# incident

plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 85.225.133.9
country_id: 2661886
description:
Jan 12 20:54:38 host2 sshd[2025588]: Disconnecting authenticating user root 85.225.133.9 port 49838: Too many authentication failures [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.153.146
country_id: 99237
description:
2026-01-12 20:54:44 dovecot_login authenticator failed for H=([65.20.153.146]) [65.20.153.146]:34041: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 85.225.133.9
country_id: 2661886
description:
Jan 12 20:54:57 host2 sshd[2026032]: Disconnecting invalid user admin 85.225.133.9 port 52574: Too many authentication failures [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.251.170
country_id: 99237
description:
2026-01-12 20:55:51 dovecot_login authenticator failed for H=([65.20.251.170]) [65.20.251.170]:53191: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.52
country_id: 6252001
description:
Jan 12 20:56:02 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.52, lip=66.85.158.92, TLS handshaking: Connection closed, session=<N4UufjJIOHJBMQE0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.201.69
country_id: 1733045
description:
2026-01-12 20:56:10 dovecot_login authenticator failed for H=([49.125.201.69]) [49.125.201.69]:50738: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.107
country_id: 6252001
description:
Jan 12 21:01:03 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 12 secs): user=<>, rip=162.216.150.107, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<OusUkDJIocGi2JZr>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.107
country_id: 6252001
description:
Jan 12 21:04:31 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 3 secs): user=<>, rip=162.216.150.107, lip=66.85.158.92, TLS: read(size=403) failed: Connection reset by peer, session=<s2qGnDJIhO2i2JZr>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 12 21:04:52 host2 sshd[2035180]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.107
country_id: 6252001
description:
Jan 12 21:04:39 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed: read(size=429) failed: Connection reset by peer (no auth attempts in 4 secs): user=<>, rip=162.216.150.107, lip=66.85.158.92, TLS: read(size=429) failed: Connection reset by peer, session=<RA36nDJIcv2i2JZr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan 12 21:07:25 host2 sshd[2037510]: Disconnected from invalid user user 2.57.121.25 port 23675 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan 12 21:08:25 host2 sshd[2038377]: Disconnected from invalid user admin 2.57.121.112 port 7513 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 104.199.46.221
country_id: 2802361
description:
Jan 12 21:08:29 host2 pure-ftpd[2038434]: (?@104.199.46.221) [INFO] New connection from 104.199.46.221


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.107
country_id: 6252001
description:
Jan 12 21:11:20 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.150.107, lip=66.85.158.92, TLS, session=<g8HjtDJIQuGi2JZr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.51.135
country_id: 3144096
description:
2026-01-12 21:12:24 dovecot_login authenticator failed for H=(cm-178.232.51.135.get.no) [178.232.51.135]:38448: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.56.0.19
country_id: 3469034
description:
2026-01-12 21:11:58 dovecot_login authenticator failed for H=(189-56-0-19.customer.tdatabrasil.net.br) [189.56.0.19]:44304: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.180.19
country_id: 337996
description:
2026-01-12 21:14:20 dovecot_login authenticator failed for H=([196.190.180.18]) [196.190.180.19]:26215: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 201.249.89.102
country_id: 3625428
description:
Jan 12 21:14:36 host2 sshd[2043739]: Disconnected from invalid user arkserver 201.249.89.102 port 48146 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.232.119.77
country_id: 2921044
description:
Jan 12 21:15:03 host2 pure-ftpd[2044463]: (?@165.232.119.77) [INFO] New connection from 165.232.119.77


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.249.89.102
country_id: 3625428
description:
Jan 12 21:15:46 host2 sshd[2045187]: Disconnected from invalid user odoo 201.249.89.102 port 59838 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan 12 21:17:26 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<hr@seyawin.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<Vq16yjJIOZ1100Db>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 164.90.155.129
country_id: 6252001
description:
Jan 12 21:18:16 host2 pure-ftpd[2047627]: (?@164.90.155.129) [INFO] New connection from 164.90.155.129


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.8.218.251
country_id: 2661886
description:
2026-01-12 21:18:19 dovecot_login authenticator failed for H=([81.8.218.251]) [81.8.218.251]:38514: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.107.84.244
country_id: 7626844
description:
2026-01-12 21:17:54 dovecot_login authenticator failed for H=(244.84.107.200.flamingotv.net) [200.107.84.244]:43859: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.220.169.113
country_id: 2635167
description:
2026-01-12 21:20:09 dovecot_login authenticator failed for H=(165-220-169-113.cust.exede.net) [165.220.169.113]:48376: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.104.225.201
country_id: 6252001
description:
2026-01-12 21:20:37 dovecot_login authenticator failed for H=(syn-024-104-225-201.res.spectrum.com) [24.104.225.201]:54113: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.107.163.195
country_id: 3932488
description:
2026-01-12 21:23:46 dovecot_login authenticator failed for H=([200.107.163.195]) [200.107.163.195]:47142: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.162.60
country_id: 2186224
description:
2026-01-12 21:24:20 dovecot_login authenticator failed for H=([121.73.162.60]) [121.73.162.60]:48446: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 174.138.78.232
country_id: 6252001
description:
Jan 12 21:27:32 host2 pure-ftpd[2055782]: (?@174.138.78.232) [INFO] New connection from 174.138.78.232


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 208.109.34.86
country_id: 6252001
description:
Jan 12 21:26:56 host2 pure-ftpd[2055324]: (?@208.109.34.86) [INFO] New connection from 208.109.34.86


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.89.178.151
country_id: 3865483
description:
Jan 12 21:27:00 host2 sshd[2055366]: Disconnected from invalid user dockeruser 200.89.178.151 port 24892 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.64.105.252
country_id: 6252001
description:
Jan 12 21:28:55 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.64.105.252, lip=66.85.158.91, session=<km3K8zJIOp4UQGn8>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 200.89.178.151
country_id: 3865483
description:
Jan 12 21:29:35 host2 sshd[2057301]: Disconnected from invalid user vlc 200.89.178.151 port 58682 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.237.119.118
country_id: 6252001
description:
2026-01-12 21:29:39 dovecot_login authenticator failed for H=118-119-237-24.gci.net [24.237.119.118]:50055: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.89.178.151
country_id: 3865483
description:
Jan 12 21:30:53 host2 sshd[2059134]: Disconnected from invalid user varnish 200.89.178.151 port 25935 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.195.96
country_id: 6252001
description:
Jan 12 21:30:59 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.65.195.96, lip=66.85.158.92, session=<YAIn+zJIgs8UQcNg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.239.10.198
country_id: 357994
description:
2026-01-12 21:34:25 dovecot_login authenticator failed for H=([154.239.10.205]) [154.239.10.198]:42222: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.230.122
country_id: 1269750
description:
2026-01-12 21:33:47 dovecot_login authenticator failed for H=([182.95.215.69]) [182.95.230.122]:46104: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.8.240.44
country_id: 2017370
description:
2026-01-12 21:33:48 dovecot_login authenticator failed for H=([46.8.240.44]) [46.8.240.44]:48924: 535 Incorrect authentication data (set_id=admin@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.152
country_id: 1269750
description:
2026-01-12 21:34:06 dovecot_login authenticator failed for H=(nsg-corporate-152.227.187.122.airtel.in) [122.187.227.152]:57779: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 12 21:35:20 host2 sshd[2063271]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.222.93.199
country_id: 6252001
description:
2026-01-12 21:42:30 dovecot_plain authenticator failed for H=c-98-222-93-199.hsd1.il.comcast.net (quingly) [98.222.93.199]:53846: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.220.169.113
country_id: 2635167
description:
2026-01-12 21:48:46 dovecot_login authenticator failed for H=(165-220-169-113.cust.exede.net) [165.220.169.113]:54661: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.179.134.120
country_id: 1269750
description:
2026-01-12 21:49:01 dovecot_login authenticator failed for H=(abts-mum-static-120.134.179.122.airtelbroadband.in) [122.179.134.120]:50109: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.164.177.6
country_id: 390903
description:
2026-01-12 21:49:20 dovecot_login authenticator failed for H=([95.164.177.6]) [95.164.177.6]:39700: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.183.110.215
country_id: 798544
description:
2026-01-12 21:51:54 dovecot_login authenticator failed for H=178.183.110.215.mobile.static.t-mobile.pl [178.183.110.215]:57650: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan 12 21:52:22 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@seyawin.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<Ig6BRzNITL9100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.23.72.189
country_id: 6252001
description:
2026-01-12 21:52:31 dovecot_login authenticator failed for H=([209.23.72.189]) [209.23.72.189]:43008: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.104.98
country_id: 3469034
description:
Jan 12 21:55:16 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=187.120.104.98, lip=66.85.158.91, TLS, session=<NWfAUDNIM5y7eGhi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.28.190.208
country_id: 2510769
description:
Jan 12 21:55:34 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<careers>, method=PLAIN, rip=139.28.190.208, lip=66.85.158.91, TLS, session=<qUQRUjNIoYOLHL7Q>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.186.193.149
country_id: 1643084
description:
2026-01-12 21:59:01 dovecot_login authenticator failed for H=([103.186.193.149]) [103.186.193.149]:43640: 535 Incorrect authentication data (set_id=admin@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.209.148.60
country_id: 2661886
description:
2026-01-12 21:59:18 dovecot_login authenticator failed for H=82-209-148-60.cust.bredband2.com [82.209.148.60]:52382: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 172.202.118.31
country_id: 6252001
description:
Jan 12 22:01:12 host2 pure-ftpd[2099015]: (?@172.202.118.31) [INFO] New connection from 172.202.118.31


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.112.146
country_id: 1269750
description:
2026-01-12 22:01:49 dovecot_login authenticator failed for H=([125.18.67.17]) [182.95.112.146]:42206: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.118.138
country_id: 3144096
description:
2026-01-12 22:02:07 dovecot_login authenticator failed for H=(cm-46.212.118.138.get.no) [46.212.118.138]:57247: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 106.51.75.252
country_id: 1269750
description:
Jan 12 22:03:00 host2 pure-ftpd[2100420]: (?@106.51.75.252) [INFO] New connection from 106.51.75.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.88.196.91
country_id: 6252001
description:
2026-01-12 22:05:09 dovecot_plain authenticator failed for H=c-73-88-196-91.hsd1.ky.comcast.net (forolch) [73.88.196.91]:44676: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.204.134.124
country_id: 6252001
description:
2026-01-12 22:07:56 dovecot_plain authenticator failed for H=c-98-204-134-124.hsd1.md.comcast.net (rossitensa) [98.204.134.124]:58404: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.79.29.108
country_id: 1831722
description:
Jan 12 22:10:59 host2 sshd[2107226]: Disconnected from invalid user ansible 202.79.29.108 port 51076 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 209.141.57.124
country_id: 6252001
description:
Jan 12 22:13:28 host2 sshd[2110127]: Disconnected from invalid user debian 209.141.57.124 port 60340 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 134.209.102.173
country_id: 1880251
description:
2026-01-12 22:15:30 dovecot_login authenticator failed for H=([134.209.102.173]) [134.209.102.173]:45442: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.104.24.6
country_id: 3923057
description:
2026-01-12 22:15:55 dovecot_login authenticator failed for H=(SCZ-190-104-24-00006.tigo.bo) [190.104.24.6]:42034: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 202.79.29.108
country_id: 1831722
description:
Jan 12 22:17:03 host2 sshd[2113814]: Disconnected from invalid user dockeruser 202.79.29.108 port 37574 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.46.148.180
country_id: 6252001
description:
2026-01-12 22:17:10 dovecot_plain authenticator failed for H=c-68-46-148-180.hsd1.mi.comcast.net (croan) [68.46.148.180]:36164: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.79.29.108
country_id: 1831722
description:
Jan 12 22:17:36 host2 sshd[2114321]: Disconnected from invalid user deployadmin 202.79.29.108 port 57354 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan 12 22:18:45 host2 sshd[2115392]: Disconnected from invalid user user 2.57.121.25 port 19292 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.182.125.210
country_id: 6252001
description:
2026-01-12 22:19:52 dovecot_plain authenticator failed for H=(imbandoic) [12.182.125.210]:37388: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 172.202.118.47
country_id: 6252001
description:
Jan 12 22:20:01 host2 pure-ftpd[2116882]: (?@172.202.118.47) [INFO] New connection from 172.202.118.47


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.80.250.102
country_id: 2264397
description:
2026-01-12 22:21:21 dovecot_login authenticator failed for H=bl15-250-102.dsl.telepac.pt [188.80.250.102]:51725: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.67.152.201
country_id: 1269750
description:
2026-01-12 22:21:50 dovecot_login authenticator failed for H=([103.67.152.201]) [103.67.152.201]:44468: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 12 22:22:48 host2 sshd[2119737]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 54.174.234.236
country_id: 6252001
description:
Jan 12 22:22:57 host2 pure-ftpd[2119880]: (?@54.174.234.236) [INFO] New connection from 54.174.234.236


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 74.94.234.151
country_id: 6252001
description:
Jan 12 22:23:59 host2 sshd[2120772]: Disconnected from invalid user c 74.94.234.151 port 49708 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 74.94.234.151
country_id: 6252001
description:
Jan 12 22:25:48 host2 sshd[2122678]: Disconnected from invalid user pzuser 74.94.234.151 port 45214 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.15.149.254
country_id: 3469034
description:
2026-01-12 22:25:12 dovecot_login authenticator failed for H=(201-15-149-254.pltce300.ipd.brasiltelecom.net.br) [201.15.149.254]:42777: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.218.57.50
country_id: 3996063
description:
2026-01-12 22:25:39 dovecot_login authenticator failed for H=(customer-187-218-57-50.uninet-ide.com.mx) [187.218.57.50]:53130: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 74.94.234.151
country_id: 6252001
description:
Jan 12 22:26:32 host2 sshd[2123381]: Disconnected from invalid user ftpuser1 74.94.234.151 port 56514 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.143.92.137
country_id: 2510769
description:
Jan 12 22:26:32 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=185.143.92.137, lip=66.85.158.91, TLS, session=<Hr/AwDNIl8m5j1yJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.208.42
country_id: 1269750
description:
2026-01-12 22:26:55 dovecot_login authenticator failed for H=([128.185.208.42]) [128.185.208.42]:58026: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.252.241
country_id: 3865483
description:
Jan 12 22:26:57 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 23 secs): user=<env_eng>, method=PLAIN, rip=179.0.252.241, lip=66.85.158.91, TLS, session=<+p/2wTNIA6izAPzx>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.196.184.78
country_id: 6252001
description:
2026-01-12 22:26:31 dovecot_login authenticator failed for H=([74.196.184.78]) [74.196.184.78]:53033: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 162.214.92.14
country_id: 6252001
description:
Jan 12 22:27:50 host2 sshd[2124643]: Disconnected from invalid user gitlab-runner 162.214.92.14 port 47168 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.214.92.14
country_id: 6252001
description:
Jan 12 22:27:15 host2 sshd[2124045]: Disconnected from invalid user sftp 162.214.92.14 port 36080 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 74.94.234.151
country_id: 6252001
description:
Jan 12 22:27:16 host2 sshd[2124043]: Disconnected from invalid user dockeruser 74.94.234.151 port 39580 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 135.125.234.73
country_id: 3017382
description:
Jan 12 22:27:31 host2 sshd[2124383]: Disconnected from invalid user ftpuser1 135.125.234.73 port 59142 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.182
country_id: 6252001
description:
Jan 12 22:28:20 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.197.182, lip=66.85.158.91, TLS: Connection closed, session=<xb1EyDNIMiZAPsW2>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.61.187.220
country_id: 6252001
description:
Jan 12 22:28:24 host2 sshd[2125105]: Disconnected from invalid user socksuser 45.61.187.220 port 60020 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.232.73.57
country_id: 2921044
description:
Jan 12 22:28:53 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=165.232.73.57, lip=66.85.158.92, session=<FcUxyjNIR0Kl6Ek5>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.226.100.58
country_id: 2921044
description:
Jan 12 22:28:53 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.226.100.58, lip=66.85.158.92, session=<CFI3yjNIhi1A4mQ6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.53.34.211
country_id: 2921044
description:
Jan 12 22:29:02 host2 sshd[2125623]: Disconnected from invalid user sftp 152.53.34.211 port 56390 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.189
country_id: 6252001
description:
Jan 12 22:28:10 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=64.62.197.189, lip=66.85.158.91, session=<6f6gxzNIt7xAPsW9>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.61.187.220
country_id: 6252001
description:
Jan 12 22:29:31 host2 sshd[2126139]: Disconnected from invalid user webtest 45.61.187.220 port 52888 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.53.34.211
country_id: 2921044
description:
Jan 12 22:29:32 host2 sshd[2126151]: Disconnected from invalid user newuser 152.53.34.211 port 34962 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.53.34.211
country_id: 2921044
description:
Jan 12 22:30:32 host2 sshd[2127350]: Disconnected from invalid user proxyuser 152.53.34.211 port 35876 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 131.100.242.102
country_id: 3469034
description:
Jan 12 22:31:11 host2 sshd[2127913]: Disconnected from invalid user upload 131.100.242.102 port 51382 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 135.125.234.73
country_id: 3017382
description:
Jan 12 22:31:23 host2 sshd[2128089]: Disconnected from invalid user app 135.125.234.73 port 60286 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 12 22:32:11 host2 sshd[2128957]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.222.62
country_id: 1269750
description:
2026-01-12 22:34:32 dovecot_plain authenticator failed for H=(insed) [125.19.222.62]:60840: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.38
country_id: 6252001
description:
Jan 12 22:34:57 host2 pure-ftpd[2131430]: (?@205.210.31.38) [INFO] New connection from 205.210.31.38


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 131.100.242.102
country_id: 3469034
description:
Jan 12 22:35:30 host2 sshd[2132467]: Disconnected from invalid user max 131.100.242.102 port 52210 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 131.100.242.102
country_id: 3469034
description:
Jan 12 22:36:11 host2 sshd[2133085]: Disconnected from invalid user oracle 131.100.242.102 port 54628 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.216.209.74
country_id: 933860
description:
Jan 12 22:42:02 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<env_eng>, method=PLAIN, rip=41.216.209.74, lip=66.85.158.91, TLS, session=<FZIT+DNIPO4p2NFK>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 186.86.52.137
country_id: 3686110
description:
Jan 12 22:41:20 host2 sshd[2137381]: Disconnected from invalid user sshtest 186.86.52.137 port 9303 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.229.252.185
country_id: 3865483
description:
Jan 12 22:41:40 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=200.229.252.185, lip=66.85.158.91, TLS, session=<Anu69jNITKLI5fy5>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.233
country_id: 2635167
description:
Jan 12 22:46:00 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 46 secs): user=<>, rip=35.203.210.233, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<KI5tBzRIdM0jy9Lp>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.233
country_id: 2635167
description:
Jan 12 22:46:33 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 18 secs): user=<>, rip=35.203.210.233, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=</mRkCTRIVOgjy9Lp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.90.94
country_id: 1269750
description:
2026-01-12 22:47:43 dovecot_login authenticator failed for H=([182.95.85.106]) [27.123.90.94]:47918: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.215.199.37
country_id: 1819730
description:
2026-01-12 22:47:27 dovecot_login authenticator failed for H=([125.215.199.37]) [125.215.199.37]:53475: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 12 22:50:04 host2 sshd[2146138]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.149.165.107
country_id: 6252001
description:
2026-01-12 22:51:31 dovecot_login authenticator failed for H=c-76-149-165-107.hsd1.ut.comcast.net [76.149.165.107]:60649: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.214
country_id: 1269750
description:
2026-01-12 22:52:12 dovecot_login authenticator failed for H=([182.95.181.214]) [182.95.181.214]:56496: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 52.157.243.170
country_id: 2750405
description:
2026-01-12 22:52:33 dovecot_login authenticator failed for H=(ADMIN) [52.157.243.170]:56950: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.116
country_id: 1269750
description:
2026-01-12 22:53:20 dovecot_login authenticator failed for H=(nsg-corporate-116.230.187.122.airtel.in) [122.187.230.116]:45151: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.233
country_id: 2635167
description:
Jan 12 22:53:55 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.203.210.233, lip=66.85.158.91, TLS, session=<JTTGIzRIUvwjy9Lp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.153.30.124
country_id: 357994
description:
Jan 12 22:59:40 host2 sshd[2154505]: Disconnected from invalid user user 41.153.30.124 port 55012 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 216.10.242.215
country_id: 1269750
description:
Jan 12 23:01:07 host2 sshd[2155733]: Disconnected from invalid user luis 216.10.242.215 port 44466 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 216.10.242.215
country_id: 1269750
description:
Jan 12 23:01:43 host2 sshd[2156248]: Disconnected from invalid user user 216.10.242.215 port 35108 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.153.30.124
country_id: 357994
description:
Jan 12 23:01:57 host2 sshd[2156523]: Disconnected from invalid user tunneluser 41.153.30.124 port 43684 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.222.202
country_id: 1269750
description:
2026-01-12 23:03:04 dovecot_login authenticator failed for H=([128.185.247.100]) [182.95.222.202]:42886: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.27.76.210
country_id: 3469034
description:
2026-01-12 23:02:33 dovecot_login authenticator failed for H=(ip-177-27-76-210.user.vivozap.com.br) [177.27.76.210]:37837: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.175
country_id: 6252001
description:
Jan 12 23:04:19 host2 pure-ftpd[2158563]: (?@198.235.24.175) [INFO] New connection from 198.235.24.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.183.106.192
country_id: 6252001
description:
2026-01-12 23:06:02 dovecot_login authenticator failed for H=([75.183.106.192]) [75.183.106.192]:47125: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 190.181.44.194
country_id: 3923057
description:
Jan 12 23:06:17 host2 sshd[2160332]: Disconnected from invalid user ftp-user 190.181.44.194 port 52978 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.3.222.78
country_id: 798544
description:
Jan 12 23:06:23 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=195.3.222.78, lip=66.85.158.91, session=<1qRXUDRImOLDA95O>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.153.30.124
country_id: 357994
description:
Jan 12 23:06:31 host2 sshd[2160502]: Disconnected from invalid user dockertest 41.153.30.124 port 49642 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.104.142
country_id: 1269750
description:
2026-01-12 23:06:53 dovecot_login authenticator failed for H=([27.123.104.142]) [27.123.104.142]:51286: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.181.44.194
country_id: 3923057
description:
Jan 12 23:07:34 host2 sshd[2161453]: Disconnected from invalid user odoo 190.181.44.194 port 42012 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 12 23:09:16 host2 sshd[2162775]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.123.173
country_id: 1819730
description:
Jan 12 23:23:37 host2 sshd[2174761]: Disconnected from invalid user admin 101.36.123.173 port 39538 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.83.180.221
country_id: 2750405
description:
Jan 12 23:24:08 host2 sshd[2175180]: Disconnected from invalid user ubuntu 83.83.180.221 port 35292 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 57.128.182.5
country_id: 2635167
description:
Jan 12 23:24:11 host2 sshd[2175214]: Disconnected from invalid user ubuntu 57.128.182.5 port 55384 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.83.180.221
country_id: 2750405
description:
Jan 12 23:24:41 host2 sshd[2175581]: Disconnected from invalid user admin 83.83.180.221 port 44064 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.213.163.226
country_id: 1880251
description:
Jan 12 23:24:42 host2 sshd[2175606]: Disconnected from invalid user admin 35.213.163.226 port 45460 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.132.53.75
country_id: 3932488
description:
Jan 12 23:24:49 host2 sshd[2175675]: Disconnected from invalid user admin 161.132.53.75 port 59694 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 57.128.182.5
country_id: 2635167
description:
Jan 12 23:25:05 host2 sshd[2175988]: Disconnected from invalid user ubuntu 57.128.182.5 port 60606 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.41.104.237
country_id: 3175395
description:
2026-01-12 23:26:04 dovecot_login authenticator failed for H=host-79-41-104-237.retail.telecomitalia.it ([127.0.0.1]) [79.41.104.237]:58682: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 129.45.84.119
country_id: 2589581
description:
2026-01-12 23:26:21 dovecot_login authenticator failed for H=([127.0.0.1]) [129.45.84.119]:43542: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 57.128.182.5
country_id: 2635167
description:
Jan 12 23:26:47 host2 sshd[2177576]: Disconnected from invalid user admin 57.128.182.5 port 43730 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.132.53.75
country_id: 3932488
description:
Jan 12 23:28:30 host2 sshd[2179296]: Disconnected from invalid user ubuntu 161.132.53.75 port 55812 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 35.213.163.226
country_id: 1880251
description:
Jan 12 23:28:16 host2 sshd[2179091]: Disconnected from invalid user ubuntu 35.213.163.226 port 54944 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.160.255.115
country_id: 1880251
description:
Jan 12 23:28:17 host2 sshd[2179113]: Disconnected from invalid user admin 43.160.255.115 port 60350 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.184.82
country_id: 1269750
description:
2026-01-12 23:29:52 dovecot_login authenticator failed for H=([182.95.184.82]) [182.95.184.82]:47846: 535 Incorrect authentication data (set_id=abuse)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.165.78.31
country_id: 1819730
description:
2026-01-12 23:29:24 dovecot_login authenticator failed for H=([69.165.78.31]) [69.165.78.31]:38362: 535 Incorrect authentication data (set_id=abuse@simple-engineering.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 196.189.155.89
country_id: 337996
description:
Jan 12 23:29:36 host2 sshd[2180132]: Disconnected from invalid user admin 196.189.155.89 port 38964 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 161.132.53.75
country_id: 3932488
description:
Jan 12 23:30:52 host2 sshd[2181705]: Disconnected from invalid user admin 161.132.53.75 port 45958 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan 12 23:30:08 host2 sshd[2180947]: Disconnected from invalid user admin 2.57.121.112 port 61451 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.189.155.89
country_id: 337996
description:
Jan 12 23:30:48 host2 sshd[2181596]: Disconnected from invalid user ubuntu 196.189.155.89 port 57152 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 12 23:33:58 host2 sshd[2184195]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.128.209.48
country_id: 3469034
description:
2026-01-12 23:36:16 dovecot_login authenticator failed for H=(138.219.244.10.static.softdados.net) [177.128.209.48]:51720: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.186.114.73
country_id: 1168579
description:
2026-01-12 23:36:31 dovecot_login authenticator failed for H=([103.186.114.73]) [103.186.114.73]:34335: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 118.193.37.10
country_id: 1819730
description:
Jan 12 23:39:00 host2 pure-ftpd[2188812]: (?@118.193.37.10) [INFO] New connection from 118.193.37.10


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.232.119.77
country_id: 2921044
description:
Jan 12 23:39:17 host2 pure-ftpd[2189095]: (?@165.232.119.77) [INFO] New connection from 165.232.119.77


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 177.153.62.49
country_id: 3469034
description:
Jan 12 23:39:18 host2 pure-ftpd[2189117]: (?@177.153.62.49) [INFO] New connection from 177.153.62.49


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.221.178
country_id: 1269750
description:
2026-01-12 23:41:58 dovecot_plain authenticator failed for H=(inske) [125.19.221.178]:57672: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.154.40.42
country_id: 1819730
description:
Jan 12 23:48:08 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=165.154.40.42, lip=66.85.158.92, session=<ZzOp5TRIzNilmigq>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 165.154.40.42
country_id: 1819730
description:
Jan 12 23:48:09 host2 dovecot[3239883]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=165.154.40.42, lip=66.85.158.92, TLS, session=<Rp235TRImtmlmigq>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 89.249.55.106
country_id: 2017370
description:
[2026-01-12 23:49:06 +0530] info [cpaneld] 89.249.55.106 - melanifi "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user melanifi (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-12 23:51:56 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (reaut) [87.103.126.54]:16738: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 86.111.91.69
country_id: 690791
description:
2026-01-12 23:52:01 dovecot_login authenticator failed for H=host-86-111-91-69.566f.la.net.ua [86.111.91.69]:52248: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.98.174
country_id: 1269750
description:
2026-01-12 23:52:41 dovecot_login authenticator failed for H=(nsg-corporate-217.166.185.122.airtel.in) [27.123.98.174]:34406: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.102.242
country_id: 290557
description:
2026-01-12 23:53:49 dovecot_plain authenticator failed for H=(hipostra) [80.227.102.242]:33612: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.65.140.218
country_id: 3017382
description:
2026-01-12 23:57:32 dovecot_login authenticator failed for H=82-65-140-218.subs.proxad.net [82.65.140.218]:52718: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.57
country_id: 6252001
description:
Jan 12 23:57:40 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.57, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<uIG5BzVINcbG6xg5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.228.146
country_id: 1269750
description:
2026-01-12 23:57:47 dovecot_login authenticator failed for H=([125.20.228.146]) [125.20.228.146]:37392: 535 Incorrect authentication data (set_id=postmaster@systemtec.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.170.99.195
country_id: 1269750
description:
2026-01-12 23:57:56 dovecot_login authenticator failed for H=(abts-mum-static-195.99.170.122.airtelbroadband.in) [122.170.99.195]:47446: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.182.130
country_id: 1269750
description:
2026-01-12 23:57:15 dovecot_login authenticator failed for H=(mail1.i-megh.com) [182.95.182.130]:39256: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.42.225.40
country_id: 2510769
description:
2026-01-12 23:58:17 dovecot_login authenticator failed for H=40.red-81-42-225.staticip.rima-tde.net [81.42.225.40]:60236: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.231.6
country_id: 1269750
description:
2026-01-13 00:00:07 dovecot_login authenticator failed for H=([128.185.231.6]) [128.185.231.6]:47242: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 195.158.9.235
country_id: 1512440
description:
Jan 13 00:00:13 host2 pure-ftpd[2211722]: (?@195.158.9.235) [INFO] New connection from 195.158.9.235


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 223.197.186.7
country_id: 1819730
description:
Jan 13 00:02:35 host2 sshd[2213965]: Disconnected from invalid user botuser 223.197.186.7 port 55427 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.83.15.101
country_id: 1819730
description:
Jan 13 00:04:05 host2 sshd[2215321]: Disconnected from invalid user dockertest 154.83.15.101 port 60544 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 223.197.186.7
country_id: 1819730
description:
Jan 13 00:03:13 host2 sshd[2214586]: Disconnected from invalid user testing 223.197.186.7 port 28845 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.194.231.208
country_id: 1861060
description:
Jan 13 00:05:11 host2 sshd[2216508]: Disconnected from invalid user pzuser 118.194.231.208 port 50530 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 118.194.231.208
country_id: 1861060
description:
Jan 13 00:06:22 host2 sshd[2217555]: Disconnected from invalid user ftp-admin 118.194.231.208 port 50686 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 211.24.41.44
country_id: 1733045
description:
Jan 13 00:06:35 host2 sshd[2217750]: Disconnected from invalid user ftpuser 211.24.41.44 port 50736 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.231.25.64
country_id: 3686110
description:
2026-01-13 00:08:33 dovecot_login authenticator failed for H=(1522312565.colombiatel.co) [152.231.25.64]:37917: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.113.10
country_id: 1269750
description:
2026-01-13 00:08:13 dovecot_login authenticator failed for H=(abts-north-dynamic-121.212.66.182.airtelbroadband.in) [27.123.113.10]:34516: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 146.59.17.183
country_id: 3017382
description:
Jan 13 00:08:17 host2 pure-ftpd[2219458]: (?@146.59.17.183) [INFO] New connection from 146.59.17.183


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.184.218.49
country_id: 3469034
description:
2026-01-13 00:09:25 dovecot_login authenticator failed for H=([179.184.218.49]) [179.184.218.49]:35136: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.207.250.1
country_id: 3469034
description:
2026-01-13 00:09:35 dovecot_login authenticator failed for H=(ticons.static.gvt.net.br) [177.207.250.1]:39188: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 208.109.34.86
country_id: 6252001
description:
Jan 13 00:16:02 host2 pure-ftpd[2227413]: (?@208.109.34.86) [INFO] New connection from 208.109.34.86


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 13 00:17:05 host2 sshd[2228307]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.195.19.75
country_id: 1269750
description:
2026-01-13 00:16:52 dovecot_login authenticator failed for H=([47.247.80.227]) [14.195.19.75]:58664: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.147.248.44
country_id: 1269750
description:
2026-01-13 00:17:20 dovecot_login authenticator failed for H=([103.147.248.44]) [103.147.248.44]:34322: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.170.59
country_id: 99237
description:
2026-01-13 00:18:56 dovecot_login authenticator failed for H=([65.20.170.59]) [65.20.170.59]:37418: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.166.253.226
country_id: 1269750
description:
2026-01-13 00:18:30 dovecot_login authenticator failed for H=(abts-kk-static-226.253.166.122.airtelbroadband.in) [122.166.253.226]:39690: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 50.28.105.119
country_id: 6252001
description:
Jan 13 00:18:48 host2 pure-ftpd[2229810]: (?@50.28.105.119) [INFO] New connection from 50.28.105.119


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 15.204.140.61
country_id: 6252001
description:
Jan 13 00:24:23 host2 pure-ftpd[2235803]: (?@15.204.140.61) [INFO] New connection from 15.204.140.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.160.114.72
country_id: 1210997
description:
2026-01-13 00:26:45 dovecot_login authenticator failed for H=([182.160.114.72]) [182.160.114.72]:45352: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.164.148.87
country_id: 1512440
description:
2026-01-13 00:26:56 dovecot_login authenticator failed for H=([62.164.148.87]) [62.164.148.87]:52716: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 159.203.59.222
country_id: 6251999
description:
Jan 13 00:26:15 host2 pure-ftpd[2237629]: (?@159.203.59.222) [INFO] New connection from 159.203.59.222


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.218.18
country_id: 1269750
description:
2026-01-13 00:29:34 dovecot_login authenticator failed for H=([128.185.217.27]) [128.185.218.18]:49198: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.6.121.246
country_id: 3469034
description:
2026-01-13 00:29:48 dovecot_login authenticator failed for H=([191.217.23.65]) [187.6.121.246]:48643: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.57.94
country_id: 953987
description:
Jan 13 00:30:34 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<careers>, method=PLAIN, rip=102.129.57.94, lip=66.85.158.91, TLS, session=<JXhMfDVIc+ZmgTle>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.168.192
country_id: 3175395
description:
Jan 13 00:30:13 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=185.15.168.192, lip=66.85.158.91, TLS, session=<d7UrezVImd25D6jA>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.224.26
country_id: 1269750
description:
2026-01-13 00:30:32 dovecot_login authenticator failed for H=([152.52.224.26]) [152.52.224.26]:46324: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 64.23.194.146
country_id: 6252001
description:
Jan 13 00:32:45 host2 pure-ftpd[2243924]: (?@64.23.194.146) [INFO] New connection from 64.23.194.146


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 13 00:34:51 host2 sshd[2246019]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.162
country_id: 2993457
description:
Jan 13 00:35:17 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=194.165.16.162, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<s609jjVIZP/CpRCi>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.251.249.79
country_id: 2300660
description:
2026-01-13 00:35:43 dovecot_login authenticator failed for H=([197.251.249.79]) [197.251.249.79]:44475: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.29.104.32
country_id: 6252001
description:
2026-01-13 00:35:56 dovecot_login authenticator failed for H=32.104.29.34.bc.googleusercontent.com [34.29.104.32]:41048: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.226.118
country_id: 1269750
description:
2026-01-13 00:36:54 dovecot_login authenticator failed for H=([27.123.119.219]) [182.95.226.118]:40334: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.211.220.203
country_id: 2661886
description:
2026-01-13 00:37:11 dovecot_login authenticator failed for H=31-211-220-203.customers.ownit.se [31.211.220.203]:48693: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan 13 00:37:18 host2 sshd[2248433]: Disconnected from invalid user user 2.57.121.25 port 14713 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.195.15.194
country_id: 3469034
description:
2026-01-13 00:39:41 dovecot_login authenticator failed for H=([200.195.15.194]) [200.195.15.194]:51511: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 183.81.170.93
country_id: 2029969
description:
Jan 13 00:39:58 host2 pure-ftpd[2251102]: (?@183.81.170.93) [INFO] New connection from 183.81.170.93


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 13 00:41:12 host2 sshd[2252342]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan 13 00:40:21 host2 sshd[2251604]: Disconnected from invalid user admin 2.57.121.112 port 19497 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan 13 00:42:35 host2 sshd[2253511]: Disconnected from invalid user admin 2.57.121.112 port 39895 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.209.44.9
country_id: 2661886
description:
2026-01-13 00:47:28 dovecot_login authenticator failed for H=217-209-44-9-no600.tbcn.telia.com [217.209.44.9]:36600: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.95.24.117
country_id: 2464461
description:
2026-01-13 00:47:40 dovecot_login authenticator failed for H=([193.95.21.147]) [193.95.24.117]:50916: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 132.220.107.88
country_id: 2750405
description:
Jan 13 00:48:16 host2 pure-ftpd[2259754]: (?@132.220.107.88) [INFO] New connection from 132.220.107.88


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.208.81.125
country_id: 6252001
description:
2026-01-13 00:49:17 dovecot_plain authenticator failed for H=c-73-208-81-125.hsd1.in.comcast.net (unring) [73.208.81.125]:44012: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.183.74.177
country_id: 6252001
description:
2026-01-13 00:49:20 dovecot_plain authenticator failed for H=c-73-183-74-177.hsd1.pa.comcast.net (diosts) [73.183.74.177]:43032: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.125.248.125
country_id: 798544
description:
Jan 13 00:52:50 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=109.125.248.125, lip=66.85.158.91, TLS, session=<NikQzDVIvKJtffh9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.72.163
country_id: 3469034
description:
Jan 13 00:53:10 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<env_eng>, method=PLAIN, rip=187.120.72.163, lip=66.85.158.91, TLS, session=<ifUrzTVIK7C7eEij>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 138.197.113.120
country_id: 6252001
description:
Jan 13 00:54:49 host2 pure-ftpd[2267001]: (?@138.197.113.120) [INFO] New connection from 138.197.113.120


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.202.197.108
country_id: 6252001
description:
2026-01-13 00:57:28 dovecot_plain authenticator failed for H=(arachna) [50.202.197.108]:51735: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 40.76.167.156
country_id: 6252001
description:
Jan 13 00:57:35 host2 pure-ftpd[2269991]: (?@40.76.167.156) [INFO] New connection from 40.76.167.156


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.154.41.50
country_id: 1819730
description:
Jan 13 00:59:09 host2 pure-ftpd[2271372]: (?@165.154.41.50) [INFO] New connection from 165.154.41.50


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 13 01:00:11 host2 sshd[2272526]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan 13 00:59:56 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@seyawin.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<N3hG5jVIIrR100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.224.169.28
country_id: 6252001
description:
2026-01-13 01:02:29 dovecot_plain authenticator failed for H=c-71-224-169-28.hsd1.pa.comcast.net (taeon) [71.224.169.28]:33888: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 54.36.172.109
country_id: 3017382
description:
Jan 13 01:03:56 host2 pure-ftpd[2276445]: (?@54.36.172.109) [INFO] New connection from 54.36.172.109


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 103.174.102.191
country_id: 1269750
description:
Jan 13 01:04:47 host2 pure-ftpd[2277268]: (?@103.174.102.191) [INFO] New connection from 103.174.102.191


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 57.128.188.106
country_id: 3017382
description:
Jan 13 01:05:53 host2 pure-ftpd[2278671]: (?@57.128.188.106) [INFO] New connection from 57.128.188.106


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 68.183.90.246
country_id: 1269750
description:
Jan 13 01:10:44 host2 pure-ftpd[2283603]: (?@68.183.90.246) [INFO] New connection from 68.183.90.246


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 79.137.79.129
country_id: 3017382
description:
Jan 13 01:14:26 host2 pure-ftpd[2287338]: (?@79.137.79.129) [INFO] New connection from 79.137.79.129


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 45.156.128.177
country_id: 2264397
description:
Jan 13 01:17:56 host2 pure-ftpd[2290774]: (?@45.156.128.177) [INFO] New connection from 45.156.128.177


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.20.69
country_id: 6252001
description:
Jan 13 01:20:16 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.20.69, lip=66.85.158.92, session=<a5wdLzZIPvtBMRRF>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.24
country_id: 6252001
description:
Jan 13 01:21:09 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.24, lip=66.85.158.92, TLS handshaking: Connection closed, session=<+qdRMjZIYRRAPpwY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.24
country_id: 6252001
description:
Jan 13 01:21:27 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.24, lip=66.85.158.92, TLS handshaking: Connection closed, session=<nl9eMzZIGA5APpwY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.201.62
country_id: 1269750
description:
2026-01-13 01:23:09 dovecot_login authenticator failed for H=(nsg-corporate-226.215.186.122.airtel.in) [122.186.201.62]:42410: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.144.27.228
country_id: 6252001
description:
2026-01-13 01:22:16 dovecot_plain authenticator failed for H=c-73-144-27-228.hsd1.mi.comcast.net (noict) [73.144.27.228]:56358: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.49.97.15
country_id: 6252001
description:
2026-01-13 01:22:17 dovecot_login authenticator failed for H=(64-49-97-15.protekweb.com) [64.49.97.15]:42696: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.60.77.128
country_id: 6252001
description:
2026-01-13 01:27:02 dovecot_plain authenticator failed for H=c-68-60-77-128.hsd1.mi.comcast.net (suanitoxy) [68.60.77.128]:37136: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.201
country_id: 6252001
description:
Jan 13 01:27:00 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.235.24.201, lip=66.85.158.91, TLS, session=<DMw8RzZImPXG6xjJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.226.92.143
country_id: 2921044
description:
Jan 13 01:27:36 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=64.226.92.143, lip=66.85.158.92, TLS, session=</dVXSTZIgkpA4lyP>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.229
country_id: 6252001
description:
Jan 13 01:35:55 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 3 secs): user=<>, rip=205.210.31.229, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<GV4TZzZIOMPN0h/l>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.22
country_id: 1269750
description:
2026-01-13 01:35:59 dovecot_login authenticator failed for H=([182.95.181.22]) [182.95.181.22]:43054: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.174.182.38
country_id: 2077456
description:
2026-01-13 01:36:28 dovecot_login authenticator failed for H=203-174-182-38.ade.static-ipl.aapt.com.au [203.174.182.38]:38945: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.247
country_id: 1733045
description:
2026-01-13 01:37:11 dovecot_login authenticator failed for H=([49.124.152.247]) [49.124.152.247]:39678: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.215.245.175
country_id: 3469034
description:
2026-01-13 01:37:38 dovecot_login authenticator failed for H=([189.59.210.1]) [186.215.245.175]:48947: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.195.66
country_id: 1269750
description:
2026-01-13 01:38:04 dovecot_login authenticator failed for H=([128.185.169.25]) [125.19.195.66]:43308: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.74
country_id: 6252001
description:
Jan 13 01:38:35 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=205.210.31.74, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<sl6ocDZIR87N0h9K>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.227.134.232
country_id: 2921044
description:
Jan 13 01:43:27 host2 pure-ftpd[2315894]: (?@165.227.134.232) [INFO] New connection from 165.227.134.232


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.79.195
country_id: 337996
description:
2026-01-13 01:46:12 dovecot_login authenticator failed for H=([213.55.79.199]) [213.55.79.195]:44742: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.82.55.80
country_id: 3469034
description:
Jan 13 01:46:20 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=170.82.55.80, lip=66.85.158.91, TLS, session=<j6RRizZIg6OqUjdQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.68.52.210
country_id: 1269750
description:
2026-01-13 01:46:34 dovecot_login authenticator failed for H=([103.68.52.210]) [103.68.52.210]:60704: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.72.97
country_id: 3469034
description:
Jan 13 01:46:42 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<careers>, method=PLAIN, rip=187.120.72.97, lip=66.85.158.91, TLS, session=<wnCMjDZIAIa7eEhh>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 38.242.212.239
country_id: 3017382
description:
Jan 13 01:47:18 host2 pure-ftpd[2320206]: (?@38.242.212.239) [INFO] New connection from 38.242.212.239


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.0.38.130
country_id: 1210997
description:
2026-01-13 01:48:23 dovecot_login authenticator failed for H=([49.0.38.130]) [49.0.38.130]:44924: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.196.144.25
country_id: 6252001
description:
2026-01-13 01:48:33 dovecot_plain authenticator failed for H=c-73-196-144-25.hsd1.nj.comcast.net (ilgatele) [73.196.144.25]:50880: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.128.209.48
country_id: 3469034
description:
2026-01-13 01:49:04 dovecot_login authenticator failed for H=(138.219.244.10.static.softdados.net) [177.128.209.48]:36320: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan 13 01:49:42 host2 sshd[2322296]: Disconnected from invalid user user 2.57.121.25 port 39074 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 91.230.168.95
country_id: 6252001
description:
Jan 13 01:50:04 host2 pure-ftpd[2322782]: (?@91.230.168.95) [INFO] New connection from 91.230.168.95


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 91.230.168.90
country_id: 6252001
description:
Jan 13 01:50:03 host2 pure-ftpd[2322777]: (?@91.230.168.90) [INFO] New connection from 91.230.168.90


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.50.226.182
country_id: 3469034
description:
2026-01-13 01:50:07 dovecot_login authenticator failed for H=(187-50-226-182.customer.tdatabrasil.net.br) [187.50.226.182]:56750: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 66.29.149.46
country_id: 6252001
description:
Jan 13 01:50:30 host2 sshd[2323240]: Disconnected from invalid user ubuntu 66.29.149.46 port 49356 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.40.101.10
country_id: 6252001
description:
2026-01-13 01:50:42 dovecot_plain authenticator failed for H=c-98-40-101-10.hsd1.tn.comcast.net (slaruggia) [98.40.101.10]:51868: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 44.220.185.18
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 44.220.185.18: 250 connections per 30 seconds to 8443 port.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.191.8.27
country_id: 3017382
description:
2026-01-13 01:50:23 dovecot_login authenticator failed for H=([176.191.8.27]) [176.191.8.27]:47896: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 66.29.149.46
country_id: 6252001
description:
Jan 13 01:52:27 host2 sshd[2325139]: Received disconnect from 66.29.149.46 port 59174:11: Bye Bye [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 66.29.149.46
country_id: 6252001
description:
Jan 13 01:52:27 host2 sshd[2325139]: Disconnected from invalid user ubuntu 66.29.149.46 port 59174 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 66.29.149.46
country_id: 6252001
description:
Jan 13 01:53:25 host2 sshd[2325973]: Disconnected from invalid user admin 66.29.149.46 port 41074 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.156.94.19
country_id: 1861060
description:
2026-01-13 01:54:59 dovecot_login authenticator failed for H=19.94.156.220.rev.iijmobile.jp ([127.0.0.1]) [220.156.94.19]:35258: 535 Incorrect authentication data (set_id=chitral00@bostonlanka.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 106.51.75.252
country_id: 1269750
description:
Jan 13 01:55:00 host2 pure-ftpd[2327738]: (?@106.51.75.252) [INFO] New connection from 106.51.75.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.229.157.48
country_id: 1605651
description:
2026-01-13 01:55:12 dovecot_login authenticator failed for H=([127.0.0.1]) [49.229.157.48]:48726: 535 Incorrect authentication data (set_id=chitral00)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.111.136.21
country_id: 294640
description:
2026-01-13 01:54:18 dovecot_login authenticator failed for H=([84.111.136.21]) [84.111.136.21]:43067: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.143.17.18
country_id: 6252001
description:
2026-01-13 01:54:59 dovecot_login authenticator failed for H=47-143-17-18.fdr02.elsn.ca.frontiernet.net [47.143.17.18]:22656: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 158.94.210.79
country_id: 2750405
description:
[2025-12-26 17:26:14 +0530] info [whostmgrd] 158.94.210.79 - RE_Trinco "GET /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan 13 01:56:42 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<2MxSsTZIe7t100Db>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 210.79.142.221
country_id: 1643084
description:
Jan 13 01:57:27 host2 sshd[2330343]: Disconnected from invalid user admin 210.79.142.221 port 51288 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 210.79.142.221
country_id: 1643084
description:
Jan 13 01:58:30 host2 sshd[2331308]: Disconnected from invalid user admin 210.79.142.221 port 53004 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 13 02:01:41 host2 sshd[2334503]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 68.183.90.246
country_id: 1269750
description:
Jan 13 02:02:42 host2 pure-ftpd[2335554]: (?@68.183.90.246) [INFO] New connection from 68.183.90.246


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.33.34
country_id: 1269750
description:
Jan 13 02:04:11 host2 sshd[2337065]: Disconnected from invalid user admin 139.59.33.34 port 34210 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.33.34
country_id: 1269750
description:
Jan 13 02:04:46 host2 sshd[2337621]: Disconnected from invalid user admin 139.59.33.34 port 35202 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 162.240.173.20
country_id: 6252001
description:
Jan 13 02:04:59 host2 pure-ftpd[2337865]: (?@162.240.173.20) [INFO] New connection from 162.240.173.20


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 139.59.33.34
country_id: 1269750
description:
Jan 13 02:05:20 host2 sshd[2338470]: Disconnected from invalid user ubuntu 139.59.33.34 port 37146 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.33.34
country_id: 1269750
description:
Jan 13 02:06:56 host2 sshd[2340194]: Disconnected from invalid user admin 139.59.33.34 port 35920 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 142.79.227.70
country_id: 1269750
description:
Jan 13 02:14:41 host2 pure-ftpd[2347751]: (?@142.79.227.70) [INFO] New connection from 142.79.227.70


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.214.78
country_id: 1269750
description:
2026-01-13 02:18:24 dovecot_login authenticator failed for H=([128.185.39.145]) [128.185.214.78]:44388: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.171.4.138
country_id: 1733045
description:
2026-01-13 02:18:10 dovecot_login authenticator failed for H=([183.171.4.138]) [183.171.4.138]:49966: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 13 02:19:20 host2 sshd[2352331]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.230.122
country_id: 1269750
description:
2026-01-13 02:20:45 dovecot_login authenticator failed for H=([182.95.230.122]) [182.95.230.122]:37458: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.213.230.122
country_id: 6252001
description:
2026-01-13 02:20:52 dovecot_login authenticator failed for H=([67.213.230.122]) [67.213.230.122]:55993: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.122.247
country_id: 3144096
description:
2026-01-13 02:20:55 dovecot_login authenticator failed for H=(cm-178.232.122.247.get.no) [178.232.122.247]:39461: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.61.176.110
country_id: 3469034
description:
2026-01-13 02:20:31 dovecot_login authenticator failed for H=([187.50.122.20]) [177.61.176.110]:34771: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 181.215.193.122
country_id: 298795
description:
Jan 13 02:23:05 host2 pure-ftpd[2356192]: (?@181.215.193.122) [INFO] New connection from 181.215.193.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.69.161.7
country_id: 6252001
description:
2026-01-13 02:24:56 dovecot_login authenticator failed for H=([208.69.161.7]) [208.69.161.7]:49935: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.170.251.33
country_id: 2017370
description:
2026-01-13 02:24:44 dovecot_login authenticator failed for H=(178.170.251.33.leadertelecom.ru) [178.170.251.33]:56134: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.39.127
country_id: 1819730
description:
Jan 13 02:25:45 host2 sshd[2358952]: Disconnected from invalid user user01 118.193.39.127 port 60140 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 106.51.1.63
country_id: 1269750
description:
Jan 13 02:26:00 host2 sshd[2359137]: Disconnected from invalid user c 106.51.1.63 port 44682 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.166.254.166
country_id: 1269750
description:
Jan 13 02:26:13 host2 sshd[2359345]: Disconnected from invalid user testsftp 122.166.254.166 port 60238 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 106.51.1.63
country_id: 1269750
description:
Jan 13 02:26:36 host2 sshd[2359670]: Disconnected from invalid user bot2 106.51.1.63 port 57614 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 136.119.213.208
country_id: 6252001
description:
Jan 13 02:26:48 host2 sshd[2359836]: Disconnected from invalid user testuser 136.119.213.208 port 42466 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.89.148.218
country_id: 6252001
description:
Jan 13 02:27:07 host2 sshd[2360088]: Disconnected from invalid user vpsuser 159.89.148.218 port 58070 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.130.227.106
country_id: 1512440
description:
Jan 13 02:26:09 host2 sshd[2359287]: Disconnected from invalid user devel 95.130.227.106 port 53878 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 106.51.1.63
country_id: 1269750
description:
Jan 13 02:27:11 host2 sshd[2360117]: Disconnected from invalid user debian 106.51.1.63 port 42336 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 136.119.213.208
country_id: 6252001
description:
Jan 13 02:27:50 host2 sshd[2360607]: Disconnected from invalid user testsftp 136.119.213.208 port 57056 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 136.119.213.208
country_id: 6252001
description:
Jan 13 02:28:30 host2 sshd[2361284]: Disconnected from invalid user user 136.119.213.208 port 39964 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.146.233.156
country_id: 1269750
description:
2026-01-13 02:28:55 dovecot_login authenticator failed for H=([103.146.233.156]) [103.146.233.156]:45847: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.39.127
country_id: 1819730
description:
Jan 13 02:29:04 host2 sshd[2361839]: Disconnected from invalid user arkserver 118.193.39.127 port 44154 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.142.126.37
country_id: 6252001
description:
2026-01-13 02:29:25 dovecot_plain authenticator failed for H=c-69-142-126-37.hsd1.nj.comcast.net (catioss) [69.142.126.37]:33756: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.39.127
country_id: 1819730
description:
Jan 13 02:29:38 host2 sshd[2362482]: Disconnected from invalid user devuser 118.193.39.127 port 42506 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.78
country_id: 1269750
description:
2026-01-13 02:29:15 dovecot_login authenticator failed for H=(nsg-corporate-186.152.185.122.airtel.in) [182.95.178.78]:44406: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.229.6
country_id: 149590
description:
2026-01-13 02:29:37 dovecot_login authenticator failed for H=([41.59.229.6]) [41.59.229.6]:37284: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.166.254.166
country_id: 1269750
description:
Jan 13 02:29:51 host2 sshd[2362680]: Disconnected from invalid user bot3 122.166.254.166 port 39774 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 118.193.39.127
country_id: 1819730
description:
Jan 13 02:30:09 host2 sshd[2363104]: Disconnected from invalid user webtest 118.193.39.127 port 36012 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.203.34.136
country_id: 6252001
description:
2026-01-13 02:31:43 dovecot_plain authenticator failed for H=c-98-203-34-136.hsd1.fl.comcast.net (canon) [98.203.34.136]:55928: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 122.166.254.166
country_id: 1269750
description:
Jan 13 02:32:37 host2 sshd[2365428]: Disconnected from invalid user webtest 122.166.254.166 port 56436 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan 13 02:35:53 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@seyawin.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<UlJvPTdIQct100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.218.18
country_id: 1269750
description:
2026-01-13 02:37:05 dovecot_login authenticator failed for H=([128.185.217.27]) [128.185.218.18]:37544: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.44.133.238
country_id: 3469034
description:
2026-01-13 02:37:48 dovecot_login authenticator failed for H=(189-56-191-126.customer.tdatabrasil.net.br) [189.44.133.238]:41498: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 164.90.155.129
country_id: 6252001
description:
Jan 13 02:38:06 host2 pure-ftpd[2370661]: (?@164.90.155.129) [INFO] New connection from 164.90.155.129


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 72.167.47.211
country_id: 6252001
description:
Jan 13 02:40:52 host2 pure-ftpd[2373513]: (?@72.167.47.211) [INFO] New connection from 72.167.47.211


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 64.227.160.146
country_id: 1269750
description:
Jan 13 02:40:13 host2 pure-ftpd[2372711]: (?@64.227.160.146) [INFO] New connection from 64.227.160.146


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.10.31.238
country_id: 719819
description:
Jan 13 02:42:24 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=45.10.31.238, lip=66.85.158.91, TLS, session=<06jgUzdIUJUtCh/u>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.252.115
country_id: 3865483
description:
Jan 13 02:42:46 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<env_eng>, method=PLAIN, rip=179.0.252.115, lip=66.85.158.91, TLS, session=<g5UAVTdIh8azAPxz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Jan 13 02:44:30 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@kiriaswanu.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<QsM2XDdIDLkv/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Jan 13 02:45:13 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 6 secs): user=<help@kiriaswanu.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<tFiWXjdIEt4v/lVz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.165.174.234
country_id: 1269750
description:
2026-01-13 02:46:39 dovecot_login authenticator failed for H=([103.165.174.234]) [103.165.174.234]:60811: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.180
country_id: 6252001
description:
Jan 13 02:50:02 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.180, lip=66.85.158.92, session=<DfskcDdI8SBBMQG0>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 51.75.254.157
country_id: 3017382
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 51.75.254.157 - lezzarotech "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarotech (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.172
country_id: 6252001
description:
Jan 13 02:50:13 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.172, lip=66.85.158.92, TLS: Connection closed, session=<zZPQcDdIENNBMQGs>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 13 02:51:18 host2 sshd[2384133]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 13 02:54:02 host2 sshd[2386815]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.111.98
country_id: 6252001
description:
2026-01-13 02:55:20 dovecot_login authenticator failed for H=syn-035-130-111-098.biz.spectrum.com [35.130.111.98]:39176: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.226
country_id: 1733045
description:
2026-01-13 02:55:42 dovecot_login authenticator failed for H=([49.124.152.226]) [49.124.152.226]:44946: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.218.50
country_id: 1269750
description:
2026-01-13 03:00:38 dovecot_login authenticator failed for H=([125.19.218.50]) [125.19.218.50]:53234: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.27.83
country_id: 1643084
description:
2026-01-13 03:01:07 dovecot_login authenticator failed for H=(ip-arana.net.id.as132673) [103.90.27.83]:42534: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan 13 03:02:10 host2 sshd[2395210]: Disconnected from invalid user admin 2.57.121.112 port 50207 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.177.213.250
country_id: 357994
description:
2026-01-13 03:03:22 dovecot_plain authenticator failed for H=(worock) [154.177.213.250]:53648: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.188.251
country_id: 290557
description:
2026-01-13 03:03:49 dovecot_plain authenticator failed for H=(oveling) [91.73.188.251]:54330: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.93.80.158
country_id: 1269750
description:
2026-01-13 03:09:06 dovecot_login authenticator failed for H=(victoryent.in) [111.93.80.158]:59062: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 164.92.194.83
country_id: 2921044
description:
Jan 13 03:09:30 host2 pure-ftpd[2402549]: (?@164.92.194.83) [INFO] New connection from 164.92.194.83


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.220.126
country_id: 1269750
description:
2026-01-13 03:09:33 dovecot_login authenticator failed for H=([152.52.220.126]) [152.52.220.126]:33464: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.206.201.253
country_id: 1269750
description:
2026-01-13 03:14:36 dovecot_login authenticator failed for H=(49.206.201.253.actcorp.in) [49.206.201.253]:43266: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.18.99.126
country_id: 1269750
description:
2026-01-13 03:14:54 dovecot_login authenticator failed for H=([125.18.99.126]) [125.18.99.126]:50922: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.36.202.177
country_id: 3469034
description:
Jan 13 03:22:30 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=138.36.202.177, lip=66.85.158.91, TLS, session=<Gxoc4zdIqqGKJMqx>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.250.204
country_id: 3865483
description:
Jan 13 03:22:53 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<env_eng>, method=PLAIN, rip=179.0.250.204, lip=66.85.158.91, TLS, session=<jPVp5DdIyYezAPrM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.111.109.194
country_id: 1269750
description:
2026-01-13 03:23:46 dovecot_login authenticator failed for H=([103.111.109.194]) [103.111.109.194]:44854: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.27.83
country_id: 1643084
description:
2026-01-13 03:24:13 dovecot_login authenticator failed for H=(ip-arana.net.id.as132673) [103.90.27.83]:34522: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 216.218.206.69
country_id: 6252001
description:
Jan 13 03:27:01 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=216.218.206.69, lip=66.85.158.91, session=<2F9v9DdIIlTY2s5F>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 216.218.206.69
country_id: 6252001
description:
Jan 13 03:27:13 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=216.218.206.69, lip=66.85.158.91, TLS: Connection closed, session=<iYMe9TdIGnbY2s5F>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.227
country_id: 6252001
description:
Jan 13 03:27:43 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.227, lip=66.85.158.91, TLS handshaking: Connection closed, session=<A7Pu9jdI+Z1APsXj>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.227
country_id: 6252001
description:
Jan 13 03:28:16 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.197.227, lip=66.85.158.91, TLS: Connection closed, session=<Slvi+DdI9q5APsXj>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 69.5.0.120
country_id: 1643084
description:
Jan 13 03:28:32 host2 sshd[2422473]: Disconnected from invalid user ubuntu 69.5.0.120 port 44394 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.40.101.10
country_id: 6252001
description:
2026-01-13 03:28:49 dovecot_plain authenticator failed for H=c-98-40-101-10.hsd1.tn.comcast.net (valism) [98.40.101.10]:41330: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.230.142
country_id: 1269750
description:
2026-01-13 03:29:16 dovecot_login authenticator failed for H=([182.79.202.89]) [182.95.230.142]:42462: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan 13 03:33:31 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@seyawin.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<KF6JCzhIvel100Db>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 69.5.0.120
country_id: 1643084
description:
Jan 13 03:33:37 host2 sshd[2427394]: Disconnected from invalid user ubuntu 69.5.0.120 port 47024 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.164
country_id: 1269750
description:
2026-01-13 03:34:41 dovecot_login authenticator failed for H=(nsg-corporate-164.227.187.122.airtel.in) [122.187.227.164]:40098: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.101.16.250
country_id: 272103
description:
2026-01-13 03:34:51 dovecot_login authenticator failed for H=([185.134.179.106]) [185.101.16.250]:48708: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.227.3.79
country_id: 6252001
description:
Jan 13 03:36:03 host2 sshd[2430070]: Disconnected from invalid user admin 165.227.3.79 port 40955 [preauth]


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.39
country_id: 2635167
description:
Jan 13 03:35:11 host2 dovecot[3239883]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=185.247.137.39, lip=66.85.158.92, TLS, session=<ee+mEThI/cq594kn>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 115.85.80.12
country_id: 1643084
description:
Jan 13 03:35:31 host2 sshd[2429500]: Disconnected from invalid user admin 115.85.80.12 port 59458 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 57.128.188.106
country_id: 3017382
description:
Jan 13 03:36:48 host2 pure-ftpd[2430917]: (?@57.128.188.106) [INFO] New connection from 57.128.188.106


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.227.3.79
country_id: 6252001
description:
Jan 13 03:37:03 host2 sshd[2431194]: Disconnected from invalid user ubuntu 165.227.3.79 port 51661 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 165.227.3.79
country_id: 6252001
description:
Jan 13 03:38:07 host2 sshd[2432353]: Disconnected from invalid user admin 165.227.3.79 port 34139 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.227.3.79
country_id: 6252001
description:
Jan 13 03:38:37 host2 sshd[2432862]: Disconnected from invalid user admin 165.227.3.79 port 39494 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 69.5.0.120
country_id: 1643084
description:
Jan 13 03:39:12 host2 sshd[2433410]: Disconnected from invalid user ubuntu 69.5.0.120 port 57382 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.45
country_id: 1733045
description:
2026-01-13 03:41:10 dovecot_login authenticator failed for H=([49.124.153.45]) [49.124.153.45]:46464: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.116.206.194
country_id: 1269750
description:
Jan 13 03:43:37 host2 pure-ftpd[2438145]: (?@66.116.206.194) [INFO] New connection from 66.116.206.194


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.255.205.54
country_id: 2413451
description:
2026-01-13 03:44:41 dovecot_login authenticator failed for H=(197-255-205-54.netpagedns.net) [197.255.205.54]:53886: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 31.97.205.109
country_id: 1269750
description:
Jan 13 03:44:40 host2 pure-ftpd[2439270]: (?@31.97.205.109) [INFO] New connection from 31.97.205.109


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.67.106.221
country_id: 3686110
description:
2026-01-13 03:45:04 dovecot_login authenticator failed for H=([190.67.106.221]) [190.67.106.221]:60702: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 13 03:45:35 host2 sshd[2440526]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 164.92.194.83
country_id: 2921044
description:
Jan 13 03:47:26 host2 pure-ftpd[2442709]: (?@164.92.194.83) [INFO] New connection from 164.92.194.83


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 68.183.196.119
country_id: 6251999
description:
Jan 13 03:47:47 host2 pure-ftpd[2443200]: (?@68.183.196.119) [INFO] New connection from 68.183.196.119


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 117.232.85.78
country_id: 1269750
description:
Jan 13 03:49:47 host2 pure-ftpd[2445220]: (?@117.232.85.78) [INFO] New connection from 117.232.85.78


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.50.94.29
country_id: 1605651
description:
2026-01-13 03:52:24 dovecot_login authenticator failed for H=([147.50.94.29]) [147.50.94.29]:49542: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.154
country_id: 1269750
description:
2026-01-13 03:52:38 dovecot_login authenticator failed for H=(nsg-corporate-154.230.187.122.airtel.in) [122.187.230.154]:46966: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.210.192.240
country_id: 3144096
description:
2026-01-13 03:53:18 dovecot_login authenticator failed for H=([84.210.192.240]) [84.210.192.240]:54951: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.201.212.54
country_id: 99237
description:
2026-01-13 03:53:37 dovecot_login authenticator failed for H=([62.201.212.54]) [62.201.212.54]:53926: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.161.93.53
country_id: 1269750
description:
2026-01-13 03:53:50 dovecot_login authenticator failed for H=([103.161.93.53]) [103.161.93.53]:56035: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.235.140.163
country_id: 2017370
description:
2026-01-13 03:54:43 dovecot_login authenticator failed for H=(37-235-140-163.dynamic.customer.lanta.me) [37.235.140.163]:60740: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.29.197.188
country_id: 453733
description:
2026-01-13 03:55:09 dovecot_login authenticator failed for H=188-197-29-85.dyn.estpak.ee [85.29.197.188]:43235: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.191.8.27
country_id: 3017382
description:
2026-01-13 03:57:35 dovecot_login authenticator failed for H=([176.191.8.27]) [176.191.8.27]:48850: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.161.232.9
country_id: 6252001
description:
2026-01-13 03:57:44 dovecot_login authenticator failed for H=ip98-161-232-9.ph.ph.cox.net [98.161.232.9]:51224: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.48.229.117
country_id: 3469034
description:
2026-01-13 04:01:06 dovecot_login authenticator failed for H=ip-179.48.229.117.fiberlinkpe.net.br (ip-179.48.229.118.fiberlinkpe.net.br) [179.48.229.117]:38376: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.23.72.121
country_id: 6252001
description:
2026-01-13 04:01:16 dovecot_login authenticator failed for H=([209.23.72.121]) [209.23.72.121]:37584: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.15.90
country_id: 1149361
description:
2026-01-13 04:02:33 dovecot_login authenticator failed for H=([149.54.15.90]) [149.54.15.90]:41205: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.183.221.168
country_id: 6252001
description:
2026-01-13 04:02:57 dovecot_login authenticator failed for H=wsip-70-183-221-168.br.br.cox.net [70.183.221.168]:57276: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 13 04:03:09 host2 sshd[2460831]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.146.191
country_id: 3996063
description:
2026-01-13 04:04:37 dovecot_login authenticator failed for H=([177.236.146.191]) [177.236.146.191]:41627: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.0.41.134
country_id: 226074
description:
2026-01-13 04:05:08 dovecot_login authenticator failed for H=([196.0.41.134]) [196.0.41.134]:44383: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.10
country_id: 6252001
description:
Jan 13 04:08:03 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=91.230.168.10, lip=66.85.158.91, TLS handshaking: Connection closed, session=<jl8shzhIdYtb5qgK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.6
country_id: 6252001
description:
Jan 13 04:08:28 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=91.230.168.6, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<+oWjiDhIt9lb5qgG>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.14
country_id: 6252001
description:
Jan 13 04:08:31 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.230.168.14, lip=66.85.158.91, TLS: Connection closed, session=<Wd/RiDhIH7Nb5qgO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan 13 04:08:39 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<zSEsiThIO9F100Db>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.1
country_id: 6252001
description:
Jan 13 04:08:13 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=91.230.168.1, lip=66.85.158.91, TLS: Connection closed, session=<4krJhzhIP55b5qgB>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.128.209.48
country_id: 3469034
description:
2026-01-13 04:10:04 dovecot_login authenticator failed for H=(138.219.244.10.static.softdados.net) [177.128.209.48]:46594: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.17
country_id: 6252001
description:
Jan 13 04:09:24 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=195.184.76.17, lip=66.85.158.91, TLS handshaking: Connection closed, session=<PYgDjDhInd7DuEwR>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.117
country_id: 6252001
description:
Jan 13 04:09:34 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=195.184.76.117, lip=66.85.158.91, TLS: Connection closed, session=<E3ifjDhIL83DuEx1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.233.235.203
country_id: 2661886
description:
2026-01-13 04:09:45 dovecot_login authenticator failed for H=81-233-235-203-no600.tbcn.telia.com [81.233.235.203]:54532: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.112
country_id: 6252001
description:
Jan 13 04:09:45 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=195.184.76.112, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<SkhGjThI4aHDuExw>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.251.121.70
country_id: 1861060
description:
2026-01-13 04:14:23 dovecot_login authenticator failed for H=works.ssc-gr.info [160.251.121.70]:55104: 535 Incorrect authentication data (set_id=admin@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.149.93
country_id: 99237
description:
2026-01-13 04:15:59 dovecot_plain authenticator failed for H=(leaets) [65.20.149.93]:49860: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.230.65.53
country_id: 1512440
description:
2026-01-13 04:15:09 dovecot_login authenticator failed for H=([213.230.65.53]) [213.230.65.53]:43648: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.220.169.113
country_id: 2635167
description:
2026-01-13 04:18:17 dovecot_login authenticator failed for H=(165-220-169-113.cust.exede.net) [165.220.169.113]:41065: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 4.206.200.244
country_id: 6251999
description:
Jan 13 04:19:59 host2 sshd[2479228]: Disconnected from invalid user admin 4.206.200.244 port 48588 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 4.206.200.244
country_id: 6251999
description:
Jan 13 04:23:32 host2 sshd[2482248]: Disconnected from invalid user ubuntu 4.206.200.244 port 45870 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 4.206.200.244
country_id: 6251999
description:
Jan 13 04:24:06 host2 sshd[2482626]: Disconnected from invalid user admin 4.206.200.244 port 59570 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 164.92.194.83
country_id: 2921044
description:
Jan 13 04:25:03 host2 pure-ftpd[2483361]: (?@164.92.194.83) [INFO] New connection from 164.92.194.83


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 4.206.200.244
country_id: 6251999
description:
Jan 13 04:25:15 host2 sshd[2483577]: Disconnected from invalid user admin 4.206.200.244 port 45138 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 57.132.184.5
country_id: 6252001
description:
2026-01-13 04:27:47 dovecot_login authenticator failed for H=57-132-184-5.dyn.grandenetworks.net ([127.0.0.1]) [57.132.184.5]:56996: 535 Incorrect authentication data (set_id=inf@bostonlanka.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 118.193.37.10
country_id: 1819730
description:
Jan 13 04:27:51 host2 pure-ftpd[2485983]: (?@118.193.37.10) [INFO] New connection from 118.193.37.10


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.210.214.97
country_id: 3144096
description:
2026-01-13 04:27:54 dovecot_login authenticator failed for H=([127.0.0.1]) [84.210.214.97]:37810: 535 Incorrect authentication data (set_id=inf)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 195.158.9.235
country_id: 1512440
description:
Jan 13 04:33:29 host2 pure-ftpd[2490812]: (?@195.158.9.235) [INFO] New connection from 195.158.9.235


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 159.223.20.91
country_id: 2921044
description:
Jan 13 04:33:46 host2 pure-ftpd[2491046]: (?@159.223.20.91) [INFO] New connection from 159.223.20.91


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 13 04:35:11 host2 sshd[2492818]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.11.17.169
country_id: 3175395
description:
2026-01-13 04:35:50 dovecot_plain authenticator failed for H=host-188-11-17-169.business.telecomitalia.it (grally) [188.11.17.169]:50044: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.215.74.195
country_id: 2661886
description:
2026-01-13 04:38:37 dovecot_plain authenticator failed for H=217-215-74-195-no2620.tbcn.telia.com (tress) [217.215.74.195]:36584: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 8.134.107.111
country_id: 1814991
description:
Jan 13 04:38:55 host2 pure-ftpd[2496625]: (?@8.134.107.111) [INFO] New connection from 8.134.107.111


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.218.18
country_id: 1269750
description:
2026-01-13 04:43:12 dovecot_login authenticator failed for H=([128.185.217.27]) [128.185.218.18]:42030: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.220.90
country_id: 1269750
description:
2026-01-13 04:43:33 dovecot_login authenticator failed for H=(dsl-tn-dynamic-137.209.22.125.airtelbroadband.in) [128.185.220.90]:43378: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.232.119.77
country_id: 2921044
description:
Jan 13 04:45:17 host2 pure-ftpd[2503364]: (?@165.232.119.77) [INFO] New connection from 165.232.119.77


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.21
country_id: 241170
description:
Jan 13 04:49:51 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.21, lip=66.85.158.91, session=<InyHHDlIOMDE+2YV>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.110
country_id: 6252001
description:
Jan 13 04:51:09 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=91.230.168.110, lip=66.85.158.92, session=<8JFJITlI39hb5qhu>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.203
country_id: 6252001
description:
Jan 13 04:51:20 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=91.230.168.203, lip=66.85.158.92, session=<r27wITlI+4Nb5qjL>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.104
country_id: 6252001
description:
Jan 13 04:51:32 host2 dovecot[3239883]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=91.230.168.104, lip=66.85.158.92, session=<ipKuIjlIM+db5qho>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.219.104.210
country_id: 3175395
description:
2026-01-13 04:54:33 dovecot_login authenticator failed for H=net-188-219-104-210.cust.vodafonedsl.it [188.219.104.210]:44565: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.236.145.128
country_id: 6252001
description:
2026-01-13 04:54:50 dovecot_login authenticator failed for H=(node12.vindb.org) [104.236.145.128]:50920: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.20
country_id: 241170
description:
Jan 13 04:55:49 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.20, lip=66.85.158.91, session=<kG7pMTlI3N7E+2YU>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 208.109.34.86
country_id: 6252001
description:
Jan 13 04:56:00 host2 pure-ftpd[2515674]: (?@208.109.34.86) [INFO] New connection from 208.109.34.86


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 13 04:58:10 host2 sshd[2516778]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 15.204.140.61
country_id: 6252001
description:
Jan 13 04:57:24 host2 pure-ftpd[2516413]: (?@15.204.140.61) [INFO] New connection from 15.204.140.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.146.58
country_id: 3996063
description:
2026-01-13 04:58:40 dovecot_login authenticator failed for H=([177.236.146.58]) [177.236.146.58]:33232: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.64.18
country_id: 1269750
description:
2026-01-13 04:58:54 dovecot_login authenticator failed for H=([182.78.209.116]) [182.78.64.18]:33668: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 190.122.133.155
country_id: 3865483
description:
Jan 13 05:00:15 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=190.122.133.155, lip=66.85.158.91, session=<ngfXQTlIAbi+eoWb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.115.187.76
country_id: 690791
description:
Jan 13 04:59:58 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=188.115.187.76, lip=66.85.158.91, TLS, session=<hBPgPzlIvIC8c7tM>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.93
country_id: 6252001
description:
Jan 13 05:00:01 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.93, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<m6kKQTlIh8/N0h9d>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 177.153.62.49
country_id: 3469034
description:
Jan 13 05:00:05 host2 pure-ftpd[2517936]: (?@177.153.62.49) [INFO] New connection from 177.153.62.49


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.220.185.230
country_id: 6252001
description:
Jan 13 05:00:35 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=44.220.185.230, lip=66.85.158.92, TLS handshaking: Connection closed, session=<v/EHQzlI2tcs3Lnm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.252.207
country_id: 3865483
description:
Jan 13 05:00:41 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 23 secs): user=<careers>, method=PLAIN, rip=179.0.252.207, lip=66.85.158.91, TLS, session=<b6EOQjlI7eSzAPzP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.54.206
country_id: 1269750
description:
2026-01-13 05:03:57 dovecot_login authenticator failed for H=([127.0.0.1]) [182.95.54.206]:46100: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2026-01-13 05:06:09 dovecot_login authenticator failed for H=c-71-62-34-216.hsd1.va.comcast.net [71.62.34.216]:33534: 535 Incorrect authentication data (set_id=postmaster@visionsolutionshospital.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.177.213.250
country_id: 357994
description:
2026-01-13 05:06:06 dovecot_plain authenticator failed for H=(unpropors) [154.177.213.250]:58982: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.0.113.110
country_id: 226074
description:
2026-01-13 05:06:28 dovecot_login authenticator failed for H=([196.0.113.110]) [196.0.113.110]:37470: 535 Incorrect authentication data (set_id=postmaster@visionsolutionshospital.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.246.114.111
country_id: 1880251
description:
2026-01-13 05:06:59 dovecot_login authenticator failed for H=([124.246.114.111]) [124.246.114.111]:35488: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.177.210.193
country_id: 3469034
description:
2026-01-13 05:07:21 dovecot_login authenticator failed for H=(193.210.177.45.fronteirainternet.com.br) [45.177.210.193]:50924: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.158.138.179
country_id: 1269750
description:
2026-01-13 05:07:37 dovecot_login authenticator failed for H=([103.158.138.179]) [103.158.138.179]:58634: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.26.122.22
country_id: 298795
description:
2026-01-13 05:10:25 dovecot_login authenticator failed for H=([127.0.0.1]) [5.26.122.22]:44660: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.170.60.176
country_id: 3469034
description:
2026-01-13 05:10:42 dovecot_login authenticator failed for H=([127.0.0.1]) [177.170.60.176]:18460: 535 Incorrect authentication data (set_id=kasunp)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 50.28.105.119
country_id: 6252001
description:
Jan 13 05:11:16 host2 pure-ftpd[2523447]: (?@50.28.105.119) [INFO] New connection from 50.28.105.119


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 159.203.59.222
country_id: 6251999
description:
Jan 13 05:12:34 host2 pure-ftpd[2524215]: (?@159.203.59.222) [INFO] New connection from 159.203.59.222


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 64.23.194.146
country_id: 6252001
description:
Jan 13 05:14:35 host2 pure-ftpd[2525097]: (?@64.23.194.146) [INFO] New connection from 64.23.194.146


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.82.20.241
country_id: 1819730
description:
2026-01-13 05:17:16 dovecot_login authenticator failed for H=202-82-20-241.static.imsbiz.com [202.82.20.241]:54744: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.47.190
country_id: 99237
description:
2026-01-13 05:17:47 dovecot_login authenticator failed for H=([185.255.47.190]) [185.255.47.190]:56228: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan 13 05:17:57 host2 sshd[2527074]: Disconnected from invalid user user 2.57.121.25 port 25716 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 183.81.170.93
country_id: 2029969
description:
Jan 13 05:17:28 host2 pure-ftpd[2526844]: (?@183.81.170.93) [INFO] New connection from 183.81.170.93


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.192
country_id: 6252001
description:
Jan 13 05:19:08 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=205.210.31.192, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<CJ5nhTlIk9vN0h/A>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.223.46
country_id: 1269750
description:
2026-01-13 05:18:28 dovecot_login authenticator failed for H=([182.95.223.46]) [182.95.223.46]:36260: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 129.226.172.185
country_id: 1819730
description:
Jan 13 05:20:04 host2 sshd[2528157]: Disconnected from invalid user bitwarden 129.226.172.185 port 48728 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan 13 05:20:17 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@seyawin.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<dwBaiTlIV8N100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.171.162.222
country_id: 6251999
description:
2026-01-13 05:21:47 dovecot_login authenticator failed for H=([127.0.0.1]) [66.171.162.222]:38002: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 129.226.172.185
country_id: 1819730
description:
Jan 13 05:21:48 host2 sshd[2529007]: Disconnected from invalid user share 129.226.172.185 port 46216 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.214.109.76
country_id: 3144096
description:
2026-01-13 05:22:03 dovecot_login authenticator failed for H=([127.0.0.1]) [84.214.109.76]:47309: 535 Incorrect authentication data (set_id=kasunp)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.18.166.89
country_id: 1269750
description:
Jan 13 05:22:26 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=103.18.166.89, lip=66.85.158.91, TLS, session=<kq8MkDlIbd1nEqZZ>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 129.226.172.185
country_id: 1819730
description:
Jan 13 05:22:30 host2 sshd[2529259]: Disconnected from invalid user sftpuser 129.226.172.185 port 59986 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.227.33.189
country_id: 3865483
description:
Jan 13 05:22:50 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<env_eng>, method=PLAIN, rip=45.227.33.189, lip=66.85.158.91, TLS, session=<c35okTlIWukt4yG9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.159.179
country_id: 1733045
description:
2026-01-13 05:25:11 dovecot_login authenticator failed for H=([49.124.159.179]) [49.124.159.179]:58502: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.160.139.163
country_id: 2510769
description:
2026-01-13 05:25:30 dovecot_login authenticator failed for H=(163.pool90-160-139.dynamic.orange.es) [90.160.139.163]:54739: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.91.212.232
country_id: 3017382
description:
Jan 13 05:25:39 host2 sshd[2531103]: Disconnected from invalid user bot1 51.91.212.232 port 43664 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.146.222
country_id: 3996063
description:
2026-01-13 05:26:03 dovecot_login authenticator failed for H=([177.236.146.222]) [177.236.146.222]:45031: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.95.197.36
country_id: 3469034
description:
Jan 13 05:25:59 host2 sshd[2531323]: Disconnected from invalid user odoo17 34.95.197.36 port 39498 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.60.146
country_id: 1269750
description:
2026-01-13 05:26:48 dovecot_login authenticator failed for H=([182.95.25.99]) [182.95.60.146]:41948: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.66
country_id: 1036973
description:
2026-01-13 05:27:19 dovecot_login authenticator failed for H=([196.28.226.66]) [196.28.226.66]:56670: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 34.95.197.36
country_id: 3469034
description:
Jan 13 05:27:23 host2 sshd[2532086]: Disconnected from invalid user ansible 34.95.197.36 port 60292 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 13 05:29:29 host2 sshd[2532981]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 103.148.157.64
country_id: 1269750
description:
Jan 13 05:30:01 host2 pure-ftpd[2533303]: (?@103.148.157.64) [INFO] New connection from 103.148.157.64


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 34.27.42.6
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 34.27.42.6 - lezzarot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarot (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.127.53.61
country_id: 6252001
description:
2026-01-13 05:32:02 dovecot_plain authenticator failed for H=c-24-127-53-61.hsd1.mi.comcast.net (nonric) [24.127.53.61]:40500: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.60
country_id: 6252001
description:
Jan 13 05:32:57 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed: read(size=704) failed: Connection reset by peer (no auth attempts in 2 secs): user=<>, rip=167.94.146.60, lip=66.85.158.92, TLS: read(size=704) failed: Connection reset by peer, session=<7hjLtjlIaI+nXpI8>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.94.192.162
country_id: 732800
description:
[2025-12-26 17:26:14 +0530] info [webmaild] 185.94.192.162 - env_eng@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 13 05:37:45 host2 sshd[2538398]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.146.244
country_id: 3996063
description:
2026-01-13 05:38:04 dovecot_login authenticator failed for H=([177.236.146.244]) [177.236.146.244]:54741: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 196.251.100.112
country_id: 241170
description:
Jan 13 05:37:31 host2 pure-ftpd[2538270]: (?@196.251.100.112) [INFO] New connection from 196.251.100.112


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 91.231.222.160
country_id: 3190538
description:
Jan 13 05:37:33 host2 pure-ftpd[2538287]: (?@91.231.222.160) [INFO] New connection from 91.231.222.160


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 191.13.244.233
country_id: 3469034
description:
Jan 13 05:38:22 host2 sshd[2538994]: Disconnected from invalid user sftpuser 191.13.244.233 port 40018 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.23.73.205
country_id: 6252001
description:
2026-01-13 05:38:29 dovecot_login authenticator failed for H=([209.23.73.205]) [209.23.73.205]:43836: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.178.221.180
country_id: 1210997
description:
2026-01-13 05:41:20 dovecot_login authenticator failed for H=([127.0.0.1]) [103.178.221.180]:44171: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.228.33.30
country_id: 798544
description:
Jan 13 05:41:22 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<training@v-deploy.com>, method=PLAIN, rip=91.228.33.30, lip=66.85.158.91, TLS, session=<mBLc0zlIWchb5CEe>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 172.105.224.72
country_id: 1861060
description:
Jan 13 05:41:41 host2 pure-ftpd[2541999]: (?@172.105.224.72) [INFO] New connection from 172.105.224.72


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.221.144.12
country_id: 690791
description:
Jan 13 05:41:43 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<training>, method=PLAIN, rip=37.221.144.12, lip=66.85.158.91, TLS, session=<DUgK1TlInqAl3ZAM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.22
country_id: 1269750
description:
2026-01-13 05:42:14 dovecot_login authenticator failed for H=([182.95.20.31]) [182.95.228.22]:52332: 535 Incorrect authentication data (set_id=reception)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.185.166
country_id: 1269750
description:
2026-01-13 05:41:33 dovecot_login authenticator failed for H=([127.0.0.1]) [182.95.185.166]:51818: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.23.184.136
country_id: 3469034
description:
Jan 13 05:41:49 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<training>, method=PLAIN, rip=177.23.184.136, lip=66.85.158.91, TLS, session=<AvpR1TlI/6WxF7iI>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.146.34
country_id: 1733045
description:
2026-01-13 05:41:54 dovecot_login authenticator failed for H=([49.124.146.34]) [49.124.146.34]:48998: 535 Incorrect authentication data (set_id=reception@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.85.106.175
country_id: 3469034
description:
Jan 13 05:41:25 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<training@v-deploy.com>, method=PLAIN, rip=187.85.106.175, lip=66.85.158.91, TLS, session=<1fji0zlIuNy7VWqv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.41.18
country_id: 1269750
description:
2026-01-13 05:42:30 dovecot_login authenticator failed for H=([182.95.20.13]) [122.187.41.18]:52012: 535 Incorrect authentication data (set_id=reception)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 191.13.244.233
country_id: 3469034
description:
Jan 13 05:42:31 host2 sshd[2542547]: Disconnected from invalid user deploy 191.13.244.233 port 50118 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 103.174.102.191
country_id: 1269750
description:
Jan 13 05:42:48 host2 pure-ftpd[2542741]: (?@103.174.102.191) [INFO] New connection from 103.174.102.191


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-13 05:43:17 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (symeally) [87.103.126.54]:4897: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.18.99.10
country_id: 1269750
description:
2026-01-13 05:48:15 dovecot_login authenticator failed for H=([125.18.99.10]) [125.18.99.10]:43892: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.92.124.2
country_id: 1269750
description:
2026-01-13 05:48:25 dovecot_login authenticator failed for H=(static.bb.ill.59.92.124.2.bsnl.in) [59.92.124.2]:42907: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.222.70.208
country_id: 3175395
description:
2026-01-13 05:50:11 dovecot_login authenticator failed for H=([89.222.70.208]) [89.222.70.208]:40796: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.2
country_id: 1149361
description:
2026-01-13 05:49:45 dovecot_login authenticator failed for H=([149.54.62.2]) [149.54.62.2]:44076: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 79.137.79.129
country_id: 3017382
description:
Jan 13 05:52:43 host2 pure-ftpd[2549396]: (?@79.137.79.129) [INFO] New connection from 79.137.79.129


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.25.186.130
country_id: 6252001
description:
2026-01-13 05:59:19 dovecot_login authenticator failed for H=(173-25-186-130.client.mchsi.com) [173.25.186.130]:49702: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 40.76.167.156
country_id: 6252001
description:
Jan 13 06:02:01 host2 pure-ftpd[2555900]: (?@40.76.167.156) [INFO] New connection from 40.76.167.156


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.241.102
country_id: 1269750
description:
2026-01-13 06:02:29 dovecot_login authenticator failed for H=([125.19.175.152]) [182.78.241.102]:50654: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.61.82
country_id: 1269750
description:
2026-01-13 06:02:55 dovecot_login authenticator failed for H=([182.95.61.82]) [182.95.61.82]:43236: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.4
country_id: 99237
description:
2026-01-13 06:03:05 dovecot_plain authenticator failed for H=(twignitub) [65.20.133.4]:51336: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 179.40.112.10
country_id: 3865483
description:
Jan 13 06:07:27 host2 sshd[2559908]: Disconnected from invalid user admin 179.40.112.10 port 49354 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.171.86.81
country_id: 2017370
description:
2026-01-13 06:07:36 dovecot_login authenticator failed for H=([93.171.86.81]) [93.171.86.81]:34756: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.211.57.196
country_id: 6252001
description:
2026-01-13 06:07:46 dovecot_login authenticator failed for H=wsip-72-211-57-196.lv.lv.cox.net [72.211.57.196]:52428: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 57.128.188.106
country_id: 3017382
description:
Jan 13 06:08:18 host2 pure-ftpd[2560430]: (?@57.128.188.106) [INFO] New connection from 57.128.188.106


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.40.112.10
country_id: 3865483
description:
Jan 13 06:08:46 host2 sshd[2560630]: Disconnected from invalid user admin 179.40.112.10 port 46922 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.40.112.10
country_id: 3865483
description:
Jan 13 06:09:27 host2 sshd[2561039]: Disconnected from invalid user ubuntu 179.40.112.10 port 59806 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.237.57.144
country_id: 1269750
description:
Jan 13 06:09:30 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 24 secs): user=<env_eng>, method=PLAIN, rip=103.237.57.144, lip=66.85.158.91, TLS, session=<0j4WODpIrp9n7TmQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.96.199.84
country_id: 3865483
description:
Jan 13 06:09:03 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=186.96.199.84, lip=66.85.158.91, TLS, session=<2UOyNjpIpMa6YMdU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.50.226.182
country_id: 3469034
description:
Jan 13 06:13:17 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 25 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=187.50.226.182, lip=66.85.158.91, TLS, session=<L++NRTpILOW7MuK2>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.153.146
country_id: 99237
description:
Jan 13 06:13:36 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<hr>, method=PLAIN, rip=65.20.153.146, lip=66.85.158.91, TLS, session=<0jwfRzpIjbdBFJmS>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.237
country_id: 6252001
description:
Jan 13 06:12:53 host2 pure-ftpd[2563434]: (?@147.185.132.237) [INFO] New connection from 147.185.132.237


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.124
country_id: 1036973
description:
2026-01-13 06:14:25 dovecot_login authenticator failed for H=([196.28.226.124]) [196.28.226.124]:42168: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.220.30
country_id: 1269750
description:
2026-01-13 06:15:16 dovecot_login authenticator failed for H=([125.19.220.30]) [125.19.220.30]:46750: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.173.58.47
country_id: 6252001
description:
2026-01-13 06:20:12 dovecot_plain authenticator failed for H=c-67-173-58-47.hsd1.il.comcast.net (bated) [67.173.58.47]:54588: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.124.60.46
country_id: 1168579
description:
2026-01-13 06:24:45 dovecot_login authenticator failed for H=([203.124.60.46]) [203.124.60.46]:46365: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 13 06:26:03 host2 sshd[2571880]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.201.122.108
country_id: 2750405
description:
2026-01-13 06:26:12 dovecot_login authenticator failed for H=(ADMIN) [172.201.122.108]:54596: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.150.243.22
country_id: 6252001
description:
2026-01-13 06:26:57 dovecot_plain authenticator failed for H=(noninting) [12.150.243.22]:36987: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 74.208.234.244
country_id: 6252001
description:
Jan 13 06:29:50 host2 pure-ftpd[2573443]: (?@74.208.234.244) [INFO] New connection from 74.208.234.244


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.212
country_id: 6252001
description:
Jan 13 06:34:38 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=198.235.24.212, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<hmJlkzpIH8jG6xjU>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 67.10.185.103
country_id: 6252001
description:
Jan 13 06:34:41 host2 sshd[2576177]: Disconnected from invalid user ts1 67.10.185.103 port 38470 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.83.150.103
country_id: 3017382
description:
Jan 13 06:35:04 host2 sshd[2576523]: Disconnected from invalid user ubuntu 51.83.150.103 port 54664 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 67.10.185.103
country_id: 6252001
description:
Jan 13 06:35:17 host2 sshd[2576730]: Disconnected from invalid user timemachine 67.10.185.103 port 49478 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 87.236.176.43
country_id: 2635167
description:
Jan 13 06:39:22 host2 pure-ftpd[2578594]: (?@87.236.176.43) [INFO] New connection from 87.236.176.43


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.157.248.41
country_id: 1643084
description:
Jan 13 06:39:00 host2 sshd[2578308]: Disconnected from invalid user devel 43.157.248.41 port 33478 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 115.241.83.2
country_id: 1269750
description:
Jan 13 06:39:06 host2 sshd[2578389]: Disconnected from invalid user ubuntu 115.241.83.2 port 54470 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 195.25.17.31
country_id: 3017382
description:
Jan 13 06:41:18 host2 sshd[2579774]: Disconnected from invalid user ubuntu 195.25.17.31 port 44389 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.79.102.35
country_id: 3017382
description:
Jan 13 06:41:43 host2 pure-ftpd[2579890]: (?@147.79.102.35) [INFO] New connection from 147.79.102.35


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.44.133.238
country_id: 3469034
description:
2026-01-13 06:42:03 dovecot_login authenticator failed for H=(189-56-191-126.customer.tdatabrasil.net.br) [189.44.133.238]:57411: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.246.114.111
country_id: 1880251
description:
2026-01-13 06:42:43 dovecot_login authenticator failed for H=([124.246.114.111]) [124.246.114.111]:47782: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 195.25.17.31
country_id: 3017382
description:
Jan 13 06:43:26 host2 sshd[2580618]: Received disconnect from 195.25.17.31 port 13411:11: Bye Bye [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 213.142.151.19
country_id: 298795
description:
Jan 13 06:44:07 host2 sshd[2580897]: Disconnected from invalid user ubuntu 213.142.151.19 port 41764 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 115.241.83.2
country_id: 1269750
description:
Jan 13 06:43:48 host2 sshd[2580739]: Disconnected from invalid user admin 115.241.83.2 port 43008 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.208.81.125
country_id: 6252001
description:
2026-01-13 06:47:56 dovecot_plain authenticator failed for H=c-73-208-81-125.hsd1.in.comcast.net (thaller) [73.208.81.125]:40756: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.97.155.25
country_id: 6252001
description:
2026-01-13 06:50:28 dovecot_plain authenticator failed for H=c-76-97-155-25.hsd1.ga.comcast.net (unble) [76.97.155.25]:43066: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.83.31.53
country_id: 6252001
description:
2026-01-13 06:50:28 dovecot_login authenticator failed for H=(lezzarotech.com) [45.83.31.53]:55078: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 132.220.107.88
country_id: 2750405
description:
Jan 13 06:51:11 host2 pure-ftpd[2584592]: (?@132.220.107.88) [INFO] New connection from 132.220.107.88


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.67.45.29
country_id: 2661886
description:
2026-01-13 06:51:52 dovecot_login authenticator failed for H=213-67-45-29-no600.tbcn.telia.com [213.67.45.29]:44584: 535 Incorrect authentication data (set_id=admin@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-13 06:52:03 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (prexus) [87.103.126.54]:32306: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.8.125.130
country_id: 3469034
description:
2026-01-13 06:52:14 dovecot_login authenticator failed for H=([189.8.125.130]) [189.8.125.130]:34306: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.44.61
country_id: 1819730
description:
Jan 13 06:54:55 host2 sshd[2586792]: Disconnected from invalid user teste 118.193.44.61 port 36808 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 158.94.210.79
country_id: 2750405
description:
[2025-12-26 17:26:14 +0530] info [whostmgrd] 158.94.210.79 - 2096 "GET /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: invalid user name specified


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 118.193.44.61
country_id: 1819730
description:
Jan 13 06:56:51 host2 sshd[2587966]: Disconnected from invalid user ftpuser 118.193.44.61 port 47176 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.227.134.232
country_id: 2921044
description:
Jan 13 06:57:52 host2 pure-ftpd[2588578]: (?@165.227.134.232) [INFO] New connection from 165.227.134.232


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 34.79.124.224
country_id: 2802361
description:
Jan 13 06:58:53 host2 pure-ftpd[2589059]: (?@34.79.124.224) [INFO] New connection from 34.79.124.224


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 13 07:00:20 host2 sshd[2590151]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.44.61
country_id: 1819730
description:
Jan 13 07:00:30 host2 sshd[2590207]: Disconnected from invalid user odoo17 118.193.44.61 port 32924 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 64.227.160.146
country_id: 1269750
description:
Jan 13 07:02:19 host2 pure-ftpd[2591322]: (?@64.227.160.146) [INFO] New connection from 64.227.160.146


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 142.79.227.70
country_id: 1269750
description:
Jan 13 07:02:27 host2 pure-ftpd[2591388]: (?@142.79.227.70) [INFO] New connection from 142.79.227.70


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.219
country_id: 6252001
description:
Jan 13 07:01:39 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=205.210.31.219, lip=66.85.158.91, session=<OBr+8zpIBOLN0h/b>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.182.125.210
country_id: 6252001
description:
2026-01-13 07:05:07 dovecot_plain authenticator failed for H=(lasther) [12.182.125.210]:38153: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-13 07:05:12 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (tualic) [87.103.126.54]:21346: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.224.247.23
country_id: 1269750
description:
Jan 13 07:07:04 host2 sshd[2594634]: Disconnected from invalid user admin 103.224.247.23 port 40418 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.224.247.23
country_id: 1269750
description:
Jan 13 07:07:43 host2 sshd[2595125]: Disconnected from invalid user admin 103.224.247.23 port 41020 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 38.242.212.239
country_id: 3017382
description:
Jan 13 07:09:52 host2 pure-ftpd[2597148]: (?@38.242.212.239) [INFO] New connection from 38.242.212.239


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 193.123.245.198
country_id: 1835841
description:
Jan 13 07:10:06 host2 sshd[2597470]: Disconnected from invalid user ubuntu 193.123.245.198 port 47558 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.222.93.199
country_id: 6252001
description:
2026-01-13 07:10:33 dovecot_plain authenticator failed for H=c-98-222-93-199.hsd1.il.comcast.net (dully) [98.222.93.199]:54658: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.38.16.85
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 45.38.16.85 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 193.123.245.198
country_id: 1835841
description:
Jan 13 07:12:23 host2 sshd[2599022]: Disconnected from invalid user ubuntu 193.123.245.198 port 39398 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 193.123.245.198
country_id: 1835841
description:
Jan 13 07:12:57 host2 sshd[2599215]: Disconnected from invalid user admin 193.123.245.198 port 36446 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 162.240.173.20
country_id: 6252001
description:
Jan 13 07:16:05 host2 pure-ftpd[2601301]: (?@162.240.173.20) [INFO] New connection from 162.240.173.20


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.154.84.190
country_id: 2287781
description:
2026-01-13 07:17:15 dovecot_login authenticator failed for H=([160.154.84.190]) [160.154.84.190]:59616: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.250.11.92
country_id: 1643084
description:
Jan 13 07:17:39 host2 sshd[2601834]: Disconnected from invalid user ssh-user 103.250.11.92 port 44524 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 206.217.136.36
country_id: 6252001
description:
Jan 13 07:18:05 host2 sshd[2602044]: Disconnected from invalid user azureuser 206.217.136.36 port 52042 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.188.172.6
country_id: 3923057
description:
Jan 13 07:19:10 host2 sshd[2602512]: Disconnected from invalid user bitnami 181.188.172.6 port 32866 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.145.33
country_id: 1819730
description:
2026-01-13 07:19:11 dovecot_login authenticator failed for H=(223-197-145-33.static.imsbiz.com) [223.197.145.33]:64189: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.89.120.125
country_id: 3469034
description:
2026-01-13 07:19:28 dovecot_login authenticator failed for H=(190.89.120.125-fo-dyn.redeultranet.com.br) [190.89.120.125]:49816: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.86.102
country_id: 1269750
description:
2026-01-13 07:19:53 dovecot_login authenticator failed for H=([182.79.86.102]) [182.79.86.102]:59042: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.188.172.6
country_id: 3923057
description:
Jan 13 07:20:42 host2 sshd[2603492]: Disconnected from invalid user sshadmin 181.188.172.6 port 42434 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 181.188.172.6
country_id: 3923057
description:
Jan 13 07:21:24 host2 sshd[2603937]: Disconnected from invalid user odoo17 181.188.172.6 port 47983 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.188.172.6
country_id: 3923057
description:
Jan 13 07:22:07 host2 sshd[2604198]: Disconnected from invalid user user1 181.188.172.6 port 53534 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.1.200.187
country_id: 6252001
description:
2026-01-13 07:23:07 dovecot_plain authenticator failed for H=c-24-1-200-187.hsd1.il.comcast.net (aughly) [24.1.200.187]:53794: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.3.182
country_id: 1269750
description:
Jan 13 07:22:44 host2 sshd[2604481]: Disconnected from invalid user debian 139.59.3.182 port 49266 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 206.217.136.36
country_id: 6252001
description:
Jan 13 07:23:43 host2 sshd[2604936]: Disconnected from invalid user ftp-user 206.217.136.36 port 48230 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.165.15.132
country_id: 1733045
description:
Jan 13 07:23:40 host2 sshd[2604913]: Disconnected from invalid user remote 202.165.15.132 port 15105 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.192.52
country_id: 1819730
description:
Jan 13 07:25:10 host2 sshd[2605776]: Disconnected from invalid user sftptest 152.32.192.52 port 44016 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.250.11.92
country_id: 1643084
description:
Jan 13 07:25:17 host2 sshd[2605874]: Disconnected from invalid user system 103.250.11.92 port 36982 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.3.182
country_id: 1269750
description:
Jan 13 07:24:42 host2 sshd[2605422]: Disconnected from invalid user newuser 139.59.3.182 port 60624 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.165.15.132
country_id: 1733045
description:
Jan 13 07:24:55 host2 sshd[2605564]: Disconnected from invalid user oracle 202.165.15.132 port 62285 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.3.182
country_id: 1269750
description:
Jan 13 07:25:53 host2 sshd[2606165]: Disconnected from invalid user sshadmin 139.59.3.182 port 37330 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.50.154
country_id: 1269750
description:
2026-01-13 07:27:05 dovecot_login authenticator failed for H=([182.95.50.154]) [182.95.50.154]:45872: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.151.70.150
country_id: 2750405
description:
2026-01-13 07:27:52 dovecot_login authenticator failed for H=31-151-70-150.dynamic.upc.nl [31.151.70.150]:56479: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.97.28
country_id: 1819730
description:
Jan 13 07:30:27 host2 sshd[2608638]: Disconnected from invalid user user 165.154.97.28 port 52334 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.142.184.55
country_id: 1210997
description:
2026-01-13 07:31:20 dovecot_login authenticator failed for H=([103.133.175.82]) [103.142.184.55]:34853: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.94
country_id: 6252001
description:
Jan 13 07:31:14 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 46 secs): user=<>, rip=147.185.133.94, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<OyzRXTtIqNuTuYVe>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.232.203.22
country_id: 3017382
description:
2026-01-13 07:31:39 dovecot_login authenticator failed for H=([149.232.203.22]) [149.232.203.22]:49566: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.94
country_id: 6252001
description:
Jan 13 07:31:50 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 14 secs): user=<>, rip=147.185.133.94, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<SN32XztInviTuYVe>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.33
country_id: 6252001
description:
Jan 13 07:32:57 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.33, lip=66.85.158.91, session=<ubf5YztI2eVAPpwh>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.24
country_id: 6252001
description:
Jan 13 07:33:07 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.24, lip=66.85.158.91, TLS: Connection closed, session=<UlyTZDtIgE5APpwY>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 13 07:34:10 host2 sshd[2610699]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 165.154.97.28
country_id: 1819730
description:
Jan 13 07:34:56 host2 sshd[2610996]: Disconnected from invalid user student1 165.154.97.28 port 34238 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.121.205.29
country_id: 3923057
description:
Jan 13 07:35:31 host2 sshd[2611566]: Disconnected from invalid user admin 186.121.205.29 port 54788 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.67.152.201
country_id: 1269750
description:
2026-01-13 07:35:52 dovecot_login authenticator failed for H=([103.67.152.201]) [103.67.152.201]:50118: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.230.142
country_id: 1269750
description:
2026-01-13 07:36:20 dovecot_login authenticator failed for H=([182.79.202.89]) [182.95.230.142]:50838: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 72.167.47.211
country_id: 6252001
description:
Jan 13 07:36:23 host2 pure-ftpd[2611945]: (?@72.167.47.211) [INFO] New connection from 72.167.47.211


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.127.86
country_id: 1269750
description:
2026-01-13 07:36:35 dovecot_login authenticator failed for H=([27.123.119.191]) [122.184.127.86]:44872: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.94
country_id: 6252001
description:
Jan 13 07:37:36 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=147.185.133.94, lip=66.85.158.92, TLS, session=<GuiPdDtIKOOTuYVe>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 46.249.99.168
country_id: 2921044
description:
Jan 13 07:38:29 host2 sshd[2613020]: Disconnected from invalid user ubuntu 46.249.99.168 port 45212 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 164.92.236.103
country_id: 2921044
description:
Jan 13 07:37:58 host2 sshd[2612727]: Disconnected from invalid user ubuntu 164.92.236.103 port 36130 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.64.18
country_id: 1269750
description:
2026-01-13 07:38:09 dovecot_login authenticator failed for H=([182.78.209.116]) [182.78.64.18]:46418: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 46.249.99.168
country_id: 2921044
description:
Jan 13 07:38:57 host2 sshd[2613326]: Disconnected from invalid user admin 46.249.99.168 port 37434 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.161.217.228
country_id: 2510769
description:
2026-01-13 07:38:47 dovecot_login authenticator failed for H=([90.161.217.228]) [90.161.217.228]:54355: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.42.229.152
country_id: 1880251
description:
Jan 13 07:39:19 host2 sshd[2613621]: Disconnected from invalid user admin 152.42.229.152 port 59524 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 160.251.215.3
country_id: 1861060
description:
Jan 13 07:39:23 host2 pure-ftpd[2613749]: (?@160.251.215.3) [INFO] New connection from 160.251.215.3


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 79.116.4.22
country_id: 2510769
description:
Jan 13 07:39:57 host2 sshd[2614188]: Disconnected from invalid user admin 79.116.4.22 port 32910 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.98.176.164
country_id: 1643084
description:
Jan 13 07:40:15 host2 sshd[2614604]: Disconnected from invalid user ubuntu 103.98.176.164 port 47748 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.188.159.138
country_id: 3923057
description:
Jan 13 07:39:54 host2 sshd[2614147]: Disconnected from invalid user ubuntu 181.188.159.138 port 41890 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.42.229.152
country_id: 1880251
description:
Jan 13 07:41:56 host2 sshd[2615807]: Disconnected from invalid user ubuntu 152.42.229.152 port 57156 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.98.176.164
country_id: 1643084
description:
Jan 13 07:42:01 host2 sshd[2615961]: Disconnected from invalid user ubuntu 103.98.176.164 port 50538 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.69
country_id: 6252001
description:
Jan 13 07:42:45 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=147.185.132.69, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=</9sAhztIV9iTuYRF>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.42.229.152
country_id: 1880251
description:
Jan 13 07:43:51 host2 sshd[2617275]: Disconnected from invalid user ubuntu 152.42.229.152 port 60456 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.19
country_id: 241170
description:
Jan 13 07:46:15 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.19, lip=66.85.158.91, session=<27dpkztIro/E+2YT>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.170.1.244
country_id: 3017382
description:
2026-01-13 07:46:27 dovecot_login authenticator failed for H=176-170-1-244.abo.bbox.fr [176.170.1.244]:53452: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.128.209.48
country_id: 3469034
description:
2026-01-13 07:46:39 dovecot_login authenticator failed for H=(138.219.244.10.static.softdados.net) [177.128.209.48]:48790: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.202
country_id: 2635167
description:
Jan 13 07:47:38 host2 dovecot[3239883]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=185.247.137.202, lip=66.85.158.91, TLS, session=<nbB0mDtI3Y2594nK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.222.1.234
country_id: 1269750
description:
2026-01-13 07:48:34 dovecot_login authenticator failed for H=(static.ill.117.247.82.240.bsnl.co.in) [117.222.1.234]:35224: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.177.210.193
country_id: 3469034
description:
2026-01-13 07:48:52 dovecot_login authenticator failed for H=([45.177.210.193]) [45.177.210.193]:51250: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.123.202
country_id: 1269750
description:
2026-01-13 07:49:28 dovecot_login authenticator failed for H=([182.95.123.202]) [182.95.123.202]:55372: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 106.51.75.252
country_id: 1269750
description:
Jan 13 07:49:30 host2 pure-ftpd[2622298]: (?@106.51.75.252) [INFO] New connection from 106.51.75.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.57.194
country_id: 1269750
description:
2026-01-13 07:49:48 dovecot_login authenticator failed for H=([182.79.126.100]) [182.95.57.194]:33286: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 181.188.159.138
country_id: 3923057
description:
Jan 13 07:51:09 host2 sshd[2623817]: Disconnected from invalid user admin 181.188.159.138 port 55388 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.161.137
country_id: 3144096
description:
2026-01-13 07:52:34 dovecot_login authenticator failed for H=(137-161-97-62.cust.smartcall.no) [62.97.161.137]:45042: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.124.251.49
country_id: 6252001
description:
2026-01-13 07:53:33 dovecot_login authenticator failed for H=([147.124.251.49]) [147.124.251.49]:59271: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.104.225.201
country_id: 6252001
description:
2026-01-13 07:54:08 dovecot_plain authenticator failed for H=(crevial) [24.104.225.201]:60609: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.194.231
country_id: 3144096
description:
2026-01-13 07:54:18 dovecot_login authenticator failed for H=(cm-178.232.194.231.get.no) [178.232.194.231]:48409: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.249.245.22
country_id: 1819730
description:
Jan 13 07:54:38 host2 sshd[2627226]: Disconnected from invalid user botuser 45.249.245.22 port 37886 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.14
country_id: 798549
description:
Jan 13 07:55:56 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=85.217.149.14, lip=66.85.158.91, session=<M4YotjtI2pdV2ZUO>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.144.28.85
country_id: 1819730
description:
Jan 13 07:56:22 host2 sshd[2629042]: Disconnected from invalid user demo 103.144.28.85 port 50826 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.49.152.10
country_id: 3469034
description:
Jan 13 07:56:27 host2 sshd[2629122]: Disconnected from invalid user ftpuser 187.49.152.10 port 51354 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.54.10
country_id: 1269750
description:
2026-01-13 07:54:52 dovecot_login authenticator failed for H=([182.95.54.10]) [182.95.54.10]:45732: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.0.225.215
country_id: 3469034
description:
Jan 13 07:55:56 host2 sshd[2628661]: Disconnected from invalid user tests 177.0.225.215 port 36402 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.144.28.85
country_id: 1819730
description:
Jan 13 07:56:53 host2 sshd[2629458]: Disconnected from invalid user varnish 103.144.28.85 port 33314 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.49.152.10
country_id: 3469034
description:
Jan 13 07:57:07 host2 sshd[2629615]: Disconnected from invalid user demo 187.49.152.10 port 58870 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.0.225.215
country_id: 3469034
description:
Jan 13 07:57:08 host2 sshd[2629633]: Disconnected from invalid user demo 177.0.225.215 port 34842 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.201.122.108
country_id: 2750405
description:
2026-01-13 07:57:13 dovecot_login authenticator failed for H=(ADMIN) [172.201.122.108]:55216: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 177.0.225.215
country_id: 3469034
description:
Jan 13 07:58:20 host2 sshd[2630695]: Disconnected from invalid user admin1 177.0.225.215 port 59986 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.22
country_id: 1269750
description:
2026-01-13 07:58:25 dovecot_login authenticator failed for H=([182.95.20.31]) [182.95.228.22]:42800: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.168.136.150
country_id: 6252001
description:
2026-01-13 07:58:35 dovecot_plain authenticator failed for H=c-73-168-136-150.hsd1.il.comcast.net (intiliker) [73.168.136.150]:57618: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.209.106.190
country_id: 2077456
description:
2026-01-13 07:58:37 dovecot_login authenticator failed for H=([123.209.106.190]) [123.209.106.190]:34050: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.0.225.215
country_id: 3469034
description:
Jan 13 07:57:44 host2 sshd[2630110]: Disconnected from invalid user bot1 177.0.225.215 port 39660 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.144.28.85
country_id: 1819730
description:
Jan 13 07:57:56 host2 sshd[2630264]: Disconnected from invalid user sdtd 103.144.28.85 port 56016 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.0.225.215
country_id: 3469034
description:
Jan 13 07:58:56 host2 sshd[2631183]: Disconnected from invalid user demo 177.0.225.215 port 46970 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.203.213.8
country_id: 192950
description:
Jan 13 07:59:01 host2 sshd[2631243]: Disconnected from invalid user vpnuser 41.203.213.8 port 60322 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.153.171.41
country_id: 1210997
description:
2026-01-13 08:00:33 dovecot_plain authenticator failed for H=(DESKTOP-OHC04PA) [103.153.171.41]:1428: 535 Incorrect authentication data (set_id=mohberuwala@epid.gov.lk)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 103.153.171.40
country_id: 1210997
description:
Jan 13 07:59:47 host2 pure-ftpd[2631785]: (?@103.153.171.40) [WARNING] Authentication failed for user [mohberuwala@epid.gov.lk]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.43.254.214
country_id: 732800
description:
2026-01-13 08:00:07 dovecot_login authenticator failed for H=cable-84-43-254-214.mnet.bg [84.43.254.214]:56204: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.249.245.22
country_id: 1819730
description:
Jan 13 08:00:08 host2 sshd[2632369]: Disconnected from invalid user testing 45.249.245.22 port 37720 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.83.145.39
country_id: 6252001
description:
Jan 13 08:00:05 host2 dovecot[3239883]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.83.145.39, lip=66.85.158.91, session=<rJ77xDtI9NMDU5En>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 103.153.171.41
country_id: 1210997
description:
Jan 13 07:59:48 host2 pure-ftpd[2631922]: (?@103.153.171.41) [INFO] New connection from 103.153.171.41


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 103.153.171.41
country_id: 1210997
description:
Jan 13 07:59:55 host2 pure-ftpd[2631922]: (?@103.153.171.41) [WARNING] Authentication failed for user [mohberuwala]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 103.153.171.40
country_id: 1210997
description:
Jan 13 07:59:39 host2 pure-ftpd[2631785]: (?@103.153.171.40) [INFO] New connection from 103.153.171.40


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.153.171.40
country_id: 1210997
description:
Jan 13 07:59:40 host2 sshd[2631783]: Invalid user mohberuwala@epid.gov.lk from 103.153.171.40 port 56690


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 89.44.137.240
country_id: 798549
description:
Jan 13 08:00:55 host2 sshd[2633158]: Disconnected from invalid user builder 89.44.137.240 port 36098 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.216.20.24
country_id: 3469034
description:
Jan 13 08:00:40 host2 sshd[2632955]: Disconnected from invalid user tests 179.216.20.24 port 32723 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.203.213.8
country_id: 192950
description:
Jan 13 08:01:38 host2 sshd[2633831]: Disconnected from invalid user administrador 41.203.213.8 port 47522 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.20
country_id: 798549
description:
Jan 13 08:01:52 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=85.217.149.20, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<HIdkyztIPq9V2ZUU>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 41.203.213.8
country_id: 192950
description:
Jan 13 08:02:14 host2 sshd[2634404]: Disconnected from invalid user csserver 41.203.213.8 port 34476 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.249.245.22
country_id: 1819730
description:
Jan 13 08:02:48 host2 sshd[2634865]: Disconnected from invalid user es 45.249.245.22 port 60814 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 103.153.171.40
country_id: 1210997
description:
Jan 13 08:02:49 host2 dovecot[3239883]: pop3-login: Disconnected: Inactivity (no auth attempts in 180 secs): user=<>, rip=103.153.171.40, lip=66.85.158.91, TLS handshaking, session=<b8PBzjtII7hnmaso>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.35.53
country_id: 3144096
description:
2026-01-13 08:03:43 dovecot_login authenticator failed for H=([46.212.35.53]) [46.212.35.53]:51989: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.209.30
country_id: 1269750
description:
2026-01-13 08:03:56 dovecot_login authenticator failed for H=([128.185.209.30]) [128.185.209.30]:45422: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.205
country_id: 6252001
description:
Jan 13 08:04:41 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.205, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<LHJq1TtIP9vN0h/N>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 179.216.20.24
country_id: 3469034
description:
Jan 13 08:06:11 host2 sshd[2638411]: Disconnected from invalid user viewtinet 179.216.20.24 port 35301 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.202.20.23
country_id: 6252001
description:
Jan 13 08:09:25 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=44.202.20.23, lip=66.85.158.91, TLS, session=<voRY5jtI+LEsyhQX>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.194
country_id: 1269750
description:
2026-01-13 08:08:40 dovecot_login authenticator failed for H=([182.95.228.194]) [182.95.228.194]:41768: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.22
country_id: 241170
description:
Jan 13 08:10:44 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.22, lip=66.85.158.91, session=<dVbx6jtIbNjE+2YW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.23
country_id: 241170
description:
Jan 13 08:12:30 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.23, lip=66.85.158.91, session=<DUAz8TtIkubE+2YX>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.243.5
country_id: 3469034
description:
Jan 13 08:13:57 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<env_eng>, method=PLAIN, rip=186.209.243.5, lip=66.85.158.91, TLS, session=<KfeI9TtIJcq60fMF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.130.168.89
country_id: 3469034
description:
Jan 13 08:13:37 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=177.130.168.89, lip=66.85.158.91, TLS, session=<3yRC9DtIKO6xgqhZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.170.107
country_id: 3175395
description:
Jan 13 08:17:16 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=185.15.170.107, lip=66.85.158.91, TLS, session=<pExnATxI8NG5D6pr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.71.161
country_id: 3469034
description:
Jan 13 08:17:37 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<careers>, method=PLAIN, rip=177.44.71.161, lip=66.85.158.91, TLS, session=<y6KVAjxIcdSxLEeh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.201.122.108
country_id: 2750405
description:
2026-01-13 08:19:43 dovecot_login authenticator failed for H=(ADMIN) [172.201.122.108]:55310: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.125.124.14
country_id: 3469034
description:
2026-01-13 08:21:35 dovecot_login authenticator failed for H=(vtx-b-124-014.virtex.com.br) [179.125.124.14]:56581: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-13 08:21:31 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (ramened) [87.103.126.54]:6182: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.118.70.58
country_id: 2802361
description:
[2025-12-26 17:26:14 +0530] info [webmaild] 178.118.70.58 - - "POST /cpsess0130295740/3rdparty/roundcube/:2087/json-api/create_user_session HTTP/1.1" FAILED LOGIN webmaild: user name not provided or invalid user


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.40.189.43
country_id: 6252001
description:
2026-01-13 08:22:43 dovecot_plain authenticator failed for H=c-68-40-189-43.hsd1.mi.comcast.net (woosser) [68.40.189.43]:54008: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.223.176.171
country_id: 6252001
description:
2026-01-13 08:26:06 dovecot_login authenticator failed for H=([50.223.176.171]) [50.223.176.171]:42122: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.156.0.88
country_id: 3144096
description:
2026-01-13 08:26:52 dovecot_login authenticator failed for H=([78.156.0.88]) [78.156.0.88]:59643: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.22.66.171
country_id: 953987
description:
2026-01-13 08:28:23 dovecot_login authenticator failed for H=([127.0.0.1]) [102.22.66.171]:60648: 535 Incorrect authentication data (set_id=kasunp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.194.101.58
country_id: 3175395
description:
2026-01-13 08:28:10 dovecot_login authenticator failed for H=([127.0.0.1]) [2.194.101.58]:59762: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.253.156.173
country_id: 1643084
description:
Jan 13 08:30:16 host2 sshd[2658208]: Disconnected from invalid user admin 182.253.156.173 port 41786 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 186.86.52.137
country_id: 3686110
description:
Jan 13 08:31:24 host2 sshd[2659050]: Disconnected from invalid user ubuntu 186.86.52.137 port 20207 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 181.215.193.122
country_id: 298795
description:
Jan 13 08:30:46 host2 pure-ftpd[2658607]: (?@181.215.193.122) [INFO] New connection from 181.215.193.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.1.200.187
country_id: 6252001
description:
2026-01-13 08:31:53 dovecot_plain authenticator failed for H=c-24-1-200-187.hsd1.il.comcast.net (phorbudult) [24.1.200.187]:56392: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 161.35.195.132
country_id: 2921044
description:
Jan 13 08:33:36 host2 pure-ftpd[2660532]: (?@161.35.195.132) [INFO] New connection from 161.35.195.132


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.113.10
country_id: 1269750
description:
2026-01-13 08:34:07 dovecot_login authenticator failed for H=(abts-north-dynamic-121.212.66.182.airtelbroadband.in) [27.123.113.10]:42846: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.253.156.173
country_id: 1643084
description:
Jan 13 08:34:07 host2 sshd[2660840]: Disconnected from invalid user ubuntu 182.253.156.173 port 57966 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.147.248.44
country_id: 1269750
description:
2026-01-13 08:34:44 dovecot_login authenticator failed for H=([103.147.248.44]) [103.147.248.44]:42596: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.253.156.173
country_id: 1643084
description:
Jan 13 08:36:17 host2 sshd[2662776]: Disconnected from invalid user ubuntu 182.253.156.173 port 48618 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 182.253.156.173
country_id: 1643084
description:
Jan 13 08:36:58 host2 sshd[2663414]: Disconnected from invalid user admin 182.253.156.173 port 55518 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.253.156.173
country_id: 1643084
description:
Jan 13 08:37:40 host2 sshd[2664218]: Disconnected from invalid user admin 182.253.156.173 port 59742 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.86.52.137
country_id: 3686110
description:
Jan 13 08:38:13 host2 sshd[2664742]: Disconnected from invalid user admin 186.86.52.137 port 22327 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan 13 08:38:18 host2 sshd[2664803]: Disconnected from invalid user admin 2.57.121.112 port 32778 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.192.245.178
country_id: 1269750
description:
2026-01-13 08:38:23 dovecot_login authenticator failed for H=(dhcp-192-245-178.in2cable.com) [203.192.245.178]:53864: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.201.122.108
country_id: 2750405
description:
2026-01-13 08:38:27 dovecot_login authenticator failed for H=(ADMIN) [172.201.122.108]:53750: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.127.86
country_id: 1269750
description:
2026-01-13 08:38:47 dovecot_login authenticator failed for H=([27.123.119.191]) [122.184.127.86]:40728: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.86.52.137
country_id: 3686110
description:
Jan 13 08:39:08 host2 sshd[2665517]: Disconnected from invalid user admin 186.86.52.137 port 2389 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 172.105.224.72
country_id: 1861060
description:
Jan 13 08:41:08 host2 pure-ftpd[2667808]: (?@172.105.224.72) [INFO] New connection from 172.105.224.72


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 57.128.188.106
country_id: 3017382
description:
Jan 13 08:42:15 host2 pure-ftpd[2668809]: (?@57.128.188.106) [INFO] New connection from 57.128.188.106


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.227.254.152
country_id: 3703430
description:
Jan 13 08:42:33 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=45.227.254.152, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<SF/eXDxI/ggt4/6Y>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 164.92.194.83
country_id: 2921044
description:
Jan 13 08:44:56 host2 pure-ftpd[2671417]: (?@164.92.194.83) [INFO] New connection from 164.92.194.83


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.167
country_id: 2993457
description:
Jan 13 08:46:02 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=194.165.16.167, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<D91MaTxIHP/CpRCn>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.129.13.184
country_id: 1880251
description:
2026-01-13 08:49:13 dovecot_login authenticator failed for H=(184.13.129.180.unknown.m1.com.sg) [180.129.13.184]:44946: 535 Incorrect authentication data (set_id=abuse@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.6.121.246
country_id: 3469034
description:
2026-01-13 08:50:22 dovecot_login authenticator failed for H=([191.217.23.65]) [187.6.121.246]:55316: 535 Incorrect authentication data (set_id=hostmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.120.98
country_id: 1269750
description:
2026-01-13 08:50:34 dovecot_login authenticator failed for H=([59.145.74.209]) [122.184.120.98]:46862: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.208.58
country_id: 1036973
description:
2026-01-13 08:49:53 dovecot_login authenticator failed for H=([197.219.208.58]) [197.219.208.58]:58276: 535 Incorrect authentication data (set_id=abuse@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.40.63
country_id: 1819730
description:
2026-01-13 08:49:57 dovecot_login authenticator failed for H=063.40.246.220.static.netvigator.com [220.246.40.63]:44136: 535 Incorrect authentication data (set_id=hostmaster@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.157.219.158
country_id: 6252001
description:
2026-01-13 08:54:53 dovecot_plain authenticator failed for H=c-76-157-219-158.hsd1.il.comcast.net (unslize) [76.157.219.158]:58432: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.201.122.108
country_id: 2750405
description:
2026-01-13 08:56:33 dovecot_login authenticator failed for H=(ADMIN) [172.201.122.108]:45728: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.116.165
country_id: 3144096
description:
2026-01-13 08:56:54 dovecot_login authenticator failed for H=(cm-178.232.116.165.get.no) [178.232.116.165]:36909: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 134.56.58.179
country_id: 6252001
description:
2026-01-13 08:57:10 dovecot_login authenticator failed for H=(134.56.58.179.hwccustomers.com) [134.56.58.179]:49809: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.106
country_id: 6252001
description:
Jan 13 08:58:44 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.106, lip=66.85.158.91, TLS, session=<ttPDljxIBOCTuYRq>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 68.183.196.119
country_id: 6251999
description:
Jan 13 08:59:41 host2 pure-ftpd[2685746]: (?@68.183.196.119) [INFO] New connection from 68.183.196.119


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.38.3.181
country_id: 2215636
description:
2026-01-13 09:01:47 dovecot_plain authenticator failed for H=(gympeadat) [102.38.3.181]:52417: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.116.206.194
country_id: 1269750
description:
Jan 13 09:01:50 host2 pure-ftpd[2687794]: (?@66.116.206.194) [INFO] New connection from 66.116.206.194


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.169.40.221
country_id: 1269750
description:
2026-01-13 09:06:18 dovecot_login authenticator failed for H=([122.169.40.221]) [122.169.40.221]:60980: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.201.69
country_id: 1733045
description:
2026-01-13 09:05:50 dovecot_login authenticator failed for H=([49.125.201.69]) [49.125.201.69]:51734: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.123.45.2
country_id: 1269750
description:
2026-01-13 09:07:47 dovecot_login authenticator failed for H=([103.123.45.2]) [103.123.45.2]:47034: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.134.27.194
country_id: 1210997
description:
2026-01-13 09:08:25 dovecot_login authenticator failed for H=([103.134.27.194]) [103.134.27.194]:48486: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.201.122.108
country_id: 2750405
description:
2026-01-13 09:14:25 dovecot_login authenticator failed for H=(ADMIN) [172.201.122.108]:40868: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 13 09:16:44 host2 sshd[2699288]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 195.158.9.235
country_id: 1512440
description:
Jan 13 09:16:59 host2 pure-ftpd[2699527]: (?@195.158.9.235) [INFO] New connection from 195.158.9.235


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 13 09:17:46 host2 sshd[2700263]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.185.198.73
country_id: 798544
description:
2026-01-13 09:18:27 dovecot_plain authenticator failed for H=5.185.198.73.ipv4.public.orange.pl (packpre) [5.185.198.73]:49444: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.103.27.217
country_id: 390903
description:
2026-01-13 09:19:14 dovecot_login authenticator failed for H=owniyj.static.otenet.gr (lime36.static.otenet.gr) [62.103.27.217]:30047: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.115.144.103
country_id: 3469034
description:
2026-01-13 09:19:39 dovecot_login authenticator failed for H=(191.34.253.17.dynamic.adsl.gvt.net.br) [187.115.144.103]:38832: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.156.0.88
country_id: 3144096
description:
2026-01-13 09:19:53 dovecot_login authenticator failed for H=(cm-78.156.0.88.get.no) [78.156.0.88]:60044: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.237.173.220
country_id: 6252001
description:
Jan 13 09:21:08 host2 dovecot[3239883]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.237.173.220, lip=66.85.158.92, session=<Zu/W5jxIjNkD7a3c>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.124.111.122
country_id: 2077456
description:
2026-01-13 09:22:02 dovecot_login authenticator failed for H=27-124-111-122.static.as58511.net [27.124.111.122]:38386: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Jan 13 09:24:33 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 9 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS handshaking: Connection closed, session=<1v0O8zxI7ugDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Jan 13 09:26:39 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS handshaking: Connection closed, session=<5Vub+jxI/OwDgmBb>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.227.133.53
country_id: 6252001
description:
Jan 13 09:26:49 host2 sshd[2705183]: Disconnected from invalid user admin 192.227.133.53 port 41960 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 15.204.140.61
country_id: 6252001
description:
Jan 13 09:27:08 host2 pure-ftpd[2705299]: (?@15.204.140.61) [INFO] New connection from 15.204.140.61


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.151.91.78
country_id: 732800
description:
Jan 13 09:30:08 host2 sshd[2706536]: Disconnected from invalid user ubuntu 45.151.91.78 port 47536 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.227.133.53
country_id: 6252001
description:
Jan 13 09:30:19 host2 sshd[2706754]: Disconnected from invalid user ubuntu 192.227.133.53 port 48152 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.151.91.78
country_id: 732800
description:
Jan 13 09:29:39 host2 sshd[2706090]: Disconnected from invalid user ubuntu 45.151.91.78 port 32948 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.248.243.181
country_id: 2542007
description:
2026-01-13 09:29:50 dovecot_plain authenticator failed for H=(dedurasm) [41.248.243.181]:52590: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Jan 13 09:31:58 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS, session=<5NmTDT1IlLEDgmBb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.201.122.108
country_id: 2750405
description:
2026-01-13 09:32:20 dovecot_login authenticator failed for H=(ADMIN) [172.201.122.108]:47712: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 192.227.133.53
country_id: 6252001
description:
Jan 13 09:32:43 host2 sshd[2707818]: Disconnected from invalid user admin 192.227.133.53 port 34956 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.147
country_id: 2635167
description:
Jan 13 09:32:34 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 46 secs): user=<>, rip=35.203.211.147, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<UtS2Dz1IzMgjy9OT>


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 192.227.133.53
country_id: 6252001
description:
Jan 13 09:32:43 host2 sshd[2707818]: Received disconnect from 192.227.133.53 port 34956:11: Bye Bye [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.147
country_id: 2635167
description:
Jan 13 09:33:36 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed: read(size=429) failed: Connection reset by peer (no auth attempts in 13 secs): user=<>, rip=35.203.211.147, lip=66.85.158.91, TLS: read(size=429) failed: Connection reset by peer, session=<ohRqEz1IDPQjy9OT>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Jan 13 09:35:03 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS handshaking: Connection closed, session=<1SifGD1IKogDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Jan 13 09:36:32 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<u3TsHT1IEqwDgmBb>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 68.183.90.246
country_id: 1269750
description:
Jan 13 09:37:18 host2 pure-ftpd[2709994]: (?@68.183.90.246) [INFO] New connection from 68.183.90.246


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Jan 13 09:37:43 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS, session=<ivcsIj1IQLEDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.147
country_id: 2635167
description:
Jan 13 09:37:51 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.203.211.147, lip=66.85.158.91, TLS, session=<3rWgIj1IwO4jy9OT>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.195.138.52
country_id: 6252001
description:
2026-01-13 09:37:56 dovecot_plain authenticator failed for H=c-98-195-138-52.hsd1.tx.comcast.net (yorcely) [98.195.138.52]:39026: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.117.232.42
country_id: 2017370
description:
2026-01-13 09:38:12 dovecot_login authenticator failed for H=([85.117.232.42]) [85.117.232.42]:35528: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.58.66.231
country_id: 3469034
description:
2026-01-13 09:38:44 dovecot_login authenticator failed for H=(industrianaval.fla.gvt.net.br) [187.58.66.231]:40351: 535 Incorrect authentication data (set_id=all@2s-travels.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Jan 13 09:38:51 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS, session=<ffg8Jj1IGNsDgmBb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.204.134.124
country_id: 6252001
description:
2026-01-13 09:40:28 dovecot_plain authenticator failed for H=c-98-204-134-124.hsd1.md.comcast.net (inelter) [98.204.134.124]:34226: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.83.98
country_id: 1269750
description:
2026-01-13 09:40:55 dovecot_login authenticator failed for H=(nsg-static-193.132.71.182.airtel.in) [182.79.83.98]:52338: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 181.118.183.189
country_id: 3865483
description:
Jan 13 09:43:17 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=181.118.183.189, lip=66.85.158.91, TLS, session=<DOvfND1I74m1dre9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.252.8
country_id: 3865483
description:
Jan 13 09:43:37 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<careers>, method=PLAIN, rip=179.0.252.8, lip=66.85.158.91, TLS, session=<ewonNj1IvZqzAPwI>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.93.60.253
country_id: 3865483
description:
2026-01-13 09:47:43 dovecot_login authenticator failed for H=(host253.181-93-60.telecom.net.ar) [181.93.60.253]:62835: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.100.41.198
country_id: 798549
description:
2026-01-13 09:47:54 dovecot_login authenticator failed for H=([109.100.41.198]) [109.100.41.198]:45087: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.69.10.191
country_id: 6252001
description:
Jan 13 09:49:13 host2 sshd[2719155]: Invalid user cloudtourssrilan_travel from 38.69.10.191 port 63668


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.122
country_id: 1269750
description:
2026-01-13 09:52:50 dovecot_login authenticator failed for H=([152.52.236.122]) [152.52.236.122]:42776: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.163.150
country_id: 1269750
description:
2026-01-13 09:54:06 dovecot_login authenticator failed for H=(nsg-corporate-193.168.185.122.airtel.in) [125.19.163.150]:38918: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Jan 13 09:54:19 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, session=<mFuBXT1I3M0DlTsa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.71.82
country_id: 1269750
description:
2026-01-13 09:53:55 dovecot_login authenticator failed for H=(nsg-static-82.71.76.182-airtel.com) [182.76.71.82]:44852: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Jan 13 09:55:40 host2 dovecot[3239883]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, session=<nblVYj1IDIIDlTsa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.0.166.123
country_id: 1605651
description:
2026-01-13 09:56:40 dovecot_login authenticator failed for H=([106.0.166.123]) [106.0.166.123]:39216: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 183.81.170.93
country_id: 2029969
description:
Jan 13 09:56:50 host2 pure-ftpd[2726537]: (?@183.81.170.93) [INFO] New connection from 183.81.170.93


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.235.226.154
country_id: 294640
description:
2026-01-13 09:57:02 dovecot_login authenticator failed for H=([147.235.226.154]) [147.235.226.154]:51000: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Jan 13 09:57:44 host2 dovecot[3239883]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, session=<Q8vEaT1IZoYDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Jan 13 09:59:01 host2 dovecot[3239883]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, session=<Jldabj1I/IoDlTsa>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.232.119.77
country_id: 2921044
description:
Jan 13 10:00:14 host2 pure-ftpd[2729611]: (?@165.232.119.77) [INFO] New connection from 165.232.119.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.166.153.20
country_id: 6252001
description:
2026-01-13 10:00:41 dovecot_plain authenticator failed for H=c-174-166-153-20.hsd1.nj.comcast.net (scaled) [174.166.153.20]:35182: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 159.203.59.222
country_id: 6251999
description:
Jan 13 10:01:56 host2 pure-ftpd[2731336]: (?@159.203.59.222) [INFO] New connection from 159.203.59.222


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 64.23.194.146
country_id: 6252001
description:
Jan 13 10:04:00 host2 pure-ftpd[2733153]: (?@64.23.194.146) [INFO] New connection from 64.23.194.146


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.58.87.108
country_id: 6252001
description:
2026-01-13 10:06:12 dovecot_plain authenticator failed for H=c-174-58-87-108.hsd1.fl.comcast.net (kuprella) [174.58.87.108]:45490: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.82.181.183
country_id: 6252001
description:
2026-01-13 10:08:54 dovecot_login authenticator failed for H=ool-4352b5b7.dyn.optonline.net [67.82.181.183]:35672: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.215.245.175
country_id: 3469034
description:
2026-01-13 10:09:33 dovecot_login authenticator failed for H=([189.59.210.1]) [186.215.245.175]:50335: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 208.109.34.86
country_id: 6252001
description:
Jan 13 10:15:23 host2 pure-ftpd[2742566]: (?@208.109.34.86) [INFO] New connection from 208.109.34.86


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.235.225.181
country_id: 6252001
description:
2026-01-13 10:14:34 dovecot_plain authenticator failed for H=c-71-235-225-181.hsd1.ct.comcast.net (spored) [71.235.225.181]:44884: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.113.10.113
country_id: 2328926
description:
Jan 13 10:17:45 host2 sshd[2744518]: Disconnected from invalid user ubuntu 154.113.10.113 port 34644 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.97.74
country_id: 1269750
description:
2026-01-13 10:19:15 dovecot_login authenticator failed for H=([128.185.224.142]) [27.123.97.74]:49426: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.191.239.155
country_id: 6252001
description:
Jan 13 10:19:21 host2 sshd[2745808]: Disconnected from invalid user ubuntu 172.191.239.155 port 60962 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.169.40.221
country_id: 1269750
description:
2026-01-13 10:19:29 dovecot_login authenticator failed for H=([122.169.40.221]) [122.169.40.221]:32784: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.113.10.113
country_id: 2328926
description:
Jan 13 10:19:06 host2 sshd[2745601]: Disconnected from invalid user ubuntu 154.113.10.113 port 46948 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.10
country_id: 241170
description:
Jan 13 10:20:18 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.10, lip=66.85.158.91, session=<QetMuj1INq7E+2YK>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.191.239.155
country_id: 6252001
description:
Jan 13 10:22:19 host2 sshd[2748133]: Disconnected from invalid user ubuntu 172.191.239.155 port 50710 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.36
country_id: 6252001
description:
Jan 13 10:22:31 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=195.184.76.36, lip=66.85.158.91, session=</jRewj1I+5PDuEwk>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.191.239.155
country_id: 6252001
description:
Jan 13 10:21:41 host2 sshd[2747679]: Disconnected from invalid user ubuntu 172.191.239.155 port 39126 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.241
country_id: 6252001
description:
Jan 13 10:22:21 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=195.184.76.241, lip=66.85.158.91, session=<B5PDwT1I4cPDuEzx>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.241
country_id: 6252001
description:
Jan 13 10:22:48 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=195.184.76.241, lip=66.85.158.91, session=<8jlgwz1IC9bDuEzx>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.244
country_id: 6252001
description:
Jan 13 10:22:45 host2 dovecot[3239883]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=195.184.76.244, lip=66.85.158.91, session=<23Iwwz1IF5jDuEz0>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 177.153.62.49
country_id: 3469034
description:
Jan 13 10:24:16 host2 pure-ftpd[2749675]: (?@177.153.62.49) [INFO] New connection from 177.153.62.49


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 103.174.102.191
country_id: 1269750
description:
Jan 13 10:25:03 host2 pure-ftpd[2750357]: (?@103.174.102.191) [INFO] New connection from 103.174.102.191


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 77.83.39.144
country_id: 690791
description:
Jan 13 10:25:45 host2 sshd[2750965]: Invalid user cloudtourssrilan_travel from 77.83.39.144 port 57822


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.105
country_id: 2635167
description:
Jan 13 10:26:40 host2 dovecot[3239883]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 7 secs): user=<>, rip=185.247.137.105, lip=66.85.158.92, TLS, session=<PI0v0T1ITei594lp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.58.255.251
country_id: 1522867
description:
Jan 13 10:28:28 host2 sshd[2752928]: Disconnected from invalid user devops 95.58.255.251 port 41200 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.0.87.50
country_id: 226074
description:
Jan 13 10:31:15 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=196.0.87.50, lip=66.85.158.91, TLS, session=<zchs4D1I1NfEAFcy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.100.41.198
country_id: 798549
description:
2026-01-13 10:31:24 dovecot_login authenticator failed for H=([109.100.41.198]) [109.100.41.198]:58404: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 95.58.255.251
country_id: 1522867
description:
Jan 13 10:30:50 host2 sshd[2754701]: Disconnected from invalid user remote 95.58.255.251 port 33600 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.71.236.61
country_id: 3469034
description:
Jan 13 10:31:35 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<env_eng>, method=PLAIN, rip=45.71.236.61, lip=66.85.158.91, TLS, session=<bKi14T1IVI4tR+w9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.83.134.101
country_id: 3469034
description:
2026-01-13 10:31:54 dovecot_login authenticator failed for H=(179.83.135.1.dynamic.adsl.gvt.net.br) [179.83.134.101]:33157: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 157.230.123.130
country_id: 2921044
description:
Jan 13 10:33:42 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=157.230.123.130, lip=66.85.158.91, session=<oG1f6j1IlQSd5nuC>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 134.209.224.40
country_id: 2921044
description:
Jan 13 10:33:42 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=134.209.224.40, lip=66.85.158.91, session=<nrlk6j1Ieh+G0eAo>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 164.90.155.129
country_id: 6252001
description:
Jan 13 10:34:11 host2 pure-ftpd[2757762]: (?@164.90.155.129) [INFO] New connection from 164.90.155.129


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.79.134
country_id: 1269750
description:
2026-01-13 10:36:12 dovecot_login authenticator failed for H=([182.78.79.134]) [182.78.79.134]:34376: 535 Incorrect authentication data (set_id=postmaster@neotechlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.231.112.22
country_id: 3017382
description:
2026-01-13 10:36:29 dovecot_login authenticator failed for H=([188.231.112.22]) [188.231.112.22]:57656: 535 Incorrect authentication data (set_id=postmaster@neotechlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
country_id: 1643084
description:
2026-01-13 10:36:51 dovecot_login authenticator failed for H=(ip-103-29-185-162.pascalwave.com) [103.29.185.162]:52958: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.59.132.186
country_id: 1269750
description:
Jan 13 10:43:51 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=103.59.132.186, lip=66.85.158.91, TLS, session=<bvKKDT5I2tNnO4S6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.213.194.142
country_id: 1269750
description:
Jan 13 10:44:23 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 27 secs): user=<env_eng>, method=PLAIN, rip=103.213.194.142, lip=66.85.158.91, TLS, session=<Dxf+Dj5IL65n1cKO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.222
country_id: 2186224
description:
2026-01-13 10:45:10 dovecot_login authenticator failed for H=([121.73.169.222]) [121.73.169.222]:43036: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.49.166
country_id: 1269750
description:
2026-01-13 10:45:38 dovecot_login authenticator failed for H=([182.95.21.30]) [182.95.49.166]:59322: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 50.28.105.119
country_id: 6252001
description:
Jan 13 10:46:00 host2 pure-ftpd[2767988]: (?@50.28.105.119) [INFO] New connection from 50.28.105.119


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 71.6.167.142
country_id: 6252001
description:
Jan 13 10:48:27 host2 dovecot[3239883]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=71.6.167.142, lip=66.85.158.92, session=<RrEhHz5IRO1HBqeO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 71.6.167.142
country_id: 6252001
description:
Jan 13 10:48:29 host2 dovecot[3239883]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=71.6.167.142, lip=66.85.158.92, session=<RMk5Hz5IKIFHBqeO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.11
country_id: 1814991
description:
Jan 13 10:49:09 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=94.231.206.11, lip=66.85.158.91, session=<y5OlIT5I7Ype584L>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 71.6.167.142
country_id: 6252001
description:
Jan 13 10:48:33 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=71.6.167.142, lip=66.85.158.92, TLS, session=<3Z59Hz5I2oxHBqeO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.14
country_id: 1814991
description:
Jan 13 10:48:40 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=94.231.206.14, lip=66.85.158.91, session=<HnnkHz5IS8de584O>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.1
country_id: 1814991
description:
Jan 13 10:48:51 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=94.231.206.1, lip=66.85.158.91, session=<y+2OID5ISbRe584B>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.36.214.46
country_id: 3469034
description:
Jan 13 10:49:01 host2 sshd[2770203]: Disconnected from invalid user admin 177.36.214.46 port 48639 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.8
country_id: 1814991
description:
Jan 13 10:49:06 host2 dovecot[3239883]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=94.231.206.8, lip=66.85.158.91, session=<dL9rIT5IN9de584I>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 13 10:50:25 host2 sshd[2771171]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.218
country_id: 6252001
description:
Jan 13 10:49:57 host2 pure-ftpd[2770811]: (?@198.235.24.218) [INFO] New connection from 198.235.24.218


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 177.36.214.46
country_id: 3469034
description:
Jan 13 10:52:16 host2 sshd[2772615]: Disconnected from invalid user admin 177.36.214.46 port 48450 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.195.150
country_id: 290557
description:
2026-01-13 10:52:29 dovecot_login authenticator failed for H=([91.73.195.150]) [91.73.195.150]:55937: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.4
country_id: 99237
description:
2026-01-13 10:51:39 dovecot_plain authenticator failed for H=(viononst) [65.20.133.4]:47100: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.151
country_id: 1269750
description:
2026-01-13 10:51:39 dovecot_login authenticator failed for H=([122.187.229.151]) [122.187.229.151]:41021: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.36.214.46
country_id: 3469034
description:
Jan 13 10:52:55 host2 sshd[2773072]: Disconnected from invalid user admin 177.36.214.46 port 54059 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.250.191.189
country_id: 458258
description:
2026-01-13 10:54:18 dovecot_login authenticator failed for H=([178.250.191.189]) [178.250.191.189]:39786: 535 Incorrect authentication data (set_id=admin@jrdc.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.110.237
country_id: 3144096
description:
2026-01-13 10:53:56 dovecot_login authenticator failed for H=(cm-46.212.110.237.get.no) [46.212.110.237]:41165: 535 Incorrect authentication data (set_id=admin@jrdc.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.145.33
country_id: 1819730
description:
2026-01-13 10:54:00 dovecot_login authenticator failed for H=(223-197-145-33.static.imsbiz.com) [223.197.145.33]:60675: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.99.40
country_id: 149590
description:
2026-01-13 10:54:17 dovecot_login authenticator failed for H=([41.59.99.40]) [41.59.99.40]:49543: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.18
country_id: 798549
description:
Jan 13 10:55:16 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=85.217.149.18, lip=66.85.158.92, session=<gPp9Nz5IhMdV2ZUS>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.36.214.46
country_id: 3469034
description:
Jan 13 10:55:23 host2 sshd[2775805]: Disconnected from invalid user ubuntu 177.36.214.46 port 48260 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.16.55
country_id: 3469034
description:
2026-01-13 10:54:37 dovecot_login authenticator failed for H=(177-174-16-55.user.vivozap.com.br) [177.174.16.55]:55060: 535 Incorrect authentication data (set_id=admin@jrdc.lk)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 159.223.20.91
country_id: 2921044
description:
Jan 13 10:55:45 host2 pure-ftpd[2776056]: (?@159.223.20.91) [INFO] New connection from 159.223.20.91


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.144
country_id: 1269750
description:
2026-01-13 10:56:08 dovecot_login authenticator failed for H=(nsg-corporate-144.230.187.122.airtel.in) [122.187.230.144]:34582: 535 Incorrect authentication data (set_id=abuse@neotechlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.165.78.31
country_id: 1819730
description:
2026-01-13 10:57:04 dovecot_login authenticator failed for H=([69.165.78.31]) [69.165.78.31]:59688: 535 Incorrect authentication data (set_id=abuse@neotechlk.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 13 10:59:17 host2 sshd[2778865]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 13 11:00:19 host2 sshd[2780064]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.52.122
country_id: 1269750
description:
2026-01-13 11:03:50 dovecot_login authenticator failed for H=([128.185.80.65]) [182.95.52.122]:52236: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.148.44.92
country_id: 2077456
description:
2026-01-13 11:04:22 dovecot_login authenticator failed for H=ip-206-148-44-92.internet.url.net.au [206.148.44.92]:35201: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.22
country_id: 798549
description:
Jan 13 11:04:40 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=85.217.149.22, lip=66.85.158.92, session=<NnYWWT5IcORV2ZUW>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 13 11:06:07 host2 sshd[2785114]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 40.76.167.156
country_id: 6252001
description:
Jan 13 11:05:55 host2 pure-ftpd[2784948]: (?@40.76.167.156) [INFO] New connection from 40.76.167.156


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.90.12.192
country_id: 6252001
description:
Jan 13 11:08:46 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.90.12.192, lip=66.85.158.91, TLS, session=<P/vGZz5IbrkDWgzA>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 83.143.29.114
country_id: 933860
description:
Jan 13 11:09:18 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=83.143.29.114, lip=66.85.158.91, TLS, session=<hxCCaD5IaI5Tjx1y>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.160.114.72
country_id: 1210997
description:
2026-01-13 11:09:19 dovecot_login authenticator failed for H=([182.160.114.72]) [182.160.114.72]:33320: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.95.200.219
country_id: 798544
description:
Jan 13 11:09:36 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<env_eng>, method=PLAIN, rip=109.95.200.219, lip=66.85.158.91, TLS, session=<CiHDaT5IaMltX8jb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.63.10
country_id: 1269750
description:
2026-01-13 11:09:56 dovecot_login authenticator failed for H=([182.95.63.10]) [182.95.63.10]:55444: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan 13 11:10:32 host2 sshd[2788585]: Disconnected from invalid user admin 2.57.121.112 port 18837 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 68.183.90.246
country_id: 1269750
description:
Jan 13 11:12:16 host2 pure-ftpd[2790111]: (?@68.183.90.246) [INFO] New connection from 68.183.90.246


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.249.234.70
country_id: 3469034
description:
Jan 13 11:13:29 host2 sshd[2791602]: Invalid user info@idesignvector.com from 186.249.234.70 port 56452


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.249.234.70
country_id: 3469034
description:
2026-01-13 11:13:13 dovecot_plain authenticator failed for H=(DFM-APP-02.dfm.local) [186.249.234.70]:53166: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 216.133.148.234
country_id: 6252001
description:
Jan 13 11:15:20 host2 sshd[2793173]: Disconnected from invalid user ftpadmin 216.133.148.234 port 34196 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.73.171.250
country_id: 149590
description:
Jan 13 11:15:55 host2 sshd[2793588]: Disconnected from invalid user github 154.73.171.250 port 21823 [preauth]


plugin: ossec
rule: 2501
name: User authentication failure.
description:
	cpanel::cpsrvd::do_token_denied("login failed", HASH(0x37642d0), undef, "jupiter") called at cpsrvd.pl line 5171


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 170.254.229.191
country_id: 3686110
description:
Jan 13 11:17:20 host2 sshd[2794987]: Disconnected from invalid user work 170.254.229.191 port 56646 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.74.243.17
country_id: 2510769
description:
Jan 13 11:18:02 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=185.74.243.17, lip=66.85.158.91, TLS, session=<11j1hz5Id9m5SvMR>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.73.171.250
country_id: 149590
description:
Jan 13 11:18:10 host2 sshd[2795685]: Disconnected from invalid user es 154.73.171.250 port 34998 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.250.88
country_id: 3865483
description:
Jan 13 11:18:23 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<env_eng>, method=PLAIN, rip=179.0.250.88, lip=66.85.158.91, TLS, session=<Pz0OiT5I4d6zAPpY>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.73.171.250
country_id: 149590
description:
Jan 13 11:18:52 host2 sshd[2796238]: Disconnected from invalid user test 154.73.171.250 port 16489 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 216.133.148.234
country_id: 6252001
description:
Jan 13 11:19:25 host2 sshd[2796661]: Disconnected from invalid user odoo13 216.133.148.234 port 47708 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 189.183.0.24
country_id: 3996063
description:
Jan 13 11:20:15 host2 sshd[2797458]: Disconnected from invalid user sysadmin 189.183.0.24 port 41976 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.5.112.200
country_id: 2510769
description:
2026-01-13 11:23:18 dovecot_login authenticator failed for H=200.red-88-5-112.dynamicip.rima-tde.net ([127.0.0.1]) [88.5.112.200]:41818: 535 Incorrect authentication data (set_id=kasunp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.255.2
country_id: 1269750
description:
2026-01-13 11:23:11 dovecot_login authenticator failed for H=([127.0.0.1]) [122.186.255.2]:46052: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.155.228.189
country_id: 2661886
description:
2026-01-13 11:32:48 dovecot_login authenticator failed for H=h95-155-228-189.cust.bredband2.com [95.155.228.189]:53129: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.92.66.188
country_id: 6251999
description:
2026-01-13 11:33:10 dovecot_login authenticator failed for H=([147.92.66.188]) [147.92.66.188]:43588: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 103.148.157.64
country_id: 1269750
description:
Jan 13 11:45:38 host2 pure-ftpd[2818080]: (?@103.148.157.64) [INFO] New connection from 103.148.157.64


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.124.229
country_id: 337996
description:
2026-01-13 11:47:55 dovecot_login authenticator failed for H=([196.189.124.229]) [196.189.124.229]:46384: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.219.149.74
country_id: 2328926
description:
2026-01-13 11:48:20 dovecot_login authenticator failed for H=(netcomafrica.com) [41.219.149.74]:41522: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.216.58
country_id: 1269750
description:
2026-01-13 11:48:49 dovecot_login authenticator failed for H=([152.52.234.148]) [125.19.216.58]:52832: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.103.27.217
country_id: 390903
description:
2026-01-13 11:48:16 dovecot_login authenticator failed for H=owniyj.static.otenet.gr ([2.85.77.70]) [62.103.27.217]:7392: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 35.195.241.97
country_id: 2802361
description:
Jan 13 11:48:21 host2 pure-ftpd[2820466]: (?@35.195.241.97) [INFO] New connection from 35.195.241.97


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.54.62.66
country_id: 3469034
description:
Jan 13 11:52:11 host2 sshd[2823205]: Disconnected from invalid user ubuntu 177.54.62.66 port 53832 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 187.62.87.27
country_id: 3469034
description:
Jan 13 11:53:22 host2 sshd[2824155]: Disconnected from invalid user ubuntu 187.62.87.27 port 56324 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.54.62.66
country_id: 3469034
description:
Jan 13 11:53:35 host2 sshd[2824306]: Disconnected from invalid user admin 177.54.62.66 port 58245 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 167.94.146.53
country_id: 6252001
description:
Jan 13 11:53:57 host2 pure-ftpd[2824588]: (?@167.94.146.53) [INFO] New connection from 167.94.146.53


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.31.210
country_id: 1269750
description:
2026-01-13 11:54:30 dovecot_login authenticator failed for H=(nsg-corporate-49.218.186.122.airtel.in) [103.251.31.210]:53840: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan 13 11:54:47 host2 sshd[2825588]: Disconnected from invalid user user 2.57.121.25 port 12406 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.124.221.2
country_id: 2750405
description:
2026-01-13 11:54:54 dovecot_login authenticator failed for H=ip-213-124-221-2.ip.prioritytelecom.net [213.124.221.2]:37648: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 177.54.62.66
country_id: 3469034
description:
Jan 13 11:54:57 host2 sshd[2825806]: Disconnected from invalid user admin 177.54.62.66 port 55574 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.54.62.66
country_id: 3469034
description:
Jan 13 11:54:19 host2 sshd[2824934]: Disconnected from invalid user admin 177.54.62.66 port 51827 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.118.126
country_id: 1269750
description:
2026-01-13 11:54:44 dovecot_login authenticator failed for H=(aes-static-097.188.22.125.airtel.in) [122.184.118.126]:60658: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.70.126
country_id: 1269750
description:
2026-01-13 11:55:08 dovecot_login authenticator failed for H=([122.185.222.137]) [182.78.70.126]:57806: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.56
country_id: 6252001
description:
Jan 13 11:55:33 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=167.94.146.56, lip=66.85.158.91, TLS: Connection closed, session=<QG8XDz9IcsWnXpI4>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.213.170
country_id: 1819730
description:
Jan 13 11:55:43 host2 sshd[2826658]: Disconnected from invalid user admin 152.32.213.170 port 50894 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.62.87.27
country_id: 3469034
description:
Jan 13 11:55:47 host2 sshd[2826781]: Disconnected from invalid user ubuntu 187.62.87.27 port 51764 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 117.232.85.78
country_id: 1269750
description:
Jan 13 11:55:21 host2 pure-ftpd[2826421]: (?@117.232.85.78) [INFO] New connection from 117.232.85.78


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.213.170
country_id: 1819730
description:
Jan 13 11:58:22 host2 sshd[2829119]: Disconnected from invalid user ubuntu 152.32.213.170 port 46442 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 142.79.227.70
country_id: 1269750
description:
Jan 13 11:59:26 host2 pure-ftpd[2830238]: (?@142.79.227.70) [INFO] New connection from 142.79.227.70


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 146.190.22.247
country_id: 2750405
description:
Jan 13 11:59:56 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=146.190.22.247, lip=66.85.158.91, session=<VCekHj9IUMOSvhb3>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.38
country_id: 2635167
description:
Jan 13 12:02:07 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.38, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<+tmSJj9IkaS594km>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.101
country_id: 2635167
description:
Jan 13 12:02:06 host2 dovecot[3239883]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=185.247.137.101, lip=66.85.158.91, TLS, session=<IaeCJj9IFdG594ll>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.51
country_id: 2635167
description:
Jan 13 12:02:40 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.51, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<5VGOKD9IC7S594kz>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 132.220.107.88
country_id: 2750405
description:
Jan 13 12:02:52 host2 pure-ftpd[2833357]: (?@132.220.107.88) [INFO] New connection from 132.220.107.88


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.41
country_id: 2635167
description:
Jan 13 12:03:14 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed: read(size=679) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=185.247.137.41, lip=66.85.158.91, TLS handshaking: read(size=679) failed: Connection reset by peer, session=</7SJKj9IE4y594kp>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.38
country_id: 2635167
description:
Jan 13 12:03:47 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed: read(size=693) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.38, lip=66.85.158.91, TLS handshaking: read(size=693) failed: Connection reset by peer, session=<0uqELD9Itaq594km>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.51
country_id: 2635167
description:
Jan 13 12:04:21 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed: read(size=612) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.51, lip=66.85.158.91, TLS handshaking: read(size=612) failed: Connection reset by peer, session=<VNWPLj9IiaZX7LAz>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.54
country_id: 2635167
description:
Jan 13 12:04:54 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=185.247.137.54, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<JzGJMD9I3dO594k2>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.42
country_id: 2635167
description:
Jan 13 12:05:28 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=87.236.176.42, lip=66.85.158.91, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<am6GMj9I49ZX7LAq>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.38
country_id: 2635167
description:
Jan 13 12:06:01 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.38, lip=66.85.158.91, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<guqBND9IC92594km>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.56
country_id: 2635167
description:
Jan 13 12:06:34 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=185.247.137.56, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<6yl7Nj9IwYS594k4>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.42
country_id: 2635167
description:
Jan 13 12:07:07 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=185.247.137.42, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<d2F2OD9IuYy594kq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.131.211.168
country_id: 690791
description:
2026-01-13 12:07:27 dovecot_login authenticator failed for H=([94.131.211.168]) [94.131.211.168]:52504: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.124.142.221
country_id: 3144096
description:
2026-01-13 12:07:41 dovecot_login authenticator failed for H=([188.124.142.221]) [188.124.142.221]:53747: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.224.169.28
country_id: 6252001
description:
2026-01-13 12:10:49 dovecot_plain authenticator failed for H=c-71-224-169-28.hsd1.pa.comcast.net (upurne) [71.224.169.28]:49386: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.208.177.56
country_id: 6252001
description:
2026-01-13 12:10:52 dovecot_login authenticator failed for H=([74.208.177.56]) [74.208.177.56]:50810: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.89.240.251
country_id: 1210997
description:
Jan 13 12:10:57 host2 sshd[2841000]: Disconnected from invalid user ubuntu 103.89.240.251 port 35758 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.174.63
country_id: 99237
description:
2026-01-13 12:11:07 dovecot_plain authenticator failed for H=(swintery) [65.20.174.63]:49049: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.227.134.232
country_id: 2921044
description:
Jan 13 12:10:16 host2 pure-ftpd[2840438]: (?@165.227.134.232) [INFO] New connection from 165.227.134.232


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.114.243.85
country_id: 3625428
description:
2026-01-13 12:10:26 dovecot_login authenticator failed for H=([190.114.243.80]) [190.114.243.85]:54058: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.165.130.26
country_id: 1643084
description:
Jan 13 12:12:29 host2 sshd[2842207]: Disconnected from invalid user ubuntu 103.165.130.26 port 6752 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.89.240.251
country_id: 1210997
description:
Jan 13 12:13:27 host2 sshd[2842936]: Disconnected from invalid user admin 103.89.240.251 port 40324 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.211.152.138
country_id: 3469034
description:
Jan 13 12:15:51 host2 sshd[2845031]: Disconnected from invalid user ubuntu 102.211.152.138 port 32914 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.67.56.52
country_id: 1643084
description:
Jan 13 12:15:20 host2 sshd[2844573]: Disconnected from invalid user ubuntu 36.67.56.52 port 3639 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.89.240.251
country_id: 1210997
description:
Jan 13 12:15:21 host2 sshd[2844575]: Disconnected from invalid user admin 103.89.240.251 port 33894 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.211.152.138
country_id: 3469034
description:
Jan 13 12:16:27 host2 sshd[2845511]: Disconnected from invalid user ubuntu 102.211.152.138 port 45816 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 102.211.152.138
country_id: 3469034
description:
Jan 13 12:17:05 host2 sshd[2846280]: Disconnected from invalid user admin 102.211.152.138 port 33222 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.248.104.19
country_id: 192950
description:
Jan 13 12:16:13 host2 sshd[2845305]: Disconnected from invalid user ubuntu 197.248.104.19 port 48260 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.248.104.19
country_id: 192950
description:
Jan 13 12:17:31 host2 sshd[2846633]: Disconnected from invalid user ubuntu 197.248.104.19 port 59314 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.208
country_id: 6252001
description:
Jan 13 12:19:00 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=205.210.31.208, lip=66.85.158.92, session=<WKTrYj9IuubN0h/Q>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 197.248.104.19
country_id: 192950
description:
Jan 13 12:19:26 host2 sshd[2848145]: Disconnected from invalid user ubuntu 197.248.104.19 port 44876 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.211.152.138
country_id: 3469034
description:
Jan 13 12:19:39 host2 sshd[2848318]: Disconnected from invalid user ubuntu 102.211.152.138 port 52530 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.165.130.26
country_id: 1643084
description:
Jan 13 12:21:35 host2 sshd[2850615]: Disconnected from invalid user admin 103.165.130.26 port 6755 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan 13 12:24:55 host2 sshd[2853490]: Disconnected from invalid user admin 2.57.121.112 port 39498 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.87.1.47
country_id: 2510769
description:
Jan 13 12:25:18 host2 sshd[2853991]: Disconnected from invalid user ubuntu 85.87.1.47 port 6847 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.51.110
country_id: 953987
description:
Jan 13 12:26:09 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=102.129.51.110, lip=66.85.158.91, TLS, session=<sGVRez9IBO1mgTNu>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.87.1.47
country_id: 2510769
description:
Jan 13 12:26:14 host2 sshd[2854761]: Disconnected from invalid user ubuntu 85.87.1.47 port 6423 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.135.238
country_id: 99237
description:
Jan 13 12:26:27 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<careers>, method=PLAIN, rip=65.20.135.238, lip=66.85.158.91, TLS, session=<jGOhfD9ITpVBFIfu>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan 13 12:27:30 host2 sshd[2855571]: Disconnected from invalid user admin 2.57.121.112 port 48570 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.88.10.10
country_id: 2328926
description:
2026-01-13 12:29:39 dovecot_login authenticator failed for H=([102.88.10.10]) [102.88.10.10]:56704: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.162.73
country_id: 2186224
description:
2026-01-13 12:30:02 dovecot_login authenticator failed for H=([121.73.162.73]) [121.73.162.73]:51114: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.20
country_id: 1269750
description:
2026-01-13 12:30:02 dovecot_login authenticator failed for H=([122.187.230.20]) [122.187.230.20]:55238: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 162.240.173.20
country_id: 6252001
description:
Jan 13 12:30:06 host2 pure-ftpd[2857532]: (?@162.240.173.20) [INFO] New connection from 162.240.173.20


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.250.93
country_id: 99237
description:
2026-01-13 12:30:19 dovecot_login authenticator failed for H=([65.20.250.93]) [65.20.250.93]:55169: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 38.242.212.239
country_id: 3017382
description:
Jan 13 12:31:21 host2 pure-ftpd[2858558]: (?@38.242.212.239) [INFO] New connection from 38.242.212.239


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.116.22
country_id: 1861060
description:
Jan 13 12:33:00 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=139.162.116.22, lip=66.85.158.91, TLS: Connection closed, session=<FecGlT9IjMGLonQW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.82.212.15
country_id: 2510769
description:
2026-01-13 12:36:12 dovecot_login authenticator failed for H=([88.82.212.15]) [88.82.212.15]:43598: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.202.197.108
country_id: 6252001
description:
2026-01-13 12:36:49 dovecot_plain authenticator failed for H=(osanchexat) [50.202.197.108]:47427: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
country_id: 1643084
description:
2026-01-13 12:37:01 dovecot_login authenticator failed for H=(ip-103-29-185-162.pascalwave.com) [103.29.185.162]:57788: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 13 12:42:05 host2 sshd[2867346]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.215.74.195
country_id: 2661886
description:
2026-01-13 12:41:47 dovecot_plain authenticator failed for H=217-215-74-195-no2620.tbcn.telia.com (asseparate) [217.215.74.195]:33871: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.235.225.181
country_id: 6252001
description:
2026-01-13 12:41:50 dovecot_plain authenticator failed for H=c-71-235-225-181.hsd1.ct.comcast.net (hynismous) [71.235.225.181]:35322: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 13 12:43:07 host2 sshd[2868501]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.37.98.107
country_id: 3469034
description:
Jan 13 12:42:48 host2 sshd[2868089]: Disconnected from invalid user admin 177.37.98.107 port 32469 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.49.117.132
country_id: 3686110
description:
Jan 13 12:44:20 host2 sshd[2869726]: Disconnected from invalid user ubuntu 181.49.117.132 port 58852 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.37.98.107
country_id: 3469034
description:
Jan 13 12:45:14 host2 sshd[2870774]: Disconnected from invalid user admin 177.37.98.107 port 31153 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 181.49.117.132
country_id: 3686110
description:
Jan 13 12:45:20 host2 sshd[2870940]: Disconnected from invalid user ubuntu 181.49.117.132 port 41826 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.49.117.132
country_id: 3686110
description:
Jan 13 12:48:17 host2 sshd[2874300]: Disconnected from invalid user ubuntu 181.49.117.132 port 47206 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.93.249.106
country_id: 1643084
description:
Jan 13 12:48:22 host2 sshd[2874391]: Disconnected from invalid user admin 36.93.249.106 port 56684 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.99.14
country_id: 290557
description:
2026-01-13 12:48:36 dovecot_login authenticator failed for H=([5.32.99.14]) [5.32.99.14]:44217: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.125.124.14
country_id: 3469034
description:
2026-01-13 12:48:15 dovecot_login authenticator failed for H=(vtx-b-124-014.virtex.com.br) [179.125.124.14]:51380: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.228
country_id: 1269750
description:
2026-01-13 12:48:21 dovecot_login authenticator failed for H=(nsg-corporate-228.228.187.122.airtel.in) [122.187.228.228]:50588: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 110.238.75.92
country_id: 953987
description:
Jan 13 12:48:23 host2 sshd[2874406]: Disconnected from invalid user ubuntu 110.238.75.92 port 28779 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.150.135.19
country_id: 690791
description:
2026-01-13 12:48:34 dovecot_login authenticator failed for H=(19.135.150.178.triolan.net) [178.150.135.19]:6619: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 177.37.98.107
country_id: 3469034
description:
Jan 13 12:48:35 host2 sshd[2874498]: Disconnected from invalid user ubuntu 177.37.98.107 port 29599 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 130.250.191.229
country_id: 1269750
description:
Jan 13 12:48:43 host2 sshd[2874694]: Disconnected from invalid user admin 130.250.191.229 port 33748 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 130.250.191.229
country_id: 1269750
description:
Jan 13 12:50:00 host2 sshd[2875806]: Disconnected from invalid user admin 130.250.191.229 port 45628 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.93.249.106
country_id: 1643084
description:
Jan 13 12:50:20 host2 sshd[2876409]: Disconnected from invalid user admin 36.93.249.106 port 54250 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.247.23.131
country_id: 1269750
description:
Jan 13 12:55:02 host2 sshd[2880635]: Disconnected from invalid user ubuntu 117.247.23.131 port 43728 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 20.173.116.24
country_id: 289688
description:
Jan 13 12:55:29 host2 sshd[2881356]: Disconnected from invalid user admin 20.173.116.24 port 56038 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.227.164.153
country_id: 1269750
description:
Jan 13 12:55:54 host2 dovecot[3239883]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=64.227.164.153, lip=66.85.158.91, TLS, session=<ysTq5j9IiIRA46SZ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.107.10.66
country_id: 2921044
description:
Jan 13 12:57:44 host2 sshd[2883212]: Disconnected from invalid user tests 89.107.10.66 port 59398 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.230.142.81
country_id: 6252001
description:
Jan 13 12:58:21 host2 sshd[2883689]: Disconnected from invalid user builder 157.230.142.81 port 45640 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.186.40.250
country_id: 3895114
description:
Jan 13 12:59:36 host2 sshd[2884690]: Disconnected from invalid user deploytest 201.186.40.250 port 44316 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.146.202.174
country_id: 1643084
description:
Jan 13 12:59:11 host2 sshd[2884269]: Disconnected from invalid user tunnel 103.146.202.174 port 36158 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 201.186.40.250
country_id: 3895114
description:
Jan 13 13:01:44 host2 sshd[2886665]: Disconnected from invalid user newuser 201.186.40.250 port 46676 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 72.167.47.211
country_id: 6252001
description:
Jan 13 13:02:15 host2 pure-ftpd[2887085]: (?@72.167.47.211) [INFO] New connection from 72.167.47.211


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.186.40.250
country_id: 3895114
description:
Jan 13 13:02:25 host2 sshd[2887212]: Disconnected from invalid user ark 201.186.40.250 port 58066 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.107.10.66
country_id: 2921044
description:
Jan 13 13:03:29 host2 sshd[2888203]: Disconnected from invalid user administrador 89.107.10.66 port 41150 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.230.142.81
country_id: 6252001
description:
Jan 13 13:04:25 host2 sshd[2889282]: Disconnected from invalid user ftpadmin 157.230.142.81 port 39404 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.179.137.212
country_id: 3865483
description:
Jan 13 13:04:22 host2 sshd[2889171]: Disconnected from invalid user ssh-user 190.179.137.212 port 52442 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 109.206.241.199
country_id: 453733
description:
Jan 13 13:04:35 host2 sshd[2889460]: Disconnected from invalid user ts 109.206.241.199 port 45504 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 89.107.10.66
country_id: 2921044
description:
Jan 13 13:04:50 host2 sshd[2889714]: Disconnected from invalid user builder 89.107.10.66 port 60250 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.157.95.30
country_id: 6251999
description:
2026-01-13 13:06:09 dovecot_login authenticator failed for H=d157-95-30.home4.cgocable.net [24.157.95.30]:32888: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.230.142.81
country_id: 6252001
description:
Jan 13 13:05:30 host2 sshd[2890461]: Disconnected from invalid user web 157.230.142.81 port 46952 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.193.178.214
country_id: 1643084
description:
Jan 13 13:05:32 host2 sshd[2890420]: Disconnected from invalid user service 103.193.178.214 port 58662 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.173.78.90
country_id: 2510769
description:
2026-01-13 13:06:30 dovecot_login authenticator failed for H=(90.pool90-173-78.static.orange.es) [90.173.78.90]:49866: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.233.110
country_id: 99237
description:
2026-01-13 13:06:43 dovecot_login authenticator failed for H=([65.20.233.110]) [65.20.233.110]:39364: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.179.137.212
country_id: 3865483
description:
Jan 13 13:06:11 host2 sshd[2891080]: Disconnected from invalid user dockertest 190.179.137.212 port 60258 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.146.202.174
country_id: 1643084
description:
Jan 13 13:07:39 host2 sshd[2892642]: Disconnected from invalid user deploytest 103.146.202.174 port 56248 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 155.4.244.169
country_id: 2661886
description:
Jan 13 13:15:47 host2 sshd[2900253]: Disconnected from invalid user steam 155.4.244.169 port 27725 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 155.4.244.169
country_id: 2661886
description:
Jan 13 13:16:24 host2 sshd[2900923]: Disconnected from invalid user sshadmin 155.4.244.169 port 26480 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.153.28.138
country_id: 6252001
description:
Jan 13 13:16:37 host2 sshd[2901124]: Disconnected from invalid user github 43.153.28.138 port 42626 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 94.102.4.12
country_id: 298795
description:
Jan 13 13:17:22 host2 sshd[2902033]: Disconnected from invalid user ftp-admin 94.102.4.12 port 33134 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 136.232.11.10
country_id: 1269750
description:
Jan 13 13:17:50 host2 sshd[2902382]: Disconnected from invalid user developer 136.232.11.10 port 20523 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 94.102.4.12
country_id: 298795
description:
Jan 13 13:17:55 host2 sshd[2902440]: Disconnected from invalid user vpn 94.102.4.12 port 44040 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.58.114
country_id: 1269750
description:
2026-01-13 13:18:02 dovecot_login authenticator failed for H=([182.95.58.114]) [182.95.58.114]:43500: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.153.28.138
country_id: 6252001
description:
Jan 13 13:17:12 host2 sshd[2901916]: Disconnected from invalid user user 43.153.28.138 port 54280 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.66
country_id: 1149361
description:
2026-01-13 13:18:21 dovecot_login authenticator failed for H=([149.54.62.66]) [149.54.62.66]:60740: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.179.27.94
country_id: 1643084
description:
Jan 13 13:18:31 host2 sshd[2902870]: Disconnected from invalid user tester 103.179.27.94 port 42874 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.96.151.198
country_id: 3996063
description:
Jan 13 13:18:33 host2 sshd[2902925]: Disconnected from invalid user socksuser 186.96.151.198 port 59534 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.66.2.184
country_id: 390903
description:
2026-01-13 13:19:03 dovecot_login authenticator failed for H=orz58h.static.otenet.gr [94.66.2.184]:35112: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 186.96.151.198
country_id: 3996063
description:
Jan 13 13:19:42 host2 sshd[2903786]: Disconnected from invalid user tests 186.96.151.198 port 35604 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.127.90.34
country_id: 2440476
description:
2026-01-13 13:19:47 dovecot_login authenticator failed for H=([154.127.90.34]) [154.127.90.34]:46671: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.179.27.94
country_id: 1643084
description:
Jan 13 13:20:27 host2 sshd[2904532]: Disconnected from invalid user sammy 103.179.27.94 port 42304 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.29.225.206
country_id: 1605651
description:
Jan 13 13:20:42 host2 sshd[2904712]: Disconnected from invalid user user1 202.29.225.206 port 33060 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.96.151.198
country_id: 3996063
description:
Jan 13 13:20:16 host2 sshd[2904377]: Disconnected from invalid user remote 186.96.151.198 port 55914 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.223.80
country_id: 1880251
description:
Jan 13 13:21:05 host2 sshd[2904942]: Disconnected from invalid user builder 45.78.223.80 port 52220 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 202.29.225.206
country_id: 1605651
description:
Jan 13 13:21:22 host2 sshd[2905173]: Disconnected from invalid user odoo15 202.29.225.206 port 44264 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.183.74.130
country_id: 1643084
description:
Jan 13 13:21:31 host2 sshd[2905237]: Disconnected from invalid user socksuser 103.183.74.130 port 39172 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 136.232.11.10
country_id: 1269750
description:
Jan 13 13:23:28 host2 sshd[2906937]: Disconnected from invalid user botuser1 136.232.11.10 port 8831 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.237.115.206
country_id: 732800
description:
2026-01-13 13:23:53 dovecot_login authenticator failed for H=(151.237.115.206.pronet.bg) [151.237.115.206]:55473: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.80
country_id: 1269750
description:
2026-01-13 13:24:07 dovecot_login authenticator failed for H=([122.187.229.80]) [122.187.229.80]:45077: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 77.83.39.144
country_id: 690791
description:
Jan 13 13:26:43 host2 sshd[2909274]: Invalid user cloudtourssrilan_travel from 77.83.39.144 port 41666


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 77.83.39.144
country_id: 690791
description:
[2026-01-13 13:26:49 +0530] info [cpaneld] 77.83.39.144 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilan_travel (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.184.94.75
country_id: 2328926
description:
Jan 13 13:32:43 host2 sshd[2913626]: Disconnected from invalid user admin 41.184.94.75 port 39750 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.55.194.114
country_id: 6252001
description:
2026-01-13 13:33:24 dovecot_plain authenticator failed for H=c-73-55-194-114.hsd1.tx.comcast.net (enrakenoic) [73.55.194.114]:46726: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.127.53.61
country_id: 6252001
description:
2026-01-13 13:33:21 dovecot_plain authenticator failed for H=c-24-127-53-61.hsd1.mi.comcast.net (mendam) [24.127.53.61]:54272: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.89.197.82
country_id: 2186224
description:
2026-01-13 13:34:42 dovecot_login authenticator failed for H=219-89-197-82.adsl.xtra.co.nz [219.89.197.82]:50840: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.16.55
country_id: 3469034
description:
2026-01-13 13:34:16 dovecot_login authenticator failed for H=(177-174-16-81.user.vivozap.com.br) [177.174.16.55]:57563: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.70.134
country_id: 1819730
description:
2026-01-13 13:36:02 dovecot_login authenticator failed for H=42-200-70-134.static.imsbiz.com [42.200.70.134]:48542: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.168.241.32
country_id: 1269750
description:
2026-01-13 13:35:25 dovecot_login authenticator failed for H=([103.168.241.32]) [103.168.241.32]:32830: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.10.197.168
country_id: 2661886
description:
2026-01-13 13:36:51 dovecot_login authenticator failed for H=h-176-10-197-168.a444.priv.bahnhof.se [176.10.197.168]:47562: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.164.35.116
country_id: 2328926
description:
Jan 13 13:37:01 host2 sshd[2916698]: Disconnected from invalid user ubuntu 102.164.35.116 port 45494 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.164.35.116
country_id: 2328926
description:
Jan 13 13:38:26 host2 sshd[2917799]: Disconnected from invalid user ubuntu 102.164.35.116 port 41976 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 102.164.35.116
country_id: 2328926
description:
Jan 13 13:39:03 host2 sshd[2918372]: Disconnected from invalid user ubuntu 102.164.35.116 port 44028 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.164.35.116
country_id: 2328926
description:
Jan 13 13:39:39 host2 sshd[2918832]: Disconnected from invalid user ubuntu 102.164.35.116 port 45676 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.202.20.23
country_id: 6252001
description:
Jan 13 13:40:12 host2 dovecot[3239883]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=44.202.20.23, lip=66.85.158.91, session=<D2lRhUBIeJIsyhQX>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-01-13 13:40:15 dovecot_plain authenticator failed for H=(parare) [64.72.74.162]:47283: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.174.199
country_id: 1819730
description:
Jan 13 13:40:38 host2 sshd[2919794]: Disconnected from invalid user ubuntu 152.32.174.199 port 50548 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.174.199
country_id: 1819730
description:
Jan 13 13:41:15 host2 sshd[2920229]: Disconnected from invalid user admin 152.32.174.199 port 41268 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.51.135
country_id: 3144096
description:
2026-01-13 13:41:42 dovecot_login authenticator failed for H=([178.232.51.135]) [178.232.51.135]:49031: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.111.110
country_id: 1269750
description:
2026-01-13 13:42:02 dovecot_login authenticator failed for H=([182.75.152.97]) [27.123.111.110]:41280: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.239.10.198
country_id: 357994
description:
2026-01-13 13:42:16 dovecot_login authenticator failed for H=([154.239.10.205]) [154.239.10.198]:36346: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.162.86
country_id: 2186224
description:
2026-01-13 13:42:27 dovecot_login authenticator failed for H=([127.0.0.1]) [121.73.162.86]:57644: 535 Incorrect authentication data (set_id=art@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.87
country_id: 2186224
description:
2026-01-13 13:42:41 dovecot_login authenticator failed for H=([127.0.0.1]) [121.73.163.87]:47294: 535 Incorrect authentication data (set_id=art)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.0.8.204
country_id: 3469034
description:
2026-01-13 13:43:28 dovecot_login authenticator failed for H=([206.0.8.204]) [206.0.8.204]:36504: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.236.145.128
country_id: 6252001
description:
2026-01-13 13:43:41 dovecot_login authenticator failed for H=(node12.vindb.org) [104.236.145.128]:54819: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.248
country_id: 1733045
description:
2026-01-13 13:45:59 dovecot_login authenticator failed for H=([49.124.152.248]) [49.124.152.248]:35850: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.29.26
country_id: 3144096
description:
2026-01-13 13:46:26 dovecot_login authenticator failed for H=(cm-178.232.29.26.get.no) [178.232.29.26]:39687: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.114.130
country_id: 1269750
description:
2026-01-13 13:46:49 dovecot_login authenticator failed for H=([27.123.114.130]) [27.123.114.130]:37142: 535 Incorrect authentication data (set_id=abuse@kamecho.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.222.51.149
country_id: 2510769
description:
2026-01-13 13:47:01 dovecot_login authenticator failed for H=149.51.222.87.dynamic.jazztel.es [87.222.51.149]:49948: 535 Incorrect authentication data (set_id=abuse)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.171.53.82
country_id: 1733045
description:
2026-01-13 13:46:14 dovecot_login authenticator failed for H=([183.171.53.82]) [183.171.53.82]:51408: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.104.11.51
country_id: 6252001
description:
Jan 13 13:50:04 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=172.104.11.51, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<BVqbqEBIXq2saAsz>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 122.166.56.233
country_id: 1269750
description:
Jan 13 13:50:27 host2 pure-ftpd[2927695]: (?@122.166.56.233) [INFO] New connection from 122.166.56.233


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.115.173.11
country_id: 1269750
description:
2026-01-13 13:50:49 dovecot_login authenticator failed for H=([45.115.173.11]) [45.115.173.11]:35750: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.160.206
country_id: 1269750
description:
2026-01-13 13:50:24 dovecot_login authenticator failed for H=([125.19.160.206]) [125.19.160.206]:35614: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.102.122
country_id: 1269750
description:
2026-01-13 13:53:18 dovecot_login authenticator failed for H=([125.18.219.209]) [27.123.102.122]:39188: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.211.94.35
country_id: 289688
description:
2026-01-13 13:53:30 dovecot_login authenticator failed for H=([37.211.94.35]) [37.211.94.35]:9539: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.207.66.154
country_id: 6251999
description:
2026-01-13 13:55:46 dovecot_login authenticator failed for H=host-24-207-66-154.public.eastlink.ca [24.207.66.154]:54774: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.63.10
country_id: 1269750
description:
2026-01-13 13:56:15 dovecot_login authenticator failed for H=(nsg-static-177.160.71.182.airtel.in) [182.95.63.10]:51278: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.164.148.87
country_id: 1512440
description:
2026-01-13 13:57:17 dovecot_login authenticator failed for H=([62.164.148.87]) [62.164.148.87]:49142: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.43.109
country_id: 1819730
description:
2026-01-13 13:57:37 dovecot_login authenticator failed for H=109.43.246.220.static.netvigator.com [220.246.43.109]:63091: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.208.46.130
country_id: 1522867
description:
2026-01-13 13:58:00 dovecot_login authenticator failed for H=([37.208.46.130]) [37.208.46.130]:48799: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.219.149.74
country_id: 2328926
description:
2026-01-13 13:58:49 dovecot_login authenticator failed for H=(netcomafrica.com) [41.219.149.74]:37893: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.78
country_id: 1269750
description:
2026-01-13 13:59:10 dovecot_login authenticator failed for H=(nsg-corporate-186.152.185.122.airtel.in) [182.95.178.78]:55248: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.151.88.27
country_id: 6251999
description:
2026-01-13 13:59:36 dovecot_login authenticator failed for H=([184.151.88.27]) [184.151.88.27]:48918: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.182.166
country_id: 1269750
description:
2026-01-13 14:00:22 dovecot_login authenticator failed for H=([127.0.0.1]) [182.95.182.166]:50636: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.183.30
country_id: 1269750
description:
2026-01-13 14:00:38 dovecot_login authenticator failed for H=([127.0.0.1]) [182.95.183.30]:41984: 535 Incorrect authentication data (set_id=kasunp)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.79.207.111
country_id: 6252001
description:
Jan 13 14:01:52 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 7 secs): user=<>, rip=45.79.207.111, lip=66.85.158.92, TLS handshaking: read(size=1026) failed: Connection reset by peer, session=<PPPZ0kBIOdotT89v>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 195.158.9.235
country_id: 1512440
description:
Jan 13 14:01:56 host2 pure-ftpd[2937441]: (?@195.158.9.235) [INFO] New connection from 195.158.9.235


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.27.253.6
country_id: 1168579
description:
2026-01-13 14:01:37 dovecot_login authenticator failed for H=(58-27-253-6.wateen.net) [58.27.253.6]:49172: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.207.66.154
country_id: 6251999
description:
2026-01-13 14:01:49 dovecot_login authenticator failed for H=host-24-207-66-154.public.eastlink.ca [24.207.66.154]:52480: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.51.126.17
country_id: 6252001
description:
Jan 13 14:03:34 host2 sshd[2938611]: Disconnected from invalid user ts3 158.51.126.17 port 59718 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 129.148.36.96
country_id: 3469034
description:
Jan 13 14:04:21 host2 sshd[2939131]: Disconnected from invalid user deploytest 129.148.36.96 port 40740 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 57.134.138.161
country_id: 6251999
description:
Jan 13 14:04:35 host2 sshd[2939320]: Disconnected from invalid user varnish 57.134.138.161 port 48608 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.51.126.17
country_id: 6252001
description:
Jan 13 14:04:36 host2 sshd[2939326]: Disconnected from invalid user rstudio 158.51.126.17 port 47722 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 158.51.126.17
country_id: 6252001
description:
Jan 13 14:05:09 host2 sshd[2940114]: Disconnected from invalid user service 158.51.126.17 port 59014 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.228.53.174
country_id: 6252001
description:
Jan 13 14:05:21 host2 dovecot[3239883]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=66.228.53.174, lip=66.85.158.92, TLS, session=<BZ9O30BIdrdC5DWu>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.169
country_id: 6252001
description:
Jan 13 14:05:26 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.169, lip=66.85.158.92, TLS, session=<FnmR30BIEuPG6xip>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.75.42
country_id: 1149361
description:
2026-01-13 14:06:40 dovecot_login authenticator failed for H=([180.94.75.42]) [180.94.75.42]:40217: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 57.134.138.161
country_id: 6251999
description:
Jan 13 14:07:43 host2 sshd[2943145]: Disconnected from invalid user c 57.134.138.161 port 45406 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.76.120.191
country_id: 1643084
description:
Jan 13 14:07:47 host2 sshd[2943165]: Disconnected from invalid user odoo15 103.76.120.191 port 45466 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.189.124.195
country_id: 337996
description:
Jan 13 14:07:53 host2 sshd[2943248]: Disconnected from invalid user service 196.189.124.195 port 41674 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.144.233.139
country_id: 2921044
description:
Jan 13 14:08:00 host2 sshd[2943325]: Disconnected from invalid user webtest 45.144.233.139 port 40932 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.156.82.86
country_id: 1880251
description:
2026-01-13 14:07:08 dovecot_login authenticator failed for H=(86.82.156.175.unknown.m1.com.sg) [175.156.82.86]:47231: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 57.134.138.161
country_id: 6251999
description:
Jan 13 14:08:16 host2 sshd[2943551]: Disconnected from invalid user web 57.134.138.161 port 60646 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.144.233.139
country_id: 2921044
description:
Jan 13 14:08:32 host2 sshd[2943746]: Disconnected from invalid user service 45.144.233.139 port 33930 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 129.148.36.96
country_id: 3469034
description:
Jan 13 14:08:36 host2 sshd[2943809]: Disconnected from invalid user develop 129.148.36.96 port 42290 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 57.128.188.106
country_id: 3017382
description:
Jan 13 14:08:43 host2 pure-ftpd[2943905]: (?@57.128.188.106) [INFO] New connection from 57.128.188.106


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.110.237
country_id: 3144096
description:
2026-01-13 14:09:07 dovecot_login authenticator failed for H=(cm-46.212.110.237.get.no) [46.212.110.237]:43359: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
country_id: 1643084
description:
2026-01-13 14:09:22 dovecot_login authenticator failed for H=(ip-103-29-185-162.pascalwave.com) [103.29.185.162]:51458: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 57.134.138.161
country_id: 6251999
description:
Jan 13 14:09:20 host2 sshd[2944469]: Disconnected from invalid user jenkins 57.134.138.161 port 39954 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 129.148.36.96
country_id: 3469034
description:
Jan 13 14:09:25 host2 sshd[2944504]: Disconnected from invalid user splunk 129.148.36.96 port 42164 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 212.102.40.218
country_id: 6252001
description:
Jan 13 14:09:39 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=212.102.40.218, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<6Tel7kBISljUZija>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 15.204.140.61
country_id: 6252001
description:
Jan 13 14:10:06 host2 pure-ftpd[2945392]: (?@15.204.140.61) [INFO] New connection from 15.204.140.61


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 129.148.36.96
country_id: 3469034
description:
Jan 13 14:10:19 host2 sshd[2945762]: Disconnected from invalid user ts1 129.148.36.96 port 48696 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.169.104.237
country_id: 6252001
description:
Jan 13 14:10:44 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.169.104.237, lip=66.85.158.92, TLS, session=<miWG8kBIDKsUqWjt>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.189.124.195
country_id: 337996
description:
Jan 13 14:11:28 host2 sshd[2946959]: Disconnected from invalid user a 196.189.124.195 port 55204 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 196.189.124.195
country_id: 337996
description:
Jan 13 14:12:22 host2 sshd[2947790]: Disconnected from invalid user ssh-user 196.189.124.195 port 38850 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Jan 13 14:15:40 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<PxIrBEFIUoMDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Jan 13 14:16:10 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, TLS handshaking: Connection closed, session=<I6b4BUFINsIDiUnd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan 13 14:18:19 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@seyawin.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<fHmKDUFIMLx100Db>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Jan 13 14:18:34 host2 dovecot[3239883]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, TLS, session=<iSeODkFI7qQDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Jan 13 14:19:51 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<t/0eE0FItJADiUnd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.18.166.74
country_id: 1269750
description:
Jan 13 14:19:56 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 27 secs): user=<env_eng>, method=PLAIN, rip=103.18.166.74, lip=66.85.158.91, TLS, session=<4k/YEUFIeMFnEqZK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.213.194.137
country_id: 1269750
description:
Jan 13 14:19:26 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=103.213.194.137, lip=66.85.158.91, TLS, session=<cD6TEEFIj4xn1cKJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.126.241.118
country_id: 2661886
description:
2026-01-13 14:19:31 dovecot_login authenticator failed for H=([127.0.0.1]) [188.126.241.118]:34866: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 191.243.56.183
country_id: 3469034
description:
Jan 13 14:20:17 host2 sshd[2955364]: Disconnected from invalid user admin 191.243.56.183 port 28743 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Jan 13 14:20:43 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, TLS handshaking: Connection closed, session=<q09DFkFIdJoDiUnd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.206.119
country_id: 1819730
description:
2026-01-13 14:22:05 dovecot_login authenticator failed for H=(m121-202-206-119.smartone.com) [121.202.206.119]:60330: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.45.200.87
country_id: 2077456
description:
2026-01-13 14:21:29 dovecot_login authenticator failed for H=([203.45.200.87]) [203.45.200.87]:33972: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Jan 13 14:21:30 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, TLS, session=<PGsPGUFI3skDiUnd>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.116.206.194
country_id: 1269750
description:
Jan 13 14:22:00 host2 pure-ftpd[2956818]: (?@66.116.206.194) [INFO] New connection from 66.116.206.194


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 34.78.138.227
country_id: 2802361
description:
Jan 13 14:22:51 host2 pure-ftpd[2957493]: (?@34.78.138.227) [INFO] New connection from 34.78.138.227


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 13 14:24:50 host2 sshd[2959129]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 191.243.56.183
country_id: 3469034
description:
Jan 13 14:24:16 host2 sshd[2958651]: Disconnected from invalid user ubuntu 191.243.56.183 port 4980 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 13 14:25:52 host2 sshd[2960137]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 191.243.56.183
country_id: 3469034
description:
Jan 13 14:25:29 host2 sshd[2959796]: Disconnected from invalid user ubuntu 191.243.56.183 port 38258 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 118.193.37.10
country_id: 1819730
description:
Jan 13 14:25:38 host2 pure-ftpd[2959954]: (?@118.193.37.10) [INFO] New connection from 118.193.37.10


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 164.92.194.83
country_id: 2921044
description:
Jan 13 14:25:38 host2 pure-ftpd[2959939]: (?@164.92.194.83) [INFO] New connection from 164.92.194.83


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 191.243.56.183
country_id: 3469034
description:
Jan 13 14:26:07 host2 sshd[2960406]: Disconnected from invalid user admin 191.243.56.183 port 54773 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.165.174.234
country_id: 1269750
description:
2026-01-13 14:26:19 dovecot_login authenticator failed for H=([103.165.174.234]) [103.165.174.234]:53685: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.2
country_id: 1269750
description:
2026-01-13 14:26:36 dovecot_login authenticator failed for H=([125.20.223.161]) [152.52.236.2]:58804: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.46.214.110
country_id: 3703430
description:
2026-01-13 14:32:00 dovecot_login authenticator failed for H=(104.214.46.200.psinetpa.net) [200.46.214.110]:47896: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.58.62
country_id: 1269750
description:
2026-01-13 14:31:42 dovecot_login authenticator failed for H=([125.19.70.49]) [182.95.58.62]:58338: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.213
country_id: 3017382
description:
Jan 13 14:32:19 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=91.231.89.213, lip=66.85.158.92, TLS: Connection closed, session=<Bne/P0FIdcFb51nV>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.209
country_id: 3017382
description:
Jan 13 14:32:32 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=91.231.89.209, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<dkWHQEFIQZtb51nR>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.211
country_id: 3017382
description:
Jan 13 14:32:36 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.231.89.211, lip=66.85.158.92, TLS: Connection closed, session=<Gli3QEFIu5tb51nT>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.214
country_id: 3017382
description:
Jan 13 14:32:09 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=91.231.89.214, lip=66.85.158.92, TLS handshaking: Connection closed, session=<j08bP0FIJZVb51nW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.116.247.26
country_id: 1522867
description:
2026-01-13 14:32:59 dovecot_plain authenticator failed for H=(shlikah) [212.116.247.26]:59534: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.100.41.198
country_id: 798549
description:
Jan 13 14:33:57 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<marketing@lezzarotech.com>, method=PLAIN, rip=109.100.41.198, lip=66.85.158.91, TLS, session=<Mq6VREFIj+RtZCnG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.213.230.122
country_id: 6252001
description:
Jan 13 14:34:15 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<marketing>, method=PLAIN, rip=67.213.230.122, lip=66.85.158.91, TLS, session=<9gGqRUFIod5D1eZ6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.90.12.192
country_id: 6252001
description:
Jan 13 14:35:59 host2 dovecot[3239883]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.90.12.192, lip=66.85.158.92, session=<sijUTEFIOowDWgzA>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 181.215.193.122
country_id: 298795
description:
Jan 13 14:36:20 host2 pure-ftpd[2969466]: (?@181.215.193.122) [INFO] New connection from 181.215.193.122


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 71.6.146.185
country_id: 6252001
description:
Jan 13 14:37:02 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record (no auth attempts in 0 secs): user=<>, rip=71.6.146.185, lip=66.85.158.91, TLS: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record, session=<bSGfUEFI3JBHBpK5>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 71.6.146.185
country_id: 6252001
description:
Jan 13 14:37:08 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=71.6.146.185, lip=66.85.158.91, TLS handshaking: Connection closed, session=<+NPuUEFIHplHBpK5>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.43
country_id: 3017382
description:
Jan 13 14:40:39 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=91.231.89.43, lip=66.85.158.92, TLS: Connection closed, session=<SduIXUFIP7pb51kr>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.41
country_id: 3017382
description:
Jan 13 14:40:52 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=91.231.89.41, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=</H1SXkFIaexb51kp>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.44
country_id: 3017382
description:
Jan 13 14:40:55 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.231.89.44, lip=66.85.158.92, TLS: Connection closed, session=<GpWCXkFI2Z5b51ks>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.42
country_id: 3017382
description:
Jan 13 14:40:28 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=91.231.89.42, lip=66.85.158.92, TLS handshaking: Connection closed, session=<ohDnXEFIVeFb51kq>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.163.15.225
country_id: 6252001
description:
Jan 13 14:46:08 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.163.15.225, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<jpUocUFI/rIUow/h>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.222.81.115
country_id: 6252001
description:
Jan 13 14:50:54 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=44.222.81.115, lip=66.85.158.92, TLS, session=<aYM2gkFIoJks3lFz>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.97
country_id: 6252001
description:
Jan 13 14:52:30 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.97, lip=66.85.158.92, TLS, session=<wpzph0FILOjG6xhh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.164.137
country_id: 99237
description:
2026-01-13 14:54:11 dovecot_plain authenticator failed for H=(cratings) [65.20.164.137]:51408: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan 13 14:54:45 host2 sshd[2985484]: Disconnected from invalid user admin 2.57.121.112 port 58518 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.40.215.162
country_id: 3469034
description:
2026-01-13 14:55:56 dovecot_login authenticator failed for H=187-40-215-162.user.veloxzone.com.br [187.40.215.162]:45950: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.89.136.197
country_id: 3469034
description:
Jan 13 14:56:10 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=190.89.136.197, lip=66.85.158.91, TLS, session=<4lPuk0FICZ++WYjF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.80.9
country_id: 3144096
description:
2026-01-13 14:56:27 dovecot_login authenticator failed for H=([178.232.80.9]) [178.232.80.9]:52343: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.77.50.215
country_id: 3175395
description:
Jan 13 14:56:28 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<careers>, method=PLAIN, rip=185.77.50.215, lip=66.85.158.91, TLS, session=<CdgblUFIUsq5TTLX>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.0.36.82
country_id: 1210997
description:
2026-01-13 14:58:44 dovecot_login authenticator failed for H=([49.0.36.82]) [49.0.36.82]:39776: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.52.217.71
country_id: 3686110
description:
2026-01-13 14:59:14 dovecot_login authenticator failed for H=(static-ip-cr18152021771.cable.net.co) [181.52.217.71]:53052: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.92.124.2
country_id: 1269750
description:
2026-01-13 15:03:41 dovecot_login authenticator failed for H=(static.bb.ill.59.92.124.2.bsnl.in) [59.92.124.2]:58877: 535 Incorrect authentication data (set_id=postmaster@kamecho.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.148.194
country_id: 99237
description:
2026-01-13 15:04:01 dovecot_plain authenticator failed for H=(ditheely) [65.20.148.194]:51167: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.46.45.121
country_id: 290557
description:
2026-01-13 15:04:02 dovecot_login authenticator failed for H=([20.46.45.121]) [20.46.45.121]:64899: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.51
country_id: 3144096
description:
2026-01-13 15:03:29 dovecot_login authenticator failed for H=(51-170-97-62.cust.smartcall.no) [62.97.170.51]:38884: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 64.23.194.146
country_id: 6252001
description:
Jan 13 15:04:06 host2 pure-ftpd[2993295]: (?@64.23.194.146) [INFO] New connection from 64.23.194.146


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 159.203.59.222
country_id: 6251999
description:
Jan 13 15:05:35 host2 pure-ftpd[2994647]: (?@159.203.59.222) [INFO] New connection from 159.203.59.222


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.22.78.221
country_id: 2921044
description:
Jan 13 15:07:56 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=165.22.78.221, lip=66.85.158.91, TLS, session=<1+gUv0FIFNKlFk7d>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.22.78.221
country_id: 2921044
description:
Jan 13 15:08:07 host2 dovecot[3239883]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=165.22.78.221, lip=66.85.158.91, session=<uk+7v0FIolalFk7d>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 103.174.102.191
country_id: 1269750
description:
Jan 13 15:11:28 host2 pure-ftpd[2999468]: (?@103.174.102.191) [INFO] New connection from 103.174.102.191


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 183.81.170.93
country_id: 2029969
description:
Jan 13 15:13:02 host2 pure-ftpd[3000835]: (?@183.81.170.93) [INFO] New connection from 183.81.170.93


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 155.4.245.222
country_id: 2661886
description:
Jan 13 15:13:28 host2 sshd[3001163]: Disconnected from invalid user ftpuser 155.4.245.222 port 17986 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.232.119.77
country_id: 2921044
description:
Jan 13 15:13:30 host2 pure-ftpd[3001230]: (?@165.232.119.77) [INFO] New connection from 165.232.119.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.138.164.119
country_id: 2661886
description:
2026-01-13 15:13:55 dovecot_plain authenticator failed for H=79.138.164.119.mobile.tre.se (preed) [79.138.164.119]:54302: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.57.170.188
country_id: 3175395
description:
2026-01-13 15:14:50 dovecot_plain authenticator failed for H=([100.64.100.6]) [2.57.170.188]:11776: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 155.4.245.222
country_id: 2661886
description:
Jan 13 15:15:39 host2 sshd[3003223]: Disconnected from invalid user mailuser 155.4.245.222 port 35196 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 155.4.245.222
country_id: 2661886
description:
Jan 13 15:16:14 host2 sshd[3003672]: Disconnected from invalid user rstudio 155.4.245.222 port 26611 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.237.173.220
country_id: 6252001
description:
Jan 13 15:17:41 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.237.173.220, lip=66.85.158.92, TLS, session=<47b34UFIvuwD7a3c>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.208.156.167
country_id: 241170
description:
Jan 13 15:18:18 host2 sshd[3005294]: Disconnected from invalid user admin 185.208.156.167 port 39818 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.208.156.167
country_id: 241170
description:
Jan 13 15:20:03 host2 sshd[3007018]: Disconnected from invalid user devuser 185.208.156.167 port 55366 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.208.156.167
country_id: 241170
description:
Jan 13 15:20:38 host2 sshd[3007746]: Disconnected from invalid user b 185.208.156.167 port 57630 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 164.90.155.129
country_id: 6252001
description:
Jan 13 15:25:43 host2 pure-ftpd[3012346]: (?@164.90.155.129) [INFO] New connection from 164.90.155.129


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.116.22
country_id: 1861060
description:
Jan 13 15:25:57 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=139.162.116.22, lip=66.85.158.92, TLS: Connection closed, session=<3gCE/0FIuN2LonQW>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 156.238.252.133
country_id: 241170
description:
Jan 13 15:27:02 host2 sshd[3013415]: Disconnected from invalid user ubuntu 156.238.252.133 port 45826 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-13 15:26:50 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (palenize) [87.103.126.54]:49040: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.202.197.108
country_id: 6252001
description:
2026-01-13 15:26:54 dovecot_plain authenticator failed for H=(afflarruf) [50.202.197.108]:59736: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.205.169
country_id: 1733045
description:
2026-01-13 15:27:05 dovecot_login authenticator failed for H=([49.124.205.169]) [49.124.205.169]:39452: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.185.233.251
country_id: 798544
description:
2026-01-13 15:26:19 dovecot_plain authenticator failed for H=5.185.233.251.ipv4.public.orange.pl (joiscred) [5.185.233.251]:54866: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.231.213.73
country_id: 3175395
description:
Jan 13 15:27:25 host2 sshd[3013656]: Disconnected from invalid user admin 95.231.213.73 port 42498 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.185.243.158
country_id: 6252001
description:
Jan 13 15:27:35 host2 sshd[3013783]: Disconnected from invalid user ubuntu 20.185.243.158 port 39734 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.238.252.133
country_id: 241170
description:
Jan 13 15:27:36 host2 sshd[3013797]: Disconnected from invalid user ubuntu 156.238.252.133 port 40998 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.182.132.154
country_id: 1269750
description:
Jan 13 15:28:29 host2 sshd[3014443]: Disconnected from invalid user ubuntu 103.182.132.154 port 45042 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.182.118
country_id: 1269750
description:
2026-01-13 15:29:05 dovecot_login authenticator failed for H=([59.145.86.177]) [125.19.182.118]:37916: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.214.101.251
country_id: 3144096
description:
2026-01-13 15:28:40 dovecot_login authenticator failed for H=([127.0.0.1]) [84.214.101.251]:43966: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.238.252.133
country_id: 241170
description:
Jan 13 15:28:08 host2 sshd[3014195]: Disconnected from invalid user ubuntu 156.238.252.133 port 43870 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 89.134.213.29
country_id: 719819
description:
Jan 13 15:29:34 host2 sshd[3015353]: Disconnected from invalid user admin 89.134.213.29 port 46172 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.168.189
country_id: 2186224
description:
2026-01-13 15:29:15 dovecot_login authenticator failed for H=([127.0.0.1]) [121.73.168.189]:37394: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.230.158
country_id: 1269750
description:
2026-01-13 15:29:36 dovecot_login authenticator failed for H=(dsl-del-065.26.246.61.airtelbroadband.in) [182.95.230.158]:60670: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.185.243.158
country_id: 6252001
description:
Jan 13 15:30:24 host2 sshd[3016156]: Disconnected from invalid user admin 20.185.243.158 port 46076 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 41.90.100.147
country_id: 192950
description:
Jan 13 15:31:01 host2 sshd[3016550]: Disconnected from invalid user deployer 41.90.100.147 port 45472 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.168.139.28
country_id: 2264397
description:
Jan 13 15:31:40 host2 sshd[3017052]: Disconnected from invalid user ubuntu 79.168.139.28 port 53930 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 20.185.243.158
country_id: 6252001
description:
Jan 13 15:32:05 host2 sshd[3017307]: Received disconnect from 20.185.243.158 port 56590:11: Bye Bye [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.155.228.189
country_id: 2661886
description:
2026-01-13 15:33:04 dovecot_login authenticator failed for H=h95-155-228-189.cust.bredband2.com [95.155.228.189]:42236: 535 Incorrect authentication data (set_id=abuse@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.145.111
country_id: 1861060
description:
Jan 13 15:33:27 host2 sshd[3018182]: Disconnected from invalid user devtest 152.32.145.111 port 47070 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.18.99.126
country_id: 1269750
description:
2026-01-13 15:33:35 dovecot_login authenticator failed for H=([125.18.99.126]) [125.18.99.126]:40310: 535 Incorrect authentication data (set_id=abuse@euroentertainmentlk.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 79.168.139.28
country_id: 2264397
description:
Jan 13 15:33:52 host2 sshd[3018468]: Disconnected from invalid user sshuser 79.168.139.28 port 52174 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.230.122
country_id: 1269750
description:
2026-01-13 15:34:06 dovecot_login authenticator failed for H=([182.95.215.69]) [182.95.230.122]:55238: 535 Incorrect authentication data (set_id=abuse)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.168.139.28
country_id: 2264397
description:
Jan 13 15:34:21 host2 sshd[3018921]: Disconnected from invalid user mailuser 79.168.139.28 port 41106 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.145.111
country_id: 1861060
description:
Jan 13 15:35:17 host2 sshd[3019686]: Disconnected from invalid user admin1 152.32.145.111 port 56160 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.245.0.246
country_id: 1880251
description:
2026-01-13 15:42:34 dovecot_login authenticator failed for H=(246.0.245.49.unknown.m1.com.sg) [49.245.0.246]:45288: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.75.122.7
country_id: 927384
description:
2026-01-13 15:42:57 dovecot_login authenticator failed for H=([41.75.122.7]) [41.75.122.7]:35309: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 177.153.62.49
country_id: 3469034
description:
Jan 13 15:47:46 host2 pure-ftpd[3028874]: (?@177.153.62.49) [INFO] New connection from 177.153.62.49


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.158.162.24
country_id: 2510769
description:
Jan 13 15:50:19 host2 sshd[3031232]: Disconnected from invalid user dev 146.158.162.24 port 54092 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.223.91.130
country_id: 6252001
description:
Jan 13 15:51:54 host2 sshd[3032611]: Disconnected from invalid user max 162.223.91.130 port 55954 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.113.212
country_id: 1861060
description:
Jan 13 15:52:15 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=139.162.113.212, lip=66.85.158.92, TLS: Connection closed, session=<a3eZXUJI1oaLonHU>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.223.91.130
country_id: 6252001
description:
Jan 13 15:52:55 host2 sshd[3033368]: Disconnected from invalid user vpsuser 162.223.91.130 port 44726 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 162.223.91.130
country_id: 6252001
description:
Jan 13 15:53:27 host2 sshd[3033874]: Disconnected from invalid user tunneluser 162.223.91.130 port 55462 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 89.186.11.17
country_id: 798544
description:
Jan 13 15:54:16 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=89.186.11.17, lip=66.85.158.91, TLS, session=<CE7PY0JIUMFZugsR>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 189.51.118.218
country_id: 3469034
description:
Jan 13 15:54:38 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<env_eng>, method=PLAIN, rip=189.51.118.218, lip=66.85.158.91, TLS, session=<bRj4ZEJILba9M3ba>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.158.162.24
country_id: 2510769
description:
Jan 13 15:55:39 host2 sshd[3035821]: Disconnected from invalid user botuser1 146.158.162.24 port 56438 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 50.6.224.135
country_id: 6252001
description:
Jan 13 15:56:40 host2 sshd[3036506]: Disconnected from invalid user ftp-admin 50.6.224.135 port 50376 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.186.0.19
country_id: 1643084
description:
Jan 13 15:56:52 host2 sshd[3036740]: Disconnected from invalid user airflow 103.186.0.19 port 43146 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.185.161.145
country_id: 3469034
description:
2026-01-13 15:57:02 dovecot_login authenticator failed for H=(csbrasil.static.gvt.net.br) [179.185.161.145]:40198: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 95.0.32.181
country_id: 298795
description:
Jan 13 15:57:17 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<training@v-deploy.com>, method=PLAIN, rip=95.0.32.181, lip=66.85.158.91, TLS, session=</fODbkJIb8VfACC1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.216.213.53
country_id: 933860
description:
Jan 13 15:57:20 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<training@v-deploy.com>, method=PLAIN, rip=41.216.213.53, lip=66.85.158.91, TLS, session=<3WqQbkJIkMAp2NU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.171.200
country_id: 3175395
description:
Jan 13 15:57:39 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<training>, method=PLAIN, rip=185.15.171.200, lip=66.85.158.91, TLS, session=<gTThb0JIgtS5D6vI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.251.35
country_id: 3865483
description:
Jan 13 15:57:42 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<training>, method=PLAIN, rip=179.0.251.35, lip=66.85.158.91, TLS, session=<EMbMb0JILMOzAPsj>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 159.223.20.91
country_id: 2921044
description:
Jan 13 15:57:59 host2 pure-ftpd[3037450]: (?@159.223.20.91) [INFO] New connection from 159.223.20.91


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.186.0.19
country_id: 1643084
description:
Jan 13 15:58:57 host2 sshd[3038042]: Disconnected from invalid user debian 103.186.0.19 port 51144 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.145.185
country_id: 3996063
description:
2026-01-13 15:58:08 dovecot_login authenticator failed for H=([177.236.145.185]) [177.236.145.185]:33753: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.138.181
country_id: 1819730
description:
2026-01-13 15:58:24 dovecot_login authenticator failed for H=(m121-202-138-181.smartone.com) [121.202.138.181]:41714: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 208.109.34.86
country_id: 6252001
description:
Jan 13 15:58:48 host2 pure-ftpd[3037968]: (?@208.109.34.86) [INFO] New connection from 208.109.34.86


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.186.0.19
country_id: 1643084
description:
Jan 13 15:59:39 host2 sshd[3038478]: Disconnected from invalid user airflow 103.186.0.19 port 54996 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 164.90.155.129
country_id: 6252001
description:
Jan 13 16:00:33 host2 pure-ftpd[3039351]: (?@164.90.155.129) [INFO] New connection from 164.90.155.129


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 128.203.202.233
country_id: 6251999
description:
Jan 13 16:01:34 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=128.203.202.233, lip=66.85.158.91, TLS handshaking: Connection closed, session=<A4rifkJIbo+Ay8rp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.157.246.158
country_id: 2077456
description:
2026-01-13 16:01:56 dovecot_login authenticator failed for H=([120.157.246.158]) [120.157.246.158]:39880: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.125.122
country_id: 1269750
description:
2026-01-13 16:02:23 dovecot_login authenticator failed for H=([182.95.125.122]) [182.95.125.122]:37850: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 88.142.46.185
country_id: 3017382
description:
Jan 13 16:03:32 host2 sshd[3041739]: Disconnected from invalid user ubuntu 88.142.46.185 port 49202 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 88.142.46.185
country_id: 3017382
description:
Jan 13 16:04:35 host2 sshd[3042442]: Disconnected from invalid user admin 88.142.46.185 port 47044 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 13 16:07:17 host2 sshd[3044492]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 13 16:08:21 host2 sshd[3045318]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.128.150.67
country_id: 6252001
description:
2026-01-13 16:09:39 dovecot_login authenticator failed for H=c-73-128-150-67.hsd1.de.comcast.net [73.128.150.67]:44994: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.91
country_id: 2186224
description:
2026-01-13 16:09:52 dovecot_login authenticator failed for H=([121.73.169.91]) [121.73.169.91]:51178: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.170.251.33
country_id: 2017370
description:
2026-01-13 16:11:36 dovecot_login authenticator failed for H=(178.170.251.33.leadertelecom.ru) [178.170.251.33]:49756: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.242.142
country_id: 1269750
description:
2026-01-13 16:12:10 dovecot_login authenticator failed for H=([182.78.242.142]) [182.78.242.142]:52764: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.166.50.15
country_id: 453733
description:
2026-01-13 16:12:15 dovecot_login authenticator failed for H=15-50-166-83.dyn.estpak.ee [83.166.50.15]:53358: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.127.90.34
country_id: 2440476
description:
2026-01-13 16:12:26 dovecot_login authenticator failed for H=([154.127.90.34]) [154.127.90.34]:47447: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 40.76.167.156
country_id: 6252001
description:
Jan 13 16:19:42 host2 pure-ftpd[3055383]: (?@40.76.167.156) [INFO] New connection from 40.76.167.156


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.98.174
country_id: 1269750
description:
2026-01-13 16:24:34 dovecot_login authenticator failed for H=([27.123.98.174]) [27.123.98.174]:55044: 535 Incorrect authentication data (set_id=postmaster@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.250
country_id: 1036973
description:
2026-01-13 16:25:01 dovecot_login authenticator failed for H=([197.219.228.250]) [197.219.228.250]:50004: 535 Incorrect authentication data (set_id=postmaster@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.40.63
country_id: 1819730
description:
2026-01-13 16:25:35 dovecot_login authenticator failed for H=063.40.246.220.static.netvigator.com [220.246.40.63]:49756: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.200.180.174
country_id: 6252001
description:
2026-01-13 16:33:19 dovecot_login authenticator failed for H=survey.hagbergconsulting.com [207.200.180.174]:49979: 535 Incorrect authentication data (set_id=all@comdef.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.156.46
country_id: 1269750
description:
2026-01-13 16:33:52 dovecot_login authenticator failed for H=([125.19.156.46]) [125.19.156.46]:56148: 535 Incorrect authentication data (set_id=all)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.40.57.41
country_id: 1269750
description:
Jan 13 16:35:53 host2 sshd[3068365]: Disconnected from invalid user admin 45.40.57.41 port 60134 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.19.235.172
country_id: 3175395
description:
Jan 13 16:37:13 host2 sshd[3069385]: Disconnected from invalid user admin 151.19.235.172 port 60986 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.171.230.200
country_id: 6252001
description:
2026-01-13 16:37:59 dovecot_plain authenticator failed for H=c-73-171-230-200.hsd1.fl.comcast.net (fillarcu) [73.171.230.200]:60723: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.73.121.209
country_id: 732800
description:
2026-01-13 16:38:10 dovecot_login authenticator failed for H=(62-73-121-209.btc-net.bg) [62.73.121.209]:40128: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.41.202.12
country_id: 6252001
description:
2026-01-13 16:38:40 dovecot_login authenticator failed for H=syn-071-041-202-012.biz.spectrum.com [71.41.202.12]:54007: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.107.36.18
country_id: 1269750
description:
2026-01-13 16:38:23 dovecot_login authenticator failed for H=([103.107.36.18]) [103.107.36.18]:38476: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.128.202
country_id: 6252001
description:
2026-01-13 16:38:25 dovecot_login authenticator failed for H=([192.34.128.202]) [192.34.128.202]:60940: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 70.65.44.183
country_id: 6251999
description:
Jan 13 16:40:10 host2 sshd[3071600]: Disconnected from invalid user admin 70.65.44.183 port 57958 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.220.30
country_id: 1269750
description:
2026-01-13 16:40:31 dovecot_login authenticator failed for H=(nsg-corporate-153.189.187.122.airtel.in) [125.19.220.30]:60640: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.174.182.226
country_id: 2510769
description:
Jan 13 16:40:47 host2 sshd[3072133]: Disconnected from invalid user admin 185.174.182.226 port 47668 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.40.57.41
country_id: 1269750
description:
Jan 13 16:41:10 host2 sshd[3072367]: Disconnected from invalid user ubuntu 45.40.57.41 port 57182 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.174.182.226
country_id: 2510769
description:
Jan 13 16:41:18 host2 sshd[3072457]: Disconnected from invalid user admin 185.174.182.226 port 49632 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.174.182.226
country_id: 2510769
description:
Jan 13 16:42:17 host2 sshd[3073029]: Disconnected from invalid user admin 185.174.182.226 port 45854 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 70.65.44.183
country_id: 6251999
description:
Jan 13 16:42:30 host2 sshd[3073169]: Disconnected from invalid user admin 70.65.44.183 port 58110 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 70.65.44.183
country_id: 6251999
description:
Jan 13 16:43:33 host2 sshd[3074017]: Disconnected from invalid user admin 70.65.44.183 port 58190 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.51.22
country_id: 1880251
description:
Jan 13 16:43:49 host2 sshd[3074163]: Disconnected from invalid user ubuntu 101.47.51.22 port 57516 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 185.174.182.226
country_id: 2510769
description:
Jan 13 16:44:15 host2 sshd[3074493]: Received disconnect from 185.174.182.226 port 38556:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.135.37
country_id: 1269750
description:
Jan 13 16:44:46 host2 sshd[3074907]: Disconnected from invalid user admin 64.227.135.37 port 35628 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.51.22
country_id: 1880251
description:
Jan 13 16:45:54 host2 sshd[3075906]: Disconnected from invalid user admin 101.47.51.22 port 38668 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.47.51.22
country_id: 1880251
description:
Jan 13 16:47:54 host2 sshd[3077871]: Disconnected from invalid user ubuntu 101.47.51.22 port 39058 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 139.59.46.198
country_id: 1269750
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 139.59.46.198 - lezzarotech "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarotech (has_cpuser_file failed)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 57.128.188.106
country_id: 3017382
description:
Jan 13 16:49:49 host2 pure-ftpd[3079207]: (?@57.128.188.106) [INFO] New connection from 57.128.188.106


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.52.72.49
country_id: 1605651
description:
2026-01-13 16:52:08 dovecot_login authenticator failed for H=node-e9d.pool-182-52.dynamic.nt-isp.net (mx-ll-183.89.250-247.dynamic.3bb.in.th) [182.52.72.49]:55921: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.224.26
country_id: 1269750
description:
2026-01-13 16:52:23 dovecot_login authenticator failed for H=([152.52.224.26]) [152.52.224.26]:36792: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.55.16
country_id: 3144096
description:
2026-01-13 16:54:14 dovecot_login authenticator failed for H=([178.232.55.16]) [178.232.55.16]:33340: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.248.30.205
country_id: 1269750
description:
2026-01-13 16:54:34 dovecot_login authenticator failed for H=([103.248.30.205]) [103.248.30.205]:37507: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 142.79.227.70
country_id: 1269750
description:
Jan 13 16:56:19 host2 pure-ftpd[3084953]: (?@142.79.227.70) [INFO] New connection from 142.79.227.70


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 117.232.85.78
country_id: 1269750
description:
Jan 13 16:58:44 host2 pure-ftpd[3087020]: (?@117.232.85.78) [INFO] New connection from 117.232.85.78


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.154
country_id: 1269750
description:
2026-01-13 17:00:14 dovecot_login authenticator failed for H=(nsg-corporate-154.230.187.122.airtel.in) [122.187.230.154]:52235: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.128.149.159
country_id: 1835841
description:
Jan 13 17:00:16 host2 sshd[3088252]: Disconnected from invalid user ubuntu 43.128.149.159 port 49126 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.66.209
country_id: 1819730
description:
2026-01-13 17:00:31 dovecot_login authenticator failed for H=209.66.246.220.static.netvigator.com [220.246.66.209]:52419: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.199.126
country_id: 1269750
description:
2026-01-13 17:00:33 dovecot_login authenticator failed for H=([182.79.31.107]) [152.52.199.126]:38076: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.128.149.159
country_id: 1835841
description:
Jan 13 17:00:58 host2 sshd[3088770]: Disconnected from invalid user admin 43.128.149.159 port 60366 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.115.144.103
country_id: 3469034
description:
2026-01-13 17:01:00 dovecot_login authenticator failed for H=(buenosnet.static.gvt.net.br) [187.115.144.103]:44742: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.61.6
country_id: 290557
description:
2026-01-13 17:01:33 dovecot_login authenticator failed for H=([5.32.61.6]) [5.32.61.6]:33023: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-01-13 17:01:20 dovecot_login authenticator failed for H=(host-64-72-74-162.lightower.net) [64.72.74.162]:53821: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.128.149.159
country_id: 1835841
description:
Jan 13 17:01:34 host2 sshd[3089241]: Disconnected from invalid user ubuntu 43.128.149.159 port 43366 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.128.149.159
country_id: 1835841
description:
Jan 13 17:03:25 host2 sshd[3090535]: Disconnected from invalid user ubuntu 43.128.149.159 port 48832 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.169.85.72
country_id: 6252001
description:
Jan 13 17:03:48 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.169.85.72, lip=66.85.158.92, TLS handshaking: Connection closed, session=<6KRzXUNITNUUqVVI>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.154
country_id: 1269750
description:
2026-01-13 17:05:17 dovecot_login authenticator failed for H=(nsg-corporate-1.193.187.122.airtel.in) [182.95.178.154]:55618: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.192.162
country_id: 1269750
description:
2026-01-13 17:05:35 dovecot_login authenticator failed for H=([152.52.192.162]) [152.52.192.162]:35328: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.252
country_id: 1733045
description:
2026-01-13 17:06:18 dovecot_login authenticator failed for H=([49.124.152.252]) [49.124.152.252]:41504: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.177.78
country_id: 1269750
description:
2026-01-13 17:06:49 dovecot_login authenticator failed for H=([152.52.234.170]) [182.95.177.78]:53106: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.200.180.174
country_id: 6252001
description:
2026-01-13 17:06:58 dovecot_login authenticator failed for H=survey.hagbergconsulting.com [207.200.180.174]:62406: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.89.116.5
country_id: 6252001
description:
2026-01-13 17:07:16 dovecot_login authenticator failed for H=([70.89.116.5]) [70.89.116.5]:52701: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 132.220.107.88
country_id: 2750405
description:
Jan 13 17:09:24 host2 pure-ftpd[3095891]: (?@132.220.107.88) [INFO] New connection from 132.220.107.88


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.160.206
country_id: 1269750
description:
2026-01-13 17:14:16 dovecot_login authenticator failed for H=([128.185.23.89]) [125.19.160.206]:58614: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.59.4.36
country_id: 1269750
description:
2026-01-13 17:15:25 dovecot_login authenticator failed for H=(cityzone-36-4-59-103.cityzoneinfo.com) [103.59.4.36]:35708: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan 13 17:17:24 host2 sshd[3102061]: Disconnected from invalid user admin 2.57.121.112 port 10056 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.195.150
country_id: 290557
description:
2026-01-13 17:18:37 dovecot_plain authenticator failed for H=(haffs) [91.73.195.150]:50095: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.57
country_id: 2186224
description:
2026-01-13 17:22:23 dovecot_login authenticator failed for H=([127.0.0.1]) [121.73.163.57]:53464: 535 Incorrect authentication data (set_id=arts@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.162.66
country_id: 2186224
description:
2026-01-13 17:22:41 dovecot_login authenticator failed for H=([127.0.0.1]) [121.73.162.66]:45592: 535 Incorrect authentication data (set_id=arts)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.183.103.121
country_id: 2635167
description:
2026-01-13 17:23:32 dovecot_login authenticator failed for H=(185-183-103-121.xdsl.5gdsl.com) [185.183.103.121]:58576: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.219.196.17
country_id: 690791
description:
2026-01-13 17:23:46 dovecot_login authenticator failed for H=(91-219-196-17.planeta.dn.ua) [91.219.196.17]:54994: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.58.211.64
country_id: 2635167
description:
Jan 13 17:25:11 host2 sshd[3108122]: Disconnected from invalid user ftptest 143.58.211.64 port 44314 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.50.25.190
country_id: 1643084
description:
Jan 13 17:25:48 host2 sshd[3108568]: Disconnected from invalid user azureuser 27.50.25.190 port 37490 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.177.78
country_id: 1269750
description:
2026-01-13 17:25:51 dovecot_login authenticator failed for H=([152.52.234.170]) [182.95.177.78]:35682: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.164.129.224
country_id: 1835841
description:
Jan 13 17:25:56 host2 sshd[3108709]: Disconnected from invalid user develop 43.164.129.224 port 52548 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.79.134
country_id: 1269750
description:
2026-01-13 17:26:21 dovecot_login authenticator failed for H=([182.78.79.134]) [182.78.79.134]:54902: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.242.142
country_id: 1269750
description:
2026-01-13 17:28:04 dovecot_login authenticator failed for H=([125.19.172.137]) [182.78.242.142]:54096: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.47.169
country_id: 1819730
description:
2026-01-13 17:27:20 dovecot_login authenticator failed for H=169.47.246.220.static.netvigator.com [220.246.47.169]:61833: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.233.5.67
country_id: 6252001
description:
2026-01-13 17:28:31 dovecot_login authenticator failed for H=([50.233.5.67]) [50.233.5.67]:40229: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.183.62.0
country_id: 1210997
description:
Jan 13 17:28:59 host2 sshd[3110791]: Disconnected from invalid user runner 103.183.62.0 port 42540 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2026-01-13 17:29:40 dovecot_plain authenticator failed for H=(vaphaguip) [102.53.15.17]:43602: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.174.211.17
country_id: 2661886
description:
Jan 13 17:29:49 host2 sshd[3111975]: Disconnected from invalid user tunneluser 158.174.211.17 port 17004 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.174.211.17
country_id: 2661886
description:
Jan 13 17:30:36 host2 sshd[3112896]: Disconnected from invalid user build 158.174.211.17 port 29087 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 158.174.211.17
country_id: 2661886
description:
Jan 13 17:31:27 host2 sshd[3113475]: Disconnected from invalid user developer 158.174.211.17 port 26410 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.247.195
country_id: 6252001
description:
Jan 13 17:32:52 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=184.105.247.195, lip=66.85.158.92, TLS handshaking: Connection closed, session=<appyxUNITp64affD>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 157.20.207.165
country_id: 1643084
description:
Jan 13 17:33:01 host2 sshd[3114852]: Disconnected from invalid user sshadmin 157.20.207.165 port 37698 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.247.195
country_id: 6252001
description:
Jan 13 17:33:24 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=184.105.247.195, lip=66.85.158.92, TLS: Connection closed, session=<KcFNx0NIuGa4affD>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.164.129.224
country_id: 1835841
description:
Jan 13 17:34:08 host2 sshd[3115869]: Disconnected from invalid user appuser 43.164.129.224 port 36446 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.153.146
country_id: 99237
description:
2026-01-13 17:37:32 dovecot_plain authenticator failed for H=(notanple) [65.20.153.146]:37242: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 146.190.172.131
country_id: 6252001
description:
Jan 13 17:41:37 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=146.190.172.131, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<1z2w5ENIWoySvqyD>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Jan 13 17:42:34 host2 dovecot[3239883]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<tpoh6ENIIuEDhpQ7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.181.107.134
country_id: 2264397
description:
2026-01-13 17:43:46 dovecot_login authenticator failed for H=89-181-107-134.net.novis.pt [89.181.107.134]:45344: 535 Incorrect authentication data (set_id=hostmaster@comdef.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.195.52.4
country_id: 3144096
description:
2026-01-13 17:44:07 dovecot_login authenticator failed for H=([141.195.52.4]) [141.195.52.4]:37248: 535 Incorrect authentication data (set_id=hostmaster@comdef.org)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Jan 13 17:44:30 host2 dovecot[3239883]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<mcME70NIJMgDhpQ7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.168.17.20
country_id: 2077456
description:
2026-01-13 17:44:50 dovecot_login authenticator failed for H=([101.168.17.20]) [101.168.17.20]:53908: 535 Incorrect authentication data (set_id=hostmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.155.27.128
country_id: 2802361
description:
2026-01-13 17:45:35 dovecot_login authenticator failed for H=128.27.155.104.bc.googleusercontent.com [104.155.27.128]:52348: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
country_id: 6252001
description:
2026-01-13 17:45:49 dovecot_login authenticator failed for H=(made-again.tmesis.com) [24.187.213.29]:52598: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Jan 13 17:45:50 host2 dovecot[3239883]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<leXH80NI2sYDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Jan 13 17:47:14 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<qDHR+ENIDsUDhpQ7>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.134.148.59
country_id: 6252001
description:
Jan 13 17:47:41 host2 dovecot[3239883]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<iQJv+kNI7oUDhpQ7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.250.19.91
country_id: 1269750
description:
2026-01-13 17:48:20 dovecot_login authenticator failed for H=(static.ill.117.250.19.91.bsnl.co.in) [117.250.19.91]:44640: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Jan 13 17:48:50 host2 dovecot[3239883]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<5TWG/kNITsYDhpQ7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.118.112.230
country_id: 6252001
description:
2026-01-13 17:49:03 dovecot_login authenticator failed for H=syn-070-118-112-230.biz.spectrum.com [70.118.112.230]:38892: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 13 17:50:50 host2 sshd[3130118]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 13 17:51:51 host2 sshd[3130958]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.226.107.70
country_id: 3469034
description:
2026-01-13 17:51:22 dovecot_login authenticator failed for H=(72-107-226-38.edgetelecom.com.br) [38.226.107.70]:60095: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.0.8.204
country_id: 3469034
description:
2026-01-13 17:52:12 dovecot_login authenticator failed for H=([206.0.8.204]) [206.0.8.204]:46978: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.64.71.59
country_id: 3865483
description:
Jan 13 17:55:08 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=186.64.71.59, lip=66.85.158.91, TLS, session=<f/e4E0RITti6QEc7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.148.194
country_id: 99237
description:
2026-01-13 17:55:31 dovecot_plain authenticator failed for H=(uncleess) [65.20.148.194]:53502: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.85.61.200
country_id: 3469034
description:
Jan 13 17:55:29 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<env_eng>, method=PLAIN, rip=177.85.61.200, lip=66.85.158.91, TLS, session=<+NksFURIdryxVT3I>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.121.1.156
country_id: 6252001
description:
2026-01-13 18:00:25 dovecot_login authenticator failed for H=([24.121.1.156]) [24.121.1.156]:57212: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.252.85
country_id: 1210997
description:
2026-01-13 18:00:53 dovecot_login authenticator failed for H=([103.115.252.60]) [103.115.252.85]:48631: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.201.62
country_id: 1269750
description:
2026-01-13 18:07:27 dovecot_login authenticator failed for H=(aes-static-041.73.22.125.airtel.in) [122.186.201.62]:57012: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.146.149
country_id: 3996063
description:
2026-01-13 18:07:46 dovecot_login authenticator failed for H=([177.236.146.149]) [177.236.146.149]:58781: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.25.36.197
country_id: 294640
description:
2026-01-13 18:09:06 dovecot_login authenticator failed for H=([37.25.36.197]) [37.25.36.197]:39386: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.19.12.103
country_id: 2635167
description:
2026-01-13 18:09:19 dovecot_login authenticator failed for H=cpc122100-bmly10-2-0-cust102.2-3.cable.virginm.net [82.19.12.103]:50007: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.124
country_id: 1036973
description:
2026-01-13 18:11:49 dovecot_login authenticator failed for H=([196.28.226.124]) [196.28.226.124]:55506: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.225.255.82
country_id: 2510769
description:
2026-01-13 18:12:00 dovecot_login authenticator failed for H=(82.red.255.225.212.procono.es) [212.225.255.82]:45934: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.201.62
country_id: 1269750
description:
2026-01-13 18:14:10 dovecot_login authenticator failed for H=(nsg-corporate-226.215.186.122.airtel.in) [122.186.201.62]:33620: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.120.50
country_id: 1269750
description:
2026-01-13 18:15:58 dovecot_login authenticator failed for H=(nsg-static-89.234.75.182-airtel.com) [182.95.120.50]:59202: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.27.83
country_id: 1643084
description:
2026-01-13 18:16:33 dovecot_login authenticator failed for H=(ip-arana.net.id.as132673) [103.90.27.83]:34232: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.248.149.21
country_id: 3175395
description:
Jan 13 18:19:50 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=178.248.149.21, lip=66.85.158.91, TLS, session=<2pRmbERIMq2y+JUV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.13.68.97
country_id: 3175395
description:
Jan 13 18:20:09 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<careers>, method=PLAIN, rip=45.13.68.97, lip=66.85.158.91, TLS, session=<vRx+bURIVcAtDURh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.132.97.76
country_id: 2264397
description:
2026-01-13 18:22:43 dovecot_login authenticator failed for H=a94-132-97-76.cpe.netcabo.pt [94.132.97.76]:59970: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.162.194.94
country_id: 1733045
description:
2026-01-13 18:23:32 dovecot_login authenticator failed for H=([51.162.194.94]) [51.162.194.94]:38947: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.181.79.60
country_id: 1819730
description:
2026-01-13 18:27:47 dovecot_login authenticator failed for H=([65.181.79.60]) [65.181.79.60]:58817: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.79.134
country_id: 1269750
description:
2026-01-13 18:27:58 dovecot_login authenticator failed for H=([182.78.79.134]) [182.78.79.134]:46584: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.159.185
country_id: 1733045
description:
2026-01-13 18:28:35 dovecot_login authenticator failed for H=([49.124.159.185]) [49.124.159.185]:39862: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.76.55.177
country_id: 3175395
description:
2026-01-13 18:28:44 dovecot_login authenticator failed for H=([151.76.55.177]) [151.76.55.177]:52550: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.0.90.81
country_id: 2077456
description:
2026-01-13 18:29:04 dovecot_login authenticator failed for H=210.0.90.81.static.nexnet.net.au [210.0.90.81]:60420: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.140.54
country_id: 1269750
description:
2026-01-13 18:29:32 dovecot_login authenticator failed for H=([125.21.194.121]) [125.23.140.54]:44236: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan 13 18:29:48 host2 sshd[3163381]: Disconnected from invalid user admin 2.57.121.112 port 51315 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.27.33.174
country_id: 6252001
description:
2026-01-13 18:36:09 dovecot_plain authenticator failed for H=c-73-27-33-174.hsd1.fl.comcast.net (suctae) [73.27.33.174]:36368: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 40.117.97.0
country_id: 6252001
description:
Jan 13 18:38:08 host2 sshd[3170288]: Disconnected from invalid user ubuntu 40.117.97.0 port 35054 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 40.117.97.0
country_id: 6252001
description:
Jan 13 18:39:56 host2 sshd[3171588]: Disconnected from invalid user admin 40.117.97.0 port 58222 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.0.120.6
country_id: 226074
description:
Jan 13 18:40:42 host2 sshd[3172269]: Disconnected from invalid user admin 196.0.120.6 port 39770 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 196.0.120.6
country_id: 226074
description:
Jan 13 18:42:48 host2 sshd[3173807]: Disconnected from invalid user ubuntu 196.0.120.6 port 47520 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.158.22.150
country_id: 99237
description:
Jan 13 18:43:04 host2 sshd[3174092]: Disconnected from invalid user admin 185.158.22.150 port 55178 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.158.22.150
country_id: 99237
description:
Jan 13 18:44:09 host2 sshd[3174746]: Disconnected from invalid user ubuntu 185.158.22.150 port 65021 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.89.137.130
country_id: 3469034
description:
Jan 13 18:44:56 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=190.89.137.130, lip=66.85.158.91, TLS, session=<09EIxkRIBoK+WYmC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 89.106.137.87
country_id: 2963597
description:
Jan 13 18:45:24 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<env_eng>, method=PLAIN, rip=89.106.137.87, lip=66.85.158.91, TLS, session=<VWPcx0RI5olZaolX>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.43.105.11
country_id: 3469034
description:
2026-01-13 18:46:12 dovecot_login authenticator failed for H=([127.0.0.1]) [177.43.105.11]:43214: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.41.155
country_id: 3144096
description:
2026-01-13 18:46:19 dovecot_login authenticator failed for H=([127.0.0.1]) [46.212.41.155]:47101: 535 Incorrect authentication data (set_id=kasunp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.188.130
country_id: 3144096
description:
2026-01-13 18:54:21 dovecot_login authenticator failed for H=(cm-84.213.188.130.get.no) [84.213.188.130]:34384: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 71.6.146.185
country_id: 6252001
description:
Jan 13 18:55:12 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record (no auth attempts in 0 secs): user=<>, rip=71.6.146.185, lip=66.85.158.92, TLS: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record, session=<iQnm60RIFOBHBpK5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.96.233.67
country_id: 6251999
description:
2026-01-13 18:55:17 dovecot_login authenticator failed for H=208-96-233-67.resi.cgocable.ca [208.96.233.67]:39760: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.57.39.170
country_id: 6252001
description:
2026-01-13 18:59:17 dovecot_login authenticator failed for H=(syn-184-057-039-170.res.spectrum.com) [184.57.39.170]:59962: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.143.166
country_id: 1819730
description:
2026-01-13 19:14:00 dovecot_login authenticator failed for H=166.143.48.116.static.netvigator.com [116.48.143.166]:58630: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.127.128
country_id: 3144096
description:
2026-01-13 19:13:37 dovecot_login authenticator failed for H=(cm-46.212.127.128.get.no) [46.212.127.128]:56012: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.81.229.181
country_id: 6252001
description:
2026-01-13 19:18:14 dovecot_plain authenticator failed for H=(prebotint) [192.81.229.181]:37850: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.111.146
country_id: 6252001
description:
2026-01-13 19:20:05 dovecot_login authenticator failed for H=syn-035-130-111-146.biz.spectrum.com [35.130.111.146]:41227: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.210.118
country_id: 1269750
description:
2026-01-13 19:20:26 dovecot_login authenticator failed for H=([125.17.48.129]) [152.52.210.118]:38198: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.129.28
country_id: 99237
description:
2026-01-13 19:26:46 dovecot_plain authenticator failed for H=(ockoft) [65.20.129.28]:37176: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.195.211.98
country_id: 6252001
description:
2026-01-13 19:28:39 dovecot_plain authenticator failed for H=c-73-195-211-98.hsd1.nj.comcast.net (ovelly) [73.195.211.98]:50132: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.214.169.10
country_id: 2510769
description:
2026-01-13 19:28:43 dovecot_plain authenticator failed for H=(plaming) [185.214.169.10]:52788: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 13 19:34:14 host2 sshd[3213244]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 13 19:35:17 host2 sshd[3214348]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.167.160
country_id: 99237
description:
2026-01-13 19:35:07 dovecot_login authenticator failed for H=([65.20.167.160]) [65.20.167.160]:33640: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.164.93.136
country_id: 6252001
description:
2026-01-13 19:35:37 dovecot_login authenticator failed for H=(syn-024-164-093-136.res.spectrum.com) [24.164.93.136]:46246: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan 13 19:44:14 host2 sshd[3221151]: Disconnected from invalid user admin 2.57.121.112 port 49266 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.222.178
country_id: 1269750
description:
2026-01-13 19:46:22 dovecot_login authenticator failed for H=([182.95.222.178]) [182.95.222.178]:49528: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.220.90
country_id: 1269750
description:
2026-01-13 19:46:37 dovecot_login authenticator failed for H=(dsl-tn-dynamic-137.209.22.125.airtelbroadband.in) [128.185.220.90]:37168: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.204.134.124
country_id: 6252001
description:
2026-01-13 19:50:02 dovecot_plain authenticator failed for H=c-98-204-134-124.hsd1.md.comcast.net (satica) [98.204.134.124]:36752: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.63.10
country_id: 1269750
description:
2026-01-13 19:50:04 dovecot_login authenticator failed for H=(nsg-static-177.160.71.182.airtel.in) [182.95.63.10]:42860: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.27.76.210
country_id: 3469034
description:
2026-01-13 19:50:43 dovecot_login authenticator failed for H=(ip-177-27-76-210.user.vivozap.com.br) [177.27.76.210]:56228: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.0.8.204
country_id: 3469034
description:
2026-01-13 19:51:14 dovecot_login authenticator failed for H=([206.0.8.204]) [206.0.8.204]:42764: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.245.250.151
country_id: 3469034
description:
Jan 13 19:51:53 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=170.245.250.151, lip=66.85.158.91, TLS, session=<3fqJtUVIkpaq9fqX>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.177.113.25
country_id: 3175395
description:
Jan 13 19:52:23 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<careers>, method=PLAIN, rip=195.177.113.25, lip=66.85.158.91, TLS, session=<dslOt0VIAp/DsXEZ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 46.101.83.167
country_id: 2635167
description:
Jan 13 19:59:00 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=46.101.83.167, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<DeQQ0EVIftIuZVOn>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.29.26
country_id: 3144096
description:
2026-01-13 19:59:45 dovecot_login authenticator failed for H=(cm-178.232.29.26.get.no) [178.232.29.26]:35365: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.70.134
country_id: 1819730
description:
2026-01-13 20:00:02 dovecot_login authenticator failed for H=42-200-70-134.static.imsbiz.com [42.200.70.134]:40510: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 164.90.194.121
country_id: 2750405
description:
Jan 13 20:02:58 host2 dovecot[3239883]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=164.90.194.121, lip=66.85.158.91, TLS, session=<83E53kVIIpKkWsJ5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.172.54.29
country_id: 6252001
description:
2026-01-13 20:11:35 dovecot_plain authenticator failed for H=c-67-172-54-29.hsd1.pa.comcast.net (ephiewes) [67.172.54.29]:52438: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.198.131.159
country_id: 6252001
description:
Jan 13 20:14:05 host2 sshd[3248277]: Invalid user cloudtourssrilan_travel from 124.198.131.159 port 61681


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.216.213.131
country_id: 933860
description:
Jan 13 20:15:19 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<env_eng>, method=PLAIN, rip=41.216.213.131, lip=66.85.158.91, TLS, session=<J41KCUZIit0p2NWD>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.201.22.158
country_id: 290557
description:
2026-01-13 20:15:23 dovecot_plain authenticator failed for H=(bemiston) [94.201.22.158]:49722: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.89.137.111
country_id: 3469034
description:
Jan 13 20:14:58 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=190.89.137.111, lip=66.85.158.91, TLS, session=<ypP2B0ZIDY6+WYlv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.124.111.122
country_id: 2077456
description:
2026-01-13 20:37:21 dovecot_login authenticator failed for H=27-124-111-122.static.as58511.net [27.124.111.122]:45298: 535 Incorrect authentication data (set_id=postmaster@agentallianz.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.106.49.149
country_id: 3932488
description:
2026-01-13 20:37:40 dovecot_login authenticator failed for H=([200.106.49.149]) [200.106.49.149]:44794: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.200.95.18
country_id: 290557
description:
2026-01-13 20:41:34 dovecot_login authenticator failed for H=([94.200.95.18]) [94.200.95.18]:52648: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.39
country_id: 2186224
description:
2026-01-13 20:42:02 dovecot_login authenticator failed for H=([121.73.163.39]) [121.73.163.39]:41034: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 13 20:45:51 host2 sshd[3274591]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.219.235.108
country_id: 6252001
description:
Jan 13 20:51:23 host2 sshd[3279367]: Invalid user cloudtourssrilan_travel from 104.219.235.108 port 51045


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan 13 20:52:58 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@seyawin.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<JxLrkEZI9aZ100Db>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.127
country_id: 3017382
description:
Jan 13 20:53:40 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=91.196.152.127, lip=66.85.158.92, session=<KPOJk0ZIY5ZbxJh/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.38
country_id: 3017382
description:
Jan 13 20:53:50 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=91.196.152.38, lip=66.85.158.92, session=<+dwmlEZIg6VbxJgm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.34
country_id: 3017382
description:
Jan 13 20:54:03 host2 dovecot[3239883]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=91.196.152.34, lip=66.85.158.92, session=<hK3qlEZI2dtbxJgi>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.32
country_id: 3017382
description:
Jan 13 20:54:06 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.196.152.32, lip=66.85.158.92, session=<5x0dlUZI05VbxJgg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.27
country_id: 2186224
description:
2026-01-13 20:54:10 dovecot_login authenticator failed for H=([121.73.163.27]) [121.73.163.27]:39586: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.75.110
country_id: 1149361
description:
2026-01-13 20:54:34 dovecot_login authenticator failed for H=([180.94.75.110]) [180.94.75.110]:51502: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 178.253.42.163
country_id: 390903
description:
Jan 13 20:57:06 host2 sshd[3284699]: Disconnected from invalid user admin 178.253.42.163 port 48908 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 23.236.169.235
country_id: 6252001
description:
Jan 13 20:58:03 host2 sshd[3285480]: Disconnected from invalid user admin 23.236.169.235 port 36624 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 23.236.169.235
country_id: 6252001
description:
Jan 13 20:58:34 host2 sshd[3285848]: Disconnected from invalid user ubuntu 23.236.169.235 port 47830 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 23.236.169.235
country_id: 6252001
description:
Jan 13 21:00:09 host2 sshd[3287284]: Disconnected from invalid user ubuntu 23.236.169.235 port 53218 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.218.2
country_id: 1269750
description:
2026-01-13 21:01:33 dovecot_login authenticator failed for H=([61.246.205.1]) [125.19.218.2]:53298: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.34.70.2
country_id: 2510769
description:
2026-01-13 21:02:11 dovecot_login authenticator failed for H=2.red-83-34-70.dynamicip.rima-tde.net [83.34.70.2]:54381: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 178.253.42.163
country_id: 390903
description:
Jan 13 21:02:32 host2 sshd[3289362]: Disconnected from invalid user ubuntu 178.253.42.163 port 47462 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.157
country_id: 1814991
description:
Jan 13 21:03:07 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=94.231.206.157, lip=66.85.158.92, session=<1hlctUZIGc5e586d>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.202
country_id: 1814991
description:
Jan 13 21:03:18 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=94.231.206.202, lip=66.85.158.92, session=<5LT6tUZIcYpe587K>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.153
country_id: 1814991
description:
Jan 13 21:03:38 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=94.231.206.153, lip=66.85.158.92, session=<bUEyt0ZIW9te586Z>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.205
country_id: 1814991
description:
Jan 13 21:03:34 host2 dovecot[3239883]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=94.231.206.205, lip=66.85.158.92, session=<f+XytkZIF6de587N>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.54.70.40
country_id: 3686110
description:
2026-01-13 21:18:29 dovecot_login authenticator failed for H=(static-ip-1815407040.cable.net.co) [181.54.70.40]:48666: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.220.236.203
country_id: 660013
description:
2026-01-13 21:18:55 dovecot_login authenticator failed for H=([62.220.236.203]) [62.220.236.203]:49022: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.66.109.194
country_id: 932692
description:
2026-01-13 21:22:15 dovecot_login authenticator failed for H=([154.66.109.244]) [154.66.109.194]:53596: 535 Incorrect authentication data (set_id=hostmaster@2s-travels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.237.119.118
country_id: 6252001
description:
2026-01-13 21:22:31 dovecot_login authenticator failed for H=118-119-237-24.gci.net [24.237.119.118]:42476: 535 Incorrect authentication data (set_id=hostmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.167.117
country_id: 99237
description:
2026-01-13 21:22:36 dovecot_login authenticator failed for H=([65.20.167.117]) [65.20.167.117]:33786: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.148.10.122
country_id: 2750405
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 45.148.10.122 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilan_travel (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.142.184.55
country_id: 1210997
description:
2026-01-13 21:23:04 dovecot_login authenticator failed for H=([103.133.175.82]) [103.142.184.55]:55032: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.231.25.64
country_id: 3686110
description:
2026-01-13 21:23:53 dovecot_login authenticator failed for H=(1522312565.colombiatel.co) [152.231.25.64]:49530: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.37.198.190
country_id: 6252001
description:
2026-01-13 21:24:28 dovecot_login authenticator failed for H=(host190.covisint.com) [64.37.198.190]:55857: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.149
country_id: 6252001
description:
Jan 13 21:27:51 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 14 secs): user=<>, rip=147.185.133.149, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<GcfQDUdIssWTuYWV>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.64.150
country_id: 1269750
description:
2026-01-13 21:27:15 dovecot_login authenticator failed for H=([125.23.229.42]) [182.78.64.150]:60452: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.216.169.12
country_id: 2328926
description:
2026-01-13 21:27:34 dovecot_login authenticator failed for H=([41.216.169.12]) [41.216.169.12]:46690: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.149
country_id: 6252001
description:
Jan 13 21:28:47 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 5 secs): user=<>, rip=147.185.133.149, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<xXEkEUdIdO6TuYWV>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.149
country_id: 6252001
description:
Jan 13 21:29:15 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 8 secs): user=<>, rip=147.185.133.149, lip=66.85.158.92, TLS: read(size=403) failed: Connection reset by peer, session=<vXbMEkdIBuyTuYWV>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.201.228.210
country_id: 99237
description:
2026-01-13 21:31:40 dovecot_login authenticator failed for H=([62.201.228.210]) [62.201.228.210]:34462: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.238.210.226
country_id: 3469034
description:
2026-01-13 21:32:00 dovecot_login authenticator failed for H=([186.238.210.226]) [186.238.210.226]:42945: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.148.194
country_id: 99237
description:
2026-01-13 21:33:11 dovecot_plain authenticator failed for H=(calles) [65.20.148.194]:38520: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.149
country_id: 6252001
description:
Jan 13 21:35:51 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=147.185.133.149, lip=66.85.158.92, TLS, session=<c1tfKkdI3POTuYWV>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.238
country_id: 2635167
description:
Jan 13 21:36:00 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 5 secs): user=<>, rip=35.203.210.238, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<zAXpKkdInc0jy9Lu>


plugin: ossec
rule: 9703
name: Dovecot is Starting Up.
description:
Jan 13 21:36:40 host2 dovecot[3335543]: master: Dovecot v2.3.21.1 (d492236fa0) starting up for lmtp, imap, pop3 (core dumps disabled)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.56.0.19
country_id: 3469034
description:
2026-01-13 21:36:13 dovecot_login authenticator failed for H=(177-215-153-215.user.vivozap.com.br) [189.56.0.19]:39274: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.149
country_id: 6252001
description:
Jan 13 21:36:44 host2 dovecot[3335587]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.133.149, lip=66.85.158.92, TLS, session=<wtyNLUdIvOyTuYWV>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.176.126
country_id: 1269750
description:
2026-01-13 21:36:53 dovecot_login authenticator failed for H=(nsg-corporate-126.176.185.122.airtel.in) [122.185.176.126]:47112: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.238
country_id: 2635167
description:
Jan 13 21:37:00 host2 dovecot[3335587]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 5 secs): user=<>, rip=35.203.210.238, lip=66.85.158.91, TLS: read(size=403) failed: Connection reset by peer, session=<Oo+JLkdI8vEjy9Lu>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.58.18
country_id: 1269750
description:
2026-01-13 21:37:27 dovecot_login authenticator failed for H=([125.17.10.161]) [182.95.58.18]:50802: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.238
country_id: 2635167
description:
Jan 13 21:37:11 host2 dovecot[3335587]: pop3-login: Disconnected: Connection closed: read(size=429) failed: Connection reset by peer (no auth attempts in 5 secs): user=<>, rip=35.203.210.238, lip=66.85.158.91, TLS: read(size=429) failed: Connection reset by peer, session=<ljIyL0dIbuAjy9Lu>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.238
country_id: 2635167
description:
Jan 13 21:43:38 host2 dovecot[3335587]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=35.203.210.238, lip=66.85.158.91, TLS, session=<Wrk3RkdIxP8jy9Lu>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.219
country_id: 6252001
description:
Jan 13 21:46:48 host2 pure-ftpd[3344959]: (?@147.185.132.219) [INFO] New connection from 147.185.132.219


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan 13 21:48:38 host2 sshd[3346088]: Disconnected from invalid user user 2.57.121.25 port 5962 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.132.97.76
country_id: 2264397
description:
2026-01-13 21:50:02 dovecot_login authenticator failed for H=a94-132-97-76.cpe.netcabo.pt [94.132.97.76]:34650: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.53.7.231
country_id: 6252001
description:
2026-01-13 21:50:41 dovecot_login authenticator failed for H=([64.53.7.231]) [64.53.7.231]:48996: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.123.202
country_id: 1269750
description:
2026-01-13 21:54:50 dovecot_login authenticator failed for H=([182.95.123.202]) [182.95.123.202]:57160: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.192.245.178
country_id: 1269750
description:
2026-01-13 21:55:01 dovecot_login authenticator failed for H=(dhcp-192-245-178.in2cable.com) [203.192.245.178]:48430: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.64.162.195
country_id: 1643084
description:
Jan 13 21:55:23 host2 sshd[3352805]: Disconnected from invalid user alertmanager 36.64.162.195 port 47324 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 72.240.125.133
country_id: 6252001
description:
Jan 13 21:55:38 host2 sshd[3353023]: Disconnected from invalid user role1 72.240.125.133 port 60070 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 72.240.125.133
country_id: 6252001
description:
Jan 13 21:56:50 host2 sshd[3354065]: Disconnected from invalid user Admin 72.240.125.133 port 55400 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.18.228.75
country_id: 3686110
description:
Jan 13 21:56:38 host2 sshd[3353882]: Disconnected from invalid user websphere 161.18.228.75 port 60276 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.18.228.75
country_id: 3686110
description:
Jan 13 21:57:16 host2 sshd[3354466]: Disconnected from invalid user extreme 161.18.228.75 port 43142 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.160.107
country_id: 99237
description:
2026-01-13 21:57:48 dovecot_plain authenticator failed for H=(ablesiver) [65.20.160.107]:36980: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 36.64.162.195
country_id: 1643084
description:
Jan 13 21:58:13 host2 sshd[3355209]: Disconnected from invalid user amcrest 36.64.162.195 port 37816 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.18.228.75
country_id: 3686110
description:
Jan 13 21:58:22 host2 sshd[3355331]: Disconnected from invalid user zimbra 161.18.228.75 port 37128 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 123.58.213.127
country_id: 1819730
description:
Jan 13 21:59:45 host2 sshd[3356223]: Disconnected from invalid user dbadmin 123.58.213.127 port 42904 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.45.237.132
country_id: 6252001
description:
Jan 13 22:01:09 host2 sshd[3357415]: Disconnected from invalid user ubuntu 45.45.237.132 port 60036 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 123.58.213.127
country_id: 1819730
description:
Jan 13 22:01:09 host2 sshd[3357384]: Disconnected from invalid user websphere 123.58.213.127 port 57054 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.45.237.132
country_id: 6252001
description:
Jan 13 22:01:38 host2 sshd[3357705]: Disconnected from invalid user ubuntu 45.45.237.132 port 43202 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 123.58.213.127
country_id: 1819730
description:
Jan 13 22:01:49 host2 sshd[3357813]: Disconnected from invalid user nagiosadmin 123.58.213.127 port 60194 [preauth]


