# incident

plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.30.161.197
country_id: 690791
description:
2025-12-06 07:30:55 dovecot_login authenticator failed for (46.30.161.197.access.ipnet.ua) [46.30.161.197]:53351: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2025-12-06 07:31:13 dovecot_login authenticator failed for ([41.220.3.113]) [41.220.3.101]:28101: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Dec  6 07:31:48 host2 dovecot[2150]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, TLS handshaking: Connection closed, session=<1mnk8T5FAtcDg9cm>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 48.217.233.215
country_id: 6252001
description:
Dec  6 07:31:52 host2 pure-ftpd[924450]: (?@48.217.233.215) [INFO] New connection from 48.217.233.215


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Dec  6 07:32:08 host2 dovecot[2150]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<elQM8z5F2OsDg9cm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.173.58.47
country_id: 6252001
description:
2025-12-06 07:33:30 dovecot_plain authenticator failed for c-67-173-58-47.hsd1.il.comcast.net (dipoid) [67.173.58.47]:60466: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Dec  6 07:35:13 host2 dovecot[2150]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, TLS, session=<GHoZ/j5FUI4Dg9cm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.154.154
country_id: 1733045
description:
2025-12-06 07:35:41 dovecot_login authenticator failed for ([49.124.154.154]) [49.124.154.154]:50510: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.160.206
country_id: 1269750
description:
2025-12-06 07:35:58 dovecot_login authenticator failed for ([128.185.23.89]) [125.19.160.206]:53448: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Dec  6 07:38:09 host2 dovecot[2150]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, TLS handshaking: Connection closed, session=<q82PCD9FdLUDg9cm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.58
country_id: 1149361
description:
2025-12-06 07:39:10 dovecot_login authenticator failed for ([149.54.62.58]) [149.54.62.58]:34350: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Dec  6 07:39:20 host2 dovecot[2150]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, TLS handshaking: Connection closed, session=<v0XMDD9FbugDg9cm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.231.25.64
country_id: 3686110
description:
2025-12-06 07:39:45 dovecot_login authenticator failed for (1522312565.colombiatel.co) [152.231.25.64]:48348: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.249.152
country_id: 3469034
description:
Dec  6 07:40:25 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=186.209.249.152, lip=66.85.158.91, TLS, session=<Z5OQDz9FrLG60fmY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Dec  6 07:40:36 host2 dovecot[2150]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<dIxfET9F8O0Dg9cm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.17.125.163
country_id: 690791
description:
Dec  6 07:40:43 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=185.17.125.163, lip=66.85.158.91, TLS, session=<wabDED9Ftoi5EX2j>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 103.59.135.243
country_id: 1269750
description:
Dec  6 07:40:05 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (no auth attempts in 9 secs): user=<>, rip=103.59.135.243, lip=66.85.158.91, session=<r3KFDz9FVMFnO4fz>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Dec  6 07:41:16 host2 dovecot[2150]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<SkfBEz9F3OQDg9cm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.91.103.202
country_id: 6252001
description:
2025-12-06 07:41:35 dovecot_plain authenticator failed for c-24-91-103-202.hsd1.ma.comcast.net (dilline) [24.91.103.202]:50592: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.4
country_id: 99237
description:
2025-12-06 07:41:42 dovecot_plain authenticator failed for (heraneher) [65.20.133.4]:46150: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Dec  6 07:42:17 host2 dovecot[2150]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, TLS, session=<FNNcFz9F1LUDg9cm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Dec  6 07:42:54 host2 dovecot[2150]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, TLS, session=<cQOYGT9FNNEDg9cm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.208.81.125
country_id: 6252001
description:
2025-12-06 08:01:44 dovecot_plain authenticator failed for c-73-208-81-125.hsd1.in.comcast.net (postosib) [73.208.81.125]:42026: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.102.242
country_id: 290557
description:
2025-12-06 08:04:52 dovecot_plain authenticator failed for (inflotan) [80.227.102.242]:40406: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  6 08:05:48 host2 sshd[951699]: Disconnected from invalid user user 2.57.121.25 port 40938 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.239.183.180
country_id: 1694008
description:
2025-12-06 08:16:03 dovecot_plain authenticator failed for (R27PCKV70FQ2DWX) [136.239.183.180]:12920: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.90.213.28
country_id: 6252001
description:
2025-12-06 08:17:42 dovecot_plain authenticator failed for ool-4a5ad51c.dyn.optonline.net (begereed) [74.90.213.28]:57462: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.195.117.220
country_id: 3017382
description:
2025-12-06 08:20:05 dovecot_plain authenticator failed for vps-f9a28e39.vps.ovh.net (heaengly) [51.195.117.220]:54543: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.207.59.6
country_id: 6251999
description:
[2025-12-06 08:21:34 +0530] info [cpaneld] 104.207.59.6 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 207.200.180.174
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [webmaild] 207.200.180.174 - info@askinternationalconsortium.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.0.107.234
country_id: 226074
description:
Dec  6 08:25:46 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@jrdc.lk>, method=PLAIN, rip=196.0.107.234, lip=66.85.158.91, TLS, session=<HIuxsT9FNb/EAGvq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 31.222.12.1
country_id: 798544
description:
Dec  6 08:26:03 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=31.222.12.1, lip=66.85.158.91, TLS, session=<OYTosj9FiLsf3gwB>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec  6 08:29:28 host2 dovecot[2150]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (disconnected before auth was ready, waited 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<9XIZwD9FsqoDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec  6 08:31:16 host2 dovecot[2150]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<fJGQxj9FuJUDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec  6 08:32:10 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, TLS handshaking: Connection closed, session=<liXGyT9FprkDlTsa>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec  6 08:33:28 host2 sshd[968315]: Disconnected from invalid user admin 2.57.121.112 port 7624 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-06 08:34:46 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:62710: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec  6 08:33:59 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, TLS, session=<z6s90D9FRtoDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec  6 08:35:57 host2 dovecot[2150]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<87JP1z9FItIDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.213.24
country_id: 6251999
description:
Dec  6 08:36:07 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=148.113.213.24, lip=66.85.158.91, session=<Q63o1z9F49iUcdUY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec  6 08:37:16 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, TLS handshaking: Connection closed, session=<CgID3D9FEsIDlTsa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.36
country_id: 1269750
description:
2025-12-06 08:38:36 dovecot_login authenticator failed for (nsg-corporate-36.229.187.122.airtel.in) [122.187.229.36]:36189: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.202.15.69
country_id: 6252001
description:
2025-12-06 08:38:56 dovecot_login authenticator failed for ([12.202.15.69]) [12.202.15.69]:35875: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.147.45
country_id: 99237
description:
2025-12-06 08:43:52 dovecot_plain authenticator failed for (stard) [65.20.147.45]:54935: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.166
country_id: 6252001
description:
Dec  6 08:46:42 host2 dovecot[2150]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=198.235.24.166, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<raa2/T9FA9vG6xim>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  6 08:51:44 host2 dovecot[2150]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<j2CUD0BFcOAXXz9j>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.25.186.130
country_id: 6252001
description:
2025-12-06 08:55:59 dovecot_login authenticator failed for (173-25-186-130.client.mchsi.com) [173.25.186.130]:51715: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.147.94
country_id: 290557
description:
2025-12-06 08:56:36 dovecot_login authenticator failed for ([80.227.147.94]) [80.227.147.94]:57076: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.195.117.220
country_id: 3017382
description:
2025-12-06 08:58:07 dovecot_plain authenticator failed for vps-f9a28e39.vps.ovh.net (unlies) [51.195.117.220]:44070: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2025-12-06 08:58:20 dovecot_plain authenticator failed for host-196-47-172-253.afnet.net (whans) [196.47.172.253]:42348: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.66.0.46
country_id: 953987
description:
Dec  6 08:59:30 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=102.66.0.46, lip=66.85.158.91, TLS, session=<3wRTKkBFadxmQgAu>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.106.154.2
country_id: 1269750
description:
Dec  6 08:59:08 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<info@systemtec.lk>, method=PLAIN, rip=103.106.154.2, lip=66.85.158.91, TLS, session=<LebjKEBFda9napoC>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec  6 09:04:05 host2 dovecot[2150]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<tOLhO0BFVIMDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec  6 09:06:33 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS handshaking: Connection closed, session=<vm64REBFiJ0DgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec  6 09:06:58 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS handshaking: Connection closed, session=<0089RkBFOLwDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec  6 09:08:36 host2 dovecot[2150]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS, session=<fuEKTEBFxuEDgmBb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  6 09:08:37 host2 dovecot[2150]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@agronatureholdings.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<ehgBTEBFBsUXXz9j>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.166.153.20
country_id: 6252001
description:
2025-12-06 09:11:52 dovecot_plain authenticator failed for c-174-166-153-20.hsd1.nj.comcast.net (almonae) [174.166.153.20]:46336: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec  6 09:11:52 host2 dovecot[2150]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<CDu9V0BF+LUDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec  6 09:12:01 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS handshaking: Connection closed, session=<7XZEWEBF7LUDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 18.97.19.188
country_id: 6252001
description:
Dec  6 09:12:25 host2 dovecot[2150]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=18.97.19.188, lip=66.85.158.91, TLS handshaking: Connection closed, session=<MPm5WUBFCJ4SYRO8>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.195.117.220
country_id: 3017382
description:
2025-12-06 09:24:00 dovecot_plain authenticator failed for vps-f9a28e39.vps.ovh.net (ouncetthly) [51.195.117.220]:45851: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.61.199.212
country_id: 6252001
description:
2025-12-06 09:37:35 dovecot_plain authenticator failed for c-24-61-199-212.hsd1.ct.comcast.net (sphemider) [24.61.199.212]:39876: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2025-12-06 09:38:52 dovecot_login authenticator failed for c-71-62-34-216.hsd1.va.comcast.net [71.62.34.216]:48914: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.225.19.144
country_id: 2661886
description:
2025-12-06 09:41:27 dovecot_plain authenticator failed for c-85-225-19-144.bbcust.telenor.se (bollaring) [85.225.19.144]:58850: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.54.36.65
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 104.54.36.65 - colourmarklabels "GET /login/?login_only=1&user=colourmarklabels&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.248.156
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 172.56.248.156 - colourmarkl "GET /login/?login_only=1&user=colourmarkl&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user colourmarkl (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.220.179.185
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 104.220.179.185 - colourmarklab "GET /login/?login_only=1&user=colourmarklab&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user colourmarklab (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.57.101.195
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 70.57.101.195 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.149.200.137
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.149.200.137 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.254.203.67
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 71.254.203.67 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.21.233.196
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 108.21.233.196 - colourmarklabelscom "GET /login/?login_only=1&user=colourmarklabelscom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user colourmarklabelscom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.206.6.152
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 97.206.6.152 - colourmarklabel "GET /login/?login_only=1&user=colourmarklabel&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user colourmarklabel (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.88.124.208
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 172.88.124.208 - colourmarklabe "GET /login/?login_only=1&user=colourmarklabe&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user colourmarklabe (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.50.119.134
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 45.50.119.134 - colourmarkla "GET /login/?login_only=1&user=colourmarkla&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user colourmarkla (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.56.34.212
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 98.56.34.212 - colourmark "GET /login/?login_only=1&user=colourmark&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user colourmark (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.104.60.242
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 69.104.60.242 - colourma "GET /login/?login_only=1&user=colourma&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user colourma (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.113.199.236
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 98.113.199.236 - col "GET /login/?login_only=1&user=col&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user col (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.178.135.170
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 97.178.135.170 - co "GET /login/?login_only=1&user=co&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user co (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.114.221.239
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 99.114.221.239 - colourm1 "GET /login/?login_only=1&user=colourm1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user colourm1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.33.151.19
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.33.151.19 - colourm2 "GET /login/?login_only=1&user=colourm2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user colourm2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.12.51.136
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 24.12.51.136 - colourmar "GET /login/?login_only=1&user=colourmar&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user colourmar (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 184.182.46.150
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 184.182.46.150 - colourm "GET /login/?login_only=1&user=colourm&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user colourm (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.86.224.67
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 108.86.224.67 - colour "GET /login/?login_only=1&user=colour&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user colour (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.12.160.125
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.12.160.125 - colou "GET /login/?login_only=1&user=colou&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user colou (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.32.199.5
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.32.199.5 - colo "GET /login/?login_only=1&user=colo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user colo (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.195.117.220
country_id: 3017382
description:
2025-12-06 09:45:28 dovecot_plain authenticator failed for vps-f9a28e39.vps.ovh.net (baralm) [51.195.117.220]:61417: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.216.27.95
country_id: 798544
description:
Dec  6 09:45:59 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=178.216.27.95, lip=66.85.158.91, TLS, session=<256u0EBFy7my2Btf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.46.181
country_id: 953987
description:
Dec  6 09:46:24 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<587hr>, method=PLAIN, rip=102.64.46.181, lip=66.85.158.91, TLS, session=<sKH40UBFkrBmQC61>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.183.74.177
country_id: 6252001
description:
2025-12-06 09:48:25 dovecot_plain authenticator failed for c-73-183-74-177.hsd1.pa.comcast.net (stouton) [73.183.74.177]:39758: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 45.144.136.212
country_id: 1819730
description:
Dec  6 10:01:05 host2 pure-ftpd[1025542]: (?@45.144.136.212) [INFO] New connection from 45.144.136.212


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  6 10:02:53 host2 dovecot[2150]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@bostonlanka.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<HzcVDkFFRuEXXz9j>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-06 10:03:23 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (coramets) [87.103.126.54]:63559: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.51
country_id: 6252001
description:
Dec  6 10:06:30 host2 dovecot[2150]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=147.185.132.51, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=</DwlG0FFXsiTuYQz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.11.251.39
country_id: 3469034
description:
Dec  6 10:12:35 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=177.11.251.39, lip=66.85.158.91, TLS, session=<ZEPAL0FFRO6xC/sn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.26.179.186
country_id: 3175395
description:
Dec  6 10:12:52 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=217.26.179.186, lip=66.85.158.91, TLS, session=<q+fwMEFFYdvZGrO6>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  6 10:15:01 host2 sshd[1034094]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.147.94
country_id: 290557
description:
2025-12-06 10:18:40 dovecot_login authenticator failed for ([80.227.147.94]) [80.227.147.94]:38739: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2025-12-06 10:19:16 dovecot_login authenticator failed for (host-64-72-74-162.lightower.net) [64.72.74.162]:35165: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.160.166.237
country_id: 1820814
description:
2025-12-06 10:19:31 dovecot_login authenticator failed for (237-166.adsl.static.espeed.com.bn) [119.160.166.237]:45602: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.0.156.128
country_id: 3017382
description:
2025-12-06 10:22:22 dovecot_plain authenticator failed for amontpellier-655-1-340-128.w90-0.abo.wanadoo.fr (rocal) [90.0.156.128]:32954: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.63
country_id: 6252001
description:
Dec  6 10:22:39 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=167.94.146.63, lip=66.85.158.91, TLS: Connection closed, session=<IbvjVEFF+KSnXpI/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.195.117.220
country_id: 3017382
description:
2025-12-06 10:28:28 dovecot_plain authenticator failed for vps-f9a28e39.vps.ovh.net (hyglousin) [51.195.117.220]:22980: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2025-12-06 10:28:09 dovecot_plain authenticator failed for (chydrot) [64.72.74.162]:38769: 535 Incorrect authentication data (set_id=sysnytech@sysnytech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 117.241.73.194
country_id: 1269750
description:
[2025-12-06 10:28:19 +0530] info [webmaild] 117.241.73.194 - info@agentallianz.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: User info@agentallianz.com has their account suspended. Login blocked.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.0.235.30
country_id: 6252001
description:
2025-12-06 10:31:09 dovecot_plain authenticator failed for c-73-0-235-30.hsd1.fl.comcast.net (hetioeye) [73.0.235.30]:59836: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.194.98
country_id: 6252001
description:
2025-12-06 10:37:50 dovecot_plain authenticator failed for c-73-197-194-98.hsd1.nj.comcast.net (swasity) [73.197.194.98]:49692: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.15
country_id: 6252001
description:
Dec  6 10:44:28 host2 dovecot[2150]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 3 secs): user=<>, rip=147.185.132.15, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<KAbiokFFytSTuYQP>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.90
country_id: 6252001
description:
Dec  6 10:45:48 host2 dovecot[2150]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 10 secs): user=<>, rip=162.216.149.90, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<Kn+rp0FF7c+i2JVa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.37.181.181
country_id: 1831722
description:
2025-12-06 10:46:13 dovecot_login authenticator failed for ([36.37.181.181]) [36.37.181.181]:46842: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.93.84
country_id: 1269750
description:
2025-12-06 10:46:47 dovecot_login authenticator failed for ([152.52.93.82]) [152.52.93.84]:10400: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.90
country_id: 6252001
description:
Dec  6 10:47:35 host2 dovecot[2150]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 2 secs): user=<>, rip=162.216.149.90, lip=66.85.158.91, TLS: read(size=403) failed: Connection reset by peer, session=<hAMNrkFF/vGi2JVa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.129.28
country_id: 99237
description:
2025-12-06 10:51:51 dovecot_plain authenticator failed for (foracon) [65.20.129.28]:47219: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.195.117.220
country_id: 3017382
description:
2025-12-06 10:51:59 dovecot_plain authenticator failed for vps-f9a28e39.vps.ovh.net (miperus) [51.195.117.220]:54256: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.40.189.43
country_id: 6252001
description:
2025-12-06 10:52:11 dovecot_plain authenticator failed for c-68-40-189-43.hsd1.mi.comcast.net (agundevive) [68.40.189.43]:37514: 535 Incorrect authentication data (set_id=sysnytech@sysnytech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.90
country_id: 6252001
description:
Dec  6 10:53:17 host2 dovecot[2150]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.149.90, lip=66.85.158.91, TLS, session=<CVBrwkFFvPGi2JVa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-06 10:53:32 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (ading) [87.103.126.54]:26683: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.64.244.72
country_id: 690791
description:
Dec  6 11:00:33 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<accounts2@lezzarotech.com>, method=PLAIN, rip=195.64.244.72, lip=66.85.158.91, TLS, session=<yEdp20FFFpHDQPRI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.216.25.37
country_id: 798544
description:
Dec  6 11:00:33 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@jrdc.lk>, method=PLAIN, rip=178.216.25.37, lip=66.85.158.91, TLS, session=<htFt20FFH6Sy2Bkl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.246.210.13
country_id: 798544
description:
Dec  6 11:00:51 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=91.246.210.13, lip=66.85.158.91, TLS, session=<YyaH3EFF6Yxb9tIN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.181.87.209
country_id: 3865483
description:
Dec  6 11:00:53 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<accounts2>, method=PLAIN, rip=190.181.87.209, lip=66.85.158.91, TLS, session=<zUiV3EFFBui+tVfR>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.106.134
country_id: 3469034
description:
Dec  6 11:01:38 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=187.120.106.134, lip=66.85.158.91, TLS, session=<F/Yq30FF0Oi7eGqG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.211.21.36
country_id: 2300660
description:
Dec  6 11:01:59 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<accounts>, method=PLAIN, rip=41.211.21.36, lip=66.85.158.91, TLS, session=<m2xu4EFFYeop0xUk>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.167
country_id: 2993457
description:
Dec  6 11:05:08 host2 dovecot[2150]: imap-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=194.165.16.167, lip=66.85.158.91, session=<tdLR7EFFDf/CpRCn>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.230.228.16
country_id: 6252001
description:
2025-12-06 11:05:41 dovecot_plain authenticator failed for c-71-230-228-16.hsd1.de.comcast.net (paned) [71.230.228.16]:48568: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 95.0.171.75
country_id: 298795
description:
Dec  6 11:06:44 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=95.0.171.75, lip=66.85.158.91, TLS, session=<eWSL8UFFbYhfAKtL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.250.127
country_id: 3469034
description:
Dec  6 11:06:26 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@systemtec.lk>, method=PLAIN, rip=186.209.250.127, lip=66.85.158.91, TLS, session=<Qn9j8EFFJKi60fp/>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  6 11:16:29 host2 sshd[1074327]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  6 11:21:10 host2 sshd[1077144]: Disconnected from invalid user user 2.57.121.25 port 26482 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.221.130
country_id: 1269750
description:
2025-12-06 11:23:35 dovecot_plain authenticator failed for (utogyn) [122.187.221.130]:55500: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.168.136.150
country_id: 6252001
description:
2025-12-06 11:25:37 dovecot_plain authenticator failed for c-73-168-136-150.hsd1.il.comcast.net (ingsing) [73.168.136.150]:45776: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-06 11:25:41 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (guagentia) [87.103.126.54]:26493: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.136
country_id: 2635167
description:
Dec  6 11:26:15 host2 dovecot[2150]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 14 secs): user=<>, rip=35.203.210.136, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<v3dQOEJF0dwjy9KI>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.215
country_id: 6252001
description:
Dec  6 11:26:10 host2 pure-ftpd[1079902]: (?@198.235.24.215) [INFO] New connection from 198.235.24.215


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.136
country_id: 2635167
description:
Dec  6 11:27:29 host2 dovecot[2150]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 8 secs): user=<>, rip=35.203.210.136, lip=66.85.158.92, TLS: read(size=403) failed: Connection reset by peer, session=</JW6PEJF1Pcjy9KI>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 149.30.139.241
country_id: 1694008
description:
[2025-12-06 11:29:08 +0530] info [cpaneld] 149.30.139.241 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2025-12-06 11:32:01 dovecot_plain authenticator failed for (feeries) [102.53.15.18]:37169: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 170.9.236.245
country_id: 6252001
description:
Dec  6 11:33:39 host2 sshd[1085700]: error: maximum authentication attempts exceeded for root from 170.9.236.245 port 58326 ssh2 [preauth]


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 170.9.236.245
country_id: 6252001
description:
Dec  6 11:33:39 host2 sshd[1085700]: Disconnecting authenticating user root 170.9.236.245 port 58326: Too many authentication failures [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 170.9.236.245
country_id: 6252001
description:
Dec  6 11:33:44 host2 sshd[1085759]: Disconnecting invalid user admin 170.9.236.245 port 58370: Too many authentication failures [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.93.140.162
country_id: 6252001
description:
2025-12-06 11:34:08 dovecot_plain authenticator failed for (perlisse) [24.93.140.162]:57351: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.239.157.41
country_id: 357994
description:
2025-12-06 11:34:12 dovecot_plain authenticator failed for (symbentive) [41.239.157.41]:41646: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.136
country_id: 2635167
description:
Dec  6 11:34:39 host2 dovecot[2150]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.203.210.136, lip=66.85.158.92, TLS, session=<HwJjVkJFtOcjy9KI>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 87.236.176.156
country_id: 2635167
description:
Dec  6 11:36:53 host2 pure-ftpd[1089247]: (?@87.236.176.156) [INFO] New connection from 87.236.176.156


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.137.7.97
country_id: 6252001
description:
2025-12-06 11:49:19 dovecot_plain authenticator failed for c-73-137-7-97.hsd1.ga.comcast.net (gayerds) [73.137.7.97]:54776: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.183.74.177
country_id: 6252001
description:
2025-12-06 11:49:23 dovecot_plain authenticator failed for c-73-183-74-177.hsd1.pa.comcast.net (vides) [73.183.74.177]:40766: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.221.28
country_id: 6251999
description:
Dec  6 11:51:09 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=148.113.221.28, lip=66.85.158.91, TLS: Connection closed, session=<2gRbkUJFebKUcd0c>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.216.105
country_id: 6251999
description:
Dec  6 11:54:44 host2 dovecot[2150]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=148.113.216.105, lip=66.85.158.91, TLS: Connection closed, session=<V88wnkJFJuWUcdhp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.63.1.48
country_id: 2215636
description:
Dec  6 11:55:41 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=5.63.1.48, lip=66.85.158.91, TLS, session=<wZaPoEJFT7UFPwEw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.50.10
country_id: 953987
description:
Dec  6 11:56:02 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=102.129.50.10, lip=66.85.158.91, TLS, session=<V5q8oUJF8M9mgTIK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.82.141.145
country_id: 6252001
description:
2025-12-06 11:58:40 dovecot_plain authenticator failed for c-68-82-141-145.hsd1.pa.comcast.net (arreae) [68.82.141.145]:33232: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.212.178
country_id: 732800
description:
2025-12-06 12:00:29 dovecot_login authenticator failed for ([185.255.212.178]) [185.255.212.178]:42016: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.97.253.246
country_id: 6252001
description:
2025-12-06 12:00:36 dovecot_login authenticator failed for syn-024-097-253-246.biz.spectrum.com [24.97.253.246]:51192: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.228
country_id: 1269750
description:
2025-12-06 12:00:42 dovecot_login authenticator failed for (nsg-corporate-228.228.187.122.airtel.in) [122.187.228.228]:36967: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.243.166.66
country_id: 3686110
description:
2025-12-06 12:01:15 dovecot_login authenticator failed for ([8.243.166.66]) [8.243.166.66]:4501: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.97.155.25
country_id: 6252001
description:
2025-12-06 12:06:46 dovecot_plain authenticator failed for c-76-97-155-25.hsd1.ga.comcast.net (elestip) [76.97.155.25]:55846: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.197
country_id: 6252001
description:
Dec  6 12:06:44 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=205.210.31.197, lip=66.85.158.91, session=<3rMXyUJFmO7N0h/F>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  6 12:08:52 host2 dovecot[2150]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@bostonlanka.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<oGyk0EJFCpAXXz9j>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  6 12:09:27 host2 sshd[1115610]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.117.199.59
country_id: 433561
description:
2025-12-06 12:09:06 dovecot_login authenticator failed for ([154.117.199.59]) [154.117.199.59]:46868: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.184.162
country_id: 3144096
description:
2025-12-06 12:09:19 dovecot_login authenticator failed for (cm-178.232.184.162.get.no) [178.232.184.162]:55643: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.0.235.30
country_id: 6252001
description:
2025-12-06 12:14:08 dovecot_plain authenticator failed for c-73-0-235-30.hsd1.fl.comcast.net (cator) [73.0.235.30]:37746: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-06 12:16:45 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:64319: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.22.218
country_id: 290557
description:
2025-12-06 12:18:19 dovecot_plain authenticator failed for (unsaistif) [5.32.22.218]:60443: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.177.30.53
country_id: 6252001
description:
2025-12-06 12:20:23 dovecot_plain authenticator failed for c-66-177-30-53.hsd1.fl.comcast.net (prenopomis) [66.177.30.53]:50834: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-06 12:21:50 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (sphor) [87.103.126.54]:38290: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.22.218
country_id: 290557
description:
2025-12-06 12:23:35 dovecot_plain authenticator failed for (surent) [5.32.22.218]:60735: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  6 12:36:09 host2 sshd[1135270]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  6 12:36:25 host2 sshd[1135498]: Disconnected from invalid user user 2.57.121.25 port 8322 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.160
country_id: 2635167
description:
Dec  6 12:36:40 host2 dovecot[2150]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=185.247.137.160, lip=66.85.158.91, TLS handshaking: Connection closed, session=<2mcsNENFda2594mg>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.115
country_id: 2635167
description:
Dec  6 12:36:06 host2 dovecot[2150]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=185.247.137.115, lip=66.85.158.91, TLS, session=<DhceMkNFEcK594lz>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.151
country_id: 2635167
description:
Dec  6 12:36:07 host2 dovecot[2150]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.151, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<ZjExMkNFl6m594mX>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.173
country_id: 2635167
description:
Dec  6 12:37:13 host2 dovecot[2150]: pop3-login: Disconnected: Connection closed: read(size=679) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.173, lip=66.85.158.91, TLS handshaking: read(size=679) failed: Connection reset by peer, session=<P98nNkNF8aFX7LCt>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.152
country_id: 2635167
description:
Dec  6 12:37:47 host2 dovecot[2150]: pop3-login: Disconnected: Connection closed: read(size=693) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.152, lip=66.85.158.91, TLS handshaking: read(size=693) failed: Connection reset by peer, session=<HQ0jOENFt5VX7LCY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.224.62.206
country_id: 2464461
description:
2025-12-06 12:38:08 dovecot_login authenticator failed for ([41.224.62.206]) [41.224.62.206]:60203: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.176
country_id: 2635167
description:
Dec  6 12:38:20 host2 dovecot[2150]: pop3-login: Disconnected: Connection closed: read(size=612) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.176, lip=66.85.158.91, TLS handshaking: read(size=612) failed: Connection reset by peer, session=<R7EeOkNFR4+594mw>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.188.102.28
country_id: 298795
description:
2025-12-06 12:38:27 dovecot_login authenticator failed for ([78.188.102.28]) [78.188.102.28]:60350: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.164
country_id: 2635167
description:
Dec  6 12:38:53 host2 dovecot[2150]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=185.247.137.164, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<4M8XPENFocy594mk>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.153
country_id: 2635167
description:
Dec  6 12:39:26 host2 dovecot[2150]: pop3-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.153, lip=66.85.158.91, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<OycVPkNFRaNX7LCZ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.175
country_id: 2635167
description:
Dec  6 12:40:00 host2 dovecot[2150]: pop3-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.175, lip=66.85.158.91, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<LHEQQENFz8lX7LCv>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.181
country_id: 2635167
description:
Dec  6 12:40:33 host2 dovecot[2150]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=185.247.137.181, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<8sQJQkNFl7e594m1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.157
country_id: 2635167
description:
Dec  6 12:41:06 host2 dovecot[2150]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=87.236.176.157, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<tAUFRENFB99X7LCd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec  6 12:41:06 host2 sshd[1139195]: Disconnected from invalid user admin 2.57.121.112 port 39354 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.1.224.71
country_id: 3865483
description:
Dec  6 12:41:30 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=186.1.224.71, lip=66.85.158.91, TLS, session=<Z6BRRENFYKy6AeBH>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.233.110
country_id: 99237
description:
2025-12-06 12:41:42 dovecot_plain authenticator failed for (sputs) [65.20.233.110]:57803: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.89.136.215
country_id: 3469034
description:
Dec  6 12:41:51 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=190.89.136.215, lip=66.85.158.91, TLS, session=<GbOVRUNFmq2+WYjX>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec  6 12:41:59 host2 sshd[1139697]: Disconnected from invalid user benny 62.60.131.157 port 41871 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.138.181
country_id: 1819730
description:
2025-12-06 12:42:31 dovecot_login authenticator failed for (m121-202-138-181.smartone.com) [121.202.138.181]:55926: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.59.157
country_id: 3277605
description:
2025-12-06 12:42:46 dovecot_login authenticator failed for ([195.222.59.157]) [195.222.59.157]:35880: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.173.58.47
country_id: 6252001
description:
2025-12-06 12:48:05 dovecot_plain authenticator failed for c-67-173-58-47.hsd1.il.comcast.net (progrees) [67.173.58.47]:42990: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.193.112.85
country_id: 6252001
description:
2025-12-06 12:49:22 dovecot_plain authenticator failed for c-98-193-112-85.hsd1.il.comcast.net (calogly) [98.193.112.85]:52842: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.255.209
country_id: 2542007
description:
2025-12-06 12:53:45 dovecot_plain authenticator failed for (imudich) [154.144.255.209]:59324: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.107.36.18
country_id: 1269750
description:
2025-12-06 12:58:38 dovecot_login authenticator failed for ([103.107.36.18]) [103.107.36.18]:55564: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.139.107.146
country_id: 1269750
description:
2025-12-06 12:58:25 dovecot_login authenticator failed for ([14.139.107.146]) [14.139.107.146]:55626: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.21.235.162
country_id: 6252001
description:
2025-12-06 13:09:30 dovecot_plain authenticator failed for ip-64-21-235-162.ideaone.net (chemary) [64.21.235.162]:59230: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.97.190.237
country_id: 6252001
description:
2025-12-06 13:09:34 dovecot_plain authenticator failed for (varlee) [75.97.190.237]:58833: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.91.103.202
country_id: 6252001
description:
2025-12-06 13:09:37 dovecot_plain authenticator failed for c-24-91-103-202.hsd1.ma.comcast.net (kinexash) [24.91.103.202]:33554: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  6 13:11:56 host2 sshd[1161712]: error: kex_exchange_identification: read: Connection reset by peer


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 44.243.18.125
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 44.243.18.125: 250 connections per 30 seconds to 443 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 34.219.124.48
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 34.219.124.48: 250 connections per 30 seconds to 443 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 35.87.155.190
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 35.87.155.190: 250 connections per 30 seconds to 443 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 44.255.185.9
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 44.255.185.9: 250 connections per 30 seconds to 443 port.


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  6 13:27:21 host2 dovecot[2150]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@ayuzonelanka.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<6qdN6UNFjLcXXz9j>


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 173.70.144.46
country_id: 6252001
description:
Dec  6 13:28:27 host2 sshd[1175442]: User essenceceylontea from 173.70.144.46 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 52.180.157.167
country_id: 6252001
description:
Dec  6 13:33:24 host2 dovecot[2150]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=52.180.157.167, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<120Q/0NFmsY0tJ2n>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.148.194
country_id: 99237
description:
2025-12-06 13:34:41 dovecot_plain authenticator failed for (turlisc) [65.20.148.194]:43964: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-06 13:44:17 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (unceapy) [87.103.126.54]:52713: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.164.137
country_id: 99237
description:
2025-12-06 13:44:24 dovecot_plain authenticator failed for (nadas) [65.20.164.137]:38736: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.6.0.228
country_id: 3508796
description:
Dec  6 13:49:17 host2 dovecot[2150]: imap-login: Disconnected: Connection closed: read(size=500) failed: Connection reset by peer (auth failed, 2 attempts in 31 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=186.6.0.228, lip=66.85.158.91, TLS: read(size=500) failed: Connection reset by peer, session=<6P8ENkRFqc26BgDk>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  6 13:57:25 host2 sshd[1198948]: Disconnected from invalid user user 2.57.121.25 port 40189 [preauth]


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 207.90.244.28
country_id: 6252001
description:
Dec  6 13:58:22 host2 dovecot[2150]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=207.90.244.28, lip=66.85.158.91, session=<OBRXWERF7MzPWvQc>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 207.90.244.28
country_id: 6252001
description:
Dec  6 13:58:23 host2 dovecot[2150]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=207.90.244.28, lip=66.85.158.91, session=<rXpqWERFDM3PWvQc>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec  6 13:59:48 host2 sshd[1200652]: Disconnected from invalid user admin 2.57.121.112 port 30140 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  6 14:05:21 host2 sshd[1205272]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 81.189.162.142
country_id: 2782113
description:
Dec  6 14:07:54 host2 dovecot[2150]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=81.189.162.142, lip=66.85.158.91, session=<EFBDekRFIapRvaKO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.156.129.100
country_id: 2264397
description:
Dec  6 14:10:15 host2 dovecot[2150]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=45.156.129.100, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher, session=<g1rcgkRFHbEtnIFk>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 45.156.129.100
country_id: 2264397
description:
Dec  6 14:10:16 host2 dovecot[2150]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=45.156.129.100, lip=66.85.158.92, TLS, session=<NUXhgkRFOa0tnIFk>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.188.78.193
country_id: 6252001
description:
Dec  6 14:10:14 host2 dovecot[2150]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=54.188.78.193, lip=66.85.158.91, session=<ccnEgkRFfOo2vE7B>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 45.156.129.102
country_id: 2264397
description:
Dec  6 14:10:14 host2 dovecot[2150]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=45.156.129.102, lip=66.85.158.92, session=<oJrKgkRF95AtnIFm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.156.129.101
country_id: 2264397
description:
Dec  6 14:10:15 host2 dovecot[2150]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=45.156.129.101, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<geXQgkRF16ctnIFl>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 45.156.129.101
country_id: 2264397
description:
Dec  6 14:10:14 host2 dovecot[2150]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=45.156.129.101, lip=66.85.158.92, TLS, session=<vo/OgkRF/5otnIFl>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.90.215.160
country_id: 6252001
description:
Dec  6 14:11:16 host2 dovecot[2150]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.90.215.160, lip=66.85.158.91, session=<Fhd5hkRFAtAjWteg>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.246.205.14
country_id: 6252001
description:
Dec  6 14:11:17 host2 dovecot[2150]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=44.246.205.14, lip=66.85.158.91, session=<b8CJhkRFbIws9s0O>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 52.40.18.75
country_id: 6252001
description:
Dec  6 14:11:18 host2 dovecot[2150]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=52.40.18.75, lip=66.85.158.91, session=<XJuVhkRF7tQ0KBJL>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.191.88.76
country_id: 6252001
description:
Dec  6 14:11:38 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (no auth attempts in 120 secs): user=<>, rip=54.191.88.76, lip=66.85.158.91, TLS handshaking: Connection closed, session=<SRbCh0RFntE2v1hM>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 52.39.190.16
country_id: 6252001
description:
Dec  6 14:12:16 host2 dovecot[2150]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=52.39.190.16, lip=66.85.158.91, TLS, session=<mKYGikRF+JQ0J74Q>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.162.152.102
country_id: 6252001
description:
Dec  6 14:12:16 host2 dovecot[2150]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=35.162.152.102, lip=66.85.158.91, TLS, session=<9nUSikRFfLkjophm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.249.213
country_id: 3469034
description:
Dec  6 14:12:29 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@jrdc.lk>, method=PLAIN, rip=186.209.249.213, lip=66.85.158.91, TLS, session=<lXW0iURFN9S60fnV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 201.168.138.138
country_id: 3996063
description:
Dec  6 14:12:47 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=201.168.138.138, lip=66.85.158.91, TLS, session=<udntikRFYMDJqIqK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.189.187.82
country_id: 6252001
description:
Dec  6 14:12:11 host2 dovecot[2150]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=54.189.187.82, lip=66.85.158.91, TLS, session=<uG3BiURFIqU2vbtS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.85.208.4
country_id: 798544
description:
Dec  6 14:16:35 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=45.85.208.4, lip=66.85.158.91, TLS, session=<7EGDmERFZ4EtVdAE>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 35.86.253.67
country_id: 6252001
description:
Dec  6 14:16:45 host2 dovecot[2150]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=35.86.253.67, lip=66.85.158.91, session=<7zkcmkRFgqUjVv1D>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.62
country_id: 6252001
description:
Dec  6 14:16:51 host2 dovecot[2150]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=167.94.146.62, lip=66.85.158.92, TLS: Connection closed, session=<Pt90mkRFJFWnXpI+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.60.41
country_id: 953987
description:
Dec  6 14:16:18 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@systemtec.lk>, method=PLAIN, rip=102.129.60.41, lip=66.85.158.91, TLS, session=<ML1Jl0RFJs9mgTwp>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.243.200.210
country_id: 6252001
description:
Dec  6 14:17:47 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=44.243.200.210, lip=66.85.158.91, session=<DQvNnURFmoEs88jS>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 52.34.20.76
country_id: 6252001
description:
Dec  6 14:17:49 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=52.34.20.76, lip=66.85.158.91, session=<SA7mnURFXrI0IhRM>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.165.192.103
country_id: 6252001
description:
Dec  6 14:17:52 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=35.165.192.103, lip=66.85.158.91, session=<oWsOnkRFXL8jpcBn>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.90.215.160
country_id: 6252001
description:
Dec  6 14:17:51 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=35.90.215.160, lip=66.85.158.91, session=<UIsAnkRFrIkjWteg>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 44.249.83.141
country_id: 6252001
description:
Dec  6 14:19:18 host2 pure-ftpd[1215232]: (?@44.249.83.141) [INFO] New connection from 44.249.83.141


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 35.93.116.253
country_id: 6252001
description:
Dec  6 14:19:25 host2 pure-ftpd[1215315]: (?@35.93.116.253) [INFO] New connection from 35.93.116.253


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.59.253.88
country_id: 6252001
description:
2025-12-06 14:20:26 dovecot_plain authenticator failed for c-174-59-253-88.hsd1.pa.comcast.net (unkensally) [174.59.253.88]:46916: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.225.30.107
country_id: 2661886
description:
2025-12-06 14:22:29 dovecot_plain authenticator failed for 81-225-30-107-no2380.tbcn.telia.com (chephionpe) [81.225.30.107]:41963: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec  6 14:24:52 host2 sshd[1219719]: Disconnected from invalid user finn 62.60.131.157 port 60846 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.224.171.101
country_id: 6252001
description:
2025-12-06 14:26:54 dovecot_plain authenticator failed for c-73-224-171-101.hsd1.fl.comcast.net (punnonrew) [73.224.171.101]:52176: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.248.228.26
country_id: 6252001
description:
Dec  6 14:28:31 host2 dovecot[2150]: pop3-login: Disconnected: Connection closed (no auth attempts in 120 secs): user=<>, rip=44.248.228.26, lip=66.85.158.91, TLS handshaking: Connection closed, session=<FW8lxERFzsos+OQa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.82.141.145
country_id: 6252001
description:
2025-12-06 14:28:30 dovecot_plain authenticator failed for c-68-82-141-145.hsd1.pa.comcast.net (tietree) [68.82.141.145]:45440: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.188.54.45
country_id: 6252001
description:
Dec  6 14:29:53 host2 dovecot[2150]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=54.188.54.45, lip=66.85.158.91, TLS, session=<Dj4VyURFIL82vDYt>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.248.228.26
country_id: 6252001
description:
Dec  6 14:29:18 host2 dovecot[2150]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=44.248.228.26, lip=66.85.158.91, TLS, session=<eP30xkRFVJYs+OQa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.251.239.35
country_id: 6252001
description:
Dec  6 14:29:50 host2 dovecot[2150]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=44.251.239.35, lip=66.85.158.91, TLS, session=<ohjeyERFyscs++8j>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.94.203.1
country_id: 6252001
description:
Dec  6 14:29:50 host2 dovecot[2150]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=35.94.203.1, lip=66.85.158.91, TLS, session=<iJDeyERFqOYjXssB>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 52.39.190.16
country_id: 6252001
description:
Dec  6 14:29:55 host2 dovecot[2150]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=52.39.190.16, lip=66.85.158.91, TLS, session=<iGEsyURFcrE0J74Q>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.106
country_id: 6252001
description:
Dec  6 14:31:28 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.106, lip=66.85.158.92, TLS, session=<pTG9zkRFnPDN0h9q>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.10.210.68
country_id: 732800
description:
2025-12-06 14:32:00 dovecot_plain authenticator failed for (sionia) [46.10.210.68]:40557: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.237
country_id: 6252001
description:
Dec  6 14:33:09 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.237, lip=66.85.158.91, TLS, session=<YxTC1ERFlO/N0h/t>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.157.44.146
country_id: 1227603
description:
2025-12-06 14:36:24 dovecot_plain authenticator failed for (JKJEX) [175.157.44.146]:60917: 535 Incorrect authentication data (set_id=httpssmtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-06 14:41:25 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (hydral) [87.103.126.54]:12496: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.230.86.50
country_id: 6252001
description:
2025-12-06 14:45:57 dovecot_plain authenticator failed for c-73-230-86-50.hsd1.pa.comcast.net (bitersh) [73.230.86.50]:60132: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.171.77
country_id: 3175395
description:
Dec  6 14:52:37 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=185.15.171.77, lip=66.85.158.91, TLS, session=<f3lYGUVFtOa5D6tN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 181.16.212.160
country_id: 3865483
description:
Dec  6 14:52:08 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@systemtec.lk>, method=PLAIN, rip=181.16.212.160, lip=66.85.158.91, TLS, session=<jD2JF0VFQpe1ENSg>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 207.90.244.28
country_id: 6252001
description:
Dec  6 14:54:33 host2 dovecot[2150]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 1 secs): user=<>, rip=207.90.244.28, lip=66.85.158.92, session=<iFtCIUVF4K/PWvQc>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 207.90.244.28
country_id: 6252001
description:
Dec  6 14:54:32 host2 dovecot[2150]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=207.90.244.28, lip=66.85.158.92, session=<vHA4IUVF1K/PWvQc>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.229
country_id: 6252001
description:
Dec  6 15:00:39 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.235.24.229, lip=66.85.158.92, session=<iYwaN0VFYPDG6xjl>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.170.57.251
country_id: 6252001
description:
[2025-12-06 15:01:38 +0530] info [webmaild] 98.170.57.251 - info@greentaraceylon.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 89.249.55.106
country_id: 2017370
description:
[2025-12-06 15:04:12 +0530] info [cpaneld] 89.249.55.106 - ayuzonel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ayuzonel (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-06 15:05:39 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (batom) [87.103.126.54]:33427: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  6 15:06:51 host2 sshd[1249938]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-06 15:07:52 +0530] info [cpaneld] 213.209.143.251 - agronatu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agronatu (has_cpuser_file failed)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.121
country_id: 6252001
description:
Dec  6 15:10:46 host2 pure-ftpd[1252540]: (?@66.132.153.121) [INFO] New connection from 66.132.153.121


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.208
country_id: 99237
description:
2025-12-06 15:12:23 dovecot_plain authenticator failed for (zootoring) [65.20.133.208]:51469: 535 Incorrect authentication data (set_id=sysnytech@sysnytech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  6 15:17:36 host2 sshd[1257825]: Disconnected from invalid user user 2.57.121.25 port 29100 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  6 15:22:40 host2 dovecot[2150]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@askinternationalconsortium.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<JhuthUVFbsUXXz9j>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.85.152.227
country_id: 3469034
description:
Dec  6 15:25:40 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=187.85.152.227, lip=66.85.158.91, TLS, session=<gMd7j0VFWdu7VZjj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.0.122.242
country_id: 226074
description:
Dec  6 15:26:03 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info>, method=PLAIN, rip=196.0.122.242, lip=66.85.158.91, TLS, session=<tPKrkEVF5+PEAHry>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.99.14
country_id: 290557
description:
2025-12-06 15:26:15 dovecot_plain authenticator failed for (drizine) [5.32.99.14]:40150: 535 Incorrect authentication data (set_id=sysnytech@sysnytech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  6 15:26:38 host2 dovecot[2150]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ayuzonelanka.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<+Rzjk0VFdKEXXz9j>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.99.14
country_id: 290557
description:
2025-12-06 15:29:00 dovecot_login authenticator failed for ([5.32.99.14]) [5.32.99.14]:53806: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.75.215.245
country_id: 1269750
description:
2025-12-06 15:29:34 dovecot_login authenticator failed for (nsg-static-245.215.75.182-airtel.com) [182.75.215.245]:58304: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2025-12-06 15:32:30 dovecot_plain authenticator failed for (unnity) [64.72.74.162]:57882: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 199.192.123.12
country_id: 6252001
description:
2025-12-06 15:36:12 dovecot_plain authenticator failed for (stalescon) [199.192.123.12]:57886: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.53.254.168
country_id: 6252001
description:
2025-12-06 15:39:21 dovecot_plain authenticator failed for c-73-53-254-168.hsd1.fl.comcast.net (smell) [73.53.254.168]:55732: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.33.183.30
country_id: 357994
description:
2025-12-06 15:42:33 dovecot_plain authenticator failed for (nesnum) [41.33.183.30]:52406: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-06 15:49:16 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (remon) [87.103.126.54]:25035: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.224.169.28
country_id: 6252001
description:
2025-12-06 15:51:26 dovecot_plain authenticator failed for c-71-224-169-28.hsd1.pa.comcast.net (akism) [71.224.169.28]:33932: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.157.223.13
country_id: 2077456
description:
2025-12-06 15:53:26 dovecot_login authenticator failed for ([120.157.223.13]) [120.157.223.13]:38932: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.93.84
country_id: 1269750
description:
2025-12-06 15:53:41 dovecot_login authenticator failed for ([152.52.93.82]) [152.52.93.84]:10400: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  6 15:59:48 host2 sshd[1289009]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.16.7.82
country_id: 6252001
description:
2025-12-06 16:00:00 dovecot_plain authenticator failed for c-76-16-7-82.hsd1.il.comcast.net (sishia) [76.16.7.82]:51978: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.228.53.204
country_id: 6252001
description:
Dec  6 16:01:53 host2 dovecot[2150]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=66.228.53.204, lip=66.85.158.92, TLS, session=<nSIVEkZFnqZC5DXM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.188.251
country_id: 290557
description:
2025-12-06 16:03:18 dovecot_plain authenticator failed for (verecte) [91.73.188.251]:54486: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-06 16:07:16 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:63216: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.174.40
country_id: 99237
description:
Dec  6 16:10:01 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@jrdc.lk>, method=PLAIN, rip=65.20.174.40, lip=66.85.158.91, TLS, session=<qJEULkZFGrxBFK4o>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.11.119
country_id: 2300660
description:
Dec  6 16:10:21 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=41.139.11.119, lip=66.85.158.91, TLS, session=<GNJCL0ZF6Mcpiwt3>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec  6 16:16:16 host2 sshd[1302345]: Disconnected from invalid user jan 62.60.131.157 port 21963 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.208.81.125
country_id: 6252001
description:
2025-12-06 16:17:45 dovecot_plain authenticator failed for c-73-208-81-125.hsd1.in.comcast.net (torroper) [73.208.81.125]:60650: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 199.192.123.12
country_id: 6252001
description:
2025-12-06 16:17:39 dovecot_plain authenticator failed for (unsen) [199.192.123.12]:36502: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.109
country_id: 6252001
description:
Dec  6 16:19:49 host2 dovecot[2150]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.109, lip=66.85.158.92, TLS handshaking: Connection closed, session=<HgYwUkZFEZ9APsVt>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.236.228.193
country_id: 6252001
description:
Dec  6 16:19:55 host2 dovecot[2150]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=172.236.228.193, lip=66.85.158.91, TLS, session=<bFyNUkZFvuas7OTB>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.107
country_id: 6252001
description:
Dec  6 16:20:07 host2 dovecot[2150]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.107, lip=66.85.158.92, TLS handshaking: Connection closed, session=<m7BDU0ZFIGVAPsVr>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.107
country_id: 6252001
description:
Dec  6 16:20:17 host2 dovecot[2150]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.197.107, lip=66.85.158.92, TLS: Connection closed, session=<oe/kU0ZFBuZAPsVr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.107.36.18
country_id: 1269750
description:
2025-12-06 16:21:49 dovecot_login authenticator failed for ([103.107.36.18]) [103.107.36.18]:47402: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.227
country_id: 1819730
description:
2025-12-06 16:21:58 dovecot_login authenticator failed for 227.42.246.220.static.netvigator.com [220.246.42.227]:64132: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.41.202.12
country_id: 6252001
description:
2025-12-06 16:22:14 dovecot_login authenticator failed for syn-071-041-202-012.biz.spectrum.com [71.41.202.12]:60958: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.147.94
country_id: 290557
description:
2025-12-06 16:21:22 dovecot_login authenticator failed for ([80.227.147.94]) [80.227.147.94]:46539: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.139.107.146
country_id: 1269750
description:
2025-12-06 16:21:41 dovecot_login authenticator failed for ([14.139.107.146]) [14.139.107.146]:46976: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.208.81.125
country_id: 6252001
description:
2025-12-06 16:24:07 dovecot_plain authenticator failed for c-73-208-81-125.hsd1.in.comcast.net (relosolism) [73.208.81.125]:38118: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec  6 16:25:43 host2 sshd[1309343]: Disconnected from invalid user jan 62.60.131.157 port 50677 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec  6 16:28:48 host2 sshd[1311213]: Disconnected from invalid user admin 2.57.121.112 port 52059 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.250.191.189
country_id: 458258
description:
2025-12-06 16:29:29 dovecot_plain authenticator failed for (oditilets) [178.250.191.189]:57894: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.208
country_id: 99237
description:
2025-12-06 16:29:25 dovecot_plain authenticator failed for (puriedia) [65.20.133.208]:37162: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.194.98
country_id: 6252001
description:
2025-12-06 16:29:27 dovecot_plain authenticator failed for c-73-197-194-98.hsd1.nj.comcast.net (relubsly) [73.197.194.98]:34490: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.168.136.150
country_id: 6252001
description:
2025-12-06 16:32:16 dovecot_plain authenticator failed for c-73-168-136-150.hsd1.il.comcast.net (phednetee) [73.168.136.150]:52106: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.130
country_id: 6252001
description:
Dec  6 16:35:06 host2 dovecot[2150]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=195.184.76.130, lip=66.85.158.91, session=<FRDYiEZFKe7DuEyC>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.94
country_id: 6252001
description:
Dec  6 16:35:17 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=195.184.76.94, lip=66.85.158.91, session=<GSN/iUZFsbrDuExe>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.133
country_id: 6252001
description:
Dec  6 16:35:24 host2 dovecot[2150]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=195.184.76.133, lip=66.85.158.91, session=<vmXviUZF/azDuEyF>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec  6 16:37:33 host2 dovecot[2150]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, session=<GTKckUZF2NQDlTsa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.181.155.49
country_id: 1269750
description:
2025-12-06 16:37:34 dovecot_plain authenticator failed for (5HJ30XO6291) [103.181.155.49]:61697: 535 Incorrect authentication data (set_id=httpssmtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec  6 16:39:46 host2 dovecot[2150]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, session=<GW+JmUZF3toDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec  6 16:41:46 host2 dovecot[2150]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, session=<EFutoEZFmtYDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec  6 16:42:21 host2 dovecot[2150]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, session=<IYnQokZFgKoDlTsa>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.149.59.26
country_id: 6252001
description:
Dec  6 16:44:06 host2 dovecot[2150]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, session=<PN8RqUZF5LEDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec  6 16:43:40 host2 dovecot[2150]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, session=<hOt6p0ZFer4DlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec  6 16:45:57 host2 dovecot[2150]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, session=<VyWxr0ZFJtwDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec  6 16:46:20 host2 dovecot[2150]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, session=<94YNsUZFvJ4DlTsa>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.149.59.26
country_id: 6252001
description:
Dec  6 16:46:22 host2 dovecot[2150]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, session=<FewrsUZFHtADlTsa>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 71.6.134.233
country_id: 6252001
description:
Dec  6 16:48:20 host2 dovecot[2150]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=71.6.134.233, lip=66.85.158.92, TLS, session=<FpktuEZFyMlHBobp>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec  6 16:48:34 host2 dovecot[2150]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, session=<7TYLuUZF9McDlTsa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.168.136.150
country_id: 6252001
description:
2025-12-06 16:53:41 dovecot_plain authenticator failed for c-73-168-136-150.hsd1.il.comcast.net (unium) [73.168.136.150]:59852: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.15.216.41
country_id: 6252001
description:
2025-12-06 16:59:04 dovecot_plain authenticator failed for c-24-15-216-41.hsd1.il.comcast.net (gamanweit) [24.15.216.41]:50408: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.8.19.89
country_id: 6252001
description:
2025-12-06 16:58:18 dovecot_plain authenticator failed for ([100.64.100.6]) [45.8.19.89]:54520: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.184.80
country_id: 99237
description:
2025-12-06 16:59:45 dovecot_plain authenticator failed for (heamente) [65.20.184.80]:55334: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2025-12-06 16:59:50 dovecot_plain authenticator failed for host-196-47-172-253.afnet.net (rinetreorm) [196.47.172.253]:53285: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.1.34.242
country_id: 719819
description:
2025-12-06 16:59:51 dovecot_plain authenticator failed for dsl540122f2.fixip.t-online.hu (prous) [84.1.34.242]:39662: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.182.125.210
country_id: 6252001
description:
2025-12-06 17:01:05 dovecot_plain authenticator failed for (epincity) [12.182.125.210]:47003: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  6 17:01:27 host2 sshd[1336046]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.114
country_id: 6252001
description:
Dec  6 17:01:33 host2 dovecot[2150]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.114, lip=66.85.158.92, TLS: Connection closed, session=<prR250ZFdkZChJly>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  6 17:05:42 host2 sshd[1340544]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2025-12-06 17:06:45 dovecot_plain authenticator failed for (vical) [102.53.15.17]:51173: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 18.97.5.108
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 18.97.5.108: 250 connections per 30 seconds to 8443 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-06 17:09:39 +0530] info [cpaneld] 213.209.143.251 - 2strav "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.43.33.218
country_id: 1819730
description:
Dec  6 17:10:59 host2 dovecot[2150]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 2 secs): user=<>, rip=45.43.33.218, lip=66.85.158.92, session=<b+suCUdF344tKyHa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-06 17:11:18 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (supsemists) [87.103.126.54]:1654: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.43.33.218
country_id: 1819730
description:
Dec  6 17:11:25 host2 dovecot[2150]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=45.43.33.218, lip=66.85.158.92, session=<CXW6CkdFtdctKyHa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.129.57.71
country_id: 6252001
description:
2025-12-06 17:18:04 dovecot_plain authenticator failed for c-73-129-57-71.hsd1.md.comcast.net (irivarics) [73.129.57.71]:60714: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.192.97.23
country_id: 1861060
description:
2025-12-06 17:20:25 dovecot_login authenticator failed for ([203.192.97.23]) [203.192.97.23]:41186: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.141.252.55
country_id: 6252001
description:
2025-12-06 17:20:39 dovecot_login authenticator failed for ([38.141.252.55]) [38.141.252.55]:40665: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.97.253.246
country_id: 6252001
description:
2025-12-06 17:23:47 dovecot_plain authenticator failed for syn-024-097-253-246.biz.spectrum.com (irappyl) [24.97.253.246]:55826: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.213.237.28
country_id: 6252001
description:
2025-12-06 17:25:08 dovecot_plain authenticator failed for c-73-213-237-28.hsd1.va.comcast.net (crarittic) [73.213.237.28]:44964: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 20.119.99.184
country_id: 6252001
description:
Dec  6 17:35:13 host2 pure-ftpd[1365677]: (?@20.119.99.184) [INFO] New connection from 20.119.99.184


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.163.194.39
country_id: 1512440
description:
Dec  6 17:38:53 host2 pure-ftpd[1369057]: (?@198.163.194.39) [INFO] New connection from 198.163.194.39


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.218
country_id: 1733045
description:
2025-12-06 17:39:29 dovecot_login authenticator failed for ([49.124.152.218]) [49.124.152.218]:37042: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.183.66
country_id: 1269750
description:
2025-12-06 17:40:09 dovecot_login authenticator failed for ([125.19.183.66]) [125.19.183.66]:57754: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.227.254.156
country_id: 3703430
description:
Dec  6 17:42:19 host2 dovecot[2150]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (disconnected before auth was ready, waited 0 secs): user=<>, rip=45.227.254.156, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<1N9AeUdFdf4t4/6c>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-06 17:44:37 +0530] info [cpaneld] 213.209.143.251 - agrona "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agrona (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec  6 17:45:49 host2 sshd[1376339]: Disconnected from invalid user admin 2.57.121.112 port 41213 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.74.41
country_id: 1527747
description:
2025-12-06 17:46:03 dovecot_login authenticator failed for (92-62-74-41.saimanet.kg) [92.62.74.41]:36254: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.127.86
country_id: 1269750
description:
2025-12-06 17:46:23 dovecot_login authenticator failed for ([27.123.119.191]) [122.184.127.86]:32768: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.159.186
country_id: 1269750
description:
2025-12-06 17:46:48 dovecot_login authenticator failed for ([125.19.159.186]) [125.19.159.186]:44478: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-06 17:49:07 +0530] info [cpaneld] 213.209.143.251 - ajssta "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajssta (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.131.211.168
country_id: 690791
description:
2025-12-06 17:49:32 dovecot_login authenticator failed for ([94.131.211.168]) [94.131.211.168]:53206: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.193.79
country_id: 6251999
description:
Dec  6 17:51:51 host2 dovecot[2150]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=148.113.193.79, lip=66.85.158.92, session=<UItbm0dFHseUccFP>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  6 17:54:29 host2 sshd[1384351]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  6 17:55:54 host2 sshd[1385656]: Disconnected from invalid user user 2.57.121.25 port 36461 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.124.182.170
country_id: 3175395
description:
Dec  6 17:56:00 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 23 secs): user=<info@systemtec.lk>, method=PLAIN, rip=185.124.182.170, lip=66.85.158.91, TLS, session=<fa7NqEdFy+C5fLaq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.124.182.191
country_id: 3175395
description:
Dec  6 17:56:18 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=185.124.182.191, lip=66.85.158.91, TLS, session=<BetEqkdFCoe5fLa/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.31.15.108
country_id: 290557
description:
2025-12-06 17:58:14 dovecot_plain authenticator failed for (inerbum) [5.31.15.108]:44803: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.52.170
country_id: 1269750
description:
2025-12-06 18:02:52 dovecot_login authenticator failed for ([182.95.52.170]) [182.95.52.170]:45924: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.6.216
country_id: 3144096
description:
2025-12-06 18:03:06 dovecot_login authenticator failed for ([178.232.6.216]) [178.232.6.216]:44887: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.73.121.209
country_id: 732800
description:
2025-12-06 18:04:19 dovecot_plain authenticator failed for (cometal) [62.73.121.209]:33647: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-06 18:06:14 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (bliesh) [87.103.126.54]:41417: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.30
country_id: 3017382
description:
Dec  6 18:07:13 host2 dovecot[2150]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 2 secs): user=<>, rip=91.196.152.30, lip=66.85.158.91, session=<Yr1T0kdFY4ZbxJge>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.112
country_id: 3017382
description:
Dec  6 18:07:25 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=91.196.152.112, lip=66.85.158.91, session=<eUoF00dFc8JbxJhw>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  6 18:10:37 host2 sshd[1398351]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-06 18:24:16 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (fishic) [87.103.126.54]:46613: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  6 18:29:34 host2 sshd[1415147]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.147.45
country_id: 99237
description:
2025-12-06 18:30:43 dovecot_plain authenticator failed for (bachaial) [65.20.147.45]:41463: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.119
country_id: 1269750
description:
2025-12-06 18:44:39 dovecot_login authenticator failed for (nsg-corporate-119.229.187.122.airtel.in) [122.187.229.119]:50733: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.191.12
country_id: 99237
description:
2025-12-06 18:45:16 dovecot_login authenticator failed for ([65.20.191.12]) [65.20.191.12]:43688: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.167.117
country_id: 99237
description:
2025-12-06 18:45:32 dovecot_login authenticator failed for ([65.20.167.117]) [65.20.167.117]:55401: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 152.32.129.154
country_id: 1819730
description:
Dec  6 18:49:04 host2 dovecot[2150]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=152.32.129.154, lip=66.85.158.92, TLS, session=<T3T2Z0hFgtqYIIGa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 152.32.129.154
country_id: 1819730
description:
Dec  6 18:49:02 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=152.32.129.154, lip=66.85.158.92, session=<TVzfZ0hFYtmYIIGa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2025-12-06 18:49:49 dovecot_login authenticator failed for (AXjPBlVwyr) [69.5.189.21]:58024: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2025-12-06 18:50:12 dovecot_login authenticator failed for (utElo0S) [69.5.189.21]:51708: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2025-12-06 18:50:59 dovecot_login authenticator failed for (qeGb3f) [69.5.189.21]:56610: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2025-12-06 18:51:54 dovecot_plain authenticator failed for c-71-62-34-216.hsd1.va.comcast.net (eronerite) [71.62.34.216]:36116: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  6 18:56:47 host2 sshd[1438959]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 199.45.154.147
country_id: 6252001
description:
Dec  6 18:56:41 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=199.45.154.147, lip=66.85.158.91, TLS: Connection closed, session=<hQo8g0hFmsfHLZqT>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 199.45.154.147
country_id: 6252001
description:
Dec  6 18:56:57 host2 dovecot[2150]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1420918C:SSL routines:tls_early_post_process_client_hello:version too low (no auth attempts in 3 secs): user=<>, rip=199.45.154.147, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1420918C:SSL routines:tls_early_post_process_client_hello:version too low, session=<WTswhEhFyLfHLZqT>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.16.7.82
country_id: 6252001
description:
2025-12-06 18:57:05 dovecot_plain authenticator failed for c-76-16-7-82.hsd1.il.comcast.net (bibilic) [76.16.7.82]:48635: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  6 18:59:28 host2 sshd[1441378]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec  6 19:02:35 host2 sshd[1444850]: Disconnected from invalid user admin 2.57.121.112 port 61361 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.239.201.140
country_id: 1643084
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 173.239.201.140 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 40.124.173.224
country_id: 6252001
description:
Dec  6 19:04:37 host2 pure-ftpd[1447133]: (?@40.124.173.224) [INFO] New connection from 40.124.173.224


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.220.236.203
country_id: 660013
description:
2025-12-06 19:08:07 dovecot_login authenticator failed for ([62.220.236.203]) [62.220.236.203]:41258: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.168.241.32
country_id: 1269750
description:
2025-12-06 19:08:22 dovecot_login authenticator failed for ([103.168.241.32]) [103.168.241.32]:40382: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 213.209.143.251 - 2str "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.215.74.195
country_id: 2661886
description:
2025-12-06 19:11:07 dovecot_plain authenticator failed for 217-215-74-195-no2620.tbcn.telia.com (uncus) [217.215.74.195]:34968: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.196.184.78
country_id: 6252001
description:
2025-12-06 19:11:12 dovecot_login authenticator failed for ([74.196.184.78]) [74.196.184.78]:45245: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.175.76.146
country_id: 6252001
description:
2025-12-06 19:11:27 dovecot_login authenticator failed for (107-175-76-146-host.colocrossing.com) [107.175.76.146]:59384: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.83.181.181
country_id: 6252001
description:
2025-12-06 19:18:12 dovecot_plain authenticator failed for c-68-83-181-181.hsd1.pa.comcast.net (fluously) [68.83.181.181]:59444: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  6 19:21:00 host2 sshd[1462182]: Disconnected from invalid user user 2.57.121.25 port 6641 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.219.154.156
country_id: 2750405
description:
2025-12-06 19:22:00 dovecot_login authenticator failed for ([103.219.154.156]) [103.219.154.156]:47064: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.150.115
country_id: 1819730
description:
2025-12-06 19:22:20 dovecot_login authenticator failed for 115.150.48.116.static.netvigator.com [116.48.150.115]:56221: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.97.190.237
country_id: 6252001
description:
2025-12-06 19:22:37 dovecot_plain authenticator failed for (vadelital) [75.97.190.237]:39537: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2025-12-06 19:23:41 dovecot_plain authenticator failed for (dotlite) [102.53.15.18]:54075: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec  6 19:27:51 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<GYGw8khFOMYDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec  6 19:28:08 host2 dovecot[2150]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<DLe080hFFIYDhpQ7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.235.225.181
country_id: 6252001
description:
2025-12-06 19:29:04 dovecot_plain authenticator failed for c-71-235-225-181.hsd1.ct.comcast.net (mitavity) [71.235.225.181]:46902: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec  6 19:30:11 host2 dovecot[2150]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<h2n7+khFCuEDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec  6 19:31:42 host2 dovecot[2150]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<9AdtAElFlp8DhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec  6 19:32:00 host2 dovecot[2150]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<qWB7AUlFtpYDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec  6 19:33:34 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<MpAcB0lFtqwDhpQ7>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.134.148.59
country_id: 6252001
description:
Dec  6 19:34:10 host2 dovecot[2150]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<tEhHCUlF0NQDhpQ7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.177.30.53
country_id: 6252001
description:
2025-12-06 19:34:52 dovecot_plain authenticator failed for c-66-177-30-53.hsd1.fl.comcast.net (neque) [66.177.30.53]:42622: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.230.80.28
country_id: 3865483
description:
Dec  6 19:35:04 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@jrdc.lk>, method=PLAIN, rip=45.230.80.28, lip=66.85.158.91, TLS, session=<T99RC0lFoaUt5lAc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.71.178
country_id: 3469034
description:
Dec  6 19:35:23 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=177.44.71.178, lip=66.85.158.91, TLS, session=<nsGPDElF7ICxLEey>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec  6 19:35:27 host2 dovecot[2150]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<Vr7cDUlFTokDhpQ7>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 213.209.143.251 - agro "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agro (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-06 19:41:42 +0530] info [cpaneld] 213.209.143.251 - ajss "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajss (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.213.237.28
country_id: 6252001
description:
2025-12-06 19:48:55 dovecot_plain authenticator failed for c-73-213-237-28.hsd1.va.comcast.net (hutorle) [73.213.237.28]:56802: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  6 19:50:06 host2 sshd[1486420]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.50.226.182
country_id: 3469034
description:
2025-12-06 19:52:42 dovecot_login authenticator failed for (200-168-249-9.sconline.com.br) [187.50.226.182]:51313: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.46.192.20
country_id: 2510769
description:
2025-12-06 19:52:06 dovecot_login authenticator failed for ([193.46.192.20]) [193.46.192.20]:33048: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.184.80
country_id: 99237
description:
2025-12-06 19:56:08 dovecot_plain authenticator failed for (caphambuda) [65.20.184.80]:38705: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec  6 19:59:07 host2 sshd[1493522]: Disconnected from invalid user danica 62.60.131.157 port 15217 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.124
country_id: 6252001
description:
Dec  6 20:03:15 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.124, lip=66.85.158.92, TLS: Connection closed, session=<p9pEcUlFsihChJl8>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.22.92.183
country_id: 2921044
description:
Dec  6 20:03:16 host2 dovecot[2150]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=165.22.92.183, lip=66.85.158.91, TLS handshaking: read(size=1026) failed: Connection reset by peer, session=<fvVPcUlFF0ClFly3>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 207.154.199.240
country_id: 2921044
description:
Dec  6 20:03:51 host2 dovecot[2150]: pop3-login: Disconnected: Connection closed (no auth attempts in 20 secs): user=<>, rip=207.154.199.240, lip=66.85.158.91, TLS handshaking: Connection closed, session=<z+Ntc0lFrLHPmsfw>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.165
country_id: 2993457
description:
Dec  6 20:04:33 host2 dovecot[2150]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=194.165.16.165, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<PhjldUlFFv7CpRCl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-06 20:04:43 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (undbrubulk) [87.103.126.54]:19926: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-06 20:09:31 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (pruinge) [87.103.126.54]:49002: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-06 20:10:06 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:62552: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.162
country_id: 2993457
description:
Dec  6 20:15:01 host2 dovecot[2150]: pop3-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=194.165.16.162, lip=66.85.158.92, session=<qwxUm0lFjv/CpRCi>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.247.252
country_id: 6252001
description:
Dec  6 20:21:00 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=184.105.247.252, lip=66.85.158.92, session=<jfy9sElFYIG4aff8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.189.205.226
country_id: 3469034
description:
Dec  6 20:31:41 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=179.189.205.226, lip=66.85.158.91, TLS, session=<tI/K1UlFOOOzvc3i>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.45.236
country_id: 953987
description:
Dec  6 20:32:18 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<info>, method=PLAIN, rip=102.64.45.236, lip=66.85.158.91, TLS, session=<Y1jV10lF2rVmQC3s>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.196.144.25
country_id: 6252001
description:
2025-12-06 20:34:56 dovecot_plain authenticator failed for c-73-196-144-25.hsd1.nj.comcast.net (precus) [73.196.144.25]:49918: 535 Incorrect authentication data (set_id=sysnytech@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.168.136.150
country_id: 6252001
description:
2025-12-06 20:37:00 dovecot_plain authenticator failed for c-73-168-136-150.hsd1.il.comcast.net (aphuriour) [73.168.136.150]:47928: 535 Incorrect authentication data (set_id=sysnytech@sysnytech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 216.218.206.67
country_id: 6252001
description:
Dec  6 20:38:13 host2 dovecot[2150]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=216.218.206.67, lip=66.85.158.91, TLS handshaking: Connection closed, session=<1wRP7klFWF7Y2s5D>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  6 20:39:04 host2 sshd[1525444]: Disconnected from invalid user user 2.57.121.25 port 53292 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  6 20:39:27 host2 dovecot[2150]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<kpWa8klF3IoXXz9j>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.31
country_id: 2635167
description:
Dec  6 20:45:24 host2 dovecot[2150]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 46 secs): user=<>, rip=35.203.211.31, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<zkH+B0pFL9cjy9Mf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.31
country_id: 2635167
description:
Dec  6 20:46:00 host2 dovecot[2150]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=35.203.211.31, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<RTMgCkpFJvEjy9Mf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.128
country_id: 6252001
description:
Dec  6 20:49:29 host2 dovecot[2150]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=66.132.153.128, lip=66.85.158.91, session=<9TubFkpF8LRChJmA>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.194.98
country_id: 6252001
description:
2025-12-06 20:50:02 dovecot_plain authenticator failed for c-73-197-194-98.hsd1.nj.comcast.net (sunnism) [73.197.194.98]:34186: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  6 20:52:17 host2 sshd[1536664]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.31
country_id: 2635167
description:
Dec  6 20:52:25 host2 dovecot[2150]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.203.211.31, lip=66.85.158.92, TLS, session=<kq8ZIUpFBuojy9Mf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.171
country_id: 6252001
description:
Dec  6 20:55:29 host2 dovecot[2150]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=64.62.156.171, lip=66.85.158.92, session=<WeMJLEpFSdlAPpyr>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.162
country_id: 6252001
description:
Dec  6 20:55:41 host2 dovecot[2150]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.162, lip=66.85.158.92, TLS: Connection closed, session=<WpjNLEpFPrBAPpyi>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.215.74.195
country_id: 2661886
description:
2025-12-06 20:56:48 dovecot_plain authenticator failed for 217-215-74-195-no2620.tbcn.telia.com (undlul) [217.215.74.195]:54305: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.59.178.27
country_id: 298795
description:
2025-12-06 21:00:01 dovecot_login authenticator failed for ([188.59.178.27]) [188.59.178.27]:53679: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.146.233.200
country_id: 1269750
description:
2025-12-06 21:00:30 dovecot_login authenticator failed for ([103.146.233.200]) [103.146.233.200]:44691: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2025-12-06 21:02:39 dovecot_plain authenticator failed for (troscinth) [64.72.74.162]:40680: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 64.62.156.222
country_id: 6252001
description:
Dec  6 21:04:27 host2 pure-ftpd[1546428]: (?@64.62.156.222) [INFO] New connection from 64.62.156.222


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  6 21:06:08 host2 sshd[1547689]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.85.104.2
country_id: 6252001
description:
2025-12-06 21:07:45 dovecot_plain authenticator failed for (cherania) [96.85.104.2]:47270: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.219.104.210
country_id: 3175395
description:
2025-12-06 21:07:49 dovecot_plain authenticator failed for net-188-219-104-210.cust.vodafonedsl.it (denchetic) [188.219.104.210]:41090: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 134.209.173.54
country_id: 6252001
description:
Dec  6 21:19:28 host2 pure-ftpd[1559279]: (?@134.209.173.54) [INFO] New connection from 134.209.173.54


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.173.54
country_id: 6252001
description:
Dec  6 21:19:17 host2 pure-ftpd[1559161]: (?@134.209.173.54) [INFO] New connection from 134.209.173.54


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 64.225.114.100
country_id: 6252001
description:
Dec  6 21:20:11 host2 pure-ftpd[1559948]: (?@64.225.114.100) [INFO] New connection from 64.225.114.100


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.141
country_id: 6252001
description:
Dec  6 21:28:32 host2 dovecot[2150]: imap-login: Disconnected: Connection closed: read(size=704) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=66.132.153.141, lip=66.85.158.92, TLS: read(size=704) failed: Connection reset by peer, session=<Z7Y/okpFbENChJmN>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec  6 21:32:33 host2 sshd[1568651]: Disconnected from invalid user eunice 62.60.131.157 port 33361 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec  6 21:34:59 host2 sshd[1570456]: Disconnected from invalid user admin 2.57.121.112 port 49025 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 92.223.88.171
country_id: 2960313
description:
[2025-11-13 10:40:03 +0530] info [webmaild] 92.223.88.171 - washeera@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.73.93.110
country_id: 2542007
description:
2025-12-06 21:37:58 dovecot_login authenticator failed for ([105.73.93.110]) [105.73.93.110]:52280: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec  6 21:40:11 host2 sshd[1575162]: Disconnected from invalid user eunice 62.60.131.157 port 40522 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.33.80.243
country_id: 6252001
description:
Dec  6 21:42:41 host2 dovecot[2150]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=45.33.80.243, lip=66.85.158.92, session=<QB3l1EpFAv0tIVDz>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-06 21:42:17 +0530] info [cpaneld] 213.209.143.251 - agronatu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agronatu (has_cpuser_file failed)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  6 21:45:36 host2 sshd[1591864]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.77
country_id: 6252001
description:
Dec  6 21:46:10 host2 pure-ftpd[1592277]: (?@198.235.24.77) [INFO] New connection from 198.235.24.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-06 21:50:29 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (press) [87.103.126.54]:38815: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.167
country_id: 1733045
description:
2025-12-06 21:52:34 dovecot_login authenticator failed for ([49.124.152.167]) [49.124.152.167]:49458: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.81.229.179
country_id: 6252001
description:
2025-12-06 21:52:52 dovecot_login authenticator failed for (fabfibernet.com) [192.81.229.179]:45308: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 164.92.177.93
country_id: 2921044
description:
Dec  6 21:54:01 host2 dovecot[2150]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=164.92.177.93, lip=66.85.158.91, TLS handshaking: read(size=1026) failed: Connection reset by peer, session=<URFl/UpFY3qkXLFd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 209.38.201.147
country_id: 2921044
description:
Dec  6 21:54:36 host2 dovecot[2150]: pop3-login: Disconnected: Connection closed (no auth attempts in 20 secs): user=<>, rip=209.38.201.147, lip=66.85.158.91, TLS handshaking: Connection closed, session=<zd2B/0pFzOHRJsmT>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  6 21:56:57 host2 sshd[1600884]: Disconnected from invalid user user 2.57.121.25 port 11327 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.148.194
country_id: 99237
description:
2025-12-06 21:59:36 dovecot_plain authenticator failed for (platortine) [65.20.148.194]:41335: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.185.233.251
country_id: 798544
description:
2025-12-06 22:01:24 dovecot_plain authenticator failed for 5.185.233.251.ipv4.public.orange.pl (flescaints) [5.185.233.251]:57890: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.10.210.68
country_id: 732800
description:
2025-12-06 22:01:57 dovecot_plain authenticator failed for (hicaley) [46.10.210.68]:45208: 535 Incorrect authentication data (set_id=sysnytech@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.15.216.41
country_id: 6252001
description:
2025-12-06 22:10:25 dovecot_plain authenticator failed for c-24-15-216-41.hsd1.il.comcast.net (deventeri) [24.15.216.41]:53104: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.90.213.28
country_id: 6252001
description:
2025-12-06 22:10:28 dovecot_plain authenticator failed for ool-4a5ad51c.dyn.optonline.net (exant) [74.90.213.28]:44958: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  6 22:14:31 host2 dovecot[2150]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<0G2IRktFqMcXXz9j>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.68.220.15
country_id: 6252001
description:
2025-12-06 22:15:25 dovecot_plain authenticator failed for c-73-68-220-15.hsd1.ma.comcast.net (sawsher) [73.68.220.15]:56706: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.92.229
country_id: 3996063
description:
2025-12-06 22:19:26 dovecot_login authenticator failed for (201.173.92.229-clientes-izzi.mx) [201.173.92.229]:34640: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.191.211.33
country_id: 6252001
description:
2025-12-06 22:20:09 dovecot_login authenticator failed for ([65.191.211.33]) [65.191.211.33]:46218: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 207.154.235.185
country_id: 2921044
description:
Dec  6 22:22:25 host2 dovecot[2150]: pop3-login: Disconnected: Connection closed (no auth attempts in 30 secs): user=<>, rip=207.154.235.185, lip=66.85.158.91, TLS handshaking: Connection closed, session=<gPr4YktFkPvPmuu5>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.247.194
country_id: 6252001
description:
Dec  6 22:22:47 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=184.105.247.194, lip=66.85.158.91, session=<uqVAZEtFLL+4affC>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.247.194
country_id: 6252001
description:
Dec  6 22:23:00 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=184.105.247.194, lip=66.85.158.91, TLS: Connection closed, session=<YYIJZUtFliS4affC>


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 173.70.144.46
country_id: 6252001
description:
Dec  6 22:24:42 host2 sshd[1621766]: User essenceceylontea from 173.70.144.46 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2025-12-06 22:24:56 dovecot_login authenticator failed for ([154.144.243.93]) [154.144.243.93]:36166: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.36
country_id: 1269750
description:
2025-12-06 22:25:06 dovecot_login authenticator failed for (nsg-corporate-36.229.187.122.airtel.in) [122.187.229.36]:51354: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.255.210
country_id: 2542007
description:
2025-12-06 22:25:09 dovecot_login authenticator failed for ([154.144.255.210]) [154.144.255.210]:53198: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.153.144
country_id: 1819730
description:
2025-12-06 22:25:08 dovecot_login authenticator failed for (223-197-153-144.static.imsbiz.com) [223.197.153.144]:51739: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.150.135.19
country_id: 690791
description:
2025-12-06 22:25:12 dovecot_login authenticator failed for (19.135.150.178.triolan.net) [178.150.135.19]:48066: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2025-12-06 22:25:23 dovecot_login authenticator failed for ([102.53.15.56]) [102.53.15.56]:49565: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2025-12-06 22:25:22 dovecot_plain authenticator failed for (satied) [64.72.74.162]:53578: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  6 22:37:08 host2 dovecot[2150]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<sales@agronatureholdings.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<lKFYl0tF0LEXXz9j>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 87.236.176.176
country_id: 2635167
description:
Dec  6 22:38:42 host2 pure-ftpd[1631522]: (?@87.236.176.176) [INFO] New connection from 87.236.176.176


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.12
country_id: 6252001
description:
Dec  6 22:39:41 host2 pure-ftpd[1632147]: (?@147.185.132.12) [INFO] New connection from 147.185.132.12


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 64.62.197.227
country_id: 6252001
description:
Dec  6 22:41:51 host2 pure-ftpd[1633992]: (?@64.62.197.227) [INFO] New connection from 64.62.197.227


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.149.199
country_id: 1733045
description:
2025-12-06 22:42:54 dovecot_login authenticator failed for ([49.124.149.199]) [49.124.149.199]:38856: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.209.211.60
country_id: 2077456
description:
2025-12-06 22:42:17 dovecot_login authenticator failed for ([123.209.211.60]) [123.209.211.60]:47972: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.255.208
country_id: 2542007
description:
2025-12-06 22:45:43 dovecot_plain authenticator failed for (marewar) [154.144.255.208]:37374: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.73.121.209
country_id: 732800
description:
2025-12-06 22:45:46 dovecot_plain authenticator failed for (accionis) [62.73.121.209]:51015: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  6 22:48:11 host2 sshd[1639677]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.139.70
country_id: 6252001
description:
Dec  6 22:49:52 host2 dovecot[2150]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=184.105.139.70, lip=66.85.158.91, session=<i6wixUtF9ki4aYtG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.169.221
country_id: 3144096
description:
2025-12-06 22:50:42 dovecot_login authenticator failed for ([62.97.169.221]) [62.97.169.221]:38859: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.139.70
country_id: 6252001
description:
Dec  6 22:50:06 host2 dovecot[2150]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=184.105.139.70, lip=66.85.158.91, TLS: Connection closed, session=<gbz3xUtFrqS4aYtG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.213.98
country_id: 1269750
description:
2025-12-06 22:51:03 dovecot_login authenticator failed for ([128.185.241.123]) [152.52.213.98]:41674: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2025-12-06 22:54:59 dovecot_plain authenticator failed for host-196-47-172-253.afnet.net (unspids) [196.47.172.253]:42351: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.43.207
country_id: 3144096
description:
2025-12-06 22:55:16 dovecot_login authenticator failed for (cm-46.212.43.207.get.no) [46.212.43.207]:46712: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.96.160.150
country_id: 1269750
description:
2025-12-06 22:56:06 dovecot_login authenticator failed for (aes-static-075.124.17.125.airtel.in) [14.96.160.150]:54554: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.179
country_id: 6252001
description:
Dec  6 23:01:54 host2 dovecot[2150]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 21 secs): user=<>, rip=162.216.150.179, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<R44s8EtFotGi2Jaz>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.179
country_id: 6252001
description:
Dec  6 23:02:51 host2 dovecot[2150]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 12 secs): user=<>, rip=162.216.150.179, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<vu+N80tF/P2i2Jaz>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.179
country_id: 6252001
description:
Dec  6 23:03:08 host2 dovecot[2150]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 13 secs): user=<>, rip=162.216.150.179, lip=66.85.158.91, TLS: read(size=403) failed: Connection reset by peer, session=<+yGU9EtF2vWi2Jaz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.124.129.182
country_id: 3144096
description:
2025-12-06 23:03:25 dovecot_login authenticator failed for ([188.124.129.182]) [188.124.129.182]:42340: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.201.253.23
country_id: 99237
description:
2025-12-06 23:03:38 dovecot_login authenticator failed for ([62.201.253.23]) [62.201.253.23]:60494: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.164.177.6
country_id: 390903
description:
2025-12-06 23:06:33 dovecot_login authenticator failed for ([95.164.177.6]) [95.164.177.6]:53490: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.206.119
country_id: 1819730
description:
2025-12-06 23:05:58 dovecot_login authenticator failed for (m121-202-206-119.smartone.com) [121.202.206.119]:43426: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  6 23:08:00 host2 sshd[1656654]: Disconnected from invalid user user 2.57.121.25 port 43337 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.124.129.182
country_id: 3144096
description:
2025-12-06 23:08:53 dovecot_login authenticator failed for ([188.124.129.182]) [188.124.129.182]:53025: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.37.8
country_id: 798544
description:
2025-12-06 23:09:18 dovecot_login authenticator failed for 89-67-37-8.dynamic.play.pl [89.67.37.8]:58094: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.179
country_id: 6252001
description:
Dec  6 23:10:44 host2 dovecot[2150]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.150.179, lip=66.85.158.91, TLS, session=<ZIS9D0xFFvOi2Jaz>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.179
country_id: 6252001
description:
Dec  6 23:11:22 host2 dovecot[2150]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.150.179, lip=66.85.158.91, TLS, session=<xk8NEkxFyuGi2Jaz>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.116.22
country_id: 1861060
description:
Dec  6 23:18:22 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=139.162.116.22, lip=66.85.158.91, TLS: Connection closed, session=<y3MRK0xFsMyLonQW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  6 23:22:19 host2 dovecot[2150]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<EiHvOExFwq0XXz9j>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-06 23:24:04 +0530] info [cpaneld] 213.209.143.251 - 2strav "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.20.68
country_id: 6252001
description:
Dec  6 23:27:53 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.20.68, lip=66.85.158.91, TLS handshaking: Connection closed, session=<hNobTUxF7MVBMRRE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.20.68
country_id: 6252001
description:
Dec  6 23:28:14 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.20.68, lip=66.85.158.91, TLS handshaking: Connection closed, session=<IW1ZTkxFdB1BMRRE>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.215.74.195
country_id: 2661886
description:
2025-12-06 23:30:53 dovecot_plain authenticator failed for 217-215-74-195-no2620.tbcn.telia.com (idalty) [217.215.74.195]:59916: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.147.45
country_id: 99237
description:
2025-12-06 23:36:08 dovecot_plain authenticator failed for (nonia) [65.20.147.45]:55895: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.0.54.119
country_id: 2510769
description:
2025-12-06 23:38:54 dovecot_plain authenticator failed for (inizer) [81.0.54.119]:48982: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.160.107
country_id: 99237
description:
2025-12-06 23:40:35 dovecot_plain authenticator failed for (propy) [65.20.160.107]:60416: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.161.138.244
country_id: 3144096
description:
2025-12-06 23:42:49 dovecot_login authenticator failed for 244.79-161-138.customer.lyse.net [79.161.138.244]:44926: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.173.254.153
country_id: 3469034
description:
2025-12-06 23:42:53 dovecot_login authenticator failed for ([45.173.254.224]) [45.173.254.153]:45579: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.136.176.12
country_id: 2510769
description:
2025-12-06 23:43:31 dovecot_login authenticator failed for ([83.136.176.12]) [83.136.176.12]:54920: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.195.240.154
country_id: 1269750
description:
2025-12-06 23:43:00 dovecot_login authenticator failed for (static-154.240.195.14-tataidc.co.in) [14.195.240.154]:64006: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.226.118.0
country_id: 3469034
description:
2025-12-06 23:43:19 dovecot_login authenticator failed for ([38.226.118.9]) [38.226.118.0]:58064: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.146.45
country_id: 1733045
description:
2025-12-06 23:43:19 dovecot_login authenticator failed for ([49.124.146.45]) [49.124.146.45]:42468: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.161.27.82
country_id: 6252001
description:
2025-12-06 23:45:34 dovecot_plain authenticator failed for c-174-161-27-82.hsd1.tn.comcast.net (cress) [174.161.27.82]:58286: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.183.74.177
country_id: 6252001
description:
2025-12-06 23:45:38 dovecot_plain authenticator failed for c-73-183-74-177.hsd1.pa.comcast.net (rainizes) [73.183.74.177]:57064: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  6 23:49:48 host2 sshd[1693886]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.225.30.107
country_id: 2661886
description:
2025-12-06 23:51:26 dovecot_plain authenticator failed for 81-225-30-107-no2380.tbcn.telia.com (micorrabow) [81.225.30.107]:53061: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 31.14.32.7
country_id: 2750405
description:
Dec  6 23:54:41 host2 dovecot[2150]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 1 secs): user=<>, rip=31.14.32.7, lip=66.85.158.92, TLS, session=<j9H1rExFbYwfDiAH>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-06 23:55:46 +0530] info [cpaneld] 213.209.143.251 - ajssta "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajssta (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.235.225.181
country_id: 6252001
description:
2025-12-06 23:56:10 dovecot_plain authenticator failed for c-71-235-225-181.hsd1.ct.comcast.net (eleminad) [71.235.225.181]:44166: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.57.105
country_id: 953987
description:
Dec  6 23:58:26 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 23 secs): user=<587hr>, method=PLAIN, rip=102.129.57.105, lip=66.85.158.91, TLS, session=<cpf9uExFMKZmgTlp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.73.237
country_id: 3469034
description:
Dec  6 23:57:59 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=187.120.73.237, lip=66.85.158.91, TLS, session=<IWqQt0xFdoy7eEnt>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-07 00:05:00 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (emboutanic) [87.103.126.54]:16138: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  7 00:07:06 host2 dovecot[2150]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@agronatureholdings.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<y5s+2UxF+qgXXz9j>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.31.15.108
country_id: 290557
description:
2025-12-07 00:07:18 dovecot_plain authenticator failed for (trood) [5.31.15.108]:48010: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.169.49.231
country_id: 6252001
description:
Dec  7 00:20:01 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.169.49.231, lip=66.85.158.92, session=<nvSKB01FdM0UqTHn>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.222.54
country_id: 1269750
description:
2025-12-07 00:24:56 dovecot_login authenticator failed for (aes-static-089.140.22.125.airtel.in) [122.187.222.54]:53680: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.20.228.20
country_id: 1269750
description:
2025-12-07 00:25:14 dovecot_login authenticator failed for ([157.20.228.20]) [157.20.228.20]:39653: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-07 00:26:52 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:51801: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.161.27.82
country_id: 6252001
description:
2025-12-07 00:29:21 dovecot_plain authenticator failed for c-174-161-27-82.hsd1.tn.comcast.net (kispaying) [174.161.27.82]:43862: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.23.125.83
country_id: 6252001
description:
2025-12-07 00:30:10 dovecot_plain authenticator failed for c-24-23-125-83.hsd1.pa.comcast.net (pirium) [24.23.125.83]:33490: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.169.105.51
country_id: 6252001
description:
Dec  7 00:34:03 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.169.105.51, lip=66.85.158.91, session=<33W4OU1FEKQUqWkz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2025-12-07 00:36:45 dovecot_plain authenticator failed for c-71-62-34-216.hsd1.va.comcast.net (terrid) [71.62.34.216]:36772: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec  7 00:38:10 host2 sshd[1735431]: Disconnected from invalid user liberty 62.60.131.157 port 31107 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 209.38.213.40
country_id: 2921044
description:
Dec  7 00:39:24 host2 dovecot[2150]: pop3-login: Disconnected: Connection closed (no auth attempts in 30 secs): user=<>, rip=209.38.213.40, lip=66.85.158.91, TLS handshaking: Connection closed, session=<7afVTE1FTqzRJtUo>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  7 00:42:37 host2 sshd[1739645]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.243.174
country_id: 732800
description:
2025-12-07 00:42:33 dovecot_plain authenticator failed for (mised) [92.62.243.174]:54173: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec  7 00:45:45 host2 sshd[1742820]: Disconnected from invalid user liberty 62.60.131.157 port 20870 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.184.162
country_id: 3144096
description:
2025-12-07 00:48:23 dovecot_login authenticator failed for (cm-178.232.184.162.get.no) [178.232.184.162]:36951: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.170.50.2
country_id: 3932488
description:
2025-12-07 00:48:36 dovecot_login authenticator failed for ([45.170.50.2]) [45.170.50.2]:35978: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.134.45.64
country_id: 6252001
description:
2025-12-07 00:48:53 dovecot_login authenticator failed for (syn-174-134-045-064.res.spectrum.com) [174.134.45.64]:54864: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.191.242.247
country_id: 6252001
description:
2025-12-07 00:48:57 dovecot_login authenticator failed for wsip-184-191-242-247.fv.ks.cox.net [184.191.242.247]:35955: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.161.172
country_id: 3144096
description:
2025-12-07 00:49:03 dovecot_login authenticator failed for (172-161-97-62.cust.smartcall.no) [62.97.161.172]:36722: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.27.32.70
country_id: 6252001
description:
2025-12-07 00:49:15 dovecot_login authenticator failed for syn-137-027-032-070.biz.spectrum.com [137.27.32.70]:60560: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  7 00:50:35 host2 dovecot[2150]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@bostonlanka.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<hDW8dE1Fcr8XXz9j>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.63.10
country_id: 1269750
description:
2025-12-07 00:52:46 dovecot_login authenticator failed for ([182.95.25.234]) [182.95.63.10]:42790: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.29.26
country_id: 3144096
description:
2025-12-07 00:53:00 dovecot_login authenticator failed for (cm-178.232.29.26.get.no) [178.232.29.26]:35448: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.13.69
country_id: 3144096
description:
2025-12-07 00:55:00 dovecot_login authenticator failed for (cm-84.211.13.69.get.no) [84.211.13.69]:53404: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-07 00:55:12 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (cobier) [87.103.126.54]:42708: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.165.78.31
country_id: 1819730
description:
2025-12-07 00:55:33 dovecot_login authenticator failed for ([69.165.78.31]) [69.165.78.31]:42636: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2025-12-07 00:55:37 dovecot_plain authenticator failed for (gotlescii) [64.72.74.162]:51725: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.202.195.148
country_id: 6251999
description:
2025-12-07 00:56:52 dovecot_login authenticator failed for ([209.202.195.148]) [209.202.195.148]:47844: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.201.31
country_id: 3144096
description:
2025-12-07 00:57:13 dovecot_login authenticator failed for (cm-178.232.201.31.get.no) [178.232.201.31]:40750: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.123.46
country_id: 1269750
description:
2025-12-07 01:02:37 dovecot_login authenticator failed for ([182.95.123.46]) [182.95.123.46]:42622: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.222.149.239
country_id: 6251999
description:
2025-12-07 01:02:20 dovecot_login authenticator failed for host-24-222-149-239.public.eastlink.ca [24.222.149.239]:38945: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.72.176.66
country_id: 2542007
description:
2025-12-07 01:06:35 dovecot_plain authenticator failed for (gasheury) [105.72.176.66]:39118: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 89.186.8.230
country_id: 798544
description:
Dec  7 01:12:30 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@jrdc.lk>, method=PLAIN, rip=89.186.8.230, lip=66.85.158.91, TLS, session=<RHpAwk1FUONZugjm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.191.12
country_id: 99237
description:
2025-12-07 01:12:40 dovecot_plain authenticator failed for (prosite) [65.20.191.12]:56863: 535 Incorrect authentication data (set_id=sysnytech@sysnytech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.212.19.14
country_id: 2510769
description:
Dec  7 01:12:48 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=188.212.19.14, lip=66.85.158.91, TLS, session=<gx5Sw01FXpy81BMO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.56.196
country_id: 953987
description:
Dec  7 01:18:38 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@systemtec.lk>, method=PLAIN, rip=102.129.56.196, lip=66.85.158.91, TLS, session=<Du4M2E1FnqVmgTjE>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 95.0.32.181
country_id: 298795
description:
Dec  7 01:18:57 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=95.0.32.181, lip=66.85.158.91, TLS, session=<bD9G2U1FZMtfACC1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 203.55.131.4
country_id: 6252001
description:
Dec  7 01:26:27 host2 dovecot[2150]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=203.55.131.4, lip=66.85.158.91, TLS: Connection closed, session=<U8wf9U1FZsrLN4ME>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.114.21.51
country_id: 2328926
description:
2025-12-07 01:34:57 dovecot_plain authenticator failed for (convibry) [105.114.21.51]:36821: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.233.21.109
country_id: 272103
description:
2025-12-07 01:38:08 dovecot_login authenticator failed for ([109.233.21.109]) [109.233.21.109]:47878: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.52.119.193
country_id: 6252001
description:
2025-12-07 01:38:21 dovecot_plain authenticator failed for c-68-52-119-193.hsd1.tn.comcast.net (coettecic) [68.52.119.193]:37042: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.146.167
country_id: 3996063
description:
2025-12-07 01:38:23 dovecot_login authenticator failed for ([177.236.146.167]) [177.236.146.167]:52043: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  7 01:40:45 host2 sshd[1798017]: Disconnected from invalid user user 2.57.121.25 port 48610 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  7 01:43:49 host2 sshd[1800785]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.64.150
country_id: 1269750
description:
2025-12-07 01:45:45 dovecot_login authenticator failed for (nsg-corporate-73.22.185.122.airtel.in) [182.78.64.150]:35642: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
country_id: 6252001
description:
2025-12-07 01:49:15 dovecot_plain authenticator failed for (oussed) [24.187.213.29]:36964: 535 Incorrect authentication data (set_id=sysnytech@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.1.200.187
country_id: 6252001
description:
2025-12-07 01:51:48 dovecot_plain authenticator failed for c-24-1-200-187.hsd1.il.comcast.net (belierish) [24.1.200.187]:53424: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.225.30.107
country_id: 2661886
description:
2025-12-07 01:57:43 dovecot_plain authenticator failed for 81-225-30-107-no2380.tbcn.telia.com (mully) [81.225.30.107]:35157: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.183.74.177
country_id: 6252001
description:
2025-12-07 01:59:13 dovecot_plain authenticator failed for c-73-183-74-177.hsd1.pa.comcast.net (pyrmang) [73.183.74.177]:46662: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.161.27.82
country_id: 6252001
description:
2025-12-07 02:05:44 dovecot_plain authenticator failed for c-174-161-27-82.hsd1.tn.comcast.net (iniaculass) [174.161.27.82]:51486: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.250
country_id: 1036973
description:
2025-12-07 02:05:55 dovecot_login authenticator failed for ([197.219.228.250]) [197.219.228.250]:52968: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.158
country_id: 1269750
description:
2025-12-07 02:06:16 dovecot_login authenticator failed for ([125.19.175.68]) [152.52.236.158]:40868: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-07 02:07:40 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (unret) [87.103.126.54]:50303: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.170.46
country_id: 3175395
description:
Dec  7 02:08:12 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=185.15.170.46, lip=66.85.158.91, TLS, session=<g+1YiU5FmpG5D6ou>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.240.36.92
country_id: 3469034
description:
Dec  7 02:08:32 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=191.240.36.92, lip=66.85.158.91, TLS, session=<uP+Kik5Fp6i/8CRc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.172.54.29
country_id: 6252001
description:
2025-12-07 02:10:33 dovecot_plain authenticator failed for c-67-172-54-29.hsd1.pa.comcast.net (atens) [67.172.54.29]:46274: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 194.165.16.163
country_id: 2993457
description:
Dec  7 02:10:34 host2 pure-ftpd[1830955]: (?@194.165.16.163) [INFO] New connection from 194.165.16.163


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  7 02:10:41 host2 dovecot[2150]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ayuzonelanka.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<Wbg1k05FFtkXXz9j>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 103.178.191.18
country_id: 1210997
description:
Dec  7 02:17:14 host2 pure-ftpd[1839285]: (?@103.178.191.18) [INFO] New connection from 103.178.191.18


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 103.178.191.18
country_id: 1210997
description:
Dec  7 02:21:45 host2 pure-ftpd[1843934]: (?@103.178.191.18) [INFO] New connection from 103.178.191.18


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.1.200.187
country_id: 6252001
description:
2025-12-07 02:26:13 dovecot_plain authenticator failed for c-24-1-200-187.hsd1.il.comcast.net (slable) [24.1.200.187]:43410: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.169.224.27
country_id: 6252001
description:
2025-12-07 02:26:16 dovecot_plain authenticator failed for c-174-169-224-27.hsd1.vt.comcast.net (mated) [174.169.224.27]:54938: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 81.189.162.142
country_id: 2782113
description:
Dec  7 02:28:27 host2 dovecot[2150]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=81.189.162.142, lip=66.85.158.91, session=<FbS80k5F3o9RvaKO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.224.152.12
country_id: 3175395
description:
2025-12-07 02:31:23 dovecot_plain authenticator failed for (mutize) [83.224.152.12]:44750: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  7 02:36:18 host2 sshd[1859406]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.70.134
country_id: 1819730
description:
2025-12-07 02:36:28 dovecot_login authenticator failed for 42-200-70-134.static.imsbiz.com [42.200.70.134]:58621: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.113.86
country_id: 1269750
description:
2025-12-07 02:37:03 dovecot_login authenticator failed for ([27.123.113.86]) [27.123.113.86]:36568: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-07 02:41:49 +0530] info [cpaneld] 213.209.143.251 - agro "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agro (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.145.107.251
country_id: 6252001
description:
2025-12-07 02:43:04 dovecot_plain authenticator failed for c-73-145-107-251.hsd1.mi.comcast.net (kamideroes) [73.145.107.251]:57020: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.159
country_id: 3144096
description:
2025-12-07 02:44:00 dovecot_login authenticator failed for ([84.213.189.159]) [84.213.189.159]:44235: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.130.152.109
country_id: 2510769
description:
2025-12-07 02:44:20 dovecot_login authenticator failed for 109.82-130-152.dynamic.clientes.euskaltel.es [82.130.152.109]:33606: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-07 02:45:15 +0530] info [cpaneld] 213.209.143.251 - ajss "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajss (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.188.251
country_id: 290557
description:
2025-12-07 02:48:11 dovecot_plain authenticator failed for (bactoutess) [91.73.188.251]:41416: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.235.225.181
country_id: 6252001
description:
2025-12-07 02:48:13 dovecot_plain authenticator failed for c-71-235-225-181.hsd1.ct.comcast.net (pareptight) [71.235.225.181]:33348: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.251.100.110
country_id: 1819730
description:
[2025-12-07 02:47:47 +0530] info [webmaild] 196.251.100.110 - - "POST /cpsess0130295740/3rdparty/roundcube/:2087/json-api/create_user_session HTTP/1.1" FAILED LOGIN webmaild: user name not provided or invalid user


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.192
country_id: 6252001
description:
Dec  7 02:50:39 host2 dovecot[2150]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=147.185.132.192, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<9f43Ik9FH8GTuYTA>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.142.126.37
country_id: 6252001
description:
2025-12-07 02:55:10 dovecot_plain authenticator failed for c-69-142-126-37.hsd1.nj.comcast.net (aping) [69.142.126.37]:49286: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  7 03:02:39 host2 sshd[1890235]: Disconnected from invalid user user 2.57.121.25 port 15449 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.243
country_id: 6252001
description:
Dec  7 03:03:34 host2 dovecot[2150]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.243, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<db9qUE9FP8LN0h/z>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.88.102.128
country_id: 2661886
description:
2025-12-07 03:07:21 dovecot_login authenticator failed for ([80.88.102.128]) [80.88.102.128]:50356: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.240.36.254
country_id: 3469034
description:
Dec  7 03:06:44 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@jrdc.lk>, method=PLAIN, rip=191.240.36.254, lip=66.85.158.91, TLS, session=<0kK2Wk9FNMW/8CT+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.103.171.192
country_id: 798544
description:
Dec  7 03:07:02 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=176.103.171.192, lip=66.85.158.91, TLS, session=<WWXVW09FcLOwZ6vA>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.210.105.202
country_id: 3175395
description:
2025-12-07 03:07:53 dovecot_login authenticator failed for 95-210-105-202.ip.skylogicnet.com [95.210.105.202]:5997: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.162.242
country_id: 2186224
description:
2025-12-07 03:08:18 dovecot_login authenticator failed for ([121.73.162.242]) [121.73.162.242]:40972: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.167.146
country_id: 6252001
description:
2025-12-07 03:10:25 dovecot_login authenticator failed for ([70.174.167.146]) [70.174.167.146]:39113: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.143.159
country_id: 99237
description:
2025-12-07 03:10:40 dovecot_login authenticator failed for ([65.20.143.159]) [65.20.143.159]:44453: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.30.83.126
country_id: 1269750
description:
Dec  7 03:12:50 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@systemtec.lk>, method=PLAIN, rip=103.30.83.126, lip=66.85.158.91, TLS, session=<bHd0cE9F5NdnHlN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.46.71
country_id: 953987
description:
Dec  7 03:13:13 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info>, method=PLAIN, rip=102.64.46.71, lip=66.85.158.91, TLS, session=<GD24cU9FJrpmQC5H>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.235.31.47
country_id: 6252001
description:
Dec  7 03:15:13 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=50.235.31.47, lip=66.85.158.91, session=<hxXmeU9FoI8y6x8v>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 41.140.76.129
country_id: 2542007
description:
[2025-12-07 03:15:33 +0530] info [cpaneld] 41.140.76.129 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 24.104.225.201
country_id: 6252001
description:
Dec  7 03:15:40 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (auth failed, 2 attempts in 19 secs): user=<hr@lezzarotech.com>, method=LOGIN, rip=24.104.225.201, lip=66.85.158.91, session=<cMeSek9FLuAYaOHJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 24.97.253.246
country_id: 6252001
description:
Dec  7 03:15:54 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (auth failed, 2 attempts in 13 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=24.97.253.246, lip=66.85.158.91, TLS, session=<Z+TCe09FiIoYYf32>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 69.126.144.30
country_id: 6252001
description:
Dec  7 03:16:20 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<hr>, method=PLAIN, rip=69.126.144.30, lip=66.85.158.91, session=<7InYfU9FZfdFfpAe>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 167.94.146.50
country_id: 6252001
description:
Dec  7 03:17:01 host2 pure-ftpd[1905459]: (?@167.94.146.50) [INFO] New connection from 167.94.146.50


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 36.64.30.151
country_id: 1643084
description:
Dec  7 03:16:47 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 23 secs): user=<hr>, method=PLAIN, rip=36.64.30.151, lip=66.85.158.91, TLS, session=<9GVXfk9FCpUkQB6X>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.195.211.98
country_id: 6252001
description:
2025-12-07 03:21:37 dovecot_plain authenticator failed for c-73-195-211-98.hsd1.nj.comcast.net (saling) [73.195.211.98]:42000: 535 Incorrect authentication data (set_id=sysnytech@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.239.157.41
country_id: 357994
description:
2025-12-07 03:22:29 dovecot_plain authenticator failed for (gaurpoed) [41.239.157.41]:57216: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.145.10.140
country_id: 6252001
description:
2025-12-07 03:24:50 dovecot_plain authenticator failed for c-76-145-10-140.hsd1.ga.comcast.net (sunmucures) [76.145.10.140]:51100: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.81
country_id: 6252001
description:
Dec  7 03:25:49 host2 dovecot[2150]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=147.185.132.81, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<3FAFoE9FiseTuYRR>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.125.21.10
country_id: 3469034
description:
2025-12-07 03:28:10 dovecot_login authenticator failed for ([177.125.22.55]) [177.125.21.10]:44204: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.15.90
country_id: 1149361
description:
2025-12-07 03:27:47 dovecot_login authenticator failed for ([149.54.15.90]) [149.54.15.90]:45189: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  7 03:29:21 host2 sshd[1917396]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  7 03:29:55 host2 sshd[1918345]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.221
country_id: 6252001
description:
Dec  7 03:30:47 host2 dovecot[2150]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=205.210.31.221, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<AGPFsU9F/87N0h/d>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  7 03:35:18 host2 dovecot[2150]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ayuzonelanka.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<lEnOwU9FOIwXXz9j>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  7 03:36:58 host2 sshd[1927216]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.191.118
country_id: 3144096
description:
2025-12-07 03:37:12 dovecot_login authenticator failed for (cm-178.232.191.118.get.no) [178.232.191.118]:50399: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.191.74.151
country_id: 6252001
description:
2025-12-07 03:36:54 dovecot_login authenticator failed for ([172.191.74.151]) [172.191.74.151]:44564: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.53.38.51
country_id: 6251999
description:
2025-12-07 03:39:53 dovecot_plain authenticator failed for (unignessis) [24.53.38.51]:36792: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.248.4.85
country_id: 1269750
description:
2025-12-07 03:42:29 dovecot_login authenticator failed for ([115.248.153.209]) [115.248.4.85]:57273: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.34.49
country_id: 1269750
description:
2025-12-07 03:43:10 dovecot_login authenticator failed for ([103.174.34.49]) [103.174.34.49]:50021: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  7 03:43:54 host2 sshd[1934533]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.199.161.144
country_id: 6252001
description:
2025-12-07 03:44:51 dovecot_plain authenticator failed for c-73-199-161-144.hsd1.nj.comcast.net (obrat) [73.199.161.144]:49128: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  7 03:48:16 host2 dovecot[2150]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@askinternationalconsortium.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<sz4w8E9FiMwXXz9j>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec  7 03:48:48 host2 sshd[1942588]: Disconnected from invalid user admin 2.57.121.112 port 43852 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  7 03:52:29 host2 sshd[1946794]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.105.248.218
country_id: 6252001
description:
2025-12-07 03:54:06 dovecot_plain authenticator failed for (poson) [24.105.248.218]:35128: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.9.22.30
country_id: 1643084
description:
2025-12-07 03:54:19 dovecot_login authenticator failed for ([114.9.22.30]) [114.9.22.30]:50170: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.186.54.65
country_id: 298795
description:
2025-12-07 03:53:39 dovecot_login authenticator failed for ([78.186.54.65]) [78.186.54.65]:53728: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.191.242.250
country_id: 6252001
description:
2025-12-07 03:53:44 dovecot_login authenticator failed for wsip-184-191-242-250.fv.ks.cox.net [184.191.242.250]:46969: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.76.194.159
country_id: 6252001
description:
2025-12-07 03:53:46 dovecot_login authenticator failed for pool-72-76-194-159.nwrknj.fios.verizon.net [72.76.194.159]:42154: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.196.233
country_id: 3996063
description:
2025-12-07 03:53:57 dovecot_login authenticator failed for ([201.173.196.233]) [201.173.196.233]:56493: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.58.241.90
country_id: 3469034
description:
2025-12-07 03:54:02 dovecot_login authenticator failed for (ccabv.org.cta.gvt.net.br) [187.58.241.90]:39511: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec  7 03:54:43 host2 sshd[1950434]: Disconnected from invalid user admin 2.57.121.112 port 51043 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-07 03:55:43 +0530] info [cpaneld] 213.209.143.251 - 2stravel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.0.54.119
country_id: 2510769
description:
2025-12-07 03:56:33 dovecot_plain authenticator failed for (arping) [81.0.54.119]:48296: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.239.157.41
country_id: 357994
description:
2025-12-07 03:56:36 dovecot_plain authenticator failed for (unanced) [41.239.157.41]:32832: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 194.165.16.164
country_id: 2993457
description:
Dec  7 03:58:05 host2 pure-ftpd[1954758]: (?@194.165.16.164) [INFO] New connection from 194.165.16.164


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.23.158.157
country_id: 6252001
description:
Dec  7 03:58:11 host2 sshd[1954856]: Invalid user cloudtourssrilan_travel from 64.23.158.157 port 33974


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.23.158.157
country_id: 6252001
description:
Dec  7 03:59:05 host2 sshd[1955899]: Invalid user cloudtourssrilan_travel from 64.23.158.157 port 51212


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.167.145
country_id: 6252001
description:
2025-12-07 04:01:12 dovecot_login authenticator failed for ([70.174.167.145]) [70.174.167.145]:52382: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
country_id: 6252001
description:
2025-12-07 04:01:40 dovecot_login authenticator failed for (made-again.tmesis.com) [24.187.213.29]:42950: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.238.166.165
country_id: 798544
description:
Dec  7 04:02:13 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=91.238.166.165, lip=66.85.158.91, TLS, session=<JnQuIVBFHetb7qal>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.87.118.132
country_id: 3469034
description:
Dec  7 04:02:34 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=177.87.118.132, lip=66.85.158.91, TLS, session=<se1kIlBFEMmxV3aE>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  7 04:03:13 host2 sshd[1959599]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.6.216
country_id: 3144096
description:
2025-12-07 04:04:54 dovecot_login authenticator failed for ([178.232.6.216]) [178.232.6.216]:37797: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.161.159
country_id: 3144096
description:
2025-12-07 04:05:11 dovecot_login authenticator failed for (159-161-97-62.cust.smartcall.no) [62.97.161.159]:33592: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.122
country_id: 1269750
description:
2025-12-07 04:07:10 dovecot_login authenticator failed for ([125.16.31.25]) [152.52.236.122]:59244: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.116.22
country_id: 1861060
description:
Dec  7 04:06:45 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=139.162.116.22, lip=66.85.158.92, TLS: Connection closed, session=<vFpmMlBFuLCLonQW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.65.99
country_id: 3144096
description:
2025-12-07 04:06:53 dovecot_login authenticator failed for (cm-178.232.65.99.get.no) [178.232.65.99]:45870: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 20.64.105.244
country_id: 6252001
description:
Dec  7 04:09:12 host2 pure-ftpd[1966630]: (?@20.64.105.244) [INFO] New connection from 20.64.105.244


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.30.183.186
country_id: 1643084
description:
[2025-12-07 04:09:54 +0530] info [cpaneld] 103.30.183.186 - lezzarot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarot (has_cpuser_file failed)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  7 04:15:17 host2 sshd[1973132]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.240.236.109
country_id: 6252001
description:
Dec  7 04:15:02 host2 pure-ftpd[1973979]: (?@66.240.236.109) [INFO] New connection from 66.240.236.109


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  7 04:15:43 host2 sshd[1973999]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.102.50
country_id: 1269750
description:
2025-12-07 04:18:33 dovecot_login authenticator failed for (nsg-static-145.58.71.182.airtel.in) [27.123.102.50]:56668: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.124.129.182
country_id: 3144096
description:
2025-12-07 04:18:59 dovecot_login authenticator failed for ([188.124.129.182]) [188.124.129.182]:53864: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-07 04:22:15 +0530] info [cpaneld] 213.209.143.251 - agronatu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agronatu (has_cpuser_file failed)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  7 04:22:42 host2 sshd[1983364]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.178.103.158
country_id: 6252001
description:
Dec  7 04:23:57 host2 sshd[1985999]: Invalid user cloudtourssrilan_travel from 107.178.103.158 port 5053


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.178.103.158
country_id: 6252001
description:
Dec  7 04:26:00 host2 sshd[1988885]: Invalid user cloudtourssrilan_travel from 107.178.103.158 port 10014


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-07 04:26:32 +0530] info [cpaneld] 213.209.143.251 - ajsstarl "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajsstarl (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-07 04:27:32 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:63768: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  7 04:29:10 host2 sshd[1993340]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.75.110
country_id: 1149361
description:
2025-12-07 04:30:32 dovecot_login authenticator failed for ([180.94.75.110]) [180.94.75.110]:60592: 535 Incorrect authentication data (set_id=test@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.6.81.59
country_id: 1880251
description:
2025-12-07 04:30:49 dovecot_login authenticator failed for bb121-6-81-59.singnet.com.sg [121.6.81.59]:33254: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.193.112.85
country_id: 6252001
description:
2025-12-07 04:31:46 dovecot_plain authenticator failed for c-98-193-112-85.hsd1.il.comcast.net (worner) [98.193.112.85]:50746: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.129.28
country_id: 99237
description:
2025-12-07 04:32:26 dovecot_plain authenticator failed for (besslumpy) [65.20.129.28]:33450: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  7 04:35:02 host2 sshd[2000515]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.79
country_id: 6252001
description:
Dec  7 04:35:05 host2 pure-ftpd[2001700]: (?@147.185.132.79) [INFO] New connection from 147.185.132.79


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.182.99.92
country_id: 1655842
description:
2025-12-07 04:35:11 dovecot_login authenticator failed for ([183.182.99.92]) [183.182.99.92]:40350: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2025-12-07 04:35:23 dovecot_login authenticator failed for ([102.53.15.56]) [102.53.15.56]:51775: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.237.47.214
country_id: 3996063
description:
2025-12-07 04:34:57 dovecot_login authenticator failed for (customer-187-237-47-214.uninet-ide.com.mx) [187.237.47.214]:48271: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.233.140.250
country_id: 3469034
description:
2025-12-07 04:35:06 dovecot_login authenticator failed for ([181.233.140.250]) [181.233.140.250]:36696: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.222
country_id: 1819730
description:
2025-12-07 04:35:17 dovecot_login authenticator failed for 222.42.246.220.static.netvigator.com [220.246.42.222]:62982: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.57.184.151
country_id: 1269750
description:
2025-12-07 04:34:42 dovecot_login authenticator failed for ([103.57.184.151]) [103.57.184.151]:51528: 535 Incorrect authentication data


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  7 04:35:44 host2 sshd[2001267]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.177.30.53
country_id: 6252001
description:
2025-12-07 04:37:24 dovecot_plain authenticator failed for c-66-177-30-53.hsd1.fl.comcast.net (dulank) [66.177.30.53]:43076: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  7 04:42:27 host2 sshd[2009747]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.62.224.44
country_id: 3017382
description:
2025-12-07 04:44:15 dovecot_plain authenticator failed for ftp-mutu001.plug-it.com (mistriess) [185.62.224.44]:52990: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.52.119.193
country_id: 6252001
description:
2025-12-07 04:45:06 dovecot_plain authenticator failed for c-68-52-119-193.hsd1.tn.comcast.net (husies) [68.52.119.193]:48988: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  7 04:47:49 host2 sshd[2017810]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.201
country_id: 2635167
description:
Dec  7 04:51:16 host2 dovecot[2150]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=35.203.211.201, lip=66.85.158.91, session=<kzKT0VBFWuYjy9PJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.180
country_id: 2542007
description:
2025-12-07 04:53:31 dovecot_plain authenticator failed for (durimal) [102.53.15.180]:56875: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  7 04:55:18 host2 sshd[2025189]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.63.206
country_id: 1269750
description:
2025-12-07 04:55:14 dovecot_login authenticator failed for (nsg-static-113.51.72.182.airtel.in) [182.95.63.206]:54776: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.124.142.221
country_id: 3144096
description:
2025-12-07 04:55:24 dovecot_login authenticator failed for ([188.124.142.221]) [188.124.142.221]:57419: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.153.27
country_id: 3144096
description:
2025-12-07 04:55:29 dovecot_login authenticator failed for (cm-178.232.153.27.get.no) [178.232.153.27]:53904: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  7 04:55:37 host2 sshd[2025754]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.102.50
country_id: 1269750
description:
2025-12-07 04:56:19 dovecot_login authenticator failed for ([27.123.102.50]) [27.123.102.50]:49568: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.200.93.86
country_id: 290557
description:
2025-12-07 04:55:40 dovecot_login authenticator failed for ([87.200.93.86]) [87.200.93.86]:43018: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.75.42
country_id: 1149361
description:
2025-12-07 04:55:54 dovecot_login authenticator failed for ([180.94.75.42]) [180.94.75.42]:52156: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.230.228.16
country_id: 6252001
description:
2025-12-07 04:59:44 dovecot_plain authenticator failed for c-71-230-228-16.hsd1.de.comcast.net (veled) [71.230.228.16]:40512: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  7 05:00:57 host2 sshd[2031450]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.169.120.37
country_id: 1668284
description:
2025-12-07 05:01:13 dovecot_login authenticator failed for ([192.169.120.37]) [192.169.120.37]:53401: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.161.159
country_id: 3144096
description:
2025-12-07 05:01:33 dovecot_login authenticator failed for (159-161-97-62.cust.smartcall.no) [62.97.161.159]:60993: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.136
country_id: 6252001
description:
Dec  7 05:03:55 host2 dovecot[2150]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.136, lip=66.85.158.91, TLS: Connection closed, session=<ex7f/lBFUrhChJmI>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  7 05:07:18 host2 sshd[2037632]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  7 05:07:44 host2 sshd[2038087]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.93
country_id: 6252001
description:
Dec  7 05:09:54 host2 dovecot[2150]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=147.185.132.93, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<J8Q3FFFFAsSTuYRd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.101.16.250
country_id: 272103
description:
2025-12-07 05:10:13 dovecot_login authenticator failed for ([185.101.16.250]) [185.101.16.250]:36989: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.228.11.195
country_id: 6252001
description:
2025-12-07 05:10:29 dovecot_plain authenticator failed for c-71-228-11-195.hsd1.il.comcast.net (mawismies) [71.228.11.195]:34170: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 195.184.76.96
country_id: 6252001
description:
Dec  7 05:11:42 host2 pure-ftpd[2042199]: (?@195.184.76.96) [INFO] New connection from 195.184.76.96


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 195.184.76.101
country_id: 6252001
description:
Dec  7 05:11:42 host2 pure-ftpd[2042193]: (?@195.184.76.101) [INFO] New connection from 195.184.76.101


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.246.59.113
country_id: 6252001
description:
[2025-12-07 05:12:38 +0530] info [whostmgrd] 98.246.59.113 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  7 05:18:14 host2 sshd[2048657]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  7 05:18:43 host2 sshd[2049233]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.193.112.85
country_id: 6252001
description:
2025-12-07 05:21:02 dovecot_plain authenticator failed for c-98-193-112-85.hsd1.il.comcast.net (avoking) [98.193.112.85]:38164: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.102.242
country_id: 290557
description:
2025-12-07 05:28:38 dovecot_plain authenticator failed for (hablete) [80.227.102.242]:38500: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  7 05:29:43 host2 sshd[2061852]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.153
country_id: 2186224
description:
2025-12-07 05:29:52 dovecot_login authenticator failed for ([121.73.169.153]) [121.73.169.153]:37170: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.197.178
country_id: 1269750
description:
2025-12-07 05:29:32 dovecot_login authenticator failed for ([128.185.197.178]) [128.185.197.178]:42464: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 92.62.243.154
country_id: 732800
description:
Dec  7 05:34:13 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=92.62.243.154, lip=66.85.158.91, TLS, session=<EzkqalFF+9RcPvOa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.181.89.45
country_id: 3865483
description:
Dec  7 05:33:54 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=190.181.89.45, lip=66.85.158.91, TLS, session=<xETqaFFF9IC+tVkt>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.54
country_id: 6252001
description:
Dec  7 05:34:45 host2 dovecot[2150]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=167.94.146.54, lip=66.85.158.92, TLS: Connection closed, session=<XG4cbVFFwoWnXpI2>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  7 05:35:38 host2 sshd[2067415]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-07 05:38:51 +0530] info [cpaneld] 213.209.143.251 - 2strav "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.89.143.122
country_id: 2635167
description:
2025-12-07 05:41:25 dovecot_login authenticator failed for ([77.89.143.122]) [77.89.143.122]:51512: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
country_id: 3932488
description:
2025-12-07 05:41:48 dovecot_login authenticator failed for ([190.117.96.174]) [190.117.96.174]:53882: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  7 05:44:44 host2 sshd[2075663]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  7 05:45:31 host2 sshd[2076681]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.15.90
country_id: 1149361
description:
2025-12-07 05:47:17 dovecot_login authenticator failed for ([149.54.15.90]) [149.54.15.90]:43215: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.13.139.61
country_id: 2510769
description:
2025-12-07 05:47:37 dovecot_login authenticator failed for 61.red-88-13-139.dynamicip.rima-tde.net [88.13.139.61]:43946: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.97.190.237
country_id: 6252001
description:
2025-12-07 05:48:30 dovecot_plain authenticator failed for (accise) [75.97.190.237]:33936: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2025-12-07 05:48:35 dovecot_plain authenticator failed for host-196-47-172-253.afnet.net (kinald) [196.47.172.253]:39382: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.122.97.185
country_id: 3996063
description:
Dec  7 05:53:28 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=138.122.97.185, lip=66.85.158.91, TLS, session=<553jrlFF1L2KemG5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.1.200.187
country_id: 6252001
description:
2025-12-07 05:53:02 dovecot_plain authenticator failed for c-24-1-200-187.hsd1.il.comcast.net (unalisa) [24.1.200.187]:48924: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.71.73
country_id: 3469034
description:
Dec  7 05:53:06 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@systemtec.lk>, method=PLAIN, rip=177.44.71.73, lip=66.85.158.91, TLS, session=<LLyJrVFF59ixLEdJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.218.95.154
country_id: 6252001
description:
2025-12-07 05:53:16 dovecot_plain authenticator failed for syn-074-218-095-154.biz.spectrum.com (penturuss) [74.218.95.154]:60562: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 171.22.234.166
country_id: 3175395
description:
Dec  7 05:53:58 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=171.22.234.166, lip=66.85.158.91, TLS, session=<3mDbsFFFJZyrFuqm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.96.199
country_id: 3469034
description:
Dec  7 05:53:40 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@jrdc.lk>, method=PLAIN, rip=177.44.96.199, lip=66.85.158.91, TLS, session=<fQWZr1FF8qyxLGDH>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  7 05:54:36 host2 sshd[2086340]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.34.49
country_id: 1269750
description:
2025-12-07 05:55:27 dovecot_login authenticator failed for ([103.174.34.49]) [103.174.34.49]:53662: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-07 05:54:56 dovecot_login authenticator failed for 54.126.103.87.rev.vodafone.pt [87.103.126.54]:7132: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.195.117.220
country_id: 3017382
description:
2025-12-07 05:55:33 dovecot_plain authenticator failed for vps-f9a28e39.vps.ovh.net (chick) [51.195.117.220]:40841: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.40.189.43
country_id: 6252001
description:
2025-12-07 05:57:06 dovecot_plain authenticator failed for c-68-40-189-43.hsd1.mi.comcast.net (zated) [68.40.189.43]:35706: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.239.157.41
country_id: 357994
description:
2025-12-07 06:00:59 dovecot_plain authenticator failed for (hamal) [41.239.157.41]:47666: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.167.210
country_id: 3144096
description:
2025-12-07 06:01:33 dovecot_login authenticator failed for (210-167-97-62.cust.smartcall.no) [62.97.167.210]:58686: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.149.116
country_id: 3996063
description:
2025-12-07 06:01:46 dovecot_login authenticator failed for ([177.236.149.116]) [177.236.149.116]:45565: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  7 06:05:52 host2 sshd[2100730]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.220.169.113
country_id: 2635167
description:
2025-12-07 06:05:54 dovecot_login authenticator failed for (165-220-169-113.cust.exede.net) [165.220.169.113]:58456: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.239.182
country_id: 1269750
description:
2025-12-07 06:06:12 dovecot_login authenticator failed for (aes-static-177.143.22.125.airtel.in) [128.185.239.182]:45934: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.192.74
country_id: 1269750
description:
2025-12-07 06:07:54 dovecot_login authenticator failed for ([152.52.192.74]) [152.52.192.74]:41290: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.25.186.130
country_id: 6252001
description:
2025-12-07 06:08:12 dovecot_login authenticator failed for (173-25-186-130.client.mchsi.com) [173.25.186.130]:52798: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.13.220.220
country_id: 6252001
description:
2025-12-07 06:13:12 dovecot_plain authenticator failed for c-73-13-220-220.hsd1.de.comcast.net (callous) [73.13.220.220]:36652: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  7 06:15:51 host2 sshd[2111246]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  7 06:21:59 host2 sshd[2118182]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.30.170
country_id: 3144096
description:
2025-12-07 06:22:21 dovecot_login authenticator failed for ([178.232.30.170]) [178.232.30.170]:38893: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.102.148.242
country_id: 6252001
description:
2025-12-07 06:22:53 dovecot_login authenticator failed for syn-098-102-148-242.biz.spectrum.com [98.102.148.242]:59350: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.213.236.66
country_id: 6252001
description:
2025-12-07 06:24:47 dovecot_plain authenticator failed for c-73-213-236-66.hsd1.va.comcast.net (pacet) [73.213.236.66]:57060: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.255.209
country_id: 2542007
description:
2025-12-07 06:26:56 dovecot_login authenticator failed for ([154.144.255.209]) [154.144.255.209]:41710: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.87.248.223
country_id: 732800
description:
2025-12-07 06:27:05 dovecot_login authenticator failed for 95-87-248-223.ip.btc-net.bg [95.87.248.223]:53638: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.85.104.2
country_id: 6252001
description:
2025-12-07 06:36:29 dovecot_plain authenticator failed for (metriale) [96.85.104.2]:45208: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.31.42.170
country_id: 1821275
description:
2025-12-07 06:45:52 dovecot_login authenticator failed for (n12531z42l170.static.ctmip.net) [125.31.42.170]:43180: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.10.140
country_id: 3144096
description:
2025-12-07 06:46:33 dovecot_login authenticator failed for (cm-84.211.10.140.get.no) [84.211.10.140]:57750: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.112.148.66
country_id: 130758
description:
2025-12-07 06:48:07 dovecot_login authenticator failed for ([185.112.148.66]) [185.112.148.66]:36381: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.253.122
country_id: 1269750
description:
2025-12-07 06:48:37 dovecot_login authenticator failed for ([128.185.253.122]) [128.185.253.122]:54792: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 91.231.89.250
country_id: 3017382
description:
Dec  7 06:58:36 host2 pure-ftpd[2149059]: (?@91.231.89.250) [INFO] New connection from 91.231.89.250


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 91.231.89.153
country_id: 3017382
description:
Dec  7 06:58:37 host2 pure-ftpd[2149065]: (?@91.231.89.153) [INFO] New connection from 91.231.89.153


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec  7 07:02:17 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<0RIuplJFUsMDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec  7 07:03:07 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<r1YnqVJFRusDhBfJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.235.225.181
country_id: 6252001
description:
2025-12-07 07:04:03 dovecot_plain authenticator failed for c-71-235-225-181.hsd1.ct.comcast.net (foridia) [71.235.225.181]:52822: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec  7 07:04:46 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<wjwEr1JFcrkDhBfJ>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-07 07:05:27 +0530] info [cpaneld] 213.209.143.251 - 2str "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 199.192.123.12
country_id: 6252001
description:
2025-12-07 07:06:26 dovecot_plain authenticator failed for (sexcid) [199.192.123.12]:50570: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec  7 07:05:36 host2 dovecot[2150]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<uxQDslJFpIgDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec  7 07:06:41 host2 dovecot[2150]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<QBrktVJF8NADhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec  7 07:07:55 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<vQZGulJFnMADhBfJ>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.132.23.201
country_id: 6252001
description:
Dec  7 07:08:19 host2 dovecot[2150]: imap-login: Disconnected: Input buffer full (no auth attempts in 1 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<332zu1JF7O0DhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec  7 07:08:46 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<mZ9TvVJFGIsDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec  7 07:09:38 host2 dovecot[2150]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<nEtrwFJFMpMDhBfJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.216.68
country_id: 3996063
description:
2025-12-07 07:11:32 dovecot_login authenticator failed for (201.173.216.68-clientes-izzi.mx) [201.173.216.68]:44497: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.36
country_id: 6252001
description:
Dec  7 07:25:23 host2 dovecot[2150]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=198.235.24.36, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<2hzB+FJFSczG6xgk>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.85.104.2
country_id: 6252001
description:
2025-12-07 07:27:50 dovecot_plain authenticator failed for (fempelery) [96.85.104.2]:47934: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.169.28
country_id: 3175395
description:
Dec  7 07:27:59 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=185.15.169.28, lip=66.85.158.91, TLS, session=<VQL7AFNF1qG5D6kc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.87.115.3
country_id: 3469034
description:
Dec  7 07:28:23 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info>, method=PLAIN, rip=177.87.115.3, lip=66.85.158.91, TLS, session=<MLo9AlNFCeyxV3MD>


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 173.70.144.46
country_id: 6252001
description:
Dec  7 07:30:12 host2 sshd[2175828]: User essenceceylontea from 173.70.144.46 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.253.154
country_id: 1269750
description:
2025-12-07 07:31:17 dovecot_login authenticator failed for ([182.78.122.253]) [125.19.253.154]:51964: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.49.97.15
country_id: 6252001
description:
2025-12-07 07:31:33 dovecot_login authenticator failed for (64-49-97-15.protekweb.com) [64.49.97.15]:37476: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.68.220.15
country_id: 6252001
description:
2025-12-07 07:33:27 dovecot_plain authenticator failed for c-73-68-220-15.hsd1.ma.comcast.net (tives) [73.68.220.15]:49644: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.81.229.179
country_id: 6252001
description:
2025-12-07 07:33:24 dovecot_plain authenticator failed for (viumdines) [192.81.229.179]:55050: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-07 07:39:19 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (borermies) [87.103.126.54]:8248: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.205.208
country_id: 99237
description:
Dec  7 07:40:42 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@systemtec.lk>, method=PLAIN, rip=65.20.205.208, lip=66.85.158.91, TLS, session=<hqd8LlNFs9hBFM3Q>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.145.10.140
country_id: 6252001
description:
2025-12-07 07:40:21 dovecot_plain authenticator failed for c-76-145-10-140.hsd1.ga.comcast.net (bavinve) [76.145.10.140]:44654: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 213.209.143.251 - ajss "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajss (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.236.172.240
country_id: 798544
description:
Dec  7 07:40:59 host2 dovecot[2150]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=91.236.172.240, lip=66.85.158.91, TLS, session=<OIOVL1NFApBb7Kzw>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.161
country_id: 6252001
description:
Dec  7 07:43:35 host2 dovecot[2150]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 12 secs): user=<>, rip=147.185.132.161, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<7TPZOVNFjc+TuYSh>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.161
country_id: 6252001
description:
Dec  7 07:44:36 host2 dovecot[2150]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 7 secs): user=<>, rip=147.185.132.161, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<SgmAPVNFRPuTuYSh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.72.153.110
country_id: 290557
description:
2025-12-07 07:45:24 dovecot_plain authenticator failed for (hilly) [91.72.153.110]:35811: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.85.104.2
country_id: 6252001
description:
2025-12-07 07:45:26 dovecot_plain authenticator failed for (outiverve) [96.85.104.2]:54104: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.161
country_id: 6252001
description:
Dec  7 07:44:54 host2 dovecot[2150]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 22 secs): user=<>, rip=147.185.132.161, lip=66.85.158.91, TLS: read(size=403) failed: Connection reset by peer, session=<QYGXPlNFRvuTuYSh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.60.77.128
country_id: 6252001
description:
2025-12-07 07:48:02 dovecot_plain authenticator failed for c-68-60-77-128.hsd1.mi.comcast.net (cantogiet) [68.60.77.128]:49656: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.183.225.156
country_id: 3658394
description:
2025-12-07 07:49:33 dovecot_login authenticator failed for (hfce-201-183-225-156.customer.claro.com.ec) [201.183.225.156]:60025: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.99.190.167
country_id: 2186224
description:
2025-12-07 07:49:38 dovecot_login authenticator failed for (dynamic-cpe-pool.orcon.net.nz) [121.99.190.167]:59269: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.97.74
country_id: 1269750
description:
2025-12-07 07:49:42 dovecot_login authenticator failed for ([182.79.70.81]) [27.123.97.74]:52896: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.181.133.153
country_id: 3469034
description:
2025-12-07 07:49:46 dovecot_login authenticator failed for ([179.181.135.1]) [179.181.133.153]:56651: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.40.122.250
country_id: 2629691
description:
2025-12-07 07:49:51 dovecot_login authenticator failed for nova-185-040-122-250.cpe.novanet.is [185.40.122.250]:50269: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  7 07:50:27 host2 sshd[2193368]: Disconnected from invalid user user 2.57.121.25 port 55068 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.124.60.46
country_id: 1168579
description:
2025-12-07 07:50:04 dovecot_login authenticator failed for ([203.124.60.46]) [203.124.60.46]:41621: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec  7 07:50:07 host2 sshd[2192974]: Disconnected from invalid user admin 2.57.121.112 port 57254 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.161
country_id: 6252001
description:
Dec  7 07:51:05 host2 dovecot[2150]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.161, lip=66.85.158.91, TLS, session=<D4iqVFNFrvaTuYSh>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.161
country_id: 6252001
description:
Dec  7 07:52:03 host2 dovecot[2150]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.161, lip=66.85.158.91, TLS, session=<UngkWFNFguqTuYSh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.235.225.181
country_id: 6252001
description:
2025-12-07 07:55:43 dovecot_plain authenticator failed for c-71-235-225-181.hsd1.ct.comcast.net (tabred) [71.235.225.181]:46436: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 109.105.210.55
country_id: 2264397
description:
Dec  7 07:55:59 host2 dovecot[2199651]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=109.105.210.55, lip=66.85.158.92, TLS, session=<qgM3ZlNFh4JtadI3>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 109.105.210.52
country_id: 2264397
description:
Dec  7 07:55:59 host2 dovecot[2199651]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=109.105.210.52, lip=66.85.158.92, TLS, session=<nmUtZlNFvNttadI0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 109.105.210.54
country_id: 2264397
description:
Dec  7 07:56:00 host2 dovecot[2199651]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=109.105.210.54, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<4SJFZlNFq4BtadI2>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 109.105.210.53
country_id: 2264397
description:
Dec  7 07:56:04 host2 dovecot[2199651]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=109.105.210.53, lip=66.85.158.92, TLS, session=<tBCFZlNFx6VtadI1>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 109.105.210.53
country_id: 2264397
description:
Dec  7 07:55:55 host2 dovecot[2199651]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=109.105.210.53, lip=66.85.158.92, TLS, session=<IEz9ZVNFt61tadI1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.69.165.17
country_id: 149590
description:
2025-12-07 08:00:08 dovecot_plain authenticator failed for (5HJ30XO6291) [102.69.165.17]:53885: 535 Incorrect authentication data (set_id=chitral00@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.140.219
country_id: 298795
description:
2025-12-07 08:00:36 dovecot_plain authenticator failed for (aremorres) [5.11.140.219]:35420: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.104.225.201
country_id: 6252001
description:
2025-12-07 08:00:40 dovecot_plain authenticator failed for (waimostom) [24.104.225.201]:59906: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-07 08:00:43 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (lenals) [87.103.126.54]:63732: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  7 08:03:32 host2 sshd[2208946]: Disconnected from invalid user user 2.57.121.25 port 33735 [preauth]


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.219
country_id: 2635167
description:
Dec  7 08:05:29 host2 dovecot[2208013]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=185.247.137.219, lip=66.85.158.91, TLS, session=<i8MwiFNFAZG594nb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 81.189.162.142
country_id: 2782113
description:
Dec  7 08:06:40 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=81.189.162.142, lip=66.85.158.91, session=<hWZHjFNFHM1RvaKO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.26.159.5
country_id: 798549
description:
2025-12-07 08:08:28 dovecot_plain authenticator failed for (5HJ30XO6291) [188.26.159.5]:59099: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.173.10.75
country_id: 6252001
description:
2025-12-07 08:09:58 dovecot_plain authenticator failed for (chaph) [209.173.10.75]:33954: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.227.25.115
country_id: 6252001
description:
2025-12-07 08:10:00 dovecot_plain authenticator failed for c-98-227-25-115.hsd1.il.comcast.net (tionactied) [98.227.25.115]:38430: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-07 08:10:19 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:51872: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-07 08:10:22 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (comione) [87.103.126.54]:25375: 535 Incorrect authentication data (set_id=sysnytech@sysnytech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec  7 08:16:22 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<cLMer1NFUL4DjyE/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.224.169.28
country_id: 6252001
description:
2025-12-07 08:17:54 dovecot_plain authenticator failed for c-71-224-169-28.hsd1.pa.comcast.net (sampels) [71.224.169.28]:38302: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec  7 08:18:06 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<ftNFtVNFNrQDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec  7 08:20:15 host2 dovecot[2208013]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 1 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS, session=<BlX1vFNF/J4DjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec  7 08:21:20 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, TLS handshaking: Connection closed, session=<PCXYwFNFIpcDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec  7 08:22:06 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, TLS, session=<IV6Xw1NFHOUDjyE/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.10.210.68
country_id: 732800
description:
2025-12-07 08:23:44 dovecot_plain authenticator failed for (enatibled) [46.10.210.68]:40143: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec  7 08:24:17 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS, session=<RChmy1NFTuQDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 71.6.146.186
country_id: 6252001
description:
Dec  7 08:24:53 host2 dovecot[2208013]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=71.6.146.186, lip=66.85.158.92, session=<r86NzVNF9IpHBpK6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.104.254.93
country_id: 3865483
description:
2025-12-07 08:25:23 dovecot_login authenticator failed for (static.94.254.104.190.cps.com.ar) [190.104.254.93]:56635: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec  7 08:25:36 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, TLS handshaking: Connection closed, session=</Ewj0FNFPIQDjyE/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.208.46.130
country_id: 1522867
description:
2025-12-07 08:25:56 dovecot_login authenticator failed for ([37.208.46.130]) [37.208.46.130]:36839: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec  7 08:25:59 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, TLS, session=<cu+B0VNFvpsDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.80
country_id: 6252001
description:
Dec  7 08:36:03 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.80, lip=66.85.158.92, TLS, session=<lb5/9VNFzPjN0h9Q>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.225.30.107
country_id: 2661886
description:
2025-12-07 08:36:08 dovecot_plain authenticator failed for 81-225-30-107-no2380.tbcn.telia.com (tasmering) [81.225.30.107]:60246: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.153.146
country_id: 99237
description:
2025-12-07 08:38:39 dovecot_plain authenticator failed for (balburytic) [65.20.153.146]:45232: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.215.74.195
country_id: 2661886
description:
2025-12-07 08:39:51 dovecot_plain authenticator failed for 217-215-74-195-no2620.tbcn.telia.com (unrevyic) [217.215.74.195]:46395: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.233.79.230
country_id: 1269750
description:
2025-12-07 08:47:37 dovecot_login authenticator failed for ([136.233.79.226]) [136.233.79.230]:39196: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.170.99.195
country_id: 1269750
description:
2025-12-07 08:47:47 dovecot_login authenticator failed for (abts-mum-static-195.99.170.122.airtelbroadband.in) [122.170.99.195]:37815: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.89.22.113
country_id: 3469034
description:
2025-12-07 08:47:49 dovecot_login authenticator failed for (177-89-22-113.cable.cabotelecom.com.br) [177.89.22.113]:55049: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 31.13.138.139
country_id: 3175395
description:
Dec  7 08:47:57 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@jrdc.lk>, method=PLAIN, rip=31.13.138.139, lip=66.85.158.91, TLS, session=<A/AYH1RFZqQfDYqL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.186.54.65
country_id: 298795
description:
2025-12-07 08:48:12 dovecot_login authenticator failed for ([78.186.54.65]) [78.186.54.65]:59064: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.255.212.105
country_id: 732800
description:
Dec  7 08:48:15 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=185.255.212.105, lip=66.85.158.91, TLS, session=<t5gqIFRFgJu5/9Rp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.173.78.90
country_id: 2510769
description:
2025-12-07 08:48:27 dovecot_login authenticator failed for ([90.173.78.90]) [90.173.78.90]:51161: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.84.162.177
country_id: 1861060
description:
2025-12-07 08:48:34 dovecot_login authenticator failed for 177.162.84.34.bc.googleusercontent.com [34.84.162.177]:59930: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.75.202
country_id: 1149361
description:
2025-12-07 08:52:00 dovecot_login authenticator failed for ([180.94.75.202]) [180.94.75.202]:59116: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  7 08:52:21 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@anandaobauae.org>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<qFStL1RFHNwXXz9j>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.226.107.70
country_id: 3469034
description:
2025-12-07 08:52:35 dovecot_login authenticator failed for (72-107-226-38.edgetelecom.com.br) [38.226.107.70]:58910: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 109.105.209.33
country_id: 2264397
description:
Dec  7 08:53:08 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:142090FC:SSL routines:tls_early_post_process_client_hello:unknown protocol (no auth attempts in 0 secs): user=<>, rip=109.105.209.33, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:142090FC:SSL routines:tls_early_post_process_client_hello:unknown protocol, session=<V2eaMlRFvZxtadEh>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 109.105.209.32
country_id: 2264397
description:
Dec  7 08:53:04 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed: SSL_read failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=109.105.209.32, lip=66.85.158.91, TLS: SSL_read failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<07BSMlRFoLVtadEg>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 109.105.209.35
country_id: 2264397
description:
Dec  7 08:53:04 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=109.105.209.35, lip=66.85.158.91, TLS, session=<FyxgMlRF+4RtadEj>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 109.105.209.34
country_id: 2264397
description:
Dec  7 08:53:03 host2 dovecot[2208013]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=109.105.209.34, lip=66.85.158.91, TLS, session=<I01IMlRFcaxtadEi>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.59.160.96
country_id: 1643084
description:
[2025-12-07 08:56:30 +0530] info [cpaneld] 103.59.160.96 - 2083 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.158
country_id: 1269750
description:
2025-12-07 09:19:15 dovecot_login authenticator failed for (nsg-corporate-97.172.186.122.airtel.in) [152.52.236.158]:37110: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec  7 09:19:30 host2 sshd[2282810]: Disconnected from invalid user irving 62.60.131.157 port 59133 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.95.24.117
country_id: 2464461
description:
2025-12-07 09:18:59 dovecot_login authenticator failed for ([193.95.21.147]) [193.95.24.117]:41088: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.196.144.25
country_id: 6252001
description:
2025-12-07 09:25:41 dovecot_plain authenticator failed for c-73-196-144-25.hsd1.nj.comcast.net (fosingly) [73.196.144.25]:41378: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.159.249.233
country_id: 1269750
description:
2025-12-07 09:29:49 dovecot_plain authenticator failed for (5D07V5) [103.159.249.233]:56793: 535 Incorrect authentication data (set_id=art@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.159.249.233
country_id: 1269750
description:
2025-12-07 09:29:56 dovecot_login authenticator failed for (5D07V5) [103.159.249.233]:56793: 535 Incorrect authentication data (set_id=art@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.143.166
country_id: 1819730
description:
2025-12-07 09:31:24 dovecot_login authenticator failed for 166.143.48.116.static.netvigator.com [116.48.143.166]:35026: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.120.50
country_id: 1269750
description:
2025-12-07 09:31:39 dovecot_login authenticator failed for (nsg-static-89.234.75.182-airtel.com) [182.95.120.50]:34424: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.160.166.237
country_id: 1820814
description:
2025-12-07 09:31:05 dovecot_login authenticator failed for (237-166.adsl.static.espeed.com.bn) [119.160.166.237]:51236: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.82.141.145
country_id: 6252001
description:
2025-12-07 09:32:07 dovecot_plain authenticator failed for c-68-82-141-145.hsd1.pa.comcast.net (unintic) [68.82.141.145]:52350: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.37.218
country_id: 2300660
description:
Dec  7 09:36:00 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=41.139.37.218, lip=66.85.158.91, TLS, session=<jMCVylRFzJEpiyXa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 89.231.35.38
country_id: 798544
description:
Dec  7 09:36:22 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<587hr>, method=PLAIN, rip=89.231.35.38, lip=66.85.158.91, TLS, session=<kJYKzFRFcqZZ5yMm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.15.216.41
country_id: 6252001
description:
2025-12-07 09:39:47 dovecot_plain authenticator failed for c-24-15-216-41.hsd1.il.comcast.net (bacel) [24.15.216.41]:52108: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2025-12-07 09:39:45 dovecot_plain authenticator failed for (deber) [102.53.15.18]:47402: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.226.27.227
country_id: 294640
description:
2025-12-07 09:41:51 dovecot_plain authenticator failed for (sultumoral) [109.226.27.227]:32949: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.52
country_id: 6252001
description:
Dec  7 09:43:30 host2 pure-ftpd[2306470]: (?@147.185.132.52) [INFO] New connection from 147.185.132.52


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.97.190.237
country_id: 6252001
description:
2025-12-07 09:45:13 dovecot_plain authenticator failed for (undics) [75.97.190.237]:56290: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.56.59.77
country_id: 3175395
description:
2025-12-07 09:46:11 dovecot_login authenticator failed for host-79-56-59-77.retail.telecomitalia.it ([185.196.221.176]) [79.56.59.77]:42316: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.136.176.12
country_id: 2510769
description:
2025-12-07 09:46:26 dovecot_login authenticator failed for ([83.136.176.12]) [83.136.176.12]:37801: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.37.203.28
country_id: 1831722
description:
2025-12-07 09:46:40 dovecot_login authenticator failed for ([36.37.203.28]) [36.37.203.28]:56196: 535 Incorrect authentication data (set_id=training)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.234.56
country_id: 1269750
description:
2025-12-07 09:46:49 dovecot_login authenticator failed for (nsg-corporate-56.234.187.122.airtel.in) [122.187.234.56]:55300: 535 Incorrect authentication data (set_id=training)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2025-12-07 09:46:02 dovecot_login authenticator failed for ([154.144.243.93]) [154.144.243.93]:44510: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.222.81.115
country_id: 6252001
description:
Dec  7 09:47:10 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=44.222.81.115, lip=66.85.158.91, TLS, session=<am7W81RFkscs3lFz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
country_id: 6252001
description:
2025-12-07 09:48:10 dovecot_plain authenticator failed for (disce) [24.187.213.29]:45322: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.213.237.28
country_id: 6252001
description:
2025-12-07 09:51:07 dovecot_plain authenticator failed for c-73-213-237-28.hsd1.va.comcast.net (forate) [73.213.237.28]:38942: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.55
country_id: 6252001
description:
Dec  7 09:51:00 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=167.94.146.55, lip=66.85.158.91, TLS: Connection closed, session=<t+2CAVVFjKmnXpI3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.56.225
country_id: 953987
description:
Dec  7 09:53:45 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@jrdc.lk>, method=PLAIN, rip=102.129.56.225, lip=66.85.158.91, TLS, session=<a1AqClVFRK5mgTjh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.195.211.98
country_id: 6252001
description:
2025-12-07 09:54:47 dovecot_plain authenticator failed for c-73-195-211-98.hsd1.nj.comcast.net (excered) [73.195.211.98]:49858: 535 Incorrect authentication data (set_id=sysnytech@sysnytech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.143.51
country_id: 99237
description:
Dec  7 09:54:03 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=65.20.143.51, lip=66.85.158.91, TLS, session=<bqRsC1VFF4hBFI8z>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  7 09:57:19 host2 sshd[2318829]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.216.30.100
country_id: 798544
description:
Dec  7 09:59:45 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@systemtec.lk>, method=PLAIN, rip=178.216.30.100, lip=66.85.158.91, TLS, session=<FTLdH1VFrrOy2B5k>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.59.132.230
country_id: 1269750
description:
Dec  7 10:00:06 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=103.59.132.230, lip=66.85.158.91, TLS, session=<FOj2IFVFkOdnO4Tm>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  7 10:04:23 host2 sshd[2325651]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Dec  7 10:07:20 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, TLS handshaking: Connection closed, session=<A+HuO1VFEp0Dg9cm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Dec  7 10:08:06 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<QDetPlVFUKoDg9cm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Dec  7 10:09:06 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<wypAQlVFuOcDg9cm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.36
country_id: 1269750
description:
2025-12-07 10:24:35 dovecot_login authenticator failed for (nsg-corporate-36.229.187.122.airtel.in) [122.187.229.36]:59028: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.51.26.198
country_id: 1269750
description:
2025-12-07 10:25:00 dovecot_login authenticator failed for (103.51.26.198.sukaininfoway.com) [103.51.26.198]:36753: 535 Incorrect authentication data (set_id=vinod)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  7 10:27:56 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@anandaobauae.org>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<nQV+hVVFeOsXXz9j>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.85
country_id: 6252001
description:
Dec  7 10:30:01 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.85, lip=66.85.158.91, TLS, session=<OPMSjVVFjvGTuYRV>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.234.80.128
country_id: 6252001
description:
Dec  7 10:34:46 host2 dovecot[2208013]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=54.234.80.128, lip=66.85.158.92, session=<CYwMnlVFXMU26lCA>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  7 10:38:44 host2 sshd[2357125]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.193.127
country_id: 6252001
description:
Dec  7 10:39:05 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.65.193.127, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<GnF8rVVFRO4UQcF/>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  7 10:40:15 host2 sshd[2358789]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.209.84
country_id: 3144096
description:
2025-12-07 10:43:29 dovecot_login authenticator failed for (cm-178.232.209.84.get.no) [178.232.209.84]:57273: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.187.2
country_id: 1269750
description:
2025-12-07 10:43:57 dovecot_login authenticator failed for ([128.185.187.2]) [128.185.187.2]:52550: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.125.200
country_id: 294640
description:
2025-12-07 10:45:02 dovecot_login authenticator failed for (2-55-125-200.orange.net.il) [2.55.125.200]:58117: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2025-12-07 10:45:28 dovecot_login authenticator failed for c-71-62-34-216.hsd1.va.comcast.net [71.62.34.216]:43880: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.226
country_id: 6252001
description:
Dec  7 10:47:02 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 14 secs): user=<>, rip=162.216.149.226, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<JurnyVVFAs+i2JXi>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.226
country_id: 6252001
description:
Dec  7 10:48:26 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=162.216.149.226, lip=66.85.158.92, TLS: read(size=403) failed: Connection reset by peer, session=<d3zvzlVFFOGi2JXi>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.226
country_id: 6252001
description:
Dec  7 10:49:16 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 5 secs): user=<>, rip=162.216.149.226, lip=66.85.158.92, TLS: read(size=403) failed: Connection reset by peer, session=<gDrk0VVFCuai2JXi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.189.204.222
country_id: 3469034
description:
Dec  7 10:49:31 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=179.189.204.222, lip=66.85.158.91, TLS, session=<oSKc0VVFWqWzvcze>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  7 10:49:05 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@agronatureholdings.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<nX4f0VVFrugXXz9j>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.177.113.79
country_id: 3175395
description:
Dec  7 10:49:09 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=195.177.113.79, lip=66.85.158.91, TLS, session=<6+p60FVFaqnDsXFP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.118.138
country_id: 3144096
description:
2025-12-07 10:53:01 dovecot_login authenticator failed for (cm-46.212.118.138.get.no) [46.212.118.138]:35785: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.147.89.158
country_id: 1269750
description:
2025-12-07 10:53:36 dovecot_login authenticator failed for ([203.147.89.38]) [203.147.89.158]:35110: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.198.1.124
country_id: 798544
description:
Dec  7 10:53:52 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<accounts2@lezzarotech.com>, method=PLAIN, rip=185.198.1.124, lip=66.85.158.91, TLS, session=<pvxo4VVFvYC5xgF8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.112.106.163
country_id: 3175395
description:
Dec  7 10:54:10 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<accounts2>, method=PLAIN, rip=217.112.106.163, lip=66.85.158.91, TLS, session=<ZLx04lVFQ6DZcGqj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.193.112.85
country_id: 6252001
description:
2025-12-07 10:54:15 dovecot_plain authenticator failed for c-98-193-112-85.hsd1.il.comcast.net (mudinsum) [98.193.112.85]:51642: 535 Incorrect authentication data (set_id=sysnytech@sysnytech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.42.58
country_id: 953987
description:
Dec  7 10:55:02 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=102.64.42.58, lip=66.85.158.91, TLS, session=<kGVh5VVFrdBmQCo6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.226
country_id: 6252001
description:
Dec  7 10:55:07 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.149.226, lip=66.85.158.92, TLS, session=<dfvZ5lVFgOWi2JXi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.207.34.239
country_id: 6290252
description:
Dec  7 10:55:19 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<accounts>, method=PLAIN, rip=109.207.34.239, lip=66.85.158.91, TLS, session=<O/CU5lVFqpptzyLv>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.226
country_id: 6252001
description:
Dec  7 10:57:27 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.149.226, lip=66.85.158.92, TLS, session=<AMUn71VF8uCi2JXi>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.43.218.214
country_id: 1269750
description:
2025-12-07 11:00:22 dovecot_plain authenticator failed for (LF21D45A3WC8) [49.43.218.214]:58759: 535 Incorrect authentication data (set_id=art@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.251
country_id: 6252001
description:
Dec  7 11:01:22 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=205.210.31.251, lip=66.85.158.91, TLS, session=<mrgy/VVFVPHN0h/7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.70
country_id: 6252001
description:
Dec  7 11:01:34 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.70, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<Amvo/VVFuMHG6xhG>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  7 11:02:19 host2 sshd[2379351]: Disconnected from invalid user user 2.57.121.25 port 30768 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 18.97.5.44
country_id: 6252001
description:
Dec  7 11:02:56 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=18.97.5.44, lip=66.85.158.91, TLS handshaking: Connection closed, session=<V/DDAlZFfNESYQUs>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-07 11:06:19 +0530] info [cpaneld] 213.209.143.251 - 2stravel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec  7 11:07:48 host2 sshd[2384361]: Disconnected from invalid user jaxson 62.60.131.157 port 36656 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.98.201.117
country_id: 2589581
description:
2025-12-07 11:09:02 dovecot_plain authenticator failed for (56QUULLY) [105.98.201.117]:60225: 535 Incorrect authentication data (set_id=art@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.15.6
country_id: 1149361
description:
2025-12-07 11:10:37 dovecot_login authenticator failed for ([149.54.15.6]) [149.54.15.6]:56667: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.183.66
country_id: 1269750
description:
2025-12-07 11:09:56 dovecot_login authenticator failed for ([125.19.183.66]) [125.19.183.66]:33492: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.192.211.156
country_id: 1269750
description:
2025-12-07 11:17:42 dovecot_login authenticator failed for (dhcp-192-211-156.in2cable.com) [203.192.211.156]:41642: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.245.194
country_id: 1269750
description:
2025-12-07 11:17:02 dovecot_login authenticator failed for ([125.20.245.194]) [125.20.245.194]:51736: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.63.161.126
country_id: 2510769
description:
2025-12-07 11:17:23 dovecot_login authenticator failed for static-126-161-63-95.ipcom.comunitel.net [95.63.161.126]:54813: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.148.194
country_id: 99237
description:
2025-12-07 11:17:23 dovecot_plain authenticator failed for (stite) [65.20.148.194]:48291: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.243.234.23
country_id: 6252001
description:
2025-12-07 11:18:21 dovecot_login authenticator failed for c-73-243-234-23.hsd1.co.comcast.net [73.243.234.23]:38344: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.174.35
country_id: 1269750
description:
2025-12-07 11:19:23 dovecot_login authenticator failed for (nsg-corporate-35.174.186.122.airtel.in) [122.186.174.35]:52866: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.202.241
country_id: 149590
description:
2025-12-07 11:19:42 dovecot_login authenticator failed for (241.202-59-41.data-dsm.ttcldata.net) [41.59.202.241]:45038: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.226.51
country_id: 1819730
description:
2025-12-07 11:19:53 dovecot_login authenticator failed for (223-197-226-51.static.imsbiz.com) [223.197.226.51]:58046: 535 Incorrect authentication data (set_id=kasunp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.121.193.126
country_id: 3595528
description:
2025-12-07 11:19:55 dovecot_login authenticator failed for (126.193.121.190.ispguatemala.com.gt) [190.121.193.126]:49412: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.168.113
country_id: 2186224
description:
2025-12-07 11:20:15 dovecot_login authenticator failed for ([121.73.168.113]) [121.73.168.113]:54454: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.130
country_id: 6252001
description:
Dec  7 11:20:52 host2 pure-ftpd[2397016]: (?@66.132.153.130) [INFO] New connection from 66.132.153.130


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 81.189.162.142
country_id: 2782113
description:
Dec  7 11:21:28 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@simple-engineering.lk>, method=PLAIN, rip=81.189.162.142, lip=66.85.158.91, session=<5n/qRFZFW8pRvaKO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.156.0.88
country_id: 3144096
description:
2025-12-07 11:22:41 dovecot_login authenticator failed for (cm-78.156.0.88.get.no) [78.156.0.88]:50365: 535 Incorrect authentication data (set_id=office@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.164.238.63
country_id: 6252001
description:
2025-12-07 11:23:05 dovecot_login authenticator failed for c-67-164-238-63.hsd1.il.comcast.net [67.164.238.63]:16656: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  7 11:33:41 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@bostonlanka.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<UuajcFZFMtoXXz9j>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.82.141.145
country_id: 6252001
description:
2025-12-07 11:33:53 dovecot_plain authenticator failed for c-68-82-141-145.hsd1.pa.comcast.net (super) [68.82.141.145]:34054: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.215.95.14
country_id: 6252001
description:
2025-12-07 11:34:24 dovecot_plain authenticator failed for (brapheess) [50.215.95.14]:51034: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.168.136.150
country_id: 6252001
description:
2025-12-07 11:34:38 dovecot_plain authenticator failed for c-73-168-136-150.hsd1.il.comcast.net (elabayeds) [73.168.136.150]:57742: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 223.197.145.126
country_id: 1819730
description:
Dec  7 11:37:47 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 23 secs): user=<hr>, method=PLAIN, rip=223.197.145.126, lip=66.85.158.91, TLS, session=<hAULflZFJOLfxZF+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.219.104.210
country_id: 3175395
description:
Dec  7 11:37:12 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=188.219.104.210, lip=66.85.158.91, session=<SsASfVZFt5u822jS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.144.27.228
country_id: 6252001
description:
2025-12-07 11:37:29 dovecot_plain authenticator failed for c-73-144-27-228.hsd1.mi.comcast.net (undmic) [73.144.27.228]:53756: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.214.49.11
country_id: 3144096
description:
2025-12-07 11:38:14 dovecot_login authenticator failed for ([84.214.49.11]) [84.214.49.11]:38290: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.217
country_id: 6252001
description:
Dec  7 11:38:30 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.235.24.217, lip=66.85.158.92, session=<O8n6gVZFmOvG6xjZ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.217.255.171
country_id: 6252001
description:
2025-12-07 11:38:33 dovecot_login authenticator failed for ([50.217.255.171]) [50.217.255.171]:41141: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.169.207.93
country_id: 1269750
description:
2025-12-07 11:38:34 dovecot_login authenticator failed for (abts-ap-dynamic-093.207.169.122.airtelbroadband.in) [122.169.207.93]:14957: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.86.102
country_id: 1269750
description:
2025-12-07 11:39:04 dovecot_login authenticator failed for ([182.79.86.102]) [182.79.86.102]:44130: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 201.20.127.97
country_id: 3469034
description:
Dec  7 11:39:33 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 136 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=201.20.127.97, lip=66.85.158.91, session=<rR6lfVZFWI7JFH9h>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.250.191.189
country_id: 458258
description:
2025-12-07 11:40:01 dovecot_plain authenticator failed for (partibugs) [178.250.191.189]:42330: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.109.189.167
country_id: 6252001
description:
2025-12-07 11:43:21 dovecot_plain authenticator failed for (overs) [75.109.189.167]:54054: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.240
country_id: 6252001
description:
Dec  7 11:43:45 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=147.185.132.240, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<j+DDlFZFltCTuYTw>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.227.62.247
country_id: 6252001
description:
Dec  7 11:44:28 host2 pure-ftpd[2417414]: (?@165.227.62.247) [INFO] New connection from 165.227.62.247


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 165.227.62.247
country_id: 6252001
description:
Dec  7 11:44:30 host2 pure-ftpd[2417447]: (?@165.227.62.247) [INFO] New connection from 165.227.62.247


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.59.46.20
country_id: 1269750
description:
2025-12-07 11:46:53 dovecot_plain authenticator failed for (P756S1ACH72QLPV) [152.59.46.20]:55043: 535 Incorrect authentication data (set_id=art@bostonlanka.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  7 11:47:39 host2 sshd[2421148]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.89.136.228
country_id: 3469034
description:
Dec  7 11:47:04 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@jrdc.lk>, method=PLAIN, rip=190.89.136.228, lip=66.85.158.91, TLS, session=<Jutrn1ZF8bC+WYjk>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.227.39.113
country_id: 798544
description:
Dec  7 11:47:22 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=46.227.39.113, lip=66.85.158.91, TLS, session=<mSKuoFZFlKAu4ydx>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.61.199.212
country_id: 6252001
description:
2025-12-07 11:47:51 dovecot_plain authenticator failed for c-24-61-199-212.hsd1.ct.comcast.net (mentical) [24.61.199.212]:45304: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.150.56
country_id: 99237
description:
Dec  7 11:53:00 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@systemtec.lk>, method=PLAIN, rip=65.20.150.56, lip=66.85.158.91, TLS, session=<g6jUtFZFDbxBFJY4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.53.46
country_id: 953987
description:
Dec  7 11:53:22 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=102.129.53.46, lip=66.85.158.91, TLS, session=<xjcCtlZFvJFmgTUu>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-07 11:54:51 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:57630: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.144.27.228
country_id: 6252001
description:
2025-12-07 11:55:25 dovecot_plain authenticator failed for c-73-144-27-228.hsd1.mi.comcast.net (preancit) [73.144.27.228]:54516: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.216.96
country_id: 3996063
description:
2025-12-07 11:59:00 dovecot_login authenticator failed for (201.173.216.96-clientes-izzi.mx) [201.173.216.96]:52377: 535 Incorrect authentication data (set_id=admin@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.201.22.158
country_id: 290557
description:
2025-12-07 11:59:52 dovecot_login authenticator failed for ([94.201.22.158]) [94.201.22.158]:42891: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.56.34.147
country_id: 6252001
description:
2025-12-07 11:59:07 dovecot_login authenticator failed for (136-56-34-147.googlefiber.net) [136.56.34.147]:46138: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.219.104.210
country_id: 3175395
description:
2025-12-07 11:59:52 dovecot_login authenticator failed for net-188-219-104-210.cust.vodafonedsl.it [188.219.104.210]:36235: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2025-12-07 12:00:08 dovecot_login authenticator failed for (144.121.245.65.lightower.net) [64.72.74.162]:46123: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.29.26
country_id: 3144096
description:
2025-12-07 12:00:18 dovecot_login authenticator failed for (cm-178.232.29.26.get.no) [178.232.29.26]:45600: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec  7 12:05:43 host2 sshd[2438164]: Disconnected from invalid user admin 2.57.121.112 port 43750 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2025-12-07 12:09:39 dovecot_plain authenticator failed for (nomous) [102.53.15.56]:44526: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 81.189.162.142
country_id: 2782113
description:
Dec  7 12:09:49 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=81.189.162.142, lip=66.85.158.91, session=<lzPh8VZF28FRvaKO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.36
country_id: 1269750
description:
2025-12-07 12:10:56 dovecot_login authenticator failed for (nsg-corporate-36.229.187.122.airtel.in) [122.187.229.36]:43318: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.174.35
country_id: 1269750
description:
2025-12-07 12:11:37 dovecot_login authenticator failed for ([122.186.174.35]) [122.186.174.35]:44828: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.40.189.43
country_id: 6252001
description:
2025-12-07 12:14:38 dovecot_plain authenticator failed for c-68-40-189-43.hsd1.mi.comcast.net (nocal) [68.40.189.43]:41834: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  7 12:23:44 host2 sshd[2453267]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  7 12:23:48 host2 sshd[2453406]: Disconnected from invalid user user 2.57.121.25 port 35715 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.202.20.23
country_id: 6252001
description:
Dec  7 12:24:53 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=44.202.20.23, lip=66.85.158.92, TLS, session=<Gx7jJ1dFhIgsyhQX>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  7 12:25:02 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<orders@agronatureholdings.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<Huk9KFdFZuwXXz9j>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.222.81.115
country_id: 6252001
description:
Dec  7 12:27:14 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=44.222.81.115, lip=66.85.158.91, TLS, session=<6gxIMFdFsKcs3lFz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.26.53.164
country_id: 1269750
description:
2025-12-07 12:37:31 dovecot_login authenticator failed for (164-53-26-103.intechonline.net) [103.26.53.164]:46250: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.31.42.170
country_id: 1821275
description:
2025-12-07 12:37:31 dovecot_login authenticator failed for ([125.31.42.170]) [125.31.42.170]:45252: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.93.140.162
country_id: 6252001
description:
2025-12-07 12:37:38 dovecot_plain authenticator failed for (cosite) [24.93.140.162]:38640: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.183.221.168
country_id: 6252001
description:
2025-12-07 12:37:44 dovecot_login authenticator failed for wsip-70-183-221-168.br.br.cox.net [70.183.221.168]:55246: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.0.166.123
country_id: 1605651
description:
2025-12-07 12:37:47 dovecot_login authenticator failed for ([106.0.166.123]) [106.0.166.123]:55787: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.239.157.41
country_id: 357994
description:
2025-12-07 12:39:26 dovecot_login authenticator failed for ([41.65.118.172]) [41.239.157.41]:59944: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.131.211.168
country_id: 690791
description:
2025-12-07 12:39:38 dovecot_login authenticator failed for ([94.131.211.168]) [94.131.211.168]:52154: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.64.71.51
country_id: 3865483
description:
Dec  7 12:42:08 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=186.64.71.51, lip=66.85.158.91, TLS, session=<Z6J6ZFdF07W6QEcz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.71.76
country_id: 3469034
description:
Dec  7 12:42:29 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=177.44.71.76, lip=66.85.158.91, TLS, session=<2TavZVdFeomxLEdM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.215.74.195
country_id: 2661886
description:
2025-12-07 12:49:41 dovecot_plain authenticator failed for 217-215-74-195-no2620.tbcn.telia.com (rharper) [217.215.74.195]:52625: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.156.2
country_id: 1269750
description:
2025-12-07 12:50:09 dovecot_login authenticator failed for ([125.19.156.2]) [125.19.156.2]:32822: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.86.13
country_id: 3996063
description:
2025-12-07 12:50:32 dovecot_login authenticator failed for (201.173.86.13-clientes-izzi.mx) [201.173.86.13]:50236: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.30.122.21
country_id: 290557
description:
2025-12-07 12:50:58 dovecot_login authenticator failed for ([5.30.122.21]) [5.30.122.21]:56598: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.166.153.20
country_id: 6252001
description:
2025-12-07 12:56:36 dovecot_plain authenticator failed for c-174-166-153-20.hsd1.nj.comcast.net (gueseso) [174.166.153.20]:57360: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec  7 13:05:01 host2 sshd[2490422]: Disconnected from invalid user cailey 62.60.131.157 port 14777 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  7 13:10:37 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@bostonlanka.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<SZ9Ny1dFgK4XXz9j>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  7 13:14:10 host2 sshd[2498839]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2025-12-07 13:20:52 dovecot_login authenticator failed for ([154.144.243.93]) [154.144.243.93]:33102: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
country_id: 1643084
description:
2025-12-07 13:21:36 dovecot_login authenticator failed for (ip-103-29-185-162.pascalwave.com) [103.29.185.162]:39194: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 20.84.152.142
country_id: 6252001
description:
Dec  7 13:24:28 host2 pure-ftpd[2507251]: (?@20.84.152.142) [INFO] New connection from 20.84.152.142


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 62.60.135.159
country_id: 130758
description:
Denial of Service (DoS) attack was discovered from 62.60.135.159: 250 connections per 30 seconds to 80 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 62.60.135.159
country_id: 130758
description:
Denial of Service (DoS) attack was discovered from 62.60.135.159: 923 connections per 30 seconds to 80 port.


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.234.80.128
country_id: 6252001
description:
Dec  7 13:29:04 host2 dovecot[2208013]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=54.234.80.128, lip=66.85.158.92, session=<TbxfDVhFOr426lCA>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.110.112.52
country_id: 3865483
description:
Dec  7 13:30:53 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@jrdc.lk>, method=PLAIN, rip=190.110.112.52, lip=66.85.158.91, TLS, session=<ts/KElhFPOO+bnA0>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  7 13:31:11 host2 sshd[2517168]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.103.5.121
country_id: 690791
description:
Dec  7 13:31:12 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=176.103.5.121, lip=66.85.158.91, TLS, session=<qNz+E1hFhr+wZwV5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.149
country_id: 1269750
description:
2025-12-07 13:32:51 dovecot_login authenticator failed for (nsg-corporate-149.229.187.122.airtel.in) [122.187.229.149]:38608: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.161.217.228
country_id: 2510769
description:
2025-12-07 13:32:59 dovecot_login authenticator failed for (228.pool90-161-217.static.orange.es) [90.161.217.228]:48242: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.165.208.12
country_id: 2077456
description:
2025-12-07 13:36:48 dovecot_login authenticator failed for (cpe-101-165-208-12.vb08.vic.asp.telstra.net) [101.165.208.12]:43456: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.231.6
country_id: 1269750
description:
2025-12-07 13:36:03 dovecot_login authenticator failed for ([128.185.231.6]) [128.185.231.6]:50478: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 105.159.20.41
country_id: 2542007
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 105.159.20.41 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.82.141.145
country_id: 6252001
description:
2025-12-07 13:40:08 dovecot_plain authenticator failed for c-68-82-141-145.hsd1.pa.comcast.net (neudotasm) [68.82.141.145]:53254: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.122.43.61
country_id: 3469034
description:
Dec  7 13:44:00 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=138.122.43.61, lip=66.85.158.91, TLS, session=<7J6iQVhFQKCKeis9>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  7 13:44:11 host2 sshd[2526795]: Disconnected from invalid user user 2.57.121.25 port 51952 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.239.35.88
country_id: 3175395
description:
Dec  7 13:44:17 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=178.239.35.88, lip=66.85.158.91, TLS, session=<NErcQlhFV5Sy7yNY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.146.240.123
country_id: 2542007
description:
2025-12-07 13:45:51 dovecot_plain authenticator failed for (bysing) [154.146.240.123]:53820: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.33.183.30
country_id: 357994
description:
2025-12-07 13:48:08 dovecot_plain authenticator failed for (otcot) [41.33.183.30]:46973: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.108.162.24
country_id: 3469034
description:
2025-12-07 13:48:38 dovecot_login authenticator failed for ([131.108.162.24]) [131.108.162.24]:49208: 535 Incorrect authentication data (set_id=office@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.136.72
country_id: 3996063
description:
2025-12-07 13:48:56 dovecot_login authenticator failed for (187.161.136.72-clientes-izzi.mx) [187.161.136.72]:38233: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.80.9
country_id: 3144096
description:
2025-12-07 13:52:26 dovecot_login authenticator failed for ([178.232.80.9]) [178.232.80.9]:37842: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.19.177.117
country_id: 2510769
description:
2025-12-07 13:52:42 dovecot_login authenticator failed for 117.red-88-19-177.staticip.rima-tde.net [88.19.177.117]:43300: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.30.11.253
country_id: 6252001
description:
2025-12-07 13:58:57 dovecot_plain authenticator failed for (menot) [23.30.11.253]:38380: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.26.179.127
country_id: 3175395
description:
Dec  7 13:59:11 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@systemtec.lk>, method=PLAIN, rip=217.26.179.127, lip=66.85.158.91, TLS, session=<VdcbeFhF57TZGrN/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.0.136
country_id: 2300660
description:
Dec  7 13:59:32 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=41.139.0.136, lip=66.85.158.91, TLS, session=<NStAeVhFbNUpiwCI>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.137.7.97
country_id: 6252001
description:
2025-12-07 14:00:58 dovecot_plain authenticator failed for c-73-137-7-97.hsd1.ga.comcast.net (shandron) [73.137.7.97]:55826: 535 Incorrect authentication data (set_id=info@jrdc.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.30.11.253
country_id: 6252001
description:
2025-12-07 14:02:46 dovecot_plain authenticator failed for (caint) [23.30.11.253]:50522: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.169.224.27
country_id: 6252001
description:
2025-12-07 14:02:48 dovecot_plain authenticator failed for c-174-169-224-27.hsd1.vt.comcast.net (trier) [174.169.224.27]:37310: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 104.248.1.41
country_id: 6252001
description:
Dec  7 14:06:41 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=104.248.1.41, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<aHDnk1hF6s9o+AEp>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  7 14:07:08 host2 sshd[2547243]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.10.210.68
country_id: 732800
description:
2025-12-07 14:10:04 dovecot_plain authenticator failed for (bighthes) [46.10.210.68]:60213: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.26.194.79
country_id: 3017382
description:
2025-12-07 14:12:43 dovecot_login authenticator failed for ([217.26.194.79]) [217.26.194.79]:37373: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-07 14:21:07 +0530] info [cpaneld] 213.209.143.251 - agrona "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agrona (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-07 14:24:12 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (chorcumid) [87.103.126.54]:20412: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-07 14:26:14 +0530] info [cpaneld] 213.209.143.251 - ajssta "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajssta (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  7 14:27:32 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@ayuzonelanka.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<vrph3lhFepYXXz9j>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.213.236.66
country_id: 6252001
description:
2025-12-07 14:27:37 dovecot_plain authenticator failed for c-73-213-236-66.hsd1.va.comcast.net (plochness) [73.213.236.66]:45240: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.245.6.31
country_id: 1880251
description:
2025-12-07 14:28:10 dovecot_login authenticator failed for (31.6.245.49.unknown.m1.com.sg) [49.245.6.31]:53179: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.195.66
country_id: 1269750
description:
2025-12-07 14:29:30 dovecot_login authenticator failed for ([128.185.169.25]) [125.19.195.66]:39012: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.30.196.79
country_id: 290557
description:
2025-12-07 14:28:46 dovecot_login authenticator failed for ([5.30.196.79]) [5.30.196.79]:57142: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.245.59.26
country_id: 1880251
description:
2025-12-07 14:29:07 dovecot_login authenticator failed for (26.59.245.49.unknown.m1.com.sg) [49.245.59.26]:41170: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 81.189.162.142
country_id: 2782113
description:
Dec  7 14:33:17 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=81.189.162.142, lip=66.85.158.91, session=<ANDs8lhFQFVRvaKO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.230.65.90
country_id: 6252001
description:
2025-12-07 14:35:16 dovecot_plain authenticator failed for static-96-230-65-90.bstnma.fios.verizon.net (oaskess) [96.230.65.90]:39194: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.85.104.2
country_id: 6252001
description:
2025-12-07 14:35:19 dovecot_plain authenticator failed for (liale) [96.85.104.2]:49134: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 159.65.242.50
country_id: 6252001
description:
Dec  7 14:37:02 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=159.65.242.50, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<4Dt9AFlFtKqfQfIy>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec  7 14:37:51 host2 sshd[2572707]: Disconnected from invalid user admin 2.57.121.112 port 26140 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.178
country_id: 6252001
description:
Dec  7 14:40:55 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.235.24.178, lip=66.85.158.91, session=<7yVaDllFoOfG6xiy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.230.65.90
country_id: 6252001
description:
2025-12-07 14:44:14 dovecot_plain authenticator failed for static-96-230-65-90.bstnma.fios.verizon.net (eckilomy) [96.230.65.90]:44264: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec  7 14:44:32 host2 sshd[2579020]: Disconnected from invalid user charlene 62.60.131.157 port 22834 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.145.33
country_id: 1819730
description:
2025-12-07 14:48:36 dovecot_login authenticator failed for (223-197-145-33.static.imsbiz.com) [223.197.145.33]:54087: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.99.14
country_id: 290557
description:
2025-12-07 14:48:43 dovecot_plain authenticator failed for (tracrupt) [5.32.99.14]:35943: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.160.128.46
country_id: 3144096
description:
2025-12-07 14:49:07 dovecot_login authenticator failed for 46.79-160-128.customer.lyse.net [79.160.128.46]:53076: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.161.61.120
country_id: 1269750
description:
2025-12-07 14:53:47 dovecot_login authenticator failed for (abts-north-dynamic-120.61.161.122.airtelbroadband.in) [122.161.61.120]:44890: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.154.158
country_id: 1269750
description:
2025-12-07 14:54:09 dovecot_login authenticator failed for ([125.19.154.158]) [125.19.154.158]:55760: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec  7 14:54:13 host2 sshd[2587521]: Disconnected from invalid user charlene 62.60.131.157 port 18794 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.172.79.198
country_id: 1819730
description:
2025-12-07 14:57:28 dovecot_login authenticator failed for 69-172-79-198.static.imsbiz.com (173-248-234-145.static.imsbiz.com) [69.172.79.198]:60514: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.27.32.70
country_id: 6252001
description:
2025-12-07 14:58:23 dovecot_login authenticator failed for syn-137-027-032-070.biz.spectrum.com [137.27.32.70]:40976: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.219.104.210
country_id: 3175395
description:
2025-12-07 14:58:16 dovecot_plain authenticator failed for net-188-219-104-210.cust.vodafonedsl.it (siveredis) [188.219.104.210]:47089: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.147.45
country_id: 99237
description:
2025-12-07 14:58:20 dovecot_plain authenticator failed for (decid) [65.20.147.45]:49016: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 77.68.115.51
country_id: 2635167
description:
[2025-11-13 10:40:03 +0530] info [webmaild] 77.68.115.51 - senthil@yashiholdings.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.66.209
country_id: 1819730
description:
2025-12-07 15:11:45 dovecot_login authenticator failed for 209.66.246.220.static.netvigator.com [220.246.66.209]:64417: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.172.92.30
country_id: 3996063
description:
2025-12-07 15:12:00 dovecot_login authenticator failed for (201.172.92.30-clientes-izzi.mx) [201.172.92.30]:56009: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  7 15:15:00 host2 sshd[2605244]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.201.22.158
country_id: 290557
description:
2025-12-07 15:15:47 dovecot_plain authenticator failed for (gartism) [94.201.22.158]:46232: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.31.15.108
country_id: 290557
description:
2025-12-07 15:15:51 dovecot_plain authenticator failed for (berorch) [5.31.15.108]:46692: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.248
country_id: 6252001
description:
Dec  7 15:18:52 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.235.24.248, lip=66.85.158.92, TLS, session=<q2galllFdPTG6xj4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.173.2
country_id: 3996063
description:
2025-12-07 15:23:08 dovecot_login authenticator failed for (187.161.173.2-clientes-izzi.mx) [187.161.173.2]:60934: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.142.132.9
country_id: 3175395
description:
2025-12-07 15:22:35 dovecot_login authenticator failed for ([45.142.132.9]) [45.142.132.9]:54506: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.172.89.71
country_id: 3996063
description:
2025-12-07 15:24:17 dovecot_login authenticator failed for (201.172.89.71-clientes-izzi.mx) [201.172.89.71]:32882: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.191.242.226
country_id: 6252001
description:
2025-12-07 15:25:18 dovecot_login authenticator failed for wsip-184-191-242-226.fv.ks.cox.net [184.191.242.226]:35540: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.240.210
country_id: 1269750
description:
2025-12-07 15:24:42 dovecot_login authenticator failed for (nsg-corporate-210.240.187.122.airtel.in) [122.187.240.210]:49844: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.134.175.21
country_id: 6252001
description:
2025-12-07 15:24:43 dovecot_login authenticator failed for (syn-072-134-175-021.res.spectrum.com) [72.134.175.21]:56448: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.74.31.224
country_id: 290557
description:
2025-12-07 15:24:43 dovecot_login authenticator failed for ([91.74.31.224]) [91.74.31.224]:53313: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.122.151.6
country_id: 2661886
description:
2025-12-07 15:25:11 dovecot_login authenticator failed for h188-122-151-6.cust.bredband2.com [188.122.151.6]:39830: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.69.15.132
country_id: 2510769
description:
2025-12-07 15:25:56 dovecot_login authenticator failed for (109-69-15-132.puntdacces.coop) [109.69.15.132]:34879: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.147.89.158
country_id: 1269750
description:
2025-12-07 15:26:33 dovecot_login authenticator failed for ([203.147.89.38]) [203.147.89.158]:59728: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-07 15:27:05 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (truff) [87.103.126.54]:42966: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.113.212
country_id: 1861060
description:
Dec  7 15:27:31 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=139.162.113.212, lip=66.85.158.92, TLS: Connection closed, session=<wi8JtVlFRoyLonHU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.129.81.82
country_id: 3202326
description:
2025-12-07 15:29:59 dovecot_plain authenticator failed for cpe-188-129-81-82.dynamic.amis.hr (7J2Z8VH88YREWO) [188.129.81.82]:5118: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.207.210.23
country_id: 2960313
description:
2025-12-07 15:30:50 dovecot_plain authenticator failed for (mictes) [88.207.210.23]:62501: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.249.37.9
country_id: 3469034
description:
Dec  7 15:36:53 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=167.249.37.9, lip=66.85.158.91, TLS, session=<lW591VlFxImn+SUJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.68.220.15
country_id: 6252001
description:
2025-12-07 15:36:33 dovecot_plain authenticator failed for c-73-68-220-15.hsd1.ma.comcast.net (strake) [73.68.220.15]:36310: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.60.212.168
country_id: 3175395
description:
Dec  7 15:36:34 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@systemtec.lk>, method=PLAIN, rip=194.60.212.168, lip=66.85.158.91, TLS, session=<Nb9p1FlFl+jCPNSo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.180
country_id: 2542007
description:
2025-12-07 15:38:32 dovecot_plain authenticator failed for (nonopercan) [102.53.15.180]:17706: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 193.34.213.150
country_id: 798544
description:
Dec  7 15:38:40 host2 dovecot[2208013]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=193.34.213.150, lip=66.85.158.91, session=<zlHl3FlF1KXBItWW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.25.186.130
country_id: 6252001
description:
2025-12-07 15:40:47 dovecot_login authenticator failed for ([173.25.186.130]) [173.25.186.130]:60131: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2025-12-07 15:40:55 dovecot_login authenticator failed for (netmail.nasmhpd.org) [50.235.31.47]:49506: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-07 15:41:54 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:60562: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 193.34.213.150
country_id: 798544
description:
Dec  7 15:44:15 host2 dovecot[2208013]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=193.34.213.150, lip=66.85.158.92, session=<MpbY8FlFlJjBItWW>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-07 15:45:50 +0530] info [cpaneld] 213.209.143.251 - 2str "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.146.240.123
country_id: 2542007
description:
2025-12-07 15:45:58 dovecot_plain authenticator failed for (tiventry) [154.146.240.123]:50128: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.146.240.123
country_id: 2542007
description:
2025-12-07 15:50:29 dovecot_plain authenticator failed for (subshes) [154.146.240.123]:53000: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.195.211.98
country_id: 6252001
description:
2025-12-07 15:50:32 dovecot_plain authenticator failed for c-73-195-211-98.hsd1.nj.comcast.net (undeud) [73.195.211.98]:58686: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  7 15:51:16 host2 sshd[2638419]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.41.211.48
country_id: 6252001
description:
2025-12-07 15:52:59 dovecot_login authenticator failed for 48.211.41.34.bc.googleusercontent.com [34.41.211.48]:40936: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.226.82
country_id: 1269750
description:
2025-12-07 15:53:25 dovecot_login authenticator failed for ([128.185.144.1]) [182.95.226.82]:43480: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.146.244
country_id: 3996063
description:
2025-12-07 15:56:26 dovecot_login authenticator failed for ([177.236.146.244]) [177.236.146.244]:41492: 535 Incorrect authentication data (set_id=postmaster@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.211.15.93
country_id: 1269750
description:
2025-12-07 15:56:39 dovecot_login authenticator failed for (static.ill.117.211.15.93.bsnl.co.in) [117.211.15.93]:47730: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.203.49.126
country_id: 2963597
description:
Dec  7 15:57:42 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@jrdc.lk>, method=PLAIN, rip=37.203.49.126, lip=66.85.158.91, TLS, session=<0LrkH1pFuuklyzF+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.72.87
country_id: 3469034
description:
Dec  7 15:58:01 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=187.120.72.87, lip=66.85.158.91, TLS, session=<uhYMIVpFAuK7eEhX>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.51.26.198
country_id: 1269750
description:
2025-12-07 16:00:00 dovecot_plain authenticator failed for (subde) [103.51.26.198]:58740: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.254.161.7
country_id: 1269750
description:
2025-12-07 16:01:03 dovecot_plain authenticator failed for (56QUULLY) [38.254.161.7]:56550: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec  7 16:03:17 host2 sshd[2649665]: Disconnected from invalid user admin 2.57.121.112 port 19705 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.42
country_id: 130758
description:
Dec  7 16:05:01 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=62.60.135.42, lip=66.85.158.91, session=<X0YdO1pFlNI+PIcq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  7 16:08:05 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@ayuzonelanka.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<Uxn3RVpFOKYXXz9j>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.166
country_id: 2993457
description:
Dec  7 16:10:02 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=194.165.16.166, lip=66.85.158.91, session=<R10KTVpFVv7CpRCm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.218.95.154
country_id: 6252001
description:
2025-12-07 16:22:44 dovecot_login authenticator failed for syn-074-218-095-154.biz.spectrum.com [74.218.95.154]:53466: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  7 16:23:03 host2 sshd[2667781]: Disconnected from invalid user user 2.57.121.25 port 13221 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.44.22
country_id: 6252001
description:
2025-12-07 16:23:14 dovecot_login authenticator failed for ([98.181.44.22]) [98.181.44.22]:46017: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.99
country_id: 130758
description:
Dec  7 16:23:32 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=62.60.135.99, lip=66.85.158.91, session=<H75dfVpF/qU+PIdj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.53.7.231
country_id: 6252001
description:
2025-12-07 16:24:44 dovecot_plain authenticator failed for (noles) [64.53.7.231]:50658: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.182.125.210
country_id: 6252001
description:
2025-12-07 16:24:49 dovecot_plain authenticator failed for (indism) [12.182.125.210]:58034: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.145.215
country_id: 3996063
description:
2025-12-07 16:26:24 dovecot_login authenticator failed for ([177.236.145.215]) [177.236.145.215]:35374: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.44.20
country_id: 6252001
description:
2025-12-07 16:27:22 dovecot_login authenticator failed for ([98.181.44.20]) [98.181.44.20]:51001: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2025-12-07 16:27:29 dovecot_login authenticator failed for ([197.219.228.242]) [197.219.228.242]:33482: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.30.196.79
country_id: 290557
description:
2025-12-07 16:27:30 dovecot_login authenticator failed for ([5.30.196.79]) [5.30.196.79]:56077: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.226.118
country_id: 1269750
description:
2025-12-07 16:26:53 dovecot_login authenticator failed for ([27.123.119.219]) [182.95.226.118]:35334: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.219.221.101
country_id: 6251999
description:
2025-12-07 16:26:57 dovecot_login authenticator failed for ([207.219.221.101]) [207.219.221.101]:45027: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.146.144
country_id: 1819730
description:
2025-12-07 16:27:07 dovecot_login authenticator failed for (m121-202-146-144.smartone.com) [121.202.146.144]:42612: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.49.147.210
country_id: 1605651
description:
2025-12-07 16:27:02 dovecot_login authenticator failed for ([110.49.147.210]) [110.49.147.210]:38075: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.98.28.43
country_id: 1269750
description:
2025-12-07 16:27:37 dovecot_login authenticator failed for ([14.98.28.43]) [14.98.28.43]:33152: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec  7 16:29:22 host2 dovecot[2208013]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<lik6klpF7qMDjyE/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.206.93.90
country_id: 290557
description:
2025-12-07 16:28:54 dovecot_plain authenticator failed for (wrize) [94.206.93.90]:45783: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec  7 16:30:11 host2 sshd[2674540]: Disconnected from invalid user denisse 62.60.131.157 port 27477 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 199.45.154.115
country_id: 6252001
description:
Dec  7 16:30:26 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=199.45.154.115, lip=66.85.158.92, TLS: Connection closed, session=<iUgFllpFYvrHLZpz>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec  7 16:30:41 host2 dovecot[2208013]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<oW/kllpFrpkDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec  7 16:32:00 host2 dovecot[2208013]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<a1efm1pFqq4DjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec  7 16:33:19 host2 dovecot[2208013]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<JUZSoFpFTNMDjyE/>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.143.33.63
country_id: 6252001
description:
Dec  7 16:33:30 host2 dovecot[2208013]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<v1D4oFpFhLsDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec  7 16:34:39 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<QtcRpVpFzOkDjyE/>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.143.33.63
country_id: 6252001
description:
Dec  7 16:34:48 host2 dovecot[2208013]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<7iuipVpFvLcDjyE/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.42.225.40
country_id: 2510769
description:
2025-12-07 16:37:15 dovecot_plain authenticator failed for 40.red-81-42-225.staticip.rima-tde.net (cessiledne) [81.42.225.40]:39176: 535 Incorrect authentication data (set_id=sysnytech@sysnytech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 115.84.87.46
country_id: 1655842
description:
[2025-12-07 16:38:26 +0530] info [cpaneld] 115.84.87.46 - fhbgov "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fhbgov (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.38
country_id: 130758
description:
Dec  7 16:38:58 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=62.60.135.38, lip=66.85.158.91, session=<nVSGtFpFHO4+PIcm>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 115.84.87.46
country_id: 1655842
description:
[2025-12-07 16:39:20 +0530] info [cpaneld] 115.84.87.46 - fhbhealt "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.4
country_id: 99237
description:
2025-12-07 16:41:16 dovecot_plain authenticator failed for (biclave) [65.20.133.4]:33097: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2025-12-07 16:44:15 dovecot_plain authenticator failed for host-196-47-172-253.afnet.net (unerse) [196.47.172.253]:34134: 535 Incorrect authentication data (set_id=sysnytech@sysnytech.com)


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 173.70.144.46
country_id: 6252001
description:
Dec  7 16:46:57 host2 sshd[2689300]: User essenceceylontea from 173.70.144.46 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  7 16:58:50 host2 sshd[2700051]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.168.136.150
country_id: 6252001
description:
2025-12-07 16:59:02 dovecot_plain authenticator failed for c-73-168-136-150.hsd1.il.comcast.net (pantiffric) [73.168.136.150]:54466: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.230.65.90
country_id: 6252001
description:
2025-12-07 16:59:05 dovecot_plain authenticator failed for static-96-230-65-90.bstnma.fios.verizon.net (blegrize) [96.230.65.90]:41084: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.235.225.181
country_id: 6252001
description:
2025-12-07 17:02:36 dovecot_plain authenticator failed for c-71-235-225-181.hsd1.ct.comcast.net (mingursear) [71.235.225.181]:55922: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.177.30.53
country_id: 6252001
description:
2025-12-07 17:02:38 dovecot_plain authenticator failed for c-66-177-30-53.hsd1.fl.comcast.net (kirnachoty) [66.177.30.53]:50456: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.202.20.23
country_id: 6252001
description:
Dec  7 17:03:13 host2 dovecot[2208013]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=44.202.20.23, lip=66.85.158.91, session=<ghxDC1tFENMsyhQX>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.120.142.233
country_id: 2510769
description:
2025-12-07 17:03:20 dovecot_plain authenticator failed for (psynced) [185.120.142.233]:34566: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.219.104.210
country_id: 3175395
description:
2025-12-07 17:03:24 dovecot_plain authenticator failed for net-188-219-104-210.cust.vodafonedsl.it (preapy) [188.219.104.210]:44005: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
country_id: 6252001
description:
2025-12-07 17:03:27 dovecot_plain authenticator failed for (clitical) [24.187.213.29]:52182: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.172
country_id: 1733045
description:
2025-12-07 17:04:57 dovecot_login authenticator failed for ([49.124.152.172]) [49.124.152.172]:51004: 535 Incorrect authentication data (set_id=sales@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.112.103.9
country_id: 1861060
description:
2025-12-07 17:05:16 dovecot_login authenticator failed for p160010-obmd01.osaka.ocn.ne.jp [61.112.103.9]:51071: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-07 17:07:00 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (pleimplut) [87.103.126.54]:48378: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.102
country_id: 130758
description:
Dec  7 17:11:10 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=62.60.135.102, lip=66.85.158.91, session=<quSrJ1tF1ps+PIdm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.40
country_id: 130758
description:
Dec  7 17:13:34 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=62.60.135.40, lip=66.85.158.91, session=<xdhDMFtFFOo+PIco>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.99
country_id: 130758
description:
Dec  7 17:22:19 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=62.60.135.99, lip=66.85.158.91, session=<gh+OT1tFCr0+PIdj>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.90.12.192
country_id: 6252001
description:
Dec  7 17:23:36 host2 dovecot[2208013]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.90.12.192, lip=66.85.158.91, session=<208oVFtFrsQDWgzA>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.59.253.88
country_id: 6252001
description:
2025-12-07 17:27:15 dovecot_plain authenticator failed for c-174-59-253-88.hsd1.pa.comcast.net (augly) [174.59.253.88]:57052: 535 Incorrect authentication data (set_id=sysnytech@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.40.189.43
country_id: 6252001
description:
2025-12-07 17:27:18 dovecot_plain authenticator failed for c-68-40-189-43.hsd1.mi.comcast.net (bilight) [68.40.189.43]:42634: 535 Incorrect authentication data (set_id=sysnytech@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.172.54.29
country_id: 6252001
description:
2025-12-07 17:27:22 dovecot_plain authenticator failed for c-67-172-54-29.hsd1.pa.comcast.net (nouloseyer) [67.172.54.29]:55272: 535 Incorrect authentication data (set_id=sysnytech@sysnytech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.89.57.53
country_id: 1269750
description:
Dec  7 17:29:21 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=103.89.57.53, lip=66.85.158.91, TLS, session=<L210Z1tF88FnWTk1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.0.93
country_id: 2300660
description:
Dec  7 17:29:41 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=41.139.0.93, lip=66.85.158.91, TLS, session=<8vDXaFtF8OApiwBd>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  7 17:35:03 host2 sshd[2730007]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  7 17:35:03 host2 sshd[2729839]: Disconnected from invalid user user 2.57.121.25 port 12119 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.110
country_id: 1269750
description:
2025-12-07 17:37:15 dovecot_login authenticator failed for ([182.95.228.110]) [182.95.228.110]:56674: 535 Incorrect authentication data (set_id=contacto@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 149.88.26.69
country_id: 294640
description:
Dec  7 17:37:37 host2 dovecot[2208013]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=149.88.26.69, lip=66.85.158.91, session=<2AFKhltF9KaVWBpF>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 156.146.55.181
country_id: 732800
description:
Dec  7 17:37:38 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=156.146.55.181, lip=66.85.158.91, session=<4fhehltF5qickje1>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 188.241.177.120
country_id: 3469034
description:
Dec  7 17:37:35 host2 pure-ftpd[2732644]: (?@188.241.177.120) [INFO] New connection from 188.241.177.120


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 173.239.247.46
country_id: 1562822
description:
Dec  7 17:37:37 host2 dovecot[2208013]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=173.239.247.46, lip=66.85.158.91, session=<pYpLhltFKsKt7/cu>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 154.47.16.229
country_id: 3686110
description:
Dec  7 17:37:47 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=154.47.16.229, lip=66.85.158.91, TLS handshaking: Connection closed, session=<yGXfhltFZr6aLxDl>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 84.239.42.134
country_id: 690791
description:
Dec  7 17:37:48 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=84.239.42.134, lip=66.85.158.91, session=<Pt3uhltFQpJU7yqG>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 188.214.125.74
country_id: 1694008
description:
Dec  7 17:37:47 host2 dovecot[2208013]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=188.214.125.74, lip=66.85.158.91, session=<hwfbhltFkIa81n1K>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 103.108.174.158
country_id: 1269750
description:
Dec  7 17:37:47 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=103.108.174.158, lip=66.85.158.91, TLS, session=<zcjfhltFar5nbK6e>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.210.246.54
country_id: 289688
description:
2025-12-07 17:37:25 dovecot_login authenticator failed for ([37.210.246.54]) [37.210.246.54]:50638: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.217.71.151
country_id: 3175395
description:
Dec  7 17:37:37 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=185.217.71.151, lip=66.85.158.91, session=<eJVPhltFHMK52UeX>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 103.108.174.168
country_id: 1269750
description:
Dec  7 17:37:38 host2 dovecot[2208013]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=103.108.174.168, lip=66.85.158.91, session=<gatahltFbs1nbK6o>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 181.214.218.182
country_id: 2802361
description:
Dec  7 17:37:38 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=181.214.218.182, lip=66.85.158.91, TLS handshaking: Connection closed, session=<FvxYhltF1qO11tq2>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.80.150.219
country_id: 3190538
description:
Dec  7 17:37:47 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=195.80.150.219, lip=66.85.158.91, session=<BUrfhltFgIbDUJbb>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 149.102.232.94
country_id: 3057568
description:
Dec  7 17:37:35 host2 pure-ftpd[2732655]: (?@149.102.232.94) [INFO] New connection from 149.102.232.94


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 173.244.49.49
country_id: 1668284
description:
Dec  7 17:37:35 host2 pure-ftpd[2732665]: (?@173.244.49.49) [INFO] New connection from 173.244.49.49


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 188.241.177.142
country_id: 3469034
description:
Dec  7 17:37:37 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=188.241.177.142, lip=66.85.158.91, session=<LkhNhltF6qa88bGO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.189.114.123
country_id: 719819
description:
Dec  7 17:37:38 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=185.189.114.123, lip=66.85.158.91, TLS, session=<NFJZhltFhsS5vXJ7>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-07 17:41:23 +0530] info [cpaneld] 213.209.143.251 - 2stravel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.99
country_id: 130758
description:
Dec  7 17:40:58 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=62.60.135.99, lip=66.85.158.91, session=<8fJAkltFQrw+PIdj>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  7 17:42:04 host2 sshd[2736732]: Disconnected from invalid user user 2.57.121.25 port 53449 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2025-12-07 17:42:31 dovecot_plain authenticator failed for (icatied) [154.144.243.93]:59384: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.108
country_id: 130758
description:
Dec  7 17:47:13 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=62.60.135.108, lip=66.85.158.91, session=<pl6XqFtFkKs+PIds>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2025-12-07 17:47:51 dovecot_plain authenticator failed for (deass) [154.144.243.93]:41464: 535 Incorrect authentication data (set_id=sysnytech@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.62.224.44
country_id: 3017382
description:
2025-12-07 17:47:54 dovecot_plain authenticator failed for ftp-mutu001.plug-it.com (callopher) [185.62.224.44]:39248: 535 Incorrect authentication data (set_id=sysnytech@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.160.107
country_id: 99237
description:
2025-12-07 17:50:25 dovecot_plain authenticator failed for (glygme) [65.20.160.107]:43558: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.145.118.40
country_id: 3175395
description:
2025-12-07 17:54:15 dovecot_plain authenticator failed for net-93-145-118-40.cust.vodafonedsl.it (elusky) [93.145.118.40]:49760: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.13.94
country_id: 3144096
description:
2025-12-07 17:54:37 dovecot_login authenticator failed for (cm-84.211.13.94.get.no) [84.211.13.94]:44889: 535 Incorrect authentication data (set_id=contacto@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.251.66
country_id: 1269750
description:
2025-12-07 17:55:03 dovecot_login authenticator failed for ([128.185.224.250]) [125.20.251.66]:33540: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.46.39
country_id: 6252001
description:
2025-12-07 17:57:45 dovecot_login authenticator failed for ([98.181.46.39]) [98.181.46.39]:54383: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.83.30.199
country_id: 6252001
description:
2025-12-07 17:58:14 dovecot_login authenticator failed for ool-43531ec7.dyn.optonline.net [67.83.30.199]:33622: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.225.114.100
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 64.225.114.100 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.191.12
country_id: 99237
description:
2025-12-07 17:59:25 dovecot_plain authenticator failed for (afters) [65.20.191.12]:49926: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  7 18:00:10 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<order@askinternationalconsortium.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<4bvE1ltFMtAXXz9j>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.66
country_id: 1149361
description:
2025-12-07 18:02:59 dovecot_login authenticator failed for ([149.54.62.66]) [149.54.62.66]:37229: 535 Incorrect authentication data (set_id=postmaster@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.251.73
country_id: 1269750
description:
2025-12-07 18:03:32 dovecot_login authenticator failed for (nsg-corporate-73.251.187.122.airtel.in) [122.187.251.73]:44458: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-07 18:05:42 +0530] info [cpaneld] 213.209.143.251 - agronatu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agronatu (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-07 18:09:28 +0530] info [cpaneld] 213.209.143.251 - ajsstarl "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajsstarl (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.231.85.75
country_id: 2464461
description:
2025-12-07 18:11:09 dovecot_login authenticator failed for ([41.231.85.75]) [41.231.85.75]:41604: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.103
country_id: 130758
description:
Dec  7 18:11:37 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=62.60.135.103, lip=66.85.158.91, session=<bErm/1tFHMg+PIdn>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.97.62
country_id: 1269750
description:
2025-12-07 18:11:46 dovecot_login authenticator failed for (nsg-corporate-209.240.186.122.airtel.in) [27.123.97.62]:35402: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.102.49.193
country_id: 2750405
description:
Dec  7 18:17:24 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record (no auth attempts in 1 secs): user=<>, rip=94.102.49.193, lip=66.85.158.92, TLS: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record, session=<DceLFFxFEMdeZjHB>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 94.102.49.193
country_id: 2750405
description:
Dec  7 18:17:22 host2 dovecot[2208013]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 2 secs): user=<>, rip=94.102.49.193, lip=66.85.158.92, TLS, session=<g/R0FFxFdrteZjHB>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.230.86.50
country_id: 6252001
description:
2025-12-07 18:27:22 dovecot_plain authenticator failed for c-73-230-86-50.hsd1.pa.comcast.net (paluitim) [73.230.86.50]:42456: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.31.15.108
country_id: 290557
description:
2025-12-07 18:27:32 dovecot_plain authenticator failed for (aftic) [5.31.15.108]:60383: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.3.178.94
country_id: 3175395
description:
2025-12-07 18:27:02 dovecot_plain authenticator failed for (bessopory) [151.3.178.94]:55602: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.137.7.97
country_id: 6252001
description:
2025-12-07 18:27:03 dovecot_plain authenticator failed for c-73-137-7-97.hsd1.ga.comcast.net (seens) [73.137.7.97]:57926: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.40
country_id: 130758
description:
Dec  7 18:27:12 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=62.60.135.40, lip=66.85.158.91, session=<JlWWN1xFtrY+PIco>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.53.7.231
country_id: 6252001
description:
2025-12-07 18:27:19 dovecot_plain authenticator failed for (plean) [64.53.7.231]:45012: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.42
country_id: 130758
description:
Dec  7 18:32:58 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=62.60.135.42, lip=66.85.158.91, session=<F2M+TFxFCr8+PIcq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.177.113.12
country_id: 3175395
description:
Dec  7 18:36:20 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@jrdc.lk>, method=PLAIN, rip=195.177.113.12, lip=66.85.158.91, TLS, session=<IuskV1xFn8DDsXEM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.124.182.133
country_id: 3175395
description:
Dec  7 18:36:40 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=185.124.182.133, lip=66.85.158.91, TLS, session=<i81dWFxFRI65fLaF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.216.28.142
country_id: 798544
description:
Dec  7 18:42:47 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@systemtec.lk>, method=PLAIN, rip=178.216.28.142, lip=66.85.158.91, TLS, session=<TelXblxF7Z2y2ByO>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  7 18:43:09 host2 sshd[2789422]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.122.128.164
country_id: 3865483
description:
Dec  7 18:43:12 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info>, method=PLAIN, rip=190.122.128.164, lip=66.85.158.91, TLS, session=<emqOb1xFvK6+eoCk>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 51.159.234.118
country_id: 2750405
description:
Dec  7 18:45:48 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1420918C:SSL routines:tls_early_post_process_client_hello:version too low (no auth attempts in 0 secs): user=<>, rip=51.159.234.118, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1420918C:SSL routines:tls_early_post_process_client_hello:version too low, session=<u3wcelxFPrwzn+p2>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.118
country_id: 6252001
description:
Dec  7 18:45:48 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 15 secs): user=<>, rip=66.132.153.118, lip=66.85.158.92, TLS handshaking: Connection closed, session=<KjQaelxFVvJChJl2>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 51.159.234.118
country_id: 2750405
description:
Dec  7 18:45:47 host2 pure-ftpd[2792140]: (?@51.159.234.118) [INFO] New connection from 51.159.234.118


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2025-12-07 18:47:15 dovecot_login authenticator failed for ([41.220.3.113]) [41.220.3.101]:60507: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.206.93.90
country_id: 290557
description:
2025-12-07 18:47:31 dovecot_login authenticator failed for ([94.206.93.90]) [94.206.93.90]:53205: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.46.148.180
country_id: 6252001
description:
2025-12-07 18:48:10 dovecot_plain authenticator failed for c-68-46-148-180.hsd1.mi.comcast.net (supir) [68.46.148.180]:36136: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.96
country_id: 130758
description:
Dec  7 18:48:19 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=62.60.135.96, lip=66.85.158.91, session=<2Uslg1xF0sw+PIdg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.129.28
country_id: 99237
description:
2025-12-07 19:03:03 dovecot_plain authenticator failed for (delecum) [65.20.129.28]:34721: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.123.219.82
country_id: 6252001
description:
2025-12-07 19:03:06 dovecot_plain authenticator failed for ool-457bdb52.dyn.optonline.net (daceting) [69.123.219.82]:60198: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.123
country_id: 6252001
description:
Dec  7 19:04:45 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=66.132.153.123, lip=66.85.158.91, TLS: Connection closed, session=<Cp7nvVxFZpxChJl7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.220.132.207
country_id: 2077456
description:
2025-12-07 19:05:09 dovecot_login authenticator failed for 207.132.220.111.sta.wbroadband.net.au [111.220.132.207]:50867: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.87.248.223
country_id: 732800
description:
2025-12-07 19:05:37 dovecot_login authenticator failed for 95-87-248-223.ip.btc-net.bg [95.87.248.223]:59360: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.123
country_id: 6252001
description:
Dec  7 19:04:53 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1420918C:SSL routines:tls_early_post_process_client_hello:version too low (no auth attempts in 0 secs): user=<>, rip=66.132.153.123, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1420918C:SSL routines:tls_early_post_process_client_hello:version too low, session=<JWNfvlxFZqpChJl7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.226.14.93
country_id: 294640
description:
2025-12-07 19:06:29 dovecot_plain authenticator failed for (tomby) [109.226.14.93]:52421: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-07 19:07:47 +0530] info [cpaneld] 213.209.143.251 - agrona "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agrona (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec  7 19:07:51 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<gVbXyFxFdNw+PIcd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.30
country_id: 130758
description:
Dec  7 19:09:47 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<WkzLz1xFMIk+PIce>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-07 19:09:58 +0530] info [cpaneld] 213.209.143.251 - ajssta "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajssta (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec  7 19:10:43 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<+ccW01xF8IY+PIcl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.41
country_id: 130758
description:
Dec  7 19:10:44 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=62.60.135.41, lip=66.85.158.91, session=<Ba8k01xF1p4+PIcp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.127.150
country_id: 1269750
description:
2025-12-07 19:11:51 dovecot_login authenticator failed for (nsg-corporate-177.246.185.122.airtel.in) [122.184.127.150]:58646: 535 Incorrect authentication data (set_id=sales@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2025-12-07 19:11:53 dovecot_login authenticator failed for ([154.144.243.93]) [154.144.243.93]:39772: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.186
country_id: 2186224
description:
2025-12-07 19:12:40 dovecot_login authenticator failed for ([121.73.163.186]) [121.73.163.186]:35808: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.146.18
country_id: 1269750
description:
2025-12-07 19:12:48 dovecot_login authenticator failed for (nsg-corporate-127.152.185.122.airtel.in) [122.185.146.18]:39574: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.128.202
country_id: 6252001
description:
2025-12-07 19:12:03 dovecot_login authenticator failed for ([192.34.128.202]) [192.34.128.202]:50998: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.59.16.119
country_id: 3175395
description:
2025-12-07 19:12:28 dovecot_login authenticator failed for ([101.59.16.119]) [101.59.16.119]:53118: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.152.225.154
country_id: 6251999
description:
2025-12-07 19:12:32 dovecot_login authenticator failed for s75-152-225-154.ab.hsia.telus.net [75.152.225.154]:11274: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.185.120.60
country_id: 6252001
description:
2025-12-07 19:12:33 dovecot_login authenticator failed for ([98.185.120.60]) [98.185.120.60]:47738: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.92.29
country_id: 1168579
description:
2025-12-07 19:13:01 dovecot_login authenticator failed for (29.92.zcomnetworks.com.pk) [103.148.92.29]:60504: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.94
country_id: 6252001
description:
Dec  7 19:15:22 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.94, lip=66.85.158.92, session=<XZbh41xFqn9BMQFe>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.247.194
country_id: 6252001
description:
Dec  7 19:16:00 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=184.105.247.194, lip=66.85.158.92, session=<GfEh5lxFeO64affC>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.206
country_id: 6252001
description:
Dec  7 19:16:10 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.206, lip=66.85.158.92, TLS handshaking: Connection closed, session=<6I+45lxFz+RBMQHO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.202
country_id: 6252001
description:
Dec  7 19:16:28 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.202, lip=66.85.158.92, TLS handshaking: Connection closed, session=<sYLM51xFTMpBMQHK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.92
country_id: 130758
description:
Dec  7 19:16:38 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=62.60.135.92, lip=66.85.158.91, session=<fHZK6FxFLtQ+PIdc>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  7 19:19:37 host2 sshd[2822473]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.172.54.29
country_id: 6252001
description:
2025-12-07 19:21:19 dovecot_plain authenticator failed for c-67-172-54-29.hsd1.pa.comcast.net (troid) [67.172.54.29]:33270: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec  7 19:21:48 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<iczG+lxF6s4+PIce>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.97.190.237
country_id: 6252001
description:
2025-12-07 19:21:52 dovecot_plain authenticator failed for (mical) [75.97.190.237]:44696: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.235.225.181
country_id: 6252001
description:
2025-12-07 19:21:16 dovecot_plain authenticator failed for c-71-235-225-181.hsd1.ct.comcast.net (nounan) [71.235.225.181]:53560: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.42
country_id: 130758
description:
Dec  7 19:22:08 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.42, lip=66.85.158.91, session=<Isnu+1xF4KM+PIcq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2025-12-07 19:26:30 dovecot_plain authenticator failed for host-196-47-172-253.afnet.net (mistaly) [196.47.172.253]:53353: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec  7 19:26:00 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<QVC/CV1FROY+PIce>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.188.251
country_id: 290557
description:
2025-12-07 19:26:25 dovecot_plain authenticator failed for (pinvele) [91.73.188.251]:47014: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.53.228.211
country_id: 1527747
description:
2025-12-07 19:27:54 dovecot_login authenticator failed for ([77.95.56.101]) [185.53.228.211]:7432: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.10.197.168
country_id: 2661886
description:
2025-12-07 19:28:42 dovecot_login authenticator failed for h-176-10-197-168.a444.priv.bahnhof.se [176.10.197.168]:38640: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec  7 19:29:23 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<3unjFV1F6OI+PIdf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.108
country_id: 130758
description:
Dec  7 19:29:57 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@venee.lk>, method=PLAIN, rip=62.60.135.108, lip=66.85.158.91, session=<pWHnF11FkOk+PIds>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 150.249.252.237
country_id: 1861060
description:
2025-12-07 19:31:17 dovecot_login authenticator failed for fs96f9fced.tkyc203.ap.nuro.jp [150.249.252.237]:51575: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.51.166
country_id: 1269750
description:
2025-12-07 19:31:36 dovecot_login authenticator failed for ([125.23.112.209]) [182.95.51.166]:60950: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-07 19:32:48 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:49186: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.28.190.76
country_id: 2510769
description:
Dec  7 19:34:46 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=139.28.190.76, lip=66.85.158.91, TLS, session=<NP0/KF1FUKWLHL5M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 181.16.209.5
country_id: 3865483
description:
Dec  7 19:35:07 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=181.16.209.5, lip=66.85.158.91, TLS, session=<YPNfKV1F+uK1ENEF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.85.202
country_id: 337996
description:
2025-12-07 19:36:41 dovecot_login authenticator failed for ([196.191.212.236]) [213.55.85.202]:3703: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.59.81.78
country_id: 1269750
description:
Dec  7 19:37:02 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=139.59.81.78, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<kXVeMV1FdquLO1FO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.165.208.12
country_id: 2077456
description:
2025-12-07 19:36:59 dovecot_login authenticator failed for (cpe-101-165-208-12.vb08.vic.asp.telstra.net) [101.165.208.12]:50262: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.81.229.179
country_id: 6252001
description:
2025-12-07 19:38:49 dovecot_plain authenticator failed for (untiousm) [192.81.229.179]:50004: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Dec  7 19:39:26 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<O4zPOV1FIJA+PIcs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.72.9.151
country_id: 1269750
description:
2025-12-07 19:39:03 dovecot_login authenticator failed for (9.72.116.151.hathway.com) [116.72.9.151]:41828: 535 Incorrect authentication data (set_id=test@dragon.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.92.45.236
country_id: 6252001
description:
[2025-12-07 19:42:17 +0530] info [whostmgrd] 72.92.45.236 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.6.160.129
country_id: 6252001
description:
[2025-12-07 19:42:24 +0530] info [cpaneld] 73.6.160.129 - sysnyt "GET /login/?login_only=1&user=sysnyt&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sysnyt (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.165.146.177
country_id: 6252001
description:
[2025-12-07 19:42:28 +0530] info [cpaneld] 75.165.146.177 - sysny "GET /login/?login_only=1&user=sysny&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sysny (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.71.37.127
country_id: 6252001
description:
[2025-12-07 19:42:29 +0530] info [cpaneld] 73.71.37.127 - sysn "GET /login/?login_only=1&user=sysn&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sysn (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 65.32.143.34
country_id: 6252001
description:
[2025-12-07 19:42:38 +0530] info [cpaneld] 65.32.143.34 - sys "GET /login/?login_only=1&user=sys&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sys (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.89.72.49
country_id: 6252001
description:
[2025-12-07 19:42:14 +0530] info [cpaneld] 170.89.72.49 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.235.235.200
country_id: 6252001
description:
[2025-12-07 19:42:15 +0530] info [cpaneld] 73.235.235.200 - sysnytech "GET /login/?login_only=1&user=sysnytech&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.243.58.71
country_id: 6252001
description:
[2025-12-07 19:42:18 +0530] info [cpaneld] 108.243.58.71 - sysnytechcom "GET /login/?login_only=1&user=sysnytechcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sysnytechcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.97.61.203
country_id: 6252001
description:
[2025-12-07 19:42:41 +0530] info [cpaneld] 98.97.61.203 - sy "GET /login/?login_only=1&user=sy&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sy (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.117.110.120
country_id: 6252001
description:
[2025-12-07 19:42:23 +0530] info [cpaneld] 172.117.110.120 - sysnyte "GET /login/?login_only=1&user=sysnyte&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sysnyte (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.147.202.243
country_id: 6252001
description:
[2025-12-07 19:42:12 +0530] info [cpaneld] 24.147.202.243 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.48.52.170
country_id: 6252001
description:
[2025-12-07 19:42:20 +0530] info [cpaneld] 45.48.52.170 - sysnytec "GET /login/?login_only=1&user=sysnytec&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sysnytec (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Dec  7 19:43:08 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<JGoRR11F1OY+PIcr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.107
country_id: 130758
description:
Dec  7 19:43:22 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.107, lip=66.85.158.91, session=<FpXZR11FGrM+PIdr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.59.214.168
country_id: 3469034
description:
2025-12-07 19:45:11 dovecot_login authenticator failed for ([191.59.214.168]) [191.59.214.168]:49442: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.36.204
country_id: 3144096
description:
2025-12-07 19:44:58 dovecot_login authenticator failed for (cm-178.232.36.204.get.no) [178.232.36.204]:39737: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.195.211.98
country_id: 6252001
description:
2025-12-07 19:46:27 dovecot_plain authenticator failed for c-73-195-211-98.hsd1.nj.comcast.net (rapicklen) [73.195.211.98]:44680: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 199.45.154.125
country_id: 6252001
description:
Dec  7 19:47:31 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=199.45.154.125, lip=66.85.158.92, TLS: Connection closed, session=<j7raVl1FTLfHLZp9>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-07 19:54:43 +0530] info [cpaneld] 213.209.143.251 - 2str "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.106.56.125
country_id: 6252001
description:
Dec  7 19:58:08 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.106.56.125, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<yW7PfF1FAtYUajh9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.53.131.12
country_id: 3469034
description:
Dec  7 19:59:31 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=191.53.131.12, lip=66.85.158.91, TLS, session=<m+J7gF1Fr9S/NYMM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.181.109.235
country_id: 3865483
description:
Dec  7 19:59:58 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 23 secs): user=<587hr>, method=PLAIN, rip=190.181.109.235, lip=66.85.158.91, TLS, session=<MtDygV1Ffqy+tW3r>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec  7 20:00:38 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<ltSehV1FsOg+PIce>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-07 20:00:45 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (argishbon) [87.103.126.54]:35152: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.206.93.90
country_id: 290557
description:
2025-12-07 20:02:33 dovecot_plain authenticator failed for (squenur) [94.206.93.90]:41862: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.106
country_id: 130758
description:
Dec  7 20:03:15 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=62.60.135.106, lip=66.85.158.91, session=<Ao72jl1F5KQ+PIdq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.140.18.186
country_id: 1269750
description:
2025-12-07 20:10:21 dovecot_login authenticator failed for ([103.140.18.186]) [103.140.18.186]:58604: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.160.67.39
country_id: 3996063
description:
2025-12-07 20:10:34 dovecot_login authenticator failed for ([201.160.67.39]) [201.160.67.39]:57364: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.46.34
country_id: 6252001
description:
2025-12-07 20:10:41 dovecot_login authenticator failed for ([98.181.46.34]) [98.181.46.34]:40040: 535 Incorrect authentication data (set_id=admin@dragon.lk)


