# incident

plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.246.101
country_id: 1269750
description:
Jan  7 05:35:56 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@jrdc.lk>, method=PLAIN, rip=103.164.246.101, lip=66.85.158.91, TLS, session=<iOtiDcFHFOdnpPZl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.0.119.190
country_id: 226074
description:
Jan  7 05:35:58 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@jrdc.lk>, method=PLAIN, rip=196.0.119.190, lip=66.85.158.91, TLS, session=<mCtkDcFHnrLEAHe+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.250.173
country_id: 3865483
description:
Jan  7 05:36:20 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=179.0.250.173, lip=66.85.158.91, TLS, session=<cm2pDsFHb42zAPqt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.171.172
country_id: 3175395
description:
Jan  7 05:35:54 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@jrdc.lk>, method=PLAIN, rip=185.15.171.172, lip=66.85.158.91, TLS, session=<q2hTDcFHd9O5D6us>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.246.226
country_id: 1269750
description:
Jan  7 05:35:57 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@jrdc.lk>, method=PLAIN, rip=103.164.246.226, lip=66.85.158.91, TLS, session=<3j5fDcFHQJFnpPbi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.63.133.74
country_id: 3175395
description:
Jan  7 05:36:13 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=185.63.133.74, lip=66.85.158.91, TLS, session=<eQlsDsFHE965P4VK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 213.92.222.43
country_id: 798544
description:
Jan  7 05:36:14 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=213.92.222.43, lip=66.85.158.91, TLS, session=<xNZ/DsFHzg3VXN4r>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.251.130
country_id: 3865483
description:
Jan  7 05:36:20 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info>, method=PLAIN, rip=179.0.251.130, lip=66.85.158.91, TLS, session=<SIefDsFHT6uzAPuC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.171.92
country_id: 3175395
description:
Jan  7 05:36:24 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=185.15.171.92, lip=66.85.158.91, TLS, session=<bO4cD8FHEaC5D6tc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.177.76.126
country_id: 357994
description:
2026-01-07 05:36:26 dovecot_plain authenticator failed for H=(ZZ7H17CIG) [154.177.76.126]:18810: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 138.68.105.139
country_id: 2921044
description:
Jan  7 05:37:01 host2 pure-ftpd[2578812]: (?@138.68.105.139) [INFO] New connection from 138.68.105.139


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 138.68.105.139
country_id: 2921044
description:
Jan  7 05:37:02 host2 pure-ftpd[2578889]: (?@138.68.105.139) [INFO] New connection from 138.68.105.139


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.198.131.159
country_id: 6252001
description:
Jan  7 05:47:06 host2 sshd[2589650]: Invalid user cloudtourssrilan_travel from 124.198.131.159 port 52058


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.103.231.213
country_id: 1168579
description:
2026-01-07 05:47:33 dovecot_plain authenticator failed for H=(P756S1ACH72QLPV) [59.103.231.213]:52872: 535 Incorrect authentication data (set_id=lasithar@ksoft.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.119.50
country_id: 1819730
description:
Jan  7 05:49:22 host2 sshd[2591467]: Disconnected from invalid user support 101.36.119.50 port 57286 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.249.18.109
country_id: 3017382
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 173.249.18.109 - lezzarotech "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarotech (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.72.76.123
country_id: 3469034
description:
Jan  7 05:51:44 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=177.72.76.123, lip=66.85.158.91, TLS, session=<Zh3fRcFHIMmxSEx7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.101.157.28
country_id: 2921044
description:
2026-01-07 05:51:56 dovecot_login authenticator failed for H=(ADMIN) [191.101.157.28]:1350: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.251.115
country_id: 3865483
description:
Jan  7 05:52:10 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=179.0.251.115, lip=66.85.158.91, TLS, session=<KN8rR8FH0JCzAPtz>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.14.96.56
country_id: 2510769
description:
Jan  7 05:54:30 host2 sshd[2596658]: Disconnected from invalid user claude 62.14.96.56 port 54820 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.36.119.50
country_id: 1819730
description:
Jan  7 05:56:00 host2 sshd[2598156]: Disconnected from invalid user ali 101.36.119.50 port 39000 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.127.53.61
country_id: 6252001
description:
2026-01-07 05:56:04 dovecot_plain authenticator failed for H=c-24-127-53-61.hsd1.mi.comcast.net (tabled) [24.127.53.61]:44024: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.189.235.93
country_id: 1643084
description:
Jan  7 05:55:31 host2 sshd[2597667]: Disconnected from invalid user temp 103.189.235.93 port 58842 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.155.194.190
country_id: 953987
description:
2026-01-07 05:55:57 dovecot_plain authenticator failed for H=156-155-194-190.ip.internet.co.za (1J0G627F) [156.155.194.190]:65418: 535 Incorrect authentication data (set_id=lasithar@ksoft.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 62.14.96.56
country_id: 2510769
description:
Jan  7 05:57:06 host2 sshd[2599120]: Disconnected from invalid user dana 62.14.96.56 port 48220 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.119.50
country_id: 1819730
description:
Jan  7 05:56:28 host2 sshd[2598656]: Disconnected from invalid user jimmy 101.36.119.50 port 58700 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.112.109.248
country_id: 6252001
description:
2026-01-07 05:57:35 dovecot_login authenticator failed for H=(host-24-112-109-248.vyvebroadband.net) [24.112.109.248]:52318: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.0.165.219
country_id: 1605651
description:
2026-01-07 05:57:23 dovecot_login authenticator failed for H=([106.0.165.219]) [106.0.165.219]:44827: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.146.144
country_id: 1819730
description:
2026-01-07 06:08:34 dovecot_login authenticator failed for H=(m121-202-146-144.smartone.com) [121.202.146.144]:51568: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.218.2
country_id: 1269750
description:
2026-01-07 06:09:02 dovecot_login authenticator failed for H=([61.246.205.1]) [125.19.218.2]:55074: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.22.95.67
country_id: 6251999
description:
2026-01-07 06:19:32 dovecot_login authenticator failed for H=(ADMIN) [149.22.95.67]:34235: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.15.216.41
country_id: 6252001
description:
2026-01-07 06:23:37 dovecot_plain authenticator failed for H=c-24-15-216-41.hsd1.il.comcast.net (unated) [24.15.216.41]:45426: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.64.71.37
country_id: 3865483
description:
Jan  7 06:27:04 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=186.64.71.37, lip=66.85.158.91, TLS, session=<U+cNxMFHnJG6QEcl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.216.25.7
country_id: 798544
description:
Jan  7 06:27:22 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=178.216.25.7, lip=66.85.158.91, TLS, session=<EF9cxcFHv4Oy2BkH>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  7 06:31:20 host2 sshd[2641387]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.213.34.110
country_id: 298795
description:
2026-01-07 06:41:26 dovecot_login authenticator failed for H=(ADMIN) [188.213.34.110]:9706: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  7 06:46:34 host2 sshd[2664915]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.183.74.177
country_id: 6252001
description:
2026-01-07 06:47:23 dovecot_plain authenticator failed for H=c-73-183-74-177.hsd1.pa.comcast.net (sigic) [73.183.74.177]:33182: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 46.105.235.55
country_id: 3017382
description:
[2026-01-07 06:50:20 +0530] info [cpaneld] 46.105.235.55 - lezzarot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarot (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2026-01-07 06:53:45 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:62057: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  7 06:54:26 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS handshaking: Connection closed, session=<vIskJ8JHELYDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  7 06:56:55 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<Ab0PMMJHousDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  7 06:57:28 host2 dovecot[1170291]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS, session=<Ur8JMsJHQrUDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  7 06:58:20 host2 dovecot[1170291]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS, session=</qggNcJHCuUDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.104.30.66
country_id: 6252001
description:
Jan  7 06:58:52 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=172.104.30.66, lip=66.85.158.91, TLS handshaking: Connection closed, session=<22j/NsJH3tesaB5C>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  7 06:59:25 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS handshaking: Connection closed, session=<OmL5OMJHiLIDhBfJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.126.94.82
country_id: 2623032
description:
2026-01-07 07:00:55 dovecot_login authenticator failed for H=(ADMIN) [188.126.94.82]:5288: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  7 07:01:02 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS, session=<hJq/PsJHZroDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  7 07:01:18 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS handshaking: Connection closed, session=<of+4P8JH2rYDhBfJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.183.245.232
country_id: 1605651
description:
2026-01-07 07:02:48 dovecot_login authenticator failed for H=(mx-ll-180.183.245-232.dynamic.3bb.in.th) [180.183.245.232]:41402: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.113.185.14
country_id: 3469034
description:
2026-01-07 07:03:42 dovecot_login authenticator failed for H=([189.113.185.14]) [189.113.185.14]:36316: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.161.196.5
country_id: 99237
description:
2026-01-07 07:03:17 dovecot_login authenticator failed for H=([46.161.196.5]) [46.161.196.5]:53140: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.101.210.175
country_id: 2077456
description:
2026-01-07 07:23:40 dovecot_login authenticator failed for H=(ADMIN) [191.101.210.175]:40387: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.249.126
country_id: 3865483
description:
Jan  7 07:24:51 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 26 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=179.0.249.126, lip=66.85.158.91, TLS, session=<5fxhksJHla2zAPl+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.72.78.204
country_id: 3469034
description:
Jan  7 07:25:10 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=177.72.78.204, lip=66.85.158.91, TLS, session=<Vr8BlMJHr4SxSE7M>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.178.115.138
country_id: 6252001
description:
Jan  7 07:28:47 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=172.178.115.138, lip=66.85.158.92, session=<VTkGosJHEKussnOK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.174
country_id: 6252001
description:
Jan  7 07:30:53 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.174, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<vC6GqcJH6MnN0h+u>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.136
country_id: 6252001
description:
Jan  7 07:33:11 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.197.136, lip=66.85.158.91, session=<TZXEscJHubRAPsWI>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.122
country_id: 6252001
description:
Jan  7 07:33:23 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.197.122, lip=66.85.158.91, TLS: Connection closed, session=<Z65wssJHZntAPsV6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.96.62.29
country_id: 1269750
description:
2026-01-07 07:36:17 dovecot_login authenticator failed for H=([59.96.62.29]) [59.96.62.29]:46806: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.37.223.58
country_id: 3175395
description:
2026-01-07 07:36:34 dovecot_login authenticator failed for H=net-2-37-223-58.cust.vodafonedsl.it [2.37.223.58]:60166: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.194.98
country_id: 6252001
description:
2026-01-07 07:40:31 dovecot_plain authenticator failed for H=c-73-197-194-98.hsd1.nj.comcast.net (waysited) [73.197.194.98]:47022: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.90.126.119
country_id: 3703430
description:
2026-01-07 07:41:43 dovecot_login authenticator failed for H=(ADMIN) [91.90.126.119]:65258: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  7 07:45:10 host2 sshd[2731952]: Disconnected from invalid user admin 2.57.121.112 port 50958 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.248.111.238
country_id: 6252001
description:
2026-01-07 07:46:30 dovecot_plain authenticator failed for H=(gatte) [38.248.111.238]:52795: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.58
country_id: 6252001
description:
Jan  7 07:50:02 host2 pure-ftpd[2738406]: (?@147.185.132.58) [INFO] New connection from 147.185.132.58


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.64.105.230
country_id: 6252001
description:
Jan  7 07:51:04 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.64.105.230, lip=66.85.158.91, session=<t42u8cJHVogUQGnm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.109.56.73
country_id: 6252001
description:
2026-01-07 07:55:52 dovecot_login authenticator failed for H=(dfw-206-109-56-73.ip4.99.network) [206.109.56.73]:62424: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.144.20
country_id: 3996063
description:
2026-01-07 07:55:41 dovecot_login authenticator failed for H=([177.236.144.20]) [177.236.144.20]:37189: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.68
country_id: 2635167
description:
Jan  7 07:56:22 host2 dovecot[1170291]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=87.236.176.68, lip=66.85.158.92, TLS, session=<VmejBMNHLbhX7LBE>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.129.232.250
country_id: 6252001
description:
2026-01-07 08:01:30 dovecot_login authenticator failed for H=(ADMIN) [102.129.232.250]:33704: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.180.145.27
country_id: 3469034
description:
Jan  7 08:02:29 host2 sshd[2751669]: Disconnected from invalid user claude 45.180.145.27 port 49002 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.180.145.27
country_id: 3469034
description:
Jan  7 08:03:17 host2 sshd[2752459]: Disconnected from invalid user claude 45.180.145.27 port 41084 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 59.97.205.137
country_id: 1269750
description:
Jan  7 08:06:02 host2 sshd[2755502]: Disconnected from invalid user zwj 59.97.205.137 port 32865 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.126
country_id: 6252001
description:
Jan  7 08:05:23 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 15 secs): user=<>, rip=66.132.153.126, lip=66.85.158.91, TLS handshaking: Connection closed, session=<neDgJMNHrklChJl+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 59.97.205.137
country_id: 1269750
description:
Jan  7 08:06:38 host2 sshd[2756039]: Disconnected from invalid user hassan 59.97.205.137 port 50217 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 59.97.205.137
country_id: 1269750
description:
Jan  7 08:07:54 host2 sshd[2757240]: Disconnected from invalid user devuser 59.97.205.137 port 7805 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.159
country_id: 6252001
description:
Jan  7 08:09:01 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=147.185.132.159, lip=66.85.158.91, TLS, session=<MWLgMcNH1PGTuYSf>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 143.58.211.64
country_id: 2635167
description:
Jan  7 08:11:33 host2 sshd[2761122]: Disconnected from invalid user claude 143.58.211.64 port 42024 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.255.147.244
country_id: 1269750
description:
Jan  7 08:11:50 host2 sshd[2761385]: Disconnected from invalid user k8s 103.255.147.244 port 59042 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 143.58.211.64
country_id: 2635167
description:
Jan  7 08:12:02 host2 sshd[2761557]: Received disconnect from 143.58.211.64 port 57456:11: Bye Bye [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.238.191.229
country_id: 6252001
description:
Jan  7 08:14:42 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.238.191.229, lip=66.85.158.91, TLS, session=<zRs3RsNHloQD7r/l>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.133.156.8
country_id: 1643084
description:
Jan  7 08:15:19 host2 sshd[2765788]: Disconnected from invalid user ftpuser 43.133.156.8 port 33758 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.46.50.43
country_id: 290557
description:
Jan  7 08:16:38 host2 sshd[2767233]: Disconnected from invalid user claude 20.46.50.43 port 48442 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 157.230.111.59
country_id: 2921044
description:
Jan  7 08:18:02 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=157.230.111.59, lip=66.85.158.91, TLS, session=<X28eUsNH9BOd5m87>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.133.156.8
country_id: 1643084
description:
Jan  7 08:17:41 host2 sshd[2768655]: Disconnected from invalid user ftp_user 43.133.156.8 port 39448 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.133.156.8
country_id: 1643084
description:
Jan  7 08:18:13 host2 sshd[2769350]: Disconnected from invalid user u 43.133.156.8 port 59980 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.124.202
country_id: 1269750
description:
2026-01-07 08:18:42 dovecot_login authenticator failed for H=([182.95.124.202]) [182.95.124.202]:33408: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.107.116.210
country_id: 798544
description:
2026-01-07 08:19:02 dovecot_login authenticator failed for H=(host-176.107.116-210.dynamic.mm.pl) [176.107.116.210]:35695: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.255.147.244
country_id: 1269750
description:
Jan  7 08:19:08 host2 sshd[2770527]: Disconnected from invalid user testtest 103.255.147.244 port 48784 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.46.50.43
country_id: 290557
description:
Jan  7 08:20:20 host2 sshd[2772224]: Disconnected from invalid user deployer 20.46.50.43 port 38436 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 20.46.50.43
country_id: 290557
description:
Jan  7 08:21:41 host2 sshd[2773795]: Disconnected from invalid user testtest 20.46.50.43 port 43002 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.154
country_id: 3144096
description:
2026-01-07 08:21:55 dovecot_login authenticator failed for H=(cm-84.213.189.154.get.no) [84.213.189.154]:60335: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.95.24.117
country_id: 2464461
description:
2026-01-07 08:21:32 dovecot_login authenticator failed for H=([193.95.21.147]) [193.95.24.117]:57304: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  7 08:23:44 host2 sshd[2776889]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.220.236.203
country_id: 660013
description:
2026-01-07 08:27:52 dovecot_login authenticator failed for H=([62.220.236.203]) [62.220.236.203]:33402: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.146.240.123
country_id: 2542007
description:
2026-01-07 08:28:20 dovecot_login authenticator failed for H=([154.146.240.123]) [154.146.240.123]:58266: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.199.59.208
country_id: 798544
description:
2026-01-07 08:29:23 dovecot_login authenticator failed for H=(ADMIN) [138.199.59.208]:17956: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.82.40.34
country_id: 1694008
description:
2026-01-07 08:31:27 dovecot_login authenticator failed for H=([203.82.40.34]) [203.82.40.34]:47844: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.109.38.143
country_id: 6252001
description:
2026-01-07 08:31:40 dovecot_login authenticator failed for H=143.38.109.208.host.secureserver.net [208.109.38.143]:33488: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  7 08:35:15 host2 sshd[2791059]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.126.240.75
country_id: 2661886
description:
2026-01-07 08:42:04 dovecot_login authenticator failed for H=([188.126.240.75]) [188.126.240.75]:42974: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.195.150
country_id: 290557
description:
2026-01-07 08:41:53 dovecot_plain authenticator failed for H=(aurable) [91.73.195.150]:49158: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2026-01-07 08:41:57 dovecot_plain authenticator failed for H=(tarcingal) [102.53.15.17]:36082: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.92.249
country_id: 1168579
description:
2026-01-07 08:42:23 dovecot_login authenticator failed for H=(249.92.zcomnetworks.com.pk) [103.148.92.249]:45219: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 181.214.206.45
country_id: 2750405
description:
Jan  7 08:45:59 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=181.214.206.45, lip=66.85.158.91, session=<G34etsNHuNe11s4t>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.132.194.21
country_id: 597427
description:
Jan  7 08:45:59 host2 dovecot[1170291]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=45.132.194.21, lip=66.85.158.91, session=<L1wbtsNHxtcthMIV>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.70
country_id: 6252001
description:
Jan  7 08:46:02 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=198.235.24.70, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<i+JCtsNH/NXG6xhG>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan  7 08:46:19 host2 sshd[2804083]: Disconnected from invalid user user 2.57.121.25 port 30542 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.232.223.113
country_id: 798544
description:
Jan  7 08:52:32 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=94.232.223.113, lip=66.85.158.91, TLS, session=<8DV/zMNHHule6N9x>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.238.119
country_id: 6252001
description:
2026-01-07 08:52:55 dovecot_login authenticator failed for H=(ADMIN) [95.181.238.119]:31644: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.250.90
country_id: 3865483
description:
Jan  7 08:52:14 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=179.0.250.90, lip=66.85.158.91, TLS, session=<lY5Gy8NH05azAPpa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.188.252.208
country_id: 6252001
description:
2026-01-07 08:55:25 dovecot_plain authenticator failed for H=c-73-188-252-208.hsd1.pa.comcast.net (rasth) [73.188.252.208]:54116: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.196.144.25
country_id: 6252001
description:
2026-01-07 09:02:15 dovecot_plain authenticator failed for H=c-73-196-144-25.hsd1.nj.comcast.net (lousots) [73.196.144.25]:54232: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.201.62
country_id: 1269750
description:
2026-01-07 09:05:00 dovecot_login authenticator failed for H=([125.22.73.41]) [122.186.201.62]:44128: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.45.132.96
country_id: 3175395
description:
2026-01-07 09:05:17 dovecot_login authenticator failed for H=([151.45.132.96]) [151.45.132.96]:38780: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.111.6.121
country_id: 1269750
description:
2026-01-07 09:08:17 dovecot_login authenticator failed for H=([103.111.6.121]) [103.111.6.121]:34713: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.145.122.196
country_id: 3175395
description:
2026-01-07 09:08:36 dovecot_login authenticator failed for H=([82.145.122.196]) [82.145.122.196]:53282: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.73.108
country_id: 294640
description:
2026-01-07 09:10:50 dovecot_login authenticator failed for H=(2-55-73-108.orange.net.il) [2.55.73.108]:42144: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.136.176.12
country_id: 2510769
description:
2026-01-07 09:10:21 dovecot_login authenticator failed for H=([83.136.176.12]) [83.136.176.12]:52769: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.64.16
country_id: 1269750
description:
Jan  7 09:10:36 host2 sshd[2831015]: Disconnected from invalid user claude 139.59.64.16 port 59908 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.136.207.202
country_id: 1605651
description:
2026-01-07 09:11:33 dovecot_login authenticator failed for H=([58.136.207.202]) [58.136.207.202]:44975: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 114.10.47.6
country_id: 1643084
description:
Jan  7 09:14:09 host2 sshd[2834328]: Disconnected from invalid user ubuntu 114.10.47.6 port 10767 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.201.182
country_id: 1880251
description:
Jan  7 09:14:58 host2 sshd[2835046]: Disconnected from invalid user wilson 45.78.201.182 port 59754 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.133.172.6
country_id: 2635167
description:
2026-01-07 09:13:41 dovecot_login authenticator failed for H=(ADMIN) [45.133.172.6]:16171: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.83.145.39
country_id: 6252001
description:
Jan  7 09:16:50 host2 dovecot[1170291]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.83.145.39, lip=66.85.158.92, session=</epsJMRHerQDU5En>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.120
country_id: 2635167
description:
Jan  7 09:17:23 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 10 secs): user=<>, rip=35.203.211.120, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<+2VjJsRHjM8jy9N4>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 114.10.47.6
country_id: 1643084
description:
Jan  7 09:17:39 host2 sshd[2837746]: Disconnected from invalid user claude 114.10.47.6 port 56613 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.201.182
country_id: 1880251
description:
Jan  7 09:17:11 host2 sshd[2837269]: Disconnected from invalid user claude 45.78.201.182 port 35140 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.64.16
country_id: 1269750
description:
Jan  7 09:17:14 host2 sshd[2837305]: Disconnected from invalid user servidor 139.59.64.16 port 35206 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 91.92.199.36
country_id: 732800
description:
Jan  7 09:17:25 host2 sshd[2837516]: Disconnected from invalid user claude 91.92.199.36 port 41334 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.120
country_id: 2635167
description:
Jan  7 09:18:23 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 8 secs): user=<>, rip=35.203.211.120, lip=66.85.158.92, TLS: read(size=403) failed: Connection reset by peer, session=<avXxKcRHtvAjy9N4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.197.8.201
country_id: 3175395
description:
Jan  7 09:18:38 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=185.197.8.201, lip=66.85.158.91, TLS, session=<leXkKcRHPoy5xQjJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.43.231.80
country_id: 798544
description:
Jan  7 09:18:56 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=193.43.231.80, lip=66.85.158.91, TLS, session=<0NLuKsRHXsfBK+dQ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.201.182
country_id: 1880251
description:
Jan  7 09:20:30 host2 sshd[2841032]: Disconnected from invalid user bitrix 45.78.201.182 port 37892 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  7 09:22:22 host2 sshd[2843127]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.201.182
country_id: 1880251
description:
Jan  7 09:22:35 host2 sshd[2843338]: Disconnected from invalid user claude 45.78.201.182 port 47424 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 139.59.64.16
country_id: 1269750
description:
Jan  7 09:24:05 host2 sshd[2844888]: Disconnected from invalid user test 139.59.64.16 port 35260 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.120
country_id: 2635167
description:
Jan  7 09:24:13 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.203.211.120, lip=66.85.158.92, TLS, session=<U1DVPsRHxPUjy9N4>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.162.230.58
country_id: 3469034
description:
[2025-12-26 17:26:14 +0530] info [webmaild] 45.162.230.58 - 587hr@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.22.90.217
country_id: 2802361
description:
2026-01-07 09:34:28 dovecot_login authenticator failed for H=(ADMIN) [149.22.90.217]:13497: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.162.163
country_id: 298795
description:
2026-01-07 09:37:03 dovecot_login authenticator failed for H=([5.11.162.163]) [5.11.162.163]:35893: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.107.116.210
country_id: 798544
description:
2026-01-07 09:37:21 dovecot_login authenticator failed for H=(host-176.107.116-210.dynamic.mm.pl) [176.107.116.210]:45307: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.23.73.205
country_id: 6252001
description:
2026-01-07 09:41:08 dovecot_login authenticator failed for H=([209.23.73.205]) [209.23.73.205]:59294: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.223.142
country_id: 1269750
description:
2026-01-07 09:41:26 dovecot_login authenticator failed for H=([128.185.247.127]) [182.95.223.142]:39670: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.222.81.115
country_id: 6252001
description:
Jan  7 09:42:24 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=44.222.81.115, lip=66.85.158.92, TLS, session=<8W3ef8RHbMMs3lFz>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  7 09:44:58 host2 sshd[2869753]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.183
country_id: 6252001
description:
Jan  7 09:45:16 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=198.235.24.183, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<u6YWisRHZs/G6xi3>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  7 09:46:39 host2 sshd[2871895]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.37.32.248
country_id: 1269750
description:
2026-01-07 09:46:19 dovecot_login authenticator failed for H=(nsg-corporate-90.179.185.122.airtel.in) [49.37.32.248]:54974: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  7 09:47:15 host2 sshd[2872590]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.105.248.218
country_id: 6252001
description:
2026-01-07 09:49:13 dovecot_login authenticator failed for H=([24.105.248.218]) [24.105.248.218]:51044: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.36.204
country_id: 3144096
description:
2026-01-07 09:49:22 dovecot_login authenticator failed for H=(cm-178.232.36.204.get.no) [178.232.36.204]:59045: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.100
country_id: 6252001
description:
Jan  7 09:51:24 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=198.235.24.100, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<c9EKoMRHh9jG6xhk>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.29.57
country_id: 1880251
description:
Jan  7 09:52:09 host2 sshd[2877920]: Disconnected from invalid user claude 165.154.29.57 port 34216 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.125.162.32
country_id: 718075
description:
Jan  7 09:54:59 host2 sshd[2881416]: Disconnected from invalid user neko 79.125.162.32 port 50274 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.29.57
country_id: 1880251
description:
Jan  7 09:55:16 host2 sshd[2881836]: Disconnected from invalid user claude 165.154.29.57 port 41102 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 79.125.162.32
country_id: 718075
description:
Jan  7 09:55:32 host2 sshd[2882145]: Disconnected from invalid user bitrix 79.125.162.32 port 42582 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 165.154.29.57
country_id: 1880251
description:
Jan  7 09:57:37 host2 sshd[2883962]: Disconnected from invalid user deploy 165.154.29.57 port 51434 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.32.122.85
country_id: 597427
description:
2026-01-07 10:04:14 dovecot_login authenticator failed for H=(ADMIN) [194.32.122.85]:40246: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-07 10:05:47 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (crowism) [87.103.126.54]:13636: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  7 10:06:04 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 1 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<5Ct71MRHRskDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  7 10:06:13 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS handshaking: Connection closed, session=<iP8G1cRHMskDhBfJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2026-01-07 10:06:12 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:61422: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.237.173.220
country_id: 6252001
description:
Jan  7 10:09:25 host2 dovecot[1170291]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.237.173.220, lip=66.85.158.92, session=<pLV/4MRHiskD7a3c>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  7 10:09:29 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<x4Ww4MRHrN8DhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  7 10:11:59 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS handshaking: Connection closed, session=</IWt6cRHWoADhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  7 10:15:30 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS, session=<k1E+9sRHtrkDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  7 10:19:11 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<EJplA8VHIu0DhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  7 10:19:17 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS handshaking: Connection closed, session=<IXXDA8VHgN8DhBfJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.132.181.70
country_id: 1522867
description:
2026-01-07 10:20:47 dovecot_login authenticator failed for H=2.132.181.70.dynamic.telecom.kz [2.132.181.70]:39112: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  7 10:20:57 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS, session=<FzS/CcVHKqEDhBfJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.250.191.189
country_id: 458258
description:
2026-01-07 10:21:10 dovecot_login authenticator failed for H=([178.250.191.189]) [178.250.191.189]:53904: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.192.245.178
country_id: 1269750
description:
2026-01-07 10:21:46 dovecot_login authenticator failed for H=(dhcp-192-245-178.in2cable.com) [203.192.245.178]:33816: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.94.119.250
country_id: 1694008
description:
[2026-01-07 10:22:22 +0530] info [webmaild] 172.94.119.250 - hr@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.61.228.13
country_id: 2077456
description:
2026-01-07 10:23:27 dovecot_login authenticator failed for H=(ADMIN) [179.61.228.13]:63347: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.8.241.171
country_id: 2077456
description:
2026-01-07 10:28:32 dovecot_login authenticator failed for H=([161.8.241.171]) [161.8.241.171]:58086: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.177.88.62
country_id: 3624060
description:
2026-01-07 10:28:55 dovecot_login authenticator failed for H=([186.177.88.62]) [186.177.88.62]:58167: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.74.136.134
country_id: 6252001
description:
2026-01-07 10:35:06 dovecot_plain authenticator failed for H=syn-050-074-136-134.biz.spectrum.com (tecilvily) [50.74.136.134]:40120: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
country_id: 6252001
description:
2026-01-07 10:34:58 dovecot_plain authenticator failed for H=(beringy) [24.187.213.29]:45116: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.49.115.132
country_id: 1269750
description:
2026-01-07 10:41:37 dovecot_plain authenticator failed for H=(JKJEX) [157.49.115.132]:51362: 535 Incorrect authentication data (set_id=lasithar@ksoft.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.253
country_id: 6252001
description:
Jan  7 10:43:08 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.253, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<86EKWcVHgdDN0h/9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.37.242.247
country_id: 1269750
description:
2026-01-07 10:43:45 dovecot_plain authenticator failed for H=(JKJEX) [49.37.242.247]:54103: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.183.74.177
country_id: 6252001
description:
2026-01-07 10:45:45 dovecot_plain authenticator failed for H=c-73-183-74-177.hsd1.pa.comcast.net (auxoling) [73.183.74.177]:34308: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.246.170.194
country_id: 1269750
description:
Jan  7 10:47:10 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=103.246.170.194, lip=66.85.158.91, TLS, session=<ZhtdZsVHA9xn9qrC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.189.201.122
country_id: 3469034
description:
Jan  7 10:47:31 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=179.189.201.122, lip=66.85.158.91, TLS, session=<6bukZ8VHfIyzvcl6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.225.31.22
country_id: 718075
description:
2026-01-07 10:49:44 dovecot_login authenticator failed for H=(ADMIN) [185.225.31.22]:51092: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  7 10:50:22 host2 sshd[2935122]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.58.241.90
country_id: 3469034
description:
2026-01-07 10:52:46 dovecot_login authenticator failed for H=(ccabv.org9.static.gvt.net.br) [187.58.241.90]:36727: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.207.251.240
country_id: 290557
description:
2026-01-07 10:53:02 dovecot_login authenticator failed for H=([94.207.251.240]) [94.207.251.240]:57714: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.20.68
country_id: 6252001
description:
Jan  7 10:53:26 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.20.68, lip=66.85.158.92, TLS handshaking: Connection closed, session=<ShbmfcVHDnZBMRRE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.209
country_id: 2635167
description:
Jan  7 10:54:14 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 46 secs): user=<>, rip=35.203.210.209, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<qhO5gMVHZ98jy9LR>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.46.45.121
country_id: 290557
description:
2026-01-07 10:57:30 dovecot_login authenticator failed for H=([20.46.45.121]) [20.46.45.121]:57178: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.54
country_id: 1149361
description:
2026-01-07 10:57:43 dovecot_login authenticator failed for H=([149.54.62.54]) [149.54.62.54]:49571: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.42.225.40
country_id: 2510769
description:
2026-01-07 10:57:51 dovecot_login authenticator failed for H=40.red-81-42-225.staticip.rima-tde.net [81.42.225.40]:37992: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.162.163
country_id: 298795
description:
2026-01-07 10:57:57 dovecot_login authenticator failed for H=([5.11.162.163]) [5.11.162.163]:37118: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.57
country_id: 1733045
description:
2026-01-07 10:58:38 dovecot_login authenticator failed for H=([49.124.153.57]) [49.124.153.57]:55530: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.216.92.113
country_id: 6290252
description:
Jan  7 10:59:32 host2 sshd[2943533]: Disconnected from invalid user claude 89.216.92.113 port 56764 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.192.166
country_id: 1269750
description:
2026-01-07 10:59:34 dovecot_login authenticator failed for H=([27.123.105.234]) [128.185.192.166]:49558: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.208.38
country_id: 1036973
description:
2026-01-07 10:59:48 dovecot_login authenticator failed for H=([197.219.208.38]) [197.219.208.38]:55168: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.216.92.113
country_id: 6290252
description:
Jan  7 11:00:42 host2 sshd[2944580]: Disconnected from invalid user celia 89.216.92.113 port 60648 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.196
country_id: 6252001
description:
Jan  7 11:01:09 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=205.210.31.196, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<K0V6mcVHDcXN0h/E>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  7 11:02:09 host2 sshd[2945652]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.209
country_id: 2635167
description:
Jan  7 11:01:55 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=35.203.210.209, lip=66.85.158.91, TLS, session=<nL41nMVHkugjy9LR>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 89.216.92.113
country_id: 6290252
description:
Jan  7 11:01:13 host2 sshd[2944999]: Disconnected from invalid user jamesm 89.216.92.113 port 44086 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.216.92.113
country_id: 6290252
description:
Jan  7 11:02:17 host2 sshd[2945762]: Disconnected from invalid user center 89.216.92.113 port 35842 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.200.237.19
country_id: 1269750
description:
Jan  7 11:02:26 host2 sshd[2945860]: Disconnected from invalid user owncloud 35.200.237.19 port 1100 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 71.6.134.230
country_id: 6252001
description:
Jan  7 11:08:59 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=71.6.134.230, lip=66.85.158.91, TLS: Connection closed, session=<2amFtcVHYtpHBobm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.129.145.153
country_id: 6252001
description:
2026-01-07 11:10:38 dovecot_login authenticator failed for H=(ADMIN) [102.129.145.153]:51490: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.231.85.75
country_id: 2464461
description:
2026-01-07 11:18:05 dovecot_login authenticator failed for H=([41.231.85.75]) [41.231.85.75]:59261: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.1.105.105
country_id: 1269750
description:
2026-01-07 11:17:27 dovecot_login authenticator failed for H=([61.1.105.105]) [61.1.105.105]:52302: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.206.119
country_id: 1819730
description:
2026-01-07 11:17:41 dovecot_login authenticator failed for H=(m121-202-206-119.smartone.com) [121.202.206.119]:50486: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 112.134.156.236
country_id: 1227603
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 112.134.156.236 - simpleengineerin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: User simpleengineerin has their account suspended. Login blocked.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.108.227.174
country_id: 1269750
description:
2026-01-07 11:35:10 dovecot_plain authenticator failed for H=(JKJEX) [42.108.227.174]:20447: 535 Incorrect authentication data (set_id=sanjanap@ksoft.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  7 11:35:23 host2 sshd[2974576]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.108.227.174
country_id: 1269750
description:
2026-01-07 11:35:17 dovecot_login authenticator failed for H=(JKJEX) [42.108.227.174]:20447: 535 Incorrect authentication data (set_id=sanjanap@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.157.95.30
country_id: 6251999
description:
2026-01-07 11:36:28 dovecot_login authenticator failed for H=d157-95-30.home4.cgocable.net [24.157.95.30]:48454: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.82.110.150
country_id: 660013
description:
2026-01-07 11:36:42 dovecot_login authenticator failed for H=([45.82.110.150]) [45.82.110.150]:34192: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.45
country_id: 6252001
description:
Jan  7 11:37:06 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.45, lip=66.85.158.91, TLS, session=<WFMPGsZH5OTN0h8t>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  7 11:37:42 host2 sshd[2976305]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.16.81.48
country_id: 2077456
description:
2026-01-07 11:38:41 dovecot_login authenticator failed for H=(ADMIN) [154.16.81.48]:7734: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.50.167.81
country_id: 1269750
description:
2026-01-07 11:40:33 dovecot_login authenticator failed for H=([36.50.167.81]) [36.50.167.81]:53980: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.60.78
country_id: 1269750
description:
2026-01-07 11:41:02 dovecot_login authenticator failed for H=([61.246.127.217]) [122.186.60.78]:60088: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.228
country_id: 1269750
description:
2026-01-07 11:43:34 dovecot_login authenticator failed for H=(nsg-corporate-228.228.187.122.airtel.in) [122.187.228.228]:51063: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.226.107.70
country_id: 3469034
description:
2026-01-07 11:43:47 dovecot_login authenticator failed for H=(72-107-226-38.edgetelecom.com.br) [38.226.107.70]:40607: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.85.202
country_id: 337996
description:
2026-01-07 11:43:48 dovecot_login authenticator failed for H=([196.191.212.235]) [213.55.85.202]:4087: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  7 11:45:58 host2 sshd[2983954]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.106.32.192
country_id: 6252001
description:
Jan  7 11:45:20 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (disconnected before auth was ready, waited 0 secs): user=<>, rip=20.106.32.192, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<UIh7N8ZHDN0UaiDA>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.169.104.246
country_id: 6252001
description:
Jan  7 11:51:08 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.169.104.246, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<oE8+TMZH3NUUqWj2>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.184.114
country_id: 1269750
description:
2026-01-07 11:50:29 dovecot_login authenticator failed for H=(aes-static-065.58.246.61.airtel.in) [182.95.184.114]:40680: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.226.240
country_id: 1269750
description:
2026-01-07 11:50:50 dovecot_login authenticator failed for H=(nsg-corporate-240.226.187.122.airtel.in) [122.187.226.240]:52201: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.121.175.220
country_id: 3579143
description:
2026-01-07 11:51:16 dovecot_login authenticator failed for H=(client-adsl-93-121-175-220.mediaserv.net) [93.121.175.220]:45916: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.122
country_id: 1269750
description:
2026-01-07 11:51:33 dovecot_login authenticator failed for H=([128.185.223.36]) [182.95.178.122]:33536: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.83.145.39
country_id: 6252001
description:
Jan  7 11:51:48 host2 dovecot[1170291]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.83.145.39, lip=66.85.158.91, session=<LJKgTsZHqOcDU5En>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 213.153.174.18
country_id: 298795
description:
Jan  7 11:53:54 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=213.153.174.18, lip=66.85.158.91, TLS, session=<PLwhVcZHKO7Vma4S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.121.95.175
country_id: 3469034
description:
Jan  7 11:54:14 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=138.121.95.175, lip=66.85.158.91, TLS, session=<JN9FVsZHXeuKeV+v>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.237.173.220
country_id: 6252001
description:
Jan  7 12:00:38 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.237.173.220, lip=66.85.158.92, TLS, session=<cF8+bsZHoLMD7a3c>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.216.215.142
country_id: 933860
description:
Jan  7 12:01:48 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=41.216.215.142, lip=66.85.158.91, TLS, session=<ZvAqccZHebEp2NeO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.240.96.216
country_id: 3469034
description:
Jan  7 12:02:09 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=191.240.96.216, lip=66.85.158.91, TLS, session=<oFyOcsZHupe/8GDY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.173.23.104
country_id: 2635167
description:
2026-01-07 12:02:38 dovecot_login authenticator failed for H=(ADMIN) [158.173.23.104]:35927: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-07 12:03:40 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (oranoph) [87.103.126.54]:22667: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.199.118.234
country_id: 1880251
description:
2026-01-07 12:06:42 dovecot_login authenticator failed for H=(448990.cloudwaysapps.com) [128.199.118.234]:30356: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.53.199.160
country_id: 6252001
description:
2026-01-07 12:09:21 dovecot_login authenticator failed for H=(136-53-199-160.googlefiber.net) [136.53.199.160]:43417: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.98.41.27
country_id: 1269750
description:
2026-01-07 12:10:04 dovecot_login authenticator failed for H=([59.98.41.27]) [59.98.41.27]:45285: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.202.197.108
country_id: 6252001
description:
2026-01-07 12:10:59 dovecot_plain authenticator failed for H=(ardliation) [50.202.197.108]:57416: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.244.106
country_id: 1269750
description:
2026-01-07 12:16:10 dovecot_login authenticator failed for H=([152.52.244.106]) [152.52.244.106]:38676: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.235.225.181
country_id: 6252001
description:
2026-01-07 12:15:33 dovecot_plain authenticator failed for H=c-71-235-225-181.hsd1.ct.comcast.net (munon) [71.235.225.181]:55422: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.201.85
country_id: 1733045
description:
2026-01-07 12:16:28 dovecot_login authenticator failed for H=([49.125.201.85]) [49.125.201.85]:32852: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.47.146
country_id: 1819730
description:
2026-01-07 12:17:23 dovecot_login authenticator failed for H=146.47.246.220.static.netvigator.com [220.246.47.146]:64189: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.86.130
country_id: 1269750
description:
2026-01-07 12:17:48 dovecot_login authenticator failed for H=(nsg-static-130.86.76.182-airtel.com) [182.76.86.130]:56372: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.220.97.188
country_id: 6252001
description:
2026-01-07 12:23:20 dovecot_login authenticator failed for H=c-98-220-97-188.hsd1.il.comcast.net [98.220.97.188]:41864: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.90.41.136
country_id: 1522867
description:
2026-01-07 12:24:10 dovecot_login authenticator failed for H=178.90.41.136.dynamic.telecom.kz [178.90.41.136]:58770: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.56.54.173
country_id: 6252001
description:
2026-01-07 12:24:40 dovecot_login authenticator failed for H=(ADMIN) [212.56.54.173]:6247: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.43.109
country_id: 1819730
description:
2026-01-07 12:30:55 dovecot_login authenticator failed for H=109.43.246.220.static.netvigator.com [220.246.43.109]:57455: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.168.50
country_id: 2186224
description:
2026-01-07 12:31:18 dovecot_login authenticator failed for H=([121.73.168.50]) [121.73.168.50]:48844: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.234.80.128
country_id: 6252001
description:
Jan  7 12:33:09 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=54.234.80.128, lip=66.85.158.91, TLS, session=<KMJ74sZHBOE26lCA>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.54
country_id: 6252001
description:
Jan  7 12:33:06 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=167.94.146.54, lip=66.85.158.92, TLS: Connection closed, session=<JEVR4sZHLminXpI2>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.54
country_id: 6252001
description:
Jan  7 12:33:14 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=167.94.146.54, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<D2vR4sZH9DmnXpI2>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.161.150
country_id: 1269750
description:
2026-01-07 12:42:32 dovecot_login authenticator failed for H=(nsg-corporate-25.230.186.122.airtel.in) [125.19.161.150]:42540: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.177.118
country_id: 1269750
description:
2026-01-07 12:42:52 dovecot_login authenticator failed for H=([152.52.234.180]) [182.95.177.118]:43504: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  7 12:50:34 host2 sshd[3042106]: Disconnected from invalid user admin 2.57.121.112 port 37415 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.52.194
country_id: 1269750
description:
2026-01-07 12:50:46 dovecot_login authenticator failed for H=([182.95.52.194]) [182.95.52.194]:47814: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.75.110
country_id: 1149361
description:
2026-01-07 12:51:10 dovecot_login authenticator failed for H=([180.94.75.110]) [180.94.75.110]:40162: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.146.60.90
country_id: 2782113
description:
2026-01-07 12:51:25 dovecot_login authenticator failed for H=(ADMIN) [156.146.60.90]:61395: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.65.238.7
country_id: 3469034
description:
Jan  7 12:52:51 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=45.65.238.7, lip=66.85.158.91, TLS, session=<ZNbVJ8dHH7YtQe4H>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.253.159.70
country_id: 732800
description:
Jan  7 12:53:09 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=185.253.159.70, lip=66.85.158.91, TLS, session=</RkJKcdHb7q5/Z9G>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.134.139.173
country_id: 6251999
description:
2026-01-07 12:58:04 dovecot_login authenticator failed for H=([207.134.139.173]) [207.134.139.173]:31768: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.252.18
country_id: 1269750
description:
2026-01-07 12:58:20 dovecot_login authenticator failed for H=(dsl-kk-static-089.203.95.61.airtelbroadband.in) [125.20.252.18]:54354: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.77
country_id: 6252001
description:
Jan  7 12:58:37 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.235.24.77, lip=66.85.158.92, session=<bs+YPcdHoPrG6xhN>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 47.250.82.167
country_id: 1733045
description:
Jan  7 13:00:48 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 3 secs): user=<>, rip=47.250.82.167, lip=66.85.158.91, session=<YfdpRcdHGtYv+lKn>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  7 13:01:59 host2 sshd[3053889]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.245.97.82
country_id: 1880251
description:
Jan  7 13:01:37 host2 sshd[3053559]: Disconnected from invalid user musikbot 43.245.97.82 port 55030 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.13.215.124
country_id: 1605651
description:
Jan  7 13:02:36 host2 sshd[3054422]: Disconnected from invalid user ankit 103.13.215.124 port 55410 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.33.34
country_id: 1269750
description:
Jan  7 13:02:39 host2 sshd[3054470]: Disconnected from invalid user nico 139.59.33.34 port 53908 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.245.97.82
country_id: 1880251
description:
Jan  7 13:02:16 host2 sshd[3054145]: Disconnected from invalid user ann 43.245.97.82 port 37786 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.33.34
country_id: 1269750
description:
Jan  7 13:05:48 host2 sshd[3057954]: Disconnected from invalid user ann 139.59.33.34 port 46986 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 139.59.33.34
country_id: 1269750
description:
Jan  7 13:06:26 host2 sshd[3058577]: Disconnected from invalid user claude 139.59.33.34 port 33022 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.13.215.124
country_id: 1605651
description:
Jan  7 13:07:42 host2 sshd[3059782]: Disconnected from invalid user celia 103.13.215.124 port 41072 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.123
country_id: 2186224
description:
2026-01-07 13:07:33 dovecot_login authenticator failed for H=([121.73.163.123]) [121.73.163.123]:33740: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.13.215.124
country_id: 1605651
description:
Jan  7 13:08:20 host2 sshd[3060458]: Disconnected from invalid user andrea 103.13.215.124 port 56498 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.103.120.150
country_id: 1819730
description:
2026-01-07 13:15:56 dovecot_login authenticator failed for H=150.120.103.218.static.netvigator.com [218.103.120.150]:64244: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.23.72.121
country_id: 6252001
description:
2026-01-07 13:16:06 dovecot_login authenticator failed for H=([209.23.72.121]) [209.23.72.121]:33042: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.65
country_id: 6252001
description:
Jan  7 13:16:23 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.235.24.65, lip=66.85.158.92, TLS, session=<9hIlfcdHTOjG6xhB>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.133.156.138
country_id: 294640
description:
2026-01-07 13:18:38 dovecot_login authenticator failed for H=([195.133.156.138]) [195.133.156.138]:48236: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.239.78.124
country_id: 1819730
description:
2026-01-07 13:18:25 dovecot_login authenticator failed for H=(182.239.78.124.hk.chinamobile.com) [182.239.78.124]:41624: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2026-01-07 13:24:38 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:60825: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  7 13:26:09 host2 sshd[3081484]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  7 13:28:27 host2 sshd[3083963]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.160.139.163
country_id: 2510769
description:
2026-01-07 13:30:53 dovecot_plain authenticator failed for H=(knote) [90.160.139.163]:44642: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.207.248.5
country_id: 3469034
description:
2026-01-07 13:33:29 dovecot_login authenticator failed for H=(mamanguape.static.gvt.net.br) [177.207.248.5]:37487: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.74.0.182
country_id: 3469034
description:
2026-01-07 13:33:49 dovecot_login authenticator failed for H=([177.74.52.129]) [177.74.0.182]:53436: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.173.152.4
country_id: 2658434
description:
2026-01-07 13:33:53 dovecot_login authenticator failed for H=(ADMIN) [158.173.152.4]:42625: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.64.68.99
country_id: 1643084
description:
Jan  7 13:34:38 host2 sshd[3089784]: Disconnected from invalid user rescue 36.64.68.99 port 37216 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 104.208.108.166
country_id: 1819730
description:
Jan  7 13:36:03 host2 sshd[3091169]: Disconnected from invalid user ubuntu 104.208.108.166 port 7810 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.77.150.244
country_id: 3017382
description:
Jan  7 13:38:38 host2 sshd[3093621]: Disconnected from invalid user rescue 51.77.150.244 port 36216 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.150.106.178
country_id: 6252001
description:
Jan  7 13:39:25 host2 sshd[3094386]: Disconnected from invalid user adam 107.150.106.178 port 35888 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.158.23.150
country_id: 99237
description:
Jan  7 13:39:30 host2 sshd[3094433]: Disconnected from invalid user ansible 185.158.23.150 port 25572 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.150.106.178
country_id: 6252001
description:
Jan  7 13:40:26 host2 sshd[3095565]: Disconnected from invalid user sftpuser 107.150.106.178 port 48314 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.158.23.150
country_id: 99237
description:
Jan  7 13:40:39 host2 sshd[3095733]: Disconnected from invalid user nguyen 185.158.23.150 port 36014 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 186.96.151.198
country_id: 3996063
description:
Jan  7 13:40:11 host2 sshd[3095287]: Disconnected from invalid user claude 186.96.151.198 port 47958 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.3.56.187
country_id: 99237
description:
Jan  7 13:41:53 host2 sshd[3096780]: Disconnected from invalid user ubuntu 62.3.56.187 port 36436 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.158.23.150
country_id: 99237
description:
Jan  7 13:41:14 host2 sshd[3096252]: Disconnected from invalid user rescue 185.158.23.150 port 17276 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.77.150.244
country_id: 3017382
description:
Jan  7 13:42:11 host2 sshd[3097028]: Disconnected from invalid user ubuntu 51.77.150.244 port 51134 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.3.56.187
country_id: 99237
description:
Jan  7 13:42:27 host2 sshd[3097262]: Disconnected from invalid user student9 62.3.56.187 port 46466 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 108.173.137.12
country_id: 6251999
description:
Jan  7 13:44:05 host2 sshd[3098981]: Disconnected from invalid user morgan 108.173.137.12 port 46998 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.150.106.178
country_id: 6252001
description:
Jan  7 13:44:13 host2 sshd[3099177]: Disconnected from invalid user shivam 107.150.106.178 port 41544 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 62.3.56.187
country_id: 99237
description:
Jan  7 13:44:34 host2 sshd[3099513]: Received disconnect from 62.3.56.187 port 58234:11: Bye Bye [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 62.3.56.187
country_id: 99237
description:
Jan  7 13:45:06 host2 sshd[3100052]: Disconnected from invalid user nguyen 62.3.56.187 port 42602 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.203.138
country_id: 1269750
description:
2026-01-07 13:45:25 dovecot_login authenticator failed for H=(nsg-corporate-201.0.185.122.airtel.in) [125.23.203.138]:36832: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.245.172.214
country_id: 1269750
description:
2026-01-07 13:45:39 dovecot_login authenticator failed for H=([115.245.172.214]) [115.245.172.214]:38038: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.150.106.178
country_id: 6252001
description:
Jan  7 13:47:05 host2 sshd[3102173]: Disconnected from invalid user claude 107.150.106.178 port 50572 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 108.173.137.12
country_id: 6251999
description:
Jan  7 13:46:35 host2 sshd[3101734]: Disconnected from invalid user nguyen 108.173.137.12 port 60004 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 162.243.200.40
country_id: 6252001
description:
Jan  7 13:50:03 host2 pure-ftpd[3104884]: (?@162.243.200.40) [INFO] New connection from 162.243.200.40


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 164.92.215.249
country_id: 2750405
description:
Jan  7 13:50:13 host2 pure-ftpd[3105114]: (?@164.92.215.249) [INFO] New connection from 164.92.215.249


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.100.53.47
country_id: 1831722
description:
2026-01-07 13:52:40 dovecot_plain authenticator failed for H=(V4836VC8A) [175.100.53.47]:9367: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.148.129
country_id: 3144096
description:
2026-01-07 13:53:37 dovecot_login authenticator failed for H=(cm-178.232.148.129.get.no) [178.232.148.129]:50998: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.161.137
country_id: 3144096
description:
2026-01-07 13:54:29 dovecot_login authenticator failed for H=(137-161-97-62.cust.smartcall.no) [62.97.161.137]:37392: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.234.30
country_id: 289688
description:
2026-01-07 13:54:58 dovecot_login authenticator failed for H=(ADMIN) [95.181.234.30]:24589: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.226.240
country_id: 1269750
description:
2026-01-07 13:54:16 dovecot_login authenticator failed for H=(nsg-corporate-240.226.187.122.airtel.in) [122.187.226.240]:37796: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.53.7.231
country_id: 6252001
description:
2026-01-07 13:55:48 dovecot_login authenticator failed for H=([64.53.7.231]) [64.53.7.231]:53956: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.74.94
country_id: 1149361
description:
2026-01-07 13:55:40 dovecot_login authenticator failed for H=([180.94.74.94]) [180.94.74.94]:42924: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  7 13:57:22 host2 sshd[3112127]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.245.39.145
country_id: 6290252
description:
2026-01-07 13:59:25 dovecot_plain authenticator failed for H=(58F1THHLM15) [109.245.39.145]:13869: 535 Incorrect authentication data (set_id=lasithar@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.60.78
country_id: 1269750
description:
2026-01-07 14:02:59 dovecot_login authenticator failed for H=([61.246.127.217]) [122.186.60.78]:43196: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.199.126
country_id: 1269750
description:
2026-01-07 14:03:45 dovecot_login authenticator failed for H=([182.79.31.107]) [152.52.199.126]:47948: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.102.188.117
country_id: 294640
description:
2026-01-07 14:11:30 dovecot_login authenticator failed for H=([82.102.188.117]) [82.102.188.117]:54189: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.198.98
country_id: 1819730
description:
2026-01-07 14:11:12 dovecot_login authenticator failed for H=(m121-202-198-98.smartone.com) [121.202.198.98]:44698: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.104.102
country_id: 1269750
description:
2026-01-07 14:13:04 dovecot_login authenticator failed for H=([27.123.104.102]) [27.123.104.102]:58308: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.72.184.60
country_id: 6252001
description:
2026-01-07 14:12:14 dovecot_login authenticator failed for H=24-72-184-24-72-184-60.cpe.sparklight.net [24.72.184.60]:36390: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.223.249.5
country_id: 2395170
description:
Jan  7 14:12:22 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=41.223.249.5, lip=66.85.158.91, TLS, session=<MwgnRMhHc+Up3/kF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.150.250
country_id: 1733045
description:
2026-01-07 14:12:43 dovecot_login authenticator failed for H=([49.124.150.250]) [49.124.150.250]:52198: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.60.212.209
country_id: 3175395
description:
Jan  7 14:12:50 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=194.60.212.209, lip=66.85.158.91, TLS, session=<qx8HRshHc4/CPNTR>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.96.227.144
country_id: 6252001
description:
2026-01-07 14:14:02 dovecot_login authenticator failed for H=(ADMIN) [191.96.227.144]:41522: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.205.197
country_id: 99237
description:
2026-01-07 14:19:21 dovecot_login authenticator failed for H=([65.20.205.197]) [65.20.205.197]:45251: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.142.184.55
country_id: 1210997
description:
2026-01-07 14:19:47 dovecot_login authenticator failed for H=([103.133.175.82]) [103.142.184.55]:56381: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.253.202.163
country_id: 6290252
description:
Jan  7 14:23:13 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=178.253.202.163, lip=66.85.158.91, TLS, session=<fTYka8hHOLuy/cqj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.125.243.150
country_id: 798544
description:
Jan  7 14:23:13 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=109.125.243.150, lip=66.85.158.91, TLS, session=<Ug4la8hHn5htffOW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.255.215.103
country_id: 732800
description:
Jan  7 14:23:32 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<hr>, method=PLAIN, rip=185.255.215.103, lip=66.85.158.91, TLS, session=<4/s9bMhHNde5/9dn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.125.248.92
country_id: 798544
description:
Jan  7 14:23:33 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<hr>, method=PLAIN, rip=109.125.248.92, lip=66.85.158.91, TLS, session=<IQVIbMhHpwttffhc>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  7 14:27:55 host2 sshd[3142059]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 54.162.22.9
country_id: 6252001
description:
[2026-01-07 14:27:20 +0530] info [cpaneld] 54.162.22.9 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.157.158
country_id: 1269750
description:
2026-01-07 14:29:25 dovecot_login authenticator failed for H=([128.185.70.193]) [125.19.157.158]:42648: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.208
country_id: 1733045
description:
2026-01-07 14:29:58 dovecot_login authenticator failed for H=([49.124.152.208]) [49.124.152.208]:44928: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.32.50.178
country_id: 6252001
description:
2026-01-07 14:34:53 dovecot_login authenticator failed for H=(ADMIN) [212.32.50.178]:56036: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.146.222
country_id: 3996063
description:
2026-01-07 14:39:59 dovecot_login authenticator failed for H=([177.236.146.222]) [177.236.146.222]:34686: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.132.97.76
country_id: 2264397
description:
2026-01-07 14:40:17 dovecot_login authenticator failed for H=a94-132-97-76.cpe.netcabo.pt [94.132.97.76]:38138: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.21.28.14
country_id: 6252001
description:
2026-01-07 14:42:27 dovecot_plain authenticator failed for H=c-73-21-28-14.hsd1.ga.comcast.net (aphious) [73.21.28.14]:44486: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.56.12.205
country_id: 1168579
description:
2026-01-07 14:44:41 dovecot_login authenticator failed for H=([210.56.12.205]) [210.56.12.205]:47796: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.56.0.19
country_id: 3469034
description:
2026-01-07 14:45:08 dovecot_login authenticator failed for H=(177-215-153-215.user.vivozap.com.br) [189.56.0.19]:43115: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.22.204.23
country_id: 1210997
description:
2026-01-07 14:48:18 dovecot_login authenticator failed for H=([202.22.204.23]) [202.22.204.23]:47645: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 35.216.172.131
country_id: 2658434
description:
Jan  7 14:48:26 host2 pure-ftpd[3167122]: (?@35.216.172.131) [INFO] New connection from 35.216.172.131


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 35.216.172.131
country_id: 2658434
description:
Jan  7 14:48:30 host2 pure-ftpd[3167202]: (?@35.216.172.131) [INFO] New connection from 35.216.172.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.177.143.61
country_id: 1819730
description:
2026-01-07 14:48:42 dovecot_login authenticator failed for H=([210.177.143.61]) [210.177.143.61]:36734: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 128.90.49.3
country_id: 1880251
description:
[2026-01-07 14:51:03 +0530] info [cpaneld] 128.90.49.3 - cloudtourssrilan "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 54.162.22.9
country_id: 6252001
description:
[2026-01-07 14:51:21 +0530] info [cpaneld] 54.162.22.9 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.124.17.38
country_id: 6252001
description:
2026-01-07 14:58:24 dovecot_login authenticator failed for H=(ADMIN) [91.124.17.38]:30623: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  7 14:59:41 host2 sshd[3178859]: Disconnected from invalid user admin 2.57.121.112 port 42223 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.204.179.54
country_id: 6252001
description:
2026-01-07 15:02:57 dovecot_plain authenticator failed for H=ec2-34-204-179-54.compute-1.amazonaws.com (EC2AMAZ-LBU63OQ.ec2.internal) [34.204.179.54]:60985: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.191
country_id: 2635167
description:
Jan  7 15:06:43 host2 dovecot[1170291]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=87.236.176.191, lip=66.85.158.91, TLS, session=<geO4B8lHOYlX7LC/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.163
country_id: 2635167
description:
Jan  7 15:06:44 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=185.247.137.163, lip=66.85.158.91, TLS handshaking: Connection closed, session=<z4fFB8lHRa6594mj>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.146
country_id: 2635167
description:
Jan  7 15:07:17 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.146, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<BuLACclHrbVX7LCS>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.148
country_id: 2635167
description:
Jan  7 15:07:51 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=185.247.137.148, lip=66.85.158.91, TLS handshaking: Connection closed, session=<Zjy8C8lH3dC594mU>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.158
country_id: 2635167
description:
Jan  7 15:08:24 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: read(size=693) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.158, lip=66.85.158.91, TLS handshaking: read(size=693) failed: Connection reset by peer, session=<hby3DclHP+O594me>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.173
country_id: 2635167
description:
Jan  7 15:08:57 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: read(size=612) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.173, lip=66.85.158.91, TLS handshaking: read(size=612) failed: Connection reset by peer, session=<8AKzD8lHd9e594mt>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.148
country_id: 2635167
description:
Jan  7 15:09:30 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=185.247.137.148, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<tWysEclHT7C594mU>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.60.233.159
country_id: 3017382
description:
[2026-01-07 15:09:44 +0530] info [cpaneld] 37.60.233.159 - lezzarot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarot (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.156
country_id: 2635167
description:
Jan  7 15:10:04 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=87.236.176.156, lip=66.85.158.91, TLS handshaking: Connection closed, session=<drCpE8lHXbZX7LCc>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.178
country_id: 2635167
description:
Jan  7 15:10:38 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.178, lip=66.85.158.91, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<LJK0FclHd9JX7LCy>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.166
country_id: 2635167
description:
Jan  7 15:11:11 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=87.236.176.166, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<dw+uF8lH9+1X7LCm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.149
country_id: 2635167
description:
Jan  7 15:11:44 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=87.236.176.149, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<ilCpGclHy75X7LCV>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.106.164.74
country_id: 1733045
description:
Jan  7 15:13:47 host2 sshd[3192331]: Disconnected from invalid user claude 203.106.164.74 port 38818 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.72.233.36
country_id: 2464461
description:
Jan  7 15:14:30 host2 sshd[3192934]: Disconnected from invalid user claude 154.72.233.36 port 54586 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.228.134
country_id: 1269750
description:
2026-01-07 15:14:46 dovecot_login authenticator failed for H=(nsg-static-209.69.76.182-airtel.com) [128.185.228.134]:42018: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.189.85.66
country_id: 3469034
description:
2026-01-07 15:16:08 dovecot_login authenticator failed for H=179-189-85-66.goldnettelecom.com.br [179.189.85.66]:60972: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.253.154
country_id: 1269750
description:
2026-01-07 15:15:11 dovecot_login authenticator failed for H=([182.78.122.253]) [125.19.253.154]:58368: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.204.179.54
country_id: 6252001
description:
2026-01-07 15:15:38 dovecot_plain authenticator failed for H=ec2-34-204-179-54.compute-1.amazonaws.com (EC2AMAZ-LBU63OQ.ec2.internal) [34.204.179.54]:60158: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.85.150.173
country_id: 3923057
description:
2026-01-07 15:15:53 dovecot_login authenticator failed for H=(static-200-85-150173.vnet.bo) [200.85.150.173]:49044: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.138
country_id: 6252001
description:
Jan  7 15:16:55 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.138, lip=66.85.158.92, TLS: Connection closed, session=<PVYtLMlH9itChJmK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 93.71.118.99
country_id: 3175395
description:
Jan  7 15:16:22 host2 sshd[3194781]: Disconnected from invalid user claude 93.71.118.99 port 46372 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Jan  7 15:16:28 host2 dovecot[1170291]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<dKeOKslHBNsDhpQ7>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.180.88.176
country_id: 6252001
description:
Jan  7 15:16:34 host2 sshd[3194963]: Disconnected from invalid user comercial 107.180.88.176 port 45304 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  7 15:17:17 host2 sshd[3195659]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  7 15:17:23 host2 sshd[3195737]: Disconnected from invalid user admin 2.57.121.112 port 37848 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 154.72.233.36
country_id: 2464461
description:
Jan  7 15:17:46 host2 sshd[3196149]: Received disconnect from 154.72.233.36 port 56466:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.69.0.72
country_id: 6252001
description:
Jan  7 15:17:21 host2 sshd[3195724]: Disconnected from invalid user comercial 34.69.0.72 port 34342 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 93.71.118.99
country_id: 3175395
description:
Jan  7 15:18:32 host2 sshd[3196926]: Disconnected from invalid user simon 93.71.118.99 port 34012 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Jan  7 15:18:44 host2 dovecot[1170291]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<ZJ6mMslH6N8DhpQ7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.127.128
country_id: 3144096
description:
2026-01-07 15:19:00 dovecot_login authenticator failed for H=(cm-46.212.127.128.get.no) [46.212.127.128]:59094: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  7 15:19:36 host2 sshd[3197915]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.231.114
country_id: 1269750
description:
2026-01-07 15:19:28 dovecot_login authenticator failed for H=([182.95.20.113]) [128.185.231.114]:35236: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.106.164.74
country_id: 1733045
description:
Jan  7 15:19:55 host2 sshd[3198182]: Disconnected from invalid user comercial 203.106.164.74 port 46790 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Jan  7 15:20:41 host2 dovecot[1170291]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<c66iOclH5NEDhpQ7>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 203.106.164.74
country_id: 1733045
description:
Jan  7 15:21:28 host2 sshd[3200238]: Disconnected from invalid user bigbluebutton 203.106.164.74 port 41720 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.69.0.72
country_id: 6252001
description:
Jan  7 15:21:33 host2 sshd[3200349]: Disconnected from invalid user oneadmin 34.69.0.72 port 60872 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 34.69.0.72
country_id: 6252001
description:
Jan  7 15:22:37 host2 sshd[3201429]: Received disconnect from 34.69.0.72 port 39154:11: Bye Bye [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 34.69.0.72
country_id: 6252001
description:
Jan  7 15:23:08 host2 sshd[3201911]: Disconnected from invalid user claude 34.69.0.72 port 57972 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.32.50.180
country_id: 6252001
description:
2026-01-07 15:23:42 dovecot_login authenticator failed for H=(ADMIN) [212.32.50.180]:55783: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.134.148.59
country_id: 6252001
description:
Jan  7 15:24:26 host2 dovecot[1170291]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<ts4WR8lHmKUDhpQ7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.92.51.186
country_id: 1269750
description:
2026-01-07 15:26:12 dovecot_login authenticator failed for H=(static.bb.ill.59.92.51.186.bsnl.in) [59.92.51.186]:40628: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.139.244
country_id: 99237
description:
Jan  7 15:26:24 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=65.20.139.244, lip=66.85.158.91, TLS, session=<cm4XTclHHZtBFIv0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Jan  7 15:26:44 host2 dovecot[1170291]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<Mr9NT8lHVLsDhpQ7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.179.188.197
country_id: 3469034
description:
Jan  7 15:26:47 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=45.179.188.197, lip=66.85.158.91, TLS, session=<Ks4+TslHMI0ts7zF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.210.118
country_id: 1269750
description:
2026-01-07 15:27:13 dovecot_login authenticator failed for H=([152.52.210.118]) [152.52.210.118]:39464: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  7 15:37:44 host2 sshd[3214136]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.29
country_id: 3017382
description:
Jan  7 15:39:54 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=91.231.89.29, lip=66.85.158.92, session=<B1thfslHtYxb51kd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.27
country_id: 3017382
description:
Jan  7 15:40:04 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=91.231.89.27, lip=66.85.158.92, session=<OMj+fslHF9Nb51kb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.219
country_id: 3017382
description:
Jan  7 15:40:19 host2 dovecot[1170291]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=91.231.89.219, lip=66.85.158.92, session=<XUDlf8lH7eVb51nb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.220
country_id: 3017382
description:
Jan  7 15:40:23 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.231.89.220, lip=66.85.158.92, session=<ypcXgMlHX4db51nc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.109.56.74
country_id: 6252001
description:
2026-01-07 15:40:59 dovecot_login authenticator failed for H=(dfw-206-109-56-74.ip4.99.network) [206.109.56.74]:64506: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.52.170
country_id: 1269750
description:
2026-01-07 15:41:22 dovecot_login authenticator failed for H=([182.95.52.170]) [182.95.52.170]:45236: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.138.193.174
country_id: 290557
description:
2026-01-07 15:46:04 dovecot_login authenticator failed for H=(ADMIN) [217.138.193.174]:43931: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  7 15:47:16 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<6mO/mMlHhMoDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  7 15:49:06 host2 dovecot[1170291]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<zcBDn8lHdOIDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  7 15:49:13 host2 dovecot[1170291]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<WdSqn8lHpKQDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  7 15:50:17 host2 dovecot[1170291]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<tu6Io8lHArADhBfJ>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  7 15:52:08 host2 dovecot[1170291]: imap-login: Disconnected: Input buffer full (no auth attempts in 1 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<8+EYqslHqp4DhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  7 15:52:09 host2 dovecot[1170291]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<S6MvqslHRsIDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  7 15:53:19 host2 dovecot[1170291]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<0YdcrslHfKkDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  7 15:55:08 host2 dovecot[1170291]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<Q8LctMlH1oYDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.195.49
country_id: 6252001
description:
Jan  7 15:56:29 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.65.195.49, lip=66.85.158.92, session=<Y3CruclHdKsUQcMx>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.64.105.248
country_id: 6252001
description:
Jan  7 15:59:16 host2 dovecot[1170291]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=20.64.105.248, lip=66.85.158.91, session=<3d6jw8lH8OsUQGn4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.222.149.239
country_id: 6251999
description:
2026-01-07 15:59:25 dovecot_login authenticator failed for H=host-24-222-149-239.public.eastlink.ca [24.222.149.239]:60712: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.156.82.86
country_id: 1880251
description:
2026-01-07 15:59:13 dovecot_login authenticator failed for H=(86.82.156.175.unknown.m1.com.sg) [175.156.82.86]:48393: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  7 16:04:25 host2 sshd[3238620]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.244.56.226
country_id: 6252001
description:
2026-01-07 16:05:45 dovecot_login authenticator failed for H=(ADMIN) [173.244.56.226]:56565: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.173.57
country_id: 3144096
description:
2026-01-07 16:08:49 dovecot_login authenticator failed for H=([62.97.173.57]) [62.97.173.57]:49184: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.124.139.77
country_id: 3144096
description:
2026-01-07 16:08:57 dovecot_login authenticator failed for H=([188.124.139.77]) [188.124.139.77]:55224: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.130.206
country_id: 3144096
description:
2026-01-07 16:10:24 dovecot_login authenticator failed for H=(cm-178.232.130.206.get.no) [178.232.130.206]:36768: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.92.249
country_id: 1168579
description:
2026-01-07 16:10:44 dovecot_login authenticator failed for H=(249.92.zcomnetworks.com.pk) [103.148.92.249]:42319: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.10.206
country_id: 2300660
description:
Jan  7 16:11:18 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=41.139.10.206, lip=66.85.158.91, TLS, session=<LKp37clHyLkpiwrO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.47.133
country_id: 2300660
description:
Jan  7 16:11:43 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=41.139.47.133, lip=66.85.158.91, TLS, session=<L23f7slHy5spiy+F>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.252.111
country_id: 3865483
description:
Jan  7 16:20:57 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=179.0.252.111, lip=66.85.158.91, TLS, session=<IPwHEMpHJcezAPxv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.229.98.82
country_id: 2510769
description:
Jan  7 16:21:14 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=185.229.98.82, lip=66.85.158.91, TLS, session=<m7o3EcpHW6m55WJS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.211.172.152
country_id: 6252001
description:
2026-01-07 16:25:14 dovecot_plain authenticator failed for H=ec2-34-211-172-152.us-west-2.compute.amazonaws.com (EC2AMAZ-IIGIKVB.us-west-2.compute.internal) [34.211.172.152]:53894: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.214.84.37
country_id: 690791
description:
2026-01-07 16:27:56 dovecot_login authenticator failed for H=(91.214.84.37.sky-net.com.ua) [91.214.84.37]:53174: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.233.5.67
country_id: 6252001
description:
2026-01-07 16:28:08 dovecot_login authenticator failed for H=([50.233.5.67]) [50.233.5.67]:49547: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.208.46.130
country_id: 1522867
description:
2026-01-07 16:28:35 dovecot_login authenticator failed for H=([37.208.46.130]) [37.208.46.130]:46203: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 86.111.91.69
country_id: 690791
description:
2026-01-07 16:28:49 dovecot_login authenticator failed for H=host-86-111-91-69.566f.la.net.ua [86.111.91.69]:56072: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.172.147.190
country_id: 1269750
description:
2026-01-07 16:28:58 dovecot_login authenticator failed for H=([110.172.147.190]) [110.172.147.190]:46332: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.94.66
country_id: 1269750
description:
2026-01-07 16:29:23 dovecot_login authenticator failed for H=([27.123.94.66]) [27.123.94.66]:39482: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.90.120.167
country_id: 798549
description:
2026-01-07 16:29:52 dovecot_login authenticator failed for H=(ADMIN) [91.90.120.167]:43964: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.83.145.39
country_id: 6252001
description:
Jan  7 16:33:34 host2 dovecot[1170291]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.83.145.39, lip=66.85.158.91, session=<X/NHPspHMsUDU5En>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.8.240.44
country_id: 2017370
description:
2026-01-07 16:34:50 dovecot_login authenticator failed for H=([46.8.240.44]) [46.8.240.44]:47052: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.55.131.151
country_id: 1694008
description:
2026-01-07 16:35:36 dovecot_login authenticator failed for H=(122.55.143.46.static.pldt.net) [122.55.131.151]:55634: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 64.225.101.76
country_id: 2921044
description:
Jan  7 16:40:23 host2 pure-ftpd[3274797]: (?@64.225.101.76) [INFO] New connection from 64.225.101.76


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 31.222.12.1
country_id: 798544
description:
Jan  7 16:41:08 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=31.222.12.1, lip=66.85.158.91, TLS, session=<fKBgWMpHC9Af3gwB>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 95.142.132.168
country_id: 298795
description:
Jan  7 16:41:26 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=95.142.132.168, lip=66.85.158.91, TLS, session=<jq9zWcpHYdxfjoSo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.250.118.53
country_id: 3865483
description:
2026-01-07 16:42:22 dovecot_login authenticator failed for H=([167.250.118.53]) [167.250.118.53]:54376: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.181.81.150
country_id: 1269750
description:
2026-01-07 16:42:44 dovecot_login authenticator failed for H=([103.181.81.150]) [103.181.81.150]:36913: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.183.103.121
country_id: 2635167
description:
2026-01-07 16:43:04 dovecot_login authenticator failed for H=(185-183-103-121.xdsl.5gdsl.com) [185.183.103.121]:54158: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.102.148.242
country_id: 6252001
description:
2026-01-07 16:47:27 dovecot_login authenticator failed for H=syn-098-102-148-242.biz.spectrum.com [98.102.148.242]:46362: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.172.15.103
country_id: 3469034
description:
2026-01-07 16:47:49 dovecot_login authenticator failed for H=(177-172-15-62.user.vivozap.com.br) [177.172.15.103]:30111: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 71.6.134.234
country_id: 6252001
description:
Jan  7 16:51:28 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=71.6.134.234, lip=66.85.158.92, TLS: Connection closed, session=<3GlMfspHrM9HBobq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2026-01-07 16:52:53 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:60385: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.246.106.45
country_id: 2623032
description:
2026-01-07 16:55:23 dovecot_login authenticator failed for H=(ADMIN) [46.246.106.45]:9496: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  7 16:57:45 host2 sshd[3292203]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.250.19.91
country_id: 1269750
description:
2026-01-07 16:57:55 dovecot_login authenticator failed for H=(static.ill.117.250.19.91.bsnl.co.in) [117.250.19.91]:48000: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.235.35.123
country_id: 1269750
description:
2026-01-07 16:58:18 dovecot_login authenticator failed for H=([20.235.35.123]) [20.235.35.123]:33314: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.96.144
country_id: 3469034
description:
Jan  7 17:04:03 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@jrdc.lk>, method=PLAIN, rip=177.44.96.144, lip=66.85.158.91, TLS, session=<vLMfqspHW6+xLGCQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 80.248.76.174
country_id: 2363686
description:
Jan  7 17:04:08 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<info@jrdc.lk>, method=PLAIN, rip=80.248.76.174, lip=66.85.158.91, TLS, session=<hyBHqspHxeNQ+Eyu>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.204.23.3
country_id: 6252001
description:
Jan  7 17:03:58 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@jrdc.lk>, method=PLAIN, rip=67.204.23.3, lip=66.85.158.91, TLS, session=<LUcNqspHYupDzBcD>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 31.179.228.60
country_id: 798544
description:
Jan  7 17:03:58 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@jrdc.lk>, method=PLAIN, rip=31.179.228.60, lip=66.85.158.91, TLS, session=<US4PqspHOtQfs+Q8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.221.145.100
country_id: 690791
description:
Jan  7 17:04:00 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@jrdc.lk>, method=PLAIN, rip=37.221.145.100, lip=66.85.158.91, TLS, session=<goUOqspHObsl3ZFk>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.8.254.17
country_id: 3469034
description:
Jan  7 17:04:20 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=177.8.254.17, lip=66.85.158.91, TLS, session=<D8U8q8pHv9ixCP4R>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.57.226
country_id: 953987
description:
Jan  7 17:04:20 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=102.129.57.226, lip=66.85.158.91, TLS, session=<i+owq8pHWdJmgTni>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.179.189.120
country_id: 3469034
description:
Jan  7 17:04:23 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=45.179.189.120, lip=66.85.158.91, TLS, session=<qjFtq8pH4M4ts714>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.246.242
country_id: 1269750
description:
Jan  7 17:04:21 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=103.164.246.242, lip=66.85.158.91, TLS, session=<zPwxq8pHIehnpPby>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 93.51.226.100
country_id: 3175395
description:
Jan  7 17:04:26 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=93.51.226.100, lip=66.85.158.91, TLS, session=<ULq0q8pHecBdM+Jk>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.83.134.101
country_id: 3469034
description:
2026-01-07 17:06:13 dovecot_login authenticator failed for H=(179.83.135.1.dynamic.adsl.gvt.net.br) [179.83.134.101]:60808: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.116.247.31
country_id: 1522867
description:
2026-01-07 17:06:39 dovecot_login authenticator failed for H=([212.116.247.31]) [212.116.247.31]:37440: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  7 17:09:10 host2 sshd[3303880]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.153.184
country_id: 3144096
description:
2026-01-07 17:08:37 dovecot_login authenticator failed for H=(cm-178.232.153.184.get.no) [178.232.153.184]:38841: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.247.189.189
country_id: 6252001
description:
2026-01-07 17:08:25 dovecot_login authenticator failed for H=([50.247.189.189]) [50.247.189.189]:35546: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  7 17:11:29 host2 sshd[3306649]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.128.209.48
country_id: 3469034
description:
2026-01-07 17:14:44 dovecot_login authenticator failed for H=(138.219.244.10.static.softdados.net) [177.128.209.48]:53756: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.97.64.146
country_id: 3469034
description:
2026-01-07 17:14:54 dovecot_login authenticator failed for H=138-97-64-146.westlink.net.br [138.97.64.146]:60880: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.0.3
country_id: 3469034
description:
2026-01-07 17:14:32 dovecot_login authenticator failed for H=(177-174-0-3.user.vivozap.com.br) [177.174.0.3]:57638: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.129.252.135
country_id: 6252001
description:
2026-01-07 17:14:34 dovecot_login authenticator failed for H=(ADMIN) [102.129.252.135]:58596: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.4
country_id: 1733045
description:
2026-01-07 17:15:11 dovecot_login authenticator failed for H=([49.124.153.4]) [49.124.153.4]:40378: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.124.50.151
country_id: 1168579
description:
2026-01-07 17:18:18 dovecot_login authenticator failed for H=([203.124.50.151]) [203.124.50.151]:54419: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.163.219
country_id: 3144096
description:
2026-01-07 17:18:35 dovecot_login authenticator failed for H=(219-163-97-62.cust.smartcall.no) [62.97.163.219]:57664: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.0.142.131
country_id: 1819730
description:
2026-01-07 17:18:56 dovecot_login authenticator failed for H=14-0-142-131.static.pccw-hkt.com [14.0.142.131]:51007: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.130
country_id: 6252001
description:
Jan  7 17:25:01 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=66.132.153.130, lip=66.85.158.92, TLS: Connection closed, session=<6jVM9spHBGxChJmC>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.130
country_id: 6252001
description:
Jan  7 17:25:11 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=66.132.153.130, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<KMXl9spH7CBChJmC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.217.40.11
country_id: 6252001
description:
2026-01-07 17:28:25 dovecot_login authenticator failed for H=([50.217.40.11]) [50.217.40.11]:49696: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.122.97.66
country_id: 3996063
description:
Jan  7 17:28:41 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=138.122.97.66, lip=66.85.158.91, TLS, session=<D3hyAstH84uKemFC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.100.104
country_id: 294640
description:
2026-01-07 17:28:42 dovecot_login authenticator failed for H=(2-55-100-104.orange.net.il) [2.55.100.104]:38032: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.198.1.89
country_id: 798544
description:
Jan  7 17:28:59 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=185.198.1.89, lip=66.85.158.91, TLS, session=<A819A8tH/9W5xgFZ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.230.127.217
country_id: 1512440
description:
2026-01-07 17:29:31 dovecot_login authenticator failed for H=([213.230.127.217]) [213.230.127.217]:36494: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.120.98
country_id: 1269750
description:
2026-01-07 17:29:47 dovecot_login authenticator failed for H=([59.145.74.209]) [122.184.120.98]:48416: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.86.18.43
country_id: 3469034
description:
Jan  7 17:30:21 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=177.86.18.43, lip=66.85.158.91, TLS, session=<pNlPCMtH1K+xVhIr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.153.236
country_id: 99237
description:
Jan  7 17:30:51 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 28 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=65.20.153.236, lip=66.85.158.91, TLS handshaking: Connection closed, session=<QUx7CctHRONBFJns>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 177.53.165.212
country_id: 3469034
description:
Jan  7 17:30:56 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=177.53.165.212, lip=66.85.158.91, TLS, session=<C1F5C8tHAZqxNaXU>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  7 17:32:24 host2 sshd[3325659]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.113.212
country_id: 1861060
description:
Jan  7 17:32:33 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=139.162.113.212, lip=66.85.158.92, TLS: Connection closed, session=<CkA6EctHVMGLonHU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.133.172.243
country_id: 2635167
description:
2026-01-07 17:36:40 dovecot_login authenticator failed for H=(ADMIN) [45.133.172.243]:2811: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.56
country_id: 99237
description:
2026-01-07 17:43:20 dovecot_login authenticator failed for H=([65.20.133.56]) [65.20.133.56]:56781: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.186.114.73
country_id: 1168579
description:
2026-01-07 17:43:40 dovecot_login authenticator failed for H=([103.186.114.73]) [103.186.114.73]:60948: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.17.233.246
country_id: 1269750
description:
2026-01-07 17:50:11 dovecot_login authenticator failed for H=([125.17.233.246]) [125.17.233.246]:46802: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.54.10
country_id: 1269750
description:
2026-01-07 17:50:25 dovecot_login authenticator failed for H=([128.185.241.106]) [182.95.54.10]:51428: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 54.162.22.9
country_id: 6252001
description:
2026-01-07 17:52:39 dovecot_plain authenticator failed for H=ec2-54-162-22-9.compute-1.amazonaws.com (EC2AMAZ-EJJQGKM.ec2.internal) [54.162.22.9]:56321: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.106.33.119
country_id: 6252001
description:
Jan  7 17:55:24 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=20.106.33.119, lip=66.85.158.91, TLS, session=<6HzxYstHguoUaiF3>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.80.88.160
country_id: 6252001
description:
Jan  7 17:56:20 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.80.88.160, lip=66.85.158.92, TLS, session=<YPxJZstHYq8UUFig>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.164
country_id: 2186224
description:
2026-01-07 17:56:33 dovecot_login authenticator failed for H=([121.73.163.164]) [121.73.163.164]:52568: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.222.54
country_id: 1269750
description:
2026-01-07 17:57:00 dovecot_login authenticator failed for H=(aes-static-089.140.22.125.airtel.in) [122.187.222.54]:33370: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.146.41.81
country_id: 3175395
description:
2026-01-07 18:00:54 dovecot_login authenticator failed for H=(ADMIN) [156.146.41.81]:47050: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 146.190.22.247
country_id: 2750405
description:
Jan  7 18:02:35 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=146.190.22.247, lip=66.85.158.91, session=<7oF/fMtHYsCSvhb3>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.210.193.176
country_id: 6252001
description:
Jan  7 18:03:29 host2 sshd[3355247]: Disconnected from invalid user admin 192.210.193.176 port 60302 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 192.210.193.176
country_id: 6252001
description:
Jan  7 18:05:07 host2 sshd[3356923]: Disconnected from invalid user user1 192.210.193.176 port 60228 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.208.48.177
country_id: 6252001
description:
Jan  7 18:05:10 host2 sshd[3356977]: Disconnected from invalid user ftpuser 172.208.48.177 port 48620 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.139.192.188
country_id: 1643084
description:
Jan  7 18:04:14 host2 sshd[3355845]: Disconnected from invalid user frappe 103.139.192.188 port 32994 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.210.193.176
country_id: 6252001
description:
Jan  7 18:04:31 host2 sshd[3356194]: Disconnected from invalid user deploy 192.210.193.176 port 48566 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.66.119.139
country_id: 2661886
description:
2026-01-07 18:06:47 dovecot_login authenticator failed for H=78-66-119-139-no600.tbcn.telia.com [78.66.119.139]:50528: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.208.48.177
country_id: 6252001
description:
Jan  7 18:09:00 host2 sshd[3361267]: Disconnected from invalid user frappe 172.208.48.177 port 57898 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.18.229.242
country_id: 1694008
description:
Jan  7 18:09:06 host2 sshd[3361412]: Disconnected from invalid user claude 103.18.229.242 port 58530 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.224.19
country_id: 1880251
description:
Jan  7 18:09:25 host2 sshd[3361760]: Disconnected from invalid user test1 45.78.224.19 port 59810 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.208.48.177
country_id: 6252001
description:
Jan  7 18:09:32 host2 sshd[3361936]: Disconnected from invalid user claude 172.208.48.177 port 52768 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.17.133.138
country_id: 3469034
description:
Jan  7 18:09:32 host2 sshd[3361892]: Disconnected from invalid user test 201.17.133.138 port 45178 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.139.192.188
country_id: 1643084
description:
Jan  7 18:10:45 host2 sshd[3363690]: Disconnected from invalid user user 103.139.192.188 port 44754 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.17.133.138
country_id: 3469034
description:
Jan  7 18:10:53 host2 sshd[3363820]: Disconnected from invalid user ubuntu 201.17.133.138 port 38784 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.139.192.188
country_id: 1643084
description:
Jan  7 18:11:31 host2 sshd[3364393]: Disconnected from invalid user test1 103.139.192.188 port 36348 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.18.229.242
country_id: 1694008
description:
Jan  7 18:11:52 host2 sshd[3364663]: Disconnected from invalid user deploy 103.18.229.242 port 43060 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.29
country_id: 1733045
description:
2026-01-07 18:15:56 dovecot_login authenticator failed for H=([49.124.151.29]) [49.124.151.29]:41160: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.0.38.130
country_id: 1210997
description:
2026-01-07 18:15:59 dovecot_login authenticator failed for H=([49.0.38.130]) [49.0.38.130]:44204: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.10.56.170
country_id: 732800
description:
2026-01-07 18:16:10 dovecot_login authenticator failed for H=46-10-56-170.ip.btc-net.bg [46.10.56.170]:42559: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.214.49.11
country_id: 3144096
description:
2026-01-07 18:16:26 dovecot_login authenticator failed for H=(cm-84.214.49.11.get.no) [84.214.49.11]:44517: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.224.19
country_id: 1880251
description:
Jan  7 18:19:21 host2 sshd[3372566]: Disconnected from invalid user frappe 45.78.224.19 port 37854 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  7 18:22:06 host2 sshd[3375020]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2026-01-07 18:24:03 dovecot_login authenticator failed for H=([196.216.81.126]) [196.216.81.126]:54124: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.131.211.168
country_id: 690791
description:
2026-01-07 18:23:45 dovecot_login authenticator failed for H=([94.131.211.168]) [94.131.211.168]:52214: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.246.106
country_id: 1269750
description:
2026-01-07 18:24:22 dovecot_login authenticator failed for H=([27.123.119.254]) [128.185.246.106]:38446: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.232.3
country_id: 2542007
description:
2026-01-07 18:24:37 dovecot_login authenticator failed for H=(ADMIN) [95.181.232.3]:65506: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.106.196.150
country_id: 1880251
description:
2026-01-07 18:24:44 dovecot_login authenticator failed for H=(bb128-106-196-150.singnet.com.sg) [128.106.196.150]:7672: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.64.96.40
country_id: 6252001
description:
Jan  7 18:24:52 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.64.96.40, lip=66.85.158.92, TLS handshaking: Connection closed, session=<oNBczMtHboYUQGAo>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.70.102.114
country_id: 2233387
description:
Jan  7 18:27:33 host2 sshd[3379905]: Disconnected from invalid user deploy 154.70.102.114 port 48914 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.113.105.228
country_id: 1269750
description:
Jan  7 18:29:19 host2 sshd[3381509]: Disconnected from invalid user admin 103.113.105.228 port 41719 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.64.105.81
country_id: 6252001
description:
Jan  7 18:29:27 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.64.105.81, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<+jHB3MtHdOQUQGlR>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.162.242
country_id: 2186224
description:
2026-01-07 18:32:05 dovecot_login authenticator failed for H=([121.73.162.242]) [121.73.162.242]:60902: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.208.38
country_id: 1036973
description:
2026-01-07 18:31:37 dovecot_login authenticator failed for H=([197.219.208.38]) [197.219.208.38]:46026: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.113.105.228
country_id: 1269750
description:
Jan  7 18:37:35 host2 sshd[3388571]: Disconnected from invalid user user 103.113.105.228 port 54589 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.123.45.2
country_id: 1269750
description:
2026-01-07 18:39:55 dovecot_login authenticator failed for H=([103.123.45.2]) [103.123.45.2]:34148: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.113.105.228
country_id: 1269750
description:
Jan  7 18:40:56 host2 sshd[3391892]: Disconnected from invalid user admin 103.113.105.228 port 39793 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.201.79
country_id: 1733045
description:
2026-01-07 18:48:00 dovecot_login authenticator failed for H=([49.125.201.79]) [49.125.201.79]:55874: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.215.245.175
country_id: 3469034
description:
2026-01-07 18:48:17 dovecot_login authenticator failed for H=([189.59.210.1]) [186.215.245.175]:50686: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.90.126.50
country_id: 3703430
description:
2026-01-07 18:48:22 dovecot_login authenticator failed for H=(ADMIN) [91.90.126.50]:24912: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  7 18:49:23 host2 sshd[3399475]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  7 18:54:03 host2 sshd[3404110]: Disconnected from invalid user admin 2.57.121.112 port 54440 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.193.128.104
country_id: 1269750
description:
2026-01-07 18:58:05 dovecot_login authenticator failed for H=(nsg-corporate-6.249.186.122.airtel.in) [116.193.128.104]:35520: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.128.18
country_id: 3144096
description:
2026-01-07 18:58:28 dovecot_login authenticator failed for H=(cm-178.232.128.18.get.no) [178.232.128.18]:58812: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  7 19:01:01 host2 sshd[3410649]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.211.77.184
country_id: 1269750
description:
2026-01-07 19:01:10 dovecot_login authenticator failed for H=(static.ftth.bgn.117.211.77.184.bsnl.in) [117.211.77.184]:44298: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.160.139.163
country_id: 2510769
description:
2026-01-07 19:01:20 dovecot_login authenticator failed for H=(163.pool90-160-139.dynamic.orange.es) [90.160.139.163]:60053: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.237.107
country_id: 3144096
description:
2026-01-07 19:01:33 dovecot_login authenticator failed for H=(cm-178.232.237.107.get.no) [178.232.237.107]:50485: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  7 19:03:20 host2 sshd[3412509]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.204.74
country_id: 1269750
description:
2026-01-07 19:07:18 dovecot_login authenticator failed for H=(dsl-ncr-dynamic-097.37.23.125.airtelbroadband.in) [125.23.204.74]:40410: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.111.152.79
country_id: 798544
description:
2026-01-07 19:07:33 dovecot_login authenticator failed for H=([176.111.152.79]) [176.111.152.79]:56382: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.185.24.228
country_id: 6252001
description:
Jan  7 19:09:52 host2 sshd[3417114]: Disconnected from invalid user user1 172.185.24.228 port 33202 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.153.146
country_id: 99237
description:
2026-01-07 19:10:49 dovecot_login authenticator failed for H=([65.20.153.146]) [65.20.153.146]:33885: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.185.24.228
country_id: 6252001
description:
Jan  7 19:10:51 host2 sshd[3418278]: Disconnected from invalid user admin 172.185.24.228 port 46276 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.185.24.228
country_id: 6252001
description:
Jan  7 19:12:46 host2 sshd[3419831]: Disconnected from invalid user user 172.185.24.228 port 56798 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.239.247.136
country_id: 1562822
description:
2026-01-07 19:14:49 dovecot_login authenticator failed for H=(ADMIN) [173.239.247.136]:7565: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.76.126
country_id: 1149361
description:
2026-01-07 19:17:28 dovecot_login authenticator failed for H=([180.94.76.126]) [180.94.76.126]:45353: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.247.47.169
country_id: 3175395
description:
2026-01-07 19:19:22 dovecot_login authenticator failed for H=host-95-247-47-169.retail.telecomitalia.it [95.247.47.169]:38204: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.231.114
country_id: 1269750
description:
2026-01-07 19:19:48 dovecot_login authenticator failed for H=([128.185.231.114]) [128.185.231.114]:35470: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  7 19:23:25 host2 sshd[3430165]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 148.170.156.248
country_id: 6251999
description:
2026-01-07 19:27:03 dovecot_login authenticator failed for H=host-148-170-156-248.public.eastlink.ca [148.170.156.248]:50860: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.245.172.214
country_id: 1269750
description:
2026-01-07 19:27:24 dovecot_login authenticator failed for H=([115.245.172.214]) [115.245.172.214]:60450: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.129.232.99
country_id: 6252001
description:
2026-01-07 19:32:11 dovecot_login authenticator failed for H=(ADMIN) [102.129.232.99]:33642: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.210.222.23
country_id: 3144096
description:
2026-01-07 19:40:51 dovecot_login authenticator failed for H=([84.210.222.23]) [84.210.222.23]:39750: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.221.130
country_id: 1269750
description:
2026-01-07 19:42:42 dovecot_login authenticator failed for H=(nsg-corporate-130.221.187.122.airtel.in) [122.187.221.130]:54980: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.149.165.107
country_id: 6252001
description:
2026-01-07 19:42:58 dovecot_login authenticator failed for H=c-76-149-165-107.hsd1.ut.comcast.net [76.149.165.107]:46828: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.72
country_id: 2186224
description:
2026-01-07 19:44:01 dovecot_login authenticator failed for H=([121.73.163.72]) [121.73.163.72]:37832: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.191.74.151
country_id: 6252001
description:
2026-01-07 19:45:04 dovecot_login authenticator failed for H=([172.191.74.151]) [172.191.74.151]:54852: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.111.146
country_id: 6252001
description:
2026-01-07 19:44:44 dovecot_login authenticator failed for H=syn-035-130-111-146.biz.spectrum.com [35.130.111.146]:39487: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.74.122
country_id: 1149361
description:
2026-01-07 19:44:51 dovecot_login authenticator failed for H=([180.94.74.122]) [180.94.74.122]:42843: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.53.110.11
country_id: 2661886
description:
2026-01-07 19:45:27 dovecot_login authenticator failed for H=h77-53-110-11.cust.bredband2.com [77.53.110.11]:59078: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.170.251.33
country_id: 2017370
description:
2026-01-07 19:45:39 dovecot_login authenticator failed for H=([178.170.251.33]) [178.170.251.33]:59462: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.216.29.89
country_id: 798544
description:
Jan  7 19:49:01 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=178.216.29.89, lip=66.85.158.91, TLS, session=<w+tU+MxHs8iy2B1Z>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.191.74.151
country_id: 6252001
description:
2026-01-07 19:48:35 dovecot_login authenticator failed for H=([172.191.74.151]) [172.191.74.151]:47974: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.216.215.145
country_id: 933860
description:
Jan  7 19:48:43 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=41.216.215.145, lip=66.85.158.91, TLS, session=<hSYK98xHMZgp2NeR>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.251.251.171
country_id: 1861060
description:
Jan  7 19:50:15 host2 sshd[3455916]: Disconnected from invalid user user 160.251.251.171 port 60920 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.61.240.158
country_id: 2186224
description:
2026-01-07 19:53:54 dovecot_login authenticator failed for H=(ADMIN) [179.61.240.158]:59791: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.129
country_id: 6252001
description:
Jan  7 19:57:09 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 12 secs): user=<>, rip=162.216.149.129, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<f5FcFs1HQt2i2JWB>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.129
country_id: 6252001
description:
Jan  7 19:58:10 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 7 secs): user=<>, rip=162.216.149.129, lip=66.85.158.92, TLS: read(size=403) failed: Connection reset by peer, session=<bnoIGs1HjPii2JWB>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.161.93.53
country_id: 1269750
description:
2026-01-07 20:04:00 dovecot_login authenticator failed for H=([103.161.93.53]) [103.161.93.53]:61281: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.168.35.240
country_id: 2077456
description:
2026-01-07 20:03:59 dovecot_login authenticator failed for H=([101.168.35.240]) [101.168.35.240]:35102: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.102
country_id: 1269750
description:
2026-01-07 20:04:15 dovecot_login authenticator failed for H=(nsg-corporate-9.90.186.122.airtel.in) [182.95.228.102]:34198: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.185.37.239
country_id: 1269750
description:
2026-01-07 20:04:27 dovecot_login authenticator failed for H=(abts-tn-dynamic-239.37.185.136.airtelbroadband.in) [136.185.37.239]:51344: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.50.5.94
country_id: 1269750
description:
2026-01-07 20:04:52 dovecot_login authenticator failed for H=([103.50.5.94]) [103.50.5.94]:40228: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-07 20:04:57 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:60797: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.129
country_id: 6252001
description:
Jan  7 20:04:56 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.149.129, lip=66.85.158.92, TLS, session=<Rms3Ms1Hkuui2JWB>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.237.191
country_id: 99237
description:
2026-01-07 20:05:23 dovecot_login authenticator failed for H=([65.20.237.191]) [65.20.237.191]:45457: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.129.234.141
country_id: 6252001
description:
2026-01-07 20:12:00 dovecot_login authenticator failed for H=(ADMIN) [102.129.234.141]:57316: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.144
country_id: 1269750
description:
2026-01-07 20:13:06 dovecot_login authenticator failed for H=(nsg-corporate-144.227.187.122.airtel.in) [122.187.227.144]:36676: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.17
country_id: 798549
description:
Jan  7 20:18:58 host2 dovecot[1170291]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=85.217.149.17, lip=66.85.158.92, session=<V2FqZM1HKshV2ZUR>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2026-01-07 20:21:24 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:59898: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  7 20:22:49 host2 sshd[3488328]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.36.115.152
country_id: 1269750
description:
2026-01-07 20:22:18 dovecot_login authenticator failed for H=([103.68.19.170]) [49.36.115.152]:37584: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.1.66.154
country_id: 1694008
description:
2026-01-07 20:22:31 dovecot_login authenticator failed for H=(122.55.57.177.pldt.net) [210.1.66.154]:56029: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.244.232.163
country_id: 298795
description:
2026-01-07 20:24:51 dovecot_login authenticator failed for H=([178.244.232.163]) [178.244.232.163]:55966: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.220.97.188
country_id: 6252001
description:
2026-01-07 20:25:05 dovecot_login authenticator failed for H=c-98-220-97-188.hsd1.il.comcast.net [98.220.97.188]:44418: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.114
country_id: 1149361
description:
2026-01-07 20:26:09 dovecot_login authenticator failed for H=([149.54.62.114]) [149.54.62.114]:43431: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.133.172.219
country_id: 2635167
description:
2026-01-07 20:30:49 dovecot_login authenticator failed for H=(ADMIN) [45.133.172.219]:6460: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.146.238.122
country_id: 2542007
description:
2026-01-07 20:36:16 dovecot_login authenticator failed for H=([154.146.238.122]) [154.146.238.122]:52748: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.230.32.160
country_id: 1880251
description:
Jan  7 20:36:39 host2 sshd[3502360]: Disconnected from invalid user admin 157.230.32.160 port 48308 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.230.134
country_id: 1269750
description:
2026-01-07 20:36:58 dovecot_login authenticator failed for H=([182.95.215.73]) [182.95.230.134]:56374: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 154.213.163.14
country_id: 2921044
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 154.213.163.14 - simpleengineerin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: User simpleengineerin has their account suspended. Login blocked.


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.142.154.29
country_id: 1819730
description:
Jan  7 20:38:29 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=45.142.154.29, lip=66.85.158.91, TLS, session=<KA4zqs1HxNYtjpod>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 199.195.254.215
country_id: 6252001
description:
Jan  7 20:38:42 host2 sshd[3504374]: Disconnected from invalid user deploy 199.195.254.215 port 51816 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 157.230.32.160
country_id: 1880251
description:
Jan  7 20:41:50 host2 sshd[3507893]: Disconnected from invalid user ubuntu 157.230.32.160 port 41054 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 199.195.254.215
country_id: 6252001
description:
Jan  7 20:43:42 host2 sshd[3510170]: Disconnected from invalid user deploy 199.195.254.215 port 48642 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 199.195.254.215
country_id: 6252001
description:
Jan  7 20:44:23 host2 sshd[3510966]: Disconnected from invalid user deploy 199.195.254.215 port 60288 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.230.32.160
country_id: 1880251
description:
Jan  7 20:44:55 host2 sshd[3511468]: Disconnected from invalid user deploy 157.230.32.160 port 58312 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.86.54
country_id: 1269750
description:
2026-01-07 20:45:25 dovecot_login authenticator failed for H=([182.79.86.54]) [182.79.86.54]:44968: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.248.120.6
country_id: 1269750
description:
Jan  7 20:46:48 host2 sshd[3513882]: Disconnected from invalid user ubuntu 103.248.120.6 port 42832 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.230.32.160
country_id: 1880251
description:
Jan  7 20:46:59 host2 sshd[3514095]: Disconnected from invalid user deploy 157.230.32.160 port 59540 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  7 20:48:47 host2 sshd[3515921]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.90.126.112
country_id: 3703430
description:
2026-01-07 20:49:40 dovecot_login authenticator failed for H=(ADMIN) [91.90.126.112]:50966: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.3
country_id: 798549
description:
Jan  7 20:50:33 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=85.217.149.3, lip=66.85.158.92, session=<p05R1c1HjtVV2ZUD>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.172.15.103
country_id: 3469034
description:
2026-01-07 20:54:13 dovecot_login authenticator failed for H=(177-172-15-62.user.vivozap.com.br) [177.172.15.103]:12643: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.143.88
country_id: 1819730
description:
2026-01-07 20:54:37 dovecot_login authenticator failed for H=(m121-202-143-88.smartone.com) [121.202.143.88]:35199: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.202.54
country_id: 1269750
description:
2026-01-07 20:57:29 dovecot_login authenticator failed for H=(nsg-corporate-54.202.186.122.airtel.in) [122.186.202.54]:43130: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 134.56.58.179
country_id: 6252001
description:
2026-01-07 20:57:39 dovecot_login authenticator failed for H=(134.56.58.179.hwccustomers.com) [134.56.58.179]:34427: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.12.179
country_id: 1269750
description:
2026-01-07 21:07:13 dovecot_login authenticator failed for H=([128.185.12.179]) [128.185.12.179]:57518: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.36.115.152
country_id: 1269750
description:
2026-01-07 21:07:22 dovecot_login authenticator failed for H=([103.68.19.170]) [49.36.115.152]:40013: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.214.78
country_id: 1269750
description:
2026-01-07 21:08:54 dovecot_login authenticator failed for H=([128.185.214.78]) [128.185.214.78]:38634: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.52.194
country_id: 1269750
description:
2026-01-07 21:09:24 dovecot_login authenticator failed for H=([182.95.52.194]) [182.95.52.194]:54882: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.132.164.25
country_id: 2635167
description:
2026-01-07 21:13:06 dovecot_login authenticator failed for H=(ADMIN) [23.132.164.25]:49998: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.241.102
country_id: 1269750
description:
2026-01-07 21:14:57 dovecot_login authenticator failed for H=([125.19.175.152]) [182.78.241.102]:37150: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.246.178
country_id: 1269750
description:
2026-01-07 21:15:21 dovecot_login authenticator failed for H=([182.79.95.139]) [152.52.246.178]:47046: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.133.47.12
country_id: 1522867
description:
2026-01-07 21:16:59 dovecot_login authenticator failed for H=(ADMIN) [62.133.47.12]:20665: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.240.36.101
country_id: 3469034
description:
Jan  7 21:18:02 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=191.240.36.101, lip=66.85.158.91, TLS, session=<e9N9Ns5HBq6/8CRl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.216.30.6
country_id: 798544
description:
Jan  7 21:17:40 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=178.216.30.6, lip=66.85.158.91, TLS, session=<f3dYNc5H6dCy2B4G>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  7 21:19:13 host2 sshd[3533815]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  7 21:21:32 host2 sshd[3535252]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.128.150.67
country_id: 6252001
description:
2026-01-07 21:21:14 dovecot_login authenticator failed for H=c-73-128-150-67.hsd1.de.comcast.net [73.128.150.67]:46058: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.2
country_id: 1269750
description:
2026-01-07 21:21:46 dovecot_login authenticator failed for H=([125.19.173.202]) [152.52.236.2]:43698: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 213.177.179.5
country_id: 1668284
description:
Jan  7 21:27:14 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=213.177.179.5, lip=66.85.158.91, session=<PFuHWM5HmabVsbMF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.192.211.156
country_id: 1269750
description:
2026-01-07 21:32:42 dovecot_login authenticator failed for H=(dhcp-192-211-156.in2cable.com) [203.192.211.156]:50044: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.186.39.208
country_id: 798544
description:
Jan  7 21:36:06 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=193.186.39.208, lip=66.85.158.91, TLS, session=<V681d85HIajBuifQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.221.136.1
country_id: 690791
description:
Jan  7 21:36:25 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=37.221.136.1, lip=66.85.158.91, TLS, session=<cptQeM5HgJAl3YgB>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 212.103.61.15
country_id: 2782113
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 212.103.61.15 - topviewl "GET /execute/Email/list_pops?api.version=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.252.76
country_id: 3865483
description:
Jan  7 21:38:49 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 24 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=179.0.252.76, lip=66.85.158.91, TLS, session=<PDSIgM5HssezAPxM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.97.22
country_id: 3469034
description:
Jan  7 21:39:11 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=177.44.97.22, lip=66.85.158.91, TLS, session=<3osWgs5HONOxLGEW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 128.127.94.174
country_id: 798544
description:
Jan  7 21:41:52 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=128.127.94.174, lip=66.85.158.91, TLS, session=<7A7Wi85HE82Af16u>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.90.126.151
country_id: 3703430
description:
Jan  7 21:42:18 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.90.126.151, lip=66.85.158.91, session=<zYBojs5HIJRbWn6X>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 95.181.238.189
country_id: 6252001
description:
Jan  7 21:42:18 host2 dovecot[1170291]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=95.181.238.189, lip=66.85.158.91, session=<S5dljs5Hjudfte69>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 79.127.175.116
country_id: 390903
description:
Jan  7 21:42:18 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=79.127.175.116, lip=66.85.158.91, TLS, session=<is9rjs5HKrtPf690>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.71.42
country_id: 3469034
description:
Jan  7 21:42:23 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=177.44.71.42, lip=66.85.158.91, TLS, session=<MfKbjc5HsaexLEcq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.244.49.93
country_id: 1668284
description:
2026-01-07 21:43:33 dovecot_login authenticator failed for H=(ADMIN) [173.244.49.93]:19909: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.241.132.152
country_id: 1269750
description:
2026-01-07 21:47:55 dovecot_login authenticator failed for H=([115.244.235.242]) [43.241.132.152]:39872: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.66.214.70
country_id: 1269750
description:
2026-01-07 21:49:48 dovecot_login authenticator failed for H=([182.66.80.41]) [182.66.214.70]:46714: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.246.106
country_id: 1269750
description:
2026-01-07 21:50:01 dovecot_login authenticator failed for H=([125.16.255.97]) [125.20.246.106]:52068: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.184.130
country_id: 1269750
description:
2026-01-07 21:56:07 dovecot_login authenticator failed for H=([182.95.184.130]) [182.95.184.130]:55210: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 134.185.86.25
country_id: 1880251
description:
Jan  7 21:56:48 host2 sshd[3579831]: Disconnected from invalid user nccp 134.185.86.25 port 59724 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.159.186
country_id: 1269750
description:
2026-01-07 21:56:53 dovecot_login authenticator failed for H=([125.19.159.186]) [125.19.159.186]:45800: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.155.204.203
country_id: 1880251
description:
2026-01-07 21:59:47 dovecot_login authenticator failed for H=(124.155.204-203.unknown.starhub.net.sg) [124.155.204.203]:39838: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.210.151.158
country_id: 3144096
description:
2026-01-07 21:59:31 dovecot_login authenticator failed for H=([84.210.151.158]) [84.210.151.158]:53437: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.165.78.31
country_id: 1819730
description:
2026-01-07 21:59:30 dovecot_login authenticator failed for H=([69.165.78.31]) [69.165.78.31]:46872: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.72
country_id: 2186224
description:
2026-01-07 21:59:43 dovecot_login authenticator failed for H=([121.73.163.72]) [121.73.163.72]:35162: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.248.72.123
country_id: 192950
description:
Jan  7 22:01:48 host2 sshd[3584640]: Disconnected from invalid user user 197.248.72.123 port 33928 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.71.82
country_id: 1269750
description:
2026-01-07 22:03:23 dovecot_login authenticator failed for H=(nsg-static-82.71.76.182-airtel.com) [182.76.71.82]:51678: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 181.212.81.228
country_id: 3895114
description:
Jan  7 22:07:11 host2 sshd[3590373]: Disconnected from invalid user ubuntu 181.212.81.228 port 57250 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.248.72.123
country_id: 192950
description:
Jan  7 22:07:16 host2 sshd[3590424]: Disconnected from invalid user deploy 197.248.72.123 port 49004 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.129.122.12
country_id: 3923057
description:
Jan  7 22:08:40 host2 sshd[3591681]: Disconnected from invalid user ubuntu 190.129.122.12 port 17416 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.55.249.98
country_id: 6252001
description:
Jan  7 22:08:58 host2 sshd[3591970]: Disconnected from invalid user ubuntu 45.55.249.98 port 41440 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.2.194.25
country_id: 2963597
description:
2026-01-07 22:09:07 dovecot_login authenticator failed for H=(ADMIN) [155.2.194.25]:26454: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.131.224.191
country_id: 1269750
description:
Jan  7 22:09:19 host2 sshd[3592460]: Disconnected from invalid user deploy 34.131.224.191 port 38454 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 93.48.24.181
country_id: 3175395
description:
Jan  7 22:10:03 host2 sshd[3593174]: Disconnected from invalid user ubuntu 93.48.24.181 port 36192 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.248.72.123
country_id: 192950
description:
Jan  7 22:10:08 host2 sshd[3593293]: Disconnected from invalid user deploy 197.248.72.123 port 59478 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.212.81.228
country_id: 3895114
description:
Jan  7 22:11:26 host2 sshd[3594878]: Disconnected from invalid user user 181.212.81.228 port 43264 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 93.48.24.181
country_id: 3175395
description:
Jan  7 22:11:28 host2 sshd[3594906]: Disconnected from invalid user deploy 93.48.24.181 port 38268 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.248.72.123
country_id: 192950
description:
Jan  7 22:12:12 host2 sshd[3595775]: Disconnected from invalid user user 197.248.72.123 port 53120 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 23.91.96.70
country_id: 1819730
description:
Jan  7 22:12:14 host2 sshd[3595841]: Disconnected from invalid user user 23.91.96.70 port 58640 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.131.224.191
country_id: 1269750
description:
Jan  7 22:12:39 host2 sshd[3596289]: Disconnected from invalid user admin 34.131.224.191 port 35464 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.129.122.12
country_id: 3923057
description:
Jan  7 22:13:45 host2 sshd[3597636]: Disconnected from invalid user user 190.129.122.12 port 1111 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  7 22:14:24 host2 sshd[3598578]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 177.130.248.114
country_id: 3469034
description:
Jan  7 22:15:14 host2 sshd[3599679]: Disconnected from invalid user user1 177.130.248.114 port 39264 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.131.224.191
country_id: 1269750
description:
Jan  7 22:15:26 host2 sshd[3599905]: Disconnected from invalid user user 34.131.224.191 port 52888 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.196.253.20
country_id: 2635167
description:
Jan  7 22:15:34 host2 sshd[3600059]: Disconnected from invalid user ubuntu 196.196.253.20 port 44278 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 23.91.96.70
country_id: 1819730
description:
Jan  7 22:16:21 host2 sshd[3600926]: Disconnected from invalid user ubuntu 23.91.96.70 port 47600 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 196.196.253.20
country_id: 2635167
description:
Jan  7 22:17:47 host2 sshd[3602519]: Disconnected from invalid user admin1 196.196.253.20 port 44420 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 137.59.55.50
country_id: 1269750
description:
Jan  7 22:17:49 host2 sshd[3602568]: Disconnected from invalid user deploy 137.59.55.50 port 51213 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 23.91.96.70
country_id: 1819730
description:
Jan  7 22:18:43 host2 sshd[3603384]: Disconnected from invalid user admin1 23.91.96.70 port 54206 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.112.222.136
country_id: 3624060
description:
Jan  7 22:20:07 host2 sshd[3604796]: Disconnected from invalid user user 190.112.222.136 port 37624 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 137.59.55.50
country_id: 1269750
description:
Jan  7 22:20:19 host2 sshd[3605004]: Disconnected from invalid user user 137.59.55.50 port 36804 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 137.59.55.50
country_id: 1269750
description:
Jan  7 22:21:00 host2 sshd[3605610]: Disconnected from invalid user admin1 137.59.55.50 port 44554 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.85.43.162
country_id: 3686110
description:
2026-01-07 22:21:01 dovecot_login authenticator failed for H=([190.85.43.162]) [190.85.43.162]:39557: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.7.200.152
country_id: 1861060
description:
2026-01-07 22:21:19 dovecot_login authenticator failed for H=v157-7-200-152.cwit.static.cnode.io [157.7.200.152]:42258: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.152
country_id: 6252001
description:
Jan  7 22:21:16 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 15 secs): user=<>, rip=162.216.149.152, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<24PNGc9H5dCi2JWY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.152
country_id: 6252001
description:
Jan  7 22:22:50 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 7 secs): user=<>, rip=162.216.149.152, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<os5fH89HGuOi2JWY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.152
country_id: 6252001
description:
Jan  7 22:23:22 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 7 secs): user=<>, rip=162.216.149.152, lip=66.85.158.91, TLS: read(size=403) failed: Connection reset by peer, session=<9/JIIc9HcP6i2JWY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.114.126
country_id: 1269750
description:
2026-01-07 22:23:58 dovecot_login authenticator failed for H=([27.123.114.126]) [27.123.114.126]:50682: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.70.19.11
country_id: 3469034
description:
2026-01-07 22:24:23 dovecot_login authenticator failed for H=(45-70-19-11.static.damsolutionsturbo.com.br) [45.70.19.11]:49526: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 34.224.165.84
country_id: 6252001
description:
Jan  7 22:26:09 host2 pure-ftpd[3609889]: (?@34.224.165.84) [INFO] New connection from 34.224.165.84


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.112
country_id: 6252001
description:
Jan  7 22:26:26 host2 pure-ftpd[3610086]: (?@147.185.132.112) [INFO] New connection from 147.185.132.112


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.81.229.179
country_id: 6252001
description:
2026-01-07 22:27:48 dovecot_login authenticator failed for H=([192.81.229.179]) [192.81.229.179]:48708: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.201.212.54
country_id: 99237
description:
2026-01-07 22:27:59 dovecot_login authenticator failed for H=([62.201.212.54]) [62.201.212.54]:45316: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.72
country_id: 6252001
description:
Jan  7 22:27:42 host2 pure-ftpd[3611109]: (?@205.210.31.72) [INFO] New connection from 205.210.31.72


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.52.122
country_id: 1269750
description:
2026-01-07 22:29:38 dovecot_login authenticator failed for H=([128.185.80.65]) [182.95.52.122]:39700: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.72.74.130
country_id: 2017370
description:
2026-01-07 22:29:50 dovecot_login authenticator failed for H=([188.72.74.130]) [188.72.74.130]:52714: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.152
country_id: 6252001
description:
Jan  7 22:29:50 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.149.152, lip=66.85.158.91, TLS, session=<n69nOM9HHu2i2JWY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.152
country_id: 6252001
description:
Jan  7 22:30:38 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.149.152, lip=66.85.158.91, TLS, session=<kLxJO89Hmuii2JWY>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 172.202.50.78
country_id: 6252001
description:
Jan  7 22:31:07 host2 pure-ftpd[3614413]: (?@172.202.50.78) [INFO] New connection from 172.202.50.78


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.142.154.102
country_id: 1819730
description:
Jan  7 22:32:52 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 5 secs): user=<>, rip=45.142.154.102, lip=66.85.158.92, TLS, session=<961CQ89HALwtjppm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.88.97.36
country_id: 2921044
description:
2026-01-07 22:33:43 dovecot_login authenticator failed for H=(ADMIN) [45.88.97.36]:63380: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.236.228.111
country_id: 6252001
description:
Jan  7 22:37:26 host2 dovecot[1170291]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=172.236.228.111, lip=66.85.158.92, session=<FLudU89HgGus7ORv>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.236.228.220
country_id: 6252001
description:
Jan  7 22:37:27 host2 dovecot[1170291]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=172.236.228.220, lip=66.85.158.91, session=<oRGrU89Hqses7OTc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.31.8.12
country_id: 614540
description:
2026-01-07 22:37:30 dovecot_login authenticator failed for H=([194.31.8.12]) [194.31.8.12]:58823: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.11.252.160
country_id: 3469034
description:
2026-01-07 22:37:44 dovecot_login authenticator failed for H=(187-11-252-160.dsl.telesp.net.br) [187.11.252.160]:46802: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 14.139.107.146
country_id: 1269750
description:
Jan  7 22:40:44 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=14.139.107.146, lip=66.85.158.91, session=</jI4X89HrroOi2uS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 122.187.228.228
country_id: 1269750
description:
Jan  7 22:40:53 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=122.187.228.228, lip=66.85.158.91, TLS, session=<fl67Xs9HWdx6u+Tk>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 171.6.100.66
country_id: 1605651
description:
Jan  7 22:41:00 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=171.6.100.66, lip=66.85.158.91, session=<DUsZYM9H+IirBmRC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.34.128.202
country_id: 6252001
description:
Jan  7 22:40:59 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=192.34.128.202, lip=66.85.158.91, session=<zJAqYM9HhJ7AIoDK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.205.197
country_id: 99237
description:
Jan  7 22:41:21 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=65.20.205.197, lip=66.85.158.91, TLS, session=<dKp6YM9HP5FBFM3F>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.103.53.44
country_id: 1269750
description:
Jan  7 22:41:20 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=103.103.53.44, lip=66.85.158.91, TLS, session=<InprYM9HLrVnZzUs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 95.209.141.149
country_id: 2623032
description:
Jan  7 22:41:29 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<hr>, method=PLAIN, rip=95.209.141.149, lip=66.85.158.91, TLS, session=<2SYEYc9HvJhf0Y2V>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.68.22.140
country_id: 1269750
description:
Jan  7 22:41:43 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<hr>, method=PLAIN, rip=103.68.22.140, lip=66.85.158.91, session=<vr+uYs9HjqdnRBaM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.57.69.227
country_id: 690791
description:
Jan  7 22:41:40 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr>, method=PLAIN, rip=37.57.69.227, lip=66.85.158.91, session=<AuCcYs9H3MwlOUXj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.129.28
country_id: 99237
description:
Jan  7 22:42:01 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr>, method=PLAIN, rip=65.20.129.28, lip=66.85.158.91, session=<ZSfPY89HHJNBFIEc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 122.166.253.226
country_id: 1269750
description:
Jan  7 22:42:08 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<hr>, method=PLAIN, rip=122.166.253.226, lip=66.85.158.91, session=<P9YqZM9HEaV6pv3i>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 95.209.141.145
country_id: 2623032
description:
Jan  7 22:42:20 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr>, method=PLAIN, rip=95.209.141.145, lip=66.85.158.91, session=<PDz1ZM9HKOdf0Y2R>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 36.93.154.207
country_id: 1643084
description:
Jan  7 22:42:20 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<hr>, method=PLAIN, rip=36.93.154.207, lip=66.85.158.91, TLS, session=<MwoUZM9HDowkXZrP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.53.15.17
country_id: 2542007
description:
Jan  7 22:42:38 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<hr>, method=PLAIN, rip=102.53.15.17, lip=66.85.158.91, TLS, session=<Zgg0Zc9HZZRmNQ8R>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 20.64.105.237
country_id: 6252001
description:
Jan  7 22:44:06 host2 pure-ftpd[3626505]: (?@20.64.105.237) [INFO] New connection from 20.64.105.237


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 152.32.189.128
country_id: 1819730
description:
Jan  7 22:43:36 host2 pure-ftpd[3626066]: (?@152.32.189.128) [INFO] New connection from 152.32.189.128


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.129.13.184
country_id: 1880251
description:
2026-01-07 22:51:06 dovecot_login authenticator failed for H=(184.13.129.180.unknown.m1.com.sg) [180.129.13.184]:51389: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.162.163
country_id: 298795
description:
2026-01-07 22:50:25 dovecot_login authenticator failed for H=([5.11.162.163]) [5.11.162.163]:47029: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.73.190.46
country_id: 2542007
description:
2026-01-07 22:50:31 dovecot_login authenticator failed for H=([105.73.190.46]) [105.73.190.46]:58334: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.37.181.181
country_id: 1831722
description:
2026-01-07 22:50:47 dovecot_login authenticator failed for H=([36.37.181.181]) [36.37.181.181]:54334: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.198.129.123
country_id: 1819730
description:
2026-01-07 23:02:05 dovecot_login authenticator failed for H=123.129.198.203.static.netvigator.com [203.198.129.123]:59573: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.33.109.8
country_id: 6252001
description:
Jan  7 23:01:20 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=45.33.109.8, lip=66.85.158.91, session=<ghIRqc9HQeUtIW0I>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.246.122.37
country_id: 3144096
description:
2026-01-07 23:01:42 dovecot_login authenticator failed for H=(ADMIN) [46.246.122.37]:62248: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.115.237.19
country_id: 3923057
description:
2026-01-07 23:02:41 dovecot_login authenticator failed for H=([181.115.237.19]) [181.115.237.19]:49895: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.250.160.76
country_id: 1269750
description:
2026-01-07 23:03:03 dovecot_login authenticator failed for H=([103.250.160.76]) [103.250.160.76]:50450: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 13.68.214.34
country_id: 6252001
description:
2026-01-07 23:02:19 dovecot_login authenticator failed for H=([13.68.214.34]) [13.68.214.34]:59414: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.2
country_id: 1269750
description:
2026-01-07 23:03:26 dovecot_login authenticator failed for H=([125.19.173.202]) [152.52.236.2]:52530: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.210.94.61
country_id: 294640
description:
2026-01-07 23:06:37 dovecot_login authenticator failed for H=([46.210.94.61]) [46.210.94.61]:34416: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.54.70.40
country_id: 3686110
description:
2026-01-07 23:08:09 dovecot_login authenticator failed for H=(static-ip-1815407040.cable.net.co) [181.54.70.40]:53788: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.184.130
country_id: 1269750
description:
2026-01-07 23:07:15 dovecot_login authenticator failed for H=(nsg-corporate-41.139.185.122.airtel.in) [182.95.184.130]:51398: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.52.206
country_id: 1269750
description:
2026-01-07 23:07:50 dovecot_login authenticator failed for H=([182.95.52.206]) [182.95.52.206]:56850: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.106
country_id: 2635167
description:
Jan  7 23:07:50 host2 dovecot[1170291]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=185.247.137.106, lip=66.85.158.91, TLS, session=<jsZRwM9Hh8W594lq>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  7 23:10:29 host2 sshd[3657801]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.84.155.190
country_id: 6252001
description:
2026-01-07 23:18:02 dovecot_login authenticator failed for H=(pool-162-84-155-190.nycmny.fios.verizon.net) [162.84.155.190]:45990: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  7 23:18:51 host2 sshd[3666129]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.123
country_id: 2186224
description:
2026-01-07 23:18:35 dovecot_login authenticator failed for H=([121.73.163.123]) [121.73.163.123]:57456: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.221.224.110
country_id: 2077456
description:
2026-01-07 23:18:54 dovecot_login authenticator failed for H=(203-221-224-110.tpgi.com.au) [203.221.224.110]:46149: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.16.194.197
country_id: 3865483
description:
Jan  7 23:21:32 host2 sshd[3668882]: Disconnected from invalid user admin 190.16.194.197 port 45262 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.112.79.121
country_id: 1643084
description:
Jan  7 23:21:23 host2 sshd[3668682]: Disconnected from invalid user admin 27.112.79.121 port 50278 [preauth]


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.210
country_id: 2635167
description:
Jan  7 23:22:47 host2 dovecot[1170291]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=87.236.176.210, lip=66.85.158.91, TLS, session=<JR6/9c9HgbFX7LDS>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.102
country_id: 2635167
description:
Jan  7 23:22:48 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=185.247.137.102, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<lTzQ9c9HZ9S594lm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.126
country_id: 6252001
description:
Jan  7 23:23:40 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 15 secs): user=<>, rip=66.132.153.126, lip=66.85.158.91, TLS handshaking: Connection closed, session=<1mXv+M9HEuZChJl+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.233.21
country_id: 2993457
description:
2026-01-07 23:23:47 dovecot_login authenticator failed for H=(ADMIN) [95.181.233.21]:60210: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.75
country_id: 2635167
description:
Jan  7 23:23:54 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=185.247.137.75, lip=66.85.158.91, TLS handshaking: Connection closed, session=<ufrG+c9HKZe594lL>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.100
country_id: 2635167
description:
Jan  7 23:23:21 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.100, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=</7XL989HYbVX7LBk>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.93
country_id: 2635167
description:
Jan  7 23:25:04 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=612) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.93, lip=66.85.158.91, TLS handshaking: read(size=612) failed: Connection reset by peer, session=<5hHy/c9HvYNX7LBd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.166.54.40
country_id: 453733
description:
2026-01-07 23:24:15 dovecot_login authenticator failed for H=40-54-166-83.dyn.estpak.ee [83.166.54.40]:55284: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.81
country_id: 2635167
description:
Jan  7 23:24:27 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=693) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.81, lip=66.85.158.91, TLS handshaking: read(size=693) failed: Connection reset by peer, session=<z2fC+89HC71X7LBR>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.213.63.12
country_id: 6252001
description:
Jan  7 23:24:34 host2 sshd[3671908]: Disconnected from invalid user deploy 38.213.63.12 port 40356 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.83
country_id: 2635167
description:
Jan  7 23:25:37 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=87.236.176.83, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<QI/r/89HS+BX7LBT>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.16.194.197
country_id: 3865483
description:
Jan  7 23:25:49 host2 sshd[3673291]: Disconnected from invalid user admin 190.16.194.197 port 35012 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.74
country_id: 2635167
description:
Jan  7 23:26:11 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=185.247.137.74, lip=66.85.158.91, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<fWPuAdBH/6S594lK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.99
country_id: 2635167
description:
Jan  7 23:26:45 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=87.236.176.99, lip=66.85.158.91, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<P8/6A9BHW4RX7LBj>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.101
country_id: 2635167
description:
Jan  7 23:27:17 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=185.247.137.101, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<q0zjBdBHH8e594ll>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 38.213.63.12
country_id: 6252001
description:
Jan  7 23:27:42 host2 sshd[3674960]: Disconnected from invalid user admin 38.213.63.12 port 42246 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.98
country_id: 2635167
description:
Jan  7 23:27:51 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=185.247.137.98, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<w4XeB9BHa5u594li>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.112.79.121
country_id: 1643084
description:
Jan  7 23:28:11 host2 sshd[3675445]: Disconnected from invalid user ubuntu 27.112.79.121 port 48026 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.213.63.12
country_id: 6252001
description:
Jan  7 23:29:18 host2 sshd[3676673]: Disconnected from invalid user deploy 38.213.63.12 port 47730 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 27.112.79.121
country_id: 1643084
description:
Jan  7 23:30:06 host2 sshd[3677459]: Disconnected from invalid user admin1 27.112.79.121 port 50292 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.196.10.62
country_id: 2635167
description:
Jan  7 23:30:09 host2 sshd[3677607]: Disconnected from invalid user user1 185.196.10.62 port 52640 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.16.194.197
country_id: 3865483
description:
Jan  7 23:30:40 host2 sshd[3678258]: Disconnected from invalid user admin 190.16.194.197 port 33428 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.202.54
country_id: 1269750
description:
2026-01-07 23:31:36 dovecot_login authenticator failed for H=(nsg-corporate-54.202.186.122.airtel.in) [122.186.202.54]:52020: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.33.112
country_id: 3144096
description:
2026-01-07 23:32:03 dovecot_login authenticator failed for H=([178.232.33.112]) [178.232.33.112]:47491: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  7 23:37:51 host2 sshd[3685465]: Disconnected from invalid user admin 2.57.121.112 port 27145 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.196.10.62
country_id: 2635167
description:
Jan  7 23:39:21 host2 sshd[3687093]: Disconnected from invalid user deploy 185.196.10.62 port 41116 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 123.58.213.127
country_id: 1819730
description:
Jan  7 23:41:44 host2 sshd[3689735]: Disconnected from invalid user user1 123.58.213.127 port 56078 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 144.126.217.19
country_id: 6252001
description:
Jan  7 23:41:15 host2 sshd[3689305]: Disconnected from invalid user ubuntu 144.126.217.19 port 48812 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.88.10.10
country_id: 2328926
description:
2026-01-07 23:42:55 dovecot_login authenticator failed for H=([102.88.10.10]) [102.88.10.10]:51796: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 123.58.213.127
country_id: 1819730
description:
Jan  7 23:44:46 host2 sshd[3693140]: Disconnected from invalid user deploy 123.58.213.127 port 50332 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.236.119.165
country_id: 6252001
description:
Jan  7 23:44:14 host2 dovecot[1170291]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=172.236.119.165, lip=66.85.158.92, session=<AWV5QtBHcras7Hel>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 144.126.217.19
country_id: 6252001
description:
Jan  7 23:44:28 host2 sshd[3692554]: Disconnected from invalid user user 144.126.217.19 port 46176 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.26.79
country_id: 1269750
description:
Jan  7 23:45:15 host2 sshd[3693731]: Disconnected from invalid user user 139.59.26.79 port 45926 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 144.126.217.19
country_id: 6252001
description:
Jan  7 23:46:07 host2 sshd[3694505]: Disconnected from invalid user user 144.126.217.19 port 54072 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 139.59.26.79
country_id: 1269750
description:
Jan  7 23:46:26 host2 sshd[3694792]: Disconnected from invalid user test 139.59.26.79 port 40442 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.16.96.250
country_id: 3469034
description:
Jan  7 23:47:37 host2 sshd[3695911]: Disconnected from invalid user user 187.16.96.250 port 45564 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2026-01-07 23:48:34 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:59341: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.16.96.250
country_id: 3469034
description:
Jan  7 23:51:18 host2 sshd[3700779]: Disconnected from invalid user ubuntu 187.16.96.250 port 53388 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.239.42.56
country_id: 690791
description:
2026-01-07 23:51:25 dovecot_login authenticator failed for H=(ADMIN) [84.239.42.56]:1518: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 187.16.96.250
country_id: 3469034
description:
Jan  7 23:52:35 host2 sshd[3702002]: Disconnected from invalid user ubuntu 187.16.96.250 port 46812 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.16.96.250
country_id: 3469034
description:
Jan  7 23:53:47 host2 sshd[3703150]: Disconnected from invalid user ubuntu 187.16.96.250 port 51820 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.178.26.161
country_id: 3996063
description:
Jan  7 23:54:48 host2 sshd[3704516]: Disconnected from invalid user admin1 189.178.26.161 port 38118 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.16.96.250
country_id: 3469034
description:
Jan  7 23:56:07 host2 sshd[3706062]: Disconnected from invalid user ubuntu 187.16.96.250 port 59910 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 134.185.82.192
country_id: 1880251
description:
Jan  7 23:56:07 host2 sshd[3706073]: Disconnected from invalid user gov 134.185.82.192 port 41262 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.120
country_id: 6252001
description:
Jan  7 23:56:12 host2 pure-ftpd[3706198]: (?@66.132.153.120) [INFO] New connection from 66.132.153.120


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.178.26.161
country_id: 3996063
description:
Jan  7 23:56:48 host2 sshd[3706745]: Disconnected from invalid user root1 189.178.26.161 port 38330 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 134.185.82.192
country_id: 1880251
description:
Jan  7 23:56:52 host2 sshd[3706797]: Disconnected from invalid user gov 134.185.82.192 port 51566 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  7 23:57:37 host2 sshd[3707523]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 134.185.82.192
country_id: 1880251
description:
Jan  7 23:57:22 host2 sshd[3707346]: Disconnected from invalid user gov 134.185.82.192 port 57790 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.178.26.161
country_id: 3996063
description:
Jan  7 23:57:31 host2 sshd[3707472]: Disconnected from invalid user deploy 189.178.26.161 port 51434 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.178.26.161
country_id: 3996063
description:
Jan  7 23:58:48 host2 sshd[3708691]: Disconnected from invalid user ubuntu 189.178.26.161 port 50858 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 189.178.26.161
country_id: 3996063
description:
Jan  8 00:00:37 host2 sshd[3710854]: Disconnected from invalid user test 189.178.26.161 port 34996 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.178.26.161
country_id: 3996063
description:
Jan  8 00:01:44 host2 sshd[3711948]: Disconnected from invalid user deploy 189.178.26.161 port 33128 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.81.208.35
country_id: 6252001
description:
Jan  8 00:02:00 host2 sshd[3712157]: Disconnected from invalid user ubuntu 192.81.208.35 port 60860 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  8 00:02:58 host2 sshd[3713047]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 36.93.249.106
country_id: 1643084
description:
Jan  8 00:02:58 host2 sshd[3713038]: Disconnected from invalid user test 36.93.249.106 port 52838 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.81.208.35
country_id: 6252001
description:
Jan  8 00:03:22 host2 sshd[3713557]: Disconnected from invalid user ubuntu 192.81.208.35 port 42704 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.93.249.106
country_id: 1643084
description:
Jan  8 00:03:35 host2 sshd[3713732]: Disconnected from invalid user ubuntu 36.93.249.106 port 50944 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.93.249.106
country_id: 1643084
description:
Jan  8 00:04:14 host2 sshd[3714363]: Disconnected from invalid user test 36.93.249.106 port 40816 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 192.81.208.35
country_id: 6252001
description:
Jan  8 00:04:18 host2 sshd[3714443]: Disconnected from invalid user ubuntu 192.81.208.35 port 43978 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.178.26.161
country_id: 3996063
description:
Jan  8 00:04:12 host2 sshd[3714345]: Disconnected from invalid user ubuntu 189.178.26.161 port 59464 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.79.115.134
country_id: 6252001
description:
Jan  8 00:08:43 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=45.79.115.134, lip=66.85.158.91, session=<kh8QmtBHP6ktT3OG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.56.54.44
country_id: 6252001
description:
2026-01-08 00:08:49 dovecot_login authenticator failed for H=(ADMIN) [212.56.54.44]:19314: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.121.43
country_id: 3144096
description:
2026-01-08 00:10:39 dovecot_login authenticator failed for H=([178.232.121.43]) [178.232.121.43]:46855: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.12.179
country_id: 1269750
description:
2026-01-08 00:11:13 dovecot_login authenticator failed for H=([128.185.12.179]) [128.185.12.179]:56776: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.203.37.225
country_id: 6252001
description:
2026-01-08 00:11:30 dovecot_login authenticator failed for H=104-203-37-225.static4.bluestreamfiber.net [104.203.37.225]:34736: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.80.9
country_id: 3144096
description:
2026-01-08 00:13:42 dovecot_login authenticator failed for H=(cm-178.232.80.9.get.no) [178.232.80.9]:34611: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.179.189.33
country_id: 3469034
description:
Jan  8 00:13:59 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=45.179.189.33, lip=66.85.158.91, TLS, session=<qVHLq9BHrqYts70h>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.215.1.201
country_id: 2635167
description:
2026-01-08 00:14:10 dovecot_login authenticator failed for H=([88.215.1.201]) [88.215.1.201]:56362: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.96.219
country_id: 3469034
description:
Jan  8 00:14:21 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=177.44.96.219, lip=66.85.158.91, TLS, session=<p0QArdBH6ZGxLGDb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.80.9
country_id: 3144096
description:
2026-01-08 00:15:30 dovecot_login authenticator failed for H=([178.232.80.9]) [178.232.80.9]:38931: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.200
country_id: 6252001
description:
Jan  8 00:18:56 host2 pure-ftpd[3732434]: (?@205.210.31.200) [INFO] New connection from 205.210.31.200


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.169.40.221
country_id: 1269750
description:
2026-01-08 00:19:24 dovecot_login authenticator failed for H=(164-53-26-103.intechonline.net) [122.169.40.221]:56134: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.158.205.225
country_id: 1861060
description:
2026-01-08 00:19:11 dovecot_login authenticator failed for H=kd113158205225.ppp-bb.dion.ne.jp [113.158.205.225]:46550: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.154.170
country_id: 1733045
description:
2026-01-08 00:27:48 dovecot_login authenticator failed for H=([49.124.154.170]) [49.124.154.170]:53452: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.230.134
country_id: 1269750
description:
2026-01-08 00:28:01 dovecot_login authenticator failed for H=([182.95.215.73]) [182.95.230.134]:34582: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.254.54
country_id: 1269750
description:
2026-01-08 00:29:01 dovecot_login authenticator failed for H=([128.185.254.54]) [128.185.254.54]:55462: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.237.55
country_id: 3625428
description:
2026-01-08 00:30:31 dovecot_login authenticator failed for H=(ADMIN) [95.181.237.55]:46234: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.68.226.171
country_id: 3017382
description:
2026-01-08 00:31:31 dovecot_login authenticator failed for H=vps-b674cd8d.vps.ovh.net [51.68.226.171]:44676: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.96.233.67
country_id: 6251999
description:
2026-01-08 00:31:54 dovecot_login authenticator failed for H=208-96-233-67.resi.cgocable.ca [208.96.233.67]:40448: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.23.242.223
country_id: 953987
description:
2026-01-08 00:36:39 dovecot_login authenticator failed for H=([102.23.242.223]) [102.23.242.223]:59102: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.240.109.153
country_id: 6252001
description:
Jan  8 00:37:14 host2 sshd[3751821]: Disconnected from invalid user user 162.240.109.153 port 39992 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.240.109.153
country_id: 6252001
description:
Jan  8 00:38:25 host2 sshd[3752983]: Disconnected from invalid user admin 162.240.109.153 port 38236 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 162.240.109.153
country_id: 6252001
description:
Jan  8 00:40:49 host2 sshd[3755563]: Disconnected from invalid user admin 162.240.109.153 port 34748 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.90.126.133
country_id: 3703430
description:
Jan  8 00:41:15 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=91.90.126.133, lip=66.85.158.91, TLS handshaking: Connection closed, session=<MO1mDtFHKK5bWn6F>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 188.214.125.70
country_id: 1694008
description:
Jan  8 00:41:22 host2 pure-ftpd[3756417]: (?@188.214.125.70) [INFO] New connection from 188.214.125.70


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 191.96.227.207
country_id: 6252001
description:
Jan  8 00:41:23 host2 pure-ftpd[3756432]: (?@191.96.227.207) [INFO] New connection from 191.96.227.207


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.240.109.153
country_id: 6252001
description:
Jan  8 00:42:00 host2 sshd[3757222]: Disconnected from invalid user ubuntu 162.240.109.153 port 32992 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.40.57.41
country_id: 1269750
description:
Jan  8 00:42:38 host2 sshd[3757973]: Disconnected from invalid user ubuntu 45.40.57.41 port 52490 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.40.57.41
country_id: 1269750
description:
Jan  8 00:43:12 host2 sshd[3758613]: Disconnected from invalid user ubuntu 45.40.57.41 port 60002 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.240.109.153
country_id: 6252001
description:
Jan  8 00:44:26 host2 sshd[3759943]: Disconnected from invalid user test 162.240.109.153 port 57718 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.40.57.41
country_id: 1269750
description:
Jan  8 00:44:16 host2 sshd[3759674]: Disconnected from invalid user ubuntu 45.40.57.41 port 51654 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.10
country_id: 1269750
description:
2026-01-08 00:52:55 dovecot_login authenticator failed for H=(aes-static-137.135.17.125.airtel.in) [182.95.228.10]:49424: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 161.118.238.65
country_id: 1880251
description:
Jan  8 00:53:21 host2 sshd[3768445]: Disconnected from invalid user health 161.118.238.65 port 40580 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.103.7.116
country_id: 690791
description:
Jan  8 00:53:50 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=176.103.7.116, lip=66.85.158.91, TLS, session=<loNZOtFHXsawZwd0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.118.238.65
country_id: 1880251
description:
Jan  8 00:53:10 host2 sshd[3768299]: Disconnected from invalid user health 161.118.238.65 port 35084 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.246.208.66
country_id: 798544
description:
Jan  8 00:54:08 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=91.246.208.66, lip=66.85.158.91, TLS, session=<vIFuO9FH9IRb9tBC>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  8 01:01:13 host2 sshd[3777398]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  8 01:03:01 host2 sshd[3779191]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  8 01:03:31 host2 sshd[3779851]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.76
country_id: 6252001
description:
Jan  8 01:06:27 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=147.185.132.76, lip=66.85.158.92, TLS, session=<VVaAaNFHMvSTuYRM>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.163
country_id: 2993457
description:
Jan  8 01:10:09 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=194.165.16.163, lip=66.85.158.92, session=<UYO7ddFHegnCpRCj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.90.124.5
country_id: 3042225
description:
2026-01-08 01:13:38 dovecot_login authenticator failed for H=(ADMIN) [91.90.124.5]:34507: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.167
country_id: 2993457
description:
Jan  8 01:13:41 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=194.165.16.167, lip=66.85.158.92, session=<8MlpgtFHCf/CpRCn>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  8 01:14:29 host2 sshd[3791113]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.253
country_id: 6252001
description:
Jan  8 01:17:22 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=205.210.31.253, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<tq+Jj9FHytbN0h/9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.229.1.186
country_id: 6252001
description:
2026-01-08 01:17:39 dovecot_login authenticator failed for H=c-71-229-1-186.hsd1.al.comcast.net [71.229.1.186]:35418: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.56.34.147
country_id: 6252001
description:
2026-01-08 01:17:53 dovecot_login authenticator failed for H=(136-56-34-147.googlefiber.net) [136.56.34.147]:41750: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.112.109.248
country_id: 6252001
description:
2026-01-08 01:18:11 dovecot_login authenticator failed for H=(host-24-112-109-248.vyvebroadband.net) [24.112.109.248]:36881: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 132.251.249.156
country_id: 3923057
description:
2026-01-08 01:22:21 dovecot_login authenticator failed for H=host-132-251-249-156.supernet.com.bo (static-200-58-83-79.supernet.com.bo) [132.251.249.156]:54002: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.206.201.253
country_id: 1269750
description:
2026-01-08 01:22:34 dovecot_login authenticator failed for H=(49.206.201.253.actcorp.in) [49.206.201.253]:39520: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.135
country_id: 6252001
description:
Jan  8 01:23:24 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=66.132.153.135, lip=66.85.158.91, TLS: Connection closed, session=<HhYppdFHphRChJmH>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.102.158.36
country_id: 294640
description:
2026-01-08 01:26:09 dovecot_login authenticator failed for H=([82.102.158.36]) [82.102.158.36]:49765: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.211.94.35
country_id: 289688
description:
2026-01-08 01:26:50 dovecot_login authenticator failed for H=([37.211.94.35]) [37.211.94.35]:43293: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.183
country_id: 3144096
description:
2026-01-08 01:29:52 dovecot_login authenticator failed for H=(cm-84.213.189.183.get.no) [84.213.189.183]:33060: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.126.89.35
country_id: 660013
description:
2026-01-08 01:30:57 dovecot_login authenticator failed for H=(ADMIN) [188.126.89.35]:58723: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.51.230
country_id: 1149361
description:
2026-01-08 01:31:18 dovecot_login authenticator failed for H=([149.54.51.230]) [149.54.51.230]:47893: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.207.20.193
country_id: 290557
description:
2026-01-08 01:31:33 dovecot_login authenticator failed for H=([94.207.20.193]) [94.207.20.193]:39549: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.135.25.184
country_id: 1522867
description:
2026-01-08 01:35:01 dovecot_login authenticator failed for H=2.135.25.184.dynamic.telecom.kz [2.135.25.184]:54489: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.66
country_id: 6252001
description:
Jan  8 01:36:02 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.66, lip=66.85.158.91, TLS handshaking: Connection closed, session=<9qJJ0tFHbv9BMQFC>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.66
country_id: 6252001
description:
Jan  8 01:36:20 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.66, lip=66.85.158.91, TLS handshaking: Connection closed, session=<8rpi09FHhFNBMQFC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.77.51.78
country_id: 3175395
description:
Jan  8 01:39:26 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=185.77.51.78, lip=66.85.158.91, TLS, session=<pA6A3dFHWtK5TTNO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.125.244.155
country_id: 798544
description:
Jan  8 01:39:08 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 26 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=109.125.244.155, lip=66.85.158.91, TLS, session=<0Q3e29FHHaxtffSb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.184.83.17
country_id: 6252001
description:
2026-01-08 01:42:13 dovecot_login authenticator failed for H=h17.83.184.173.dynamic.ip.windstream.net [173.184.83.17]:58210: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.46.45.121
country_id: 290557
description:
2026-01-08 01:42:25 dovecot_login authenticator failed for H=([20.46.45.121]) [20.46.45.121]:60176: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 135.237.125.78
country_id: 6252001
description:
Jan  8 01:43:11 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=135.237.125.78, lip=66.85.158.92, session=<XeHn69FH8paH7X1O>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.24
country_id: 798549
description:
Jan  8 01:49:45 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=85.217.149.24, lip=66.85.158.91, session=<ND5aA9JHIINV2ZUY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.190.111.235
country_id: 1880251
description:
Jan  8 01:50:31 host2 sshd[3824582]: Disconnected from invalid user deploy 146.190.111.235 port 50800 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 149.40.59.84
country_id: 2750405
description:
[2025-12-26 17:26:14 +0530] info [webmaild] 149.40.59.84 - washeera@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 134.185.82.192
country_id: 1880251
description:
Jan  8 01:52:43 host2 sshd[3826462]: Disconnected from invalid user health 134.185.82.192 port 38476 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.244.49.51
country_id: 1668284
description:
2026-01-08 01:52:52 dovecot_login authenticator failed for H=(ADMIN) [173.244.49.51]:54132: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 134.185.82.192
country_id: 1880251
description:
Jan  8 01:52:52 host2 sshd[3826598]: Disconnected from invalid user health 134.185.82.192 port 40230 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.84.144.171
country_id: 6252001
description:
Jan  8 01:53:08 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.84.144.171, lip=66.85.158.91, session=<sJp7D9JH+qsUVJCr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.226.118
country_id: 1269750
description:
2026-01-08 01:54:19 dovecot_login authenticator failed for H=([125.18.154.73]) [182.95.226.118]:47176: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.230.134
country_id: 1269750
description:
2026-01-08 01:54:34 dovecot_login authenticator failed for H=([182.95.230.134]) [182.95.230.134]:60066: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.190.111.235
country_id: 1880251
description:
Jan  8 01:55:13 host2 sshd[3829130]: Disconnected from invalid user ubuntu 146.190.111.235 port 52092 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.128.77.56
country_id: 1643084
description:
Jan  8 01:56:22 host2 sshd[3830413]: Disconnected from invalid user admin 34.128.77.56 port 46480 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 146.190.111.235
country_id: 1880251
description:
Jan  8 01:57:38 host2 sshd[3831444]: Disconnected from invalid user admin1 146.190.111.235 port 42322 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.250.11.116
country_id: 1643084
description:
Jan  8 01:58:34 host2 sshd[3832249]: Disconnected from invalid user test 103.250.11.116 port 51486 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.190.111.235
country_id: 1880251
description:
Jan  8 01:59:24 host2 sshd[3832957]: Disconnected from invalid user deploy 146.190.111.235 port 42192 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.250.11.116
country_id: 1643084
description:
Jan  8 01:59:54 host2 sshd[3833373]: Disconnected from invalid user admin1 103.250.11.116 port 40770 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 34.128.77.56
country_id: 1643084
description:
Jan  8 02:00:17 host2 sshd[3834000]: Disconnected from invalid user admin 34.128.77.56 port 53846 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.30.83.74
country_id: 1269750
description:
Jan  8 02:00:58 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=103.30.83.74, lip=66.85.158.91, TLS, session=<DpJkKtJHz4lnHlNK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.76.241.31
country_id: 933860
description:
Jan  8 02:01:00 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=41.76.241.31, lip=66.85.158.91, TLS, session=<RtVoKtJHtMkpTPEf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.56.14
country_id: 953987
description:
Jan  8 02:01:21 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<hr>, method=PLAIN, rip=102.129.56.14, lip=66.85.158.91, TLS, session=<EcClK9JHU+ZmgTgO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.51.223.4
country_id: 1269750
description:
Jan  8 02:01:21 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<hr>, method=PLAIN, rip=103.51.223.4, lip=66.85.158.91, TLS, session=<t2+4K9JH0M1nM98E>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.185.170
country_id: 1269750
description:
2026-01-08 02:02:28 dovecot_login authenticator failed for H=([122.184.128.193]) [182.95.185.170]:44418: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.146.42
country_id: 1733045
description:
2026-01-08 02:03:21 dovecot_login authenticator failed for H=([49.124.146.42]) [49.124.146.42]:37336: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.177.78
country_id: 1269750
description:
2026-01-08 02:04:44 dovecot_login authenticator failed for H=([182.95.177.78]) [182.95.177.78]:44764: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 38.10.70.123
country_id: 298795
description:
Jan  8 02:05:37 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=38.10.70.123, lip=66.85.158.91, TLS, session=<ClIXO9JHJuwmCkZ7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.255.212.181
country_id: 732800
description:
Jan  8 02:05:57 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=185.255.212.181, lip=66.85.158.91, TLS, session=<TyE2PNJHL825/9S1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 111.68.98.152
country_id: 1168579
description:
Jan  8 02:09:22 host2 sshd[3842437]: Disconnected from invalid user user 111.68.98.152 port 59764 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.181
country_id: 6252001
description:
Jan  8 02:09:30 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=198.235.24.181, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<PWoFStJHasnG6xi1>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 111.68.98.152
country_id: 1168579
description:
Jan  8 02:11:10 host2 sshd[3844660]: Disconnected from invalid user user1 111.68.98.152 port 44550 [preauth]


plugin: ossec
rule: 2501
name: User authentication failure.
description:
2026-01-08 02:13:05 1vdaMz-0000000G8eK-1fvo <= wordpress@venee.lk U=veneelk P=local S=36247 id=C6p5cv72JAb1rH1hDhVhPwFg0JBWjeRK2ZDlkJRHTc@coatrent.venee.lk T="Failed login by IP 35.192.157.134 venee.lk/coatrent" for admin@venee.lk


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  8 02:13:22 host2 sshd[3846764]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.199
country_id: 6252001
description:
Jan  8 02:15:03 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=64.62.156.199, lip=66.85.158.92, session=<WSbSXdJHUVRAPpzH>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.192
country_id: 6252001
description:
Jan  8 02:15:13 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.192, lip=66.85.158.92, TLS: Connection closed, session=<XJF1XtJHSrxAPpzA>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.133.193.42
country_id: 2629691
description:
2026-01-08 02:17:32 dovecot_login authenticator failed for H=(ADMIN) [45.133.193.42]:1556: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 184.105.139.68
country_id: 6252001
description:
Jan  8 02:20:54 host2 pure-ftpd[3853757]: (?@184.105.139.68) [INFO] New connection from 184.105.139.68


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  8 02:22:50 host2 sshd[3855642]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.172.15.103
country_id: 3469034
description:
2026-01-08 02:24:16 dovecot_login authenticator failed for H=(177-172-15-62.user.vivozap.com.br) [177.172.15.103]:58919: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.128.209.48
country_id: 3469034
description:
2026-01-08 02:24:53 dovecot_login authenticator failed for H=(138.219.244.10.static.softdados.net) [177.128.209.48]:37482: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 74.82.47.2
country_id: 6252001
description:
Jan  8 02:27:39 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=74.82.47.2, lip=66.85.158.91, session=<zz/pitJHuuBKUi8C>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.59.154
country_id: 1269750
description:
2026-01-08 02:27:45 dovecot_login authenticator failed for H=([182.95.25.48]) [182.95.59.154]:46600: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.164.148.87
country_id: 1512440
description:
2026-01-08 02:27:36 dovecot_login authenticator failed for H=([62.164.148.87]) [62.164.148.87]:53762: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.57.158
country_id: 1269750
description:
2026-01-08 02:28:18 dovecot_login authenticator failed for H=([182.95.24.209]) [182.95.57.158]:50376: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.215.1.201
country_id: 2635167
description:
2026-01-08 02:31:32 dovecot_login authenticator failed for H=([88.215.1.201]) [88.215.1.201]:42808: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.202.9.133
country_id: 6252001
description:
Jan  8 02:31:43 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.202.9.133, lip=66.85.158.91, TLS: Connection closed, session=<1JJxmdJHnOsjygmF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.250.118.53
country_id: 3865483
description:
2026-01-08 02:32:13 dovecot_login authenticator failed for H=([167.250.118.53]) [167.250.118.53]:55457: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 2501
name: User authentication failure.
description:
2026-01-08 02:33:19 1vdagY-0000000GDiG-1WHk <= wordpress@venee.lk U=veneelk P=local S=36245 id=gJN4Yi1S0mJmXbO4ij8UEruxlPZIZBDInsT29KQ4OE@coatrent.venee.lk T="Failed login by IP 35.192.157.134 venee.lk/coatrent" for admin@venee.lk


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.93.84
country_id: 1269750
description:
2026-01-08 02:33:56 dovecot_login authenticator failed for H=([152.52.93.82]) [152.52.93.84]:10400: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.174.63
country_id: 99237
description:
2026-01-08 02:34:06 dovecot_login authenticator failed for H=([65.20.174.63]) [65.20.174.63]:52329: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.144
country_id: 1269750
description:
2026-01-08 02:34:18 dovecot_login authenticator failed for H=(nsg-corporate-144.230.187.122.airtel.in) [122.187.230.144]:54108: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.226.240
country_id: 1269750
description:
2026-01-08 02:34:44 dovecot_login authenticator failed for H=(nsg-corporate-240.226.187.122.airtel.in) [122.187.226.240]:35114: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.125.229.18
country_id: 3194884
description:
2026-01-08 02:37:57 dovecot_login authenticator failed for H=(ADMIN) [176.125.229.18]:6639: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.42
country_id: 1733045
description:
2026-01-08 02:38:17 dovecot_login authenticator failed for H=([49.124.153.42]) [49.124.153.42]:59620: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.188.98
country_id: 1269750
description:
2026-01-08 02:39:06 dovecot_login authenticator failed for H=([125.19.165.242]) [125.19.188.98]:40912: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  8 02:39:55 host2 sshd[3873078]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.43.77
country_id: 6252001
description:
Jan  8 02:46:53 host2 sshd[3880962]: Disconnected from invalid user user1 209.141.43.77 port 39334 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  8 02:51:10 host2 sshd[3885249]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.216.63.127
country_id: 1835841
description:
Jan  8 02:51:39 host2 sshd[3885666]: Disconnected from invalid user admin1 35.216.63.127 port 40404 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.191.14.210
country_id: 1643084
description:
Jan  8 02:51:41 host2 sshd[3885696]: Disconnected from invalid user admin 103.191.14.210 port 53108 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 216.10.242.161
country_id: 1269750
description:
Jan  8 02:52:08 host2 sshd[3886151]: Disconnected from invalid user ubuntu 216.10.242.161 port 58948 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 216.10.242.161
country_id: 1269750
description:
Jan  8 02:52:40 host2 sshd[3886648]: Disconnected from invalid user admin1 216.10.242.161 port 60490 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  8 02:53:27 host2 sshd[3887392]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.183
country_id: 3144096
description:
2026-01-08 02:53:31 dovecot_login authenticator failed for H=(cm-84.213.189.183.get.no) [84.213.189.183]:56940: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 216.10.242.161
country_id: 1269750
description:
Jan  8 02:53:45 host2 sshd[3887625]: Disconnected from invalid user user1 216.10.242.161 port 55244 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 213.177.179.5
country_id: 1668284
description:
Jan  8 02:55:18 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=213.177.179.5, lip=66.85.158.92, session=<ZojH7dJHj4TVsbMF>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.191.14.210
country_id: 1643084
description:
Jan  8 02:55:23 host2 sshd[3889874]: Disconnected from invalid user user1 103.191.14.210 port 42600 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 35.216.63.127
country_id: 1835841
description:
Jan  8 02:56:17 host2 sshd[3890921]: Disconnected from invalid user admin 35.216.63.127 port 12500 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.12.85.136
country_id: 6252001
description:
Jan  8 02:57:14 host2 sshd[3891870]: Disconnected from invalid user user1 198.12.85.136 port 33414 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.216.63.127
country_id: 1835841
description:
Jan  8 02:57:35 host2 sshd[3892169]: Disconnected from invalid user admin1 35.216.63.127 port 55628 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 198.12.85.136
country_id: 6252001
description:
Jan  8 02:57:47 host2 sshd[3892335]: Disconnected from invalid user test 198.12.85.136 port 41214 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.191.14.210
country_id: 1643084
description:
Jan  8 02:58:22 host2 sshd[3892902]: Disconnected from invalid user user1 103.191.14.210 port 54046 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.43.77
country_id: 6252001
description:
Jan  8 02:58:33 host2 sshd[3893059]: Disconnected from invalid user user1 209.141.43.77 port 48704 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 198.12.85.136
country_id: 6252001
description:
Jan  8 02:59:10 host2 sshd[3893684]: Received disconnect from 198.12.85.136 port 51638:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.203.124
country_id: 1880251
description:
Jan  8 03:00:10 host2 sshd[3894439]: Disconnected from invalid user admin1 45.78.203.124 port 57516 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.203.124
country_id: 1880251
description:
Jan  8 03:01:16 host2 sshd[3895981]: Disconnected from invalid user test 45.78.203.124 port 51116 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.214.165.131
country_id: 6252001
description:
2026-01-08 03:01:23 dovecot_login authenticator failed for H=(ADMIN) [181.214.165.131]:38144: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.237
country_id: 6252001
description:
Jan  8 03:04:30 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 3 secs): user=<>, rip=147.185.132.237, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<bNusDtNH8tWTuYTt>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.202.58
country_id: 1269750
description:
2026-01-08 03:05:41 dovecot_login authenticator failed for H=(nsg-corporate-58.202.186.122.airtel.in) [122.186.202.58]:50632: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 74.235.121.84
country_id: 6252001
description:
Jan  8 03:06:46 host2 pure-ftpd[3901158]: (?@74.235.121.84) [INFO] New connection from 74.235.121.84


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.124.229
country_id: 337996
description:
2026-01-08 03:07:53 dovecot_login authenticator failed for H=([196.189.124.229]) [196.189.124.229]:56384: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.173.78.90
country_id: 2510769
description:
2026-01-08 03:08:18 dovecot_login authenticator failed for H=([90.173.78.90]) [90.173.78.90]:52046: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.149.142.17
country_id: 630336
description:
2026-01-08 03:11:03 dovecot_login authenticator failed for H=([77.74.34.30]) [91.149.142.17]:45981: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.51.135
country_id: 3144096
description:
2026-01-08 03:11:13 dovecot_login authenticator failed for H=(cm-178.232.51.135.get.no) [178.232.51.135]:56894: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.74
country_id: 6252001
description:
Jan  8 03:12:02 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=198.235.24.74, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<0AWlKdNHJtnG6xhK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.93.37.178
country_id: 1269750
description:
2026-01-08 03:13:46 dovecot_login authenticator failed for H=([103.93.37.178]) [103.93.37.178]:58800: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.61.215.87
country_id: 3469034
description:
2026-01-08 03:14:08 dovecot_login authenticator failed for H=201-61-215-87.bbone.telesp.net.br [201.61.215.87]:53013: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2026-01-08 03:13:42 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:58810: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 165.227.230.95
country_id: 2635167
description:
Jan  8 03:14:19 host2 sshd[3908501]: Disconnected from invalid user user 165.227.230.95 port 49206 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.166.49.42
country_id: 1269750
description:
Jan  8 03:14:16 host2 sshd[3908420]: Disconnected from invalid user ubuntu 122.166.49.42 port 33468 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.248.197.77
country_id: 3469034
description:
Jan  8 03:15:39 host2 sshd[3909800]: Disconnected from invalid user admin1 186.248.197.77 port 16994 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.166.49.42
country_id: 1269750
description:
Jan  8 03:15:26 host2 sshd[3909625]: Disconnected from invalid user ubuntu 122.166.49.42 port 56130 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 161.118.239.99
country_id: 1880251
description:
Jan  8 03:16:18 host2 sshd[3910576]: Disconnected from invalid user gov 161.118.239.99 port 52760 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 165.227.230.95
country_id: 2635167
description:
Jan  8 03:17:04 host2 sshd[3911306]: Received disconnect from 165.227.230.95 port 39610:11: Bye Bye [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.250.220
country_id: 3865483
description:
Jan  8 03:17:27 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=179.0.250.220, lip=66.85.158.91, TLS, session=<XaWzO9NHCLizAPrc>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.166.49.42
country_id: 1269750
description:
Jan  8 03:17:40 host2 sshd[3911827]: Disconnected from invalid user deploy 122.166.49.42 port 44978 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.255.206.153
country_id: 3469034
description:
Jan  8 03:17:46 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=138.255.206.153, lip=66.85.158.91, TLS, session=<TOEcPdNHp9OK/86Z>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.73.3
country_id: 1819730
description:
2026-01-08 03:21:32 dovecot_login authenticator failed for H=42-200-73-3.static.imsbiz.com [42.200.73.3]:35032: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.247.195
country_id: 6252001
description:
Jan  8 03:21:52 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=184.105.247.195, lip=66.85.158.92, session=<3cbSTNNHEKm4affD>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.20.69
country_id: 6252001
description:
Jan  8 03:22:28 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.20.69, lip=66.85.158.92, TLS handshaking: Connection closed, session=</1nuTtNHniVBMRRF>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.20.68
country_id: 6252001
description:
Jan  8 03:22:17 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.20.68, lip=66.85.158.91, TLS handshaking: Connection closed, session=<5s1FTtNHKCRBMRRE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.247.195
country_id: 6252001
description:
Jan  8 03:22:19 host2 dovecot[1170291]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=184.105.247.195, lip=66.85.158.92, session=<yDpuTtNHNN24affD>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.90.120.206
country_id: 798549
description:
2026-01-08 03:25:24 dovecot_login authenticator failed for H=(ADMIN) [91.90.120.206]:6479: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.6
country_id: 1269750
description:
2026-01-08 03:29:52 dovecot_login authenticator failed for H=([182.95.181.6]) [182.95.181.6]:59986: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  8 03:30:39 host2 sshd[3924782]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 20.83.151.102
country_id: 6252001
description:
Jan  8 03:31:15 host2 pure-ftpd[3925469]: (?@20.83.151.102) [INFO] New connection from 20.83.151.102


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.117
country_id: 6252001
description:
Jan  8 03:33:11 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 16 secs): user=<>, rip=66.132.153.117, lip=66.85.158.91, TLS handshaking: Connection closed, session=<IxFAddNHhKFChJl1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.53.254.168
country_id: 6252001
description:
2026-01-08 03:41:05 dovecot_plain authenticator failed for H=c-73-53-254-168.hsd1.fl.comcast.net (dentrodued) [73.53.254.168]:60750: 535 Incorrect authentication data (set_id=it@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 20.65.194.133
country_id: 6252001
description:
Jan  8 03:45:22 host2 pure-ftpd[3939950]: (?@20.65.194.133) [INFO] New connection from 20.65.194.133


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.246.178
country_id: 1269750
description:
2026-01-08 03:47:33 dovecot_login authenticator failed for H=([182.79.95.139]) [152.52.246.178]:50862: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.104.78
country_id: 1269750
description:
2026-01-08 03:47:53 dovecot_login authenticator failed for H=([27.123.104.78]) [27.123.104.78]:42374: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.215.98.8
country_id: 3144096
description:
2026-01-08 03:47:55 dovecot_login authenticator failed for H=(cm-84.215.98.8.get.no) [84.215.98.8]:47661: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.154.80.36
country_id: 2245662
description:
2026-01-08 03:48:25 dovecot_login authenticator failed for H=([213.154.80.21]) [213.154.80.36]:39962: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 52.180.146.167
country_id: 6252001
description:
Jan  8 03:49:46 host2 pure-ftpd[3943457]: (?@52.180.146.167) [INFO] New connection from 52.180.146.167


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.241.127.152
country_id: 6252001
description:
Jan  8 03:50:38 host2 sshd[3944019]: Disconnected from invalid user user1 162.241.127.152 port 60406 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.244.49.67
country_id: 1668284
description:
2026-01-08 03:51:08 dovecot_login authenticator failed for H=(ADMIN) [173.244.49.67]:42408: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.89.148.218
country_id: 6252001
description:
Jan  8 03:52:19 host2 sshd[3945091]: Disconnected from invalid user user 159.89.148.218 port 57736 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.241.127.152
country_id: 6252001
description:
Jan  8 03:54:56 host2 sshd[3947090]: Disconnected from invalid user ubuntu 162.241.127.152 port 52744 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.123.134.194
country_id: 6252001
description:
Jan  8 03:54:15 host2 sshd[3946663]: Disconnected from invalid user ubuntu 34.123.134.194 port 45820 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.85.163.94
country_id: 6252001
description:
Jan  8 03:54:20 host2 sshd[3946777]: Disconnected from invalid user ubuntu 34.85.163.94 port 48396 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.193.178.214
country_id: 1643084
description:
Jan  8 03:54:31 host2 sshd[3946876]: Disconnected from invalid user deploy 103.193.178.214 port 53816 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 159.89.148.218
country_id: 6252001
description:
Jan  8 03:54:33 host2 sshd[3946900]: Disconnected from invalid user ubuntu 159.89.148.218 port 54366 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 34.123.134.194
country_id: 6252001
description:
Jan  8 03:56:29 host2 sshd[3948196]: Disconnected from invalid user ubuntu 34.123.134.194 port 42242 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 162.241.127.152
country_id: 6252001
description:
Jan  8 03:57:19 host2 sshd[3948897]: Received disconnect from 162.241.127.152 port 56688:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.193.178.214
country_id: 1643084
description:
Jan  8 03:57:31 host2 sshd[3948962]: Disconnected from invalid user ubuntu 103.193.178.214 port 43912 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.89.148.218
country_id: 6252001
description:
Jan  8 03:58:31 host2 sshd[3949692]: Disconnected from invalid user admin 159.89.148.218 port 51574 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.241.127.152
country_id: 6252001
description:
Jan  8 03:59:20 host2 sshd[3950271]: Disconnected from invalid user test 162.241.127.152 port 48704 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.193.178.214
country_id: 1643084
description:
Jan  8 04:00:05 host2 sshd[3950856]: Disconnected from invalid user deploy 103.193.178.214 port 48072 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.8.108.39
country_id: 3469034
description:
Jan  8 04:00:21 host2 sshd[3951067]: Disconnected from invalid user admin1 189.8.108.39 port 39832 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  8 04:01:35 host2 sshd[3951987]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 189.8.108.39
country_id: 3469034
description:
Jan  8 04:01:33 host2 sshd[3951961]: Disconnected from invalid user test 189.8.108.39 port 46174 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.202.90
country_id: 1880251
description:
Jan  8 04:01:15 host2 sshd[3951665]: Disconnected from invalid user ubuntu 45.78.202.90 port 42928 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.116
country_id: 6252001
description:
Jan  8 04:05:05 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 15 secs): user=<>, rip=66.132.153.116, lip=66.85.158.92, TLS handshaking: Connection closed, session=<w2Bg59NHjORChJl0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.250.165
country_id: 3865483
description:
Jan  8 04:10:06 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=179.0.250.165, lip=66.85.158.91, TLS, session=<CMsi+NNHuMmzAPql>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.107.84.244
country_id: 7626844
description:
2026-01-08 04:09:11 dovecot_login authenticator failed for H=(244.84.107.200.flamingotv.net) [200.107.84.244]:38171: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.197.9.59
country_id: 3175395
description:
Jan  8 04:10:24 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=185.197.9.59, lip=66.85.158.91, TLS, session=<5eJq+dNH9+W5xQk7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.170.150.178
country_id: 1605651
description:
2026-01-08 04:11:56 dovecot_login authenticator failed for H=([203.170.150.178]) [203.170.150.178]:35704: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.214.164.169
country_id: 6252001
description:
2026-01-08 04:14:49 dovecot_login authenticator failed for H=(ADMIN) [181.214.164.169]:44272: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.143
country_id: 6252001
description:
Jan  8 04:17:01 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.143, lip=66.85.158.92, TLS: Connection closed, session=<zVYFEtRHLtVChJmP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.128.202
country_id: 6252001
description:
2026-01-08 04:22:07 dovecot_login authenticator failed for H=([192.34.128.202]) [192.34.128.202]:46386: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 193.26.115.235
country_id: 6252001
description:
Jan  8 04:31:17 host2 pure-ftpd[3980362]: (?@193.26.115.235) [INFO] New connection from 193.26.115.235


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 193.26.115.235
country_id: 6252001
description:
Jan  8 04:31:17 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=193.26.115.235, lip=66.85.158.91, TLS handshaking: Connection closed, session=<g8sORdRHo8/BGnPr>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.104.11.51
country_id: 6252001
description:
Jan  8 04:32:09 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:140943F2:SSL routines:ssl3_read_bytes:sslv3 alert unexpected message: SSL alert number 10 (no auth attempts in 0 secs): user=<>, rip=172.104.11.51, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:140943F2:SSL routines:ssl3_read_bytes:sslv3 alert unexpected message: SSL alert number 10, session=<x04nSNRHunWsaAsz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.245.0.246
country_id: 1880251
description:
2026-01-08 04:32:19 dovecot_login authenticator failed for H=(246.0.245.49.unknown.m1.com.sg) [49.245.0.246]:43907: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.246.106
country_id: 1269750
description:
2026-01-08 04:32:36 dovecot_login authenticator failed for H=([125.16.255.97]) [125.20.246.106]:44976: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.230.122
country_id: 1269750
description:
2026-01-08 04:32:42 dovecot_login authenticator failed for H=([59.145.116.161]) [182.95.230.122]:45434: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.227.166
country_id: 1269750
description:
2026-01-08 04:33:02 dovecot_login authenticator failed for H=([103.56.85.65]) [128.185.227.166]:44388: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.33.112
country_id: 3144096
description:
2026-01-08 04:33:06 dovecot_login authenticator failed for H=([178.232.33.112]) [178.232.33.112]:51996: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 40.124.175.30
country_id: 6252001
description:
Jan  8 04:34:24 host2 pure-ftpd[3983785]: (?@40.124.175.30) [INFO] New connection from 40.124.175.30


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.248.30.205
country_id: 1269750
description:
2026-01-08 04:38:08 dovecot_login authenticator failed for H=([103.248.30.205]) [103.248.30.205]:55156: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.69.114.35
country_id: 1269750
description:
2026-01-08 04:37:44 dovecot_plain authenticator failed for H=(ousts) [103.69.114.35]:56134: 535 Incorrect authentication data (set_id=it@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.161
country_id: 2993457
description:
Jan  8 04:39:06 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=194.165.16.161, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<4HMEYdRH3P/CpRCh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.241.125.193
country_id: 6252001
description:
2026-01-08 04:39:44 dovecot_login authenticator failed for H=(ADMIN) [151.241.125.193]:60434: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.191.8.27
country_id: 3017382
description:
2026-01-08 04:39:52 dovecot_login authenticator failed for H=([176.191.8.27]) [176.191.8.27]:48018: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.103.6.92
country_id: 690791
description:
Jan  8 04:40:36 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@jrdc.lk>, method=PLAIN, rip=176.103.6.92, lip=66.85.158.91, TLS, session=<t05dZdRHINSwZwZc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.221.153.183
country_id: 690791
description:
Jan  8 04:40:36 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@jrdc.lk>, method=PLAIN, rip=37.221.153.183, lip=66.85.158.91, TLS, session=<voVYZdRHJIMl3Zm3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.89.136.182
country_id: 3469034
description:
Jan  8 04:40:39 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@jrdc.lk>, method=PLAIN, rip=190.89.136.182, lip=66.85.158.91, TLS, session=<N0BxZdRHbeC+WYi2>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  8 04:40:40 host2 sshd[3990002]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.137.230
country_id: 1269750
description:
2026-01-08 04:41:33 dovecot_login authenticator failed for H=(abts-north-static-230.137.160.122.airtelbroadband.in) [122.160.137.230]:40641: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.22.87.128
country_id: 3469034
description:
Jan  8 04:40:48 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@jrdc.lk>, method=PLAIN, rip=177.22.87.128, lip=66.85.158.91, TLS, session=<MhUAZtRH0rixFleA>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 31.222.1.179
country_id: 3077311
description:
Jan  8 04:40:54 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=31.222.1.179, lip=66.85.158.91, TLS, session=<m+FxZtRH39of3gGz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.125.247.185
country_id: 798544
description:
Jan  8 04:41:04 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=109.125.247.185, lip=66.85.158.91, TLS, session=<WqbeZtRHfMxtffe5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.60.154
country_id: 953987
description:
Jan  8 04:41:10 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=102.129.60.154, lip=66.85.158.91, TLS, session=<pXZBZ9RHqahmgTya>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.42.11
country_id: 953987
description:
Jan  8 04:40:40 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@jrdc.lk>, method=PLAIN, rip=102.64.42.11, lip=66.85.158.91, TLS, session=<VT9tZdRHRqVmQCoL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.103.4.196
country_id: 690791
description:
Jan  8 04:40:55 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=176.103.4.196, lip=66.85.158.91, TLS, session=<3ZN6ZtRH7oGwZwTE>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.246.208.125
country_id: 798544
description:
Jan  8 04:40:57 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=91.246.208.125, lip=66.85.158.91, TLS, session=<172pZtRHTINb9tB9>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  8 04:42:56 host2 sshd[3991683]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  8 04:52:10 host2 sshd[3999315]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 213.35.113.99
country_id: 1880251
description:
Jan  8 04:53:38 host2 sshd[4000394]: Disconnected from invalid user health 213.35.113.99 port 60078 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.70.134
country_id: 1819730
description:
2026-01-08 04:53:02 dovecot_login authenticator failed for H=42-200-70-134.static.imsbiz.com [42.200.70.134]:45608: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.237
country_id: 6252001
description:
Jan  8 04:53:12 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=205.210.31.237, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<e7d0k9RHXs/N0h/t>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.126.26.213
country_id: 1861060
description:
2026-01-08 04:53:15 dovecot_login authenticator failed for H=knet202126026213.kvision.ne.jp [202.126.26.213]:37630: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.205.250.78
country_id: 290557
description:
2026-01-08 04:57:10 dovecot_login authenticator failed for H=([94.205.250.78]) [94.205.250.78]:51262: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.81.142.41
country_id: 3996063
description:
2026-01-08 04:58:03 dovecot_login authenticator failed for H=(ADMIN) [77.81.142.41]:32176: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 149.88.25.228
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [webmaild] 149.88.25.228 - env_eng@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.47.145
country_id: 1819730
description:
2026-01-08 04:57:55 dovecot_login authenticator failed for H=145.47.246.220.static.netvigator.com [220.246.47.145]:50109: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.164.251.182
country_id: 6252001
description:
2026-01-08 04:58:44 dovecot_login authenticator failed for H=216-164-251-182.s9140.c3-0.eas-cbr4.atw-eas.pa.cable.rcncustomer.com [216.164.251.182]:38206: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.210.126.172
country_id: 294640
description:
2026-01-08 04:59:50 dovecot_login authenticator failed for H=([46.210.126.172]) [46.210.126.172]:34526: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.93.204.162
country_id: 3469034
description:
Jan  8 05:00:55 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=177.93.204.162, lip=66.85.158.91, TLS, session=<3OfwrdRHK4yxXcyi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.24.182.58
country_id: 1269750
description:
Jan  8 05:00:34 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=103.24.182.58, lip=66.85.158.91, TLS, session=<mgW4rNRHk89nGLY6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.79.115.134
country_id: 6252001
description:
Jan  8 05:02:02 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 8 secs): user=<>, rip=45.79.115.134, lip=66.85.158.91, TLS handshaking: read(size=1026) failed: Connection reset by peer, session=<LLMHs9RHAp8tT3OG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.125.83.34
country_id: 1880251
description:
2026-01-08 05:03:48 dovecot_login authenticator failed for H=([203.125.110.142]) [203.125.83.34]:57396: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.194
country_id: 1269750
description:
2026-01-08 05:04:14 dovecot_login authenticator failed for H=([152.52.234.46]) [182.95.176.194]:38076: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  8 05:07:23 host2 sshd[4014431]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.59.95.177
country_id: 1643084
description:
Jan  8 05:09:44 host2 sshd[4016501]: Disconnected from invalid user ubuntu 103.59.95.177 port 52400 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.128.151.92
country_id: 6252001
description:
2026-01-08 05:11:01 dovecot_login authenticator failed for H=c-73-128-151-92.hsd1.de.comcast.net [73.128.151.92]:40972: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.59.95.177
country_id: 1643084
description:
Jan  8 05:11:03 host2 sshd[4017953]: Disconnected from invalid user user1 103.59.95.177 port 44818 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.58.114
country_id: 1269750
description:
2026-01-08 05:12:09 dovecot_login authenticator failed for H=([182.95.58.114]) [182.95.58.114]:40680: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.59.95.177
country_id: 1643084
description:
Jan  8 05:12:21 host2 sshd[4018960]: Disconnected from invalid user user1 103.59.95.177 port 53628 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.120.182
country_id: 3144096
description:
2026-01-08 05:11:47 dovecot_login authenticator failed for H=(cm-178.232.120.182.get.no) [178.232.120.182]:45710: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.59.95.177
country_id: 1643084
description:
Jan  8 05:12:56 host2 sshd[4019373]: Disconnected from invalid user deploy 103.59.95.177 port 54168 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 212.102.40.218
country_id: 6252001
description:
Jan  8 05:15:25 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=212.102.40.218, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<i2vo4tRHRkLUZija>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.81.229.179
country_id: 6252001
description:
2026-01-08 05:17:45 dovecot_login authenticator failed for H=(fabfibernet.com) [192.81.229.179]:52444: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 103.163.208.106
country_id: 1819730
description:
Jan  8 05:18:03 host2 pure-ftpd[4023848]: (?@103.163.208.106) [INFO] New connection from 103.163.208.106


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 103.163.208.106
country_id: 1819730
description:
Jan  8 05:18:20 host2 pure-ftpd[4024067]: (?@103.163.208.106) [INFO] New connection from 103.163.208.106


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 103.163.208.106
country_id: 1819730
description:
Jan  8 05:18:33 host2 pure-ftpd[4024237]: (?@103.163.208.106) [INFO] New connection from 103.163.208.106


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.173.29.148
country_id: 1643084
description:
Jan  8 05:19:20 host2 sshd[4024919]: Disconnected from invalid user test 43.173.29.148 port 42620 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 103.163.208.106
country_id: 1819730
description:
Jan  8 05:18:22 host2 pure-ftpd[4024088]: (?@103.163.208.106) [INFO] New connection from 103.163.208.106


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.122
country_id: 1269750
description:
2026-01-08 05:20:20 dovecot_login authenticator failed for H=([59.145.84.169]) [182.95.176.122]:38172: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.233.25
country_id: 2993457
description:
2026-01-08 05:19:57 dovecot_login authenticator failed for H=(ADMIN) [95.181.233.25]:10923: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2026-01-08 05:22:37 dovecot_login authenticator failed for H=([197.219.228.242]) [197.219.228.242]:60404: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.124.221.2
country_id: 2750405
description:
2026-01-08 05:22:55 dovecot_login authenticator failed for H=ip-213-124-221-2.ip.prioritytelecom.net [213.124.221.2]:44818: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.111.223.51
country_id: 2635167
description:
2026-01-08 05:23:41 dovecot_login authenticator failed for H=cpc145672-oxfd28-2-0-cust818.4-3.cable.virginm.net [81.111.223.51]:42037: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.94.120.250
country_id: 732800
description:
[2025-12-26 17:26:14 +0530] info [webmaild] 172.94.120.250 - hr@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.61.6
country_id: 290557
description:
2026-01-08 05:34:16 dovecot_plain authenticator failed for H=(nosemenes) [5.32.61.6]:47431: 535 Incorrect authentication data (set_id=it@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.164.93.136
country_id: 6252001
description:
2026-01-08 05:35:27 dovecot_login authenticator failed for H=(syn-024-164-093-136.res.spectrum.com) [24.164.93.136]:36656: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.158.138.179
country_id: 1269750
description:
2026-01-08 05:35:39 dovecot_login authenticator failed for H=([103.158.138.179]) [103.158.138.179]:48488: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.242.142
country_id: 1269750
description:
2026-01-08 05:36:49 dovecot_login authenticator failed for H=([125.19.172.137]) [182.78.242.142]:43184: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  8 05:37:40 host2 sshd[4041540]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2026-01-08 05:37:30 dovecot_login authenticator failed for H=([196.216.81.126]) [196.216.81.126]:44814: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 144.172.114.180
country_id: 6252001
description:
Jan  8 05:42:27 host2 pure-ftpd[4045714]: (?@144.172.114.180) [INFO] New connection from 144.172.114.180


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.136.176.12
country_id: 2510769
description:
2026-01-08 05:44:59 dovecot_login authenticator failed for H=([83.136.176.12]) [83.136.176.12]:56406: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.239.226.200
country_id: 6252001
description:
2026-01-08 05:44:59 dovecot_login authenticator failed for H=(ADMIN) [173.239.226.200]:40587: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 192.155.90.118
country_id: 6252001
description:
Jan  8 05:45:05 host2 dovecot[1170291]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=192.155.90.118, lip=66.85.158.91, TLS, session=<oYQATdVHAuzAm1p2>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.166
country_id: 2993457
description:
Jan  8 05:45:38 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=194.165.16.166, lip=66.85.158.91, session=<tvf6TtVHGf7CpRCm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.121.175.220
country_id: 3579143
description:
2026-01-08 05:48:32 dovecot_login authenticator failed for H=(client-adsl-93-121-175-220.mediaserv.net) [93.121.175.220]:37390: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.132.40.41
country_id: 6252001
description:
2026-01-08 05:49:05 dovecot_login authenticator failed for H=([216.132.40.41]) [216.132.40.41]:40063: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.229.154
country_id: 1269750
description:
2026-01-08 05:52:37 dovecot_login authenticator failed for H=([182.95.13.209]) [182.95.229.154]:34500: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.5.113.133
country_id: 3865483
description:
2026-01-08 05:53:02 dovecot_login authenticator failed for H=(host133.advance.com.ar) [200.5.113.133]:33416: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.121.193.126
country_id: 3595528
description:
2026-01-08 05:55:36 dovecot_login authenticator failed for H=(126.193.121.190.ispguatemala.com.gt) [190.121.193.126]:45702: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.6.121.246
country_id: 3469034
description:
2026-01-08 05:55:50 dovecot_login authenticator failed for H=([191.217.23.65]) [187.6.121.246]:44065: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.202.250.46
country_id: 3469034
description:
2026-01-08 05:59:59 dovecot_login authenticator failed for H=([200.202.250.46]) [200.202.250.46]:52611: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.226.82
country_id: 1269750
description:
2026-01-08 06:00:09 dovecot_login authenticator failed for H=([122.185.184.134]) [182.95.226.82]:50206: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.255.189.56
country_id: 298795
description:
2026-01-08 05:59:38 dovecot_login authenticator failed for H=(88.255.189.56.static.ttnet.com.tr) [88.255.189.56]:60203: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.102
country_id: 1269750
description:
2026-01-08 06:00:37 dovecot_login authenticator failed for H=(nsg-corporate-9.90.186.122.airtel.in) [182.95.228.102]:48026: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.191.100
country_id: 3144096
description:
2026-01-08 06:00:51 dovecot_login authenticator failed for H=(cm-84.213.191.100.get.no) [84.213.191.100]:34695: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.68.226.87
country_id: 3017382
description:
Jan  8 06:01:36 host2 sshd[4065814]: Disconnected from invalid user ubuntu 51.68.226.87 port 57944 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.68.226.87
country_id: 3017382
description:
Jan  8 06:02:04 host2 sshd[4066170]: Disconnected from invalid user admin 51.68.226.87 port 41184 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.68.226.87
country_id: 3017382
description:
Jan  8 06:03:02 host2 sshd[4066916]: Disconnected from invalid user admin 51.68.226.87 port 35900 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 51.68.226.87
country_id: 3017382
description:
Jan  8 06:04:23 host2 sshd[4068068]: Received disconnect from 51.68.226.87 port 42082:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 46.101.206.166
country_id: 2921044
description:
Jan  8 06:04:31 host2 sshd[4068306]: Disconnected from invalid user admin1 46.101.206.166 port 45582 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 46.101.206.166
country_id: 2921044
description:
Jan  8 06:05:28 host2 sshd[4069261]: Disconnected from invalid user deploy 46.101.206.166 port 55588 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.156.1.127
country_id: 3469034
description:
2026-01-08 06:07:06 dovecot_login authenticator failed for H=([38.156.1.127]) [38.156.1.127]:50401: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 46.101.206.166
country_id: 2921044
description:
Jan  8 06:06:25 host2 sshd[4070045]: Disconnected from invalid user admin 46.101.206.166 port 35760 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  8 06:07:51 host2 sshd[4071347]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.93.60.253
country_id: 3865483
description:
2026-01-08 06:07:35 dovecot_login authenticator failed for H=(host253.181-93-60.telecom.net.ar) [181.93.60.253]:55414: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.254.54
country_id: 1269750
description:
2026-01-08 06:07:22 dovecot_login authenticator failed for H=([128.185.254.54]) [128.185.254.54]:38118: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.172
country_id: 6252001
description:
Jan  8 06:08:59 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.172, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<XYJvotVHp93N0h+s>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.149.52.116
country_id: 6251999
description:
2026-01-08 06:09:29 dovecot_login authenticator failed for H=(ADMIN) [89.149.52.116]:1324: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.136.176.12
country_id: 2510769
description:
2026-01-08 06:12:35 dovecot_login authenticator failed for H=([83.136.176.12]) [83.136.176.12]:60613: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.49.63.41
country_id: 3469034
description:
2026-01-08 06:13:56 dovecot_login authenticator failed for H=customer-187-49-63-41.f1net.com.br [187.49.63.41]:54703: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.153.146
country_id: 99237
description:
2026-01-08 06:14:45 dovecot_plain authenticator failed for H=(supre) [65.20.153.146]:52485: 535 Incorrect authentication data (set_id=it@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.104.42
country_id: 1269750
description:
2026-01-08 06:15:19 dovecot_login authenticator failed for H=([27.123.104.42]) [27.123.104.42]:40636: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.37.32.248
country_id: 1269750
description:
2026-01-08 06:15:32 dovecot_login authenticator failed for H=(nsg-corporate-90.179.185.122.airtel.in) [49.37.32.248]:45194: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.47.190
country_id: 99237
description:
2026-01-08 06:15:21 dovecot_login authenticator failed for H=([185.255.47.190]) [185.255.47.190]:51816: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.132
country_id: 6252001
description:
Jan  8 06:17:09 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.132, lip=66.85.158.92, TLS: Connection closed, session=</rmsv9VHLtdChJmE>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-01-08 06:16:31 dovecot_plain authenticator failed for H=(limle) [64.72.74.162]:37467: 535 Incorrect authentication data (set_id=it@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 23.94.179.104
country_id: 6252001
description:
Jan  8 06:17:33 host2 sshd[4080441]: Disconnected from invalid user user 23.94.179.104 port 33028 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan  8 06:18:20 host2 sshd[4081107]: Disconnected from invalid user user 2.57.121.25 port 53417 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 23.94.179.104
country_id: 6252001
description:
Jan  8 06:19:09 host2 sshd[4081999]: Disconnected from invalid user ubuntu 23.94.179.104 port 38286 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.91.103.202
country_id: 6252001
description:
2026-01-08 06:21:18 dovecot_plain authenticator failed for H=c-24-91-103-202.hsd1.ma.comcast.net (golowsm) [24.91.103.202]:44388: 535 Incorrect authentication data (set_id=it@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.139.157
country_id: 1269750
description:
Jan  8 06:21:23 host2 sshd[4084537]: Disconnected from invalid user ubuntu 64.227.139.157 port 55044 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 23.94.179.104
country_id: 6252001
description:
Jan  8 06:21:38 host2 sshd[4084773]: Received disconnect from 23.94.179.104 port 37620:11: Bye Bye [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 23.94.179.104
country_id: 6252001
description:
Jan  8 06:22:07 host2 sshd[4085240]: Disconnected from invalid user user1 23.94.179.104 port 48782 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  8 06:23:16 host2 sshd[4086257]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 23.94.179.104
country_id: 6252001
description:
Jan  8 06:22:34 host2 sshd[4085650]: Disconnected from invalid user admin 23.94.179.104 port 59938 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 150.5.169.176
country_id: 1819730
description:
Jan  8 06:24:06 host2 sshd[4086935]: Disconnected from invalid user test 150.5.169.176 port 42222 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.139.157
country_id: 1269750
description:
Jan  8 06:24:12 host2 sshd[4087057]: Disconnected from invalid user admin 64.227.139.157 port 33746 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  8 06:24:41 host2 sshd[4087516]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 64.227.139.157
country_id: 1269750
description:
Jan  8 06:25:58 host2 sshd[4088957]: Disconnected from invalid user test 64.227.139.157 port 60466 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 150.5.169.176
country_id: 1819730
description:
Jan  8 06:28:09 host2 sshd[4091153]: Disconnected from invalid user admin 150.5.169.176 port 41412 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2026-01-08 06:28:45 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:58236: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 150.5.169.176
country_id: 1819730
description:
Jan  8 06:29:42 host2 sshd[4092528]: Disconnected from invalid user admin 150.5.169.176 port 36388 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.214.84.80
country_id: 690791
description:
2026-01-08 06:29:57 dovecot_login authenticator failed for H=([91.214.84.80]) [91.214.84.80]:34044: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.193.53.56
country_id: 1269750
description:
2026-01-08 06:30:10 dovecot_login authenticator failed for H=([113.193.53.56]) [113.193.53.56]:51228: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.183.103.121
country_id: 2635167
description:
2026-01-08 06:31:58 dovecot_login authenticator failed for H=(185-183-103-121.xdsl.5gdsl.com) [185.183.103.121]:34944: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.220.147
country_id: 3144096
description:
2026-01-08 06:32:01 dovecot_login authenticator failed for H=([178.232.220.147]) [178.232.220.147]:44257: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.63
country_id: 2186224
description:
2026-01-08 06:32:20 dovecot_login authenticator failed for H=([121.73.169.63]) [121.73.169.63]:43714: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.220.169.113
country_id: 2635167
description:
2026-01-08 06:32:27 dovecot_login authenticator failed for H=(165-220-169-113.cust.exede.net) [165.220.169.113]:47177: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.98.41.27
country_id: 1269750
description:
2026-01-08 06:32:57 dovecot_login authenticator failed for H=([59.98.41.27]) [59.98.41.27]:36857: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.239.42.61
country_id: 690791
description:
2026-01-08 06:33:37 dovecot_login authenticator failed for H=(ADMIN) [84.239.42.61]:26820: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 139.59.43.242
country_id: 1269750
description:
Jan  8 06:34:39 host2 sshd[4097752]: Disconnected from invalid user deploy 139.59.43.242 port 56142 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.43.242
country_id: 1269750
description:
Jan  8 06:35:56 host2 sshd[4099063]: Disconnected from invalid user ubuntu 139.59.43.242 port 34892 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  8 06:40:19 host2 sshd[4103377]: Disconnected from invalid user admin 2.57.121.112 port 31363 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.148.129
country_id: 3144096
description:
2026-01-08 06:42:07 dovecot_login authenticator failed for H=(cm-178.232.148.129.get.no) [178.232.148.129]:36334: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.214.63.110
country_id: 3144096
description:
2026-01-08 06:41:47 dovecot_login authenticator failed for H=(cm-84.214.63.110.get.no) [84.214.63.110]:57691: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.111.152.79
country_id: 798544
description:
2026-01-08 06:45:53 dovecot_login authenticator failed for H=(176-111-152-79.airmax.pl) [176.111.152.79]:33137: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.162.102
country_id: 1269750
description:
2026-01-08 06:45:27 dovecot_login authenticator failed for H=([125.19.162.102]) [125.19.162.102]:36464: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.160
country_id: 1269750
description:
2026-01-08 06:45:37 dovecot_login authenticator failed for H=(nsg-corporate-160.229.187.122.airtel.in) [122.187.229.160]:51309: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.166
country_id: 1269750
description:
2026-01-08 06:49:15 dovecot_login authenticator failed for H=([182.95.181.166]) [182.95.181.166]:45630: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.229.142
country_id: 1269750
description:
2026-01-08 06:49:47 dovecot_login authenticator failed for H=([182.95.20.115]) [182.95.229.142]:35230: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.194.231
country_id: 3144096
description:
2026-01-08 06:54:57 dovecot_login authenticator failed for H=(cm-178.232.194.231.get.no) [178.232.194.231]:39299: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.231.6
country_id: 1269750
description:
2026-01-08 06:55:15 dovecot_login authenticator failed for H=([125.20.231.225]) [128.185.231.6]:34730: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.224.242.137
country_id: 2635167
description:
2026-01-08 06:56:50 dovecot_login authenticator failed for H=([109.224.242.137]) [109.224.242.137]:36746: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.46.45.121
country_id: 290557
description:
2026-01-08 06:57:02 dovecot_login authenticator failed for H=([20.46.45.121]) [20.46.45.121]:64826: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.215.235.109
country_id: 1831722
description:
2026-01-08 07:03:45 dovecot_login authenticator failed for H=(ADMIN) [188.215.235.109]:63553: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.23.73.205
country_id: 6252001
description:
2026-01-08 07:05:17 dovecot_login authenticator failed for H=([209.23.73.205]) [209.23.73.205]:36942: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.186.193.149
country_id: 1643084
description:
2026-01-08 07:05:19 dovecot_login authenticator failed for H=([103.186.193.149]) [103.186.193.149]:35094: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.64.64.8
country_id: 2264397
description:
2026-01-08 07:05:37 dovecot_login authenticator failed for H=bl23-64-8.dsl.telepac.pt [144.64.64.8]:2748: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.54.70.40
country_id: 3686110
description:
2026-01-08 07:05:51 dovecot_login authenticator failed for H=(static-ip-1815407040.cable.net.co) [181.54.70.40]:34618: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.30.86.18
country_id: 1522867
description:
2026-01-08 07:08:20 dovecot_login authenticator failed for H=([147.30.86.18]) [147.30.86.18]:46870: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.166
country_id: 2993457
description:
Jan  8 07:11:36 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=194.165.16.166, lip=66.85.158.92, session=<fKVigtZHVv7CpRCm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.37.32.248
country_id: 1269750
description:
2026-01-08 07:13:15 dovecot_login authenticator failed for H=([115.240.6.56]) [49.37.32.248]:59270: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.211.217.182
country_id: 1269750
description:
Jan  8 07:12:58 host2 sshd[4139773]: Disconnected from invalid user ubuntu 103.211.217.182 port 57608 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.185.37.239
country_id: 1269750
description:
2026-01-08 07:14:04 dovecot_login authenticator failed for H=([136.185.37.239]) [136.185.37.239]:37853: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.211.217.182
country_id: 1269750
description:
Jan  8 07:13:34 host2 sshd[4140626]: Disconnected from invalid user admin1 103.211.217.182 port 49062 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.68.52.210
country_id: 1269750
description:
2026-01-08 07:16:42 dovecot_login authenticator failed for H=([103.68.52.210]) [103.68.52.210]:36836: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.66.214.70
country_id: 1269750
description:
2026-01-08 07:17:01 dovecot_login authenticator failed for H=([182.66.214.70]) [182.66.214.70]:49876: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.116
country_id: 1269750
description:
2026-01-08 07:20:03 dovecot_login authenticator failed for H=(nsg-corporate-116.230.187.122.airtel.in) [122.187.230.116]:37798: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.143.166
country_id: 1819730
description:
2026-01-08 07:20:36 dovecot_login authenticator failed for H=166.143.48.116.static.netvigator.com [116.48.143.166]:53927: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.141
country_id: 6252001
description:
Jan  8 07:21:33 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 19 secs): user=<>, rip=66.132.153.141, lip=66.85.158.91, TLS handshaking: Connection closed, session=<7b/zpdZHuhpChJmN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.64.71.52
country_id: 3865483
description:
Jan  8 07:22:15 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=186.64.71.52, lip=66.85.158.91, TLS, session=<gtVPp9ZHydy6QEc0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.105
country_id: 6252001
description:
Jan  8 07:22:19 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=205.210.31.105, lip=66.85.158.91, TLS, session=<I2G1qNZHJuTN0h9p>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.170.24
country_id: 3175395
description:
Jan  8 07:22:33 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=185.15.170.24, lip=66.85.158.91, TLS, session=<xsqNqNZHbLa5D6oY>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 122.176.115.34
country_id: 1269750
description:
Jan  8 07:31:38 host2 sshd[4158078]: Disconnected from invalid user user1 122.176.115.34 port 54650 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.133.193.45
country_id: 2629691
description:
2026-01-08 07:32:16 dovecot_login authenticator failed for H=(ADMIN) [45.133.193.45]:15692: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.176.115.34
country_id: 1269750
description:
Jan  8 07:34:15 host2 sshd[4160479]: Disconnected from invalid user admin 122.176.115.34 port 44250 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.57
country_id: 1733045
description:
2026-01-08 07:38:32 dovecot_login authenticator failed for H=([49.124.151.57]) [49.124.151.57]:59252: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.149.26
country_id: 99237
description:
2026-01-08 07:38:44 dovecot_login authenticator failed for H=([65.20.149.26]) [65.20.149.26]:44124: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.1.47.28
country_id: 6252001
description:
Jan  8 07:40:41 host2 sshd[4166413]: Disconnected from invalid user deploy 128.1.47.28 port 60560 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.125.120.7
country_id: 2245662
description:
Jan  8 07:45:08 host2 sshd[4170116]: Disconnected from invalid user user 154.125.120.7 port 37749 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 128.1.47.28
country_id: 6252001
description:
Jan  8 07:45:06 host2 sshd[4170219]: Disconnected from invalid user user 128.1.47.28 port 51224 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.146.18
country_id: 1269750
description:
2026-01-08 07:45:04 dovecot_login authenticator failed for H=(nsg-corporate-127.152.185.122.airtel.in) [122.185.146.18]:39446: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.170.173.26
country_id: 1210997
description:
Jan  8 07:46:19 host2 sshd[4171609]: Disconnected from invalid user test 103.170.173.26 port 53917 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.114.243.85
country_id: 3625428
description:
2026-01-08 07:47:04 dovecot_login authenticator failed for H=([190.114.243.80]) [190.114.243.85]:48200: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.128.18
country_id: 3144096
description:
2026-01-08 07:46:47 dovecot_login authenticator failed for H=(cm-178.232.128.18.get.no) [178.232.128.18]:51528: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 180.252.148.249
country_id: 1643084
description:
Jan  8 07:46:53 host2 sshd[4172077]: Disconnected from invalid user admin 180.252.148.249 port 46688 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.125.120.7
country_id: 2245662
description:
Jan  8 07:47:27 host2 sshd[4172528]: Disconnected from invalid user deploy 154.125.120.7 port 35506 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.170.173.26
country_id: 1210997
description:
Jan  8 07:47:37 host2 sshd[4172677]: Disconnected from invalid user deploy 103.170.173.26 port 37381 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.136.43.74
country_id: 2017370
description:
Jan  8 07:48:30 host2 sshd[4173390]: Disconnected from invalid user admin1 103.136.43.74 port 52374 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.113.67.35
country_id: 1269750
description:
Jan  8 07:49:32 host2 sshd[4174227]: Disconnected from invalid user ubuntu 103.113.67.35 port 38802 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.113.67.35
country_id: 1269750
description:
Jan  8 07:51:28 host2 sshd[4176179]: Disconnected from invalid user admin1 103.113.67.35 port 53424 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.120.76
country_id: 1819730
description:
Jan  8 07:51:46 host2 sshd[4176347]: Disconnected from invalid user ubuntu 101.36.120.76 port 47416 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.113.67.35
country_id: 1269750
description:
Jan  8 07:53:17 host2 sshd[4177821]: Disconnected from invalid user user1 103.113.67.35 port 40870 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.120.76
country_id: 1819730
description:
Jan  8 07:52:36 host2 sshd[4177159]: Disconnected from invalid user test 101.36.120.76 port 44148 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 103.136.43.74
country_id: 2017370
description:
Jan  8 07:53:14 host2 sshd[4177790]: Received disconnect from 103.136.43.74 port 35266:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.136.43.74
country_id: 2017370
description:
Jan  8 07:54:15 host2 sshd[4179032]: Disconnected from invalid user ubuntu 103.136.43.74 port 60540 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.36.120.76
country_id: 1819730
description:
Jan  8 07:53:31 host2 sshd[4178034]: Disconnected from invalid user admin 101.36.120.76 port 49158 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.46.214.110
country_id: 3703430
description:
2026-01-08 07:54:36 dovecot_login authenticator failed for H=([200.46.214.104]) [200.46.214.110]:48116: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.36.204
country_id: 3144096
description:
2026-01-08 07:54:54 dovecot_login authenticator failed for H=(cm-178.232.36.204.get.no) [178.232.36.204]:46159: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 180.252.148.249
country_id: 1643084
description:
Jan  8 07:55:15 host2 sshd[4180183]: Disconnected from invalid user test 180.252.148.249 port 59794 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.129.153.122
country_id: 6252001
description:
2026-01-08 07:56:07 dovecot_login authenticator failed for H=(ADMIN) [102.129.153.122]:22413: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.169.40.221
country_id: 1269750
description:
2026-01-08 07:58:16 dovecot_login authenticator failed for H=(164-53-26-103.intechonline.net) [122.169.40.221]:50520: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 85.190.234.158
country_id: 3017382
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 85.190.234.158 - topviewuser "GET /execute/Email/list_pops?api.version=1 HTTP/1.1" FAILED LOGIN cpaneld: user name not provided or invalid user


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.252.85
country_id: 1210997
description:
2026-01-08 07:58:37 dovecot_login authenticator failed for H=([103.115.252.60]) [103.115.252.85]:37032: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.161.152
country_id: 298795
description:
2026-01-08 08:04:17 dovecot_login authenticator failed for H=([5.11.161.152]) [5.11.161.152]:53341: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  8 08:03:51 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (disconnected before auth was ready, waited 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<5HY/PddHopkDhBfJ>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  8 08:04:41 host2 sshd[4188702]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.109.56.74
country_id: 6252001
description:
2026-01-08 08:04:26 dovecot_login authenticator failed for H=(dfw-206-109-56-74.ip4.99.network) [206.109.56.74]:47218: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  8 08:05:18 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<PhlwQtdHYIUDhBfJ>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  8 08:06:07 host2 sshd[4190197]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  8 08:06:40 host2 dovecot[1170291]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS, session=<45ZbR9dHULQDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  8 08:07:52 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (disconnected before auth was ready, waited 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<VP2fS9dHpMkDhBfJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.41.173.77
country_id: 3017382
description:
2026-01-08 08:08:57 dovecot_login authenticator failed for H=77-173-41-213.cust.keyyo.net [213.41.173.77]:48133: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.194
country_id: 1269750
description:
2026-01-08 08:09:31 dovecot_login authenticator failed for H=([182.95.228.194]) [182.95.228.194]:37430: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  8 08:09:33 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS, session=<1BKkUddHkJsDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.73
country_id: 6252001
description:
Jan  8 08:15:20 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.73, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<KA1MZtdHQczN0h9J>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.181.107.134
country_id: 2264397
description:
2026-01-08 08:16:57 dovecot_login authenticator failed for H=89-181-107-134.net.novis.pt [89.181.107.134]:58468: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.185.170
country_id: 1269750
description:
2026-01-08 08:17:19 dovecot_login authenticator failed for H=([182.95.26.55]) [182.95.185.170]:46550: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.41.211.48
country_id: 6252001
description:
2026-01-08 08:18:34 dovecot_login authenticator failed for H=48.211.41.34.bc.googleusercontent.com [34.41.211.48]:34750: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.74.211.27
country_id: 6252001
description:
2026-01-08 08:19:06 dovecot_plain authenticator failed for H=c-75-74-211-27.hsd1.fl.comcast.net (spoly) [75.74.211.27]:52117: 535 Incorrect authentication data (set_id=it@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.86.54
country_id: 1269750
description:
2026-01-08 08:19:07 dovecot_login authenticator failed for H=([182.79.86.54]) [182.79.86.54]:57862: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-08 08:19:09 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (zinsh) [87.103.126.54]:65348: 535 Incorrect authentication data (set_id=it@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.213.230.122
country_id: 6252001
description:
2026-01-08 08:19:24 dovecot_login authenticator failed for H=([67.213.230.122]) [67.213.230.122]:53399: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.22.95.154
country_id: 6251999
description:
2026-01-08 08:20:57 dovecot_login authenticator failed for H=(ADMIN) [149.22.95.154]:59259: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.18.99.126
country_id: 1269750
description:
2026-01-08 08:20:59 dovecot_login authenticator failed for H=([125.18.99.126]) [125.18.99.126]:57856: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.133
country_id: 6252001
description:
Jan  8 08:21:26 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.133, lip=66.85.158.91, TLS: Connection closed, session=<iQYmfNdHekpChJmF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.164.148.87
country_id: 1512440
description:
2026-01-08 08:21:50 dovecot_login authenticator failed for H=([62.164.148.87]) [62.164.148.87]:53388: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.103.27.217
country_id: 390903
description:
2026-01-08 08:21:25 dovecot_login authenticator failed for H=owniyj.static.otenet.gr (lime36.static.otenet.gr) [62.103.27.217]:23452: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.8
country_id: 2186224
description:
2026-01-08 08:21:25 dovecot_login authenticator failed for H=([121.73.163.8]) [121.73.163.8]:41320: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.154.51.27
country_id: 1605651
description:
Jan  8 08:23:12 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=165.154.51.27, lip=66.85.158.91, session=<8Kt1gtdHONSlmjMb>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 165.154.51.27
country_id: 1605651
description:
Jan  8 08:23:13 host2 dovecot[1170291]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=165.154.51.27, lip=66.85.158.91, TLS, session=<yqqHgtdHLNWlmjMb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.216.58
country_id: 1269750
description:
2026-01-08 08:25:23 dovecot_login authenticator failed for H=([152.52.234.148]) [125.19.216.58]:46262: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.132.221.87
country_id: 1210997
description:
2026-01-08 08:25:50 dovecot_login authenticator failed for H=([103.132.220.252]) [103.132.221.87]:50542: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  8 08:26:48 host2 sshd[15043]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.100.156.38
country_id: 1605651
description:
2026-01-08 08:31:46 dovecot_login authenticator failed for H=mail.sotus.co.th [171.100.156.38]:32899: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.207.248.5
country_id: 3469034
description:
2026-01-08 08:31:58 dovecot_login authenticator failed for H=(mamanguape.static.gvt.net.br) [177.207.248.5]:55134: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  8 08:34:13 host2 sshd[21765]: Disconnected from invalid user admin 2.57.121.112 port 34669 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 141.94.237.134
country_id: 3017382
description:
Jan  8 08:39:01 host2 sshd[25930]: Disconnected from invalid user test 141.94.237.134 port 47428 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 141.94.237.134
country_id: 3017382
description:
Jan  8 08:39:57 host2 sshd[26677]: Disconnected from invalid user ubuntu 141.94.237.134 port 38914 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 141.94.237.134
country_id: 3017382
description:
Jan  8 08:40:31 host2 sshd[27439]: Disconnected from invalid user admin 141.94.237.134 port 37436 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 37.46.18.65
country_id: 6252001
description:
Jan  8 08:40:37 host2 sshd[27559]: Disconnected from invalid user test 37.46.18.65 port 60132 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.192.162
country_id: 1269750
description:
2026-01-08 08:42:16 dovecot_login authenticator failed for H=([125.19.171.114]) [152.52.192.162]:52256: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 37.46.18.65
country_id: 6252001
description:
Jan  8 08:42:24 host2 sshd[29201]: Disconnected from invalid user deploy 37.46.18.65 port 40318 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.118.138
country_id: 3144096
description:
2026-01-08 08:42:35 dovecot_login authenticator failed for H=([46.212.118.138]) [46.212.118.138]:60458: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 37.46.18.65
country_id: 6252001
description:
Jan  8 08:43:02 host2 sshd[29672]: Disconnected from invalid user admin 37.46.18.65 port 43170 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.90.120.152
country_id: 798549
description:
2026-01-08 08:43:06 dovecot_login authenticator failed for H=(ADMIN) [91.90.120.152]:39369: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.148.174.234
country_id: 2017370
description:
2026-01-08 08:47:28 dovecot_login authenticator failed for H=([31.148.174.234]) [31.148.174.234]:53450: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.221.122
country_id: 3144096
description:
2026-01-08 08:47:16 dovecot_login authenticator failed for H=(cm-178.232.221.122.get.no) [178.232.221.122]:45175: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 37.46.18.65
country_id: 6252001
description:
Jan  8 08:48:53 host2 sshd[36838]: Disconnected from invalid user admin 37.46.18.65 port 51860 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 37.46.18.65
country_id: 6252001
description:
Jan  8 08:49:34 host2 sshd[37547]: Disconnected from invalid user test 37.46.18.65 port 40564 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.196.10.62
country_id: 2635167
description:
Jan  8 08:50:47 host2 sshd[38816]: Disconnected from invalid user ubuntu 185.196.10.62 port 38884 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.68.22.140
country_id: 1269750
description:
2026-01-08 08:52:37 dovecot_login authenticator failed for H=([103.68.22.140]) [103.68.22.140]:57672: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.154.217.188
country_id: 690791
description:
2026-01-08 08:52:49 dovecot_login authenticator failed for H=ip-d9bc.d-net.kiev.ua [94.154.217.188]:55712: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.196.10.62
country_id: 2635167
description:
Jan  8 08:56:08 host2 sshd[44604]: Disconnected from invalid user deploy 185.196.10.62 port 53664 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.182.130
country_id: 1269750
description:
2026-01-08 08:58:33 dovecot_login authenticator failed for H=(mail1.i-megh.com) [182.95.182.130]:41210: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.88.102.128
country_id: 2661886
description:
2026-01-08 08:58:46 dovecot_login authenticator failed for H=([80.88.102.128]) [80.88.102.128]:57284: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.152.225.154
country_id: 6251999
description:
2026-01-08 08:59:12 dovecot_login authenticator failed for H=s75-152-225-154.ab.hsia.telus.net [75.152.225.154]:27779: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.196.10.62
country_id: 2635167
description:
Jan  8 08:58:27 host2 sshd[46704]: Disconnected from invalid user user 185.196.10.62 port 33122 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.187.2
country_id: 1269750
description:
2026-01-08 08:59:28 dovecot_login authenticator failed for H=(nsg-corporate-2.187.185.122.airtel.in) [122.185.187.2]:45394: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.121
country_id: 6252001
description:
Jan  8 09:01:27 host2 pure-ftpd[49578]: (?@66.132.153.121) [INFO] New connection from 66.132.153.121


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.179.134.120
country_id: 1269750
description:
2026-01-08 09:02:33 dovecot_login authenticator failed for H=(abts-mum-static-120.134.179.122.airtelbroadband.in) [122.179.134.120]:50220: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.194
country_id: 1269750
description:
2026-01-08 09:04:54 dovecot_login authenticator failed for H=([152.52.234.46]) [182.95.176.194]:39886: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.0.36.82
country_id: 1210997
description:
2026-01-08 09:05:26 dovecot_login authenticator failed for H=([49.0.36.82]) [49.0.36.82]:52572: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.46.115.28
country_id: 6290252
description:
2026-01-08 09:07:43 dovecot_login authenticator failed for H=(ADMIN) [37.46.115.28]:58736: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.31.40.212
country_id: 290557
description:
2026-01-08 09:08:36 dovecot_login authenticator failed for H=([5.31.40.212]) [5.31.40.212]:46676: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.61.22
country_id: 3144096
description:
2026-01-08 09:08:51 dovecot_login authenticator failed for H=(cm-178.232.61.22.get.no) [178.232.61.22]:46036: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.20.234.161
country_id: 587116
description:
2026-01-08 09:11:43 dovecot_login authenticator failed for H=([94.20.234.161]) [94.20.234.161]:55288: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.103.27.217
country_id: 390903
description:
2026-01-08 09:11:54 dovecot_login authenticator failed for H=owniyj.static.otenet.gr (ppp-2-85-77-70.home.otenet.gr) [62.103.27.217]:26315: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.194.231
country_id: 3144096
description:
2026-01-08 09:12:03 dovecot_login authenticator failed for H=(cm-178.232.194.231.get.no) [178.232.194.231]:34799: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.105.218.147
country_id: 1694008
description:
2026-01-08 09:11:25 dovecot_login authenticator failed for H=([124.105.219.170]) [124.105.218.147]:50422: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan  8 09:15:10 host2 sshd[61878]: Disconnected from invalid user user 2.57.121.25 port 12907 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.132.176.37
country_id: 2635167
description:
Jan  8 09:15:29 host2 sshd[62161]: Disconnected from invalid user admin1 51.132.176.37 port 47418 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.125
country_id: 1036973
description:
2026-01-08 09:18:03 dovecot_login authenticator failed for H=([196.28.226.125]) [196.28.226.125]:37776: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.89.159.59
country_id: 3865483
description:
2026-01-08 09:17:40 dovecot_login authenticator failed for H=(59-159-89-200.fibertel.com.ar) [200.89.159.59]:59968: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.132.176.37
country_id: 2635167
description:
Jan  8 09:19:08 host2 sshd[65288]: Disconnected from invalid user test 51.132.176.37 port 54964 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.132.176.37
country_id: 2635167
description:
Jan  8 09:20:17 host2 sshd[66416]: Disconnected from invalid user deploy 51.132.176.37 port 54072 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.136.164.157
country_id: 6252001
description:
2026-01-08 09:20:27 dovecot_login authenticator failed for H=c-76-136-164-157.hsd1.il.comcast.net [76.136.164.157]:53430: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.42.227.251
country_id: 3175395
description:
2026-01-08 09:20:33 dovecot_login authenticator failed for H=93-42-227-251.ip88.fastwebnet.it [93.42.227.251]:38892: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.170.59
country_id: 99237
description:
2026-01-08 09:20:40 dovecot_login authenticator failed for H=([65.20.170.59]) [65.20.170.59]:34329: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.210.38.204
country_id: 390903
description:
2026-01-08 09:21:24 dovecot_login authenticator failed for H=(149-210-38-204.mobile.nym.cosmote.net) [149.210.38.204]:58760: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.124.135.48
country_id: 3144096
description:
2026-01-08 09:22:22 dovecot_login authenticator failed for H=([188.124.135.48]) [188.124.135.48]:52682: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.167.90.67
country_id: 3508796
description:
Jan  8 09:22:34 host2 sshd[68467]: Disconnected from invalid user admin1 190.167.90.67 port 56654 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  8 09:23:34 host2 sshd[69290]: Disconnected from invalid user admin 2.57.121.112 port 25631 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.167.90.67
country_id: 3508796
description:
Jan  8 09:23:46 host2 sshd[69448]: Disconnected from invalid user deploy 190.167.90.67 port 60197 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.163.122.133
country_id: 1210997
description:
2026-01-08 09:24:03 dovecot_login authenticator failed for H=(IP-122-133.bol-online.com) [182.163.122.133]:11597: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.108.174.4
country_id: 3469034
description:
Jan  8 09:24:25 host2 sshd[69945]: Disconnected from invalid user user1 200.108.174.4 port 51750 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.200.42.112
country_id: 1880251
description:
2026-01-08 09:24:28 dovecot_login authenticator failed for H=([118.200.42.112]) [118.200.42.112]:57696: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 190.167.90.67
country_id: 3508796
description:
Jan  8 09:25:58 host2 sshd[71421]: Disconnected from invalid user deploy 190.167.90.67 port 55844 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 24.199.94.128
country_id: 6252001
description:
Jan  8 09:26:06 host2 sshd[71572]: Disconnected from invalid user ubuntu 24.199.94.128 port 45672 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 24.199.94.128
country_id: 6252001
description:
Jan  8 09:27:05 host2 sshd[72362]: Disconnected from invalid user user 24.199.94.128 port 43792 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.108.174.4
country_id: 3469034
description:
Jan  8 09:27:12 host2 sshd[72557]: Disconnected from invalid user user 200.108.174.4 port 50356 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 24.199.94.128
country_id: 6252001
description:
Jan  8 09:27:36 host2 sshd[72895]: Disconnected from invalid user ubuntu 24.199.94.128 port 35660 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.167.90.67
country_id: 3508796
description:
Jan  8 09:28:05 host2 sshd[73337]: Disconnected from invalid user ubuntu 190.167.90.67 port 47428 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.110.13.19
country_id: 2635167
description:
2026-01-08 09:29:35 dovecot_login authenticator failed for H=(ADMIN) [194.110.13.19]:33817: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 200.108.174.4
country_id: 3469034
description:
Jan  8 09:29:44 host2 sshd[74651]: Disconnected from invalid user admin 200.108.174.4 port 46876 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.8.218.251
country_id: 2661886
description:
2026-01-08 09:37:21 dovecot_login authenticator failed for H=([81.8.218.251]) [81.8.218.251]:49890: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.96.233.67
country_id: 6251999
description:
2026-01-08 09:37:49 dovecot_login authenticator failed for H=208-96-233-67.resi.cgocable.ca [208.96.233.67]:35586: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 46.105.235.55
country_id: 3017382
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 46.105.235.55 - lezzarotech "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarotech (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2026-01-08 09:42:38 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:57629: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.66
country_id: 6252001
description:
Jan  8 09:42:15 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 46 secs): user=<>, rip=147.185.133.66, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<e7AmndhHVseTuYVC>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  8 09:46:07 host2 sshd[89704]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  8 09:47:33 host2 sshd[91342]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.23.72.144
country_id: 6252001
description:
2026-01-08 09:48:04 dovecot_login authenticator failed for H=([209.23.72.144]) [209.23.72.144]:57604: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.132.19.77
country_id: 3932488
description:
Jan  8 09:48:14 host2 sshd[91884]: Disconnected from invalid user ubuntu 161.132.19.77 port 59444 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.70.126
country_id: 1269750
description:
2026-01-08 09:48:16 dovecot_login authenticator failed for H=(nsg-corporate-137.222.185.122.airtel.in) [182.78.70.126]:36230: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 175.100.24.139
country_id: 1831722
description:
Jan  8 09:48:46 host2 sshd[92205]: Disconnected from invalid user ubuntu 175.100.24.139 port 51868 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.161.114.113
country_id: 2017370
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 195.161.114.113 - lezzarotech "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarotech (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.66
country_id: 6252001
description:
Jan  8 09:49:52 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.133.66, lip=66.85.158.91, TLS, session=<Na5nuNhHBOuTuYVC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.161.196.5
country_id: 99237
description:
2026-01-08 09:50:11 dovecot_login authenticator failed for H=([46.161.196.5]) [46.161.196.5]:33384: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.161.137
country_id: 3144096
description:
2026-01-08 09:51:03 dovecot_login authenticator failed for H=([62.97.161.137]) [62.97.161.137]:39142: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.60.144.54
country_id: 2510769
description:
2026-01-08 09:50:25 dovecot_login authenticator failed for H=(47-60-144-54.red-acceso.airtel.net) [47.60.144.54]:49447: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.91.113.248
country_id: 6252001
description:
2026-01-08 09:50:35 dovecot_login authenticator failed for H=(syn-172-091-113-248.res.spectrum.com) [172.91.113.248]:39984: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 161.132.19.77
country_id: 3932488
description:
Jan  8 09:51:28 host2 sshd[94685]: Disconnected from invalid user test 161.132.19.77 port 51606 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.206.51
country_id: 3144096
description:
2026-01-08 09:55:05 dovecot_login authenticator failed for H=(cm-178.232.206.51.get.no) [178.232.206.51]:58745: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.67.45.29
country_id: 2661886
description:
2026-01-08 09:55:15 dovecot_login authenticator failed for H=213-67-45-29-no600.tbcn.telia.com [213.67.45.29]:58016: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.221.194
country_id: 3144096
description:
2026-01-08 09:55:29 dovecot_login authenticator failed for H=([178.232.221.194]) [178.232.221.194]:49675: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.102.232.12
country_id: 3057568
description:
2026-01-08 09:55:31 dovecot_login authenticator failed for H=(ADMIN) [149.102.232.12]:61789: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.245.182
country_id: 1269750
description:
2026-01-08 09:55:40 dovecot_login authenticator failed for H=([152.52.234.134]) [125.20.245.182]:42492: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.16
country_id: 241170
description:
Jan  8 09:57:55 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.16, lip=66.85.158.91, session=<HX0T1dhHsLnE+2YQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.8.250.161
country_id: 3469034
description:
Jan  8 09:59:43 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=177.8.250.161, lip=66.85.158.91, TLS, session=<7XaO2thHOouxCPqh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.240.96.83
country_id: 3469034
description:
Jan  8 10:00:04 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=191.240.96.83, lip=66.85.158.91, TLS, session=</gLF29hHsLK/8GBT>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.83.135.122
country_id: 6251999
description:
2026-01-08 10:03:35 dovecot_login authenticator failed for H=([24.83.135.122]) [24.83.135.122]:37408: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.104.225.201
country_id: 6252001
description:
2026-01-08 10:04:10 dovecot_login authenticator failed for H=(syn-024-104-225-201.res.spectrum.com) [24.104.225.201]:51704: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 216.155.93.75
country_id: 3895114
description:
Jan  8 10:05:06 host2 sshd[109087]: Disconnected from invalid user admin 216.155.93.75 port 53332 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.144.20
country_id: 3996063
description:
2026-01-08 10:05:48 dovecot_login authenticator failed for H=([177.236.144.20]) [177.236.144.20]:53815: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.143
country_id: 6252001
description:
Jan  8 10:05:57 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.143, lip=66.85.158.91, TLS: Connection closed, session=<ByLl8dhHhJRChJmP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.161.137
country_id: 3144096
description:
2026-01-08 10:05:30 dovecot_login authenticator failed for H=(137-161-97-62.cust.smartcall.no) [62.97.161.137]:37616: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.1.105.105
country_id: 1269750
description:
2026-01-08 10:09:44 dovecot_login authenticator failed for H=([61.1.105.105]) [61.1.105.105]:52627: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.27.83
country_id: 1643084
description:
2026-01-08 10:10:09 dovecot_login authenticator failed for H=(ip-arana.net.id.as132673) [103.90.27.83]:56198: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 216.155.93.75
country_id: 3895114
description:
Jan  8 10:10:11 host2 sshd[113781]: Disconnected from invalid user user 216.155.93.75 port 38862 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 216.155.93.75
country_id: 3895114
description:
Jan  8 10:10:55 host2 sshd[114662]: Disconnected from invalid user user 216.155.93.75 port 45512 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.195.66
country_id: 1269750
description:
2026-01-08 10:11:53 dovecot_login authenticator failed for H=([125.19.195.66]) [125.19.195.66]:44688: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2026-01-08 10:12:06 dovecot_login authenticator failed for H=([197.219.228.242]) [197.219.228.242]:55030: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.46.214.110
country_id: 3703430
description:
2026-01-08 10:11:41 dovecot_login authenticator failed for H=(104.214.46.200.psinetpa.net) [200.46.214.110]:38102: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 82.23.183.33
country_id: 2921044
description:
Jan  8 10:13:47 host2 dovecot[1170291]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=82.23.183.33, lip=66.85.158.91, session=<zHvrDdlH6rJSF7ch>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.163.122.133
country_id: 1210997
description:
2026-01-08 10:14:32 dovecot_login authenticator failed for H=(IP-122-133.bol-online.com) [182.163.122.133]:57397: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.213.98
country_id: 1269750
description:
2026-01-08 10:14:51 dovecot_login authenticator failed for H=([128.185.241.123]) [152.52.213.98]:59176: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.231.243.28
country_id: 6252001
description:
2026-01-08 10:16:20 dovecot_login authenticator failed for H=([50.231.243.28]) [50.231.243.28]:59748: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.64.10
country_id: 1269750
description:
2026-01-08 10:19:11 dovecot_login authenticator failed for H=([125.18.244.137]) [182.78.64.10]:44880: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.135.117.245
country_id: 6252001
description:
2026-01-08 10:18:59 dovecot_login authenticator failed for H=107-135-117-245.lightspeed.livnmi.sbcglobal.net [107.135.117.245]:46571: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.68.52.210
country_id: 1269750
description:
2026-01-08 10:19:31 dovecot_login authenticator failed for H=([103.68.52.210]) [103.68.52.210]:37792: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.161.172
country_id: 3144096
description:
2026-01-08 10:20:25 dovecot_login authenticator failed for H=(172-161-97-62.cust.smartcall.no) [62.97.161.172]:48280: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.231.25.64
country_id: 3686110
description:
2026-01-08 10:20:52 dovecot_login authenticator failed for H=(1522312565.colombiatel.co) [152.231.25.64]:50950: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.124.174
country_id: 1269750
description:
2026-01-08 10:21:17 dovecot_login authenticator failed for H=([182.95.124.174]) [182.95.124.174]:50272: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.235.140.163
country_id: 2017370
description:
2026-01-08 10:21:43 dovecot_login authenticator failed for H=([37.235.140.163]) [37.235.140.163]:57358: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.239.84.72
country_id: 2635167
description:
2026-01-08 10:24:09 dovecot_login authenticator failed for H=(ADMIN) [193.239.84.72]:11634: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 77.83.39.144
country_id: 690791
description:
Jan  8 10:26:57 host2 sshd[129019]: Invalid user cloudtourssrilan_travel from 77.83.39.144 port 37148


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.108.162.24
country_id: 3469034
description:
2026-01-08 10:27:04 dovecot_login authenticator failed for H=([131.108.162.24]) [131.108.162.24]:34070: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.41.18
country_id: 1269750
description:
2026-01-08 10:27:31 dovecot_login authenticator failed for H=([182.95.20.13]) [122.187.41.18]:41496: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.168.244
country_id: 2186224
description:
2026-01-08 10:27:59 dovecot_login authenticator failed for H=([121.73.168.244]) [121.73.168.244]:52840: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.53.79.83
country_id: 1733045
description:
2026-01-08 10:32:17 dovecot_plain authenticator failed for H=(E1261D68V5UP6) [60.53.79.83]:57386: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.107
country_id: 6252001
description:
Jan  8 10:34:36 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 7 secs): user=<>, rip=147.185.132.107, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<ycpeWNlHttWTuYRr>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.107
country_id: 6252001
description:
Jan  8 10:35:43 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 3 secs): user=<>, rip=147.185.132.107, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<yg5cXNlHzuOTuYRr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.196.202.17
country_id: 3175395
description:
2026-01-08 10:37:21 dovecot_login authenticator failed for H=([2.196.202.17]) [2.196.202.17]:51316: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  8 10:41:21 host2 sshd[142777]: Disconnected from invalid user admin 2.57.121.112 port 30731 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.107
country_id: 6252001
description:
Jan  8 10:41:57 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.107, lip=66.85.158.92, TLS, session=<pKysctlHUPWTuYRr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.157.111.178
country_id: 453733
description:
Jan  8 10:43:09 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=185.157.111.178, lip=66.85.158.91, TLS, session=<6KP8ddlHjJe5nW+y>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.18
country_id: 241170
description:
Jan  8 10:44:23 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.18, lip=66.85.158.91, session=<O5A6e9lHeNXE+2YS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.255.215.138
country_id: 732800
description:
Jan  8 10:43:37 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=185.255.215.138, lip=66.85.158.91, TLS, session=<zm+qd9lHe625/9eK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.125.228.39
country_id: 2589581
description:
2026-01-08 10:43:47 dovecot_login authenticator failed for H=(ADMIN) [176.125.228.39]:55245: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.146.209
country_id: 3996063
description:
2026-01-08 10:44:41 dovecot_login authenticator failed for H=([177.236.146.209]) [177.236.146.209]:39920: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.65.146
country_id: 1269750
description:
2026-01-08 10:45:06 dovecot_login authenticator failed for H=(nsg-corporate-146.65.185.122.airtel.in) [122.185.65.146]:44128: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.17
country_id: 241170
description:
Jan  8 10:46:56 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.17, lip=66.85.158.91, session=<5pBihNlHYJbE+2YR>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.15
country_id: 241170
description:
Jan  8 10:47:38 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.15, lip=66.85.158.91, session=<c5rZhtlHCqzE+2YP>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.12
country_id: 798549
description:
Jan  8 10:48:26 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=85.217.149.12, lip=66.85.158.91, TLS: Connection closed, session=<kuvVidlHZOBV2ZUM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.12
country_id: 241170
description:
Jan  8 10:48:40 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.12, lip=66.85.158.91, session=<Y3yPitlHUrnE+2YM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.67.22
country_id: 1269750
description:
2026-01-08 10:48:42 dovecot_login authenticator failed for H=(nsg-corporate-246.50.185.122.airtel.in) [182.78.67.22]:57940: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.64.64.8
country_id: 2264397
description:
2026-01-08 10:49:02 dovecot_login authenticator failed for H=bl23-64-8.dsl.telepac.pt [144.64.64.8]:4874: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 62.171.146.247
country_id: 2921044
description:
[2026-01-08 10:49:09 +0530] info [cpaneld] 62.171.146.247 - lezzarot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarot (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.52
country_id: 6252001
description:
Jan  8 10:49:22 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.52, lip=66.85.158.92, session=<Z4cxjdlHVvKTuYQ0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.12
country_id: 798549
description:
Jan  8 10:48:31 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=85.217.149.12, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<C6wkitlH+sxV2ZUM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.81.229.181
country_id: 6252001
description:
2026-01-08 10:50:18 dovecot_login authenticator failed for H=(fabfibernet.com) [192.81.229.181]:58656: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.67.152.201
country_id: 1269750
description:
2026-01-08 10:49:48 dovecot_login authenticator failed for H=([103.67.152.201]) [103.67.152.201]:49564: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.102.122
country_id: 1269750
description:
2026-01-08 10:50:34 dovecot_login authenticator failed for H=([125.18.219.209]) [27.123.102.122]:46914: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Jan  8 10:50:38 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, TLS handshaking: Connection closed, session=<er+9kdlHELEDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Jan  8 10:52:07 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<jMMEl9lHCskDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Jan  8 10:52:31 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, TLS handshaking: Connection closed, session=<JCB3mNlHMMsDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Jan  8 10:53:35 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<mQA/nNlHroQDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Jan  8 10:55:13 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, TLS handshaking: Connection closed, session=<tiIcotlHAroDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Jan  8 10:56:43 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<KtZyp9lH/NcDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Jan  8 10:57:41 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<R9LvqtlHPpoDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Jan  8 10:59:19 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, TLS, session=<EW6/sNlHzsQDhpQ7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.14
country_id: 241170
description:
Jan  8 11:01:30 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.14, lip=66.85.158.91, session=<dwxXuNlH2t/E+2YO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.13
country_id: 241170
description:
Jan  8 11:04:22 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.13, lip=66.85.158.91, session=<Bsq1wtlHUtrE+2YN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.38.108
country_id: 3865483
description:
2026-01-08 11:06:14 dovecot_login authenticator failed for H=(ADMIN) [146.70.38.108]:40565: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 18.97.19.253
country_id: 6252001
description:
Jan  8 11:10:24 host2 dovecot[1170291]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=18.97.19.253, lip=66.85.158.91, session=<UVFr2NlHYLcSYRP9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.50.5.94
country_id: 1269750
description:
2026-01-08 11:12:08 dovecot_login authenticator failed for H=([103.50.5.94]) [103.50.5.94]:45326: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 159.16.201.242
country_id: 3996063
description:
2026-01-08 11:12:47 dovecot_login authenticator failed for H=([159.16.195.171]) [159.16.201.242]:53565: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.103.27.217
country_id: 390903
description:
2026-01-08 11:13:09 dovecot_login authenticator failed for H=owniyj.static.otenet.gr ([2.85.77.70]) [62.103.27.217]:64000: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 82.23.183.33
country_id: 2921044
description:
Jan  8 11:19:58 host2 dovecot[1170291]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=82.23.183.33, lip=66.85.158.92, session=<p8yf+tlHjNVSF7ch>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.58.83.146
country_id: 3175395
description:
2026-01-08 11:21:28 dovecot_login authenticator failed for H=([101.58.83.146]) [101.58.83.146]:63511: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.31.8.12
country_id: 614540
description:
2026-01-08 11:20:54 dovecot_login authenticator failed for H=([194.31.8.12]) [194.31.8.12]:52460: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.50.226.182
country_id: 3469034
description:
2026-01-08 11:21:15 dovecot_login authenticator failed for H=(187-50-226-182.customer.tdatabrasil.net.br) [187.50.226.182]:53188: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.94.66
country_id: 1269750
description:
2026-01-08 11:22:07 dovecot_login authenticator failed for H=([27.123.94.66]) [27.123.94.66]:49134: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.10.197.168
country_id: 2661886
description:
2026-01-08 11:22:30 dovecot_login authenticator failed for H=h-176-10-197-168.a444.priv.bahnhof.se [176.10.197.168]:51722: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 185.189.114.123
country_id: 719819
description:
Jan  8 11:25:48 host2 pure-ftpd[186639]: (?@185.189.114.123) [INFO] New connection from 185.189.114.123


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.90.126.143
country_id: 3703430
description:
Jan  8 11:25:49 host2 dovecot[1170291]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=91.90.126.143, lip=66.85.158.91, session=<VLOSD9pHytVbWn6P>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 146.70.65.4
country_id: 2328926
description:
Jan  8 11:25:49 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=146.70.65.4, lip=66.85.158.91, TLS, session=<LaWSD9pHIMCSRkEE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 95.181.239.140
country_id: 1227603
description:
Jan  8 11:25:50 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=95.181.239.140, lip=66.85.158.91, TLS handshaking: Connection closed, session=<qEWUD9pHEsBfte+M>


