# incident

plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.201.182
country_id: 1880251
description:
Jan  7 09:20:30 host2 sshd[2841032]: Disconnected from invalid user bitrix 45.78.201.182 port 37892 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  7 09:22:22 host2 sshd[2843127]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.201.182
country_id: 1880251
description:
Jan  7 09:22:35 host2 sshd[2843338]: Disconnected from invalid user claude 45.78.201.182 port 47424 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 139.59.64.16
country_id: 1269750
description:
Jan  7 09:24:05 host2 sshd[2844888]: Disconnected from invalid user test 139.59.64.16 port 35260 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.120
country_id: 2635167
description:
Jan  7 09:24:13 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.203.211.120, lip=66.85.158.92, TLS, session=<U1DVPsRHxPUjy9N4>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.162.230.58
country_id: 3469034
description:
[2025-12-26 17:26:14 +0530] info [webmaild] 45.162.230.58 - 587hr@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.22.90.217
country_id: 2802361
description:
2026-01-07 09:34:28 dovecot_login authenticator failed for H=(ADMIN) [149.22.90.217]:13497: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.162.163
country_id: 298795
description:
2026-01-07 09:37:03 dovecot_login authenticator failed for H=([5.11.162.163]) [5.11.162.163]:35893: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.107.116.210
country_id: 798544
description:
2026-01-07 09:37:21 dovecot_login authenticator failed for H=(host-176.107.116-210.dynamic.mm.pl) [176.107.116.210]:45307: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.23.73.205
country_id: 6252001
description:
2026-01-07 09:41:08 dovecot_login authenticator failed for H=([209.23.73.205]) [209.23.73.205]:59294: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.223.142
country_id: 1269750
description:
2026-01-07 09:41:26 dovecot_login authenticator failed for H=([128.185.247.127]) [182.95.223.142]:39670: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.222.81.115
country_id: 6252001
description:
Jan  7 09:42:24 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=44.222.81.115, lip=66.85.158.92, TLS, session=<8W3ef8RHbMMs3lFz>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  7 09:44:58 host2 sshd[2869753]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.183
country_id: 6252001
description:
Jan  7 09:45:16 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=198.235.24.183, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<u6YWisRHZs/G6xi3>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  7 09:46:39 host2 sshd[2871895]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.37.32.248
country_id: 1269750
description:
2026-01-07 09:46:19 dovecot_login authenticator failed for H=(nsg-corporate-90.179.185.122.airtel.in) [49.37.32.248]:54974: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  7 09:47:15 host2 sshd[2872590]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.105.248.218
country_id: 6252001
description:
2026-01-07 09:49:13 dovecot_login authenticator failed for H=([24.105.248.218]) [24.105.248.218]:51044: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.36.204
country_id: 3144096
description:
2026-01-07 09:49:22 dovecot_login authenticator failed for H=(cm-178.232.36.204.get.no) [178.232.36.204]:59045: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.100
country_id: 6252001
description:
Jan  7 09:51:24 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=198.235.24.100, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<c9EKoMRHh9jG6xhk>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.29.57
country_id: 1880251
description:
Jan  7 09:52:09 host2 sshd[2877920]: Disconnected from invalid user claude 165.154.29.57 port 34216 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.125.162.32
country_id: 718075
description:
Jan  7 09:54:59 host2 sshd[2881416]: Disconnected from invalid user neko 79.125.162.32 port 50274 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.29.57
country_id: 1880251
description:
Jan  7 09:55:16 host2 sshd[2881836]: Disconnected from invalid user claude 165.154.29.57 port 41102 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 79.125.162.32
country_id: 718075
description:
Jan  7 09:55:32 host2 sshd[2882145]: Disconnected from invalid user bitrix 79.125.162.32 port 42582 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 165.154.29.57
country_id: 1880251
description:
Jan  7 09:57:37 host2 sshd[2883962]: Disconnected from invalid user deploy 165.154.29.57 port 51434 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.32.122.85
country_id: 597427
description:
2026-01-07 10:04:14 dovecot_login authenticator failed for H=(ADMIN) [194.32.122.85]:40246: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-07 10:05:47 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (crowism) [87.103.126.54]:13636: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  7 10:06:04 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 1 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<5Ct71MRHRskDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  7 10:06:13 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS handshaking: Connection closed, session=<iP8G1cRHMskDhBfJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2026-01-07 10:06:12 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:61422: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.237.173.220
country_id: 6252001
description:
Jan  7 10:09:25 host2 dovecot[1170291]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.237.173.220, lip=66.85.158.92, session=<pLV/4MRHiskD7a3c>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  7 10:09:29 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<x4Ww4MRHrN8DhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  7 10:11:59 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS handshaking: Connection closed, session=</IWt6cRHWoADhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  7 10:15:30 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS, session=<k1E+9sRHtrkDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  7 10:19:11 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<EJplA8VHIu0DhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  7 10:19:17 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS handshaking: Connection closed, session=<IXXDA8VHgN8DhBfJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.132.181.70
country_id: 1522867
description:
2026-01-07 10:20:47 dovecot_login authenticator failed for H=2.132.181.70.dynamic.telecom.kz [2.132.181.70]:39112: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  7 10:20:57 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS, session=<FzS/CcVHKqEDhBfJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.250.191.189
country_id: 458258
description:
2026-01-07 10:21:10 dovecot_login authenticator failed for H=([178.250.191.189]) [178.250.191.189]:53904: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.192.245.178
country_id: 1269750
description:
2026-01-07 10:21:46 dovecot_login authenticator failed for H=(dhcp-192-245-178.in2cable.com) [203.192.245.178]:33816: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.94.119.250
country_id: 1694008
description:
[2026-01-07 10:22:22 +0530] info [webmaild] 172.94.119.250 - hr@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.61.228.13
country_id: 2077456
description:
2026-01-07 10:23:27 dovecot_login authenticator failed for H=(ADMIN) [179.61.228.13]:63347: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.8.241.171
country_id: 2077456
description:
2026-01-07 10:28:32 dovecot_login authenticator failed for H=([161.8.241.171]) [161.8.241.171]:58086: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.177.88.62
country_id: 3624060
description:
2026-01-07 10:28:55 dovecot_login authenticator failed for H=([186.177.88.62]) [186.177.88.62]:58167: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.74.136.134
country_id: 6252001
description:
2026-01-07 10:35:06 dovecot_plain authenticator failed for H=syn-050-074-136-134.biz.spectrum.com (tecilvily) [50.74.136.134]:40120: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
country_id: 6252001
description:
2026-01-07 10:34:58 dovecot_plain authenticator failed for H=(beringy) [24.187.213.29]:45116: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.49.115.132
country_id: 1269750
description:
2026-01-07 10:41:37 dovecot_plain authenticator failed for H=(JKJEX) [157.49.115.132]:51362: 535 Incorrect authentication data (set_id=lasithar@ksoft.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.253
country_id: 6252001
description:
Jan  7 10:43:08 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.253, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<86EKWcVHgdDN0h/9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.37.242.247
country_id: 1269750
description:
2026-01-07 10:43:45 dovecot_plain authenticator failed for H=(JKJEX) [49.37.242.247]:54103: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.183.74.177
country_id: 6252001
description:
2026-01-07 10:45:45 dovecot_plain authenticator failed for H=c-73-183-74-177.hsd1.pa.comcast.net (auxoling) [73.183.74.177]:34308: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.246.170.194
country_id: 1269750
description:
Jan  7 10:47:10 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=103.246.170.194, lip=66.85.158.91, TLS, session=<ZhtdZsVHA9xn9qrC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.189.201.122
country_id: 3469034
description:
Jan  7 10:47:31 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=179.189.201.122, lip=66.85.158.91, TLS, session=<6bukZ8VHfIyzvcl6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.225.31.22
country_id: 718075
description:
2026-01-07 10:49:44 dovecot_login authenticator failed for H=(ADMIN) [185.225.31.22]:51092: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  7 10:50:22 host2 sshd[2935122]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.58.241.90
country_id: 3469034
description:
2026-01-07 10:52:46 dovecot_login authenticator failed for H=(ccabv.org9.static.gvt.net.br) [187.58.241.90]:36727: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.207.251.240
country_id: 290557
description:
2026-01-07 10:53:02 dovecot_login authenticator failed for H=([94.207.251.240]) [94.207.251.240]:57714: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.20.68
country_id: 6252001
description:
Jan  7 10:53:26 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.20.68, lip=66.85.158.92, TLS handshaking: Connection closed, session=<ShbmfcVHDnZBMRRE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.209
country_id: 2635167
description:
Jan  7 10:54:14 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 46 secs): user=<>, rip=35.203.210.209, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<qhO5gMVHZ98jy9LR>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.46.45.121
country_id: 290557
description:
2026-01-07 10:57:30 dovecot_login authenticator failed for H=([20.46.45.121]) [20.46.45.121]:57178: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.54
country_id: 1149361
description:
2026-01-07 10:57:43 dovecot_login authenticator failed for H=([149.54.62.54]) [149.54.62.54]:49571: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.42.225.40
country_id: 2510769
description:
2026-01-07 10:57:51 dovecot_login authenticator failed for H=40.red-81-42-225.staticip.rima-tde.net [81.42.225.40]:37992: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.162.163
country_id: 298795
description:
2026-01-07 10:57:57 dovecot_login authenticator failed for H=([5.11.162.163]) [5.11.162.163]:37118: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.57
country_id: 1733045
description:
2026-01-07 10:58:38 dovecot_login authenticator failed for H=([49.124.153.57]) [49.124.153.57]:55530: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.216.92.113
country_id: 6290252
description:
Jan  7 10:59:32 host2 sshd[2943533]: Disconnected from invalid user claude 89.216.92.113 port 56764 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.192.166
country_id: 1269750
description:
2026-01-07 10:59:34 dovecot_login authenticator failed for H=([27.123.105.234]) [128.185.192.166]:49558: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.208.38
country_id: 1036973
description:
2026-01-07 10:59:48 dovecot_login authenticator failed for H=([197.219.208.38]) [197.219.208.38]:55168: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.216.92.113
country_id: 6290252
description:
Jan  7 11:00:42 host2 sshd[2944580]: Disconnected from invalid user celia 89.216.92.113 port 60648 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.196
country_id: 6252001
description:
Jan  7 11:01:09 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=205.210.31.196, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<K0V6mcVHDcXN0h/E>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  7 11:02:09 host2 sshd[2945652]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.209
country_id: 2635167
description:
Jan  7 11:01:55 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=35.203.210.209, lip=66.85.158.91, TLS, session=<nL41nMVHkugjy9LR>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 89.216.92.113
country_id: 6290252
description:
Jan  7 11:01:13 host2 sshd[2944999]: Disconnected from invalid user jamesm 89.216.92.113 port 44086 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.216.92.113
country_id: 6290252
description:
Jan  7 11:02:17 host2 sshd[2945762]: Disconnected from invalid user center 89.216.92.113 port 35842 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.200.237.19
country_id: 1269750
description:
Jan  7 11:02:26 host2 sshd[2945860]: Disconnected from invalid user owncloud 35.200.237.19 port 1100 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 71.6.134.230
country_id: 6252001
description:
Jan  7 11:08:59 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=71.6.134.230, lip=66.85.158.91, TLS: Connection closed, session=<2amFtcVHYtpHBobm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.129.145.153
country_id: 6252001
description:
2026-01-07 11:10:38 dovecot_login authenticator failed for H=(ADMIN) [102.129.145.153]:51490: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.231.85.75
country_id: 2464461
description:
2026-01-07 11:18:05 dovecot_login authenticator failed for H=([41.231.85.75]) [41.231.85.75]:59261: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.1.105.105
country_id: 1269750
description:
2026-01-07 11:17:27 dovecot_login authenticator failed for H=([61.1.105.105]) [61.1.105.105]:52302: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.206.119
country_id: 1819730
description:
2026-01-07 11:17:41 dovecot_login authenticator failed for H=(m121-202-206-119.smartone.com) [121.202.206.119]:50486: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 112.134.156.236
country_id: 1227603
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 112.134.156.236 - simpleengineerin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: User simpleengineerin has their account suspended. Login blocked.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.108.227.174
country_id: 1269750
description:
2026-01-07 11:35:10 dovecot_plain authenticator failed for H=(JKJEX) [42.108.227.174]:20447: 535 Incorrect authentication data (set_id=sanjanap@ksoft.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  7 11:35:23 host2 sshd[2974576]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.108.227.174
country_id: 1269750
description:
2026-01-07 11:35:17 dovecot_login authenticator failed for H=(JKJEX) [42.108.227.174]:20447: 535 Incorrect authentication data (set_id=sanjanap@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.157.95.30
country_id: 6251999
description:
2026-01-07 11:36:28 dovecot_login authenticator failed for H=d157-95-30.home4.cgocable.net [24.157.95.30]:48454: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.82.110.150
country_id: 660013
description:
2026-01-07 11:36:42 dovecot_login authenticator failed for H=([45.82.110.150]) [45.82.110.150]:34192: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.45
country_id: 6252001
description:
Jan  7 11:37:06 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.45, lip=66.85.158.91, TLS, session=<WFMPGsZH5OTN0h8t>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  7 11:37:42 host2 sshd[2976305]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.16.81.48
country_id: 2077456
description:
2026-01-07 11:38:41 dovecot_login authenticator failed for H=(ADMIN) [154.16.81.48]:7734: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.50.167.81
country_id: 1269750
description:
2026-01-07 11:40:33 dovecot_login authenticator failed for H=([36.50.167.81]) [36.50.167.81]:53980: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.60.78
country_id: 1269750
description:
2026-01-07 11:41:02 dovecot_login authenticator failed for H=([61.246.127.217]) [122.186.60.78]:60088: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.228
country_id: 1269750
description:
2026-01-07 11:43:34 dovecot_login authenticator failed for H=(nsg-corporate-228.228.187.122.airtel.in) [122.187.228.228]:51063: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.226.107.70
country_id: 3469034
description:
2026-01-07 11:43:47 dovecot_login authenticator failed for H=(72-107-226-38.edgetelecom.com.br) [38.226.107.70]:40607: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.85.202
country_id: 337996
description:
2026-01-07 11:43:48 dovecot_login authenticator failed for H=([196.191.212.235]) [213.55.85.202]:4087: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  7 11:45:58 host2 sshd[2983954]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.106.32.192
country_id: 6252001
description:
Jan  7 11:45:20 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (disconnected before auth was ready, waited 0 secs): user=<>, rip=20.106.32.192, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<UIh7N8ZHDN0UaiDA>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.169.104.246
country_id: 6252001
description:
Jan  7 11:51:08 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.169.104.246, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<oE8+TMZH3NUUqWj2>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.184.114
country_id: 1269750
description:
2026-01-07 11:50:29 dovecot_login authenticator failed for H=(aes-static-065.58.246.61.airtel.in) [182.95.184.114]:40680: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.226.240
country_id: 1269750
description:
2026-01-07 11:50:50 dovecot_login authenticator failed for H=(nsg-corporate-240.226.187.122.airtel.in) [122.187.226.240]:52201: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.121.175.220
country_id: 3579143
description:
2026-01-07 11:51:16 dovecot_login authenticator failed for H=(client-adsl-93-121-175-220.mediaserv.net) [93.121.175.220]:45916: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.122
country_id: 1269750
description:
2026-01-07 11:51:33 dovecot_login authenticator failed for H=([128.185.223.36]) [182.95.178.122]:33536: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.83.145.39
country_id: 6252001
description:
Jan  7 11:51:48 host2 dovecot[1170291]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.83.145.39, lip=66.85.158.91, session=<LJKgTsZHqOcDU5En>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 213.153.174.18
country_id: 298795
description:
Jan  7 11:53:54 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=213.153.174.18, lip=66.85.158.91, TLS, session=<PLwhVcZHKO7Vma4S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.121.95.175
country_id: 3469034
description:
Jan  7 11:54:14 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=138.121.95.175, lip=66.85.158.91, TLS, session=<JN9FVsZHXeuKeV+v>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.237.173.220
country_id: 6252001
description:
Jan  7 12:00:38 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.237.173.220, lip=66.85.158.92, TLS, session=<cF8+bsZHoLMD7a3c>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.216.215.142
country_id: 933860
description:
Jan  7 12:01:48 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=41.216.215.142, lip=66.85.158.91, TLS, session=<ZvAqccZHebEp2NeO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.240.96.216
country_id: 3469034
description:
Jan  7 12:02:09 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=191.240.96.216, lip=66.85.158.91, TLS, session=<oFyOcsZHupe/8GDY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.173.23.104
country_id: 2635167
description:
2026-01-07 12:02:38 dovecot_login authenticator failed for H=(ADMIN) [158.173.23.104]:35927: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-07 12:03:40 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (oranoph) [87.103.126.54]:22667: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.199.118.234
country_id: 1880251
description:
2026-01-07 12:06:42 dovecot_login authenticator failed for H=(448990.cloudwaysapps.com) [128.199.118.234]:30356: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.53.199.160
country_id: 6252001
description:
2026-01-07 12:09:21 dovecot_login authenticator failed for H=(136-53-199-160.googlefiber.net) [136.53.199.160]:43417: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.98.41.27
country_id: 1269750
description:
2026-01-07 12:10:04 dovecot_login authenticator failed for H=([59.98.41.27]) [59.98.41.27]:45285: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.202.197.108
country_id: 6252001
description:
2026-01-07 12:10:59 dovecot_plain authenticator failed for H=(ardliation) [50.202.197.108]:57416: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.244.106
country_id: 1269750
description:
2026-01-07 12:16:10 dovecot_login authenticator failed for H=([152.52.244.106]) [152.52.244.106]:38676: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.235.225.181
country_id: 6252001
description:
2026-01-07 12:15:33 dovecot_plain authenticator failed for H=c-71-235-225-181.hsd1.ct.comcast.net (munon) [71.235.225.181]:55422: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.201.85
country_id: 1733045
description:
2026-01-07 12:16:28 dovecot_login authenticator failed for H=([49.125.201.85]) [49.125.201.85]:32852: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.47.146
country_id: 1819730
description:
2026-01-07 12:17:23 dovecot_login authenticator failed for H=146.47.246.220.static.netvigator.com [220.246.47.146]:64189: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.86.130
country_id: 1269750
description:
2026-01-07 12:17:48 dovecot_login authenticator failed for H=(nsg-static-130.86.76.182-airtel.com) [182.76.86.130]:56372: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.220.97.188
country_id: 6252001
description:
2026-01-07 12:23:20 dovecot_login authenticator failed for H=c-98-220-97-188.hsd1.il.comcast.net [98.220.97.188]:41864: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.90.41.136
country_id: 1522867
description:
2026-01-07 12:24:10 dovecot_login authenticator failed for H=178.90.41.136.dynamic.telecom.kz [178.90.41.136]:58770: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.56.54.173
country_id: 6252001
description:
2026-01-07 12:24:40 dovecot_login authenticator failed for H=(ADMIN) [212.56.54.173]:6247: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.43.109
country_id: 1819730
description:
2026-01-07 12:30:55 dovecot_login authenticator failed for H=109.43.246.220.static.netvigator.com [220.246.43.109]:57455: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.168.50
country_id: 2186224
description:
2026-01-07 12:31:18 dovecot_login authenticator failed for H=([121.73.168.50]) [121.73.168.50]:48844: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.234.80.128
country_id: 6252001
description:
Jan  7 12:33:09 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=54.234.80.128, lip=66.85.158.91, TLS, session=<KMJ74sZHBOE26lCA>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.54
country_id: 6252001
description:
Jan  7 12:33:06 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=167.94.146.54, lip=66.85.158.92, TLS: Connection closed, session=<JEVR4sZHLminXpI2>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.54
country_id: 6252001
description:
Jan  7 12:33:14 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=167.94.146.54, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<D2vR4sZH9DmnXpI2>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.161.150
country_id: 1269750
description:
2026-01-07 12:42:32 dovecot_login authenticator failed for H=(nsg-corporate-25.230.186.122.airtel.in) [125.19.161.150]:42540: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.177.118
country_id: 1269750
description:
2026-01-07 12:42:52 dovecot_login authenticator failed for H=([152.52.234.180]) [182.95.177.118]:43504: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  7 12:50:34 host2 sshd[3042106]: Disconnected from invalid user admin 2.57.121.112 port 37415 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.52.194
country_id: 1269750
description:
2026-01-07 12:50:46 dovecot_login authenticator failed for H=([182.95.52.194]) [182.95.52.194]:47814: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.75.110
country_id: 1149361
description:
2026-01-07 12:51:10 dovecot_login authenticator failed for H=([180.94.75.110]) [180.94.75.110]:40162: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.146.60.90
country_id: 2782113
description:
2026-01-07 12:51:25 dovecot_login authenticator failed for H=(ADMIN) [156.146.60.90]:61395: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.65.238.7
country_id: 3469034
description:
Jan  7 12:52:51 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=45.65.238.7, lip=66.85.158.91, TLS, session=<ZNbVJ8dHH7YtQe4H>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.253.159.70
country_id: 732800
description:
Jan  7 12:53:09 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=185.253.159.70, lip=66.85.158.91, TLS, session=</RkJKcdHb7q5/Z9G>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.134.139.173
country_id: 6251999
description:
2026-01-07 12:58:04 dovecot_login authenticator failed for H=([207.134.139.173]) [207.134.139.173]:31768: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.252.18
country_id: 1269750
description:
2026-01-07 12:58:20 dovecot_login authenticator failed for H=(dsl-kk-static-089.203.95.61.airtelbroadband.in) [125.20.252.18]:54354: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.77
country_id: 6252001
description:
Jan  7 12:58:37 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.235.24.77, lip=66.85.158.92, session=<bs+YPcdHoPrG6xhN>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 47.250.82.167
country_id: 1733045
description:
Jan  7 13:00:48 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 3 secs): user=<>, rip=47.250.82.167, lip=66.85.158.91, session=<YfdpRcdHGtYv+lKn>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  7 13:01:59 host2 sshd[3053889]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.245.97.82
country_id: 1880251
description:
Jan  7 13:01:37 host2 sshd[3053559]: Disconnected from invalid user musikbot 43.245.97.82 port 55030 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.13.215.124
country_id: 1605651
description:
Jan  7 13:02:36 host2 sshd[3054422]: Disconnected from invalid user ankit 103.13.215.124 port 55410 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.33.34
country_id: 1269750
description:
Jan  7 13:02:39 host2 sshd[3054470]: Disconnected from invalid user nico 139.59.33.34 port 53908 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.245.97.82
country_id: 1880251
description:
Jan  7 13:02:16 host2 sshd[3054145]: Disconnected from invalid user ann 43.245.97.82 port 37786 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.33.34
country_id: 1269750
description:
Jan  7 13:05:48 host2 sshd[3057954]: Disconnected from invalid user ann 139.59.33.34 port 46986 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 139.59.33.34
country_id: 1269750
description:
Jan  7 13:06:26 host2 sshd[3058577]: Disconnected from invalid user claude 139.59.33.34 port 33022 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.13.215.124
country_id: 1605651
description:
Jan  7 13:07:42 host2 sshd[3059782]: Disconnected from invalid user celia 103.13.215.124 port 41072 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.123
country_id: 2186224
description:
2026-01-07 13:07:33 dovecot_login authenticator failed for H=([121.73.163.123]) [121.73.163.123]:33740: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.13.215.124
country_id: 1605651
description:
Jan  7 13:08:20 host2 sshd[3060458]: Disconnected from invalid user andrea 103.13.215.124 port 56498 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.103.120.150
country_id: 1819730
description:
2026-01-07 13:15:56 dovecot_login authenticator failed for H=150.120.103.218.static.netvigator.com [218.103.120.150]:64244: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.23.72.121
country_id: 6252001
description:
2026-01-07 13:16:06 dovecot_login authenticator failed for H=([209.23.72.121]) [209.23.72.121]:33042: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.65
country_id: 6252001
description:
Jan  7 13:16:23 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.235.24.65, lip=66.85.158.92, TLS, session=<9hIlfcdHTOjG6xhB>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.133.156.138
country_id: 294640
description:
2026-01-07 13:18:38 dovecot_login authenticator failed for H=([195.133.156.138]) [195.133.156.138]:48236: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.239.78.124
country_id: 1819730
description:
2026-01-07 13:18:25 dovecot_login authenticator failed for H=(182.239.78.124.hk.chinamobile.com) [182.239.78.124]:41624: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2026-01-07 13:24:38 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:60825: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


