# incident

plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.58.241.90
country_id: 3469034
description:
2025-11-03 05:50:10 dovecot_login authenticator failed for ([187.58.241.90]) [187.58.241.90]:48738: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.248.170
country_id: 1269750
description:
2025-11-03 05:50:37 dovecot_login authenticator failed for ([125.19.248.170]) [125.19.248.170]:52796: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.174.182.38
country_id: 2077456
description:
2025-11-03 05:50:52 dovecot_login authenticator failed for 203-174-182-38.ade.static-ipl.aapt.com.au [203.174.182.38]:43760: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.40
country_id: 6252001
description:
Nov  3 06:04:37 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.40, lip=66.85.158.92, session=<cvBK4aVCpP3G6xgo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 143.244.54.21
country_id: 798549
description:
2025-11-03 06:05:24 dovecot_login authenticator failed for (ADMIN) [143.244.54.21]:12632: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  3 06:16:18 host2 sshd[88364]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 89.187.162.180
country_id: 1880251
description:
Nov  3 06:25:04 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=89.187.162.180, lip=66.85.158.91, TLS, session=<dMB4KqZCAp1Zu6K0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 188.215.235.43
country_id: 1831722
description:
Nov  3 06:24:27 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=188.215.235.43, lip=66.85.158.91, session=<y4A4KKZCQOO81+sr>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 173.244.33.9
country_id: 1282988
description:
Nov  3 06:24:27 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=173.244.33.9, lip=66.85.158.91, TLS handshaking: Connection closed, session=<Pcc3KKZCFrqt9CEJ>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 217.138.193.188
country_id: 290557
description:
Nov  3 06:25:00 host2 pure-ftpd[97160]: (?@217.138.193.188) [INFO] New connection from 217.138.193.188


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 178.175.142.131
country_id: 617790
description:
Nov  3 06:25:04 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=178.175.142.131, lip=66.85.158.91, TLS, session=<LL50KqZCwLWyr46D>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.90.122.153
country_id: 3042058
description:
Nov  3 06:24:26 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=91.90.122.153, lip=66.85.158.91, session=<cXI0KKZC+o1bWnqZ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 146.70.12.7
country_id: 1168579
description:
Nov  3 06:24:27 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=146.70.12.7, lip=66.85.158.91, TLS handshaking: Connection closed, session=<8Gc4KKZCxO2SRgwH>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.225.28.12
country_id: 718075
description:
Nov  3 06:25:04 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=185.225.28.12, lip=66.85.158.91, TLS handshaking: Connection closed, session=<jLd3KqZCAJ254RwM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.97.74
country_id: 1269750
description:
2025-11-03 06:25:55 dovecot_login authenticator failed for ([182.79.70.81]) [27.123.97.74]:57626: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.90.126.53
country_id: 3703430
description:
2025-11-03 06:26:06 dovecot_login authenticator failed for (ADMIN) [91.90.126.53]:53706: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 176.125.229.144
country_id: 3194884
description:
Nov  3 06:26:25 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=176.125.229.144, lip=66.85.158.91, TLS, session=<7SdGL6ZCSJKwfeWQ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 95.181.232.25
country_id: 2542007
description:
Nov  3 06:26:57 host2 dovecot[3704077]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=95.181.232.25, lip=66.85.158.91, session=<rzMtMaZCAMNftegZ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 146.70.12.7
country_id: 1168579
description:
Nov  3 06:26:57 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=146.70.12.7, lip=66.85.158.91, TLS handshaking: Connection closed, session=<jz02MaZCDtySRgwH>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 95.181.234.141
country_id: 289688
description:
Nov  3 06:26:46 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=95.181.234.141, lip=66.85.158.91, session=<8dKNMKZC/O1fteqN>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.225.28.12
country_id: 718075
description:
Nov  3 06:26:57 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=185.225.28.12, lip=66.85.158.91, TLS, session=<BUU1MaZCGNy54RwM>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 31.171.152.105
country_id: 783754
description:
Nov  3 06:26:57 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=31.171.152.105, lip=66.85.158.91, TLS, session=<jNczMaZCbKMfq5hp>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 95.181.232.142
country_id: 2542007
description:
Nov  3 06:26:20 host2 pure-ftpd[98577]: (?@95.181.232.142) [INFO] New connection from 95.181.232.142


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 89.187.162.180
country_id: 1880251
description:
Nov  3 06:26:22 host2 pure-ftpd[98630]: (?@89.187.162.180) [INFO] New connection from 89.187.162.180


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 86.106.74.250
country_id: 719819
description:
Nov  3 06:26:44 host2 dovecot[3704077]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=86.106.74.250, lip=66.85.158.91, session=<4P5tMKZCwLpWakr6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.134.213.165
country_id: 2510769
description:
Nov  3 06:26:26 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=45.134.213.165, lip=66.85.158.91, session=<B2lbL6ZCMocthtWl>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 98.159.36.3
country_id: 3277605
description:
Nov  3 06:26:23 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=98.159.36.3, lip=66.85.158.91, TLS, session=<oZImL6ZCOqJinyQD>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.90.122.140
country_id: 3042058
description:
Nov  3 06:26:23 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.90.122.140, lip=66.85.158.91, TLS handshaking: Connection closed, session=<DVsoL6ZCUudbWnqM>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.154.153.21
country_id: 3923057
description:
Nov  3 06:26:25 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=45.154.153.21, lip=66.85.158.91, TLS handshaking: Connection closed, session=<TdxFL6ZCQpItmpkV>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 79.127.175.78
country_id: 390903
description:
Nov  3 06:26:23 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=79.127.175.78, lip=66.85.158.91, TLS, session=<IN8oL6ZCYudPf69O>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 173.244.33.9
country_id: 1282988
description:
Nov  3 06:26:57 host2 dovecot[3704077]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=173.244.33.9, lip=66.85.158.91, session=<X3wxMaZC0LWt9CEJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.231.182.151
country_id: 453733
description:
Nov  3 06:26:44 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=165.231.182.151, lip=66.85.158.91, session=<dB5xMKZCsrql57aX>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 146.70.65.11
country_id: 2328926
description:
Nov  3 06:26:46 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=146.70.65.11, lip=66.85.158.91, TLS handshaking: Connection closed, session=<sv6IMKZClMOSRkEL>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 149.88.26.65
country_id: 294640
description:
Nov  3 06:26:57 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=149.88.26.65, lip=66.85.158.91, session=<1AU3MaZCNLeVWBpB>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 98.159.41.8
country_id: 1327865
description:
Nov  3 06:26:23 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=98.159.41.8, lip=66.85.158.91, TLS handshaking: Connection closed, session=<rMMnL6ZCOKJinykI>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 138.199.39.162
country_id: 1861060
description:
Nov  3 06:26:23 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=138.199.39.162, lip=66.85.158.91, session=<IJspL6ZCRvKKxyei>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 149.88.26.70
country_id: 294640
description:
Nov  3 06:26:24 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=149.88.26.70, lip=66.85.158.91, session=<cfw/L6ZCZNmVWBpG>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.225.28.4
country_id: 718075
description:
Nov  3 06:26:45 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=185.225.28.4, lip=66.85.158.91, TLS, session=<yeZyMKZCQtq54RwE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 95.181.234.143
country_id: 289688
description:
Nov  3 06:27:11 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=95.181.234.143, lip=66.85.158.91, session=<5+QKMqZCJsFfteqP>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 95.181.232.142
country_id: 2542007
description:
Nov  3 06:26:57 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=95.181.232.142, lip=66.85.158.91, TLS handshaking: Connection closed, session=<TFwzMaZCaKNfteiO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 196.245.54.13
country_id: 2510769
description:
Nov  3 06:26:23 host2 dovecot[3704077]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=196.245.54.13, lip=66.85.158.91, session=<FA4pL6ZC7OfE9TYN>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 176.125.229.144
country_id: 3194884
description:
Nov  3 06:27:06 host2 pure-ftpd[99546]: (?@176.125.229.144) [INFO] New connection from 176.125.229.144


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 176.125.229.144
country_id: 3194884
description:
Nov  3 06:27:34 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=176.125.229.144, lip=66.85.158.91, session=</xxqM6ZCeMqwfeWQ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 149.88.26.65
country_id: 294640
description:
Nov  3 06:27:57 host2 dovecot[3704077]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=149.88.26.65, lip=66.85.158.91, session=<jofGNKZCiOmVWBpB>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 79.127.175.78
country_id: 390903
description:
Nov  3 06:27:59 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=79.127.175.78, lip=66.85.158.91, TLS handshaking: Connection closed, session=<qAjdNKZCiKdPf69O>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 217.138.193.188
country_id: 290557
description:
Nov  3 06:27:36 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=217.138.193.188, lip=66.85.158.91, TLS handshaking: Connection closed, session=<4IF/M6ZCULzZisG8>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 149.88.26.70
country_id: 294640
description:
Nov  3 06:27:57 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=149.88.26.70, lip=66.85.158.91, TLS handshaking: Connection closed, session=<p3rKNKZCdJeVWBpG>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 89.187.162.103
country_id: 1880251
description:
Nov  3 06:27:57 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=89.187.162.103, lip=66.85.158.91, session=<YyvLNKZCaulZu6Jn>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 71.6.146.130
country_id: 6252001
description:
Nov  3 06:31:43 host2 dovecot[3704077]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=71.6.146.130, lip=66.85.158.92, session=<pk08QqZCkMFHBpKC>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 71.6.146.130
country_id: 6252001
description:
Nov  3 06:31:44 host2 dovecot[3704077]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=71.6.146.130, lip=66.85.158.92, session=<GjRRQqZClsRHBpKC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.225.28.231
country_id: 718075
description:
2025-11-03 06:48:09 dovecot_login authenticator failed for (ADMIN) [185.225.28.231]:13217: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 31.171.152.105
country_id: 783754
description:
Nov  3 06:58:13 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=31.171.152.105, lip=66.85.158.91, TLS handshaking: Connection closed, session=<AM0HoaZCUKUfq5hp>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 217.138.193.188
country_id: 290557
description:
Nov  3 06:58:14 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=217.138.193.188, lip=66.85.158.91, session=<5u4PoaZCoJfZisG8>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 89.187.162.180
country_id: 1880251
description:
Nov  3 06:58:15 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=89.187.162.180, lip=66.85.158.91, TLS handshaking: Connection closed, session=<+5UfoaZCZoRZu6K0>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 89.187.162.180
country_id: 1880251
description:
Nov  3 06:58:11 host2 pure-ftpd[133026]: (?@89.187.162.180) [INFO] New connection from 89.187.162.180


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 95.181.232.25
country_id: 2542007
description:
Nov  3 06:58:13 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=95.181.232.25, lip=66.85.158.91, TLS, session=<oVgHoaZCXqVftegZ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 95.181.234.143
country_id: 289688
description:
Nov  3 06:58:14 host2 dovecot[3704077]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=95.181.234.143, lip=66.85.158.91, session=<7cEJoaZCqJdfteqP>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 196.196.53.39
country_id: 458258
description:
Nov  3 07:01:06 host2 dovecot[3704077]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=196.196.53.39, lip=66.85.158.91, session=<+v9Xq6ZCrJzExDUn>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 149.88.26.70
country_id: 294640
description:
Nov  3 07:01:07 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=149.88.26.70, lip=66.85.158.91, session=<+OJbq6ZCppyVWBpG>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.132.194.64
country_id: 597427
description:
Nov  3 07:01:08 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=45.132.194.64, lip=66.85.158.91, TLS handshaking: Connection closed, session=<9P1vq6ZCjL4thMJA>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 89.187.162.180
country_id: 1880251
description:
Nov  3 07:01:08 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=89.187.162.180, lip=66.85.158.91, session=<o1pzq6ZCfMJZu6K0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 95.181.234.143
country_id: 289688
description:
Nov  3 07:01:42 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=95.181.234.143, lip=66.85.158.91, TLS handshaking: Connection closed, session=<mnZvraZCfLxfteqP>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 95.181.232.142
country_id: 2542007
description:
Nov  3 07:01:41 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=95.181.232.142, lip=66.85.158.91, TLS handshaking: Connection closed, session=<uTNoraZCSYxfteiO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 146.70.65.11
country_id: 2328926
description:
Nov  3 07:01:40 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=146.70.65.11, lip=66.85.158.91, TLS handshaking: Connection closed, session=<RPNUraZCiM6SRkEL>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 149.88.26.65
country_id: 294640
description:
Nov  3 07:01:40 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=149.88.26.65, lip=66.85.158.91, session=<2TVaraZCDuyVWBpB>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 149.102.232.85
country_id: 3057568
description:
Nov  3 07:01:41 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=149.102.232.85, lip=66.85.158.91, session=<0bRjraZCzOmVZuhV>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.231.182.151
country_id: 453733
description:
Nov  3 07:01:41 host2 dovecot[3704077]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=165.231.182.151, lip=66.85.158.91, session=<tcVgraZC1uml57aX>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.132.194.64
country_id: 597427
description:
Nov  3 07:01:40 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=45.132.194.64, lip=66.85.158.91, TLS, session=<8FBVraZClM4thMJA>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 217.138.193.188
country_id: 290557
description:
Nov  3 07:01:40 host2 dovecot[3704077]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=217.138.193.188, lip=66.85.158.91, session=<vJZVraZCFOzZisG8>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 154.47.16.139
country_id: 3686110
description:
Nov  3 07:01:41 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=154.47.16.139, lip=66.85.158.91, TLS, session=<+CRpraZCoMqaLxCL>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 188.215.235.43
country_id: 1831722
description:
Nov  3 07:02:40 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=188.215.235.43, lip=66.85.158.91, TLS, session=<jJXxsKZCVuS81+sr>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 158.173.158.81
country_id: 3017382
description:
Nov  3 07:02:40 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=158.173.158.81, lip=66.85.158.91, TLS handshaking: Connection closed, session=<ouvvsKZCUOSerZ5R>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 138.199.39.162
country_id: 1861060
description:
Nov  3 07:02:42 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=138.199.39.162, lip=66.85.158.91, TLS handshaking: Connection closed, session=<x0IFsaZCrLeKxyei>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 146.70.65.11
country_id: 2328926
description:
Nov  3 07:02:41 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=146.70.65.11, lip=66.85.158.91, session=<T9cAsaZCLN2SRkEL>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 188.215.235.43
country_id: 1831722
description:
Nov  3 07:04:19 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=188.215.235.43, lip=66.85.158.91, TLS handshaking: Connection closed, session=<ANXPtqZCsKW81+sr>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.231.182.151
country_id: 453733
description:
Nov  3 07:04:20 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=165.231.182.151, lip=66.85.158.91, session=<9TTctqZC6p6l57aX>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 98.159.36.3
country_id: 3277605
description:
Nov  3 07:04:19 host2 dovecot[3704077]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=98.159.36.3, lip=66.85.158.91, session=<G3TZtqZC8p5inyQD>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 173.244.32.10
country_id: 3508796
description:
Nov  3 07:04:41 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=173.244.32.10, lip=66.85.158.91, TLS, session=<XyIbuKZCwr2t9CAK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 178.175.142.131
country_id: 617790
description:
Nov  3 07:04:19 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=178.175.142.131, lip=66.85.158.91, session=<0XnNtqZCuIOyr46D>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.32.122.14
country_id: 597427
description:
Nov  3 07:04:19 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=194.32.122.14, lip=66.85.158.91, session=<Z8bOtqZCtrfCIHoO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 217.138.193.188
country_id: 290557
description:
Nov  3 07:04:19 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=217.138.193.188, lip=66.85.158.91, TLS, session=<y0LQtqZCHODZisG8>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 176.125.229.144
country_id: 3194884
description:
Nov  3 07:04:41 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=176.125.229.144, lip=66.85.158.91, TLS handshaking: Connection closed, session=<f7sbuKZCaLuwfeWQ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.133.46.16
country_id: 130758
description:
Nov  3 07:04:18 host2 dovecot[3704077]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=62.133.46.16, lip=66.85.158.91, session=<+TXKtqZC3OQ+hS4Q>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 89.187.162.180
country_id: 1880251
description:
Nov  3 07:04:18 host2 dovecot[3704077]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=89.187.162.180, lip=66.85.158.91, session=<tcfJtqZC7I9Zu6K0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 188.215.235.43
country_id: 1831722
description:
Nov  3 07:05:47 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=188.215.235.43, lip=66.85.158.91, session=<6qkKvKZCpTm81+sr>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 37.19.223.208
country_id: 2782113
description:
Nov  3 07:05:47 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=37.19.223.208, lip=66.85.158.91, session=<RyAOvKZC0KQlE9/Q>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 173.244.42.148
country_id: 1835841
description:
Nov  3 07:05:47 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=173.244.42.148, lip=66.85.158.91, TLS handshaking: Connection closed, session=<JaMKvKZCKL2t9CqU>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 217.138.193.188
country_id: 290557
description:
Nov  3 07:05:41 host2 pure-ftpd[141871]: (?@217.138.193.188) [INFO] New connection from 217.138.193.188


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 188.215.235.43
country_id: 1831722
description:
Nov  3 07:05:42 host2 pure-ftpd[141875]: (?@188.215.235.43) [INFO] New connection from 188.215.235.43


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.231.182.151
country_id: 453733
description:
Nov  3 07:05:46 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=165.231.182.151, lip=66.85.158.91, session=<AY38u6ZCApSl57aX>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 95.181.232.142
country_id: 2542007
description:
Nov  3 07:05:47 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=95.181.232.142, lip=66.85.158.91, TLS handshaking: Connection closed, session=<EIsNvKZCKrJfteiO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 178.175.142.131
country_id: 617790
description:
Nov  3 07:05:47 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=178.175.142.131, lip=66.85.158.91, TLS handshaking: Connection closed, session=<zvANvKZCWteyr46D>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 95.181.232.25
country_id: 2542007
description:
Nov  3 07:05:48 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=95.181.232.25, lip=66.85.158.91, session=<Th8ivKZCFrNftegZ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.90.122.140
country_id: 3042058
description:
Nov  3 07:05:47 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=91.90.122.140, lip=66.85.158.91, TLS, session=<CKoNvKZCatdbWnqM>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 173.244.33.10
country_id: 1282988
description:
Nov  3 07:05:45 host2 dovecot[3704077]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=173.244.33.10, lip=66.85.158.91, session=<iWH4u6ZCEJSt9CEK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 149.88.26.70
country_id: 294640
description:
Nov  3 07:05:46 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=149.88.26.70, lip=66.85.158.91, session=<rscHvKZCRuaVWBpG>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.32.122.14
country_id: 597427
description:
Nov  3 07:06:19 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=194.32.122.14, lip=66.85.158.91, session=<4nP3vaZCvoXCIHoO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 149.88.26.70
country_id: 294640
description:
Nov  3 07:06:19 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=149.88.26.70, lip=66.85.158.91, session=<bCX4vaZCQpGVWBpG>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 154.47.16.139
country_id: 3686110
description:
Nov  3 07:06:19 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=154.47.16.139, lip=66.85.158.91, TLS handshaking: Connection closed, session=<ykj5vaZCkoOaLxCL>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 95.181.232.25
country_id: 2542007
description:
Nov  3 07:06:19 host2 dovecot[3704077]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=95.181.232.25, lip=66.85.158.91, session=<J2L0vaZCTshftegZ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 196.245.54.13
country_id: 2510769
description:
Nov  3 07:06:19 host2 dovecot[3704077]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=196.245.54.13, lip=66.85.158.91, session=<yI70vaZCjOvE9TYN>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 31.171.152.105
country_id: 783754
description:
Nov  3 07:06:19 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=31.171.152.105, lip=66.85.158.91, TLS handshaking: Connection closed, session=<0GP9vaZCuKEfq5hp>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 196.196.53.39
country_id: 458258
description:
Nov  3 07:06:19 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=196.196.53.39, lip=66.85.158.91, TLS, session=<Cd/4vaZCTtnExDUn>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.134.213.165
country_id: 2510769
description:
Nov  3 07:07:43 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=45.134.213.165, lip=66.85.158.91, TLS, session=<OLz1wqZCwpMthtWl>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 84.247.105.126
country_id: 6251999
description:
Nov  3 07:07:52 host2 pure-ftpd[144312]: (?@84.247.105.126) [INFO] New connection from 84.247.105.126


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 154.47.16.139
country_id: 3686110
description:
Nov  3 07:07:57 host2 dovecot[3704077]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=154.47.16.139, lip=66.85.158.91, session=<Nd/Lw6ZCzqqaLxCL>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 188.215.235.43
country_id: 1831722
description:
Nov  3 07:07:57 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=188.215.235.43, lip=66.85.158.91, session=<tO/Qw6ZCyKq81+sr>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 31.171.152.105
country_id: 783754
description:
Nov  3 07:07:57 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=31.171.152.105, lip=66.85.158.91, TLS handshaking: Connection closed, session=</4/Qw6ZCNogfq5hp>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 84.247.105.126
country_id: 6251999
description:
Nov  3 07:08:13 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=84.247.105.126, lip=66.85.158.91, session=<37+/xKZC+KRU92l+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 149.88.26.65
country_id: 294640
description:
Nov  3 07:07:42 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=149.88.26.65, lip=66.85.158.91, session=<ICXqwqZCnIeVWBpB>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 149.88.26.70
country_id: 294640
description:
Nov  3 07:08:13 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=149.88.26.70, lip=66.85.158.91, session=<xVfCxKZCQq+VWBpG>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 217.138.193.188
country_id: 290557
description:
Nov  3 07:08:09 host2 pure-ftpd[144721]: (?@217.138.193.188) [INFO] New connection from 217.138.193.188


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.32.122.14
country_id: 597427
description:
Nov  3 07:08:13 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=194.32.122.14, lip=66.85.158.91, TLS handshaking: Connection closed, session=<743BxKZCvoXCIHoO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.90.122.140
country_id: 3042058
description:
Nov  3 07:07:42 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=91.90.122.140, lip=66.85.158.91, TLS handshaking: Connection closed, session=<0iPowqZCQONbWnqM>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.132.194.64
country_id: 597427
description:
Nov  3 07:07:43 host2 dovecot[3704077]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=45.132.194.64, lip=66.85.158.91, session=<J7zzwqZCisUthMJA>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 178.175.142.131
country_id: 617790
description:
Nov  3 07:07:57 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=178.175.142.131, lip=66.85.158.91, TLS, session=<XXjQw6ZCOIiyr46D>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 138.199.39.162
country_id: 1861060
description:
Nov  3 07:08:10 host2 pure-ftpd[144732]: (?@138.199.39.162) [INFO] New connection from 138.199.39.162


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 173.244.42.148
country_id: 1835841
description:
Nov  3 07:07:40 host2 pure-ftpd[144215]: (?@173.244.42.148) [INFO] New connection from 173.244.42.148


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.231.182.151
country_id: 453733
description:
Nov  3 07:07:42 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=165.231.182.151, lip=66.85.158.91, TLS handshaking: Connection closed, session=<FLbowqZCkpKl57aX>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.154.153.21
country_id: 3923057
description:
Nov  3 07:07:43 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=45.154.153.21, lip=66.85.158.91, TLS handshaking: Connection closed, session=<9Iv1wqZCspMtmpkV>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 98.159.36.3
country_id: 3277605
description:
Nov  3 07:07:43 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=98.159.36.3, lip=66.85.158.91, session=<HJb2wqZCaMVinyQD>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 89.187.162.103
country_id: 1880251
description:
Nov  3 07:08:36 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=89.187.162.103, lip=66.85.158.91, session=<WfUgxqZC2IRZu6Jn>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 89.187.162.103
country_id: 1880251
description:
Nov  3 07:10:14 host2 pure-ftpd[147000]: (?@89.187.162.103) [INFO] New connection from 89.187.162.103


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 178.175.142.131
country_id: 617790
description:
Nov  3 07:10:14 host2 pure-ftpd[146968]: (?@178.175.142.131) [INFO] New connection from 178.175.142.131


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 138.199.39.162
country_id: 1861060
description:
Nov  3 07:10:28 host2 pure-ftpd[147128]: (?@138.199.39.162) [INFO] New connection from 138.199.39.162


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  3 07:11:14 host2 sshd[147924]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.32.122.14
country_id: 597427
description:
Nov  3 07:10:30 host2 dovecot[3704077]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=194.32.122.14, lip=66.85.158.91, session=<0dPyzKZCPI/CIHoO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 149.102.232.85
country_id: 3057568
description:
Nov  3 07:10:31 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=149.102.232.85, lip=66.85.158.91, TLS handshaking: Connection closed, session=<l4f6zKZCXMOVZuhV>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 138.199.39.162
country_id: 1861060
description:
Nov  3 07:10:31 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=138.199.39.162, lip=66.85.158.91, TLS, session=<qwf8zKZCasOKxyei>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.173.23.178
country_id: 2635167
description:
2025-11-03 07:10:40 dovecot_login authenticator failed for (ADMIN) [158.173.23.178]:18871: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 188.215.235.43
country_id: 1831722
description:
Nov  3 07:10:18 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=188.215.235.43, lip=66.85.158.91, session=<0vs9zKZCMMy81+sr>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.209
country_id: 6252001
description:
Nov  3 07:10:18 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=205.210.31.209, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<SIY7zKZCQsLN0h/R>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 176.125.229.144
country_id: 3194884
description:
Nov  3 07:10:30 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=176.125.229.144, lip=66.85.158.91, session=<7UP2zKZCLI+wfeWQ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 89.187.162.180
country_id: 1880251
description:
Nov  3 07:10:31 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=89.187.162.180, lip=66.85.158.91, session=<af/5zKZCHrJZu6K0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.90.122.140
country_id: 3042058
description:
Nov  3 07:12:07 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=91.90.122.140, lip=66.85.158.91, session=<ppaz0qZCFsNbWnqM>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 84.247.105.126
country_id: 6251999
description:
Nov  3 07:12:05 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=84.247.105.126, lip=66.85.158.91, TLS handshaking: Connection closed, session=<t4yf0qZCvsVU92l+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 217.138.193.188
country_id: 290557
description:
Nov  3 07:12:06 host2 dovecot[3704077]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=217.138.193.188, lip=66.85.158.91, session=<fIqh0qZCrIDZisG8>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.134.213.165
country_id: 2510769
description:
Nov  3 07:12:07 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=45.134.213.165, lip=66.85.158.91, session=<ffO00qZC2L4thtWl>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 95.181.232.142
country_id: 2542007
description:
Nov  3 07:12:05 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=95.181.232.142, lip=66.85.158.91, TLS, session=<Trif0qZCwsVfteiO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 31.171.152.105
country_id: 783754
description:
Nov  3 07:12:07 host2 dovecot[3704077]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=31.171.152.105, lip=66.85.158.91, session=<Vcux0qZC6L4fq5hp>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 149.88.26.65
country_id: 294640
description:
Nov  3 07:12:07 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=149.88.26.65, lip=66.85.158.91, TLS, session=<wg630qZCJq+VWBpB>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 89.187.162.103
country_id: 1880251
description:
Nov  3 07:11:56 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=89.187.162.103, lip=66.85.158.91, TLS handshaking: Connection closed, session=<kHkP0qZCVIlZu6Jn>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 196.245.54.13
country_id: 2510769
description:
Nov  3 07:12:06 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=196.245.54.13, lip=66.85.158.91, session=<ut+l0qZCqoDE9TYN>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 95.181.232.142
country_id: 2542007
description:
Nov  3 07:11:52 host2 pure-ftpd[148604]: (?@95.181.232.142) [INFO] New connection from 95.181.232.142


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 138.199.39.162
country_id: 1861060
description:
Nov  3 07:11:56 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=138.199.39.162, lip=66.85.158.91, TLS, session=<j7AP0qZCeImKxyei>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 95.181.232.142
country_id: 2542007
description:
Nov  3 07:14:13 host2 pure-ftpd[150810]: (?@95.181.232.142) [INFO] New connection from 95.181.232.142


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.116.22
country_id: 1861060
description:
Nov  3 07:14:07 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=139.162.116.22, lip=66.85.158.91, TLS: Connection closed, session=<8X3l2aZCWt2LonQW>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 45.134.213.165
country_id: 2510769
description:
Nov  3 07:14:37 host2 pure-ftpd[151181]: (?@45.134.213.165) [INFO] New connection from 45.134.213.165


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 84.247.105.126
country_id: 6251999
description:
Nov  3 07:14:43 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=84.247.105.126, lip=66.85.158.91, TLS, session=<lpUE3KZCNstU92l+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov  3 07:14:50 host2 sshd[151357]: Disconnected from invalid user user 2.57.121.25 port 36425 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 146.70.65.11
country_id: 2328926
description:
Nov  3 07:14:16 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=146.70.65.11, lip=66.85.158.91, TLS, session=<8nlk2qZCNJSSRkEL>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 149.102.232.85
country_id: 3057568
description:
Nov  3 07:14:16 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=149.102.232.85, lip=66.85.158.91, TLS handshaking: Connection closed, session=<nxtn2qZCsMiVZuhV>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 98.159.40.4
country_id: 1227603
description:
Nov  3 07:14:17 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=98.159.40.4, lip=66.85.158.91, session=<T/x62qZCTtFinygE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 149.88.26.70
country_id: 294640
description:
Nov  3 07:14:16 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=149.88.26.70, lip=66.85.158.91, TLS, session=<Y7hn2qZCvMiVWBpG>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 176.125.229.144
country_id: 3194884
description:
Nov  3 07:14:40 host2 pure-ftpd[151195]: (?@176.125.229.144) [INFO] New connection from 176.125.229.144


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.32.122.14
country_id: 597427
description:
Nov  3 07:14:43 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=194.32.122.14, lip=66.85.158.91, TLS handshaking: Connection closed, session=<CT4F3KZCjsfCIHoO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 196.245.54.13
country_id: 2510769
description:
Nov  3 07:14:43 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=196.245.54.13, lip=66.85.158.91, TLS, session=<Z/QE3KZCnsfE9TYN>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.134.213.165
country_id: 2510769
description:
Nov  3 07:14:16 host2 dovecot[3704077]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=45.134.213.165, lip=66.85.158.91, session=<zYZh2qZC7qMthtWl>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 138.199.39.162
country_id: 1861060
description:
Nov  3 07:14:16 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=138.199.39.162, lip=66.85.158.91, TLS handshaking: Connection closed, session=<NPtl2qZCMpSKxyei>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 95.181.234.143
country_id: 289688
description:
Nov  3 07:14:16 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=95.181.234.143, lip=66.85.158.91, session=<NGFm2qZC4qNfteqP>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 31.171.152.105
country_id: 783754
description:
Nov  3 07:14:43 host2 dovecot[3704077]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=31.171.152.105, lip=66.85.158.91, session=<byMD3KZC5tcfq5hp>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 188.215.235.43
country_id: 1831722
description:
Nov  3 07:14:41 host2 pure-ftpd[151229]: (?@188.215.235.43) [INFO] New connection from 188.215.235.43


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 95.181.234.141
country_id: 289688
description:
Nov  3 07:14:40 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=95.181.234.141, lip=66.85.158.91, TLS, session=<V4XZ26ZCdslfteqN>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 149.88.26.65
country_id: 294640
description:
Nov  3 07:14:41 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=149.88.26.65, lip=66.85.158.91, session=<A5/j26ZC6OaVWBpB>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 188.213.34.5
country_id: 298795
description:
Nov  3 07:15:18 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=188.213.34.5, lip=66.85.158.91, TLS handshaking: Connection closed, session=<tUIS3qZCQqy81SIF>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.134.213.165
country_id: 2510769
description:
Nov  3 07:15:16 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=45.134.213.165, lip=66.85.158.91, TLS, session=<EjsB3qZCTJEthtWl>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.132.194.64
country_id: 597427
description:
Nov  3 07:15:16 host2 dovecot[3704077]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=45.132.194.64, lip=66.85.158.91, session=<iTn/3aZCNKYthMJA>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 173.244.42.148
country_id: 1835841
description:
Nov  3 07:15:16 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=173.244.42.148, lip=66.85.158.91, TLS handshaking: Connection closed, session=<NY8C3qZCPpGt9CqU>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.15.225.33
country_id: 6252001
description:
Nov  3 07:19:26 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 1 secs): user=<>, rip=20.15.225.33, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<9WHa7KZCyOkUD+Eh>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 199.45.155.88
country_id: 6252001
description:
Nov  3 07:23:29 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=199.45.155.88, lip=66.85.158.91, TLS: Connection closed, session=<fCli+6ZC4KTHLZtY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.56.0.19
country_id: 3469034
description:
2025-11-03 07:28:37 dovecot_login authenticator failed for (177-215-153-215.user.vivozap.com.br) [189.56.0.19]:45520: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.236.145.128
country_id: 6252001
description:
2025-11-03 07:28:50 dovecot_login authenticator failed for (node12.vindb.org) [104.236.145.128]:57573: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.131.8.20
country_id: 1168579
description:
2025-11-03 07:29:21 dovecot_login authenticator failed for ([103.131.8.20]) [103.131.8.20]:38532: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.237.42
country_id: 3625428
description:
2025-11-03 07:35:49 dovecot_login authenticator failed for (ADMIN) [95.181.237.42]:52618: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 104.236.209.11
country_id: 6252001
description:
Nov  3 07:38:12 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=104.236.209.11, lip=66.85.158.91, TLS: Connection closed, session=<GfIGMKdCyoVo7NEL>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.124
country_id: 6252001
description:
Nov  3 07:37:48 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.124, lip=66.85.158.91, TLS: Connection closed, session=<h+KOLqdCXMBChJl8>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.84.166.43
country_id: 6252001
description:
Nov  3 07:38:07 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.84.166.43, lip=66.85.158.92, TLS, session=<bnOvL6dCkLkUVKYr>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 104.236.209.11
country_id: 6252001
description:
Nov  3 07:38:16 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed: read(size=612) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=104.236.209.11, lip=66.85.158.91, TLS handshaking: read(size=612) failed: Connection reset by peer, session=<BBQ6MKdCAoZo7NEL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.194
country_id: 1269750
description:
2025-11-03 07:47:01 dovecot_login authenticator failed for ([152.52.234.46]) [182.95.176.194]:35332: 535 Incorrect authentication data (set_id=info@kamechotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.40.45.223
country_id: 1861060
description:
2025-11-03 07:47:17 dovecot_login authenticator failed for p4095-ipbfpfx02osakakita.osaka.ocn.ne.jp [60.40.45.223]:60427: 535 Incorrect authentication data (set_id=info@kamechotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.219.229.99
country_id: 6252001
description:
2025-11-03 07:47:25 dovecot_login authenticator failed for (67-219-229-99.mycomspan.com) [67.219.229.99]:51321: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.187.120.138
country_id: 298795
description:
2025-11-03 07:47:47 dovecot_login authenticator failed for (78.187.120.138.dynamic.ttnet.com.tr) [78.187.120.138]:52942: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  3 07:48:32 host2 sshd[185004]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.37.32.248
country_id: 1269750
description:
2025-11-03 07:54:37 dovecot_login authenticator failed for ([136.232.73.130]) [49.37.32.248]:49978: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.166.153.20
country_id: 6252001
description:
2025-11-03 07:54:42 dovecot_plain authenticator failed for c-174-166-153-20.hsd1.nj.comcast.net (cophagui) [174.166.153.20]:35310: 535 Incorrect authentication data (set_id=it@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.250.191.189
country_id: 458258
description:
2025-11-03 07:54:51 dovecot_login authenticator failed for ([178.250.191.189]) [178.250.191.189]:41594: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  3 07:55:46 host2 sshd[192767]: Disconnected from invalid user presley 62.60.131.157 port 16864 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.125.229.21
country_id: 3194884
description:
2025-11-03 07:59:41 dovecot_login authenticator failed for (ADMIN) [176.125.229.21]:41868: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.236.163
country_id: 6252001
description:
2025-11-03 08:15:24 dovecot_plain authenticator failed for c-73-197-236-163.hsd1.nj.comcast.net (randrust) [73.197.236.163]:34650: 535 Incorrect authentication data (set_id=it@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.53
country_id: 6252001
description:
Nov  3 08:16:20 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=167.94.146.53, lip=66.85.158.91, TLS: Connection closed, session=<hKFiuKdCHt+nXpI1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.241.80.64
country_id: 1814991
description:
2025-11-03 08:19:46 dovecot_login authenticator failed for (ADMIN) [188.241.80.64]:22363: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.128.150.67
country_id: 6252001
description:
2025-11-03 08:22:12 dovecot_login authenticator failed for c-73-128-150-67.hsd1.de.comcast.net [73.128.150.67]:47200: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.233.177.188
country_id: 6252001
description:
2025-11-03 08:22:28 dovecot_login authenticator failed for (188.177.233.68.naturalwireless.com) [68.233.177.188]:37146: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.135.208.13
country_id: 1861060
description:
2025-11-03 08:24:31 dovecot_login authenticator failed for dsl-212-135-208-13.dsl.easynet.co.uk [212.135.208.13]:46574: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.64.94
country_id: 3469034
description:
2025-11-03 08:24:46 dovecot_login authenticator failed for ([189.108.156.41]) [187.8.64.94]:34660: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 143.202.145.6
country_id: 3865483
description:
2025-11-03 08:25:09 dovecot_login authenticator failed for (6-red145.ceviamonte.com.ar) [143.202.145.6]:39270: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov  3 08:32:58 host2 sshd[232775]: Disconnected from invalid user user 2.57.121.25 port 35211 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.116
country_id: 6252001
description:
Nov  3 08:40:51 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.116, lip=66.85.158.91, TLS: Connection closed, session=<J7sNEKhC1MhChJl0>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  3 08:43:31 host2 sshd[245204]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.253.160.20
country_id: 174982
description:
2025-11-03 08:44:59 dovecot_login authenticator failed for (ADMIN) [185.253.160.20]:5190: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.115
country_id: 6252001
description:
Nov  3 08:45:18 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=147.185.132.115, lip=66.85.158.92, TLS, session=<rMPxH6hCDO6TuYRz>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.224
country_id: 6252001
description:
Nov  3 08:48:05 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.224, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<MdDkKahCsN7G6xjg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-03 08:50:48 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:61301: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2025-11-03 08:53:28 dovecot_plain authenticator failed for (witass) [154.144.243.93]:52394: 535 Incorrect authentication data (set_id=it@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.146.57.61
country_id: 1880251
description:
2025-11-03 09:05:33 dovecot_login authenticator failed for (ADMIN) [156.146.57.61]:15155: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.248.243.181
country_id: 2542007
description:
2025-11-03 09:06:45 dovecot_plain authenticator failed for (elholve) [41.248.243.181]:42410: 535 Incorrect authentication data (set_id=it@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.79.128.205
country_id: 6252001
description:
Nov  3 09:15:14 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:140943F2:SSL routines:ssl3_read_bytes:sslv3 alert unexpected message: SSL alert number 10 (no auth attempts in 0 secs): user=<>, rip=45.79.128.205, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:140943F2:SSL routines:ssl3_read_bytes:sslv3 alert unexpected message: SSL alert number 10, session=<SLUEi6hCMuItT4DN>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  3 09:20:49 host2 sshd[290497]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.194
country_id: 1269750
description:
2025-11-03 09:40:51 dovecot_login authenticator failed for ([182.95.176.194]) [182.95.176.194]:50214: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.121.192.210
country_id: 3595528
description:
2025-11-03 09:42:15 dovecot_login authenticator failed for (210.192.121.190.ispguatemala.com.gt) [190.121.192.210]:60030: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.114
country_id: 6252001
description:
Nov  3 09:44:02 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.114, lip=66.85.158.92, TLS: Connection closed, session=<e3sC8qhCEoBChJly>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.190.57
country_id: 6251999
description:
Nov  3 09:47:19 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=148.113.190.57, lip=66.85.158.91, TLS, session=<jBG9/ahCquKUcb45>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.219
country_id: 6252001
description:
Nov  3 09:53:51 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 18 secs): user=<>, rip=162.216.149.219, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<dQwcFalCD8Ki2JXb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.219
country_id: 6252001
description:
Nov  3 09:54:59 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 7 secs): user=<>, rip=162.216.149.219, lip=66.85.158.92, TLS: read(size=403) failed: Connection reset by peer, session=<w1QlGalC7vOi2JXb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.219
country_id: 6252001
description:
Nov  3 10:01:11 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.149.219, lip=66.85.158.92, TLS, session=<MR1XL6lCcuOi2JXb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.219
country_id: 6252001
description:
Nov  3 10:02:02 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.149.219, lip=66.85.158.92, TLS, session=<HD1iMqlC5vmi2JXb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.56
country_id: 2635167
description:
Nov  3 10:06:19 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 15 secs): user=<>, rip=35.203.211.56, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<uaWtQalCX9Ujy9M4>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.56
country_id: 2635167
description:
Nov  3 10:07:18 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 7 secs): user=<>, rip=35.203.211.56, lip=66.85.158.91, TLS: read(size=403) failed: Connection reset by peer, session=<XUM1RalCDu0jy9M4>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.56
country_id: 2635167
description:
Nov  3 10:13:29 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.203.211.56, lip=66.85.158.91, TLS, session=<dapWW6lC3OUjy9M4>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.104.11.51
country_id: 6252001
description:
Nov  3 10:15:42 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=172.104.11.51, lip=66.85.158.92, TLS, session=<r0Y9Y6lCYrisaAsz>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov  3 10:15:44 host2 sshd[349072]: Disconnected from invalid user user 2.57.121.25 port 12685 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.0.156.128
country_id: 3017382
description:
2025-11-03 10:16:51 dovecot_plain authenticator failed for amontpellier-655-1-340-128.w90-0.abo.wanadoo.fr (squia) [90.0.156.128]:51230: 535 Incorrect authentication data (set_id=it@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.156.80.11
country_id: 1269750
description:
2025-11-03 10:22:01 dovecot_login authenticator failed for ([182.156.80.11]) [182.156.80.11]:49566: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.112.90
country_id: 1269750
description:
2025-11-03 10:22:20 dovecot_login authenticator failed for ([125.19.175.128]) [27.123.112.90]:50648: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.185.198.73
country_id: 798544
description:
2025-11-03 10:27:50 dovecot_plain authenticator failed for 5.185.198.73.ipv4.public.orange.pl (phity) [5.185.198.73]:43260: 535 Incorrect authentication data (set_id=it@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.191.12
country_id: 99237
description:
2025-11-03 10:27:52 dovecot_plain authenticator failed for (graft) [65.20.191.12]:33238: 535 Incorrect authentication data (set_id=it@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.163.61.119
country_id: 6252001
description:
Nov  3 10:31:59 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.163.61.119, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<EvJ/nalC5NwUoz13>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.223.152.94
country_id: 1269750
description:
2025-11-03 10:34:44 dovecot_login authenticator failed for (static.bb.vda.117.223.152.94.bsnl.in) [117.223.152.94]:36990: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.209.221.7
country_id: 1861060
description:
2025-11-03 10:34:44 dovecot_login authenticator failed for ([8.209.221.7]) [8.209.221.7]:34740: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 48.217.64.148
country_id: 6252001
description:
Nov  3 10:33:56 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=48.217.64.148, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<ggBzpKlCTrow2UCU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.25.186.130
country_id: 6252001
description:
2025-11-03 10:35:08 dovecot_login authenticator failed for (173-25-186-130.client.mchsi.com) [173.25.186.130]:58155: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.235.140.163
country_id: 290557
description:
2025-11-03 10:35:10 dovecot_login authenticator failed for (37-235-140-163.dynamic.customer.lanta.me) [37.235.140.163]:44450: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.195.194
country_id: 1819730
description:
2025-11-03 10:35:15 dovecot_login authenticator failed for (m121-202-195-194.smartone.com) [121.202.195.194]:1800: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.124.111.122
country_id: 2077456
description:
2025-11-03 10:35:29 dovecot_login authenticator failed for 27-124-111-122.static.as58511.net [27.124.111.122]:59733: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.4.31.215
country_id: 2661886
description:
2025-11-03 10:35:49 dovecot_login authenticator failed for h-155-4-31-215.a2204.priv.bahnhof.se [155.4.31.215]:32902: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.163.103
country_id: 99237
description:
2025-11-03 10:38:14 dovecot_plain authenticator failed for (idilcory) [65.20.163.103]:34875: 535 Incorrect authentication data (set_id=it@v-deploy.com)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.252
country_id: 2635167
description:
Nov  3 10:44:23 host2 dovecot[3704077]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=185.247.137.252, lip=66.85.158.92, TLS, session=<SN/YyalCsZy594n8>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 37.19.223.232
country_id: 2782113
description:
Nov  3 10:45:31 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=37.19.223.232, lip=66.85.158.91, TLS, session=<tRPlzalC6rklE9/o>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 188.214.122.52
country_id: 357994
description:
Nov  3 10:45:31 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=188.214.122.52, lip=66.85.158.91, session=<UPzkzalCgMC81no0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 188.213.34.5
country_id: 298795
description:
Nov  3 10:45:31 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=188.213.34.5, lip=66.85.158.91, TLS handshaking: Connection closed, session=<qlXlzalCmNG81SIF>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.154.153.20
country_id: 3923057
description:
Nov  3 10:45:31 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=45.154.153.20, lip=66.85.158.91, session=<UB/qzalCwIQtmpkU>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 149.34.242.240
country_id: 2963597
description:
Nov  3 10:45:28 host2 pure-ftpd[379870]: (?@149.34.242.240) [INFO] New connection from 149.34.242.240


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 176.125.228.166
country_id: 2589581
description:
Nov  3 10:45:31 host2 dovecot[3704077]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=176.125.228.166, lip=66.85.158.91, session=<1dzhzalCqpGwfeSm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 178.175.130.252
country_id: 617790
description:
Nov  3 10:45:32 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=178.175.130.252, lip=66.85.158.91, TLS handshaking: Connection closed, session=<QeHzzalCvtayr4L8>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 181.214.218.123
country_id: 2802361
description:
Nov  3 10:45:28 host2 pure-ftpd[379902]: (?@181.214.218.123) [INFO] New connection from 181.214.218.123


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 84.17.56.172
country_id: 1819730
description:
Nov  3 10:45:31 host2 dovecot[3704077]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=84.17.56.172, lip=66.85.158.91, session=<aunlzalCoulUETis>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 176.125.229.135
country_id: 3194884
description:
Nov  3 10:45:32 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=176.125.229.135, lip=66.85.158.91, TLS, session=<4c7zzalC3sOwfeWH>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.175.128.43
country_id: 617790
description:
2025-11-03 10:47:22 dovecot_login authenticator failed for (ADMIN) [178.175.128.43]:40228: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.160.107
country_id: 99237
description:
2025-11-03 10:48:06 dovecot_plain authenticator failed for (cafer) [65.20.160.107]:37842: 535 Incorrect authentication data (set_id=it@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.226.88.121
country_id: 2661886
description:
2025-11-03 10:48:09 dovecot_plain authenticator failed for 81-226-88-121-no600.tbcn.telia.com (sulan) [81.226.88.121]:51081: 535 Incorrect authentication data (set_id=it@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.248
country_id: 6252001
description:
Nov  3 10:58:03 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=198.235.24.248, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<ZVW2+qlC1sjG6xj4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.102.57.96
country_id: 2921044
description:
2025-11-03 11:07:20 dovecot_login authenticator failed for (ADMIN) [212.102.57.96]:61614: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.130
country_id: 6252001
description:
Nov  3 11:08:16 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed: read(size=713) failed: Connection reset by peer (no auth attempts in 2 secs): user=<>, rip=66.132.153.130, lip=66.85.158.91, TLS: read(size=713) failed: Connection reset by peer, session=<mHA6H6pCcNlChJmC>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.182.140.205
country_id: 3017382
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 217.182.140.205 - lezzarotech "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarotech (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.207
country_id: 6252001
description:
Nov  3 11:13:25 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.207, lip=66.85.158.92, TLS, session=<SVmsMapCkOTG6xjP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.40.215.162
country_id: 3469034
description:
2025-11-03 11:17:51 dovecot_login authenticator failed for 187-40-215-162.user.veloxzone.com.br (152-237-221-1.user.vtal.net.br) [187.40.215.162]:51622: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.245.38
country_id: 1269750
description:
2025-11-03 11:18:10 dovecot_login authenticator failed for ([152.52.12.201]) [152.52.245.38]:59286: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-11-03 11:32:18 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (dercums) [87.103.126.54]:29601: 535 Incorrect authentication data (set_id=it@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.215.182.65
country_id: 6252001
description:
2025-11-03 11:35:48 dovecot_login authenticator failed for (ADMIN) [181.215.182.65]:47958: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.116
country_id: 6252001
description:
Nov  3 11:38:01 host2 pure-ftpd[437604]: (?@66.132.153.116) [INFO] New connection from 66.132.153.116


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.251.115.154
country_id: 2750405
description:
[2025-10-23 10:01:31 +0530] info [webmaild] 196.251.115.154 - - "POST /cpsess0130295740/3rdparty/roundcube/:2087/json-api/create_user_session HTTP/1.1" FAILED LOGIN webmaild: user name not provided or invalid user


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.117
country_id: 6252001
description:
Nov  3 11:50:20 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.117, lip=66.85.158.92, TLS, session=<wC+stapCLI9ChJl1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.200.226.113
country_id: 290557
description:
2025-11-03 11:59:07 dovecot_plain authenticator failed for (typenons) [87.200.226.113]:46917: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.32.96.252
country_id: 3017382
description:
2025-11-03 12:00:22 dovecot_login authenticator failed for ip252.ip-178-32-96.eu (ADMIN) [178.32.96.252]:36200: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.205.197
country_id: 99237
description:
2025-11-03 12:11:44 dovecot_plain authenticator failed for (stedavess) [65.20.205.197]:39165: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  3 12:11:57 host2 sshd[475931]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-03 12:20:32 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:56839: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.146.39.93
country_id: 6252001
description:
2025-11-03 12:27:19 dovecot_login authenticator failed for (ADMIN) [156.146.39.93]:54670: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 103.176.152.25
country_id: 1605651
description:
Nov  3 12:46:48 host2 pure-ftpd[513715]: (?@103.176.152.25) [INFO] New connection from 103.176.152.25


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.204.134.124
country_id: 6252001
description:
2025-11-03 12:48:52 dovecot_plain authenticator failed for c-98-204-134-124.hsd1.md.comcast.net (caliment) [98.204.134.124]:32822: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2025-11-03 12:53:17 dovecot_plain authenticator failed for (unhels) [102.53.15.18]:34163: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.138.162.9
country_id: 290557
description:
2025-11-03 12:57:59 dovecot_login authenticator failed for (ADMIN) [217.138.162.9]:43312: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.58
country_id: 6252001
description:
Nov  3 13:03:46 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=167.94.146.58, lip=66.85.158.92, TLS: Connection closed, session=<gkFUvKtCWpenXpI6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.27.253.6
country_id: 1168579
description:
2025-11-03 13:04:42 dovecot_login authenticator failed for (125-209-116-242.multi.net.pk) [58.27.253.6]:62530: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.79.120.248
country_id: 6251999
description:
2025-11-03 13:04:46 dovecot_login authenticator failed for s01060030f43b0098.vn.shawcable.net [70.79.120.248]:57640: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.133.156.115
country_id: 294640
description:
2025-11-03 13:05:17 dovecot_login authenticator failed for ([195.133.156.115]) [195.133.156.115]:40072: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.84.179.128
country_id: 3996063
description:
2025-11-03 13:06:28 dovecot_login authenticator failed for ([140.84.179.128]) [140.84.179.128]:58812: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.218.18
country_id: 1269750
description:
2025-11-03 13:08:07 dovecot_login authenticator failed for ([128.185.217.27]) [128.185.218.18]:48052: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.210.105.202
country_id: 3175395
description:
2025-11-03 13:08:37 dovecot_login authenticator failed for 95-210-105-202.ip.skylogicnet.com [95.210.105.202]:32157: 535 Incorrect authentication data


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov  3 13:13:14 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<z+4r3qtCOsgDhBfJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.60.142
country_id: 1269750
description:
2025-11-03 13:14:05 dovecot_login authenticator failed for ([122.186.60.142]) [122.186.60.142]:60976: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov  3 13:15:13 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS, session=<d19G5atCWp4DhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov  3 13:17:09 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<Pwko7KtCEJoDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov  3 13:17:11 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS handshaking: Connection closed, session=<TA9R7KtC9OEDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov  3 13:19:07 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS, session=<eZc586tC4tQDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov  3 13:19:15 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<neqv86tCnrIDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov  3 13:21:00 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS, session=<PIz0+atCZtoDhBfJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.129.67
country_id: 99237
description:
2025-11-03 13:24:42 dovecot_plain authenticator failed for (prene) [65.20.129.67]:53427: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.113
country_id: 6252001
description:
Nov  3 13:26:00 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.113, lip=66.85.158.92, TLS: Connection closed, session=<v8XUC6xCRttChJlx>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.90.122.4
country_id: 3042058
description:
2025-11-03 13:26:46 dovecot_login authenticator failed for (ADMIN) [91.90.122.4]:46380: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.232
country_id: 6252001
description:
Nov  3 13:32:52 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.232, lip=66.85.158.91, session=<gcNcJKxCapdBMQHo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.232
country_id: 6252001
description:
Nov  3 13:33:15 host2 dovecot[3704077]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=65.49.1.232, lip=66.85.158.91, session=<x3HBJaxCMkRBMQHo>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  3 13:33:37 host2 sshd[565707]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  3 13:39:13 host2 sshd[572334]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.59
country_id: 6252001
description:
Nov  3 13:44:56 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.59, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<AtCFT6xCzcnN0h87>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 112.134.173.219
country_id: 1227603
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 112.134.173.219 - cloudtourssrilan "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: User cloudtourssrilan has their account suspended. Login blocked.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.156.14.49
country_id: 732800
description:
2025-11-03 13:54:26 dovecot_login authenticator failed for (ADMIN) [94.156.14.49]:38312: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.243.174
country_id: 732800
description:
2025-11-03 13:56:34 dovecot_plain authenticator failed for (phidit) [92.62.243.174]:48527: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.131.63
country_id: 99237
description:
2025-11-03 13:57:06 dovecot_login authenticator failed for ([65.20.131.63]) [65.20.131.63]:52074: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.128.78.112
country_id: 3017382
description:
2025-11-03 13:57:23 dovecot_login authenticator failed for 217-128-78-112.ftth.fr.orangecustomers.net [217.128.78.112]:57951: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.127.53.61
country_id: 6252001
description:
2025-11-03 14:09:42 dovecot_plain authenticator failed for c-24-127-53-61.hsd1.mi.comcast.net (priman) [24.127.53.61]:55536: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 41.76.108.97
country_id: 953987
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 41.76.108.97 - bostonlanka "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.32.50.35
country_id: 6252001
description:
2025-11-03 14:26:34 dovecot_login authenticator failed for (ADMIN) [212.32.50.35]:48336: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.125
country_id: 6252001
description:
Nov  3 14:35:20 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.125, lip=66.85.158.91, TLS: Connection closed, session=<zy7HA61C5NdChJl9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.213.34.103
country_id: 298795
description:
2025-11-03 14:53:42 dovecot_login authenticator failed for (ADMIN) [188.213.34.103]:33492: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  3 15:06:46 host2 sshd[669501]: error: kex_exchange_identification: read: Connection reset by peer


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 66.85.155.91
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 66.85.155.91: 250 connections per 30 seconds to 53 port.


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  3 15:19:48 host2 sshd[685743]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.120
country_id: 6252001
description:
Nov  3 15:20:44 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=198.235.24.120, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<7w8mpq1C+9LG6xh4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.241
country_id: 2750405
description:
2025-11-03 15:21:25 dovecot_login authenticator failed for (wKtZhwDrT) [178.16.54.241]:50664: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.246.122.171
country_id: 3144096
description:
2025-11-03 15:22:11 dovecot_login authenticator failed for (ADMIN) [46.246.122.171]:40084: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.241
country_id: 2750405
description:
2025-11-03 15:22:37 dovecot_login authenticator failed for (EnCirtm) [178.16.54.241]:64942: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.162
country_id: 2993457
description:
Nov  3 15:23:03 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=194.165.16.162, lip=66.85.158.91, session=<+Btprq1Clf/CpRCi>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.241
country_id: 2750405
description:
2025-11-03 15:23:22 dovecot_login authenticator failed for (8wqyCJrXK) [178.16.54.241]:57653: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 71.6.146.130
country_id: 6252001
description:
Nov  3 15:24:46 host2 dovecot[3704077]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=71.6.146.130, lip=66.85.158.91, session=<Sk2LtK1CvoJHBpKC>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 71.6.146.130
country_id: 6252001
description:
Nov  3 15:24:57 host2 dovecot[3704077]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 1 secs): user=<>, rip=71.6.146.130, lip=66.85.158.91, session=<E6E9ta1CboZHBpKC>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.192
country_id: 6252001
description:
Nov  3 15:25:37 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.192, lip=66.85.158.91, session=<GHaht61CFOKTuYTA>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  3 15:35:27 host2 sshd[705405]: Disconnected from invalid user brad 62.60.131.157 port 17832 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.146.60.70
country_id: 2782113
description:
2025-11-03 15:53:47 dovecot_login authenticator failed for (ADMIN) [156.146.60.70]:34549: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-03 15:56:48 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:52714: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.118.240.71
country_id: 6252001
description:
Nov  3 16:08:15 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.118.240.71, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<GYgaUK5CYp0UdvBH>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 135.237.125.174
country_id: 6252001
description:
Nov  3 16:08:46 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=135.237.125.174, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<5W/oUa5CHsWH7X2u>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.151.136
country_id: 1819730
description:
2025-11-03 16:10:43 dovecot_login authenticator failed for 136.151.48.116.static.netvigator.com [116.48.151.136]:60941: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.254.26
country_id: 1269750
description:
2025-11-03 16:11:00 dovecot_login authenticator failed for ([125.21.188.41]) [125.19.254.26]:55374: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.235.225.181
country_id: 6252001
description:
2025-11-03 16:15:38 dovecot_plain authenticator failed for c-71-235-225-181.hsd1.ct.comcast.net (chenels) [71.235.225.181]:53752: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.101.1.180
country_id: 2635167
description:
2025-11-03 16:15:42 dovecot_plain authenticator failed for (fedrid) [46.101.1.180]:49518: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 51.38.104.3
country_id: 3017382
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 51.38.104.3 - yashihol "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user yashihol (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.183.225.156
country_id: 3658394
description:
2025-11-03 16:24:12 dovecot_login authenticator failed for ([201.183.225.156]) [201.183.225.156]:54771: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.134.175.21
country_id: 6252001
description:
2025-11-03 16:25:13 dovecot_login authenticator failed for ([72.134.175.21]) [72.134.175.21]:60444: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.138.162.8
country_id: 290557
description:
2025-11-03 16:25:00 dovecot_login authenticator failed for (ADMIN) [217.138.162.8]:49684: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.225.30.107
country_id: 2661886
description:
2025-11-03 16:34:51 dovecot_plain authenticator failed for 81-225-30-107-no2380.tbcn.telia.com (unalike) [81.225.30.107]:57950: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  3 16:39:51 host2 sshd[782197]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov  3 16:46:14 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<+vrv165CVOMDg9cm>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  3 16:45:27 host2 sshd[789625]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov  3 16:46:36 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<Hdc22a5C3I8Dg9cm>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 45.156.129.91
country_id: 2264397
description:
Nov  3 16:48:17 host2 dovecot[3704077]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=45.156.129.91, lip=66.85.158.92, TLS, session=<9144365Cj5YtnIFb>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 45.156.129.92
country_id: 2264397
description:
Nov  3 16:48:16 host2 dovecot[3704077]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=45.156.129.92, lip=66.85.158.92, session=<2Vcu365Cc8ktnIFc>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.156.129.91
country_id: 2264397
description:
Nov  3 16:48:17 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1420918C:SSL routines:tls_early_post_process_client_hello:version too low (no auth attempts in 0 secs): user=<>, rip=45.156.129.91, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1420918C:SSL routines:tls_early_post_process_client_hello:version too low, session=<1Gk9365CAeQtnIFb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.156.129.90
country_id: 2264397
description:
Nov  3 16:48:18 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=45.156.129.90, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=</QtK365CS7YtnIFa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov  3 16:47:49 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, TLS handshaking: Connection closed, session=<RyCU3a5CiOsDg9cm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov  3 16:48:30 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<wO8B4K5Ceq8Dg9cm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov  3 16:50:23 host2 dovecot[3704077]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, TLS, session=<5rTB5q5CZMkDg9cm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov  3 16:52:38 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<fazT7q5CJJwDg9cm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov  3 16:53:52 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, TLS handshaking: Connection closed, session=<ncs+865CErMDg9cm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov  3 16:54:35 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, TLS, session=<FZjC9a5CBLQDg9cm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.218.18
country_id: 1269750
description:
2025-11-03 16:59:56 dovecot_login authenticator failed for ([128.185.217.27]) [128.185.218.18]:50148: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.162.163
country_id: 298795
description:
2025-11-03 17:00:12 dovecot_login authenticator failed for ([5.11.162.163]) [5.11.162.163]:51771: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 89.249.55.106
country_id: 2017370
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 89.249.55.106 - epid "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.191.12
country_id: 99237
description:
2025-11-03 17:13:53 dovecot_plain authenticator failed for (munse) [65.20.191.12]:44161: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov  3 17:22:19 host2 sshd[838361]: Disconnected from invalid user user 2.57.121.25 port 54000 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2025-11-03 17:25:32 dovecot_plain authenticator failed for (qualing) [196.47.172.253]:51584: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2025-11-03 17:25:35 dovecot_plain authenticator failed for (ached) [64.72.74.162]:50028: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.193.149.88
country_id: 6252001
description:
2025-11-03 17:29:49 dovecot_plain authenticator failed for ool-44c19558.dyn.optonline.net (batracy) [68.193.149.88]:39223: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.214.165.66
country_id: 6252001
description:
2025-11-03 17:32:22 dovecot_login authenticator failed for (ADMIN) [181.214.165.66]:8017: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.66.214.70
country_id: 1269750
description:
2025-11-03 17:38:14 dovecot_login authenticator failed for ([182.66.214.70]) [182.66.214.70]:59074: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.53.94.242
country_id: 1269750
description:
2025-11-03 17:38:27 dovecot_login authenticator failed for (arpa.static.242.94.53.202.nettlinx.com) [202.53.94.242]:39870: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 134.209.173.54
country_id: 6252001
description:
Nov  3 17:51:17 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=134.209.173.54, lip=66.85.158.92, session=<I5KUwK9C4JuG0a02>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.169.82.194
country_id: 935317
description:
2025-11-03 17:58:37 dovecot_login authenticator failed for (165-169-82-194.zeop.re) [165.169.82.194]:59701: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.101.202
country_id: 1269750
description:
2025-11-03 17:58:58 dovecot_login authenticator failed for (dsl-tn-dynamic-065.124.246.61.airtelbroadband.in) [27.123.101.202]:59434: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.193.149.88
country_id: 6252001
description:
2025-11-03 17:59:24 dovecot_login authenticator failed for ool-44c19558.dyn.optonline.net [68.193.149.88]:57537: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.220.30
country_id: 1269750
description:
2025-11-03 18:04:37 dovecot_login authenticator failed for ([125.17.106.169]) [122.187.220.30]:58298: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.207.248.141
country_id: 3469034
description:
2025-11-03 18:05:10 dovecot_login authenticator failed for (centrodenefrologia.static.gvt.net.br) [177.207.248.141]:46024: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.94.190.202
country_id: 719819
description:
2025-11-03 18:07:16 dovecot_login authenticator failed for (ADMIN) [185.94.190.202]:64646: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  3 18:13:31 host2 sshd[906580]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  3 18:19:08 host2 sshd[914640]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.208.158
country_id: 1269750
description:
2025-11-03 18:20:33 dovecot_login authenticator failed for ([182.79.5.249]) [128.185.208.158]:34152: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.79.134
country_id: 1269750
description:
2025-11-03 18:21:14 dovecot_login authenticator failed for ([128.185.189.57]) [182.78.79.134]:38454: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.129.142.196
country_id: 2077456
description:
2025-11-03 18:21:45 dovecot_login authenticator failed for (115-129-142-196.tpgi.com.au) [115.129.142.196]:54535: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.239.41.74
country_id: 3469034
description:
2025-11-03 18:35:57 dovecot_login authenticator failed for ([186.239.41.74]) [186.239.41.74]:40390: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.238.254.156
country_id: 2661886
description:
2025-11-03 18:36:11 dovecot_login authenticator failed for 213-238-254-156.customers.ownit.se [213.238.254.156]:50662: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.200.20.66
country_id: 290557
description:
2025-11-03 18:37:11 dovecot_plain authenticator failed for (antes) [94.200.20.66]:53374: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 132.145.159.15
country_id: 6252001
description:
Nov  3 18:38:55 host2 pure-ftpd[937786]: (?@132.145.159.15) [INFO] New connection from 132.145.159.15


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 132.145.159.15
country_id: 6252001
description:
Nov  3 18:38:55 host2 sshd[937767]: User cloudtourssrilan from 132.145.159.15 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 132.145.159.15
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 132.145.159.15 - cloudtourssrilan_travel "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilan_travel (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.178.70
country_id: 1269750
description:
2025-11-03 18:39:00 dovecot_login authenticator failed for ([182.79.95.167]) [122.185.178.70]:46602: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.159.165.216
country_id: 294640
description:
2025-11-03 18:39:17 dovecot_login authenticator failed for ([85.159.165.216]) [85.159.165.216]:45850: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.38.59
country_id: 3865483
description:
2025-11-03 18:42:03 dovecot_login authenticator failed for (ADMIN) [146.70.38.59]:28284: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.156.90.102
country_id: 2921044
description:
2025-11-03 18:51:07 dovecot_login authenticator failed for beige-albatross-54703.zap.cloud (VZQVVlUMLX) [194.156.90.102]:56423: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  3 18:54:32 host2 sshd[957211]: Disconnected from invalid user jaylan 62.60.131.157 port 43226 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.141.211.58
country_id: 3469034
description:
2025-11-03 18:55:59 dovecot_login authenticator failed for (200-141-211-58.host.telemar.net.br) [200.141.211.58]:35233: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.155.179
country_id: 1733045
description:
2025-11-03 18:56:33 dovecot_login authenticator failed for ([49.124.155.179]) [49.124.155.179]:60396: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov  3 19:01:22 host2 sshd[966003]: Disconnected from invalid user user 2.57.121.25 port 27739 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.243.175
country_id: 732800
description:
2025-11-03 19:07:36 dovecot_plain authenticator failed for (trius) [92.62.243.175]:54806: 535 Incorrect authentication data (set_id=contact@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.208.81.125
country_id: 6252001
description:
2025-11-03 19:07:39 dovecot_plain authenticator failed for c-73-208-81-125.hsd1.in.comcast.net (scostings) [73.208.81.125]:39390: 535 Incorrect authentication data (set_id=contact@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 132.145.159.15
country_id: 6252001
description:
Nov  3 19:10:19 host2 pure-ftpd[977460]: (?@132.145.159.15) [INFO] New connection from 132.145.159.15


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 132.145.159.15
country_id: 6252001
description:
Nov  3 19:10:18 host2 sshd[977448]: User cloudtourssrilan from 132.145.159.15 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  3 19:12:18 host2 sshd[979501]: Disconnected from invalid user jaylan 62.60.131.157 port 41429 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.199.111.92
country_id: 6252001
description:
[2025-11-03 19:18:18 +0530] info [cpaneld] 24.199.111.92 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.65.166
country_id: 2328926
description:
2025-11-03 19:20:39 dovecot_login authenticator failed for (ADMIN) [146.70.65.166]:35946: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.200.20.66
country_id: 290557
description:
2025-11-03 19:22:20 dovecot_plain authenticator failed for (spetace) [94.200.20.66]:50132: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.168.136.150
country_id: 6252001
description:
2025-11-03 19:22:23 dovecot_plain authenticator failed for c-73-168-136-150.hsd1.il.comcast.net (tuadihuis) [73.168.136.150]:40328: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2025-11-03 19:24:12 dovecot_plain authenticator failed for (arcutic) [154.144.243.93]:39290: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.129.57.71
country_id: 6252001
description:
2025-11-03 19:24:15 dovecot_plain authenticator failed for c-73-129-57-71.hsd1.md.comcast.net (atopic) [73.129.57.71]:43108: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.205.228
country_id: 99237
description:
2025-11-03 19:33:57 dovecot_login authenticator failed for ([65.20.205.228]) [65.20.205.228]:38372: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.57.183
country_id: 3277605
description:
2025-11-03 19:33:29 dovecot_login authenticator failed for ([195.222.57.183]) [195.222.57.183]:55460: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.69.178.104
country_id: 3017382
description:
2025-11-03 19:40:33 dovecot_plain authenticator failed for 104.178.69.85.rev.sfr.net (rentregoty) [85.69.178.104]:49364: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  3 19:47:35 host2 sshd[1021331]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-03 19:48:46 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:54271: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  3 19:53:15 host2 sshd[1027835]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 176.235.182.73
country_id: 298795
description:
Nov  3 19:59:06 host2 sshd[1034978]: error: maximum authentication attempts exceeded for root from 176.235.182.73 port 50439 ssh2 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 176.235.182.73
country_id: 298795
description:
Nov  3 19:59:18 host2 sshd[1035352]: Disconnecting invalid user admin 176.235.182.73 port 53743: Too many authentication failures [preauth]


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 176.235.182.73
country_id: 298795
description:
Nov  3 19:59:06 host2 sshd[1034978]: Disconnecting authenticating user root 176.235.182.73 port 50439: Too many authentication failures [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  3 20:06:31 host2 sshd[1049874]: Disconnected from invalid user reilly 62.60.131.157 port 25821 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.204.88
country_id: 99237
description:
2025-11-03 20:19:55 dovecot_login authenticator failed for ([65.20.204.88]) [65.20.204.88]:49705: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.229.202.197
country_id: 3175395
description:
2025-11-03 20:20:08 dovecot_login authenticator failed for host-95-229-202-197.business.telecomitalia.it [95.229.202.197]:42568: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.237.243.62
country_id: 192950
description:
2025-11-03 20:19:42 dovecot_login authenticator failed for (197.237.243.62.wananchi.com) [197.237.243.62]:33301: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  3 20:24:18 host2 sshd[1082110]: Disconnected from invalid user reilly 62.60.131.157 port 35516 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.167
country_id: 2993457
description:
Nov  3 20:24:21 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=194.165.16.167, lip=66.85.158.92, session=<wijv47FCav7CpRCn>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 148.113.193.59
country_id: 6251999
description:
Nov  3 20:28:01 host2 pure-ftpd[1088345]: (?@148.113.193.59) [INFO] New connection from 148.113.193.59


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 148.113.193.59
country_id: 6251999
description:
Nov  3 20:28:07 host2 pure-ftpd[1088578]: (?@148.113.193.59) [INFO] New connection from 148.113.193.59


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2025-11-03 20:28:40 dovecot_plain authenticator failed for c-71-62-34-216.hsd1.va.comcast.net (slotereae) [71.62.34.216]:40000: 535 Incorrect authentication data (set_id=contact@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.8.245.34
country_id: 2017370
description:
2025-11-03 20:35:25 dovecot_plain authenticator failed for (upcory) [46.8.245.34]:37310: 535 Incorrect authentication data (set_id=contact@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.253.162.21
country_id: 146669
description:
2025-11-03 20:36:31 dovecot_login authenticator failed for (ADMIN) [185.253.162.21]:54192: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov  3 20:40:00 host2 sshd[1106495]: Disconnected from invalid user user 2.57.121.25 port 31381 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.93.84
country_id: 1269750
description:
2025-11-03 20:48:50 dovecot_login authenticator failed for ([152.52.93.84]) [152.52.93.84]:10400: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.68
country_id: 6252001
description:
Nov  3 20:56:43 host2 pure-ftpd[1128316]: (?@198.235.24.68) [INFO] New connection from 198.235.24.68


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.198.161.236
country_id: 1269750
description:
2025-11-03 20:58:05 dovecot_login authenticator failed for ([103.250.160.76]) [117.198.161.236]:50284: 535 Incorrect authentication data (set_id=info@kamechotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.154.170
country_id: 1733045
description:
2025-11-03 20:58:20 dovecot_login authenticator failed for ([49.124.154.170]) [49.124.154.170]:50858: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.127.90.34
country_id: 2440476
description:
2025-11-03 21:03:20 dovecot_login authenticator failed for ([154.127.90.34]) [154.127.90.34]:57793: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.12.179
country_id: 1269750
description:
2025-11-03 21:03:50 dovecot_login authenticator failed for ([128.185.12.179]) [128.185.12.179]:44080: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.8.240.26
country_id: 2017370
description:
2025-11-03 21:11:52 dovecot_plain authenticator failed for (sonbragen) [46.8.240.26]:41412: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.244.56.90
country_id: 6252001
description:
2025-11-03 21:15:44 dovecot_login authenticator failed for (ADMIN) [173.244.56.90]:21172: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.65
country_id: 6252001
description:
Nov  3 21:18:59 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.197.65, lip=66.85.158.92, session=<xsZYp7JCDShAPsVB>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.62
country_id: 6252001
description:
Nov  3 21:19:13 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.197.62, lip=66.85.158.92, TLS: Connection closed, session=<RA4zqLJCsuFAPsU+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.89
country_id: 6252001
description:
Nov  3 21:19:20 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.89, lip=66.85.158.92, TLS handshaking: Connection closed, session=<XHKTqLJCa5FAPpxZ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.80
country_id: 6252001
description:
Nov  3 21:19:39 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.80, lip=66.85.158.92, TLS handshaking: Connection closed, session=<k++0qbJCGnJAPpxQ>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  3 21:22:00 host2 sshd[1159381]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 152.32.141.40
country_id: 2328926
description:
Nov  3 21:27:09 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=152.32.141.40, lip=66.85.158.92, session=<T56MxLJCVraYII0o>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 152.32.141.40
country_id: 2328926
description:
Nov  3 21:27:10 host2 dovecot[3704077]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=152.32.141.40, lip=66.85.158.92, TLS, session=<Q1igxLJCuLeYII0o>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.183
country_id: 6252001
description:
Nov  3 21:27:51 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 13 secs): user=<>, rip=162.216.149.183, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<JXYJx7JCiN6i2JW3>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  3 21:27:39 host2 sshd[1166101]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.183
country_id: 6252001
description:
Nov  3 21:29:28 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 12 secs): user=<>, rip=162.216.149.183, lip=66.85.158.92, TLS: read(size=403) failed: Connection reset by peer, session=<3sLQzLJC3v6i2JW3>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.183
country_id: 6252001
description:
Nov  3 21:29:39 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed: read(size=429) failed: Connection reset by peer (no auth attempts in 6 secs): user=<>, rip=162.216.149.183, lip=66.85.158.92, TLS: read(size=429) failed: Connection reset by peer, session=<qPR2zbJC+vei2JW3>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.221
country_id: 6252001
description:
Nov  3 21:32:16 host2 pure-ftpd[1171338]: (?@198.235.24.221) [INFO] New connection from 198.235.24.221


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.245.115.125
country_id: 6252001
description:
Nov  3 21:33:33 host2 sshd[1172936]: Invalid user simple-engineering from 157.245.115.125 port 58702


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.120.237.162
country_id: 6251999
description:
[2025-10-23 10:01:31 +0530] info [webmaild] 37.120.237.162 - env_eng@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.4
country_id: 6252001
description:
Nov  3 21:34:38 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.4, lip=66.85.158.91, TLS handshaking: Connection closed, session=<PFxU37JC5ZdAPsUE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.2
country_id: 6252001
description:
Nov  3 21:34:56 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.2, lip=66.85.158.91, TLS handshaking: Connection closed, session=<r6Bp4LJCfLJAPsUC>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.183
country_id: 6252001
description:
Nov  3 21:36:02 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.149.183, lip=66.85.158.92, TLS, session=<XC1O5LJCjPCi2JW3>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  3 21:35:42 host2 sshd[1175646]: Disconnected from invalid user jevon 62.60.131.157 port 54330 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.205.228
country_id: 99237
description:
2025-11-03 21:44:49 dovecot_login authenticator failed for ([65.20.205.228]) [65.20.205.228]:59890: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.213.23
country_id: 6251999
description:
Nov  3 21:45:32 host2 dovecot[3704077]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=148.113.213.23, lip=66.85.158.91, session=<JvFOBrNCVuOUcdUX>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.161.199
country_id: 2186224
description:
2025-11-03 21:46:09 dovecot_login authenticator failed for ([121.73.161.199]) [121.73.161.199]:39836: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.146.46
country_id: 1733045
description:
2025-11-03 21:46:12 dovecot_login authenticator failed for ([49.124.146.46]) [49.124.146.46]:52882: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.32.123.9
country_id: 3469034
description:
2025-11-03 21:46:32 dovecot_login authenticator failed for (187-032-123-009.static.ctbctelecom.com.br) [187.32.123.9]:3568: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.40.63
country_id: 1819730
description:
2025-11-03 21:45:47 dovecot_login authenticator failed for 063.40.246.220.static.netvigator.com [220.246.40.63]:57532: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.206
country_id: 6252001
description:
Nov  3 21:50:03 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.206, lip=66.85.158.91, session=<3n9uFrNCp5tBMQHO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.202
country_id: 6252001
description:
Nov  3 21:50:15 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.202, lip=66.85.158.91, TLS: Connection closed, session=<dSgqF7NCpLlBMQHK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.71.82
country_id: 1269750
description:
2025-11-03 21:51:50 dovecot_login authenticator failed for (nsg-static-82.71.76.182-airtel.com) [182.76.71.82]:54412: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.36
country_id: 1733045
description:
2025-11-03 21:52:41 dovecot_login authenticator failed for ([49.124.153.36]) [49.124.153.36]:49880: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov  3 21:53:08 host2 sshd[1208690]: Disconnected from invalid user user 2.57.121.25 port 17830 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.113.212
country_id: 1861060
description:
Nov  3 21:58:46 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=139.162.113.212, lip=66.85.158.92, TLS: Connection closed, session=</fCbNbNCLIWLonHU>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov  3 22:03:02 host2 dovecot[3704077]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, session=<Il7hRLNCSrQDg9cm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov  3 22:05:18 host2 dovecot[3704077]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, session=<EkEETbNC0r4Dg9cm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.28
country_id: 1733045
description:
2025-11-03 22:05:42 dovecot_login authenticator failed for ([49.124.153.28]) [49.124.153.28]:46668: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.210.95.88
country_id: 294640
description:
2025-11-03 22:06:04 dovecot_login authenticator failed for ([46.210.95.88]) [46.210.95.88]:43548: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov  3 22:07:13 host2 dovecot[3704077]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, session=<tibbU7NCGNMDg9cm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 143.202.145.6
country_id: 3865483
description:
2025-11-03 22:09:37 dovecot_login authenticator failed for (6-red145.ceviamonte.com.ar) [143.202.145.6]:60024: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.89.159.59
country_id: 3865483
description:
2025-11-03 22:09:50 dovecot_login authenticator failed for (59-159-89-200.fibertel.com.ar) [200.89.159.59]:36976: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.233.110
country_id: 99237
description:
2025-11-03 22:09:34 dovecot_login authenticator failed for ([65.20.233.110]) [65.20.233.110]:44442: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov  3 22:09:20 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, session=<LjZtW7NC1sEDg9cm>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.131.215.38
country_id: 6252001
description:
Nov  3 22:09:33 host2 dovecot[3704077]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, session=<wqMrXLNCUNwDg9cm>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.131.215.38
country_id: 6252001
description:
Nov  3 22:10:04 host2 dovecot[3704077]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, session=<NcoJXrNCvNADg9cm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.93.2.86
country_id: 3469034
description:
2025-11-03 22:10:07 dovecot_login authenticator failed for (187-93-2-86.customer.tdatabrasil.net.br) [187.93.2.86]:48288: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov  3 22:11:47 host2 dovecot[3704077]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, session=<dUIlZLNCONQDg9cm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov  3 22:12:19 host2 dovecot[3704077]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, session=<y4QRZrNCvr4Dg9cm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2025-11-03 22:16:16 dovecot_plain authenticator failed for (memodig) [102.53.15.17]:34389: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 71.6.134.234
country_id: 6252001
description:
Nov  3 22:17:57 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=71.6.134.234, lip=66.85.158.92, session=<f0w0erNC0oBHBobq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.211.31.222
country_id: 2510769
description:
2025-11-03 22:19:25 dovecot_login authenticator failed for ([77.211.31.222]) [77.211.31.222]:37806: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.243.78
country_id: 1269750
description:
2025-11-03 22:19:50 dovecot_login authenticator failed for (nsg-corporate-78.243.186.122.airtel.in) [122.186.243.78]:49454: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.139.69
country_id: 6252001
description:
Nov  3 22:21:47 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=184.105.139.69, lip=66.85.158.92, TLS handshaking: Connection closed, session=<nAbwh7NCUp64aYtF>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.139.69
country_id: 6252001
description:
Nov  3 22:22:08 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=184.105.139.69, lip=66.85.158.92, TLS handshaking: Connection closed, session=<KBgyibNCFre4aYtF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.105.248.218
country_id: 6252001
description:
2025-11-03 22:21:59 dovecot_plain authenticator failed for (foropal) [24.105.248.218]:56326: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.216.58
country_id: 1269750
description:
2025-11-03 22:27:36 dovecot_login authenticator failed for ([152.52.234.148]) [125.19.216.58]:47548: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.158.235.131
country_id: 690791
description:
2025-11-03 22:28:02 dovecot_login authenticator failed for ([178.158.235.131]) [178.158.235.131]:44306: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  3 22:28:51 host2 sshd[1252286]: Disconnected from invalid user julien 62.60.131.157 port 53968 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.97.155.25
country_id: 6252001
description:
2025-11-03 22:31:33 dovecot_plain authenticator failed for c-76-97-155-25.hsd1.ga.comcast.net (chpodocks) [76.97.155.25]:48046: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.226.88.121
country_id: 2661886
description:
2025-11-03 22:37:07 dovecot_plain authenticator failed for 81-226-88-121-no600.tbcn.telia.com (ponomonae) [81.226.88.121]:60282: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 104.236.209.11
country_id: 6252001
description:
Nov  3 22:47:43 host2 dovecot[3704077]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 1 secs): user=<>, rip=104.236.209.11, lip=66.85.158.92, TLS, session=<u1ys5LNCLKho7NEL>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 104.236.209.11
country_id: 6252001
description:
Nov  3 22:47:54 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=104.236.209.11, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<1KZQ5bNC9tZo7NEL>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.29.21.127
country_id: 6252001
description:
Nov  3 22:48:58 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.29.21.127, lip=66.85.158.91, session=<OgEl6bNCwN8UHRV/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.106.197.7
country_id: 6252001
description:
Nov  3 22:50:57 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.106.197.7, lip=66.85.158.92, session=<IBY98LNCKOEUasUH>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.177.101.34
country_id: 6252001
description:
2025-11-03 22:56:39 dovecot_plain authenticator failed for c-174-177-101-34.hsd1.tn.comcast.net (draily) [174.177.101.34]:56368: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.193.79
country_id: 6251999
description:
Nov  3 23:02:24 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=148.113.193.79, lip=66.85.158.91, session=<0Q44GbRCPpOUccFP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.121.76.190
country_id: 732800
description:
2025-11-03 23:04:49 dovecot_plain authenticator failed for (pidiph) [87.121.76.190]:41334: 535 Incorrect authentication data (set_id=it@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.216
country_id: 2635167
description:
Nov  3 23:06:51 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 46 secs): user=<>, rip=35.203.210.216, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<oeQiKbRCRNUjy9LY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.216
country_id: 2635167
description:
Nov  3 23:07:13 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=35.203.210.216, lip=66.85.158.91, TLS: read(size=403) failed: Connection reset by peer, session=<+nFqKrRCqucjy9LY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.172.76.147
country_id: 6252001
description:
Nov  3 23:09:03 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=54.172.76.147, lip=66.85.158.91, TLS, session=<ECD/MLRCdu02rEyT>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.145.10.140
country_id: 6252001
description:
2025-11-03 23:10:05 dovecot_plain authenticator failed for c-76-145-10-140.hsd1.ga.comcast.net (coloic) [76.145.10.140]:34928: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.216
country_id: 2635167
description:
Nov  3 23:13:45 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=35.203.210.216, lip=66.85.158.91, TLS, session=<uDXCQbRCLvIjy9LY>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  3 23:14:39 host2 sshd[1305089]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.191.74.151
country_id: 6252001
description:
2025-11-03 23:19:10 dovecot_login authenticator failed for ([172.191.74.151]) [172.191.74.151]:33466: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 63.47.149.59
country_id: 6252001
description:
2025-11-03 23:19:24 dovecot_login authenticator failed for host59.sub-63-47-149.myvzw.com [63.47.149.59]:44869: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.184.33.86
country_id: 3469034
description:
2025-11-03 23:18:56 dovecot_login authenticator failed for 179.184.33.86.static.gvt.net.br (accera.static.gvt.net.br) [179.184.33.86]:54060: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.231.25.64
country_id: 3686110
description:
2025-11-03 23:20:11 dovecot_login authenticator failed for (1522312565.colombiatel.co) [152.231.25.64]:50325: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  3 23:20:16 host2 sshd[1311456]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.88.152
country_id: 294640
description:
2025-11-03 23:20:27 dovecot_login authenticator failed for (31-154-88-152.orange.net.il) [2.55.88.152]:37301: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.193.79
country_id: 6251999
description:
Nov  3 23:21:42 host2 dovecot[3704077]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=148.113.193.79, lip=66.85.158.92, session=<w5E8XrRC7NeUccFP>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.120
country_id: 6252001
description:
Nov  3 23:25:04 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=66.132.153.120, lip=66.85.158.92, TLS: Connection closed, session=<tMI8arRCuNRChJl4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.32.96.252
country_id: 3017382
description:
2025-11-03 23:25:34 dovecot_login authenticator failed for ip252.ip-178-32-96.eu (ADMIN) [178.32.96.252]:59606: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.151
country_id: 2750405
description:
2025-11-03 23:25:45 dovecot_plain authenticator failed for ([45.94.31.151]) [45.94.31.151]:65030: 535 Incorrect authentication data (set_id=admin@cloudtourssrilanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.37.32.248
country_id: 1269750
description:
2025-11-03 23:26:35 dovecot_login authenticator failed for (223-30-0-0.lan.sify.net) [49.37.32.248]:43580: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.50.194.182
country_id: 3469034
description:
2025-11-03 23:27:03 dovecot_login authenticator failed for (187-50-194-182.customer.tdatabrasil.net.br) [187.50.194.182]:41289: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 9.234.8.125
country_id: 2635167
description:
Nov  3 23:32:28 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=9.234.8.125, lip=66.85.158.92, session=<g0G5hLRCsOEJ6gh9>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  3 23:38:27 host2 sshd[1331336]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.20.66
country_id: 6252001
description:
Nov  3 23:38:38 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.20.66, lip=66.85.158.92, session=<rOzLmrRC2tRBMRRC>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.20.66
country_id: 6252001
description:
Nov  3 23:38:54 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=65.49.20.66, lip=66.85.158.92, TLS: Connection closed, session=<DA+0m7RCFiJBMRRC>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 44.202.89.164
country_id: 6252001
description:
Nov  3 23:41:22 host2 pure-ftpd[1334620]: (?@44.202.89.164) [INFO] New connection from 44.202.89.164


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.158.170.13
country_id: 2542007
description:
2025-11-03 23:44:04 dovecot_plain authenticator failed for ([127.0.0.1]) [105.158.170.13]:64885: 535 Incorrect authentication data (set_id=admin@cloudtourssrilanka.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 177.157.246.12
country_id: 3469034
description:
Nov  3 23:44:21 host2 pure-ftpd[1337889]: (?@177.157.246.12) [INFO] New connection from 177.157.246.12


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.24
country_id: 6252001
description:
Nov  3 23:52:05 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.24, lip=66.85.158.91, TLS handshaking: Connection closed, session=<1T3myrRChPNBMQEY>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.161.114.113
country_id: 2017370
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 195.161.114.113 - bostonlanka "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov  3 23:55:10 host2 sshd[1351442]: Disconnected from invalid user user 2.57.121.25 port 37524 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.90.34.90
country_id: 2328926
description:
2025-11-03 23:56:56 dovecot_login authenticator failed for ([102.90.34.90]) [102.90.34.90]:34522: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.215.245.175
country_id: 3469034
description:
2025-11-03 23:57:14 dovecot_login authenticator failed for ([186.239.240.127]) [186.215.245.175]:33138: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.214.125.148
country_id: 1694008
description:
2025-11-04 00:03:27 dovecot_login authenticator failed for (ADMIN) [188.214.125.148]:53392: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 75.102.132.149
country_id: 6252001
description:
Nov  4 00:05:22 host2 sshd[1364118]: Disconnecting invalid user admin 75.102.132.149 port 47844: Too many authentication failures [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.138
country_id: 6252001
description:
Nov  4 00:05:32 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=147.185.132.138, lip=66.85.158.91, TLS, session=<Nf/z+rRCdumTuYSK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-04 00:05:19 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:58359: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 75.102.132.149
country_id: 6252001
description:
Nov  4 00:05:09 host2 sshd[1363711]: error: maximum authentication attempts exceeded for root from 75.102.132.149 port 46118 ssh2 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 75.102.132.149
country_id: 6252001
description:
Nov  4 00:05:20 host2 sshd[1364074]: error: maximum authentication attempts exceeded for invalid user admin from 75.102.132.149 port 47422 ssh2 [preauth]


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 75.102.132.149
country_id: 6252001
description:
Nov  4 00:05:09 host2 sshd[1363711]: Disconnecting authenticating user root 75.102.132.149 port 46118: Too many authentication failures [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.236.228.208
country_id: 6252001
description:
Nov  4 00:26:11 host2 dovecot[3704077]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=172.236.228.208, lip=66.85.158.91, session=<7LvQRLVCqJGs7OTQ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.222.81.115
country_id: 6252001
description:
Nov  4 00:29:15 host2 dovecot[3704077]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=44.222.81.115, lip=66.85.158.92, session=<0mnOT7VCKKIs3lFz>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.172.76.147
country_id: 6252001
description:
Nov  4 00:31:23 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=54.172.76.147, lip=66.85.158.92, TLS, session=<G0xsV7VCiuQ2rEyT>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.127
country_id: 6252001
description:
Nov  4 00:35:05 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=66.132.153.127, lip=66.85.158.91, TLS: Connection closed, session=<IIOiZLVC+pJChJl/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.127
country_id: 6252001
description:
Nov  4 00:35:09 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=66.132.153.127, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<mKXiZLVCRpNChJl/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.148.165
country_id: 99237
description:
2025-11-04 00:40:59 dovecot_plain authenticator failed for (cationg) [65.20.148.165]:51366: 535 Incorrect authentication data (set_id=it@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.179.251
country_id: 99237
description:
2025-11-04 00:41:58 dovecot_login authenticator failed for ([65.20.179.251]) [65.20.179.251]:43694: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.124
country_id: 2186224
description:
2025-11-04 00:42:25 dovecot_login authenticator failed for ([121.73.169.124]) [121.73.169.124]:34328: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.239.203.122
country_id: 2077456
description:
2025-11-04 00:44:57 dovecot_login authenticator failed for (ADMIN) [173.239.203.122]:48306: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  4 00:47:59 host2 sshd[1416866]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.34.17.250
country_id: 99237
description:
2025-11-04 00:49:01 dovecot_login authenticator failed for ([185.34.17.250]) [185.34.17.250]:43063: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.156.46
country_id: 1269750
description:
2025-11-04 00:49:17 dovecot_login authenticator failed for ([125.19.156.46]) [125.19.156.46]:48958: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 152.32.133.103
country_id: 1819730
description:
Nov  4 00:51:12 host2 dovecot[3704077]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=152.32.133.103, lip=66.85.158.92, TLS, session=<2ztRnrVC8MeYIIVn>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 152.32.133.103
country_id: 1819730
description:
Nov  4 00:51:12 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=152.32.133.103, lip=66.85.158.92, session=<gBZEnrVCBMeYIIVn>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.194.98
country_id: 6252001
description:
2025-11-04 00:53:46 dovecot_plain authenticator failed for c-73-197-194-98.hsd1.nj.comcast.net (nonwish) [73.197.194.98]:36098: 535 Incorrect authentication data (set_id=it@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  4 00:53:34 host2 sshd[1423612]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 74.249.178.45
country_id: 6252001
description:
Nov  4 00:55:06 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=74.249.178.45, lip=66.85.158.91, session=<YmE+rLVCHsBK+bIt>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.97
country_id: 6252001
description:
Nov  4 01:00:28 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=198.235.24.97, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<mJ9rv7VC1tTG6xhh>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov  4 01:07:09 host2 sshd[1440370]: Disconnected from invalid user user 2.57.121.25 port 37541 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.4
country_id: 1733045
description:
2025-11-04 01:10:24 dovecot_login authenticator failed for ([49.124.151.4]) [49.124.151.4]:44374: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.130
country_id: 1269750
description:
2025-11-04 01:10:26 dovecot_login authenticator failed for ([152.52.234.35]) [182.95.176.130]:48550: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.12.112.186
country_id: 3469034
description:
2025-11-04 01:10:58 dovecot_login authenticator failed for ([187.12.112.186]) [187.12.112.186]:48120: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 103.108.174.170
country_id: 1269750
description:
Nov  4 01:15:27 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=103.108.174.170, lip=66.85.158.91, TLS, session=<P67+9LVC6sxnbK6q>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 154.47.30.21
country_id: 953987
description:
Nov  4 01:15:31 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=154.47.30.21, lip=66.85.158.91, TLS handshaking: Connection closed, session=<78dE9bVCwuaaLx4V>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 84.239.49.10
country_id: 798549
description:
Nov  4 01:15:26 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=84.239.49.10, lip=66.85.158.91, session=<xgz49LVCjIpU7zEK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 176.125.228.148
country_id: 2589581
description:
Nov  4 01:15:26 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=176.125.228.148, lip=66.85.158.91, session=<1Fj89LVCfoqwfeSU>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 95.181.237.139
country_id: 3625428
description:
Nov  4 01:15:30 host2 dovecot[3704077]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=95.181.237.139, lip=66.85.158.91, session=<Zl8r9bVCEMVfte2L>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 98.159.40.21
country_id: 1227603
description:
Nov  4 01:15:30 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=98.159.40.21, lip=66.85.158.91, session=<NMw19bVCYo9inygV>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 173.244.42.173
country_id: 1835841
description:
Nov  4 01:15:26 host2 dovecot[3704077]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=173.244.42.173, lip=66.85.158.91, session=<iYL49LVCjoqt9Cqt>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 173.239.220.18
country_id: 3658394
description:
Nov  4 01:15:27 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=173.239.220.18, lip=66.85.158.91, TLS handshaking: Connection closed, session=<sPgJ9bVC1M6t79wS>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 185.253.160.141
country_id: 174982
description:
Nov  4 01:15:23 host2 pure-ftpd[1449746]: (?@185.253.160.141) [INFO] New connection from 185.253.160.141


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.32.122.7
country_id: 597427
description:
Nov  4 01:15:27 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=194.32.122.7, lip=66.85.158.91, TLS handshaking: Connection closed, session=<16j99LVC6MzCIHoH>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 146.70.11.56
country_id: 3895114
description:
Nov  4 01:15:26 host2 dovecot[3704077]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=146.70.11.56, lip=66.85.158.91, session=<XgL19LVCoIqSRgs4>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 103.108.174.133
country_id: 1269750
description:
Nov  4 01:15:30 host2 dovecot[3704077]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=103.108.174.133, lip=66.85.158.91, session=<T2cw9bVCbo9nbK6F>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.137
country_id: 130758
description:
Nov  4 01:28:00 host2 sshd[1464158]: Invalid user secondcoffeeinternational from 62.60.131.137 port 60930


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.255.9.170
country_id: 2661886
description:
2025-11-04 01:42:02 dovecot_login authenticator failed for c83-255-9-170.bredband.tele2.se [83.255.9.170]:46172: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 63.47.149.59
country_id: 6252001
description:
2025-11-04 01:41:34 dovecot_login authenticator failed for host59.sub-63-47-149.myvzw.com [63.47.149.59]:37038: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.102.50
country_id: 1269750
description:
2025-11-04 01:44:15 dovecot_login authenticator failed for ([27.123.102.50]) [27.123.102.50]:44212: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.201.212.54
country_id: 99237
description:
2025-11-04 01:44:35 dovecot_login authenticator failed for ([62.201.212.54]) [62.201.212.54]:59710: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.147.94
country_id: 290557
description:
2025-11-04 01:45:11 dovecot_plain authenticator failed for (wearionity) [80.227.147.94]:58928: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.130
country_id: 6252001
description:
Nov  4 01:52:20 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.130, lip=66.85.158.91, TLS, session=<MwryeLZCeuHN0h+C>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  4 01:58:47 host2 sshd[1502229]: Disconnected from invalid user amara 62.60.131.157 port 9546 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.241.30
country_id: 1269750
description:
2025-11-04 02:03:36 dovecot_login authenticator failed for ([182.78.241.30]) [182.78.241.30]:60824: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.149.219
country_id: 1733045
description:
2025-11-04 02:04:20 dovecot_login authenticator failed for ([49.124.149.219]) [49.124.149.219]:32900: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.138
country_id: 130758
description:
Nov  4 02:07:22 host2 sshd[1512503]: Invalid user secondcoffeeinternational from 62.60.131.138 port 54040


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 40.124.175.188
country_id: 6252001
description:
Nov  4 02:12:40 host2 pure-ftpd[1518416]: (?@40.124.175.188) [INFO] New connection from 40.124.175.188


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.139
country_id: 130758
description:
Nov  4 02:14:51 host2 sshd[1520838]: Invalid user secondcoffeeinternational from 62.60.131.139 port 46654


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  4 02:20:29 host2 sshd[1527418]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.227.188.86
country_id: 6252001
description:
Nov  4 02:20:51 host2 pure-ftpd[1527987]: (?@165.227.188.86) [INFO] New connection from 165.227.188.86


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.199.118.234
country_id: 1880251
description:
2025-11-04 02:25:23 dovecot_login authenticator failed for (448990.cloudwaysapps.com) [128.199.118.234]:33172: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.107.6
country_id: 1269750
description:
2025-11-04 02:25:37 dovecot_login authenticator failed for ([125.19.110.89]) [182.78.107.6]:36592: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  4 02:25:55 host2 sshd[1533876]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.137
country_id: 130758
description:
Nov  4 02:29:14 host2 sshd[1537616]: Invalid user secondcoffeeinternational from 62.60.131.137 port 45268


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 128.203.204.199
country_id: 6251999
description:
Nov  4 02:29:24 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=128.203.204.199, lip=66.85.158.92, session=<qt56/bZCHLeAy8zH>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  4 02:29:59 host2 sshd[1538407]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.195.138.52
country_id: 6252001
description:
2025-11-04 02:36:37 dovecot_plain authenticator failed for c-98-195-138-52.hsd1.tx.comcast.net (coudhon) [98.195.138.52]:58530: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.122
country_id: 6252001
description:
Nov  4 02:38:40 host2 pure-ftpd[1548349]: (?@198.235.24.122) [INFO] New connection from 198.235.24.122


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.169.105.38
country_id: 6252001
description:
Nov  4 02:38:42 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.169.105.38, lip=66.85.158.91, session=<et/CHrdCWsUUqWkm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.136
country_id: 130758
description:
Nov  4 02:42:45 host2 sshd[1552908]: Invalid user secondcoffeeinternational from 62.60.131.136 port 37728


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov  4 02:43:50 host2 sshd[1553904]: Disconnected from invalid user user 2.57.121.25 port 10545 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.116.22
country_id: 1861060
description:
Nov  4 02:47:20 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=139.162.116.22, lip=66.85.158.92, TLS: Connection closed, session=<0nSfPbdCnKmLonQW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.238.92.245
country_id: 2623032
description:
2025-11-04 02:55:41 dovecot_plain authenticator failed for (volid) [84.238.92.245]:50373: 535 Incorrect authentication data (set_id=it@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.255.208.169
country_id: 2661886
description:
2025-11-04 03:00:12 dovecot_login authenticator failed for 94-255-208-169.cust.bredband2.com [94.255.208.169]:59522: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.83.145.39
country_id: 6252001
description:
Nov  4 03:00:25 host2 dovecot[3704077]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.83.145.39, lip=66.85.158.91, session=<kkdsbLdCQMUDU5En>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.245.10.228
country_id: 1880251
description:
2025-11-04 02:59:59 dovecot_login authenticator failed for (228.10.245.49.unknown.m1.com.sg) [49.245.10.228]:53422: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.205.228
country_id: 99237
description:
2025-11-04 03:00:45 dovecot_login authenticator failed for ([65.20.205.228]) [65.20.205.228]:56295: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.92
country_id: 6252001
description:
Nov  4 03:00:56 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=198.235.24.92, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<7gZCbrdCiMHG6xhc>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.140
country_id: 6252001
description:
Nov  4 03:04:28 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.140, lip=66.85.158.91, TLS: Connection closed, session=<8QHperdCFNtChJmM>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.127
country_id: 6252001
description:
Nov  4 03:06:16 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.127, lip=66.85.158.91, session=<QCFQgbdCxO3G6xh/>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.138
country_id: 130758
description:
Nov  4 03:08:26 host2 sshd[1584407]: Invalid user secondcoffeeinternational from 62.60.131.138 port 54552


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.83.145.39
country_id: 6252001
description:
Nov  4 03:09:46 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=3.83.145.39, lip=66.85.158.92, TLS, session=<6Y/RjbdC5r4DU5En>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.139
country_id: 130758
description:
Nov  4 03:16:39 host2 sshd[1594414]: Invalid user secondcoffeeinternational from 62.60.131.139 port 39384


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  4 03:17:49 host2 sshd[1595992]: Disconnected from invalid user lamar 62.60.131.157 port 14267 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 178.22.24.15
country_id: 2017370
description:
Nov  4 03:20:31 host2 dovecot[3704077]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=178.22.24.15, lip=66.85.158.91, session=<r/VItLdCguayFhgP>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.236.228.227
country_id: 6252001
description:
Nov  4 03:29:11 host2 dovecot[3704077]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=172.236.228.227, lip=66.85.158.92, session=<hlVJ07dCHLWs7OTj>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.137
country_id: 130758
description:
Nov  4 03:31:13 host2 sshd[1616701]: Invalid user secondcoffeeinternational from 62.60.131.137 port 52936


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.213.237.28
country_id: 6252001
description:
2025-11-04 03:39:29 dovecot_plain authenticator failed for c-73-213-237-28.hsd1.va.comcast.net (catized) [73.213.237.28]:51122: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.127.177.194
country_id: 6252001
description:
2025-11-04 03:39:29 dovecot_plain authenticator failed for static-50-127-177-194.chtn.wv.frontiernet.net (atter) [50.127.177.194]:50334: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.136
country_id: 130758
description:
Nov  4 03:44:29 host2 sshd[1631753]: Invalid user secondcoffeeinternational from 62.60.131.136 port 50562


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  4 03:43:59 host2 sshd[1630773]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  4 03:51:24 host2 sshd[1641059]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 178.22.24.15
country_id: 2017370
description:
Nov  4 03:57:00 host2 dovecot[3704077]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=178.22.24.15, lip=66.85.158.92, session=<Ekq9NrhCwOWyFhgP>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  4 03:56:49 host2 sshd[1647904]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.176.157.57
country_id: 6252001
description:
2025-11-04 04:01:21 dovecot_plain authenticator failed for c-73-176-157-57.hsd1.il.comcast.net (lecholaphy) [73.176.157.57]:43644: 535 Incorrect authentication data (set_id=it@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-04 04:04:16 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:51333: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.194.174.27
country_id: 6252001
description:
2025-11-04 04:04:03 dovecot_plain authenticator failed for (wyess) [216.194.174.27]:37042: 535 Incorrect authentication data (set_id=it@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.138
country_id: 130758
description:
Nov  4 04:10:26 host2 sshd[1664757]: Invalid user secondcoffeeinternational from 62.60.131.138 port 54090


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.98
country_id: 6252001
description:
Nov  4 04:18:57 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=198.235.24.98, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<rDREhbhCyc7G6xhi>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.142.126.37
country_id: 6252001
description:
2025-11-04 04:24:37 dovecot_plain authenticator failed for c-69-142-126-37.hsd1.nj.comcast.net (mulbased) [69.142.126.37]:54532: 535 Incorrect authentication data (set_id=it@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.32.96.252
country_id: 3017382
description:
2025-11-04 04:30:21 dovecot_login authenticator failed for ip252.ip-178-32-96.eu (ADMIN) [178.32.96.252]:52910: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.59.253.88
country_id: 6252001
description:
2025-11-04 04:34:06 dovecot_plain authenticator failed for c-174-59-253-88.hsd1.pa.comcast.net (antish) [174.59.253.88]:50300: 535 Incorrect authentication data (set_id=it@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  4 04:35:25 host2 sshd[1701694]: Disconnected from invalid user arlene 62.60.131.157 port 25647 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.246.114.111
country_id: 1880251
description:
2025-11-04 04:42:30 dovecot_login authenticator failed for ([124.246.114.111]) [124.246.114.111]:60322: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.159.82
country_id: 1269750
description:
2025-11-04 04:42:52 dovecot_login authenticator failed for (nsg-static-121.108.76.182-airtel.com) [182.78.159.82]:39812: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.144
country_id: 1269750
description:
2025-11-04 04:43:05 dovecot_login authenticator failed for (nsg-corporate-144.227.187.122.airtel.in) [122.187.227.144]:51135: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.220.16.51
country_id: 1269750
description:
2025-11-04 04:44:48 dovecot_login authenticator failed for ([103.220.16.51]) [103.220.16.51]:48364: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.79.134
country_id: 1269750
description:
2025-11-04 04:45:16 dovecot_login authenticator failed for ([182.78.79.134]) [182.78.79.134]:53014: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.243.68.66
country_id: 1861060
description:
2025-11-04 04:45:34 dovecot_login authenticator failed for 66.68.243.35.bc.googleusercontent.com [35.243.68.66]:47318: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 168.149.213.8
country_id: 6252001
description:
2025-11-04 04:45:58 dovecot_login authenticator failed for ([168.149.213.8]) [168.149.213.8]:58362: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.72.87.7
country_id: 3469034
description:
2025-11-04 04:46:20 dovecot_login authenticator failed for 177-72-87-7.static.as262543.net.br [177.72.87.7]:54818: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.204.193
country_id: 99237
description:
2025-11-04 04:54:12 dovecot_plain authenticator failed for (enseuted) [65.20.204.193]:55644: 535 Incorrect authentication data (set_id=it@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov  4 05:07:14 host2 sshd[1742285]: Disconnected from invalid user user 2.57.121.25 port 13292 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.138
country_id: 130758
description:
Nov  4 05:12:39 host2 sshd[1748670]: Invalid user secondcoffeeinternational from 62.60.131.138 port 56168


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.128.234.37
country_id: 3017382
description:
2025-11-04 05:13:21 dovecot_login authenticator failed for 37.234.128.77.rev.sfr.net [77.128.234.37]:32802: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.243.175
country_id: 732800
description:
2025-11-04 05:13:41 dovecot_login authenticator failed for (92.62.243.175.fibermax.bg) [92.62.243.175]:48383: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  4 05:22:23 host2 sshd[1759966]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  4 05:27:49 host2 sshd[1766140]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2025-11-04 05:28:36 dovecot_plain authenticator failed for (wieconbell) [196.47.172.253]:54696: 535 Incorrect authentication data (set_id=it@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.177.30.53
country_id: 6252001
description:
2025-11-04 05:28:39 dovecot_plain authenticator failed for c-66-177-30-53.hsd1.fl.comcast.net (ockornal) [66.177.30.53]:55682: 535 Incorrect authentication data (set_id=it@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.236.163
country_id: 6252001
description:
2025-11-04 05:28:32 dovecot_plain authenticator failed for c-73-197-236-163.hsd1.nj.comcast.net (sculne) [73.197.236.163]:57504: 535 Incorrect authentication data (set_id=it@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.237.173.220
country_id: 6252001
description:
Nov  4 05:31:12 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.237.173.220, lip=66.85.158.91, TLS, session=<ZNijh7lCSMED7a3c>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.137
country_id: 130758
description:
Nov  4 05:36:33 host2 sshd[1776692]: Invalid user secondcoffeeinternational from 62.60.131.137 port 39754


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.26.236.10
country_id: 6252001
description:
2025-11-04 05:47:59 dovecot_login authenticator failed for ([12.26.236.10]) [12.26.236.10]:55522: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.128.151.92
country_id: 6252001
description:
2025-11-04 05:48:18 dovecot_login authenticator failed for c-73-128-151-92.hsd1.de.comcast.net [73.128.151.92]:49554: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.136
country_id: 130758
description:
Nov  4 05:48:37 host2 sshd[1790486]: Invalid user secondcoffeeinternational from 62.60.131.136 port 40938


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.40.189.43
country_id: 6252001
description:
2025-11-04 05:49:31 dovecot_plain authenticator failed for c-68-40-189-43.hsd1.mi.comcast.net (actorthle) [68.40.189.43]:55142: 535 Incorrect authentication data (set_id=it@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2025-11-04 06:00:30 dovecot_plain authenticator failed for c-71-62-34-216.hsd1.va.comcast.net (ancises) [71.62.34.216]:56598: 535 Incorrect authentication data (set_id=it@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.57
country_id: 6252001
description:
Nov  4 06:04:19 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=167.94.146.57, lip=66.85.158.92, TLS: Connection closed, session=<r/YV/rlCBtynXpI5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.158.142.39
country_id: 690791
description:
2025-11-04 06:11:52 dovecot_login authenticator failed for ([178.158.142.39]) [178.158.142.39]:38398: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.138
country_id: 130758
description:
Nov  4 06:15:10 host2 sshd[1821472]: Invalid user secondcoffeeinternational from 62.60.131.138 port 36712


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.234.80.128
country_id: 6252001
description:
Nov  4 06:21:18 host2 dovecot[3704077]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=54.234.80.128, lip=66.85.158.92, session=<mujZOrpC0KA26lCA>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  4 06:22:28 host2 sshd[1829496]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.139
country_id: 130758
description:
Nov  4 06:22:34 host2 sshd[1829677]: Invalid user secondcoffeeinternational from 62.60.131.139 port 50294


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.187.205
country_id: 337996
description:
2025-11-04 06:25:12 dovecot_login authenticator failed for ([196.188.187.205]) [196.188.187.205]:57334: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.97.190.237
country_id: 6252001
description:
2025-11-04 06:25:15 dovecot_plain authenticator failed for (fleer) [75.97.190.237]:58534: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.70.122.245
country_id: 1269750
description:
2025-11-04 06:25:28 dovecot_login authenticator failed for (abts-mum-static-245.122.70.182.airtelbroadband.in) [182.70.122.245]:38878: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.150.8.174
country_id: 1522867
description:
2025-11-04 06:33:07 dovecot_plain authenticator failed for 37.150.8.174.dynamic.telecom.kz (cutancy) [37.150.8.174]:47355: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.14.31.158
country_id: 3017382
description:
2025-11-04 06:33:09 dovecot_plain authenticator failed for laubervilliers-657-1-93-158.w80-14.abo.wanadoo.fr (prermery) [80.14.31.158]:35920: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.224
country_id: 6252001
description:
Nov  4 06:39:02 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.224, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<FIc6erpCvM7G6xjg>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.83.145.39
country_id: 6252001
description:
Nov  4 06:38:21 host2 dovecot[3704077]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.83.145.39, lip=66.85.158.91, session=<Cf7Td7pCkrUDU5En>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov  4 06:42:04 host2 dovecot[3704077]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<x0kRhbpC1NUDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov  4 06:42:28 host2 dovecot[3704077]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<XZR/hrpCCuwDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov  4 06:43:50 host2 dovecot[3704077]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<02Zhi7pCNOADgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov  4 06:44:13 host2 dovecot[3704077]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<C2bNjLpCruADgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov  4 06:46:13 host2 dovecot[3704077]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<yxj2k7pCXIoDgmBb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.207.248.5
country_id: 3469034
description:
2025-11-04 06:46:22 dovecot_login authenticator failed for (mamanguape.static.gvt.net.br) [177.207.248.5]:55920: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.185.29.233
country_id: 3469034
description:
2025-11-04 06:46:37 dovecot_login authenticator failed for (corporativo.static.gvt.net.br) [179.185.29.233]:44152: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov  4 06:47:10 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<TUtSl7pCbJUDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.119
country_id: 6252001
description:
Nov  4 06:47:44 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 17 secs): user=<>, rip=66.132.153.119, lip=66.85.158.91, TLS handshaking: Connection closed, session=<qFdWmbpCXtlChJl3>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.130.96.91
country_id: 6252001
description:
Nov  4 06:48:01 host2 dovecot[3704077]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<6CZZmrpC6JoDgmBb>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.130.96.91
country_id: 6252001
description:
Nov  4 06:48:25 host2 dovecot[3704077]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<IU3Rm7pCNIgDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov  4 06:50:23 host2 dovecot[3704077]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<6EjOorpC/JwDgmBb>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  4 06:50:34 host2 sshd[1861536]: Disconnected from invalid user alonso 62.60.131.157 port 19167 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  4 06:53:33 host2 sshd[1864644]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.27
country_id: 6252001
description:
Nov  4 06:55:23 host2 pure-ftpd[1867079]: (?@147.185.132.27) [INFO] New connection from 147.185.132.27


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  4 06:59:00 host2 sshd[1871023]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 103.176.152.40
country_id: 1605651
description:
Nov  4 06:59:27 host2 pure-ftpd[1871475]: (?@103.176.152.40) [INFO] New connection from 103.176.152.40


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.148.165
country_id: 99237
description:
2025-11-04 07:02:08 dovecot_plain authenticator failed for (artrack) [65.20.148.165]:43150: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.150.233.119
country_id: 2661886
description:
2025-11-04 07:02:15 dovecot_plain authenticator failed for c188-150-233-119.bredband.tele2.se (urion) [188.150.233.119]:59492: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  4 07:07:59 host2 sshd[1882067]: Disconnected from invalid user cordell 62.60.131.157 port 60833 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 24.199.111.92
country_id: 6252001
description:
Nov  4 07:09:00 host2 pure-ftpd[1883180]: (?@24.199.111.92) [INFO] New connection from 24.199.111.92


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.158.138.179
country_id: 1269750
description:
2025-11-04 07:19:03 dovecot_login authenticator failed for ([103.158.138.179]) [103.158.138.179]:44266: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.195.66
country_id: 1269750
description:
2025-11-04 07:18:25 dovecot_login authenticator failed for ([125.19.195.66]) [125.19.195.66]:46750: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 182.1.16.117
country_id: 1643084
description:
Nov  4 07:24:04 host2 dovecot[3704077]: imap-login: Disconnected: Aborted login by logging out (auth failed, 1 attempts in 3 secs): user=<training@v-deploy.com>, method=PLAIN, rip=182.1.16.117, lip=66.85.158.91, TLS, session=<DgoeG7tCAXe2ARB1>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 148.113.216.105
country_id: 6251999
description:
Nov  4 07:23:17 host2 pure-ftpd[1899539]: (?@148.113.216.105) [INFO] New connection from 148.113.216.105


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 148.113.216.105
country_id: 6251999
description:
Nov  4 07:23:32 host2 pure-ftpd[1899819]: (?@148.113.216.105) [INFO] New connection from 148.113.216.105


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 177.228.111.23
country_id: 3996063
description:
Nov  4 07:23:47 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=177.228.111.23, lip=66.85.158.91, TLS, session=<Xw9MGrtCDcCx5G8X>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.124.229
country_id: 337996
description:
2025-11-04 07:26:52 dovecot_login authenticator failed for ([196.189.124.229]) [196.189.124.229]:48794: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.211.131
country_id: 6251999
description:
Nov  4 07:27:07 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=148.113.211.131, lip=66.85.158.92, session=<Y001JrtC+uOUcdOD>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-04 07:32:33 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:56527: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 2a01:239:212:7c00::1
country_id: 2921044
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 2a01:239:212:7c00::1 - yashiholdingscom "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user yashiholdingscom (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.137
country_id: 130758
description:
Nov  4 07:45:29 host2 sshd[1924740]: Invalid user secondcoffeeinternational from 62.60.131.137 port 47590


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.79.120.248
country_id: 6251999
description:
2025-11-04 07:51:03 dovecot_login authenticator failed for s01060030f43b0098.vn.shawcable.net [70.79.120.248]:44395: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.239.41.74
country_id: 3469034
description:
2025-11-04 07:51:21 dovecot_login authenticator failed for ([186.239.41.74]) [186.239.41.74]:45880: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.166.153.20
country_id: 6252001
description:
2025-11-04 08:05:23 dovecot_plain authenticator failed for c-174-166-153-20.hsd1.nj.comcast.net (wantruseus) [174.166.153.20]:51926: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.210.228
country_id: 6251999
description:
Nov  4 08:05:32 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=148.113.210.228, lip=66.85.158.92, TLS, session=<Vq+Rr7tCNIOUcdLk>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.241.108
country_id: 298795
description:
2025-11-04 08:11:49 dovecot_plain authenticator failed for (havate) [5.11.241.108]:50297: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.74.136.134
country_id: 6252001
description:
2025-11-04 08:13:36 dovecot_plain authenticator failed for syn-050-074-136-134.biz.spectrum.com (icatheed) [50.74.136.134]:33724: 535 Incorrect authentication data (set_id=it@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.181
country_id: 6252001
description:
Nov  4 08:17:01 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.181, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<4jOt2LtCtdTG6xi1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.208
country_id: 99237
description:
2025-11-04 08:19:52 dovecot_plain authenticator failed for (untoroth) [65.20.133.208]:57502: 535 Incorrect authentication data (set_id=it@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.173.58.47
country_id: 6252001
description:
2025-11-04 08:21:08 dovecot_plain authenticator failed for c-67-173-58-47.hsd1.il.comcast.net (fignme) [67.173.58.47]:44694: 535 Incorrect authentication data (set_id=it@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.208
country_id: 6252001
description:
Nov  4 08:21:35 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=195.184.76.208, lip=66.85.158.92, TLS handshaking: Connection closed, session=<U8UE6btCrdXDuEzQ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.142
country_id: 6252001
description:
Nov  4 08:21:46 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=195.184.76.142, lip=66.85.158.92, TLS: Connection closed, session=<qDii6btCu+zDuEyO>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  4 08:24:49 host2 sshd[1970855]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.138
country_id: 6252001
description:
Nov  4 08:25:40 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=195.184.76.138, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<hCmT97tCGYzDuEyK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.211
country_id: 6252001
description:
Nov  4 08:25:43 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=195.184.76.211, lip=66.85.158.92, TLS: Connection closed, session=<KyjC97tC15vDuEzT>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  4 08:30:15 host2 sshd[1977600]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.221.119
country_id: 298795
description:
2025-11-04 08:30:12 dovecot_plain authenticator failed for (luvist) [5.11.221.119]:34642: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 159.65.221.19
country_id: 6252001
description:
Nov  4 08:31:43 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=159.65.221.19, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<KSk0DbxCpLSfQd0T>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.233.92.123
country_id: 1269750
description:
2025-11-04 08:39:02 dovecot_login authenticator failed for ([103.233.92.123]) [103.233.92.123]:51126: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.130.176.136
country_id: 6252001
description:
2025-11-04 08:38:41 dovecot_login authenticator failed for mobile-166-130-176-136.mycingular.net [166.130.176.136]:38385: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.220.210
country_id: 2403846
description:
2025-11-04 08:38:59 dovecot_login authenticator failed for ([196.216.220.210]) [196.216.220.210]:55998: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.219.2
country_id: 1269750
description:
2025-11-04 08:39:15 dovecot_login authenticator failed for ([125.21.105.49]) [128.185.219.2]:47728: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov  4 08:51:21 host2 sshd[2004056]: Disconnected from invalid user user 2.57.121.25 port 17898 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.86.130
country_id: 1269750
description:
2025-11-04 08:54:52 dovecot_login authenticator failed for (nsg-static-130.86.76.182-airtel.com) [182.76.86.130]:34840: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.32.253.235
country_id: 99237
description:
2025-11-04 08:55:11 dovecot_login authenticator failed for ([213.32.253.235]) [213.32.253.235]:53885: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.199.161.144
country_id: 6252001
description:
2025-11-04 08:56:47 dovecot_plain authenticator failed for c-73-199-161-144.hsd1.nj.comcast.net (troly) [73.199.161.144]:40548: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2025-11-04 08:58:39 dovecot_plain authenticator failed for (unalike) [102.53.15.56]:42013: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.136
country_id: 130758
description:
Nov  4 08:59:44 host2 sshd[2014839]: Invalid user secondcoffeeinternational from 62.60.131.136 port 40740


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.120.142.233
country_id: 2510769
description:
2025-11-04 09:01:46 dovecot_plain authenticator failed for (polized) [185.120.142.233]:55171: 535 Incorrect authentication data (set_id=it@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.28
country_id: 3017382
description:
Nov  4 09:02:31 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=91.196.152.28, lip=66.85.158.92, TLS handshaking: Connection closed, session=<40Vke7xCA91bxJgc>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.29
country_id: 3017382
description:
Nov  4 09:02:50 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 19 secs): user=<>, rip=91.196.152.29, lip=66.85.158.92, TLS: Connection closed, session=<pMV7fLxC7blbxJgd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.119
country_id: 3017382
description:
Nov  4 09:03:38 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=91.196.152.119, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<pXNaf7xCQepbxJh3>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.113
country_id: 3017382
description:
Nov  4 09:03:41 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.196.152.113, lip=66.85.158.92, TLS: Connection closed, session=<DHGKf7xCtZZbxJhx>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2025-11-04 09:03:45 dovecot_plain authenticator failed for (serptist) [102.53.15.56]:55785: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov  4 09:14:41 host2 sshd[2034806]: Disconnected from invalid user user 2.57.121.25 port 22792 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.138
country_id: 130758
description:
Nov  4 09:29:52 host2 sshd[2053403]: Invalid user secondcoffeeinternational from 62.60.131.138 port 54610


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.130
country_id: 6252001
description:
Nov  4 09:36:52 host2 pure-ftpd[2061620]: (?@66.132.153.130) [INFO] New connection from 66.132.153.130


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 70.174.171.101
country_id: 6252001
description:
Nov  4 09:39:48 host2 dovecot[3704077]: imap-login: Disconnected: Aborted login by logging out (auth failed, 1 attempts in 3 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=70.174.171.101, lip=66.85.158.91, TLS, session=<0FOJAL1CN6FGrqtl>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.212
country_id: 6252001
description:
Nov  4 09:39:49 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=205.210.31.212, lip=66.85.158.92, TLS, session=<jWjFAL1CBvTN0h/U>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.51.219.26
country_id: 3469034
description:
2025-11-04 09:40:58 dovecot_login authenticator failed for (187-51-219-26.customer.tdatabrasil.net.br) [187.51.219.26]:34784: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.56.26
country_id: 1269750
description:
2025-11-04 09:41:13 dovecot_login authenticator failed for ([59.145.127.41]) [122.187.56.26]:57994: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.16.55
country_id: 3469034
description:
2025-11-04 09:43:09 dovecot_login authenticator failed for (177-174-16-81.user.vivozap.com.br) [177.174.16.55]:54392: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.146.217.105
country_id: 1861060
description:
2025-11-04 09:42:45 dovecot_login authenticator failed for 105.217.146.34.bc.googleusercontent.com [34.146.217.105]:46858: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.201.54.90
country_id: 3469034
description:
2025-11-04 09:50:37 dovecot_login authenticator failed for (187-51-252-236.customer.tdatabrasil.net.br) [186.201.54.90]:39269: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.149.26
country_id: 99237
description:
2025-11-04 09:50:44 dovecot_login authenticator failed for ([65.20.149.26]) [65.20.149.26]:45697: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.26.236.10
country_id: 6252001
description:
2025-11-04 09:50:49 dovecot_login authenticator failed for ([12.26.236.10]) [12.26.236.10]:54658: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.222.177.146
country_id: 6252001
description:
2025-11-04 09:50:59 dovecot_login authenticator failed for ([12.222.177.146]) [12.222.177.146]:51275: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.222
country_id: 1733045
description:
2025-11-04 09:51:18 dovecot_login authenticator failed for ([49.124.152.222]) [49.124.152.222]:44990: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.136
country_id: 130758
description:
Nov  4 10:06:07 host2 sshd[2096778]: Invalid user secondcoffeeinternational from 62.60.131.136 port 58084


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.147.10.33
country_id: 1694008
description:
2025-11-04 10:08:30 dovecot_login authenticator failed for ([115.147.10.33]) [115.147.10.33]:60352: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.115.70
country_id: 1269750
description:
2025-11-04 10:08:49 dovecot_login authenticator failed for ([59.145.114.129]) [182.95.115.70]:54196: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.136
country_id: 6252001
description:
Nov  4 10:10:21 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.136, lip=66.85.158.92, TLS: Connection closed, session=<itTxbb1CVuNChJmI>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.59.157
country_id: 3277605
description:
2025-11-04 10:15:28 dovecot_login authenticator failed for ([195.222.59.157]) [195.222.59.157]:45848: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.51.42
country_id: 1149361
description:
2025-11-04 10:15:54 dovecot_login authenticator failed for ([149.54.51.42]) [149.54.51.42]:40467: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.204.193
country_id: 99237
description:
2025-11-04 10:21:48 dovecot_plain authenticator failed for (acclatte) [65.20.204.193]:53972: 535 Incorrect authentication data (set_id=it@euroentertainmentlk.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.73
country_id: 2635167
description:
Nov  4 10:23:40 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 46 secs): user=<>, rip=35.203.211.73, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<HLaTnb1CWMkjy9NJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.73
country_id: 2635167
description:
Nov  4 10:24:20 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed: read(size=429) failed: Connection reset by peer (no auth attempts in 6 secs): user=<>, rip=35.203.211.73, lip=66.85.158.92, TLS: read(size=429) failed: Connection reset by peer, session=<pwD+n71ChOEjy9NJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.193
country_id: 6252001
description:
Nov  4 10:27:44 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.193, lip=66.85.158.92, session=<4yQnrL1CPUVAPpzB>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.192
country_id: 6252001
description:
Nov  4 10:27:58 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.192, lip=66.85.158.92, TLS: Connection closed, session=<Kqn7rL1CuupAPpzA>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.73
country_id: 2635167
description:
Nov  4 10:30:56 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.203.211.73, lip=66.85.158.92, TLS, session=<+ZaUt71CrPAjy9NJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2025-11-04 10:37:21 dovecot_plain authenticator failed for (tromace) [102.53.15.17]:46343: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.225.62.25
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 98.225.62.25 - anandaob "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: User anandaob has their account suspended. Login blocked.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 123.231.122.36
country_id: 1227603
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 123.231.122.36 - anandaob "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: User anandaob has their account suspended. Login blocked.


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.27
country_id: 2635167
description:
Nov  4 10:49:05 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 46 secs): user=<>, rip=35.203.211.27, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<kyR9+L1CU9Yjy9Mb>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 20.65.193.163
country_id: 6252001
description:
Nov  4 10:50:01 host2 pure-ftpd[2150751]: (?@20.65.193.163) [INFO] New connection from 20.65.193.163


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.27
country_id: 2635167
description:
Nov  4 10:49:38 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 15 secs): user=<>, rip=35.203.211.27, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<Cdl1+r1CKOcjy9Mb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.27
country_id: 2635167
description:
Nov  4 10:50:25 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed: read(size=429) failed: Connection reset by peer (no auth attempts in 15 secs): user=<>, rip=35.203.211.27, lip=66.85.158.91, TLS: read(size=429) failed: Connection reset by peer, session=<yMBF/b1CRO0jy9Mb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.54.85.220
country_id: 294640
description:
2025-11-04 10:52:35 dovecot_login authenticator failed for (2-54-85-220.orange.net.il) [2.54.85.220]:44668: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.64.65.30
country_id: 2264397
description:
2025-11-04 10:52:57 dovecot_login authenticator failed for bl23-65-30.dsl.telepac.pt [144.64.65.30]:4488: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.27
country_id: 2635167
description:
Nov  4 10:56:42 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=35.203.211.27, lip=66.85.158.91, TLS, session=<gvu3E75CAOQjy9Mb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.27
country_id: 2635167
description:
Nov  4 10:57:42 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.203.211.27, lip=66.85.158.91, TLS, session=<gFZPF75CFvcjy9Mb>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 132.145.159.15
country_id: 6252001
description:
Nov  4 11:13:05 host2 pure-ftpd[2179438]: (?@132.145.159.15) [INFO] New connection from 132.145.159.15


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 132.145.159.15
country_id: 6252001
description:
Nov  4 11:13:04 host2 sshd[2179410]: User cloudtourssrilan from 132.145.159.15 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.60
country_id: 1733045
description:
2025-11-04 11:17:38 dovecot_login authenticator failed for ([49.124.153.60]) [49.124.153.60]:53080: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.12
country_id: 1733045
description:
2025-11-04 11:17:56 dovecot_login authenticator failed for ([49.124.153.12]) [49.124.153.12]:41836: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.166.50.15
country_id: 453733
description:
2025-11-04 11:17:15 dovecot_login authenticator failed for 15-50-166-83.dyn.estpak.ee [83.166.50.15]:42501: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.238.92.245
country_id: 2623032
description:
2025-11-04 11:19:13 dovecot_plain authenticator failed for (fersate) [84.238.92.245]:43665: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.255
country_id: 6252001
description:
Nov  4 11:28:08 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=205.210.31.255, lip=66.85.158.92, TLS, session=<yZUihL5CrvbN0h//>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-04 11:40:48 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:58018: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 132.145.159.15
country_id: 6252001
description:
Nov  4 11:42:40 host2 pure-ftpd[2213597]: (?@132.145.159.15) [INFO] New connection from 132.145.159.15


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 132.145.159.15
country_id: 6252001
description:
Nov  4 11:42:39 host2 sshd[2213568]: User cloudtourssrilan from 132.145.159.15 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.181
country_id: 6252001
description:
Nov  4 11:44:28 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.181, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<d2eOvr5Cu8rN0h+1>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  4 11:54:46 host2 sshd[2230194]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  4 12:06:31 host2 sshd[2244580]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 72.14.178.148
country_id: 6252001
description:
Nov  4 12:06:35 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 9 secs): user=<>, rip=72.14.178.148, lip=66.85.158.91, TLS handshaking: read(size=1026) failed: Connection reset by peer, session=<gFGkDb9CIMNIDrKU>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 212.102.40.218
country_id: 6252001
description:
Nov  4 12:10:01 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=212.102.40.218, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<WXXtGb9CLoXUZija>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov  4 12:17:22 host2 sshd[2257741]: Disconnected from invalid user user 2.57.121.25 port 8151 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.135
country_id: 6252001
description:
Nov  4 12:31:48 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.135, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<0wDUZ79CiszN0h+H>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.215.38
country_id: 1269750
description:
2025-11-04 12:39:49 dovecot_login authenticator failed for ([182.79.35.233]) [128.185.215.38]:59946: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.89.211.172
country_id: 1522867
description:
2025-11-04 12:40:05 dovecot_login authenticator failed for 178.89.211.172.dynamic.telecom.kz [178.89.211.172]:54997: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.187.47
country_id: 99237
description:
2025-11-04 12:39:21 dovecot_login authenticator failed for ([65.20.187.47]) [65.20.187.47]:42940: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.115.128.149
country_id: 3469034
description:
2025-11-04 12:39:35 dovecot_login authenticator failed for (189.115.128.149.static.host.gvt.net.br) [189.115.128.149]:51982: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov  4 12:40:17 host2 sshd[2284281]: Disconnected from invalid user user 2.57.121.25 port 43652 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  4 12:42:47 host2 sshd[2287046]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.138
country_id: 130758
description:
Nov  4 12:45:15 host2 sshd[2290201]: Invalid user secondcoffeeinternational from 62.60.131.138 port 48230


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.104
country_id: 6252001
description:
Nov  4 12:53:35 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=198.235.24.104, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<2+XCtb9CO8PG6xho>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.236.228.111
country_id: 6252001
description:
Nov  4 12:59:34 host2 dovecot[3704077]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=172.236.228.111, lip=66.85.158.92, TLS, session=<C+Yjy79C/p6s7ORv>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.128
country_id: 2635167
description:
Nov  4 13:01:36 host2 dovecot[3704077]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=87.236.176.128, lip=66.85.158.92, TLS, session=<sDpl0r9CtddX7LCA>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.41
country_id: 2635167
description:
Nov  4 13:01:37 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.41, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<rHN40r9CG9G594kp>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.40
country_id: 2635167
description:
Nov  4 13:02:10 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.40, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<arZz1L9CAbq594ko>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.43.33.218
country_id: 1819730
description:
Nov  4 13:02:23 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=45.43.33.218, lip=66.85.158.92, TLS handshaking: Connection closed, session=<Fbg51b9C95YtKyHa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.64
country_id: 2635167
description:
Nov  4 13:02:44 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed: read(size=679) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=185.247.137.64, lip=66.85.158.92, TLS handshaking: read(size=679) failed: Connection reset by peer, session=<DApv1r9C2YW594lA>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.48
country_id: 2635167
description:
Nov  4 13:03:50 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=87.236.176.48, lip=66.85.158.92, TLS handshaking: Connection closed, session=<47dl2r9CnbdX7LAw>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.60
country_id: 2635167
description:
Nov  4 13:03:17 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed: read(size=693) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.60, lip=66.85.158.92, TLS handshaking: read(size=693) failed: Connection reset by peer, session=<ymRq2L9CW6NX7LA8>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.55
country_id: 2635167
description:
Nov  4 13:04:23 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=87.236.176.55, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<rR1f3L9C9YpX7LA3>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.68
country_id: 2635167
description:
Nov  4 13:04:57 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=185.247.137.68, lip=66.85.158.92, TLS handshaking: Connection closed, session=<q01c3r9Co9W594lE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.64
country_id: 2635167
description:
Nov  4 13:05:30 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.64, lip=66.85.158.92, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<hpVX4L9CP7O594lA>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.68
country_id: 2635167
description:
Nov  4 13:06:03 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=185.247.137.68, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<zvNQ4r9CX8W594lE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.72
country_id: 2635167
description:
Nov  4 13:06:37 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=185.247.137.72, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<C6tb5L9CPay594lI>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 132.145.159.15
country_id: 6252001
description:
Nov  4 13:06:44 host2 pure-ftpd[2316420]: (?@132.145.159.15) [INFO] New connection from 132.145.159.15


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 132.145.159.15
country_id: 6252001
description:
Nov  4 13:06:43 host2 sshd[2316400]: User cloudtourssrilan from 132.145.159.15 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.236.228.115
country_id: 6252001
description:
Nov  4 13:07:12 host2 dovecot[3704077]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=172.236.228.115, lip=66.85.158.91, TLS, session=<+nZr5r9C/Has7ORz>


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 132.145.159.15
country_id: 6252001
description:
Nov  4 13:10:06 host2 sshd[2320229]: User cloudtourssrilan from 132.145.159.15 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 132.145.159.15
country_id: 6252001
description:
Nov  4 13:10:07 host2 pure-ftpd[2320292]: (?@132.145.159.15) [INFO] New connection from 132.145.159.15


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.226.118.0
country_id: 3469034
description:
2025-11-04 13:11:09 dovecot_login authenticator failed for ([38.226.118.9]) [38.226.118.0]:33802: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.197.174
country_id: 1269750
description:
2025-11-04 13:11:44 dovecot_login authenticator failed for ([152.52.197.174]) [152.52.197.174]:39104: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.164.107.5
country_id: 6252001
description:
Nov  4 13:14:26 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=194.164.107.5, lip=66.85.158.91, TLS: Connection closed, session=<GvBJAMBCWOLCpGsF>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.136
country_id: 130758
description:
Nov  4 13:18:39 host2 sshd[2330671]: Invalid user secondcoffeeinternational from 62.60.131.136 port 49498


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.0.90.81
country_id: 2077456
description:
2025-11-04 13:20:50 dovecot_login authenticator failed for 210.0.90.81.static.nexnet.net.au [210.0.90.81]:54052: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 49.42.182.209
country_id: 1269750
description:
Nov  4 13:22:00 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=49.42.182.209, lip=66.85.158.91, TLS, session=<CvpjG8BCxeExKrbR>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 103.46.7.248
country_id: 1643084
description:
Nov  4 13:22:04 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=103.46.7.248, lip=66.85.158.91, TLS, session=<h/GTG8BC5tRnLgf4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.203.37.70
country_id: 3686110
description:
Nov  4 13:22:07 host2 dovecot[3704077]: imap-login: Disconnected: Aborted login by logging out (auth failed, 1 attempts in 2 secs): user=<washeera@lezzarotech.com>, method=PLAIN, rip=152.203.37.70, lip=66.85.158.91, TLS, session=<5DSuG8BCs8CYyyVG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.203.37.70
country_id: 3686110
description:
Nov  4 13:22:19 host2 dovecot[3704077]: imap-login: Disconnected: Aborted login by logging out (auth failed, 1 attempts in 6 secs): user=<washeera@lezzarotech.com>, method=PLAIN, rip=152.203.37.70, lip=66.85.158.91, TLS, session=<HuscHMBCt8CYyyVG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 157.50.68.13
country_id: 1269750
description:
Nov  4 13:24:29 host2 dovecot[3704077]: imap-login: Disconnected: Aborted login by logging out (auth failed, 1 attempts in 3 secs): user=<washeera@lezzarotech.com>, method=PLAIN, rip=157.50.68.13, lip=66.85.158.91, TLS, session=<pNQSJMBCM/GdMkQN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 210.186.96.220
country_id: 1733045
description:
Nov  4 13:26:02 host2 dovecot[3704077]: imap-login: Disconnected: Aborted login by logging out (auth failed, 1 attempts in 2 secs): user=<washeera@lezzarotech.com>, method=PLAIN, rip=210.186.96.220, lip=66.85.158.91, TLS, session=<L6mtKcBCG8rSumDc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 125.209.97.189
country_id: 1168579
description:
Nov  4 13:26:51 host2 dovecot[3704077]: imap-login: Disconnected: Aborted login by logging out (auth failed, 1 attempts in 2 secs): user=<washeera@lezzarotech.com>, method=PLAIN, rip=125.209.97.189, lip=66.85.158.91, TLS, session=<fe6PLMBCSu190WG9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 157.50.68.13
country_id: 1269750
description:
Nov  4 13:27:36 host2 dovecot[3704077]: imap-login: Disconnected: Inactivity (auth failed, 1 attempts in 179 secs): user=<washeera@lezzarotech.com>, method=PLAIN, rip=157.50.68.13, lip=66.85.158.91, TLS, session=<Mzm8JMBCRvGdMkQN>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.67
country_id: 6252001
description:
Nov  4 13:27:41 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.67, lip=66.85.158.92, session=<aie3L8BCrObN0h9D>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  4 13:30:09 host2 sshd[2344302]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  4 13:42:26 host2 sshd[2358697]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  4 13:43:25 host2 sshd[2359778]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  4 13:44:18 host2 sshd[2360870]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  4 13:45:36 host2 sshd[2362881]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  4 13:46:21 host2 sshd[2363713]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.131.165.45
country_id: 2661886
description:
2025-11-04 13:58:02 dovecot_login authenticator failed for ([88.131.165.45]) [88.131.165.45]:55610: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.130
country_id: 6252001
description:
Nov  4 14:03:54 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.130, lip=66.85.158.92, TLS: Connection closed, session=<bZ4uscBC3KNChJmC>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  4 14:15:15 host2 sshd[2399778]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  4 14:17:56 host2 sshd[2402768]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.136
country_id: 130758
description:
Nov  4 14:23:50 host2 sshd[2409556]: Invalid user secondcoffeeinternational from 62.60.131.136 port 58630


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 194.165.16.167
country_id: 2993457
description:
Nov  4 14:24:41 host2 pure-ftpd[2410521]: (?@194.165.16.167) [INFO] New connection from 194.165.16.167


plugin: ossec
rule: 2501
name: User authentication failure.
description:
2025-11-04 14:34:57 1vGCyF-0000000AAGn-2Xgy <= veneelk@host2.phenomhost.com U=veneelk P=local S=36272 id=lqqtrcPsaXpUdV9ZQCxMlyTz297CDVdNmf02SF2LsgA@coatrent.venee.lk T="Failed login by IP 64.23.228.135 www.limitloginattempts.com" for admin@venee.lk


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.3
country_id: 6252001
description:
Nov  4 14:39:13 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed: read(size=509) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=195.184.76.3, lip=66.85.158.92, TLS handshaking: read(size=509) failed: Connection reset by peer, session=<8tuBL8FCMcrDuEwD>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.230
country_id: 6252001
description:
Nov  4 14:39:27 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 14 secs): user=<>, rip=195.184.76.230, lip=66.85.158.92, TLS: Connection closed, session=<69pWMMFCudzDuEzm>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 188.165.202.189
country_id: 3017382
description:
Nov  4 14:48:33 host2 pure-ftpd[2440154]: (?@188.165.202.189) [INFO] New connection from 188.165.202.189


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.43.33.210
country_id: 1819730
description:
Nov  4 14:49:57 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=45.43.33.210, lip=66.85.158.92, TLS handshaking: Connection closed, session=<xxThVcFCLektKyHS>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.43.33.210
country_id: 1819730
description:
Nov  4 14:50:39 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=45.43.33.210, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<0VFjWMFCAZAtKyHS>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 40.124.173.173
country_id: 6252001
description:
Nov  4 14:51:13 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=40.124.173.173, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<2cJ0WsFCnIMofK2t>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.138
country_id: 130758
description:
Nov  4 14:55:27 host2 sshd[2449993]: Invalid user secondcoffeeinternational from 62.60.131.138 port 55450


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.61.225.169
country_id: 1269750
description:
Nov  4 14:56:48 host2 sshd[2451454]: Invalid user visionsolutionshospital from 103.61.225.169 port 55302


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.136.122
country_id: 1269750
description:
Nov  4 14:59:15 host2 sshd[2454198]: Invalid user visionsolutionshospital from 64.227.136.122 port 40894


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.189.235.217
country_id: 1643084
description:
Nov  4 14:59:18 host2 sshd[2454268]: Invalid user visionsolutionshospital from 103.189.235.217 port 52326


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.159.91.86
country_id: 3017382
description:
Nov  4 15:02:06 host2 sshd[2457615]: Invalid user visionsolutionshospital from 51.159.91.86 port 38139


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.236.196.180
country_id: 6252001
description:
Nov  4 15:03:01 host2 sshd[2458558]: Invalid user visionsolutionshospital from 104.236.196.180 port 46552


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.136.122
country_id: 1269750
description:
Nov  4 15:03:22 host2 sshd[2459263]: Invalid user visionsolutionshospital from 64.227.136.122 port 55062


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.136.227.147
country_id: 3469034
description:
Nov  4 15:03:26 host2 sshd[2459395]: Invalid user visionsolutionshospital from 177.136.227.147 port 32888


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov  4 15:04:49 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (disconnected before auth was ready, waited 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<KLMMi8FCTMQDgmBb>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  4 15:05:14 host2 sshd[2461635]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.146.203.212
country_id: 1643084
description:
Nov  4 15:05:17 host2 sshd[2461653]: Invalid user visionsolutionshospital from 103.146.203.212 port 52686


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.159.91.86
country_id: 3017382
description:
Nov  4 15:07:29 host2 sshd[2463978]: Invalid user visionsolutionshospital from 51.159.91.86 port 12423


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov  4 15:08:45 host2 dovecot[3704077]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, session=<t18amcFCYr8Dg9cm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov  4 15:09:28 host2 dovecot[3704077]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, session=<jva2m8FCtuUDg9cm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.53.197.53
country_id: 2921044
description:
Nov  4 15:10:10 host2 sshd[2466989]: Invalid user visionsolutionshospital from 152.53.197.53 port 59582


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov  4 15:11:11 host2 dovecot[3704077]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, session=<koHOocFCoLMDg9cm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov  4 15:11:54 host2 dovecot[3704077]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, session=<Q0FhpMFCFIEDg9cm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov  4 15:12:22 host2 dovecot[3704077]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, session=<EfAMpsFCStYDg9cm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov  4 15:13:32 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, session=<Jg4/qsFCps0Dg9cm>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.131.215.38
country_id: 6252001
description:
Nov  4 15:13:41 host2 dovecot[3704077]: imap-login: Disconnected: Input buffer full (no auth attempts in 1 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, session=<QO++qsFCZJEDg9cm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.186.147.126
country_id: 1880251
description:
Nov  4 15:14:51 host2 sshd[2472078]: Invalid user visionsolutionshospital from 35.186.147.126 port 20368


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.131.215.38
country_id: 6252001
description:
Nov  4 15:14:25 host2 dovecot[3704077]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, session=<NjxlrcFCJrEDg9cm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov  4 15:15:14 host2 dovecot[3704077]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, session=<SCFYsMFChJ0Dg9cm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.225.52.249
country_id: 290557
description:
Nov  4 15:15:38 host2 sshd[2473170]: Invalid user visionsolutionshospital from 43.225.52.249 port 57758


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-04 15:16:25 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:51587: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.253.82.89
country_id: 6252001
description:
Nov  4 15:17:59 host2 sshd[2476119]: Invalid user visionsolutionshospital from 47.253.82.89 port 34300


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.164.1.102
country_id: 1605651
description:
Nov  4 15:18:07 host2 sshd[2476338]: Invalid user visionsolutionshospital from 43.164.1.102 port 58788


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.253.96.143
country_id: 6252001
description:
Nov  4 15:18:57 host2 sshd[2477173]: Invalid user visionsolutionshospital from 47.253.96.143 port 59384


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 5.132.127.172
country_id: 2750405
description:
Nov  4 15:23:34 host2 sshd[2482361]: Invalid user visionsolutionshospital from 5.132.127.172 port 57152


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.108
country_id: 3017382
description:
Nov  4 15:25:08 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=91.231.89.108, lip=66.85.158.92, TLS handshaking: Connection closed, session=<RYSy08FCG9lb51ls>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.109
country_id: 3017382
description:
Nov  4 15:25:18 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=91.231.89.109, lip=66.85.158.92, TLS: Connection closed, session=<Tl5T1MFCX7lb51lt>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.110
country_id: 3017382
description:
Nov  4 15:25:49 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=91.231.89.110, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<wZ8q1sFCI9xb51lu>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.108
country_id: 3017382
description:
Nov  4 15:25:52 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.231.89.108, lip=66.85.158.92, TLS: Connection closed, session=<ceBa1sFC/7Rb51ls>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 71.6.146.185
country_id: 6252001
description:
Nov  4 15:32:06 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record (no auth attempts in 0 secs): user=<>, rip=71.6.146.185, lip=66.85.158.92, TLS: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record, session=<UaOj7MFCFNxHBpK5>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 71.6.146.185
country_id: 6252001
description:
Nov  4 15:32:16 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=71.6.146.185, lip=66.85.158.92, TLS, session=<+Ok+7cFCGu5HBpK5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.61.215.87
country_id: 3469034
description:
2025-11-04 15:33:40 dovecot_login authenticator failed for 201-61-215-87.bbone.telesp.net.br [201.61.215.87]:33425: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.125.169.77
country_id: 3469034
description:
2025-11-04 15:34:27 dovecot_login authenticator failed for 179-125-169-77.static.desktop.com.br [179.125.169.77]:44888: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.112.102
country_id: 1269750
description:
2025-11-04 15:45:53 dovecot_login authenticator failed for ([182.95.112.102]) [182.95.112.102]:56338: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.240.94
country_id: 1269750
description:
2025-11-04 15:46:22 dovecot_login authenticator failed for ([125.19.175.124]) [182.78.240.94]:37328: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.150.195.172
country_id: 6252001
description:
Nov  4 15:48:49 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 1 secs): user=<>, rip=20.150.195.172, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<3xZkKMJCBpMUlsOs>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  4 15:53:01 host2 sshd[2515583]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.16
country_id: 1733045
description:
2025-11-04 15:54:06 dovecot_login authenticator failed for ([49.124.153.16]) [49.124.153.16]:52876: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.93.2.86
country_id: 3469034
description:
2025-11-04 15:54:27 dovecot_login authenticator failed for (187-93-2-86.customer.tdatabrasil.net.br) [187.93.2.86]:53617: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov  4 15:55:24 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<I8T7P8JCFpkDg9cm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov  4 15:57:14 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, TLS handshaking: Connection closed, session=<rVyCRsJCMuEDg9cm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov  4 15:58:17 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (disconnected before auth was ready, waited 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<6xRMSsJCLq0Dg9cm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov  4 15:59:36 host2 dovecot[3704077]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, TLS, session=<68P2TsJCMOgDg9cm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov  4 16:01:46 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (disconnected before auth was ready, waited 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<yZy0VsJCbpoDg9cm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov  4 16:02:32 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<V9VzWcJCJrEDg9cm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov  4 16:03:17 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, TLS, session=<2foqXMJCfpUDg9cm>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 71.6.146.130
country_id: 6252001
description:
Nov  4 16:08:38 host2 dovecot[3704077]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 2 secs): user=<>, rip=71.6.146.130, lip=66.85.158.92, TLS, session=<Pz9Jb8JCMKFHBpKC>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 71.6.146.130
country_id: 6252001
description:
Nov  4 16:08:39 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record (no auth attempts in 0 secs): user=<>, rip=71.6.146.130, lip=66.85.158.92, TLS: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record, session=<05Zeb8JCpKRHBpKC>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.114
country_id: 6252001
description:
Nov  4 16:09:12 host2 pure-ftpd[2535163]: (?@66.132.153.114) [INFO] New connection from 66.132.153.114


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.88.102.128
country_id: 2661886
description:
2025-11-04 16:31:00 dovecot_login authenticator failed for (128.102.88.80.sta.ac-net.se) [80.88.102.128]:58106: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.57.183
country_id: 3277605
description:
2025-11-04 16:31:23 dovecot_login authenticator failed for ([195.222.57.183]) [195.222.57.183]:38074: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.236.163
country_id: 6252001
description:
2025-11-04 16:31:35 dovecot_plain authenticator failed for c-73-197-236-163.hsd1.nj.comcast.net (unreates) [73.197.236.163]:58492: 535 Incorrect authentication data (set_id=contact@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.152
country_id: 6252001
description:
Nov  4 16:34:04 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.152, lip=66.85.158.91, TLS handshaking: Connection closed, session=<qUhDysJCasVAPpyY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.161
country_id: 6252001
description:
Nov  4 16:33:44 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.161, lip=66.85.158.91, TLS handshaking: Connection closed, session=<gHQTycJCGzpAPpyh>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.152
country_id: 6252001
description:
Nov  4 16:34:19 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.152, lip=66.85.158.91, TLS: Connection closed, session=<Ed0qy8JCLjdAPpyY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.238.55.194
country_id: 6252001
description:
2025-11-04 16:37:20 dovecot_plain authenticator failed for (stene) [50.238.55.194]:31479: 535 Incorrect authentication data (set_id=contact@v-deploy.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  4 16:40:21 host2 sshd[2570568]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  4 16:41:30 host2 sshd[2571778]: Disconnected from invalid user drew 62.60.131.157 port 29873 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.185.102.59
country_id: 294640
description:
2025-11-04 16:47:43 dovecot_login authenticator failed for ([130.185.102.59]) [130.185.102.59]:60421: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 2501
name: User authentication failure.
description:
2025-11-04 17:01:25 1vGFG1-0000000AtAO-0W2X <= veneelk@host2.phenomhost.com U=veneelk P=local S=36260 id=50yU4Dl7YXQpMSLhG3dKqMgls0ib6kfQ1o6uhUpXo@coatrent.venee.lk T="Failed login by IP 64.23.228.135 www.limitloginattempts.com" for admin@venee.lk


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.128.241.207
country_id: 2661886
description:
2025-11-04 17:08:07 dovecot_login authenticator failed for 195-128-241-207.bredband.obenetwork.net [195.128.241.207]:58191: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.64
country_id: 1733045
description:
2025-11-04 17:08:16 dovecot_login authenticator failed for ([49.124.153.64]) [49.124.153.64]:55158: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.237.115.208
country_id: 732800
description:
2025-11-04 17:08:25 dovecot_login authenticator failed for (151.237.115.208.pronet.bg) [151.237.115.208]:58753: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.249.76.221
country_id: 1269750
description:
2025-11-04 17:08:30 dovecot_login authenticator failed for (static-221.76.249.49-tataidc.co.in) [49.249.76.221]:58374: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.212
country_id: 1819730
description:
2025-11-04 17:13:59 dovecot_login authenticator failed for 212.42.246.220.static.netvigator.com [220.246.42.212]:49917: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.49.186
country_id: 1269750
description:
2025-11-04 17:14:26 dovecot_login authenticator failed for ([182.95.49.186]) [182.95.49.186]:42290: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.146.122.49
country_id: 3175395
description:
2025-11-04 17:23:30 dovecot_login authenticator failed for net-93-146-122-49.cust.vodafonedsl.it [93.146.122.49]:4941: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.151.32.99
country_id: 6252001
description:
2025-11-04 17:23:59 dovecot_login authenticator failed for c-76-151-32-99.hsd1.md.comcast.net [76.151.32.99]:60790: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  4 17:28:23 host2 sshd[2626689]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.31.38.185
country_id: 290557
description:
2025-11-04 17:32:22 dovecot_plain authenticator failed for (sonfrulah) [5.31.38.185]:57170: 535 Incorrect authentication data (set_id=contact@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.163.2.151
country_id: 6252001
description:
Nov  4 17:37:21 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.163.2.151, lip=66.85.158.91, TLS handshaking: Connection closed, session=<BZKPrMNCIsIUowKX>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 71.6.134.231
country_id: 6252001
description:
Nov  4 17:38:41 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=71.6.134.231, lip=66.85.158.91, session=<ielSscNC/NBHBobn>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.8.245.34
country_id: 2017370
description:
2025-11-04 17:41:06 dovecot_login authenticator failed for ([46.8.245.34]) [46.8.245.34]:35540: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.231.137.43
country_id: 1643084
description:
2025-11-04 17:41:33 dovecot_login authenticator failed for ([123.231.137.43]) [123.231.137.43]:19009: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov  4 17:42:23 host2 sshd[2642801]: Disconnected from invalid user user 2.57.121.25 port 15055 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.202.117.220
country_id: 6252001
description:
Nov  4 17:51:47 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=172.202.117.220, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<TQsv4MNCSLysynXc>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  4 17:53:34 host2 sshd[2657182]: Disconnected from invalid user rachelle 62.60.131.157 port 64526 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.199.163.128
country_id: 2635167
description:
2025-11-04 17:57:26 dovecot_login authenticator failed for 128.163.199.146.dyn.plus.net [146.199.163.128]:35656: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.184.33.86
country_id: 3469034
description:
2025-11-04 17:57:41 dovecot_login authenticator failed for 179.184.33.86.static.gvt.net.br (accera.static.gvt.net.br) [179.184.33.86]:52795: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.229.1.186
country_id: 6252001
description:
2025-11-04 17:57:56 dovecot_login authenticator failed for c-71-229-1-186.hsd1.al.comcast.net [71.229.1.186]:49998: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 71.6.146.130
country_id: 6252001
description:
Nov  4 18:05:00 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record (no auth attempts in 0 secs): user=<>, rip=71.6.146.130, lip=66.85.158.91, TLS: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record, session=<m25vD8RCRoBHBpKC>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 71.6.146.130
country_id: 6252001
description:
Nov  4 18:04:59 host2 dovecot[3704077]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 2 secs): user=<>, rip=71.6.146.130, lip=66.85.158.91, TLS, session=<TkpqD8RCEutHBpKC>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 71.6.146.130
country_id: 6252001
description:
Nov  4 18:05:07 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=71.6.146.130, lip=66.85.158.91, TLS handshaking: Connection closed, session=<MS7gD8RCDotHBpKC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.177.147.177
country_id: 357994
description:
2025-11-04 18:10:23 dovecot_plain authenticator failed for (imbostled) [154.177.147.177]:33188: 535 Incorrect authentication data (set_id=contact@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.225.30.107
country_id: 2661886
description:
2025-11-04 18:10:28 dovecot_plain authenticator failed for 81-225-30-107-no2380.tbcn.telia.com (psonorake) [81.225.30.107]:50361: 535 Incorrect authentication data (set_id=contact@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  4 18:15:57 host2 sshd[2683840]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 188.214.125.55
country_id: 1694008
description:
Nov  4 18:17:54 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=188.214.125.55, lip=66.85.158.91, TLS handshaking: Connection closed, session=<9/6aPcRCiIG81n03>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 176.125.229.135
country_id: 3194884
description:
Nov  4 18:17:58 host2 dovecot[3704077]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=176.125.229.135, lip=66.85.158.91, session=<+DPQPcRCaNiwfeWH>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.132.194.17
country_id: 597427
description:
Nov  4 18:18:00 host2 dovecot[3704077]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=45.132.194.17, lip=66.85.158.91, session=<lxrqPcRCSskthMIR>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 31.171.152.103
country_id: 783754
description:
Nov  4 18:17:54 host2 dovecot[3704077]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=31.171.152.103, lip=66.85.158.91, session=<CamSPcRC4rkfq5hn>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 138.199.59.151
country_id: 798544
description:
Nov  4 18:17:55 host2 pure-ftpd[2685858]: (?@138.199.59.151) [INFO] New connection from 138.199.59.151


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 178.175.142.134
country_id: 617790
description:
Nov  4 18:17:54 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=178.175.142.134, lip=66.85.158.91, TLS, session=<gbSZPcRCmIGyr46G>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 188.126.94.240
country_id: 2623032
description:
Nov  4 18:17:58 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=188.126.94.240, lip=66.85.158.91, TLS, session=<bWPSPcRCtne8fl7w>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 79.127.175.20
country_id: 390903
description:
Nov  4 18:17:58 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=79.127.175.20, lip=66.85.158.91, TLS, session=<Y4nUPcRClJdPf68U>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 188.214.122.68
country_id: 357994
description:
Nov  4 18:18:00 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=188.214.122.68, lip=66.85.158.91, session=<zbPtPcRCQMm81npE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 149.34.242.250
country_id: 2963597
description:
Nov  4 18:17:54 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=149.34.242.250, lip=66.85.158.91, session=<jamVPcRC2rmVIvL6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.154.153.22
country_id: 3923057
description:
Nov  4 18:18:19 host2 dovecot[3704077]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=45.154.153.22, lip=66.85.158.91, session=<o94TP8RCxMotmpkW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 95.181.236.141
country_id: 614540
description:
Nov  4 18:18:19 host2 dovecot[3704077]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=95.181.236.141, lip=66.85.158.91, session=<su4UP8RCHoZfteyN>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 188.214.122.68
country_id: 357994
description:
Nov  4 18:18:19 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=188.214.122.68, lip=66.85.158.91, session=<puoWP8RCvMq81npE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.64.98.14
country_id: 1655842
description:
Nov  4 18:18:19 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.64.98.14, lip=66.85.158.91, session=<6BYZP8RCHIZAQGIO>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 95.181.236.141
country_id: 614540
description:
Nov  4 18:18:16 host2 pure-ftpd[2686274]: (?@95.181.236.141) [INFO] New connection from 95.181.236.141


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 173.244.32.22
country_id: 3508796
description:
Nov  4 18:18:15 host2 pure-ftpd[2686269]: (?@173.244.32.22) [INFO] New connection from 173.244.32.22


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.132.194.17
country_id: 597427
description:
Nov  4 18:19:46 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=45.132.194.17, lip=66.85.158.91, session=<DkNCRMRCuI0thMIR>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 138.199.30.24
country_id: 2635167
description:
Nov  4 18:19:49 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=138.199.30.24, lip=66.85.158.91, TLS handshaking: Connection closed, session=<MI5yRMRCAIuKxx4Y>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 191.96.168.41
country_id: 2750405
description:
Nov  4 18:19:20 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=191.96.168.41, lip=66.85.158.91, session=<Dhe4QsRCwo6/YKgp>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 31.171.152.103
country_id: 783754
description:
Nov  4 18:19:46 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=31.171.152.103, lip=66.85.158.91, session=<c1c+RMRCVtgfq5hn>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 188.241.80.132
country_id: 1814991
description:
Nov  4 18:19:45 host2 dovecot[3704077]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=188.241.80.132, lip=66.85.158.91, session=<0sM5RMRCZNi88VCE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 89.187.162.180
country_id: 1880251
description:
Nov  4 18:19:46 host2 dovecot[3704077]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=89.187.162.180, lip=66.85.158.91, session=<Ek07RMRCvI1Zu6K0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 173.244.32.22
country_id: 3508796
description:
Nov  4 18:19:47 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=173.244.32.22, lip=66.85.158.91, TLS handshaking: Connection closed, session=<z3RLRMRC9MSt9CAW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 178.175.142.134
country_id: 617790
description:
Nov  4 18:19:45 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=178.175.142.134, lip=66.85.158.91, TLS handshaking: Connection closed, session=<FtI3RMRCJJ6yr46G>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.253.97.244
country_id: 3144096
description:
Nov  4 18:19:45 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=185.253.97.244, lip=66.85.158.91, TLS, session=<KKg3RMRCNJ65/WH0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 138.199.59.151
country_id: 798544
description:
Nov  4 18:19:48 host2 dovecot[3704077]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=138.199.59.151, lip=66.85.158.91, session=<YJ9fRMRC1LWKxzuX>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 95.181.236.149
country_id: 614540
description:
Nov  4 18:19:16 host2 pure-ftpd[2687216]: (?@95.181.236.149) [INFO] New connection from 95.181.236.149


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 188.126.94.233
country_id: 2623032
description:
Nov  4 18:19:20 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=188.126.94.233, lip=66.85.158.91, TLS handshaking: Connection closed, session=<TlK4QsRCkrC8fl7p>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 173.244.32.22
country_id: 3508796
description:
Nov  4 18:20:55 host2 dovecot[3704077]: pop3-login: Disconnected: Inactivity (no auth attempts in 180 secs): user=<>, rip=173.244.32.22, lip=66.85.158.91, session=<tfdjSMRCUtit9CAW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.132.194.17
country_id: 597427
description:
Nov  4 18:20:55 host2 dovecot[3704077]: pop3-login: Disconnected: Inactivity (no auth attempts in 180 secs): user=<>, rip=45.132.194.17, lip=66.85.158.91, TLS handshaking, session=<fMJlSMRCROUthMIR>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.150.8.174
country_id: 1522867
description:
2025-11-04 18:39:40 dovecot_plain authenticator failed for 37.150.8.174.dynamic.telecom.kz (hyrive) [37.150.8.174]:37240: 535 Incorrect authentication data (set_id=contact@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.148.28
country_id: 1733045
description:
2025-11-04 18:40:05 dovecot_login authenticator failed for ([49.124.148.28]) [49.124.148.28]:59594: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.218.14
country_id: 1269750
description:
2025-11-04 18:40:31 dovecot_login authenticator failed for ([128.185.217.24]) [128.185.218.14]:58892: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.32.122.27
country_id: 597427
description:
Nov  4 18:48:20 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=194.32.122.27, lip=66.85.158.91, TLS, session=<AIdrqsRCItHCIHob>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.154.153.22
country_id: 3923057
description:
Nov  4 18:48:20 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=45.154.153.22, lip=66.85.158.91, TLS handshaking: Connection closed, session=<dxRrqsRCENEtmpkW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 89.187.162.180
country_id: 1880251
description:
Nov  4 18:48:20 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=89.187.162.180, lip=66.85.158.91, session=<Y7FyqsRC6JdZu6K0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 216.24.213.197
country_id: 6252001
description:
Nov  4 18:48:20 host2 dovecot[3704077]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=216.24.213.197, lip=66.85.158.91, session=<VCxuqsRC+JfYGNXF>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 216.24.213.197
country_id: 6252001
description:
Nov  4 18:48:17 host2 pure-ftpd[2722598]: (?@216.24.213.197) [INFO] New connection from 216.24.213.197


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.154.153.22
country_id: 3923057
description:
Nov  4 18:53:05 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=45.154.153.22, lip=66.85.158.91, session=<yeFmu8RCCL4tmpkW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 188.126.94.240
country_id: 2623032
description:
Nov  4 18:53:05 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=188.126.94.240, lip=66.85.158.91, TLS, session=<OaZpu8RC5pO8fl7w>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 216.24.213.197
country_id: 6252001
description:
Nov  4 18:53:05 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=216.24.213.197, lip=66.85.158.91, TLS handshaking: Connection closed, session=<5XJpu8RC1pPYGNXF>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 176.125.229.135
country_id: 3194884
description:
Nov  4 18:52:40 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=176.125.229.135, lip=66.85.158.91, session=<Z4TrucRC+MqwfeWH>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 188.215.235.45
country_id: 1831722
description:
Nov  4 18:52:40 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=188.215.235.45, lip=66.85.158.91, TLS, session=<lE/tucRC/KO81+st>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 173.244.42.162
country_id: 1835841
description:
Nov  4 18:52:40 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=173.244.42.162, lip=66.85.158.91, TLS handshaking: Connection closed, session=<DMnsucRC8KOt9Cqi>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 138.199.30.24
country_id: 2635167
description:
Nov  4 18:53:05 host2 dovecot[3704077]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=138.199.30.24, lip=66.85.158.91, session=<KTFku8RCDL6Kxx4Y>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 173.239.201.3
country_id: 1605651
description:
Nov  4 18:52:39 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=173.239.201.3, lip=66.85.158.91, TLS handshaking: Connection closed, session=<h9HZucRCAJat78kD>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 98.159.36.6
country_id: 3277605
description:
Nov  4 18:52:39 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=98.159.36.6, lip=66.85.158.91, TLS, session=<EODXucRCFpZinyQG>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.32.122.10
country_id: 597427
description:
Nov  4 18:53:59 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=194.32.122.10, lip=66.85.158.91, TLS, session=<rOikvsRC4NfCIHoK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 176.125.229.135
country_id: 3194884
description:
Nov  4 18:53:59 host2 dovecot[3704077]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=176.125.229.135, lip=66.85.158.91, session=<1cqgvsRCet+wfeWH>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 196.196.53.28
country_id: 458258
description:
Nov  4 18:53:59 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=196.196.53.28, lip=66.85.158.91, session=<+jelvsRCduLExDUc>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 173.244.42.162
country_id: 1835841
description:
Nov  4 18:53:59 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=173.244.42.162, lip=66.85.158.91, session=<WRmlvsRCeN+t9Cqi>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.243.174
country_id: 732800
description:
2025-11-04 18:53:27 dovecot_plain authenticator failed for (untholord) [92.62.243.174]:45489: 535 Incorrect authentication data (set_id=contact@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 31.171.152.103
country_id: 783754
description:
Nov  4 18:53:55 host2 pure-ftpd[2729705]: (?@31.171.152.103) [INFO] New connection from 31.171.152.103


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 188.241.80.132
country_id: 1814991
description:
Nov  4 18:53:59 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=188.241.80.132, lip=66.85.158.91, TLS handshaking: Connection closed, session=<d2OmvsRC0te88VCE>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 188.126.94.240
country_id: 2623032
description:
Nov  4 18:55:24 host2 pure-ftpd[2731957]: (?@188.126.94.240) [INFO] New connection from 188.126.94.240


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 84.17.56.168
country_id: 1819730
description:
Nov  4 18:55:52 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=84.17.56.168, lip=66.85.158.91, session=<q6hYxcRCiphUETio>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 188.215.235.45
country_id: 1831722
description:
Nov  4 18:55:53 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=188.215.235.45, lip=66.85.158.91, session=<wFVtxcRC3qW81+st>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 173.239.201.3
country_id: 1605651
description:
Nov  4 18:55:53 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=173.239.201.3, lip=66.85.158.91, TLS handshaking: Connection closed, session=<H4xtxcRCIOet78kD>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 188.126.94.240
country_id: 2623032
description:
Nov  4 18:55:51 host2 dovecot[3704077]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=188.126.94.240, lip=66.85.158.91, session=<W4BUxcRCjJi8fl7w>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.64.98.14
country_id: 1655842
description:
Nov  4 18:55:53 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=64.64.98.14, lip=66.85.158.91, TLS handshaking: Connection closed, session=<botsxcRC9OpAQGIO>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 194.32.122.27
country_id: 597427
description:
Nov  4 18:55:25 host2 pure-ftpd[2731961]: (?@194.32.122.27) [INFO] New connection from 194.32.122.27


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 138.199.59.151
country_id: 798544
description:
Nov  4 18:58:52 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=138.199.59.151, lip=66.85.158.91, session=<JyMb0MRCSsSKxzuX>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.32.122.10
country_id: 597427
description:
Nov  4 18:58:52 host2 dovecot[3704077]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=194.32.122.10, lip=66.85.158.91, session=<QckX0MRCBDDCIHoK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 95.181.234.143
country_id: 289688
description:
Nov  4 18:58:54 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=95.181.234.143, lip=66.85.158.91, session=<FTY10MRCWIBfteqP>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 173.239.201.3
country_id: 1605651
description:
Nov  4 18:58:50 host2 pure-ftpd[2735709]: (?@173.239.201.3) [INFO] New connection from 173.239.201.3


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 95.181.234.143
country_id: 289688
description:
Nov  4 18:58:51 host2 pure-ftpd[2735733]: (?@95.181.234.143) [INFO] New connection from 95.181.234.143


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 178.175.142.134
country_id: 617790
description:
Nov  4 18:58:54 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=178.175.142.134, lip=66.85.158.91, TLS handshaking: Connection closed, session=<bTMx0MRCbsyyr46G>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 173.239.201.3
country_id: 1605651
description:
Nov  4 18:58:54 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=173.239.201.3, lip=66.85.158.91, TLS handshaking: Connection closed, session=<rK410MRCptqt78kD>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 173.239.201.3
country_id: 1605651
description:
Nov  4 18:59:44 host2 dovecot[3704077]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=173.239.201.3, lip=66.85.158.91, session=<KG8408RCIL+t78kD>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 188.215.235.53
country_id: 1831722
description:
Nov  4 18:59:45 host2 dovecot[3704077]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=188.215.235.53, lip=66.85.158.91, session=<LdxA08RCYta81+s1>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 95.181.234.143
country_id: 289688
description:
Nov  4 18:59:43 host2 pure-ftpd[2736897]: (?@95.181.234.143) [INFO] New connection from 95.181.234.143


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 188.126.94.240
country_id: 2623032
description:
Nov  4 18:59:45 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=188.126.94.240, lip=66.85.158.91, session=<b2g908RCWNa8fl7w>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 79.127.175.20
country_id: 390903
description:
Nov  4 18:59:45 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=79.127.175.20, lip=66.85.158.91, TLS handshaking: Connection closed, session=<gOE908RCyIFPf68U>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 173.244.42.162
country_id: 1835841
description:
Nov  4 18:59:45 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=173.244.42.162, lip=66.85.158.91, session=<Xcg908RCEr+t9Cqi>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 45.154.153.22
country_id: 3923057
description:
Nov  4 18:59:42 host2 pure-ftpd[2736875]: (?@45.154.153.22) [INFO] New connection from 45.154.153.22


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 79.127.175.20
country_id: 390903
description:
Nov  4 19:02:38 host2 pure-ftpd[2740593]: (?@79.127.175.20) [INFO] New connection from 79.127.175.20


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 95.181.236.141
country_id: 614540
description:
Nov  4 19:02:34 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=95.181.236.141, lip=66.85.158.91, session=<PORN3cRCSsJfteyN>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 196.196.53.29
country_id: 458258
description:
Nov  4 19:02:35 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=196.196.53.29, lip=66.85.158.91, session=<dGpj3cRCrsbExDUd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 79.127.175.20
country_id: 390903
description:
Nov  4 19:02:40 host2 dovecot[3704077]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=79.127.175.20, lip=66.85.158.91, session=<gy+r3cRC1r9Pf68U>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 95.181.234.143
country_id: 289688
description:
Nov  4 19:02:34 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=95.181.234.143, lip=66.85.158.91, TLS, session=<uUBU3cRCBONfteqP>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 84.17.56.168
country_id: 1819730
description:
Nov  4 19:02:35 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=84.17.56.168, lip=66.85.158.91, TLS handshaking: Connection closed, session=<Wrtn3cRC4rFUETio>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 196.196.53.29
country_id: 458258
description:
Nov  4 19:02:37 host2 pure-ftpd[2740560]: (?@196.196.53.29) [INFO] New connection from 196.196.53.29


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 89.187.162.180
country_id: 1880251
description:
Nov  4 19:02:41 host2 dovecot[3704077]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=89.187.162.180, lip=66.85.158.91, session=<2q683cRC0ItZu6K0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 173.244.42.162
country_id: 1835841
description:
Nov  4 19:02:41 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=173.244.42.162, lip=66.85.158.91, TLS handshaking: Connection closed, session=<EzC+3cRC5s2t9Cqi>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 196.196.53.28
country_id: 458258
description:
Nov  4 19:02:42 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=196.196.53.28, lip=66.85.158.91, session=<YmjS3cRCzOzExDUc>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 176.125.229.135
country_id: 3194884
description:
Nov  4 19:02:34 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=176.125.229.135, lip=66.85.158.91, TLS handshaking: Connection closed, session=<J6BS3cRC9uKwfeWH>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 188.214.125.55
country_id: 1694008
description:
Nov  4 19:02:35 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=188.214.125.55, lip=66.85.158.91, TLS handshaking: Connection closed, session=<bX5p3cRC7LG81n03>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 45.132.194.17
country_id: 597427
description:
Nov  4 19:02:37 host2 pure-ftpd[2740540]: (?@45.132.194.17) [INFO] New connection from 45.132.194.17


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 31.171.152.103
country_id: 783754
description:
Nov  4 19:02:33 host2 dovecot[3704077]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=31.171.152.103, lip=66.85.158.91, session=<7eVK3cRCUMIfq5hn>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 149.34.242.250
country_id: 2963597
description:
Nov  4 19:03:59 host2 pure-ftpd[2742514]: (?@149.34.242.250) [INFO] New connection from 149.34.242.250


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 37.19.223.28
country_id: 2782113
description:
Nov  4 19:04:01 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=37.19.223.28, lip=66.85.158.91, session=<GHN+4sRC4sQlE98c>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 95.181.236.141
country_id: 614540
description:
Nov  4 19:04:01 host2 dovecot[3704077]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=95.181.236.141, lip=66.85.158.91, session=<VCt74sRC8sRfteyN>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 31.171.152.103
country_id: 783754
description:
Nov  4 19:04:02 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=31.171.152.103, lip=66.85.158.91, TLS handshaking: Connection closed, session=<00KW4sRC+usfq5hn>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  4 19:04:10 host2 sshd[2742802]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 196.196.53.29
country_id: 458258
description:
Nov  4 19:04:26 host2 pure-ftpd[2743211]: (?@196.196.53.29) [INFO] New connection from 196.196.53.29


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 138.199.59.151
country_id: 798544
description:
Nov  4 19:04:26 host2 pure-ftpd[2743206]: (?@138.199.59.151) [INFO] New connection from 138.199.59.151


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.64.98.14
country_id: 1655842
description:
Nov  4 19:04:30 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=64.64.98.14, lip=66.85.158.91, TLS handshaking: Connection closed, session=<KnQ95MRC1uZAQGIO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 216.24.213.197
country_id: 6252001
description:
Nov  4 19:04:36 host2 dovecot[3704077]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=216.24.213.197, lip=66.85.158.91, session=<OCic5MRCZNLYGNXF>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.132.194.17
country_id: 597427
description:
Nov  4 19:04:39 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=45.132.194.17, lip=66.85.158.91, TLS handshaking: Connection closed, session=<ydnM5MRCVoMthMIR>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 79.127.175.20
country_id: 390903
description:
Nov  4 19:04:29 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=79.127.175.20, lip=66.85.158.91, session=<6yMo5MRCSpNPf68U>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 31.171.152.103
country_id: 783754
description:
Nov  4 19:04:28 host2 dovecot[3704077]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=31.171.152.103, lip=66.85.158.91, session=<2psk5MRCTpMfq5hn>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 31.171.152.103
country_id: 783754
description:
Nov  4 19:04:35 host2 pure-ftpd[2743377]: (?@31.171.152.103) [INFO] New connection from 31.171.152.103


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.32.122.10
country_id: 597427
description:
Nov  4 19:04:36 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=194.32.122.10, lip=66.85.158.91, session=<56uf5MRC9KLCIHoK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.32.122.27
country_id: 597427
description:
Nov  4 19:04:37 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=194.32.122.27, lip=66.85.158.91, TLS handshaking: Connection closed, session=<QIen5MRCjKnCIHob>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 173.239.201.3
country_id: 1605651
description:
Nov  4 19:04:35 host2 pure-ftpd[2743375]: (?@173.239.201.3) [INFO] New connection from 173.239.201.3


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 188.214.125.55
country_id: 1694008
description:
Nov  4 19:04:36 host2 pure-ftpd[2743392]: (?@188.214.125.55) [INFO] New connection from 188.214.125.55


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 188.126.94.233
country_id: 2623032
description:
Nov  4 19:04:36 host2 dovecot[3704077]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=188.126.94.233, lip=66.85.158.91, session=<AqKc5MRCusi8fl7p>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 188.215.235.45
country_id: 1831722
description:
Nov  4 19:04:34 host2 pure-ftpd[2743364]: (?@188.215.235.45) [INFO] New connection from 188.215.235.45


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 84.17.56.168
country_id: 1819730
description:
Nov  4 19:04:37 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=84.17.56.168, lip=66.85.158.91, TLS, session=<RnWo5MRC+/9UETio>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 188.241.80.132
country_id: 1814991
description:
Nov  4 19:05:58 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=188.241.80.132, lip=66.85.158.91, TLS handshaking: Connection closed, session=<5dV/6cRCpLG88VCE>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-04 19:05:36 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:55213: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 84.17.56.168
country_id: 1819730
description:
Nov  4 19:05:58 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=84.17.56.168, lip=66.85.158.91, session=<ifWB6cRC4MRUETio>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 188.126.94.240
country_id: 2623032
description:
Nov  4 19:06:39 host2 pure-ftpd[2746421]: (?@188.126.94.240) [INFO] New connection from 188.126.94.240


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.133.46.28
country_id: 130758
description:
Nov  4 19:06:43 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=62.133.46.28, lip=66.85.158.91, TLS, session=<9Z0l7MRCVMM+hS4c>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 37.19.223.28
country_id: 2782113
description:
Nov  4 19:06:43 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=37.19.223.28, lip=66.85.158.91, session=<VD8w7MRC1MklE98c>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 178.175.142.134
country_id: 617790
description:
Nov  4 19:06:43 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=178.175.142.134, lip=66.85.158.91, TLS handshaking: Connection closed, session=<PyUk7MRCSMOyr46G>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 149.88.26.14
country_id: 294640
description:
Nov  4 19:06:42 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=149.88.26.14, lip=66.85.158.91, TLS handshaking: Connection closed, session=<5aQf7MRCjIuVWBoO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.132.194.17
country_id: 597427
description:
Nov  4 19:06:42 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=45.132.194.17, lip=66.85.158.91, TLS, session=<hyYf7MRCjosthMIR>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.123
country_id: 6252001
description:
Nov  4 19:08:48 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 15 secs): user=<>, rip=66.132.153.123, lip=66.85.158.91, TLS handshaking: Connection closed, session=<Ydqc88RC/KRChJl7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.250.191.189
country_id: 458258
description:
2025-11-04 19:09:21 dovecot_login authenticator failed for ([178.250.191.189]) [178.250.191.189]:37064: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.199.12.218
country_id: 2802361
description:
2025-11-04 19:09:58 dovecot_login authenticator failed for d54c70cda.static.telenet.be [84.199.12.218]:36908: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 86.109.170.140
country_id: 2510769
description:
Nov  4 19:16:09 host2 sshd[2757607]: Invalid user Can't open saiaresur from 86.109.170.140 port 33852


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 86.109.170.140
country_id: 2510769
description:
Nov  4 19:16:27 host2 sshd[2757991]: Invalid user Can't open saiaresur from 86.109.170.140 port 54890


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.215.74.195
country_id: 2661886
description:
2025-11-04 19:19:44 dovecot_plain authenticator failed for 217-215-74-195-no2620.tbcn.telia.com (exped) [217.215.74.195]:41633: 535 Incorrect authentication data (set_id=contact@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  4 19:21:55 host2 sshd[2764272]: Disconnected from invalid user jett 62.60.131.157 port 37202 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov  4 19:22:09 host2 sshd[2764568]: Disconnected from invalid user user 2.57.121.25 port 41896 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 40.124.173.160
country_id: 6252001
description:
Nov  4 19:26:07 host2 pure-ftpd[2769957]: (?@40.124.173.160) [INFO] New connection from 40.124.173.160


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  4 19:26:28 host2 sshd[2770361]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.61.149.165
country_id: 6252001
description:
Nov  4 19:27:45 host2 sshd[2771917]: Invalid user Can't open saiaresur from 45.61.149.165 port 35724


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  4 19:28:53 host2 sshd[2773201]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.127.120.34
country_id: 1269750
description:
2025-11-04 19:33:35 dovecot_login authenticator failed for ([45.127.120.34]) [45.127.120.34]:34598: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.83.41.60
country_id: 3469034
description:
2025-11-04 19:33:15 dovecot_login authenticator failed for (170-83-41-60.swtelecom.com.br) [170.83.41.60]:35152: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 52.180.145.88
country_id: 6252001
description:
Nov  4 19:36:18 host2 pure-ftpd[2781406]: (?@52.180.145.88) [INFO] New connection from 52.180.145.88


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov  4 19:44:22 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<VHbMcsVCeKQDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov  4 19:46:17 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<91ayecVCjK0DhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov  4 19:48:09 host2 dovecot[3704077]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS, session=<92xTgMVCqNwDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov  4 19:50:28 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS handshaking: Connection closed, session=<knGZiMVCnrwDhBfJ>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  4 19:51:52 host2 sshd[2799002]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov  4 19:52:35 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS, session=<bV8skMVCyLYDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 71.6.146.185
country_id: 6252001
description:
Nov  4 20:00:47 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record (no auth attempts in 0 secs): user=<>, rip=71.6.146.185, lip=66.85.158.91, TLS: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record, session=<Tl+FrcVCeuZHBpK5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.118.112.230
country_id: 6252001
description:
2025-11-04 20:01:00 dovecot_login authenticator failed for syn-070-118-112-230.biz.spectrum.com [70.118.112.230]:39576: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.230.86.50
country_id: 6252001
description:
2025-11-04 20:01:19 dovecot_plain authenticator failed for c-73-230-86-50.hsd1.pa.comcast.net (galling) [73.230.86.50]:57836: 535 Incorrect authentication data (set_id=contact@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.17.185.94
country_id: 1269750
description:
2025-11-04 20:01:30 dovecot_login authenticator failed for ([125.18.28.146]) [125.17.185.94]:51171: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.81.132.114
country_id: 2264397
description:
2025-11-04 20:03:22 dovecot_login authenticator failed for bl16-132-114.dsl.telepac.pt [188.81.132.114]:36194: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.7.83.133
country_id: 1269750
description:
2025-11-04 20:03:39 dovecot_login authenticator failed for ([1.7.83.133]) [1.7.83.133]:45098: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  4 20:10:23 host2 sshd[2818903]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.61.149.165
country_id: 6252001
description:
Nov  4 20:15:00 host2 sshd[2823790]: Invalid user Can't open saiaresur from 45.61.149.165 port 53536


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  4 20:18:25 host2 sshd[2827173]: Disconnected from invalid user jett 62.60.131.157 port 54268 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  4 20:25:33 host2 sshd[2835570]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.22.116.94
country_id: 1269750
description:
2025-11-04 20:26:27 dovecot_login authenticator failed for ([152.52.234.222]) [125.22.116.94]:38146: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.52.114
country_id: 1269750
description:
2025-11-04 20:26:10 dovecot_login authenticator failed for ([59.145.219.185]) [182.95.52.114]:43138: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.104
country_id: 6252001
description:
Nov  4 20:34:32 host2 pure-ftpd[2845719]: (?@205.210.31.104) [INFO] New connection from 205.210.31.104


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  4 20:35:06 host2 sshd[2846421]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  4 20:40:10 host2 sshd[2851562]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.232.179.250
country_id: 1269750
description:
Nov  4 20:42:59 host2 sshd[2854961]: Invalid user Can't open saiaresur from 165.232.179.250 port 36300


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.4
country_id: 6252001
description:
Nov  4 20:47:24 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 12 secs): user=<>, rip=91.230.168.4, lip=66.85.158.92, session=<ykI9VMZCiexb5qgE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.12
country_id: 6252001
description:
Nov  4 20:47:34 host2 dovecot[3704077]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=91.230.168.12, lip=66.85.158.92, session=<TvvZVMZCb5pb5qgM>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.0
country_id: 6252001
description:
Nov  4 20:47:12 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=91.230.168.0, lip=66.85.158.92, session=<5lGBU8ZCe41b5qgA>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 194.164.107.5
country_id: 6252001
description:
Nov  4 20:49:37 host2 pure-ftpd[2862809]: (?@194.164.107.5) [INFO] New connection from 194.164.107.5


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 199.45.155.88
country_id: 6252001
description:
Nov  4 20:52:13 host2 pure-ftpd[2865863]: (?@199.45.155.88) [INFO] New connection from 199.45.155.88


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.129.31.42
country_id: 3686110
description:
2025-11-04 20:58:38 dovecot_login authenticator failed for ([181.129.31.42]) [181.129.31.42]:48757: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.251.170
country_id: 99237
description:
2025-11-04 20:59:00 dovecot_login authenticator failed for ([65.20.251.170]) [65.20.251.170]:39954: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov  4 21:01:29 host2 sshd[2875832]: Disconnected from invalid user user 2.57.121.25 port 54695 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.156.46
country_id: 1269750
description:
2025-11-04 21:01:54 dovecot_login authenticator failed for ([125.19.156.46]) [125.19.156.46]:60464: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.210.254
country_id: 6251999
description:
Nov  4 21:05:05 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=148.113.210.254, lip=66.85.158.91, session=<xt12k8ZCUqOUcdL+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.70.122.245
country_id: 1269750
description:
2025-11-04 21:08:00 dovecot_login authenticator failed for (abts-mum-static-245.122.70.182.airtelbroadband.in) [182.70.122.245]:45478: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.33.130
country_id: 1149361
description:
2025-11-04 21:07:39 dovecot_login authenticator failed for ([149.54.33.130]) [149.54.33.130]:55958: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.96
country_id: 2635167
description:
Nov  4 21:07:49 host2 dovecot[3704077]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=185.247.137.96, lip=66.85.158.91, TLS, session=<MdNCncZCKbK594lg>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.232.179.250
country_id: 1269750
description:
Nov  4 21:11:34 host2 sshd[2888232]: Invalid user Can't open saiaresur from 165.232.179.250 port 60068


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 159.223.198.96
country_id: 6252001
description:
Nov  4 21:15:36 host2 dovecot[3704077]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=159.223.198.96, lip=66.85.158.92, TLS, session=<7XccucZCON+f38Zg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.5
country_id: 1880251
description:
2025-11-04 21:19:33 dovecot_login authenticator failed for (Fkkm3um) [165.154.217.5]:58947: 535 Incorrect authentication data (set_id=ajith)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.5
country_id: 1880251
description:
2025-11-04 21:20:18 dovecot_login authenticator failed for (Yic3Ekusi) [165.154.217.5]:61556: 535 Incorrect authentication data (set_id=ajith)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  4 21:28:04 host2 sshd[2905953]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.168.56.34
country_id: 3469034
description:
Nov  4 21:32:59 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<marketing@lezzarotech.com>, method=PLAIN, rip=45.168.56.34, lip=66.85.158.91, session=<9P0Y98ZCwpktqDgi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 80.227.102.242
country_id: 290557
description:
Nov  4 21:33:25 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<marketing@lezzarotech.com>, method=PLAIN, rip=80.227.102.242, lip=66.85.158.91, session=<hgKs+MZCK8FQ42by>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 216.218.206.68
country_id: 6252001
description:
Nov  4 21:33:27 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=216.218.206.68, lip=66.85.158.91, TLS handshaking: Connection closed, session=<xkrv+MZCNGvY2s5E>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.139.67
country_id: 6252001
description:
Nov  4 21:33:40 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=184.105.139.67, lip=66.85.158.91, session=<i1W3+cZCUO24aYtD>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 180.188.253.150
country_id: 1269750
description:
Nov  4 21:33:49 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<marketing>, method=PLAIN, rip=180.188.253.150, lip=66.85.158.91, TLS, session=<D4X5+MZCHMu0vP2W>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.117.44.239
country_id: 2510769
description:
Nov  4 21:33:20 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<marketing@lezzarotech.com>, method=PLAIN, rip=185.117.44.239, lip=66.85.158.91, session=<4xJV+MZCUwu5dSzv>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 216.218.206.68
country_id: 6252001
description:
Nov  4 21:34:09 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=216.218.206.68, lip=66.85.158.91, TLS: Connection closed, session=<kipr+8ZCaBnY2s5E>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.139.67
country_id: 6252001
description:
Nov  4 21:34:16 host2 dovecot[3704077]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=184.105.139.67, lip=66.85.158.91, session=<yTrV+8ZCdqa4aYtD>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 64.62.156.222
country_id: 6252001
description:
Nov  4 21:41:24 host2 pure-ftpd[2933859]: (?@64.62.156.222) [INFO] New connection from 64.62.156.222


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  4 21:48:30 host2 sshd[2955261]: Disconnected from invalid user adeline 62.60.131.157 port 29989 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.211.131
country_id: 6251999
description:
Nov  4 21:59:10 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=148.113.211.131, lip=66.85.158.91, session=<CmjsVMdCnLSUcdOD>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.90.12.192
country_id: 6252001
description:
Nov  4 22:02:40 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.90.12.192, lip=66.85.158.91, TLS, session=<tGllYcdCsucDWgzA>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  4 22:15:58 host2 sshd[2988297]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.202
country_id: 6252001
description:
Nov  4 22:18:28 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.202, lip=66.85.158.92, TLS handshaking: Connection closed, session=<OWfnmcdC/iZAPpzK>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 64.62.156.108
country_id: 6252001
description:
Nov  4 22:23:28 host2 pure-ftpd[2997466]: (?@64.62.156.108) [INFO] New connection from 64.62.156.108


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.161.27.82
country_id: 6252001
description:
2025-11-04 22:27:35 dovecot_plain authenticator failed for c-174-161-27-82.hsd1.tn.comcast.net (jecheroms) [174.161.27.82]:49457: 535 Incorrect authentication data (set_id=contact@lezzarotech.com)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.54
country_id: 2635167
description:
Nov  4 22:27:17 host2 dovecot[3704077]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=87.236.176.54, lip=66.85.158.92, TLS, session=<2911ucdCuYpX7LA2>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.221
country_id: 2635167
description:
Nov  4 22:27:31 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 46 secs): user=<>, rip=35.203.210.221, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<btRCusdCS8Ujy9Ld>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.221
country_id: 2635167
description:
Nov  4 22:28:16 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed: read(size=429) failed: Connection reset by peer (no auth attempts in 5 secs): user=<>, rip=35.203.210.221, lip=66.85.158.92, TLS: read(size=429) failed: Connection reset by peer, session=<d532vMdCzucjy9Ld>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.221
country_id: 2635167
description:
Nov  4 22:33:53 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.203.210.221, lip=66.85.158.92, TLS, session=<MJsK0cdCrPEjy9Ld>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.86
country_id: 3017382
description:
Nov  4 22:38:08 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=91.231.89.86, lip=66.85.158.92, session=<KdtD4MdCS8tb51lW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.214
country_id: 3017382
description:
Nov  4 22:38:48 host2 dovecot[3704077]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=91.231.89.214, lip=66.85.158.92, session=<AcCh4sdCw5hb51nW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.215
country_id: 3017382
description:
Nov  4 22:38:51 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.231.89.215, lip=66.85.158.92, session=<nCXU4sdCpZhb51nX>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.84
country_id: 3017382
description:
Nov  4 22:38:19 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=91.231.89.84, lip=66.85.158.92, session=<ecbo4MdCZ6pb51lU>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.202.20.23
country_id: 6252001
description:
Nov  4 22:38:31 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=44.202.20.23, lip=66.85.158.92, TLS, session=<qBac4cdC6uksyhQX>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 168.91.250.232
country_id: 6252001
description:
Nov  4 22:48:32 host2 sshd[3025669]: Invalid user Can't open saiaresur from 168.91.250.232 port 54292


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.37.40.218
country_id: 6252001
description:
2025-11-04 22:54:27 dovecot_plain authenticator failed for c-68-37-40-218.hsd1.mi.comcast.net (ressitesse) [68.37.40.218]:53736: 535 Incorrect authentication data (set_id=contact@euroentertainmentlk.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.114
country_id: 6252001
description:
Nov  4 22:54:38 host2 pure-ftpd[3032955]: (?@198.235.24.114) [INFO] New connection from 198.235.24.114


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.138.237.18
country_id: 1269750
description:
Nov  4 22:55:31 host2 sshd[3034113]: Invalid user Can't open saiaresur from 103.138.237.18 port 5039


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.211.25.202
country_id: 2233387
description:
Nov  4 22:58:58 host2 sshd[3037839]: Invalid user Can't open saiaresur from 165.211.25.202 port 34116


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.152
country_id: 6252001
description:
Nov  4 22:59:27 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.152, lip=66.85.158.92, TLS handshaking: Connection closed, session=<6pF3LMhCExFAPpyY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.163
country_id: 6252001
description:
Nov  4 23:00:12 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 7 secs): user=<>, rip=147.185.132.163, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<oWktL8hCwsiTuYSj>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.163
country_id: 6252001
description:
Nov  4 23:01:26 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 5 secs): user=<>, rip=147.185.132.163, lip=66.85.158.91, TLS: read(size=403) failed: Connection reset by peer, session=<sheUM8hCIuiTuYSj>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.239.165.114
country_id: 1643084
description:
Nov  4 23:02:08 host2 sshd[3041318]: Invalid user sivagnanamfoundation from 103.239.165.114 port 43624


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.61.149.165
country_id: 6252001
description:
Nov  4 23:01:26 host2 sshd[3040577]: Invalid user Can't open saiaresur from 45.61.149.165 port 51746


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  4 23:03:08 host2 sshd[3042607]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.247.20.83
country_id: 1643084
description:
Nov  4 23:06:53 host2 sshd[3047375]: Invalid user sivagnanamfoundation from 103.247.20.83 port 48588


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.232.179.250
country_id: 1269750
description:
Nov  4 23:07:04 host2 sshd[3047588]: Invalid user Can't open saiaresur from 165.232.179.250 port 37136


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.232.179.250
country_id: 1269750
description:
Nov  4 23:07:44 host2 sshd[3048206]: Invalid user Can't open saiaresur from 165.232.179.250 port 54414


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.163
country_id: 6252001
description:
Nov  4 23:08:41 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.163, lip=66.85.158.91, TLS, session=<mN99TchCwOOTuYSj>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.61.149.165
country_id: 6252001
description:
Nov  4 23:09:40 host2 sshd[3050655]: Invalid user Can't open saiaresur from 45.61.149.165 port 33696


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 13.52.183.230
country_id: 6252001
description:
Nov  4 23:10:44 host2 pure-ftpd[3051987]: (?@13.52.183.230) [INFO] New connection from 13.52.183.230


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  4 23:10:40 host2 sshd[3051782]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  4 23:11:45 host2 sshd[3053306]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-04 23:12:02 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:50960: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.245.115.125
country_id: 6252001
description:
Nov  4 23:13:16 host2 sshd[3055043]: Invalid user sivagnanamfoundation from 157.245.115.125 port 50600


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 150.95.83.190
country_id: 1861060
description:
Nov  4 23:14:13 host2 sshd[3056092]: Invalid user sivagnanamfoundation from 150.95.83.190 port 54144


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.232.179.250
country_id: 1269750
description:
Nov  4 23:14:44 host2 sshd[3056487]: Invalid user Can't open saiaresur from 165.232.179.250 port 45824


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  4 23:17:18 host2 sshd[3059476]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.121.192.210
country_id: 3595528
description:
2025-11-04 23:20:21 dovecot_login authenticator failed for (210.192.121.190.ispguatemala.com.gt) [190.121.192.210]:38488: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.237.173.220
country_id: 6252001
description:
Nov  4 23:20:38 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.237.173.220, lip=66.85.158.91, TLS, session=<Pt46eMhCBq4D7a3c>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.104.24.6
country_id: 3923057
description:
2025-11-04 23:21:25 dovecot_login authenticator failed for (SCZ-190-104-24-00006.tigo.bo) [190.104.24.6]:34464: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.178.137.243
country_id: 3017382
description:
Nov  4 23:21:46 host2 sshd[3064752]: Invalid user sivagnanamfoundation from 51.178.137.243 port 55418


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.84.173.178
country_id: 1210997
description:
Nov  4 23:26:40 host2 sshd[3070658]: Invalid user Can't open saiaresur from 103.84.173.178 port 60184


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  4 23:28:30 host2 sshd[3072408]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.212.246.200
country_id: 192950
description:
Nov  4 23:29:09 host2 sshd[3073135]: Invalid user sivagnanamfoundation from 102.212.246.200 port 47358


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 209.38.249.122
country_id: 2921044
description:
Nov  4 23:29:16 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=209.38.249.122, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=</84Wl8hCTtDRJvl6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.20.68
country_id: 6252001
description:
Nov  4 23:29:46 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.20.68, lip=66.85.158.91, session=<+1LjmMhCdFFBMRRE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.20.68
country_id: 6252001
description:
Nov  4 23:30:14 host2 dovecot[3704077]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=65.49.20.68, lip=66.85.158.91, session=<paSVmshCzhpBMRRE>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.147.89.158
country_id: 1269750
description:
2025-11-04 23:32:04 dovecot_login authenticator failed for ([203.147.89.38]) [203.147.89.158]:53966: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.84.173.178
country_id: 1210997
description:
Nov  4 23:31:35 host2 sshd[3075642]: Invalid user Can't open saiaresur from 103.84.173.178 port 42152


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.205.250.78
country_id: 290557
description:
2025-11-04 23:32:17 dovecot_login authenticator failed for ([94.205.250.78]) [94.205.250.78]:64301: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.97.77.182
country_id: 1269750
description:
2025-11-04 23:32:42 dovecot_login authenticator failed for ([14.97.77.182]) [14.97.77.182]:51816: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.214.49.194
country_id: 6252001
description:
2025-11-04 23:32:45 dovecot_login authenticator failed for wsip-72-214-49-194.hr.hr.cox.net [72.214.49.194]:38214: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.84.54
country_id: 1269750
description:
2025-11-04 23:33:13 dovecot_login authenticator failed for ([182.79.151.121]) [27.123.84.54]:50516: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  4 23:34:14 host2 sshd[3078336]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.84.173.178
country_id: 1210997
description:
Nov  4 23:34:38 host2 sshd[3078789]: Invalid user Can't open saiaresur from 103.84.173.178 port 45400


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.153.146
country_id: 99237
description:
2025-11-04 23:40:01 dovecot_login authenticator failed for ([65.20.153.146]) [65.20.153.146]:35180: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.147.45
country_id: 99237
description:
2025-11-04 23:40:58 dovecot_login authenticator failed for ([65.20.147.45]) [65.20.147.45]:45641: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.125.169.77
country_id: 3469034
description:
2025-11-04 23:41:00 dovecot_login authenticator failed for 179-125-169-77.static.desktop.com.br [179.125.169.77]:51971: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.146.203.212
country_id: 1643084
description:
Nov  4 23:40:34 host2 sshd[3085413]: Invalid user sivagnanamfoundation from 103.146.203.212 port 41228


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.177.4.91
country_id: 1694008
description:
2025-11-04 23:41:35 dovecot_login authenticator failed for ([203.177.4.91]) [203.177.4.91]:20619: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.139.69
country_id: 6252001
description:
Nov  4 23:42:27 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=184.105.139.69, lip=66.85.158.92, session=<NXdJxshCSu+4aYtF>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 151.254.11.76
country_id: 102358
description:
Nov  4 23:44:13 host2 pure-ftpd[3089552]: (?@151.254.11.76) [INFO] New connection from 151.254.11.76


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.71.251.47
country_id: 6252001
description:
Nov  4 23:46:28 host2 sshd[3092607]: Invalid user sivagnanamfoundation from 167.71.251.47 port 36272


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.76.191.29
country_id: 1819730
description:
2025-11-04 23:48:52 dovecot_login authenticator failed for 029.191.76.219.static.netvigator.com [219.76.191.29]:56265: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  4 23:50:39 host2 sshd[3097285]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 164.92.185.101
country_id: 2921044
description:
Nov  4 23:53:14 host2 sshd[3100177]: Invalid user sivagnanamfoundation from 164.92.185.101 port 53598


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 66.116.198.38
country_id: 1269750
description:
Nov  4 23:53:51 host2 sshd[3100732]: Invalid user sivagnanamfoundation from 66.116.198.38 port 49550


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.75
country_id: 6252001
description:
Nov  4 23:54:38 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.75, lip=66.85.158.92, TLS, session=<MIfb8chCkvyTuYRL>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.239.165.114
country_id: 1643084
description:
Nov  4 23:55:43 host2 sshd[3103682]: Invalid user sivagnanamfoundation from 103.239.165.114 port 49094


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.253.96.143
country_id: 6252001
description:
Nov  4 23:56:37 host2 sshd[3104686]: Invalid user sivagnanamfoundation from 47.253.96.143 port 36636


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.17.125.63
country_id: 690791
description:
Nov  4 23:57:48 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@greentaraceylon.com>, method=PLAIN, rip=185.17.125.63, lip=66.85.158.91, TLS, session=<aJAi/MhCi9S5EX0/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.207.35.168
country_id: 6290252
description:
Nov  4 23:58:05 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=109.207.35.168, lip=66.85.158.91, TLS, session=<cTg3/chCaedtzyOo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.138
country_id: 6252001
description:
Nov  4 23:58:16 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.138, lip=66.85.158.91, TLS: Connection closed, session=<PE3U/shCSsNChJmK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.245.115.125
country_id: 6252001
description:
Nov  4 23:59:12 host2 sshd[3107617]: Invalid user sivagnanamfoundation from 157.245.115.125 port 57818


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.247.20.83
country_id: 1643084
description:
Nov  5 00:00:48 host2 sshd[3109824]: Invalid user sivagnanamfoundation from 103.247.20.83 port 48730


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.38.159
country_id: 1819730
description:
Nov  5 00:01:06 host2 sshd[3110189]: Invalid user sivagnanamfoundation from 118.193.38.159 port 38612


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 00:02:08 host2 sshd[3111406]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.85
country_id: 6252001
description:
Nov  5 00:02:43 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.85, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<rH69DslCCsXG6xhV>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.20.228.20
country_id: 1269750
description:
2025-11-05 00:08:45 dovecot_login authenticator failed for ([157.20.228.20]) [157.20.228.20]:43666: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.185.96.113
country_id: 294640
description:
2025-11-05 00:08:44 dovecot_login authenticator failed for ([130.185.96.113]) [130.185.96.113]:59958: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.46
country_id: 1733045
description:
2025-11-05 00:09:35 dovecot_login authenticator failed for ([49.124.153.46]) [49.124.153.46]:38654: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 54.219.166.60
country_id: 6252001
description:
Nov  5 00:10:13 host2 pure-ftpd[3120606]: (?@54.219.166.60) [INFO] New connection from 54.219.166.60


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 193.110.157.47
country_id: 2750405
description:
Nov  5 00:11:47 host2 sshd[3122220]: Invalid user sivagnanamfoundation from 193.110.157.47 port 44182


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.235.110
country_id: 1269750
description:
2025-11-05 00:12:03 dovecot_login authenticator failed for ([128.185.160.185]) [128.185.235.110]:58552: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.110.213.247
country_id: 6251999
description:
Nov  5 00:12:17 host2 sshd[3122806]: Invalid user sivagnanamfoundation from 143.110.213.247 port 54760


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.235.44
country_id: 1269750
description:
2025-11-05 00:12:29 dovecot_login authenticator failed for (beta.corporatecitizen.in) [103.29.235.44]:39488: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.146.21.153
country_id: 1605651
description:
Nov  5 00:15:49 host2 sshd[3126958]: Invalid user sivagnanamfoundation from 203.146.21.153 port 35408


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.212.246.200
country_id: 192950
description:
Nov  5 00:18:23 host2 sshd[3130034]: Invalid user sivagnanamfoundation from 102.212.246.200 port 51624


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 150.95.83.190
country_id: 1861060
description:
Nov  5 00:18:45 host2 sshd[3130332]: Invalid user sivagnanamfoundation from 150.95.83.190 port 33076


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 82.215.106.192
country_id: 1512440
description:
Nov  5 00:23:25 host2 pure-ftpd[3136099]: (?@82.215.106.192) [INFO] New connection from 82.215.106.192


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 137.184.152.60
country_id: 6252001
description:
Nov  5 00:24:15 host2 sshd[3137189]: Invalid user sivagnanamfoundation from 137.184.152.60 port 54536


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 00:28:09 host2 sshd[3141610]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.136.122
country_id: 1269750
description:
Nov  5 00:27:35 host2 sshd[3140965]: Invalid user sivagnanamfoundation from 64.227.136.122 port 57808


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.48.100.83
country_id: 3932488
description:
Nov  5 00:27:36 host2 sshd[3141007]: Invalid user sivagnanamfoundation from 200.48.100.83 port 53108


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.21
country_id: 1733045
description:
2025-11-05 00:27:28 dovecot_login authenticator failed for ([49.124.152.21]) [49.124.152.21]:42686: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.61.149.165
country_id: 6252001
description:
Nov  5 00:31:37 host2 sshd[3145707]: Invalid user Can't open saiaresur from 45.61.149.165 port 37558


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 00:34:36 host2 sshd[3148737]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.238.254.156
country_id: 2661886
description:
2025-11-05 00:34:50 dovecot_login authenticator failed for 213-238-254-156.customers.ownit.se [213.238.254.156]:59626: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.232.179.250
country_id: 1269750
description:
Nov  5 00:35:59 host2 sshd[3150466]: Invalid user Can't open saiaresur from 165.232.179.250 port 41404


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  5 00:36:21 host2 sshd[3150932]: Disconnected from invalid user jacklyn 62.60.131.157 port 32016 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.93.84
country_id: 1269750
description:
2025-11-05 00:37:09 dovecot_login authenticator failed for ([152.52.93.82]) [152.52.93.84]:10400: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 00:37:41 host2 sshd[3152336]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.184.33.86
country_id: 3469034
description:
2025-11-05 00:37:23 dovecot_login authenticator failed for 179.184.33.86.static.gvt.net.br [179.184.33.86]:58413: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.84.173.178
country_id: 1210997
description:
Nov  5 00:37:29 host2 sshd[3152072]: Invalid user Can't open saiaresur from 103.84.173.178 port 36808


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.36.42
country_id: 1819730
description:
2025-11-05 00:37:36 dovecot_login authenticator failed for 042.36.246.220.static.netvigator.com [220.246.36.42]:51894: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.83.51.57
country_id: 1269750
description:
2025-11-05 00:38:39 dovecot_login authenticator failed for (broadband.actcorp.in) [183.83.51.57]:34812: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.232.179.250
country_id: 1269750
description:
Nov  5 00:39:17 host2 sshd[3154267]: Invalid user Can't open saiaresur from 165.232.179.250 port 59262


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.214.78
country_id: 1269750
description:
2025-11-05 00:42:01 dovecot_login authenticator failed for ([128.185.214.78]) [128.185.214.78]:46606: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 150.95.83.190
country_id: 1861060
description:
Nov  5 00:42:11 host2 sshd[3157757]: Invalid user sivagnanamfoundation from 150.95.83.190 port 57708


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.75.114
country_id: 1149361
description:
2025-11-05 00:42:25 dovecot_login authenticator failed for ([180.94.75.114]) [180.94.75.114]:36526: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.84.173.178
country_id: 1210997
description:
Nov  5 00:42:54 host2 sshd[3158479]: Invalid user Can't open saiaresur from 103.84.173.178 port 57254


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.135.67.189
country_id: 3469034
description:
2025-11-05 00:44:10 dovecot_login authenticator failed for (unicred.static.gvt.net.br) [177.135.67.189]:55288: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.75.114
country_id: 1149361
description:
2025-11-05 00:43:36 dovecot_login authenticator failed for ([180.94.75.114]) [180.94.75.114]:38393: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 00:46:35 host2 sshd[3162873]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.221.153.85
country_id: 690791
description:
Nov  5 00:57:30 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@greentaraceylon.com>, method=PLAIN, rip=37.221.153.85, lip=66.85.158.91, TLS, session=<fl2Y0clCALEl3ZlV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.189.201.102
country_id: 3469034
description:
Nov  5 00:57:52 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=179.189.201.102, lip=66.85.158.91, TLS, session=<BeHM0slCk8izvclm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.207.210.23
country_id: 2960313
description:
2025-11-05 01:02:28 dovecot_plain authenticator failed for (turrovet) [88.207.210.23]:60651: 535 Incorrect authentication data (set_id=contact@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 01:19:01 host2 sshd[3199376]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.71.82
country_id: 1269750
description:
2025-11-05 01:23:15 dovecot_login authenticator failed for (nsg-static-82.71.76.182-airtel.com) [182.76.71.82]:37862: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.6.121.246
country_id: 3469034
description:
2025-11-05 01:23:45 dovecot_login authenticator failed for ([191.217.23.65]) [187.6.121.246]:44970: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 01:25:08 host2 sshd[3206162]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.237.239.173
country_id: 3077311
description:
Nov  5 01:26:13 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 15 secs): user=<info@greentaraceylon.com>, method=PLAIN, rip=91.237.239.173, lip=66.85.158.91, TLS, session=<yXJyOMpCBYxb7e+t>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 181.225.198.49
country_id: 3865483
description:
Nov  5 01:26:34 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=181.225.198.49, lip=66.85.158.91, TLS, session=<2jeFOcpCNqy14cYx>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.226.27.227
country_id: 294640
description:
2025-11-05 01:29:38 dovecot_plain authenticator failed for (abittutbal) [109.226.27.227]:34618: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.141
country_id: 6252001
description:
Nov  5 01:30:35 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=66.132.153.141, lip=66.85.158.92, TLS: Connection closed, session=<P0z+SMpC9MZChJmN>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 01:34:05 host2 sshd[3215928]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.154.110.150
country_id: 1819730
description:
Nov  5 01:44:47 host2 pure-ftpd[3228183]: (?@165.154.110.150) [INFO] New connection from 165.154.110.150


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 01:44:33 host2 sshd[3227733]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.89.170.72
country_id: 1522867
description:
2025-11-05 01:44:55 dovecot_login authenticator failed for 178.89.170.72.dynamic.telecom.kz [178.89.170.72]:40432: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.126.114.239
country_id: 1880251
description:
2025-11-05 01:44:14 dovecot_login authenticator failed for 239.114.126.34.bc.googleusercontent.com [34.126.114.239]:47000: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.204
country_id: 6252001
description:
Nov  5 01:47:20 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=198.235.24.204, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<FLvchMpC89bG6xjM>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 01:51:47 host2 sshd[3236140]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 01:55:42 host2 sshd[3240794]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 01:57:23 host2 sshd[3242686]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.211.25.202
country_id: 2233387
description:
Nov  5 02:04:06 host2 sshd[3250723]: Invalid user Can't open saiaresur from 165.211.25.202 port 48810


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.238.191.229
country_id: 6252001
description:
Nov  5 02:07:55 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.238.191.229, lip=66.85.158.92, TLS, session=<JiiGzspCrMID7r/l>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.211.25.202
country_id: 2233387
description:
Nov  5 02:30:52 host2 sshd[3280334]: Invalid user Can't open saiaresur from 165.211.25.202 port 57416


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 02:31:54 host2 sshd[3281417]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 45.142.154.32
country_id: 1819730
description:
Nov  5 02:31:25 host2 pure-ftpd[3280924]: (?@45.142.154.32) [INFO] New connection from 45.142.154.32


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.228.53.174
country_id: 6252001
description:
Nov  5 02:37:54 host2 dovecot[3154217]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=66.228.53.174, lip=66.85.158.91, session=<vlPAOctCgvlC5DWu>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.207.41.228
country_id: 6290252
description:
Nov  5 02:42:52 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@greentaraceylon.com>, method=PLAIN, rip=109.207.41.228, lip=66.85.158.91, TLS, session=<xNJqSstCtOBtzynk>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.130.171.160
country_id: 3469034
description:
Nov  5 02:43:13 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=177.130.171.160, lip=66.85.158.91, TLS, session=<5VGoS8tCLbuxgqug>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 02:50:01 host2 sshd[3301966]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  5 02:50:35 host2 sshd[3302732]: Disconnected from invalid user baby 62.60.131.157 port 6079 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.143
country_id: 6252001
description:
Nov  5 02:55:23 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=66.132.153.143, lip=66.85.158.91, TLS: Connection closed, session=<6Bk8eMtC3OxChJmP>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.143
country_id: 6252001
description:
Nov  5 02:55:29 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=66.132.153.143, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<Tb2feMtCBO1ChJmP>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.211.25.202
country_id: 2233387
description:
Nov  5 02:56:30 host2 sshd[3310387]: Invalid user Can't open saiaresur from 165.211.25.202 port 43462


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.34.237.45
country_id: 285570
description:
2025-11-05 02:58:26 dovecot_plain authenticator failed for (reofling) [37.34.237.45]:50950: 535 Incorrect authentication data (set_id=contact@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 03:15:45 host2 sshd[3331099]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 03:18:47 host2 sshd[3334277]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 03:26:41 host2 sshd[3344922]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-05 03:28:35 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:59621: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  5 03:31:41 host2 sshd[3351177]: Disconnected from invalid user baby 62.60.131.157 port 28233 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.84.237.158
country_id: 3469034
description:
2025-11-05 03:35:24 dovecot_login authenticator failed for 177-84-237-158.allrede.tec.br [177.84.237.158]:37582: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 119.28.107.251
country_id: 1880251
description:
[2025-11-05 03:35:25 +0530] info [cpaneld] 119.28.107.251 - lezzarotech "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarotech (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.101.164.140
country_id: 1861060
description:
2025-11-05 03:36:01 dovecot_login authenticator failed for 157.101.164.140.static.zoot.jp [157.101.164.140]:52370: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
country_id: 6252001
description:
2025-11-05 03:36:16 dovecot_login authenticator failed for (made-again.tmesis.com) [24.187.213.29]:46784: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.55.189.211
country_id: 6252001
description:
2025-11-05 03:36:17 dovecot_login authenticator failed for (wllk99-129-211.dsl.netins.net) [67.55.189.211]:46603: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.237.173.220
country_id: 6252001
description:
Nov  5 03:42:28 host2 dovecot[3154217]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.237.173.220, lip=66.85.158.91, session=<CC+eIMxCmN8D7a3c>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.223
country_id: 6252001
description:
Nov  5 03:44:22 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.223, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<FP9rJ8xCe8HN0h/f>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.230.168.26
country_id: 2661886
description:
2025-11-05 03:43:50 dovecot_login authenticator failed for 90-230-168-26-no600.tbcn.telia.com [90.230.168.26]:39150: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.51.82
country_id: 1149361
description:
2025-11-05 03:44:58 dovecot_login authenticator failed for ([149.54.51.82]) [149.54.51.82]:35258: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 18.97.19.233
country_id: 6252001
description:
Nov  5 03:48:41 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=18.97.19.233, lip=66.85.158.92, TLS handshaking: Connection closed, session=<ZfLiNsxCAKQSYRPp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.124.218
country_id: 337996
description:
2025-11-05 03:51:20 dovecot_login authenticator failed for ([196.189.124.218]) [196.189.124.218]:55328: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.237.173.220
country_id: 6252001
description:
Nov  5 03:51:41 host2 dovecot[3154217]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.237.173.220, lip=66.85.158.92, session=<WLWSQcxCoOoD7a3c>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.44.143.75
country_id: 3175395
description:
2025-11-05 03:54:33 dovecot_plain authenticator failed for 93-44-143-75.ip97.fastwebnet.it (trious) [93.44.143.75]:45258: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 20.127.224.63
country_id: 6252001
description:
Nov  5 03:57:55 host2 pure-ftpd[3384981]: (?@20.127.224.63) [INFO] New connection from 20.127.224.63


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 04:02:10 host2 sshd[3390088]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.156.128.88
country_id: 2264397
description:
Nov  5 04:03:19 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=45.156.128.88, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<D780a8xCwZUtnIBY>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 45.156.128.86
country_id: 2264397
description:
Nov  5 04:03:11 host2 dovecot[3154217]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=45.156.128.86, lip=66.85.158.92, TLS, session=<QGq1asxCs5EtnIBW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.156.128.86
country_id: 2264397
description:
Nov  5 04:03:14 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=45.156.128.86, lip=66.85.158.92, TLS, session=<+vTfasxCHp4tnIBW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.156.128.89
country_id: 2264397
description:
Nov  5 04:03:15 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=45.156.128.89, lip=66.85.158.92, TLS, session=<T7LuasxCR9AtnIBZ>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 04:06:05 host2 sshd[3396787]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.30.82.70
country_id: 1269750
description:
Nov  5 04:06:26 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@greentaraceylon.com>, method=PLAIN, rip=103.30.82.70, lip=66.85.158.91, TLS, session=<E+I3dcxCiM9nHlJG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.41.76
country_id: 2300660
description:
Nov  5 04:06:48 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=41.139.41.76, lip=66.85.158.91, TLS, session=<Jtl6dsxCve0piylM>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  5 04:09:09 host2 sshd[3401488]: Disconnected from invalid user rashad 62.60.131.157 port 21770 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 04:10:24 host2 sshd[3403588]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov  5 04:09:29 host2 sshd[3401970]: Disconnected from invalid user user 2.57.121.25 port 39384 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.47.30.146
country_id: 953987
description:
2025-11-05 04:12:02 dovecot_plain authenticator failed for ([192.168.88.10]) [154.47.30.146]:36618: 535 Incorrect authentication data (set_id=admin@cloudtourssrilanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.164
country_id: 6252001
description:
Nov  5 04:12:54 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=198.235.24.164, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<6/t9jcxC5cLG6xik>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 04:17:53 host2 sshd[3414521]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.132.133.54
country_id: 1269750
description:
2025-11-05 04:21:21 dovecot_login authenticator failed for (dsl-del-dynamic-073.72.246.61.airtelbroadband.in) [203.132.133.54]:34988: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.27.76.210
country_id: 3469034
description:
2025-11-05 04:21:41 dovecot_login authenticator failed for (187-8-89-120.customer.tdatabrasil.net.br) [177.27.76.210]:55260: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.46.160.175
country_id: 2661886
description:
2025-11-05 04:22:02 dovecot_login authenticator failed for 37-46-160-175.customers.ownit.se [37.46.160.175]:40364: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.104.158
country_id: 1269750
description:
2025-11-05 04:27:37 dovecot_login authenticator failed for (smtp4.cpc.gov.in) [27.123.104.158]:47720: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.82.194
country_id: 1269750
description:
2025-11-05 04:27:49 dovecot_login authenticator failed for ([59.145.171.168]) [182.78.82.194]:35650: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.56.0.19
country_id: 3469034
description:
2025-11-05 04:28:08 dovecot_login authenticator failed for (177-215-153-215.user.vivozap.com.br) [189.56.0.19]:54163: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.83.30.199
country_id: 6252001
description:
2025-11-05 04:28:23 dovecot_login authenticator failed for ool-43531ec7.dyn.optonline.net [67.83.30.199]:55341: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 04:30:57 host2 sshd[3432679]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2025-11-05 04:31:31 dovecot_plain authenticator failed for (puble) [154.144.243.93]:48046: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 04:40:23 host2 sshd[3443052]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.58.241.90
country_id: 3469034
description:
2025-11-05 04:40:21 dovecot_login authenticator failed for (ccabv.org.cta.gvt.net.br) [187.58.241.90]:36648: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.57.224.221
country_id: 1168579
description:
2025-11-05 04:40:42 dovecot_login authenticator failed for ([103.57.224.221]) [103.57.224.221]:59599: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 04:45:23 host2 sshd[3448637]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 04:46:43 host2 sshd[3449833]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  5 04:49:29 host2 sshd[3452547]: Disconnected from invalid user rashad 62.60.131.157 port 30344 [preauth]


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 62.60.131.151
country_id: 130758
description:
Denial of Service (DoS) attack was discovered from 62.60.131.151: 250 connections per 30 seconds to 80 port.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.185.233.251
country_id: 798544
description:
2025-11-05 04:52:03 dovecot_plain authenticator failed for 5.185.233.251.ipv4.public.orange.pl (speuole) [5.185.233.251]:34294: 535 Incorrect authentication data (set_id=contact@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 04:52:03 host2 sshd[3455778]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.172.54.29
country_id: 6252001
description:
2025-11-05 04:52:32 dovecot_plain authenticator failed for c-67-172-54-29.hsd1.pa.comcast.net (eusurweed) [67.172.54.29]:36772: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 04:52:42 host2 sshd[3456484]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.160.107
country_id: 99237
description:
2025-11-05 04:52:37 dovecot_plain authenticator failed for (bypess) [65.20.160.107]:41618: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 04:53:56 host2 sshd[3457679]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.198
country_id: 6252001
description:
Nov  5 04:53:44 host2 pure-ftpd[3457514]: (?@205.210.31.198) [INFO] New connection from 205.210.31.198


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.236
country_id: 6252001
description:
Nov  5 04:58:48 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=205.210.31.236, lip=66.85.158.91, session=<ZzmdMc1C7PLN0h/s>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 101.36.97.172
country_id: 2635167
description:
Nov  5 05:00:23 host2 pure-ftpd[3464918]: (?@101.36.97.172) [INFO] New connection from 101.36.97.172


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.200.166
country_id: 149590
description:
2025-11-05 05:01:26 dovecot_login authenticator failed for (166.200-59-41.ttcl.co.tz) [41.59.200.166]:51211: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.164.137
country_id: 99237
description:
2025-11-05 05:00:54 dovecot_plain authenticator failed for (equie) [65.20.164.137]:60330: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.146.49.206
country_id: 6252001
description:
2025-11-05 05:01:42 dovecot_login authenticator failed for ([216.146.49.206]) [216.146.49.206]:46130: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.154.138.32
country_id: 3017382
description:
2025-11-05 05:03:21 H=([100.64.100.6]) [45.154.138.32]:27011 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 CV=no F=<admin@cloudtourssrilanka.com> rejected RCPT <geli.abraham@bbox.fr>: SMTP AUTH is required for message submission on port 587


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.154.138.32
country_id: 3017382
description:
2025-11-05 05:03:14 dovecot_plain authenticator failed for ([100.64.100.6]) [45.154.138.32]:27011: 535 Incorrect authentication data (set_id=admin@cloudtourssrilanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.130.169.255
country_id: 3469034
description:
Nov  5 05:04:27 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@greentaraceylon.com>, method=PLAIN, rip=177.130.169.255, lip=66.85.158.91, TLS, session=<P2S5RM1CXpqxgqn/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.154.138.32
country_id: 3017382
description:
2025-11-05 05:03:30 dovecot_plain authenticator failed for ([100.64.100.6]) [45.154.138.32]:55775: 535 Incorrect authentication data (set_id=admin@cloudtourssrilanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.8.251.126
country_id: 3469034
description:
Nov  5 05:04:47 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=177.8.251.126, lip=66.85.158.91, TLS, session=<roj7Rc1CgrGxCPt+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov  5 05:19:29 host2 sshd[3486253]: Disconnected from invalid user user 2.57.121.25 port 36333 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.121.76.190
country_id: 732800
description:
2025-11-05 05:24:06 dovecot_plain authenticator failed for (ovelpers) [87.121.76.190]:51958: 535 Incorrect authentication data (set_id=contact@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  5 05:26:26 host2 sshd[3493773]: Disconnected from invalid user tariq 62.60.131.157 port 39192 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.171.53.82
country_id: 1733045
description:
2025-11-05 05:33:42 dovecot_login authenticator failed for ([183.171.53.82]) [183.171.53.82]:42124: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.49.145.163
country_id: 1605651
description:
2025-11-05 05:33:26 dovecot_login authenticator failed for ([110.49.145.163]) [110.49.145.163]:50846: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.226.118.0
country_id: 3469034
description:
2025-11-05 05:36:54 dovecot_login authenticator failed for ([38.226.118.9]) [38.226.118.0]:49738: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.134.58
country_id: 1269750
description:
2025-11-05 05:37:46 dovecot_login authenticator failed for (nsg-static-58.134.76.182-airtel.com) [182.76.134.58]:64550: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 05:40:57 host2 sshd[3510213]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.241
country_id: 6252001
description:
Nov  5 05:43:23 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.241, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<gckM0c1C4crN0h/x>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 05:44:13 host2 sshd[3513425]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 05:54:04 host2 sshd[3524685]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.181.101.193
country_id: 3865483
description:
Nov  5 05:59:59 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<info>, method=PLAIN, rip=190.181.101.193, lip=66.85.158.91, TLS, session=<4DcYC85C/JW+tWXB>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 169.239.117.81
country_id: 2215636
description:
Nov  5 05:59:34 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@greentaraceylon.com>, method=PLAIN, rip=169.239.117.81, lip=66.85.158.91, TLS, session=<FC/aCc5CEO2p73VR>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 06:05:30 host2 sshd[3537910]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 06:13:36 host2 sshd[3546620]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.183
country_id: 1269750
description:
2025-11-05 06:14:11 dovecot_login authenticator failed for (nsg-corporate-183.230.187.122.airtel.in) [122.187.230.183]:38923: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.251.90
country_id: 1269750
description:
2025-11-05 06:14:16 dovecot_login authenticator failed for ([125.19.251.90]) [125.19.251.90]:35318: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.10.197.168
country_id: 2661886
description:
2025-11-05 06:14:30 dovecot_login authenticator failed for h-176-10-197-168.a444.priv.bahnhof.se [176.10.197.168]:40848: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.177.88.96
country_id: 3624060
description:
2025-11-05 06:14:51 dovecot_login authenticator failed for ([186.177.88.96]) [186.177.88.96]:48041: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 42.3.133.38
country_id: 1819730
description:
Nov  5 06:15:36 host2 sshd[3548751]: error: maximum authentication attempts exceeded for root from 42.3.133.38 port 50496 ssh2 [preauth]


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 42.3.133.38
country_id: 1819730
description:
Nov  5 06:15:36 host2 sshd[3548751]: Disconnecting authenticating user root 42.3.133.38 port 50496: Too many authentication failures [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 42.3.133.38
country_id: 1819730
description:
Nov  5 06:15:51 host2 sshd[3548926]: Disconnecting invalid user admin 42.3.133.38 port 51705: Too many authentication failures [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.95.245
country_id: 3469034
description:
2025-11-05 06:23:55 dovecot_login authenticator failed for ([186.201.32.242]) [177.174.95.245]:54455: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.193.147.37
country_id: 1269750
description:
2025-11-05 06:24:22 dovecot_login authenticator failed for ([203.193.147.49]) [203.193.147.37]:64893: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.159.165.216
country_id: 294640
description:
2025-11-05 06:24:30 dovecot_login authenticator failed for ([85.159.165.216]) [85.159.165.216]:36478: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 06:26:46 host2 sshd[3560515]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 06:28:09 host2 sshd[3562000]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  5 06:42:58 host2 sshd[3577577]: Disconnected from invalid user citlalli 62.60.131.157 port 56517 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.93.84
country_id: 1269750
description:
2025-11-05 06:43:49 dovecot_login authenticator failed for ([152.52.93.82]) [152.52.93.84]:10400: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.145.62
country_id: 1733045
description:
2025-11-05 06:43:25 dovecot_login authenticator failed for ([49.124.145.62]) [49.124.145.62]:55764: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.216.169.12
country_id: 2328926
description:
2025-11-05 06:43:37 dovecot_login authenticator failed for ([41.216.169.12]) [41.216.169.12]:53554: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 06:44:53 host2 sshd[3579644]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.193.176
country_id: 6252001
description:
Nov  5 06:47:01 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.65.193.176, lip=66.85.158.92, session=<aPSjtM5CRtcUQcGw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.216.28.53
country_id: 798544
description:
Nov  5 06:54:49 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@greentaraceylon.com>, method=PLAIN, rip=178.216.28.53, lip=66.85.158.91, TLS, session=<8n+Hz85CNbey2Bw1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.44.140.207
country_id: 690791
description:
Nov  5 06:55:07 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=194.44.140.207, lip=66.85.158.91, TLS, session=<EMuc0M5CFsjCLIzP>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.126
country_id: 6252001
description:
Nov  5 07:00:25 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 15 secs): user=<>, rip=66.132.153.126, lip=66.85.158.91, TLS handshaking: Connection closed, session=<Z2mR5M5Cxo9ChJl+>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 07:02:49 host2 sshd[3598817]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.222.23.245
country_id: 6252001
description:
2025-11-05 07:04:00 dovecot_login authenticator failed for ([158.222.23.245]) [158.222.23.245]:34292: 535 Incorrect authentication data (set_id=info@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.41.84.60
country_id: 798544
description:
2025-11-05 07:04:25 dovecot_login authenticator failed for (60.84.41.31.ip4.feromedia.eu) [31.41.84.60]:36100: 535 Incorrect authentication data (set_id=info@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.151.88.27
country_id: 6251999
description:
2025-11-05 07:04:40 dovecot_login authenticator failed for ([184.151.88.27]) [184.151.88.27]:54818: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.158.10
country_id: 99237
description:
2025-11-05 07:04:41 dovecot_login authenticator failed for ([65.20.158.10]) [65.20.158.10]:34929: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-05 07:06:35 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:50518: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 07:07:19 host2 sshd[3604060]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.237.173.220
country_id: 6252001
description:
Nov  5 07:10:58 host2 dovecot[3154217]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.237.173.220, lip=66.85.158.91, session=<NQlQCs9CXNwD7a3c>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov  5 07:11:17 host2 sshd[3608341]: Disconnected from invalid user user 2.57.121.25 port 5849 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 07:15:47 host2 sshd[3612948]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 103.176.152.10
country_id: 1605651
description:
Nov  5 07:15:54 host2 pure-ftpd[3613220]: (?@103.176.152.10) [INFO] New connection from 103.176.152.10


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  5 07:22:26 host2 sshd[3619838]: Disconnected from invalid user citlalli 62.60.131.157 port 14266 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.231.25.64
country_id: 3686110
description:
2025-11-05 07:23:32 dovecot_login authenticator failed for (1522312565.colombiatel.co) [152.231.25.64]:43172: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 07:23:13 host2 sshd[3620689]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.74.41
country_id: 1527747
description:
2025-11-05 07:24:02 dovecot_login authenticator failed for (92-62-74-41.saimanet.kg) [92.62.74.41]:58496: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.46.192.20
country_id: 2510769
description:
2025-11-05 07:24:13 dovecot_login authenticator failed for ([193.46.192.20]) [193.46.192.20]:57797: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.14.151.205
country_id: 1880251
description:
2025-11-05 07:24:38 dovecot_login authenticator failed for bb116-14-151-205.singnet.com.sg [116.14.151.205]:50541: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.177.4.91
country_id: 1694008
description:
2025-11-05 07:32:19 dovecot_login authenticator failed for ([203.177.4.91]) [203.177.4.91]:34660: 535 Incorrect authentication data (set_id=info@cloudtourssrilanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.144.79.102
country_id: 1269750
description:
2025-11-05 07:32:27 dovecot_login authenticator failed for (aes-static-102.79.144.59.airtel.in) [59.144.79.102]:35032: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.237.119.118
country_id: 6252001
description:
2025-11-05 07:32:40 dovecot_login authenticator failed for 118-119-237-24.gci.net [24.237.119.118]:57345: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.17.124.75
country_id: 1269750
description:
2025-11-05 07:32:42 dovecot_login authenticator failed for (aes-static-075.124.17.125.airtel.in) [125.17.124.75]:56864: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.200.171.25
country_id: 290557
description:
2025-11-05 07:32:41 dovecot_login authenticator failed for ([87.200.171.25]) [87.200.171.25]:34935: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.115.128.149
country_id: 3469034
description:
2025-11-05 07:32:14 dovecot_login authenticator failed for (189.115.128.149.static.host.gvt.net.br) [189.115.128.149]:35457: 535 Incorrect authentication data (set_id=info@cloudtourssrilanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.62
country_id: 1733045
description:
2025-11-05 07:35:22 dovecot_login authenticator failed for ([49.124.151.62]) [49.124.151.62]:59616: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.214.78
country_id: 1269750
description:
2025-11-05 07:35:28 dovecot_login authenticator failed for ([128.185.214.78]) [128.185.214.78]:59428: 535 Incorrect authentication data (set_id=info@colourmarklabels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.234.54
country_id: 1269750
description:
2025-11-05 07:35:40 dovecot_login authenticator failed for (nsg-corporate-54.234.187.122.airtel.in) [122.187.234.54]:57055: 535 Incorrect authentication data (set_id=info@colourmarklabels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.193.149.88
country_id: 6252001
description:
2025-11-05 07:35:41 dovecot_login authenticator failed for ool-44c19558.dyn.optonline.net [68.193.149.88]:40475: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.143.14
country_id: 1269750
description:
2025-11-05 07:35:47 dovecot_login authenticator failed for ([103.251.143.14]) [103.251.143.14]:59954: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.228.146
country_id: 1269750
description:
2025-11-05 07:35:49 dovecot_login authenticator failed for ([125.16.32.137]) [125.20.228.146]:60596: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.233.110
country_id: 99237
description:
2025-11-05 07:36:28 dovecot_login authenticator failed for ([65.20.233.110]) [65.20.233.110]:38214: 535 Incorrect authentication data (set_id=info)


