# incident

plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.248.201.39
country_id: 1269750
description:
2026-01-16 03:29:30 dovecot_login authenticator failed for H=([117.248.201.39]) [117.248.201.39]:60996: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.167.160
country_id: 99237
description:
2026-01-16 03:29:44 dovecot_login authenticator failed for H=([65.20.167.160]) [65.20.167.160]:35617: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 170.80.65.140
country_id: 3469034
description:
Jan 16 03:30:33 host2 sshd[1894007]: Disconnected from invalid user prometheus 170.80.65.140 port 39302 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 123.58.209.224
country_id: 1819730
description:
Jan 16 03:32:48 host2 sshd[1896012]: Disconnected from invalid user role1 123.58.209.224 port 40590 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 170.80.65.140
country_id: 3469034
description:
Jan 16 03:32:59 host2 sshd[1896127]: Disconnected from invalid user role1 170.80.65.140 port 59180 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 170.80.65.140
country_id: 3469034
description:
Jan 16 03:33:36 host2 sshd[1896743]: Disconnected from invalid user ubnt 170.80.65.140 port 36686 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.15.115.240
country_id: 1605651
description:
Jan 16 03:33:53 host2 sshd[1896964]: Disconnected from invalid user jetty 209.15.115.240 port 39160 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 57.129.75.137
country_id: 2921044
description:
Jan 16 03:34:28 host2 sshd[1897471]: Disconnected from invalid user uniview 57.129.75.137 port 58610 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 92.191.96.115
country_id: 2510769
description:
Jan 16 03:34:48 host2 sshd[1897716]: Disconnected from invalid user rancher 92.191.96.115 port 54698 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 123.58.209.224
country_id: 1819730
description:
Jan 16 03:35:07 host2 sshd[1898179]: Disconnected from invalid user hikvision 123.58.209.224 port 38444 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 123.58.209.224
country_id: 1819730
description:
Jan 16 03:35:44 host2 sshd[1898737]: Disconnected from invalid user oper 123.58.209.224 port 43332 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 92.191.96.115
country_id: 2510769
description:
Jan 16 03:35:29 host2 sshd[1898532]: Disconnected from invalid user vpxuser 92.191.96.115 port 3682 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.15.115.240
country_id: 1605651
description:
Jan 16 03:36:15 host2 sshd[1899302]: Disconnected from invalid user avigilon 209.15.115.240 port 43534 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 209.15.115.240
country_id: 1605651
description:
Jan 16 03:36:50 host2 sshd[1899830]: Disconnected from invalid user webadmin 209.15.115.240 port 50098 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 57.129.75.137
country_id: 2921044
description:
Jan 16 03:36:21 host2 sshd[1899411]: Disconnected from invalid user nsroot 57.129.75.137 port 42582 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.127.222.185
country_id: 3057568
description:
2026-01-16 03:36:47 dovecot_login authenticator failed for H=adsl-dyn185.91-127-222.t-com.sk [91.127.222.185]:51589: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 129.0.111.246
country_id: 2233387
description:
2026-01-16 03:37:06 dovecot_login authenticator failed for H=(host-129.0.111.246.mtn.cm) [129.0.111.246]:52645: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.188.251
country_id: 290557
description:
2026-01-16 03:37:22 dovecot_plain authenticator failed for H=(hydroma) [91.73.188.251]:33014: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.220
country_id: 6252001
description:
Jan 16 03:40:11 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.220, lip=66.85.158.92, TLS, session=<nNsEfXRIoOnG6xjc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.226.240
country_id: 1269750
description:
2026-01-16 03:42:52 dovecot_login authenticator failed for H=(nsg-corporate-240.226.187.122.airtel.in) [122.187.226.240]:42568: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.43
country_id: 6252001
description:
Jan 16 03:42:57 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=205.210.31.43, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<747xhnRINc3N0h8r>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.6.101.246
country_id: 2510769
description:
2026-01-16 03:43:03 dovecot_login authenticator failed for H=246.red-88-6-101.staticip.rima-tde.net [88.6.101.246]:43651: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2026-01-16 03:43:43 dovecot_login authenticator failed for H=host-196-47-172-253.afnet.net [196.47.172.253]:34729: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.41.202.12
country_id: 6252001
description:
2026-01-16 03:43:51 dovecot_login authenticator failed for H=syn-071-041-202-012.biz.spectrum.com [71.41.202.12]:60623: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 66.116.204.139
country_id: 1269750
description:
Jan 16 03:44:41 host2 sshd[1907857]: User agentallianz from 66.116.204.139 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.213
country_id: 1269750
description:
2026-01-16 03:46:06 dovecot_login authenticator failed for H=(nsg-corporate-213.230.187.122.airtel.in) [122.187.230.213]:35419: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.106.49.149
country_id: 3932488
description:
2026-01-16 03:47:00 dovecot_login authenticator failed for H=([200.106.49.149]) [200.106.49.149]:49746: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 16 03:51:00 host2 sshd[1914965]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.248.43.99
country_id: 1831722
description:
Jan 16 03:51:31 host2 sshd[1915604]: Disconnected from invalid user naztec 103.248.43.99 port 52782 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.16
country_id: 6252001
description:
Jan 16 03:52:25 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=147.185.132.16, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<9Y3HqHRIK8+TuYQQ>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 143.244.47.59
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [webmaild] 143.244.47.59 - 587hr@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.150.243.22
country_id: 6252001
description:
2026-01-16 03:54:04 dovecot_plain authenticator failed for H=(eboloper) [12.150.243.22]:25177: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 64.225.40.153
country_id: 6252001
description:
Jan 16 03:54:09 host2 sshd[1918524]: User agentallianz from 64.225.40.153 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.248.43.99
country_id: 1831722
description:
Jan 16 03:53:32 host2 sshd[1917630]: Disconnected from invalid user honeywell 103.248.43.99 port 43570 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.110.213.247
country_id: 6251999
description:
Jan 16 03:53:43 host2 sshd[1917834]: Invalid user agronatureholdings from 143.110.213.247 port 57366


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 104.152.52.113
country_id: 6252001
description:
Jan 16 03:55:52 host2 pure-ftpd[1920592]: (?@104.152.52.113) [INFO] New connection from 104.152.52.113


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 104.152.52.103
country_id: 6252001
description:
Jan 16 03:55:52 host2 pure-ftpd[1920594]: (?@104.152.52.103) [INFO] New connection from 104.152.52.103


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2026-01-16 03:55:59 dovecot_login authenticator failed for H=([197.219.228.242]) [197.219.228.242]:60770: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.248.43.99
country_id: 1831722
description:
Jan 16 03:57:17 host2 sshd[1922152]: Disconnected from invalid user ipcop 103.248.43.99 port 51350 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.68.37.25
country_id: 2661886
description:
2026-01-16 04:04:13 dovecot_plain authenticator failed for H=78-68-37-25-no2560.tbcn.telia.com (nousesser) [78.68.37.25]:38738: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.110.213.247
country_id: 6251999
description:
Jan 16 04:15:29 host2 sshd[1942161]: Invalid user agronatureholdings from 143.110.213.247 port 55896


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.55.89.5
country_id: 1269750
description:
2026-01-16 04:17:00 dovecot_login authenticator failed for H=([103.55.89.5]) [103.55.89.5]:42666: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.34.49
country_id: 1269750
description:
2026-01-16 04:17:11 dovecot_login authenticator failed for H=([103.174.34.49]) [103.174.34.49]:60087: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.62
country_id: 6252001
description:
Jan 16 04:19:57 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=167.94.146.62, lip=66.85.158.91, TLS: Connection closed, session=<mH8/C3VIlgenXpI+>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 16 04:20:45 host2 sshd[1948334]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.105.21.148
country_id: 719819
description:
Jan 16 04:24:28 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=109.105.21.148, lip=66.85.158.91, TLS, session=<iftqGnVIEKBtaRWU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.46.192.20
country_id: 2510769
description:
2026-01-16 04:24:07 dovecot_login authenticator failed for H=([193.46.192.20]) [193.46.192.20]:48097: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.54
country_id: 1149361
description:
2026-01-16 04:24:25 dovecot_login authenticator failed for H=([149.54.62.54]) [149.54.62.54]:45063: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.118.34.213
country_id: 1269750
description:
Jan 16 04:24:32 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=45.118.34.213, lip=66.85.158.91, TLS, session=<RFKJGnVI3OQtdiLV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.177.113.59
country_id: 3175395
description:
Jan 16 04:24:51 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<env_eng>, method=PLAIN, rip=195.177.113.59, lip=66.85.158.91, TLS, session=<eia5G3VIvtPDsXE7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.56.246
country_id: 953987
description:
Jan 16 04:25:03 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 32 secs): user=<env_eng>, method=PLAIN, rip=102.129.56.246, lip=66.85.158.91, TLS, session=<IQ+dG3VIwtJmgTj2>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.68.37.25
country_id: 2661886
description:
2026-01-16 04:27:16 dovecot_plain authenticator failed for H=78-68-37-25-no2560.tbcn.telia.com (rapasoses) [78.68.37.25]:41460: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.193.112.85
country_id: 6252001
description:
2026-01-16 04:27:24 dovecot_plain authenticator failed for H=c-98-193-112-85.hsd1.il.comcast.net (anternally) [98.193.112.85]:33014: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.66.109.194
country_id: 932692
description:
2026-01-16 04:29:05 dovecot_login authenticator failed for H=([154.66.109.244]) [154.66.109.194]:44384: 535 Incorrect authentication data (set_id=postmaster@systemtec.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.27
country_id: 1733045
description:
2026-01-16 04:28:49 dovecot_login authenticator failed for H=([49.124.153.27]) [49.124.153.27]:52004: 535 Incorrect authentication data (set_id=postmaster@systemtec.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.220.10.60
country_id: 1269750
description:
2026-01-16 04:29:38 dovecot_login authenticator failed for H=(static.ftth.hpr.117.220.10.60.bsnl.in) [117.220.10.60]:51089: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 66.116.204.139
country_id: 1269750
description:
Jan 16 04:29:45 host2 sshd[1960024]: User agentallianz from 66.116.204.139 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.232.165.143
country_id: 798544
description:
Jan 16 04:32:36 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=91.232.165.143, lip=66.85.158.91, TLS, session=<sP97N3VIMohb6KWP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.26.178.119
country_id: 3175395
description:
Jan 16 04:32:53 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<careers>, method=PLAIN, rip=217.26.178.119, lip=66.85.158.91, TLS, session=<eJKOOHVIvanZGrJ3>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 186.80.18.158
country_id: 3686110
description:
Jan 16 04:35:51 host2 sshd[1964645]: Disconnected from invalid user admin 186.80.18.158 port 56396 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.80.18.158
country_id: 3686110
description:
Jan 16 04:37:32 host2 sshd[1965945]: Disconnected from invalid user ubuntu 186.80.18.158 port 60800 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 5.95.121.178
country_id: 3175395
description:
Jan 16 04:37:40 host2 sshd[1966029]: Disconnected from invalid user ubuntu 5.95.121.178 port 44842 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 5.95.121.178
country_id: 3175395
description:
Jan 16 04:38:39 host2 sshd[1966665]: Disconnected from invalid user admin 5.95.121.178 port 59412 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 91.231.89.202
country_id: 3017382
description:
Jan 16 04:42:27 host2 pure-ftpd[1969809]: (?@91.231.89.202) [INFO] New connection from 91.231.89.202


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 91.231.89.206
country_id: 3017382
description:
Jan 16 04:42:26 host2 pure-ftpd[1969803]: (?@91.231.89.206) [INFO] New connection from 91.231.89.206


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.123.219.82
country_id: 6252001
description:
2026-01-16 04:50:58 dovecot_plain authenticator failed for H=ool-457bdb52.dyn.optonline.net (mingwan) [69.123.219.82]:57343: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.68.220.15
country_id: 6252001
description:
2026-01-16 04:51:37 dovecot_plain authenticator failed for H=c-73-68-220-15.hsd1.ma.comcast.net (biliza) [73.68.220.15]:52432: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-16 04:51:40 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (chess) [87.103.126.54]:54090: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.83.130.80
country_id: 1269750
description:
2026-01-16 04:51:48 dovecot_login authenticator failed for H=(80.130.83.103.static.rapidnet.in) [103.83.130.80]:32936: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.177.70.52
country_id: 3624060
description:
2026-01-16 04:52:01 dovecot_login authenticator failed for H=([186.177.70.52]) [186.177.70.52]:53222: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.255.203.124
country_id: 2413451
description:
2026-01-16 04:58:49 dovecot_login authenticator failed for H=(197-255-203-124.netpagedns.net) [197.255.203.124]:44849: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.23.125.83
country_id: 6252001
description:
2026-01-16 04:58:58 dovecot_plain authenticator failed for H=c-24-23-125-83.hsd1.pa.comcast.net (coriacery) [24.23.125.83]:34744: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.218.95.154
country_id: 6252001
description:
2026-01-16 04:59:02 dovecot_login authenticator failed for H=syn-074-218-095-154.biz.spectrum.com [74.218.95.154]:34217: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.219.154.156
country_id: 2750405
description:
2026-01-16 04:59:24 dovecot_login authenticator failed for H=([103.219.154.156]) [103.219.154.156]:38262: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.82.194
country_id: 1269750
description:
2026-01-16 04:59:39 dovecot_login authenticator failed for H=([59.145.171.168]) [182.78.82.194]:39940: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.156.0.88
country_id: 3144096
description:
2026-01-16 05:01:07 dovecot_login authenticator failed for H=(cm-78.156.0.88.get.no) [78.156.0.88]:42853: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.245.182
country_id: 1269750
description:
2026-01-16 05:00:53 dovecot_login authenticator failed for H=([182.78.255.201]) [125.20.245.182]:50296: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.219.38
country_id: 1269750
description:
2026-01-16 05:02:15 dovecot_login authenticator failed for H=([128.185.219.38]) [128.185.219.38]:34078: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.166.54.40
country_id: 453733
description:
2026-01-16 05:02:46 dovecot_login authenticator failed for H=40-54-166-83.dyn.estpak.ee [83.166.54.40]:48796: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 141.11.167.241
country_id: 2750405
description:
Jan 16 05:05:18 host2 sshd[1987799]: Disconnected from invalid user peoplesoft 141.11.167.241 port 39250 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 161.132.53.88
country_id: 3932488
description:
Jan 16 05:07:36 host2 sshd[1989409]: Disconnected from invalid user manager 161.132.53.88 port 45868 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.132.53.88
country_id: 3932488
description:
Jan 16 05:08:41 host2 sshd[1990156]: Disconnected from invalid user informix 161.132.53.88 port 39394 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 137.59.55.50
country_id: 1269750
description:
Jan 16 05:08:58 host2 sshd[1990352]: Disconnected from invalid user victor 137.59.55.50 port 37409 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.149.27.208
country_id: 1819730
description:
Jan 16 05:09:52 host2 sshd[1991098]: Disconnected from invalid user haproxy 103.149.27.208 port 46744 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 202.152.201.166
country_id: 1643084
description:
Jan 16 05:11:04 host2 sshd[1992619]: Disconnected from invalid user vnc 202.152.201.166 port 52486 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.152.201.166
country_id: 1643084
description:
Jan 16 05:10:27 host2 sshd[1991990]: Disconnected from invalid user gitlab-runner 202.152.201.166 port 41710 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.40.189.43
country_id: 6252001
description:
2026-01-16 05:10:27 dovecot_plain authenticator failed for H=c-68-40-189-43.hsd1.mi.comcast.net (baculne) [68.40.189.43]:36248: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.41
country_id: 2750405
description:
2026-01-16 05:10:33 dovecot_login authenticator failed for H=(Copy-of-VM-2022) [45.94.31.41]:13950: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 137.59.55.50
country_id: 1269750
description:
Jan 16 05:10:59 host2 sshd[1992489]: Disconnected from invalid user hudson 137.59.55.50 port 53136 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.152.201.166
country_id: 1643084
description:
Jan 16 05:11:41 host2 sshd[1993346]: Disconnected from invalid user upload 202.152.201.166 port 34932 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 137.59.55.50
country_id: 1269750
description:
Jan 16 05:12:31 host2 sshd[1994167]: Disconnected from invalid user netgear 137.59.55.50 port 48424 [preauth]


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 66.116.204.139
country_id: 1269750
description:
Jan 16 05:14:28 host2 sshd[1996247]: User agentallianz from 66.116.204.139 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.149.27.208
country_id: 1819730
description:
Jan 16 05:15:03 host2 sshd[1996837]: Disconnected from invalid user upload 103.149.27.208 port 38274 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.149.27.208
country_id: 1819730
description:
Jan 16 05:15:36 host2 sshd[1997418]: Disconnected from invalid user client 103.149.27.208 port 51056 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.102.242
country_id: 290557
description:
2026-01-16 05:16:02 dovecot_plain authenticator failed for H=(mishilize) [80.227.102.242]:60883: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 52.165.81.251
country_id: 6252001
description:
Jan 16 05:17:34 host2 pure-ftpd[1999508]: (?@52.165.81.251) [INFO] New connection from 52.165.81.251


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-01-16 05:24:18 dovecot_plain authenticator failed for H=(sangs) [64.72.74.162]:52398: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 16 05:27:48 host2 sshd[2010000]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.218.57.50
country_id: 3996063
description:
2026-01-16 05:31:07 dovecot_login authenticator failed for H=(customer-187-218-57-50.uninet-ide.com.mx) [187.218.57.50]:64026: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.159.164.28
country_id: 294640
description:
2026-01-16 05:31:20 dovecot_login authenticator failed for H=([85.159.164.28]) [85.159.164.28]:57598: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.177.9.119
country_id: 3865483
description:
2026-01-16 05:34:32 dovecot_login authenticator failed for H=(181-177-9-119.fiberway.com.ar) [181.177.9.119]:43534: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 66.116.204.139
country_id: 1269750
description:
Jan 16 05:36:30 host2 sshd[2016513]: User agentallianz from 66.116.204.139 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.102.246.17
country_id: 390903
description:
2026-01-16 05:40:12 dovecot_plain authenticator failed for H=(DESKTOP-FF50JKH.localdomain) [149.102.246.17]:34741: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.17.124.75
country_id: 1269750
description:
2026-01-16 05:40:14 dovecot_login authenticator failed for H=([14.96.29.14]) [125.17.124.75]:60900: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.102.246.17
country_id: 390903
description:
2026-01-16 05:40:18 dovecot_login authenticator failed for H=(DESKTOP-FF50JKH.localdomain) [149.102.246.17]:34741: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.170.42.208
country_id: 1269750
description:
2026-01-16 05:40:27 dovecot_login authenticator failed for H=(abts-mum-dynamic-208.42.170.122.airtelbroadband.in) [122.170.42.208]:42108: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 185.93.89.48
country_id: 130758
description:
Jan 16 05:42:12 host2 sshd[2020688]: User agentallianz from 185.93.89.48 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.160.139.163
country_id: 2510769
description:
2026-01-16 05:41:20 dovecot_plain authenticator failed for H=(whietiost) [90.160.139.163]:37623: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.249.7.27
country_id: 1512440
description:
Jan 16 05:43:41 host2 sshd[2021772]: Disconnected from invalid user prometheus 138.249.7.27 port 35022 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.183.98
country_id: 1269750
description:
2026-01-16 05:44:28 dovecot_login authenticator failed for H=(nsg-static-025.8.72.182.airtel.in) [125.23.183.98]:44576: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.196.184.78
country_id: 6252001
description:
2026-01-16 05:44:45 dovecot_login authenticator failed for H=([74.196.184.78]) [74.196.184.78]:40565: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan 16 05:47:45 host2 sshd[2024991]: Disconnected from invalid user user 2.57.121.25 port 22300 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.41.173.77
country_id: 3017382
description:
2026-01-16 05:48:55 dovecot_login authenticator failed for H=77-173-41-213.cust.keyyo.net [213.41.173.77]:49074: 535 Incorrect authentication data (set_id=reserve)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.90.128.97
country_id: 6252001
description:
2026-01-16 05:48:29 dovecot_login authenticator failed for H=(syn-172-090-128-097.res.spectrum.com) [172.90.128.97]:52552: 535 Incorrect authentication data (set_id=reserve@jrdc.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 95.130.227.106
country_id: 1512440
description:
Jan 16 05:48:54 host2 sshd[2026166]: Disconnected from invalid user apache 95.130.227.106 port 44390 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 138.249.7.27
country_id: 1512440
description:
Jan 16 05:50:06 host2 sshd[2027174]: Disconnected from invalid user acti 138.249.7.27 port 54080 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.178.70
country_id: 1269750
description:
2026-01-16 05:49:31 dovecot_login authenticator failed for H=([182.79.95.167]) [122.185.178.70]:35154: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.166
country_id: 1269750
description:
2026-01-16 05:51:14 dovecot_login authenticator failed for H=(nsg-static-089.96.71.182.airtel.in) [182.95.181.166]:53850: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.202.90
country_id: 1880251
description:
Jan 16 05:50:25 host2 sshd[2027440]: Disconnected from invalid user cloud 45.78.202.90 port 57566 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.210.214.171
country_id: 3144096
description:
2026-01-16 05:51:30 dovecot_login authenticator failed for H=(cm-84.210.214.171.get.no) [84.210.214.171]:57621: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.202.90
country_id: 1880251
description:
Jan 16 05:54:04 host2 sshd[2030053]: Disconnected from invalid user scott 45.78.202.90 port 60028 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.122.96.199
country_id: 3996063
description:
Jan 16 05:53:35 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<training@v-deploy.com>, method=PLAIN, rip=138.122.96.199, lip=66.85.158.91, TLS, session=<h8QPWXZIPJeKemDH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.226.113.94
country_id: 3057568
description:
Jan 16 05:53:35 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<training@v-deploy.com>, method=PLAIN, rip=91.226.113.94, lip=66.85.158.91, TLS, session=<2ioNWXZIi6Zb4nFe>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.216.88.74
country_id: 3469034
description:
Jan 16 05:53:57 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<training>, method=PLAIN, rip=186.216.88.74, lip=66.85.158.91, TLS, session=<dLlGWnZIbc662FhK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.183.221.168
country_id: 6252001
description:
2026-01-16 05:56:36 dovecot_login authenticator failed for H=wsip-70-183-221-168.br.br.cox.net [70.183.221.168]:53793: 535 Incorrect authentication data (set_id=abuse@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 16 05:57:41 host2 sshd[2033678]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 185.93.89.48
country_id: 130758
description:
Jan 16 05:56:57 host2 sshd[2033032]: User agentallianz from 185.93.89.48 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.64
country_id: 6252001
description:
Jan 16 05:57:04 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=147.185.132.64, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<ZKeSZnZIkdqTuYRA>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.168.161
country_id: 2186224
description:
2026-01-16 05:57:34 dovecot_login authenticator failed for H=([121.73.168.161]) [121.73.168.161]:32894: 535 Incorrect authentication data (set_id=abuse@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.31.8.12
country_id: 614540
description:
2026-01-16 05:58:35 dovecot_login authenticator failed for H=([194.31.8.12]) [194.31.8.12]:59665: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.168.148
country_id: 337996
description:
2026-01-16 05:58:52 dovecot_login authenticator failed for H=([196.188.168.148]) [196.188.168.148]:54558: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.48
country_id: 6252001
description:
Jan 16 05:58:15 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=167.94.146.48, lip=66.85.158.92, TLS: Connection closed, session=<qfbSanZIvHqnXpIw>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.110.213.247
country_id: 6251999
description:
Jan 16 05:59:23 host2 sshd[2034753]: Invalid user agronatureholdings from 143.110.213.247 port 54426


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 66.116.204.139
country_id: 1269750
description:
Jan 16 05:59:54 host2 sshd[2035037]: User agentallianz from 66.116.204.139 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 64.225.40.153
country_id: 6252001
description:
Jan 16 06:00:36 host2 sshd[2035799]: User agentallianz from 64.225.40.153 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.161
country_id: 2993457
description:
Jan 16 06:02:21 host2 dovecot[221878]: imap-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=194.165.16.161, lip=66.85.158.91, session=<hDl1eXZIdf/CpRCh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.145.122.196
country_id: 3175395
description:
2026-01-16 06:02:23 dovecot_login authenticator failed for H=([82.145.122.196]) [82.145.122.196]:51636: 535 Incorrect authentication data (set_id=abuse@agentallianz.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.235.226.154
country_id: 294640
description:
2026-01-16 06:02:50 dovecot_login authenticator failed for H=([147.235.226.154]) [147.235.226.154]:40076: 535 Incorrect authentication data (set_id=abuse)


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan 16 06:04:09 host2 sshd[2038344]: User agentallianz from 35.186.147.126 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 162.240.229.246
country_id: 6252001
description:
Jan 16 06:08:21 host2 sshd[2041174]: User agentallianz from 162.240.229.246 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 208.69.84.112
country_id: 6252001
description:
Jan 16 06:15:37 host2 sshd[2046486]: Disconnected from invalid user ruckus 208.69.84.112 port 48752 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.74.136.134
country_id: 6252001
description:
2026-01-16 06:16:05 dovecot_plain authenticator failed for H=syn-050-074-136-134.biz.spectrum.com (conste) [50.74.136.134]:35270: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 130.250.191.237
country_id: 1269750
description:
Jan 16 06:17:11 host2 sshd[2047481]: Disconnected from invalid user mobotix 130.250.191.237 port 49366 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 130.250.191.237
country_id: 1269750
description:
Jan 16 06:18:24 host2 sshd[2048242]: Disconnected from invalid user suraj 130.250.191.237 port 49944 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.227.119.165
country_id: 2921044
description:
Jan 16 06:18:41 host2 dovecot[221878]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=64.227.119.165, lip=66.85.158.91, TLS, session=<aKXhs3ZIguRA43el>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 208.69.84.112
country_id: 6252001
description:
Jan 16 06:19:15 host2 sshd[2048925]: Disconnected from invalid user gitea 208.69.84.112 port 32958 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 208.69.84.112
country_id: 6252001
description:
Jan 16 06:19:47 host2 sshd[2049281]: Disconnected from invalid user ADMIN 208.69.84.112 port 45684 [preauth]


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan 16 06:25:46 host2 sshd[2053742]: User agentallianz from 35.186.147.126 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.182.130
country_id: 1269750
description:
2026-01-16 06:29:57 dovecot_login authenticator failed for H=(mail1.i-megh.com) [182.95.182.130]:46398: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.183.74.177
country_id: 6252001
description:
2026-01-16 06:29:19 dovecot_plain authenticator failed for H=c-73-183-74-177.hsd1.pa.comcast.net (matiter) [73.183.74.177]:39994: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.175.24.142
country_id: 6252001
description:
2026-01-16 06:29:42 dovecot_login authenticator failed for H=(ip4.gtt.net) [65.175.24.142]:46188: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.159.186
country_id: 1269750
description:
2026-01-16 06:36:57 dovecot_login authenticator failed for H=([125.19.159.186]) [125.19.159.186]:33636: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 185.93.89.48
country_id: 130758
description:
Jan 16 06:43:57 host2 sshd[2067085]: User agentallianz from 185.93.89.48 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 66.116.204.139
country_id: 1269750
description:
Jan 16 06:45:26 host2 sshd[2068768]: User agentallianz from 66.116.204.139 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan 16 06:47:53 host2 sshd[2070674]: User agentallianz from 35.186.147.126 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.164.137
country_id: 99237
description:
2026-01-16 06:48:47 dovecot_plain authenticator failed for H=(imbulter) [65.20.164.137]:43283: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.129.31.42
country_id: 3686110
description:
2026-01-16 06:53:18 dovecot_login authenticator failed for H=(adsl-181-129-31-42.une.net.co) [181.129.31.42]:47451: 535 Incorrect authentication data (set_id=abuse@visionsolutionshospital.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.78.16.88
country_id: 2661886
description:
2026-01-16 06:53:34 dovecot_login authenticator failed for H=a088.broadband.quicknet.se [217.78.16.88]:48320: 535 Incorrect authentication data (set_id=abuse)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.237.134
country_id: 1269750
description:
2026-01-16 06:54:23 dovecot_login authenticator failed for H=(aes-static-097.196.22.125.airtel.in) [125.23.237.134]:59092: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.15.149.254
country_id: 3469034
description:
2026-01-16 06:54:56 dovecot_login authenticator failed for H=(201-15-149-254.pltce300.ipd.brasiltelecom.net.br) [201.15.149.254]:58748: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.246.255.183
country_id: 294640
description:
2026-01-16 07:03:26 dovecot_login authenticator failed for H=([185.246.255.183]) [185.246.255.183]:45532: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.203.231.220
country_id: 2464461
description:
2026-01-16 07:04:08 dovecot_login authenticator failed for H=([196.203.231.220]) [196.203.231.220]:49612: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan 16 07:05:24 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@seyawin.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<Wl7QWndI87p100Db>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 16 07:07:38 host2 sshd[2087957]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 16 07:08:27 host2 sshd[2088729]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.64.68.99
country_id: 1643084
description:
Jan 16 07:08:53 host2 sshd[2088984]: Disconnected from invalid user hp 36.64.68.99 port 39114 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 50.232.189.209
country_id: 6252001
description:
Jan 16 07:09:10 host2 sshd[2089210]: Disconnected from invalid user sol 50.232.189.209 port 55280 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.64.68.99
country_id: 1643084
description:
Jan 16 07:11:50 host2 sshd[2091373]: Disconnected from invalid user arista 36.64.68.99 port 52560 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 36.64.68.99
country_id: 1643084
description:
Jan 16 07:13:00 host2 sshd[2092573]: Disconnected from invalid user sol 36.64.68.99 port 59068 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.64.68.99
country_id: 1643084
description:
Jan 16 07:12:25 host2 sshd[2091934]: Disconnected from invalid user vncuser 36.64.68.99 port 37810 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.64.68.99
country_id: 1643084
description:
Jan 16 07:13:34 host2 sshd[2093140]: Disconnected from invalid user utente 36.64.68.99 port 36898 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.108.79.119
country_id: 3686110
description:
Jan 16 07:14:26 host2 sshd[2093770]: Disconnected from invalid user ubuntu 190.108.79.119 port 20138 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 144.217.13.134
country_id: 6251999
description:
Jan 16 07:16:14 host2 sshd[2095542]: Disconnected from invalid user admin 144.217.13.134 port 33676 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 190.108.79.119
country_id: 3686110
description:
Jan 16 07:15:42 host2 sshd[2095000]: Disconnected from invalid user ubuntu 190.108.79.119 port 13419 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.216.63.127
country_id: 1835841
description:
Jan 16 07:15:57 host2 sshd[2095237]: Disconnected from invalid user ubuntu 35.216.63.127 port 40404 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 144.217.13.134
country_id: 6251999
description:
Jan 16 07:17:09 host2 sshd[2096466]: Disconnected from invalid user ubuntu 144.217.13.134 port 54188 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.216.63.127
country_id: 1835841
description:
Jan 16 07:17:16 host2 sshd[2096576]: Disconnected from invalid user admin 35.216.63.127 port 21960 [preauth]


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 185.93.89.48
country_id: 130758
description:
Jan 16 07:16:20 host2 sshd[2095644]: User agentallianz from 185.93.89.48 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 16 07:17:47 host2 sshd[2097064]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.157.223.37
country_id: 1643084
description:
Jan 16 07:17:59 host2 sshd[2097237]: Disconnected from invalid user ubuntu 43.157.223.37 port 49072 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.30.81.25
country_id: 1269750
description:
Jan 16 07:17:21 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=103.30.81.25, lip=66.85.158.91, TLS, session=<2B2FhHdILZ1nHlEZ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 144.217.13.134
country_id: 6251999
description:
Jan 16 07:17:37 host2 sshd[2096896]: Disconnected from invalid user ubuntu 144.217.13.134 port 41830 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.53.129.253
country_id: 3469034
description:
Jan 16 07:17:44 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<env_eng>, method=PLAIN, rip=191.53.129.253, lip=66.85.158.91, TLS, session=<ChHmhXdIiKq/NYH9>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.108.79.119
country_id: 3686110
description:
Jan 16 07:18:20 host2 sshd[2097561]: Disconnected from invalid user ubuntu 190.108.79.119 port 39025 [preauth]


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 64.225.40.153
country_id: 6252001
description:
Jan 16 07:19:32 host2 sshd[2098588]: User agentallianz from 64.225.40.153 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.216.63.127
country_id: 1835841
description:
Jan 16 07:21:46 host2 sshd[2100722]: Disconnected from invalid user ubuntu 35.216.63.127 port 16224 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.246.106
country_id: 1269750
description:
2026-01-16 07:22:01 dovecot_login authenticator failed for H=([125.16.255.97]) [125.20.246.106]:46706: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 35.216.63.127
country_id: 1835841
description:
Jan 16 07:22:24 host2 sshd[2101438]: Disconnected from invalid user ubuntu 35.216.63.127 port 60450 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.186.54.65
country_id: 298795
description:
2026-01-16 07:22:20 dovecot_login authenticator failed for H=(78.186.54.65.static.ttnet.com.tr) [78.186.54.65]:51314: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.169.105.32
country_id: 6252001
description:
Jan 16 07:25:42 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.169.105.32, lip=66.85.158.91, session=<gOuJo3dI8tIUqWkg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.224.10
country_id: 1269750
description:
2026-01-16 07:30:15 dovecot_login authenticator failed for H=([125.20.224.10]) [125.20.224.10]:43170: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.239.218.115
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 173.239.218.115 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilan_travel (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.183.110.215
country_id: 798544
description:
2026-01-16 07:31:06 dovecot_login authenticator failed for H=178.183.110.215.mobile.static.t-mobile.pl [178.183.110.215]:44504: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 66.116.204.139
country_id: 1269750
description:
Jan 16 07:31:15 host2 sshd[2110141]: User agentallianz from 66.116.204.139 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 181.16.212.54
country_id: 3865483
description:
Jan 16 07:33:19 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=181.16.212.54, lip=66.85.158.91, TLS, session=<BM+RvXdIp8+1ENQ2>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.196.110.87
country_id: 798544
description:
Jan 16 07:33:36 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<careers>, method=PLAIN, rip=91.196.110.87, lip=66.85.158.91, TLS, session=<itzavndIq+hbxG5X>


