# incident

plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.239.218.115
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 173.239.218.115 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilan_travel (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.183.110.215
country_id: 798544
description:
2026-01-16 07:31:06 dovecot_login authenticator failed for H=178.183.110.215.mobile.static.t-mobile.pl [178.183.110.215]:44504: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 66.116.204.139
country_id: 1269750
description:
Jan 16 07:31:15 host2 sshd[2110141]: User agentallianz from 66.116.204.139 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 181.16.212.54
country_id: 3865483
description:
Jan 16 07:33:19 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=181.16.212.54, lip=66.85.158.91, TLS, session=<BM+RvXdIp8+1ENQ2>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.196.110.87
country_id: 798544
description:
Jan 16 07:33:36 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<careers>, method=PLAIN, rip=91.196.110.87, lip=66.85.158.91, TLS, session=<itzavndIq+hbxG5X>


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 64.225.40.153
country_id: 6252001
description:
Jan 16 07:42:43 host2 sshd[2119691]: User agentallianz from 64.225.40.153 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 16 07:43:43 host2 sshd[2120451]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.46.106
country_id: 953987
description:
Jan 16 07:46:03 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=102.64.46.106, lip=66.85.158.91, TLS, session=<Cqcm63dIsOBmQC5q>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.110.213.247
country_id: 6251999
description:
Jan 16 07:45:50 host2 sshd[2122364]: Invalid user agronatureholdings from 143.110.213.247 port 58254


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.238.63.168
country_id: 798544
description:
Jan 16 07:46:21 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<env_eng>, method=PLAIN, rip=185.238.63.168, lip=66.85.158.91, TLS, session=<Nm9q7HdIdKa57j+o>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.45.235.112
country_id: 2510769
description:
2026-01-16 07:48:43 dovecot_login authenticator failed for H=112.red-83-45-235.dynamicip.rima-tde.net [83.45.235.112]:34018: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.121.175.220
country_id: 3579143
description:
2026-01-16 07:48:52 dovecot_login authenticator failed for H=(client-adsl-93-121-175-220.mediaserv.net) [93.121.175.220]:36344: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.245
country_id: 3017382
description:
Jan 16 07:52:08 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=91.231.89.245, lip=66.85.158.91, TLS handshaking: Connection closed, session=<Wa0ZAnhIj+Bb51n1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.143
country_id: 3017382
description:
Jan 16 07:52:35 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.231.89.143, lip=66.85.158.91, TLS: Connection closed, session=<1By1A3hI56xb51mP>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.142
country_id: 3017382
description:
Jan 16 07:52:19 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=91.231.89.142, lip=66.85.158.91, TLS: Connection closed, session=<5nC6AnhIJ+pb51mO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.140
country_id: 3017382
description:
Jan 16 07:52:32 host2 dovecot[221878]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=91.231.89.140, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<ggaFA3hI+Y1b51mM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.49.113
country_id: 3144096
description:
2026-01-16 07:53:34 dovecot_login authenticator failed for H=(cm-178.232.49.113.get.no) [178.232.49.113]:37184: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.215.245.175
country_id: 3469034
description:
2026-01-16 07:53:44 dovecot_login authenticator failed for H=([186.239.240.127]) [186.215.245.175]:33876: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.210.126.172
country_id: 294640
description:
2026-01-16 07:57:11 dovecot_login authenticator failed for H=([46.210.126.172]) [46.210.126.172]:43374: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.90.12.192
country_id: 6252001
description:
Jan 16 07:57:28 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.90.12.192, lip=66.85.158.91, TLS, session=<b/AoFXhInK8DWgzA>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.208
country_id: 6252001
description:
Jan 16 07:58:25 host2 dovecot[221878]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.208, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<nZiVGHhIK9rG6xjQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.252.85
country_id: 1210997
description:
2026-01-16 07:59:12 dovecot_login authenticator failed for H=([103.115.252.60]) [103.115.252.85]:32861: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 185.93.89.48
country_id: 130758
description:
Jan 16 08:02:28 host2 sshd[2135991]: User agentallianz from 185.93.89.48 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 139.59.46.198
country_id: 1269750
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 139.59.46.198 - lezzarot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarot (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.22
country_id: 1269750
description:
2026-01-16 08:03:41 dovecot_login authenticator failed for H=([122.184.136.185]) [182.95.181.22]:57016: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.168.61
country_id: 2186224
description:
2026-01-16 08:04:47 dovecot_login authenticator failed for H=([121.73.168.61]) [121.73.168.61]:54444: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.201.79
country_id: 1733045
description:
2026-01-16 08:05:08 dovecot_login authenticator failed for H=([49.125.201.79]) [49.125.201.79]:46576: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 52.165.81.253
country_id: 6252001
description:
Jan 16 08:06:05 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=52.165.81.253, lip=66.85.158.92, session=<Vy72M3hIRNc0pVH9>


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 64.225.40.153
country_id: 6252001
description:
Jan 16 08:06:11 host2 sshd[2138982]: User agentallianz from 64.225.40.153 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.4
country_id: 99237
description:
2026-01-16 08:07:19 dovecot_plain authenticator failed for H=(quilater) [65.20.133.4]:32798: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 207.90.244.14
country_id: 6252001
description:
Jan 16 08:08:47 host2 dovecot[221878]: imap-login: Disconnected: Connection closed: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record (no auth attempts in 0 secs): user=<>, rip=207.90.244.14, lip=66.85.158.92, TLS: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record, session=<6JyhPXhIiNjPWvQO>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 207.90.244.14
country_id: 6252001
description:
Jan 16 08:08:47 host2 dovecot[221878]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=207.90.244.14, lip=66.85.158.92, TLS, session=<jIWdPXhIhtjPWvQO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.230
country_id: 2635167
description:
Jan 16 08:11:11 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=87.236.176.230, lip=66.85.158.91, TLS handshaking: Connection closed, session=<jCYxRnhIh5VX7LDm>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.18
country_id: 2635167
description:
Jan 16 08:11:10 host2 dovecot[221878]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=185.247.137.18, lip=66.85.158.91, TLS, session=<oBYgRnhIFbO594kS>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.224
country_id: 2635167
description:
Jan 16 08:11:44 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.224, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<kpgsSHhIwb1X7LDg>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.127
country_id: 6252001
description:
Jan 16 08:11:45 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 7 secs): user=<>, rip=162.216.150.127, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<HJ07SHhIT9Ci2JZ/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.219
country_id: 2635167
description:
Jan 16 08:12:17 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed: read(size=679) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.219, lip=66.85.158.91, TLS handshaking: read(size=679) failed: Connection reset by peer, session=<mt4nSnhIs6FX7LDb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.127
country_id: 6252001
description:
Jan 16 08:12:38 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=162.216.150.127, lip=66.85.158.91, TLS: read(size=403) failed: Connection reset by peer, session=</mlsS3hIIuCi2JZ/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.218
country_id: 2635167
description:
Jan 16 08:12:50 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed: read(size=693) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.218, lip=66.85.158.91, TLS handshaking: read(size=693) failed: Connection reset by peer, session=<Lm0jTHhIR5hX7LDa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.240
country_id: 2635167
description:
Jan 16 08:13:24 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed: read(size=612) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.240, lip=66.85.158.91, TLS handshaking: read(size=612) failed: Connection reset by peer, session=<wKceTnhIu9FX7LDw>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 35.216.254.237
country_id: 2658434
description:
Jan 16 08:13:32 host2 pure-ftpd[2145593]: (?@35.216.254.237) [INFO] New connection from 35.216.254.237


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.222.62
country_id: 1269750
description:
2026-01-16 08:13:32 dovecot_plain authenticator failed for H=(percyal) [125.19.222.62]:55296: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 35.216.254.237
country_id: 2658434
description:
Jan 16 08:13:36 host2 pure-ftpd[2145646]: (?@35.216.254.237) [INFO] New connection from 35.216.254.237


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.250
country_id: 2635167
description:
Jan 16 08:13:57 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=185.247.137.250, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<aBUYUHhI0+a594n6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.235
country_id: 2635167
description:
Jan 16 08:14:30 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.235, lip=66.85.158.91, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<nG0VUnhI98y594nr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan 16 08:14:47 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 5 secs): user=<contact@seyawin.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<qXzIUnhIvqx100Db>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.250
country_id: 2635167
description:
Jan 16 08:15:03 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.250, lip=66.85.158.91, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<XdAQVHhIs62594n6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.222
country_id: 2635167
description:
Jan 16 08:15:37 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=87.236.176.222, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<ZD8KVnhId65X7LDe>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.23.209.47
country_id: 3865483
description:
2026-01-16 08:15:36 dovecot_login authenticator failed for H=(cpe-186-23-209-47.telecentro-reversos.com.ar) [186.23.209.47]:56987: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.55.189.211
country_id: 6252001
description:
2026-01-16 08:15:57 dovecot_login authenticator failed for H=([67.55.189.211]) [67.55.189.211]:59198: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.239
country_id: 2635167
description:
Jan 16 08:16:10 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=185.247.137.239, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<orEFWHhIV+K594nv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.185.158
country_id: 1269750
description:
2026-01-16 08:16:16 dovecot_login authenticator failed for H=([182.95.185.158]) [182.95.185.158]:33266: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.200.42.112
country_id: 1880251
description:
2026-01-16 08:16:43 dovecot_login authenticator failed for H=(bb118-200-42-112.singnet.com.sg) [118.200.42.112]:56204: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.157.116.167
country_id: 6251999
description:
2026-01-16 08:16:54 dovecot_login authenticator failed for H=d157-116-167.home4.cgocable.net [24.157.116.167]:50910: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.124.139.77
country_id: 3144096
description:
2026-01-16 08:17:16 dovecot_login authenticator failed for H=([188.124.139.77]) [188.124.139.77]:36143: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 66.116.204.139
country_id: 1269750
description:
Jan 16 08:17:22 host2 sshd[2148756]: User agentallianz from 66.116.204.139 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 162.240.229.246
country_id: 6252001
description:
Jan 16 08:18:38 host2 sshd[2149764]: User agentallianz from 162.240.229.246 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.46.148.180
country_id: 6252001
description:
2026-01-16 08:19:01 dovecot_plain authenticator failed for H=c-68-46-148-180.hsd1.mi.comcast.net (unhed) [68.46.148.180]:44838: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.127
country_id: 6252001
description:
Jan 16 08:19:33 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.150.127, lip=66.85.158.91, TLS, session=<Yo4fZHhIFO+i2JZ/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 207.90.244.14
country_id: 6252001
description:
Jan 16 08:28:48 host2 dovecot[221878]: imap-login: Disconnected: Connection closed: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record (no auth attempts in 0 secs): user=<>, rip=207.90.244.14, lip=66.85.158.91, TLS: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record, session=<CbQwhXhIGL7PWvQO>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 207.90.244.14
country_id: 6252001
description:
Jan 16 08:28:47 host2 dovecot[221878]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=207.90.244.14, lip=66.85.158.91, TLS, session=<h2wthXhICL7PWvQO>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.110.213.247
country_id: 6251999
description:
Jan 16 08:30:11 host2 sshd[2160201]: Invalid user agronatureholdings from 143.110.213.247 port 45780


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan 16 08:35:45 host2 sshd[2164792]: User agentallianz from 35.186.147.126 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.46.45.121
country_id: 290557
description:
2026-01-16 08:37:11 dovecot_login authenticator failed for H=([20.46.45.121]) [20.46.45.121]:57107: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.195.126
country_id: 6252001
description:
Jan 16 08:38:01 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.65.195.126, lip=66.85.158.92, session=<M0UtpnhIhIUUQcN+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.200.42.112
country_id: 1880251
description:
2026-01-16 08:37:37 dovecot_login authenticator failed for H=(bb118-200-42-112.singnet.com.sg) [118.200.42.112]:48438: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.220
country_id: 130758
description:
2026-01-16 08:39:57 dovecot_login authenticator failed for H=(localhost) [62.60.130.220]:50954: 535 Incorrect authentication data (set_id=planning)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.87.18
country_id: 1269750
description:
2026-01-16 08:40:12 dovecot_login authenticator failed for H=([182.95.197.193]) [182.79.87.18]:58272: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.127.244.67
country_id: 6252001
description:
Jan 16 08:41:12 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.127.244.67, lip=66.85.158.91, TLS, session=<cWGSsXhIPNYUf/RD>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.46.124.0
country_id: 3686110
description:
2026-01-16 08:40:33 dovecot_login authenticator failed for H=(azteca-comunicaciones.com) [201.46.124.0]:1048: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 66.116.204.139
country_id: 1269750
description:
Jan 16 08:40:48 host2 sshd[2168901]: User agentallianz from 66.116.204.139 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.14.75.6
country_id: 6252001
description:
Jan 16 08:44:25 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.14.75.6, lip=66.85.158.91, session=<0rwMvXhIooEUDksG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan 16 08:44:56 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<fpfIvnhIvKp100Db>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 16 08:47:30 host2 sshd[2175469]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 185.93.89.48
country_id: 130758
description:
Jan 16 08:48:47 host2 sshd[2177388]: User agentallianz from 185.93.89.48 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.23.140
country_id: 3144096
description:
2026-01-16 08:51:12 dovecot_login authenticator failed for H=(cm-178.232.23.140.get.no) [178.232.23.140]:44424: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.138.53.19
country_id: 1643084
description:
2026-01-16 08:52:13 dovecot_login authenticator failed for H=([103.138.53.19]) [103.138.53.19]:56517: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.57
country_id: 6252001
description:
Jan 16 08:55:33 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=167.94.146.57, lip=66.85.158.91, TLS: Connection closed, session=<yl7o5HhIbFanXpI5>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.57
country_id: 6252001
description:
Jan 16 08:55:35 host2 dovecot[221878]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=167.94.146.57, lip=66.85.158.91, session=<3VMB5XhIOLanXpI5>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 16 08:56:51 host2 sshd[2186290]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.63.50
country_id: 1269750
description:
2026-01-16 08:57:05 dovecot_login authenticator failed for H=([182.95.63.50]) [182.95.63.50]:46966: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.83.44.142
country_id: 1269750
description:
2026-01-16 08:57:18 dovecot_login authenticator failed for H=(183.83.44.142.actcorp.in) [183.83.44.142]:33136: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.6.121.246
country_id: 3469034
description:
2026-01-16 09:01:56 dovecot_login authenticator failed for H=([191.217.23.65]) [187.6.121.246]:60254: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.219.68.189
country_id: 3865483
description:
2026-01-16 09:02:15 dovecot_login authenticator failed for H=([201.219.68.189]) [201.219.68.189]:56983: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.228.146
country_id: 1269750
description:
2026-01-16 09:02:31 dovecot_login authenticator failed for H=([125.16.32.137]) [125.20.228.146]:36756: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.207.176.58
country_id: 192950
description:
2026-01-16 09:02:50 dovecot_login authenticator failed for H=([196.207.176.58]) [196.207.176.58]:51953: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.159.186
country_id: 1269750
description:
2026-01-16 09:03:37 dovecot_login authenticator failed for H=([125.19.159.186]) [125.19.159.186]:39714: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 86.150.100.174
country_id: 2635167
description:
2026-01-16 09:04:44 dovecot_login authenticator failed for H=host86-150-100-174.range86-150.btcentralplus.com [86.150.100.174]:48618: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.0.183.222
country_id: 3865483
description:
Jan 16 09:07:10 host2 sshd[2195522]: Disconnected from invalid user alcatel 200.0.183.222 port 38336 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.185.243.158
country_id: 6252001
description:
Jan 16 09:07:41 host2 sshd[2195854]: Disconnected from invalid user ansible 20.185.243.158 port 40304 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.5.223
country_id: 2300660
description:
Jan 16 09:09:07 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<careers>, method=PLAIN, rip=41.139.5.223, lip=66.85.158.91, TLS, session=<n4ZFFHlIEogpiwXf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.56.144
country_id: 953987
description:
Jan 16 09:08:46 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=102.129.56.144, lip=66.85.158.91, TLS, session=<siAJE3lI8MhmgTiQ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.90.12.192
country_id: 6252001
description:
Jan 16 09:10:07 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.90.12.192, lip=66.85.158.92, TLS, session=<Jnr5GHlIvIQDWgzA>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.43.212.209
country_id: 3175395
description:
Jan 16 09:09:43 host2 sshd[2197599]: Disconnected from invalid user jenkins 151.43.212.209 port 39874 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 20.185.243.158
country_id: 6252001
description:
Jan 16 09:11:16 host2 sshd[2199042]: Disconnected from invalid user user 20.185.243.158 port 45446 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.43.212.209
country_id: 3175395
description:
Jan 16 09:11:08 host2 sshd[2198931]: Disconnected from invalid user jetty 151.43.212.209 port 39955 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 200.0.183.222
country_id: 3865483
description:
Jan 16 09:13:31 host2 sshd[2200851]: Disconnected from invalid user vps 200.0.183.222 port 56430 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.43.212.209
country_id: 3175395
description:
Jan 16 09:12:40 host2 sshd[2200134]: Disconnected from invalid user device 151.43.212.209 port 39882 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.110.213.247
country_id: 6251999
description:
Jan 16 09:14:12 host2 sshd[2201515]: Invalid user agronatureholdings from 143.110.213.247 port 47496


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 51.159.234.118
country_id: 2750405
description:
Jan 16 09:14:41 host2 pure-ftpd[2201913]: (?@51.159.234.118) [INFO] New connection from 51.159.234.118


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 51.159.234.118
country_id: 2750405
description:
Jan 16 09:14:41 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1420918C:SSL routines:tls_early_post_process_client_hello:version too low (no auth attempts in 0 secs): user=<>, rip=51.159.234.118, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1420918C:SSL routines:tls_early_post_process_client_hello:version too low, session=<nmxJKXlImrozn+p2>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.202.118.19
country_id: 6252001
description:
Jan 16 09:15:40 host2 dovecot[221878]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=172.202.118.19, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<9//KLHlI1uCsynYT>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.42.225.40
country_id: 2510769
description:
2026-01-16 09:17:20 dovecot_plain authenticator failed for H=40.red-81-42-225.staticip.rima-tde.net (philiess) [81.42.225.40]:55512: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 152.32.140.12
country_id: 2328926
description:
Jan 16 09:26:21 host2 dovecot[221878]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=152.32.140.12, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<E9ANU3lIQrWYIIwM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.122
country_id: 1269750
description:
2026-01-16 09:27:05 dovecot_login authenticator failed for H=([182.95.176.122]) [182.95.176.122]:55920: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.194.231
country_id: 3144096
description:
2026-01-16 09:26:40 dovecot_login authenticator failed for H=(cm-178.232.194.231.get.no) [178.232.194.231]:59653: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 152.32.140.12
country_id: 2328926
description:
Jan 16 09:26:51 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (no auth attempts in 18 secs): user=<>, rip=152.32.140.12, lip=66.85.158.92, TLS, session=<EuDXVHlIJIqYIIwM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan 16 09:27:52 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<webmaster@seyawin.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<CMJMWHlIkKt100Db>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 152.32.140.12
country_id: 2328926
description:
Jan 16 09:29:19 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=152.32.140.12, lip=66.85.158.91, TLS, session=<kGSjXXlIft2YIIwM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.213.236.66
country_id: 6252001
description:
2026-01-16 09:29:21 dovecot_plain authenticator failed for H=c-73-213-236-66.hsd1.va.comcast.net (cablant) [73.213.236.66]:44492: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 152.32.140.12
country_id: 2328926
description:
Jan 16 09:29:50 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (no auth attempts in 19 secs): user=<>, rip=152.32.140.12, lip=66.85.158.91, TLS, session=<RGF5X3lIANSYIIwM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.168.188
country_id: 3175395
description:
Jan 16 09:31:28 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<env_eng>, method=PLAIN, rip=185.15.168.188, lip=66.85.158.91, TLS, session=<XGleZHlIi565D6i8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.68.178.59
country_id: 3175395
description:
Jan 16 09:31:11 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=185.68.178.59, lip=66.85.158.91, TLS, session=<sXhDY3lIUgi5RLI7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.59
country_id: 6252001
description:
Jan 16 09:33:14 host2 dovecot[221878]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=167.94.146.59, lip=66.85.158.91, session=<SIiea3lILKWnXpI7>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 110.78.149.39
country_id: 1605651
description:
Jan 16 09:33:20 host2 sshd[2217227]: Disconnected from invalid user admin 110.78.149.39 port 52842 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.159.186
country_id: 1269750
description:
2026-01-16 09:34:08 dovecot_login authenticator failed for H=([125.19.159.186]) [125.19.159.186]:35820: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.153.135
country_id: 1819730
description:
2026-01-16 09:34:31 dovecot_login authenticator failed for H=(223-197-153-135.static.imsbiz.com) [223.197.153.135]:55382: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 110.78.149.39
country_id: 1605651
description:
Jan 16 09:35:10 host2 sshd[2218521]: Disconnected from invalid user ubuntu 110.78.149.39 port 44092 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 110.78.149.39
country_id: 1605651
description:
Jan 16 09:35:43 host2 sshd[2218930]: Disconnected from invalid user admin 110.78.149.39 port 56166 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.110.213.247
country_id: 6251999
description:
Jan 16 09:35:55 host2 sshd[2219080]: Invalid user agronatureholdings from 143.110.213.247 port 45562


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.200
country_id: 6252001
description:
Jan 16 09:36:44 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 7 secs): user=<>, rip=147.185.133.200, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<R3cneHlI+s6TuYXI>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.200
country_id: 6252001
description:
Jan 16 09:37:42 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed: read(size=429) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=147.185.133.200, lip=66.85.158.92, TLS: read(size=429) failed: Connection reset by peer, session=<cdCXe3lI1ueTuYXI>


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan 16 09:40:27 host2 sshd[2222653]: User agentallianz from 35.186.147.126 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.193.112.85
country_id: 6252001
description:
2026-01-16 09:41:13 dovecot_plain authenticator failed for H=c-98-193-112-85.hsd1.il.comcast.net (tables) [98.193.112.85]:33860: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.60.143.30
country_id: 3175395
description:
2026-01-16 09:42:17 dovecot_login authenticator failed for H=([151.60.143.30]) [151.60.143.30]:41432: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.92.202
country_id: 1269750
description:
2026-01-16 09:43:19 dovecot_login authenticator failed for H=([125.17.215.121]) [27.123.92.202]:44260: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.64.3.94
country_id: 1269750
description:
2026-01-16 09:42:35 dovecot_login authenticator failed for H=(aes-static-049.93.22.125.airtel.in) [182.64.3.94]:59466: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.74.0.182
country_id: 3469034
description:
2026-01-16 09:43:48 dovecot_login authenticator failed for H=([177.74.52.129]) [177.74.0.182]:47878: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.93.215.39
country_id: 3469034
description:
Jan 16 09:44:15 host2 sshd[2225159]: Disconnected from invalid user mongoadmin 177.93.215.39 port 36122 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.200
country_id: 6252001
description:
Jan 16 09:44:17 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=147.185.133.200, lip=66.85.158.92, TLS, session=<exAkk3lI8uyTuYXI>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.93.215.39
country_id: 3469034
description:
Jan 16 09:45:26 host2 sshd[2226127]: Disconnected from invalid user manager 177.93.215.39 port 52526 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.248.30.205
country_id: 1269750
description:
2026-01-16 09:45:48 dovecot_login authenticator failed for H=([103.248.30.205]) [103.248.30.205]:60239: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 177.93.215.39
country_id: 3469034
description:
Jan 16 09:46:05 host2 sshd[2226759]: Disconnected from invalid user kubernetes 177.93.215.39 port 35332 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.107.163.195
country_id: 3932488
description:
2026-01-16 09:46:16 dovecot_login authenticator failed for H=([200.107.163.195]) [200.107.163.195]:18620: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.93.215.39
country_id: 3469034
description:
Jan 16 09:46:42 host2 sshd[2227357]: Disconnected from invalid user User3 177.93.215.39 port 46374 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.236.228.222
country_id: 6252001
description:
Jan 16 09:46:45 host2 dovecot[221878]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=172.236.228.222, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<0Kf5m3lIdiWs7OTe>


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 185.93.89.48
country_id: 130758
description:
Jan 16 09:51:32 host2 sshd[2230853]: User agentallianz from 185.93.89.48 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 64.225.40.153
country_id: 6252001
description:
Jan 16 09:54:48 host2 sshd[2233729]: User agentallianz from 64.225.40.153 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.158.14.232
country_id: 1512440
description:
2026-01-16 09:58:23 dovecot_login authenticator failed for H=([195.158.14.232]) [195.158.14.232]:57300: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.50
country_id: 6252001
description:
Jan 16 10:02:02 host2 pure-ftpd[2239621]: (?@205.210.31.50) [INFO] New connection from 205.210.31.50


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan 16 10:04:09 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@seyawin.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<UKIU2nlIqsV100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.211.94.35
country_id: 289688
description:
2026-01-16 10:05:47 dovecot_login authenticator failed for H=([37.211.94.35]) [37.211.94.35]:54670: 535 Incorrect authentication data (set_id=postmaster@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.145.122.196
country_id: 3175395
description:
2026-01-16 10:06:02 dovecot_login authenticator failed for H=([82.145.122.196]) [82.145.122.196]:36202: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 185.93.89.48
country_id: 130758
description:
Jan 16 10:07:24 host2 sshd[2243513]: User agentallianz from 185.93.89.48 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 152.32.197.166
country_id: 3469034
description:
Jan 16 10:10:14 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=152.32.197.166, lip=66.85.158.91, TLS, session=<Cb7173lIptGYIMWm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.96.62.29
country_id: 1269750
description:
2026-01-16 10:11:08 dovecot_login authenticator failed for H=([59.96.62.29]) [59.96.62.29]:47436: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 152.32.197.166
country_id: 3469034
description:
Jan 16 10:10:43 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (no auth attempts in 18 secs): user=<>, rip=152.32.197.166, lip=66.85.158.91, TLS, session=<G3i38XlIcoeYIMWm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.212
country_id: 1819730
description:
2026-01-16 10:11:41 dovecot_login authenticator failed for H=212.42.246.220.static.netvigator.com [220.246.42.212]:57456: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.213.237.28
country_id: 6252001
description:
2026-01-16 10:12:18 dovecot_plain authenticator failed for H=c-73-213-237-28.hsd1.va.comcast.net (aphening) [73.213.237.28]:40386: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.169.224.27
country_id: 6252001
description:
2026-01-16 10:14:46 dovecot_plain authenticator failed for H=c-174-169-224-27.hsd1.vt.comcast.net (evass) [174.169.224.27]:52454: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 152.32.197.166
country_id: 3469034
description:
Jan 16 10:17:50 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=152.32.197.166, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<Nf0oC3pIGJaYIMWm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 152.32.197.166
country_id: 3469034
description:
Jan 16 10:18:38 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (no auth attempts in 18 secs): user=<>, rip=152.32.197.166, lip=66.85.158.92, TLS handshaking: Connection closed, session=<RH79DXpIBMCYIMWm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.81
country_id: 1269750
description:
2026-01-16 10:21:22 dovecot_login authenticator failed for H=(nsg-corporate-81.230.187.122.airtel.in) [122.187.230.81]:56397: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.123.219.82
country_id: 6252001
description:
2026-01-16 10:21:35 dovecot_login authenticator failed for H=ool-457bdb52.dyn.optonline.net [69.123.219.82]:38860: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.110.213.247
country_id: 6251999
description:
Jan 16 10:21:00 host2 sshd[2253417]: Invalid user agronatureholdings from 143.110.213.247 port 60960


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.255.208
country_id: 2542007
description:
2026-01-16 10:21:48 dovecot_login authenticator failed for H=([154.144.255.208]) [154.144.255.208]:47480: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.213
country_id: 1269750
description:
2026-01-16 10:22:02 dovecot_login authenticator failed for H=(nsg-corporate-213.230.187.122.airtel.in) [122.187.230.213]:52595: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.171.7.149
country_id: 1733045
description:
2026-01-16 10:21:38 dovecot_login authenticator failed for H=([183.171.7.149]) [183.171.7.149]:34214: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.36
country_id: 1269750
description:
2026-01-16 10:21:44 dovecot_login authenticator failed for H=(nsg-corporate-36.229.187.122.airtel.in) [122.187.229.36]:42787: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.55.89.5
country_id: 1269750
description:
2026-01-16 10:21:45 dovecot_login authenticator failed for H=([103.55.89.5]) [103.55.89.5]:45868: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.237.47.214
country_id: 3996063
description:
2026-01-16 10:22:03 dovecot_login authenticator failed for H=(customer-187-237-47-214.uninet-ide.com.mx) [187.237.47.214]:42960: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.166
country_id: 2993457
description:
Jan 16 10:22:22 host2 dovecot[221878]: imap-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=194.165.16.166, lip=66.85.158.92, session=<qshgG3pIkv7CpRCm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.139.107.146
country_id: 1269750
description:
2026-01-16 10:21:40 dovecot_login authenticator failed for H=([14.139.107.146]) [14.139.107.146]:55488: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.66.214.34
country_id: 1269750
description:
2026-01-16 10:22:00 dovecot_login authenticator failed for H=(nsg-corporate-78.223.187.122.airtel.in) [182.66.214.34]:53818: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.57.39.170
country_id: 6252001
description:
2026-01-16 10:23:49 dovecot_login authenticator failed for H=(syn-184-057-039-170.res.spectrum.com) [184.57.39.170]:55096: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.168.161
country_id: 2186224
description:
2026-01-16 10:24:01 dovecot_login authenticator failed for H=([121.73.168.161]) [121.73.168.161]:34360: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan 16 10:24:15 host2 sshd[2255993]: User agentallianz from 35.186.147.126 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 16 10:26:48 host2 sshd[2258035]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.132.32.143
country_id: 6252001
description:
2026-01-16 10:28:18 dovecot_login authenticator failed for H=(syn-072-132-032-143.res.spectrum.com) [72.132.32.143]:34039: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.145.33
country_id: 1819730
description:
2026-01-16 10:28:05 dovecot_login authenticator failed for H=(223-197-145-33.static.imsbiz.com) [223.197.145.33]:61189: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.150.243.22
country_id: 6252001
description:
2026-01-16 10:30:46 dovecot_plain authenticator failed for H=(ingue) [12.150.243.22]:17561: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan 16 10:32:35 host2 sshd[2262174]: Disconnected from invalid user user 2.57.121.25 port 10834 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 16 10:36:10 host2 sshd[2265079]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.25
country_id: 1733045
description:
2026-01-16 10:35:46 dovecot_login authenticator failed for H=([49.124.153.25]) [49.124.153.25]:59958: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.112.146
country_id: 1269750
description:
2026-01-16 10:36:06 dovecot_login authenticator failed for H=([182.95.85.103]) [182.95.112.146]:40458: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 109.105.210.52
country_id: 2264397
description:
Jan 16 10:37:40 host2 dovecot[221878]: imap-login: Disconnected: Connection closed: SSL_read failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=109.105.210.52, lip=66.85.158.92, TLS: SSL_read failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<RPQZUnpI5ohtadI0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 109.105.210.54
country_id: 2264397
description:
Jan 16 10:37:44 host2 dovecot[221878]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1420918C:SSL routines:tls_early_post_process_client_hello:version too low (no auth attempts in 0 secs): user=<>, rip=109.105.210.54, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1420918C:SSL routines:tls_early_post_process_client_hello:version too low, session=<IrFQUnpIqbFtadI2>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 109.105.210.53
country_id: 2264397
description:
Jan 16 10:37:46 host2 dovecot[221878]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=109.105.210.53, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<5DxsUnpIeZxtadI1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 109.105.210.55
country_id: 2264397
description:
Jan 16 10:37:49 host2 dovecot[221878]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=109.105.210.55, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher, session=<DbyeUnpIxeRtadI3>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 109.105.210.55
country_id: 2264397
description:
Jan 16 10:37:38 host2 dovecot[221878]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=109.105.210.55, lip=66.85.158.92, session=<LH71UXpIL8ZtadI3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan 16 10:39:21 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@seyawin.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<Buz5V3pIOLl100Db>


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 64.225.40.153
country_id: 6252001
description:
Jan 16 10:41:49 host2 sshd[2269410]: User agentallianz from 64.225.40.153 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.233.140.250
country_id: 3469034
description:
2026-01-16 10:44:07 dovecot_login authenticator failed for H=([181.233.140.250]) [181.233.140.250]:37683: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.68.220.15
country_id: 6252001
description:
2026-01-16 10:50:40 dovecot_plain authenticator failed for H=c-73-68-220-15.hsd1.ma.comcast.net (haric) [73.68.220.15]:34592: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 85.217.149.10
country_id: 6251999
description:
Jan 16 11:06:29 host2 pure-ftpd[2288678]: (?@85.217.149.10) [INFO] New connection from 85.217.149.10


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 85.217.149.10
country_id: 6251999
description:
Jan 16 11:06:23 host2 pure-ftpd[2288613]: (?@85.217.149.10) [INFO] New connection from 85.217.149.10


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.8
country_id: 6251999
description:
Jan 16 11:07:38 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=85.217.149.8, lip=66.85.158.92, TLS: Connection closed, session=<M886vXpI4JZV2ZUI>


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan 16 11:07:56 host2 sshd[2289907]: User agentallianz from 35.186.147.126 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.39.235
country_id: 953987
description:
Jan 16 11:08:25 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=102.64.39.235, lip=66.85.158.91, TLS, session=<gFHqvnpIQ9hmQCfr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.62.101
country_id: 953987
description:
Jan 16 11:08:47 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<careers>, method=PLAIN, rip=102.129.62.101, lip=66.85.158.91, TLS, session=<diEwwHpIvO1mgT5l>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.245.182
country_id: 1269750
description:
2026-01-16 11:11:43 dovecot_login authenticator failed for H=([152.52.234.134]) [125.20.245.182]:39912: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.208.58
country_id: 1036973
description:
2026-01-16 11:13:20 dovecot_login authenticator failed for H=([197.219.208.58]) [197.219.208.58]:53584: 535 Incorrect authentication data (set_id=hostmaster@2s-travels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.149.213.242
country_id: 3469034
description:
2026-01-16 11:13:41 dovecot_login authenticator failed for H=([200.149.213.242]) [200.149.213.242]:39547: 535 Incorrect authentication data (set_id=hostmaster)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan 16 11:14:27 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@seyawin.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<A3GB1XpI3KB100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.159.164.28
country_id: 294640
description:
2026-01-16 11:15:23 dovecot_login authenticator failed for H=([85.159.164.28]) [85.159.164.28]:35086: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.165.174.234
country_id: 1269750
description:
2026-01-16 11:15:49 dovecot_login authenticator failed for H=([103.165.174.234]) [103.165.174.234]:57907: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.158
country_id: 1269750
description:
2026-01-16 11:18:30 dovecot_login authenticator failed for H=(nsg-corporate-97.172.186.122.airtel.in) [152.52.236.158]:52954: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.27.32.70
country_id: 6252001
description:
2026-01-16 11:18:36 dovecot_login authenticator failed for H=syn-137-027-032-070.biz.spectrum.com [137.27.32.70]:58802: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.194
country_id: 1269750
description:
2026-01-16 11:18:42 dovecot_login authenticator failed for H=(nsg-corporate-194.230.187.122.airtel.in) [122.187.230.194]:47516: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.183.18
country_id: 1269750
description:
2026-01-16 11:18:52 dovecot_login authenticator failed for H=([125.23.183.18]) [125.23.183.18]:36670: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.106.49.149
country_id: 3932488
description:
2026-01-16 11:19:04 dovecot_login authenticator failed for H=([200.106.49.149]) [200.106.49.149]:38814: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.128.202
country_id: 6252001
description:
2026-01-16 11:19:26 dovecot_login authenticator failed for H=([192.34.128.202]) [192.34.128.202]:58842: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2026-01-16 11:22:16 dovecot_plain authenticator failed for H=(plabons) [102.53.15.17]:47217: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.54
country_id: 6252001
description:
Jan 16 11:27:13 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.235.24.54, lip=66.85.158.92, session=<JaZOA3tIJPXG6xg2>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.110.213.247
country_id: 6251999
description:
Jan 16 11:27:32 host2 sshd[2305534]: Invalid user agronatureholdings from 143.110.213.247 port 59236


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 213.6.203.226
country_id: 6254930
description:
Jan 16 11:28:13 host2 sshd[2306115]: Disconnected from invalid user webadmin 213.6.203.226 port 48196 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 213.6.203.226
country_id: 6254930
description:
Jan 16 11:29:40 host2 sshd[2307281]: Disconnected from invalid user activemq 213.6.203.226 port 59535 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.114.21.51
country_id: 2328926
description:
2026-01-16 11:30:56 dovecot_plain authenticator failed for H=(overicklia) [105.114.21.51]:42789: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.45.60
country_id: 953987
description:
Jan 16 11:31:08 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<env_eng>, method=PLAIN, rip=102.64.45.60, lip=66.85.158.91, TLS, session=<6REfEHtILddmQC08>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 213.6.203.226
country_id: 6254930
description:
Jan 16 11:30:41 host2 sshd[2308221]: Disconnected from invalid user apc 213.6.203.226 port 37392 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.186.197.101
country_id: 3469034
description:
Jan 16 11:30:46 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=138.186.197.101, lip=66.85.158.91, TLS, session=<vdjuDntIeq+KusVl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.233.21.109
country_id: 272103
description:
2026-01-16 11:32:11 dovecot_login authenticator failed for H=([109.233.21.109]) [109.233.21.109]:50154: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.59.226
country_id: 337996
description:
2026-01-16 11:32:29 dovecot_login authenticator failed for H=([196.189.59.226]) [196.189.59.226]:42097: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 46.101.206.166
country_id: 2921044
description:
Jan 16 11:32:33 host2 sshd[2309603]: Disconnected from invalid user mosquitto 46.101.206.166 port 49926 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.191.142.67
country_id: 337996
description:
2026-01-16 11:34:25 dovecot_login authenticator failed for H=([196.191.142.67]) [196.191.142.67]:53540: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.245.182
country_id: 1269750
description:
2026-01-16 11:34:40 dovecot_login authenticator failed for H=([125.20.245.182]) [125.20.245.182]:33362: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-16 11:35:39 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (inanae) [87.103.126.54]:16874: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.166.153.20
country_id: 6252001
description:
2026-01-16 11:37:39 dovecot_plain authenticator failed for H=c-174-166-153-20.hsd1.nj.comcast.net (dials) [174.166.153.20]:57912: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-16 11:39:04 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (bilfusnono) [87.103.126.54]:3251: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan 16 11:39:21 host2 sshd[2315019]: User agentallianz from 162.240.154.125 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.142.130
country_id: 1733045
description:
2026-01-16 11:41:32 dovecot_login authenticator failed for H=([49.124.142.130]) [49.124.142.130]:38272: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.100.107.238
country_id: 1831722
description:
2026-01-16 11:41:53 dovecot_login authenticator failed for H=(dynamic-ip-adsl.metfone.com.kh) [175.100.107.238]:35464: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.168.155
country_id: 2186224
description:
2026-01-16 11:42:32 dovecot_login authenticator failed for H=([121.73.168.155]) [121.73.168.155]:34372: 535 Incorrect authentication data (set_id=abuse@systemtec.lk)


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 66.116.204.139
country_id: 1269750
description:
Jan 16 11:46:13 host2 sshd[2321160]: User agentallianz from 66.116.204.139 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.21.28.14
country_id: 6252001
description:
2026-01-16 11:48:22 dovecot_plain authenticator failed for H=c-73-21-28-14.hsd1.ga.comcast.net (exoperbus) [73.21.28.14]:39792: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.202.197.108
country_id: 6252001
description:
2026-01-16 11:48:25 dovecot_plain authenticator failed for H=(knonjoid) [50.202.197.108]:49021: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan 16 11:49:33 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@seyawin.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<mFwHU3tIKsR100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.205.197
country_id: 99237
description:
2026-01-16 11:54:24 dovecot_login authenticator failed for H=([65.20.205.197]) [65.20.205.197]:59892: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.185.18.67
country_id: 3469034
description:
2026-01-16 11:55:10 dovecot_login authenticator failed for H=([179.185.18.67]) [179.185.18.67]:40400: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 159.89.6.108
country_id: 2921044
description:
Jan 16 11:55:46 host2 dovecot[221878]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=159.89.6.108, lip=66.85.158.91, session=<lmxjaXtIAVCfWQZs>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 164.92.234.5
country_id: 2921044
description:
Jan 16 11:55:48 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=164.92.234.5, lip=66.85.158.91, session=<Y5t5aXtI+lOkXOoF>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 80.82.77.33
country_id: 2750405
description:
Jan 16 11:57:02 host2 dovecot[221878]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=80.82.77.33, lip=66.85.158.91, session=<3aPobXtI9uZQUk0h>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 80.82.77.33
country_id: 2750405
description:
Jan 16 11:57:03 host2 dovecot[221878]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=80.82.77.33, lip=66.85.158.91, session=<69D7bXtIyuxQUk0h>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.145.142.243
country_id: 1269750
description:
2026-01-16 11:57:16 dovecot_login authenticator failed for H=([203.145.142.243]) [203.145.142.243]:48184: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.87.164.167
country_id: 6252001
description:
2026-01-16 11:57:32 dovecot_login authenticator failed for H=(syn-076-087-164-167.res.spectrum.com) [76.87.164.167]:59091: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.194
country_id: 1269750
description:
2026-01-16 11:59:34 dovecot_login authenticator failed for H=(nsg-static-217.97.72.182.airtel.in) [182.95.228.194]:44138: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.31.40.212
country_id: 290557
description:
2026-01-16 11:59:43 dovecot_login authenticator failed for H=([5.31.40.212]) [5.31.40.212]:54020: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.220
country_id: 130758
description:
2026-01-16 12:03:54 dovecot_login authenticator failed for H=(localhost) [62.60.130.220]:51745: 535 Incorrect authentication data (set_id=vpnuser)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.62
country_id: 1149361
description:
2026-01-16 12:04:12 dovecot_login authenticator failed for H=([149.54.62.62]) [149.54.62.62]:33246: 535 Incorrect authentication data (set_id=admin@2s-travels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.149.189
country_id: 1733045
description:
2026-01-16 12:04:56 dovecot_login authenticator failed for H=([49.124.149.189]) [49.124.149.189]:33894: 535 Incorrect authentication data (set_id=all@comdef.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.72.184.60
country_id: 6252001
description:
2026-01-16 12:04:23 dovecot_login authenticator failed for H=24-72-184-24-72-184-60.cpe.sparklight.net [24.72.184.60]:35184: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.126.26.213
country_id: 1861060
description:
2026-01-16 12:04:25 dovecot_login authenticator failed for H=knet202126026213.kvision.ne.jp [202.126.26.213]:52372: 535 Incorrect authentication data (set_id=all@comdef.org)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 16 12:06:05 host2 sshd[2339198]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.58.66.231
country_id: 3469034
description:
2026-01-16 12:05:41 dovecot_login authenticator failed for H=(industrianaval.fla.gvt.net.br) [187.58.66.231]:32993: 535 Incorrect authentication data (set_id=all)


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 66.116.204.139
country_id: 1269750
description:
Jan 16 12:09:43 host2 sshd[2342621]: User agentallianz from 66.116.204.139 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 66.154.125.60
country_id: 6251999
description:
Jan 16 12:11:28 host2 sshd[2344586]: Disconnected from invalid user runner 66.154.125.60 port 52298 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.61.170
country_id: 1861060
description:
Jan 16 12:11:56 host2 sshd[2345063]: Disconnected from invalid user rsync 118.193.61.170 port 51506 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-16 12:13:21 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (mants) [87.103.126.54]:55025: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 129.212.191.182
country_id: 6252001
description:
Jan 16 12:13:32 host2 sshd[2346602]: Disconnected from invalid user almacen 129.212.191.182 port 40460 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.221.90
country_id: 1880251
description:
Jan 16 12:13:44 host2 sshd[2346819]: Disconnected from invalid user puppet 45.78.221.90 port 43592 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 16 12:15:26 host2 sshd[2348467]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.61.170
country_id: 1861060
description:
Jan 16 12:15:27 host2 sshd[2348464]: Disconnected from invalid user splunkadmin 118.193.61.170 port 49046 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 66.154.125.60
country_id: 6251999
description:
Jan 16 12:16:00 host2 sshd[2348923]: Disconnected from invalid user grafana 66.154.125.60 port 52480 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 118.193.61.170
country_id: 1861060
description:
Jan 16 12:16:07 host2 sshd[2349048]: Disconnected from invalid user puppet 118.193.61.170 port 40846 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 129.212.191.182
country_id: 6252001
description:
Jan 16 12:15:22 host2 sshd[2348402]: Disconnected from invalid user rafael 129.212.191.182 port 43232 [preauth]


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.245
country_id: 2635167
description:
Jan 16 12:16:48 host2 dovecot[221878]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=87.236.176.245, lip=66.85.158.92, TLS, session=<GEuetHtISepX7LD1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 66.154.125.60
country_id: 6251999
description:
Jan 16 12:16:34 host2 sshd[2349434]: Disconnected from invalid user kuka 66.154.125.60 port 52534 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 66.154.125.60
country_id: 6251999
description:
Jan 16 12:17:38 host2 sshd[2350409]: Disconnected from invalid user almacen 66.154.125.60 port 52640 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 129.212.191.182
country_id: 6252001
description:
Jan 16 12:17:49 host2 sshd[2350582]: Disconnected from invalid user splunkadmin 129.212.191.182 port 35646 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.221.90
country_id: 1880251
description:
Jan 16 12:19:17 host2 sshd[2351957]: Disconnected from invalid user cyrus 45.78.221.90 port 45496 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.9
country_id: 1733045
description:
2026-01-16 12:20:11 dovecot_login authenticator failed for H=([49.124.151.9]) [49.124.151.9]:46920: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.221.90
country_id: 1880251
description:
Jan 16 12:20:19 host2 sshd[2353020]: Disconnected from invalid user rustserver 45.78.221.90 port 46408 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.63.10
country_id: 1269750
description:
2026-01-16 12:20:24 dovecot_login authenticator failed for H=([182.95.25.234]) [182.95.63.10]:57332: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.221.90
country_id: 1880251
description:
Jan 16 12:24:30 host2 sshd[2357465]: Disconnected from invalid user vodafone 45.78.221.90 port 45916 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan 16 12:25:36 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@seyawin.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<5Zbx03tIF4l100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.108.162.24
country_id: 3469034
description:
2026-01-16 12:30:23 dovecot_login authenticator failed for H=([131.108.162.24]) [131.108.162.24]:53882: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.22.218
country_id: 290557
description:
2026-01-16 12:30:46 dovecot_login authenticator failed for H=([5.32.22.218]) [5.32.22.218]:55677: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.146.233.179
country_id: 1269750
description:
2026-01-16 12:31:08 dovecot_login authenticator failed for H=([103.146.233.179]) [103.146.233.179]:40880: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-16 12:34:31 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (cliblan) [87.103.126.54]:14866: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.6.81.59
country_id: 1880251
description:
2026-01-16 12:39:06 dovecot_login authenticator failed for H=bb121-6-81-59.singnet.com.sg [121.6.81.59]:34708: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.177.158
country_id: 1269750
description:
2026-01-16 12:38:46 dovecot_login authenticator failed for H=([152.52.234.192]) [182.95.177.158]:42582: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan 16 12:39:40 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<BwNkBnxI3OkDjyE/>


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 64.225.40.153
country_id: 6252001
description:
Jan 16 12:39:40 host2 sshd[2372428]: User agentallianz from 64.225.40.153 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan 16 12:40:57 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<X6H+CnxI/IwDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan 16 12:41:34 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<vwktDXxIEq0DjyE/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.51.26.198
country_id: 1269750
description:
2026-01-16 12:42:02 dovecot_login authenticator failed for H=(103.51.26.198.sukaininfoway.com) [103.51.26.198]:46568: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-01-16 12:42:13 dovecot_login authenticator failed for H=(host-64-72-74-162.lightower.net) [64.72.74.162]:58583: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.238.191.229
country_id: 6252001
description:
Jan 16 12:43:14 host2 dovecot[221878]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.238.191.229, lip=66.85.158.92, session=<9HgjE3xIQL8D7r/l>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan 16 12:42:55 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<rLsDEnxIhtUDjyE/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.129.28
country_id: 99237
description:
2026-01-16 12:49:43 dovecot_plain authenticator failed for H=(nonchne) [65.20.129.28]:52985: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.207.210.23
country_id: 2960313
description:
2026-01-16 12:50:02 dovecot_plain authenticator failed for H=(partbor) [88.207.210.23]:64921: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.38.201.238
country_id: 6252001
description:
2026-01-16 12:50:27 dovecot_plain authenticator failed for H=c-68-38-201-238.hsd1.in.comcast.net (hypos) [68.38.201.238]:42188: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.166
country_id: 2993457
description:
Jan 16 12:58:41 host2 dovecot[221878]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=194.165.16.166, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<rVleSnxII//CpRCm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.121.1.156
country_id: 6252001
description:
2026-01-16 12:59:23 dovecot_login authenticator failed for H=([24.121.1.156]) [24.121.1.156]:38142: 535 Incorrect authentication data (set_id=abuse@kamecho.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.206
country_id: 1269750
description:
2026-01-16 12:59:44 dovecot_login authenticator failed for H=([182.95.178.206]) [182.95.178.206]:53828: 535 Incorrect authentication data (set_id=abuse)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan 16 13:00:43 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<d56IUXxI1cN100Db>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 117.211.64.219
country_id: 1269750
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[117.211.64.219] [Remote Port]=[50133] [Authentication Database]=[mail] [Username]=[admin@seyawin.com] (10/10 failures) (blocked until [Sat Jan 17 07:30:41 2026 UTC/Sat Jan 17 13:00:41 2026 LOCAL])


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.154.41.213
country_id: 1819730
description:
Jan 16 13:02:07 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=165.154.41.213, lip=66.85.158.91, session=<HJerVnxI1MmlminV>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 165.154.41.213
country_id: 1819730
description:
Jan 16 13:02:15 host2 dovecot[221878]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 7 secs): user=<>, rip=165.154.41.213, lip=66.85.158.91, TLS, session=</BIkV3xIRMulminV>


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 64.225.40.153
country_id: 6252001
description:
Jan 16 13:02:23 host2 sshd[2392093]: User agentallianz from 64.225.40.153 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.214.108.39
country_id: 3469034
description:
2026-01-16 13:04:10 dovecot_login authenticator failed for H=(b3d66c27.virtua.com.br) [179.214.108.39]:56476: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.228.160
country_id: 149590
description:
2026-01-16 13:04:35 dovecot_login authenticator failed for H=(160.228-59-41.static-zone.ttcldata.net) [41.59.228.160]:36326: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.220.236.203
country_id: 660013
description:
2026-01-16 13:06:50 dovecot_login authenticator failed for H=([62.220.236.203]) [62.220.236.203]:47660: 535 Incorrect authentication data (set_id=admin@jrdc.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.115.144.103
country_id: 3469034
description:
2026-01-16 13:07:05 dovecot_login authenticator failed for H=(buenosnet.static.gvt.net.br) [187.115.144.103]:47599: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.109.178.210
country_id: 1269750
description:
Jan 16 13:08:23 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<careers>, method=PLAIN, rip=103.109.178.210, lip=66.85.158.91, TLS, session=<Ua79a3xIcbhnbbLS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.226.88.121
country_id: 2661886
description:
2026-01-16 13:07:45 dovecot_plain authenticator failed for H=81-226-88-121-no600.tbcn.telia.com (cutirly) [81.226.88.121]:49429: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.103.11.128
country_id: 690791
description:
Jan 16 13:08:03 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=176.103.11.128, lip=66.85.158.91, TLS, session=<UozUanxIgs6wZwuA>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.114
country_id: 1149361
description:
2026-01-16 13:12:19 dovecot_login authenticator failed for H=([149.54.62.114]) [149.54.62.114]:35394: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.168.34
country_id: 2186224
description:
2026-01-16 13:13:11 dovecot_login authenticator failed for H=([121.73.168.34]) [121.73.168.34]:35782: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.125.124.14
country_id: 3469034
description:
2026-01-16 13:16:14 dovecot_login authenticator failed for H=(vtx-b-124-014.virtex.com.br) [179.125.124.14]:52066: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 142.93.99.221
country_id: 2921044
description:
Jan 16 13:15:58 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=142.93.99.221, lip=66.85.158.91, TLS, session=<bossiHxInoOOXWPd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.230.124.17
country_id: 1512440
description:
2026-01-16 13:16:28 dovecot_login authenticator failed for H=(17.64.uzpak.uz) [213.230.124.17]:56794: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.196.48.232
country_id: 6252001
description:
Jan 16 13:18:16 host2 dovecot[221878]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=54.196.48.232, lip=66.85.158.91, session=<GA5ykHxIGqE2xDDo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.243.174
country_id: 732800
description:
2026-01-16 13:19:49 dovecot_plain authenticator failed for H=(huzatinds) [92.62.243.174]:33764: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.48.161.42
country_id: 1210997
description:
2026-01-16 13:20:16 dovecot_login authenticator failed for H=(103-48-161-42.Dhaka.carnival.com.bd) [103.48.161.42]:49331: 535 Incorrect authentication data (set_id=postmaster@visionsolutionshospital.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.110.213.247
country_id: 6251999
description:
Jan 16 13:20:22 host2 sshd[2404820]: Invalid user agronatureholdings from 143.110.213.247 port 60360


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.100.156.38
country_id: 1605651
description:
2026-01-16 13:20:27 dovecot_login authenticator failed for H=mail.sotus.co.th [171.100.156.38]:45085: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.183.18
country_id: 1269750
description:
2026-01-16 13:21:57 dovecot_login authenticator failed for H=([125.23.183.18]) [125.23.183.18]:47876: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.208.46.130
country_id: 1522867
description:
2026-01-16 13:22:24 dovecot_login authenticator failed for H=([37.208.46.130]) [37.208.46.130]:51666: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.128.126.155
country_id: 6252001
description:
2026-01-16 13:21:34 dovecot_login authenticator failed for H=([128.128.114.1]) [128.128.126.155]:45940: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.113.212
country_id: 1861060
description:
Jan 16 13:21:42 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=139.162.113.212, lip=66.85.158.92, TLS: Connection closed, session=<gE+vnHxIwruLonHU>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.165
country_id: 2993457
description:
Jan 16 13:25:24 host2 dovecot[221878]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=194.165.16.165, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<eS/sqXxI+f/CpRCl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.81.229.181
country_id: 6252001
description:
2026-01-16 13:25:42 dovecot_plain authenticator failed for H=(bloscas) [192.81.229.181]:49030: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan 16 13:27:09 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS handshaking: Connection closed, session=<RTovsHxIyKUDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan 16 13:29:29 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<DdmJuHxIjtYDhBfJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.216.215.145
country_id: 933860
description:
Jan 16 13:31:02 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<env_eng>, method=PLAIN, rip=41.216.215.145, lip=66.85.158.91, TLS, session=<VRPjvHxIt6Yp2NeR>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.120.98
country_id: 1269750
description:
2026-01-16 13:31:21 dovecot_plain authenticator failed for H=(progy) [122.184.120.98]:51534: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.32.11
country_id: 953987
description:
Jan 16 13:30:39 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=102.64.32.11, lip=66.85.158.91, TLS, session=<vSJuu3xIIKJmQCAL>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan 16 13:31:26 host2 dovecot[221878]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS, session=<7aWGv3xI0okDhBfJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.170.150.178
country_id: 1605651
description:
2026-01-16 13:32:39 dovecot_login authenticator failed for H=([203.170.150.178]) [203.170.150.178]:58934: 535 Incorrect authentication data (set_id=hostmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2026-01-16 13:32:45 dovecot_login authenticator failed for H=([197.219.228.242]) [197.219.228.242]:34484: 535 Incorrect authentication data (set_id=svetlana)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.146.233.156
country_id: 1269750
description:
2026-01-16 13:32:26 dovecot_login authenticator failed for H=([103.146.233.156]) [103.146.233.156]:39326: 535 Incorrect authentication data (set_id=hostmaster@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.228.234
country_id: 1269750
description:
2026-01-16 13:32:32 dovecot_login authenticator failed for H=(nsg-static-234.228.76.182-airtel.com) [182.76.228.234]:45534: 535 Incorrect authentication data (set_id=svetlana@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan 16 13:32:36 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS, session=<Gmyyw3xI6OEDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan 16 13:33:41 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS handshaking: Connection closed, session=<iB6Ux3xIGJ8DhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan 16 13:35:23 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<JVqezXxIhKIDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan 16 13:36:10 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS handshaking: Connection closed, session=<du1v0HxIhocDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan 16 13:36:32 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS, session=<qlTH0XxIcL4DhBfJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan 16 13:37:03 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@seyawin.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<uD9q03xIlcp100Db>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan 16 13:37:28 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS, session=<IosY1XxIWIMDhBfJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.247
country_id: 1269750
description:
2026-01-16 13:37:28 dovecot_login authenticator failed for H=(nsg-corporate-247.228.187.122.airtel.in) [122.187.228.247]:48913: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.204.124.32
country_id: 1269750
description:
2026-01-16 13:38:28 dovecot_login authenticator failed for H=(broadband.actcorp.in) [49.204.124.32]:43748: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan 16 13:41:09 host2 sshd[2420330]: User agentallianz from 35.186.147.126 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan 16 13:41:48 host2 dovecot[221878]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<Y8+T5HxI3sgDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan 16 13:43:48 host2 dovecot[221878]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<4MK363xI5uEDhBfJ>


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 66.116.204.139
country_id: 1269750
description:
Jan 16 13:44:16 host2 sshd[2422321]: User agentallianz from 66.116.204.139 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 16 13:45:30 host2 sshd[2423212]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan 16 13:45:32 host2 dovecot[221878]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<bmru8XxIvroDhBfJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.160.114.72
country_id: 1210997
description:
2026-01-16 13:46:42 dovecot_login authenticator failed for H=([182.160.114.72]) [182.160.114.72]:52562: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.238.252.46
country_id: 241170
description:
2026-01-16 13:46:52 dovecot_login authenticator failed for H=([156.238.252.46]) [156.238.252.46]:44058: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.72
country_id: 6252001
description:
Jan 16 13:47:06 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.72, lip=66.85.158.91, TLS, session=<ULCR93xIIvTN0h9I>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan 16 13:48:14 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<MF6W+3xI3uMDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan 16 13:48:58 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<ScU4/nxIUI4DhBfJ>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.132.23.201
country_id: 6252001
description:
Jan 16 13:49:07 host2 dovecot[221878]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<plzG/nxISLkDhBfJ>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.132.23.201
country_id: 6252001
description:
Jan 16 13:49:52 host2 dovecot[221878]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<ECByAX1IsosDhBfJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.252.37.194
country_id: 3175395
description:
2026-01-16 13:49:58 dovecot_login authenticator failed for H=host-95-252-37-194.retail.telecomitalia.it [95.252.37.194]:47984: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.145.35
country_id: 1269750
description:
2026-01-16 13:49:50 dovecot_login authenticator failed for H=([103.174.145.35]) [103.174.145.35]:55873: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan 16 13:51:20 host2 dovecot[221878]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<gZy0Bn1IRKMDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan 16 13:51:56 host2 dovecot[221878]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<bGLUCH1Isq4DhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.196.48.232
country_id: 6252001
description:
Jan 16 13:52:45 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=54.196.48.232, lip=66.85.158.91, TLS, session=<MuW9C31IXJI2xDDo>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 16 13:54:51 host2 sshd[2429947]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.88.196.91
country_id: 6252001
description:
2026-01-16 13:56:01 dovecot_plain authenticator failed for H=c-73-88-196-91.hsd1.ky.comcast.net (preptly) [73.88.196.91]:59802: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.82
country_id: 6252001
description:
Jan 16 13:56:45 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.82, lip=66.85.158.92, TLS, session=<y9sNGn1IfP7G6xhS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.150.243.22
country_id: 6252001
description:
2026-01-16 13:59:01 dovecot_plain authenticator failed for H=(hortante) [12.150.243.22]:14206: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.187.152.61
country_id: 6252001
description:
2026-01-16 13:59:39 dovecot_plain authenticator failed for H=(inasism) [50.187.152.61]:51792: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.212.96.237
country_id: 3144096
description:
2026-01-16 13:59:49 dovecot_plain authenticator failed for H=ti0125a400-5061.bb.online.no (cable) [80.212.96.237]:34067: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.66.209
country_id: 1819730
description:
2026-01-16 14:02:44 dovecot_login authenticator failed for H=209.66.246.220.static.netvigator.com [220.246.66.209]:56874: 535 Incorrect authentication data (set_id=reception@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.168.140.35
country_id: 3469034
description:
2026-01-16 14:02:56 dovecot_login authenticator failed for H=(45.168.140-35.smartlinkfibra.com.br) [45.168.140.35]:40712: 535 Incorrect authentication data (set_id=reception)


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan 16 14:03:12 host2 sshd[2436795]: User agentallianz from 35.186.147.126 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.0.90.81
country_id: 2077456
description:
2026-01-16 14:04:40 dovecot_login authenticator failed for H=210.0.90.81.static.nexnet.net.au [210.0.90.81]:52486: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 4.35.66.245
country_id: 6252001
description:
2026-01-16 14:05:36 dovecot_login authenticator failed for H=([4.35.66.245]) [4.35.66.245]:59176: 535 Incorrect authentication data (set_id=abuse@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.156.0.88
country_id: 3144096
description:
2026-01-16 14:06:19 dovecot_login authenticator failed for H=([78.156.0.88]) [78.156.0.88]:51224: 535 Incorrect authentication data (set_id=abuse)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 86.111.91.69
country_id: 690791
description:
2026-01-16 14:07:36 dovecot_login authenticator failed for H=host-86-111-91-69.566f.la.net.ua [86.111.91.69]:60728: 535 Incorrect authentication data (set_id=abuse@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.156.6.147
country_id: 3144096
description:
2026-01-16 14:07:51 dovecot_login authenticator failed for H=(cm-78.156.6.147.get.no) [78.156.6.147]:35830: 535 Incorrect authentication data (set_id=abuse)


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 66.116.204.139
country_id: 1269750
description:
Jan 16 14:08:26 host2 sshd[2440588]: User agentallianz from 66.116.204.139 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 164.164.117.23
country_id: 1269750
description:
2026-01-16 14:11:17 dovecot_login authenticator failed for H=([164.164.117.23]) [164.164.117.23]:46808: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan 16 14:12:23 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<help@seyawin.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<f/HGUX1Ii79100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.129.206.14
country_id: 1269750
description:
2026-01-16 14:11:44 dovecot_login authenticator failed for H=([203.129.206.14]) [203.129.206.14]:43382: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.27
country_id: 3017382
description:
Jan 16 14:17:19 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=91.196.152.27, lip=66.85.158.91, session=<mAmZY31IjY9bxJgb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.28
country_id: 3017382
description:
Jan 16 14:17:29 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=91.196.152.28, lip=66.85.158.91, session=<hX82ZH1IA9xbxJgc>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.117
country_id: 3017382
description:
Jan 16 14:17:43 host2 dovecot[221878]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=91.196.152.117, lip=66.85.158.91, session=<JzQJZX1IgdFbxJh1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.113
country_id: 3017382
description:
Jan 16 14:17:46 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.196.152.113, lip=66.85.158.91, session=<Yq47ZX1Ie4xbxJhx>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.57.170.166
country_id: 3175395
description:
2026-01-16 14:22:04 dovecot_plain authenticator failed for H=([100.64.100.6]) [2.57.170.166]:39687: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.27.32.70
country_id: 6252001
description:
2026-01-16 14:23:09 dovecot_login authenticator failed for H=syn-137-027-032-070.biz.spectrum.com [137.27.32.70]:37240: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.102.50
country_id: 1269750
description:
2026-01-16 14:24:22 dovecot_login authenticator failed for H=(nsg-static-145.58.71.182.airtel.in) [27.123.102.50]:44962: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.168.17.20
country_id: 2077456
description:
2026-01-16 14:24:35 dovecot_login authenticator failed for H=([101.168.17.20]) [101.168.17.20]:45204: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan 16 14:25:10 host2 sshd[2452288]: User agentallianz from 35.186.147.126 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.100.176.41
country_id: 3175395
description:
2026-01-16 14:27:36 dovecot_plain authenticator failed for H=(twing) [149.100.176.41]:47920: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.182.118.138
country_id: 732800
description:
2026-01-16 14:31:41 dovecot_login authenticator failed for H=([62.182.118.138]) [62.182.118.138]:52803: 535 Incorrect authentication data (set_id=info@jrdc.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.184.2
country_id: 1269750
description:
2026-01-16 14:32:30 dovecot_login authenticator failed for H=([152.52.238.55]) [182.95.184.2]:36980: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.156.94.19
country_id: 1861060
description:
2026-01-16 14:31:58 dovecot_login authenticator failed for H=19.94.156.220.rev.iijmobile.jp [220.156.94.19]:57624: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.182
country_id: 1269750
description:
2026-01-16 14:33:00 dovecot_plain authenticator failed for H=(heale) [182.95.178.182]:44716: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-16 14:33:04 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (admism) [87.103.126.54]:36476: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.220.90
country_id: 1269750
description:
2026-01-16 14:33:05 dovecot_login authenticator failed for H=(dsl-tn-dynamic-137.209.22.125.airtelbroadband.in) [128.185.220.90]:39108: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.52.206
country_id: 1269750
description:
2026-01-16 14:35:32 dovecot_login authenticator failed for H=([27.123.105.41]) [182.95.52.206]:39616: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 64.225.40.153
country_id: 6252001
description:
Jan 16 14:36:24 host2 sshd[2460497]: User agentallianz from 64.225.40.153 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.169.97.132
country_id: 1269750
description:
2026-01-16 14:35:51 dovecot_login authenticator failed for H=(abts-mum-static-132.97.169.122.airtelbroadband.in) [122.169.97.132]:33927: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.205
country_id: 1814991
description:
Jan 16 14:43:19 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=94.231.206.205, lip=66.85.158.91, session=<92qXwH1IL7de587N>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.153
country_id: 1814991
description:
Jan 16 14:43:30 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=94.231.206.153, lip=66.85.158.91, session=<3Zo7wX1ISahe586Z>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.157
country_id: 1814991
description:
Jan 16 14:43:46 host2 dovecot[221878]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=94.231.206.157, lip=66.85.158.91, session=<dLgtwn1Isdhe586d>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.158
country_id: 1814991
description:
Jan 16 14:43:49 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=94.231.206.158, lip=66.85.158.91, session=<0fZlwn1IebFe586e>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.220
country_id: 130758
description:
2026-01-16 14:45:02 dovecot_login authenticator failed for H=(localhost) [62.60.130.220]:51624: 535 Incorrect authentication data (set_id=test01)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.53
country_id: 1733045
description:
2026-01-16 14:46:41 dovecot_login authenticator failed for H=([49.124.151.53]) [49.124.151.53]:45266: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.238.247.238
country_id: 3469034
description:
2026-01-16 14:47:12 dovecot_login authenticator failed for H=([186.238.247.238]) [186.238.247.238]:52134: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.118
country_id: 6252001
description:
Jan 16 14:47:14 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.118, lip=66.85.158.91, TLS, session=<HNCYzn1IIPWTuYR2>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan 16 14:47:43 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@seyawin.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<3iIz0H1IQqB100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.208.81.125
country_id: 6252001
description:
2026-01-16 14:48:07 dovecot_plain authenticator failed for H=c-73-208-81-125.hsd1.in.comcast.net (extopy) [73.208.81.125]:51152: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.144.79.102
country_id: 1269750
description:
2026-01-16 14:48:16 dovecot_login authenticator failed for H=([59.144.79.102]) [59.144.79.102]:54668: 535 Incorrect authentication data (set_id=hostmaster@comdef.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.227.211.82
country_id: 1269750
description:
2026-01-16 14:49:13 dovecot_login authenticator failed for H=([110.227.211.82]) [110.227.211.82]:38836: 535 Incorrect authentication data (set_id=hostmaster)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 46.101.108.210
country_id: 2921044
description:
Jan 16 14:52:28 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (no auth attempts in 20 secs): user=<>, rip=46.101.108.210, lip=66.85.158.91, TLS handshaking: Connection closed, session=<o3JV4X1IpFIuZWzS>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.225.99.17
country_id: 2921044
description:
Jan 16 14:51:53 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=64.225.99.17, lip=66.85.158.91, TLS handshaking: read(size=1026) failed: Connection reset by peer, session=<+Lw6331IJeNA4WMR>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.210.155.199
country_id: 3144096
description:
2026-01-16 14:55:13 dovecot_login authenticator failed for H=(cm-84.210.155.199.get.no) [84.210.155.199]:49572: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.156.0.88
country_id: 3144096
description:
2026-01-16 14:54:58 dovecot_login authenticator failed for H=(cm-78.156.0.88.get.no) [78.156.0.88]:47325: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.29.138.157
country_id: 3175395
description:
2026-01-16 14:57:58 dovecot_plain authenticator failed for H=(porga) [212.29.138.157]:39099: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.120.98
country_id: 1269750
description:
2026-01-16 15:00:34 dovecot_login authenticator failed for H=([122.184.120.98]) [122.184.120.98]:47550: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 64.225.40.153
country_id: 6252001
description:
Jan 16 14:59:51 host2 sshd[2482406]: User agentallianz from 64.225.40.153 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.58.66.231
country_id: 3469034
description:
2026-01-16 15:01:03 dovecot_login authenticator failed for H=(187.58.64.145.static.host.gvt.net.br) [187.58.66.231]:33129: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.158
country_id: 1269750
description:
2026-01-16 15:01:44 dovecot_login authenticator failed for H=(nsg-corporate-185.188.186.122.airtel.in) [182.95.178.158]:37502: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 87.236.176.178
country_id: 2635167
description:
Jan 16 15:05:47 host2 pure-ftpd[2488168]: (?@87.236.176.178) [INFO] New connection from 87.236.176.178


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.172.76.147
country_id: 6252001
description:
Jan 16 15:10:18 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=54.172.76.147, lip=66.85.158.92, TLS, session=<p6QPIX5IMrM2rEyT>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.110.213.247
country_id: 6251999
description:
Jan 16 15:14:55 host2 sshd[2495944]: Invalid user agronatureholdings from 143.110.213.247 port 48008


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.255.50
country_id: 1269750
description:
2026-01-16 15:14:57 dovecot_login authenticator failed for H=([122.186.255.50]) [122.186.255.50]:35136: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.247.248.154
country_id: 3469034
description:
2026-01-16 15:15:16 dovecot_login authenticator failed for H=([170.247.248.154]) [170.247.248.154]:58758: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.201.138
country_id: 1269750
description:
2026-01-16 15:15:42 dovecot_login authenticator failed for H=([125.19.174.244]) [128.185.201.138]:36400: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.100
country_id: 6252001
description:
Jan 16 15:16:09 host2 dovecot[221878]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=162.216.150.100, lip=66.85.158.91, session=<53ICNn5Iwumi2JZk>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 204.106.234.86
country_id: 6252001
description:
2026-01-16 15:16:15 dovecot_login authenticator failed for H=len-b2-086.dsl.inlandnet.com [204.106.234.86]:51711: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.255.255.26
country_id: 2661886
description:
2026-01-16 15:16:34 dovecot_login authenticator failed for H=94-255-255-26.cust.bredband2.com [94.255.255.26]:56002: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 66.116.204.139
country_id: 1269750
description:
Jan 16 15:15:36 host2 sshd[2496576]: User agentallianz from 66.116.204.139 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.222.81.115
country_id: 6252001
description:
Jan 16 15:16:41 host2 dovecot[221878]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=44.222.81.115, lip=66.85.158.91, session=<LkDyN35IzpQs3lFz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.247
country_id: 130758
description:
2026-01-16 15:16:53 dovecot_login authenticator failed for H=(localhost) [62.60.130.247]:50599: 535 Incorrect authentication data (set_id=invite)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.223.36.108
country_id: 3932488
description:
2026-01-16 15:17:08 dovecot_login authenticator failed for H=([190.223.36.108]) [190.223.36.108]:59310: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.91
country_id: 2635167
description:
Jan 16 15:17:17 host2 dovecot[221878]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=87.236.176.91, lip=66.85.158.91, TLS, session=<yl4VOn5Id7FX7LBb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.12.179
country_id: 1269750
description:
2026-01-16 15:17:25 dovecot_login authenticator failed for H=([128.185.12.179]) [128.185.12.179]:50826: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 16 15:24:34 host2 sshd[2503544]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.238.191.229
country_id: 6252001
description:
Jan 16 15:23:49 host2 dovecot[221878]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.238.191.229, lip=66.85.158.92, session=<bcdoUX5IwrwD7r/l>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan 16 15:23:59 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@seyawin.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<QCrpUX5IyaF100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.34.61.19
country_id: 2661886
description:
2026-01-16 15:25:15 dovecot_plain authenticator failed for H=c-92-34-61-19.bbcust.telenor.se (miant) [92.34.61.19]:38586: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.176.157.57
country_id: 6252001
description:
2026-01-16 15:28:48 dovecot_plain authenticator failed for H=c-73-176-157-57.hsd1.il.comcast.net (berph) [73.176.157.57]:46572: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.202.58
country_id: 1269750
description:
2026-01-16 15:29:33 dovecot_login authenticator failed for H=(nsg-corporate-58.202.186.122.airtel.in) [122.186.202.58]:50208: 535 Incorrect authentication data (set_id=all@maximsholdings.com)


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan 16 15:29:50 host2 sshd[2508285]: User agentallianz from 35.186.147.126 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.230.86.16
country_id: 2661886
description:
2026-01-16 15:30:20 dovecot_plain authenticator failed for H=90-230-86-16-no600.tbcn.telia.com (tiers) [90.230.86.16]:37077: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.165
country_id: 2993457
description:
Jan 16 15:29:51 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=194.165.16.165, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<zvsGZ35Iov/CpRCl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.124.60.46
country_id: 1168579
description:
2026-01-16 15:29:51 dovecot_login authenticator failed for H=([203.124.60.46]) [203.124.60.46]:55610: 535 Incorrect authentication data (set_id=all)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.116.220.140
country_id: 3865483
description:
Jan 16 15:31:45 host2 sshd[2509801]: Disconnected from invalid user storage 181.116.220.140 port 48743 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 181.116.220.140
country_id: 3865483
description:
Jan 16 15:33:03 host2 sshd[2510760]: Disconnected from invalid user azureuser 181.116.220.140 port 57234 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.220.17.18
country_id: 2287781
description:
2026-01-16 15:33:02 dovecot_login authenticator failed for H=([102.220.17.17]) [102.220.17.18]:13168: 535 Incorrect authentication data (set_id=postmaster@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.231.243.28
country_id: 6252001
description:
2026-01-16 15:33:18 dovecot_login authenticator failed for H=([50.231.243.28]) [50.231.243.28]:38122: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 16 15:34:01 host2 sshd[2511394]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.116.220.140
country_id: 3865483
description:
Jan 16 15:34:19 host2 sshd[2511594]: Disconnected from invalid user kerberos 181.116.220.140 port 37051 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.161.96.107
country_id: 6252001
description:
2026-01-16 15:34:00 dovecot_plain authenticator failed for H=c-73-161-96-107.hsd1.mi.comcast.net (porrition) [73.161.96.107]:36218: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.89.168.54
country_id: 3175395
description:
Jan 16 15:34:01 host2 sshd[2511383]: Disconnected from invalid user User3 152.89.168.54 port 38348 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.89.168.54
country_id: 3175395
description:
Jan 16 15:34:36 host2 sshd[2511751]: Disconnected from invalid user vpsuser 152.89.168.54 port 44420 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.116.220.140
country_id: 3865483
description:
Jan 16 15:35:32 host2 sshd[2512622]: Disconnected from invalid user viewer 181.116.220.140 port 46219 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Jan 16 15:36:56 host2 dovecot[221878]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<5R9agH5IgpMDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Jan 16 15:37:59 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, TLS handshaking: Connection closed, session=<obMahH5IKOoDlTsa>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.110.213.247
country_id: 6251999
description:
Jan 16 15:38:50 host2 sshd[2519102]: Invalid user agronatureholdings from 143.110.213.247 port 38162


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan 16 15:41:20 host2 sshd[2529332]: Disconnected from invalid user user 2.57.121.25 port 14063 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Jan 16 15:40:37 host2 dovecot[221878]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<wCaKjX5ITqsDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.60
country_id: 6252001
description:
Jan 16 15:40:54 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=167.94.146.60, lip=66.85.158.91, TLS: Connection closed, session=<Gh2Hjn5I6HanXpI8>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Jan 16 15:41:44 host2 dovecot[221878]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, TLS, session=<I26EkX5IBKsDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Jan 16 15:44:17 host2 dovecot[221878]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<FTKhmn5IHssDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Jan 16 15:44:41 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, TLS handshaking: Connection closed, session=<TBIPnH5IUMoDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Jan 16 15:45:56 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, TLS, session=<P9OAoH5IgOcDlTsa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.151.249
country_id: 1819730
description:
2026-01-16 15:50:42 dovecot_login authenticator failed for H=249.151.48.116.static.netvigator.com [116.48.151.249]:60571: 535 Incorrect authentication data (set_id=md@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.168.148
country_id: 337996
description:
2026-01-16 15:51:39 dovecot_login authenticator failed for H=([196.188.168.148]) [196.188.168.148]:33764: 535 Incorrect authentication data (set_id=business@maximsholdings.com)


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan 16 15:51:40 host2 sshd[2549843]: User agentallianz from 35.186.147.126 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.16.164.76
country_id: 2661886
description:
2026-01-16 15:53:02 dovecot_login authenticator failed for H=ip076.net-81-16-164.koping.net [81.16.164.76]:51880: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.174.18
country_id: 1269750
description:
2026-01-16 15:57:25 dovecot_login authenticator failed for H=([152.52.234.33]) [182.95.174.18]:37640: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan 16 16:00:08 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@seyawin.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<KcAt035IQ8B100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.112.109.248
country_id: 6252001
description:
2026-01-16 16:00:21 dovecot_plain authenticator failed for H=(lined) [24.112.109.248]:49564: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.201.208
country_id: 1880251
description:
Jan 16 16:00:48 host2 sshd[2560163]: Disconnected from invalid user rancher 45.78.201.208 port 34552 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.110.213.247
country_id: 6251999
description:
Jan 16 16:01:59 host2 sshd[2561048]: Invalid user agronatureholdings from 143.110.213.247 port 36266


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.222
country_id: 1269750
description:
2026-01-16 16:01:42 dovecot_login authenticator failed for H=([122.187.230.222]) [122.187.230.222]:32808: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
country_id: 1643084
description:
2026-01-16 16:01:58 dovecot_login authenticator failed for H=(ip-103-29-185-162.pascalwave.com) [103.29.185.162]:47366: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.202.197.108
country_id: 6252001
description:
2026-01-16 16:01:29 dovecot_plain authenticator failed for H=(snomum) [50.202.197.108]:50010: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 66.116.204.139
country_id: 1269750
description:
Jan 16 16:01:40 host2 sshd[2560839]: User agentallianz from 66.116.204.139 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.201.208
country_id: 1880251
description:
Jan 16 16:02:54 host2 sshd[2561727]: Disconnected from invalid user apps 45.78.201.208 port 38502 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.62
country_id: 6252001
description:
Jan 16 16:04:34 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=167.94.146.62, lip=66.85.158.91, TLS: Connection closed, session=<mtws435I0FinXpI+>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 167.94.146.62
country_id: 6252001
description:
Jan 16 16:04:34 host2 pure-ftpd[2562995]: (?@167.94.146.62) [INFO] New connection from 167.94.146.62


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 4.210.186.201
country_id: 2750405
description:
Jan 16 16:05:19 host2 sshd[2563704]: Disconnected from invalid user tester 4.210.186.201 port 9250 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.156.46
country_id: 1269750
description:
2026-01-16 16:06:11 dovecot_login authenticator failed for H=([125.19.156.46]) [125.19.156.46]:40598: 535 Incorrect authentication data (set_id=reserve@jrdc.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.123.146.93
country_id: 2750405
description:
Jan 16 16:06:18 host2 sshd[2564514]: Disconnected from invalid user cassandra 20.123.146.93 port 35264 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.26.80.233
country_id: 298795
description:
2026-01-16 16:08:00 dovecot_plain authenticator failed for H=(nicentiess) [5.26.80.233]:58464: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.6
country_id: 1269750
description:
2026-01-16 16:08:23 dovecot_login authenticator failed for H=([182.95.181.6]) [182.95.181.6]:46144: 535 Incorrect authentication data (set_id=admin@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.18.99.38
country_id: 1269750
description:
2026-01-16 16:08:38 dovecot_login authenticator failed for H=([125.18.99.38]) [125.18.99.38]:39758: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.27.33.174
country_id: 6252001
description:
2026-01-16 16:08:41 dovecot_plain authenticator failed for H=c-73-27-33-174.hsd1.fl.comcast.net (acouticols) [73.27.33.174]:57182: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 4.210.186.201
country_id: 2750405
description:
Jan 16 16:09:27 host2 sshd[2566811]: Disconnected from invalid user seafile 4.210.186.201 port 59394 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.162
country_id: 1269750
description:
2026-01-16 16:09:38 dovecot_login authenticator failed for H=(nsg-corporate-162.230.187.122.airtel.in) [122.187.230.162]:44845: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.52.114
country_id: 1269750
description:
2026-01-16 16:09:58 dovecot_login authenticator failed for H=(nsg-corporate-255.223.187.122.airtel.in) [182.79.52.114]:43190: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2026-01-16 16:10:04 dovecot_login authenticator failed for H=([154.144.243.93]) [154.144.243.93]:47648: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.123.146.93
country_id: 2750405
description:
Jan 16 16:10:27 host2 sshd[2568029]: Disconnected from invalid user kuka 20.123.146.93 port 33500 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.102.242
country_id: 290557
description:
2026-01-16 16:10:47 dovecot_login authenticator failed for H=([80.227.102.242]) [80.227.102.242]:34705: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.107.36.18
country_id: 1269750
description:
2026-01-16 16:11:08 dovecot_login authenticator failed for H=([103.107.36.18]) [103.107.36.18]:55738: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.123.146.94
country_id: 2750405
description:
Jan 16 16:11:26 host2 sshd[2568711]: Disconnected from invalid user sysdiag 20.123.146.94 port 12376 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.155.228.189
country_id: 2661886
description:
2026-01-16 16:12:24 dovecot_login authenticator failed for H=h95-155-228-189.cust.bredband2.com [95.155.228.189]:59725: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.138.53.19
country_id: 1643084
description:
2026-01-16 16:12:51 dovecot_login authenticator failed for H=([103.138.53.19]) [103.138.53.19]:44222: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan 16 16:13:56 host2 sshd[2570638]: User agentallianz from 35.186.147.126 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.123.146.95
country_id: 2750405
description:
Jan 16 16:13:38 host2 sshd[2570431]: Disconnected from invalid user snmp 20.123.146.95 port 64472 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 4.210.186.201
country_id: 2750405
description:
Jan 16 16:16:37 host2 sshd[2572498]: Disconnected from invalid user dolphinscheduler 4.210.186.201 port 31761 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 20.123.146.92
country_id: 2750405
description:
Jan 16 16:17:54 host2 sshd[2573298]: Disconnected from invalid user netbackup 20.123.146.92 port 52222 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.157.158
country_id: 1269750
description:
2026-01-16 16:18:02 dovecot_login authenticator failed for H=([128.185.70.193]) [125.19.157.158]:58196: 535 Incorrect authentication data (set_id=postmaster@kamecho.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.105.141.172
country_id: 3923057
description:
2026-01-16 16:18:21 dovecot_login authenticator failed for H=static-200-105-141-172.acelerate.net (static-200-105-141-161.acelerate.net) [200.105.141.172]:55050: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 86.150.100.174
country_id: 2635167
description:
2026-01-16 16:18:53 dovecot_login authenticator failed for H=host86-150-100-174.range86-150.btcentralplus.com [86.150.100.174]:35422: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.2.44.54
country_id: 1269750
description:
2026-01-16 16:19:12 dovecot_login authenticator failed for H=(static.bb.alp.61.2.44.54.bsnl.in) [61.2.44.54]:53444: 535 Incorrect authentication data (set_id=postmaster@agentallianz.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.83.30.199
country_id: 6252001
description:
2026-01-16 16:18:17 dovecot_login authenticator failed for H=ool-43531ec7.dyn.optonline.net [67.83.30.199]:58778: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.119.118
country_id: 1269750
description:
2026-01-16 16:19:43 dovecot_login authenticator failed for H=([128.185.243.163]) [182.95.119.118]:45768: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.82.110.150
country_id: 660013
description:
2026-01-16 16:21:39 dovecot_login authenticator failed for H=([45.82.110.150]) [45.82.110.150]:53442: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.70.157.25
country_id: 6252001
description:
2026-01-16 16:21:56 dovecot_login authenticator failed for H=([152.70.157.25]) [152.70.157.25]:41110: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.176.157.57
country_id: 6252001
description:
2026-01-16 16:22:04 dovecot_plain authenticator failed for H=c-73-176-157-57.hsd1.il.comcast.net (milingrin) [73.176.157.57]:37542: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 66.116.204.139
country_id: 1269750
description:
Jan 16 16:25:40 host2 sshd[2579160]: User agentallianz from 66.116.204.139 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.138.90.195
country_id: 2661886
description:
2026-01-16 16:27:33 dovecot_login authenticator failed for H=h79-138-90-195.cust.bredband2.com [79.138.90.195]:50478: 535 Incorrect authentication data (set_id=all@2s-travels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.101.50
country_id: 1269750
description:
2026-01-16 16:27:44 dovecot_login authenticator failed for H=(nsg-corporate-50.101.185.122.airtel.in) [122.185.101.50]:42308: 535 Incorrect authentication data (set_id=all@2s-travels.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.252.16.238
country_id: 1269750
description:
Jan 16 16:31:27 host2 sshd[2583298]: Disconnected from invalid user vagrant 117.252.16.238 port 44002 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 91.92.199.36
country_id: 732800
description:
Jan 16 16:31:51 host2 sshd[2583549]: Disconnected from invalid user installer 91.92.199.36 port 38432 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 91.92.199.36
country_id: 732800
description:
Jan 16 16:32:27 host2 sshd[2583955]: Disconnected from invalid user vpnuser 91.92.199.36 port 40620 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.252.16.238
country_id: 1269750
description:
Jan 16 16:32:44 host2 sshd[2584106]: Disconnected from invalid user User2 117.252.16.238 port 58588 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.247
country_id: 130758
description:
2026-01-16 16:32:51 dovecot_login authenticator failed for H=(localhost) [62.60.130.247]:64870: 535 Incorrect authentication data (set_id=copia)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 117.252.16.238
country_id: 1269750
description:
Jan 16 16:33:24 host2 sshd[2584551]: Disconnected from invalid user sonarqube 117.252.16.238 port 35744 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan 16 16:35:05 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@seyawin.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<QlEyUH9I0KZ100Db>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.58
country_id: 6252001
description:
Jan 16 16:34:43 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=167.94.146.58, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<nlr5Tn9I6DqnXpI6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.182.118.138
country_id: 732800
description:
2026-01-16 16:34:56 dovecot_login authenticator failed for H=([62.182.118.138]) [62.182.118.138]:38833: 535 Incorrect authentication data (set_id=director@jrdc.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.37.32.248
country_id: 1269750
description:
2026-01-16 16:35:19 dovecot_login authenticator failed for H=(nsg-corporate-90.179.185.122.airtel.in) [49.37.32.248]:40954: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.230.122
country_id: 1269750
description:
2026-01-16 16:35:33 dovecot_login authenticator failed for H=([182.95.230.122]) [182.95.230.122]:46086: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.164.13
country_id: 6252001
description:
2026-01-16 16:35:18 dovecot_login authenticator failed for H=([192.34.164.13]) [192.34.164.13]:29989: 535 Incorrect authentication data (set_id=director)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.146.240.123
country_id: 2542007
description:
2026-01-16 16:39:11 dovecot_plain authenticator failed for H=(fulity) [154.146.240.123]:35874: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.132.53.75
country_id: 3932488
description:
Jan 16 16:39:16 host2 sshd[2588759]: Disconnected from invalid user lighttpd 161.132.53.75 port 37564 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.191.97
country_id: 99237
description:
2026-01-16 16:39:31 dovecot_login authenticator failed for H=([65.20.191.97]) [65.20.191.97]:46478: 535 Incorrect authentication data (set_id=postmaster@systemtec.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.71.82
country_id: 1269750
description:
2026-01-16 16:39:52 dovecot_login authenticator failed for H=(nsg-static-82.71.76.182-airtel.com) [182.76.71.82]:56742: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.180.145.27
country_id: 3469034
description:
Jan 16 16:40:16 host2 sshd[2589841]: Disconnected from invalid user dba 45.180.145.27 port 41196 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.89.198.191
country_id: 2186224
description:
2026-01-16 16:41:07 dovecot_login authenticator failed for H=219-89-198-191.adsl.xtra.co.nz [219.89.198.191]:57256: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.180.145.27
country_id: 3469034
description:
Jan 16 16:40:59 host2 sshd[2590280]: Disconnected from invalid user airflow 45.180.145.27 port 46714 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 161.132.53.75
country_id: 3932488
description:
Jan 16 16:42:05 host2 sshd[2591021]: Disconnected from invalid user kafka 161.132.53.75 port 56564 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.56
country_id: 1733045
description:
2026-01-16 16:41:30 dovecot_login authenticator failed for H=([49.124.153.56]) [49.124.153.56]:36272: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.180.145.27
country_id: 3469034
description:
Jan 16 16:41:37 host2 sshd[2590718]: Disconnected from invalid user rstudio 45.180.145.27 port 38464 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.255.62.58
country_id: 1819730
description:
Jan 16 16:42:37 host2 sshd[2591399]: Disconnected from invalid user sconsole 20.255.62.58 port 43898 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.166.176.136
country_id: 2139685
description:
2026-01-16 16:43:13 dovecot_login authenticator failed for H=host-202-166-176-136.static.lagoon.nc [202.166.176.136]:39024: 535 Incorrect authentication data (set_id=abuse@agentallianz.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.215
country_id: 1269750
description:
2026-01-16 16:43:32 dovecot_login authenticator failed for H=(nsg-corporate-215.230.187.122.airtel.in) [122.187.230.215]:44964: 535 Incorrect authentication data (set_id=abuse)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 20.255.62.58
country_id: 1819730
description:
Jan 16 16:43:50 host2 sshd[2592199]: Disconnected from invalid user netscreen 20.255.62.58 port 54516 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 118.194.231.208
country_id: 1861060
description:
Jan 16 16:45:11 host2 sshd[2593365]: Disconnected from invalid user webserver 118.194.231.208 port 48042 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.176.126
country_id: 1269750
description:
2026-01-16 16:44:15 dovecot_login authenticator failed for H=([27.123.119.235]) [122.185.176.126]:57586: 535 Incorrect authentication data (set_id=it@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.59
country_id: 1269750
description:
2026-01-16 16:44:29 dovecot_login authenticator failed for H=(nsg-corporate-59.229.187.122.airtel.in) [122.187.229.59]:54862: 535 Incorrect authentication data (set_id=it)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.187.9.8
country_id: 1880251
description:
Jan 16 16:45:50 host2 sshd[2594011]: Disconnected from invalid user kafka 52.187.9.8 port 44576 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 52.187.9.8
country_id: 1880251
description:
Jan 16 16:46:25 host2 sshd[2594751]: Disconnected from invalid user hanwha 52.187.9.8 port 55296 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.110.213.247
country_id: 6251999
description:
Jan 16 16:48:17 host2 sshd[2596344]: Invalid user agronatureholdings from 143.110.213.247 port 53202


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 164.92.234.5
country_id: 2921044
description:
Jan 16 16:48:50 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (no auth attempts in 30 secs): user=<>, rip=164.92.234.5, lip=66.85.158.91, TLS handshaking: Connection closed, session=</JF8gX9IsBykXOoF>


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 66.116.204.139
country_id: 1269750
description:
Jan 16 16:50:04 host2 sshd[2597948]: User agentallianz from 66.116.204.139 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.127.101.225
country_id: 1880251
description:
2026-01-16 16:50:40 dovecot_login authenticator failed for H=([101.127.101.225]) [101.127.101.225]:54460: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.168.252
country_id: 2186224
description:
2026-01-16 16:50:26 dovecot_login authenticator failed for H=([121.73.168.252]) [121.73.168.252]:39656: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan 16 16:58:02 host2 sshd[2606418]: User agentallianz from 35.186.147.126 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 64.225.40.153
country_id: 6252001
description:
Jan 16 16:57:32 host2 sshd[2605843]: User agentallianz from 64.225.40.153 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.181.28.202
country_id: 3469034
description:
Jan 16 16:59:13 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<training>, method=PLAIN, rip=45.181.28.202, lip=66.85.158.91, TLS, session=<KDxhpX9ICMottRzK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.171.198
country_id: 3175395
description:
Jan 16 16:59:15 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<training>, method=PLAIN, rip=185.15.171.198, lip=66.85.158.91, TLS, session=<AomnpX9Iwaa5D6vG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.247.169.77
country_id: 2510769
description:
Jan 16 16:58:49 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<training@v-deploy.com>, method=PLAIN, rip=188.247.169.77, lip=66.85.158.91, TLS, session=<v5s2pH9IgLK896lN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.11.173
country_id: 2300660
description:
Jan 16 16:58:56 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<training@v-deploy.com>, method=PLAIN, rip=41.139.11.173, lip=66.85.158.91, TLS, session=<+fBMpH9IS6gpiwut>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.184.130
country_id: 1269750
description:
2026-01-16 16:59:38 dovecot_login authenticator failed for H=([182.95.184.130]) [182.95.184.130]:40150: 535 Incorrect authentication data (set_id=postmaster@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.168.241.32
country_id: 1269750
description:
2026-01-16 17:00:00 dovecot_login authenticator failed for H=([103.168.241.32]) [103.168.241.32]:44940: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.150.115
country_id: 1819730
description:
2026-01-16 17:01:16 dovecot_login authenticator failed for H=115.150.48.116.static.netvigator.com [116.48.150.115]:53403: 535 Incorrect authentication data (set_id=abuse@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.82.20.241
country_id: 1819730
description:
2026-01-16 17:01:37 dovecot_login authenticator failed for H=202-82-20-241.static.imsbiz.com [202.82.20.241]:61282: 535 Incorrect authentication data (set_id=abuse)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.209.108.42
country_id: 6254930
description:
2026-01-16 17:02:24 dovecot_plain authenticator failed for H=(frapper) [185.209.108.42]:48328: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.215.74.195
country_id: 2661886
description:
2026-01-16 17:02:44 dovecot_plain authenticator failed for H=217-215-74-195-no2620.tbcn.telia.com (oxive) [217.215.74.195]:44223: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.188.98
country_id: 1269750
description:
2026-01-16 17:06:48 dovecot_login authenticator failed for H=([125.19.165.242]) [125.19.188.98]:50748: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.97.251.203
country_id: 2017370
description:
2026-01-16 17:07:11 dovecot_login authenticator failed for H=([82.97.251.203]) [82.97.251.203]:55546: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 16 17:08:08 host2 sshd[2614629]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.2.176.137
country_id: 6252001
description:
2026-01-16 17:08:39 dovecot_login authenticator failed for H=96-2-176-137-dynamic.midco.net [96.2.176.137]:59622: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.50
country_id: 2635167
description:
Jan 16 17:09:42 host2 dovecot[221878]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=87.236.176.50, lip=66.85.158.92, TLS, session=<nRIdzH9Ia99X7LAy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan 16 17:11:59 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@seyawin.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<ugoc1H9IYI1100Db>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 212.112.118.108
country_id: 1527747
description:
Jan 16 17:13:48 host2 pure-ftpd[2618767]: (?@212.112.118.108) [INFO] New connection from 212.112.118.108


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 167.94.146.61
country_id: 6252001
description:
Jan 16 17:14:05 host2 pure-ftpd[2618991]: (?@167.94.146.61) [INFO] New connection from 167.94.146.61


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.136.190
country_id: 99237
description:
Jan 16 17:14:20 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<duke.576@bostonlanka.com>, method=PLAIN, rip=65.20.136.190, lip=66.85.158.91, TLS, session=<aSGb239I/ptBFIi+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.73.121
country_id: 3469034
description:
Jan 16 17:14:41 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<duke.576>, method=PLAIN, rip=187.120.73.121, lip=66.85.158.91, TLS, session=<Id/M3H9I8MO7eEl5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.66
country_id: 1149361
description:
2026-01-16 17:16:20 dovecot_login authenticator failed for H=([149.54.62.66]) [149.54.62.66]:33518: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.10.197.168
country_id: 2661886
description:
2026-01-16 17:15:44 dovecot_login authenticator failed for H=h-176-10-197-168.a444.priv.bahnhof.se [176.10.197.168]:59944: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.78.16.88
country_id: 2661886
description:
2026-01-16 17:15:50 dovecot_login authenticator failed for H=a088.broadband.quicknet.se [217.78.16.88]:60832: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.64.206
country_id: 1269750
description:
2026-01-16 17:15:52 dovecot_login authenticator failed for H=(nsg-corporate-206.64.186.122.airtel.in) [122.186.64.206]:49700: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 47.245.117.221
country_id: 1880251
description:
Jan 16 17:16:41 host2 pure-ftpd[2620944]: (?@47.245.117.221) [INFO] New connection from 47.245.117.221


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.31.154
country_id: 1269750
description:
2026-01-16 17:16:51 dovecot_login authenticator failed for H=([125.20.249.154]) [103.251.31.154]:37048: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.155.110
country_id: 1269750
description:
2026-01-16 17:17:17 dovecot_login authenticator failed for H=(dsl-ncr-dynamic-110.155.23.125.airtelbroadband.in) [125.23.155.110]:37146: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.39
country_id: 1643084
description:
2026-01-16 17:17:49 dovecot_login authenticator failed for H=([157.15.40.39]) [157.15.40.39]:58716: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan 16 17:19:47 host2 sshd[2623078]: User agentallianz from 35.186.147.126 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.113.212
country_id: 1861060
description:
Jan 16 17:22:10 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=139.162.113.212, lip=66.85.158.91, TLS: Connection closed, session=<HSqu+H9I/oOLonHU>


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 64.225.40.153
country_id: 6252001
description:
Jan 16 17:21:34 host2 sshd[2624483]: User agentallianz from 64.225.40.153 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.59.157
country_id: 3277605
description:
2026-01-16 17:29:18 dovecot_login authenticator failed for H=([195.222.59.157]) [195.222.59.157]:37142: 535 Incorrect authentication data (set_id=abuse@visionsolutionshospital.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.185.190
country_id: 1269750
description:
2026-01-16 17:29:40 dovecot_login authenticator failed for H=([182.95.87.220]) [122.185.185.190]:49778: 535 Incorrect authentication data (set_id=abuse)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.200
country_id: 690791
description:
2026-01-16 17:29:24 H=([77.83.39.200]) [77.83.39.200]:50121 F=<dpr@priv8shop.com> rejected RCPT <callmegeneralak47@hotmail.com>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.218.101
country_id: 1269750
description:
2026-01-16 17:33:05 dovecot_login authenticator failed for H=([182.79.218.101]) [182.79.218.101]:50312: 535 Incorrect authentication data (set_id=abuse@neotechlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.172.79.198
country_id: 1819730
description:
2026-01-16 17:33:17 dovecot_login authenticator failed for H=69-172-79-198.static.imsbiz.com (173-248-234-145.static.imsbiz.com) [69.172.79.198]:58303: 535 Incorrect authentication data (set_id=abuse)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.149.93
country_id: 99237
description:
2026-01-16 17:34:29 dovecot_plain authenticator failed for H=(basan) [65.20.149.93]:45698: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.109.56.72
country_id: 6252001
description:
2026-01-16 17:36:35 dovecot_login authenticator failed for H=(dfw-206-109-56-72.ip4.99.network) [206.109.56.72]:49844: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.241.228.34
country_id: 1269750
description:
2026-01-16 17:37:17 dovecot_login authenticator failed for H=([115.241.228.34]) [115.241.228.34]:51702: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.242.214
country_id: 290557
description:
2026-01-16 17:41:07 dovecot_login authenticator failed for H=([80.227.242.214]) [80.227.242.214]:57186: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.134.4.86
country_id: 3175395
description:
2026-01-16 17:40:50 dovecot_login authenticator failed for H=(78-134-4-86.static.eolo.it) [78.134.4.86]:42988: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.83.41.60
country_id: 3469034
description:
2026-01-16 17:42:57 dovecot_login authenticator failed for H=(170-83-41-60.swtelecom.com.br) [170.83.41.60]:37548: 535 Incorrect authentication data (set_id=all@comdef.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.170.150.247
country_id: 1605651
description:
2026-01-16 17:43:26 dovecot_login authenticator failed for H=([203.170.150.247]) [203.170.150.247]:56468: 535 Incorrect authentication data (set_id=all)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.217.204.91
country_id: 2658434
description:
2026-01-16 17:44:49 dovecot_login authenticator failed for H=adsl-89-217-204-91.adslplus.ch [89.217.204.91]:47588: 535 Incorrect authentication data (set_id=abuse@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.22
country_id: 1269750
description:
2026-01-16 17:45:18 dovecot_login authenticator failed for H=(aes-static-105.28.22.125.airtel.in) [182.95.228.22]:34032: 535 Incorrect authentication data (set_id=abuse)


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 64.225.40.153
country_id: 6252001
description:
Jan 16 17:45:45 host2 sshd[2643811]: User agentallianz from 64.225.40.153 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.238.92.245
country_id: 2623032
description:
2026-01-16 17:46:41 dovecot_login authenticator failed for H=(84-238-92-245.ptr.bnaa.dk) [84.238.92.245]:59484: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.19.45.20
country_id: 2510769
description:
2026-01-16 17:46:43 dovecot_login authenticator failed for H=20.red-88-19-45.staticip.rima-tde.net [88.19.45.20]:57367: 535 Incorrect authentication data (set_id=abuse@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.4.68.72
country_id: 1210997
description:
2026-01-16 17:47:28 dovecot_login authenticator failed for H=(210.4.68-72.bdcom.com) [210.4.68.72]:59780: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan 16 17:47:33 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<help@seyawin.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<VIlNU4BIrKB100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.247
country_id: 130758
description:
2026-01-16 17:49:54 dovecot_login authenticator failed for H=(localhost) [62.60.130.247]:54550: 535 Incorrect authentication data (set_id=bbs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.227.140.125
country_id: 2661886
description:
2026-01-16 17:50:33 dovecot_login authenticator failed for H=c-83-227-140-125.bbcust.telenor.se [83.227.140.125]:34818: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.124.202
country_id: 1269750
description:
2026-01-16 17:51:08 dovecot_login authenticator failed for H=([182.95.124.202]) [182.95.124.202]:39316: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.208.105.16
country_id: 6252001
description:
2026-01-16 17:51:28 dovecot_login authenticator failed for H=71-208-105-16.ftmy.qwest.net [71.208.105.16]:55453: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.199.126
country_id: 1269750
description:
2026-01-16 17:55:54 dovecot_login authenticator failed for H=([182.79.31.107]) [152.52.199.126]:59514: 535 Incorrect authentication data (set_id=reserve@jrdc.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.165.125.212
country_id: 690791
description:
2026-01-16 18:01:43 dovecot_plain authenticator failed for H=(reucalway) [178.165.125.212]:47103: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan 16 18:04:09 host2 sshd[2659083]: Disconnected from invalid user admin 2.57.121.112 port 35521 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.248.243.181
country_id: 2542007
description:
2026-01-16 18:06:32 dovecot_plain authenticator failed for H=(persuming) [41.248.243.181]:49064: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.63.50
country_id: 1269750
description:
2026-01-16 18:09:02 dovecot_login authenticator failed for H=([125.16.246.121]) [182.95.63.50]:38150: 535 Incorrect authentication data (set_id=abuse@systemtec.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.3.227.160
country_id: 1861060
description:
2026-01-16 18:09:18 dovecot_login authenticator failed for H=p7001161-ipoefx.ipoe.ocn.ne.jp [118.3.227.160]:57202: 535 Incorrect authentication data (set_id=abuse)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.208.58
country_id: 1036973
description:
2026-01-16 18:10:33 dovecot_login authenticator failed for H=([197.219.208.58]) [197.219.208.58]:47996: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.149.161.131
country_id: 6252001
description:
2026-01-16 18:10:15 dovecot_login authenticator failed for H=c-50-149-161-131.hsd1.tn.comcast.net [50.149.161.131]:58658: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 64.225.40.153
country_id: 6252001
description:
Jan 16 18:10:37 host2 sshd[2664889]: User agentallianz from 64.225.40.153 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.163.122.133
country_id: 1210997
description:
2026-01-16 18:12:54 dovecot_login authenticator failed for H=(IP-122-133.bol-online.com) [182.163.122.133]:56725: 535 Incorrect authentication data (set_id=postmaster@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.143.14
country_id: 1269750
description:
2026-01-16 18:13:05 dovecot_login authenticator failed for H=([103.251.143.14]) [103.251.143.14]:37890: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.216.169.12
country_id: 2328926
description:
2026-01-16 18:13:26 dovecot_login authenticator failed for H=([41.216.169.12]) [41.216.169.12]:50610: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.162.86
country_id: 2186224
description:
2026-01-16 18:17:43 dovecot_login authenticator failed for H=([121.73.162.86]) [121.73.162.86]:40120: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.36.115.152
country_id: 1269750
description:
2026-01-16 18:18:24 dovecot_login authenticator failed for H=([103.68.19.170]) [49.36.115.152]:39360: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.110.213.247
country_id: 6251999
description:
Jan 16 18:20:59 host2 sshd[2674180]: Invalid user agronatureholdings from 143.110.213.247 port 44928


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan 16 18:22:49 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@seyawin.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<Xp5w0YBIJdt100Db>


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan 16 18:25:51 host2 sshd[2677811]: User agentallianz from 35.186.147.126 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.250.93
country_id: 99237
description:
2026-01-16 18:28:20 dovecot_login authenticator failed for H=([65.20.250.93]) [65.20.250.93]:50147: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.200
country_id: 690791
description:
2026-01-16 18:28:52 H=([77.83.39.200]) [77.83.39.200]:51007 F=<dpr@priv8shop.com> rejected RCPT <callmegeneralak47@hotmail.com>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.172.98
country_id: 1269750
description:
2026-01-16 18:28:39 dovecot_login authenticator failed for H=([27.123.119.146]) [122.187.172.98]:55140: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.45.200.87
country_id: 2077456
description:
2026-01-16 18:30:23 dovecot_login authenticator failed for H=([203.45.200.87]) [203.45.200.87]:39532: 535 Incorrect authentication data (set_id=postmaster@simple-engineering.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.152.28.227
country_id: 3469034
description:
Jan 16 18:30:28 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<duke.576>, method=PLAIN, rip=177.152.28.227, lip=66.85.158.91, TLS, session=<pcDg64BIlbmxmBzj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.185.229.191
country_id: 3865483
description:
2026-01-16 18:29:53 dovecot_login authenticator failed for H=([190.185.229.191]) [190.185.229.191]:37910: 535 Incorrect authentication data (set_id=postmaster@simple-engineering.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.36.84.115
country_id: 597427
description:
Jan 16 18:30:08 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<duke.576@bostonlanka.com>, method=PLAIN, rip=46.36.84.115, lip=66.85.158.91, TLS, session=<StHK6oBIv9IuJFRz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.191.142.67
country_id: 337996
description:
2026-01-16 18:30:39 dovecot_login authenticator failed for H=([196.191.142.67]) [196.191.142.67]:57310: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.132.32.143
country_id: 6252001
description:
2026-01-16 18:32:41 dovecot_login authenticator failed for H=([72.132.32.143]) [72.132.32.143]:59171: 535 Incorrect authentication data (set_id=admin@2s-travels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.68.166.44
country_id: 798544
description:
2026-01-16 18:33:13 dovecot_login authenticator failed for H=89-68-166-44.dynamic.play.pl [89.68.166.44]:48644: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 64.225.40.153
country_id: 6252001
description:
Jan 16 18:34:40 host2 sshd[2684430]: User agentallianz from 64.225.40.153 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.167.202
country_id: 290557
description:
2026-01-16 18:36:11 dovecot_login authenticator failed for H=([91.73.167.202]) [91.73.167.202]:10705: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 13.68.214.34
country_id: 6252001
description:
2026-01-16 18:36:25 dovecot_login authenticator failed for H=([13.68.214.34]) [13.68.214.34]:51774: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.185.96.126
country_id: 294640
description:
2026-01-16 18:36:38 dovecot_login authenticator failed for H=([130.185.96.126]) [130.185.96.126]:38930: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.165.182.203
country_id: 6252001
description:
2026-01-16 18:39:59 dovecot_plain authenticator failed for H=(dattly) [173.165.182.203]:54635: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 66.116.204.139
country_id: 1269750
description:
Jan 16 18:45:05 host2 sshd[2692558]: User agentallianz from 66.116.204.139 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.210.214.171
country_id: 3144096
description:
2026-01-16 18:45:33 dovecot_login authenticator failed for H=(cm-84.210.214.171.get.no) [84.210.214.171]:57318: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.83.134.101
country_id: 3469034
description:
2026-01-16 18:45:45 dovecot_login authenticator failed for H=(179.83.135.1.dynamic.adsl.gvt.net.br) [179.83.134.101]:45274: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.219.104.210
country_id: 3175395
description:
2026-01-16 18:46:13 dovecot_login authenticator failed for H=net-188-219-104-210.cust.vodafonedsl.it [188.219.104.210]:48618: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.205.250.78
country_id: 290557
description:
2026-01-16 18:46:27 dovecot_plain authenticator failed for H=(aully) [94.205.250.78]:54598: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.140.219
country_id: 298795
description:
2026-01-16 18:46:51 dovecot_plain authenticator failed for H=(desping) [5.11.140.219]:34296: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.30.130.3
country_id: 6251999
description:
2026-01-16 18:47:03 dovecot_login authenticator failed for H=host-96-30-130-3.public.eastlink.ca [96.30.130.3]:53230: 535 Incorrect authentication data (set_id=postmaster@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.248.156.49
country_id: 1522867
description:
2026-01-16 18:47:07 dovecot_login authenticator failed for H=([109.248.156.49]) [109.248.156.49]:55706: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.170.99.195
country_id: 1269750
description:
2026-01-16 18:47:20 dovecot_login authenticator failed for H=(abts-mum-static-195.99.170.122.airtelbroadband.in) [122.170.99.195]:54368: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.64.3.134
country_id: 1269750
description:
2026-01-16 18:46:48 dovecot_login authenticator failed for H=([125.21.245.33]) [182.64.3.134]:58544: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.159.145.213
country_id: 1168579
description:
2026-01-16 18:46:48 dovecot_login authenticator failed for H=([119.159.145.213]) [119.159.145.213]:57432: 535 Incorrect authentication data (set_id=postmaster@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.154.217.188
country_id: 690791
description:
2026-01-16 18:47:53 dovecot_login authenticator failed for H=ip-d9bc.d-net.kiev.ua [94.154.217.188]:57664: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.16.55
country_id: 3469034
description:
2026-01-16 18:48:21 dovecot_login authenticator failed for H=(177-174-16-81.user.vivozap.com.br) [177.174.16.55]:44756: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.154.84.190
country_id: 2287781
description:
2026-01-16 18:48:28 dovecot_login authenticator failed for H=([160.154.84.190]) [160.154.84.190]:58562: 535 Incorrect authentication data (set_id=md@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.1.40.151
country_id: 6251999
description:
2026-01-16 18:47:49 dovecot_login authenticator failed for H=96-1-40-151-staticipeast.wireless.telus.com [96.1.40.151]:43141: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.79.134
country_id: 1269750
description:
2026-01-16 18:52:15 dovecot_login authenticator failed for H=([128.185.189.57]) [182.78.79.134]:40534: 535 Incorrect authentication data (set_id=it@maximsholdings.com)


