01-09 03:41:19 dovecot_login authenticator failed for H=(ADMIN) [191.101.31.61]:31022: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.61.199.212
country_id: 6252001
description:
2026-01-09 03:42:58 dovecot_plain authenticator failed for H=c-24-61-199-212.hsd1.ct.comcast.net (undism) [24.61.199.212]:40768: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.143.69.79
country_id: 2750405
description:
2026-01-09 03:43:00 dovecot_login authenticator failed for H=([108.143.69.79]) [108.143.69.79]:49232: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  9 03:43:45 host2 sshd[1023435]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.41.18
country_id: 1269750
description:
2026-01-09 03:43:17 dovecot_login authenticator failed for H=([182.73.193.249]) [122.187.41.18]:37052: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.178.203.226
country_id: 6252001
description:
2026-01-09 03:43:57 dovecot_login authenticator failed for H=pool-71-178-203-226.washdc.fios.verizon.net [71.178.203.226]:59596: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.241.102
country_id: 1269750
description:
2026-01-09 03:44:10 dovecot_login authenticator failed for H=([125.19.175.152]) [182.78.241.102]:38056: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 98.159.40.140
country_id: 1210997
description:
Jan  9 03:44:29 host2 pure-ftpd[1023946]: (?@98.159.40.140) [INFO] New connection from 98.159.40.140


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 188.215.235.48
country_id: 1831722
description:
Jan  9 03:44:30 host2 pure-ftpd[1023955]: (?@188.215.235.48) [INFO] New connection from 188.215.235.48


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 146.70.65.18
country_id: 2328926
description:
Jan  9 03:44:31 host2 dovecot[821886]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=146.70.65.18, lip=66.85.158.91, TLS, session=<r8Csu+dHip2SRkES>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 188.126.94.254
country_id: 2623032
description:
Jan  9 03:44:32 host2 dovecot[821886]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=188.126.94.254, lip=66.85.158.91, TLS handshaking: Connection closed, session=<uo2uu+dHuO28fl7+>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  9 03:45:10 host2 sshd[1024800]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.62.239.4
country_id: 732800
description:
2026-01-09 03:46:13 dovecot_plain authenticator failed for H=(ramphaga) [149.62.239.4]:60960: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 204.76.203.231
country_id: 2750405
description:
Jan  9 03:46:15 host2 dovecot[821886]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=204.76.203.231, lip=66.85.158.91, session=<C9vUwedH5O3MTMvn>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.229.1.186
country_id: 6252001
description:
2026-01-09 03:49:16 dovecot_login authenticator failed for H=c-71-229-1-186.hsd1.al.comcast.net [71.229.1.186]:36210: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.93.80.158
country_id: 1269750
description:
2026-01-09 03:49:34 dovecot_login authenticator failed for H=([111.93.80.158]) [111.93.80.158]:35928: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.91.135.181
country_id: 6252001
description:
2026-01-09 03:53:46 dovecot_login authenticator failed for H=([70.91.135.181]) [70.91.135.181]:52036: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.251.121.70
country_id: 1861060
description:
2026-01-09 03:53:57 dovecot_login authenticator failed for H=works.ssc-gr.info [160.251.121.70]:33112: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.216.88.58
country_id: 3469034
description:
Jan  9 03:54:46 host2 dovecot[821886]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=186.216.88.58, lip=66.85.158.91, TLS, session=</d9C3+dHJKm62Fg6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.106.49.149
country_id: 3932488
description:
2026-01-09 03:54:50 dovecot_login authenticator failed for H=([200.106.49.149]) [200.106.49.149]:47932: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.131.211.168
country_id: 690791
description:
2026-01-09 03:55:07 dovecot_login authenticator failed for H=([94.131.211.168]) [94.131.211.168]:55810: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.249.159
country_id: 3865483
description:
Jan  9 03:55:24 host2 dovecot[821886]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 23 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=179.0.249.159, lip=66.85.158.91, TLS, session=<9nQs4edHWL2zAPmf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.194.36
country_id: 6252001
description:
Jan  9 03:59:12 host2 dovecot[821886]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.65.194.36, lip=66.85.158.92, TLS handshaking: Connection closed, session=<ULwq8OdH/KcUQcIk>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.115
country_id: 6252001
description:
Jan  9 04:02:25 host2 dovecot[821886]: pop3-login: Disconnected: Connection closed (no auth attempts in 15 secs): user=<>, rip=66.132.153.115, lip=66.85.158.92, TLS handshaking: Connection closed, session=<ZMap++dHBOdChJlz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.84.179.128
country_id: 3996063
description:
2026-01-09 04:05:34 dovecot_login authenticator failed for H=([140.84.179.128]) [140.84.179.128]:54566: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.206.54
country_id: 1269750
description:
2026-01-09 04:05:59 dovecot_login authenticator failed for H=([182.95.3.57]) [125.19.206.54]:33810: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.113.155.132
country_id: 690791
description:
2026-01-09 04:06:58 dovecot_plain authenticator failed for H=(gamous) [176.113.155.132]:36606: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.47
country_id: 3017382
description:
Jan  9 04:07:47 host2 dovecot[821886]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.196.152.47, lip=66.85.158.92, TLS: Connection closed, session=<ywvWDuhHa4dbxJgv>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.44
country_id: 3017382
description:
Jan  9 04:07:17 host2 dovecot[821886]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=91.196.152.44, lip=66.85.158.92, TLS handshaking: Connection closed, session=<UiQYDehHz+BbxJgs>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.65
country_id: 3017382
description:
Jan  9 04:07:29 host2 dovecot[821886]: imap-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=91.196.152.65, lip=66.85.158.92, TLS: Connection closed, session=<gZvLDehHpedbxJhB>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.64
country_id: 3017382
description:
Jan  9 04:07:44 host2 dovecot[821886]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=91.196.152.64, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<oe6lDuhHN7tbxJhA>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.235.156
country_id: 102358
description:
2026-01-09 04:08:32 dovecot_login authenticator failed for H=(ADMIN) [95.181.235.156]:31184: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.246.106
country_id: 1269750
description:
2026-01-09 04:11:15 dovecot_login authenticator failed for H=([27.123.119.254]) [128.185.246.106]:39060: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.208.139.191
country_id: 2921044
description:
2026-01-09 04:11:34 dovecot_login authenticator failed for H=([94.198.134.241]) [85.208.139.191]:55596: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.177.210.193
country_id: 3469034
description:
2026-01-09 04:14:48 dovecot_login authenticator failed for H=(193.210.177.45.fronteirainternet.com.br) [45.177.210.193]:56992: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.36.42
country_id: 1819730
description:
2026-01-09 04:20:21 dovecot_login authenticator failed for H=042.36.246.220.static.netvigator.com [220.246.36.42]:49915: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.182.5.98
country_id: 3469034
description:
2026-01-09 04:20:52 dovecot_login authenticator failed for H=([45.182.5.96]) [45.182.5.98]:57708: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.70.19.11
country_id: 3469034
description:
2026-01-09 04:21:55 dovecot_login authenticator failed for H=([45.70.19.11]) [45.70.19.11]:40232: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.57.39.170
country_id: 6252001
description:
2026-01-09 04:22:12 dovecot_login authenticator failed for H=([184.57.39.170]) [184.57.39.170]:62256: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.219.149.74
country_id: 2328926
description:
2026-01-09 04:23:59 dovecot_login authenticator failed for H=(netcomafrica.com) [41.219.149.74]:10795: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.132.32.143
country_id: 6252001
description:
2026-01-09 04:24:29 dovecot_login authenticator failed for H=([72.132.32.143]) [72.132.32.143]:59571: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.27.253.6
country_id: 1168579
description:
2026-01-09 04:24:45 dovecot_login authenticator failed for H=(58-27-253-6.wateen.net) [58.27.253.6]:25671: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.235.110
country_id: 1269750
description:
2026-01-09 04:24:12 dovecot_login authenticator failed for H=([128.185.160.185]) [128.185.235.110]:47896: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 91.231.89.194
country_id: 3017382
description:
Jan  9 04:28:23 host2 pure-ftpd[1070572]: (?@91.231.89.194) [INFO] New connection from 91.231.89.194


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.60.143.30
country_id: 3175395
description:
2026-01-09 04:29:26 dovecot_login authenticator failed for H=([151.60.143.30]) [151.60.143.30]:45519: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.228.134
country_id: 1269750
description:
2026-01-09 04:30:07 dovecot_login authenticator failed for H=(nsg-static-209.69.76.182-airtel.com) [128.185.228.134]:58944: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.90.126.96
country_id: 3703430
description:
2026-01-09 04:31:16 dovecot_login authenticator failed for H=(ADMIN) [91.90.126.96]:36531: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.46.192.20
country_id: 2510769
description:
2026-01-09 04:31:52 dovecot_login authenticator failed for H=([193.46.192.20]) [193.46.192.20]:57953: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.46.148.180
country_id: 6252001
description:
2026-01-09 04:33:26 dovecot_plain authenticator failed for H=c-68-46-148-180.hsd1.mi.comcast.net (cogacesban) [68.46.148.180]:34330: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 108.160.128.179
country_id: 1861060
description:
Denial of Service (DoS) attack was discovered from 108.160.128.179: 250 connections per 30 seconds to 443 port.


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.232.189.209
country_id: 6252001
description:
Jan  9 04:36:44 host2 sshd[1081648]: Disconnected from invalid user test 50.232.189.209 port 59024 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.232.189.209
country_id: 6252001
description:
Jan  9 04:38:19 host2 sshd[1082433]: Disconnected from invalid user admin1 50.232.189.209 port 52574 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 50.232.189.209
country_id: 6252001
description:
Jan  9 04:38:49 host2 sshd[1082700]: Disconnected from invalid user admin1 50.232.189.209 port 35704 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.199.126
country_id: 1269750
description:
2026-01-09 04:39:07 dovecot_login authenticator failed for H=([152.52.199.126]) [152.52.199.126]:33498: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.106.197.7
country_id: 6252001
description:
Jan  9 04:39:29 host2 dovecot[821886]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.106.197.7, lip=66.85.158.92, TLS, session=<uO0+gOhHsMwUasUH>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.166.54
country_id: 1269750
description:
2026-01-09 04:39:59 dovecot_login authenticator failed for H=([125.19.95.209]) [122.187.166.54]:43450: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.154.195.142
country_id: 1819730
description:
Jan  9 04:40:31 host2 sshd[1084030]: Disconnected from invalid user admin1 43.154.195.142 port 57318 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.154.195.142
country_id: 1819730
description:
Jan  9 04:41:08 host2 sshd[1084390]: Disconnected from invalid user admin1 43.154.195.142 port 60722 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.19.118.27
country_id: 3175395
description:
Jan  9 04:42:07 host2 sshd[1084983]: Disconnected from invalid user test 151.19.118.27 port 13058 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 186.56.11.17
country_id: 3865483
description:
Jan  9 04:42:17 host2 sshd[1085087]: Disconnected from invalid user admin 186.56.11.17 port 36706 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.154.195.142
country_id: 1819730
description:
Jan  9 04:42:22 host2 sshd[1085146]: Disconnected from invalid user test 43.154.195.142 port 55196 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.110.238.50
country_id: 3469034
description:
Jan  9 04:42:34 host2 sshd[1085265]: Disconnected from invalid user admin1 187.110.238.50 port 59976 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.56.11.17
country_id: 3865483
description:
Jan  9 04:43:50 host2 sshd[1086074]: Disconnected from invalid user ubuntu 186.56.11.17 port 34356 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 85.206.171.113
country_id: 597427
description:
Jan  9 04:44:43 host2 sshd[1086668]: Received disconnect from 85.206.171.113 port 46786:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.147.159.91
country_id: 1643084
description:
Jan  9 04:45:52 host2 sshd[1088144]: Disconnected from invalid user user 103.147.159.91 port 38946 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.99.80.102
country_id: 3469034
description:
Jan  9 04:46:01 host2 sshd[1088222]: Disconnected from invalid user user 138.99.80.102 port 43030 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 85.206.171.113
country_id: 597427
description:
Jan  9 04:45:10 host2 sshd[1087328]: Disconnected from invalid user admin1 85.206.171.113 port 36352 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 187.110.238.50
country_id: 3469034
description:
Jan  9 04:47:28 host2 sshd[1089581]: Disconnected from invalid user deploy 187.110.238.50 port 46520 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.99.80.102
country_id: 3469034
description:
Jan  9 04:47:41 host2 sshd[1089723]: Disconnected from invalid user ubuntu 138.99.80.102 port 44308 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.147.159.91
country_id: 1643084
description:
Jan  9 04:47:46 host2 sshd[1089789]: Disconnected from invalid user deploy 103.147.159.91 port 39154 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.64.206
country_id: 1269750
description:
2026-01-09 04:49:31 dovecot_login authenticator failed for H=(nsg-corporate-206.64.186.122.airtel.in) [122.186.64.206]:39574: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 159.180.242.106
country_id: 3017382
description:
2026-01-09 04:50:03 dovecot_login authenticator failed for H=(106.242.180.159.in-addr.arpa.celeste.fr) [159.180.242.106]:40178: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.66.2.184
country_id: 390903
description:
2026-01-09 04:50:41 dovecot_login authenticator failed for H=orz58h.static.otenet.gr [94.66.2.184]:42196: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.210.73.33
country_id: 3469034
description:
2026-01-09 04:50:52 dovecot_login authenticator failed for H=(189-108-224-67.customer.tdatabrasil.net.br) [191.210.73.33]:60935: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.81.229.181
country_id: 6252001
description:
2026-01-09 04:50:09 dovecot_login authenticator failed for H=(fabfibernet.com) [192.81.229.181]:57098: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.161.172
country_id: 3144096
description:
2026-01-09 04:50:23 dovecot_login authenticator failed for H=(172-161-97-62.cust.smartcall.no) [62.97.161.172]:32799: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.147.159.91
country_id: 1643084
description:
Jan  9 04:51:10 host2 sshd[1092389]: Disconnected from invalid user deploy 103.147.159.91 port 39494 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.230.142
country_id: 1269750
description:
2026-01-09 04:51:54 dovecot_login authenticator failed for H=([182.79.202.89]) [182.95.230.142]:40668: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  9 04:52:54 host2 sshd[1093550]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.181.196.96
country_id: 3469034
description:
2026-01-09 04:52:14 dovecot_login authenticator failed for H=(96.196.181.45.datasysteminfor.com.br) [45.181.196.96]:48589: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.135.198.226
country_id: 2510769
description:
Jan  9 04:52:36 host2 dovecot[821886]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=45.135.198.226, lip=66.85.158.91, TLS, session=<0loeruhHl4oth8bi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.26.179.88
country_id: 3175395
description:
Jan  9 04:52:58 host2 dovecot[821886]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=217.26.179.88, lip=66.85.158.91, TLS, session=<wWg6r+hHvdrZGrNY>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  9 04:53:19 host2 sshd[1093853]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.88.26.193
country_id: 294640
description:
2026-01-09 04:53:19 dovecot_login authenticator failed for H=(ADMIN) [149.88.26.193]:46205: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.157.219.158
country_id: 6252001
description:
2026-01-09 04:55:46 dovecot_plain authenticator failed for H=c-76-157-219-158.hsd1.il.comcast.net (nostrosed) [76.157.219.158]:38116: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.120.216.232
country_id: 1819730
description:
Jan  9 04:57:23 host2 sshd[1097791]: Disconnected from invalid user admin1 45.120.216.232 port 41112 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 148.113.24.68
country_id: 1269750
description:
Jan  9 04:57:25 host2 sshd[1097797]: Disconnected from invalid user user 148.113.24.68 port 56526 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 86.54.42.186
country_id: 241170
description:
Jan  9 04:59:08 host2 sshd[1099051]: Disconnected from invalid user user 86.54.42.186 port 57056 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.38.32.246
country_id: 6252001
description:
Jan  9 04:59:51 host2 dovecot[821886]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.38.32.246, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<VmAMyehHCtgUJiD2>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 148.113.24.68
country_id: 1269750
description:
Jan  9 05:00:18 host2 sshd[1100221]: Disconnected from invalid user admin 148.113.24.68 port 55960 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.116.29
country_id: 1819730
description:
Jan  9 05:00:39 host2 sshd[1100668]: Disconnected from invalid user admin 101.36.116.29 port 55154 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.19.118.27
country_id: 3175395
description:
Jan  9 05:00:11 host2 sshd[1100113]: Disconnected from invalid user test 151.19.118.27 port 14003 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.116.29
country_id: 1819730
description:
Jan  9 05:01:15 host2 sshd[1101225]: Disconnected from invalid user deploy 101.36.116.29 port 56252 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.36.116.29
country_id: 1819730
description:
Jan  9 05:01:50 host2 sshd[1101653]: Disconnected from invalid user user 101.36.116.29 port 43836 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.129
country_id: 6252001
description:
Jan  9 05:02:35 host2 dovecot[821886]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.129, lip=66.85.158.92, TLS: Connection closed, session=<NzbT0uhHcvFChJmB>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 147.50.227.79
country_id: 1605651
description:
Jan  9 05:03:13 host2 sshd[1102823]: Disconnected from invalid user admin 147.50.227.79 port 60126 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 147.50.227.79
country_id: 1605651
description:
Jan  9 05:04:19 host2 sshd[1103672]: Disconnected from invalid user user1 147.50.227.79 port 52768 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.221.194
country_id: 3144096
description:
2026-01-09 05:04:31 dovecot_login authenticator failed for H=([178.232.221.194]) [178.232.221.194]:40997: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 101.36.116.29
country_id: 1819730
description:
Jan  9 05:03:57 host2 sshd[1103353]: Received disconnect from 101.36.116.29 port 34974:11: Bye Bye [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.215.125.250
country_id: 192950
description:
2026-01-09 05:05:08 dovecot_login authenticator failed for H=(41.215.125.250.accesskenya.com) [41.215.125.250]:38964: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.19.118.27
country_id: 3175395
description:
Jan  9 05:08:13 host2 sshd[1106659]: Disconnected from invalid user admin1 151.19.118.27 port 13139 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.127.53.61
country_id: 6252001
description:
2026-01-09 05:12:46 dovecot_plain authenticator failed for H=c-24-127-53-61.hsd1.mi.comcast.net (thealvener) [24.127.53.61]:42688: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 143.244.52.64
country_id: 798549
description:
2026-01-09 05:14:07 dovecot_login authenticator failed for H=(ADMIN) [143.244.52.64]:45273: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 205.185.115.224
country_id: 6252001
description:
Jan  9 05:16:48 host2 sshd[1114369]: Disconnected from invalid user test 205.185.115.224 port 58296 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 129.226.172.185
country_id: 1819730
description:
Jan  9 05:16:55 host2 sshd[1114436]: Disconnected from invalid user user1 129.226.172.185 port 52036 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 205.185.115.224
country_id: 6252001
description:
Jan  9 05:17:28 host2 sshd[1114879]: Disconnected from invalid user ubuntu 205.185.115.224 port 41786 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 205.185.115.224
country_id: 6252001
description:
Jan  9 05:18:02 host2 sshd[1115330]: Disconnected from invalid user user 205.185.115.224 port 52640 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.155.55.174
country_id: 1880251
description:
Jan  9 05:18:58 host2 sshd[1115999]: Disconnected from invalid user test 107.155.55.174 port 51514 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 107.155.55.174
country_id: 1880251
description:
Jan  9 05:20:11 host2 sshd[1117059]: Disconnected from invalid user user1 107.155.55.174 port 46090 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.184.114
country_id: 1269750
description:
2026-01-09 05:20:21 dovecot_login authenticator failed for H=([152.52.238.86]) [182.95.184.114]:34700: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 129.226.172.185
country_id: 1819730
description:
Jan  9 05:20:01 host2 sshd[1116726]: Disconnected from invalid user admin 129.226.172.185 port 47272 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.200.166
country_id: 149590
description:
2026-01-09 05:20:08 dovecot_login authenticator failed for H=([41.59.200.166]) [41.59.200.166]:56452: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.183.82.237
country_id: 1269750
description:
Jan  9 05:20:09 host2 sshd[1117010]: Disconnected from invalid user ubuntu 68.183.82.237 port 59392 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.207.210.23
country_id: 2960313
description:
2026-01-09 05:21:40 dovecot_plain authenticator failed for H=(grassishan) [88.207.210.23]:61088: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 129.226.172.185
country_id: 1819730
description:
Jan  9 05:21:17 host2 sshd[1117952]: Disconnected from invalid user ubuntu 129.226.172.185 port 42656 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  9 05:23:52 host2 sshd[1119999]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.183.82.237
country_id: 1269750
description:
Jan  9 05:23:29 host2 sshd[1119749]: Disconnected from invalid user test 68.183.82.237 port 58852 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan  9 05:23:40 host2 sshd[1119842]: Disconnected from invalid user user 2.57.121.25 port 26238 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.41.211.48
country_id: 6252001
description:
2026-01-09 05:23:22 dovecot_login authenticator failed for H=48.211.41.34.bc.googleusercontent.com [34.41.211.48]:53270: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.154.80.36
country_id: 2245662
description:
2026-01-09 05:24:04 dovecot_login authenticator failed for H=([213.154.80.21]) [213.154.80.36]:45775: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 68.183.82.237
country_id: 1269750
description:
Jan  9 05:24:31 host2 sshd[1120483]: Disconnected from invalid user user1 68.183.82.237 port 58590 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  9 05:25:17 host2 sshd[1121214]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 68.183.82.237
country_id: 1269750
description:
Jan  9 05:25:02 host2 sshd[1120853]: Received disconnect from 68.183.82.237 port 41476:11: Bye Bye [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.37.8
country_id: 798544
description:
2026-01-09 05:26:54 dovecot_login authenticator failed for H=89-67-37-8.dynamic.play.pl [89.67.37.8]:34320: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.213.98
country_id: 1269750
description:
2026-01-09 05:27:02 dovecot_login authenticator failed for H=([128.185.241.123]) [152.52.213.98]:39000: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.208.81.125
country_id: 6252001
description:
2026-01-09 05:27:45 dovecot_plain authenticator failed for H=c-73-208-81-125.hsd1.in.comcast.net (linnite) [73.208.81.125]:41672: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.31.95.163
country_id: 3686110
description:
Jan  9 05:28:44 host2 sshd[1123930]: Disconnected from invalid user deploy 186.31.95.163 port 54184 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.61.176.110
country_id: 3469034
description:
2026-01-09 05:27:54 dovecot_login authenticator failed for H=([187.50.122.20]) [177.61.176.110]:60532: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 49.204.74.149
country_id: 1269750
description:
Jan  9 05:29:17 host2 sshd[1124286]: Disconnected from invalid user user1 49.204.74.149 port 48528 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 179.40.112.10
country_id: 3865483
description:
Jan  9 05:30:44 host2 sshd[1125510]: Disconnected from invalid user user 179.40.112.10 port 42440 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.40.112.10
country_id: 3865483
description:
Jan  9 05:31:25 host2 sshd[1126101]: Disconnected from invalid user ubuntu 179.40.112.10 port 55598 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.40.112.10
country_id: 3865483
description:
Jan  9 05:32:03 host2 sshd[1126552]: Disconnected from invalid user admin 179.40.112.10 port 40528 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.247.239.202
country_id: 1269750
description:
2026-01-09 05:32:06 dovecot_login authenticator failed for H=([117.247.239.202]) [117.247.239.202]:45678: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.122
country_id: 1269750
description:
2026-01-09 05:32:41 dovecot_login authenticator failed for H=([125.16.31.25]) [152.52.236.122]:39554: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 49.204.74.149
country_id: 1269750
description:
Jan  9 05:31:57 host2 sshd[1126458]: Disconnected from invalid user admin1 49.204.74.149 port 39880 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 49.204.74.149
country_id: 1269750
description:
Jan  9 05:33:08 host2 sshd[1127507]: Disconnected from invalid user user 49.204.74.149 port 33924 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.31.95.163
country_id: 3686110
description:
Jan  9 05:33:28 host2 sshd[1127857]: Disconnected from invalid user user 186.31.95.163 port 58260 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.216.177.55
country_id: 1643084
description:
Jan  9 05:35:23 host2 sshd[1129380]: Disconnected from invalid user deploy 41.216.177.55 port 41174 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 186.31.95.163
country_id: 3686110
description:
Jan  9 05:35:38 host2 sshd[1129585]: Disconnected from invalid user admin 186.31.95.163 port 52846 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 41.216.177.55
country_id: 1643084
description:
Jan  9 05:37:36 host2 sshd[1131097]: Disconnected from invalid user deploy 41.216.177.55 port 50002 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.16.97.90
country_id: 3469034
description:
2026-01-09 05:37:49 dovecot_login authenticator failed for H=mvx-187-16-97-90.mundivox.com [187.16.97.90]:36660: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.38.27
country_id: 3865483
description:
2026-01-09 05:39:19 dovecot_login authenticator failed for H=(ADMIN) [146.70.38.27]:14938: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.156.2
country_id: 1269750
description:
2026-01-09 05:39:33 dovecot_login authenticator failed for H=([125.19.156.2]) [125.19.156.2]:52786: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.113.212
country_id: 1861060
description:
Jan  9 05:41:16 host2 dovecot[821886]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=139.162.113.212, lip=66.85.158.91, TLS: Connection closed, session=<4v0xXelHAKOLonHU>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.68
country_id: 6252001
description:
Jan  9 05:43:10 host2 pure-ftpd[1135728]: (?@198.235.24.68) [INFO] New connection from 198.235.24.68


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.59
country_id: 6252001
description:
Jan  9 05:44:37 host2 dovecot[821886]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=167.94.146.59, lip=66.85.158.92, TLS: Connection closed, session=<mAoiaelH7HmnXpI7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.242.142
country_id: 1269750
description:
2026-01-09 05:45:47 dovecot_login authenticator failed for H=([125.19.172.137]) [182.78.242.142]:42638: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 164.92.119.250
country_id: 6252001
description:
Jan  9 05:46:21 host2 dovecot[821886]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=164.92.119.250, lip=66.85.158.91, TLS, session=<wd5gb+lHYN6kXHf6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.123
country_id: 2186224
description:
2026-01-09 05:46:02 dovecot_login authenticator failed for H=([121.73.163.123]) [121.73.163.123]:58158: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 23.236.169.235
country_id: 6252001
description:
Jan  9 05:47:47 host2 sshd[1139675]: Disconnected from invalid user test 23.236.169.235 port 37408 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 159.89.9.41
country_id: 2921044
description:
Jan  9 05:48:13 host2 dovecot[821886]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=159.89.9.41, lip=66.85.158.91, session=<foANdulHKF+fWQkp>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.99.137.128
country_id: 2921044
description:
Jan  9 05:48:13 host2 dovecot[821886]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=167.99.137.128, lip=66.85.158.91, session=<cpoCdulHj2mnY4mA>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 23.236.169.235
country_id: 6252001
description:
Jan  9 05:49:20 host2 sshd[1140810]: Disconnected from invalid user admin 23.236.169.235 port 43256 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.51.135
country_id: 3144096
description:
2026-01-09 05:50:06 dovecot_login authenticator failed for H=([178.232.51.135]) [178.232.51.135]:49729: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.51.162
country_id: 1149361
description:
2026-01-09 05:50:20 dovecot_login authenticator failed for H=([149.54.51.162]) [149.54.51.162]:59790: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 23.236.169.235
country_id: 6252001
description:
Jan  9 05:50:22 host2 sshd[1141682]: Disconnected from invalid user admin 23.236.169.235 port 37742 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 135.237.122.43
country_id: 6252001
description:
Jan  9 05:51:09 host2 sshd[1142267]: Disconnected from invalid user user 135.237.122.43 port 32888 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 82.24.64.209
country_id: 2635167
description:
Jan  9 05:52:27 host2 sshd[1143445]: Disconnected from invalid user test 82.24.64.209 port 35636 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 82.24.64.209
country_id: 2635167
description:
Jan  9 05:51:59 host2 sshd[1142957]: Disconnected from invalid user test 82.24.64.209 port 59636 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 135.237.122.43
country_id: 6252001
description:
Jan  9 05:53:17 host2 sshd[1144194]: Disconnected from invalid user test 135.237.122.43 port 42172 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 135.237.122.43
country_id: 6252001
description:
Jan  9 05:53:48 host2 sshd[1144536]: Disconnected from invalid user ubuntu 135.237.122.43 port 54886 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.24
country_id: 241170
description:
Jan  9 05:57:12 host2 dovecot[821886]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.24, lip=66.85.158.91, session=<sssBlulHFtzE+2YY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.195.52.4
country_id: 3144096
description:
2026-01-09 05:58:01 dovecot_login authenticator failed for H=([141.195.52.4]) [141.195.52.4]:48916: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.125
country_id: 6252001
description:
Jan  9 05:58:47 host2 dovecot[821886]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.125, lip=66.85.158.91, TLS: Connection closed, session=<WGTZm+lHIn9ChJl9>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.116.22
country_id: 1861060
description:
Jan  9 06:00:41 host2 dovecot[821886]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=139.162.116.22, lip=66.85.158.92, TLS: Connection closed, session=<yEWboulH5I2LonQW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.180
country_id: 2542007
description:
2026-01-09 06:04:46 dovecot_plain authenticator failed for H=(hallation) [102.53.15.180]:39195: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.246.122.170
country_id: 3144096
description:
2026-01-09 06:05:51 dovecot_login authenticator failed for H=(ADMIN) [46.246.122.170]:56316: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.220.236.203
country_id: 660013
description:
2026-01-09 06:08:05 dovecot_login authenticator failed for H=([62.220.236.203]) [62.220.236.203]:37882: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.64.94
country_id: 3469034
description:
2026-01-09 06:09:03 dovecot_login authenticator failed for H=([189.108.156.41]) [187.8.64.94]:47595: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.58.114
country_id: 1269750
description:
2026-01-09 06:10:14 dovecot_login authenticator failed for H=([182.95.58.114]) [182.95.58.114]:37246: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.168.11.67
country_id: 2077456
description:
2026-01-09 06:10:51 dovecot_login authenticator failed for H=([101.168.11.67]) [101.168.11.67]:40126: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.206.51
country_id: 3144096
description:
2026-01-09 06:11:19 dovecot_login authenticator failed for H=(cm-178.232.206.51.get.no) [178.232.206.51]:59149: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.14.24.50
country_id: 2658434
description:
2026-01-09 06:12:30 dovecot_login authenticator failed for H=50.24.14.46.static.wline.lns.sme.cust.swisscom.ch [46.14.24.50]:55631: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.211.96
country_id: 99237
description:
2026-01-09 06:13:03 dovecot_login authenticator failed for H=([65.20.211.96]) [65.20.211.96]:42639: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.129.67
country_id: 99237
description:
2026-01-09 06:14:15 dovecot_plain authenticator failed for H=(oxinted) [65.20.129.67]:44845: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.160.139.163
country_id: 2510769
description:
2026-01-09 06:16:41 dovecot_plain authenticator failed for H=(mindik) [90.160.139.163]:38159: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.42.194
country_id: 953987
description:
Jan  9 06:18:28 host2 dovecot[821886]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=102.64.42.194, lip=66.85.158.91, TLS, session=<LzgK4elHluZmQCrC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.230.64.246
country_id: 1512440
description:
2026-01-09 06:17:45 dovecot_login authenticator failed for H=([213.230.64.246]) [213.230.64.246]:42746: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 57.129.90.215
country_id: 2921044
description:
2026-01-09 06:18:14 dovecot_login authenticator failed for H=ns3241969.ip-57-129-90.eu [57.129.90.215]:59980: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.73.60
country_id: 3469034
description:
Jan  9 06:19:02 host2 dovecot[821886]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=187.120.73.60, lip=66.85.158.91, TLS, session=<LdAI4+lHTZy7eEk8>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.201.138
country_id: 1269750
description:
2026-01-09 06:21:22 dovecot_login authenticator failed for H=([125.19.174.244]) [128.185.201.138]:42598: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.184.82
country_id: 1269750
description:
2026-01-09 06:21:49 dovecot_login authenticator failed for H=([59.145.212.121]) [182.95.184.82]:34864: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.112.146
country_id: 1269750
description:
2026-01-09 06:22:13 dovecot_login authenticator failed for H=([125.18.67.17]) [182.95.112.146]:46406: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.73.3
country_id: 1819730
description:
2026-01-09 06:22:48 dovecot_login authenticator failed for H=42-200-73-3.static.imsbiz.com [42.200.73.3]:49071: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 43.241.36.24
country_id: 1269750
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 43.241.36.24 - epid "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.133
country_id: 6252001
description:
Jan  9 06:33:11 host2 dovecot[821886]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=66.132.153.133, lip=66.85.158.92, session=<01XeFupHdL5ChJmF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.0.107.158
country_id: 226074
description:
2026-01-09 06:34:01 dovecot_login authenticator failed for H=([196.0.107.158]) [196.0.107.158]:37490: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.175.128.35
country_id: 617790
description:
2026-01-09 06:33:40 dovecot_login authenticator failed for H=(ADMIN) [178.175.128.35]:13395: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.87.18
country_id: 1269750
description:
2026-01-09 06:34:52 dovecot_login authenticator failed for H=([182.95.197.193]) [182.79.87.18]:48458: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.251.170
country_id: 99237
description:
2026-01-09 06:36:25 dovecot_login authenticator failed for H=([65.20.251.170]) [65.20.251.170]:33949: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.248.243.181
country_id: 2542007
description:
2026-01-09 06:42:16 dovecot_plain authenticator failed for H=(jauming) [41.248.243.181]:44292: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.89.137.4
country_id: 3469034
description:
Jan  9 06:42:59 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 26 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=190.89.137.4, lip=66.85.158.91, TLS, session=<90xYOOpHwOe+WYkE>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.130.168.29
country_id: 3469034
description:
Jan  9 06:43:20 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=177.130.168.29, lip=66.85.158.91, TLS, session=<Ib73OepHXqCxgqgd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.76.242
country_id: 3469034
description:
Jan  9 06:45:24 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=187.120.76.242, lip=66.85.158.91, TLS, session=<Bs5gQepHI627eEzy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.249.229
country_id: 3865483
description:
Jan  9 06:45:49 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=179.0.249.229, lip=66.85.158.91, TLS, session=<XSK4QupHjMazAPnl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.238.213.180
country_id: 2661886
description:
2026-01-09 06:48:32 dovecot_login authenticator failed for H=h85-238-213-180.cust.bredband2.com [85.238.213.180]:51632: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.109.56.74
country_id: 6252001
description:
2026-01-09 06:48:46 dovecot_login authenticator failed for H=(dfw-206-109-56-74.ip4.99.network) [206.109.56.74]:30792: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.233.235.203
country_id: 2661886
description:
2026-01-09 06:49:06 dovecot_login authenticator failed for H=81-233-235-203-no600.tbcn.telia.com [81.233.235.203]:49652: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.64.126.23
country_id: 3175395
description:
2026-01-09 06:49:42 dovecot_login authenticator failed for H=([151.64.126.23]) [151.64.126.23]:43668: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.67.152.201
country_id: 1269750
description:
2026-01-09 06:53:33 dovecot_login authenticator failed for H=([103.67.152.201]) [103.67.152.201]:34310: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 40.124.185.212
country_id: 6252001
description:
Jan  9 06:55:57 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=40.124.185.212, lip=66.85.158.91, session=<vFJAaOpHBpgofLnU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.215.235.99
country_id: 1831722
description:
2026-01-09 06:57:08 dovecot_login authenticator failed for H=(ADMIN) [188.215.235.99]:1926: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.149.93
country_id: 99237
description:
2026-01-09 07:03:51 dovecot_plain authenticator failed for H=(toins) [65.20.149.93]:52435: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.49
country_id: 6252001
description:
Jan  9 07:06:46 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=167.94.146.49, lip=66.85.158.92, TLS: Connection closed, session=<jsD6jupHLK2nXpIx>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.191.70.126
country_id: 6252001
description:
2026-01-09 07:07:01 dovecot_login authenticator failed for H=pool-71-191-70-126.washdc.fios.verizon.net [71.191.70.126]:57620: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.49
country_id: 6252001
description:
Jan  9 07:06:49 host2 dovecot[1180436]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=167.94.146.49, lip=66.85.158.92, session=<E4cZj+pHZq2nXpIx>


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 44.220.185.28
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 44.220.185.28: 250 connections per 30 seconds to 2080 port.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.36.115.152
country_id: 1269750
description:
2026-01-09 07:17:03 dovecot_login authenticator failed for H=([103.68.19.170]) [49.36.115.152]:58735: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.247.248.154
country_id: 3469034
description:
2026-01-09 07:17:13 dovecot_login authenticator failed for H=([170.247.248.154]) [170.247.248.154]:35358: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.145.33
country_id: 1819730
description:
2026-01-09 07:17:30 dovecot_login authenticator failed for H=([223.197.145.33]) [223.197.145.33]:60578: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.78
country_id: 1733045
description:
2026-01-09 07:18:33 dovecot_login authenticator failed for H=([49.124.151.78]) [49.124.151.78]:39042: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.240.44.121
country_id: 798544
description:
Jan  9 07:19:23 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<hr>, method=PLAIN, rip=91.240.44.121, lip=66.85.158.91, TLS, session=<2ykMu+pHlr5b8Cx5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.0.39.38
country_id: 226074
description:
Jan  9 07:19:26 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<hr>, method=PLAIN, rip=196.0.39.38, lip=66.85.158.91, TLS, session=<ZMYQu+pH8JjEACcm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 31.179.228.33
country_id: 798544
description:
Jan  9 07:19:05 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=31.179.228.33, lip=66.85.158.91, TLS, session=<W3TwuepHNoYfs+Qh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.255.212.70
country_id: 732800
description:
Jan  9 07:19:04 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=185.255.212.70, lip=66.85.158.91, TLS, session=<BrrkuepH5Oe5/9RG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.43.109
country_id: 1819730
description:
2026-01-09 07:19:14 dovecot_login authenticator failed for H=109.43.246.220.static.netvigator.com [220.246.43.109]:61259: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.59.226
country_id: 337996
description:
2026-01-09 07:21:40 dovecot_login authenticator failed for H=([196.189.59.227]) [196.189.59.226]:45079: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.169.56.221
country_id: 1643084
description:
2026-01-09 07:21:17 dovecot_login authenticator failed for H=([202.169.56.221]) [202.169.56.221]:33012: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-01-09 07:22:59 dovecot_plain authenticator failed for H=(hallus) [64.72.74.162]:59215: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.46.113.165
country_id: 2960313
description:
2026-01-09 07:24:56 dovecot_login authenticator failed for H=(ADMIN) [37.46.113.165]:48710: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.70.26
country_id: 294640
description:
2026-01-09 07:25:34 dovecot_login authenticator failed for H=([2.55.70.26]) [2.55.70.26]:51275: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.212
country_id: 1819730
description:
2026-01-09 07:25:54 dovecot_login authenticator failed for H=212.42.246.220.static.netvigator.com [220.246.42.212]:49555: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.46.113.165
country_id: 2960313
description:
2026-01-09 07:27:49 dovecot_login authenticator failed for H=(ADMIN) [37.46.113.165]:46814: 535 Incorrect authentication data


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  9 07:28:29 host2 sshd[1221630]: Disconnected from invalid user admin 2.57.121.112 port 10092 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.201.138
country_id: 1269750
description:
2026-01-09 07:30:31 dovecot_login authenticator failed for H=([128.185.201.138]) [128.185.201.138]:37592: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.183.106.192
country_id: 6252001
description:
2026-01-09 07:30:40 dovecot_login authenticator failed for H=(syn-075-183-106-192.res.spectrum.com) [75.183.106.192]:48935: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.122
country_id: 6252001
description:
Jan  9 07:32:27 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.122, lip=66.85.158.92, TLS handshaking: Connection closed, session=<WvHG6upHdBVAPpx6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.122
country_id: 6252001
description:
Jan  9 07:32:57 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.122, lip=66.85.158.92, TLS: Connection closed, session=<9Aad7OpHpF1APpx6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.140.218.210
country_id: 1269750
description:
2026-01-09 07:34:04 dovecot_login authenticator failed for H=(14.140.218.210.static-bangalore-vsnl.net.in) [14.140.218.210]:53587: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.64.150
country_id: 1269750
description:
2026-01-09 07:34:36 dovecot_login authenticator failed for H=([125.23.229.42]) [182.78.64.150]:45396: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.219
country_id: 3017382
description:
Jan  9 07:43:57 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=91.231.89.219, lip=66.85.158.91, TLS handshaking: Connection closed, session=<EMLnE+tHMbNb51nb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.28
country_id: 3017382
description:
Jan  9 07:44:07 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=91.231.89.28, lip=66.85.158.91, TLS: Connection closed, session=<lIqHFOtHhZpb51kc>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.218
country_id: 3017382
description:
Jan  9 07:44:23 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.231.89.218, lip=66.85.158.91, TLS: Connection closed, session=<dPh1FetHp9Vb51na>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.185.158
country_id: 1269750
description:
2026-01-09 07:46:30 dovecot_login authenticator failed for H=([182.95.185.158]) [182.95.185.158]:34608: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.155.27.128
country_id: 2802361
description:
2026-01-09 07:46:06 dovecot_login authenticator failed for H=128.27.155.104.bc.googleusercontent.com [104.155.27.128]:56125: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.88.97.45
country_id: 2921044
description:
2026-01-09 07:47:20 dovecot_login authenticator failed for H=(ADMIN) [45.88.97.45]:24357: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.215.245.175
country_id: 3469034
description:
2026-01-09 07:47:31 dovecot_login authenticator failed for H=(visaotur.sdr.gvt.net.br) [186.215.245.175]:49707: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.0.40.238
country_id: 1210997
description:
2026-01-09 07:46:52 dovecot_login authenticator failed for H=([49.0.40.238]) [49.0.40.238]:56859: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.224.26
country_id: 1269750
description:
2026-01-09 07:47:55 dovecot_login authenticator failed for H=([152.52.224.26]) [152.52.224.26]:42376: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.179
country_id: 3017382
description:
Jan  9 07:48:22 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=91.196.152.179, lip=66.85.158.91, TLS handshaking: Connection closed, session=<mmm6I+tH4apbxJiz>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.183
country_id: 3017382
description:
Jan  9 07:48:33 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=91.196.152.183, lip=66.85.158.91, TLS: Connection closed, session=<171aJOtH88lbxJi3>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.210
country_id: 3017382
description:
Jan  9 07:48:46 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=91.196.152.210, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<TxQmJetHc5pbxJjS>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.215
country_id: 3017382
description:
Jan  9 07:48:49 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.196.152.215, lip=66.85.158.91, TLS: Connection closed, session=<0EFWJetHcdVbxJjX>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 13.73.111.251
country_id: 2077456
description:
Jan  9 07:50:15 host2 sshd[1238254]: Disconnected from invalid user admin1 13.73.111.251 port 43156 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 13.73.111.251
country_id: 2077456
description:
Jan  9 07:50:53 host2 sshd[1238693]: Disconnected from invalid user ubuntu 13.73.111.251 port 54838 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 13.73.111.251
country_id: 2077456
description:
Jan  9 07:52:15 host2 sshd[1239772]: Disconnected from invalid user user1 13.73.111.251 port 48340 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.166.153.20
country_id: 6252001
description:
2026-01-09 07:54:00 dovecot_plain authenticator failed for H=c-174-166-153-20.hsd1.nj.comcast.net (plized) [174.166.153.20]:43622: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.217.40.11
country_id: 6252001
description:
2026-01-09 07:53:56 dovecot_plain authenticator failed for H=(crohan) [50.217.40.11]:59830: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.64.150
country_id: 1269750
description:
2026-01-09 07:56:00 dovecot_login authenticator failed for H=(nsg-corporate-73.22.185.122.airtel.in) [182.78.64.150]:41604: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.177.210.193
country_id: 3469034
description:
2026-01-09 07:56:20 dovecot_login authenticator failed for H=(193.210.177.45.fronteirainternet.com.br) [45.177.210.193]:52126: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.57.39.170
country_id: 6252001
description:
2026-01-09 08:03:44 dovecot_login authenticator failed for H=(syn-184-057-039-170.res.spectrum.com) [184.57.39.170]:61613: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.118.138
country_id: 3144096
description:
2026-01-09 08:06:57 dovecot_login authenticator failed for H=(cm-46.212.118.138.get.no) [46.212.118.138]:45505: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.152.57.60
country_id: 2510769
description:
2026-01-09 08:09:39 dovecot_login authenticator failed for H=([85.152.57.60]) [85.152.57.60]:43196: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.205.2.9
country_id: 1269750
description:
2026-01-09 08:10:12 dovecot_login authenticator failed for H=([117.205.2.9]) [117.205.2.9]:35622: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.246.106
country_id: 1269750
description:
2026-01-09 08:10:35 dovecot_login authenticator failed for H=([125.16.255.97]) [125.20.246.106]:51526: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.227.94
country_id: 1269750
description:
2026-01-09 08:10:55 dovecot_login authenticator failed for H=([152.52.227.94]) [152.52.227.94]:48670: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.14.75.2
country_id: 6252001
description:
Jan  9 08:13:40 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.14.75.2, lip=66.85.158.92, session=<sxg4futHCq0UDksC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.214.165.147
country_id: 6252001
description:
2026-01-09 08:14:54 dovecot_login authenticator failed for H=(ADMIN) [181.214.165.147]:51396: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.204
country_id: 6252001
description:
Jan  9 08:15:06 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 24 secs): user=<>, rip=162.216.150.204, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<MUVZg+tH4tWi2JbM>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.204
country_id: 6252001
description:
Jan  9 08:16:03 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 13 secs): user=<>, rip=162.216.150.204, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<j/y0hutHiPSi2JbM>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.127
country_id: 6252001
description:
Jan  9 08:17:11 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.127, lip=66.85.158.92, TLS: Connection closed, session=<bc/KiutH4H1ChJl/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.204
country_id: 6252001
description:
Jan  9 08:16:57 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed: read(size=429) failed: Connection reset by peer (no auth attempts in 8 secs): user=<>, rip=162.216.150.204, lip=66.85.158.91, TLS: read(size=429) failed: Connection reset by peer, session=<03v1ietHLOai2JbM>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.111.226.241
country_id: 290291
description:
[2025-12-26 17:26:14 +0530] info [webmaild] 172.111.226.241 - hr@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.180
country_id: 2542007
description:
2026-01-09 08:19:08 dovecot_plain authenticator failed for H=(nially) [102.53.15.180]:58698: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.208.58
country_id: 1036973
description:
2026-01-09 08:20:36 dovecot_login authenticator failed for H=([197.219.208.58]) [197.219.208.58]:41618: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.154.221.68
country_id: 2510769
description:
2026-01-09 08:21:15 dovecot_login authenticator failed for H=68.red-79-154-221.dynamicip.rima-tde.net [79.154.221.68]:43919: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.231.202.201
country_id: 51537
description:
2026-01-09 08:23:09 dovecot_login authenticator failed for H=([197.231.202.201]) [197.231.202.201]:35165: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.231.25.64
country_id: 3686110
description:
2026-01-09 08:23:46 dovecot_login authenticator failed for H=(1522312565.colombiatel.co) [152.231.25.64]:39313: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.83.134.101
country_id: 3469034
description:
2026-01-09 08:23:59 dovecot_login authenticator failed for H=(179.83.135.1.dynamic.adsl.gvt.net.br) [179.83.134.101]:34915: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.204
country_id: 6252001
description:
Jan  9 08:24:02 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.150.204, lip=66.85.158.91, TLS, session=<lcBFo+tH0Oei2JbM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.221.254.250
country_id: 783754
description:
2026-01-09 08:24:28 dovecot_login authenticator failed for H=([185.221.254.250]) [185.221.254.250]:56768: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.208.38
country_id: 1036973
description:
2026-01-09 08:25:09 dovecot_login authenticator failed for H=([197.219.208.38]) [197.219.208.38]:44782: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.183.110.215
country_id: 798544
description:
2026-01-09 08:25:34 dovecot_login authenticator failed for H=178.183.110.215.mobile.static.t-mobile.pl [178.183.110.215]:56698: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.83.130.80
country_id: 1269750
description:
2026-01-09 08:25:41 dovecot_login authenticator failed for H=(80.130.83.103.static.rapidnet.in) [103.83.130.80]:49820: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.222
country_id: 2186224
description:
2026-01-09 08:26:07 dovecot_login authenticator failed for H=([121.73.169.222]) [121.73.169.222]:45010: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  9 08:27:40 host2 sshd[1267977]: error: kex_exchange_identification: read: Connection reset by peer


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 62.169.18.6
country_id: 3017382
description:
Denial of Service (DoS) attack was discovered from 62.169.18.6: 465 connections per 30 seconds to 80 port.


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 5.29.135.63
country_id: 294640
description:
Jan  9 08:32:02 host2 sshd[1271883]: Disconnected from invalid user admin1 5.29.135.63 port 44056 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.82.141.145
country_id: 6252001
description:
2026-01-09 08:32:58 dovecot_plain authenticator failed for H=c-68-82-141-145.hsd1.pa.comcast.net (unble) [68.82.141.145]:52744: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 5.29.135.63
country_id: 294640
description:
Jan  9 08:33:10 host2 sshd[1272815]: Disconnected from invalid user user 5.29.135.63 port 57818 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.40.189.43
country_id: 6252001
description:
2026-01-09 08:33:23 dovecot_plain authenticator failed for H=c-68-40-189-43.hsd1.mi.comcast.net (augnated) [68.40.189.43]:60798: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.31.8.12
country_id: 614540
description:
2026-01-09 08:38:27 dovecot_login authenticator failed for H=([194.31.8.12]) [194.31.8.12]:64768: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 20.118.209.70
country_id: 6252001
description:
Jan  9 08:38:34 host2 pure-ftpd[1277003]: (?@20.118.209.70) [INFO] New connection from 20.118.209.70


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.114.190
country_id: 1269750
description:
2026-01-09 08:39:08 dovecot_login authenticator failed for H=([27.123.114.190]) [27.123.114.190]:60412: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  9 08:41:53 host2 sshd[1279797]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.238.105.135
country_id: 3865483
description:
Jan  9 08:41:57 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=45.238.105.135, lip=66.85.158.91, TLS, session=<4+EX4utHF8Et7mmH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.39.142.50
country_id: 3469034
description:
Jan  9 08:42:17 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=177.39.142.50, lip=66.85.158.91, TLS, session=<M5B14+tH8Z2xJ44y>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.4.72.204
country_id: 2661886
description:
2026-01-09 08:43:23 dovecot_login authenticator failed for H=h-155-4-72-204.a192.priv.bahnhof.se [155.4.72.204]:56021: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.36.204
country_id: 3144096
description:
2026-01-09 08:43:13 dovecot_login authenticator failed for H=(cm-178.232.36.204.get.no) [178.232.36.204]:35378: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.40.101.10
country_id: 6252001
description:
2026-01-09 08:45:02 dovecot_plain authenticator failed for H=c-98-40-101-10.hsd1.tn.comcast.net (brime) [98.40.101.10]:54584: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 40.124.185.206
country_id: 6252001
description:
Jan  9 08:46:32 host2 pure-ftpd[1284550]: (?@40.124.185.206) [INFO] New connection from 40.124.185.206


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-09 08:48:15 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (overaps) [87.103.126.54]:19227: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.123
country_id: 6252001
description:
Jan  9 08:48:52 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.123, lip=66.85.158.91, session=<URIY/OtHcvWTuYR7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.22
country_id: 1149361
description:
2026-01-09 08:52:30 dovecot_login authenticator failed for H=([149.54.62.22]) [149.54.62.22]:38062: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.238.2.7
country_id: 3469034
description:
2026-01-09 08:53:22 dovecot_login authenticator failed for H=45-238-2-7.netmaisfibra.net.br [45.238.2.7]:50282: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.31
country_id: 1733045
description:
2026-01-09 08:53:46 dovecot_login authenticator failed for H=([49.124.153.31]) [49.124.153.31]:45192: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.181.133.153
country_id: 3469034
description:
2026-01-09 08:53:56 dovecot_login authenticator failed for H=([179.181.133.153]) [179.181.133.153]:60356: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.247.239.202
country_id: 1269750
description:
2026-01-09 08:57:09 dovecot_login authenticator failed for H=([117.247.239.202]) [117.247.239.202]:51236: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.201
country_id: 6252001
description:
Jan  9 08:57:36 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=198.235.24.201, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<XwZTG+xHCM/G6xjJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.225.220
country_id: 1269750
description:
2026-01-09 08:56:51 dovecot_login authenticator failed for H=(nsg-corporate-220.225.187.122.airtel.in) [122.187.225.220]:45093: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.168.12
country_id: 2186224
description:
2026-01-09 08:58:19 dovecot_login authenticator failed for H=([121.73.168.12]) [121.73.168.12]:40402: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.127.86
country_id: 1269750
description:
2026-01-09 08:57:52 dovecot_login authenticator failed for H=(dsl-ncr-dynamic-097.178.23.125.airtelbroadband.in) [182.79.127.86]:41254: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.226.88.121
country_id: 2661886
description:
2026-01-09 08:59:39 dovecot_plain authenticator failed for H=81-226-88-121-no600.tbcn.telia.com (fresings) [81.226.88.121]:59224: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.248.111.238
country_id: 6252001
description:
2026-01-09 09:00:28 dovecot_plain authenticator failed for H=(maimbols) [38.248.111.238]:38461: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 146.190.22.247
country_id: 2750405
description:
Jan  9 09:00:54 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=146.190.22.247, lip=66.85.158.91, session=<hGoCJ+xH5pmSvhb3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.233.5.67
country_id: 6252001
description:
2026-01-09 09:02:24 dovecot_login authenticator failed for H=([50.233.5.67]) [50.233.5.67]:45561: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.170.26.169
country_id: 2077456
description:
2026-01-09 09:02:37 dovecot_login authenticator failed for H=(124-170-26-169.tpgi.com.au) [124.170.26.169]:51567: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.56.48.131
country_id: 2750405
description:
2026-01-09 09:05:02 dovecot_login authenticator failed for H=(ADMIN) [212.56.48.131]:58092: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.196.144.25
country_id: 6252001
description:
2026-01-09 09:06:27 dovecot_plain authenticator failed for H=c-73-196-144-25.hsd1.nj.comcast.net (crantly) [73.196.144.25]:55994: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.164.148.87
country_id: 1512440
description:
2026-01-09 09:09:20 dovecot_login authenticator failed for H=([62.164.148.87]) [62.164.148.87]:53162: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.0.90.81
country_id: 2077456
description:
2026-01-09 09:09:08 dovecot_login authenticator failed for H=210.0.90.81.static.nexnet.net.au [210.0.90.81]:54744: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 109.241.24.186
country_id: 798544
description:
Jan  9 09:15:26 host2 sshd[1312257]: Disconnected from invalid user ubuntu 109.241.24.186 port 36368 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.75.122.7
country_id: 927384
description:
2026-01-09 09:16:11 dovecot_login authenticator failed for H=([41.75.122.7]) [41.75.122.7]:34891: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.157.2.238
country_id: 2921044
description:
Jan  9 09:16:27 host2 sshd[1313100]: Disconnected from invalid user ubuntu 43.157.2.238 port 42612 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.22
country_id: 1269750
description:
2026-01-09 09:16:38 dovecot_login authenticator failed for H=(aes-static-105.28.22.125.airtel.in) [182.95.228.22]:38770: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.157.2.238
country_id: 2921044
description:
Jan  9 09:16:56 host2 sshd[1313398]: Disconnected from invalid user deploy 43.157.2.238 port 47776 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan  9 09:16:59 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS handshaking: Connection closed, session=<4jWqYOxHmMYDjyE/>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 109.241.24.186
country_id: 798544
description:
Jan  9 09:17:18 host2 sshd[1313663]: Disconnected from invalid user admin 109.241.24.186 port 52964 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan  9 09:18:07 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<XIqxZOxHSroDjyE/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.56.0.19
country_id: 3469034
description:
2026-01-09 09:18:49 dovecot_login authenticator failed for H=(177-215-153-215.user.vivozap.com.br) [189.56.0.19]:45289: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.97.62
country_id: 1269750
description:
2026-01-09 09:19:03 dovecot_login authenticator failed for H=(nsg-corporate-209.240.186.122.airtel.in) [27.123.97.62]:47112: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 109.241.24.186
country_id: 798544
description:
Jan  9 09:18:26 host2 sshd[1314509]: Disconnected from invalid user user 109.241.24.186 port 39172 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan  9 09:20:02 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (disconnected before auth was ready, waited 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<niqHa+xH0u0DjyE/>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 109.241.24.186
country_id: 798544
description:
Jan  9 09:20:09 host2 sshd[1315911]: Disconnected from invalid user test 109.241.24.186 port 58566 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.198
country_id: 6252001
description:
Jan  9 09:20:56 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.198, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<ntzCbuxHO9PN0h/G>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan  9 09:22:52 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS handshaking: Connection closed, session=<q4OqdexHgoQDjyE/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.201.138
country_id: 1269750
description:
2026-01-09 09:23:22 dovecot_login authenticator failed for H=([128.185.201.138]) [128.185.201.138]:58102: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan  9 09:23:31 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<YI4DeOxHXKsDjyE/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.132.133.54
country_id: 1269750
description:
2026-01-09 09:23:38 dovecot_login authenticator failed for H=(dsl-del-dynamic-073.72.246.61.airtelbroadband.in) [203.132.133.54]:52554: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan  9 09:25:40 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS, session=</Gerf+xHFIEDjyE/>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 47.245.81.126
country_id: 1880251
description:
Jan  9 09:27:57 host2 pure-ftpd[1322213]: (?@47.245.81.126) [INFO] New connection from 47.245.81.126


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.133.47.10
country_id: 1522867
description:
2026-01-09 09:29:08 dovecot_login authenticator failed for H=(ADMIN) [62.133.47.10]:38380: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.213.237.28
country_id: 6252001
description:
2026-01-09 09:28:47 dovecot_plain authenticator failed for H=c-73-213-237-28.hsd1.va.comcast.net (puradisfic) [73.213.237.28]:53622: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.133.47.10
country_id: 1522867
description:
2026-01-09 09:29:15 dovecot_login authenticator failed for H=(ADMIN) [62.133.47.10]:17770: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.214.138.79
country_id: 2510769
description:
Jan  9 09:31:26 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=185.214.138.79, lip=66.85.158.91, TLS, session=<BHxdk+xH85O51opP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 89.106.141.216
country_id: 2963597
description:
Jan  9 09:31:44 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=89.106.141.216, lip=66.85.158.91, TLS, session=</mRjlOxH/IdZao3Y>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.87
country_id: 6252001
description:
Jan  9 09:35:24 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.87, lip=66.85.158.91, TLS, session=<5L6CouxHAOmTuYRX>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.227.70
country_id: 1269750
description:
2026-01-09 09:36:43 dovecot_login authenticator failed for H=([182.95.227.70]) [182.95.227.70]:42428: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.127.128
country_id: 3144096
description:
2026-01-09 09:37:03 dovecot_login authenticator failed for H=([46.212.127.128]) [46.212.127.128]:41802: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.51
country_id: 3144096
description:
2026-01-09 09:43:00 dovecot_login authenticator failed for H=(51-170-97-62.cust.smartcall.no) [62.97.170.51]:60558: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.215.245.175
country_id: 3469034
description:
2026-01-09 09:43:24 dovecot_login authenticator failed for H=([186.239.240.127]) [186.215.245.175]:52334: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-09 09:43:32 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (tived) [87.103.126.54]:41213: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.229.42
country_id: 1269750
description:
2026-01-09 09:46:08 dovecot_login authenticator failed for H=([152.52.238.53]) [152.52.229.42]:56738: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.146.233.200
country_id: 1269750
description:
2026-01-09 09:46:20 dovecot_login authenticator failed for H=([103.146.233.200]) [103.146.233.200]:39979: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.123.109.93
country_id: 732800
description:
2026-01-09 09:49:38 dovecot_login authenticator failed for H=(test) [93.123.109.93]:58473: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.177.78
country_id: 1269750
description:
2026-01-09 09:51:02 dovecot_login authenticator failed for H=([182.95.177.78]) [182.95.177.78]:43214: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.166.54
country_id: 1269750
description:
2026-01-09 09:51:15 dovecot_login authenticator failed for H=([125.19.95.209]) [122.187.166.54]:36426: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.174.63
country_id: 99237
description:
2026-01-09 09:57:50 dovecot_plain authenticator failed for H=(unshely) [65.20.174.63]:40369: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.246.159
country_id: 1269750
description:
Jan  9 09:58:43 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@jrdc.lk>, method=PLAIN, rip=103.164.246.159, lip=66.85.158.91, TLS, session=<FfTH9OxH/5xnpPaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 92.55.226.10
country_id: 798544
description:
Jan  9 09:58:51 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@jrdc.lk>, method=PLAIN, rip=92.55.226.10, lip=66.85.158.91, TLS, session=<BPRZ9exH4qVcN+IK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.100.41.198
country_id: 798549
description:
2026-01-09 09:59:01 dovecot_login authenticator failed for H=([109.100.41.198]) [109.100.41.198]:55363: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.96.104
country_id: 3469034
description:
Jan  9 09:59:06 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<info>, method=PLAIN, rip=177.44.96.104, lip=66.85.158.91, TLS, session=<SXj69exHS+exLGBo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 87.54.18.202
country_id: 2623032
description:
Jan  9 09:58:40 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@jrdc.lk>, method=PLAIN, rip=87.54.18.202, lip=66.85.158.91, TLS, session=<uMC19OxHjb1XNhLK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.159.123.19
country_id: 3865483
description:
Jan  9 09:59:02 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=186.159.123.19, lip=66.85.158.91, TLS, session=<EYzh9exHXOS6n3sT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.249.96
country_id: 3865483
description:
Jan  9 09:59:04 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info>, method=PLAIN, rip=179.0.249.96, lip=66.85.158.91, TLS, session=<nxfi9exHAp6zAPlg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.67.155.209
country_id: 298795
description:
Jan  9 09:58:40 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@jrdc.lk>, method=PLAIN, rip=45.67.155.209, lip=66.85.158.91, TLS, session=<Dp289OxHGO0tQ5vR>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 181.13.110.39
country_id: 3865483
description:
Jan  9 09:58:42 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@jrdc.lk>, method=PLAIN, rip=181.13.110.39, lip=66.85.158.91, TLS, session=<cdrJ9OxH7se1DW4n>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.232.203.22
country_id: 3017382
description:
2026-01-09 09:59:23 dovecot_login authenticator failed for H=([149.232.203.22]) [149.232.203.22]:35531: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.26.179.201
country_id: 3175395
description:
Jan  9 09:59:22 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=217.26.179.201, lip=66.85.158.91, TLS, session=</GI69+xHHp/ZGrPJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.127.63.9
country_id: 1605651
description:
2026-01-09 09:59:45 dovecot_login authenticator failed for H=([45.127.63.9]) [45.127.63.9]:58094: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.103.3.89
country_id: 690791
description:
Jan  9 09:59:19 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=176.103.3.89, lip=66.85.158.91, TLS, session=<SIgJ9+xH24CwZwNZ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.225.31.21
country_id: 718075
description:
2026-01-09 10:01:47 dovecot_login authenticator failed for H=(ADMIN) [185.225.31.21]:45095: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.117
country_id: 6252001
description:
Jan  9 10:01:14 host2 pure-ftpd[1351014]: (?@66.132.153.117) [INFO] New connection from 66.132.153.117


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.230.64.246
country_id: 1512440
description:
2026-01-09 10:06:28 dovecot_login authenticator failed for H=([213.230.64.246]) [213.230.64.246]:55084: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.84.179.128
country_id: 3996063
description:
2026-01-09 10:06:40 dovecot_login authenticator failed for H=([140.84.179.128]) [140.84.179.128]:51090: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.221.133.6
country_id: 3469034
description:
2026-01-09 10:07:50 dovecot_login authenticator failed for H=6-133-221-131.dynamic.v1telecom.com.br [131.221.133.6]:38892: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.161.196.5
country_id: 99237
description:
2026-01-09 10:07:12 dovecot_login authenticator failed for H=([46.161.196.5]) [46.161.196.5]:52424: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.197.178
country_id: 1269750
description:
2026-01-09 10:10:25 dovecot_login authenticator failed for H=([128.185.197.178]) [128.185.197.178]:37298: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.57.186
country_id: 953987
description:
Jan  9 10:14:07 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=102.129.57.186, lip=66.85.158.91, TLS, session=<p5HRK+1HkadmgTm6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.44.140.78
country_id: 690791
description:
Jan  9 10:13:46 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=194.44.140.78, lip=66.85.158.91, TLS, session=<vCO0Ku1HBc/CLIxO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 34.138.58.198
country_id: 6252001
description:
Jan  9 10:14:47 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=34.138.58.198, lip=66.85.158.91, session=<WslYL+1H1I0iijrG>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  9 10:15:22 host2 sshd[1364473]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 34.75.44.106
country_id: 6252001
description:
Jan  9 10:15:19 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed: read(size=994) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=34.75.44.106, lip=66.85.158.91, session=<0cY/Me1HitQiSyxq>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 67.10.185.103
country_id: 6252001
description:
Jan  9 10:19:50 host2 sshd[1368293]: Disconnected from invalid user ubuntu 67.10.185.103 port 43014 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 157.230.109.221
country_id: 2921044
description:
Jan  9 10:20:06 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 20 secs): user=<>, rip=157.230.109.221, lip=66.85.158.91, TLS handshaking: Connection closed, session=<GIJhQu1H/GCd5m3d>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 164.92.252.183
country_id: 2921044
description:
Jan  9 10:19:31 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=164.92.252.183, lip=66.85.158.91, TLS handshaking: read(size=1026) failed: Connection reset by peer, session=<vw9IQO1H/5mkXPy3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.177.113.45
country_id: 3175395
description:
Jan  9 10:19:50 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=195.177.113.45, lip=66.85.158.91, TLS, session=<7/NFQO1HFNvDsXEt>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.168.241.32
country_id: 1269750
description:
2026-01-09 10:20:56 dovecot_login authenticator failed for H=([103.168.241.32]) [103.168.241.32]:52457: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.214.138.101
country_id: 2510769
description:
Jan  9 10:20:19 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=185.214.138.101, lip=66.85.158.91, TLS, session=<8lAWQu1HsLO51opl>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.171.99
country_id: 1819730
description:
Jan  9 10:20:25 host2 sshd[1368973]: Disconnected from invalid user user1 152.32.171.99 port 58738 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.191.74.151
country_id: 6252001
description:
2026-01-09 10:21:27 dovecot_login authenticator failed for H=([172.191.74.151]) [172.191.74.151]:34792: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.171.99
country_id: 1819730
description:
Jan  9 10:21:42 host2 sshd[1370009]: Disconnected from invalid user ubuntu 152.32.171.99 port 39674 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.83.98
country_id: 1269750
description:
2026-01-09 10:21:44 dovecot_login authenticator failed for H=(nsg-static-193.132.71.182.airtel.in) [182.79.83.98]:49954: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.171.99
country_id: 1819730
description:
Jan  9 10:22:50 host2 sshd[1370900]: Disconnected from invalid user ubuntu 152.32.171.99 port 41994 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.171.99
country_id: 1819730
description:
Jan  9 10:23:27 host2 sshd[1371288]: Disconnected from invalid user ubuntu 152.32.171.99 port 52142 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.153.146
country_id: 99237
description:
2026-01-09 10:23:18 dovecot_login authenticator failed for H=([65.20.153.146]) [65.20.153.146]:59116: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.152.225.154
country_id: 6251999
description:
2026-01-09 10:23:28 dovecot_login authenticator failed for H=s75-152-225-154.ab.hsia.telus.net [75.152.225.154]:3215: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.41.211.48
country_id: 6252001
description:
2026-01-09 10:25:26 dovecot_login authenticator failed for H=48.211.41.34.bc.googleusercontent.com [34.41.211.48]:57324: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.155.177
country_id: 1733045
description:
2026-01-09 10:25:45 dovecot_login authenticator failed for H=([49.124.155.177]) [49.124.155.177]:40344: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.47.30.48
country_id: 953987
description:
2026-01-09 10:27:22 dovecot_login authenticator failed for H=(ADMIN) [154.47.30.48]:52382: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  9 10:29:35 host2 sshd[1376905]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.114.190
country_id: 1269750
description:
2026-01-09 10:30:08 dovecot_login authenticator failed for H=([128.185.223.185]) [27.123.114.190]:33408: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.227.70
country_id: 1269750
description:
2026-01-09 10:30:33 dovecot_login authenticator failed for H=([182.95.215.9]) [182.95.227.70]:56962: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.61.6
country_id: 290557
description:
2026-01-09 10:31:15 dovecot_plain authenticator failed for H=(molograted) [5.32.61.6]:54531: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2026-01-09 10:31:19 dovecot_plain authenticator failed for H=host-196-47-172-253.afnet.net (tried) [196.47.172.253]:50760: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.105.248.218
country_id: 6252001
description:
2026-01-09 10:31:22 dovecot_plain authenticator failed for H=(ovels) [24.105.248.218]:54214: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.123.45.2
country_id: 1269750
description:
2026-01-09 10:31:49 dovecot_login authenticator failed for H=([103.123.45.2]) [103.123.45.2]:57280: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.8.48.178
country_id: 1605651
description:
2026-01-09 10:35:05 dovecot_login authenticator failed for H=ppp-58-8-48-178.revip2.asianet.co.th [58.8.48.178]:58814: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.228.134
country_id: 1269750
description:
2026-01-09 10:35:37 dovecot_login authenticator failed for H=(nsg-static-209.69.76.182-airtel.com) [128.185.228.134]:58436: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.46.144
country_id: 1819730
description:
2026-01-09 10:41:08 dovecot_login authenticator failed for H=144.46.246.220.static.netvigator.com [220.246.46.144]:61161: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 155.4.244.107
country_id: 2661886
description:
Jan  9 10:41:20 host2 sshd[1386592]: Disconnected from invalid user user 155.4.244.107 port 35697 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.114.190
country_id: 1269750
description:
2026-01-09 10:41:31 dovecot_login authenticator failed for H=([128.185.223.185]) [27.123.114.190]:44064: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.220.16.51
country_id: 1269750
description:
2026-01-09 10:43:40 dovecot_login authenticator failed for H=([103.220.16.51]) [103.220.16.51]:40122: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 155.4.244.107
country_id: 2661886
description:
Jan  9 10:44:23 host2 sshd[1388632]: Disconnected from invalid user user1 155.4.244.107 port 36246 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 47.250.128.158
country_id: 1733045
description:
Jan  9 10:45:24 host2 pure-ftpd[1389538]: (?@47.250.128.158) [INFO] New connection from 47.250.128.158


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.15.216.41
country_id: 6252001
description:
2026-01-09 10:45:27 dovecot_plain authenticator failed for H=c-24-15-216-41.hsd1.il.comcast.net (vatanism) [24.15.216.41]:33164: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 155.4.244.107
country_id: 2661886
description:
Jan  9 10:46:11 host2 sshd[1390133]: Disconnected from invalid user admin 155.4.244.107 port 31007 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.220.90
country_id: 1269750
description:
2026-01-09 10:47:34 dovecot_login authenticator failed for H=(dsl-tn-dynamic-137.209.22.125.airtelbroadband.in) [128.185.220.90]:37534: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.249.247.165
country_id: 1819730
description:
Jan  9 10:47:13 host2 sshd[1390961]: Disconnected from invalid user test 45.249.247.165 port 45398 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.79.195
country_id: 337996
description:
2026-01-09 10:48:21 dovecot_login authenticator failed for H=([213.55.79.199]) [213.55.79.195]:59284: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 13.48.177.141
country_id: 2661886
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 13.48.177.141 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 45.249.247.165
country_id: 1819730
description:
Jan  9 10:50:25 host2 sshd[1393600]: Received disconnect from 45.249.247.165 port 57456:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.192.236.125
country_id: 1269750
description:
Jan  9 10:52:18 host2 sshd[1396064]: Disconnected from invalid user admin 117.192.236.125 port 37942 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 117.192.236.125
country_id: 1269750
description:
Jan  9 10:53:33 host2 sshd[1397446]: Disconnected from invalid user user 117.192.236.125 port 54967 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.192.236.125
country_id: 1269750
description:
Jan  9 10:54:49 host2 sshd[1398915]: Disconnected from invalid user deploy 117.192.236.125 port 43367 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.105.248.218
country_id: 6252001
description:
2026-01-09 10:55:13 dovecot_plain authenticator failed for H=(deidic) [24.105.248.218]:39034: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.208
country_id: 99237
description:
2026-01-09 10:55:45 dovecot_plain authenticator failed for H=(chrubdinal) [65.20.133.208]:55743: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.172.54.29
country_id: 6252001
description:
2026-01-09 10:57:49 dovecot_plain authenticator failed for H=c-67-172-54-29.hsd1.pa.comcast.net (sommists) [67.172.54.29]:60712: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.51.136
country_id: 953987
description:
Jan  9 10:57:25 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 23 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=102.129.51.136, lip=66.85.158.91, TLS, session=<jIhxxu1Hx5ZmgTOI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.121.95.197
country_id: 3469034
description:
Jan  9 10:57:45 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=138.121.95.197, lip=66.85.158.91, TLS, session=<23zpx+1HlZiKeV/F>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.192.236.125
country_id: 1269750
description:
Jan  9 10:58:40 host2 sshd[1402088]: Disconnected from invalid user user1 117.192.236.125 port 57120 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-09 10:59:35 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (almoconic) [87.103.126.54]:50510: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.133
country_id: 6252001
description:
Jan  9 11:02:37 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=66.132.153.133, lip=66.85.158.91, TLS: Connection closed, session=<21Rl2u1HaNFChJmF>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  9 11:03:47 host2 sshd[1406049]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.207
country_id: 6252001
description:
Jan  9 11:04:52 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 3 secs): user=<>, rip=205.210.31.207, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<Dnlv4u1HNsbN0h/P>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.142.130
country_id: 1733045
description:
2026-01-09 11:08:07 dovecot_login authenticator failed for H=([49.124.142.130]) [49.124.142.130]:52466: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.59.157
country_id: 3277605
description:
2026-01-09 11:08:57 dovecot_login authenticator failed for H=([195.222.59.157]) [195.222.59.157]:56792: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.229.38
country_id: 1269750
description:
2026-01-09 11:08:32 dovecot_login authenticator failed for H=([182.95.229.38]) [182.95.229.38]:43228: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.46.186
country_id: 1269750
description:
2026-01-09 11:08:31 dovecot_login authenticator failed for H=([125.21.153.217]) [182.95.46.186]:60342: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.196
country_id: 6252001
description:
Jan  9 11:09:36 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.196, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<q/hh8+1H5M3N0h/E>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.191.124.201
country_id: 1269750
description:
2026-01-09 11:13:54 dovecot_login authenticator failed for H=([160.191.124.201]) [160.191.124.201]:47259: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.8.218.251
country_id: 2661886
description:
2026-01-09 11:14:03 dovecot_login authenticator failed for H=(251.218.8.81.sta.ac-net.se) [81.8.218.251]:46286: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.123.46
country_id: 1269750
description:
2026-01-09 11:17:09 dovecot_login authenticator failed for H=([182.95.123.46]) [182.95.123.46]:38218: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.195.4.247
country_id: 6252001
description:
2026-01-09 11:17:20 dovecot_login authenticator failed for H=(mobile-166-195-004-247.mycingular.net) [166.195.4.247]:49342: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.246.122.50
country_id: 3144096
description:
2026-01-09 11:20:51 dovecot_login authenticator failed for H=(ADMIN) [46.246.122.50]:23540: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 31.222.6.125
country_id: 3077311
description:
Jan  9 11:21:15 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=31.222.6.125, lip=66.85.158.91, TLS, session=<JuUQHO5HOOgf3gZ9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.89.137.49
country_id: 3469034
description:
Jan  9 11:21:37 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=190.89.137.49, lip=66.85.158.91, TLS, session=<oNIwHe5HlNO+WYkx>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-09 11:22:04 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (cluous) [87.103.126.54]:30302: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 20.98.165.171
country_id: 6252001
description:
Jan  9 11:26:26 host2 pure-ftpd[1424263]: (?@20.98.165.171) [INFO] New connection from 20.98.165.171


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.227.144.87
country_id: 2921044
description:
Jan  9 11:28:31 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=165.227.144.87, lip=66.85.158.92, TLS handshaking: read(size=1026) failed: Connection reset by peer, session=<yoILN+5HIzGl45BX>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.57
country_id: 6252001
description:
Jan  9 11:29:10 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=147.185.132.57, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<661kOe5H/cKTuYQ5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2026-01-09 11:29:46 dovecot_login authenticator failed for H=([41.220.3.113]) [41.220.3.101]:34175: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 164.92.162.246
country_id: 2921044
description:
Jan  9 11:29:06 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 20 secs): user=<>, rip=164.92.162.246, lip=66.85.158.92, TLS handshaking: Connection closed, session=<ZiwnOe5HHs2kXKL2>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.66.214.70
country_id: 1269750
description:
2026-01-09 11:30:04 dovecot_login authenticator failed for H=([182.66.214.70]) [182.66.214.70]:53100: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.54.10
country_id: 1269750
description:
2026-01-09 11:32:44 dovecot_login authenticator failed for H=([182.95.54.10]) [182.95.54.10]:51124: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.18.99.10
country_id: 1269750
description:
2026-01-09 11:33:31 dovecot_login authenticator failed for H=([125.18.99.10]) [125.18.99.10]:33298: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.218.18
country_id: 1269750
description:
2026-01-09 11:33:38 dovecot_login authenticator failed for H=([128.185.217.27]) [128.185.218.18]:44632: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.239.78.124
country_id: 1819730
description:
2026-01-09 11:34:07 dovecot_login authenticator failed for H=(182.239.78.124.hk.chinamobile.com) [182.239.78.124]:36146: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.147
country_id: 6252001
description:
Jan  9 11:34:45 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 11 secs): user=<>, rip=162.216.150.147, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<RYhcTe5Hrcqi2JaT>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.147
country_id: 6252001
description:
Jan  9 11:35:55 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 12 secs): user=<>, rip=162.216.150.147, lip=66.85.158.92, TLS: read(size=403) failed: Connection reset by peer, session=<g6F6Ue5HWO6i2JaT>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.199.126
country_id: 1269750
description:
2026-01-09 11:38:08 dovecot_login authenticator failed for H=([182.79.31.107]) [152.52.199.126]:32858: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.245.13.114
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [webmaild] 172.245.13.114 - env_eng@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  9 11:40:42 host2 sshd[1434726]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.147
country_id: 6252001
description:
Jan  9 11:42:49 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.150.147, lip=66.85.158.92, TLS, session=<A/gtau5HFuKi2JaT>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.155.180
country_id: 1733045
description:
2026-01-09 11:45:14 dovecot_login authenticator failed for H=([49.124.155.180]) [49.124.155.180]:57544: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.215.74.195
country_id: 2661886
description:
2026-01-09 11:45:51 dovecot_plain authenticator failed for H=217-215-74-195-no2620.tbcn.telia.com (aniant) [217.215.74.195]:37432: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.125.229.12
country_id: 3194884
description:
2026-01-09 11:49:01 dovecot_login authenticator failed for H=(ADMIN) [176.125.229.12]:64296: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.51.26.198
country_id: 1269750
description:
2026-01-09 11:57:54 dovecot_plain authenticator failed for H=(ority) [103.51.26.198]:32902: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 64.227.76.184
country_id: 2750405
description:
Jan  9 11:58:41 host2 pure-ftpd[1449376]: (?@64.227.76.184) [INFO] New connection from 64.227.76.184


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 146.190.82.181
country_id: 1880251
description:
Jan  9 11:58:47 host2 pure-ftpd[1449442]: (?@146.190.82.181) [INFO] New connection from 146.190.82.181


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.72.74.162
country_id: 6252001
description:
Jan  9 12:02:41 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=64.72.74.162, lip=66.85.158.91, session=<Eu0Vse5HZI5ASEqi>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  9 12:03:13 host2 sshd[1452852]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.179.34
country_id: 1880251
description:
Jan  9 12:02:51 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=188.166.179.34, lip=66.85.158.91, TLS, session=<kCSjsO5H5Le8prMi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 189.56.0.19
country_id: 3469034
description:
Jan  9 12:03:06 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<hr>, method=PLAIN, rip=189.56.0.19, lip=66.85.158.91, session=<8AqDsu5HbKC9OAAT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 81.233.235.203
country_id: 2661886
description:
Jan  9 12:03:23 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<hr>, method=PLAIN, rip=81.233.235.203, lip=66.85.158.91, TLS, session=<6/3Bsu5HeNBR6evL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 78.186.54.65
country_id: 298795
description:
Jan  9 12:02:58 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=78.186.54.65, lip=66.85.158.91, TLS, session=<Z2RMse5HLoVOujZB>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 95.229.5.248
country_id: 3175395
description:
Jan  9 12:02:58 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=95.229.5.248, lip=66.85.158.91, session=<YjkWsu5HHpFf5QX4>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 138.68.70.41
country_id: 2921044
description:
Jan  9 12:03:03 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=138.68.70.41, lip=66.85.158.91, TLS, session=<JbaLsu5HOmyKREYp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.19.195.12
country_id: 3144096
description:
Jan  9 12:03:16 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=85.19.195.12, lip=66.85.158.91, TLS, session=</BZTsu5Htq5VE8MM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.93.37.178
country_id: 1269750
description:
2026-01-09 12:04:00 dovecot_login authenticator failed for H=([103.93.37.178]) [103.93.37.178]:43882: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.185.158
country_id: 1269750
description:
2026-01-09 12:04:12 dovecot_login authenticator failed for H=([182.95.26.52]) [182.95.185.158]:57366: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.103.120.150
country_id: 1819730
description:
2026-01-09 12:07:01 dovecot_login authenticator failed for H=150.120.103.218.static.netvigator.com [218.103.120.150]:55957: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.160.206
country_id: 1269750
description:
2026-01-09 12:07:16 dovecot_login authenticator failed for H=([128.185.23.89]) [125.19.160.206]:56088: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.28.216.188
country_id: 1694008
description:
2026-01-09 12:06:53 dovecot_plain authenticator failed for H=(U289EEWT) [120.28.216.188]:9045: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.34.70.2
country_id: 2510769
description:
2026-01-09 12:13:03 dovecot_login authenticator failed for H=2.red-83-34-70.dynamicip.rima-tde.net [83.34.70.2]:54928: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  9 12:17:26 host2 sshd[1463926]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.57
country_id: 6252001
description:
Jan  9 12:20:45 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=167.94.146.57, lip=66.85.158.91, TLS: Connection closed, session=<j+jY8e5H9sinXpI5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.151.249
country_id: 1819730
description:
2026-01-09 12:21:38 dovecot_login authenticator failed for H=249.151.48.116.static.netvigator.com [116.48.151.249]:55115: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.32.163.238
country_id: 953987
description:
2026-01-09 12:21:50 dovecot_login authenticator failed for H=([102.32.163.238]) [102.32.163.238]:49197: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.234.3
country_id: 289688
description:
2026-01-09 12:22:17 dovecot_login authenticator failed for H=(ADMIN) [95.181.234.3]:22028: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.38.3.181
country_id: 2215636
description:
2026-01-09 12:23:41 dovecot_plain authenticator failed for H=(heels) [102.38.3.181]:46652: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.0.235.30
country_id: 6252001
description:
2026-01-09 12:23:44 dovecot_plain authenticator failed for H=c-73-0-235-30.hsd1.fl.comcast.net (synatralic) [73.0.235.30]:52298: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.215.1.201
country_id: 2635167
description:
2026-01-09 12:25:41 dovecot_login authenticator failed for H=([88.215.1.201]) [88.215.1.201]:36710: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.97.190.237
country_id: 6252001
description:
2026-01-09 12:26:45 dovecot_plain authenticator failed for H=(unkly) [75.97.190.237]:41829: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.31.154
country_id: 1269750
description:
2026-01-09 12:26:37 dovecot_login authenticator failed for H=([59.145.84.25]) [103.251.31.154]:40416: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.172.54.29
country_id: 6252001
description:
2026-01-09 12:28:15 dovecot_plain authenticator failed for H=c-67-172-54-29.hsd1.pa.comcast.net (daenon) [67.172.54.29]:46088: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.27
country_id: 3144096
description:
2026-01-09 12:28:32 dovecot_login authenticator failed for H=(cm-84.213.189.27.get.no) [84.213.189.27]:59765: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.126
country_id: 1269750
description:
2026-01-09 12:28:44 dovecot_login authenticator failed for H=([125.17.198.33]) [182.95.178.126]:56196: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.4
country_id: 99237
description:
2026-01-09 12:29:05 dovecot_plain authenticator failed for H=(amfulecle) [65.20.133.4]:57138: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.243
country_id: 6252001
description:
Jan  9 12:29:58 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=205.210.31.243, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<oFfHEu9HacHN0h/z>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.201.86
country_id: 1733045
description:
2026-01-09 12:33:40 dovecot_login authenticator failed for H=([49.125.201.86]) [49.125.201.86]:56262: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.117
country_id: 6252001
description:
Jan  9 12:33:59 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 15 secs): user=<>, rip=66.132.153.117, lip=66.85.158.92, TLS handshaking: Connection closed, session=<p1UxIe9H+kBChJl1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.113.212
country_id: 1861060
description:
Jan  9 12:42:49 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=139.162.113.212, lip=66.85.158.92, TLS: Connection closed, session=<b0m9QO9H1JOLonHU>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.217.144.113
country_id: 1643084
description:
Jan  9 12:43:56 host2 sshd[1484396]: Disconnected from invalid user admin 103.217.144.113 port 59340 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.187.85
country_id: 337996
description:
2026-01-09 12:44:38 dovecot_login authenticator failed for H=([196.188.187.85]) [196.188.187.85]:59170: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.75.110
country_id: 1149361
description:
2026-01-09 12:44:49 dovecot_login authenticator failed for H=([180.94.75.110]) [180.94.75.110]:43358: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 20.193.141.133
country_id: 1269750
description:
Jan  9 12:46:38 host2 sshd[1486518]: Disconnected from invalid user deploy 20.193.141.133 port 24244 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.9
country_id: 798549
description:
Jan  9 12:47:14 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=85.217.149.9, lip=66.85.158.91, TLS: Connection closed, session=<Q9iUUO9HLKZV2ZUJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.193.141.133
country_id: 1269750
description:
Jan  9 12:47:49 host2 sshd[1487425]: Disconnected from invalid user deploy 20.193.141.133 port 17771 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.79.134
country_id: 1269750
description:
2026-01-09 12:48:02 dovecot_login authenticator failed for H=([152.52.218.233]) [182.78.79.134]:60746: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.176.126
country_id: 1269750
description:
2026-01-09 12:48:26 dovecot_login authenticator failed for H=(nsg-corporate-126.176.185.122.airtel.in) [122.185.176.126]:46198: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.194.22
country_id: 1269750
description:
2026-01-09 12:48:27 dovecot_login authenticator failed for H=([182.95.22.249]) [128.185.194.22]:35806: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.98.28.43
country_id: 1269750
description:
2026-01-09 12:49:18 dovecot_login authenticator failed for H=([14.98.28.43]) [14.98.28.43]:42762: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.87.18
country_id: 1269750
description:
2026-01-09 12:48:52 dovecot_login authenticator failed for H=([182.79.87.18]) [182.79.87.18]:44790: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.114.190
country_id: 1269750
description:
2026-01-09 12:49:08 dovecot_login authenticator failed for H=([27.123.114.190]) [27.123.114.190]:54172: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.69
country_id: 1733045
description:
2026-01-09 12:49:07 dovecot_login authenticator failed for H=([49.124.151.69]) [49.124.151.69]:52914: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.251.70
country_id: 1269750
description:
2026-01-09 12:50:17 dovecot_login authenticator failed for H=([125.17.70.25]) [125.20.251.70]:54090: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.100.156.38
country_id: 1605651
description:
2026-01-09 12:49:57 dovecot_login authenticator failed for H=mail.sotus.co.th [171.100.156.38]:57628: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.237.80.79
country_id: 1880251
description:
Jan  9 12:51:08 host2 sshd[1490236]: Disconnected from invalid user admin 52.237.80.79 port 53000 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.68.22.140
country_id: 1269750
description:
2026-01-09 12:51:33 dovecot_login authenticator failed for H=([103.68.22.140]) [103.68.22.140]:50565: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 52.237.80.79
country_id: 1880251
description:
Jan  9 12:51:44 host2 sshd[1490601]: Disconnected from invalid user user1 52.237.80.79 port 49618 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.125.122
country_id: 1269750
description:
2026-01-09 12:51:53 dovecot_login authenticator failed for H=(nsg-static-233.166.76.182-airtel.com) [182.95.125.122]:55772: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 142.93.212.130
country_id: 1269750
description:
Jan  9 12:51:57 host2 sshd[1490739]: Disconnected from invalid user deploy 142.93.212.130 port 54734 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.53.40.72
country_id: 3469034
description:
Jan  9 12:52:36 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=191.53.40.72, lip=66.85.158.91, TLS, session=<gzGjYu9H5c6/NShI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.109.178.48
country_id: 1269750
description:
Jan  9 12:52:59 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=103.109.178.48, lip=66.85.158.91, TLS, session=<CmHpY+9HPORnbbIw>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.238.9
country_id: 6252001
description:
2026-01-09 12:53:32 dovecot_login authenticator failed for H=(ADMIN) [95.181.238.9]:10676: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 142.93.212.130
country_id: 1269750
description:
Jan  9 12:54:22 host2 sshd[1492639]: Disconnected from invalid user ubuntu 142.93.212.130 port 36000 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.52
country_id: 6252001
description:
Jan  9 12:55:26 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.235.24.52, lip=66.85.158.92, TLS, session=<WvTlbe9HYuLG6xg0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 171.22.233.208
country_id: 3175395
description:
Jan  9 13:03:23 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=171.22.233.208, lip=66.85.158.91, TLS, session=<seBaie9HNZurFunQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.192.166
country_id: 1269750
description:
2026-01-09 13:03:43 dovecot_login authenticator failed for H=([27.123.105.234]) [128.185.192.166]:45344: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.249.97.66
country_id: 3469034
description:
Jan  9 13:03:44 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=167.249.97.66, lip=66.85.158.91, TLS, session=<zdF3iu9HMoWn+WFC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.243.68.66
country_id: 1861060
description:
2026-01-09 13:04:07 dovecot_login authenticator failed for H=66.68.243.35.bc.googleusercontent.com [35.243.68.66]:59844: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.221.137.85
country_id: 690791
description:
Jan  9 13:05:25 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=37.221.137.85, lip=66.85.158.91, TLS, session=<SFqhkO9HVIIl3YlV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.252.204
country_id: 3865483
description:
Jan  9 13:05:47 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=179.0.252.204, lip=66.85.158.91, TLS, session=<PVe+ke9H7N2zAPzM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.12.179
country_id: 1269750
description:
2026-01-09 13:06:24 dovecot_login authenticator failed for H=([128.185.12.179]) [128.185.12.179]:44938: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.193.168.136
country_id: 1269750
description:
2026-01-09 13:06:43 dovecot_login authenticator failed for H=([203.193.168.136]) [203.193.168.136]:58026: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.169.224.27
country_id: 6252001
description:
2026-01-09 13:09:44 dovecot_plain authenticator failed for H=c-174-169-224-27.hsd1.vt.comcast.net (miste) [174.169.224.27]:32834: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-09 13:09:48 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (diserys) [87.103.126.54]:1795: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.235.110
country_id: 1269750
description:
2026-01-09 13:13:41 dovecot_login authenticator failed for H=([128.185.160.185]) [128.185.235.110]:56440: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.209.108.42
country_id: 6254930
description:
2026-01-09 13:13:50 dovecot_plain authenticator failed for H=(noide) [185.209.108.42]:56196: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.163.58
country_id: 1269750
description:
2026-01-09 13:14:08 dovecot_login authenticator failed for H=([125.19.163.58]) [125.19.163.58]:52034: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.218.95.154
country_id: 6252001
description:
2026-01-09 13:16:36 dovecot_login authenticator failed for H=syn-074-218-095-154.biz.spectrum.com [74.218.95.154]:48006: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.210.151.158
country_id: 3144096
description:
2026-01-09 13:17:05 dovecot_login authenticator failed for H=([84.210.151.158]) [84.210.151.158]:59720: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.70.126
country_id: 1269750
description:
2026-01-09 13:17:09 dovecot_login authenticator failed for H=([125.20.232.243]) [182.78.70.126]:56814: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.37.52
country_id: 798544
description:
2026-01-09 13:17:29 dovecot_login authenticator failed for H=89-67-37-52.dynamic.play.pl [89.67.37.52]:55716: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.97.62
country_id: 1269750
description:
2026-01-09 13:21:14 dovecot_login authenticator failed for H=(nsg-corporate-209.240.186.122.airtel.in) [27.123.97.62]:45960: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.228.33.36
country_id: 798544
description:
Jan  9 13:22:39 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=91.228.33.36, lip=66.85.158.91, TLS, session=<kpA5zu9Hnulb5CEk>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.30.14.221
country_id: 6252001
description:
2026-01-09 13:22:20 dovecot_login authenticator failed for H=pool-108-30-14-221.nycmny.fios.verizon.net [108.30.14.221]:43850: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.255.73.237
country_id: 1269750
description:
Jan  9 13:22:21 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=103.255.73.237, lip=66.85.158.91, TLS, session=<8EQPze9HhZBn/0nt>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.125.230.13
country_id: 2562770
description:
2026-01-09 13:25:49 dovecot_login authenticator failed for H=(ADMIN) [176.125.230.13]:36295: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.223.176.171
country_id: 6252001
description:
2026-01-09 13:30:06 dovecot_login authenticator failed for H=([50.223.176.171]) [50.223.176.171]:39762: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.241.102
country_id: 1269750
description:
2026-01-09 13:30:36 dovecot_login authenticator failed for H=([125.19.175.152]) [182.78.241.102]:42178: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.54.170.192
country_id: 3175395
description:
Jan  9 13:35:42 host2 sshd[1526662]: Disconnected from invalid user admin1 156.54.170.192 port 56268 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 142.93.103.217
country_id: 2921044
description:
Jan  9 13:36:07 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=142.93.103.217, lip=66.85.158.92, TLS handshaking: read(size=1026) failed: Connection reset by peer, session=<Dwxe/+9HAYKOXWfZ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.54.170.192
country_id: 3175395
description:
Jan  9 13:36:12 host2 sshd[1527025]: Disconnected from invalid user deploy 156.54.170.192 port 33723 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.226.72.34
country_id: 2921044
description:
Jan  9 13:36:43 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 20 secs): user=<>, rip=64.226.72.34, lip=66.85.158.92, TLS handshaking: Connection closed, session=<ov+AAfBHKnxA4kgi>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.186.40.250
country_id: 3895114
description:
Jan  9 13:37:08 host2 sshd[1527630]: Disconnected from invalid user test 201.186.40.250 port 34952 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 156.54.170.192
country_id: 3175395
description:
Jan  9 13:37:14 host2 sshd[1527689]: Disconnected from invalid user deploy 156.54.170.192 port 45099 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.227.171.221
country_id: 2921044
description:
Jan  9 13:38:44 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=165.227.171.221, lip=66.85.158.91, session=<p8q0CPBHlZSl46vd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 134.122.70.87
country_id: 2921044
description:
Jan  9 13:38:44 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=134.122.70.87, lip=66.85.158.91, session=<m0TBCPBHRraGekZX>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.190.155.43
country_id: 6252001
description:
2026-01-09 13:38:09 dovecot_plain authenticator failed for H=(pesis) [76.190.155.43]:50782: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.227.166
country_id: 1269750
description:
2026-01-09 13:39:21 dovecot_login authenticator failed for H=([128.185.227.166]) [128.185.227.166]:42144: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.54.170.192
country_id: 3175395
description:
Jan  9 13:39:10 host2 sshd[1529064]: Disconnected from invalid user user 156.54.170.192 port 39617 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 201.186.40.250
country_id: 3895114
description:
Jan  9 13:39:49 host2 sshd[1529494]: Disconnected from invalid user admin 201.186.40.250 port 52526 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 178.128.243.225
country_id: 2750405
description:
Jan  9 13:41:34 host2 sshd[1530849]: Disconnected from invalid user ubuntu 178.128.243.225 port 41450 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 178.128.243.225
country_id: 2750405
description:
Jan  9 13:42:02 host2 sshd[1531124]: Disconnected from invalid user user 178.128.243.225 port 48194 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 178.128.243.225
country_id: 2750405
description:
Jan  9 13:43:26 host2 sshd[1532282]: Received disconnect from 178.128.243.225 port 40798:11: Bye Bye [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.145.142.243
country_id: 1269750
description:
2026-01-09 13:44:18 dovecot_login authenticator failed for H=([203.145.142.243]) [203.145.142.243]:47262: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.149.26
country_id: 99237
description:
2026-01-09 13:44:36 dovecot_login authenticator failed for H=([65.20.149.26]) [65.20.149.26]:48580: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.221.122
country_id: 3144096
description:
2026-01-09 13:44:01 dovecot_login authenticator failed for H=(cm-178.232.221.122.get.no) [178.232.221.122]:60482: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.173.10.75
country_id: 6252001
description:
2026-01-09 13:45:39 dovecot_login authenticator failed for H=([209.173.10.75]) [209.173.10.75]:50766: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.62.129.18
country_id: 2077456
description:
2026-01-09 13:45:55 dovecot_login authenticator failed for H=202-62-129-18.ip.vocus.network [202.62.129.18]:51430: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 164.92.162.246
country_id: 2921044
description:
Jan  9 13:48:13 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 29 secs): user=<>, rip=164.92.162.246, lip=66.85.158.92, TLS handshaking: Connection closed, session=<seusKvBHrkGkXKL2>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.194
country_id: 6252001
description:
Jan  9 13:49:20 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.194, lip=66.85.158.91, TLS, session=<682rLvBH0PjN0h/C>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.22.242.162
country_id: 1880251
description:
Jan  9 13:50:32 host2 pure-ftpd[1538122]: (?@165.22.242.162) [INFO] New connection from 165.22.242.162


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  9 13:50:50 host2 sshd[1538268]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.226.68.242
country_id: 2921044
description:
Jan  9 13:53:01 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.226.68.242, lip=66.85.158.91, TLS, session=<TTjTO/BHcJxA4kTy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.232.47
country_id: 2542007
description:
2026-01-09 13:58:21 dovecot_login authenticator failed for H=(ADMIN) [95.181.232.47]:36034: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.169.82.194
country_id: 935317
description:
2026-01-09 13:59:25 dovecot_login authenticator failed for H=(165-169-82-194.zeop.re) [165.169.82.194]:45994: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.227.245.154
country_id: 690791
description:
2026-01-09 14:00:00 dovecot_login authenticator failed for H=(213-227-245-154.static.vega-ua.net) [213.227.245.154]:21353: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-09 14:02:26 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (unonseping) [87.103.126.54]:4787: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.0.191.33
country_id: 6252001
description:
2026-01-09 14:02:45 dovecot_plain authenticator failed for H=c-73-0-191-33.hsd1.fl.comcast.net (ancesinag) [73.0.191.33]:38096: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.173.57
country_id: 3144096
description:
2026-01-09 14:04:16 dovecot_login authenticator failed for H=([62.97.173.57]) [62.97.173.57]:47594: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.23.73.187
country_id: 6252001
description:
2026-01-09 14:04:26 dovecot_login authenticator failed for H=([209.23.73.187]) [209.23.73.187]:53518: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  9 14:05:03 host2 sshd[1550181]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.146
country_id: 3017382
description:
Jan  9 14:08:17 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.231.89.146, lip=66.85.158.91, session=<wlZkcvBHU4db51mS>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.233
country_id: 3017382
description:
Jan  9 14:07:51 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=91.231.89.233, lip=66.85.158.91, session=<SsrdcPBHSZZb51np>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.37.198.190
country_id: 6252001
description:
2026-01-09 14:07:51 dovecot_login authenticator failed for H=([64.37.198.190]) [64.37.198.190]:54697: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.147
country_id: 3017382
description:
Jan  9 14:08:01 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=91.231.89.147, lip=66.85.158.91, session=<vOZ6cfBH9+Vb51mT>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.148
country_id: 3017382
description:
Jan  9 14:08:13 host2 dovecot[1180436]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=91.231.89.148, lip=66.85.158.91, session=<W+QxcvBHR4Jb51mU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.185.170
country_id: 1269750
description:
2026-01-09 14:08:34 dovecot_login authenticator failed for H=([182.95.26.55]) [182.95.185.170]:49784: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.237.191
country_id: 99237
description:
2026-01-09 14:08:52 dovecot_login authenticator failed for H=([65.20.237.191]) [65.20.237.191]:34238: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.223.46
country_id: 1269750
description:
2026-01-09 14:09:11 dovecot_login authenticator failed for H=([182.95.223.46]) [182.95.223.46]:41888: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.158
country_id: 1269750
description:
2026-01-09 14:09:19 dovecot_login authenticator failed for H=([182.95.178.158]) [182.95.178.158]:56520: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.120.98
country_id: 1269750
description:
2026-01-09 14:14:59 dovecot_login authenticator failed for H=([59.145.74.209]) [122.184.120.98]:44624: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.230.158
country_id: 1269750
description:
2026-01-09 14:15:05 dovecot_login authenticator failed for H=([61.246.26.65]) [182.95.230.158]:47046: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.43.172
country_id: 1819730
description:
2026-01-09 14:14:38 dovecot_login authenticator failed for H=172.43.246.220.static.netvigator.com [220.246.43.172]:57106: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.25.59.5
country_id: 3469034
description:
2026-01-09 14:14:46 dovecot_login authenticator failed for H=(ip-177-25-59-5.user.vivozap.com.br) [177.25.59.5]:46324: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  9 14:16:02 host2 sshd[1560155]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.154.164
country_id: 1733045
description:
2026-01-09 14:15:51 dovecot_login authenticator failed for H=([49.124.154.164]) [49.124.154.164]:36128: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.63.10
country_id: 1269750
description:
2026-01-09 14:16:10 dovecot_login authenticator failed for H=([182.95.63.10]) [182.95.63.10]:49876: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.157.98.80
country_id: 453733
description:
2026-01-09 14:18:15 dovecot_login authenticator failed for H=80-98-157-37.dyn.estpak.ee [37.157.98.80]:53246: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.18.99.38
country_id: 1269750
description:
2026-01-09 14:18:38 dovecot_login authenticator failed for H=([182.95.20.225]) [125.18.99.38]:54034: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.62.239.4
country_id: 732800
description:
2026-01-09 14:20:53 dovecot_plain authenticator failed for H=(hommulados) [149.62.239.4]:53352: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.161
country_id: 2993457
description:
Jan  9 14:28:00 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=194.165.16.161, lip=66.85.158.92, session=<HITpuPBH5P7CpRCh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2026-01-09 14:31:02 dovecot_plain authenticator failed for H=host-196-47-172-253.afnet.net (phaterier) [196.47.172.253]:58239: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.174.63
country_id: 99237
description:
2026-01-09 14:31:07 dovecot_plain authenticator failed for H=(copite) [65.20.174.63]:33907: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.225.31.28
country_id: 718075
description:
2026-01-09 14:30:26 dovecot_login authenticator failed for H=(ADMIN) [185.225.31.28]:15217: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.158
country_id: 1814991
description:
Jan  9 14:33:06 host2 dovecot[1180436]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=94.231.206.158, lip=66.85.158.91, session=<Z94ty/BH2cBe586e>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.202
country_id: 1814991
description:
Jan  9 14:32:40 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=94.231.206.202, lip=66.85.158.91, session=<VeSWyfBH9epe587K>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.200
country_id: 1814991
description:
Jan  9 14:32:50 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=94.231.206.200, lip=66.85.158.91, session=<5b81yvBHpZZe587I>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.205
country_id: 1814991
description:
Jan  9 14:33:10 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=94.231.206.205, lip=66.85.158.91, session=<rm9ny/BHz8Fe587N>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.239.182
country_id: 1269750
description:
2026-01-09 14:36:10 dovecot_login authenticator failed for H=(aes-static-177.143.22.125.airtel.in) [128.185.239.182]:58998: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.34.17.250
country_id: 99237
description:
2026-01-09 14:36:35 dovecot_login authenticator failed for H=([185.34.17.250]) [185.34.17.250]:38956: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.42.229.152
country_id: 1880251
description:
Jan  9 14:38:41 host2 sshd[1578190]: Disconnected from invalid user admin 152.42.229.152 port 36258 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.42.229.152
country_id: 1880251
description:
Jan  9 14:41:18 host2 sshd[1580371]: Disconnected from invalid user ubuntu 152.42.229.152 port 52774 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.59.226
country_id: 337996
description:
2026-01-09 14:43:59 dovecot_login authenticator failed for H=([196.189.59.227]) [196.189.59.226]:43300: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
country_id: 6252001
description:
2026-01-09 14:44:04 dovecot_plain authenticator failed for H=(baliss) [24.187.213.29]:54670: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.42.229.152
country_id: 1880251
description:
Jan  9 14:44:30 host2 sshd[1582826]: Disconnected from invalid user admin1 152.42.229.152 port 55878 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.192.80.143
country_id: 3175395
description:
2026-01-09 14:44:32 dovecot_login authenticator failed for H=([2.192.80.143]) [2.192.80.143]:37240: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.147.94
country_id: 290557
description:
2026-01-09 14:46:11 dovecot_plain authenticator failed for H=(glogulis) [80.227.147.94]:59605: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.208
country_id: 1733045
description:
2026-01-09 14:46:37 dovecot_login authenticator failed for H=([49.124.152.208]) [49.124.152.208]:54046: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.165.174.234
country_id: 1269750
description:
2026-01-09 14:47:59 dovecot_login authenticator failed for H=([103.165.174.234]) [103.165.174.234]:56557: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.155.110
country_id: 1269750
description:
2026-01-09 14:47:11 dovecot_login authenticator failed for H=(dsl-ncr-dynamic-169.179.23.125.airtelbroadband.in) [125.23.155.110]:33654: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.152.225.154
country_id: 6251999
description:
2026-01-09 14:48:23 dovecot_login authenticator failed for H=s75-152-225-154.ab.hsia.telus.net [75.152.225.154]:2160: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.220.236.203
country_id: 660013
description:
2026-01-09 14:51:43 dovecot_login authenticator failed for H=([62.220.236.203]) [62.220.236.203]:48512: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.22.242.162
country_id: 1880251
description:
Jan  9 14:51:53 host2 pure-ftpd[1588841]: (?@165.22.242.162) [INFO] New connection from 165.22.242.162


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.85.202
country_id: 337996
description:
2026-01-09 14:51:11 dovecot_login authenticator failed for H=([196.191.212.226]) [213.55.85.202]:4789: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.195.138.52
country_id: 6252001
description:
2026-01-09 14:53:51 dovecot_plain authenticator failed for H=c-98-195-138-52.hsd1.tx.comcast.net (sneptna) [98.195.138.52]:39042: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.22.242.162
country_id: 1880251
description:
Jan  9 14:59:06 host2 pure-ftpd[1594933]: (?@165.22.242.162) [INFO] New connection from 165.22.242.162


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.248.111.238
country_id: 6252001
description:
2026-01-09 15:00:16 dovecot_plain authenticator failed for H=(cardisess) [38.248.111.238]:34332: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.68.52.210
country_id: 1269750
description:
2026-01-09 15:02:53 dovecot_login authenticator failed for H=([103.68.52.210]) [103.68.52.210]:34080: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.233.21.109
country_id: 272103
description:
2026-01-09 15:03:30 dovecot_login authenticator failed for H=([109.233.21.109]) [109.233.21.109]:41532: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.165.182.203
country_id: 6252001
description:
2026-01-09 15:09:35 dovecot_login authenticator failed for H=(173-165-182-203-atlanta.hfc.comcastbusiness.net) [173.165.182.203]:50611: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 181.118.183.176
country_id: 3865483
description:
Jan  9 15:15:37 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=181.118.183.176, lip=66.85.158.91, TLS, session=<9NgXYvFH1JW1drew>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.70.126.215
country_id: 1269750
description:
Jan  9 15:16:00 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=103.70.126.215, lip=66.85.158.91, TLS, session=<CU1nY/FHN9BnRn7X>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.146.18
country_id: 1269750
description:
2026-01-09 15:17:08 dovecot_login authenticator failed for H=(nsg-corporate-127.152.185.122.airtel.in) [122.185.146.18]:56040: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.149.208
country_id: 1733045
description:
2026-01-09 15:16:16 dovecot_login authenticator failed for H=([49.124.149.208]) [49.124.149.208]:56052: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-09 15:16:37 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:8971: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.46.186
country_id: 1269750
description:
2026-01-09 15:17:36 dovecot_login authenticator failed for H=([125.21.153.217]) [182.95.46.186]:38080: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.248.111.238
country_id: 6252001
description:
2026-01-09 15:17:54 dovecot_plain authenticator failed for H=(phadia) [38.248.111.238]:40817: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.245.182
country_id: 1269750
description:
2026-01-09 15:22:31 dovecot_login authenticator failed for H=([125.20.245.182]) [125.20.245.182]:35508: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.124.229
country_id: 337996
description:
2026-01-09 15:22:12 dovecot_login authenticator failed for H=([196.189.124.229]) [196.189.124.229]:56222: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.163.102.126
country_id: 3469034
description:
Jan  9 15:24:34 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=164.163.102.126, lip=66.85.158.91, TLS, session=<do4jgvFHBquko2Z+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.243.92.96
country_id: 2510769
description:
Jan  9 15:24:51 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=185.243.92.96, lip=66.85.158.91, TLS, session=<8YtIg/FHSZS581xg>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.156.109.106
country_id: 1880251
description:
Jan  9 15:27:24 host2 sshd[1616675]: Disconnected from invalid user ubuntu 43.156.109.106 port 36408 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.156.109.106
country_id: 1880251
description:
Jan  9 15:28:30 host2 sshd[1617438]: Disconnected from invalid user test 43.156.109.106 port 59602 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.246.208.125
country_id: 798544
description:
Jan  9 15:31:54 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=91.246.208.125, lip=66.85.158.91, TLS, session=<0xp0nPFHBNJb9tB9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.255.215.57
country_id: 732800
description:
Jan  9 15:32:12 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=185.255.215.57, lip=66.85.158.91, TLS, session=<0HWGnfFHJLm5/9c5>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.154.32.153
country_id: 1819730
description:
Jan  9 15:35:36 host2 sshd[1622969]: Disconnected from invalid user user1 43.154.32.153 port 45014 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.119.118
country_id: 1269750
description:
2026-01-09 15:35:55 dovecot_login authenticator failed for H=([125.18.210.161]) [182.95.119.118]:41296: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.22
country_id: 1149361
description:
2026-01-09 15:36:13 dovecot_login authenticator failed for H=([149.54.62.22]) [149.54.62.22]:44479: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.201.62
country_id: 1269750
description:
2026-01-09 15:37:08 dovecot_login authenticator failed for H=(nsg-corporate-62.201.186.122.airtel.in) [122.186.201.62]:55050: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.11
country_id: 798549
description:
Jan  9 15:37:14 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=85.217.149.11, lip=66.85.158.91, session=<jS2FsPFH9LpV2ZUL>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  9 15:38:36 host2 sshd[1625308]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.4
country_id: 798549
description:
Jan  9 15:38:43 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=85.217.149.4, lip=66.85.158.92, session=<3QfbtfFHmtZV2ZUE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Jan  9 15:42:10 host2 dovecot[1180436]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<dGclwvFHSJIDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Jan  9 15:44:21 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<7EX8yfFHxIkDhpQ7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 129.0.111.246
country_id: 2233387
description:
2026-01-09 15:45:01 dovecot_login authenticator failed for H=(host-129.0.111.246.mtn.cm) [129.0.111.246]:65338: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Jan  9 15:45:14 host2 dovecot[1180436]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<jXYhzfFHmuEDhpQ7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.221.133.6
country_id: 3469034
description:
2026-01-09 15:45:14 dovecot_login authenticator failed for H=6-133-221-131.dynamic.v1telecom.com.br [131.221.133.6]:41942: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.213.236.66
country_id: 6252001
description:
2026-01-09 15:45:35 dovecot_plain authenticator failed for H=c-73-213-236-66.hsd1.va.comcast.net (patomytous) [73.213.236.66]:59346: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Jan  9 15:46:19 host2 dovecot[1180436]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 1 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<OSP60PFHNL4DhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Jan  9 15:47:11 host2 dovecot[1180436]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<h5sf1PFH1s8DhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Jan  9 15:48:10 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<hJKl1/FHCqgDhpQ7>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.134.148.59
country_id: 6252001
description:
Jan  9 15:49:28 host2 dovecot[1180436]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<KcZK3PFHDKIDhpQ7>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.134.148.59
country_id: 6252001
description:
Jan  9 15:50:25 host2 dovecot[1180436]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<o9Wy3/FHQNsDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Jan  9 15:51:25 host2 dovecot[1180436]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<TcI64/FHBrUDhpQ7>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  9 15:52:57 host2 sshd[1646313]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Jan  9 15:52:18 host2 dovecot[1180436]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<untm5vFHYJIDhpQ7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.53.7.231
country_id: 6252001
description:
2026-01-09 15:57:07 dovecot_login authenticator failed for H=([64.53.7.231]) [64.53.7.231]:33648: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.88.76.27
country_id: 1269750
description:
Jan  9 15:57:17 host2 sshd[1652009]: Disconnected from invalid user user 103.88.76.27 port 51724 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.64.150
country_id: 1269750
description:
2026-01-09 15:57:47 dovecot_login authenticator failed for H=([125.23.229.42]) [182.78.64.150]:49666: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.218.95.154
country_id: 6252001
description:
2026-01-09 15:58:07 dovecot_login authenticator failed for H=syn-074-218-095-154.biz.spectrum.com [74.218.95.154]:34865: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.199.126
country_id: 1269750
description:
2026-01-09 15:58:24 dovecot_login authenticator failed for H=([182.79.31.107]) [152.52.199.126]:44560: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.73.121.209
country_id: 732800
description:
2026-01-09 15:59:03 dovecot_plain authenticator failed for H=(piumiabely) [62.73.121.209]:57250: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.88.76.27
country_id: 1269750
description:
Jan  9 15:59:16 host2 sshd[1653608]: Disconnected from invalid user test 103.88.76.27 port 60538 [preauth]


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.147
country_id: 2635167
description:
Jan  9 16:01:15 host2 dovecot[1180436]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=185.247.137.147, lip=66.85.158.92, TLS, session=<cfhuBvJHX4S594mT>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.245.6.31
country_id: 1880251
description:
2026-01-09 16:06:08 dovecot_login authenticator failed for H=(31.6.245.49.unknown.m1.com.sg) [49.245.6.31]:46231: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.10.197.168
country_id: 2661886
description:
2026-01-09 16:06:23 dovecot_login authenticator failed for H=h-176-10-197-168.a444.priv.bahnhof.se [176.10.197.168]:41124: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.202.197.108
country_id: 6252001
description:
2026-01-09 16:11:18 dovecot_plain authenticator failed for H=(dentled) [50.202.197.108]:56282: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.64.150
country_id: 1269750
description:
2026-01-09 16:15:03 dovecot_login authenticator failed for H=(nsg-corporate-73.22.185.122.airtel.in) [182.78.64.150]:49300: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.168.76
country_id: 2186224
description:
2026-01-09 16:15:06 dovecot_login authenticator failed for H=([121.73.168.76]) [121.73.168.76]:47136: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.58.66.231
country_id: 3469034
description:
2026-01-09 16:14:43 dovecot_login authenticator failed for H=(industrianaval.fla.gvt.net.br) [187.58.66.231]:40365: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.42.225.40
country_id: 2510769
description:
2026-01-09 16:15:15 dovecot_login authenticator failed for H=40.red-81-42-225.staticip.rima-tde.net [81.42.225.40]:50410: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.123.45.2
country_id: 1269750
description:
2026-01-09 16:28:55 dovecot_login authenticator failed for H=([103.123.45.2]) [103.123.45.2]:36016: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.8.241.121
country_id: 2077456
description:
2026-01-09 16:29:24 dovecot_login authenticator failed for H=([161.8.241.121]) [161.8.241.121]:42937: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.25
country_id: 798549
description:
Jan  9 16:29:43 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=85.217.149.25, lip=66.85.158.92, session=<vXw3bPJH7K9V2ZUZ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.112.146
country_id: 1269750
description:
2026-01-09 16:30:18 dovecot_login authenticator failed for H=([182.95.85.103]) [182.95.112.146]:60888: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.15
country_id: 798549
description:
Jan  9 16:30:46 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=85.217.149.15, lip=66.85.158.92, TLS: Connection closed, session=<TY/zb/JHmKhV2ZUP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.30.161.197
country_id: 690791
description:
2026-01-09 16:30:57 dovecot_login authenticator failed for H=(46.30.161.197.access.ipnet.ua) [46.30.161.197]:50225: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.212
country_id: 1819730
description:
2026-01-09 16:31:09 dovecot_login authenticator failed for H=212.42.246.220.static.netvigator.com [220.246.42.212]:62653: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.59.166.126
country_id: 1269750
description:
2026-01-09 16:34:20 dovecot_plain authenticator failed for H=(8N8LN255TCKTWN) [152.59.166.126]:53173: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2026-01-09 16:39:58 dovecot_login authenticator failed for H=([197.219.228.242]) [197.219.228.242]:38550: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.149.161.131
country_id: 6252001
description:
2026-01-09 16:39:39 dovecot_login authenticator failed for H=c-50-149-161-131.hsd1.tn.comcast.net [50.149.161.131]:62479: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.161.27.82
country_id: 6252001
description:
2026-01-09 16:43:36 dovecot_plain authenticator failed for H=c-174-161-27-82.hsd1.tn.comcast.net (spenes) [174.161.27.82]:35984: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.187.85
country_id: 337996
description:
2026-01-09 16:43:42 dovecot_login authenticator failed for H=([196.188.187.85]) [196.188.187.85]:59474: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 13.68.214.34
country_id: 6252001
description:
2026-01-09 16:44:07 dovecot_login authenticator failed for H=([13.68.214.34]) [13.68.214.34]:55064: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.154
country_id: 3144096
description:
2026-01-09 16:48:29 dovecot_login authenticator failed for H=([84.213.189.154]) [84.213.189.154]:38021: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.168.252
country_id: 2186224
description:
2026-01-09 16:49:42 dovecot_login authenticator failed for H=([121.73.168.252]) [121.73.168.252]:41682: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.125
country_id: 1036973
description:
2026-01-09 16:50:34 dovecot_login authenticator failed for H=([196.28.226.125]) [196.28.226.125]:35493: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 155.248.164.42
country_id: 1861060
description:
Jan  9 16:53:55 host2 sshd[1698620]: Disconnected from invalid user user 155.248.164.42 port 53904 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.248.162
country_id: 1269750
description:
2026-01-09 16:54:13 dovecot_login authenticator failed for H=(033.162.18.125.dhcp.anaronline.net) [125.19.248.162]:51052: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.183
country_id: 3144096
description:
2026-01-09 16:54:24 dovecot_login authenticator failed for H=([84.213.189.183]) [84.213.189.183]:36992: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.154.80.36
country_id: 2245662
description:
2026-01-09 16:54:43 dovecot_login authenticator failed for H=([213.154.80.21]) [213.154.80.36]:42780: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.172.98
country_id: 1269750
description:
2026-01-09 16:54:55 dovecot_login authenticator failed for H=([27.123.119.146]) [122.187.172.98]:47270: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 122.176.122.24
country_id: 1269750
description:
Jan  9 16:54:11 host2 sshd[1698881]: Disconnected from invalid user user 122.176.122.24 port 51276 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 155.248.164.42
country_id: 1861060
description:
Jan  9 16:55:09 host2 sshd[1699907]: Disconnected from invalid user user 155.248.164.42 port 43374 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 155.248.164.42
country_id: 1861060
description:
Jan  9 16:58:01 host2 sshd[1702253]: Disconnected from invalid user test 155.248.164.42 port 51298 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 155.248.164.42
country_id: 1861060
description:
Jan  9 16:58:33 host2 sshd[1702781]: Disconnected from invalid user test 155.248.164.42 port 48960 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.146.240.123
country_id: 2542007
description:
2026-01-09 16:58:47 dovecot_plain authenticator failed for H=(voltunes) [154.146.240.123]:57114: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.157.95.30
country_id: 6251999
description:
2026-01-09 17:02:13 dovecot_login authenticator failed for H=d157-95-30.home4.cgocable.net [24.157.95.30]:54500: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.242.74
country_id: 1269750
description:
2026-01-09 17:03:00 dovecot_login authenticator failed for H=([128.185.242.74]) [128.185.242.74]:43190: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.66.119.139
country_id: 2661886
description:
2026-01-09 17:06:05 dovecot_login authenticator failed for H=78-66-119-139-no600.tbcn.telia.com [78.66.119.139]:60196: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.172.15.103
country_id: 3469034
description:
2026-01-09 17:06:23 dovecot_login authenticator failed for H=(177-172-15-62.user.vivozap.com.br) [177.172.15.103]:31827: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.238.213.180
country_id: 2661886
description:
2026-01-09 17:10:22 dovecot_login authenticator failed for H=h85-238-213-180.cust.bredband2.com [85.238.213.180]:33190: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 104.248.245.14
country_id: 2921044
description:
Jan  9 17:12:34 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=104.248.245.14, lip=66.85.158.92, session=<x0Z1BfNHbtto+PUO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 46.101.244.226
country_id: 2921044
description:
Jan  9 17:12:33 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=46.101.244.226, lip=66.85.158.92, session=<4CJlBfNHBeYuZfTi>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.22.242.162
country_id: 1880251
description:
Jan  9 17:13:17 host2 pure-ftpd[1712680]: (?@165.22.242.162) [INFO] New connection from 165.22.242.162


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.168.241.32
country_id: 1269750
description:
2026-01-09 17:19:26 dovecot_login authenticator failed for H=([103.168.241.32]) [103.168.241.32]:46430: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2026-01-09 17:19:04 dovecot_login authenticator failed for H=([197.219.228.242]) [197.219.228.242]:56394: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.136
country_id: 6252001
description:
Jan  9 17:17:30 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.136, lip=66.85.158.92, TLS: Connection closed, session=<Ay0bF/NHWNdChJmI>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.222
country_id: 2186224
description:
2026-01-09 17:18:45 dovecot_login authenticator failed for H=([121.73.169.222]) [121.73.169.222]:39806: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  9 17:27:12 host2 sshd[1723263]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.125.228.7
country_id: 2589581
description:
2026-01-09 17:32:18 dovecot_login authenticator failed for H=(ADMIN) [176.125.228.7]:27926: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.80.41.90
country_id: 3469034
description:
Jan  9 17:37:06 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=170.80.41.90, lip=66.85.158.91, TLS, session=<D47jW/NHatyqUCla>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.73.94
country_id: 1269750
description:
2026-01-09 17:36:23 dovecot_login authenticator failed for H=([125.19.196.193]) [182.78.73.94]:44982: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.184.80
country_id: 99237
description:
2026-01-09 17:37:23 dovecot_plain authenticator failed for H=(witormony) [65.20.184.80]:39711: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.170.1
country_id: 3175395
description:
Jan  9 17:37:29 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=185.15.170.1, lip=66.85.158.91, TLS, session=<ybNtXfNHkZa5D6oB>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.162
country_id: 2993457
description:
Jan  9 17:40:04 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=194.165.16.162, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<XPHOZ/NHOf7CpRCi>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  9 17:41:37 host2 sshd[1734407]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.184.114
country_id: 1269750
description:
2026-01-09 17:42:48 dovecot_login authenticator failed for H=([152.52.238.86]) [182.95.184.114]:39298: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.208.46.130
country_id: 1522867
description:
2026-01-09 17:43:12 dovecot_login authenticator failed for H=([37.208.46.130]) [37.208.46.130]:39544: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 57.129.90.215
country_id: 2921044
description:
2026-01-09 17:43:49 dovecot_login authenticator failed for H=ns3241969.ip-57-129-90.eu [57.129.90.215]:55124: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.164.93.136
country_id: 6252001
description:
2026-01-09 17:45:49 dovecot_login authenticator failed for H=(syn-024-164-093-136.res.spectrum.com) [24.164.93.136]:44041: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.201.22.158
country_id: 290557
description:
2026-01-09 17:46:06 dovecot_login authenticator failed for H=([94.201.22.158]) [94.201.22.158]:60966: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.52.119.193
country_id: 6252001
description:
2026-01-09 17:55:10 dovecot_plain authenticator failed for H=c-68-52-119-193.hsd1.tn.comcast.net (recinspid) [68.52.119.193]:58028: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.57.224.221
country_id: 1168579
description:
2026-01-09 17:59:56 dovecot_login authenticator failed for H=([103.57.224.221]) [103.57.224.221]:44411: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 192.3.179.41
country_id: 6252001
description:
Jan  9 18:00:56 host2 sshd[1750779]: Disconnected from invalid user ubuntu 192.3.179.41 port 33114 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.81.142.124
country_id: 3996063
description:
2026-01-09 18:02:06 dovecot_login authenticator failed for H=(ADMIN) [77.81.142.124]:37796: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.3.179.41
country_id: 6252001
description:
Jan  9 18:02:31 host2 sshd[1751888]: Disconnected from invalid user admin 192.3.179.41 port 49968 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.166.153.20
country_id: 6252001
description:
2026-01-09 18:03:06 dovecot_plain authenticator failed for H=c-174-166-153-20.hsd1.nj.comcast.net (copic) [174.166.153.20]:44588: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.161
country_id: 2993457
description:
Jan  9 18:03:18 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=194.165.16.161, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<jgnfuvNHuf/CpRCh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.67.22
country_id: 1269750
description:
2026-01-09 18:05:48 dovecot_login authenticator failed for H=([182.95.2.9]) [182.78.67.22]:37828: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.237.191
country_id: 99237
description:
2026-01-09 18:06:02 dovecot_login authenticator failed for H=([65.20.237.191]) [65.20.237.191]:55370: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.127.86
country_id: 1269750
description:
2026-01-09 18:06:09 dovecot_login authenticator failed for H=([27.123.119.191]) [122.184.127.86]:58824: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 4.213.160.153
country_id: 1269750
description:
Jan  9 18:05:16 host2 sshd[1754278]: Disconnected from invalid user ubuntu 4.213.160.153 port 60426 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.113.155.132
country_id: 690791
description:
2026-01-09 18:06:28 dovecot_plain authenticator failed for H=(ightner) [176.113.155.132]:38103: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.201.138
country_id: 1269750
description:
2026-01-09 18:06:13 dovecot_login authenticator failed for H=([125.19.174.244]) [128.185.201.138]:33390: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 134.209.102.173
country_id: 1880251
description:
2026-01-09 18:11:47 dovecot_login authenticator failed for H=([134.209.102.173]) [134.209.102.173]:42344: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.223.36.108
country_id: 3932488
description:
2026-01-09 18:11:22 dovecot_login authenticator failed for H=([190.223.36.108]) [190.223.36.108]:55244: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.102.242
country_id: 290557
description:
2026-01-09 18:16:29 dovecot_plain authenticator failed for H=(ratiocal) [80.227.102.242]:58963: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  9 18:24:53 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@nsteeleng.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<t3L6B/RH+g6i8Jp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  9 18:28:22 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<ZdxrFPRHSkyi8Jp9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.127.181.54
country_id: 390903
description:
2026-01-09 18:28:06 dovecot_login authenticator failed for H=(ADMIN) [79.127.181.54]:4818: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.201.248
country_id: 1880251
description:
Jan  9 18:28:18 host2 sshd[1776146]: Disconnected from invalid user user 45.78.201.248 port 39506 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.213.237.28
country_id: 6252001
description:
2026-01-09 18:28:31 dovecot_plain authenticator failed for H=c-73-213-237-28.hsd1.va.comcast.net (petemet) [73.213.237.28]:59886: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.174.73.209
country_id: 798544
description:
Jan  9 18:32:54 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=46.174.73.209, lip=66.85.158.91, TLS, session=<mpLHI/RHStEurknR>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.96.106.156
country_id: 3686110
description:
Jan  9 18:32:37 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=186.96.106.156, lip=66.85.158.91, TLS, session=<ohCrIvRHaLK6YGqc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.188.158.216
country_id: 2510769
description:
2026-01-09 18:35:31 dovecot_login authenticator failed for H=([207.188.158.216]) [207.188.158.216]:42707: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.130.148.217
country_id: 1512440
description:
2026-01-09 18:35:52 dovecot_login authenticator failed for H=([45.130.148.217]) [45.130.148.217]:49676: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.201.248
country_id: 1880251
description:
Jan  9 18:36:49 host2 sshd[1783586]: Disconnected from invalid user ubuntu 45.78.201.248 port 53424 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 46.101.128.229
country_id: 2921044
description:
Jan  9 18:36:51 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=46.101.128.229, lip=66.85.158.92, session=<vgvfMvRHVUYuZYDl>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.201.248
country_id: 1880251
description:
Jan  9 18:38:11 host2 sshd[1784769]: Disconnected from invalid user admin 45.78.201.248 port 55098 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.158.10
country_id: 99237
description:
2026-01-09 18:44:56 dovecot_login authenticator failed for H=([65.20.158.10]) [65.20.158.10]:58169: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.171.177
country_id: 3175395
description:
Jan  9 18:44:59 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 27 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=185.15.171.177, lip=66.85.158.91, TLS, session=<V0phTvRHDq+5D6ux>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.222.202
country_id: 1269750
description:
2026-01-09 18:45:12 dovecot_login authenticator failed for H=([128.185.247.100]) [182.95.222.202]:44052: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.103.11.62
country_id: 690791
description:
Jan  9 18:45:15 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=176.103.11.62, lip=66.85.158.91, TLS, session=<0KnyT/RHAJSwZws+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.227.146.235
country_id: 2921044
description:
Jan  9 18:49:07 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=165.227.146.235, lip=66.85.158.92, session=<92fBXvRHBn2l45Lr>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 46.105.235.55
country_id: 3017382
description:
[2026-01-09 18:51:19 +0530] info [cpaneld] 46.105.235.55 - lezzarot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarot (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.237.27
country_id: 3625428
description:
2026-01-09 18:52:26 dovecot_login authenticator failed for H=(ADMIN) [95.181.237.27]:17617: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.54.10
country_id: 1269750
description:
2026-01-09 18:53:36 dovecot_login authenticator failed for H=([128.185.241.106]) [182.95.54.10]:41708: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.226.118
country_id: 1269750
description:
2026-01-09 18:53:56 dovecot_login authenticator failed for H=([125.18.154.73]) [182.95.226.118]:52040: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.195.19.75
country_id: 1269750
description:
2026-01-09 18:55:20 dovecot_login authenticator failed for H=([47.247.80.227]) [14.195.19.75]:38408: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.102.148.242
country_id: 6252001
description:
2026-01-09 18:54:50 dovecot_login authenticator failed for H=syn-098-102-148-242.biz.spectrum.com [98.102.148.242]:33276: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.170.52
country_id: 3175395
description:
Jan  9 18:59:18 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=185.15.170.52, lip=66.85.158.91, TLS, session=<rEQlgvRHg9i5D6o0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.64.95.24
country_id: 3865483
description:
Jan  9 18:59:22 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=186.64.95.24, lip=66.85.158.91, TLS, session=<Ce41gvRHCMi6QF8Y>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.194.98
country_id: 6252001
description:
2026-01-09 18:59:09 dovecot_plain authenticator failed for H=c-73-197-194-98.hsd1.nj.comcast.net (coning) [73.197.194.98]:43340: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 31.134.98.210
country_id: 3057568
description:
Jan  9 18:59:36 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<hr>, method=PLAIN, rip=31.134.98.210, lip=66.85.158.91, TLS, session=<bllGg/RHy84fhmLS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.72.101
country_id: 3469034
description:
Jan  9 18:59:44 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<hr>, method=PLAIN, rip=187.120.72.101, lip=66.85.158.91, TLS, session=<udaQg/RHXb67eEhl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.96.189.27
country_id: 298795
description:
2026-01-09 19:01:34 dovecot_plain authenticator failed for H=(unprobast) [85.96.189.27]:34798: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  9 19:02:59 host2 sshd[1809185]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  9 19:03:29 host2 sshd[1809778]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  9 19:06:00 host2 sshd[1810838]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.3.227.160
country_id: 1861060
description:
2026-01-09 19:06:09 dovecot_login authenticator failed for H=p7001161-ipoefx.ipoe.ocn.ne.jp [118.3.227.160]:46494: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.230.134
country_id: 1269750
description:
2026-01-09 19:05:31 dovecot_login authenticator failed for H=([182.95.230.134]) [182.95.230.134]:59450: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.23.72.254
country_id: 6252001
description:
2026-01-09 19:05:55 dovecot_login authenticator failed for H=([209.23.72.254]) [209.23.72.254]:52920: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Jan  9 19:06:32 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@lankaherbalsolutions.com>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<4pvunPRHQrMvWfaQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.111.136.21
country_id: 294640
description:
2026-01-09 19:06:35 dovecot_login authenticator failed for H=([84.111.136.21]) [84.111.136.21]:52523: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  9 19:08:37 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@nsteeleng.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<ClZTpPRHhjii8Jp9>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 138.68.70.41
country_id: 2921044
description:
Jan  9 19:09:49 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 30 secs): user=<>, rip=138.68.70.41, lip=66.85.158.91, TLS handshaking: Connection closed, session=<eOrFqPRHQJyKREYp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan  9 19:10:27 host2 sshd[1817937]: Disconnected from invalid user user 2.57.121.25 port 35923 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  9 19:10:34 host2 sshd[1817906]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  9 19:12:09 host2 sshd[1819526]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Jan  9 19:12:01 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sobaherbal.com>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<0oKNsPRHSt8vWfaQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  9 19:12:10 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<qBMNsfRHJiCi8Jp9>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  9 19:12:33 host2 sshd[1819981]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.33.130
country_id: 1149361
description:
2026-01-09 19:34:01 dovecot_login authenticator failed for H=([149.54.33.130]) [149.54.33.130]:49767: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.47.146
country_id: 1819730
description:
2026-01-09 19:34:10 dovecot_login authenticator failed for H=146.47.246.220.static.netvigator.com [220.246.47.146]:51495: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.195.66
country_id: 1269750
description:
2026-01-09 19:34:19 dovecot_login authenticator failed for H=([125.19.195.66]) [125.19.195.66]:57586: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.111.110
country_id: 1269750
description:
2026-01-09 19:34:27 dovecot_login authenticator failed for H=([27.123.111.110]) [27.123.111.110]:60518: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 34.122.105.182
country_id: 6252001
description:
Jan  9 19:35:13 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=34.122.105.182, lip=66.85.158.92, TLS: Connection closed, session=<KF2lA/VHGKEiemm2>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.142.134
country_id: 1733045
description:
2026-01-09 19:34:53 dovecot_login authenticator failed for H=([49.124.142.134]) [49.124.142.134]:41970: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.115.144.103
country_id: 3469034
description:
2026-01-09 19:36:14 dovecot_login authenticator failed for H=(191.34.253.17.dynamic.adsl.gvt.net.br) [187.115.144.103]:53871: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.109.56.72
country_id: 6252001
description:
2026-01-09 19:36:54 dovecot_login authenticator failed for H=(dfw-206-109-56-72.ip4.99.network) [206.109.56.72]:55752: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Jan  9 19:40:51 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lankaherbalsolutions.com>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<gpuhF/VHxKovWfaQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.96.192.41
country_id: 3865483
description:
Jan  9 19:44:49 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=186.96.192.41, lip=66.85.158.91, TLS, session=<48bXJPVHEN26YMAp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.180
country_id: 2542007
description:
2026-01-09 19:44:58 dovecot_plain authenticator failed for H=(herobtrows) [102.53.15.180]:46885: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.251.8
country_id: 3865483
description:
Jan  9 19:45:10 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=179.0.251.8, lip=66.85.158.91, TLS, session=<VSIaJvVHrsuzAPsI>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.106.49.2
country_id: 6252001
description:
Jan  9 19:45:15 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.106.49.2, lip=66.85.158.92, session=<sBWHJ/VHmM8UajEC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Jan  9 19:46:06 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sobaherbal.com>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<nSJoKvVHaoovWfaQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.226.118
country_id: 1269750
description:
2026-01-09 19:47:18 dovecot_login authenticator failed for H=([182.95.226.118]) [182.95.226.118]:40476: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.51.40
country_id: 953987
description:
Jan  9 19:47:18 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=102.129.51.40, lip=66.85.158.91, TLS, session=<WxW0LfVHGtJmgTMo>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.22.242.162
country_id: 1880251
description:
Jan  9 19:46:39 host2 pure-ftpd[1847803]: (?@165.22.242.162) [INFO] New connection from 165.22.242.162


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.143.216
country_id: 99237
description:
Jan  9 19:47:37 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=65.20.143.216, lip=66.85.158.91, TLS, session=<RCbyLvVH45NBFI/Y>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.171.7.171
country_id: 1733045
description:
2026-01-09 19:48:10 dovecot_login authenticator failed for H=([183.171.7.171]) [183.171.7.171]:46430: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 134.122.91.196
country_id: 2921044
description:
Jan  9 19:49:41 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 30 secs): user=<>, rip=134.122.91.196, lip=66.85.158.92, TLS handshaking: Connection closed, session=<6atVN/VHWFSGelvE>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  9 19:52:20 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@nsteeleng.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<ZGmyQPVHYGWi8Jp9>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  9 19:54:41 host2 sshd[1853808]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.22.242.162
country_id: 1880251
description:
Jan  9 19:55:04 host2 pure-ftpd[1854204]: (?@165.22.242.162) [INFO] New connection from 165.22.242.162


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.157.80.73
country_id: 2077456
description:
2026-01-09 19:55:10 dovecot_login authenticator failed for H=([120.157.80.73]) [120.157.80.73]:45818: 535 Incorrect authentication data (set_id=bostonlanka)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.195.19.75
country_id: 1269750
description:
2026-01-09 19:54:32 dovecot_login authenticator failed for H=([47.247.80.227]) [14.195.19.75]:33554: 535 Incorrect authentication data (set_id=bostonlanka@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  9 19:55:51 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<TVxETfVH9K+i8Jp9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.222.54
country_id: 1269750
description:
2026-01-09 19:56:37 dovecot_login authenticator failed for H=(nsg-corporate-54.222.187.122.airtel.in) [122.187.222.54]:41984: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.220.90
country_id: 1269750
description:
2026-01-09 19:56:51 dovecot_login authenticator failed for H=(dsl-tn-dynamic-137.209.22.125.airtelbroadband.in) [128.185.220.90]:60254: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.148.165
country_id: 99237
description:
2026-01-09 20:01:15 dovecot_plain authenticator failed for H=(entoot) [65.20.148.165]:60611: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.58.62
country_id: 1269750
description:
2026-01-09 20:05:54 dovecot_login authenticator failed for H=([182.95.58.62]) [182.95.58.62]:51686: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 143.244.34.15
country_id: 6252001
description:
2026-01-09 20:06:08 dovecot_login authenticator failed for H=(ADMIN) [143.244.34.15]:1599: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.196.42.114
country_id: 2077456
description:
2026-01-09 20:06:23 dovecot_login authenticator failed for H=([203.196.42.114]) [203.196.42.114]:41956: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  9 20:09:09 host2 sshd[1866182]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.193.105
country_id: 6252001
description:
Jan  9 20:09:37 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=20.65.193.105, lip=66.85.158.91, session=<7a+cfvVHSL8UQcFp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.223.232.26
country_id: 3469034
description:
2026-01-09 20:11:26 dovecot_login authenticator failed for H=(187-40-1-41.user.veloxzone.com.br) [200.223.232.26]:53015: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.109.56.74
country_id: 6252001
description:
2026-01-09 20:11:43 dovecot_login authenticator failed for H=(dfw-206-109-56-74.ip4.99.network) [206.109.56.74]:40208: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  9 20:13:19 host2 sshd[1870021]: Disconnected from invalid user admin 2.57.121.112 port 35461 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.142.134
country_id: 1733045
description:
2026-01-09 20:13:54 dovecot_login authenticator failed for H=([49.124.142.134]) [49.124.142.134]:54234: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.146.166
country_id: 1269750
description:
2026-01-09 20:14:07 dovecot_login authenticator failed for H=([125.19.175.250]) [122.185.146.166]:43764: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Jan  9 20:14:51 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@lankaherbalsolutions.com>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<Sy04kfVH6LMvWfaQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.194.128.158
country_id: 1269750
description:
2026-01-09 20:16:59 dovecot_login authenticator failed for H=(static-158.128.194.14-tataidc.co.in) [14.194.128.158]:40950: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Jan  9 20:20:07 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<finance@sobaherbal.com>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<za0KpPVH+KsvWfaQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.213.237.28
country_id: 6252001
description:
2026-01-09 20:26:16 dovecot_plain authenticator failed for H=c-73-213-237-28.hsd1.va.comcast.net (odichidan) [73.213.237.28]:45414: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.122
country_id: 6252001
description:
Jan  9 20:30:51 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 16 secs): user=<>, rip=66.132.153.122, lip=66.85.158.92, TLS handshaking: Connection closed, session=<AqWXyvVHoLZChJl6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.129.252.239
country_id: 6252001
description:
2026-01-09 20:31:39 dovecot_login authenticator failed for H=(ADMIN) [102.129.252.239]:46561: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.113.10
country_id: 1269750
description:
2026-01-09 20:32:35 dovecot_login authenticator failed for H=([125.20.249.192]) [27.123.113.10]:44460: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.138
country_id: 6252001
description:
Jan  9 20:34:29 host2 pure-ftpd[1886737]: (?@205.210.31.138) [INFO] New connection from 205.210.31.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.209.30
country_id: 1269750
description:
2026-01-09 20:35:32 dovecot_login authenticator failed for H=([128.185.209.30]) [128.185.209.30]:60114: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  9 20:36:30 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@nsteeleng.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<g/Gv3vVHLuWi8Jp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  9 20:40:08 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<9E+e6/VHQumi8Jp9>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 1.52.36.172
country_id: 1562822
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 1.52.36.172 - lezzarot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarot (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.11.252.160
country_id: 3469034
description:
2026-01-09 20:39:26 dovecot_login authenticator failed for H=(187-11-252-160.dsl.telesp.net.br) [187.11.252.160]:52932: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.47.92.86
country_id: 1643084
description:
Jan  9 20:39:38 host2 sshd[1890797]: Disconnected from invalid user sandeep 38.47.92.86 port 43810 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.156.6.147
country_id: 3144096
description:
2026-01-09 20:40:05 dovecot_login authenticator failed for H=([78.156.6.147]) [78.156.6.147]:34383: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.38.215.165
country_id: 3175395
description:
Jan  9 20:41:31 host2 sshd[1892328]: Disconnected from invalid user subhadra 151.38.215.165 port 4080 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.106.196.150
country_id: 1880251
description:
2026-01-09 20:43:59 dovecot_login authenticator failed for H=(bb128-106-196-150.singnet.com.sg) [128.106.196.150]:19602: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.127.86
country_id: 1269750
description:
2026-01-09 20:44:26 dovecot_login authenticator failed for H=([27.123.119.191]) [122.184.127.86]:36536: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.47.92.86
country_id: 1643084
description:
Jan  9 20:45:17 host2 sshd[1895433]: Disconnected from invalid user bimal 38.47.92.86 port 50908 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 38.47.92.86
country_id: 1643084
description:
Jan  9 20:45:59 host2 sshd[1896201]: Disconnected from invalid user sivataben 38.47.92.86 port 49022 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.163
country_id: 2993457
description:
Jan  9 20:47:04 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=194.165.16.163, lip=66.85.158.92, session=<YhiTBPZHbf7CpRCj>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.47.92.86
country_id: 1643084
description:
Jan  9 20:47:58 host2 sshd[1898196]: Disconnected from invalid user rupali 38.47.92.86 port 42510 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-09 20:47:25 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (unburidne) [87.103.126.54]:58837: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.228.7.54
country_id: 2510769
description:
2026-01-09 20:47:29 dovecot_login authenticator failed for H=54.net-94.228.7.isbl.embou.net [94.228.7.54]:50094: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.8
country_id: 2186224
description:
2026-01-09 20:47:56 dovecot_login authenticator failed for H=([121.73.163.8]) [121.73.163.8]:47876: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Jan  9 20:49:03 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lankaherbalsolutions.com>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<U1GOC/ZHoJAvWfaQ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 152.32.251.174
country_id: 1819730
description:
Jan  9 20:49:06 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=152.32.251.174, lip=66.85.158.91, TLS, session=<HJnUC/ZHliiYIPuu>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.37.219
country_id: 798544
description:
2026-01-09 20:48:31 dovecot_login authenticator failed for H=89-67-37-219.dynamic.play.pl [89.67.37.219]:44481: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.55
country_id: 6252001
description:
Jan  9 20:48:37 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.55, lip=66.85.158.91, TLS handshaking: Connection closed, session=<ILIgCvZHNbpAPsU3>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.47
country_id: 6252001
description:
Jan  9 20:48:56 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.47, lip=66.85.158.91, TLS handshaking: Connection closed, session=<quQ4C/ZH6PVAPsUv>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 152.32.251.174
country_id: 1819730
description:
Jan  9 20:49:12 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed: read(size=679) failed: Connection reset by peer (no auth attempts in 3 secs): user=<>, rip=152.32.251.174, lip=66.85.158.91, TLS handshaking: read(size=679) failed: Connection reset by peer, session=<JfkzDPZHpiuYIPuu>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.47
country_id: 6252001
description:
Jan  9 20:49:11 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.197.47, lip=66.85.158.91, TLS: Connection closed, session=<EpYmDPZHeLFAPsUv>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.38.215.165
country_id: 3175395
description:
Jan  9 20:54:10 host2 sshd[1902966]: Disconnected from invalid user surjit 151.38.215.165 port 4159 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Jan  9 20:54:24 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sobaherbal.com>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<pWeyHvZHkNQvWfaQ>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 151.38.215.165
country_id: 3175395
description:
Jan  9 20:54:48 host2 sshd[1903702]: Disconnected from invalid user vasant 151.38.215.165 port 4657 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.38.215.165
country_id: 3175395
description:
Jan  9 20:56:11 host2 sshd[1905067]: Disconnected from invalid user jayamma 151.38.215.165 port 4116 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.161.96.107
country_id: 6252001
description:
2026-01-09 20:59:34 dovecot_plain authenticator failed for H=c-73-161-96-107.hsd1.mi.comcast.net (salanded) [73.161.96.107]:40488: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.204.134.124
country_id: 6252001
description:
2026-01-09 21:01:21 dovecot_plain authenticator failed for H=c-98-204-134-124.hsd1.md.comcast.net (butfughety) [98.204.134.124]:60694: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-09 21:04:27 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (sotering) [87.103.126.54]:44359: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 163.44.173.168
country_id: 1861060
description:
Jan  9 21:05:31 host2 sshd[1912939]: Disconnected from invalid user claude 163.44.173.168 port 43118 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2026-01-09 21:06:01 dovecot_login authenticator failed for H=([196.216.81.126]) [196.216.81.126]:56436: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 163.44.173.168
country_id: 1861060
description:
Jan  9 21:06:15 host2 sshd[1913542]: Disconnected from invalid user test1 163.44.173.168 port 53970 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.0.212.86
country_id: 3469034
description:
Jan  9 21:06:27 host2 sshd[1913666]: Disconnected from invalid user teamspeak 177.0.212.86 port 40343 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 84.247.137.65
country_id: 3017382
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 84.247.137.65 - cloudtourssrilan "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.0.212.86
country_id: 3469034
description:
Jan  9 21:07:48 host2 sshd[1914615]: Disconnected from invalid user admin1 177.0.212.86 port 38326 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.170.3.81
country_id: 3996063
description:
Jan  9 21:08:08 host2 sshd[1914895]: Disconnected from invalid user postgres 187.170.3.81 port 51922 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 177.0.212.86
country_id: 3469034
description:
Jan  9 21:08:26 host2 sshd[1915213]: Disconnected from invalid user postgres 177.0.212.86 port 41081 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.172.54.29
country_id: 6252001
description:
2026-01-09 21:08:42 dovecot_plain authenticator failed for H=c-67-172-54-29.hsd1.pa.comcast.net (fiereplary) [67.172.54.29]:58432: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.170.3.81
country_id: 3996063
description:
Jan  9 21:09:18 host2 sshd[1915873]: Disconnected from invalid user user 187.170.3.81 port 45836 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.170.3.81
country_id: 3996063
description:
Jan  9 21:10:31 host2 sshd[1917166]: Disconnected from invalid user claude 187.170.3.81 port 41828 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 187.170.3.81
country_id: 3996063
description:
Jan  9 21:11:32 host2 sshd[1917973]: Disconnected from invalid user teamspeak 187.170.3.81 port 35654 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 107.150.117.121
country_id: 2921044
description:
Jan  9 21:12:00 host2 pure-ftpd[1918335]: (?@107.150.117.121) [INFO] New connection from 107.150.117.121


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 107.150.117.121
country_id: 2921044
description:
Jan  9 21:12:19 host2 pure-ftpd[1918642]: (?@107.150.117.121) [INFO] New connection from 107.150.117.121


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 107.150.117.121
country_id: 2921044
description:
Jan  9 21:13:36 host2 pure-ftpd[1919917]: (?@107.150.117.121) [INFO] New connection from 107.150.117.121


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.217.144.65
country_id: 1643084
description:
Jan  9 21:13:54 host2 sshd[1920068]: Disconnected from invalid user claude 103.217.144.65 port 47566 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  9 21:21:38 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<support@nsteeleng.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<vg/xf/ZH0mSi8Jp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Jan  9 21:23:44 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lankaherbalsolutions.com>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<O3yVh/ZHoqUvWfaQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.64.18
country_id: 1269750
description:
2026-01-09 21:23:53 dovecot_login authenticator failed for H=([182.78.64.18]) [182.78.64.18]:34318: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.37.32.248
country_id: 1269750
description:
2026-01-09 21:25:04 dovecot_login authenticator failed for H=([136.232.73.130]) [49.37.32.248]:55500: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.196.92
country_id: 1819730
description:
2026-01-09 21:24:20 dovecot_login authenticator failed for H=(223-197-196-92.static.imsbiz.com) [223.197.196.92]:56072: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.247
country_id: 1269750
description:
2026-01-09 21:24:44 dovecot_login authenticator failed for H=(nsg-corporate-247.229.187.122.airtel.in) [122.187.229.247]:46474: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  9 21:25:56 host2 sshd[1928753]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  9 21:25:32 host2 sshd[1930053]: Disconnected from invalid user admin 2.57.121.112 port 52459 [preauth]


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 162.240.154.125
country_id: 6252001
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[162.240.154.125] [Remote Port]=[41140] [Authentication Database]=[mail] [Username]=[support@bostonlanka.com] (10/10 failures) (blocked until [Sat Jan 10 15:55:20 2026 UTC/Sat Jan 10 21:25:20 2026 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  9 21:25:22 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<9ghwjfZHtKCi8Jp9>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 47.89.246.144
country_id: 6252001
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[47.89.246.144] [Remote Port]=[60564] [Authentication Database]=[mail] [Username]=[support@sobaherbal.com] (10/10 failures) (blocked until [Sat Jan 10 15:59:00 2026 UTC/Sat Jan 10 21:29:00 2026 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Jan  9 21:29:02 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sobaherbal.com>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<2lCNmvZHlOwvWfaQ>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.133
country_id: 6252001
description:
Jan  9 21:29:04 host2 pure-ftpd[1932560]: (?@66.132.153.133) [INFO] New connection from 66.132.153.133


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.47.136.38
country_id: 3175395
description:
Jan  9 21:32:06 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=185.47.136.38, lip=66.85.158.91, TLS, session=<J4SApPZHoIS5L4gm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.148.8.172
country_id: 1269750
description:
Jan  9 21:32:29 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=103.148.8.172, lip=66.85.158.91, TLS, session=<AR2+pfZHZrZnlAis>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.45.132.96
country_id: 3175395
description:
2026-01-09 21:38:04 dovecot_login authenticator failed for H=([151.45.132.96]) [151.45.132.96]:42690: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.230.134
country_id: 1269750
description:
2026-01-09 21:38:21 dovecot_login authenticator failed for H=([182.95.230.134]) [182.95.230.134]:42556: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-09 21:38:22 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (pyloid) [87.103.126.54]:13493: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.161.93.53
country_id: 1269750
description:
2026-01-09 21:38:44 dovecot_login authenticator failed for H=([103.161.93.53]) [103.161.93.53]:41825: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.188.130
country_id: 3144096
description:
2026-01-09 21:39:44 dovecot_login authenticator failed for H=([84.213.188.130]) [84.213.188.130]:55686: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.249.241
country_id: 3865483
description:
Jan  9 21:41:45 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<info>, method=PLAIN, rip=179.0.249.241, lip=66.85.158.91, TLS, session=<lK3XxvZHRqKzAPnx>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.202.108.134
country_id: 798544
description:
Jan  9 21:41:53 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=85.202.108.134, lip=66.85.158.91, TLS, session=<EaScx/ZHOM9VymyG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 171.22.233.230
country_id: 3175395
description:
Jan  9 21:41:20 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@jrdc.lk>, method=PLAIN, rip=171.22.233.230, lip=66.85.158.91, TLS, session=<XWWuxfZHMsarFunm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 89.254.163.126
country_id: 458258
description:
Jan  9 21:41:20 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@jrdc.lk>, method=PLAIN, rip=89.254.163.126, lip=66.85.158.91, TLS, session=<F+euxfZHKJNZ/qN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.143.216
country_id: 99237
description:
Jan  9 21:41:40 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=65.20.143.216, lip=66.85.158.91, TLS, session=<KgbFxvZHtbxBFI/Y>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 181.192.106.243
country_id: 3469034
description:
Jan  9 21:41:32 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 23 secs): user=<info@jrdc.lk>, method=PLAIN, rip=181.192.106.243, lip=66.85.158.91, TLS, session=<YHwDxvZHRuK1wGrz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.0.10.98
country_id: 226074
description:
Jan  9 21:41:36 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 27 secs): user=<info@jrdc.lk>, method=PLAIN, rip=196.0.10.98, lip=66.85.158.91, TLS, session=<MoD+xfZHkIPEAApi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.61.252
country_id: 953987
description:
Jan  9 21:41:44 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<info>, method=PLAIN, rip=102.129.61.252, lip=66.85.158.91, TLS, session=<fFzKxvZHI6NmgT38>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.216.27.188
country_id: 798544
description:
Jan  9 21:41:51 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=178.216.27.188, lip=66.85.158.91, TLS, session=<DgZzx/ZHAe6y2Bu8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 128.127.94.77
country_id: 798544
description:
Jan  9 21:41:20 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@jrdc.lk>, method=PLAIN, rip=128.127.94.77, lip=66.85.158.91, TLS, session=<rpGuxfZHHM6Af15N>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.179.134.120
country_id: 1269750
description:
2026-01-09 21:42:22 dovecot_login authenticator failed for H=(abts-mum-static-120.134.179.122.airtelbroadband.in) [122.179.134.120]:58573: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.1.105.105
country_id: 1269750
description:
2026-01-09 21:42:44 dovecot_login authenticator failed for H=([61.1.105.105]) [61.1.105.105]:44791: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.129.13.184
country_id: 1880251
description:
2026-01-09 21:43:07 dovecot_login authenticator failed for H=(184.13.129.180.unknown.m1.com.sg) [180.129.13.184]:53723: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.84.162.177
country_id: 1861060
description:
2026-01-09 21:43:34 dovecot_login authenticator failed for H=177.162.84.34.bc.googleusercontent.com [34.84.162.177]:60634: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  9 21:44:21 host2 sshd[1944197]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Jan  9 21:57:11 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@lankaherbalsolutions.com>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<vksm//ZHeNkvWfaQ>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.76
country_id: 6252001
description:
Jan  9 21:57:54 host2 pure-ftpd[1955061]: (?@198.235.24.76) [INFO] New connection from 198.235.24.76


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  9 21:58:46 host2 sshd[1955705]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Jan  9 22:02:16 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sobaherbal.com>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<aX5jEfdHNsUvWfaQ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.249.192.30
country_id: 3625428
description:
Jan  9 22:02:18 host2 sshd[1958994]: Disconnected from invalid user laxman 201.249.192.30 port 54934 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.137.7.97
country_id: 6252001
description:
2026-01-09 22:02:49 dovecot_plain authenticator failed for H=c-73-137-7-97.hsd1.ga.comcast.net (hially) [73.137.7.97]:49556: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 201.249.192.30
country_id: 3625428
description:
Jan  9 22:02:57 host2 sshd[1959655]: Disconnected from invalid user rajiya 201.249.192.30 port 13164 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 35.187.114.229
country_id: 2802361
description:
Jan  9 22:04:40 host2 pure-ftpd[1963040]: (?@35.187.114.229) [INFO] New connection from 35.187.114.229


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.67.155.120
country_id: 298795
description:
Jan  9 22:07:02 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=45.67.155.120, lip=66.85.158.91, TLS, session=<UxpvIfdH2cctQ5t4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.97.251.202
country_id: 798544
description:
Jan  9 22:06:41 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=176.97.251.202, lip=66.85.158.91, TLS, session=<GTY+IPdHcoqwYfvK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  9 22:07:36 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@nsteeleng.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<OaxoJPdHSFCi8Jp9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.188.130
country_id: 3144096
description:
2026-01-09 22:08:04 dovecot_login authenticator failed for H=(cm-84.213.188.130.get.no) [84.213.188.130]:45511: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.73.190.46
country_id: 2542007
description:
2026-01-09 22:08:33 dovecot_login authenticator failed for H=([105.73.190.46]) [105.73.190.46]:33070: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 34.91.0.68
country_id: 2750405
description:
Jan  9 22:09:40 host2 sshd[1977822]: Disconnected from invalid user vpn 34.91.0.68 port 35390 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.186.186.168
country_id: 49518
description:
Jan  9 22:10:51 host2 sshd[1978969]: Disconnected from invalid user testuser 41.186.186.168 port 38052 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  9 22:10:16 host2 sshd[1978454]: Disconnected from invalid user admin 2.57.121.112 port 27957 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  9 22:11:18 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<tsqsMfdHuu6i8Jp9>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 196.0.120.211
country_id: 226074
description:
Jan  9 22:11:21 host2 sshd[1979356]: Disconnected from invalid user vpn 196.0.120.211 port 38210 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.147.37.185
country_id: 3996063
description:
Jan  9 22:13:25 host2 sshd[1981574]: Disconnected from invalid user user 189.147.37.185 port 51308 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 189.147.37.185
country_id: 3996063
description:
Jan  9 22:14:02 host2 sshd[1982203]: Disconnected from invalid user vpn 189.147.37.185 port 35586 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 41.186.186.168
country_id: 49518
description:
Jan  9 22:16:51 host2 sshd[1985132]: Disconnected from invalid user server 41.186.186.168 port 58144 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.22.242.162
country_id: 1880251
description:
Jan  9 22:16:57 host2 pure-ftpd[1985227]: (?@165.22.242.162) [INFO] New connection from 165.22.242.162


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 34.79.182.243
country_id: 2802361
description:
Jan  9 22:17:17 host2 pure-ftpd[1985520]: (?@34.79.182.243) [INFO] New connection from 34.79.182.243


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.128.128.212
country_id: 2077456
description:
2026-01-09 22:20:31 dovecot_login authenticator failed for H=(115-128-128-212.tpgi.com.au) [115.128.128.212]:59316: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.167
country_id: 2993457
description:
Jan  9 22:22:31 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=194.165.16.167, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<1U/uWfdHH//CpRCn>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.22.242.162
country_id: 1880251
description:
Jan  9 22:24:30 host2 pure-ftpd[1991085]: (?@165.22.242.162) [INFO] New connection from 165.22.242.162


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 18.97.26.39
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 18.97.26.39: 250 connections per 30 seconds to 2078 port.


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 54.163.33.187
country_id: 6252001
description:
Jan  9 22:26:01 host2 pure-ftpd[1992868]: (?@54.163.33.187) [INFO] New connection from 54.163.33.187


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.221.216.189
country_id: 2635167
description:
Jan  9 22:29:07 host2 sshd[1995029]: Disconnected from invalid user claude 185.221.216.189 port 54954 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.221.216.189
country_id: 2635167
description:
Jan  9 22:29:40 host2 sshd[1995518]: Disconnected from invalid user ftpuser 185.221.216.189 port 38450 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.221.216.189
country_id: 2635167
description:
Jan  9 22:30:36 host2 sshd[1996274]: Disconnected from invalid user server 185.221.216.189 port 33702 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.128.181.199
country_id: 357994
description:
Jan  9 22:32:33 host2 sshd[1997584]: Disconnected from invalid user user2 41.128.181.199 port 39830 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 41.128.181.199
country_id: 357994
description:
Jan  9 22:33:39 host2 sshd[1998298]: Disconnected from invalid user test 41.128.181.199 port 50608 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.64
country_id: 6252001
description:
Jan  9 22:34:46 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.64, lip=66.85.158.91, session=<pJK4hfdHt2BBMQFA>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.52
country_id: 6252001
description:
Jan  9 22:34:57 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.52, lip=66.85.158.91, TLS: Connection closed, session=<IjdnhvdHykhBMQE0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.128.181.199
country_id: 357994
description:
Jan  9 22:34:41 host2 sshd[1999266]: Disconnected from invalid user server 41.128.181.199 port 49390 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.137
country_id: 6252001
description:
Jan  9 22:34:46 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.137, lip=66.85.158.91, TLS handshaking: Connection closed, session=<Swa6hfdHlrBAPsWJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.137
country_id: 6252001
description:
Jan  9 22:35:13 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.197.137, lip=66.85.158.91, TLS: Connection closed, session=<i09fh/dH9k9APsWJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-09 22:36:07 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (subclus) [87.103.126.54]:16737: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.236.228.227
country_id: 6252001
description:
Jan  9 22:38:09 host2 dovecot[1180436]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=172.236.228.227, lip=66.85.158.92, session=<DSrYkfdHDG2s7OTj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.64.157.244
country_id: 2264397
description:
2026-01-09 22:38:08 dovecot_plain authenticator failed for H=bl23-157-244.dsl.telepac.pt (fulity) [144.64.157.244]:37618: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.168.252
country_id: 2186224
description:
2026-01-09 22:37:39 dovecot_login authenticator failed for H=([121.73.168.252]) [121.73.168.252]:53606: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.220.90
country_id: 1269750
description:
2026-01-09 22:38:05 dovecot_login authenticator failed for H=(dsl-tn-dynamic-137.209.22.125.airtelbroadband.in) [128.185.220.90]:34310: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.227.236.175
country_id: 1861060
description:
Jan  9 22:41:50 host2 sshd[2005705]: Disconnected from invalid user pwan 156.227.236.175 port 50810 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.186
country_id: 6252001
description:
Jan  9 22:42:29 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 17 secs): user=<>, rip=147.185.133.186, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<AXJYofdHOM2TuYW6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan  9 22:43:41 host2 sshd[2006869]: Disconnected from invalid user user 2.57.121.25 port 36771 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.185.161.145
country_id: 3469034
description:
2026-01-09 22:43:55 dovecot_login authenticator failed for H=(csbrasil.static.gvt.net.br) [179.185.161.145]:34725: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.76.55.177
country_id: 3175395
description:
2026-01-09 22:43:33 dovecot_login authenticator failed for H=([151.76.55.177]) [151.76.55.177]:40340: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.186
country_id: 6252001
description:
Jan  9 22:43:35 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 21 secs): user=<>, rip=147.185.133.186, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<jrNLpfdHnveTuYW6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.186
country_id: 6252001
description:
Jan  9 22:44:15 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed: read(size=429) failed: Connection reset by peer (no auth attempts in 16 secs): user=<>, rip=147.185.133.186, lip=66.85.158.92, TLS: read(size=429) failed: Connection reset by peer, session=<XoWhp/dHKuGTuYW6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.112.102
country_id: 1269750
description:
2026-01-09 22:44:39 dovecot_login authenticator failed for H=([182.95.112.102]) [182.95.112.102]:51202: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.210.151.158
country_id: 3144096
description:
2026-01-09 22:44:55 dovecot_login authenticator failed for H=([84.210.151.158]) [84.210.151.158]:58567: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.227.236.175
country_id: 1861060
description:
Jan  9 22:45:43 host2 sshd[2009164]: Disconnected from invalid user ainal 156.227.236.175 port 59602 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.190.155.43
country_id: 6252001
description:
2026-01-09 22:46:47 dovecot_plain authenticator failed for H=(undionta) [76.190.155.43]:37136: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 156.227.236.175
country_id: 1861060
description:
Jan  9 22:46:21 host2 sshd[2009651]: Disconnected from invalid user pawan 156.227.236.175 port 54294 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.227.236.175
country_id: 1861060
description:
Jan  9 22:49:30 host2 sshd[2012145]: Disconnected from invalid user nasim 156.227.236.175 port 60598 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.186
country_id: 6252001
description:
Jan  9 22:50:47 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=147.185.133.186, lip=66.85.158.92, TLS, session=<IgQBv/dHQOuTuYW6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.72.184.60
country_id: 6252001
description:
2026-01-09 22:52:01 dovecot_login authenticator failed for H=24-72-184-24-72-184-60.cpe.sparklight.net [24.72.184.60]:34638: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.186
country_id: 6252001
description:
Jan  9 22:51:27 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=147.185.133.186, lip=66.85.158.92, TLS, session=<STthwfdHfvOTuYW6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.60.142
country_id: 1269750
description:
2026-01-09 22:51:26 dovecot_login authenticator failed for H=(nsg-corporate-142.60.186.122.airtel.in) [122.186.60.142]:38574: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  9 22:52:44 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@nsteeleng.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<Ui/jxfdHXKei8Jp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.251.142
country_id: 3865483
description:
Jan  9 22:53:01 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=179.0.251.142, lip=66.85.158.91, TLS, session=<RH/GxfdHHJSzAPuO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.18.99.10
country_id: 1269750
description:
2026-01-09 22:52:23 dovecot_login authenticator failed for H=([125.18.136.89]) [125.18.99.10]:51838: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.238.106.159
country_id: 3865483
description:
Jan  9 22:53:22 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=45.238.106.159, lip=66.85.158.91, TLS, session=<DOAkx/dHpI4t7mqf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.10
country_id: 798549
description:
Jan  9 22:55:16 host2 dovecot[1180436]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=85.217.149.10, lip=66.85.158.91, session=<l7gLz/dHTp9V2ZUK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.11
country_id: 6252001
description:
Jan  9 22:55:43 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=195.184.76.11, lip=66.85.158.92, TLS handshaking: Connection closed, session=<LFeu0PdHK6DDuEwL>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.13
country_id: 6252001
description:
Jan  9 22:55:53 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=195.184.76.13, lip=66.85.158.92, TLS: Connection closed, session=<fQFJ0fdHf7fDuEwN>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.14
country_id: 6252001
description:
Jan  9 22:56:07 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=195.184.76.14, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<Meoa0vdHT7nDuEwO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.232
country_id: 6252001
description:
Jan  9 22:56:10 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=195.184.76.232, lip=66.85.158.92, TLS: Connection closed, session=<HeBJ0vdHSZDDuEzo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.40.101.10
country_id: 6252001
description:
2026-01-09 22:57:05 dovecot_plain authenticator failed for H=c-98-40-101-10.hsd1.tn.comcast.net (suppe) [98.40.101.10]:60470: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.156.6.147
country_id: 3144096
description:
2026-01-09 22:57:11 dovecot_login authenticator failed for H=([78.156.6.147]) [78.156.6.147]:48866: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  9 22:56:20 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<PwrB0vdHlDKi8Jp9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.245.75.93
country_id: 1880251
description:
2026-01-09 22:57:47 dovecot_login authenticator failed for H=([49.245.75.93]) [49.245.75.93]:46068: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 43.241.36.24
country_id: 1269750
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 43.241.36.24 - yashihol "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user yashihol (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.233
country_id: 6252001
description:
Jan  9 23:01:56 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=195.184.76.233, lip=66.85.158.92, TLS: Connection closed, session=<EEzm5vdHtZPDuEzp>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.13
country_id: 6252001
description:
Jan  9 23:02:11 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=195.184.76.13, lip=66.85.158.92, TLS: Connection closed, session=<yVLN5/dH36LDuEwN>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.8
country_id: 6252001
description:
Jan  9 23:01:46 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=195.184.76.8, lip=66.85.158.92, TLS handshaking: Connection closed, session=<8ztK5vdHJeTDuEwI>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.201.92
country_id: 1733045
description:
2026-01-09 23:07:04 dovecot_login authenticator failed for H=([49.125.201.92]) [49.125.201.92]:36616: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.177.9.119
country_id: 3865483
description:
2026-01-09 23:06:38 dovecot_login authenticator failed for H=(181-177-9-119.fiberway.com.ar) [181.177.9.119]:34802: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 138.204.127.54
country_id: 3469034
description:
Jan  9 23:09:21 host2 sshd[2029797]: Disconnected from invalid user test 138.204.127.54 port 46289 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.246.222.33
country_id: 732800
description:
Jan  9 23:11:05 host2 sshd[2031573]: Disconnected from invalid user postgres 185.246.222.33 port 54166 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.46.192.20
country_id: 2510769
description:
2026-01-09 23:11:28 dovecot_login authenticator failed for H=([193.46.192.20]) [193.46.192.20]:42395: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.246.222.33
country_id: 732800
description:
Jan  9 23:11:35 host2 sshd[2031906]: Disconnected from invalid user steam 185.246.222.33 port 59644 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.59
country_id: 1733045
description:
2026-01-09 23:11:53 dovecot_login authenticator failed for H=([49.124.151.59]) [49.124.151.59]:39326: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.138
country_id: 2635167
description:
Jan  9 23:11:54 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 14 secs): user=<>, rip=35.203.211.138, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<oVuICvhHZ8gjy9OK>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.246.222.33
country_id: 732800
description:
Jan  9 23:12:06 host2 sshd[2032296]: Disconnected from invalid user testuser 185.246.222.33 port 41148 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.58.18
country_id: 1269750
description:
2026-01-09 23:12:19 dovecot_login authenticator failed for H=([182.95.58.18]) [182.95.58.18]:54266: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.246.222.33
country_id: 732800
description:
Jan  9 23:12:36 host2 sshd[2032826]: Disconnected from invalid user vpn 185.246.222.33 port 38950 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.138
country_id: 2635167
description:
Jan  9 23:13:24 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 13 secs): user=<>, rip=35.203.211.138, lip=66.85.158.91, TLS: read(size=403) failed: Connection reset by peer, session=<YkvpD/hHwOwjy9OK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.152
country_id: 6252001
description:
Jan  9 23:15:32 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.152, lip=66.85.158.92, TLS handshaking: Connection closed, session=<9daLF/hH0H1BMQGY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.156
country_id: 6252001
description:
Jan  9 23:15:14 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.156, lip=66.85.158.92, TLS handshaking: Connection closed, session=<0TB7FvhHj+xBMQGc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.51.26.198
country_id: 1269750
description:
2026-01-09 23:17:43 dovecot_plain authenticator failed for H=(biveromens) [103.51.26.198]:47644: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.238.64
country_id: 6252001
description:
2026-01-09 23:18:39 dovecot_login authenticator failed for H=(ADMIN) [95.181.238.64]:18193: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.138
country_id: 2635167
description:
Jan  9 23:20:08 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.203.211.138, lip=66.85.158.91, TLS, session=<8H3+J/hHjvcjy9OK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  9 23:21:29 host2 sshd[2040446]: Disconnected from invalid user admin 2.57.121.112 port 16417 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.60.186
country_id: 1819730
description:
2026-01-09 23:26:29 dovecot_login authenticator failed for H=42-200-60-186.static.imsbiz.com [42.200.60.186]:64220: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.146.222
country_id: 3996063
description:
2026-01-09 23:27:04 dovecot_login authenticator failed for H=([177.236.146.222]) [177.236.146.222]:34300: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.207.4.58
country_id: 1269750
description:
Jan  9 23:27:50 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=103.207.4.58, lip=66.85.158.91, TLS, session=<tHdvQvhHY59nzwQ6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.28.190.207
country_id: 2510769
description:
Jan  9 23:28:08 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=139.28.190.207, lip=66.85.158.91, TLS, session=<+vCTQ/hH3rGLHL7P>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  9 23:32:57 host2 sshd[2051484]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.222
country_id: 1733045
description:
2026-01-09 23:32:41 dovecot_login authenticator failed for H=([49.124.152.222]) [49.124.152.222]:34054: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.204.134.124
country_id: 6252001
description:
2026-01-09 23:37:13 dovecot_plain authenticator failed for H=c-98-204-134-124.hsd1.md.comcast.net (distitic) [98.204.134.124]:46666: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  9 23:37:44 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@nsteeleng.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<OqvFZvhHWtei8Jp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  9 23:41:22 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@bostonlanka.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<H3TPc/hHspGi8Jp9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.194.231
country_id: 3144096
description:
2026-01-09 23:43:08 dovecot_login authenticator failed for H=([178.232.194.231]) [178.232.194.231]:59857: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.70.134
country_id: 1819730
description:
2026-01-09 23:44:03 dovecot_login authenticator failed for H=42-200-70-134.static.imsbiz.com [42.200.70.134]:39016: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.83.98
country_id: 1269750
description:
2026-01-09 23:43:46 dovecot_login authenticator failed for H=([182.71.132.193]) [182.79.83.98]:35920: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  9 23:47:18 host2 sshd[2065210]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-09 23:47:32 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (gatis) [87.103.126.54]:13900: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.159.14.187
country_id: 3469034
description:
2026-01-09 23:49:32 dovecot_login authenticator failed for H=(200-168-190-81.jandaia.com) [200.159.14.187]:35797: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 115.42.173.64
country_id: 1880251
description:
2026-01-09 23:49:44 H=([115.42.173.64]) [115.42.173.64]:55512 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<contact@bostonlanka.com> A=dovecot_login:contact@bostonlanka.com rejected RCPT <u1@frosttree.xyz>: Sender verify failed


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.187.146.90
country_id: 1643084
description:
Jan  9 23:55:13 host2 sshd[2073497]: Disconnected from invalid user teamspeak 103.187.146.90 port 60436 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.121.61.198
country_id: 3017382
description:
2026-01-09 23:55:38 dovecot_login authenticator failed for H=ip198.ip-91-121-61.eu (ADMIN) [91.121.61.198]:60454: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.187.146.90
country_id: 1643084
description:
Jan  9 23:55:55 host2 sshd[2074355]: Disconnected from invalid user admin 103.187.146.90 port 57884 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.27.83
country_id: 1643084
description:
2026-01-09 23:57:03 dovecot_login authenticator failed for H=(ip-arana.net.id.as132673) [103.90.27.83]:38580: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.210.151.158
country_id: 3144096
description:
2026-01-09 23:56:42 dovecot_login authenticator failed for H=([84.210.151.158]) [84.210.151.158]:34223: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.96
country_id: 6252001
description:
Jan 10 00:03:21 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.96, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<ooOPwvhHSdPG6xhg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.124
country_id: 1036973
description:
2026-01-10 00:13:06 dovecot_login authenticator failed for H=([196.28.226.124]) [196.28.226.124]:36627: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.21
country_id: 241170
description:
Jan 10 00:17:11 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.21, lip=66.85.158.91, session=<1s3b8/hHlqXE+2YV>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.28.86.1
country_id: 1819730
description:
2026-01-10 00:16:55 dovecot_login authenticator failed for H=(113-28-86-1.static.imsbiz.com) [113.28.86.1]:63843: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.142.135
country_id: 1733045
description:
2026-01-10 00:18:17 dovecot_login authenticator failed for H=([49.124.142.135]) [49.124.142.135]:44124: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.214.78
country_id: 1269750
description:
2026-01-10 00:18:33 dovecot_login authenticator failed for H=([125.20.249.39]) [128.185.214.78]:53246: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 4.210.91.174
country_id: 2963597
description:
Jan 10 00:18:37 host2 sshd[2097433]: Disconnected from invalid user deployerer 4.210.91.174 port 1024 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 198.23.160.197
country_id: 6252001
description:
Jan 10 00:19:28 host2 sshd[2098135]: Disconnected from invalid user vpn 198.23.160.197 port 39406 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 4.210.91.174
country_id: 2963597
description:
Jan 10 00:19:32 host2 sshd[2098161]: Disconnected from invalid user deployerer 4.210.91.174 port 1024 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 4.210.91.174
country_id: 2963597
description:
Jan 10 00:20:34 host2 sshd[2099365]: Disconnected from invalid user test1 4.210.91.174 port 1024 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 184.105.139.68
country_id: 6252001
description:
Jan 10 00:22:45 host2 pure-ftpd[2101550]: (?@184.105.139.68) [INFO] New connection from 184.105.139.68


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.111.118
country_id: 1269750
description:
2026-01-10 00:25:07 dovecot_login authenticator failed for H=([128.185.223.220]) [27.123.111.118]:57944: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 201.55.191.16
country_id: 3469034
description:
Jan 10 00:24:38 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=201.55.191.16, lip=66.85.158.91, TLS, session=<sLJ5DflHD7TJN78Q>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.231.114
country_id: 1269750
description:
2026-01-10 00:24:53 dovecot_login authenticator failed for H=([128.185.231.114]) [128.185.231.114]:43534: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.196.143.171
country_id: 3469034
description:
Jan 10 00:24:57 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=200.196.143.171, lip=66.85.158.91, TLS, session=<8Dm8DvlHJNfIxI+r>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.131
country_id: 6252001
description:
Jan 10 00:25:30 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=205.210.31.131, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<iG+7EflHRsLN0h+D>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.20
country_id: 241170
description:
Jan 10 00:27:29 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.20, lip=66.85.158.91, session=<l/CrGPlH1LjE+2YU>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.22.242.162
country_id: 1880251
description:
Jan 10 00:32:42 host2 pure-ftpd[2110289]: (?@165.22.242.162) [INFO] New connection from 165.22.242.162


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.124.139.77
country_id: 3144096
description:
2026-01-10 00:34:53 dovecot_login authenticator failed for H=([188.124.139.77]) [188.124.139.77]:38133: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.114
country_id: 1149361
description:
2026-01-10 00:35:13 dovecot_login authenticator failed for H=([149.54.62.114]) [149.54.62.114]:54874: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.142.154.108
country_id: 1819730
description:
Jan 10 00:36:01 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=45.142.154.108, lip=66.85.158.92, TLS, session=<70BaN/lH1qktjpps>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.142.154.108
country_id: 1819730
description:
Jan 10 00:36:14 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=45.142.154.108, lip=66.85.158.92, TLS handshaking: Connection closed, session=<OLAgOPlHbLYtjpps>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.22.242.162
country_id: 1880251
description:
Jan 10 00:39:44 host2 pure-ftpd[2116843]: (?@165.22.242.162) [INFO] New connection from 165.22.242.162


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.54.70.40
country_id: 3686110
description:
2026-01-10 00:40:55 dovecot_login authenticator failed for H=(static-ip-1815407040.cable.net.co) [181.54.70.40]:34578: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.59.154
country_id: 1269750
description:
2026-01-10 00:41:16 dovecot_login authenticator failed for H=([182.95.25.48]) [182.95.59.154]:43206: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.123.45.2
country_id: 1269750
description:
2026-01-10 00:41:34 dovecot_login authenticator failed for H=([103.123.45.2]) [103.123.45.2]:60602: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.181.79.60
country_id: 1819730
description:
2026-01-10 00:46:12 dovecot_login authenticator failed for H=([65.181.79.60]) [65.181.79.60]:50472: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 104.234.152.3
country_id: 3469034
description:
Denial of Service (DoS) attack was discovered from 104.234.152.3: 250 connections per 30 seconds to 443 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 104.234.152.1
country_id: 3469034
description:
Denial of Service (DoS) attack was discovered from 104.234.152.1: 250 connections per 30 seconds to 443 port.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.164.251.182
country_id: 6252001
description:
2026-01-10 00:46:31 dovecot_login authenticator failed for H=216-164-251-182.s9140.c3-0.eas-cbr4.atw-eas.pa.cable.rcncustomer.com [216.164.251.182]:44358: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.194
country_id: 1269750
description:
2026-01-10 00:48:57 dovecot_login authenticator failed for H=(nsg-corporate-194.229.187.122.airtel.in) [122.187.229.194]:43112: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.223.53.234
country_id: 3932488
description:
2026-01-10 00:49:06 dovecot_login authenticator failed for H=([190.223.53.234]) [190.223.53.234]:34238: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.89.136.203
country_id: 3469034
description:
Jan 10 00:48:21 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=190.89.136.203, lip=66.85.158.91, TLS, session=<bapVYvlHmsK+WYjL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.150.135.19
country_id: 690791
description:
2026-01-10 00:48:23 dovecot_login authenticator failed for H=([178.150.135.19]) [178.150.135.19]:28481: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.213
country_id: 1269750
description:
2026-01-10 00:48:37 dovecot_login authenticator failed for H=([122.187.230.213]) [122.187.230.213]:37271: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.72.111
country_id: 3469034
description:
Jan 10 00:48:43 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=187.120.72.111, lip=66.85.158.91, TLS, session=<cAijY/lHAtm7eEhv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.239.213.201
country_id: 3175395
description:
2026-01-10 00:48:50 dovecot_login authenticator failed for H=2-239-213-201.ip251.fastwebnet.it [2.239.213.201]:5681: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.237.47.214
country_id: 3996063
description:
2026-01-10 00:48:23 dovecot_login authenticator failed for H=(customer-187-237-47-214.uninet-ide.com.mx) [187.237.47.214]:36324: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.18
country_id: 6252001
description:
Jan 10 00:49:48 host2 dovecot[1180436]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=162.216.150.18, lip=66.85.158.92, session=<Wc6gaPlHLuSi2JYS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-10 00:52:08 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (desting) [87.103.126.54]:52376: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.27.83
country_id: 1643084
description:
2026-01-10 00:53:44 dovecot_login authenticator failed for H=(ip-arana.net.id.as132673) [103.90.27.83]:42894: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.132.40.41
country_id: 6252001
description:
2026-01-10 00:53:58 dovecot_login authenticator failed for H=([216.132.40.41]) [216.132.40.41]:37803: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.30.11.253
country_id: 6252001
description:
2026-01-10 00:55:35 dovecot_plain authenticator failed for H=(fiege) [23.30.11.253]:49227: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.235.225.181
country_id: 6252001
description:
2026-01-10 01:01:46 dovecot_plain authenticator failed for H=c-71-235-225-181.hsd1.ct.comcast.net (guffe) [71.235.225.181]:57078: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.55
country_id: 6252001
description:
Jan 10 01:04:37 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.55, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<r0WjnflHTMvG6xg3>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.139.67
country_id: 6252001
description:
Jan 10 01:05:09 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=184.105.139.67, lip=66.85.158.91, session=<kLyIn/lH6pS4aYtD>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.139.67
country_id: 6252001
description:
Jan 10 01:05:22 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=184.105.139.67, lip=66.85.158.91, TLS: Connection closed, session=<koxUoPlHWv+4aYtD>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.104.225.201
country_id: 6252001
description:
2026-01-10 01:09:43 dovecot_plain authenticator failed for H=(uncuset) [24.104.225.201]:39031: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.188.251
country_id: 290557
description:
2026-01-10 01:10:04 dovecot_plain authenticator failed for H=(heomi) [91.73.188.251]:57393: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.228.190.124
country_id: 3865483
description:
2026-01-10 01:11:13 dovecot_login authenticator failed for H=(45-228-190-124.obercom.net.ar) [45.228.190.124]:37338: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.187.205
country_id: 337996
description:
2026-01-10 01:11:41 dovecot_login authenticator failed for H=([196.188.187.205]) [196.188.187.205]:34076: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.211.94.35
country_id: 289688
description:
2026-01-10 01:15:37 dovecot_login authenticator failed for H=([37.211.94.35]) [37.211.94.35]:22753: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.105.218.147
country_id: 1694008
description:
2026-01-10 01:15:57 dovecot_login authenticator failed for H=([124.105.219.170]) [124.105.218.147]:40834: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 10 01:21:04 host2 sshd[2156263]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.118
country_id: 6252001
description:
Jan 10 01:23:38 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.235.24.118, lip=66.85.158.92, TLS, session=<rT2t4flHUunG6xh2>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.46.148.180
country_id: 6252001
description:
2026-01-10 01:29:42 dovecot_plain authenticator failed for H=c-68-46-148-180.hsd1.mi.comcast.net (gertemism) [68.46.148.180]:54438: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.215.74.195
country_id: 2661886
description:
2026-01-10 01:29:45 dovecot_plain authenticator failed for H=217-215-74-195-no2620.tbcn.telia.com (ungal) [217.215.74.195]:39128: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.63.50
country_id: 1269750
description:
2026-01-10 01:32:29 dovecot_login authenticator failed for H=([182.95.63.50]) [182.95.63.50]:36792: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.62.87.27
country_id: 3469034
description:
Jan 10 01:32:41 host2 sshd[2166119]: Disconnected from invalid user postgres 187.62.87.27 port 57646 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.112.6
country_id: 1269750
description:
2026-01-10 01:32:43 dovecot_login authenticator failed for H=(nsg-corporate-129.186.186.122.airtel.in) [27.123.112.6]:36204: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.62.87.27
country_id: 3469034
description:
Jan 10 01:33:38 host2 sshd[2166695]: Disconnected from invalid user user 187.62.87.27 port 37606 [preauth]


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 207.90.244.14
country_id: 6252001
description:
Jan 10 01:35:07 host2 dovecot[1180436]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=207.90.244.14, lip=66.85.158.92, session=<ZPe7CvpHpLvPWvQO>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 187.62.87.27
country_id: 3469034
description:
Jan 10 01:34:15 host2 sshd[2167067]: Disconnected from invalid user user 187.62.87.27 port 44000 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 10 01:35:17 host2 sshd[2167962]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 207.90.244.14
country_id: 6252001
description:
Jan 10 01:35:08 host2 dovecot[1180436]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=207.90.244.14, lip=66.85.158.92, session=<3wDJCvpHwLvPWvQO>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.10.252.119
country_id: 1643084
description:
Jan 10 01:36:44 host2 sshd[2168901]: Disconnected from invalid user server 157.10.252.119 port 42674 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 157.10.252.119
country_id: 1643084
description:
Jan 10 01:37:22 host2 sshd[2169432]: Disconnected from invalid user testuser 157.10.252.119 port 43326 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.88.10.10
country_id: 2328926
description:
2026-01-10 01:40:05 dovecot_plain authenticator failed for H=(obale) [102.88.10.10]:49616: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan 10 01:42:03 host2 sshd[2173494]: Disconnected from invalid user admin 2.57.121.112 port 35888 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.111.208.241
country_id: 1149361
description:
[2025-12-26 17:26:14 +0530] info [webmaild] 172.111.208.241 - hr@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.75.142.157
country_id: 3017382
description:
2026-01-10 01:49:55 dovecot_login authenticator failed for H=157.ip-51-75-142.eu [51.75.142.157]:50824: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.174
country_id: 1269750
description:
2026-01-10 01:50:07 dovecot_login authenticator failed for H=([182.95.178.174]) [182.95.178.174]:36002: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.246.106
country_id: 1269750
description:
2026-01-10 01:51:26 dovecot_login authenticator failed for H=([125.16.255.97]) [125.20.246.106]:41230: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.113.10
country_id: 1269750
description:
2026-01-10 01:51:52 dovecot_login authenticator failed for H=(abts-north-dynamic-121.212.66.182.airtelbroadband.in) [27.123.113.10]:57650: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.192.74.183
country_id: 6252001
description:
2026-01-10 01:52:57 dovecot_plain authenticator failed for H=c-98-192-74-183.hsd1.ga.comcast.net (vieverida) [98.192.74.183]:53084: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.142
country_id: 6252001
description:
Jan 10 01:54:56 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.142, lip=66.85.158.92, TLS: Connection closed, session=<xJ2aUfpHMsNAPpyO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 216.218.206.68
country_id: 6252001
description:
Jan 10 01:54:29 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=216.218.206.68, lip=66.85.158.92, session=<KA8BUPpHFFTY2s5E>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.149
country_id: 6252001
description:
Jan 10 01:54:45 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.149, lip=66.85.158.92, session=<LHbuUPpHOYxAPpyV>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.142
country_id: 6252001
description:
Jan 10 01:55:08 host2 dovecot[1180436]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=64.62.156.142, lip=66.85.158.92, session=<vJVSUvpHvqpAPpyO>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.196.9.133
country_id: 2635167
description:
Jan 10 02:00:48 host2 sshd[2189827]: Disconnected from invalid user ftpuser 185.196.9.133 port 56498 [preauth]


