# incident

plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.92.124.2
country_id: 1269750
description:
2026-01-13 15:03:41 dovecot_login authenticator failed for H=(static.bb.ill.59.92.124.2.bsnl.in) [59.92.124.2]:58877: 535 Incorrect authentication data (set_id=postmaster@kamecho.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.148.194
country_id: 99237
description:
2026-01-13 15:04:01 dovecot_plain authenticator failed for H=(ditheely) [65.20.148.194]:51167: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.46.45.121
country_id: 290557
description:
2026-01-13 15:04:02 dovecot_login authenticator failed for H=([20.46.45.121]) [20.46.45.121]:64899: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.51
country_id: 3144096
description:
2026-01-13 15:03:29 dovecot_login authenticator failed for H=(51-170-97-62.cust.smartcall.no) [62.97.170.51]:38884: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 64.23.194.146
country_id: 6252001
description:
Jan 13 15:04:06 host2 pure-ftpd[2993295]: (?@64.23.194.146) [INFO] New connection from 64.23.194.146


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 159.203.59.222
country_id: 6251999
description:
Jan 13 15:05:35 host2 pure-ftpd[2994647]: (?@159.203.59.222) [INFO] New connection from 159.203.59.222


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.22.78.221
country_id: 2921044
description:
Jan 13 15:07:56 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=165.22.78.221, lip=66.85.158.91, TLS, session=<1+gUv0FIFNKlFk7d>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.22.78.221
country_id: 2921044
description:
Jan 13 15:08:07 host2 dovecot[3239883]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=165.22.78.221, lip=66.85.158.91, session=<uk+7v0FIolalFk7d>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 103.174.102.191
country_id: 1269750
description:
Jan 13 15:11:28 host2 pure-ftpd[2999468]: (?@103.174.102.191) [INFO] New connection from 103.174.102.191


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 183.81.170.93
country_id: 2029969
description:
Jan 13 15:13:02 host2 pure-ftpd[3000835]: (?@183.81.170.93) [INFO] New connection from 183.81.170.93


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 155.4.245.222
country_id: 2661886
description:
Jan 13 15:13:28 host2 sshd[3001163]: Disconnected from invalid user ftpuser 155.4.245.222 port 17986 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.232.119.77
country_id: 2921044
description:
Jan 13 15:13:30 host2 pure-ftpd[3001230]: (?@165.232.119.77) [INFO] New connection from 165.232.119.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.138.164.119
country_id: 2661886
description:
2026-01-13 15:13:55 dovecot_plain authenticator failed for H=79.138.164.119.mobile.tre.se (preed) [79.138.164.119]:54302: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.57.170.188
country_id: 3175395
description:
2026-01-13 15:14:50 dovecot_plain authenticator failed for H=([100.64.100.6]) [2.57.170.188]:11776: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 155.4.245.222
country_id: 2661886
description:
Jan 13 15:15:39 host2 sshd[3003223]: Disconnected from invalid user mailuser 155.4.245.222 port 35196 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 155.4.245.222
country_id: 2661886
description:
Jan 13 15:16:14 host2 sshd[3003672]: Disconnected from invalid user rstudio 155.4.245.222 port 26611 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.237.173.220
country_id: 6252001
description:
Jan 13 15:17:41 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.237.173.220, lip=66.85.158.92, TLS, session=<47b34UFIvuwD7a3c>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.208.156.167
country_id: 241170
description:
Jan 13 15:18:18 host2 sshd[3005294]: Disconnected from invalid user admin 185.208.156.167 port 39818 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.208.156.167
country_id: 241170
description:
Jan 13 15:20:03 host2 sshd[3007018]: Disconnected from invalid user devuser 185.208.156.167 port 55366 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.208.156.167
country_id: 241170
description:
Jan 13 15:20:38 host2 sshd[3007746]: Disconnected from invalid user b 185.208.156.167 port 57630 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 164.90.155.129
country_id: 6252001
description:
Jan 13 15:25:43 host2 pure-ftpd[3012346]: (?@164.90.155.129) [INFO] New connection from 164.90.155.129


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.116.22
country_id: 1861060
description:
Jan 13 15:25:57 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=139.162.116.22, lip=66.85.158.92, TLS: Connection closed, session=<3gCE/0FIuN2LonQW>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 156.238.252.133
country_id: 241170
description:
Jan 13 15:27:02 host2 sshd[3013415]: Disconnected from invalid user ubuntu 156.238.252.133 port 45826 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-13 15:26:50 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (palenize) [87.103.126.54]:49040: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.202.197.108
country_id: 6252001
description:
2026-01-13 15:26:54 dovecot_plain authenticator failed for H=(afflarruf) [50.202.197.108]:59736: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.205.169
country_id: 1733045
description:
2026-01-13 15:27:05 dovecot_login authenticator failed for H=([49.124.205.169]) [49.124.205.169]:39452: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.185.233.251
country_id: 798544
description:
2026-01-13 15:26:19 dovecot_plain authenticator failed for H=5.185.233.251.ipv4.public.orange.pl (joiscred) [5.185.233.251]:54866: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.231.213.73
country_id: 3175395
description:
Jan 13 15:27:25 host2 sshd[3013656]: Disconnected from invalid user admin 95.231.213.73 port 42498 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.185.243.158
country_id: 6252001
description:
Jan 13 15:27:35 host2 sshd[3013783]: Disconnected from invalid user ubuntu 20.185.243.158 port 39734 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.238.252.133
country_id: 241170
description:
Jan 13 15:27:36 host2 sshd[3013797]: Disconnected from invalid user ubuntu 156.238.252.133 port 40998 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.182.132.154
country_id: 1269750
description:
Jan 13 15:28:29 host2 sshd[3014443]: Disconnected from invalid user ubuntu 103.182.132.154 port 45042 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.182.118
country_id: 1269750
description:
2026-01-13 15:29:05 dovecot_login authenticator failed for H=([59.145.86.177]) [125.19.182.118]:37916: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.214.101.251
country_id: 3144096
description:
2026-01-13 15:28:40 dovecot_login authenticator failed for H=([127.0.0.1]) [84.214.101.251]:43966: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.238.252.133
country_id: 241170
description:
Jan 13 15:28:08 host2 sshd[3014195]: Disconnected from invalid user ubuntu 156.238.252.133 port 43870 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 89.134.213.29
country_id: 719819
description:
Jan 13 15:29:34 host2 sshd[3015353]: Disconnected from invalid user admin 89.134.213.29 port 46172 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.168.189
country_id: 2186224
description:
2026-01-13 15:29:15 dovecot_login authenticator failed for H=([127.0.0.1]) [121.73.168.189]:37394: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.230.158
country_id: 1269750
description:
2026-01-13 15:29:36 dovecot_login authenticator failed for H=(dsl-del-065.26.246.61.airtelbroadband.in) [182.95.230.158]:60670: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.185.243.158
country_id: 6252001
description:
Jan 13 15:30:24 host2 sshd[3016156]: Disconnected from invalid user admin 20.185.243.158 port 46076 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 41.90.100.147
country_id: 192950
description:
Jan 13 15:31:01 host2 sshd[3016550]: Disconnected from invalid user deployer 41.90.100.147 port 45472 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.168.139.28
country_id: 2264397
description:
Jan 13 15:31:40 host2 sshd[3017052]: Disconnected from invalid user ubuntu 79.168.139.28 port 53930 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 20.185.243.158
country_id: 6252001
description:
Jan 13 15:32:05 host2 sshd[3017307]: Received disconnect from 20.185.243.158 port 56590:11: Bye Bye [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.155.228.189
country_id: 2661886
description:
2026-01-13 15:33:04 dovecot_login authenticator failed for H=h95-155-228-189.cust.bredband2.com [95.155.228.189]:42236: 535 Incorrect authentication data (set_id=abuse@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.145.111
country_id: 1861060
description:
Jan 13 15:33:27 host2 sshd[3018182]: Disconnected from invalid user devtest 152.32.145.111 port 47070 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.18.99.126
country_id: 1269750
description:
2026-01-13 15:33:35 dovecot_login authenticator failed for H=([125.18.99.126]) [125.18.99.126]:40310: 535 Incorrect authentication data (set_id=abuse@euroentertainmentlk.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 79.168.139.28
country_id: 2264397
description:
Jan 13 15:33:52 host2 sshd[3018468]: Disconnected from invalid user sshuser 79.168.139.28 port 52174 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.230.122
country_id: 1269750
description:
2026-01-13 15:34:06 dovecot_login authenticator failed for H=([182.95.215.69]) [182.95.230.122]:55238: 535 Incorrect authentication data (set_id=abuse)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.168.139.28
country_id: 2264397
description:
Jan 13 15:34:21 host2 sshd[3018921]: Disconnected from invalid user mailuser 79.168.139.28 port 41106 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.145.111
country_id: 1861060
description:
Jan 13 15:35:17 host2 sshd[3019686]: Disconnected from invalid user admin1 152.32.145.111 port 56160 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.245.0.246
country_id: 1880251
description:
2026-01-13 15:42:34 dovecot_login authenticator failed for H=(246.0.245.49.unknown.m1.com.sg) [49.245.0.246]:45288: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.75.122.7
country_id: 927384
description:
2026-01-13 15:42:57 dovecot_login authenticator failed for H=([41.75.122.7]) [41.75.122.7]:35309: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 177.153.62.49
country_id: 3469034
description:
Jan 13 15:47:46 host2 pure-ftpd[3028874]: (?@177.153.62.49) [INFO] New connection from 177.153.62.49


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.158.162.24
country_id: 2510769
description:
Jan 13 15:50:19 host2 sshd[3031232]: Disconnected from invalid user dev 146.158.162.24 port 54092 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.223.91.130
country_id: 6252001
description:
Jan 13 15:51:54 host2 sshd[3032611]: Disconnected from invalid user max 162.223.91.130 port 55954 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.113.212
country_id: 1861060
description:
Jan 13 15:52:15 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=139.162.113.212, lip=66.85.158.92, TLS: Connection closed, session=<a3eZXUJI1oaLonHU>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.223.91.130
country_id: 6252001
description:
Jan 13 15:52:55 host2 sshd[3033368]: Disconnected from invalid user vpsuser 162.223.91.130 port 44726 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 162.223.91.130
country_id: 6252001
description:
Jan 13 15:53:27 host2 sshd[3033874]: Disconnected from invalid user tunneluser 162.223.91.130 port 55462 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 89.186.11.17
country_id: 798544
description:
Jan 13 15:54:16 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=89.186.11.17, lip=66.85.158.91, TLS, session=<CE7PY0JIUMFZugsR>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 189.51.118.218
country_id: 3469034
description:
Jan 13 15:54:38 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<env_eng>, method=PLAIN, rip=189.51.118.218, lip=66.85.158.91, TLS, session=<bRj4ZEJILba9M3ba>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.158.162.24
country_id: 2510769
description:
Jan 13 15:55:39 host2 sshd[3035821]: Disconnected from invalid user botuser1 146.158.162.24 port 56438 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 50.6.224.135
country_id: 6252001
description:
Jan 13 15:56:40 host2 sshd[3036506]: Disconnected from invalid user ftp-admin 50.6.224.135 port 50376 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.186.0.19
country_id: 1643084
description:
Jan 13 15:56:52 host2 sshd[3036740]: Disconnected from invalid user airflow 103.186.0.19 port 43146 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.185.161.145
country_id: 3469034
description:
2026-01-13 15:57:02 dovecot_login authenticator failed for H=(csbrasil.static.gvt.net.br) [179.185.161.145]:40198: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 95.0.32.181
country_id: 298795
description:
Jan 13 15:57:17 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<training@v-deploy.com>, method=PLAIN, rip=95.0.32.181, lip=66.85.158.91, TLS, session=</fODbkJIb8VfACC1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.216.213.53
country_id: 933860
description:
Jan 13 15:57:20 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<training@v-deploy.com>, method=PLAIN, rip=41.216.213.53, lip=66.85.158.91, TLS, session=<3WqQbkJIkMAp2NU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.171.200
country_id: 3175395
description:
Jan 13 15:57:39 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<training>, method=PLAIN, rip=185.15.171.200, lip=66.85.158.91, TLS, session=<gTThb0JIgtS5D6vI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.251.35
country_id: 3865483
description:
Jan 13 15:57:42 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<training>, method=PLAIN, rip=179.0.251.35, lip=66.85.158.91, TLS, session=<EMbMb0JILMOzAPsj>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 159.223.20.91
country_id: 2921044
description:
Jan 13 15:57:59 host2 pure-ftpd[3037450]: (?@159.223.20.91) [INFO] New connection from 159.223.20.91


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.186.0.19
country_id: 1643084
description:
Jan 13 15:58:57 host2 sshd[3038042]: Disconnected from invalid user debian 103.186.0.19 port 51144 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.145.185
country_id: 3996063
description:
2026-01-13 15:58:08 dovecot_login authenticator failed for H=([177.236.145.185]) [177.236.145.185]:33753: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.138.181
country_id: 1819730
description:
2026-01-13 15:58:24 dovecot_login authenticator failed for H=(m121-202-138-181.smartone.com) [121.202.138.181]:41714: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 208.109.34.86
country_id: 6252001
description:
Jan 13 15:58:48 host2 pure-ftpd[3037968]: (?@208.109.34.86) [INFO] New connection from 208.109.34.86


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.186.0.19
country_id: 1643084
description:
Jan 13 15:59:39 host2 sshd[3038478]: Disconnected from invalid user airflow 103.186.0.19 port 54996 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 164.90.155.129
country_id: 6252001
description:
Jan 13 16:00:33 host2 pure-ftpd[3039351]: (?@164.90.155.129) [INFO] New connection from 164.90.155.129


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 128.203.202.233
country_id: 6251999
description:
Jan 13 16:01:34 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=128.203.202.233, lip=66.85.158.91, TLS handshaking: Connection closed, session=<A4rifkJIbo+Ay8rp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.157.246.158
country_id: 2077456
description:
2026-01-13 16:01:56 dovecot_login authenticator failed for H=([120.157.246.158]) [120.157.246.158]:39880: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.125.122
country_id: 1269750
description:
2026-01-13 16:02:23 dovecot_login authenticator failed for H=([182.95.125.122]) [182.95.125.122]:37850: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 88.142.46.185
country_id: 3017382
description:
Jan 13 16:03:32 host2 sshd[3041739]: Disconnected from invalid user ubuntu 88.142.46.185 port 49202 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 88.142.46.185
country_id: 3017382
description:
Jan 13 16:04:35 host2 sshd[3042442]: Disconnected from invalid user admin 88.142.46.185 port 47044 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 13 16:07:17 host2 sshd[3044492]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 13 16:08:21 host2 sshd[3045318]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.128.150.67
country_id: 6252001
description:
2026-01-13 16:09:39 dovecot_login authenticator failed for H=c-73-128-150-67.hsd1.de.comcast.net [73.128.150.67]:44994: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.91
country_id: 2186224
description:
2026-01-13 16:09:52 dovecot_login authenticator failed for H=([121.73.169.91]) [121.73.169.91]:51178: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.170.251.33
country_id: 2017370
description:
2026-01-13 16:11:36 dovecot_login authenticator failed for H=(178.170.251.33.leadertelecom.ru) [178.170.251.33]:49756: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.242.142
country_id: 1269750
description:
2026-01-13 16:12:10 dovecot_login authenticator failed for H=([182.78.242.142]) [182.78.242.142]:52764: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.166.50.15
country_id: 453733
description:
2026-01-13 16:12:15 dovecot_login authenticator failed for H=15-50-166-83.dyn.estpak.ee [83.166.50.15]:53358: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.127.90.34
country_id: 2440476
description:
2026-01-13 16:12:26 dovecot_login authenticator failed for H=([154.127.90.34]) [154.127.90.34]:47447: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 40.76.167.156
country_id: 6252001
description:
Jan 13 16:19:42 host2 pure-ftpd[3055383]: (?@40.76.167.156) [INFO] New connection from 40.76.167.156


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.98.174
country_id: 1269750
description:
2026-01-13 16:24:34 dovecot_login authenticator failed for H=([27.123.98.174]) [27.123.98.174]:55044: 535 Incorrect authentication data (set_id=postmaster@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.250
country_id: 1036973
description:
2026-01-13 16:25:01 dovecot_login authenticator failed for H=([197.219.228.250]) [197.219.228.250]:50004: 535 Incorrect authentication data (set_id=postmaster@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.40.63
country_id: 1819730
description:
2026-01-13 16:25:35 dovecot_login authenticator failed for H=063.40.246.220.static.netvigator.com [220.246.40.63]:49756: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.200.180.174
country_id: 6252001
description:
2026-01-13 16:33:19 dovecot_login authenticator failed for H=survey.hagbergconsulting.com [207.200.180.174]:49979: 535 Incorrect authentication data (set_id=all@comdef.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.156.46
country_id: 1269750
description:
2026-01-13 16:33:52 dovecot_login authenticator failed for H=([125.19.156.46]) [125.19.156.46]:56148: 535 Incorrect authentication data (set_id=all)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.40.57.41
country_id: 1269750
description:
Jan 13 16:35:53 host2 sshd[3068365]: Disconnected from invalid user admin 45.40.57.41 port 60134 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.19.235.172
country_id: 3175395
description:
Jan 13 16:37:13 host2 sshd[3069385]: Disconnected from invalid user admin 151.19.235.172 port 60986 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.171.230.200
country_id: 6252001
description:
2026-01-13 16:37:59 dovecot_plain authenticator failed for H=c-73-171-230-200.hsd1.fl.comcast.net (fillarcu) [73.171.230.200]:60723: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.73.121.209
country_id: 732800
description:
2026-01-13 16:38:10 dovecot_login authenticator failed for H=(62-73-121-209.btc-net.bg) [62.73.121.209]:40128: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.41.202.12
country_id: 6252001
description:
2026-01-13 16:38:40 dovecot_login authenticator failed for H=syn-071-041-202-012.biz.spectrum.com [71.41.202.12]:54007: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.107.36.18
country_id: 1269750
description:
2026-01-13 16:38:23 dovecot_login authenticator failed for H=([103.107.36.18]) [103.107.36.18]:38476: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.128.202
country_id: 6252001
description:
2026-01-13 16:38:25 dovecot_login authenticator failed for H=([192.34.128.202]) [192.34.128.202]:60940: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 70.65.44.183
country_id: 6251999
description:
Jan 13 16:40:10 host2 sshd[3071600]: Disconnected from invalid user admin 70.65.44.183 port 57958 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.220.30
country_id: 1269750
description:
2026-01-13 16:40:31 dovecot_login authenticator failed for H=(nsg-corporate-153.189.187.122.airtel.in) [125.19.220.30]:60640: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.174.182.226
country_id: 2510769
description:
Jan 13 16:40:47 host2 sshd[3072133]: Disconnected from invalid user admin 185.174.182.226 port 47668 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.40.57.41
country_id: 1269750
description:
Jan 13 16:41:10 host2 sshd[3072367]: Disconnected from invalid user ubuntu 45.40.57.41 port 57182 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.174.182.226
country_id: 2510769
description:
Jan 13 16:41:18 host2 sshd[3072457]: Disconnected from invalid user admin 185.174.182.226 port 49632 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.174.182.226
country_id: 2510769
description:
Jan 13 16:42:17 host2 sshd[3073029]: Disconnected from invalid user admin 185.174.182.226 port 45854 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 70.65.44.183
country_id: 6251999
description:
Jan 13 16:42:30 host2 sshd[3073169]: Disconnected from invalid user admin 70.65.44.183 port 58110 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 70.65.44.183
country_id: 6251999
description:
Jan 13 16:43:33 host2 sshd[3074017]: Disconnected from invalid user admin 70.65.44.183 port 58190 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.51.22
country_id: 1880251
description:
Jan 13 16:43:49 host2 sshd[3074163]: Disconnected from invalid user ubuntu 101.47.51.22 port 57516 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 185.174.182.226
country_id: 2510769
description:
Jan 13 16:44:15 host2 sshd[3074493]: Received disconnect from 185.174.182.226 port 38556:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.135.37
country_id: 1269750
description:
Jan 13 16:44:46 host2 sshd[3074907]: Disconnected from invalid user admin 64.227.135.37 port 35628 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.51.22
country_id: 1880251
description:
Jan 13 16:45:54 host2 sshd[3075906]: Disconnected from invalid user admin 101.47.51.22 port 38668 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.47.51.22
country_id: 1880251
description:
Jan 13 16:47:54 host2 sshd[3077871]: Disconnected from invalid user ubuntu 101.47.51.22 port 39058 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 139.59.46.198
country_id: 1269750
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 139.59.46.198 - lezzarotech "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarotech (has_cpuser_file failed)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 57.128.188.106
country_id: 3017382
description:
Jan 13 16:49:49 host2 pure-ftpd[3079207]: (?@57.128.188.106) [INFO] New connection from 57.128.188.106


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.52.72.49
country_id: 1605651
description:
2026-01-13 16:52:08 dovecot_login authenticator failed for H=node-e9d.pool-182-52.dynamic.nt-isp.net (mx-ll-183.89.250-247.dynamic.3bb.in.th) [182.52.72.49]:55921: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.224.26
country_id: 1269750
description:
2026-01-13 16:52:23 dovecot_login authenticator failed for H=([152.52.224.26]) [152.52.224.26]:36792: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.55.16
country_id: 3144096
description:
2026-01-13 16:54:14 dovecot_login authenticator failed for H=([178.232.55.16]) [178.232.55.16]:33340: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.248.30.205
country_id: 1269750
description:
2026-01-13 16:54:34 dovecot_login authenticator failed for H=([103.248.30.205]) [103.248.30.205]:37507: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 142.79.227.70
country_id: 1269750
description:
Jan 13 16:56:19 host2 pure-ftpd[3084953]: (?@142.79.227.70) [INFO] New connection from 142.79.227.70


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 117.232.85.78
country_id: 1269750
description:
Jan 13 16:58:44 host2 pure-ftpd[3087020]: (?@117.232.85.78) [INFO] New connection from 117.232.85.78


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.154
country_id: 1269750
description:
2026-01-13 17:00:14 dovecot_login authenticator failed for H=(nsg-corporate-154.230.187.122.airtel.in) [122.187.230.154]:52235: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.128.149.159
country_id: 1835841
description:
Jan 13 17:00:16 host2 sshd[3088252]: Disconnected from invalid user ubuntu 43.128.149.159 port 49126 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.66.209
country_id: 1819730
description:
2026-01-13 17:00:31 dovecot_login authenticator failed for H=209.66.246.220.static.netvigator.com [220.246.66.209]:52419: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.199.126
country_id: 1269750
description:
2026-01-13 17:00:33 dovecot_login authenticator failed for H=([182.79.31.107]) [152.52.199.126]:38076: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.128.149.159
country_id: 1835841
description:
Jan 13 17:00:58 host2 sshd[3088770]: Disconnected from invalid user admin 43.128.149.159 port 60366 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.115.144.103
country_id: 3469034
description:
2026-01-13 17:01:00 dovecot_login authenticator failed for H=(buenosnet.static.gvt.net.br) [187.115.144.103]:44742: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.61.6
country_id: 290557
description:
2026-01-13 17:01:33 dovecot_login authenticator failed for H=([5.32.61.6]) [5.32.61.6]:33023: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-01-13 17:01:20 dovecot_login authenticator failed for H=(host-64-72-74-162.lightower.net) [64.72.74.162]:53821: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.128.149.159
country_id: 1835841
description:
Jan 13 17:01:34 host2 sshd[3089241]: Disconnected from invalid user ubuntu 43.128.149.159 port 43366 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.128.149.159
country_id: 1835841
description:
Jan 13 17:03:25 host2 sshd[3090535]: Disconnected from invalid user ubuntu 43.128.149.159 port 48832 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.169.85.72
country_id: 6252001
description:
Jan 13 17:03:48 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.169.85.72, lip=66.85.158.92, TLS handshaking: Connection closed, session=<6KRzXUNITNUUqVVI>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.154
country_id: 1269750
description:
2026-01-13 17:05:17 dovecot_login authenticator failed for H=(nsg-corporate-1.193.187.122.airtel.in) [182.95.178.154]:55618: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.192.162
country_id: 1269750
description:
2026-01-13 17:05:35 dovecot_login authenticator failed for H=([152.52.192.162]) [152.52.192.162]:35328: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.252
country_id: 1733045
description:
2026-01-13 17:06:18 dovecot_login authenticator failed for H=([49.124.152.252]) [49.124.152.252]:41504: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.177.78
country_id: 1269750
description:
2026-01-13 17:06:49 dovecot_login authenticator failed for H=([152.52.234.170]) [182.95.177.78]:53106: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.200.180.174
country_id: 6252001
description:
2026-01-13 17:06:58 dovecot_login authenticator failed for H=survey.hagbergconsulting.com [207.200.180.174]:62406: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.89.116.5
country_id: 6252001
description:
2026-01-13 17:07:16 dovecot_login authenticator failed for H=([70.89.116.5]) [70.89.116.5]:52701: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 132.220.107.88
country_id: 2750405
description:
Jan 13 17:09:24 host2 pure-ftpd[3095891]: (?@132.220.107.88) [INFO] New connection from 132.220.107.88


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.160.206
country_id: 1269750
description:
2026-01-13 17:14:16 dovecot_login authenticator failed for H=([128.185.23.89]) [125.19.160.206]:58614: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.59.4.36
country_id: 1269750
description:
2026-01-13 17:15:25 dovecot_login authenticator failed for H=(cityzone-36-4-59-103.cityzoneinfo.com) [103.59.4.36]:35708: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan 13 17:17:24 host2 sshd[3102061]: Disconnected from invalid user admin 2.57.121.112 port 10056 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.195.150
country_id: 290557
description:
2026-01-13 17:18:37 dovecot_plain authenticator failed for H=(haffs) [91.73.195.150]:50095: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.57
country_id: 2186224
description:
2026-01-13 17:22:23 dovecot_login authenticator failed for H=([127.0.0.1]) [121.73.163.57]:53464: 535 Incorrect authentication data (set_id=arts@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.162.66
country_id: 2186224
description:
2026-01-13 17:22:41 dovecot_login authenticator failed for H=([127.0.0.1]) [121.73.162.66]:45592: 535 Incorrect authentication data (set_id=arts)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.183.103.121
country_id: 2635167
description:
2026-01-13 17:23:32 dovecot_login authenticator failed for H=(185-183-103-121.xdsl.5gdsl.com) [185.183.103.121]:58576: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.219.196.17
country_id: 690791
description:
2026-01-13 17:23:46 dovecot_login authenticator failed for H=(91-219-196-17.planeta.dn.ua) [91.219.196.17]:54994: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.58.211.64
country_id: 2635167
description:
Jan 13 17:25:11 host2 sshd[3108122]: Disconnected from invalid user ftptest 143.58.211.64 port 44314 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.50.25.190
country_id: 1643084
description:
Jan 13 17:25:48 host2 sshd[3108568]: Disconnected from invalid user azureuser 27.50.25.190 port 37490 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.177.78
country_id: 1269750
description:
2026-01-13 17:25:51 dovecot_login authenticator failed for H=([152.52.234.170]) [182.95.177.78]:35682: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.164.129.224
country_id: 1835841
description:
Jan 13 17:25:56 host2 sshd[3108709]: Disconnected from invalid user develop 43.164.129.224 port 52548 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.79.134
country_id: 1269750
description:
2026-01-13 17:26:21 dovecot_login authenticator failed for H=([182.78.79.134]) [182.78.79.134]:54902: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.242.142
country_id: 1269750
description:
2026-01-13 17:28:04 dovecot_login authenticator failed for H=([125.19.172.137]) [182.78.242.142]:54096: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.47.169
country_id: 1819730
description:
2026-01-13 17:27:20 dovecot_login authenticator failed for H=169.47.246.220.static.netvigator.com [220.246.47.169]:61833: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.233.5.67
country_id: 6252001
description:
2026-01-13 17:28:31 dovecot_login authenticator failed for H=([50.233.5.67]) [50.233.5.67]:40229: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.183.62.0
country_id: 1210997
description:
Jan 13 17:28:59 host2 sshd[3110791]: Disconnected from invalid user runner 103.183.62.0 port 42540 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2026-01-13 17:29:40 dovecot_plain authenticator failed for H=(vaphaguip) [102.53.15.17]:43602: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.174.211.17
country_id: 2661886
description:
Jan 13 17:29:49 host2 sshd[3111975]: Disconnected from invalid user tunneluser 158.174.211.17 port 17004 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.174.211.17
country_id: 2661886
description:
Jan 13 17:30:36 host2 sshd[3112896]: Disconnected from invalid user build 158.174.211.17 port 29087 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 158.174.211.17
country_id: 2661886
description:
Jan 13 17:31:27 host2 sshd[3113475]: Disconnected from invalid user developer 158.174.211.17 port 26410 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.247.195
country_id: 6252001
description:
Jan 13 17:32:52 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=184.105.247.195, lip=66.85.158.92, TLS handshaking: Connection closed, session=<appyxUNITp64affD>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 157.20.207.165
country_id: 1643084
description:
Jan 13 17:33:01 host2 sshd[3114852]: Disconnected from invalid user sshadmin 157.20.207.165 port 37698 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.247.195
country_id: 6252001
description:
Jan 13 17:33:24 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=184.105.247.195, lip=66.85.158.92, TLS: Connection closed, session=<KcFNx0NIuGa4affD>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.164.129.224
country_id: 1835841
description:
Jan 13 17:34:08 host2 sshd[3115869]: Disconnected from invalid user appuser 43.164.129.224 port 36446 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.153.146
country_id: 99237
description:
2026-01-13 17:37:32 dovecot_plain authenticator failed for H=(notanple) [65.20.153.146]:37242: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 146.190.172.131
country_id: 6252001
description:
Jan 13 17:41:37 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=146.190.172.131, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<1z2w5ENIWoySvqyD>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Jan 13 17:42:34 host2 dovecot[3239883]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<tpoh6ENIIuEDhpQ7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.181.107.134
country_id: 2264397
description:
2026-01-13 17:43:46 dovecot_login authenticator failed for H=89-181-107-134.net.novis.pt [89.181.107.134]:45344: 535 Incorrect authentication data (set_id=hostmaster@comdef.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.195.52.4
country_id: 3144096
description:
2026-01-13 17:44:07 dovecot_login authenticator failed for H=([141.195.52.4]) [141.195.52.4]:37248: 535 Incorrect authentication data (set_id=hostmaster@comdef.org)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Jan 13 17:44:30 host2 dovecot[3239883]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<mcME70NIJMgDhpQ7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.168.17.20
country_id: 2077456
description:
2026-01-13 17:44:50 dovecot_login authenticator failed for H=([101.168.17.20]) [101.168.17.20]:53908: 535 Incorrect authentication data (set_id=hostmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.155.27.128
country_id: 2802361
description:
2026-01-13 17:45:35 dovecot_login authenticator failed for H=128.27.155.104.bc.googleusercontent.com [104.155.27.128]:52348: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
country_id: 6252001
description:
2026-01-13 17:45:49 dovecot_login authenticator failed for H=(made-again.tmesis.com) [24.187.213.29]:52598: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Jan 13 17:45:50 host2 dovecot[3239883]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<leXH80NI2sYDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Jan 13 17:47:14 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<qDHR+ENIDsUDhpQ7>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.134.148.59
country_id: 6252001
description:
Jan 13 17:47:41 host2 dovecot[3239883]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<iQJv+kNI7oUDhpQ7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.250.19.91
country_id: 1269750
description:
2026-01-13 17:48:20 dovecot_login authenticator failed for H=(static.ill.117.250.19.91.bsnl.co.in) [117.250.19.91]:44640: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Jan 13 17:48:50 host2 dovecot[3239883]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<5TWG/kNITsYDhpQ7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.118.112.230
country_id: 6252001
description:
2026-01-13 17:49:03 dovecot_login authenticator failed for H=syn-070-118-112-230.biz.spectrum.com [70.118.112.230]:38892: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 13 17:50:50 host2 sshd[3130118]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 13 17:51:51 host2 sshd[3130958]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.226.107.70
country_id: 3469034
description:
2026-01-13 17:51:22 dovecot_login authenticator failed for H=(72-107-226-38.edgetelecom.com.br) [38.226.107.70]:60095: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.0.8.204
country_id: 3469034
description:
2026-01-13 17:52:12 dovecot_login authenticator failed for H=([206.0.8.204]) [206.0.8.204]:46978: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.64.71.59
country_id: 3865483
description:
Jan 13 17:55:08 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=186.64.71.59, lip=66.85.158.91, TLS, session=<f/e4E0RITti6QEc7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.148.194
country_id: 99237
description:
2026-01-13 17:55:31 dovecot_plain authenticator failed for H=(uncleess) [65.20.148.194]:53502: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.85.61.200
country_id: 3469034
description:
Jan 13 17:55:29 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<env_eng>, method=PLAIN, rip=177.85.61.200, lip=66.85.158.91, TLS, session=<+NksFURIdryxVT3I>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.121.1.156
country_id: 6252001
description:
2026-01-13 18:00:25 dovecot_login authenticator failed for H=([24.121.1.156]) [24.121.1.156]:57212: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.252.85
country_id: 1210997
description:
2026-01-13 18:00:53 dovecot_login authenticator failed for H=([103.115.252.60]) [103.115.252.85]:48631: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.201.62
country_id: 1269750
description:
2026-01-13 18:07:27 dovecot_login authenticator failed for H=(aes-static-041.73.22.125.airtel.in) [122.186.201.62]:57012: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.146.149
country_id: 3996063
description:
2026-01-13 18:07:46 dovecot_login authenticator failed for H=([177.236.146.149]) [177.236.146.149]:58781: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.25.36.197
country_id: 294640
description:
2026-01-13 18:09:06 dovecot_login authenticator failed for H=([37.25.36.197]) [37.25.36.197]:39386: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.19.12.103
country_id: 2635167
description:
2026-01-13 18:09:19 dovecot_login authenticator failed for H=cpc122100-bmly10-2-0-cust102.2-3.cable.virginm.net [82.19.12.103]:50007: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.124
country_id: 1036973
description:
2026-01-13 18:11:49 dovecot_login authenticator failed for H=([196.28.226.124]) [196.28.226.124]:55506: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.225.255.82
country_id: 2510769
description:
2026-01-13 18:12:00 dovecot_login authenticator failed for H=(82.red.255.225.212.procono.es) [212.225.255.82]:45934: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.201.62
country_id: 1269750
description:
2026-01-13 18:14:10 dovecot_login authenticator failed for H=(nsg-corporate-226.215.186.122.airtel.in) [122.186.201.62]:33620: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.120.50
country_id: 1269750
description:
2026-01-13 18:15:58 dovecot_login authenticator failed for H=(nsg-static-89.234.75.182-airtel.com) [182.95.120.50]:59202: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.27.83
country_id: 1643084
description:
2026-01-13 18:16:33 dovecot_login authenticator failed for H=(ip-arana.net.id.as132673) [103.90.27.83]:34232: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.248.149.21
country_id: 3175395
description:
Jan 13 18:19:50 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=178.248.149.21, lip=66.85.158.91, TLS, session=<2pRmbERIMq2y+JUV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.13.68.97
country_id: 3175395
description:
Jan 13 18:20:09 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<careers>, method=PLAIN, rip=45.13.68.97, lip=66.85.158.91, TLS, session=<vRx+bURIVcAtDURh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.132.97.76
country_id: 2264397
description:
2026-01-13 18:22:43 dovecot_login authenticator failed for H=a94-132-97-76.cpe.netcabo.pt [94.132.97.76]:59970: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.162.194.94
country_id: 1733045
description:
2026-01-13 18:23:32 dovecot_login authenticator failed for H=([51.162.194.94]) [51.162.194.94]:38947: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.181.79.60
country_id: 1819730
description:
2026-01-13 18:27:47 dovecot_login authenticator failed for H=([65.181.79.60]) [65.181.79.60]:58817: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.79.134
country_id: 1269750
description:
2026-01-13 18:27:58 dovecot_login authenticator failed for H=([182.78.79.134]) [182.78.79.134]:46584: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.159.185
country_id: 1733045
description:
2026-01-13 18:28:35 dovecot_login authenticator failed for H=([49.124.159.185]) [49.124.159.185]:39862: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.76.55.177
country_id: 3175395
description:
2026-01-13 18:28:44 dovecot_login authenticator failed for H=([151.76.55.177]) [151.76.55.177]:52550: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.0.90.81
country_id: 2077456
description:
2026-01-13 18:29:04 dovecot_login authenticator failed for H=210.0.90.81.static.nexnet.net.au [210.0.90.81]:60420: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.140.54
country_id: 1269750
description:
2026-01-13 18:29:32 dovecot_login authenticator failed for H=([125.21.194.121]) [125.23.140.54]:44236: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan 13 18:29:48 host2 sshd[3163381]: Disconnected from invalid user admin 2.57.121.112 port 51315 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.27.33.174
country_id: 6252001
description:
2026-01-13 18:36:09 dovecot_plain authenticator failed for H=c-73-27-33-174.hsd1.fl.comcast.net (suctae) [73.27.33.174]:36368: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 40.117.97.0
country_id: 6252001
description:
Jan 13 18:38:08 host2 sshd[3170288]: Disconnected from invalid user ubuntu 40.117.97.0 port 35054 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 40.117.97.0
country_id: 6252001
description:
Jan 13 18:39:56 host2 sshd[3171588]: Disconnected from invalid user admin 40.117.97.0 port 58222 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.0.120.6
country_id: 226074
description:
Jan 13 18:40:42 host2 sshd[3172269]: Disconnected from invalid user admin 196.0.120.6 port 39770 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 196.0.120.6
country_id: 226074
description:
Jan 13 18:42:48 host2 sshd[3173807]: Disconnected from invalid user ubuntu 196.0.120.6 port 47520 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.158.22.150
country_id: 99237
description:
Jan 13 18:43:04 host2 sshd[3174092]: Disconnected from invalid user admin 185.158.22.150 port 55178 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.158.22.150
country_id: 99237
description:
Jan 13 18:44:09 host2 sshd[3174746]: Disconnected from invalid user ubuntu 185.158.22.150 port 65021 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.89.137.130
country_id: 3469034
description:
Jan 13 18:44:56 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=190.89.137.130, lip=66.85.158.91, TLS, session=<09EIxkRIBoK+WYmC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 89.106.137.87
country_id: 2963597
description:
Jan 13 18:45:24 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<env_eng>, method=PLAIN, rip=89.106.137.87, lip=66.85.158.91, TLS, session=<VWPcx0RI5olZaolX>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.43.105.11
country_id: 3469034
description:
2026-01-13 18:46:12 dovecot_login authenticator failed for H=([127.0.0.1]) [177.43.105.11]:43214: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.41.155
country_id: 3144096
description:
2026-01-13 18:46:19 dovecot_login authenticator failed for H=([127.0.0.1]) [46.212.41.155]:47101: 535 Incorrect authentication data (set_id=kasunp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.188.130
country_id: 3144096
description:
2026-01-13 18:54:21 dovecot_login authenticator failed for H=(cm-84.213.188.130.get.no) [84.213.188.130]:34384: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 71.6.146.185
country_id: 6252001
description:
Jan 13 18:55:12 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record (no auth attempts in 0 secs): user=<>, rip=71.6.146.185, lip=66.85.158.92, TLS: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record, session=<iQnm60RIFOBHBpK5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.96.233.67
country_id: 6251999
description:
2026-01-13 18:55:17 dovecot_login authenticator failed for H=208-96-233-67.resi.cgocable.ca [208.96.233.67]:39760: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.57.39.170
country_id: 6252001
description:
2026-01-13 18:59:17 dovecot_login authenticator failed for H=(syn-184-057-039-170.res.spectrum.com) [184.57.39.170]:59962: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.143.166
country_id: 1819730
description:
2026-01-13 19:14:00 dovecot_login authenticator failed for H=166.143.48.116.static.netvigator.com [116.48.143.166]:58630: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.127.128
country_id: 3144096
description:
2026-01-13 19:13:37 dovecot_login authenticator failed for H=(cm-46.212.127.128.get.no) [46.212.127.128]:56012: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.81.229.181
country_id: 6252001
description:
2026-01-13 19:18:14 dovecot_plain authenticator failed for H=(prebotint) [192.81.229.181]:37850: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.111.146
country_id: 6252001
description:
2026-01-13 19:20:05 dovecot_login authenticator failed for H=syn-035-130-111-146.biz.spectrum.com [35.130.111.146]:41227: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.210.118
country_id: 1269750
description:
2026-01-13 19:20:26 dovecot_login authenticator failed for H=([125.17.48.129]) [152.52.210.118]:38198: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.129.28
country_id: 99237
description:
2026-01-13 19:26:46 dovecot_plain authenticator failed for H=(ockoft) [65.20.129.28]:37176: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.195.211.98
country_id: 6252001
description:
2026-01-13 19:28:39 dovecot_plain authenticator failed for H=c-73-195-211-98.hsd1.nj.comcast.net (ovelly) [73.195.211.98]:50132: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.214.169.10
country_id: 2510769
description:
2026-01-13 19:28:43 dovecot_plain authenticator failed for H=(plaming) [185.214.169.10]:52788: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 13 19:34:14 host2 sshd[3213244]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 13 19:35:17 host2 sshd[3214348]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.167.160
country_id: 99237
description:
2026-01-13 19:35:07 dovecot_login authenticator failed for H=([65.20.167.160]) [65.20.167.160]:33640: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.164.93.136
country_id: 6252001
description:
2026-01-13 19:35:37 dovecot_login authenticator failed for H=(syn-024-164-093-136.res.spectrum.com) [24.164.93.136]:46246: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan 13 19:44:14 host2 sshd[3221151]: Disconnected from invalid user admin 2.57.121.112 port 49266 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.222.178
country_id: 1269750
description:
2026-01-13 19:46:22 dovecot_login authenticator failed for H=([182.95.222.178]) [182.95.222.178]:49528: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.220.90
country_id: 1269750
description:
2026-01-13 19:46:37 dovecot_login authenticator failed for H=(dsl-tn-dynamic-137.209.22.125.airtelbroadband.in) [128.185.220.90]:37168: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.204.134.124
country_id: 6252001
description:
2026-01-13 19:50:02 dovecot_plain authenticator failed for H=c-98-204-134-124.hsd1.md.comcast.net (satica) [98.204.134.124]:36752: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.63.10
country_id: 1269750
description:
2026-01-13 19:50:04 dovecot_login authenticator failed for H=(nsg-static-177.160.71.182.airtel.in) [182.95.63.10]:42860: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.27.76.210
country_id: 3469034
description:
2026-01-13 19:50:43 dovecot_login authenticator failed for H=(ip-177-27-76-210.user.vivozap.com.br) [177.27.76.210]:56228: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.0.8.204
country_id: 3469034
description:
2026-01-13 19:51:14 dovecot_login authenticator failed for H=([206.0.8.204]) [206.0.8.204]:42764: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.245.250.151
country_id: 3469034
description:
Jan 13 19:51:53 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=170.245.250.151, lip=66.85.158.91, TLS, session=<3fqJtUVIkpaq9fqX>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.177.113.25
country_id: 3175395
description:
Jan 13 19:52:23 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<careers>, method=PLAIN, rip=195.177.113.25, lip=66.85.158.91, TLS, session=<dslOt0VIAp/DsXEZ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 46.101.83.167
country_id: 2635167
description:
Jan 13 19:59:00 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=46.101.83.167, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<DeQQ0EVIftIuZVOn>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.29.26
country_id: 3144096
description:
2026-01-13 19:59:45 dovecot_login authenticator failed for H=(cm-178.232.29.26.get.no) [178.232.29.26]:35365: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.70.134
country_id: 1819730
description:
2026-01-13 20:00:02 dovecot_login authenticator failed for H=42-200-70-134.static.imsbiz.com [42.200.70.134]:40510: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 164.90.194.121
country_id: 2750405
description:
Jan 13 20:02:58 host2 dovecot[3239883]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=164.90.194.121, lip=66.85.158.91, TLS, session=<83E53kVIIpKkWsJ5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.172.54.29
country_id: 6252001
description:
2026-01-13 20:11:35 dovecot_plain authenticator failed for H=c-67-172-54-29.hsd1.pa.comcast.net (ephiewes) [67.172.54.29]:52438: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.198.131.159
country_id: 6252001
description:
Jan 13 20:14:05 host2 sshd[3248277]: Invalid user cloudtourssrilan_travel from 124.198.131.159 port 61681


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.216.213.131
country_id: 933860
description:
Jan 13 20:15:19 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<env_eng>, method=PLAIN, rip=41.216.213.131, lip=66.85.158.91, TLS, session=<J41KCUZIit0p2NWD>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.201.22.158
country_id: 290557
description:
2026-01-13 20:15:23 dovecot_plain authenticator failed for H=(bemiston) [94.201.22.158]:49722: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.89.137.111
country_id: 3469034
description:
Jan 13 20:14:58 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=190.89.137.111, lip=66.85.158.91, TLS, session=<ypP2B0ZIDY6+WYlv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.124.111.122
country_id: 2077456
description:
2026-01-13 20:37:21 dovecot_login authenticator failed for H=27-124-111-122.static.as58511.net [27.124.111.122]:45298: 535 Incorrect authentication data (set_id=postmaster@agentallianz.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.106.49.149
country_id: 3932488
description:
2026-01-13 20:37:40 dovecot_login authenticator failed for H=([200.106.49.149]) [200.106.49.149]:44794: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.200.95.18
country_id: 290557
description:
2026-01-13 20:41:34 dovecot_login authenticator failed for H=([94.200.95.18]) [94.200.95.18]:52648: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.39
country_id: 2186224
description:
2026-01-13 20:42:02 dovecot_login authenticator failed for H=([121.73.163.39]) [121.73.163.39]:41034: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 13 20:45:51 host2 sshd[3274591]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.219.235.108
country_id: 6252001
description:
Jan 13 20:51:23 host2 sshd[3279367]: Invalid user cloudtourssrilan_travel from 104.219.235.108 port 51045


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan 13 20:52:58 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@seyawin.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<JxLrkEZI9aZ100Db>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.127
country_id: 3017382
description:
Jan 13 20:53:40 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=91.196.152.127, lip=66.85.158.92, session=<KPOJk0ZIY5ZbxJh/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.38
country_id: 3017382
description:
Jan 13 20:53:50 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=91.196.152.38, lip=66.85.158.92, session=<+dwmlEZIg6VbxJgm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.34
country_id: 3017382
description:
Jan 13 20:54:03 host2 dovecot[3239883]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=91.196.152.34, lip=66.85.158.92, session=<hK3qlEZI2dtbxJgi>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.32
country_id: 3017382
description:
Jan 13 20:54:06 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.196.152.32, lip=66.85.158.92, session=<5x0dlUZI05VbxJgg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.27
country_id: 2186224
description:
2026-01-13 20:54:10 dovecot_login authenticator failed for H=([121.73.163.27]) [121.73.163.27]:39586: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.75.110
country_id: 1149361
description:
2026-01-13 20:54:34 dovecot_login authenticator failed for H=([180.94.75.110]) [180.94.75.110]:51502: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 178.253.42.163
country_id: 390903
description:
Jan 13 20:57:06 host2 sshd[3284699]: Disconnected from invalid user admin 178.253.42.163 port 48908 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 23.236.169.235
country_id: 6252001
description:
Jan 13 20:58:03 host2 sshd[3285480]: Disconnected from invalid user admin 23.236.169.235 port 36624 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 23.236.169.235
country_id: 6252001
description:
Jan 13 20:58:34 host2 sshd[3285848]: Disconnected from invalid user ubuntu 23.236.169.235 port 47830 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 23.236.169.235
country_id: 6252001
description:
Jan 13 21:00:09 host2 sshd[3287284]: Disconnected from invalid user ubuntu 23.236.169.235 port 53218 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.218.2
country_id: 1269750
description:
2026-01-13 21:01:33 dovecot_login authenticator failed for H=([61.246.205.1]) [125.19.218.2]:53298: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.34.70.2
country_id: 2510769
description:
2026-01-13 21:02:11 dovecot_login authenticator failed for H=2.red-83-34-70.dynamicip.rima-tde.net [83.34.70.2]:54381: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 178.253.42.163
country_id: 390903
description:
Jan 13 21:02:32 host2 sshd[3289362]: Disconnected from invalid user ubuntu 178.253.42.163 port 47462 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.157
country_id: 1814991
description:
Jan 13 21:03:07 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=94.231.206.157, lip=66.85.158.92, session=<1hlctUZIGc5e586d>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.202
country_id: 1814991
description:
Jan 13 21:03:18 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=94.231.206.202, lip=66.85.158.92, session=<5LT6tUZIcYpe587K>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.153
country_id: 1814991
description:
Jan 13 21:03:38 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=94.231.206.153, lip=66.85.158.92, session=<bUEyt0ZIW9te586Z>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.205
country_id: 1814991
description:
Jan 13 21:03:34 host2 dovecot[3239883]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=94.231.206.205, lip=66.85.158.92, session=<f+XytkZIF6de587N>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.54.70.40
country_id: 3686110
description:
2026-01-13 21:18:29 dovecot_login authenticator failed for H=(static-ip-1815407040.cable.net.co) [181.54.70.40]:48666: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.220.236.203
country_id: 660013
description:
2026-01-13 21:18:55 dovecot_login authenticator failed for H=([62.220.236.203]) [62.220.236.203]:49022: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.66.109.194
country_id: 932692
description:
2026-01-13 21:22:15 dovecot_login authenticator failed for H=([154.66.109.244]) [154.66.109.194]:53596: 535 Incorrect authentication data (set_id=hostmaster@2s-travels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.237.119.118
country_id: 6252001
description:
2026-01-13 21:22:31 dovecot_login authenticator failed for H=118-119-237-24.gci.net [24.237.119.118]:42476: 535 Incorrect authentication data (set_id=hostmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.167.117
country_id: 99237
description:
2026-01-13 21:22:36 dovecot_login authenticator failed for H=([65.20.167.117]) [65.20.167.117]:33786: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.148.10.122
country_id: 2750405
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 45.148.10.122 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilan_travel (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.142.184.55
country_id: 1210997
description:
2026-01-13 21:23:04 dovecot_login authenticator failed for H=([103.133.175.82]) [103.142.184.55]:55032: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.231.25.64
country_id: 3686110
description:
2026-01-13 21:23:53 dovecot_login authenticator failed for H=(1522312565.colombiatel.co) [152.231.25.64]:49530: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.37.198.190
country_id: 6252001
description:
2026-01-13 21:24:28 dovecot_login authenticator failed for H=(host190.covisint.com) [64.37.198.190]:55857: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.149
country_id: 6252001
description:
Jan 13 21:27:51 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 14 secs): user=<>, rip=147.185.133.149, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<GcfQDUdIssWTuYWV>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.64.150
country_id: 1269750
description:
2026-01-13 21:27:15 dovecot_login authenticator failed for H=([125.23.229.42]) [182.78.64.150]:60452: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.216.169.12
country_id: 2328926
description:
2026-01-13 21:27:34 dovecot_login authenticator failed for H=([41.216.169.12]) [41.216.169.12]:46690: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.149
country_id: 6252001
description:
Jan 13 21:28:47 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 5 secs): user=<>, rip=147.185.133.149, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<xXEkEUdIdO6TuYWV>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.149
country_id: 6252001
description:
Jan 13 21:29:15 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 8 secs): user=<>, rip=147.185.133.149, lip=66.85.158.92, TLS: read(size=403) failed: Connection reset by peer, session=<vXbMEkdIBuyTuYWV>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.201.228.210
country_id: 99237
description:
2026-01-13 21:31:40 dovecot_login authenticator failed for H=([62.201.228.210]) [62.201.228.210]:34462: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.238.210.226
country_id: 3469034
description:
2026-01-13 21:32:00 dovecot_login authenticator failed for H=([186.238.210.226]) [186.238.210.226]:42945: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.148.194
country_id: 99237
description:
2026-01-13 21:33:11 dovecot_plain authenticator failed for H=(calles) [65.20.148.194]:38520: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.149
country_id: 6252001
description:
Jan 13 21:35:51 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=147.185.133.149, lip=66.85.158.92, TLS, session=<c1tfKkdI3POTuYWV>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.238
country_id: 2635167
description:
Jan 13 21:36:00 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 5 secs): user=<>, rip=35.203.210.238, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<zAXpKkdInc0jy9Lu>


plugin: ossec
rule: 9703
name: Dovecot is Starting Up.
description:
Jan 13 21:36:40 host2 dovecot[3335543]: master: Dovecot v2.3.21.1 (d492236fa0) starting up for lmtp, imap, pop3 (core dumps disabled)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.56.0.19
country_id: 3469034
description:
2026-01-13 21:36:13 dovecot_login authenticator failed for H=(177-215-153-215.user.vivozap.com.br) [189.56.0.19]:39274: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.149
country_id: 6252001
description:
Jan 13 21:36:44 host2 dovecot[3335587]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.133.149, lip=66.85.158.92, TLS, session=<wtyNLUdIvOyTuYWV>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.176.126
country_id: 1269750
description:
2026-01-13 21:36:53 dovecot_login authenticator failed for H=(nsg-corporate-126.176.185.122.airtel.in) [122.185.176.126]:47112: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.238
country_id: 2635167
description:
Jan 13 21:37:00 host2 dovecot[3335587]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 5 secs): user=<>, rip=35.203.210.238, lip=66.85.158.91, TLS: read(size=403) failed: Connection reset by peer, session=<Oo+JLkdI8vEjy9Lu>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.58.18
country_id: 1269750
description:
2026-01-13 21:37:27 dovecot_login authenticator failed for H=([125.17.10.161]) [182.95.58.18]:50802: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.238
country_id: 2635167
description:
Jan 13 21:37:11 host2 dovecot[3335587]: pop3-login: Disconnected: Connection closed: read(size=429) failed: Connection reset by peer (no auth attempts in 5 secs): user=<>, rip=35.203.210.238, lip=66.85.158.91, TLS: read(size=429) failed: Connection reset by peer, session=<ljIyL0dIbuAjy9Lu>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.238
country_id: 2635167
description:
Jan 13 21:43:38 host2 dovecot[3335587]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=35.203.210.238, lip=66.85.158.91, TLS, session=<Wrk3RkdIxP8jy9Lu>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.219
country_id: 6252001
description:
Jan 13 21:46:48 host2 pure-ftpd[3344959]: (?@147.185.132.219) [INFO] New connection from 147.185.132.219


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan 13 21:48:38 host2 sshd[3346088]: Disconnected from invalid user user 2.57.121.25 port 5962 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.132.97.76
country_id: 2264397
description:
2026-01-13 21:50:02 dovecot_login authenticator failed for H=a94-132-97-76.cpe.netcabo.pt [94.132.97.76]:34650: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.53.7.231
country_id: 6252001
description:
2026-01-13 21:50:41 dovecot_login authenticator failed for H=([64.53.7.231]) [64.53.7.231]:48996: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.123.202
country_id: 1269750
description:
2026-01-13 21:54:50 dovecot_login authenticator failed for H=([182.95.123.202]) [182.95.123.202]:57160: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.192.245.178
country_id: 1269750
description:
2026-01-13 21:55:01 dovecot_login authenticator failed for H=(dhcp-192-245-178.in2cable.com) [203.192.245.178]:48430: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.64.162.195
country_id: 1643084
description:
Jan 13 21:55:23 host2 sshd[3352805]: Disconnected from invalid user alertmanager 36.64.162.195 port 47324 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 72.240.125.133
country_id: 6252001
description:
Jan 13 21:55:38 host2 sshd[3353023]: Disconnected from invalid user role1 72.240.125.133 port 60070 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 72.240.125.133
country_id: 6252001
description:
Jan 13 21:56:50 host2 sshd[3354065]: Disconnected from invalid user Admin 72.240.125.133 port 55400 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.18.228.75
country_id: 3686110
description:
Jan 13 21:56:38 host2 sshd[3353882]: Disconnected from invalid user websphere 161.18.228.75 port 60276 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.18.228.75
country_id: 3686110
description:
Jan 13 21:57:16 host2 sshd[3354466]: Disconnected from invalid user extreme 161.18.228.75 port 43142 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.160.107
country_id: 99237
description:
2026-01-13 21:57:48 dovecot_plain authenticator failed for H=(ablesiver) [65.20.160.107]:36980: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 36.64.162.195
country_id: 1643084
description:
Jan 13 21:58:13 host2 sshd[3355209]: Disconnected from invalid user amcrest 36.64.162.195 port 37816 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.18.228.75
country_id: 3686110
description:
Jan 13 21:58:22 host2 sshd[3355331]: Disconnected from invalid user zimbra 161.18.228.75 port 37128 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 123.58.213.127
country_id: 1819730
description:
Jan 13 21:59:45 host2 sshd[3356223]: Disconnected from invalid user dbadmin 123.58.213.127 port 42904 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.45.237.132
country_id: 6252001
description:
Jan 13 22:01:09 host2 sshd[3357415]: Disconnected from invalid user ubuntu 45.45.237.132 port 60036 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 123.58.213.127
country_id: 1819730
description:
Jan 13 22:01:09 host2 sshd[3357384]: Disconnected from invalid user websphere 123.58.213.127 port 57054 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.45.237.132
country_id: 6252001
description:
Jan 13 22:01:38 host2 sshd[3357705]: Disconnected from invalid user ubuntu 45.45.237.132 port 43202 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 123.58.213.127
country_id: 1819730
description:
Jan 13 22:01:49 host2 sshd[3357813]: Disconnected from invalid user nagiosadmin 123.58.213.127 port 60194 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.45.237.132
country_id: 6252001
description:
Jan 13 22:02:08 host2 sshd[3358064]: Disconnected from invalid user admin 45.45.237.132 port 35232 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan 13 22:05:04 host2 sshd[3360338]: Disconnected from invalid user admin 2.57.121.112 port 24066 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.0.3
country_id: 3469034
description:
2026-01-13 22:10:45 dovecot_login authenticator failed for H=(177-174-0-3.user.vivozap.com.br) [177.174.0.3]:51813: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.22
country_id: 1269750
description:
2026-01-13 22:11:03 dovecot_login authenticator failed for H=(aes-static-105.28.22.125.airtel.in) [182.95.228.22]:60232: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.165.174.234
country_id: 1269750
description:
2026-01-13 22:11:18 dovecot_login authenticator failed for H=([103.165.174.234]) [103.165.174.234]:55135: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-13 22:11:21 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (guscomat) [87.103.126.54]:40525: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.214.63.110
country_id: 3144096
description:
2026-01-13 22:11:27 dovecot_login authenticator failed for H=([84.214.63.110]) [84.214.63.110]:44072: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.100.218
country_id: 1269750
description:
2026-01-13 22:13:06 dovecot_login authenticator failed for H=(nsg-corporate-4.114.185.122.airtel.in) [122.185.100.218]:36116: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.98.41.27
country_id: 1269750
description:
2026-01-13 22:13:20 dovecot_login authenticator failed for H=([59.98.41.27]) [59.98.41.27]:44233: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.169.16
country_id: 3175395
description:
Jan 13 22:13:53 host2 dovecot[3335587]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=185.15.169.16, lip=66.85.158.91, TLS, session=</JtwsUdIG7K5D6kQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.238.106.164
country_id: 3865483
description:
Jan 13 22:14:22 host2 dovecot[3335587]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 23 secs): user=<env_eng>, method=PLAIN, rip=45.238.106.164, lip=66.85.158.91, TLS, session=<qEzLskdI1aAt7mqk>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.231.122.20
country_id: 798544
description:
Jan 13 22:27:34 host2 dovecot[3335587]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=91.231.122.20, lip=66.85.158.91, TLS, session=<Jqhg4kdINptb53oU>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 35.171.157.77
country_id: 6252001
description:
Jan 13 22:27:47 host2 pure-ftpd[3392454]: (?@35.171.157.77) [INFO] New connection from 35.171.157.77


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.213.195.144
country_id: 1269750
description:
Jan 13 22:27:54 host2 dovecot[3335587]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<careers>, method=PLAIN, rip=103.213.195.144, lip=66.85.158.91, TLS, session=<ya6A40dIA+1n1cOQ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.244.233.141
country_id: 2635167
description:
Jan 13 22:33:35 host2 sshd[3396946]: Disconnected from invalid user ubuntu 198.244.233.141 port 34276 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 198.244.233.141
country_id: 2635167
description:
Jan 13 22:34:06 host2 sshd[3397471]: Disconnected from invalid user admin 198.244.233.141 port 39796 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 13 22:38:59 host2 sshd[3402009]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 13 22:40:01 host2 sshd[3403030]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.86.130
country_id: 1269750
description:
2026-01-13 22:39:51 dovecot_login authenticator failed for H=(nsg-static-130.86.76.182-airtel.com) [182.76.86.130]:47880: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.234.56
country_id: 1269750
description:
2026-01-13 22:49:09 dovecot_login authenticator failed for H=(nsg-corporate-56.234.187.122.airtel.in) [122.187.234.56]:54770: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.119.144.86
country_id: 6252001
description:
2026-01-13 22:48:51 dovecot_login authenticator failed for H=24-119-144-86.cpe.sparklight.net [24.119.144.86]:46280: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-01-13 22:48:54 dovecot_login authenticator failed for H=(144.121.245.65.lightower.net) [64.72.74.162]:47044: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2026-01-13 22:49:03 dovecot_login authenticator failed for H=(227.69.57.37.triolan.net) [37.57.69.227]:37112: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.195.150
country_id: 290557
description:
2026-01-13 22:49:07 dovecot_login authenticator failed for H=([91.73.195.150]) [91.73.195.150]:44052: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.147.94
country_id: 290557
description:
2026-01-13 22:49:36 dovecot_login authenticator failed for H=([80.227.147.94]) [80.227.147.94]:32917: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.91.81.195
country_id: 1643084
description:
Jan 13 22:50:42 host2 sshd[3412476]: Disconnected from invalid user www-data 36.91.81.195 port 56122 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.60.78
country_id: 1269750
description:
2026-01-13 22:51:30 dovecot_login authenticator failed for H=(dsl-tn-dynamic-217.127.246.61.airtelbroadband.in) [122.186.60.78]:50036: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.175.18.126
country_id: 1269750
description:
2026-01-13 22:52:08 dovecot_login authenticator failed for H=(telemedia-ap-dynamic-126.18.175.122.airtelbroadband.in) [122.175.18.126]:45049: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.91.81.195
country_id: 1643084
description:
Jan 13 22:54:10 host2 sshd[3415702]: Disconnected from invalid user backup 36.91.81.195 port 37534 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 144.126.217.19
country_id: 6252001
description:
Jan 13 22:53:56 host2 sshd[3415147]: Disconnected from invalid user bot 144.126.217.19 port 46286 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 144.126.217.19
country_id: 6252001
description:
Jan 13 22:54:28 host2 sshd[3416137]: Disconnected from invalid user extreme 144.126.217.19 port 57528 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 38.22.160.113
country_id: 3996063
description:
Jan 13 22:54:16 host2 sshd[3415912]: Disconnected from invalid user sybase 38.22.160.113 port 41182 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.54
country_id: 6252001
description:
Jan 13 22:55:08 host2 pure-ftpd[3416937]: (?@198.235.24.54) [INFO] New connection from 198.235.24.54


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.91.81.195
country_id: 1643084
description:
Jan 13 22:55:22 host2 sshd[3417139]: Disconnected from invalid user apache 36.91.81.195 port 58942 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 144.126.217.19
country_id: 6252001
description:
Jan 13 22:55:28 host2 sshd[3417231]: Disconnected from invalid user anonymous 144.126.217.19 port 35902 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.67.110.201
country_id: 2077456
description:
Jan 13 22:55:50 host2 sshd[3417520]: Disconnected from invalid user snmp 152.67.110.201 port 43764 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.67.110.201
country_id: 2077456
description:
Jan 13 22:59:08 host2 sshd[3420202]: Disconnected from invalid user winccd 152.67.110.201 port 44348 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan 13 22:59:48 host2 sshd[3420724]: Disconnected from invalid user user 2.57.121.25 port 24218 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.214.44.117
country_id: 149590
description:
2026-01-13 23:00:44 dovecot_login authenticator failed for H=([102.214.44.117]) [102.214.44.117]:40818: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.145.122.196
country_id: 3175395
description:
2026-01-13 23:01:22 dovecot_login authenticator failed for H=([82.145.122.196]) [82.145.122.196]:42288: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan 13 23:02:12 host2 sshd[3423043]: Disconnected from invalid user user 2.57.121.25 port 55402 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.216.29.84
country_id: 798544
description:
Jan 13 23:09:10 host2 dovecot[3335587]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=178.216.29.84, lip=66.85.158.91, TLS, session=<MFcZd0hIzrey2B1U>


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 63.143.48.24
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 63.143.48.24: 250 connections per 30 seconds to 21 port.


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 78.28.117.27
country_id: 453733
description:
Jan 13 23:09:28 host2 dovecot[3335587]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<env_eng>, method=PLAIN, rip=78.28.117.27, lip=66.85.158.91, TLS, session=<BVcveEhIpKNOHHUb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 135.233.112.94
country_id: 6252001
description:
Jan 13 23:09:41 host2 dovecot[3335587]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=135.233.112.94, lip=66.85.158.91, session=<ARj7eUhIhI+H6XBe>


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 63.143.48.24
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 63.143.48.24: 374 connections per 30 seconds to 21 port.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.137.7.97
country_id: 6252001
description:
2026-01-13 23:18:32 dovecot_plain authenticator failed for H=c-73-137-7-97.hsd1.ga.comcast.net (nonal) [73.137.7.97]:48880: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.125.169.77
country_id: 3469034
description:
2026-01-13 23:19:22 dovecot_login authenticator failed for H=179-125-169-77.static.desktop.com.br [179.125.169.77]:44969: 535 Incorrect authentication data (set_id=director@jrdc.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.250.93
country_id: 99237
description:
2026-01-13 23:19:39 dovecot_login authenticator failed for H=([65.20.250.93]) [65.20.250.93]:55725: 535 Incorrect authentication data (set_id=director)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.184.80
country_id: 99237
description:
2026-01-13 23:21:02 dovecot_plain authenticator failed for H=(facitry) [65.20.184.80]:52074: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.111.98
country_id: 6252001
description:
2026-01-13 23:22:35 dovecot_login authenticator failed for H=syn-035-130-111-098.biz.spectrum.com [35.130.111.98]:52530: 535 Incorrect authentication data (set_id=svetlana@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.67.106.221
country_id: 3686110
description:
2026-01-13 23:22:51 dovecot_login authenticator failed for H=([190.67.106.221]) [190.67.106.221]:50504: 535 Incorrect authentication data (set_id=svetlana)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.161
country_id: 2635167
description:
Jan 13 23:26:07 host2 dovecot[3335587]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=185.247.137.161, lip=66.85.158.91, TLS handshaking: Connection closed, session=<Ica8tEhIwc2594mh>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.152
country_id: 2635167
description:
Jan 13 23:25:34 host2 dovecot[3335587]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=185.247.137.152, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<1EjBskhIocy594mY>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.24
country_id: 2635167
description:
Jan 13 23:25:32 host2 dovecot[3335587]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=185.247.137.24, lip=66.85.158.91, TLS, session=<IjmsskhIO9i594kY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.148
country_id: 2635167
description:
Jan 13 23:26:41 host2 dovecot[3335587]: imap-login: Disconnected: Connection closed: read(size=679) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.148, lip=66.85.158.91, TLS handshaking: read(size=679) failed: Connection reset by peer, session=<xp7HtkhICepX7LCU>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.170
country_id: 2635167
description:
Jan 13 23:27:14 host2 dovecot[3335587]: imap-login: Disconnected: Connection closed: read(size=693) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.170, lip=66.85.158.91, TLS handshaking: read(size=693) failed: Connection reset by peer, session=<mwHDuEhIZZm594mq>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.160
country_id: 2635167
description:
Jan 13 23:27:48 host2 dovecot[3335587]: imap-login: Disconnected: Connection closed: read(size=612) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.160, lip=66.85.158.91, TLS handshaking: read(size=612) failed: Connection reset by peer, session=<vjO+ukhIc8hX7LCg>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.157
country_id: 2635167
description:
Jan 13 23:28:21 host2 dovecot[3335587]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=185.247.137.157, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<Zbe3vEhIHYy594md>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.165
country_id: 2635167
description:
Jan 13 23:28:54 host2 dovecot[3335587]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=87.236.176.165, lip=66.85.158.91, TLS handshaking: Connection closed, session=<rCK1vkhINedX7LCl>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.169
country_id: 2635167
description:
Jan 13 23:29:27 host2 dovecot[3335587]: imap-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.169, lip=66.85.158.91, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<o4iwwEhII+FX7LCp>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.159
country_id: 2635167
description:
Jan 13 23:30:01 host2 dovecot[3335587]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=87.236.176.159, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<JdqpwkhIg+tX7LCf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.167
country_id: 2635167
description:
Jan 13 23:30:34 host2 dovecot[3335587]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=185.247.137.167, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<9kelxEhIbYi594mn>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.185.21
country_id: 6252001
description:
Jan 13 23:31:56 host2 dovecot[3335587]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.65.185.21, lip=66.85.158.92, session=<ayyMyUhITN4UQbkV>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.112.0.11
country_id: 3469034
description:
Jan 13 23:42:07 host2 sshd[3467291]: Disconnected from invalid user steam 189.112.0.11 port 48896 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 23.227.147.163
country_id: 6252001
description:
Jan 13 23:43:52 host2 sshd[3468683]: Disconnected from invalid user docker 23.227.147.163 port 55836 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.112.0.11
country_id: 3469034
description:
Jan 13 23:44:02 host2 sshd[3468827]: Disconnected from invalid user devops 189.112.0.11 port 45394 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.36.253.252
country_id: 3175395
description:
Jan 13 23:44:54 host2 sshd[3469562]: Disconnected from invalid user chef 151.36.253.252 port 3240 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2026-01-13 23:44:14 dovecot_plain authenticator failed for H=(unasor) [154.144.243.93]:35316: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 189.112.0.11
country_id: 3469034
description:
Jan 13 23:44:40 host2 sshd[3469315]: Disconnected from invalid user aws 189.112.0.11 port 56812 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 23.227.147.163
country_id: 6252001
description:
Jan 13 23:45:11 host2 sshd[3470001]: Disconnected from invalid user dockeruser 23.227.147.163 port 46434 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.112.0.11
country_id: 3469034
description:
Jan 13 23:45:55 host2 sshd[3470860]: Disconnected from invalid user super 189.112.0.11 port 51414 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 23.227.147.163
country_id: 6252001
description:
Jan 13 23:46:16 host2 sshd[3471102]: Disconnected from invalid user kafka 23.227.147.163 port 46980 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 150.5.169.138
country_id: 1819730
description:
Jan 13 23:47:40 host2 sshd[3472059]: Disconnected from invalid user naztec 150.5.169.138 port 38216 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 151.36.253.252
country_id: 3175395
description:
Jan 13 23:48:47 host2 sshd[3472972]: Disconnected from invalid user openvpn 151.36.253.252 port 3173 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.174.114.50
country_id: 1643084
description:
Jan 13 23:48:12 host2 sshd[3472470]: Disconnected from invalid user grafana 103.174.114.50 port 44716 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 150.5.169.138
country_id: 1819730
description:
Jan 13 23:48:17 host2 sshd[3472534]: Disconnected from invalid user superview 150.5.169.138 port 46966 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.81.229.181
country_id: 6252001
description:
2026-01-13 23:49:35 dovecot_login authenticator failed for H=(fabfibernet.com) [192.81.229.181]:52494: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.252.85
country_id: 1210997
description:
2026-01-13 23:49:17 dovecot_login authenticator failed for H=([103.115.252.60]) [103.115.252.85]:36531: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 150.5.169.138
country_id: 1819730
description:
Jan 13 23:49:24 host2 sshd[3473687]: Disconnected from invalid user chef 150.5.169.138 port 49766 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2026-01-13 23:50:15 dovecot_login authenticator failed for H=host-196-47-172-253.afnet.net [196.47.172.253]:49464: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.174.114.50
country_id: 1643084
description:
Jan 13 23:50:25 host2 sshd[3474547]: Disconnected from invalid user drone 103.174.114.50 port 60504 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.222
country_id: 1269750
description:
2026-01-13 23:50:39 dovecot_login authenticator failed for H=([122.187.230.222]) [122.187.230.222]:55139: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.223.53.234
country_id: 3932488
description:
2026-01-13 23:50:48 dovecot_login authenticator failed for H=([190.223.53.234]) [190.223.53.234]:50213: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.61.6
country_id: 290557
description:
2026-01-13 23:51:06 dovecot_login authenticator failed for H=([5.32.61.6]) [5.32.61.6]:47030: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.30.170
country_id: 3144096
description:
2026-01-13 23:51:18 dovecot_login authenticator failed for H=([178.232.30.170]) [178.232.30.170]:39950: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.104.24.6
country_id: 3923057
description:
2026-01-13 23:51:48 dovecot_login authenticator failed for H=(SCZ-190-104-24-00006.tigo.bo) [190.104.24.6]:55524: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.226.48.35
country_id: 1269750
description:
2026-01-13 23:54:18 dovecot_login authenticator failed for H=([117.226.48.35]) [117.226.48.35]:57392: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.142.106.177
country_id: 298795
description:
2026-01-13 23:54:34 dovecot_login authenticator failed for H=([188.132.210.145]) [195.142.106.177]:12071: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.189.235.176
country_id: 1643084
description:
Jan 13 23:57:54 host2 sshd[3481553]: Disconnected from invalid user admin 103.189.235.176 port 46138 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.95.221.140
country_id: 1643084
description:
Jan 14 00:01:00 host2 sshd[3484532]: Disconnected from invalid user admin 36.95.221.140 port 54036 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.8
country_id: 2186224
description:
2026-01-14 00:01:29 dovecot_login authenticator failed for H=([121.73.163.8]) [121.73.163.8]:43900: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.67
country_id: 6252001
description:
Jan 14 00:01:40 host2 dovecot[3335587]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.235.24.67, lip=66.85.158.92, TLS, session=<XnflM0lI7O3G6xhD>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.4.68.72
country_id: 1210997
description:
2026-01-14 00:01:47 dovecot_login authenticator failed for H=(210.4.68-72.bdcom.com) [210.4.68.72]:48080: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.75.27.166
country_id: 3017382
description:
Jan 14 00:02:20 host2 sshd[3485765]: Disconnected from invalid user couchbase 51.75.27.166 port 54316 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.198.129.123
country_id: 1819730
description:
2026-01-14 00:02:26 dovecot_login authenticator failed for H=123.129.198.203.static.netvigator.com [203.198.129.123]:56376: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.37.223.58
country_id: 3175395
description:
2026-01-14 00:02:51 dovecot_login authenticator failed for H=net-2-37-223-58.cust.vodafonedsl.it [2.37.223.58]:48710: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.36.60.94
country_id: 3175395
description:
Jan 14 00:02:57 host2 sshd[3486408]: Disconnected from invalid user rsync 151.36.60.94 port 18202 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.75.27.166
country_id: 3017382
description:
Jan 14 00:03:40 host2 sshd[3487141]: Disconnected from invalid user elasticsearch 51.75.27.166 port 40508 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 54.37.138.249
country_id: 3017382
description:
Jan 14 00:03:59 host2 sshd[3487338]: Disconnected from invalid user wincce 54.37.138.249 port 53330 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.36.60.94
country_id: 3175395
description:
Jan 14 00:03:48 host2 sshd[3487226]: Disconnected from invalid user rabbitmq 151.36.60.94 port 18227 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.189.235.176
country_id: 1643084
description:
Jan 14 00:04:25 host2 sshd[3487700]: Disconnected from invalid user ubuntu 103.189.235.176 port 46210 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.30.14.221
country_id: 6252001
description:
2026-01-14 00:04:56 dovecot_login authenticator failed for H=pool-108-30-14-221.nycmny.fios.verizon.net [108.30.14.221]:52738: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.75.27.166
country_id: 3017382
description:
Jan 14 00:04:14 host2 sshd[3487636]: Disconnected from invalid user guest 51.75.27.166 port 55852 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.204.54.62
country_id: 1269750
description:
Jan 14 00:05:05 host2 sshd[3488360]: Disconnected from invalid user wildfly 43.204.54.62 port 43626 [preauth]


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.239
country_id: 2635167
description:
Jan 14 00:06:06 host2 dovecot[3335587]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=87.236.176.239, lip=66.85.158.91, TLS, session=<Obu3Q0lIK8JX7LDv>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.7.227.98
country_id: 1269750
description:
Jan 14 00:05:25 host2 sshd[3488885]: Disconnected from invalid user frappe 124.7.227.98 port 54034 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.226.118.0
country_id: 3469034
description:
2026-01-14 00:05:38 dovecot_login authenticator failed for H=([38.226.118.9]) [38.226.118.0]:40488: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.204.54.62
country_id: 1269750
description:
Jan 14 00:05:42 host2 sshd[3489060]: Disconnected from invalid user pcfactory 43.204.54.62 port 56970 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.122.23
country_id: 1819730
description:
Jan 14 00:06:36 host2 sshd[3489756]: Disconnected from invalid user exec 101.36.122.23 port 39612 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 124.7.227.98
country_id: 1269750
description:
Jan 14 00:06:21 host2 sshd[3489581]: Disconnected from invalid user User 124.7.227.98 port 59936 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.189.235.176
country_id: 1643084
description:
Jan 14 00:07:08 host2 sshd[3490397]: Disconnected from invalid user ubuntu 103.189.235.176 port 58048 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.7.227.98
country_id: 1269750
description:
Jan 14 00:07:17 host2 sshd[3490604]: Disconnected from invalid user rabbitmq 124.7.227.98 port 30790 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 54.37.138.249
country_id: 3017382
description:
Jan 14 00:07:40 host2 sshd[3490929]: Disconnected from invalid user openvpn 54.37.138.249 port 57436 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.189.235.176
country_id: 1643084
description:
Jan 14 00:09:00 host2 sshd[3492240]: Disconnected from invalid user ubuntu 103.189.235.176 port 38448 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.122.23
country_id: 1819730
description:
Jan 14 00:08:15 host2 sshd[3491610]: Disconnected from invalid user hpe 101.36.122.23 port 47768 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.36.60.94
country_id: 3175395
description:
Jan 14 00:10:17 host2 sshd[3493555]: Disconnected from invalid user devops 151.36.60.94 port 18777 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 194.165.16.167
country_id: 2993457
description:
Jan 14 00:10:34 host2 pure-ftpd[3493825]: (?@194.165.16.167) [INFO] New connection from 194.165.16.167


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.148.174.234
country_id: 2017370
description:
2026-01-14 00:10:43 dovecot_login authenticator failed for H=([31.148.174.234]) [31.148.174.234]:50002: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.166
country_id: 1269750
description:
2026-01-14 00:11:19 dovecot_login authenticator failed for H=([182.95.181.166]) [182.95.181.166]:42056: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 52.180.157.88
country_id: 6252001
description:
Jan 14 00:18:48 host2 dovecot[3335587]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=52.180.157.88, lip=66.85.158.92, session=<UpsicUlIap40tJ1Y>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.164.137
country_id: 99237
description:
2026-01-14 00:20:50 dovecot_plain authenticator failed for H=(mopple) [65.20.164.137]:44339: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 14 00:21:33 host2 sshd[3503301]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 14 00:22:35 host2 sshd[3504335]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.122.247
country_id: 3144096
description:
2026-01-14 00:31:35 dovecot_login authenticator failed for H=(cm-178.232.122.247.get.no) [178.232.122.247]:34855: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.228.234
country_id: 1269750
description:
2026-01-14 00:31:48 dovecot_login authenticator failed for H=(nsg-static-234.228.76.182-airtel.com) [182.76.228.234]:57850: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.35.53
country_id: 3144096
description:
2026-01-14 00:31:49 dovecot_login authenticator failed for H=([46.212.35.53]) [46.212.35.53]:53456: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.230.134
country_id: 1269750
description:
2026-01-14 00:32:13 dovecot_login authenticator failed for H=([182.95.215.73]) [182.95.230.134]:40674: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.127.86
country_id: 1269750
description:
2026-01-14 00:33:49 dovecot_login authenticator failed for H=(dsl-ncr-dynamic-097.178.23.125.airtelbroadband.in) [182.79.127.86]:37496: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.66.173
country_id: 3144096
description:
2026-01-14 00:33:52 dovecot_login authenticator failed for H=([127.0.0.1]) [178.232.66.173]:46713: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.175.58.75
country_id: 294640
description:
2026-01-14 00:33:41 dovecot_login authenticator failed for H=([127.0.0.1]) [93.175.58.75]:33664: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.85.38
country_id: 1269750
description:
2026-01-14 00:34:20 dovecot_login authenticator failed for H=([182.79.85.38]) [182.79.85.38]:41496: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.230.80.29
country_id: 3865483
description:
Jan 14 00:38:56 host2 dovecot[3335587]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=45.230.80.29, lip=66.85.158.91, TLS, session=<dPfat0lIAO0t5lAd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.250.235
country_id: 3865483
description:
Jan 14 00:39:47 host2 dovecot[3335587]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 38 secs): user=<careers>, method=PLAIN, rip=179.0.250.235, lip=66.85.158.91, TLS, session=<tZ7xuUlIT9KzAPrr>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 135.237.125.122
country_id: 6252001
description:
Jan 14 00:48:14 host2 dovecot[3335587]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=135.237.125.122, lip=66.85.158.91, session=<Uk1t2klIQKKH7X16>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.220
country_id: 130758
description:
2026-01-14 00:48:33 dovecot_login authenticator failed for H=(localhost) [62.60.130.220]:52393: 535 Incorrect authentication data (set_id=conta)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.42
country_id: 6252001
description:
Jan 14 00:49:30 host2 dovecot[3335587]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 3 secs): user=<>, rip=198.235.24.42, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<KH7u3klINMPG6xgq>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.195
country_id: 6252001
description:
Jan 14 00:58:55 host2 dovecot[3335587]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=147.185.132.195, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<3oKdAEpIbcCTuYTD>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 74.82.47.3
country_id: 6252001
description:
Jan 14 01:01:38 host2 dovecot[3335587]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=74.82.47.3, lip=66.85.158.91, TLS handshaking: Connection closed, session=<0vpYCkpIwkBKUi8D>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 74.82.47.3
country_id: 6252001
description:
Jan 14 01:02:15 host2 dovecot[3335587]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=74.82.47.3, lip=66.85.158.91, TLS: Connection closed, session=<hLiNDEpIlu1KUi8D>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.169.4.104
country_id: 2635167
description:
Jan 14 01:09:36 host2 dovecot[3335587]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 50 secs): user=<>, rip=185.169.4.104, lip=66.85.158.91, TLS handshaking: read(size=1026) failed: Connection reset by peer, session=<H9LbJkpIg/m5qQRo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.51.135
country_id: 3144096
description:
2026-01-14 01:13:28 dovecot_login authenticator failed for H=([178.232.51.135]) [178.232.51.135]:51811: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.0.228.11
country_id: 1269750
description:
2026-01-14 01:13:56 dovecot_login authenticator failed for H=([61.0.228.11]) [61.0.228.11]:51590: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.176.115.34
country_id: 1269750
description:
Jan 14 01:18:42 host2 sshd[3556911]: Disconnected from invalid user alcatel 122.176.115.34 port 52232 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.194.230.231
country_id: 1861060
description:
Jan 14 01:19:43 host2 sshd[3557769]: Disconnected from invalid user runner 118.194.230.231 port 58118 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.5.113.133
country_id: 3865483
description:
2026-01-14 01:20:00 dovecot_login authenticator failed for H=(host133.advance.com.ar) [200.5.113.133]:8089: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 13.81.183.29
country_id: 2750405
description:
Jan 14 01:20:24 host2 sshd[3558607]: Disconnected from invalid user mobotix 13.81.183.29 port 43340 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.27
country_id: 1733045
description:
2026-01-14 01:20:28 dovecot_login authenticator failed for H=([49.124.151.27]) [49.124.151.27]:43222: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 172.202.118.19
country_id: 6252001
description:
Jan 14 01:21:53 host2 pure-ftpd[3560029]: (?@172.202.118.19) [INFO] New connection from 172.202.118.19


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 178.128.243.225
country_id: 2750405
description:
Jan 14 01:21:49 host2 sshd[3559924]: Disconnected from invalid user mssql 178.128.243.225 port 53840 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 178.128.243.225
country_id: 2750405
description:
Jan 14 01:22:47 host2 sshd[3560785]: Disconnected from invalid user datadog 178.128.243.225 port 57666 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.194.230.231
country_id: 1861060
description:
Jan 14 01:23:11 host2 sshd[3561240]: Disconnected from invalid user clickhouse 118.194.230.231 port 58240 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.230.3
country_id: 1880251
description:
Jan 14 01:23:52 host2 sshd[3561702]: Disconnected from invalid user chef 45.78.230.3 port 46406 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.139.107.146
country_id: 1269750
description:
2026-01-14 01:24:02 dovecot_login authenticator failed for H=([14.139.107.146]) [14.139.107.146]:53382: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.237.115.208
country_id: 732800
description:
2026-01-14 01:24:19 dovecot_login authenticator failed for H=(151.237.115.208.pronet.bg) [151.237.115.208]:36340: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 38.47.92.86
country_id: 1643084
description:
Jan 14 01:24:21 host2 sshd[3562160]: Disconnected from invalid user freepbx 38.47.92.86 port 54696 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 178.128.243.225
country_id: 2750405
description:
Jan 14 01:24:35 host2 sshd[3562326]: Disconnected from invalid user httpd 178.128.243.225 port 48002 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.194.230.231
country_id: 1861060
description:
Jan 14 01:24:22 host2 sshd[3562182]: Disconnected from invalid user aws 118.194.230.231 port 58374 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.165.121.195
country_id: 1269750
description:
Jan 14 01:25:57 host2 sshd[3563483]: Disconnected from invalid user botuser 122.165.121.195 port 55842 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.226.88.121
country_id: 2661886
description:
2026-01-14 01:26:24 dovecot_plain authenticator failed for H=81-226-88-121-no600.tbcn.telia.com (visivally) [81.226.88.121]:38395: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.196.9.84
country_id: 2635167
description:
Jan 14 01:28:48 host2 sshd[3565842]: Disconnected from invalid user upload 185.196.9.84 port 38464 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 122.165.121.195
country_id: 1269750
description:
Jan 14 01:29:13 host2 sshd[3566122]: Disconnected from invalid user aws 122.165.121.195 port 56868 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.110
country_id: 6252001
description:
Jan 14 01:29:25 host2 dovecot[3335587]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.110, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<dFazbUpI4NfN0h9u>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.230.3
country_id: 1880251
description:
Jan 14 01:29:55 host2 sshd[3566755]: Disconnected from invalid user sysdiag 45.78.230.3 port 37640 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.165.121.195
country_id: 1269750
description:
Jan 14 01:30:15 host2 sshd[3567194]: Disconnected from invalid user gogs 122.165.121.195 port 53076 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.230.3
country_id: 1880251
description:
Jan 14 01:30:52 host2 sshd[3567696]: Disconnected from invalid user vpn 45.78.230.3 port 45536 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.221.119
country_id: 298795
description:
2026-01-14 01:33:24 dovecot_plain authenticator failed for H=(inesibunce) [5.11.221.119]:45330: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.230.3
country_id: 1880251
description:
Jan 14 01:33:46 host2 sshd[3569097]: Disconnected from invalid user ADMIN 45.78.230.3 port 51526 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.240.13.18
country_id: 1819730
description:
Jan 14 01:33:50 host2 sshd[3569149]: Disconnected from invalid user admin 43.240.13.18 port 52464 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan 14 01:36:20 host2 sshd[3570840]: Disconnected from invalid user admin 2.57.121.112 port 46481 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.93.177.228
country_id: 1269750
description:
2026-01-14 01:36:27 dovecot_login authenticator failed for H=([111.93.177.228]) [111.93.177.228]:33718: 535 Incorrect authentication data (set_id=abuse@systemtec.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.60.186
country_id: 1819730
description:
2026-01-14 01:36:44 dovecot_login authenticator failed for H=42-200-60-186.static.imsbiz.com [42.200.60.186]:63617: 535 Incorrect authentication data (set_id=abuse@systemtec.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2026-01-14 01:36:51 dovecot_login authenticator failed for H=c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:54696: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.222
country_id: 1269750
description:
2026-01-14 01:37:15 dovecot_login authenticator failed for H=([122.187.230.222]) [122.187.230.222]:47419: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 88.212.44.98
country_id: 3057568
description:
Jan 14 01:38:12 host2 sshd[3572048]: Disconnected from invalid user ubuntu 88.212.44.98 port 49822 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan 14 01:38:37 host2 sshd[3572300]: Disconnected from invalid user admin 2.57.121.112 port 16352 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 88.212.44.98
country_id: 3057568
description:
Jan 14 01:40:28 host2 sshd[3573833]: Disconnected from invalid user ubuntu 88.212.44.98 port 33512 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.240.13.18
country_id: 1819730
description:
Jan 14 01:43:51 host2 sshd[3575315]: Disconnected from invalid user admin 43.240.13.18 port 45594 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.230.124.17
country_id: 1512440
description:
2026-01-14 01:45:03 dovecot_login authenticator failed for H=([213.230.124.17]) [213.230.124.17]:44162: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.140.54
country_id: 1269750
description:
2026-01-14 01:45:49 dovecot_login authenticator failed for H=(dsl-mp-dynamic-054.140.23.125.airtelbroadband.in) [125.23.140.54]:34110: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.240.13.18
country_id: 1819730
description:
Jan 14 01:47:45 host2 sshd[3578279]: Disconnected from invalid user admin 43.240.13.18 port 48426 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.121
country_id: 6252001
description:
Jan 14 01:51:39 host2 dovecot[3335587]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.121, lip=66.85.158.92, session=<ocY1vUpIlTNAPpx5>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.108
country_id: 6252001
description:
Jan 14 01:51:49 host2 dovecot[3335587]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.108, lip=66.85.158.92, TLS: Connection closed, session=<bzvUvUpING9APpxs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 93.174.180.151
country_id: 3057568
description:
Jan 14 01:51:57 host2 dovecot[3335587]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=93.174.180.151, lip=66.85.158.91, TLS, session=<kwVNvUpIeYRdrrSX>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.89.137.87
country_id: 3469034
description:
Jan 14 01:52:34 host2 dovecot[3335587]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<env_eng>, method=PLAIN, rip=190.89.137.87, lip=66.85.158.91, TLS, session=<tXZRv0pICsK+WYlX>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.240.13.18
country_id: 1819730
description:
Jan 14 01:54:33 host2 sshd[3585752]: Disconnected from invalid user ubuntu 43.240.13.18 port 59434 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.61.114
country_id: 1269750
description:
2026-01-14 01:54:49 dovecot_login authenticator failed for H=([182.95.25.142]) [182.95.61.114]:42234: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.212
country_id: 1819730
description:
2026-01-14 01:55:04 dovecot_login authenticator failed for H=212.42.246.220.static.netvigator.com [220.246.42.212]:51515: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 14 02:04:15 host2 sshd[3595394]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.77
country_id: 6252001
description:
Jan 14 02:04:58 host2 dovecot[3335587]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.77, lip=66.85.158.91, TLS handshaking: Connection closed, session=<Bm3T7EpIgnpAPsVN>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.89
country_id: 6252001
description:
Jan 14 02:04:41 host2 dovecot[3335587]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.89, lip=66.85.158.91, TLS handshaking: Connection closed, session=<xyXS60pI2a9APsVZ>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 14 02:05:16 host2 sshd[3596310]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.73.134
country_id: 3469034
description:
Jan 14 02:05:52 host2 dovecot[3335587]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 23 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=187.120.73.134, lip=66.85.158.91, TLS, session=<7Fqz7kpIN+W7eEmG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan 14 02:06:00 host2 dovecot[3335587]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@seyawin.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<rKFl8EpIzeF100Db>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.77
country_id: 6252001
description:
Jan 14 02:05:08 host2 dovecot[3335587]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.197.77, lip=66.85.158.91, TLS: Connection closed, session=<qQ9z7UpIZD5APsVN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.105.219.200
country_id: 690791
description:
Jan 14 02:06:17 host2 dovecot[3335587]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<env_eng>, method=PLAIN, rip=176.105.219.200, lip=66.85.158.91, TLS, session=<22aT8EpIQcKwadvI>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.221.122
country_id: 3144096
description:
2026-01-14 02:08:11 dovecot_login authenticator failed for H=(cm-178.232.221.122.get.no) [178.232.221.122]:51732: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.168.12.135
country_id: 2077456
description:
2026-01-14 02:08:24 dovecot_login authenticator failed for H=([101.168.12.135]) [101.168.12.135]:39200: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.200.180.174
country_id: 6252001
description:
2026-01-14 02:10:45 dovecot_login authenticator failed for H=survey.hagbergconsulting.com [207.200.180.174]:49339: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2026-01-14 02:10:58 dovecot_login authenticator failed for H=([102.53.15.18]) [102.53.15.18]:56000: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.152.225.154
country_id: 6251999
description:
2026-01-14 02:11:03 dovecot_login authenticator failed for H=s75-152-225-154.ab.hsia.telus.net [75.152.225.154]:27241: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.56.246.185
country_id: 1269750
description:
2026-01-14 02:11:42 dovecot_login authenticator failed for H=([120.56.246.185]) [120.56.246.185]:36415: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.252.168.4
country_id: 1269750
description:
2026-01-14 02:12:15 dovecot_login authenticator failed for H=a4.ucndns.in [103.252.168.4]:34201: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.155.175
country_id: 1733045
description:
2026-01-14 02:19:39 dovecot_login authenticator failed for H=([49.124.155.175]) [49.124.155.175]:46286: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.218.244
country_id: 1880251
description:
Jan 14 02:21:07 host2 sshd[3611565]: Disconnected from invalid user ubuntu 152.32.218.244 port 57546 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.85.104.2
country_id: 6252001
description:
2026-01-14 02:21:04 dovecot_plain authenticator failed for H=(ariesonted) [96.85.104.2]:57590: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.180.114.229
country_id: 6252001
description:
Jan 14 02:21:59 host2 sshd[3612222]: Disconnected from invalid user admin 47.180.114.229 port 49930 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.51.246
country_id: 1880251
description:
Jan 14 02:22:43 host2 sshd[3612849]: Disconnected from invalid user admin 101.47.51.246 port 53200 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.194.250.47
country_id: 1605651
description:
Jan 14 02:24:15 host2 sshd[3614513]: Disconnected from invalid user admin 118.194.250.47 port 34038 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 47.180.114.229
country_id: 6252001
description:
Jan 14 02:25:22 host2 sshd[3615700]: Disconnected from invalid user admin 47.180.114.229 port 42630 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.194.250.47
country_id: 1605651
description:
Jan 14 02:25:27 host2 sshd[3615750]: Disconnected from invalid user admin 118.194.250.47 port 52850 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 47.180.114.229
country_id: 6252001
description:
Jan 14 02:25:52 host2 sshd[3616230]: Received disconnect from 47.180.114.229 port 53686:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.218.244
country_id: 1880251
description:
Jan 14 02:26:15 host2 sshd[3616664]: Disconnected from invalid user admin 152.32.218.244 port 57324 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 118.194.250.47
country_id: 1605651
description:
Jan 14 02:27:09 host2 sshd[3617408]: Disconnected from invalid user admin 118.194.250.47 port 38904 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.194.250.47
country_id: 1605651
description:
Jan 14 02:28:18 host2 sshd[3618356]: Disconnected from invalid user admin 118.194.250.47 port 41792 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.218.244
country_id: 1880251
description:
Jan 14 02:28:42 host2 sshd[3618680]: Disconnected from invalid user admin 152.32.218.244 port 39764 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.218.244
country_id: 1880251
description:
Jan 14 02:29:17 host2 sshd[3619232]: Disconnected from invalid user admin 152.32.218.244 port 50686 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.51.246
country_id: 1880251
description:
Jan 14 02:29:46 host2 sshd[3619587]: Disconnected from invalid user ubuntu 101.47.51.246 port 44316 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.51.246
country_id: 1880251
description:
Jan 14 02:30:44 host2 sshd[3620685]: Disconnected from invalid user ubuntu 101.47.51.246 port 34536 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.37.181.181
country_id: 1831722
description:
2026-01-14 02:31:30 dovecot_login authenticator failed for H=([36.37.181.181]) [36.37.181.181]:41220: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.251.179.129
country_id: 1522867
description:
2026-01-14 02:32:09 dovecot_login authenticator failed for H=([5.251.179.129]) [5.251.179.129]:43041: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.122
country_id: 1269750
description:
2026-01-14 02:34:52 dovecot_login authenticator failed for H=([182.95.176.122]) [182.95.176.122]:36812: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.23.140
country_id: 3144096
description:
2026-01-14 02:35:36 dovecot_login authenticator failed for H=([178.232.23.140]) [178.232.23.140]:49971: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.47.51.246
country_id: 1880251
description:
Jan 14 02:35:43 host2 sshd[3625156]: Disconnected from invalid user admin 101.47.51.246 port 60030 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 89.249.55.106
country_id: 2017370
description:
[2026-01-14 02:35:57 +0530] info [cpaneld] 89.249.55.106 - monarchd "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user monarchd (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.159
country_id: 6252001
description:
Jan 14 02:40:29 host2 dovecot[3335587]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=147.185.132.159, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<CEzUa0tIr8OTuYSf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan 14 02:41:18 host2 dovecot[3335587]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@seyawin.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<lxaUbktIMcV100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.220
country_id: 130758
description:
2026-01-14 02:42:25 dovecot_login authenticator failed for H=(localhost) [62.60.130.220]:53522: 535 Incorrect authentication data (set_id=harry@akparnhi.ac.id)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.127.128
country_id: 3144096
description:
2026-01-14 02:44:04 dovecot_login authenticator failed for H=(cm-46.212.127.128.get.no) [46.212.127.128]:57477: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 168.228.235.21
country_id: 3508796
description:
2026-01-14 02:44:27 dovecot_login authenticator failed for H=([168.228.235.21]) [168.228.235.21]:57140: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 78.68.37.25
country_id: 2661886
description:
Jan 14 02:44:33 host2 dovecot[3335587]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=78.68.37.25, lip=66.85.158.91, session=<VVZGektIB89ORCUZ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.158.145.31
country_id: 2510769
description:
2026-01-14 02:44:41 dovecot_login authenticator failed for H=31.145.158.146.dynamic.jazztel.es [146.158.145.31]:56676: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 122.187.227.197
country_id: 1269750
description:
Jan 14 02:44:47 host2 dovecot[3335587]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=122.187.227.197, lip=66.85.158.91, session=<JRkLe0tI+ap6u+PF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 81.233.235.203
country_id: 2661886
description:
Jan 14 02:44:59 host2 dovecot[3335587]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=81.233.235.203, lip=66.85.158.91, session=<9fDOe0tI2LNR6evL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 106.51.29.53
country_id: 1269750
description:
Jan 14 02:45:12 host2 dovecot[3335587]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=106.51.29.53, lip=66.85.158.91, session=<hR+QfEtIYqhqMx01>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan 14 02:46:06 host2 sshd[3634976]: Disconnected from invalid user admin 2.57.121.112 port 21448 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.114.21.51
country_id: 2328926
description:
2026-01-14 02:48:34 dovecot_plain authenticator failed for H=(remoon) [105.114.21.51]:35502: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.137.7.97
country_id: 6252001
description:
2026-01-14 02:48:38 dovecot_plain authenticator failed for H=c-73-137-7-97.hsd1.ga.comcast.net (ditzotul) [73.137.7.97]:58504: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.139.70
country_id: 6252001
description:
Jan 14 02:54:30 host2 dovecot[3335587]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=184.105.139.70, lip=66.85.158.92, session=<KLj8nUtINCa4aYtG>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 74.82.47.4
country_id: 6252001
description:
Jan 14 02:54:34 host2 dovecot[3335587]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=74.82.47.4, lip=66.85.158.91, session=<yxc+nktIxJNKUi8E>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 77.83.39.144
country_id: 690791
description:
[2026-01-14 02:55:00 +0530] info [cpaneld] 77.83.39.144 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilan_travel (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 77.83.39.144
country_id: 690791
description:
Jan 14 02:54:59 host2 sshd[3643046]: Invalid user cloudtourssrilan_travel from 77.83.39.144 port 42868


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.64.27.145
country_id: 3932488
description:
Jan 14 02:59:18 host2 sshd[3646447]: Disconnected from invalid user webmaster 181.64.27.145 port 50200 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.22.35.88
country_id: 6252001
description:
Jan 14 02:59:32 host2 sshd[3646657]: Disconnected from invalid user chef 165.22.35.88 port 58596 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.201.83
country_id: 1733045
description:
2026-01-14 03:02:01 dovecot_login authenticator failed for H=([49.125.201.83]) [49.125.201.83]:59616: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.122
country_id: 1269750
description:
2026-01-14 03:02:51 dovecot_login authenticator failed for H=([59.145.84.169]) [182.95.176.122]:43176: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.22.35.88
country_id: 6252001
description:
Jan 14 03:02:53 host2 sshd[3650051]: Disconnected from invalid user devuser 165.22.35.88 port 39754 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 199.231.163.19
country_id: 6252001
description:
Jan 14 03:02:58 host2 sshd[3650138]: Disconnected from invalid user testuser 199.231.163.19 port 33458 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.95.22.4
country_id: 3469034
description:
2026-01-14 03:03:26 dovecot_login authenticator failed for H=([127.0.0.1]) [187.95.22.4]:40548: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.64.27.145
country_id: 3932488
description:
Jan 14 03:03:08 host2 sshd[3650365]: Disconnected from invalid user splunk 181.64.27.145 port 39530 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.200.48.114
country_id: 1269750
description:
2026-01-14 03:03:18 dovecot_login authenticator failed for H=([127.0.0.1]) [121.200.48.114]:43069: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.22.35.88
country_id: 6252001
description:
Jan 14 03:03:22 host2 sshd[3650649]: Disconnected from invalid user splunk 165.22.35.88 port 49636 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 165.22.35.88
country_id: 6252001
description:
Jan 14 03:04:15 host2 sshd[3651380]: Disconnected from invalid user git 165.22.35.88 port 37688 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.64.27.145
country_id: 3932488
description:
Jan 14 03:04:32 host2 sshd[3651571]: Disconnected from invalid user User 181.64.27.145 port 42446 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.185.24.228
country_id: 6252001
description:
Jan 14 03:04:44 host2 sshd[3651742]: Disconnected from invalid user foscam 172.185.24.228 port 50586 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 16.170.240.17
country_id: 2661886
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 16.170.240.17 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.185.24.228
country_id: 6252001
description:
Jan 14 03:06:36 host2 sshd[3653415]: Disconnected from invalid user watchguard 172.185.24.228 port 59472 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.185.24.228
country_id: 6252001
description:
Jan 14 03:07:11 host2 sshd[3653999]: Disconnected from invalid user loader 172.185.24.228 port 48768 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 129.213.226.156
country_id: 6252001
description:
Jan 14 03:07:16 host2 sshd[3654049]: Disconnected from invalid user splunk 129.213.226.156 port 39780 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.108
country_id: 6252001
description:
Jan 14 03:07:46 host2 dovecot[3335587]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.108, lip=66.85.158.92, TLS handshaking: Connection closed, session=<bCBnzUtIEvZBMQFs>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.108
country_id: 6252001
description:
Jan 14 03:08:13 host2 dovecot[3335587]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.108, lip=66.85.158.92, TLS: Connection closed, session=<uZAJz0tIesBBMQFs>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 129.213.226.156
country_id: 6252001
description:
Jan 14 03:09:19 host2 sshd[3656004]: Disconnected from invalid user git 129.213.226.156 port 40194 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2026-01-14 03:15:33 dovecot_login authenticator failed for H=([102.53.15.56]) [102.53.15.56]:57336: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.218.95.154
country_id: 6252001
description:
2026-01-14 03:15:58 dovecot_login authenticator failed for H=syn-074-218-095-154.biz.spectrum.com [74.218.95.154]:43370: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.47.169
country_id: 1819730
description:
2026-01-14 03:16:42 dovecot_login authenticator failed for H=169.47.246.220.static.netvigator.com [220.246.47.169]:60664: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.237.47.214
country_id: 3996063
description:
2026-01-14 03:17:01 dovecot_login authenticator failed for H=(customer-187-237-47-214.uninet-ide.com.mx) [187.237.47.214]:47285: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.52
country_id: 6252001
description:
Jan 14 03:31:57 host2 dovecot[3335587]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=147.185.132.52, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<L3XpI0xIVNWTuYQ0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.160.107
country_id: 99237
description:
2026-01-14 03:34:57 dovecot_plain authenticator failed for H=(delogy) [65.20.160.107]:51352: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.162.248
country_id: 2186224
description:
2026-01-14 03:39:10 dovecot_login authenticator failed for H=([121.73.162.248]) [121.73.162.248]:54076: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.230.134
country_id: 1269750
description:
2026-01-14 03:39:36 dovecot_login authenticator failed for H=([182.95.230.134]) [182.95.230.134]:39032: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.124.139.77
country_id: 3144096
description:
2026-01-14 03:40:03 dovecot_login authenticator failed for H=([188.124.139.77]) [188.124.139.77]:36554: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan 14 03:40:07 host2 sshd[3685285]: Disconnected from invalid user user 2.57.121.25 port 30859 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.146.191
country_id: 3996063
description:
2026-01-14 03:40:23 dovecot_login authenticator failed for H=([177.236.146.191]) [177.236.146.191]:36977: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.155.97.139
country_id: 453733
description:
[2026-01-14 03:43:13 +0530] info [webmaild] 185.155.97.139 - env_eng@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 14 03:45:38 host2 sshd[3690381]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 14 03:46:39 host2 sshd[3692003]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.79.181.94
country_id: 6252001
description:
Jan 14 03:47:17 host2 dovecot[3335587]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=45.79.181.94, lip=66.85.158.92, session=<QZ+6WkxIYNotT7Ve>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.162
country_id: 6252001
description:
Jan 14 03:48:11 host2 pure-ftpd[3693763]: (?@205.210.31.162) [INFO] New connection from 205.210.31.162


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.149.93
country_id: 99237
description:
2026-01-14 03:51:11 dovecot_plain authenticator failed for H=(unseart) [65.20.149.93]:36376: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.145.126
country_id: 1819730
description:
2026-01-14 03:51:28 dovecot_login authenticator failed for H=(223-197-145-126.static.imsbiz.com) [223.197.145.126]:64321: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.36
country_id: 1269750
description:
2026-01-14 03:51:40 dovecot_login authenticator failed for H=(nsg-corporate-36.229.187.122.airtel.in) [122.187.229.36]:41074: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.0.38.130
country_id: 1210997
description:
2026-01-14 03:57:40 dovecot_login authenticator failed for H=([49.0.38.130]) [49.0.38.130]:47158: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.146.233.156
country_id: 1269750
description:
2026-01-14 03:58:27 dovecot_login authenticator failed for H=([103.146.233.156]) [103.146.233.156]:33241: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.170.97.94
country_id: 1269750
description:
2026-01-14 04:01:45 dovecot_login authenticator failed for H=([122.170.97.94]) [122.170.97.94]:47828: 535 Incorrect authentication data (set_id=abuse@visionsolutionshospital.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.42.225.40
country_id: 2510769
description:
2026-01-14 04:02:14 dovecot_login authenticator failed for H=40.red-81-42-225.staticip.rima-tde.net [81.42.225.40]:36784: 535 Incorrect authentication data (set_id=abuse@visionsolutionshospital.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 77.83.39.144
country_id: 690791
description:
[2026-01-14 04:08:21 +0530] info [cpaneld] 77.83.39.144 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilan_travel (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 77.83.39.144
country_id: 690791
description:
Jan 14 04:08:21 host2 sshd[3715668]: Invalid user cloudtourssrilan_travel from 77.83.39.144 port 45004


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.185.159.132
country_id: 3865483
description:
2026-01-14 04:11:02 dovecot_login authenticator failed for H=([190.185.159.132]) [190.185.159.132]:57231: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.72.184.60
country_id: 6252001
description:
2026-01-14 04:11:04 dovecot_login authenticator failed for H=24-72-184-24-72-184-60.cpe.sparklight.net [24.72.184.60]:54380: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.246.178
country_id: 1269750
description:
2026-01-14 04:10:29 dovecot_login authenticator failed for H=([182.79.95.139]) [152.52.246.178]:43190: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.186.193.149
country_id: 1643084
description:
2026-01-14 04:10:51 dovecot_login authenticator failed for H=([103.186.193.149]) [103.186.193.149]:40242: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.156.6.147
country_id: 3144096
description:
2026-01-14 04:11:47 dovecot_login authenticator failed for H=([78.156.6.147]) [78.156.6.147]:50664: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.174
country_id: 6252001
description:
Jan 14 04:16:07 host2 dovecot[3335587]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=205.210.31.174, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<qK7awUxIDsvN0h+u>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 212.87.222.194
country_id: 660013
description:
Jan 14 04:16:35 host2 sshd[3727071]: Disconnected from invalid user ubnt 212.87.222.194 port 37176 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 146.59.236.55
country_id: 3017382
description:
Jan 14 04:18:49 host2 sshd[3729592]: Disconnected from invalid user ctxsys 146.59.236.55 port 34036 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.59.236.55
country_id: 3017382
description:
Jan 14 04:18:19 host2 sshd[3729112]: Disconnected from invalid user nexus 146.59.236.55 port 54268 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 168.205.223.74
country_id: 3469034
description:
Jan 14 04:19:54 host2 dovecot[3335587]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<env_eng>, method=PLAIN, rip=168.205.223.74, lip=66.85.158.91, TLS, session=<3BZZzkxI6c2ozd9K>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 64.227.173.33
country_id: 1269750
description:
Jan 14 04:20:03 host2 sshd[3730995]: Disconnected from invalid user ftpuser 64.227.173.33 port 37598 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.59.236.55
country_id: 3017382
description:
Jan 14 04:19:17 host2 sshd[3730165]: Disconnected from invalid user backupuser 146.59.236.55 port 48288 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.216.28.14
country_id: 798544
description:
Jan 14 04:19:22 host2 dovecot[3335587]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=178.216.28.14, lip=66.85.158.91, TLS, session=<lO1TzExIrbyy2BwO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.163.32.78
country_id: 6252001
description:
Jan 14 04:19:27 host2 dovecot[3335587]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.163.32.78, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<54nCzUxIsLgUoyBO>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.133.156.8
country_id: 1643084
description:
Jan 14 04:20:21 host2 sshd[3731394]: Disconnected from invalid user elastic 43.133.156.8 port 55940 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.189.154.201
country_id: 3595528
description:
Jan 14 04:21:45 host2 sshd[3732887]: Disconnected from invalid user backupuser 181.189.154.201 port 4707 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 212.87.222.194
country_id: 660013
description:
Jan 14 04:21:47 host2 sshd[3732893]: Disconnected from invalid user role1 212.87.222.194 port 37158 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.3.179.41
country_id: 6252001
description:
Jan 14 04:22:36 host2 sshd[3733618]: Disconnected from invalid user jdedwards 192.3.179.41 port 60060 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.183.74.120
country_id: 1643084
description:
Jan 14 04:22:44 host2 sshd[3733686]: Disconnected from invalid user watchguard 103.183.74.120 port 54314 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.110.166.67
country_id: 1694008
description:
Jan 14 04:22:52 host2 sshd[3733848]: Disconnected from invalid user ArgusAdmin 27.110.166.67 port 37666 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.183.74.120
country_id: 1643084
description:
Jan 14 04:22:09 host2 sshd[3733286]: Disconnected from invalid user kubernetes 103.183.74.120 port 45578 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.189.154.201
country_id: 3595528
description:
Jan 14 04:22:15 host2 sshd[3733393]: Disconnected from invalid user avigilon 181.189.154.201 port 4830 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 212.87.222.194
country_id: 660013
description:
Jan 14 04:22:26 host2 sshd[3733506]: Disconnected from invalid user gogs 212.87.222.194 port 52334 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 212.87.222.194
country_id: 660013
description:
Jan 14 04:23:07 host2 sshd[3734325]: Disconnected from invalid user webmaster 212.87.222.194 port 37182 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.189.154.201
country_id: 3595528
description:
Jan 14 04:23:21 host2 sshd[3734576]: Disconnected from invalid user huawei 181.189.154.201 port 5488 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.133.156.8
country_id: 1643084
description:
Jan 14 04:24:17 host2 sshd[3735417]: Disconnected from invalid user user 43.133.156.8 port 46740 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.110.166.67
country_id: 1694008
description:
Jan 14 04:27:16 host2 sshd[3738558]: Disconnected from invalid user su 27.110.166.67 port 56508 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.3.179.41
country_id: 6252001
description:
Jan 14 04:27:22 host2 sshd[3738619]: Disconnected from invalid user deploy 192.3.179.41 port 44852 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.153.110.189
country_id: 1210997
description:
Jan 14 04:27:26 host2 sshd[3738638]: Disconnected from invalid user service 103.153.110.189 port 55228 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.153.110.189
country_id: 1210997
description:
Jan 14 04:28:02 host2 sshd[3738968]: Disconnected from invalid user def 103.153.110.189 port 55874 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan 14 04:28:58 host2 dovecot[3335587]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@seyawin.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<Exaw70xIh8x100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.177
country_id: 2186224
description:
2026-01-14 04:28:23 dovecot_login authenticator failed for H=([127.0.0.1]) [121.73.163.177]:46714: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.231.82
country_id: 1269750
description:
2026-01-14 04:28:32 dovecot_login authenticator failed for H=([127.0.0.1]) [182.95.231.82]:43120: 535 Incorrect authentication data (set_id=kasunp)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.153.110.189
country_id: 1210997
description:
Jan 14 04:28:37 host2 sshd[3739640]: Disconnected from invalid user User3 103.153.110.189 port 57164 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.153.110.189
country_id: 1210997
description:
Jan 14 04:29:10 host2 sshd[3740118]: Disconnected from invalid user manager 103.153.110.189 port 59202 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.110.166.67
country_id: 1694008
description:
Jan 14 04:29:13 host2 sshd[3740151]: Disconnected from invalid user scott 27.110.166.67 port 34132 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.220
country_id: 130758
description:
2026-01-14 04:34:01 dovecot_login authenticator failed for H=(localhost) [62.60.130.220]:49677: 535 Incorrect authentication data (set_id=test01)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.57.216.142
country_id: 1168579
description:
Jan 14 04:34:20 host2 sshd[3746825]: Disconnected from invalid user cassandra 154.57.216.142 port 40572 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 185.226.197.13
country_id: 2264397
description:
Jan 14 04:34:35 host2 pure-ftpd[3747119]: (?@185.226.197.13) [INFO] New connection from 185.226.197.13


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 185.226.197.12
country_id: 2264397
description:
Jan 14 04:34:38 host2 pure-ftpd[3747174]: (?@185.226.197.12) [INFO] New connection from 185.226.197.12


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 185.226.197.14
country_id: 2264397
description:
Jan 14 04:34:34 host2 pure-ftpd[3747100]: (?@185.226.197.14) [INFO] New connection from 185.226.197.14


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.39.58.191
country_id: 2635167
description:
Jan 14 04:34:45 host2 sshd[3747308]: Disconnected from invalid user scott 34.39.58.191 port 40342 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.174.72.225
country_id: 6252001
description:
Jan 14 04:35:04 host2 sshd[3747638]: Disconnected from invalid user uniview 172.174.72.225 port 48398 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.174.72.225
country_id: 6252001
description:
Jan 14 04:35:39 host2 sshd[3748013]: Disconnected from invalid user dcui 172.174.72.225 port 33378 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.227.153.68
country_id: 6252001
description:
Jan 14 04:36:07 host2 sshd[3748432]: Disconnected from invalid user netscreen 192.227.153.68 port 49592 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.57.216.142
country_id: 1168579
description:
Jan 14 04:36:34 host2 sshd[3748657]: Disconnected from invalid user unifi 154.57.216.142 port 64602 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.44.196.71
country_id: 3175395
description:
Jan 14 04:36:48 host2 sshd[3748800]: Disconnected from invalid user ADMIN 151.44.196.71 port 42328 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.109.176
country_id: 1819730
description:
Jan 14 04:36:53 host2 sshd[3748816]: Disconnected from invalid user kuka 101.36.109.176 port 37540 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.98.51.235
country_id: 6252001
description:
Jan 14 04:37:47 host2 sshd[3749256]: Disconnected from invalid user sonarqube 198.98.51.235 port 59208 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.57.216.142
country_id: 1168579
description:
Jan 14 04:37:31 host2 sshd[3749057]: Disconnected from invalid user cisco 154.57.216.142 port 28454 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.39.58.191
country_id: 2635167
description:
Jan 14 04:37:52 host2 sshd[3749357]: Disconnected from invalid user netscreen 34.39.58.191 port 36712 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.98.51.235
country_id: 6252001
description:
Jan 14 04:38:19 host2 sshd[3749739]: Disconnected from invalid user scott 198.98.51.235 port 34772 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 34.39.58.191
country_id: 2635167
description:
Jan 14 04:38:47 host2 sshd[3749977]: Disconnected from invalid user cisco 34.39.58.191 port 54650 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.49.129.67
country_id: 3175395
description:
Jan 14 04:40:39 host2 sshd[3751219]: Disconnected from invalid user linksys 151.49.129.67 port 34322 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.227.153.68
country_id: 6252001
description:
Jan 14 04:40:08 host2 sshd[3750811]: Disconnected from invalid user httpd 192.227.153.68 port 12588 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.98.57.141
country_id: 6252001
description:
Jan 14 04:40:31 host2 sshd[3751073]: Disconnected from invalid user wireguard 198.98.57.141 port 41054 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.187.146.72
country_id: 1643084
description:
Jan 14 04:41:07 host2 sshd[3751663]: Disconnected from invalid user pelco 103.187.146.72 port 60706 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 151.49.129.67
country_id: 3175395
description:
Jan 14 04:41:08 host2 sshd[3751788]: Disconnected from invalid user rancher 151.49.129.67 port 33634 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.98.51.235
country_id: 6252001
description:
Jan 14 04:41:09 host2 sshd[3751858]: Disconnected from invalid user gogs 198.98.51.235 port 42454 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.64.105.32
country_id: 6252001
description:
Jan 14 04:41:36 host2 dovecot[3335587]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.64.105.32, lip=66.85.158.91, TLS, session=<B9EAHU1I3qsUQGkg>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 184.168.21.211
country_id: 6252001
description:
Jan 14 04:42:40 host2 sshd[3753156]: Disconnected from invalid user vagrant 184.168.21.211 port 43902 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.109.176
country_id: 1819730
description:
Jan 14 04:42:42 host2 sshd[3753141]: Disconnected from invalid user airflow 101.36.109.176 port 50834 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.227.153.68
country_id: 6252001
description:
Jan 14 04:42:09 host2 sshd[3752654]: Disconnected from invalid user sonarqube 192.227.153.68 port 20456 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.88.196.91
country_id: 6252001
description:
2026-01-14 04:43:26 dovecot_plain authenticator failed for H=c-73-88-196-91.hsd1.ky.comcast.net (hyper) [73.88.196.91]:41362: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.44.196.71
country_id: 3175395
description:
Jan 14 04:43:44 host2 sshd[3754298]: Disconnected from invalid user User3 151.44.196.71 port 42260 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-01-14 04:43:22 dovecot_plain authenticator failed for H=(sully) [64.72.74.162]:60834: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 4.211.84.189
country_id: 3017382
description:
Jan 14 04:43:29 host2 sshd[3754068]: Disconnected from invalid user remote 4.211.84.189 port 33156 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 184.168.21.211
country_id: 6252001
description:
Jan 14 04:43:12 host2 sshd[3753781]: Disconnected from invalid user peoplesoft 184.168.21.211 port 53184 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.36.109.176
country_id: 1819730
description:
Jan 14 04:44:30 host2 sshd[3754814]: Disconnected from invalid user sysdiag 101.36.109.176 port 58224 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 4.211.84.189
country_id: 3017382
description:
Jan 14 04:44:32 host2 sshd[3754874]: Disconnected from invalid user gcp 4.211.84.189 port 33708 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan 14 04:49:20 host2 sshd[3759027]: Disconnected from invalid user user 2.57.121.25 port 33709 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 161.0.186.190
country_id: 3895114
description:
Jan 14 04:51:53 host2 dovecot[3335587]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=161.0.186.190, lip=66.85.158.91, TLS, session=<J827QE1IobqhALq+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 168.205.223.74
country_id: 3469034
description:
Jan 14 04:52:21 host2 dovecot[3335587]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<env_eng>, method=PLAIN, rip=168.205.223.74, lip=66.85.158.91, TLS, session=<QvNeQk1IqOuozd9K>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 194.165.16.167
country_id: 2993457
description:
Jan 14 04:56:00 host2 pure-ftpd[3765827]: (?@194.165.16.167) [INFO] New connection from 194.165.16.167


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 111.68.107.91
country_id: 1168579
description:
Jan 14 04:56:20 host2 sshd[3766074]: Disconnected from invalid user dns 111.68.107.91 port 53468 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.175.201.167
country_id: 3469034
description:
2026-01-14 04:57:10 dovecot_login authenticator failed for H=200.175.201.167.dynamic.dialup.gvt.net.br ([201.47.244.97]) [200.175.201.167]:40322: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.128.202
country_id: 6252001
description:
2026-01-14 04:57:34 dovecot_login authenticator failed for H=([192.34.128.202]) [192.34.128.202]:41204: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.102.242
country_id: 290557
description:
2026-01-14 05:01:22 dovecot_login authenticator failed for H=([80.227.102.242]) [80.227.102.242]:47476: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.129.217.70
country_id: 1269750
description:
2026-01-14 05:00:47 dovecot_login authenticator failed for H=([203.129.217.70]) [203.129.217.70]:54957: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.181
country_id: 6252001
description:
Jan 14 05:01:19 host2 dovecot[3335587]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=91.230.168.181, lip=66.85.158.91, session=<FCuCY01I5cNb5qi1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.182
country_id: 6252001
description:
Jan 14 05:01:44 host2 dovecot[3335587]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.230.168.182, lip=66.85.158.91, session=<XlL9ZE1Iyetb5qi2>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.110.237
country_id: 3144096
description:
2026-01-14 05:02:01 dovecot_login authenticator failed for H=(cm-46.212.110.237.get.no) [46.212.110.237]:58386: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.86
country_id: 6252001
description:
Jan 14 05:01:29 host2 dovecot[3335587]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=91.230.168.86, lip=66.85.158.91, session=<clEiZE1Ibbxb5qhW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.132.181.70
country_id: 1522867
description:
2026-01-14 05:01:32 dovecot_login authenticator failed for H=2.132.181.70.dynamic.telecom.kz [2.132.181.70]:40989: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.203.86.207
country_id: 6252001
description:
2026-01-14 05:01:34 dovecot_login authenticator failed for H=([74.203.86.207]) [74.203.86.207]:58204: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.180
country_id: 6252001
description:
Jan 14 05:01:41 host2 dovecot[3335587]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=91.230.168.180, lip=66.85.158.91, session=<DkHOZE1I951b5qi0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan 14 05:07:34 host2 sshd[3775529]: Disconnected from invalid user admin 2.57.121.112 port 18298 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.46.148.180
country_id: 6252001
description:
2026-01-14 05:11:04 dovecot_plain authenticator failed for H=c-68-46-148-180.hsd1.mi.comcast.net (cogechira) [68.46.148.180]:50996: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan 14 05:12:35 host2 dovecot[3335587]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@seyawin.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<twa0i01IRKR100Db>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 203.55.131.4
country_id: 6252001
description:
Jan 14 05:15:44 host2 dovecot[3335587]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=203.55.131.4, lip=66.85.158.91, session=<NHQXl01IEKbLN4ME>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 85.208.3.116
country_id: 660013
description:
[2025-12-26 17:26:14 +0530] info [webmaild] 85.208.3.116 - washeera@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.138.53.19
country_id: 1643084
description:
2026-01-14 05:18:46 dovecot_login authenticator failed for H=([127.0.0.1]) [103.138.53.19]:46539: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.215.125.250
country_id: 192950
description:
2026-01-14 05:19:08 dovecot_login authenticator failed for H=(41.215.125.250.accesskenya.com) [41.215.125.250]:37254: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.2.176.137
country_id: 6252001
description:
2026-01-14 05:18:38 dovecot_login authenticator failed for H=96-2-176-137-dynamic.midco.net ([127.0.0.1]) [96.2.176.137]:45624: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.97.203.163
country_id: 3686110
description:
2026-01-14 05:20:06 dovecot_login authenticator failed for H=(Dinamic-Tigo186-97-203-163.tigo.com.co) [186.97.203.163]:35424: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.233
country_id: 1269750
description:
2026-01-14 05:22:43 dovecot_login authenticator failed for H=(nsg-corporate-233.228.187.122.airtel.in) [122.187.228.233]:34244: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.157.95.30
country_id: 6251999
description:
2026-01-14 05:23:02 dovecot_login authenticator failed for H=d157-95-30.home4.cgocable.net [24.157.95.30]:57580: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 14 05:27:10 host2 sshd[3793808]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.111.231.233
country_id: 3580718
description:
[2026-01-14 05:26:35 +0530] info [webmaild] 172.111.231.233 - hr@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 14 05:28:11 host2 sshd[3794883]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.102.101.248
country_id: 1269750
description:
2026-01-14 05:28:47 dovecot_login authenticator failed for H=([14.102.101.248]) [14.102.101.248]:54993: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.135.206.10
country_id: 3469034
description:
2026-01-14 05:29:13 dovecot_login authenticator failed for H=(intercityhoteis.static.gvt.net.br) [177.135.206.10]:55899: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.122
country_id: 1269750
description:
2026-01-14 05:31:27 dovecot_login authenticator failed for H=([125.17.205.185]) [182.95.178.122]:53648: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.116.247.31
country_id: 1522867
description:
2026-01-14 05:31:55 dovecot_login authenticator failed for H=([212.116.247.31]) [212.116.247.31]:42337: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 213.169.44.220
country_id: 732800
description:
Jan 14 05:33:20 host2 sshd[3800367]: Disconnected from invalid user was 213.169.44.220 port 40870 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.0.120.211
country_id: 226074
description:
Jan 14 05:34:55 host2 sshd[3801804]: Disconnected from invalid user elasticsearch 196.0.120.211 port 48480 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 66.116.199.234
country_id: 1269750
description:
Jan 14 05:36:22 host2 sshd[3803659]: Disconnected from invalid user rancher 66.116.199.234 port 33978 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.0.120.211
country_id: 226074
description:
Jan 14 05:36:18 host2 sshd[3803598]: Disconnected from invalid user informix 196.0.120.211 port 38528 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 66.116.199.234
country_id: 1269750
description:
Jan 14 05:37:33 host2 sshd[3804801]: Disconnected from invalid user samsung 66.116.199.234 port 44230 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 196.0.120.211
country_id: 226074
description:
Jan 14 05:38:09 host2 sshd[3805507]: Disconnected from invalid user rancher 196.0.120.211 port 43492 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 20.102.116.25
country_id: 6252001
description:
Jan 14 05:40:09 host2 sshd[3807011]: Disconnected from invalid user couchdb 20.102.116.25 port 44788 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.102.116.25
country_id: 6252001
description:
Jan 14 05:39:39 host2 sshd[3806515]: Disconnected from invalid user device 20.102.116.25 port 38416 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.47.217
country_id: 6252001
description:
Jan 14 05:40:05 host2 sshd[3806936]: Disconnected from invalid user remote 209.141.47.217 port 56252 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.202.54
country_id: 1269750
description:
2026-01-14 05:44:52 dovecot_login authenticator failed for H=(nsg-corporate-54.202.186.122.airtel.in) [122.186.202.54]:54282: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan 14 05:49:01 host2 dovecot[3335587]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<siH1DU5I/45100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.30.161.197
country_id: 690791
description:
2026-01-14 05:49:31 dovecot_login authenticator failed for H=([46.30.161.197]) [46.30.161.197]:56670: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.67.106.221
country_id: 3686110
description:
2026-01-14 05:54:38 dovecot_login authenticator failed for H=([190.67.106.221]) [190.67.106.221]:58934: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.80
country_id: 1269750
description:
2026-01-14 05:54:45 dovecot_login authenticator failed for H=([122.187.229.80]) [122.187.229.80]:40876: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2026-01-14 05:54:57 dovecot_login authenticator failed for H=(227.69.57.37.triolan.net) [37.57.69.227]:47892: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.207.20.193
country_id: 290557
description:
2026-01-14 05:54:52 dovecot_login authenticator failed for H=([94.207.20.193]) [94.207.20.193]:39718: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan 14 05:58:18 host2 sshd[3823372]: Disconnected from invalid user user 2.57.121.25 port 36475 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.86.94.251
country_id: 2921044
description:
Jan 14 06:04:50 host2 sshd[3829129]: Disconnected from invalid user admin 172.86.94.251 port 57822 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.86.94.251
country_id: 2921044
description:
Jan 14 06:05:45 host2 sshd[3830158]: Disconnected from invalid user ubuntu 172.86.94.251 port 41988 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.11
country_id: 6251999
description:
Jan 14 06:06:24 host2 dovecot[3335587]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=85.217.149.11, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<f+hITE5IWMRV2ZUL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.184.80
country_id: 99237
description:
2026-01-14 06:07:51 dovecot_plain authenticator failed for H=(presses) [65.20.184.80]:46280: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.220.147
country_id: 3144096
description:
2026-01-14 06:09:29 dovecot_login authenticator failed for H=(cm-178.232.220.147.get.no) [178.232.220.147]:55889: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.29.197.188
country_id: 453733
description:
2026-01-14 06:09:39 dovecot_login authenticator failed for H=188-197-29-85.dyn.estpak.ee [85.29.197.188]:40193: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.181.133.153
country_id: 3469034
description:
2026-01-14 06:10:13 dovecot_login authenticator failed for H=([179.181.133.153]) [179.181.133.153]:36272: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.160.75
country_id: 2186224
description:
2026-01-14 06:10:57 dovecot_login authenticator failed for H=([121.73.160.75]) [121.73.160.75]:57176: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.83.181.181
country_id: 6252001
description:
2026-01-14 06:16:04 dovecot_plain authenticator failed for H=c-68-83-181-181.hsd1.pa.comcast.net (hatenta) [68.83.181.181]:51836: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.157.246.158
country_id: 2077456
description:
2026-01-14 06:23:40 dovecot_login authenticator failed for H=([120.157.246.158]) [120.157.246.158]:37906: 535 Incorrect authentication data (set_id=abuse@agentallianz.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.227.94
country_id: 1269750
description:
2026-01-14 06:23:54 dovecot_login authenticator failed for H=([152.52.227.94]) [152.52.227.94]:52762: 535 Incorrect authentication data (set_id=abuse)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan 14 06:24:45 host2 dovecot[3335587]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@seyawin.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<uBvBjU5IFsx100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.220
country_id: 130758
description:
2026-01-14 06:28:22 dovecot_login authenticator failed for H=(localhost) [62.60.130.220]:53722: 535 Incorrect authentication data (set_id=monit)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.36.204.156
country_id: 2635167
description:
2026-01-14 06:31:15 dovecot_login authenticator failed for H=aztw-28-b2-v4wan-166611-cust3227.vm26.cable.virginm.net ([127.0.0.1]) [82.36.204.156]:34036: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.103.58.97
country_id: 3057568
description:
2026-01-14 06:31:22 dovecot_login authenticator failed for H=bband-dyn97.95-103-58.t-com.sk ([127.0.0.1]) [95.103.58.97]:33999: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.59
country_id: 6252001
description:
Jan 14 06:34:41 host2 dovecot[3335587]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=167.94.146.59, lip=66.85.158.92, TLS: Connection closed, session=<xUhmsU5IIBinXpI7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.22.142
country_id: 3144096
description:
2026-01-14 06:34:56 dovecot_login authenticator failed for H=([127.0.0.1]) [178.232.22.142]:46523: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.39.227.34
country_id: 1861060
description:
2026-01-14 06:35:06 dovecot_login authenticator failed for H=p430035-obmd01.tokyo.ocn.ne.jp ([127.0.0.1]) [60.39.227.34]:43849: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.197
country_id: 6252001
description:
Jan 14 06:45:28 host2 dovecot[3335587]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=205.210.31.197, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<FO39105IYNjN0h/F>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.41.202.12
country_id: 6252001
description:
2026-01-14 06:52:00 dovecot_login authenticator failed for H=syn-071-041-202-012.biz.spectrum.com [71.41.202.12]:39397: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.202.241
country_id: 149590
description:
2026-01-14 06:52:24 dovecot_login authenticator failed for H=(241.202-59-41.data-dsm.ttcldata.net) [41.59.202.241]:57558: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan 14 07:00:29 host2 dovecot[3869238]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@seyawin.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<VhKPDU9ImIR100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.67.45.29
country_id: 2661886
description:
2026-01-14 07:01:06 dovecot_login authenticator failed for H=213-67-45-29-no600.tbcn.telia.com [213.67.45.29]:45022: 535 Incorrect authentication data (set_id=info@jrdc.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.48.161.42
country_id: 1210997
description:
2026-01-14 06:55:24 dovecot_login authenticator failed for H=(103-48-161-42.Dhaka.carnival.com.bd) [103.48.161.42]:54108: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.23.140
country_id: 3144096
description:
2026-01-14 06:56:26 dovecot_login authenticator failed for H=([178.232.23.140]) [178.232.23.140]:57391: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.164.93.136
country_id: 6252001
description:
2026-01-14 07:01:43 dovecot_login authenticator failed for H=(syn-024-164-093-136.res.spectrum.com) [24.164.93.136]:59043: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.104.225.201
country_id: 6252001
description:
2026-01-14 07:08:45 dovecot_plain authenticator failed for H=(rettaudism) [24.104.225.201]:52330: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan 14 07:09:56 host2 sshd[3888594]: Disconnected from invalid user admin 2.57.121.112 port 41960 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.68.37.25
country_id: 2661886
description:
2026-01-14 07:15:11 dovecot_plain authenticator failed for H=78-68-37-25-no2560.tbcn.telia.com (idaestize) [78.68.37.25]:48335: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.186.54.65
country_id: 298795
description:
2026-01-14 07:23:07 dovecot_login authenticator failed for H=([78.186.54.65]) [78.186.54.65]:52532: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 130.185.85.106
country_id: 2264397
description:
[2026-01-14 07:22:42 +0530] info [webmaild] 130.185.85.106 - 587hr@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 134.209.102.173
country_id: 1880251
description:
2026-01-14 07:22:47 dovecot_login authenticator failed for H=([134.209.102.173]) [134.209.102.173]:39932: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.37.8
country_id: 798544
description:
2026-01-14 07:26:02 dovecot_login authenticator failed for H=89-67-37-8.dynamic.play.pl [89.67.37.8]:40606: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.186.104.101
country_id: 6252001
description:
2026-01-14 07:28:34 dovecot_login authenticator failed for H=wsip-184-186-104-101.lv.lv.cox.net [184.186.104.101]:39078: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.20.67
country_id: 6252001
description:
Jan 14 07:31:08 host2 dovecot[3869238]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.20.67, lip=66.85.158.91, TLS handshaking: Connection closed, session=<wzVGe09I2glBMRRD>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.20.67
country_id: 6252001
description:
Jan 14 07:31:28 host2 dovecot[3869238]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.20.67, lip=66.85.158.91, TLS handshaking: Connection closed, session=<xhZ9fE9IblhBMRRD>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan 14 07:36:42 host2 dovecot[3912601]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@seyawin.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<0TAQj09INqd100Db>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.8.127.134
country_id: 1269750
description:
Jan 14 07:38:15 host2 sshd[3915828]: Disconnected from invalid user cisco 202.8.127.134 port 48470 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.68.226.87
country_id: 3017382
description:
Jan 14 07:40:11 host2 sshd[3917890]: Disconnected from invalid user ntp 51.68.226.87 port 57180 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.45.95.66
country_id: 3469034
description:
Jan 14 07:40:13 host2 sshd[3917917]: Disconnected from invalid user rancher 187.45.95.66 port 65354 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.8.127.134
country_id: 1269750
description:
Jan 14 07:40:21 host2 sshd[3918035]: Disconnected from invalid user httpadmin 202.8.127.134 port 47538 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.83.15.123
country_id: 1819730
description:
Jan 14 07:39:54 host2 sshd[3917425]: Disconnected from invalid user dbsnmp 154.83.15.123 port 48480 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.164.39.253
country_id: 3469034
description:
Jan 14 07:39:55 host2 sshd[3917435]: Disconnected from invalid user snmp 45.164.39.253 port 43998 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.68.226.87
country_id: 3017382
description:
Jan 14 07:40:38 host2 sshd[3918324]: Disconnected from invalid user sap 51.68.226.87 port 40046 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.164.39.253
country_id: 3469034
description:
Jan 14 07:40:53 host2 sshd[3918510]: Disconnected from invalid user cloud 45.164.39.253 port 59140 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.8.127.134
country_id: 1269750
description:
Jan 14 07:40:56 host2 sshd[3918528]: Disconnected from invalid user naztec 202.8.127.134 port 58878 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.45.95.66
country_id: 3469034
description:
Jan 14 07:41:51 host2 sshd[3919463]: Disconnected from invalid user debian 187.45.95.66 port 24738 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 202.8.127.134
country_id: 1269750
description:
Jan 14 07:41:30 host2 sshd[3919056]: Disconnected from invalid user mysqladmin 202.8.127.134 port 42006 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.164.39.253
country_id: 3469034
description:
Jan 14 07:41:43 host2 sshd[3919246]: Disconnected from invalid user devuser 45.164.39.253 port 42270 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.164.39.253
country_id: 3469034
description:
Jan 14 07:42:58 host2 sshd[3920508]: Disconnected from invalid user gitlab 45.164.39.253 port 36564 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.45.95.66
country_id: 3469034
description:
Jan 14 07:42:33 host2 sshd[3920094]: Disconnected from invalid user hanwha 187.45.95.66 port 25601 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.83.15.123
country_id: 1819730
description:
Jan 14 07:45:14 host2 sshd[3923136]: Disconnected from invalid user nagiosadmin 154.83.15.123 port 49256 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 114.8.146.58
country_id: 1643084
description:
Jan 14 07:45:33 host2 sshd[3923746]: Disconnected from invalid user cloud 114.8.146.58 port 40600 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.30.161.197
country_id: 690791
description:
2026-01-14 07:45:49 dovecot_login authenticator failed for H=([46.30.161.197]) [46.30.161.197]:54319: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.130
country_id: 1269750
description:
2026-01-14 07:46:03 dovecot_login authenticator failed for H=(nsg-corporate-130.230.187.122.airtel.in) [122.187.230.130]:50053: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan 14 07:46:32 host2 sshd[3924628]: Disconnected from invalid user user 2.57.121.25 port 7453 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.83.15.123
country_id: 1819730
description:
Jan 14 07:46:48 host2 sshd[3924823]: Disconnected from invalid user rancher 154.83.15.123 port 40804 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.248.4.85
country_id: 1269750
description:
2026-01-14 07:48:36 dovecot_login authenticator failed for H=([115.248.4.85]) [115.248.4.85]:65424: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.83.15.123
country_id: 1819730
description:
Jan 14 07:48:28 host2 sshd[3926486]: Disconnected from invalid user kerberos 154.83.15.123 port 60602 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.217.144.20
country_id: 1643084
description:
Jan 14 07:55:17 host2 sshd[3933977]: Disconnected from invalid user resin 103.217.144.20 port 59174 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.186.193.149
country_id: 1643084
description:
2026-01-14 07:56:20 dovecot_login authenticator failed for H=([103.186.193.149]) [103.186.193.149]:37692: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.85.14.208
country_id: 6252001
description:
2026-01-14 07:56:39 dovecot_login authenticator failed for H=([107.85.14.208]) [107.85.14.208]:46358: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.146.191
country_id: 3996063
description:
2026-01-14 07:58:21 dovecot_login authenticator failed for H=([177.236.146.191]) [177.236.146.191]:37803: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.91.179.26
country_id: 732800
description:
2026-01-14 07:58:31 dovecot_login authenticator failed for H=(213-91-179-26.btc-net.bg) [213.91.179.26]:42660: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.143.69.79
country_id: 2750405
description:
2026-01-14 07:58:37 dovecot_login authenticator failed for H=([108.143.69.79]) [108.143.69.79]:52658: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.110.11.48
country_id: 2464461
description:
2026-01-14 07:58:48 dovecot_login authenticator failed for H=([102.110.11.48]) [102.110.11.48]:2031: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.201.90
country_id: 1733045
description:
2026-01-14 08:01:27 dovecot_login authenticator failed for H=([49.125.201.90]) [49.125.201.90]:34676: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.141.252.55
country_id: 6252001
description:
2026-01-14 08:01:51 dovecot_login authenticator failed for H=([38.141.252.55]) [38.141.252.55]:60053: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.41.202.12
country_id: 6252001
description:
2026-01-14 08:07:27 dovecot_plain authenticator failed for H=syn-071-041-202-012.biz.spectrum.com (drest) [71.41.202.12]:51102: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 138.199.43.2
country_id: 6252001
description:
[2026-01-14 08:10:05 +0530] info [webmaild] 138.199.43.2 - 587hr@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.248.4.85
country_id: 1269750
description:
2026-01-14 08:10:14 dovecot_login authenticator failed for H=([115.248.153.209]) [115.248.4.85]:54021: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.89
country_id: 2635167
description:
Jan 14 08:12:16 host2 dovecot[3934709]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.89, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<cxNtDlBIp7hX7LBZ>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.251
country_id: 2635167
description:
Jan 14 08:11:42 host2 dovecot[3934709]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=87.236.176.251, lip=66.85.158.92, TLS, session=<1wJZDFBIXdJX7LD7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.88
country_id: 2635167
description:
Jan 14 08:11:43 host2 dovecot[3934709]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=87.236.176.88, lip=66.85.158.92, TLS handshaking: Connection closed, session=<WZBxDFBIxeFX7LBY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.84
country_id: 2635167
description:
Jan 14 08:13:23 host2 dovecot[3934709]: pop3-login: Disconnected: Connection closed: read(size=693) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.84, lip=66.85.158.92, TLS handshaking: read(size=693) failed: Connection reset by peer, session=<VAhkElBIice594lU>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.92
country_id: 2635167
description:
Jan 14 08:12:50 host2 dovecot[3934709]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=87.236.176.92, lip=66.85.158.92, TLS handshaking: Connection closed, session=<IHxoEFBIvaJX7LBc>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.94
country_id: 2635167
description:
Jan 14 08:13:56 host2 dovecot[3934709]: pop3-login: Disconnected: Connection closed: read(size=612) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.94, lip=66.85.158.92, TLS handshaking: read(size=612) failed: Connection reset by peer, session=<sEJfFFBI79dX7LBe>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.88
country_id: 2635167
description:
Jan 14 08:15:03 host2 dovecot[3934709]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=185.247.137.88, lip=66.85.158.92, TLS handshaking: Connection closed, session=<SOhVGFBIw4W594lY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.220
country_id: 130758
description:
2026-01-14 08:15:41 dovecot_login authenticator failed for H=(localhost) [62.60.130.220]:54749: 535 Incorrect authentication data (set_id=dapper)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.85
country_id: 2635167
description:
Jan 14 08:16:09 host2 dovecot[3934709]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=87.236.176.85, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<wsdKHFBI5YtX7LBV>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.96
country_id: 6252001
description:
Jan 14 08:14:54 host2 dovecot[3934709]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.96, lip=66.85.158.91, TLS, session=<t3zSF1BIEP3N0h9g>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.83
country_id: 2635167
description:
Jan 14 08:14:29 host2 dovecot[3934709]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=87.236.176.83, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<VaRYFlBISeZX7LBT>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.101
country_id: 2635167
description:
Jan 14 08:15:36 host2 dovecot[3934709]: pop3-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.101, lip=66.85.158.92, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<8URRGlBIeepX7LBl>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.95
country_id: 2635167
description:
Jan 14 08:16:42 host2 dovecot[3934709]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=87.236.176.95, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<HQ5GHlBIpZlX7LBf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.22.218
country_id: 290557
description:
2026-01-14 08:17:12 dovecot_login authenticator failed for H=([5.32.22.218]) [5.32.22.218]:39864: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.219.104.210
country_id: 3175395
description:
2026-01-14 08:17:49 dovecot_login authenticator failed for H=net-188-219-104-210.cust.vodafonedsl.it [188.219.104.210]:41267: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.145.126
country_id: 1819730
description:
2026-01-14 08:18:11 dovecot_login authenticator failed for H=(223-197-145-126.static.imsbiz.com) [223.197.145.126]:49451: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.106.49.149
country_id: 3932488
description:
2026-01-14 08:24:16 dovecot_login authenticator failed for H=([200.106.49.149]) [200.106.49.149]:58770: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.120.98
country_id: 1269750
description:
2026-01-14 08:24:18 dovecot_login authenticator failed for H=([125.19.175.94]) [122.184.120.98]:59342: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.168.35.240
country_id: 2077456
description:
2026-01-14 08:24:34 dovecot_login authenticator failed for H=([101.168.35.240]) [101.168.35.240]:57122: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.72.88
country_id: 3469034
description:
Jan 14 08:26:14 host2 dovecot[3954879]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 23 secs): user=<training@v-deploy.com>, method=PLAIN, rip=187.120.72.88, lip=66.85.158.91, TLS, session=<n7b7PlBID6m7eEhY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.185.185
country_id: 99237
description:
2026-01-14 08:26:25 dovecot_login authenticator failed for H=([65.20.185.185]) [65.20.185.185]:44709: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.31.154
country_id: 1269750
description:
2026-01-14 08:26:02 dovecot_login authenticator failed for H=([103.251.31.154]) [103.251.31.154]:50416: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.73.144
country_id: 3469034
description:
Jan 14 08:26:08 host2 dovecot[3954879]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<training@v-deploy.com>, method=PLAIN, rip=187.120.73.144, lip=66.85.158.91, TLS, session=</AvLPlBIrOy7eEmQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.224.120.161
country_id: 3469034
description:
Jan 14 08:26:36 host2 dovecot[3954879]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<training>, method=PLAIN, rip=186.224.120.161, lip=66.85.158.91, TLS, session=<yvGgQFBIrpe64Hih>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.75.156.84
country_id: 3077311
description:
Jan 14 08:26:44 host2 dovecot[3954879]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<training>, method=PLAIN, rip=188.75.156.84, lip=66.85.158.91, TLS, session=<XwAXQVBInIu8S5xU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.247.189.189
country_id: 6252001
description:
2026-01-14 08:31:47 dovecot_login authenticator failed for H=([50.247.189.189]) [50.247.189.189]:2828: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.118.138
country_id: 3144096
description:
2026-01-14 08:31:58 dovecot_login authenticator failed for H=([46.212.118.138]) [46.212.118.138]:34125: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.82
country_id: 1269750
description:
2026-01-14 08:35:55 dovecot_login authenticator failed for H=([122.187.230.82]) [122.187.230.82]:53397: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.148.199.165
country_id: 2077456
description:
2026-01-14 08:36:17 dovecot_login authenticator failed for H=165.199.148.122.sta.wbroadband.net.au [122.148.199.165]:55149: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.70.82.95
country_id: 1282988
description:
Jan 14 08:41:35 host2 sshd[3976142]: Disconnected from invalid user admin 202.70.82.95 port 32224 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.6.81.59
country_id: 1880251
description:
2026-01-14 08:43:57 dovecot_login authenticator failed for H=bb121-6-81-59.singnet.com.sg [121.6.81.59]:45071: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.87.2
country_id: 1269750
description:
2026-01-14 08:44:58 dovecot_login authenticator failed for H=([182.78.87.2]) [182.78.87.2]:43698: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.74.63.250
country_id: 3057568
description:
[2026-01-14 08:44:27 +0530] info [webmaild] 45.74.63.250 - washeera@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 194.233.94.24
country_id: 1880251
description:
Jan 14 08:44:46 host2 sshd[3979029]: Disconnected from invalid user admin 194.233.94.24 port 58872 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.137.7.97
country_id: 6252001
description:
2026-01-14 08:46:36 dovecot_plain authenticator failed for H=c-73-137-7-97.hsd1.ga.comcast.net (unnearve) [73.137.7.97]:60594: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.70.82.95
country_id: 1282988
description:
Jan 14 08:46:40 host2 sshd[3981755]: Disconnected from invalid user admin 202.70.82.95 port 11644 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 194.233.94.24
country_id: 1880251
description:
Jan 14 08:46:43 host2 sshd[3981860]: Disconnected from invalid user ubuntu 194.233.94.24 port 52886 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.70.82.95
country_id: 1282988
description:
Jan 14 08:48:16 host2 sshd[3983577]: Disconnected from invalid user admin 202.70.82.95 port 8038 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 202.70.82.95
country_id: 1282988
description:
Jan 14 08:49:03 host2 sshd[3984018]: Disconnected from invalid user ubuntu 202.70.82.95 port 10936 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.70.82.95
country_id: 1282988
description:
Jan 14 08:50:40 host2 sshd[3985779]: Disconnected from invalid user ubuntu 202.70.82.95 port 56426 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 14 08:52:16 host2 sshd[3987316]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.107.199.180
country_id: 1880251
description:
[2026-01-14 08:52:36 +0530] info [webmaild] 103.107.199.180 - env_eng@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.63
country_id: 6252001
description:
Jan 14 08:59:41 host2 dovecot[3978232]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=167.94.146.63, lip=66.85.158.92, TLS: Connection closed, session=<EPcAuFBIdvmnXpI/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.229
country_id: 6252001
description:
Jan 14 09:06:38 host2 dovecot[3978232]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 46 secs): user=<>, rip=162.216.149.229, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<drrS0FBIYd+i2JXl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.111.152.229
country_id: 3469034
description:
Jan 14 09:07:55 host2 dovecot[3978232]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=187.111.152.229, lip=66.85.158.91, TLS, session=<Hldg1FBIwYm7b5jl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.73.160
country_id: 3469034
description:
Jan 14 09:08:31 host2 dovecot[3978232]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 23 secs): user=<env_eng>, method=PLAIN, rip=187.120.73.160, lip=66.85.158.91, TLS, session=<issu1lBIPpe7eEmg>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.229
country_id: 6252001
description:
Jan 14 09:14:14 host2 dovecot[3978232]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.149.229, lip=66.85.158.92, TLS, session=<R7j+61BItu6i2JXl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.161.217.228
country_id: 2510769
description:
2026-01-14 09:17:04 dovecot_login authenticator failed for H=([90.161.217.228]) [90.161.217.228]:45172: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.220
country_id: 6252001
description:
Jan 14 09:18:06 host2 dovecot[3978232]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 5 secs): user=<>, rip=147.185.132.220, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<Qnfb+VBIRNuTuYTc>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.220
country_id: 6252001
description:
Jan 14 09:19:01 host2 dovecot[3978232]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=147.185.132.220, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<hgsa/VBI6uWTuYTc>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 68.183.94.236
country_id: 1269750
description:
Jan 14 09:20:44 host2 sshd[4013123]: Disconnected from invalid user admin 68.183.94.236 port 54504 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.183.94.236
country_id: 1269750
description:
Jan 14 09:23:14 host2 sshd[4015329]: Disconnected from invalid user admin 68.183.94.236 port 48000 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.220
country_id: 6252001
description:
Jan 14 09:24:15 host2 dovecot[3978232]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.220, lip=66.85.158.91, TLS, session=<XKvYD1FI2uCTuYTc>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.55.57.187
country_id: 6252001
description:
Jan 14 09:24:29 host2 sshd[4016202]: Disconnected from invalid user ubuntu 45.55.57.187 port 35460 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.45.172.159
country_id: 3175395
description:
2026-01-14 09:25:53 dovecot_login authenticator failed for H=host-213-45-172-159.pool21345.interbusiness.it ([127.0.0.1]) [213.45.172.159]:54026: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.138.53.19
country_id: 1643084
description:
2026-01-14 09:26:07 dovecot_login authenticator failed for H=([127.0.0.1]) [103.138.53.19]:47937: 535 Incorrect authentication data (set_id=kasunp)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.55.57.187
country_id: 6252001
description:
Jan 14 09:27:39 host2 sshd[4018581]: Disconnected from invalid user admin 45.55.57.187 port 37738 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.251.251.171
country_id: 1861060
description:
Jan 14 09:30:21 host2 sshd[4020610]: Disconnected from invalid user ubuntu 160.251.251.171 port 37844 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 134.209.102.173
country_id: 1880251
description:
2026-01-14 09:32:07 dovecot_login authenticator failed for H=([134.209.102.173]) [134.209.102.173]:59582: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.191.211.33
country_id: 6252001
description:
2026-01-14 09:32:41 dovecot_login authenticator failed for H=([65.191.211.33]) [65.191.211.33]:42908: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.246
country_id: 6252001
description:
Jan 14 09:33:07 host2 pure-ftpd[4022742]: (?@147.185.132.246) [INFO] New connection from 147.185.132.246


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.193.6.148
country_id: 6251999
description:
2026-01-14 09:34:03 dovecot_plain authenticator failed for H=([10.18.202.51]) [91.193.6.148]:17612: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.251.251.171
country_id: 1861060
description:
Jan 14 09:34:58 host2 sshd[4024302]: Disconnected from invalid user admin 160.251.251.171 port 58012 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.113.212
country_id: 1861060
description:
Jan 14 09:39:04 host2 dovecot[3978232]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=139.162.113.212, lip=66.85.158.91, TLS: Connection closed, session=<UM7NRFFIdI+LonHU>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 160.251.251.171
country_id: 1861060
description:
Jan 14 09:42:54 host2 sshd[4030326]: Disconnected from invalid user ubuntu 160.251.251.171 port 56498 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 124.43.17.184
country_id: 1227603
description:
Jan 14 09:44:15 host2 pure-ftpd[4031475]: (?@124.43.17.184) [INFO] New connection from 124.43.17.184


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.251.251.171
country_id: 1861060
description:
Jan 14 09:45:16 host2 sshd[4032257]: Disconnected from invalid user ubuntu 160.251.251.171 port 47260 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan 14 09:55:57 host2 sshd[4042980]: Disconnected from invalid user admin 2.57.121.112 port 42302 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.223.46
country_id: 1269750
description:
2026-01-14 09:55:42 dovecot_login authenticator failed for H=([182.95.223.46]) [182.95.223.46]:51138: 535 Incorrect authentication data (set_id=admin@2s-travels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.183
country_id: 3144096
description:
2026-01-14 09:56:29 dovecot_login authenticator failed for H=(cm-84.213.189.183.get.no) [84.213.189.183]:60318: 535 Incorrect authentication data (set_id=admin@2s-travels.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.74
country_id: 6252001
description:
Jan 14 09:57:19 host2 dovecot[3978232]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.235.24.74, lip=66.85.158.91, session=<ad4ZhlFISuPG6xhK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.128.202
country_id: 6252001
description:
2026-01-14 09:58:07 dovecot_login authenticator failed for H=([192.34.128.202]) [192.34.128.202]:59516: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2026-01-14 09:58:24 dovecot_login authenticator failed for H=([154.144.243.93]) [154.144.243.93]:32996: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.41.137
country_id: 337996
description:
2026-01-14 09:58:31 dovecot_login authenticator failed for H=([196.190.43.139]) [196.190.41.137]:39126: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.235.124.67
country_id: 798544
description:
Jan 14 10:01:28 host2 dovecot[3978232]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=91.235.124.67, lip=66.85.158.91, TLS, session=<WbHuk1FIeQxb63xD>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.106.235
country_id: 3469034
description:
Jan 14 10:02:06 host2 dovecot[3978232]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<careers>, method=PLAIN, rip=187.120.106.235, lip=66.85.158.91, TLS, session=<Lp/0lVFIgMO7eGrr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.18.99.126
country_id: 1269750
description:
2026-01-14 10:07:50 dovecot_login authenticator failed for H=([125.18.99.126]) [125.18.99.126]:48412: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.60.144.54
country_id: 2510769
description:
2026-01-14 10:08:07 dovecot_login authenticator failed for H=(47-60-144-54.red-acceso.airtel.net) [47.60.144.54]:37551: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.43.109
country_id: 1819730
description:
2026-01-14 10:08:21 dovecot_login authenticator failed for H=109.43.246.220.static.netvigator.com [220.246.43.109]:63866: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.37.122.175
country_id: 1643084
description:
Jan 14 10:13:36 host2 sshd[4058033]: Disconnected from invalid user admin 36.37.122.175 port 46170 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.154
country_id: 3144096
description:
2026-01-14 10:14:06 dovecot_login authenticator failed for H=([84.213.189.154]) [84.213.189.154]:39892: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.199.126
country_id: 1269750
description:
2026-01-14 10:14:18 dovecot_login authenticator failed for H=([152.52.199.126]) [152.52.199.126]:53904: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.81
country_id: 6252001
description:
Jan 14 10:15:27 host2 dovecot[3978232]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.81, lip=66.85.158.92, TLS, session=<Fh7uxlFIrOfG6xhR>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 36.37.122.175
country_id: 1643084
description:
Jan 14 10:15:30 host2 sshd[4059762]: Disconnected from invalid user admin 36.37.122.175 port 34928 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.37.122.175
country_id: 1643084
description:
Jan 14 10:16:07 host2 sshd[4060162]: Disconnected from invalid user ubuntu 36.37.122.175 port 32820 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 20.169.104.204
country_id: 6252001
description:
Jan 14 10:18:14 host2 pure-ftpd[4061851]: (?@20.169.104.204) [INFO] New connection from 20.169.104.204


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.37.122.175
country_id: 1643084
description:
Jan 14 10:19:20 host2 sshd[4062850]: Disconnected from invalid user ubuntu 36.37.122.175 port 39592 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.227.175.188
country_id: 2921044
description:
Jan 14 10:26:02 host2 dovecot[3978232]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (disconnected before auth was ready, waited 0 secs): user=<>, rip=165.227.175.188, lip=66.85.158.91, TLS handshaking: read(size=1026) failed: Connection reset by peer, session=<WULJ7FFIU1Wl46+8>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.227.175.188
country_id: 2921044
description:
Jan 14 10:26:08 host2 dovecot[3978232]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=165.227.175.188, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher, session=<T30t7VFIy16l46+8>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 157.230.116.91
country_id: 2921044
description:
Jan 14 10:26:37 host2 dovecot[3978232]: imap-login: Disconnected: Connection closed (no auth attempts in 20 secs): user=<>, rip=157.230.116.91, lip=66.85.158.91, TLS handshaking: Connection closed, session=<RODi7lFIEJid5nRb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.68.22.140
country_id: 1269750
description:
2026-01-14 10:34:26 dovecot_login authenticator failed for H=([103.68.22.140]) [103.68.22.140]:45786: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.179.134.120
country_id: 1269750
description:
2026-01-14 10:35:02 dovecot_login authenticator failed for H=(abts-mum-static-120.134.179.122.airtelbroadband.in) [122.179.134.120]:53095: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Jan 14 10:35:57 host2 dovecot[3978232]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, TLS handshaking: Connection closed, session=<KxY6EFJIwLUDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Jan 14 10:36:12 host2 dovecot[3978232]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<9KEnEVJIwOQDlTsa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.220
country_id: 130758
description:
2026-01-14 10:38:50 dovecot_login authenticator failed for H=(localhost) [62.60.130.220]:61997: 535 Incorrect authentication data (set_id=user)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Jan 14 10:38:41 host2 dovecot[3978232]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<9hIGGlJInpwDlTsa>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan 14 10:39:09 host2 sshd[4079708]: Disconnected from invalid user user 2.57.121.25 port 51109 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Jan 14 10:40:09 host2 dovecot[3978232]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, TLS, session=<DlVNH1JIbtcDlTsa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.208.81.125
country_id: 6252001
description:
2026-01-14 10:41:01 dovecot_plain authenticator failed for H=c-73-208-81-125.hsd1.in.comcast.net (cantan) [73.208.81.125]:55790: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.10
country_id: 6252001
description:
Jan 14 10:41:18 host2 dovecot[3978232]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.10, lip=66.85.158.92, session=<VLZeI1JI+GZBMQEK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Jan 14 10:42:10 host2 dovecot[3978232]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, TLS handshaking: Connection closed, session=<Y2l6JlJInosDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Jan 14 10:44:33 host2 dovecot[3978232]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, TLS, session=<w0z8LlJIFo0DlTsa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan 14 10:47:11 host2 dovecot[3978232]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 12 secs): user=<webmaster@seyawin.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<ebG3N1JI74V100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.140.218.210
country_id: 1269750
description:
2026-01-14 10:53:59 dovecot_login authenticator failed for H=(14.140.218.210.static-bangalore-vsnl.net.in) [14.140.218.210]:57091: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 14 10:57:44 host2 sshd[4093358]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 14 10:59:09 host2 sshd[4094397]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.238.213.180
country_id: 2661886
description:
2026-01-14 11:02:12 dovecot_login authenticator failed for H=h85-238-213-180.cust.bredband2.com [85.238.213.180]:35178: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.13.139.61
country_id: 2510769
description:
2026-01-14 11:02:29 dovecot_login authenticator failed for H=61.red-88-13-139.dynamicip.rima-tde.net [88.13.139.61]:42669: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.23.72.189
country_id: 6252001
description:
2026-01-14 11:02:59 dovecot_login authenticator failed for H=([209.23.72.189]) [209.23.72.189]:54450: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.58.241.90
country_id: 3469034
description:
2026-01-14 11:03:49 dovecot_login authenticator failed for H=(ccabv.org.cta.gvt.net.br) [187.58.241.90]:53700: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.56.0.19
country_id: 3469034
description:
2026-01-14 11:04:21 dovecot_login authenticator failed for H=(177-215-153-215.user.vivozap.com.br) [189.56.0.19]:51987: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.187.2
country_id: 1269750
description:
2026-01-14 11:09:27 dovecot_login authenticator failed for H=(nsg-corporate-2.187.185.122.airtel.in) [122.185.187.2]:45492: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.20.234.161
country_id: 587116
description:
2026-01-14 11:09:07 dovecot_login authenticator failed for H=([94.20.234.161]) [94.20.234.161]:52153: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 44.220.188.35
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 44.220.188.35: 250 connections per 30 seconds to 2080 port.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.154.162
country_id: 1733045
description:
2026-01-14 11:18:54 dovecot_login authenticator failed for H=([49.124.154.162]) [49.124.154.162]:56848: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.204.134.124
country_id: 6252001
description:
2026-01-14 11:24:27 dovecot_plain authenticator failed for H=c-98-204-134-124.hsd1.md.comcast.net (ovenic) [98.204.134.124]:56298: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 12.189.234.27
country_id: 6252001
description:
Jan 14 11:27:37 host2 sshd[4117202]: Disconnected from invalid user ubuntu 12.189.234.27 port 46529 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 12.189.234.27
country_id: 6252001
description:
Jan 14 11:28:35 host2 sshd[4118074]: Received disconnect from 12.189.234.27 port 57679:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 12.189.234.27
country_id: 6252001
description:
Jan 14 11:28:35 host2 sshd[4118074]: Disconnected from invalid user admin 12.189.234.27 port 57679 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.224.149
country_id: 1880251
description:
Jan 14 11:29:28 host2 sshd[4118836]: Disconnected from invalid user ubuntu 45.78.224.149 port 59200 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.48.229.117
country_id: 3469034
description:
2026-01-14 11:30:35 dovecot_login authenticator failed for H=ip-179.48.229.117.fiberlinkpe.net.br (ip-179.48.229.118.fiberlinkpe.net.br) [179.48.229.117]:35762: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.170.97.94
country_id: 1269750
description:
2026-01-14 11:31:00 dovecot_login authenticator failed for H=(abts-mum-static-094.97.170.122.airtelbroadband.in) [122.170.97.94]:32839: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.224.149
country_id: 1880251
description:
Jan 14 11:31:36 host2 sshd[4120854]: Disconnected from invalid user admin 45.78.224.149 port 37382 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.84.162.177
country_id: 1861060
description:
2026-01-14 11:31:19 dovecot_login authenticator failed for H=177.162.84.34.bc.googleusercontent.com [34.84.162.177]:62594: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.224.149
country_id: 1880251
description:
Jan 14 11:32:37 host2 sshd[4121672]: Disconnected from invalid user ubuntu 45.78.224.149 port 33732 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.127.53.61
country_id: 6252001
description:
2026-01-14 11:37:58 dovecot_plain authenticator failed for H=c-24-127-53-61.hsd1.mi.comcast.net (somed) [24.127.53.61]:48364: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.224.149
country_id: 1880251
description:
Jan 14 11:39:55 host2 sshd[4127458]: Disconnected from invalid user admin 45.78.224.149 port 43726 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan 14 11:43:48 host2 dovecot[3978232]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 5 secs): user=<postfix@seyawin.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<74eeAlNIVup100Db>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 138.199.39.177
country_id: 1861060
description:
Jan 14 11:53:44 host2 pure-ftpd[4139544]: (?@138.199.39.177) [INFO] New connection from 138.199.39.177


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.219.149.74
country_id: 2328926
description:
2026-01-14 11:53:51 dovecot_login authenticator failed for H=([41.219.149.76]) [41.219.149.74]:33036: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.181.19.144
country_id: 1527747
description:
2026-01-14 11:54:22 dovecot_login authenticator failed for H=(158.181.19.144.mega.kg) [158.181.19.144]:48753: 535 Incorrect authentication data (set_id=postmaster@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.93.84
country_id: 1269750
description:
2026-01-14 11:54:22 dovecot_login authenticator failed for H=([115.240.244.53]) [152.52.93.84]:10400: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.254.54
country_id: 1269750
description:
2026-01-14 11:54:35 dovecot_login authenticator failed for H=([128.185.254.54]) [128.185.254.54]:57020: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.4.31.215
country_id: 2661886
description:
2026-01-14 11:54:39 dovecot_login authenticator failed for H=h-155-4-31-215.a2204.priv.bahnhof.se [155.4.31.215]:33992: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.255.189.56
country_id: 298795
description:
2026-01-14 11:55:06 dovecot_login authenticator failed for H=(88.255.189.56.static.ttnet.com.tr) [88.255.189.56]:56113: 535 Incorrect authentication data (set_id=postmaster@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.228
country_id: 1269750
description:
2026-01-14 11:55:29 dovecot_login authenticator failed for H=(nsg-corporate-228.228.187.122.airtel.in) [122.187.228.228]:40804: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.202.241
country_id: 149590
description:
2026-01-14 11:55:16 dovecot_login authenticator failed for H=(241.202-59-41.data-dsm.ttcldata.net) [41.59.202.241]:40416: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.192
country_id: 6252001
description:
Jan 14 11:57:25 host2 dovecot[3978232]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=147.185.132.192, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=</BGaM1NIcseTuYTA>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 175.157.36.83
country_id: 1227603
description:
Jan 14 11:59:51 host2 dovecot[3978232]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<orders@myproteinbox.lk>, method=PLAIN, rip=175.157.36.83, lip=66.85.158.91, TLS, session=<wHkXPFNIbx2vnSRT>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.221.122
country_id: 3144096
description:
2026-01-14 12:00:02 dovecot_login authenticator failed for H=(cm-178.232.221.122.get.no) [178.232.221.122]:38314: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 175.157.36.83
country_id: 1227603
description:
Jan 14 12:00:23 host2 dovecot[3978232]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<orders@myproteinbox.lk>, method=PLAIN, rip=175.157.36.83, lip=66.85.158.91, TLS, session=<0NsNPlNIcB2vnSRT>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 14 12:02:02 host2 sshd[4146472]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 175.157.36.83
country_id: 1227603
description:
Jan 14 12:01:39 host2 dovecot[3978232]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<orders@myproteinbox.lk>, method=PLAIN, rip=175.157.36.83, lip=66.85.158.91, TLS, session=<Gj6SQlNIcR2vnSRT>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.126.138
country_id: 1819730
description:
Jan 14 12:02:00 host2 sshd[4146403]: Disconnected from invalid user dns 101.36.126.138 port 40696 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 175.157.36.83
country_id: 1227603
description:
Jan 14 12:02:56 host2 dovecot[3978232]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<orders@myproteinbox.lk>, method=PLAIN, rip=175.157.36.83, lip=66.85.158.91, TLS, session=<B2k3R1NILd2vnSRT>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.172.152.74
country_id: 3508796
description:
Jan 14 12:03:33 host2 sshd[4147666]: Disconnected from invalid user gitea 45.172.152.74 port 33802 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 175.157.36.83
country_id: 1227603
description:
Jan 14 12:03:42 host2 dovecot[3978232]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<orders@myproteinbox.lk>, method=PLAIN, rip=175.157.36.83, lip=66.85.158.91, TLS, session=<wLziSVNIL92vnSRT>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.193.178.248
country_id: 1643084
description:
Jan 14 12:04:20 host2 sshd[4148157]: Disconnected from invalid user syslog 103.193.178.248 port 57480 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 175.157.36.83
country_id: 1227603
description:
Jan 14 12:04:52 host2 dovecot[3978232]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<orders@myproteinbox.lk>, method=PLAIN, rip=175.157.36.83, lip=66.85.158.91, TLS, session=<GGcOTlNIcx2vnSRT>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 144.126.219.163
country_id: 6252001
description:
Jan 14 12:05:47 host2 sshd[4149308]: Disconnected from invalid user postgres 144.126.219.163 port 34672 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 175.157.36.83
country_id: 1227603
description:
Jan 14 12:05:56 host2 dovecot[3978232]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<orders@myproteinbox.lk>, method=PLAIN, rip=175.157.36.83, lip=66.85.158.91, TLS, session=<++jsUVNIdR2vnSRT>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.172.152.74
country_id: 3508796
description:
Jan 14 12:05:35 host2 sshd[4149177]: Disconnected from invalid user commvault 45.172.152.74 port 54536 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 195.250.72.168
country_id: 174982
description:
Jan 14 12:06:26 host2 sshd[4149679]: Disconnected from invalid user admin 195.250.72.168 port 36158 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.172.152.74
country_id: 3508796
description:
Jan 14 12:06:12 host2 sshd[4149578]: Disconnected from invalid user upload 45.172.152.74 port 53382 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 175.157.36.83
country_id: 1227603
description:
Jan 14 12:07:15 host2 dovecot[3978232]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<orders@myproteinbox.lk>, method=PLAIN, rip=175.157.36.83, lip=66.85.158.91, TLS, session=<OKOpVlNIdx2vnSRT>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 144.126.219.163
country_id: 6252001
description:
Jan 14 12:07:23 host2 sshd[4150424]: Disconnected from invalid user x 144.126.219.163 port 35522 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.231.182.151
country_id: 453733
description:
Jan 14 12:07:14 host2 dovecot[3978232]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=165.231.182.151, lip=66.85.158.91, TLS handshaking: Connection closed, session=<EK6xVlNITLml57aX>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.164.137
country_id: 99237
description:
2026-01-14 12:07:37 dovecot_plain authenticator failed for H=(unecan) [65.20.164.137]:39070: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.126.138
country_id: 1819730
description:
Jan 14 12:07:45 host2 sshd[4150692]: Disconnected from invalid user storage 101.36.126.138 port 34560 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.36.126.138
country_id: 1819730
description:
Jan 14 12:09:04 host2 sshd[4151887]: Disconnected from invalid user kali 101.36.126.138 port 34020 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.193.178.248
country_id: 1643084
description:
Jan 14 12:08:14 host2 sshd[4151072]: Disconnected from invalid user hikvision 103.193.178.248 port 59814 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 175.157.36.83
country_id: 1227603
description:
Jan 14 12:08:29 host2 dovecot[3978232]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<orders@myproteinbox.lk>, method=PLAIN, rip=175.157.36.83, lip=66.85.158.91, TLS, session=<f7UAW1NIMt2vnSRT>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 175.157.36.83
country_id: 1227603
description:
Jan 14 12:09:22 host2 dovecot[3978232]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<orders@myproteinbox.lk>, method=PLAIN, rip=175.157.36.83, lip=66.85.158.91, TLS, session=<t68lXlNIeh2vnSRT>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 175.157.36.83
country_id: 1227603
description:
Jan 14 12:10:40 host2 dovecot[3978232]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<orders@myproteinbox.lk>, method=PLAIN, rip=175.157.36.83, lip=66.85.158.91, TLS, session=<SbDWYlNIM92vnSRT>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 175.157.36.83
country_id: 1227603
description:
Jan 14 12:11:39 host2 dovecot[3978232]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<orders@myproteinbox.lk>, method=PLAIN, rip=175.157.36.83, lip=66.85.158.91, TLS, session=<bxVUZlNIfB2vnSRT>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 175.157.36.83
country_id: 1227603
description:
Jan 14 12:12:27 host2 dovecot[3978232]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<orders@myproteinbox.lk>, method=PLAIN, rip=175.157.36.83, lip=66.85.158.91, TLS, session=<mHk/aVNINd2vnSRT>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.226.82
country_id: 1269750
description:
2026-01-14 12:12:35 dovecot_login authenticator failed for H=(nsg-corporate-134.184.185.122.airtel.in) [182.95.226.82]:38688: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.162.132
country_id: 2186224
description:
2026-01-14 12:12:49 dovecot_login authenticator failed for H=([121.73.162.132]) [121.73.162.132]:48484: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.13
country_id: 1269750
description:
2026-01-14 12:16:01 dovecot_login authenticator failed for H=(nsg-corporate-13.230.187.122.airtel.in) [122.187.230.13]:40011: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 175.157.36.83
country_id: 1227603
description:
Jan 14 12:15:31 host2 dovecot[3978232]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<orders@myproteinbox.lk>, method=PLAIN, rip=175.157.36.83, lip=66.85.158.91, TLS, session=<Zh46dFNIgh2vnSRT>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.216.169.12
country_id: 2328926
description:
2026-01-14 12:15:43 dovecot_login authenticator failed for H=([41.216.169.12]) [41.216.169.12]:48786: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 175.157.36.83
country_id: 1227603
description:
Jan 14 12:16:48 host2 dovecot[3978232]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<orders@myproteinbox.lk>, method=PLAIN, rip=175.157.36.83, lip=66.85.158.91, TLS, session=<lJXDeFNIPd2vnSRT>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.242.226.17
country_id: 6252001
description:
Jan 14 12:16:47 host2 dovecot[3978232]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=185.242.226.17, lip=66.85.158.92, session=<b/nieFNIuqW58uIR>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 175.157.36.83
country_id: 1227603
description:
Jan 14 12:18:12 host2 dovecot[3978232]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<orders@myproteinbox.lk>, method=PLAIN, rip=175.157.36.83, lip=66.85.158.91, TLS, session=<i4XIfVNIPt2vnSRT>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.242.226.17
country_id: 6252001
description:
Jan 14 12:22:29 host2 dovecot[3978232]: imap-login: Disconnected: Connection closed (disconnected before auth was ready, waited 0 secs): user=<>, rip=185.242.226.17, lip=66.85.158.91, session=<CRhDjVNIuK658uIR>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.115.144.103
country_id: 3469034
description:
2026-01-14 12:23:29 dovecot_login authenticator failed for H=([187.115.144.103]) [187.115.144.103]:37506: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.89.198.191
country_id: 2186224
description:
2026-01-14 12:23:52 dovecot_login authenticator failed for H=219-89-198-191.adsl.xtra.co.nz [219.89.198.191]:41598: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.216
country_id: 6252001
description:
Jan 14 12:26:09 host2 dovecot[3978232]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.235.24.216, lip=66.85.158.91, TLS, session=<Ch9hmlNIaPzG6xjY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.57.170.177
country_id: 3175395
description:
2026-01-14 12:33:45 dovecot_plain authenticator failed for H=([100.64.100.6]) [2.57.170.177]:43948: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.220.185.55
country_id: 6252001
description:
Jan 14 12:36:21 host2 dovecot[3978232]: imap-login: Disconnected: Connection closed (no auth attempts in 12 secs): user=<>, rip=44.220.185.55, lip=66.85.158.92, TLS handshaking: Connection closed, session=<Dt3TvlNIzNYs3Lk3>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.220.185.55
country_id: 6252001
description:
Jan 14 12:36:29 host2 dovecot[3978232]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 2 secs): user=<>, rip=44.220.185.55, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<PVxMv1NIgI0s3Lk3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.220
country_id: 130758
description:
2026-01-14 12:36:48 dovecot_login authenticator failed for H=(localhost) [62.60.130.220]:62109: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan 14 12:37:59 host2 sshd[4175747]: Disconnected from invalid user admin 2.57.121.112 port 16738 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 14 12:41:15 host2 sshd[4178447]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 14 12:42:40 host2 sshd[4179605]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.234
country_id: 6252001
description:
Jan 14 12:44:50 host2 dovecot[3978232]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.235.24.234, lip=66.85.158.92, session=<2g4y3VNIhuDG6xjq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.161.232.9
country_id: 6252001
description:
2026-01-14 12:45:58 dovecot_login authenticator failed for H=ip98-161-232-9.ph.ph.cox.net [98.161.232.9]:54722: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.227.136.237
country_id: 6252001
description:
2026-01-14 12:45:34 dovecot_login authenticator failed for H=([72.227.136.237]) [72.227.136.237]:40512: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 98.80.4.58
country_id: 6252001
description:
Jan 14 12:47:05 host2 dovecot[3978232]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=98.80.4.58, lip=66.85.158.92, session=<BV045VNINqBiUAQ6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.104.42
country_id: 1269750
description:
2026-01-14 12:48:12 dovecot_login authenticator failed for H=([27.123.104.42]) [27.123.104.42]:55468: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.140.218.210
country_id: 1269750
description:
2026-01-14 12:47:32 dovecot_login authenticator failed for H=(14.140.218.210.static-bangalore-vsnl.net.in) [14.140.218.210]:56263: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.46.144
country_id: 1819730
description:
2026-01-14 12:48:05 dovecot_login authenticator failed for H=144.46.246.220.static.netvigator.com [220.246.46.144]:49376: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.194
country_id: 1269750
description:
2026-01-14 12:48:37 dovecot_login authenticator failed for H=([152.52.234.46]) [182.95.176.194]:47932: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.185.185
country_id: 99237
description:
2026-01-14 12:48:55 dovecot_login authenticator failed for H=([65.20.185.185]) [65.20.185.185]:58353: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.114.143.79
country_id: 3865483
description:
2026-01-14 12:49:14 dovecot_login authenticator failed for H=host-cotesma-114-143-79.smandes.com.ar [181.114.143.79]:44526: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Jan 14 12:55:45 host2 dovecot[3978232]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, session=<JOc3BFRIpOoDlTsa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.149.161.131
country_id: 6252001
description:
2026-01-14 12:58:28 dovecot_login authenticator failed for H=c-50-149-161-131.hsd1.tn.comcast.net [50.149.161.131]:63021: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Jan 14 12:59:27 host2 dovecot[3978232]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, session=<dE9vEVRIjq0DlTsa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.230.142
country_id: 1269750
description:
2026-01-14 12:58:49 dovecot_login authenticator failed for H=([182.95.230.142]) [182.95.230.142]:33386: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.147.94
country_id: 290557
description:
2026-01-14 13:01:22 dovecot_plain authenticator failed for H=(oressarint) [80.227.147.94]:53243: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.149.59.26
country_id: 6252001
description:
Jan 14 13:02:44 host2 dovecot[3978232]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, session=<2IMsHVRI+t0DlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Jan 14 13:02:44 host2 dovecot[3978232]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, session=<5Bg4HVRICN4DlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Jan 14 13:03:57 host2 dovecot[3978232]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, session=<3GCEIVRIGKsDlTsa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.120.205.14
country_id: 6251999
description:
2026-01-14 13:08:13 dovecot_plain authenticator failed for H=([10.12.18.249]) [37.120.205.14]:43319: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.120.205.14
country_id: 6251999
description:
2026-01-14 13:08:31 dovecot_login authenticator failed for H=([10.12.18.249]) [37.120.205.14]:3635: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 37.120.205.14
country_id: 6251999
description:
2026-01-14 13:08:46 dovecot_login authenticator failed for H=([10.12.18.249]) [37.120.205.14]:4273: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.170.50.2
country_id: 3932488
description:
2026-01-14 13:09:57 dovecot_login authenticator failed for H=([45.170.50.2]) [45.170.50.2]:50029: 535 Incorrect authentication data (set_id=business)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.140.218.210
country_id: 1269750
description:
2026-01-14 13:09:43 dovecot_login authenticator failed for H=(14.140.218.210.Static-bangalore-vsnl.net.in) [14.140.218.210]:54518: 535 Incorrect authentication data (set_id=business@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.87.248.223
country_id: 732800
description:
2026-01-14 13:13:41 dovecot_login authenticator failed for H=95-87-248-223.ip.btc-net.bg [95.87.248.223]:40488: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.72.153.110
country_id: 290557
description:
2026-01-14 13:13:59 dovecot_login authenticator failed for H=([91.72.153.110]) [91.72.153.110]:46258: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 176.126.103.19
country_id: 2017370
description:
2026-01-14 13:15:55 H=([176.126.103.19]) [176.126.103.19]:64740 F=<accounts@globalfinancesolutions.com> rejected RCPT <omoba2011@outlook.com>: SMTP AUTH is required for message submission on port 587


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 18.97.19.144
country_id: 6252001
description:
Jan 14 13:22:04 host2 dovecot[3978232]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=18.97.19.144, lip=66.85.158.91, TLS handshaking: Connection closed, session=<uPhQYlRIiMUSYROQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.27.33.174
country_id: 6252001
description:
2026-01-14 13:27:27 dovecot_plain authenticator failed for H=c-73-27-33-174.hsd1.fl.comcast.net (serte) [73.27.33.174]:36136: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.97.74
country_id: 1269750
description:
2026-01-14 13:30:01 dovecot_login authenticator failed for H=([128.185.224.142]) [27.123.97.74]:47906: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.0.36.82
country_id: 1210997
description:
2026-01-14 13:30:27 dovecot_login authenticator failed for H=([49.0.36.82]) [49.0.36.82]:51660: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.174.63
country_id: 99237
description:
2026-01-14 13:42:12 dovecot_plain authenticator failed for H=(kerstyiss) [65.20.174.63]:43752: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.164.13
country_id: 6252001
description:
2026-01-14 13:43:54 dovecot_login authenticator failed for H=([192.34.164.13]) [192.34.164.13]:37273: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.222.202
country_id: 1269750
description:
2026-01-14 13:45:14 dovecot_login authenticator failed for H=([128.185.247.100]) [182.95.222.202]:42360: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.187.205
country_id: 337996
description:
2026-01-14 13:46:42 dovecot_login authenticator failed for H=([196.188.187.205]) [196.188.187.205]:40120: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.168.35.240
country_id: 2077456
description:
2026-01-14 13:47:28 dovecot_login authenticator failed for H=([101.168.35.240]) [101.168.35.240]:41166: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.139.107.146
country_id: 1269750
description:
2026-01-14 13:48:53 dovecot_login authenticator failed for H=([14.139.107.146]) [14.139.107.146]:60786: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.146.233.156
country_id: 1269750
description:
2026-01-14 13:54:15 dovecot_login authenticator failed for H=([103.146.233.156]) [103.146.233.156]:44206: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 112.135.198.76
country_id: 1227603
description:
Jan 14 13:53:44 host2 pure-ftpd[48907]: (?@112.135.198.76) [INFO] New connection from 112.135.198.76


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.156.82.86
country_id: 1880251
description:
2026-01-14 13:53:52 dovecot_login authenticator failed for H=(86.82.156.175.unknown.m1.com.sg) [175.156.82.86]:50611: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.104.225.201
country_id: 6252001
description:
2026-01-14 14:05:32 dovecot_plain authenticator failed for H=(unpailious) [24.104.225.201]:50300: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 112.135.198.76
country_id: 1227603
description:
Jan 14 14:06:47 host2 pure-ftpd[64713]: (?@112.135.198.76) [INFO] New connection from 112.135.198.76


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan 14 14:07:05 host2 sshd[64951]: Disconnected from invalid user admin 2.57.121.112 port 6170 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 112.135.198.76
country_id: 1227603
description:
Jan 14 14:07:30 host2 pure-ftpd[65380]: (?@112.135.198.76) [INFO] New connection from 112.135.198.76


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 112.135.198.76
country_id: 1227603
description:
Jan 14 14:08:48 host2 pure-ftpd[66923]: (?@112.135.198.76) [INFO] New connection from 112.135.198.76


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 112.135.198.76
country_id: 1227603
description:
Jan 14 14:10:19 host2 pure-ftpd[69088]: (?@112.135.198.76) [INFO] New connection from 112.135.198.76


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.44.133.238
country_id: 3469034
description:
2026-01-14 14:11:14 dovecot_login authenticator failed for H=([187.51.128.233]) [189.44.133.238]:52932: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.216.58
country_id: 1269750
description:
2026-01-14 14:11:41 dovecot_login authenticator failed for H=([152.52.234.148]) [125.19.216.58]:32836: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 112.135.198.76
country_id: 1227603
description:
Jan 14 14:12:36 host2 pure-ftpd[71998]: (?@112.135.198.76) [INFO] New connection from 112.135.198.76


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Jan 14 14:12:43 host2 dovecot[69043]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS handshaking: Connection closed, session=<2GZ8F1VIjtMDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Jan 14 14:14:13 host2 dovecot[73783]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<QkPcHFVIiMgDgmBb>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 112.135.198.76
country_id: 1227603
description:
Jan 14 14:14:18 host2 pure-ftpd[74167]: (?@112.135.198.76) [INFO] New connection from 112.135.198.76


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.107
country_id: 2635167
description:
Jan 14 14:17:01 host2 dovecot[73783]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=87.236.176.107, lip=66.85.158.92, TLS handshaking: Connection closed, session=<E9jcJlVIt8VX7LBr>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.35
country_id: 2635167
description:
Jan 14 14:17:01 host2 dovecot[73783]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=185.247.137.35, lip=66.85.158.92, TLS, session=<pdXSJlVIs+2594kj>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Jan 14 14:17:32 host2 dovecot[73783]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS handshaking: Connection closed, session=<IP2sKFVIVIUDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.106
country_id: 2635167
description:
Jan 14 14:17:34 host2 dovecot[73783]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.106, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<ZhDYKFVIoc5X7LBq>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.86
country_id: 2635167
description:
Jan 14 14:18:08 host2 dovecot[73783]: imap-login: Disconnected: Connection closed: read(size=679) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.86, lip=66.85.158.92, TLS handshaking: read(size=679) failed: Connection reset by peer, session=<lX/TKlVId+e594lW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.106
country_id: 2635167
description:
Jan 14 14:18:41 host2 dovecot[73783]: imap-login: Disconnected: Connection closed: read(size=693) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.106, lip=66.85.158.92, TLS handshaking: read(size=693) failed: Connection reset by peer, session=<ScLOLFVI2a9X7LBq>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Jan 14 14:19:11 host2 dovecot[73783]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<YHSSLlVIwOkDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.86
country_id: 2635167
description:
Jan 14 14:19:14 host2 dovecot[73783]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=87.236.176.86, lip=66.85.158.92, TLS handshaking: Connection closed, session=<Y+fJLlVIactX7LBW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.75.142.157
country_id: 3017382
description:
2026-01-14 14:19:36 dovecot_login authenticator failed for H=157.ip-51-75-142.eu [51.75.142.157]:41990: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.74
country_id: 2635167
description:
Jan 14 14:19:47 host2 dovecot[73783]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=87.236.176.74, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<OUXDMFVIh4NX7LBK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.27
country_id: 2186224
description:
2026-01-14 14:19:48 dovecot_login authenticator failed for H=([121.73.163.27]) [121.73.163.27]:50706: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.94
country_id: 2635167
description:
Jan 14 14:20:21 host2 dovecot[73783]: imap-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.94, lip=66.85.158.92, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<wJ3AMlVIo7JX7LBe>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.80
country_id: 2635167
description:
Jan 14 14:20:54 host2 dovecot[73783]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=185.247.137.80, lip=66.85.158.92, TLS handshaking: Connection closed, session=<Agy8NFVIe7u594lQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.60.186
country_id: 1819730
description:
2026-01-14 14:21:08 dovecot_login authenticator failed for H=42-200-60-186.static.imsbiz.com [42.200.60.186]:57045: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.227.70
country_id: 1269750
description:
2026-01-14 14:21:27 dovecot_login authenticator failed for H=([182.95.227.70]) [182.95.227.70]:36568: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Jan 14 14:20:33 host2 dovecot[73783]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS, session=<z86DM1VI+uMDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Jan 14 14:21:31 host2 dovecot[73783]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS, session=<yeHvNlVIBtoDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.106
country_id: 2635167
description:
Jan 14 14:22:00 host2 dovecot[73783]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=87.236.176.106, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<2dSwOFVIWZ5X7LBq>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.79
country_id: 2635167
description:
Jan 14 14:21:27 host2 dovecot[73783]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=87.236.176.79, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<OHm1NlVITctX7LBP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.13
country_id: 1269750
description:
2026-01-14 14:23:56 dovecot_login authenticator failed for H=(nsg-corporate-13.230.187.122.airtel.in) [122.187.230.13]:48815: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2026-01-14 14:24:10 dovecot_login authenticator failed for H=([196.216.81.126]) [196.216.81.126]:32826: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Jan 14 14:23:30 host2 dovecot[73783]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS handshaking: Connection closed, session=<02oJPlVICsUDgmBb>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 14 14:25:04 host2 sshd[86595]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 14 14:26:29 host2 sshd[87840]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.82.110.150
country_id: 660013
description:
2026-01-14 14:27:27 dovecot_login authenticator failed for H=([45.82.110.150]) [45.82.110.150]:45894: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.171.116
country_id: 99237
description:
2026-01-14 14:27:31 dovecot_login authenticator failed for H=([65.20.171.116]) [65.20.171.116]:45014: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.249.18.109
country_id: 3017382
description:
[2026-01-14 14:30:59 +0530] info [cpaneld] 173.249.18.109 - lezzarot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarot (has_cpuser_file failed)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 71.6.134.235
country_id: 6252001
description:
Jan 14 14:31:08 host2 dovecot[73783]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=71.6.134.235, lip=66.85.158.91, TLS, session=<EhxVWVVIDLRHBobr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.220
country_id: 130758
description:
2026-01-14 14:32:52 dovecot_login authenticator failed for H=(localhost) [62.60.130.220]:54767: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.129.67
country_id: 99237
description:
2026-01-14 14:39:49 dovecot_plain authenticator failed for H=(hysing) [65.20.129.67]:57010: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
country_id: 6252001
description:
2026-01-14 14:51:15 dovecot_login authenticator failed for H=([24.187.213.29]) [24.187.213.29]:46478: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.183.110.215
country_id: 798544
description:
2026-01-14 14:56:15 dovecot_login authenticator failed for H=178.183.110.215.mobile.static.t-mobile.pl [178.183.110.215]:54560: 535 Incorrect authentication data (set_id=md@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.124.111.122
country_id: 2077456
description:
2026-01-14 14:56:58 dovecot_login authenticator failed for H=27-124-111-122.static.as58511.net [27.124.111.122]:58699: 535 Incorrect authentication data (set_id=md)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.143.14
country_id: 1269750
description:
2026-01-14 14:58:32 dovecot_login authenticator failed for H=([103.251.143.14]) [103.251.143.14]:49156: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 158.220.122.128
country_id: 3017382
description:
[2026-01-14 14:59:16 +0530] info [cpaneld] 158.220.122.128 - lezzarotech "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarotech (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 54.37.131.169
country_id: 3017382
description:
[2026-01-14 14:59:42 +0530] info [cpaneld] 54.37.131.169 - lezzarot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarot (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.118.150.20
country_id: 3686110
description:
Jan 14 14:59:37 host2 sshd[116352]: Disconnected from invalid user ubuntu 200.118.150.20 port 44664 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 200.118.150.20
country_id: 3686110
description:
Jan 14 15:01:44 host2 sshd[118410]: Disconnected from invalid user admin 200.118.150.20 port 48444 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.118.150.20
country_id: 3686110
description:
Jan 14 15:05:08 host2 sshd[121209]: Disconnected from invalid user admin 200.118.150.20 port 59224 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.97.133.2
country_id: 6252001
description:
2026-01-14 15:05:44 dovecot_plain authenticator failed for H=syn-024-097-133-002.biz.spectrum.com (plogient) [24.97.133.2]:56091: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.242.226.33
country_id: 6252001
description:
Jan 14 15:20:47 host2 dovecot[113666]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=185.242.226.33, lip=66.85.158.91, TLS handshaking: Connection closed, session=<DgrlClZITp258uIh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.134
country_id: 1149361
description:
2026-01-14 15:22:03 dovecot_login authenticator failed for H=([127.0.0.1]) [149.54.62.134]:51829: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.156.5.109
country_id: 3144096
description:
2026-01-14 15:22:10 dovecot_login authenticator failed for H=([127.0.0.1]) [78.156.5.109]:49821: 535 Incorrect authentication data (set_id=kasunp)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.16
country_id: 6251999
description:
Jan 14 15:22:48 host2 dovecot[113666]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=85.217.149.16, lip=66.85.158.92, TLS: Connection closed, session=<5nsaElZIap9V2ZUQ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.242.226.33
country_id: 6252001
description:
Jan 14 15:24:38 host2 dovecot[113666]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=185.242.226.33, lip=66.85.158.92, TLS handshaking: Connection closed, session=<7AelGFZILqW58uIh>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.27
country_id: 6251999
description:
Jan 14 15:25:05 host2 dovecot[113666]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=85.217.149.27, lip=66.85.158.92, TLS, session=<DZtCGlZIct5V2ZUb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.12
country_id: 2186224
description:
2026-01-14 15:24:17 dovecot_login authenticator failed for H=([127.0.0.1]) [121.73.163.12]:58394: 535 Incorrect authentication data (set_id=chitral100@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.8.31.100
country_id: 1522867
description:
2026-01-14 15:24:25 dovecot_login authenticator failed for H=([127.0.0.1]) [46.8.31.100]:55864: 535 Incorrect authentication data (set_id=chitral100)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.243.174
country_id: 732800
description:
2026-01-14 15:24:26 dovecot_plain authenticator failed for H=(subsised) [92.62.243.174]:47113: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.220.188.254
country_id: 6252001
description:
Jan 14 15:25:18 host2 dovecot[113666]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=44.220.188.254, lip=66.85.158.92, TLS handshaking: Connection closed, session=<KMkUG1ZIbIEs3Lz+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.80.152.173
country_id: 3017382
description:
2026-01-14 15:25:53 dovecot_login authenticator failed for H=vps-f7a54c04.vps.ovh.net [151.80.152.173]:40094: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.162.194.94
country_id: 1733045
description:
2026-01-14 15:26:30 dovecot_login authenticator failed for H=([51.162.194.94]) [51.162.194.94]:55569: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.37.223.58
country_id: 3175395
description:
2026-01-14 15:27:58 dovecot_login authenticator failed for H=net-2-37-223-58.cust.vodafonedsl.it [2.37.223.58]:53276: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.66.214.70
country_id: 1269750
description:
2026-01-14 15:27:25 dovecot_login authenticator failed for H=([182.66.214.70]) [182.66.214.70]:35546: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
country_id: 3144096
description:
2026-01-14 15:32:32 dovecot_login authenticator failed for H=(85-19-195-12.telia-isp.no) [85.19.195.12]:40218: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.187
country_id: 1269750
description:
2026-01-14 15:32:54 dovecot_login authenticator failed for H=(nsg-corporate-187.230.187.122.airtel.in) [122.187.230.187]:38627: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.114.190
country_id: 1269750
description:
2026-01-14 15:39:07 dovecot_login authenticator failed for H=([27.123.114.190]) [27.123.114.190]:37748: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.221.122
country_id: 3144096
description:
2026-01-14 15:39:23 dovecot_login authenticator failed for H=(cm-178.232.221.122.get.no) [178.232.221.122]:52327: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 159.223.0.20
country_id: 2750405
description:
Jan 14 15:41:59 host2 dovecot[149701]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=159.223.0.20, lip=66.85.158.91, session=<Y5O8VlZI9N+f3wAU>


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 176.126.103.19
country_id: 2017370
description:
2026-01-14 15:43:55 H=([176.126.103.19]) [176.126.103.19]:52247 F=<accounts@globalfinancesolutions.com> rejected RCPT <omoba2011@outlook.com>: SMTP AUTH is required for message submission on port 587


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2026-01-14 15:45:02 dovecot_login authenticator failed for H=([102.53.15.18]) [102.53.15.18]:42503: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.41.202.12
country_id: 6252001
description:
2026-01-14 15:45:13 dovecot_login authenticator failed for H=syn-071-041-202-012.biz.spectrum.com [71.41.202.12]:52409: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 207.249.96.38
country_id: 3996063
description:
Jan 14 15:50:11 host2 sshd[159158]: Disconnected from invalid user wildfly 207.249.96.38 port 40584 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.251
country_id: 3017382
description:
Jan 14 15:51:06 host2 dovecot[149701]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=91.231.89.251, lip=66.85.158.92, session=<19pNd1ZIJaxb51n7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.249
country_id: 3017382
description:
Jan 14 15:51:16 host2 dovecot[149701]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=91.231.89.249, lip=66.85.158.92, session=<E8btd1ZIV7db51n5>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.252
country_id: 3017382
description:
Jan 14 15:51:30 host2 dovecot[149701]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.231.89.252, lip=66.85.158.92, session=<ldHCeFZIh99b51n8>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.103.245.7
country_id: 1819730
description:
Jan 14 15:51:41 host2 sshd[160274]: Disconnected from invalid user buffalo 103.103.245.7 port 58802 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.103.245.7
country_id: 1819730
description:
Jan 14 15:53:11 host2 sshd[161667]: Disconnected from invalid user ansible 103.103.245.7 port 44256 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.103.245.7
country_id: 1819730
description:
Jan 14 15:54:24 host2 sshd[162761]: Disconnected from invalid user ntp 103.103.245.7 port 55626 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.103.245.7
country_id: 1819730
description:
Jan 14 15:55:31 host2 sshd[164123]: Disconnected from invalid user webserver 103.103.245.7 port 38710 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 192.81.208.35
country_id: 6252001
description:
Jan 14 15:56:25 host2 sshd[165039]: Disconnected from invalid user aws 192.81.208.35 port 49814 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 207.249.96.38
country_id: 3996063
description:
Jan 14 15:56:27 host2 sshd[165047]: Disconnected from invalid user ubnt 207.249.96.38 port 53714 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.103.245.7
country_id: 1819730
description:
Jan 14 15:56:30 host2 sshd[165092]: Disconnected from invalid user testuser 103.103.245.7 port 50070 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 207.249.96.38
country_id: 3996063
description:
Jan 14 15:57:11 host2 sshd[165581]: Disconnected from invalid user openvpn 207.249.96.38 port 35812 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 207.249.96.38
country_id: 3996063
description:
Jan 14 15:57:43 host2 sshd[165927]: Disconnected from invalid user naztec 207.249.96.38 port 49194 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-14 15:58:42 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:41571: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.160.166.237
country_id: 1820814
description:
2026-01-14 15:58:58 dovecot_login authenticator failed for H=(237-166.adsl.static.espeed.com.bn) [119.160.166.237]:32854: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.23.72.121
country_id: 6252001
description:
2026-01-14 15:59:19 dovecot_login authenticator failed for H=([209.23.72.121]) [209.23.72.121]:32930: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.67.106.221
country_id: 3686110
description:
2026-01-14 15:59:51 dovecot_login authenticator failed for H=([190.67.106.221]) [190.67.106.221]:36198: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.204.127.54
country_id: 3469034
description:
Jan 14 16:00:40 host2 sshd[168602]: Disconnected from invalid user graylog 138.204.127.54 port 33163 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.152.40.8
country_id: 6252001
description:
Jan 14 16:00:45 host2 sshd[168725]: Disconnected from invalid user advantech 104.152.40.8 port 49080 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan 14 16:01:06 host2 dovecot[149701]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@seyawin.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<Mn3gmlZIApp100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.156.6.147
country_id: 3144096
description:
2026-01-14 16:01:39 dovecot_login authenticator failed for H=([78.156.6.147]) [78.156.6.147]:49444: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.194.98
country_id: 6252001
description:
2026-01-14 16:03:05 dovecot_plain authenticator failed for H=c-73-197-194-98.hsd1.nj.comcast.net (unacomista) [73.197.194.98]:46524: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 119.92.70.82
country_id: 1694008
description:
Jan 14 16:02:11 host2 sshd[170030]: Disconnected from invalid user activemq 119.92.70.82 port 38524 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 119.92.70.82
country_id: 1694008
description:
Jan 14 16:02:50 host2 sshd[170546]: Disconnected from invalid user kafka 119.92.70.82 port 49408 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.204.127.54
country_id: 3469034
description:
Jan 14 16:03:21 host2 sshd[171011]: Disconnected from invalid user appuser 138.204.127.54 port 51914 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 111.238.174.6
country_id: 1861060
description:
Jan 14 16:03:53 host2 sshd[171387]: Disconnected from invalid user mongodb 111.238.174.6 port 50348 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 104.152.40.8
country_id: 6252001
description:
Jan 14 16:04:08 host2 sshd[171625]: Disconnected from invalid user admin 104.152.40.8 port 49076 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.233.116.124
country_id: 1269750
description:
Jan 14 16:04:20 host2 sshd[171804]: Disconnected from invalid user webuser 68.233.116.124 port 41174 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 174.138.19.66
country_id: 1880251
description:
Jan 14 16:04:31 host2 sshd[171914]: Disconnected from invalid user remote 174.138.19.66 port 46370 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.180.154.234
country_id: 1168579
description:
Jan 14 16:04:37 host2 sshd[172112]: Disconnected from invalid user bamboo 182.180.154.234 port 47344 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 174.138.19.66
country_id: 1880251
description:
Jan 14 16:06:09 host2 sshd[173384]: Disconnected from invalid user super 174.138.19.66 port 36036 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.180.154.234
country_id: 1168579
description:
Jan 14 16:05:19 host2 sshd[172800]: Disconnected from invalid user kafka 182.180.154.234 port 58146 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 35.180.85.147
country_id: 3017382
description:
[2026-01-14 16:05:21 +0530] info [cpaneld] 35.180.85.147 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 68.233.116.124
country_id: 1269750
description:
Jan 14 16:05:29 host2 sshd[172903]: Disconnected from invalid user rancher 68.233.116.124 port 63646 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.80.35.45
country_id: 192950
description:
Jan 14 16:06:29 host2 sshd[173650]: Disconnected from invalid user admin 41.80.35.45 port 50354 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.177.169.196
country_id: 6252001
description:
Jan 14 16:07:21 host2 sshd[174338]: Disconnected from invalid user datadog 52.177.169.196 port 44364 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 14 16:08:44 host2 sshd[175560]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 52.177.169.196
country_id: 6252001
description:
Jan 14 16:08:27 host2 sshd[175346]: Disconnected from invalid user admin 52.177.169.196 port 57758 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 174.138.19.66
country_id: 1880251
description:
Jan 14 16:08:10 host2 sshd[175112]: Disconnected from invalid user squid 174.138.19.66 port 36310 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 14 16:10:09 host2 sshd[176943]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 151.60.88.192
country_id: 3175395
description:
Jan 14 16:11:26 host2 sshd[178367]: Disconnected from invalid user ubuntu 151.60.88.192 port 34496 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.80.35.45
country_id: 192950
description:
Jan 14 16:11:11 host2 sshd[178116]: Disconnected from invalid user admin 41.80.35.45 port 42980 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 212.11.64.164
country_id: 241170
description:
Jan 14 16:12:31 host2 sshd[179387]: Disconnected from invalid user admin 212.11.64.164 port 42298 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 212.11.64.164
country_id: 241170
description:
Jan 14 16:13:00 host2 sshd[179791]: Disconnected from invalid user ubuntu 212.11.64.164 port 49212 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.168.241.32
country_id: 1269750
description:
2026-01-14 16:13:59 dovecot_login authenticator failed for H=([103.168.241.32]) [103.168.241.32]:44947: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.51.166
country_id: 1269750
description:
2026-01-14 16:13:47 dovecot_login authenticator failed for H=([125.23.112.209]) [182.95.51.166]:53086: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 13.73.111.251
country_id: 2077456
description:
Jan 14 16:16:19 host2 sshd[182391]: Disconnected from invalid user apache 13.73.111.251 port 47566 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.72.233.36
country_id: 2464461
description:
Jan 14 16:16:37 host2 sshd[182564]: Disconnected from invalid user centos 154.72.233.36 port 64974 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.72.233.36
country_id: 2464461
description:
Jan 14 16:17:38 host2 sshd[183291]: Disconnected from invalid user clickhouse 154.72.233.36 port 61640 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.55.146.14
country_id: 1210997
description:
[2026-01-14 16:17:11 +0530] info [cpaneld] 103.55.146.14 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.221.16.178
country_id: 1819730
description:
Jan 14 16:17:30 host2 sshd[183189]: Disconnected from invalid user ubuntu 154.221.16.178 port 47917 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.72.233.36
country_id: 2464461
description:
Jan 14 16:18:39 host2 sshd[183927]: Disconnected from invalid user def 154.72.233.36 port 45956 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.72.233.36
country_id: 2464461
description:
Jan 14 16:19:12 host2 sshd[184289]: Disconnected from invalid user ctxsys 154.72.233.36 port 42724 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 195.158.4.216
country_id: 1512440
description:
Jan 14 16:19:51 host2 sshd[184900]: Disconnected from invalid user cron 195.158.4.216 port 62625 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.190.89.127
country_id: 6252001
description:
Jan 14 16:20:59 host2 sshd[185890]: Disconnected from invalid user apache 172.190.89.127 port 43976 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 195.158.4.216
country_id: 1512440
description:
Jan 14 16:21:36 host2 sshd[186335]: Disconnected from invalid user storage 195.158.4.216 port 40933 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.16
country_id: 241170
description:
Jan 14 16:21:43 host2 dovecot[149701]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.16, lip=66.85.158.91, session=<hmOe5FZIOpTE+2YQ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 13.73.111.251
country_id: 2077456
description:
Jan 14 16:22:11 host2 sshd[186795]: Disconnected from invalid user clickhouse 13.73.111.251 port 52292 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 13.73.111.251
country_id: 2077456
description:
Jan 14 16:22:48 host2 sshd[187195]: Disconnected from invalid user debian 13.73.111.251 port 60676 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.82.181.183
country_id: 6252001
description:
2026-01-14 16:24:10 dovecot_login authenticator failed for H=ool-4352b5b7.dyn.optonline.net [67.82.181.183]:33712: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.59.154
country_id: 1269750
description:
2026-01-14 16:24:28 dovecot_login authenticator failed for H=([182.95.25.48]) [182.95.59.154]:58214: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.208.46.130
country_id: 1522867
description:
2026-01-14 16:25:41 dovecot_login authenticator failed for H=([37.208.46.130]) [37.208.46.130]:43593: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.154.77.48
country_id: 1643084
description:
Jan 14 16:26:23 host2 sshd[189885]: Disconnected from invalid user admin 103.154.77.48 port 38288 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.201.62
country_id: 1269750
description:
2026-01-14 16:26:32 dovecot_login authenticator failed for H=([125.22.73.41]) [122.186.201.62]:51136: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.93.84
country_id: 1269750
description:
2026-01-14 16:26:50 dovecot_login authenticator failed for H=([115.240.244.53]) [152.52.93.84]:10400: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.154.77.48
country_id: 1643084
description:
Jan 14 16:27:44 host2 sshd[190952]: Disconnected from invalid user ubuntu 103.154.77.48 port 59876 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.154.77.48
country_id: 1643084
description:
Jan 14 16:28:18 host2 sshd[191366]: Disconnected from invalid user admin 103.154.77.48 port 42194 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.144.34
country_id: 1269750
description:
2026-01-14 16:32:25 dovecot_login authenticator failed for H=([182.78.144.34]) [182.78.144.34]:54404: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.250.163
country_id: 99237
description:
2026-01-14 16:32:46 dovecot_login authenticator failed for H=([65.20.250.163]) [65.20.250.163]:58778: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.237.80.79
country_id: 1880251
description:
Jan 14 16:37:47 host2 sshd[199333]: Disconnected from invalid user ubuntu 52.237.80.79 port 60400 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.133.146.37
country_id: 1643084
description:
Jan 14 16:37:33 host2 sshd[199055]: Disconnected from invalid user admin 43.133.146.37 port 57698 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan 14 16:37:42 host2 dovecot[149701]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@seyawin.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<u1HNHVdIq7p100Db>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.237.80.79
country_id: 1880251
description:
Jan 14 16:39:24 host2 sshd[200640]: Disconnected from invalid user admin 52.237.80.79 port 42984 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.133.146.37
country_id: 1643084
description:
Jan 14 16:39:49 host2 sshd[200903]: Disconnected from invalid user admin 43.133.146.37 port 43614 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.126.84.154
country_id: 1694008
description:
Jan 14 16:40:47 host2 sshd[201731]: Disconnected from invalid user admin 45.126.84.154 port 57612 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 52.237.80.79
country_id: 1880251
description:
Jan 14 16:41:04 host2 sshd[201968]: Disconnected from invalid user ubuntu 52.237.80.79 port 49550 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.133.146.37
country_id: 1643084
description:
Jan 14 16:40:22 host2 sshd[201484]: Disconnected from invalid user ubuntu 43.133.146.37 port 59730 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.237.80.79
country_id: 1880251
description:
Jan 14 16:40:28 host2 sshd[201538]: Disconnected from invalid user ubuntu 52.237.80.79 port 41050 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.126.84.154
country_id: 1694008
description:
Jan 14 16:42:30 host2 sshd[203060]: Disconnected from invalid user ubuntu 45.126.84.154 port 34112 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.150.194.114
country_id: 6252001
description:
Jan 14 16:46:08 host2 dovecot[149701]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.150.194.114, lip=66.85.158.91, TLS, session=<b4sjPFdIXsgUlsJy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.166.50.15
country_id: 453733
description:
2026-01-14 16:48:06 dovecot_login authenticator failed for H=15-50-166-83.dyn.estpak.ee [83.166.50.15]:45151: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.224.242.137
country_id: 2635167
description:
2026-01-14 16:48:19 dovecot_login authenticator failed for H=([109.224.242.136]) [109.224.242.137]:41598: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.85.202
country_id: 337996
description:
2026-01-14 16:56:54 dovecot_login authenticator failed for H=([196.191.212.236]) [213.55.85.202]:4991: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.125
country_id: 1036973
description:
2026-01-14 16:57:12 dovecot_login authenticator failed for H=([196.28.226.125]) [196.28.226.125]:41214: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.227.25.115
country_id: 6252001
description:
2026-01-14 17:03:45 dovecot_plain authenticator failed for H=c-98-227-25-115.hsd1.il.comcast.net (destubs) [98.227.25.115]:49248: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan 14 17:03:51 host2 sshd[221617]: Disconnected from invalid user admin 2.57.121.112 port 46146 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.23.72.121
country_id: 6252001
description:
2026-01-14 17:12:55 dovecot_login authenticator failed for H=([209.23.72.121]) [209.23.72.121]:50608: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.51.135
country_id: 3144096
description:
2026-01-14 17:17:22 dovecot_login authenticator failed for H=(cm-178.232.51.135.get.no) [178.232.51.135]:34783: 535 Incorrect authentication data (set_id=hostmaster@comdef.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.248.30.205
country_id: 1269750
description:
2026-01-14 17:17:51 dovecot_login authenticator failed for H=([103.248.30.205]) [103.248.30.205]:34117: 535 Incorrect authentication data (set_id=hostmaster@comdef.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.185.18.67
country_id: 3469034
description:
2026-01-14 17:18:22 dovecot_login authenticator failed for H=([179.185.18.67]) [179.185.18.67]:36763: 535 Incorrect authentication data (set_id=hostmaster@comdef.org)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 40.124.173.234
country_id: 6252001
description:
Jan 14 17:20:55 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=40.124.173.234, lip=66.85.158.92, TLS, session=</JWIuFdIwIIofK3q>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.15.118.76
country_id: 2464461
description:
2026-01-14 17:23:30 dovecot_login authenticator failed for H=([127.0.0.1]) [197.15.118.76]:51791: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.249.50.9
country_id: 1269750
description:
2026-01-14 17:23:38 dovecot_login authenticator failed for H=([127.0.0.1]) [117.249.50.9]:57561: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.48.78.29
country_id: 3469034
description:
Jan 14 17:30:04 host2 sshd[244781]: Disconnected from invalid user frappe 201.48.78.29 port 49742 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 91.147.92.31
country_id: 1522867
description:
Jan 14 17:32:32 host2 sshd[246670]: Disconnected from invalid user neo4j 91.147.92.31 port 56118 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 201.48.78.29
country_id: 3469034
description:
Jan 14 17:32:43 host2 sshd[246797]: Disconnected from invalid user oracle 201.48.78.29 port 58376 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.48.78.29
country_id: 3469034
description:
Jan 14 17:33:27 host2 sshd[247374]: Disconnected from invalid user freepbx 201.48.78.29 port 42610 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.150.41.194
country_id: 3996063
description:
Jan 14 17:33:29 host2 sshd[247401]: Disconnected from invalid user git 201.150.41.194 port 58872 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 201.150.41.194
country_id: 3996063
description:
Jan 14 17:35:51 host2 sshd[249415]: Disconnected from invalid user procurve 201.150.41.194 port 59338 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.88.20.208
country_id: 2264397
description:
2026-01-14 17:36:10 dovecot_plain authenticator failed for H=([26.49.122.131]) [149.88.20.208]:52162: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.88.20.208
country_id: 2264397
description:
2026-01-14 17:36:17 dovecot_login authenticator failed for H=([26.49.122.131]) [149.88.20.208]:52162: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 91.147.92.31
country_id: 1522867
description:
Jan 14 17:36:20 host2 sshd[250084]: Disconnected from invalid user karaf 91.147.92.31 port 35742 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.132.194.20
country_id: 597427
description:
Jan 14 17:37:25 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=45.132.194.20, lip=66.85.158.91, TLS, session=<6rWO81dIZOYthMIU>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.84.102.17
country_id: 3439705
description:
Jan 14 17:37:26 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=45.84.102.17, lip=66.85.158.91, session=<12Gf81dIvNwtVGYR>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 173.244.42.159
country_id: 1835841
description:
Jan 14 17:37:27 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=173.244.42.159, lip=66.85.158.91, TLS handshaking: Connection closed, session=<u8Sj81dIQOOt9Cqf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 146.70.65.9
country_id: 2328926
description:
Jan 14 17:37:25 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=146.70.65.9, lip=66.85.158.91, TLS handshaking: Connection closed, session=<PVCO81dIXOaSRkEJ>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 91.147.92.31
country_id: 1522867
description:
Jan 14 17:37:35 host2 sshd[250994]: Disconnected from invalid user anonymous 91.147.92.31 port 43040 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.2
country_id: 1269750
description:
2026-01-14 17:39:11 dovecot_login authenticator failed for H=([125.19.173.202]) [152.52.236.2]:58674: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.183.74.177
country_id: 6252001
description:
2026-01-14 17:42:05 dovecot_plain authenticator failed for H=c-73-183-74-177.hsd1.pa.comcast.net (matineured) [73.183.74.177]:60674: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.87.248.223
country_id: 732800
description:
2026-01-14 17:41:37 dovecot_login authenticator failed for H=95-87-248-223.ip.btc-net.bg [95.87.248.223]:38110: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.212.178
country_id: 732800
description:
2026-01-14 17:41:50 dovecot_login authenticator failed for H=([185.255.212.178]) [185.255.212.178]:60751: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.249.192.30
country_id: 3625428
description:
Jan 14 17:43:25 host2 sshd[255885]: Disconnected from invalid user geovision 201.249.192.30 port 52801 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 172.202.117.223
country_id: 6252001
description:
Jan 14 17:44:07 host2 pure-ftpd[256473]: (?@172.202.117.223) [INFO] New connection from 172.202.117.223


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.43.111.208
country_id: 3175395
description:
Jan 14 17:45:46 host2 sshd[258136]: Disconnected from invalid user su 151.43.111.208 port 35034 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 201.249.192.30
country_id: 3625428
description:
Jan 14 17:45:55 host2 sshd[258289]: Disconnected from invalid user db2admin 201.249.192.30 port 47918 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.188.130
country_id: 3144096
description:
2026-01-14 17:47:14 dovecot_login authenticator failed for H=(cm-84.213.188.130.get.no) [84.213.188.130]:41277: 535 Incorrect authentication data (set_id=abuse)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.249.192.30
country_id: 3625428
description:
Jan 14 17:46:33 host2 sshd[258875]: Disconnected from invalid user vpsuser 201.249.192.30 port 28337 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.217.204.91
country_id: 2658434
description:
2026-01-14 17:46:44 dovecot_login authenticator failed for H=adsl-89-217-204-91.adslplus.ch [89.217.204.91]:59886: 535 Incorrect authentication data (set_id=abuse@kamecho.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.218.9.86
country_id: 3469034
description:
Jan 14 17:46:50 host2 sshd[259387]: Disconnected from invalid user couchbase 181.218.9.86 port 46598 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 181.218.9.86
country_id: 3469034
description:
Jan 14 17:47:34 host2 sshd[259945]: Disconnected from invalid user httpadmin 181.218.9.86 port 49126 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.172.179.241
country_id: 2921044
description:
Jan 14 17:48:33 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=167.172.179.241, lip=66.85.158.92, session=<tj9ZG1hIxVGnrLPx>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 104.248.143.76
country_id: 2921044
description:
Jan 14 17:48:33 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=104.248.143.76, lip=66.85.158.92, session=<IiJhG1hIyMRo+I9M>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.210.21.242
country_id: 1880251
description:
Jan 14 17:48:41 host2 sshd[260862]: Disconnected from invalid user cyber 103.210.21.242 port 51696 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.192.94.162
country_id: 1643084
description:
Jan 14 17:48:42 host2 sshd[260876]: Disconnected from invalid user mqtt 139.192.94.162 port 43198 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.210.21.242
country_id: 1880251
description:
Jan 14 17:49:20 host2 sshd[261321]: Disconnected from invalid user su 103.210.21.242 port 50734 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.210.21.242
country_id: 1880251
description:
Jan 14 17:49:55 host2 sshd[261752]: Disconnected from invalid user elasticsearch 103.210.21.242 port 51204 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.129.122.12
country_id: 3923057
description:
Jan 14 17:51:10 host2 sshd[263169]: Disconnected from invalid user User 190.129.122.12 port 1351 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 5.42.239.222
country_id: 102358
description:
Jan 14 17:51:16 host2 sshd[263244]: Disconnected from invalid user mariadb 5.42.239.222 port 60424 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 66.96.239.187
country_id: 1643084
description:
Jan 14 17:50:27 host2 sshd[262479]: Disconnected from invalid user sa 66.96.239.187 port 54604 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.88.137.213
country_id: 2328926
description:
Jan 14 17:51:21 host2 sshd[263317]: Disconnected from invalid user influxdb 102.88.137.213 port 17402 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 82.24.64.220
country_id: 2635167
description:
Jan 14 17:51:40 host2 sshd[263603]: Disconnected from invalid user wildfly 82.24.64.220 port 55810 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan 14 17:51:48 host2 sshd[263672]: Disconnected from invalid user user 2.57.121.25 port 39980 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 14 17:52:45 host2 sshd[264564]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.26.36.241
country_id: 1819730
description:
Jan 14 17:52:24 host2 sshd[264180]: Disconnected from invalid user acti 118.26.36.241 port 33818 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 82.24.64.220
country_id: 2635167
description:
Jan 14 17:52:41 host2 sshd[264522]: Disconnected from invalid user bal 82.24.64.220 port 50156 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 14 17:54:14 host2 sshd[265975]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 5.42.239.222
country_id: 102358
description:
Jan 14 17:53:37 host2 sshd[265303]: Disconnected from invalid user kubernetes 5.42.239.222 port 49708 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 139.192.94.162
country_id: 1643084
description:
Jan 14 17:53:57 host2 sshd[265567]: Disconnected from invalid user influxdb 139.192.94.162 port 43388 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 188.37.194.181
country_id: 2264397
description:
Jan 14 17:53:47 host2 sshd[265414]: Disconnected from invalid user ubuntu 188.37.194.181 port 58990 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.88.137.213
country_id: 2328926
description:
Jan 14 17:53:49 host2 sshd[265449]: Disconnected from invalid user azure 102.88.137.213 port 17176 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.198.161.12
country_id: 6252001
description:
Jan 14 17:53:34 host2 sshd[265284]: Disconnected from invalid user ubnt 143.198.161.12 port 47922 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 188.37.194.181
country_id: 2264397
description:
Jan 14 17:54:18 host2 sshd[266098]: Disconnected from invalid user redisadmin 188.37.194.181 port 43490 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.88.137.213
country_id: 2328926
description:
Jan 14 17:54:30 host2 sshd[266515]: Disconnected from invalid user liberty 102.88.137.213 port 1429 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.41
country_id: 2750405
description:
2026-01-14 17:54:35 dovecot_login authenticator failed for H=(Copy-of-VM-2022) [45.94.31.41]:20528: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 129.80.134.10
country_id: 6252001
description:
Jan 14 17:55:13 host2 sshd[267504]: Disconnected from invalid user celery 129.80.134.10 port 58256 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 164.90.216.252
country_id: 2921044
description:
Jan 14 17:55:58 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=164.90.216.252, lip=66.85.158.92, TLS, session=<32HdNVhIqk+kWtj8>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 151.43.111.208
country_id: 3175395
description:
Jan 14 18:00:28 host2 sshd[271762]: Disconnected from invalid user upload 151.43.111.208 port 35670 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.58.62
country_id: 1269750
description:
2026-01-14 18:02:47 dovecot_login authenticator failed for H=([125.19.70.49]) [182.95.58.62]:60964: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.226.118
country_id: 1269750
description:
2026-01-14 18:03:02 dovecot_login authenticator failed for H=([125.18.154.73]) [182.95.226.118]:48188: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.26.53.164
country_id: 1269750
description:
2026-01-14 18:04:23 dovecot_login authenticator failed for H=([122.169.40.221]) [103.26.53.164]:41344: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.184.142
country_id: 1269750
description:
2026-01-14 18:04:45 dovecot_login authenticator failed for H=([125.17.183.33]) [182.95.184.142]:38612: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 51.75.254.157
country_id: 3017382
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 51.75.254.157 - lezzarot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarot (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.122.247
country_id: 3144096
description:
2026-01-14 18:24:45 dovecot_login authenticator failed for H=(cm-178.232.122.247.get.no) [178.232.122.247]:45236: 535 Incorrect authentication data (set_id=business@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.128.54.17
country_id: 3469034
description:
2026-01-14 18:24:51 dovecot_login authenticator failed for H=(17.54.gonzagatelecom.com.br) [177.128.54.17]:34228: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.72.153.110
country_id: 290557
description:
2026-01-14 18:24:57 dovecot_login authenticator failed for H=([91.72.153.110]) [91.72.153.110]:37070: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.235.248.73
country_id: 3469034
description:
2026-01-14 18:25:08 dovecot_login authenticator failed for H=(186.235.248.73.girardi-rs.com.br) [186.235.248.73]:51252: 535 Incorrect authentication data (set_id=business)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.128.202
country_id: 6252001
description:
2026-01-14 18:25:37 dovecot_login authenticator failed for H=([192.34.128.202]) [192.34.128.202]:35874: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.195.211.98
country_id: 6252001
description:
2026-01-14 18:26:06 dovecot_plain authenticator failed for H=c-73-195-211-98.hsd1.nj.comcast.net (couts) [73.195.211.98]:60594: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan 14 18:27:15 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@seyawin.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<XlKkpVhIPOR100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.121.137.167
country_id: 1733045
description:
2026-01-14 18:28:16 dovecot_login authenticator failed for H=([127.0.0.1]) [121.121.137.167]:19191: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.128.202
country_id: 6252001
description:
2026-01-14 18:28:32 dovecot_login authenticator failed for H=([192.34.128.202]) [192.34.128.202]:55360: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.233.231.160
country_id: 2750405
description:
2026-01-14 18:28:38 dovecot_login authenticator failed for H=customer-213-233-231-160.solcon.nl ([127.0.0.1]) [213.233.231.160]:39688: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.194.128.158
country_id: 1269750
description:
2026-01-14 18:28:43 dovecot_login authenticator failed for H=(static-158.128.194.14-tataidc.co.in) [14.194.128.158]:43712: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.223.92.208
country_id: 3175395
description:
2026-01-14 18:31:52 dovecot_login authenticator failed for H=(ADMIN) [176.223.92.208]:57149: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.249.234.70
country_id: 3469034
description:
2026-01-14 18:32:42 dovecot_plain authenticator failed for H=(DFM-APP-02.dfm.local) [186.249.234.70]:50535: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.229.38
country_id: 1269750
description:
2026-01-14 18:33:23 dovecot_login authenticator failed for H=([182.95.229.38]) [182.95.229.38]:52092: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.249.234.70
country_id: 3469034
description:
Jan 14 18:33:30 host2 sshd[302909]: Invalid user info@idesignvector.com from 186.249.234.70 port 64462


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.65.140.218
country_id: 3017382
description:
2026-01-14 18:33:37 dovecot_login authenticator failed for H=82-65-140-218.subs.proxad.net [82.65.140.218]:50186: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.57.39.170
country_id: 6252001
description:
2026-01-14 18:35:52 dovecot_login authenticator failed for H=(syn-184-057-039-170.res.spectrum.com) [184.57.39.170]:64039: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.40.215.162
country_id: 3469034
description:
2026-01-14 18:36:11 dovecot_login authenticator failed for H=187-40-215-162.user.veloxzone.com.br [187.40.215.162]:39002: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.80.105.86
country_id: 6252001
description:
Jan 14 18:36:27 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.80.105.86, lip=66.85.158.92, session=<n6eixlhIKuYUUGlW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.194
country_id: 1269750
description:
2026-01-14 18:37:23 dovecot_login authenticator failed for H=(nsg-corporate-194.230.187.122.airtel.in) [122.187.230.194]:57721: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.144.90
country_id: 6252001
description:
Jan 14 18:39:28 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.65.144.90, lip=66.85.158.91, session=<H4110VhI8IcUQZBa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 173.239.205.23
country_id: 3595528
description:
Jan 14 18:45:06 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=173.239.205.23, lip=66.85.158.91, TLS, session=<QiKS5VhIGqCt780X>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 146.70.22.68
country_id: 2510769
description:
Jan 14 18:45:05 host2 dovecot[221878]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=146.70.22.68, lip=66.85.158.91, session=<iuaP5VhIBsKSRhZE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 173.244.42.159
country_id: 1835841
description:
Jan 14 18:45:06 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=173.244.42.159, lip=66.85.158.91, session=<FM+T5VhIAsKt9Cqf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 193.176.86.40
country_id: 2921044
description:
Jan 14 18:45:06 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=193.176.86.40, lip=66.85.158.91, TLS handshaking: Connection closed, session=<+2aS5VhIGKDBsFYo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Jan 14 19:01:04 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<ZgSxHllISpIDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Jan 14 19:02:03 host2 dovecot[221878]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<tFIwIllIwN0DhpQ7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.220
country_id: 130758
description:
2026-01-14 19:01:25 dovecot_login authenticator failed for H=(localhost) [62.60.130.220]:56376: 535 Incorrect authentication data (set_id=meeting@gaido.co.id)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 152.32.245.186
country_id: 1605651
description:
Jan 14 19:03:17 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=152.32.245.186, lip=66.85.158.91, session=<3TWjJllIzrSYIPW6>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 152.32.245.186
country_id: 1605651
description:
Jan 14 19:03:19 host2 dovecot[221878]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=152.32.245.186, lip=66.85.158.91, session=<YwfDJllICraYIPW6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Jan 14 19:03:26 host2 dovecot[221878]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<5iwqJ1lIzM4DhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Jan 14 19:04:23 host2 dovecot[221878]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<d+iRKllIYpADhpQ7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.161.93.53
country_id: 1269750
description:
2026-01-14 19:04:56 dovecot_login authenticator failed for H=([103.161.93.53]) [103.161.93.53]:61896: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.63.10
country_id: 1269750
description:
2026-01-14 19:05:27 dovecot_login authenticator failed for H=(nsg-static-177.160.71.182.airtel.in) [182.95.63.10]:47760: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.38.201.238
country_id: 6252001
description:
2026-01-14 19:05:37 dovecot_plain authenticator failed for H=c-68-38-201-238.hsd1.in.comcast.net (bionones) [68.38.201.238]:55438: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan 14 19:05:46 host2 sshd[329302]: Disconnected from invalid user user 2.57.121.25 port 5196 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Jan 14 19:05:49 host2 dovecot[221878]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<iZGuL1lI7qIDhpQ7>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.134.148.59
country_id: 6252001
description:
Jan 14 19:07:04 host2 dovecot[221878]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<MxUpNFlICIsDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Jan 14 19:06:29 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<t0sKMllIBugDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Jan 14 19:07:29 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<0eahNVlInOUDhpQ7>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.134.148.59
country_id: 6252001
description:
Jan 14 19:08:05 host2 dovecot[221878]: imap-login: Disconnected: Input buffer full (no auth attempts in 1 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<zh7CN1lIBK8DhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Jan 14 19:08:24 host2 dovecot[221878]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<mxXoOFlIKtsDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Jan 14 19:09:23 host2 dovecot[221878]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<NappPFlIPsYDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.22.82.82
country_id: 2921044
description:
Jan 14 19:11:57 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (no auth attempts in 30 secs): user=<>, rip=165.22.82.82, lip=66.85.158.91, TLS handshaking: Connection closed, session=<DfuYRVlI9kGlFlJS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.230.86.50
country_id: 6252001
description:
2026-01-14 19:12:36 dovecot_plain authenticator failed for H=c-73-230-86-50.hsd1.pa.comcast.net (precablen) [73.230.86.50]:43600: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2026-01-14 19:18:09 dovecot_plain authenticator failed for H=(janink) [154.144.243.93]:46390: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.129.28
country_id: 99237
description:
2026-01-14 19:18:23 dovecot_plain authenticator failed for H=(aulity) [65.20.129.28]:36076: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.6.101.246
country_id: 2510769
description:
2026-01-14 19:20:20 dovecot_login authenticator failed for H=246.red-88-6-101.staticip.rima-tde.net [88.6.101.246]:51398: 535 Incorrect authentication data (set_id=postmaster@neotechlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.241.102
country_id: 1269750
description:
2026-01-14 19:20:55 dovecot_login authenticator failed for H=([125.19.175.152]) [182.78.241.102]:42598: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.114.190
country_id: 1269750
description:
2026-01-14 19:21:12 dovecot_login authenticator failed for H=([128.185.223.185]) [27.123.114.190]:41562: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.194
country_id: 1269750
description:
2026-01-14 19:23:04 dovecot_login authenticator failed for H=([182.95.228.194]) [182.95.228.194]:49968: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.58.62
country_id: 1269750
description:
2026-01-14 19:22:34 dovecot_login authenticator failed for H=([125.19.70.49]) [182.95.58.62]:55252: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.158.10
country_id: 99237
description:
2026-01-14 19:22:38 dovecot_login authenticator failed for H=([65.20.158.10]) [65.20.158.10]:58042: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.23.140
country_id: 3144096
description:
2026-01-14 19:23:36 dovecot_login authenticator failed for H=([178.232.23.140]) [178.232.23.140]:58968: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.66.209
country_id: 1819730
description:
2026-01-14 19:35:50 dovecot_login authenticator failed for H=209.66.246.220.static.netvigator.com [220.246.66.209]:64246: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.46.214.110
country_id: 3703430
description:
2026-01-14 19:35:15 dovecot_login authenticator failed for H=(104.214.46.200.psinetpa.net) [200.46.214.110]:34138: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.188.143.166
country_id: 1819730
description:
2026-01-14 19:35:32 dovecot_login authenticator failed for H=([180.188.143.166]) [180.188.143.166]:58496: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.96.62.29
country_id: 1269750
description:
2026-01-14 19:35:35 dovecot_login authenticator failed for H=([59.96.62.29]) [59.96.62.29]:55472: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.39.111.219
country_id: 357994
description:
Jan 14 19:36:40 host2 sshd[353818]: Disconnected from invalid user admin 197.39.111.219 port 41896 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan 14 19:37:47 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<Zov8oVlIKtkDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan 14 19:38:43 host2 dovecot[221878]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<2EZcpVlIcrsDjyE/>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.221.196.5
country_id: 357994
description:
Jan 14 19:39:23 host2 sshd[356031]: Disconnected from invalid user ubuntu 196.221.196.5 port 33170 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan 14 19:39:45 host2 dovecot[221878]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<OPYLqVlItLIDjyE/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-14 19:39:16 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (dicid) [87.103.126.54]:19666: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.219.224.230
country_id: 357994
description:
Jan 14 19:40:15 host2 sshd[356954]: Disconnected from invalid user ubuntu 196.219.224.230 port 33096 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan 14 19:41:48 host2 dovecot[221878]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<x+VesFlIxroDjyE/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.126.241.118
country_id: 2661886
description:
2026-01-14 19:42:26 dovecot_login authenticator failed for H=([127.0.0.1]) [188.126.241.118]:37060: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.38.217.83
country_id: 2077456
description:
2026-01-14 19:42:15 dovecot_login authenticator failed for H=([127.0.0.1]) [161.38.217.83]:46428: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 196.219.224.230
country_id: 357994
description:
Jan 14 19:42:20 host2 sshd[358913]: Disconnected from invalid user admin 196.219.224.230 port 33550 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.39.111.219
country_id: 357994
description:
Jan 14 19:44:21 host2 sshd[360616]: Disconnected from invalid user ubuntu 197.39.111.219 port 37820 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.221.122
country_id: 3144096
description:
2026-01-14 19:44:28 dovecot_login authenticator failed for H=(cm-178.232.221.122.get.no) [178.232.221.122]:58997: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.219.224.230
country_id: 357994
description:
Jan 14 19:45:40 host2 sshd[361939]: Disconnected from invalid user ubuntu 196.219.224.230 port 57906 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.221.196.5
country_id: 357994
description:
Jan 14 19:46:21 host2 sshd[362539]: Disconnected from invalid user admin 196.221.196.5 port 55238 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 196.221.196.5
country_id: 357994
description:
Jan 14 19:48:17 host2 sshd[364448]: Disconnected from invalid user ubuntu 196.221.196.5 port 55800 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.39.111.219
country_id: 357994
description:
Jan 14 19:49:32 host2 sshd[365541]: Disconnected from invalid user ubuntu 197.39.111.219 port 48666 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.66
country_id: 1149361
description:
2026-01-14 19:51:42 dovecot_login authenticator failed for H=([149.54.62.66]) [149.54.62.66]:56891: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 36.64.30.151
country_id: 1643084
description:
Jan 14 19:57:23 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 24 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=36.64.30.151, lip=66.85.158.91, TLS, session=<kYSk5llIRtEkQB6X>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.158.10
country_id: 99237
description:
2026-01-14 19:56:30 dovecot_login authenticator failed for H=([65.20.158.10]) [65.20.158.10]:49173: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2026-01-14 19:56:29 dovecot_login authenticator failed for H=([102.53.15.56]) [102.53.15.56]:59346: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.27
country_id: 3144096
description:
2026-01-14 19:56:45 dovecot_login authenticator failed for H=([84.213.189.27]) [84.213.189.27]:45688: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.18
country_id: 241170
description:
Jan 14 19:57:41 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.18, lip=66.85.158.91, session=<ex4F6VlITJPE+2YS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.57.184.151
country_id: 1269750
description:
Jan 14 19:57:44 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<env_eng>, method=PLAIN, rip=103.57.184.151, lip=66.85.158.91, TLS, session=<QXou6FlI/JBnObiX>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.106.49.149
country_id: 3932488
description:
2026-01-14 20:05:11 dovecot_login authenticator failed for H=([200.106.49.149]) [200.106.49.149]:37962: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2026-01-14 20:05:18 dovecot_login authenticator failed for H=host-196-47-172-253.afnet.net [196.47.172.253]:43427: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
country_id: 3144096
description:
2026-01-14 20:04:38 dovecot_login authenticator failed for H=(85-19-195-12.telia-isp.no) [85.19.195.12]:34770: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan 14 20:11:53 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 5 secs): user=<sales@seyawin.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<Y/6qG1pIRaV100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.245.182
country_id: 1269750
description:
2026-01-14 20:17:08 dovecot_login authenticator failed for H=([125.20.245.182]) [125.20.245.182]:53372: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.161.217.228
country_id: 2510769
description:
2026-01-14 20:17:34 dovecot_login authenticator failed for H=([90.161.217.228]) [90.161.217.228]:45397: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.74.122
country_id: 1149361
description:
2026-01-14 20:17:46 dovecot_login authenticator failed for H=([180.94.74.122]) [180.94.74.122]:46150: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 68.183.3.153
country_id: 2750405
description:
Jan 14 20:21:57 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=68.183.3.153, lip=66.85.158.92, session=<0VLtP1pIOoBEtwOZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.15
country_id: 241170
description:
Jan 14 20:22:36 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 5 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.15, lip=66.85.158.91, session=<Om0AQlpIuNzE+2YP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.211.94.35
country_id: 289688
description:
2026-01-14 20:22:39 dovecot_login authenticator failed for H=([37.211.94.35]) [37.211.94.35]:63616: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.154
country_id: 3144096
description:
2026-01-14 20:23:16 dovecot_login authenticator failed for H=([84.213.189.154]) [84.213.189.154]:47952: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.245.38
country_id: 1269750
description:
2026-01-14 20:24:25 dovecot_login authenticator failed for H=([152.52.12.201]) [152.52.245.38]:50388: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.174.178
country_id: 1269750
description:
2026-01-14 20:24:49 dovecot_login authenticator failed for H=([122.187.181.57]) [182.95.174.178]:41418: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.188.252.208
country_id: 6252001
description:
2026-01-14 20:28:01 dovecot_plain authenticator failed for H=c-73-188-252-208.hsd1.pa.comcast.net (urnal) [73.188.252.208]:49120: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 86.54.42.125
country_id: 241170
description:
Jan 14 20:34:20 host2 sshd[403779]: Disconnected from invalid user ubuntu 86.54.42.125 port 48488 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.214
country_id: 2635167
description:
Jan 14 20:34:38 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 29 secs): user=<>, rip=35.203.211.214, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<lMtPbVpIC9ojy9PW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.214
country_id: 2635167
description:
Jan 14 20:35:45 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 30 secs): user=<>, rip=35.203.211.214, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<gNxOcVpImPEjy9PW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan 14 20:35:55 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<BFTtcVpIcs0DjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan 14 20:36:27 host2 dovecot[221878]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<U4PKc1pImuUDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.214
country_id: 2635167
description:
Jan 14 20:36:40 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed: read(size=429) failed: Connection reset by peer (no auth attempts in 12 secs): user=<>, rip=35.203.211.214, lip=66.85.158.92, TLS: read(size=429) failed: Connection reset by peer, session=<D/2SdFpI8uojy9PW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan 14 20:37:25 host2 dovecot[221878]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<s5M9d1pICqsDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan 14 20:38:42 host2 dovecot[221878]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<0hXae1pIgsgDjyE/>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 86.54.42.125
country_id: 241170
description:
Jan 14 20:40:02 host2 sshd[408058]: Disconnected from invalid user admin 86.54.42.125 port 48924 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 86.54.42.125
country_id: 241170
description:
Jan 14 20:39:29 host2 sshd[407754]: Disconnected from invalid user ubuntu 86.54.42.125 port 60212 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.110.189.45
country_id: 2750405
description:
2026-01-14 20:39:31 dovecot_login authenticator failed for H=([193.110.189.45]) [193.110.189.45]:42965: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan 14 20:39:41 host2 dovecot[221878]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<h0tYf1pIkKUDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan 14 20:41:11 host2 dovecot[221878]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<UGbEhFpIro0DjyE/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.101.50
country_id: 1269750
description:
2026-01-14 20:40:32 dovecot_login authenticator failed for H=(nsg-corporate-50.101.185.122.airtel.in) [122.185.101.50]:49936: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.143.33.63
country_id: 6252001
description:
Jan 14 20:42:06 host2 dovecot[221878]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<j9cFiFpIkp4DjyE/>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.55
country_id: 6252001
description:
Jan 14 20:41:33 host2 pure-ftpd[409631]: (?@147.185.132.55) [INFO] New connection from 147.185.132.55


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 86.54.42.125
country_id: 241170
description:
Jan 14 20:41:35 host2 sshd[409638]: Disconnected from invalid user admin 86.54.42.125 port 55644 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.243.213.125
country_id: 290557
description:
Jan 14 20:42:04 host2 sshd[410034]: Disconnected from invalid user ubuntu 151.243.213.125 port 42330 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan 14 20:42:04 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<Ihrqh1pIiJ4DjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan 14 20:43:03 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<0hBwi1pIoqQDjyE/>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.143.33.63
country_id: 6252001
description:
Jan 14 20:43:06 host2 dovecot[221878]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<5diXi1pIsKQDjyE/>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 151.243.213.125
country_id: 290557
description:
Jan 14 20:43:13 host2 sshd[410815]: Disconnected from invalid user ubuntu 151.243.213.125 port 39854 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan 14 20:43:46 host2 dovecot[221878]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<NYn1jVpIINYDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.214
country_id: 2635167
description:
Jan 14 20:44:24 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.203.211.214, lip=66.85.158.92, TLS, session=<KxI7kFpIcuQjy9PW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan 14 20:44:45 host2 dovecot[221878]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=</Ct/kVpIGqUDjyE/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.65.140.218
country_id: 3017382
description:
2026-01-14 20:45:21 dovecot_login authenticator failed for H=82-65-140-218.subs.proxad.net [82.65.140.218]:39226: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.127.150
country_id: 1269750
description:
2026-01-14 20:46:10 dovecot_login authenticator failed for H=(nsg-corporate-177.246.185.122.airtel.in) [122.184.127.150]:44938: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.64.105.54
country_id: 6252001
description:
Jan 14 20:49:49 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.64.105.54, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<tBKYo1pIFMwUQGk2>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan 14 20:51:36 host2 sshd[417921]: Disconnected from invalid user user 2.57.121.25 port 32078 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.202.225.79
country_id: 6252001
description:
2026-01-14 20:54:07 dovecot_login authenticator failed for H=wsip-72-202-225-79.lv.lv.cox.net [72.202.225.79]:49089: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.144.27.228
country_id: 6252001
description:
2026-01-14 20:55:38 dovecot_plain authenticator failed for H=c-73-144-27-228.hsd1.mi.comcast.net (kints) [73.144.27.228]:42106: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.224
country_id: 2186224
description:
2026-01-14 20:55:58 dovecot_login authenticator failed for H=([127.0.0.1]) [121.73.169.224]:56810: 535 Incorrect authentication data (set_id=art@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.122.10
country_id: 3144096
description:
2026-01-14 20:56:05 dovecot_login authenticator failed for H=([127.0.0.1]) [46.212.122.10]:54429: 535 Incorrect authentication data (set_id=art)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 35.187.114.229
country_id: 2802361
description:
Jan 14 20:56:16 host2 pure-ftpd[422352]: (?@35.187.114.229) [INFO] New connection from 35.187.114.229


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 14 20:56:57 host2 sshd[422791]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 14 20:58:24 host2 sshd[423775]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.109.81.222
country_id: 1605651
description:
2026-01-14 20:59:06 dovecot_login authenticator failed for H=(mx-ll-183.89.250-247.dynamic.3bb.in.th) [101.109.81.222]:60675: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 203.55.131.5
country_id: 6252001
description:
Jan 14 20:59:25 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=203.55.131.5, lip=66.85.158.91, TLS: Connection closed, session=<d2T5xVpIZurLN4MF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.123.45.2
country_id: 1269750
description:
2026-01-14 20:59:54 dovecot_login authenticator failed for H=([103.123.45.2]) [103.123.45.2]:48752: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.25
country_id: 2635167
description:
Jan 14 21:01:49 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 19 secs): user=<>, rip=35.203.210.25, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<PaaKzlpIzcwjy9IZ>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 64.227.131.199
country_id: 1269750
description:
Jan 14 21:03:31 host2 sshd[428070]: Disconnected from invalid user will 64.227.131.199 port 33532 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.186.54.65
country_id: 298795
description:
2026-01-14 21:03:31 dovecot_login authenticator failed for H=([78.186.54.65]) [78.186.54.65]:45140: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.25
country_id: 2635167
description:
Jan 14 21:02:46 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 7 secs): user=<>, rip=35.203.210.25, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<GnXt0VpIqOcjy9IZ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.25
country_id: 2635167
description:
Jan 14 21:03:38 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 10 secs): user=<>, rip=35.203.210.25, lip=66.85.158.91, TLS: read(size=403) failed: Connection reset by peer, session=<ZPgA1VpIpvQjy9IZ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.229.42
country_id: 1269750
description:
2026-01-14 21:04:15 dovecot_login authenticator failed for H=([152.52.238.53]) [152.52.229.42]:37808: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.131.199
country_id: 1269750
description:
Jan 14 21:04:45 host2 sshd[429058]: Disconnected from invalid user lighttpd 64.227.131.199 port 40012 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.25
country_id: 2635167
description:
Jan 14 21:09:39 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.203.210.25, lip=66.85.158.91, TLS, session=<w/mK6lpInvojy9IZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan 14 21:13:17 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<Y4Rr91pIA7R100Db>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.38
country_id: 6252001
description:
Jan 14 21:22:02 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.38, lip=66.85.158.92, TLS: Connection closed, session=<JBnTFltILP5BMQEm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.136.54.7
country_id: 614540
description:
Jan 14 21:22:25 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=45.136.54.7, lip=66.85.158.91, TLS, session=<lSgSF1tIjoYtiDYH>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.47
country_id: 6252001
description:
Jan 14 21:21:50 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.47, lip=66.85.158.92, session=<PM8ZFltIKaBBMQEv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.89.136.185
country_id: 3469034
description:
Jan 14 21:22:47 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<env_eng>, method=PLAIN, rip=190.89.136.185, lip=66.85.158.91, TLS, session=<Ki1WGFtIUqm+WYi5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.183.74.177
country_id: 6252001
description:
2026-01-14 21:24:17 dovecot_plain authenticator failed for H=c-73-183-74-177.hsd1.pa.comcast.net (incentiols) [73.183.74.177]:60594: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 171.22.233.202
country_id: 3175395
description:
Jan 14 21:27:44 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=171.22.233.202, lip=66.85.158.91, TLS, session=<7qU2KltIx8yrFunK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.250.216.79
country_id: 953987
description:
Jan 14 21:28:11 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<careers>, method=PLAIN, rip=196.250.216.79, lip=66.85.158.91, TLS, session=<6taAK1tIZOPE+thP>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.106.48.26
country_id: 6252001
description:
Jan 14 21:28:44 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.106.48.26, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<ifHKLltI+OEUajAa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.174.35
country_id: 1269750
description:
2026-01-14 21:32:03 dovecot_login authenticator failed for H=(nsg-corporate-35.174.186.122.airtel.in) [122.186.174.35]:54748: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2026-01-14 21:32:24 dovecot_login authenticator failed for H=([196.216.81.126]) [196.216.81.126]:45790: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.96.179.9
country_id: 6251999
description:
Jan 14 21:33:25 host2 sshd[452478]: Disconnected from invalid user nagiosadmin 172.96.179.9 port 54320 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.96.179.9
country_id: 6251999
description:
Jan 14 21:33:52 host2 sshd[452948]: Disconnected from invalid user default 172.96.179.9 port 34534 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.96.179.9
country_id: 6251999
description:
Jan 14 21:35:17 host2 sshd[454476]: Disconnected from invalid user webserver 172.96.179.9 port 54216 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.47.22
country_id: 953987
description:
Jan 14 21:36:12 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=102.64.47.22, lip=66.85.158.91, TLS, session=<4p8/SFtI9ORmQC8W>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.103.5.123
country_id: 690791
description:
Jan 14 21:36:31 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<env_eng>, method=PLAIN, rip=176.103.5.123, lip=66.85.158.91, TLS, session=<pbuZSVtIQsGwZwV7>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.96.179.9
country_id: 6251999
description:
Jan 14 21:35:46 host2 sshd[454885]: Disconnected from invalid user dell 172.96.179.9 port 40388 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 142.248.80.119
country_id: 6252001
description:
Jan 14 21:40:20 host2 pure-ftpd[459271]: (?@142.248.80.119) [INFO] New connection from 142.248.80.119


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 142.248.80.119
country_id: 6252001
description:
Jan 14 21:40:55 host2 pure-ftpd[459958]: (?@142.248.80.119) [INFO] New connection from 142.248.80.119


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 142.248.80.119
country_id: 6252001
description:
Jan 14 21:40:55 host2 pure-ftpd[459955]: (?@142.248.80.119) [INFO] New connection from 142.248.80.119


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.80
country_id: 6252001
description:
Jan 14 21:48:46 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.80, lip=66.85.158.91, TLS handshaking: Connection closed, session=<VDxxdltIItlAPpxQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.95.24.117
country_id: 2464461
description:
2026-01-14 21:50:02 dovecot_login authenticator failed for H=([193.95.21.147]) [193.95.24.117]:58584: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.230.142
country_id: 1269750
description:
2026-01-14 21:50:41 dovecot_login authenticator failed for H=([182.79.202.89]) [182.95.230.142]:55450: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.64.94
country_id: 3469034
description:
2026-01-14 21:51:06 dovecot_login authenticator failed for H=(189-108-129-173.customer.tdatabrasil.net.br) [187.8.64.94]:48158: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 98.80.4.74
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 98.80.4.74: 250 connections per 30 seconds to 2078 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 98.80.4.74
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 98.80.4.74: 415 connections per 30 seconds to 2078 port.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.98.41.27
country_id: 1269750
description:
2026-01-14 22:05:05 dovecot_login authenticator failed for H=([59.98.41.27]) [59.98.41.27]:36901: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan 14 22:07:55 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@seyawin.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<Grq6ultI29d100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.223.53.234
country_id: 3932488
description:
2026-01-14 22:09:50 dovecot_login authenticator failed for H=([190.223.53.234]) [190.223.53.234]:47492: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.120.90
country_id: 3469034
description:
2026-01-14 22:09:28 dovecot_login authenticator failed for H=(187-8-120-90.customer.tdatabrasil.net.br) [187.8.120.90]:41492: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.221.130
country_id: 1269750
description:
2026-01-14 22:14:13 dovecot_login authenticator failed for H=(nsg-corporate-130.221.187.122.airtel.in) [122.187.221.130]:55164: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.220.30
country_id: 1269750
description:
2026-01-14 22:15:06 dovecot_login authenticator failed for H=(nsg-corporate-153.189.187.122.airtel.in) [125.19.220.30]:35652: 535 Incorrect authentication data (set_id=zxup4hcs)


