# incident

plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.61.149.143
country_id: 6252001
description:
Jan 15 02:49:30 host2 sshd[708307]: Disconnected from invalid user artifactory 45.61.149.143 port 49280 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.129.236
country_id: 1819730
description:
Jan 15 02:48:55 host2 sshd[707922]: Disconnected from invalid user sa 152.32.129.236 port 44144 [preauth]


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 141.94.22.51
country_id: 3017382
description:
Jan 15 02:49:35 host2 sshd[708374]: User essenceceylontea from 141.94.22.51 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.61.149.143
country_id: 6252001
description:
Jan 15 02:50:08 host2 sshd[708858]: Disconnected from invalid user elastic 45.61.149.143 port 56482 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.183.74.205
country_id: 1643084
description:
Jan 15 02:51:12 host2 sshd[709749]: Disconnected from invalid user alertmanager 103.183.74.205 port 58372 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.248.201.228
country_id: 1210997
description:
Jan 15 02:51:27 host2 sshd[709983]: Disconnected from invalid user gitea 161.248.201.228 port 49468 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 66.154.117.138
country_id: 6252001
description:
Jan 15 02:52:15 host2 sshd[710562]: Disconnected from invalid user prometheus 66.154.117.138 port 48078 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.129.236
country_id: 1819730
description:
Jan 15 02:52:37 host2 sshd[710794]: Disconnected from invalid user hikvision 152.32.129.236 port 58364 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 66.154.117.138
country_id: 6252001
description:
Jan 15 02:52:42 host2 sshd[710862]: Disconnected from invalid user super 66.154.117.138 port 34128 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.179.145.192
country_id: 2635167
description:
2026-01-15 02:52:52 dovecot_login authenticator failed for H=ec2-35-179-145-192.eu-west-2.compute.amazonaws.com (172.26.4.214) [35.179.145.192]:55802: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 66.154.117.138
country_id: 6252001
description:
Jan 15 02:53:09 host2 sshd[711339]: Disconnected from invalid user avigilon 66.154.117.138 port 60912 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.248.201.228
country_id: 1210997
description:
Jan 15 02:52:49 host2 sshd[710956]: Disconnected from invalid user influxdb 161.248.201.228 port 36572 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.183.74.205
country_id: 1643084
description:
Jan 15 02:53:28 host2 sshd[711546]: Disconnected from invalid user super 103.183.74.205 port 34300 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.129.236
country_id: 1819730
description:
Jan 15 02:54:12 host2 sshd[712115]: Disconnected from invalid user super 152.32.129.236 port 45156 [preauth]


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 186.236.237.105
country_id: 3469034
description:
Jan 15 02:53:42 host2 sshd[711722]: User essenceceylontea from 186.236.237.105 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.219.172.50
country_id: 294640
description:
Jan 15 02:53:53 host2 sshd[711828]: Disconnected from invalid user mssql 62.219.172.50 port 44026 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.248.201.228
country_id: 1210997
description:
Jan 15 02:53:56 host2 sshd[711857]: Disconnected from invalid user bind 161.248.201.228 port 49846 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.183.74.205
country_id: 1643084
description:
Jan 15 02:54:04 host2 sshd[712028]: Disconnected from invalid user sysdiag 103.183.74.205 port 54916 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.183.74.205
country_id: 1643084
description:
Jan 15 02:54:38 host2 sshd[712489]: Disconnected from invalid user avigilon 103.183.74.205 port 38248 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.193.112.85
country_id: 6252001
description:
2026-01-15 03:00:51 dovecot_plain authenticator failed for H=c-98-193-112-85.hsd1.il.comcast.net (wookt) [98.193.112.85]:46000: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.16.97.90
country_id: 3469034
description:
2026-01-15 03:01:36 dovecot_login authenticator failed for H=mvx-187-16-97-90.mundivox.com [187.16.97.90]:48136: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.19.165.90
country_id: 3469034
description:
2026-01-15 03:02:27 dovecot_login authenticator failed for H=(secovi-rs.pae.gvt.net.br) [177.19.165.90]:52033: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.206.119
country_id: 1819730
description:
2026-01-15 03:02:48 dovecot_login authenticator failed for H=(m121-202-206-119.smartone.com) [121.202.206.119]:57404: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.64.71.41
country_id: 3865483
description:
Jan 15 03:06:29 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=186.64.71.41, lip=66.85.158.91, TLS, session=<lUiV5V9I2pS6QEcp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.207.15.25
country_id: 1269750
description:
2026-01-15 03:06:44 dovecot_login authenticator failed for H=(49.207.15.25.actcorp.in) [49.207.15.25]:58581: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.26.53.164
country_id: 1269750
description:
2026-01-15 03:06:17 dovecot_login authenticator failed for H=(abts-mh-dynamic-221.40.169.122.airtelbroadband.in) [103.26.53.164]:60898: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.40.218
country_id: 953987
description:
Jan 15 03:07:01 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<env_eng>, method=PLAIN, rip=102.64.40.218, lip=66.85.158.91, TLS, session=<JxRz519IBoVmQCja>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.236.163
country_id: 6252001
description:
2026-01-15 03:11:02 dovecot_plain authenticator failed for H=c-73-197-236-163.hsd1.nj.comcast.net (gatents) [73.197.236.163]:51494: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 200.105.156.165
country_id: 3923057
description:
Jan 15 03:14:36 host2 sshd[727755]: User essenceceylontea from 200.105.156.165 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 64.23.164.189
country_id: 6252001
description:
Jan 15 03:14:42 host2 sshd[727808]: User essenceceylontea from 64.23.164.189 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.70.134
country_id: 1819730
description:
2026-01-15 03:16:35 dovecot_login authenticator failed for H=42-200-70-134.static.imsbiz.com [42.200.70.134]:60640: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.158
country_id: 1269750
description:
2026-01-15 03:16:17 dovecot_login authenticator failed for H=(nsg-corporate-97.172.186.122.airtel.in) [152.52.236.158]:34424: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.132.133.54
country_id: 1269750
description:
2026-01-15 03:16:34 dovecot_login authenticator failed for H=(dsl-del-dynamic-073.72.246.61.airtelbroadband.in) [203.132.133.54]:42112: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.39
country_id: 2186224
description:
2026-01-15 03:17:00 dovecot_login authenticator failed for H=([121.73.163.39]) [121.73.163.39]:34620: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.43.3.1
country_id: 2510769
description:
2026-01-15 03:17:14 dovecot_login authenticator failed for H=1.red-81-43-3.staticip.rima-tde.net [81.43.3.1]:50426: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.230.142
country_id: 1269750
description:
2026-01-15 03:17:43 dovecot_login authenticator failed for H=([182.95.230.142]) [182.95.230.142]:49150: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.11.252.160
country_id: 3469034
description:
2026-01-15 03:21:29 dovecot_login authenticator failed for H=(187-11-252-160.dsl.telesp.net.br) [187.11.252.160]:36558: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.203.231.220
country_id: 2464461
description:
2026-01-15 03:21:11 dovecot_login authenticator failed for H=([196.203.231.220]) [196.203.231.220]:45112: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 160.202.35.100
country_id: 1831722
description:
Jan 15 03:22:18 host2 pure-ftpd[734568]: (?@160.202.35.100) [INFO] New connection from 160.202.35.100


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.180
country_id: 2542007
description:
2026-01-15 03:23:42 dovecot_plain authenticator failed for H=(anklet) [102.53.15.180]:44174: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.39.142.61
country_id: 3469034
description:
Jan 15 03:24:57 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=177.39.142.61, lip=66.85.158.91, TLS, session=<q/mYJ2BIPtOxJ449>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.42.249
country_id: 953987
description:
Jan 15 03:25:19 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<careers>, method=PLAIN, rip=102.64.42.249, lip=66.85.158.91, TLS, session=<mBThKGBIbYdmQCr5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.226.88.121
country_id: 2661886
description:
2026-01-15 03:31:00 dovecot_plain authenticator failed for H=81-226-88-121-no600.tbcn.telia.com (solical) [81.226.88.121]:50626: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.226.113.172
country_id: 3057568
description:
Jan 15 03:32:19 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<env_eng>, method=PLAIN, rip=91.226.113.172, lip=66.85.158.91, TLS, session=<GOAUQmBIvbVb4nGs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.46.43
country_id: 953987
description:
Jan 15 03:32:00 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=102.64.46.43, lip=66.85.158.91, TLS, session=<5Z/VQGBIZstmQC4r>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan 15 03:33:22 host2 sshd[741728]: Disconnected from invalid user user 2.57.121.25 port 54361 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.196.209.55
country_id: 6252001
description:
2026-01-15 03:34:07 dovecot_plain authenticator failed for H=c-98-196-209-55.hsd1.tx.comcast.net (tingued) [98.196.209.55]:59278: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.83
country_id: 6252001
description:
Jan 15 03:35:24 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=205.210.31.83, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<zw4STmBIPM/N0h9T>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.50.155
country_id: 1269750
description:
2026-01-15 03:35:53 dovecot_login authenticator failed for H=(abts-north-static-155.50.160.122.airtelbroadband.in) [122.160.50.155]:46423: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.106.155
country_id: 3469034
description:
2026-01-15 03:36:18 dovecot_login authenticator failed for H=(177-174-106-155.user.vivozap.com.br) [177.174.106.155]:44942: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.64.3.94
country_id: 1269750
description:
2026-01-15 03:36:43 dovecot_login authenticator failed for H=([127.0.0.1]) [182.64.3.94]:43306: 535 Incorrect authentication data (set_id=chitral00@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.62.42
country_id: 1269750
description:
2026-01-15 03:36:57 dovecot_login authenticator failed for H=([127.0.0.1]) [182.95.62.42]:48892: 535 Incorrect authentication data (set_id=chitral00)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.111.110
country_id: 1269750
description:
2026-01-15 03:37:34 dovecot_login authenticator failed for H=(nsg-static-97.152.75.182-airtel.com) [27.123.111.110]:35574: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.104.24.6
country_id: 3923057
description:
2026-01-15 03:38:02 dovecot_login authenticator failed for H=(SCZ-190-104-24-00006.tigo.bo) [190.104.24.6]:39606: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.17
country_id: 6251999
description:
Jan 15 03:38:25 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=85.217.149.17, lip=66.85.158.91, TLS: Connection closed, session=<72PhWGBIioJV2ZUR>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.13
country_id: 1269750
description:
2026-01-15 03:40:24 dovecot_login authenticator failed for H=(nsg-corporate-13.230.187.122.airtel.in) [122.187.230.13]:53738: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.25.186.130
country_id: 6252001
description:
2026-01-15 03:40:43 dovecot_login authenticator failed for H=(173-25-186-130.client.mchsi.com) [173.25.186.130]:54470: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.93.128.179
country_id: 1269750
description:
Jan 15 03:41:17 host2 sshd[748101]: Disconnected from invalid user ubuntu 34.93.128.179 port 55074 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 135.233.112.94
country_id: 6252001
description:
Jan 15 03:41:17 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=135.233.112.94, lip=66.85.158.92, session=<9p4mY2BIRJeH6XBe>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.220
country_id: 130758
description:
2026-01-15 03:42:45 dovecot_login authenticator failed for H=(localhost) [62.60.130.220]:60014: 535 Incorrect authentication data (set_id=office2)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 91.199.120.62
country_id: 2510769
description:
Jan 15 03:43:37 host2 pure-ftpd[749396]: (?@91.199.120.62) [WARNING] Authentication failed for user [anandaob]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.100.208.88
country_id: 1819730
description:
Jan 15 03:43:08 host2 sshd[749254]: Disconnected from invalid user ubuntu 103.100.208.88 port 51649 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.237.114.175
country_id: 3686110
description:
Jan 15 03:44:26 host2 sshd[750221]: Disconnected from invalid user ubuntu 181.237.114.175 port 45220 [preauth]


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 91.199.120.62
country_id: 2510769
description:
Jan 15 03:43:50 host2 pure-ftpd[749547]: (?@91.199.120.62) [WARNING] Authentication failed for user [anandaob]


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 186.236.237.105
country_id: 3469034
description:
Jan 15 03:45:45 host2 sshd[751493]: User essenceceylontea from 186.236.237.105 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 40.124.184.7
country_id: 6252001
description:
Jan 15 03:45:01 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=40.124.184.7, lip=66.85.158.91, session=<DH96cGBI5rMofLgH>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.237.114.175
country_id: 3686110
description:
Jan 15 03:45:16 host2 sshd[751093]: Disconnected from invalid user admin 181.237.114.175 port 58656 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.93.128.179
country_id: 1269750
description:
Jan 15 03:45:19 host2 sshd[751132]: Disconnected from invalid user ubuntu 34.93.128.179 port 54130 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 181.237.114.175
country_id: 3686110
description:
Jan 15 03:45:56 host2 sshd[751642]: Disconnected from invalid user ubuntu 181.237.114.175 port 42242 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.186.1.120
country_id: 1643084
description:
Jan 15 03:47:13 host2 sshd[753384]: Disconnected from invalid user ubuntu 103.186.1.120 port 51102 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.93.128.179
country_id: 1269750
description:
Jan 15 03:47:50 host2 sshd[754060]: Disconnected from invalid user ubuntu 34.93.128.179 port 39684 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 15 03:50:25 host2 sshd[756637]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.236.228.38
country_id: 6252001
description:
Jan 15 03:51:08 host2 dovecot[221878]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=172.236.228.38, lip=66.85.158.91, session=<Rl9ghmBIAFqs7OQm>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 15 03:51:49 host2 sshd[757690]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 147.79.100.174
country_id: 3017382
description:
Jan 15 03:55:33 host2 sshd[761596]: User essenceceylontea from 147.79.100.174 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.173.10.75
country_id: 6252001
description:
2026-01-15 03:56:04 dovecot_login authenticator failed for H=([209.173.10.75]) [209.173.10.75]:48290: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.4
country_id: 6251999
description:
Jan 15 03:57:13 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=85.217.149.4, lip=66.85.158.91, session=<XGcgnGBIfJJV2ZUE>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 38.47.94.55
country_id: 1643084
description:
Jan 15 03:59:20 host2 sshd[764680]: Disconnected from invalid user puppet 38.47.94.55 port 35504 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.187.152.61
country_id: 6252001
description:
2026-01-15 04:01:52 dovecot_login authenticator failed for H=([50.187.152.61]) [50.187.152.61]:58526: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 64.23.164.189
country_id: 6252001
description:
Jan 15 04:03:12 host2 sshd[767932]: User essenceceylontea from 64.23.164.189 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.201.237.208
country_id: 1269750
description:
2026-01-15 04:02:17 dovecot_login authenticator failed for H=(abts-west-static-208.237.201.106.airtelbroadband.in) [106.201.237.208]:60582: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan 15 04:04:08 host2 sshd[768542]: Disconnected from invalid user user 2.57.121.25 port 12774 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 13.89.124.218
country_id: 6252001
description:
Jan 15 04:04:45 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=13.89.124.218, lip=66.85.158.92, session=<UhMOt2BIUOgNWXza>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.194
country_id: 6252001
description:
Jan 15 04:05:42 host2 pure-ftpd[769972]: (?@198.235.24.194) [INFO] New connection from 198.235.24.194


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.223.92.208
country_id: 3175395
description:
2026-01-15 04:06:00 dovecot_login authenticator failed for H=(ADMIN) [176.223.92.208]:60173: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.219.235.108
country_id: 6252001
description:
Jan 15 04:08:26 host2 sshd[771856]: Invalid user cloudtourssrilan_travel from 104.219.235.108 port 65334


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.247
country_id: 1269750
description:
2026-01-15 04:09:16 dovecot_login authenticator failed for H=(nsg-corporate-247.229.187.122.airtel.in) [122.187.229.247]:42508: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.251.170
country_id: 99237
description:
2026-01-15 04:09:36 dovecot_login authenticator failed for H=([65.20.251.170]) [65.20.251.170]:39562: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.237.115.206
country_id: 732800
description:
2026-01-15 04:11:09 dovecot_login authenticator failed for H=(151.237.115.206.pronet.bg) [151.237.115.206]:50099: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.55.89.5
country_id: 1269750
description:
2026-01-15 04:11:37 dovecot_login authenticator failed for H=([103.55.89.5]) [103.55.89.5]:55636: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 68.178.207.8
country_id: 6252001
description:
Jan 15 04:23:56 host2 sshd[785381]: User essenceceylontea from 68.178.207.8 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.230.104
country_id: 1880251
description:
Jan 15 04:25:09 host2 sshd[786559]: Disconnected from invalid user guest 45.78.230.104 port 44030 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.197.123.123
country_id: 6252001
description:
Jan 15 04:25:34 host2 sshd[786939]: Disconnected from invalid user splunk 138.197.123.123 port 52820 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.192
country_id: 1269750
description:
2026-01-15 04:25:47 dovecot_login authenticator failed for H=(nsg-corporate-192.230.187.122.airtel.in) [122.187.230.192]:59376: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.92.81.41
country_id: 1819730
description:
Jan 15 04:26:27 host2 sshd[787892]: Disconnected from invalid user luis 34.92.81.41 port 41150 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.92.81.41
country_id: 1819730
description:
Jan 15 04:27:32 host2 sshd[788877]: Disconnected from invalid user honeywell 34.92.81.41 port 58728 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 34.92.81.41
country_id: 1819730
description:
Jan 15 04:28:45 host2 sshd[789963]: Disconnected from invalid user pvserver 34.92.81.41 port 56454 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 206.81.27.245
country_id: 2921044
description:
Jan 15 04:28:37 host2 sshd[789886]: Disconnected from invalid user nagios 206.81.27.245 port 55254 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.230.104
country_id: 1880251
description:
Jan 15 04:30:06 host2 sshd[791316]: Disconnected from invalid user admin 45.78.230.104 port 36284 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.197.123.123
country_id: 6252001
description:
Jan 15 04:30:14 host2 sshd[791576]: Disconnected from invalid user activemq 138.197.123.123 port 35314 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.230.104
country_id: 1880251
description:
Jan 15 04:31:06 host2 sshd[792279]: Disconnected from invalid user Admin 45.78.230.104 port 57260 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 72.17.34.38
country_id: 6252001
description:
Jan 15 04:30:29 host2 sshd[791822]: Disconnected from invalid user upload 72.17.34.38 port 54630 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.191.157.64
country_id: 6252001
description:
Jan 15 04:30:34 host2 sshd[791881]: Disconnected from invalid user hudson 172.191.157.64 port 46390 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 138.197.123.123
country_id: 6252001
description:
Jan 15 04:31:18 host2 sshd[792504]: Disconnected from invalid user ansible 138.197.123.123 port 44258 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.91.246.101
country_id: 1269750
description:
Jan 15 04:31:42 host2 sshd[792949]: Disconnected from invalid user alertmanager 103.91.246.101 port 35530 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 72.17.34.38
country_id: 6252001
description:
Jan 15 04:32:09 host2 sshd[793409]: Disconnected from invalid user extreme 72.17.34.38 port 59880 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.124
country_id: 1036973
description:
2026-01-15 04:32:46 dovecot_login authenticator failed for H=([196.28.226.124]) [196.28.226.124]:59985: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.91.246.101
country_id: 1269750
description:
Jan 15 04:32:52 host2 sshd[794192]: Disconnected from invalid user dba 103.91.246.101 port 55280 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.91.246.101
country_id: 1269750
description:
Jan 15 04:32:18 host2 sshd[793523]: Disconnected from invalid user kafka 103.91.246.101 port 36610 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.191.157.64
country_id: 6252001
description:
Jan 15 04:33:55 host2 sshd[795087]: Disconnected from invalid user nagios 172.191.157.64 port 38894 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.230.104
country_id: 1880251
description:
Jan 15 04:33:16 host2 sshd[794593]: Disconnected from invalid user avaya 45.78.230.104 port 42492 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.161.150
country_id: 1269750
description:
2026-01-15 04:33:27 dovecot_login authenticator failed for H=([122.186.230.25]) [125.19.161.150]:42606: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.208.48.177
country_id: 6252001
description:
Jan 15 04:34:35 host2 sshd[795586]: Disconnected from invalid user www-data 172.208.48.177 port 33538 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.150.243.22
country_id: 6252001
description:
2026-01-15 04:34:15 dovecot_plain authenticator failed for H=(augent) [12.150.243.22]:8913: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.191.157.64
country_id: 6252001
description:
Jan 15 04:35:29 host2 sshd[796810]: Disconnected from invalid user amcrest 172.191.157.64 port 37604 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.22
country_id: 1269750
description:
2026-01-15 04:36:49 dovecot_login authenticator failed for H=(aes-static-105.28.22.125.airtel.in) [182.95.228.22]:54010: 535 Incorrect authentication data (set_id=hostmaster@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.89.116.5
country_id: 6252001
description:
2026-01-15 04:37:07 dovecot_login authenticator failed for H=(70-89-116.5-BusName-WA.hfc.comcastbusiness.net) [70.89.116.5]:44478: 535 Incorrect authentication data (set_id=hostmaster)


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 186.236.237.105
country_id: 3469034
description:
Jan 15 04:37:58 host2 sshd[799281]: User essenceceylontea from 186.236.237.105 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.16.164.76
country_id: 2661886
description:
2026-01-15 04:38:51 dovecot_login authenticator failed for H=ip076.net-81-16-164.koping.net [81.16.164.76]:53070: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 164.92.138.29
country_id: 2921044
description:
Jan 15 04:39:34 host2 sshd[800960]: Disconnected from invalid user manager 164.92.138.29 port 13096 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.0.36.82
country_id: 1210997
description:
2026-01-15 04:40:13 dovecot_login authenticator failed for H=([49.0.36.82]) [49.0.36.82]:34186: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.50.155
country_id: 1269750
description:
2026-01-15 04:39:15 dovecot_login authenticator failed for H=(abts-north-static-155.50.160.122.airtelbroadband.in) [122.160.50.155]:51425: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.157.80.73
country_id: 2077456
description:
2026-01-15 04:39:35 dovecot_login authenticator failed for H=([120.157.80.73]) [120.157.80.73]:47624: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.251.249.72
country_id: 2300660
description:
2026-01-15 04:41:01 dovecot_login authenticator failed for H=([197.251.249.72]) [197.251.249.72]:47652: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.54.242.253
country_id: 2186224
description:
2026-01-15 04:43:18 dovecot_login authenticator failed for H=210-54-242-253.adsl.xtra.co.nz [210.54.242.253]:54696: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 13.89.125.27
country_id: 6252001
description:
Jan 15 04:47:08 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=13.89.125.27, lip=66.85.158.91, session=<CK2dTmFIlI0NWX0b>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.220.90
country_id: 1269750
description:
2026-01-15 04:47:59 dovecot_login authenticator failed for H=(dsl-tn-dynamic-137.209.22.125.airtelbroadband.in) [128.185.220.90]:54914: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.200.10
country_id: 1269750
description:
2026-01-15 04:47:17 dovecot_login authenticator failed for H=([125.19.175.85]) [122.186.200.10]:40710: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.90.8.86
country_id: 3625428
description:
Jan 15 04:49:28 host2 sshd[810557]: Disconnected from invalid user dbsnmp 200.90.8.86 port 58870 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 200.90.8.86
country_id: 3625428
description:
Jan 15 04:50:10 host2 sshd[811486]: Disconnected from invalid user testuser 200.90.8.86 port 38276 [preauth]


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 64.23.164.189
country_id: 6252001
description:
Jan 15 04:50:38 host2 sshd[811948]: User essenceceylontea from 64.23.164.189 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.90.8.86
country_id: 3625428
description:
Jan 15 04:51:30 host2 sshd[812505]: Disconnected from invalid user aladmin 200.90.8.86 port 52074 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.60.142
country_id: 1269750
description:
2026-01-15 04:51:32 dovecot_login authenticator failed for H=(nsg-corporate-142.60.186.122.airtel.in) [122.186.60.142]:59786: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.248.47.114
country_id: 6252001
description:
2026-01-15 04:52:08 dovecot_login authenticator failed for H=(syn-172-248-047-114.res.spectrum.com) [172.248.47.114]:58254: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-15 04:52:11 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:49332: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.177.185.111
country_id: 357994
description:
2026-01-15 04:52:12 dovecot_plain authenticator failed for H=(minkless) [154.177.185.111]:41036: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.231.202.201
country_id: 51537
description:
2026-01-15 04:52:49 dovecot_login authenticator failed for H=([197.231.202.201]) [197.231.202.201]:46979: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.120.90
country_id: 3469034
description:
2026-01-15 04:53:09 dovecot_login authenticator failed for H=(187-8-120-90.customer.tdatabrasil.net.br) [187.8.120.90]:43957: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.144.27.228
country_id: 6252001
description:
2026-01-15 04:53:11 dovecot_plain authenticator failed for H=c-73-144-27-228.hsd1.mi.comcast.net (wrestious) [73.144.27.228]:46816: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.129.13.184
country_id: 1880251
description:
2026-01-15 04:57:36 dovecot_login authenticator failed for H=(184.13.129.180.unknown.m1.com.sg) [180.129.13.184]:48753: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.61.6
country_id: 290557
description:
2026-01-15 04:57:56 dovecot_login authenticator failed for H=([5.32.61.6]) [5.32.61.6]:53535: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.132.221.46
country_id: 1210997
description:
2026-01-15 04:58:40 dovecot_login authenticator failed for H=([103.132.220.252]) [103.132.221.46]:52404: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 141.94.22.51
country_id: 3017382
description:
Jan 15 05:00:30 host2 sshd[821362]: User essenceceylontea from 141.94.22.51 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.223.92.208
country_id: 3175395
description:
2026-01-15 05:00:36 dovecot_login authenticator failed for H=(ADMIN) [176.223.92.208]:51990: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 135.13.8.139
country_id: 1269750
description:
Jan 15 05:10:58 host2 sshd[831227]: Disconnected from invalid user work 135.13.8.139 port 43788 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.116.165
country_id: 3144096
description:
2026-01-15 05:15:14 dovecot_login authenticator failed for H=(cm-178.232.116.165.get.no) [178.232.116.165]:58367: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan 15 05:14:39 host2 sshd[833849]: Disconnected from invalid user user 2.57.121.25 port 26137 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.58
country_id: 1149361
description:
2026-01-15 05:15:52 dovecot_login authenticator failed for H=([149.54.62.58]) [149.54.62.58]:50448: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.156.131.17
country_id: 2264397
description:
Jan 15 05:16:50 host2 dovecot[221878]: imap-login: Disconnected: Connection closed: SSL_read failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=45.156.131.17, lip=66.85.158.92, TLS: SSL_read failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<DCrauGFIVLItnIMR>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.156.131.20
country_id: 2264397
description:
Jan 15 05:16:52 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=45.156.131.20, lip=66.85.158.92, TLS, session=<HbjxuGFIbcYtnIMU>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.156.131.19
country_id: 2264397
description:
Jan 15 05:16:53 host2 dovecot[221878]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=45.156.131.19, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<ZjUDuWFIJ4UtnIMT>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.156.131.18
country_id: 2264397
description:
Jan 15 05:16:57 host2 dovecot[221878]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:142090FC:SSL routines:tls_early_post_process_client_hello:unknown protocol (no auth attempts in 0 secs): user=<>, rip=45.156.131.18, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:142090FC:SSL routines:tls_early_post_process_client_hello:unknown protocol, session=<dHNHuWFI64EtnIMS>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 45.156.131.20
country_id: 2264397
description:
Jan 15 05:16:50 host2 dovecot[221878]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=45.156.131.20, lip=66.85.158.92, TLS, session=<qPbRuGFIB+ktnIMU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.25.113.218
country_id: 953987
description:
2026-01-15 05:22:45 dovecot_login authenticator failed for H=([196.25.113.220]) [196.25.113.218]:59945: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.170.3.81
country_id: 3996063
description:
Jan 15 05:25:09 host2 sshd[841818]: Disconnected from invalid user maint 187.170.3.81 port 58348 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.154.255
country_id: 1269750
description:
Jan 15 05:24:53 host2 sshd[841508]: Disconnected from invalid user couchbase 103.172.154.255 port 58018 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.117.58.67
country_id: 614540
description:
Jan 15 05:27:56 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=85.117.58.67, lip=66.85.158.91, TLS, session=<c7qM32FI3pJVdTpD>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.143.92.55
country_id: 2510769
description:
Jan 15 05:28:24 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<env_eng>, method=PLAIN, rip=185.143.92.55, lip=66.85.158.91, TLS, session=<8Vw+4WFIFo25j1w3>


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 186.236.237.105
country_id: 3469034
description:
Jan 15 05:29:59 host2 sshd[845228]: User essenceceylontea from 186.236.237.105 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 187.170.3.81
country_id: 3996063
description:
Jan 15 05:29:41 host2 sshd[845053]: Disconnected from invalid user mongo 187.170.3.81 port 60112 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.10.31.88
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 216.10.31.88 - topviewl "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.47.2
country_id: 1269750
description:
2026-01-15 05:31:52 dovecot_login authenticator failed for H=([122.184.143.81]) [182.95.47.2]:59002: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.144.20
country_id: 3996063
description:
2026-01-15 05:32:34 dovecot_login authenticator failed for H=([177.236.144.20]) [177.236.144.20]:44067: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 15 05:32:57 host2 sshd[847504]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 15 05:34:21 host2 sshd[848401]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.220
country_id: 130758
description:
2026-01-15 05:35:55 dovecot_login authenticator failed for H=(localhost) [62.60.130.220]:61575: 535 Incorrect authentication data (set_id=bx)


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 64.23.164.189
country_id: 6252001
description:
Jan 15 05:37:13 host2 sshd[850456]: User essenceceylontea from 64.23.164.189 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.188.253.150
country_id: 1269750
description:
2026-01-15 05:38:40 dovecot_login authenticator failed for H=([180.188.253.150]) [180.188.253.150]:58492: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.141.216.143
country_id: 298795
description:
2026-01-15 05:38:59 dovecot_login authenticator failed for H=([31.141.216.143]) [31.141.216.143]:36480: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 40.124.175.233
country_id: 6252001
description:
Jan 15 05:44:32 host2 pure-ftpd[855812]: (?@40.124.175.233) [INFO] New connection from 40.124.175.233


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.27.83
country_id: 1643084
description:
2026-01-15 05:45:10 dovecot_login authenticator failed for H=(ip-arana.net.id.as132673) [103.90.27.83]:45574: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 141.94.22.51
country_id: 3017382
description:
Jan 15 05:44:42 host2 sshd[855939]: User essenceceylontea from 141.94.22.51 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.245.0.246
country_id: 1880251
description:
2026-01-15 05:45:45 dovecot_login authenticator failed for H=(246.0.245.49.unknown.m1.com.sg) [49.245.0.246]:56019: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.56
country_id: 6252001
description:
Jan 15 05:48:17 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.56, lip=66.85.158.92, TLS, session=<T/1OKWJIuurG6xg4>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.116.22
country_id: 1861060
description:
Jan 15 05:48:21 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=139.162.116.22, lip=66.85.158.92, TLS: Connection closed, session=<zluOKWJInICLonQW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.166.153.20
country_id: 6252001
description:
2026-01-15 05:51:12 dovecot_plain authenticator failed for H=c-174-166-153-20.hsd1.nj.comcast.net (troctorted) [174.166.153.20]:51612: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 89.249.55.106
country_id: 2017370
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 89.249.55.106 - neotechl "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user neotechl (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.223.92.208
country_id: 3175395
description:
2026-01-15 05:54:14 dovecot_login authenticator failed for H=(ADMIN) [176.223.92.208]:57616: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 122.175.193.205
country_id: 1269750
description:
Jan 15 05:55:24 host2 sshd[865754]: User essenceceylontea from 122.175.193.205 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.30.161.197
country_id: 690791
description:
2026-01-15 06:01:09 dovecot_login authenticator failed for H=([46.30.161.197]) [46.30.161.197]:43528: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.99.61.248
country_id: 1269750
description:
2026-01-15 06:01:28 dovecot_login authenticator failed for H=([14.99.61.248]) [14.99.61.248]:43350: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 134.209.102.173
country_id: 1880251
description:
2026-01-15 06:06:01 dovecot_login authenticator failed for H=([134.209.102.173]) [134.209.102.173]:44006: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.41.173.77
country_id: 3017382
description:
2026-01-15 06:06:18 dovecot_login authenticator failed for H=77-173-41-213.cust.keyyo.net [213.41.173.77]:33317: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 165.232.179.250
country_id: 1269750
description:
Jan 15 06:11:07 host2 sshd[877928]: User essenceceylontea from 165.232.179.250 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.196.10.62
country_id: 2635167
description:
Jan 15 06:12:06 host2 sshd[878684]: Disconnected from invalid user installer 185.196.10.62 port 54296 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.183.138
country_id: 1269750
description:
2026-01-15 06:12:59 dovecot_login authenticator failed for H=([127.0.0.1]) [125.23.183.138]:53734: 535 Incorrect authentication data (set_id=inf@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.9
country_id: 1733045
description:
2026-01-15 06:13:12 dovecot_login authenticator failed for H=([127.0.0.1]) [49.124.152.9]:42828: 535 Incorrect authentication data (set_id=inf)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.196.10.62
country_id: 2635167
description:
Jan 15 06:16:32 host2 sshd[881686]: Disconnected from invalid user sendmail 185.196.10.62 port 57118 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.252.65
country_id: 1819730
description:
Jan 15 06:16:58 host2 sshd[881967]: Disconnected from invalid user radius 152.32.252.65 port 50320 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.252.65
country_id: 1819730
description:
Jan 15 06:17:40 host2 sshd[882450]: Disconnected from invalid user redhat 152.32.252.65 port 59680 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.252.65
country_id: 1819730
description:
Jan 15 06:18:21 host2 sshd[883061]: Disconnected from invalid user dell 152.32.252.65 port 49738 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.196.10.62
country_id: 2635167
description:
Jan 15 06:21:03 host2 sshd[885251]: Disconnected from invalid user admin 185.196.10.62 port 51010 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.4
country_id: 99237
description:
2026-01-15 06:22:26 dovecot_plain authenticator failed for H=(droyely) [65.20.133.4]:38644: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.54
country_id: 3144096
description:
2026-01-15 06:24:23 dovecot_login authenticator failed for H=(54-170-97-62.cust.smartcall.no) [62.97.170.54]:44193: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.254.54
country_id: 1269750
description:
2026-01-15 06:24:26 dovecot_login authenticator failed for H=([128.185.254.54]) [128.185.254.54]:42774: 535 Incorrect authentication data (set_id=postmaster@euroentertainmentlk.com)


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 64.23.164.189
country_id: 6252001
description:
Jan 15 06:24:36 host2 sshd[887747]: User essenceceylontea from 64.23.164.189 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.124.46
country_id: 1269750
description:
2026-01-15 06:24:46 dovecot_login authenticator failed for H=([122.184.124.46]) [122.184.124.46]:33552: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan 15 06:24:54 host2 sshd[887924]: Disconnected from invalid user user 2.57.121.25 port 10473 [preauth]


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 147.79.100.174
country_id: 3017382
description:
Jan 15 06:29:53 host2 sshd[891666]: User essenceceylontea from 147.79.100.174 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.242.142
country_id: 1269750
description:
2026-01-15 06:31:03 dovecot_login authenticator failed for H=([182.78.242.142]) [182.78.242.142]:37740: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.86.102
country_id: 1269750
description:
2026-01-15 06:30:38 dovecot_login authenticator failed for H=([182.79.86.102]) [182.79.86.102]:39112: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 68.178.207.8
country_id: 6252001
description:
Jan 15 06:33:22 host2 sshd[894781]: User essenceceylontea from 68.178.207.8 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 164.90.225.61
country_id: 2921044
description:
Jan 15 06:37:59 host2 sshd[898564]: Disconnected from invalid user sambauser 164.90.225.61 port 36194 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.164.137
country_id: 99237
description:
2026-01-15 06:39:09 dovecot_plain authenticator failed for H=(misna) [65.20.164.137]:41148: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 200.105.156.165
country_id: 3923057
description:
Jan 15 06:38:29 host2 sshd[898919]: User essenceceylontea from 200.105.156.165 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 164.90.225.61
country_id: 2921044
description:
Jan 15 06:39:42 host2 sshd[899705]: Disconnected from invalid user admin 164.90.225.61 port 48174 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 164.90.225.61
country_id: 2921044
description:
Jan 15 06:40:12 host2 sshd[900187]: Disconnected from invalid user dynamics 164.90.225.61 port 57526 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.223.92.208
country_id: 3175395
description:
2026-01-15 06:48:44 dovecot_login authenticator failed for H=(ADMIN) [176.223.92.208]:54083: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 122.175.193.205
country_id: 1269750
description:
Jan 15 06:49:16 host2 sshd[907051]: User essenceceylontea from 122.175.193.205 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.56.174.63
country_id: 3686110
description:
2026-01-15 06:49:18 dovecot_login authenticator failed for H=([127.0.0.1]) [181.56.174.63]:60860: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.156.94.19
country_id: 1861060
description:
2026-01-15 06:49:26 dovecot_login authenticator failed for H=19.94.156.220.rev.iijmobile.jp ([127.0.0.1]) [220.156.94.19]:36530: 535 Incorrect authentication data (set_id=kasunp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.173.58.47
country_id: 6252001
description:
2026-01-15 06:51:06 dovecot_plain authenticator failed for H=c-67-173-58-47.hsd1.il.comcast.net (tince) [67.173.58.47]:58662: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.130.176.136
country_id: 6252001
description:
2026-01-15 06:54:51 dovecot_login authenticator failed for H=mobile-166-130-176-136.mycingular.net [166.130.176.136]:50711: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.72.153.110
country_id: 290557
description:
2026-01-15 06:55:16 dovecot_login authenticator failed for H=([91.72.153.110]) [91.72.153.110]:46618: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.0.90.82
country_id: 2077456
description:
2026-01-15 06:55:20 dovecot_login authenticator failed for H=210.0.90.82.static.nexnet.net.au [210.0.90.82]:60458: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.120.1.74
country_id: 6252001
description:
2026-01-15 06:55:29 dovecot_login authenticator failed for H=(syn-070-120-001-074.res.spectrum.com) [70.120.1.74]:61693: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 152.32.251.174
country_id: 1819730
description:
Jan 15 06:55:42 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=152.32.251.174, lip=66.85.158.92, TLS handshaking: Connection closed, session=<x85yGmNImqCYIPuu>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.142.154.90
country_id: 1819730
description:
Jan 15 06:55:59 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=45.142.154.90, lip=66.85.158.91, TLS, session=<AatnG2NIPBUtjppa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.150.243.22
country_id: 6252001
description:
2026-01-15 06:56:01 dovecot_plain authenticator failed for H=(ovant) [12.150.243.22]:63515: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.214.101.251
country_id: 3144096
description:
2026-01-15 06:56:10 dovecot_login authenticator failed for H=([127.0.0.1]) [84.214.101.251]:56574: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.122.215.23
country_id: 6252001
description:
2026-01-15 06:56:23 dovecot_login authenticator failed for H=([127.0.0.1]) [98.122.215.23]:39480: 535 Incorrect authentication data (set_id=kasunp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.99.14
country_id: 290557
description:
2026-01-15 06:58:09 dovecot_plain authenticator failed for H=(flulthed) [5.32.99.14]:38433: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.175.185.90
country_id: 690791
description:
Jan 15 07:00:04 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=46.175.185.90, lip=66.85.158.91, TLS, session=<t2IDKWNIY4our7la>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.192.179.147
country_id: 798544
description:
Jan 15 07:00:21 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<careers>, method=PLAIN, rip=193.192.179.147, lip=66.85.158.91, TLS, session=<l+AVKmNIBcvBwLOT>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.19.12.103
country_id: 2635167
description:
2026-01-15 07:01:30 dovecot_login authenticator failed for H=cpc122100-bmly10-2-0-cust102.2-3.cable.virginm.net [82.19.12.103]:44113: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.192.245.178
country_id: 1269750
description:
2026-01-15 07:01:19 dovecot_login authenticator failed for H=(dhcp-192-245-178.in2cable.com) [203.192.245.178]:42076: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 165.232.179.250
country_id: 1269750
description:
Jan 15 07:01:24 host2 sshd[916720]: User essenceceylontea from 165.232.179.250 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.154
country_id: 3144096
description:
2026-01-15 07:02:07 dovecot_login authenticator failed for H=(cm-84.213.189.154.get.no) [84.213.189.154]:36785: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 38.252.64.174
country_id: 3469034
description:
Jan 15 07:02:07 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=38.252.64.174, lip=66.85.158.91, TLS, session=<7K1TMGNIVr4m/ECu>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.15.216.41
country_id: 6252001
description:
2026-01-15 07:02:17 dovecot_plain authenticator failed for H=c-24-15-216-41.hsd1.il.comcast.net (falivendly) [24.15.216.41]:58814: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 168.0.224.104
country_id: 3469034
description:
Jan 15 07:02:27 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<env_eng>, method=PLAIN, rip=168.0.224.104, lip=66.85.158.91, TLS, session=<1Dp9MWNIZdmoAOBo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-15 07:03:45 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (proge) [87.103.126.54]:37950: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan 15 07:04:27 host2 sshd[918965]: Disconnected from invalid user user 2.57.121.25 port 23646 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.231.243.28
country_id: 6252001
description:
2026-01-15 07:06:02 dovecot_login authenticator failed for H=([50.231.243.28]) [50.231.243.28]:40270: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 18.192.58.4
country_id: 2921044
description:
2026-01-15 07:06:45 dovecot_login authenticator failed for H=ec2-18-192-58-4.eu-central-1.compute.amazonaws.com (172.26.13.22) [18.192.58.4]:51701: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.40.101.10
country_id: 6252001
description:
2026-01-15 07:06:50 dovecot_plain authenticator failed for H=c-98-40-101-10.hsd1.tn.comcast.net (nistry) [98.40.101.10]:44824: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.214.109.76
country_id: 3144096
description:
2026-01-15 07:08:01 dovecot_login authenticator failed for H=([127.0.0.1]) [84.214.109.76]:44180: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.185.190
country_id: 1269750
description:
2026-01-15 07:08:10 dovecot_login authenticator failed for H=([127.0.0.1]) [122.185.185.190]:38350: 535 Incorrect authentication data (set_id=kasunp)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.86.180.10
country_id: 1269750
description:
Jan 15 07:09:43 host2 sshd[922825]: Disconnected from invalid user kubernetes 103.86.180.10 port 46850 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.129.140
country_id: 1819730
description:
Jan 15 07:10:26 host2 sshd[923451]: Disconnected from invalid user acti 152.32.129.140 port 56906 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.86.180.10
country_id: 1269750
description:
Jan 15 07:12:22 host2 sshd[925012]: Disconnected from invalid user artifactory 103.86.180.10 port 37294 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.86.180.10
country_id: 1269750
description:
Jan 15 07:11:42 host2 sshd[924438]: Disconnected from invalid user apps 103.86.180.10 port 59848 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.129.140
country_id: 1819730
description:
Jan 15 07:13:08 host2 sshd[925567]: Disconnected from invalid user test 152.32.129.140 port 43952 [preauth]


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 186.236.237.105
country_id: 3469034
description:
Jan 15 07:14:10 host2 sshd[926306]: User essenceceylontea from 186.236.237.105 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.129.140
country_id: 1819730
description:
Jan 15 07:13:46 host2 sshd[925981]: Disconnected from invalid user enable 152.32.129.140 port 55382 [preauth]


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 141.94.22.51
country_id: 3017382
description:
Jan 15 07:13:49 host2 sshd[926062]: User essenceceylontea from 141.94.22.51 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.145.10.140
country_id: 6252001
description:
2026-01-15 07:15:26 dovecot_plain authenticator failed for H=c-76-145-10-140.hsd1.ga.comcast.net (nuffato) [76.145.10.140]:54260: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.89.28.139
country_id: 1643084
description:
Jan 15 07:14:39 host2 sshd[926679]: Disconnected from invalid user kerberos 36.89.28.139 port 36000 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.89.28.139
country_id: 1643084
description:
Jan 15 07:16:56 host2 sshd[928494]: Disconnected from invalid user salt 36.89.28.139 port 35694 [preauth]


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 68.178.207.8
country_id: 6252001
description:
Jan 15 07:17:28 host2 sshd[928959]: User essenceceylontea from 68.178.207.8 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 36.89.28.139
country_id: 1643084
description:
Jan 15 07:17:45 host2 sshd[929111]: Disconnected from invalid user sendmail 36.89.28.139 port 60420 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.11.250.54
country_id: 3469034
description:
Jan 15 07:19:35 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<training@v-deploy.com>, method=PLAIN, rip=177.11.250.54, lip=66.85.158.91, TLS, session=<vrqgbmNIRe2xC/o2>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.255.215.175
country_id: 732800
description:
Jan 15 07:19:36 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<training@v-deploy.com>, method=PLAIN, rip=185.255.215.175, lip=66.85.158.91, TLS, session=<Si3cbmNIDJe5/9ev>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.125.248.92
country_id: 798544
description:
Jan 15 07:19:56 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<training>, method=PLAIN, rip=109.125.248.92, lip=66.85.158.91, TLS, session=<6M32b2NIMRJtffhc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.142.125
country_id: 99237
description:
Jan 15 07:19:56 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<training>, method=PLAIN, rip=65.20.142.125, lip=66.85.158.91, TLS, session=<UxsMcGNIFdhBFI59>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.205.197
country_id: 99237
description:
2026-01-15 07:23:45 dovecot_plain authenticator failed for H=(plaste) [65.20.205.197]:56236: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.183.74.177
country_id: 6252001
description:
2026-01-15 07:23:48 dovecot_plain authenticator failed for H=c-73-183-74-177.hsd1.pa.comcast.net (iscrous) [73.183.74.177]:45972: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 73.190.196.228
country_id: 6252001
description:
Jan 15 07:28:29 host2 dovecot[221878]: imap-login: Disconnected: Aborted login by logging out (auth failed, 1 attempts in 2 secs): user=<training@v-deploy.com>, method=PLAIN, rip=73.190.196.228, lip=66.85.158.91, TLS, session=<HtuLj2NIjuRJvsTk>


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 98.191.229.175
country_id: 6252001
description:
Jan 15 07:28:23 host2 sshd[936715]: Disconnecting authenticating user root 98.191.229.175 port 51608: Too many authentication failures [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 98.191.229.175
country_id: 6252001
description:
Jan 15 07:28:31 host2 sshd[936780]: Disconnecting invalid user admin 98.191.229.175 port 53526: Too many authentication failures [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.237.58
country_id: 1269750
description:
2026-01-15 07:27:41 dovecot_login authenticator failed for H=([127.0.0.1]) [125.23.237.58]:53256: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.3
country_id: 1733045
description:
2026-01-15 07:27:55 dovecot_login authenticator failed for H=([127.0.0.1]) [49.124.152.3]:39474: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 98.191.229.175
country_id: 6252001
description:
Jan 15 07:28:23 host2 sshd[936715]: error: maximum authentication attempts exceeded for root from 98.191.229.175 port 51608 ssh2 [preauth]


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 200.105.156.165
country_id: 3923057
description:
Jan 15 07:31:02 host2 sshd[938628]: User essenceceylontea from 200.105.156.165 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.174.18
country_id: 1269750
description:
2026-01-15 07:32:01 dovecot_login authenticator failed for H=([152.52.234.33]) [182.95.174.18]:57768: 535 Incorrect authentication data (set_id=signinhr)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 185.177.72.70
country_id: 3017382
description:
Denial of Service (DoS) attack was discovered from 185.177.72.70: 250 connections per 30 seconds to 80 port.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.186.193.149
country_id: 1643084
description:
2026-01-15 07:31:49 dovecot_login authenticator failed for H=([103.186.193.149]) [103.186.193.149]:43452: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.220
country_id: 130758
description:
2026-01-15 07:33:13 dovecot_login authenticator failed for H=(localhost) [62.60.130.220]:65142: 535 Incorrect authentication data (set_id=lina@dipendajatim.go.id)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 194.164.107.4
country_id: 6252001
description:
Jan 15 07:33:44 host2 dovecot[221878]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 2 secs): user=<>, rip=194.164.107.4, lip=66.85.158.91, TLS, session=<bLtqomNI4trCpGsE>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.27.83
country_id: 1643084
description:
2026-01-15 07:37:46 dovecot_login authenticator failed for H=(ip-arana.net.id.as132673) [103.90.27.83]:56892: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.183
country_id: 3144096
description:
2026-01-15 07:38:17 dovecot_login authenticator failed for H=([84.213.189.183]) [84.213.189.183]:51329: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan 15 07:39:29 host2 sshd[944730]: Disconnected from invalid user user 2.57.121.25 port 13133 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2026-01-15 07:40:08 dovecot_login authenticator failed for H=([196.216.81.126]) [196.216.81.126]:50164: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.155.189
country_id: 1733045
description:
2026-01-15 07:40:47 dovecot_login authenticator failed for H=([49.124.155.189]) [49.124.155.189]:41414: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.223.92.208
country_id: 3175395
description:
2026-01-15 07:42:08 dovecot_login authenticator failed for H=(ADMIN) [176.223.92.208]:54008: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.150.135.19
country_id: 690791
description:
2026-01-15 07:45:04 dovecot_login authenticator failed for H=(19.135.150.178.triolan.net) [178.150.135.19]:22773: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.220
country_id: 6252001
description:
Jan 15 07:45:22 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.220, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<mh0JzGNIedbN0h/c>


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 122.175.193.205
country_id: 1269750
description:
Jan 15 07:46:34 host2 sshd[950052]: User essenceceylontea from 122.175.193.205 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 165.232.179.250
country_id: 1269750
description:
Jan 15 07:51:56 host2 sshd[954248]: User essenceceylontea from 165.232.179.250 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 141.94.22.51
country_id: 3017382
description:
Jan 15 07:57:48 host2 sshd[959416]: User essenceceylontea from 141.94.22.51 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 64.23.164.189
country_id: 6252001
description:
Jan 15 08:01:09 host2 sshd[962098]: User essenceceylontea from 64.23.164.189 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.168.35.240
country_id: 2077456
description:
2026-01-15 08:02:46 dovecot_login authenticator failed for H=([101.168.35.240]) [101.168.35.240]:58164: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.129.13.184
country_id: 1880251
description:
2026-01-15 08:03:16 dovecot_login authenticator failed for H=(184.13.129.180.unknown.m1.com.sg) [180.129.13.184]:35501: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.127.86
country_id: 1269750
description:
2026-01-15 08:03:30 dovecot_login authenticator failed for H=(dsl-ncr-dynamic-097.178.23.125.airtelbroadband.in) [182.79.127.86]:42612: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 117.102.17.18
country_id: 1168579
description:
Jan 15 08:03:49 host2 sshd[964016]: Disconnected from invalid user ubuntu 117.102.17.18 port 33724 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.102.17.18
country_id: 1168579
description:
Jan 15 08:03:10 host2 sshd[963542]: Disconnected from invalid user admin 117.102.17.18 port 46284 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.102.17.18
country_id: 1168579
description:
Jan 15 08:04:23 host2 sshd[964402]: Disconnected from invalid user admin 117.102.17.18 port 34198 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.102.17.18
country_id: 1168579
description:
Jan 15 08:04:58 host2 sshd[964732]: Disconnected from invalid user admin 117.102.17.18 port 50584 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.146.238.122
country_id: 2542007
description:
2026-01-15 08:07:36 dovecot_login authenticator failed for H=([154.146.238.122]) [154.146.238.122]:54540: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 186.236.237.105
country_id: 3469034
description:
Jan 15 08:06:58 host2 sshd[966334]: User essenceceylontea from 186.236.237.105 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.12.241.225
country_id: 6252001
description:
2026-01-15 08:07:29 dovecot_login authenticator failed for H=([71.12.241.225]) [71.12.241.225]:40086: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 67.222.132.207
country_id: 6252001
description:
Jan 15 08:09:34 host2 sshd[968267]: Disconnected from invalid user admin 67.222.132.207 port 59032 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.93.168.44
country_id: 298795
description:
Jan 15 08:10:25 host2 sshd[968986]: Disconnected from invalid user ubuntu 45.93.168.44 port 39024 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 67.222.132.207
country_id: 6252001
description:
Jan 15 08:11:31 host2 sshd[969801]: Disconnected from invalid user ubuntu 67.222.132.207 port 59226 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.168.136.150
country_id: 6252001
description:
2026-01-15 08:11:42 dovecot_plain authenticator failed for H=c-73-168-136-150.hsd1.il.comcast.net (conthely) [73.168.136.150]:39946: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.93.168.44
country_id: 298795
description:
Jan 15 08:11:47 host2 sshd[970141]: Disconnected from invalid user ubuntu 45.93.168.44 port 36446 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 15 08:12:20 host2 sshd[970679]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 67.222.132.207
country_id: 6252001
description:
Jan 15 08:12:03 host2 sshd[970427]: Disconnected from invalid user admin 67.222.132.207 port 59294 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.93.168.44
country_id: 298795
description:
Jan 15 08:12:14 host2 sshd[970557]: Disconnected from invalid user ubuntu 45.93.168.44 port 41212 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.231.25.64
country_id: 3686110
description:
2026-01-15 08:12:44 dovecot_login authenticator failed for H=(1522312565.colombiatel.co) [152.231.25.64]:43862: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 67.222.132.207
country_id: 6252001
description:
Jan 15 08:13:07 host2 sshd[971409]: Disconnected from invalid user ubuntu 67.222.132.207 port 59430 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.210.151.158
country_id: 3144096
description:
2026-01-15 08:13:41 dovecot_login authenticator failed for H=([84.210.151.158]) [84.210.151.158]:47919: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.150.243.22
country_id: 6252001
description:
2026-01-15 08:16:26 dovecot_plain authenticator failed for H=(antler) [12.150.243.22]:44603: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.174.35
country_id: 1269750
description:
2026-01-15 08:17:11 dovecot_login authenticator failed for H=(nsg-corporate-35.174.186.122.airtel.in) [122.186.174.35]:45426: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.215.74.195
country_id: 2661886
description:
2026-01-15 08:17:16 dovecot_plain authenticator failed for H=217-215-74-195-no2620.tbcn.telia.com (adried) [217.215.74.195]:37324: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.66
country_id: 1269750
description:
2026-01-15 08:17:27 dovecot_login authenticator failed for H=(nsg-corporate-66.230.187.122.airtel.in) [122.187.230.66]:51858: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.64.65.30
country_id: 2264397
description:
2026-01-15 08:18:06 dovecot_login authenticator failed for H=bl23-65-30.dsl.telepac.pt [144.64.65.30]:2689: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.159.179
country_id: 1733045
description:
2026-01-15 08:18:44 dovecot_login authenticator failed for H=([49.124.159.179]) [49.124.159.179]:33186: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.248.107.130
country_id: 1269750
description:
2026-01-15 08:19:07 dovecot_login authenticator failed for H=([115.244.235.242]) [117.248.107.130]:36332: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.249.76.221
country_id: 1269750
description:
2026-01-15 08:19:19 dovecot_login authenticator failed for H=(static-221.76.249.49-tataidc.co.in) [49.249.76.221]:53834: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.156.2
country_id: 1269750
description:
2026-01-15 08:19:46 dovecot_login authenticator failed for H=([125.19.156.2]) [125.19.156.2]:36796: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.141.18.69
country_id: 6252001
description:
2026-01-15 08:22:21 dovecot_login authenticator failed for H=(209-141-18-69.sfn.uct-usa.com) [209.141.18.69]:54577: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 200.105.156.165
country_id: 3923057
description:
Jan 15 08:22:27 host2 sshd[978392]: User essenceceylontea from 200.105.156.165 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.59.26
country_id: 1269750
description:
2026-01-15 08:31:12 dovecot_login authenticator failed for H=([125.23.125.209]) [122.187.59.26]:43766: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.148.44.92
country_id: 2077456
description:
2026-01-15 08:31:31 dovecot_login authenticator failed for H=ip-206-148-44-92.internet.url.net.au [206.148.44.92]:40989: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 143.244.33.80
country_id: 1880251
description:
[2025-12-26 17:26:14 +0530] info [webmaild] 143.244.33.80 - 587hr@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.156.2
country_id: 1269750
description:
2026-01-15 08:34:48 dovecot_login authenticator failed for H=([125.19.156.2]) [125.19.156.2]:47248: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2026-01-15 08:35:33 dovecot_login authenticator failed for H=c-71-62-34-216.hsd1.va.comcast.net [71.62.34.216]:41254: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.239.41.74
country_id: 3469034
description:
2026-01-15 08:36:38 dovecot_login authenticator failed for H=([186.239.41.74]) [186.239.41.74]:55354: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.223.92.208
country_id: 3175395
description:
2026-01-15 08:36:58 dovecot_login authenticator failed for H=(ADMIN) [176.223.92.208]:60478: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.223.240.239
country_id: 49518
description:
2026-01-15 08:37:51 dovecot_login authenticator failed for H=([196.223.240.239]) [196.223.240.239]:49070: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.191.124.201
country_id: 1269750
description:
2026-01-15 08:38:06 dovecot_login authenticator failed for H=([160.191.124.201]) [160.191.124.201]:52721: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.103
country_id: 6252001
description:
Jan 15 08:39:53 host2 dovecot[221878]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=147.185.132.103, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<2UsDj2RI9sCTuYRn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.252.63
country_id: 3865483
description:
Jan 15 08:41:21 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=179.0.252.63, lip=66.85.158.91, TLS, session=<iqD7kmRIQa6zAPw/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.40.123
country_id: 953987
description:
Jan 15 08:41:42 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<careers>, method=PLAIN, rip=102.64.40.123, lip=66.85.158.91, TLS, session=<KO1alGRI4udmQCh7>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 15 08:42:22 host2 sshd[994173]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.65.99
country_id: 3144096
description:
2026-01-15 08:42:14 dovecot_login authenticator failed for H=(cm-178.232.65.99.get.no) [178.232.65.99]:34014: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.231.202.201
country_id: 51537
description:
2026-01-15 08:42:36 dovecot_login authenticator failed for H=([197.231.202.201]) [197.231.202.201]:60601: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.107.36.18
country_id: 1269750
description:
2026-01-15 08:46:34 dovecot_login authenticator failed for H=([103.107.36.18]) [103.107.36.18]:56642: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.194
country_id: 1269750
description:
2026-01-15 08:47:20 dovecot_login authenticator failed for H=([122.187.230.194]) [122.187.230.194]:44882: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.219.149.74
country_id: 2328926
description:
2026-01-15 08:47:29 dovecot_login authenticator failed for H=([41.219.149.76]) [41.219.149.74]:59189: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.156.2
country_id: 1269750
description:
2026-01-15 08:47:51 dovecot_login authenticator failed for H=([128.185.217.149]) [125.19.156.2]:41296: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.98.174
country_id: 1269750
description:
2026-01-15 08:49:23 dovecot_login authenticator failed for H=(nsg-corporate-217.166.185.122.airtel.in) [27.123.98.174]:39090: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 185.177.72.10
country_id: 3017382
description:
Denial of Service (DoS) attack was discovered from 185.177.72.10: 250 connections per 30 seconds to 443 port.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.206
country_id: 1269750
description:
2026-01-15 08:49:07 dovecot_login authenticator failed for H=([125.20.154.97]) [182.95.178.206]:44234: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.135.117.245
country_id: 6252001
description:
2026-01-15 08:50:38 dovecot_login authenticator failed for H=107-135-117-245.lightspeed.livnmi.sbcglobal.net [107.135.117.245]:43632: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.219.149.74
country_id: 2328926
description:
2026-01-15 08:49:52 dovecot_login authenticator failed for H=(netcomafrica.com) [41.219.149.74]:5962: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 64.23.164.189
country_id: 6252001
description:
Jan 15 08:50:12 host2 sshd[1002063]: User essenceceylontea from 64.23.164.189 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.140.218.210
country_id: 1269750
description:
2026-01-15 08:50:16 dovecot_login authenticator failed for H=(14.140.218.210.static-bangalore-vsnl.net.in) [14.140.218.210]:59237: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.210.118
country_id: 1269750
description:
2026-01-15 08:50:24 dovecot_login authenticator failed for H=([125.17.48.129]) [152.52.210.118]:45306: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.128.112.204
country_id: 3017382
description:
2026-01-15 08:51:55 dovecot_login authenticator failed for H=217-128-112-204.ftth.fr.orangecustomers.net [217.128.112.204]:56214: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.250.250
country_id: 1269750
description:
2026-01-15 08:52:27 dovecot_login authenticator failed for H=(nsg-corporate-250.250.187.122.airtel.in) [122.187.250.250]:52682: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 13.68.214.34
country_id: 6252001
description:
2026-01-15 08:52:51 dovecot_login authenticator failed for H=([13.68.214.34]) [13.68.214.34]:56632: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.230.127.217
country_id: 1512440
description:
2026-01-15 08:53:09 dovecot_login authenticator failed for H=([213.230.127.217]) [213.230.127.217]:48860: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.218.2
country_id: 1269750
description:
2026-01-15 08:56:30 dovecot_login authenticator failed for H=([61.246.205.1]) [125.19.218.2]:42968: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 185.247.137.27
country_id: 2635167
description:
Jan 15 08:56:59 host2 pure-ftpd[1007823]: (?@185.247.137.27) [INFO] New connection from 185.247.137.27


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.138.74
country_id: 1269750
description:
2026-01-15 08:58:08 dovecot_login authenticator failed for H=([128.185.241.213]) [125.19.138.74]:37266: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.114.243.85
country_id: 3625428
description:
2026-01-15 08:58:43 dovecot_login authenticator failed for H=([190.114.243.80]) [190.114.243.85]:41411: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.172.172.184
country_id: 2921044
description:
Jan 15 08:58:42 host2 sshd[1009029]: Invalid user agronatureholdings from 167.172.172.184 port 56716


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.148
country_id: 2635167
description:
Jan 15 08:58:48 host2 dovecot[221878]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=35.203.210.148, lip=66.85.158.92, session=<KZyw0mRIzP4jy9KU>


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 186.236.237.105
country_id: 3469034
description:
Jan 15 09:00:09 host2 sshd[1010169]: User essenceceylontea from 186.236.237.105 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.65.99
country_id: 3144096
description:
2026-01-15 09:03:07 dovecot_login authenticator failed for H=(cm-178.232.65.99.get.no) [178.232.65.99]:56325: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.216.27.208
country_id: 798544
description:
Jan 15 09:03:18 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=178.216.27.208, lip=66.85.158.91, TLS, session=<fi++4WRI0NGy2BvQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.59.226
country_id: 337996
description:
2026-01-15 09:03:24 dovecot_login authenticator failed for H=([196.189.59.227]) [196.189.59.226]:47112: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.170.227
country_id: 3175395
description:
Jan 15 09:03:37 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<env_eng>, method=PLAIN, rip=185.15.170.227, lip=66.85.158.91, TLS, session=<ieDa4mRIGeS5D6rj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.183.66
country_id: 1269750
description:
2026-01-15 09:04:32 dovecot_login authenticator failed for H=([125.19.183.66]) [125.19.183.66]:40856: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.202.250.46
country_id: 3469034
description:
2026-01-15 09:04:37 dovecot_login authenticator failed for H=([200.202.250.46]) [200.202.250.46]:52189: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.84.162.177
country_id: 1861060
description:
2026-01-15 09:04:24 dovecot_login authenticator failed for H=177.162.84.34.bc.googleusercontent.com [34.84.162.177]:65317: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.168
country_id: 2186224
description:
2026-01-15 09:05:26 dovecot_login authenticator failed for H=([121.73.163.168]) [121.73.163.168]:58202: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.124.50.151
country_id: 1168579
description:
2026-01-15 09:06:27 dovecot_login authenticator failed for H=([203.124.50.151]) [203.124.50.151]:33903: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.203.34.136
country_id: 6252001
description:
2026-01-15 09:06:36 dovecot_plain authenticator failed for H=c-98-203-34-136.hsd1.fl.comcast.net (biator) [98.203.34.136]:50254: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.170.150.178
country_id: 1605651
description:
2026-01-15 09:06:43 dovecot_login authenticator failed for H=([203.170.150.178]) [203.170.150.178]:55738: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.75
country_id: 6252001
description:
Jan 15 09:07:33 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=147.185.132.75, lip=66.85.158.92, TLS, session=<RVLu8WRIZPuTuYRL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.247.239.202
country_id: 1269750
description:
2026-01-15 09:07:48 dovecot_login authenticator failed for H=(abts-north-static-194.142.160.122.airtelbroadband.in) [117.247.239.202]:40366: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.191.8.27
country_id: 3017382
description:
2026-01-15 09:08:48 dovecot_login authenticator failed for H=([176.191.8.27]) [176.191.8.27]:40396: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.168.50
country_id: 2186224
description:
2026-01-15 09:09:18 dovecot_login authenticator failed for H=([121.73.168.50]) [121.73.168.50]:37508: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-15 09:09:53 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (broring) [87.103.126.54]:52750: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.109
country_id: 2186224
description:
2026-01-15 09:11:27 dovecot_login authenticator failed for H=([121.73.169.109]) [121.73.169.109]:39120: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.61.215.87
country_id: 3469034
description:
2026-01-15 09:11:41 dovecot_login authenticator failed for H=201-61-215-87.bbone.telesp.net.br [201.61.215.87]:40260: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.31.197.108
country_id: 6252001
description:
2026-01-15 09:13:41 dovecot_login authenticator failed for H=(173-31-197-108.client.mchsi.com) [173.31.197.108]:46356: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.247.239.202
country_id: 1269750
description:
2026-01-15 09:15:19 dovecot_login authenticator failed for H=(abts-north-static-194.142.160.122.airtelbroadband.in) [117.247.239.202]:56056: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.84.188.140
country_id: 3996063
description:
2026-01-15 09:15:45 dovecot_login authenticator failed for H=([140.84.188.140]) [140.84.188.140]:38614: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.168.11
country_id: 2186224
description:
2026-01-15 09:16:42 dovecot_login authenticator failed for H=([121.73.168.11]) [121.73.168.11]:44226: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.140.54
country_id: 1269750
description:
2026-01-15 09:17:31 dovecot_login authenticator failed for H=([125.21.194.121]) [125.23.140.54]:35086: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.61.82
country_id: 1269750
description:
2026-01-15 09:18:15 dovecot_login authenticator failed for H=([125.17.225.97]) [182.95.61.82]:53034: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.161
country_id: 2635167
description:
Jan 15 09:19:39 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 46 secs): user=<>, rip=35.203.211.161, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<P+MyHWVIuNcjy9Oh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.154
country_id: 3144096
description:
2026-01-15 09:20:41 dovecot_login authenticator failed for H=(cm-84.213.189.154.get.no) [84.213.189.154]:53774: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.161
country_id: 2635167
description:
Jan 15 09:20:05 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 8 secs): user=<>, rip=35.203.211.161, lip=66.85.158.91, TLS: read(size=403) failed: Connection reset by peer, session=<mgbNHmVI/uojy9Oh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.110.11.36
country_id: 2464461
description:
2026-01-15 09:20:30 dovecot_login authenticator failed for H=([102.110.11.36]) [102.110.11.36]:1193: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan 15 09:21:24 host2 sshd[1026278]: Disconnected from invalid user user 2.57.121.25 port 22623 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.124.46
country_id: 1269750
description:
2026-01-15 09:21:46 dovecot_login authenticator failed for H=([128.185.247.14]) [122.184.124.46]:34652: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.236.196.180
country_id: 6252001
description:
Jan 15 09:21:01 host2 sshd[1026014]: Invalid user agronatureholdings from 104.236.196.180 port 43986


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.17.124.75
country_id: 1269750
description:
2026-01-15 09:21:10 dovecot_login authenticator failed for H=(abts-kk-static-182.209.166.122.airtelbroadband.in) [125.17.124.75]:49510: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.102.50
country_id: 1269750
description:
2026-01-15 09:22:07 dovecot_login authenticator failed for H=(nsg-static-145.58.71.182.airtel.in) [27.123.102.50]:53758: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.105.141.172
country_id: 3923057
description:
2026-01-15 09:22:25 dovecot_login authenticator failed for H=static-200-105-141-172.acelerate.net (static-200-105-141-161.acelerate.net) [200.105.141.172]:36282: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.46.148.180
country_id: 6252001
description:
2026-01-15 09:22:43 dovecot_plain authenticator failed for H=c-68-46-148-180.hsd1.mi.comcast.net (stputfus) [68.46.148.180]:46788: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.5.178.229
country_id: 3865483
description:
2026-01-15 09:22:54 dovecot_login authenticator failed for H=([186.5.178.229]) [186.5.178.229]:45786: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.124.221.2
country_id: 2750405
description:
2026-01-15 09:22:55 dovecot_login authenticator failed for H=ip-213-124-221-2.ip.prioritytelecom.net [213.124.221.2]:50456: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.245.38
country_id: 1269750
description:
2026-01-15 09:22:01 dovecot_login authenticator failed for H=([152.52.12.201]) [152.52.245.38]:44786: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.235.226.154
country_id: 294640
description:
2026-01-15 09:23:17 dovecot_login authenticator failed for H=([147.235.226.154]) [147.235.226.154]:35940: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.249.19.34
country_id: 1643084
description:
2026-01-15 09:23:20 dovecot_login authenticator failed for H=([103.249.19.34]) [103.249.19.34]:56076: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.235.225.181
country_id: 6252001
description:
2026-01-15 09:23:19 dovecot_plain authenticator failed for H=c-71-235-225-181.hsd1.ct.comcast.net (appok) [71.235.225.181]:48402: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.58.66.231
country_id: 3469034
description:
2026-01-15 09:23:06 dovecot_login authenticator failed for H=(187.58.64.145.static.host.gvt.net.br) [187.58.66.231]:50084: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 43.164.1.102
country_id: 1605651
description:
Jan 15 09:25:52 host2 sshd[1029679]: User essenceceylontea from 43.164.1.102 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.50.154
country_id: 1269750
description:
2026-01-15 09:26:49 dovecot_login authenticator failed for H=([125.19.93.105]) [182.95.50.154]:57238: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.161
country_id: 2635167
description:
Jan 15 09:26:05 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.203.211.161, lip=66.85.158.91, TLS, session=<lnBDNGVIZPojy9Oh>


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 141.94.22.51
country_id: 3017382
description:
Jan 15 09:27:02 host2 sshd[1030425]: User essenceceylontea from 141.94.22.51 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.240.166.197
country_id: 6252001
description:
Jan 15 09:27:07 host2 sshd[1030468]: Invalid user agronatureholdings from 162.240.166.197 port 58714


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.201.62
country_id: 1269750
description:
2026-01-15 09:27:10 dovecot_login authenticator failed for H=(aes-static-041.73.22.125.airtel.in) [122.186.201.62]:36828: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.241.102
country_id: 1269750
description:
2026-01-15 09:27:47 dovecot_login authenticator failed for H=([125.19.175.152]) [182.78.241.102]:40614: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.22
country_id: 1269750
description:
2026-01-15 09:28:01 dovecot_login authenticator failed for H=([182.95.20.31]) [182.95.228.22]:59162: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.74.0.182
country_id: 3469034
description:
2026-01-15 09:30:48 dovecot_login authenticator failed for H=([177.74.52.129]) [177.74.0.182]:58762: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.170.150.133
country_id: 1605651
description:
2026-01-15 09:31:10 dovecot_login authenticator failed for H=([203.170.150.133]) [203.170.150.133]:44828: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.208.38
country_id: 1036973
description:
2026-01-15 09:31:31 dovecot_login authenticator failed for H=([197.219.208.38]) [197.219.208.38]:60962: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.223.92.208
country_id: 3175395
description:
2026-01-15 09:31:58 dovecot_login authenticator failed for H=(ADMIN) [176.223.92.208]:59598: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 68.178.207.8
country_id: 6252001
description:
Jan 15 09:31:57 host2 sshd[1034104]: User essenceceylontea from 68.178.207.8 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.153.32.118
country_id: 453733
description:
[2025-12-26 17:26:14 +0530] info [webmaild] 95.153.32.118 - env_eng@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.205
country_id: 6252001
description:
Jan 15 09:33:23 host2 pure-ftpd[1035147]: (?@198.235.24.205) [INFO] New connection from 198.235.24.205


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.3.227.160
country_id: 1861060
description:
2026-01-15 09:33:38 dovecot_login authenticator failed for H=p7001161-ipoefx.ipoe.ocn.ne.jp [118.3.227.160]:57186: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.122
country_id: 1269750
description:
2026-01-15 09:34:15 dovecot_login authenticator failed for H=([125.19.175.93]) [182.95.176.122]:60304: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.126
country_id: 1269750
description:
2026-01-15 09:34:42 dovecot_login authenticator failed for H=(nsg-corporate-190.152.185.122.airtel.in) [182.95.178.126]:46178: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 192.155.90.220
country_id: 6252001
description:
Jan 15 09:34:01 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:140943F2:SSL routines:ssl3_read_bytes:sslv3 alert unexpected message: SSL alert number 10 (no auth attempts in 0 secs): user=<>, rip=192.155.90.220, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:140943F2:SSL routines:ssl3_read_bytes:sslv3 alert unexpected message: SSL alert number 10, session=<VeebUGVI1JXAm1rc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.187.2
country_id: 1269750
description:
2026-01-15 09:35:22 dovecot_login authenticator failed for H=([128.185.187.2]) [128.185.187.2]:45252: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2026-01-15 09:35:30 dovecot_login authenticator failed for H=([154.144.243.93]) [154.144.243.93]:57332: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.54
country_id: 1149361
description:
2026-01-15 09:36:17 dovecot_login authenticator failed for H=([149.54.62.54]) [149.54.62.54]:33090: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.255.255.26
country_id: 2661886
description:
2026-01-15 09:36:54 dovecot_login authenticator failed for H=94-255-255-26.cust.bredband2.com [94.255.255.26]:48440: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.38.0.41
country_id: 6252001
description:
2026-01-15 09:36:03 dovecot_login authenticator failed for H=([45.38.0.41]) [45.38.0.41]:4005: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.236.228.245
country_id: 6252001
description:
Jan 15 09:37:20 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:140943F2:SSL routines:ssl3_read_bytes:sslv3 alert unexpected message: SSL alert number 10 (no auth attempts in 0 secs): user=<>, rip=172.236.228.245, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:140943F2:SSL routines:ssl3_read_bytes:sslv3 alert unexpected message: SSL alert number 10, session=<+xF1XGVISNes7OT1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.25.47.94
country_id: 1269750
description:
Jan 15 09:37:26 host2 sshd[1038247]: Disconnected from invalid user admin 103.25.47.94 port 34192 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.185.37.239
country_id: 1269750
description:
2026-01-15 09:37:36 dovecot_login authenticator failed for H=([136.185.37.239]) [136.185.37.239]:60378: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.228.146
country_id: 1269750
description:
2026-01-15 09:37:00 dovecot_login authenticator failed for H=([125.16.32.137]) [125.20.228.146]:38228: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.220
country_id: 130758
description:
2026-01-15 09:37:08 dovecot_login authenticator failed for H=(localhost) [62.60.130.220]:61183: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.127.86
country_id: 1269750
description:
2026-01-15 09:37:20 dovecot_login authenticator failed for H=(dsl-ncr-dynamic-097.178.23.125.airtelbroadband.in) [182.79.127.86]:41028: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 212.154.234.9
country_id: 1522867
description:
Jan 15 09:38:31 host2 sshd[1039230]: Disconnected from invalid user ubuntu 212.154.234.9 port 35984 [preauth]


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 64.23.164.189
country_id: 6252001
description:
Jan 15 09:39:40 host2 sshd[1040122]: User essenceceylontea from 64.23.164.189 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.25.47.94
country_id: 1269750
description:
Jan 15 09:40:16 host2 sshd[1040738]: Disconnected from invalid user admin 103.25.47.94 port 35036 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.242.142
country_id: 1269750
description:
2026-01-15 09:40:53 dovecot_login authenticator failed for H=([182.78.242.142]) [182.78.242.142]:54872: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.25.47.94
country_id: 1269750
description:
Jan 15 09:43:15 host2 sshd[1042934]: Disconnected from invalid user admin 103.25.47.94 port 52772 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-01-15 09:45:16 dovecot_login authenticator failed for H=(144.121.245.65.lightower.net) [64.72.74.162]:54266: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.80
country_id: 1269750
description:
2026-01-15 09:45:37 dovecot_login authenticator failed for H=([122.187.229.80]) [122.187.229.80]:37603: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.172.172.184
country_id: 2921044
description:
Jan 15 09:45:05 host2 sshd[1044209]: Invalid user agronatureholdings from 167.172.172.184 port 42798


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.25.47.94
country_id: 1269750
description:
Jan 15 09:46:00 host2 sshd[1044988]: Disconnected from invalid user admin 103.25.47.94 port 42238 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 212.154.234.9
country_id: 1522867
description:
Jan 15 09:46:39 host2 sshd[1045731]: Disconnected from invalid user admin 212.154.234.9 port 26562 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 212.154.234.9
country_id: 1522867
description:
Jan 15 09:47:12 host2 sshd[1046091]: Disconnected from invalid user ubuntu 212.154.234.9 port 25294 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.125.149.205
country_id: 2245662
description:
Jan 15 09:47:34 host2 sshd[1046320]: Disconnected from invalid user admin 154.125.149.205 port 58474 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.119.118
country_id: 1269750
description:
2026-01-15 09:48:15 dovecot_login authenticator failed for H=([125.18.210.161]) [182.95.119.118]:59774: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.214.49.11
country_id: 3144096
description:
2026-01-15 09:48:35 dovecot_login authenticator failed for H=([84.214.49.11]) [84.214.49.11]:54120: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.125.149.205
country_id: 2245662
description:
Jan 15 09:48:41 host2 sshd[1047251]: Disconnected from invalid user admin 154.125.149.205 port 58835 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.171.53.200
country_id: 1733045
description:
2026-01-15 09:49:36 dovecot_login authenticator failed for H=([183.171.53.200]) [183.171.53.200]:59116: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.85.202
country_id: 337996
description:
2026-01-15 09:49:38 dovecot_login authenticator failed for H=([196.191.212.235]) [213.55.85.202]:4375: 535 Incorrect authentication data (set_id=all)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.236.228.218
country_id: 6252001
description:
Jan 15 09:49:02 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=172.236.228.218, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<5DpWhmVIchWs7OTa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.104.11.46
country_id: 6252001
description:
Jan 15 09:49:05 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=172.104.11.46, lip=66.85.158.92, TLS, session=<Md91hmVIrDWsaAsu>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.222.202
country_id: 1269750
description:
2026-01-15 09:49:21 dovecot_login authenticator failed for H=([128.185.247.100]) [182.95.222.202]:46732: 535 Incorrect authentication data (set_id=all@comdef.org)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 15 09:49:59 host2 sshd[1048140]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.58.241.90
country_id: 3469034
description:
2026-01-15 09:50:33 dovecot_login authenticator failed for H=(ccabv.org9.static.gvt.net.br) [187.58.241.90]:54229: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.239.164.55
country_id: 3996063
description:
2026-01-15 09:50:37 dovecot_login authenticator failed for H=([177.239.164.55]) [177.239.164.55]:37515: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.25.59.5
country_id: 3469034
description:
2026-01-15 09:49:58 dovecot_login authenticator failed for H=(ip-177-25-59-5.user.vivozap.com.br) [177.25.59.5]:45322: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.212.27.150
country_id: 6252001
description:
2026-01-15 09:50:24 dovecot_login authenticator failed for H=(50-212-27-146-static.hfc.comcastbusiness.net) [50.212.27.150]:39708: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.125.149.205
country_id: 2245662
description:
Jan 15 09:51:03 host2 sshd[1049097]: Disconnected from invalid user admin 154.125.149.205 port 41759 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.238.2.7
country_id: 3469034
description:
2026-01-15 09:51:15 dovecot_login authenticator failed for H=45-238-2-7.netmaisfibra.net.br [45.238.2.7]:57338: 535 Incorrect authentication data (set_id=admin@2s-travels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.60.143.30
country_id: 3175395
description:
2026-01-15 09:51:16 dovecot_login authenticator failed for H=([151.60.143.30]) [151.60.143.30]:45024: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.80.250.102
country_id: 2264397
description:
2026-01-15 09:53:06 dovecot_login authenticator failed for H=bl15-250-102.dsl.telepac.pt [188.80.250.102]:62052: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.115.173.11
country_id: 1269750
description:
2026-01-15 09:53:44 dovecot_login authenticator failed for H=([45.115.173.11]) [45.115.173.11]:58657: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.119
country_id: 1269750
description:
2026-01-15 09:56:53 dovecot_login authenticator failed for H=(nsg-corporate-119.229.187.122.airtel.in) [122.187.229.119]:56226: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.168.136.150
country_id: 6252001
description:
2026-01-15 09:58:05 dovecot_plain authenticator failed for H=c-73-168-136-150.hsd1.il.comcast.net (subdorre) [73.168.136.150]:52764: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.110.189.45
country_id: 2750405
description:
2026-01-15 10:00:29 dovecot_login authenticator failed for H=([193.110.189.45]) [193.110.189.45]:59069: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.114
country_id: 1149361
description:
2026-01-15 10:01:24 dovecot_login authenticator failed for H=([149.54.62.114]) [149.54.62.114]:49031: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 13.68.214.34
country_id: 6252001
description:
2026-01-15 10:00:56 dovecot_login authenticator failed for H=([13.68.214.34]) [13.68.214.34]:55600: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.64.18
country_id: 1269750
description:
2026-01-15 10:01:43 dovecot_login authenticator failed for H=([182.78.209.116]) [182.78.64.18]:36918: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.79.5.11
country_id: 6252001
description:
Jan 15 10:02:57 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 17 secs): user=<>, rip=45.79.5.11, lip=66.85.158.91, TLS handshaking: read(size=1026) failed: Connection reset by peer, session=<zjUTuGVIFdgtTwUL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.80.250.102
country_id: 2264397
description:
2026-01-15 10:03:17 dovecot_login authenticator failed for H=bl15-250-102.dsl.telepac.pt [188.80.250.102]:53039: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.70.126
country_id: 1269750
description:
2026-01-15 10:03:36 dovecot_login authenticator failed for H=(nsg-corporate-137.222.185.122.airtel.in) [182.78.70.126]:34486: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 200.105.156.165
country_id: 3923057
description:
Jan 15 10:05:35 host2 sshd[1060677]: User essenceceylontea from 200.105.156.165 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 142.93.212.130
country_id: 1269750
description:
Jan 15 10:05:37 host2 sshd[1060691]: Disconnected from invalid user couchbase 142.93.212.130 port 58770 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 164.177.31.66
country_id: 3017382
description:
Jan 15 10:05:58 host2 sshd[1060896]: Disconnected from invalid user dbsnmp 164.177.31.66 port 51768 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.49.152.14
country_id: 3469034
description:
Jan 15 10:07:31 host2 sshd[1061959]: Disconnected from invalid user admin 187.49.152.14 port 43190 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 164.177.31.66
country_id: 3017382
description:
Jan 15 10:07:11 host2 sshd[1061735]: Disconnected from invalid user testuser 164.177.31.66 port 45628 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.166.49.42
country_id: 1269750
description:
Jan 15 10:07:59 host2 sshd[1062470]: Disconnected from invalid user pvserver 122.166.49.42 port 49734 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 164.177.31.66
country_id: 3017382
description:
Jan 15 10:07:46 host2 sshd[1062089]: Disconnected from invalid user aladmin 164.177.31.66 port 58236 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.236.196.180
country_id: 6252001
description:
Jan 15 10:07:52 host2 sshd[1062281]: Invalid user agronatureholdings from 104.236.196.180 port 57254


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 164.177.31.66
country_id: 3017382
description:
Jan 15 10:08:47 host2 sshd[1063060]: Disconnected from invalid user drone 164.177.31.66 port 33238 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.49.152.14
country_id: 3469034
description:
Jan 15 10:08:50 host2 sshd[1063118]: Disconnected from invalid user nas 187.49.152.14 port 37716 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 122.166.49.42
country_id: 1269750
description:
Jan 15 10:09:16 host2 sshd[1063409]: Disconnected from invalid user acti 122.166.49.42 port 44124 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.151
country_id: 1269750
description:
2026-01-15 10:10:39 dovecot_login authenticator failed for H=([122.187.229.151]) [122.187.229.151]:37564: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.124.221.2
country_id: 2750405
description:
2026-01-15 10:11:37 dovecot_login authenticator failed for H=ip-213-124-221-2.ip.prioritytelecom.net [213.124.221.2]:59864: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.58.66.231
country_id: 3469034
description:
2026-01-15 10:11:40 dovecot_login authenticator failed for H=([187.58.66.231]) [187.58.66.231]:37725: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.162.62
country_id: 2186224
description:
2026-01-15 10:11:41 dovecot_login authenticator failed for H=([121.73.162.62]) [121.73.162.62]:54092: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.41.18
country_id: 1269750
description:
2026-01-15 10:10:50 dovecot_login authenticator failed for H=([182.95.20.13]) [122.187.41.18]:41782: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.34.49
country_id: 1269750
description:
2026-01-15 10:10:58 dovecot_login authenticator failed for H=([103.174.34.49]) [103.174.34.49]:65117: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 212.102.40.218
country_id: 6252001
description:
Jan 15 10:11:10 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=212.102.40.218, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<uNh51WVIeiPUZija>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.101.146
country_id: 1269750
description:
2026-01-15 10:12:31 dovecot_login authenticator failed for H=(aes-static-217.70.22.125.airtel.in) [27.123.101.146]:49840: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.59.157
country_id: 3277605
description:
2026-01-15 10:11:50 dovecot_login authenticator failed for H=([195.222.59.157]) [195.222.59.157]:34342: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.41.18
country_id: 1269750
description:
2026-01-15 10:12:03 dovecot_login authenticator failed for H=([182.73.193.249]) [122.187.41.18]:60490: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 142.93.212.130
country_id: 1269750
description:
Jan 15 10:12:16 host2 sshd[1065817]: Disconnected from invalid user user 142.93.212.130 port 53052 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 34.38.246.252
country_id: 2802361
description:
Jan 15 10:13:18 host2 pure-ftpd[1066762]: (?@34.38.246.252) [INFO] New connection from 34.38.246.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.64.64.8
country_id: 2264397
description:
2026-01-15 10:12:43 dovecot_login authenticator failed for H=bl23-64-8.dsl.telepac.pt [144.64.64.8]:3172: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 159.223.37.230
country_id: 1880251
description:
Jan 15 10:14:09 host2 sshd[1067252]: Disconnected from invalid user buffalo 159.223.37.230 port 33334 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.236.228.222
country_id: 6252001
description:
Jan 15 10:14:05 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=172.236.228.222, lip=66.85.158.91, TLS, session=<LRri32VIuLus7OTe>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.210.46
country_id: 1036973
description:
2026-01-15 10:15:35 dovecot_login authenticator failed for H=(dynamic-adsl.movitel.co.mz) [197.219.210.46]:33876: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.158.235.131
country_id: 690791
description:
2026-01-15 10:15:45 dovecot_login authenticator failed for H=([178.158.235.131]) [178.158.235.131]:59982: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.168.97
country_id: 2186224
description:
2026-01-15 10:18:03 dovecot_login authenticator failed for H=([127.0.0.1]) [121.73.168.97]:44978: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.156.5.109
country_id: 3144096
description:
2026-01-15 10:18:10 dovecot_login authenticator failed for H=([127.0.0.1]) [78.156.5.109]:36234: 535 Incorrect authentication data (set_id=kasunp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.247.248.154
country_id: 3469034
description:
2026-01-15 10:18:26 dovecot_login authenticator failed for H=([170.247.248.154]) [170.247.248.154]:37918: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 15 10:20:01 host2 sshd[1071874]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.100.156.38
country_id: 1605651
description:
2026-01-15 10:20:37 dovecot_login authenticator failed for H=mail.sotus.co.th [171.100.156.38]:37372: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.0.38.130
country_id: 1210997
description:
2026-01-15 10:20:23 dovecot_login authenticator failed for H=([49.0.38.130]) [49.0.38.130]:38864: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.198.129.123
country_id: 1819730
description:
2026-01-15 10:20:27 dovecot_login authenticator failed for H=123.129.198.203.static.netvigator.com [203.198.129.123]:50380: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.168.50
country_id: 2186224
description:
2026-01-15 10:21:35 dovecot_login authenticator failed for H=([121.73.168.50]) [121.73.168.50]:58816: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.106.49.149
country_id: 3932488
description:
2026-01-15 10:21:40 dovecot_login authenticator failed for H=([200.106.49.149]) [200.106.49.149]:36270: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.70.134
country_id: 1819730
description:
2026-01-15 10:20:51 dovecot_login authenticator failed for H=42-200-70-134.static.imsbiz.com [42.200.70.134]:47402: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.64.10
country_id: 1269750
description:
2026-01-15 10:22:16 dovecot_login authenticator failed for H=([125.18.244.137]) [182.78.64.10]:43222: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.138
country_id: 6252001
description:
Jan 15 10:22:45 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.138, lip=66.85.158.91, TLS, session=</FLl/mVI1OeTuYSK>


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 165.232.179.250
country_id: 1269750
description:
Jan 15 10:23:13 host2 sshd[1074897]: User essenceceylontea from 165.232.179.250 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.231
country_id: 1733045
description:
2026-01-15 10:24:07 dovecot_login authenticator failed for H=([49.124.152.231]) [49.124.152.231]:39016: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.132.164.25
country_id: 2635167
description:
2026-01-15 10:24:37 dovecot_login authenticator failed for H=(ADMIN) [23.132.164.25]:49844: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.59.154
country_id: 1269750
description:
2026-01-15 10:25:17 dovecot_login authenticator failed for H=([182.95.7.193]) [182.95.59.154]:37396: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.122
country_id: 1269750
description:
2026-01-15 10:25:25 dovecot_login authenticator failed for H=([182.95.178.122]) [182.95.178.122]:50324: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.61.114
country_id: 1269750
description:
2026-01-15 10:25:38 dovecot_login authenticator failed for H=(nsg-corporate-17.50.186.122.airtel.in) [182.95.61.114]:57060: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.162.62
country_id: 2186224
description:
2026-01-15 10:26:01 dovecot_login authenticator failed for H=([121.73.162.62]) [121.73.162.62]:60748: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.57.39.170
country_id: 6252001
description:
2026-01-15 10:26:03 dovecot_login authenticator failed for H=(syn-184-057-039-170.res.spectrum.com) [184.57.39.170]:62396: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.59.26
country_id: 1269750
description:
2026-01-15 10:26:28 dovecot_login authenticator failed for H=([125.23.125.209]) [122.187.59.26]:38264: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.223.92.208
country_id: 3175395
description:
2026-01-15 10:26:31 dovecot_login authenticator failed for H=(ADMIN) [176.223.92.208]:57387: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 64.23.164.189
country_id: 6252001
description:
Jan 15 10:28:20 host2 sshd[1079046]: User essenceceylontea from 64.23.164.189 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.168
country_id: 2186224
description:
2026-01-15 10:28:23 dovecot_login authenticator failed for H=([121.73.163.168]) [121.73.163.168]:44356: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.172.172.184
country_id: 2921044
description:
Jan 15 10:31:35 host2 sshd[1081794]: Invalid user agronatureholdings from 167.172.172.184 port 52816


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 43.164.1.102
country_id: 1605651
description:
Jan 15 10:31:43 host2 sshd[1081869]: User essenceceylontea from 43.164.1.102 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-15 10:32:55 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (undic) [87.103.126.54]:28350: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan 15 10:33:55 host2 sshd[1083701]: Disconnected from invalid user user 2.57.121.25 port 5098 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.98.41.27
country_id: 1269750
description:
2026-01-15 10:34:09 dovecot_login authenticator failed for H=([59.98.41.27]) [59.98.41.27]:57106: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.207.15.25
country_id: 1269750
description:
2026-01-15 10:34:28 dovecot_login authenticator failed for H=(49.207.15.25.actcorp.in) [49.207.15.25]:63618: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.61.215.87
country_id: 3469034
description:
2026-01-15 10:34:33 dovecot_login authenticator failed for H=201-61-215-87.bbone.telesp.net.br [201.61.215.87]:38962: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.168.11.67
country_id: 2077456
description:
2026-01-15 10:34:48 dovecot_login authenticator failed for H=([101.168.11.67]) [101.168.11.67]:44418: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.170
country_id: 6252001
description:
Jan 15 10:35:55 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.170, lip=66.85.158.92, TLS handshaking: Connection closed, session=<Uk4BLmZI+WFAPpyq>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.162
country_id: 6252001
description:
Jan 15 10:36:13 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.162, lip=66.85.158.92, TLS handshaking: Connection closed, session=<PLsPL2ZIFE1APpyi>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 207.90.244.28
country_id: 6252001
description:
Jan 15 10:45:25 host2 dovecot[221878]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=207.90.244.28, lip=66.85.158.91, session=<qMj1T2ZIOuXPWvQc>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 207.90.244.28
country_id: 6252001
description:
Jan 15 10:45:26 host2 dovecot[221878]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=207.90.244.28, lip=66.85.158.91, session=<j5AJUGZIzpnPWvQc>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.31
country_id: 6252001
description:
Jan 15 10:46:24 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 14 secs): user=<>, rip=162.216.150.31, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<ho57U2ZIgtOi2JYf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 154.127.36.18
country_id: 2395170
description:
Jan 15 10:46:54 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=154.127.36.18, lip=66.85.158.91, TLS, session=<Mq4EVGZIGMSafyQS>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.177
country_id: 6252001
description:
Jan 15 10:47:04 host2 dovecot[221878]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.177, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<b0bcVWZIWdbN0h+x>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.117.146.190
country_id: 3469034
description:
Jan 15 10:47:14 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<careers>, method=PLAIN, rip=138.117.146.190, lip=66.85.158.91, TLS, session=<TCtiVWZI/uCKdZK+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.129.57.71
country_id: 6252001
description:
2026-01-15 10:47:34 dovecot_plain authenticator failed for H=c-73-129-57-71.hsd1.md.comcast.net (bodelia) [73.129.57.71]:52662: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.31
country_id: 6252001
description:
Jan 15 10:47:41 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 3 secs): user=<>, rip=162.216.150.31, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<IfUVWGZI1PKi2JYf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.195.52.4
country_id: 3144096
description:
2026-01-15 10:48:49 dovecot_login authenticator failed for H=([141.195.52.4]) [141.195.52.4]:44530: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.149.219
country_id: 1733045
description:
2026-01-15 10:49:12 dovecot_login authenticator failed for H=([49.124.149.219]) [49.124.149.219]:39626: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2026-01-15 10:50:02 dovecot_plain authenticator failed for H=(stoloweep) [154.144.243.93]:56974: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.67.152.201
country_id: 1269750
description:
2026-01-15 10:52:52 dovecot_login authenticator failed for H=([103.67.152.201]) [103.67.152.201]:55078: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.252.85
country_id: 1210997
description:
2026-01-15 10:53:27 dovecot_login authenticator failed for H=([103.115.252.60]) [103.115.252.85]:43006: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.87.18
country_id: 1269750
description:
2026-01-15 10:54:36 dovecot_login authenticator failed for H=([182.79.87.18]) [182.79.87.18]:39338: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.31
country_id: 6252001
description:
Jan 15 10:55:01 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.150.31, lip=66.85.158.92, TLS, session=<m+9IcmZIduei2JYf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.40
country_id: 1733045
description:
2026-01-15 10:55:23 dovecot_login authenticator failed for H=([49.124.153.40]) [49.124.153.40]:56008: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.236.196.180
country_id: 6252001
description:
Jan 15 10:55:07 host2 sshd[1102143]: Invalid user agronatureholdings from 104.236.196.180 port 43998


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.54
country_id: 3144096
description:
2026-01-15 10:55:14 dovecot_login authenticator failed for H=(54-170-97-62.cust.smartcall.no) [62.97.170.54]:60536: 535 Incorrect authentication data (set_id=md)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.149.161.131
country_id: 6252001
description:
2026-01-15 10:54:56 dovecot_login authenticator failed for H=c-50-149-161-131.hsd1.tn.comcast.net [50.149.161.131]:51654: 535 Incorrect authentication data (set_id=md@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.6.121.246
country_id: 3469034
description:
2026-01-15 10:56:10 dovecot_login authenticator failed for H=([191.217.23.65]) [187.6.121.246]:37410: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.31
country_id: 6252001
description:
Jan 15 10:55:32 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.150.31, lip=66.85.158.92, TLS, session=<3RwkdGZINuGi2JYf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.113.10
country_id: 1269750
description:
2026-01-15 10:55:39 dovecot_login authenticator failed for H=(abts-north-dynamic-121.212.66.182.airtelbroadband.in) [27.123.113.10]:52868: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 200.105.156.165
country_id: 3923057
description:
Jan 15 10:56:33 host2 sshd[1103260]: User essenceceylontea from 200.105.156.165 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.116.22
country_id: 1861060
description:
Jan 15 10:57:35 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=139.162.116.22, lip=66.85.158.91, TLS: Connection closed, session=<A6lze2ZIRpmLonQW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-15 10:57:49 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (thinfring) [87.103.126.54]:1157: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.35.178.104
country_id: 732800
description:
2026-01-15 11:01:19 dovecot_plain authenticator failed for H=(peespoes) [46.35.178.104]:41428: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.25
country_id: 6252001
description:
Jan 15 11:04:04 host2 dovecot[221878]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=205.210.31.25, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<CLmnkmZIbNDN0h8Z>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.191.8.27
country_id: 3017382
description:
2026-01-15 11:06:47 dovecot_login authenticator failed for H=([176.191.8.27]) [176.191.8.27]:54558: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.246.166
country_id: 798544
description:
2026-01-15 11:07:14 dovecot_login authenticator failed for H=89-67-246-166.dynamic.play.pl [89.67.246.166]:36347: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 128.203.204.32
country_id: 6251999
description:
Jan 15 11:09:12 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=128.203.204.32, lip=66.85.158.92, TLS handshaking: Connection closed, session=<jBAFpWZI/p+Ay8wg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.47.145
country_id: 1819730
description:
2026-01-15 11:11:48 dovecot_login authenticator failed for H=145.47.246.220.static.netvigator.com [220.246.47.145]:64679: 535 Incorrect authentication data (set_id=all@2s-travels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.248.107.130
country_id: 1269750
description:
2026-01-15 11:12:38 dovecot_login authenticator failed for H=([115.244.235.242]) [117.248.107.130]:47694: 535 Incorrect authentication data (set_id=all)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.45.251
country_id: 953987
description:
Jan 15 11:13:00 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=102.64.45.251, lip=66.85.158.91, TLS, session=<n3ZTsWZIlOdmQC37>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.24
country_id: 241170
description:
Jan 15 11:13:17 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 20 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.24, lip=66.85.158.91, session=<ALNusmZIzp/E+2YY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.211.4.222
country_id: 2300660
description:
Jan 15 11:13:21 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<env_eng>, method=PLAIN, rip=41.211.4.222, lip=66.85.158.91, TLS, session=<HQi5smZIkO0p0wTe>


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 165.232.179.250
country_id: 1269750
description:
Jan 15 11:13:47 host2 sshd[1118838]: User essenceceylontea from 165.232.179.250 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.84.162.177
country_id: 1861060
description:
2026-01-15 11:14:28 dovecot_login authenticator failed for H=177.162.84.34.bc.googleusercontent.com [34.84.162.177]:61602: 535 Incorrect authentication data (set_id=all@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.97.190.237
country_id: 6252001
description:
2026-01-15 11:15:56 dovecot_plain authenticator failed for H=(reage) [75.97.190.237]:55993: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 64.23.164.189
country_id: 6252001
description:
Jan 15 11:16:19 host2 sshd[1120974]: User essenceceylontea from 64.23.164.189 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.189.123
country_id: 99237
description:
Jan 15 11:17:19 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=65.20.189.123, lip=66.85.158.91, TLS, session=<bwYFwWZITt5BFL17>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 93.174.180.151
country_id: 3057568
description:
Jan 15 11:17:36 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<env_eng>, method=PLAIN, rip=93.174.180.151, lip=66.85.158.91, TLS, session=<FVYYwmZI/uldrrSX>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.172.172.184
country_id: 2921044
description:
Jan 15 11:17:54 host2 sshd[1122148]: Invalid user agronatureholdings from 167.172.172.184 port 35358


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2026-01-15 11:18:09 dovecot_login authenticator failed for H=c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:57910: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.202.217
country_id: 1880251
description:
Jan 15 11:18:09 host2 sshd[1122373]: Disconnected from invalid user seafile 45.78.202.217 port 43246 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.223.92.208
country_id: 3175395
description:
2026-01-15 11:21:30 dovecot_login authenticator failed for H=(ADMIN) [176.223.92.208]:59948: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.247
country_id: 1269750
description:
2026-01-15 11:21:58 dovecot_login authenticator failed for H=(nsg-corporate-247.228.187.122.airtel.in) [122.187.228.247]:47544: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.173.10.98
country_id: 6252001
description:
Jan 15 11:22:33 host2 sshd[1126291]: Disconnected from invalid user chris 107.173.10.98 port 23932 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.169.104.237
country_id: 6252001
description:
Jan 15 11:22:53 host2 dovecot[221878]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.169.104.237, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<Oo7v1WZINMIUqWjt>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.165.174.234
country_id: 1269750
description:
2026-01-15 11:22:28 dovecot_login authenticator failed for H=([103.165.174.234]) [103.165.174.234]:38868: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 165.22.132.144
country_id: 6252001
description:
Jan 15 11:23:28 host2 sshd[1127254]: Disconnected from invalid user caddy 165.22.132.144 port 40888 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.23.73.187
country_id: 6252001
description:
2026-01-15 11:26:07 dovecot_login authenticator failed for H=([209.23.73.187]) [209.23.73.187]:32968: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.173.10.98
country_id: 6252001
description:
Jan 15 11:26:27 host2 sshd[1129577]: Disconnected from invalid user asterisk 107.173.10.98 port 7820 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 107.173.10.98
country_id: 6252001
description:
Jan 15 11:27:10 host2 sshd[1130031]: Disconnected from invalid user ppp_user 107.173.10.98 port 49014 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 15 11:27:45 host2 sshd[1130393]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.202.217
country_id: 1880251
description:
Jan 15 11:28:34 host2 sshd[1130794]: Disconnected from invalid user nagiosadmin 45.78.202.217 port 40672 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.202.217
country_id: 1880251
description:
Jan 15 11:30:24 host2 sshd[1132337]: Disconnected from invalid user soporte 45.78.202.217 port 54038 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.209.30
country_id: 1269750
description:
2026-01-15 11:30:38 dovecot_login authenticator failed for H=([128.185.209.30]) [128.185.209.30]:50256: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.87.15.170
country_id: 6252001
description:
2026-01-15 11:31:08 dovecot_login authenticator failed for H=([12.174.29.81]) [12.87.15.170]:58922: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.202.217
country_id: 1880251
description:
Jan 15 11:32:26 host2 sshd[1133590]: Disconnected from invalid user httpd 45.78.202.217 port 35358 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.202.217
country_id: 1880251
description:
Jan 15 11:35:28 host2 sshd[1135906]: Disconnected from invalid user wwdbo 45.78.202.217 port 60154 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.220
country_id: 130758
description:
2026-01-15 11:37:10 dovecot_login authenticator failed for H=(localhost) [62.60.130.220]:64083: 535 Incorrect authentication data (set_id=eddy)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.150.243.22
country_id: 6252001
description:
2026-01-15 11:40:41 dovecot_plain authenticator failed for H=(forbsity) [12.150.243.22]:21619: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.83.41.60
country_id: 3469034
description:
2026-01-15 11:44:18 dovecot_login authenticator failed for H=(170-83-41-60.swtelecom.com.br) [170.83.41.60]:54142: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.70.134
country_id: 1819730
description:
2026-01-15 11:44:34 dovecot_login authenticator failed for H=42-200-70-134.static.imsbiz.com [42.200.70.134]:55863: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.101.36.159
country_id: 2963597
description:
2026-01-15 11:46:01 dovecot_login authenticator failed for H=(089-101-036159.customer.vmie.ie) [89.101.36.159]:37398: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.120.116.162
country_id: 1168579
description:
2026-01-15 11:46:24 dovecot_login authenticator failed for H=([103.120.116.162]) [103.120.116.162]:33222: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.80.9
country_id: 3144096
description:
2026-01-15 11:46:42 dovecot_login authenticator failed for H=(cm-178.232.80.9.get.no) [178.232.80.9]:56266: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.194.231
country_id: 3144096
description:
2026-01-15 11:51:53 dovecot_login authenticator failed for H=(cm-178.232.194.231.get.no) [178.232.194.231]:59626: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.165.78.31
country_id: 1819730
description:
2026-01-15 11:52:22 dovecot_login authenticator failed for H=([69.165.78.31]) [69.165.78.31]:51876: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan 15 11:55:59 host2 sshd[1151438]: Disconnected from invalid user user 2.57.121.25 port 40762 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 15 11:57:52 host2 sshd[1152717]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.246.94
country_id: 1269750
description:
2026-01-15 11:57:31 dovecot_login authenticator failed for H=(nsg-corporate-177.174.185.122.airtel.in) [152.52.246.94]:37514: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.171.116
country_id: 99237
description:
2026-01-15 11:57:53 dovecot_login authenticator failed for H=([65.20.171.116]) [65.20.171.116]:38247: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.148.199.165
country_id: 2077456
description:
2026-01-15 11:57:58 dovecot_login authenticator failed for H=165.199.148.122.sta.wbroadband.net.au [122.148.199.165]:42052: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan 15 11:58:35 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS handshaking: Connection closed, session=<2e6iVWdIOIQDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan 15 11:59:56 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<Wd9qWmdI/ucDhBfJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.28.212.184
country_id: 3469034
description:
Jan 15 12:00:54 host2 sshd[1155250]: Disconnected from invalid user ubuntu 189.28.212.184 port 35634 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 135.237.122.43
country_id: 6252001
description:
Jan 15 12:01:24 host2 sshd[1155576]: Disconnected from invalid user admin 135.237.122.43 port 55806 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan 15 12:01:50 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<yrc+YWdIztsDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan 15 12:02:38 host2 dovecot[221878]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS, session=<IdMfZGdITOsDhBfJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 135.237.122.43
country_id: 6252001
description:
Jan 15 12:01:58 host2 sshd[1155961]: Disconnected from invalid user ubuntu 135.237.122.43 port 37000 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.28.212.184
country_id: 3469034
description:
Jan 15 12:03:07 host2 sshd[1156750]: Disconnected from invalid user admin 189.28.212.184 port 34970 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan 15 12:03:30 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS handshaking: Connection closed, session=<2kkyZ2dI7IgDhBfJ>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 189.28.212.184
country_id: 3469034
description:
Jan 15 12:04:32 host2 sshd[1157865]: Disconnected from invalid user ubuntu 189.28.212.184 port 44192 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan 15 12:07:09 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS, session=<JppCdGdIgrgDhBfJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 5.182.83.231
country_id: 2510769
description:
Jan 15 12:08:25 host2 sshd[1160824]: Disconnected from invalid user ubuntu 5.182.83.231 port 57258 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 5.182.83.231
country_id: 2510769
description:
Jan 15 12:09:27 host2 sshd[1161504]: Disconnected from invalid user admin 5.182.83.231 port 42968 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 5.182.83.231
country_id: 2510769
description:
Jan 15 12:12:17 host2 sshd[1163895]: Disconnected from invalid user admin 5.182.83.231 port 38276 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 150.5.129.10
country_id: 1819730
description:
Jan 15 12:12:20 host2 sshd[1163936]: Disconnected from invalid user webadmin 150.5.129.10 port 58272 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.89.166.236
country_id: 2635167
description:
Jan 15 12:14:12 host2 sshd[1165142]: Disconnected from invalid user radius 51.89.166.236 port 57344 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 150.5.129.10
country_id: 1819730
description:
Jan 15 12:14:32 host2 sshd[1165337]: Disconnected from invalid user liberty 150.5.129.10 port 34278 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 150.5.129.10
country_id: 1819730
description:
Jan 15 12:13:54 host2 sshd[1164951]: Disconnected from invalid user sage 150.5.129.10 port 51318 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.223.101
country_id: 1880251
description:
Jan 15 12:15:42 host2 sshd[1166378]: Disconnected from invalid user elasticsearch 45.78.223.101 port 41554 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 150.5.129.10
country_id: 1819730
description:
Jan 15 12:15:09 host2 sshd[1165972]: Disconnected from invalid user gitea 150.5.129.10 port 45474 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.223.92.208
country_id: 3175395
description:
2026-01-15 12:16:28 dovecot_login authenticator failed for H=(ADMIN) [176.223.92.208]:50326: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.136.200.241
country_id: 1210997
description:
Jan 15 12:17:06 host2 sshd[1167558]: Disconnected from invalid user wlsadmin 103.136.200.241 port 55702 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.89.166.236
country_id: 2635167
description:
Jan 15 12:17:41 host2 sshd[1167934]: Disconnected from invalid user aladmin 51.89.166.236 port 46374 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.89.166.236
country_id: 2635167
description:
Jan 15 12:18:09 host2 sshd[1168253]: Disconnected from invalid user wlsadmin 51.89.166.236 port 47696 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.89.166.236
country_id: 2635167
description:
Jan 15 12:18:35 host2 sshd[1168506]: Disconnected from invalid user ldap 51.89.166.236 port 39540 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.223.101
country_id: 1880251
description:
Jan 15 12:22:55 host2 sshd[1171637]: Disconnected from invalid user appuser 45.78.223.101 port 52642 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.223.101
country_id: 1880251
description:
Jan 15 12:24:04 host2 sshd[1172393]: Disconnected from invalid user ftpuser 45.78.223.101 port 51338 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-15 12:25:52 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (lesister) [87.103.126.54]:35058: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 13.68.214.34
country_id: 6252001
description:
2026-01-15 12:26:36 dovecot_login authenticator failed for H=([13.68.214.34]) [13.68.214.34]:53688: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 191.96.227.142
country_id: 6252001
description:
2026-01-15 12:26:45 dovecot_login authenticator failed for H=([10.33.18.217]) [191.96.227.142]:47255: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.96.227.142
country_id: 6252001
description:
2026-01-15 12:26:12 dovecot_plain authenticator failed for H=([10.33.18.217]) [191.96.227.142]:39546: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.184.114
country_id: 1269750
description:
2026-01-15 12:26:26 dovecot_login authenticator failed for H=([152.52.238.86]) [182.95.184.114]:34978: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.236
country_id: 6252001
description:
Jan 15 12:28:08 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=198.235.24.236, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<ThlFv2dIhsLG6xjs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.246.203
country_id: 1269750
description:
Jan 15 12:29:41 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=103.164.246.203, lip=66.85.158.91, TLS, session=<AFrCw2dIqNdnpPbL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.241.243.124
country_id: 1269750
description:
Jan 15 12:30:03 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<env_eng>, method=PLAIN, rip=103.241.243.124, lip=66.85.158.91, TLS, session=<Dm3+xGdIsqxn8fN8>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.250.118.12
country_id: 3865483
description:
2026-01-15 12:30:16 dovecot_login authenticator failed for H=([167.250.118.12]) [167.250.118.12]:37674: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.139.168.236
country_id: 2510769
description:
2026-01-15 12:30:29 dovecot_login authenticator failed for H=236.red-2-139-168.staticip.rima-tde.net [2.139.168.236]:34676: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.27
country_id: 3144096
description:
2026-01-15 12:31:59 dovecot_login authenticator failed for H=(cm-84.213.189.27.get.no) [84.213.189.27]:50741: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-15 12:32:00 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (noninont) [87.103.126.54]:4407: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.107.6
country_id: 290557
description:
2026-01-15 12:32:05 dovecot_plain authenticator failed for H=(precallize) [5.32.107.6]:46514: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.154
country_id: 3144096
description:
2026-01-15 12:32:20 dovecot_login authenticator failed for H=([84.213.189.154]) [84.213.189.154]:45023: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.209.91.135
country_id: 2077456
description:
2026-01-15 12:35:12 dovecot_login authenticator failed for H=([123.209.91.135]) [123.209.91.135]:47152: 535 Incorrect authentication data (set_id=postmaster@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.164.47.37
country_id: 1643084
description:
2026-01-15 12:35:39 dovecot_login authenticator failed for H=(ip-103-133.222-205.cloudteknologinusantara.co.id) [125.164.47.37]:34612: 535 Incorrect authentication data (set_id=postmaster@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.209.252.178
country_id: 1269750
description:
2026-01-15 12:35:53 dovecot_login authenticator failed for H=(static-154-209-252-178.pol.net.in) [154.209.252.178]:50030: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.17.233.246
country_id: 1269750
description:
2026-01-15 12:37:46 dovecot_login authenticator failed for H=([125.17.233.246]) [125.17.233.246]:47850: 535 Incorrect authentication data (set_id=svetlana@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.223.36.108
country_id: 3932488
description:
2026-01-15 12:36:56 dovecot_login authenticator failed for H=([190.223.36.108]) [190.223.36.108]:59020: 535 Incorrect authentication data (set_id=svetlana@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.185.161.145
country_id: 3469034
description:
2026-01-15 12:37:17 dovecot_login authenticator failed for H=(csbrasil.static.gvt.net.br) [179.185.161.145]:43637: 535 Incorrect authentication data (set_id=svetlana@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan 15 12:39:54 host2 sshd[1183373]: Disconnected from invalid user user 2.57.121.25 port 24006 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.29.197.188
country_id: 453733
description:
2026-01-15 12:44:46 dovecot_login authenticator failed for H=188-197-29-85.dyn.estpak.ee [85.29.197.188]:37950: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.82.40.34
country_id: 1694008
description:
2026-01-15 12:45:10 dovecot_login authenticator failed for H=([203.82.40.34]) [203.82.40.34]:45702: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.107.6
country_id: 290557
description:
2026-01-15 12:46:08 dovecot_plain authenticator failed for H=(cograt) [5.32.107.6]:56727: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2026-01-15 12:49:08 dovecot_plain authenticator failed for H=(micairic) [102.53.15.17]:58823: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.180
country_id: 6252001
description:
Jan 15 12:49:29 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=147.185.132.180, lip=66.85.158.91, TLS, session=<Ax2iC2hI4OGTuYS0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Jan 15 12:51:22 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<1B1nEmhI8t0DgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Jan 15 12:55:34 host2 dovecot[221878]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<nidgIWhIPOgDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.156.128.158
country_id: 2264397
description:
Jan 15 12:57:32 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=45.156.128.158, lip=66.85.158.92, session=<FdlvKGhIV5otnICe>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.251.73
country_id: 1269750
description:
2026-01-15 12:57:38 dovecot_login authenticator failed for H=(nsg-corporate-73.251.187.122.airtel.in) [122.187.251.73]:40384: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.59.4.36
country_id: 1269750
description:
2026-01-15 12:57:21 dovecot_login authenticator failed for H=(cityzone-36-4-59-103.cityzoneinfo.com) [103.59.4.36]:53246: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Jan 15 12:57:24 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<5sDvJ2hITrYDgmBb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.40.253
country_id: 953987
description:
Jan 15 12:57:29 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=102.64.40.253, lip=66.85.158.91, TLS, session=<I6H5JmhIBaBmQCj9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.215.74.195
country_id: 2661886
description:
2026-01-15 12:57:42 dovecot_plain authenticator failed for H=217-215-74-195-no2620.tbcn.telia.com (gesterte) [217.215.74.195]:43749: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.130.96.91
country_id: 6252001
description:
Jan 15 12:58:05 host2 dovecot[221878]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<2nRlKmhIjKoDgmBb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.245.219.251
country_id: 6290252
description:
Jan 15 12:57:46 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<env_eng>, method=PLAIN, rip=109.245.219.251, lip=66.85.158.91, TLS, session=<2ZpLKGhIgplt9dv7>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 86.54.42.188
country_id: 241170
description:
Jan 15 12:57:53 host2 sshd[1197362]: Disconnected from invalid user ubuntu 86.54.42.188 port 36628 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Jan 15 12:59:50 host2 dovecot[221878]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<Vv6nMGhIeqYDgmBb>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 15 13:05:33 host2 sshd[1204083]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 175.157.45.37
country_id: 1227603
description:
Jan 15 13:06:23 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=175.157.45.37, lip=66.85.158.91, TLS, session=<TVQaSGhIfNqvnS0l>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.223.92.208
country_id: 3175395
description:
2026-01-15 13:12:11 dovecot_login authenticator failed for H=(ADMIN) [176.223.92.208]:49888: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.15.216.41
country_id: 6252001
description:
2026-01-15 13:15:29 dovecot_plain authenticator failed for H=c-24-15-216-41.hsd1.il.comcast.net (xysmer) [24.15.216.41]:51078: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.148.165
country_id: 99237
description:
2026-01-15 13:15:29 dovecot_plain authenticator failed for H=(quidorsal) [65.20.148.165]:33350: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.94
country_id: 6252001
description:
Jan 15 13:21:33 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=147.185.132.94, lip=66.85.158.92, session=<TnBVfmhIcPCTuYRe>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.196
country_id: 6252001
description:
Jan 15 13:23:13 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.196, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<u8hNhGhIp8HG6xjE>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 15 13:24:06 host2 sshd[1217567]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.1.117.220
country_id: 6252001
description:
Jan 15 13:24:59 host2 sshd[1218005]: Disconnected from invalid user x 198.1.117.220 port 50148 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.69.236.207
country_id: 3865483
description:
Jan 15 13:25:38 host2 sshd[1218527]: Disconnected from invalid user wlsadmin 200.69.236.207 port 35045 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.245.182
country_id: 1269750
description:
2026-01-15 13:26:08 dovecot_login authenticator failed for H=([125.20.245.182]) [125.20.245.182]:58348: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.253.156.184
country_id: 1643084
description:
Jan 15 13:26:13 host2 sshd[1218892]: Disconnected from invalid user websphere 182.253.156.184 port 43394 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.238.2.7
country_id: 3469034
description:
2026-01-15 13:26:19 dovecot_login authenticator failed for H=45-238-2-7.netmaisfibra.net.br [45.238.2.7]:33412: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.223.176.171
country_id: 6252001
description:
2026-01-15 13:26:43 dovecot_login authenticator failed for H=([50.223.176.171]) [50.223.176.171]:33743: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.64.86
country_id: 1269750
description:
2026-01-15 13:27:28 dovecot_login authenticator failed for H=(nsg-corporate-80.50.185.122.airtel.in) [122.186.64.86]:50530: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 36.255.223.75
country_id: 1880251
description:
Jan 15 13:27:35 host2 sshd[1219725]: Disconnected from invalid user db2admin 36.255.223.75 port 38782 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.81.229.179
country_id: 6252001
description:
2026-01-15 13:26:58 dovecot_plain authenticator failed for H=(snale) [192.81.229.179]:60978: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.253.156.184
country_id: 1643084
description:
Jan 15 13:28:20 host2 sshd[1220424]: Disconnected from invalid user unifi 182.253.156.184 port 46158 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.1.117.220
country_id: 6252001
description:
Jan 15 13:27:53 host2 sshd[1219931]: Disconnected from invalid user mariadb 198.1.117.220 port 34030 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.204.88
country_id: 99237
description:
2026-01-15 13:27:55 dovecot_login authenticator failed for H=([65.20.204.88]) [65.20.204.88]:59137: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.1.117.220
country_id: 6252001
description:
Jan 15 13:29:05 host2 sshd[1220968]: Disconnected from invalid user git 198.1.117.220 port 56746 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 200.69.236.207
country_id: 3865483
description:
Jan 15 13:28:58 host2 sshd[1220845]: Disconnected from invalid user asus 200.69.236.207 port 59321 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.86.198.253
country_id: 1210997
description:
Jan 15 13:29:54 host2 sshd[1221469]: Disconnected from invalid user steam 103.86.198.253 port 35715 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.86.198.253
country_id: 1210997
description:
Jan 15 13:30:31 host2 sshd[1222073]: Disconnected from invalid user unifi 103.86.198.253 port 41341 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 133.117.72.88
country_id: 1861060
description:
Jan 15 13:31:12 host2 sshd[1222461]: Disconnected from invalid user wlsadmin 133.117.72.88 port 38558 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 198.98.55.71
country_id: 6252001
description:
Jan 15 13:31:52 host2 sshd[1222844]: Disconnected from invalid user wlsadmin 198.98.55.71 port 55362 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 15 13:35:36 host2 sshd[1225532]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 34.22.151.143
country_id: 2802361
description:
Jan 15 13:36:31 host2 pure-ftpd[1226150]: (?@34.22.151.143) [INFO] New connection from 34.22.151.143


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.2
country_id: 6252001
description:
Jan 15 13:37:36 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=64.62.197.2, lip=66.85.158.92, session=<QMW0t2hIUjZAPsUC>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.2
country_id: 6252001
description:
Jan 15 13:37:47 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.197.2, lip=66.85.158.92, TLS: Connection closed, session=<rXhluGhINFVAPsUC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.220
country_id: 130758
description:
2026-01-15 13:39:32 dovecot_login authenticator failed for H=(localhost) [62.60.130.220]:65276: 535 Incorrect authentication data (set_id=ums)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 134.209.89.168
country_id: 2750405
description:
Jan 15 13:40:28 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=134.209.89.168, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<5Hz2wWhInOiG0Vmo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.162
country_id: 1269750
description:
2026-01-15 13:41:25 dovecot_login authenticator failed for H=(nsg-corporate-162.230.187.122.airtel.in) [122.187.230.162]:44878: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.51.135
country_id: 3144096
description:
2026-01-15 13:42:01 dovecot_login authenticator failed for H=(cm-178.232.51.135.get.no) [178.232.51.135]:51321: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 133.117.72.88
country_id: 1861060
description:
Jan 15 13:45:46 host2 sshd[1232671]: Disconnected from invalid user x 133.117.72.88 port 42338 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 133.117.72.88
country_id: 1861060
description:
Jan 15 13:48:05 host2 sshd[1234299]: Disconnected from invalid user kuka 133.117.72.88 port 48472 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.154.172
country_id: 1733045
description:
2026-01-15 13:50:18 dovecot_login authenticator failed for H=([49.124.154.172]) [49.124.154.172]:54768: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.127.128
country_id: 3144096
description:
2026-01-15 13:49:56 dovecot_login authenticator failed for H=(cm-46.212.127.128.get.no) [46.212.127.128]:49505: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.68.22.140
country_id: 1269750
description:
2026-01-15 13:57:45 dovecot_login authenticator failed for H=([103.68.22.140]) [103.68.22.140]:51803: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.185.8.165
country_id: 1269750
description:
2026-01-15 13:58:06 dovecot_login authenticator failed for H=(abts-tn-static-165.8.185.136.airtelbroadband.in) [136.185.8.165]:36653: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.214.112.160
country_id: 1643084
description:
Jan 15 14:02:42 host2 sshd[1247574]: Disconnected from invalid user smart 103.214.112.160 port 39504 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.84.188.140
country_id: 3996063
description:
2026-01-15 14:02:54 dovecot_login authenticator failed for H=([140.84.188.140]) [140.84.188.140]:54332: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.246.178
country_id: 1269750
description:
2026-01-15 14:03:07 dovecot_login authenticator failed for H=([182.79.95.139]) [152.52.246.178]:46130: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.163.150
country_id: 1269750
description:
2026-01-15 14:07:11 dovecot_login authenticator failed for H=(nsg-corporate-193.168.185.122.airtel.in) [125.19.163.150]:35050: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.154
country_id: 3144096
description:
2026-01-15 14:07:20 dovecot_login authenticator failed for H=([84.213.189.154]) [84.213.189.154]:33596: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.223.92.208
country_id: 3175395
description:
2026-01-15 14:06:53 dovecot_login authenticator failed for H=(ADMIN) [176.223.92.208]:62335: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.30.83.146
country_id: 1269750
description:
Jan 15 14:12:49 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=103.30.83.146, lip=66.85.158.91, TLS, session=<ITt7NGlIFdRnHlOS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.106.14
country_id: 3469034
description:
Jan 15 14:13:09 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<careers>, method=PLAIN, rip=187.120.106.14, lip=66.85.158.91, TLS, session=<lE/KNWlIwY+7eGoO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.1.200.187
country_id: 6252001
description:
2026-01-15 14:15:27 dovecot_plain authenticator failed for H=c-24-1-200-187.hsd1.il.comcast.net (undificion) [24.1.200.187]:47120: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-01-15 14:17:58 dovecot_plain authenticator failed for H=(comity) [64.72.74.162]:59268: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.65.146
country_id: 1269750
description:
2026-01-15 14:23:12 dovecot_login authenticator failed for H=(nsg-corporate-146.65.185.122.airtel.in) [122.185.65.146]:52932: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.245.6.31
country_id: 1880251
description:
2026-01-15 14:23:25 dovecot_login authenticator failed for H=(31.6.245.49.unknown.m1.com.sg) [49.245.6.31]:59674: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 13.52.211.53
country_id: 6252001
description:
Jan 15 14:24:41 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (no auth attempts in 21 secs): user=<>, rip=13.52.211.53, lip=66.85.158.92, TLS: Connection closed, session=<K+4UYGlIUOINNNM1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.144.20
country_id: 3996063
description:
2026-01-15 14:26:35 dovecot_login authenticator failed for H=([177.236.144.20]) [177.236.144.20]:56031: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.19
country_id: 6251999
description:
Jan 15 14:31:04 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=85.217.149.19, lip=66.85.158.92, session=<z23xdmlIyMtV2ZUT>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.80.9
country_id: 3144096
description:
2026-01-15 14:36:52 dovecot_login authenticator failed for H=([178.232.80.9]) [178.232.80.9]:44415: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.101.36.159
country_id: 2963597
description:
2026-01-15 14:37:14 dovecot_login authenticator failed for H=([89.101.36.159]) [89.101.36.159]:45170: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.222.93.199
country_id: 6252001
description:
2026-01-15 14:40:38 dovecot_plain authenticator failed for H=c-98-222-93-199.hsd1.il.comcast.net (amunting) [98.222.93.199]:48814: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.182.99.92
country_id: 1655842
description:
2026-01-15 14:41:59 dovecot_login authenticator failed for H=([183.182.99.92]) [183.182.99.92]:37742: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.230.228.16
country_id: 6252001
description:
2026-01-15 14:42:26 dovecot_plain authenticator failed for H=c-71-230-228-16.hsd1.de.comcast.net (hurogic) [71.230.228.16]:60046: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 15 14:43:26 host2 sshd[1280131]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.2
country_id: 1269750
description:
2026-01-15 14:44:47 dovecot_login authenticator failed for H=([125.20.223.161]) [152.52.236.2]:40148: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.209.148.60
country_id: 2661886
description:
2026-01-15 14:45:03 dovecot_login authenticator failed for H=82-209-148-60.cust.bredband2.com [82.209.148.60]:44460: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.223.92.208
country_id: 3175395
description:
2026-01-15 15:01:05 dovecot_login authenticator failed for H=(ADMIN) [176.223.92.208]:57526: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.218.72.173
country_id: 2077456
description:
Jan 15 15:04:14 host2 sshd[1297584]: Disconnected from invalid user httpadmin 68.218.72.173 port 40518 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-15 15:04:48 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (skerrudge) [87.103.126.54]:24940: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.72.176.66
country_id: 2542007
description:
2026-01-15 15:04:54 dovecot_plain authenticator failed for H=(ented) [105.72.176.66]:58038: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.83.98
country_id: 1269750
description:
2026-01-15 15:05:13 dovecot_login authenticator failed for H=(nsg-static-193.132.71.182.airtel.in) [182.79.83.98]:40234: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 63.47.149.59
country_id: 6252001
description:
2026-01-15 15:05:38 dovecot_login authenticator failed for H=host59.sub-63-47-149.myvzw.com [63.47.149.59]:35735: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 68.218.72.173
country_id: 2077456
description:
Jan 15 15:07:15 host2 sshd[1300001]: Disconnected from invalid user aws 68.218.72.173 port 41488 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.218.72.173
country_id: 2077456
description:
Jan 15 15:08:09 host2 sshd[1300852]: Disconnected from invalid user sonarqube 68.218.72.173 port 52816 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.59.80.142
country_id: 3017382
description:
Jan 15 15:07:25 host2 sshd[1300122]: Disconnected from invalid user runner 146.59.80.142 port 33668 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.59.80.142
country_id: 3017382
description:
Jan 15 15:08:27 host2 sshd[1301076]: Disconnected from invalid user exec 146.59.80.142 port 60720 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 146.59.80.142
country_id: 3017382
description:
Jan 15 15:08:58 host2 sshd[1301438]: Disconnected from invalid user bal 146.59.80.142 port 43424 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.97.133.2
country_id: 6252001
description:
2026-01-15 15:09:42 dovecot_login authenticator failed for H=syn-024-097-133-002.biz.spectrum.com [24.97.133.2]:58290: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.174.35
country_id: 1269750
description:
2026-01-15 15:10:06 dovecot_login authenticator failed for H=(nsg-corporate-35.174.186.122.airtel.in) [122.186.174.35]:49386: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Jan 15 15:11:21 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, TLS handshaking: Connection closed, session=<tW37BmpIeNMDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Jan 15 15:11:32 host2 dovecot[221878]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<eWKwB2pInO0DiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 52.53.169.199
country_id: 6252001
description:
Jan 15 15:11:27 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (no auth attempts in 21 secs): user=<>, rip=52.53.169.199, lip=66.85.158.91, TLS: Connection closed, session=<555VB2pI5pE0NanH>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Jan 15 15:12:43 host2 dovecot[221878]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (disconnected before auth was ready, waited 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<wUTdC2pI2p8DiUnd>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 15 15:13:28 host2 sshd[1305124]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Jan 15 15:13:32 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, TLS handshaking: Connection closed, session=<23rKDmpIeK4DiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Jan 15 15:15:35 host2 dovecot[221878]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (disconnected before auth was ready, waited 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<wagqFmpInoIDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Jan 15 15:17:11 host2 dovecot[221878]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<M8TeG2pIut0DiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Jan 15 15:17:47 host2 dovecot[221878]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, TLS, session=<TLD/HWpIRpkDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Jan 15 15:18:24 host2 dovecot[221878]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<liUwIGpIFNADiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Jan 15 15:19:23 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, TLS handshaking: Connection closed, session=<CG26I2pIxqQDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Jan 15 15:20:45 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, TLS, session=<rlKZKGpINKsDiUnd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.248.67
country_id: 1269750
description:
2026-01-15 15:21:09 dovecot_login authenticator failed for H=([122.187.248.67]) [122.187.248.67]:44588: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.164.137
country_id: 99237
description:
2026-01-15 15:21:16 dovecot_plain authenticator failed for H=(mariaro) [65.20.164.137]:55735: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.248.67
country_id: 1269750
description:
2026-01-15 15:21:30 dovecot_login authenticator failed for H=([122.187.248.67]) [122.187.248.67]:46032: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.240.154.125
country_id: 6252001
description:
Jan 15 15:26:08 host2 sshd[1314321]: Invalid user agronatureholdings from 162.240.154.125 port 29246


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.220
country_id: 130758
description:
2026-01-15 15:30:10 dovecot_login authenticator failed for H=(localhost) [62.60.130.220]:49283: 535 Incorrect authentication data (set_id=root)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.50.226.182
country_id: 3469034
description:
2026-01-15 15:36:10 dovecot_login authenticator failed for H=(187-50-226-182.customer.tdatabrasil.net.br) [187.50.226.182]:36536: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.206.54
country_id: 1269750
description:
2026-01-15 15:36:32 dovecot_login authenticator failed for H=([125.19.206.54]) [125.19.206.54]:33380: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.9
country_id: 1733045
description:
2026-01-15 15:38:08 dovecot_login authenticator failed for H=([127.0.0.1]) [49.124.152.9]:40674: 535 Incorrect authentication data (set_id=art@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.35.201.180
country_id: 2510769
description:
2026-01-15 15:38:16 dovecot_login authenticator failed for H=180.red-81-35-201.dynamicip.rima-tde.net ([127.0.0.1]) [81.35.201.180]:39990: 535 Incorrect authentication data (set_id=art)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.223.53.234
country_id: 3932488
description:
2026-01-15 15:47:41 dovecot_login authenticator failed for H=([190.223.53.234]) [190.223.53.234]:37579: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.25.186.130
country_id: 6252001
description:
2026-01-15 15:48:24 dovecot_login authenticator failed for H=(173-25-186-130.client.mchsi.com) [173.25.186.130]:65037: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.57.107
country_id: 953987
description:
Jan 15 15:48:53 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=102.129.57.107, lip=66.85.158.91, TLS, session=<j44bjGpI+pRmgTlr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.197.8.106
country_id: 3175395
description:
Jan 15 15:49:24 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<careers>, method=PLAIN, rip=185.197.8.106, lip=66.85.158.91, TLS, session=<5hf1jWpIE+25xQhq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan 15 15:51:45 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<postfix@seyawin.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<BZBQl2pI0Ix100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.53.254.168
country_id: 6252001
description:
2026-01-15 15:55:10 dovecot_plain authenticator failed for H=c-73-53-254-168.hsd1.fl.comcast.net (nonverytic) [73.53.254.168]:54266: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.223.92.208
country_id: 3175395
description:
2026-01-15 15:56:11 dovecot_login authenticator failed for H=(ADMIN) [176.223.92.208]:59989: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.144.225
country_id: 3996063
description:
2026-01-15 15:56:35 dovecot_login authenticator failed for H=([127.0.0.1]) [177.236.144.225]:38437: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.69.161.40
country_id: 6252001
description:
2026-01-15 15:56:41 dovecot_login authenticator failed for H=([127.0.0.1]) [208.69.161.40]:40890: 535 Incorrect authentication data (set_id=kasunp)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 143.198.68.20
country_id: 6252001
description:
Jan 15 16:04:48 host2 dovecot[221878]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=143.198.68.20, lip=66.85.158.91, session=<PVcoxmpIht+PxkQU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.226.118
country_id: 1269750
description:
2026-01-15 16:06:32 dovecot_login authenticator failed for H=([182.95.226.118]) [182.95.226.118]:56822: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.154
country_id: 1269750
description:
2026-01-15 16:06:44 dovecot_login authenticator failed for H=([182.95.178.154]) [182.95.178.154]:45612: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.219.149.74
country_id: 2328926
description:
2026-01-15 16:06:44 dovecot_login authenticator failed for H=(netcomafrica.com) [41.219.149.74]:39004: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.142.106.177
country_id: 298795
description:
2026-01-15 16:07:03 dovecot_login authenticator failed for H=([188.132.210.145]) [195.142.106.177]:11976: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.197.8.119
country_id: 3175395
description:
Jan 15 16:12:22 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<env_eng>, method=PLAIN, rip=185.197.8.119, lip=66.85.158.91, TLS, session=<viBF4GpImry5xQh3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.11.195.98
country_id: 3865483
description:
Jan 15 16:12:05 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=190.11.195.98, lip=66.85.158.91, TLS, session=<NfQC32pIqJS+C8Ni>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.85.104.2
country_id: 6252001
description:
2026-01-15 16:14:42 dovecot_plain authenticator failed for H=(auberculy) [96.85.104.2]:51030: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.64.10
country_id: 1269750
description:
2026-01-15 16:15:31 dovecot_login authenticator failed for H=([125.18.244.137]) [182.78.64.10]:50044: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.71.84.38
country_id: 3469034
description:
2026-01-15 16:16:02 dovecot_login authenticator failed for H=([127.0.0.1]) [200.71.84.38]:33264: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.99.61.248
country_id: 1269750
description:
2026-01-15 16:16:01 dovecot_login authenticator failed for H=([14.99.61.248]) [14.99.61.248]:58452: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 15 16:20:55 host2 sshd[1357482]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 89.44.137.176
country_id: 798549
description:
Jan 15 16:24:20 host2 sshd[1360283]: Disconnected from invalid user smart 89.44.137.176 port 37186 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.85.150.173
country_id: 3923057
description:
2026-01-15 16:34:19 dovecot_login authenticator failed for H=(static-200-85-150173.vnet.bo) [200.85.150.173]:53072: 535 Incorrect authentication data (set_id=admin@jrdc.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.27.253.6
country_id: 1168579
description:
2026-01-15 16:34:50 dovecot_login authenticator failed for H=(58-27-253-6.wateen.net) [58.27.253.6]:47324: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.131.195
country_id: 1819730
description:
Jan 15 16:36:04 host2 sshd[1369896]: Disconnected from invalid user admin 152.32.131.195 port 60802 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.230.158
country_id: 1269750
description:
2026-01-15 16:35:36 dovecot_login authenticator failed for H=([182.95.230.158]) [182.95.230.158]:51394: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.155.176
country_id: 1733045
description:
2026-01-15 16:36:01 dovecot_login authenticator failed for H=([49.124.155.176]) [49.124.155.176]:45966: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 203.55.131.4
country_id: 6252001
description:
Jan 15 16:37:20 host2 dovecot[221878]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=203.55.131.4, lip=66.85.158.92, TLS, session=<6Zp9OmtItuXLN4ME>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.131.195
country_id: 1819730
description:
Jan 15 16:37:30 host2 sshd[1370788]: Disconnected from invalid user ubuntu 152.32.131.195 port 55050 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.131.195
country_id: 1819730
description:
Jan 15 16:38:09 host2 sshd[1371284]: Disconnected from invalid user ubuntu 152.32.131.195 port 37732 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.131.195
country_id: 1819730
description:
Jan 15 16:38:50 host2 sshd[1371709]: Disconnected from invalid user ubuntu 152.32.131.195 port 49212 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.91.103.202
country_id: 6252001
description:
2026-01-15 16:44:23 dovecot_plain authenticator failed for H=c-24-91-103-202.hsd1.ma.comcast.net (evochirule) [24.91.103.202]:37702: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan 15 16:50:22 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@seyawin.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<r5fxaGtI7q1100Db>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 15 16:51:05 host2 sshd[1381851]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 122.166.254.166
country_id: 1269750
description:
Jan 15 16:52:11 host2 sshd[1382517]: Disconnected from invalid user admin 122.166.254.166 port 41146 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.223.92.208
country_id: 3175395
description:
2026-01-15 16:52:25 dovecot_login authenticator failed for H=(ADMIN) [176.223.92.208]:62181: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2026-01-15 16:58:33 dovecot_login authenticator failed for H=([102.53.15.18]) [102.53.15.18]:33626: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.88.10.10
country_id: 2328926
description:
2026-01-15 16:58:51 dovecot_login authenticator failed for H=([102.88.10.10]) [102.88.10.10]:36010: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.158.170.213
country_id: 2139685
description:
2026-01-15 17:06:02 dovecot_login authenticator failed for H=host-175-158-170-213.static.lagoon.nc [175.158.170.213]:60268: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.207.250.1
country_id: 3469034
description:
2026-01-15 17:06:14 dovecot_login authenticator failed for H=(ticons.static.gvt.net.br) [177.207.250.1]:57549: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.240.39.179
country_id: 6252001
description:
Jan 15 17:10:06 host2 sshd[1396790]: Disconnected from invalid user User 162.240.39.179 port 53258 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 162.240.39.179
country_id: 6252001
description:
Jan 15 17:10:40 host2 sshd[1397301]: Disconnected from invalid user weblogic 162.240.39.179 port 36310 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.240.39.179
country_id: 6252001
description:
Jan 15 17:11:46 host2 sshd[1398045]: Disconnected from invalid user foscam 162.240.39.179 port 58852 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 117.203.145.137
country_id: 1269750
description:
Jan 15 17:12:45 host2 sshd[1398726]: Disconnected from invalid user ipcop 117.203.145.137 port 57437 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.196.253.20
country_id: 2635167
description:
Jan 15 17:13:06 host2 sshd[1399065]: Disconnected from invalid user ldap 196.196.253.20 port 35106 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 196.196.253.20
country_id: 2635167
description:
Jan 15 17:14:16 host2 sshd[1399920]: Disconnected from invalid user runner 196.196.253.20 port 35172 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.196.253.20
country_id: 2635167
description:
Jan 15 17:13:44 host2 sshd[1399479]: Disconnected from invalid user hpe 196.196.253.20 port 35140 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.196.253.20
country_id: 2635167
description:
Jan 15 17:14:46 host2 sshd[1400365]: Disconnected from invalid user vivotek 196.196.253.20 port 35206 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 189.47.10.164
country_id: 3469034
description:
Jan 15 17:16:17 host2 sshd[1401671]: Disconnected from invalid user cisco 189.47.10.164 port 39822 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.40.101.10
country_id: 6252001
description:
2026-01-15 17:18:34 dovecot_plain authenticator failed for H=c-98-40-101-10.hsd1.tn.comcast.net (hocess) [98.40.101.10]:45370: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 210.79.142.221
country_id: 1643084
description:
Jan 15 17:19:54 host2 sshd[1404152]: Disconnected from invalid user admin 210.79.142.221 port 54358 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 196.188.63.137
country_id: 337996
description:
Jan 15 17:24:53 host2 sshd[1407925]: Disconnected from invalid user admin 196.188.63.137 port 40146 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.220
country_id: 130758
description:
2026-01-15 17:25:42 dovecot_login authenticator failed for H=(localhost) [62.60.130.220]:52052: 535 Incorrect authentication data (set_id=ruslan)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan 15 17:25:32 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@seyawin.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<po/C5mtIEMd100Db>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.134.226.247
country_id: 3625428
description:
Jan 15 17:27:29 host2 sshd[1409871]: Disconnected from invalid user ubuntu 38.134.226.247 port 57152 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.134.226.17
country_id: 3625428
description:
Jan 15 17:26:47 host2 sshd[1409400]: Disconnected from invalid user ubuntu 38.134.226.17 port 42450 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.215.57.238
country_id: 3144096
description:
2026-01-15 17:27:02 dovecot_login authenticator failed for H=([127.0.0.1]) [84.215.57.238]:57235: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.60.41.239
country_id: 2510769
description:
2026-01-15 17:27:23 dovecot_login authenticator failed for H=239.red-83-60-41.dynamicip.rima-tde.net ([127.0.0.1]) [83.60.41.239]:48810: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 210.79.142.221
country_id: 1643084
description:
Jan 15 17:28:46 host2 sshd[1410701]: Disconnected from invalid user ubuntu 210.79.142.221 port 43740 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.134.226.232
country_id: 3625428
description:
Jan 15 17:29:35 host2 sshd[1411221]: Disconnected from invalid user admin 38.134.226.232 port 50926 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.134.226.191
country_id: 3625428
description:
Jan 15 17:30:58 host2 sshd[1412408]: Disconnected from invalid user ubuntu 38.134.226.191 port 33978 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.88.196.91
country_id: 6252001
description:
2026-01-15 17:31:05 dovecot_plain authenticator failed for H=c-73-88-196-91.hsd1.ky.comcast.net (unhyms) [73.88.196.91]:59492: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 210.79.142.221
country_id: 1643084
description:
Jan 15 17:31:27 host2 sshd[1412721]: Disconnected from invalid user ubuntu 210.79.142.221 port 57408 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.134.226.50
country_id: 3625428
description:
Jan 15 17:31:38 host2 sshd[1412924]: Disconnected from invalid user admin 38.134.226.50 port 44980 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.134.226.123
country_id: 3625428
description:
Jan 15 17:32:22 host2 sshd[1413430]: Disconnected from invalid user ubuntu 38.134.226.123 port 48418 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.134.226.6
country_id: 3625428
description:
Jan 15 17:33:46 host2 sshd[1414610]: Disconnected from invalid user admin 38.134.226.6 port 49092 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 86.111.91.69
country_id: 690791
description:
2026-01-15 17:33:42 dovecot_login authenticator failed for H=host-86-111-91-69.566f.la.net.ua [86.111.91.69]:57149: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.89.14
country_id: 1269750
description:
2026-01-15 17:36:17 dovecot_login authenticator failed for H=([128.185.247.210]) [182.79.89.14]:60408: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.23.140
country_id: 3144096
description:
2026-01-15 17:35:49 dovecot_login authenticator failed for H=([178.232.23.140]) [178.232.23.140]:42567: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.134.226.243
country_id: 3625428
description:
Jan 15 17:35:52 host2 sshd[1416349]: Disconnected from invalid user ubuntu 38.134.226.243 port 33722 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.227.70
country_id: 1269750
description:
2026-01-15 17:36:13 dovecot_login authenticator failed for H=(dsl-ncr-dynamic-145.59.23.125.airtelbroadband.in) [182.95.227.70]:38616: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.230.158
country_id: 1269750
description:
2026-01-15 17:37:14 dovecot_login authenticator failed for H=([182.95.230.158]) [182.95.230.158]:50636: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.31.197.108
country_id: 6252001
description:
2026-01-15 17:36:41 dovecot_login authenticator failed for H=(173-31-197-108.client.mchsi.com) [173.31.197.108]:49248: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 158.220.122.128
country_id: 3017382
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 158.220.122.128 - lezzarot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarot (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.154
country_id: 1269750
description:
2026-01-15 17:38:02 dovecot_login authenticator failed for H=([182.95.178.154]) [182.95.178.154]:55738: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.134.226.247
country_id: 3625428
description:
Jan 15 17:38:41 host2 sshd[1418483]: Disconnected from invalid user ubuntu 38.134.226.247 port 34342 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.134.226.37
country_id: 3625428
description:
Jan 15 17:41:34 host2 sshd[1420836]: Disconnected from invalid user ubuntu 38.134.226.37 port 60640 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.185.233.251
country_id: 798544
description:
2026-01-15 17:43:26 dovecot_plain authenticator failed for H=5.185.233.251.ipv4.public.orange.pl (glial) [5.185.233.251]:36046: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 38.134.226.243
country_id: 3625428
description:
Jan 15 17:42:57 host2 sshd[1421866]: Disconnected from invalid user admin 38.134.226.243 port 58144 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.134.226.239
country_id: 3625428
description:
Jan 15 17:43:37 host2 sshd[1422394]: Disconnected from invalid user ubuntu 38.134.226.239 port 43144 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.183.159.154
country_id: 6252001
description:
Jan 15 17:43:40 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=54.183.159.154, lip=66.85.158.91, TLS: Connection closed, session=<ePi0J2xIzKI2t5+a>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.36.202.237
country_id: 3469034
description:
Jan 15 17:45:18 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=138.36.202.237, lip=66.85.158.91, TLS, session=<MwZ/LGxIQeWKJMrt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 212.87.249.76
country_id: 798544
description:
Jan 15 17:45:35 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<env_eng>, method=PLAIN, rip=212.87.249.76, lip=66.85.158.91, TLS, session=<loWjLWxIM5vUV/lM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.223.92.208
country_id: 3175395
description:
2026-01-15 17:48:58 dovecot_login authenticator failed for H=(ADMIN) [176.223.92.208]:56186: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.229.1.186
country_id: 6252001
description:
2026-01-15 17:50:11 dovecot_login authenticator failed for H=c-71-229-1-186.hsd1.al.comcast.net [71.229.1.186]:42414: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.128.150.67
country_id: 6252001
description:
2026-01-15 17:51:23 dovecot_login authenticator failed for H=c-73-128-150-67.hsd1.de.comcast.net [73.128.150.67]:36884: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.51.166
country_id: 1269750
description:
2026-01-15 17:50:34 dovecot_login authenticator failed for H=([182.95.51.166]) [182.95.51.166]:55040: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.193.187.154
country_id: 1269750
description:
2026-01-15 17:50:57 dovecot_login authenticator failed for H=([113.193.187.154]) [113.193.187.154]:46342: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.193.128.109
country_id: 1269750
description:
2026-01-15 17:51:02 dovecot_login authenticator failed for H=(nsg-corporate-6.249.186.122.airtel.in) [116.193.128.109]:45994: 535 Incorrect authentication data (set_id=admin@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2026-01-15 17:52:35 dovecot_plain authenticator failed for H=c-71-62-34-216.hsd1.va.comcast.net (later) [71.62.34.216]:35266: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.42.225.40
country_id: 2510769
description:
2026-01-15 17:56:24 dovecot_plain authenticator failed for H=40.red-81-42-225.staticip.rima-tde.net (hummaid) [81.42.225.40]:39780: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 52.34.27.197
country_id: 6252001
description:
Jan 15 17:56:25 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=52.34.27.197, lip=66.85.158.92, TLS: Connection closed, session=<d99UVWxIsOo0IhvF>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 15 17:59:05 host2 sshd[1434300]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan 15 18:01:21 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@seyawin.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<51/PZmxIRp1100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.76.44.40
country_id: 1522867
description:
2026-01-15 18:02:40 dovecot_login authenticator failed for H=([5.76.44.40]) [5.76.44.40]:45666: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.210.38.204
country_id: 390903
description:
2026-01-15 18:02:56 dovecot_login authenticator failed for H=(149-210-38-204.mobile.nym.cosmote.net) [149.210.38.204]:47456: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.194.231
country_id: 3144096
description:
2026-01-15 18:06:16 dovecot_login authenticator failed for H=(cm-178.232.194.231.get.no) [178.232.194.231]:59899: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.40.215.162
country_id: 3469034
description:
2026-01-15 18:06:46 dovecot_login authenticator failed for H=187-40-215-162.user.veloxzone.com.br [187.40.215.162]:43314: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.158.145.31
country_id: 2510769
description:
2026-01-15 18:07:46 dovecot_login authenticator failed for H=31.145.158.146.dynamic.jazztel.es [146.158.145.31]:35537: 535 Incorrect authentication data (set_id=it@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-15 18:10:04 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (agonce) [87.103.126.54]:30328: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.112.28.181
country_id: 6252001
description:
2026-01-15 18:10:11 dovecot_login authenticator failed for H=ool-45701cb5.dyn.optonline.net [69.112.28.181]:52253: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 161.35.30.51
country_id: 2921044
description:
Jan 15 18:10:23 host2 dovecot[221878]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=161.35.30.51, lip=66.85.158.92, TLS handshaking: read(size=1026) failed: Connection reset by peer, session=<UkE/h2xIk6ehIx4z>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.135.31.74
country_id: 1522867
description:
2026-01-15 18:10:24 dovecot_login authenticator failed for H=2.135.31.74.dynamic.telecom.kz [2.135.31.74]:43973: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.144.27.228
country_id: 6252001
description:
2026-01-15 18:10:00 dovecot_plain authenticator failed for H=c-73-144-27-228.hsd1.mi.comcast.net (cheeceon) [73.144.27.228]:41780: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.106
country_id: 1269750
description:
2026-01-15 18:11:21 dovecot_login authenticator failed for H=([182.95.20.55]) [182.95.228.106]:59598: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
country_id: 6252001
description:
2026-01-15 18:11:32 dovecot_login authenticator failed for H=([24.187.213.29]) [24.187.213.29]:49226: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.29.197.188
country_id: 453733
description:
2026-01-15 18:11:44 dovecot_login authenticator failed for H=188-197-29-85.dyn.estpak.ee [85.29.197.188]:45648: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.241.228.34
country_id: 1269750
description:
2026-01-15 18:10:50 dovecot_login authenticator failed for H=([115.241.228.34]) [115.241.228.34]:33156: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.22.82.82
country_id: 2921044
description:
Jan 15 18:10:59 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (no auth attempts in 20 secs): user=<>, rip=165.22.82.82, lip=66.85.158.92, TLS handshaking: Connection closed, session=<AiFqiWxIvpulFlJS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.103.0.164
country_id: 690791
description:
Jan 15 18:13:09 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<careers>, method=PLAIN, rip=176.103.0.164, lip=66.85.158.91, TLS, session=<H0/0j2xIbtawZwCk>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.207.35.193
country_id: 6290252
description:
Jan 15 18:12:46 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=109.207.35.193, lip=66.85.158.91, TLS, session=<2rLLjmxICJFtzyPB>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.101.146
country_id: 1269750
description:
2026-01-15 18:15:00 dovecot_login authenticator failed for H=(aes-static-217.70.22.125.airtel.in) [27.123.101.146]:60002: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.158
country_id: 1269750
description:
2026-01-15 18:15:28 dovecot_login authenticator failed for H=([125.19.175.68]) [152.52.236.158]:40998: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.218.18
country_id: 1269750
description:
2026-01-15 18:16:59 dovecot_login authenticator failed for H=([128.185.217.27]) [128.185.218.18]:58078: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 143.198.68.20
country_id: 6252001
description:
Jan 15 18:19:44 host2 dovecot[221878]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=143.198.68.20, lip=66.85.158.92, session=<ns27qGxIxJ2PxkQU>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 195.184.76.68
country_id: 6252001
description:
Jan 15 18:22:39 host2 pure-ftpd[1455081]: (?@195.184.76.68) [INFO] New connection from 195.184.76.68


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 195.184.76.71
country_id: 6252001
description:
Jan 15 18:22:39 host2 pure-ftpd[1455085]: (?@195.184.76.71) [INFO] New connection from 195.184.76.71


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.238.92.245
country_id: 2623032
description:
2026-01-15 18:25:42 dovecot_login authenticator failed for H=(84-238-92-245.ptr.bnaa.dk) [84.238.92.245]:51016: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.216.88.160
country_id: 3469034
description:
Jan 15 18:25:37 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=186.216.88.160, lip=66.85.158.91, TLS, session=<2mBqvGxIWJ+62Fig>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.64.71.55
country_id: 3865483
description:
Jan 15 18:25:59 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<env_eng>, method=PLAIN, rip=186.64.71.55, lip=66.85.158.91, TLS, session=<WanivWxIgd26QEc3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.237.47.214
country_id: 3996063
description:
2026-01-15 18:26:07 dovecot_login authenticator failed for H=(customer-187-237-47-214.uninet-ide.com.mx) [187.237.47.214]:47926: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.199.157.145
country_id: 1880251
description:
Jan 15 18:26:39 host2 sshd[1458923]: Disconnected from invalid user jboss 128.199.157.145 port 42976 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 128.199.157.145
country_id: 1880251
description:
Jan 15 18:27:14 host2 sshd[1459435]: Disconnected from invalid user download 128.199.157.145 port 54064 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.248.67
country_id: 1269750
description:
2026-01-15 18:27:17 dovecot_login authenticator failed for H=([122.187.248.67]) [122.187.248.67]:55210: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2026-01-15 18:27:27 dovecot_login authenticator failed for H=([50.235.31.47]) [50.235.31.47]:34668: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 15 18:29:24 host2 sshd[1461145]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.238.106.150
country_id: 3865483
description:
Jan 15 18:32:41 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<training@v-deploy.com>, method=PLAIN, rip=45.238.106.150, lip=66.85.158.91, TLS, session=<xKPe1WxIcMkt7mqW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.171.164
country_id: 3175395
description:
Jan 15 18:32:41 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<training@v-deploy.com>, method=PLAIN, rip=185.15.171.164, lip=66.85.158.91, TLS, session=<QhPS1WxIVra5D6uk>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.196.209.55
country_id: 6252001
description:
2026-01-15 18:33:09 dovecot_plain authenticator failed for H=c-98-196-209-55.hsd1.tx.comcast.net (unnican) [98.196.209.55]:44284: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.68.178.196
country_id: 3175395
description:
Jan 15 18:33:01 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<training>, method=PLAIN, rip=185.68.178.196, lip=66.85.158.91, TLS, session=<ypso12xIfrS5RLLE>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.97.42
country_id: 3469034
description:
Jan 15 18:33:04 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<training>, method=PLAIN, rip=177.44.97.42, lip=66.85.158.91, TLS, session=<lE0r12xIsd2xLGEq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.149.213.242
country_id: 3469034
description:
2026-01-15 18:36:10 dovecot_login authenticator failed for H=([200.164.226.113]) [200.149.213.242]:40081: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.155.27.128
country_id: 2802361
description:
2026-01-15 18:36:23 dovecot_login authenticator failed for H=128.27.155.104.bc.googleusercontent.com [104.155.27.128]:64289: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.213.175.140
country_id: 2510769
description:
Jan 15 18:37:38 host2 sshd[1467349]: Disconnected from invalid user dbadmin 185.213.175.140 port 12562 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 205.185.127.60
country_id: 6252001
description:
Jan 15 18:37:59 host2 sshd[1467597]: Disconnected from invalid user luis 205.185.127.60 port 37596 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 205.185.127.60
country_id: 6252001
description:
Jan 15 18:40:30 host2 sshd[1469622]: Disconnected from invalid user webadmin 205.185.127.60 port 45278 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 138.197.179.218
country_id: 2921044
description:
Jan 15 18:41:12 host2 dovecot[221878]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=138.197.179.218, lip=66.85.158.92, TLS handshaking: read(size=1026) failed: Connection reset by peer, session=<7ol19WxIb0WKxbPa>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.213.175.140
country_id: 2510769
description:
Jan 15 18:41:34 host2 sshd[1470516]: Disconnected from invalid user zabbix 185.213.175.140 port 41090 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 205.185.127.60
country_id: 6252001
description:
Jan 15 18:41:05 host2 sshd[1470234]: Disconnected from invalid user bind 205.185.127.60 port 56408 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 134.209.224.40
country_id: 2921044
description:
Jan 15 18:41:47 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (no auth attempts in 20 secs): user=<>, rip=134.209.224.40, lip=66.85.158.92, TLS handshaking: Connection closed, session=<55qR92xICkWG0eAo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.223.92.208
country_id: 3175395
description:
2026-01-15 18:44:43 dovecot_login authenticator failed for H=(ADMIN) [176.223.92.208]:50230: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 34.140.92.201
country_id: 2802361
description:
Jan 15 18:45:49 host2 pure-ftpd[1473855]: (?@34.140.92.201) [INFO] New connection from 34.140.92.201


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan 15 18:47:33 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@seyawin.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<VgQBDG1IUJt100Db>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 150.136.248.130
country_id: 6252001
description:
Jan 15 18:53:49 host2 sshd[1480020]: Disconnected from invalid user test 150.136.248.130 port 41510 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan 15 18:59:55 host2 sshd[1484894]: Disconnected from invalid user user 2.57.121.25 port 27482 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Jan 15 19:07:35 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<w6DZU21INKgDhpQ7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.118.162.194
country_id: 2453866
description:
2026-01-15 19:07:44 dovecot_login authenticator failed for H=([154.118.162.194]) [154.118.162.194]:14297: 535 Incorrect authentication data (set_id=hostmaster@2s-travels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.205.2.9
country_id: 1269750
description:
2026-01-15 19:07:52 dovecot_login authenticator failed for H=([117.205.2.9]) [117.205.2.9]:59189: 535 Incorrect authentication data (set_id=hostmaster@2s-travels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.37.32.248
country_id: 1269750
description:
2026-01-15 19:08:26 dovecot_login authenticator failed for H=(nsg-corporate-90.179.185.122.airtel.in) [49.37.32.248]:35820: 535 Incorrect authentication data (set_id=hostmaster)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Jan 15 19:08:31 host2 dovecot[221878]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<yOUxV21IytgDhpQ7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.158.145.31
country_id: 2510769
description:
2026-01-15 19:11:15 dovecot_login authenticator failed for H=31.145.158.146.dynamic.jazztel.es [146.158.145.31]:49128: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.23.72.189
country_id: 6252001
description:
2026-01-15 19:10:29 dovecot_login authenticator failed for H=([209.23.72.189]) [209.23.72.189]:37822: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Jan 15 19:10:51 host2 dovecot[221878]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<A1aKX21IOsoDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Jan 15 19:11:37 host2 dovecot[221878]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<aBxCYm1IeOUDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Jan 15 19:12:47 host2 dovecot[221878]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<QpZtZm1ItN4DhpQ7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.30.14.221
country_id: 6252001
description:
2026-01-15 19:15:12 dovecot_login authenticator failed for H=pool-108-30-14-221.nycmny.fios.verizon.net [108.30.14.221]:34850: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.208.46.130
country_id: 1522867
description:
2026-01-15 19:15:43 dovecot_login authenticator failed for H=([37.208.46.130]) [37.208.46.130]:36791: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.61.82
country_id: 1269750
description:
2026-01-15 19:16:21 dovecot_login authenticator failed for H=([125.17.225.97]) [182.95.61.82]:36086: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.164.13
country_id: 6252001
description:
2026-01-15 19:16:50 dovecot_login authenticator failed for H=([192.34.164.13]) [192.34.164.13]:16484: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.241.188.105
country_id: 6252001
description:
Jan 15 19:19:41 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=54.241.188.105, lip=66.85.158.91, TLS: Connection closed, session=<JIAhf21ISJ428bxp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.147.94
country_id: 290557
description:
2026-01-15 19:21:32 dovecot_plain authenticator failed for H=(crint) [80.227.147.94]:38268: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.64.3.134
country_id: 1269750
description:
2026-01-15 19:23:29 dovecot_login authenticator failed for H=([127.0.0.1]) [182.64.3.134]:49240: 535 Incorrect authentication data (set_id=arts@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.150.243.22
country_id: 6252001
description:
2026-01-15 19:23:45 dovecot_plain authenticator failed for H=(preboler) [12.150.243.22]:58030: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.49.113
country_id: 3144096
description:
2026-01-15 19:23:53 dovecot_login authenticator failed for H=([127.0.0.1]) [178.232.49.113]:33455: 535 Incorrect authentication data (set_id=arts@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.220
country_id: 130758
description:
2026-01-15 19:25:16 dovecot_login authenticator failed for H=(localhost) [62.60.130.220]:54832: 535 Incorrect authentication data (set_id=postgres)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.166.153.20
country_id: 6252001
description:
2026-01-15 19:25:31 dovecot_plain authenticator failed for H=c-174-166-153-20.hsd1.nj.comcast.net (reoney) [174.166.153.20]:39098: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.121.175.220
country_id: 3579143
description:
2026-01-15 19:26:02 dovecot_login authenticator failed for H=([93.121.175.220]) [93.121.175.220]:43352: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.70.157.25
country_id: 6252001
description:
2026-01-15 19:30:59 dovecot_login authenticator failed for H=([152.70.157.25]) [152.70.157.25]:36628: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.23.253.51
country_id: 6252001
description:
Jan 15 19:34:15 host2 dovecot[221878]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=64.23.253.51, lip=66.85.158.91, TLS, session=<iZYvs21I/MRAF/0z>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.132.133.54
country_id: 1269750
description:
2026-01-15 19:35:18 dovecot_login authenticator failed for H=([61.246.72.73]) [203.132.133.54]:46122: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.200.93.86
country_id: 290557
description:
2026-01-15 19:35:46 dovecot_login authenticator failed for H=([87.200.93.86]) [87.200.93.86]:36617: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-15 19:37:09 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (foort) [87.103.126.54]:30391: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.132.181.70
country_id: 1522867
description:
2026-01-15 19:38:19 dovecot_login authenticator failed for H=2.132.181.70.dynamic.telecom.kz [2.132.181.70]:41413: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.114.243.85
country_id: 3625428
description:
2026-01-15 19:38:29 dovecot_login authenticator failed for H=([190.114.243.80]) [190.114.243.85]:48748: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 3.90.248.24
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 3.90.248.24: 250 connections per 30 seconds to 8443 port.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.223.92.208
country_id: 3175395
description:
2026-01-15 19:40:01 dovecot_login authenticator failed for H=(ADMIN) [176.223.92.208]:55541: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 15 19:41:48 host2 sshd[1515044]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 15 19:42:56 host2 sshd[1515743]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.160.139.163
country_id: 2510769
description:
2026-01-15 19:42:25 dovecot_login authenticator failed for H=(163.pool90-160-139.dynamic.orange.es) [90.160.139.163]:59099: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.182.118.138
country_id: 732800
description:
2026-01-15 19:42:45 dovecot_login authenticator failed for H=([62.182.118.138]) [62.182.118.138]:44879: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.146.58
country_id: 3996063
description:
2026-01-15 19:43:01 dovecot_login authenticator failed for H=([177.236.146.58]) [177.236.146.58]:45745: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.2
country_id: 1269750
description:
2026-01-15 19:42:21 dovecot_login authenticator failed for H=([125.19.173.202]) [152.52.236.2]:36326: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Jan 15 19:42:41 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, session=<wQJY0W1ITLoDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Jan 15 19:43:31 host2 dovecot[221878]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, session=<SvBf1G1Iyq4DiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.153.44.250
country_id: 6252001
description:
Jan 15 19:45:15 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=54.153.44.250, lip=66.85.158.92, TLS: Connection closed, session=<5rKM2m1IPKM2mSz6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Jan 15 19:44:32 host2 dovecot[221878]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, session=<bqn6121I1rUDiUnd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-15 19:44:33 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:20791: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Jan 15 19:45:27 host2 dovecot[221878]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, session=<r0RB221IPswDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Jan 15 19:46:50 host2 dovecot[221878]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, session=<xrcv4G1IMqEDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Jan 15 19:47:44 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, session=<ybFm421I+OsDiUnd>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.137.73.221
country_id: 6252001
description:
Jan 15 19:48:01 host2 dovecot[221878]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, session=<r7F25G1IVO0DiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Jan 15 19:48:44 host2 dovecot[221878]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, session=<eCwH521IItADiUnd>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.137.73.221
country_id: 6252001
description:
Jan 15 19:49:01 host2 dovecot[221878]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, session=<ZMQE6G1IMpMDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Jan 15 19:49:34 host2 dovecot[221878]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, session=<Xub16W1IlKIDiUnd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan 15 19:52:59 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@seyawin.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=</BYK9m1IN8F100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.59.226
country_id: 337996
description:
2026-01-15 19:54:16 dovecot_login authenticator failed for H=([196.189.59.226]) [196.189.59.226]:59137: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.89.14
country_id: 1269750
description:
2026-01-15 19:54:19 dovecot_login authenticator failed for H=([128.185.247.210]) [182.79.89.14]:37982: 535 Incorrect authentication data (set_id=postmaster@kamecho.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.145.54
country_id: 1269750
description:
2026-01-15 19:53:28 dovecot_login authenticator failed for H=([128.185.135.33]) [122.185.145.54]:56174: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.97.203.163
country_id: 3686110
description:
2026-01-15 19:53:40 dovecot_login authenticator failed for H=(Dinamic-Tigo186-97-203-163.tigo.com.co) [186.97.203.163]:55590: 535 Incorrect authentication data (set_id=postmaster@kamecho.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.29.26
country_id: 3144096
description:
2026-01-15 19:56:51 dovecot_login authenticator failed for H=(cm-178.232.29.26.get.no) [178.232.29.26]:43413: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.230.158
country_id: 1269750
description:
2026-01-15 19:56:36 dovecot_login authenticator failed for H=(dsl-del-065.26.246.61.airtelbroadband.in) [182.95.230.158]:55532: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.215.202
country_id: 1269750
description:
2026-01-15 20:01:20 dovecot_login authenticator failed for H=([125.20.249.53]) [128.185.215.202]:47074: 535 Incorrect authentication data (set_id=abuse@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.80.47.126
country_id: 6252001
description:
2026-01-15 20:01:40 dovecot_login authenticator failed for H=syn-076-080-047-126.biz.spectrum.com (localhost) [76.80.47.126]:50544: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.187.30
country_id: 1269750
description:
2026-01-15 20:01:51 dovecot_login authenticator failed for H=(nsg-corporate-81.166.185.122.airtel.in) [122.185.187.30]:48992: 535 Incorrect authentication data (set_id=abuse)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.0.191.33
country_id: 6252001
description:
2026-01-15 20:01:50 dovecot_plain authenticator failed for H=c-73-0-191-33.hsd1.fl.comcast.net (pitic) [73.0.191.33]:37694: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.15
country_id: 6251999
description:
Jan 15 20:10:22 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=85.217.149.15, lip=66.85.158.91, session=<vrxZNG5IWuxV2ZUP>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 15 20:12:12 host2 sshd[1537349]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.218.95.154
country_id: 6252001
description:
2026-01-15 20:12:10 dovecot_login authenticator failed for H=syn-074-218-095-154.biz.spectrum.com [74.218.95.154]:52711: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.165.174.234
country_id: 1269750
description:
2026-01-15 20:12:47 dovecot_login authenticator failed for H=([103.165.174.234]) [103.165.174.234]:59686: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.168.136.150
country_id: 6252001
description:
2026-01-15 20:12:22 dovecot_plain authenticator failed for H=c-73-168-136-150.hsd1.il.comcast.net (pfurop) [73.168.136.150]:47792: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.181.133.153
country_id: 3469034
description:
2026-01-15 20:12:29 dovecot_login authenticator failed for H=([179.181.135.1]) [179.181.133.153]:43936: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.206.54
country_id: 1269750
description:
2026-01-15 20:18:10 dovecot_login authenticator failed for H=([182.95.3.57]) [125.19.206.54]:42684: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.201.92
country_id: 1733045
description:
2026-01-15 20:18:24 dovecot_login authenticator failed for H=([49.125.201.92]) [49.125.201.92]:54928: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.240.154.125
country_id: 6252001
description:
Jan 15 20:22:41 host2 sshd[1544109]: Invalid user agronatureholdings from 162.240.154.125 port 12906


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan 15 20:28:27 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 5 secs): user=<hr@seyawin.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<DQe9dG5IZ7N100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.50.154
country_id: 1269750
description:
2026-01-15 20:33:17 dovecot_login authenticator failed for H=([125.19.93.105]) [182.95.50.154]:60468: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.238.107.104
country_id: 3865483
description:
Jan 15 20:34:12 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<env_eng>, method=PLAIN, rip=45.238.107.104, lip=66.85.158.91, TLS, session=<Bxt3iG5ImY0t7mto>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.151
country_id: 1269750
description:
2026-01-15 20:34:15 dovecot_login authenticator failed for H=([122.187.229.151]) [122.187.229.151]:60074: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.255.73.199
country_id: 1269750
description:
Jan 15 20:33:40 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=103.255.73.199, lip=66.85.158.91, TLS, session=<DE9yhm5IWLBn/0nH>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.120.1.74
country_id: 6252001
description:
2026-01-15 20:33:43 dovecot_login authenticator failed for H=(syn-070-120-001-074.res.spectrum.com) [70.120.1.74]:56444: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.89.245.118
country_id: 617790
description:
2026-01-15 20:34:16 dovecot_login authenticator failed for H=([77.89.245.118]) [77.89.245.118]:47020: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.223.92.208
country_id: 3175395
description:
2026-01-15 20:35:32 dovecot_login authenticator failed for H=(ADMIN) [176.223.92.208]:64661: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.143.72
country_id: 298795
description:
2026-01-15 20:38:59 dovecot_plain authenticator failed for H=(prasm) [5.11.143.72]:54100: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.207.15.25
country_id: 1269750
description:
2026-01-15 20:40:11 dovecot_login authenticator failed for H=(49.207.15.25.actcorp.in) [49.207.15.25]:53270: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.166.50.15
country_id: 453733
description:
2026-01-15 20:39:39 dovecot_login authenticator failed for H=15-50-166-83.dyn.estpak.ee [83.166.50.15]:48863: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.125.124.14
country_id: 3469034
description:
2026-01-15 20:40:59 dovecot_login authenticator failed for H=(vtx-b-124-014.virtex.com.br) [179.125.124.14]:59070: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.128.202
country_id: 6252001
description:
2026-01-15 20:42:05 dovecot_login authenticator failed for H=([192.34.128.202]) [192.34.128.202]:57554: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.237.115.206
country_id: 732800
description:
2026-01-15 20:42:29 dovecot_login authenticator failed for H=(151.237.115.206.pronet.bg) [151.237.115.206]:59541: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.76.204.237
country_id: 1269750
description:
Jan 15 20:43:23 host2 sshd[1557436]: Disconnected from invalid user admin 182.76.204.237 port 36922 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.76.204.237
country_id: 1269750
description:
Jan 15 20:45:24 host2 sshd[1559351]: Disconnected from invalid user admin 182.76.204.237 port 36874 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 182.76.204.237
country_id: 1269750
description:
Jan 15 20:46:03 host2 sshd[1559874]: Disconnected from invalid user ubuntu 182.76.204.237 port 41504 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.153.146
country_id: 99237
description:
2026-01-15 20:47:55 dovecot_plain authenticator failed for H=(milars) [65.20.153.146]:39551: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.175.58.75
country_id: 294640
description:
2026-01-15 20:48:12 dovecot_login authenticator failed for H=([127.0.0.1]) [93.175.58.75]:56662: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.138.53.19
country_id: 1643084
description:
2026-01-15 20:48:21 dovecot_login authenticator failed for H=([127.0.0.1]) [103.138.53.19]:40178: 535 Incorrect authentication data (set_id=kasunp)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 212.11.64.162
country_id: 241170
description:
Jan 15 20:49:00 host2 sshd[1562260]: Disconnected from invalid user vncuser 212.11.64.162 port 49738 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.238.92.245
country_id: 2623032
description:
2026-01-15 20:49:57 dovecot_login authenticator failed for H=(84-238-92-245.ptr.bnaa.dk) [84.238.92.245]:57717: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.200.228.35
country_id: 6252001
description:
Jan 15 20:50:06 host2 sshd[1563206]: Disconnected from invalid user admin 172.200.228.35 port 34278 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.200.228.35
country_id: 6252001
description:
Jan 15 20:52:14 host2 sshd[1565040]: Disconnected from invalid user ubuntu 172.200.228.35 port 37494 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.253.154
country_id: 1269750
description:
2026-01-15 20:51:40 dovecot_login authenticator failed for H=([125.21.56.137]) [125.19.253.154]:39772: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 212.11.64.162
country_id: 241170
description:
Jan 15 20:53:05 host2 sshd[1565893]: Disconnected from invalid user ansible 212.11.64.162 port 57974 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.105.176.66
country_id: 1269750
description:
Jan 15 20:52:37 host2 sshd[1565419]: Disconnected from invalid user frappe 103.105.176.66 port 47168 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.37.181.181
country_id: 1831722
description:
2026-01-15 20:52:54 dovecot_login authenticator failed for H=([36.37.181.181]) [36.37.181.181]:34078: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.200.228.35
country_id: 6252001
description:
Jan 15 20:52:55 host2 sshd[1565676]: Disconnected from invalid user ubuntu 172.200.228.35 port 45002 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 212.11.64.162
country_id: 241170
description:
Jan 15 20:55:23 host2 sshd[1568239]: Disconnected from invalid user nextcloud 212.11.64.162 port 44512 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.61.6
country_id: 290557
description:
2026-01-15 20:56:21 dovecot_plain authenticator failed for H=(whiast) [5.32.61.6]:60074: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 212.11.64.162
country_id: 241170
description:
Jan 15 20:57:39 host2 sshd[1569790]: Disconnected from invalid user bitcoin 212.11.64.162 port 50972 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.247.189.189
country_id: 6252001
description:
2026-01-15 20:58:20 dovecot_login authenticator failed for H=([50.247.189.189]) [50.247.189.189]:26508: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 115.85.80.12
country_id: 1643084
description:
Jan 15 21:03:28 host2 sshd[1573934]: Disconnected from invalid user newuser 115.85.80.12 port 45552 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 200.189.27.41
country_id: 3686110
description:
Jan 15 21:02:37 host2 sshd[1573241]: Disconnected from invalid user mssql 200.189.27.41 port 19117 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan 15 21:03:07 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<4jXk8G5I8sl100Db>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 115.85.80.12
country_id: 1643084
description:
Jan 15 21:06:04 host2 sshd[1575749]: Disconnected from invalid user ADMIN 115.85.80.12 port 44106 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 164.92.233.170
country_id: 2921044
description:
Jan 15 21:08:20 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (no auth attempts in 30 secs): user=<>, rip=164.92.233.170, lip=66.85.158.92, TLS handshaking: Connection closed, session=<pxGrA29IwAqkXOmq>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 68.183.199.130
country_id: 6251999
description:
Jan 15 21:08:48 host2 dovecot[221878]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=68.183.199.130, lip=66.85.158.92, TLS, session=<Rs1ZBW9IFu1Et8eC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.226.88.121
country_id: 2661886
description:
2026-01-15 21:09:13 dovecot_plain authenticator failed for H=81-226-88-121-no600.tbcn.telia.com (peepoddus) [81.226.88.121]:52813: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.66
country_id: 6252001
description:
Jan 15 21:13:09 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.66, lip=66.85.158.91, TLS handshaking: Connection closed, session=<vyrmFG9ILi1BMQFC>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.66
country_id: 6252001
description:
Jan 15 21:13:30 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.66, lip=66.85.158.91, TLS handshaking: Connection closed, session=<gX8jFm9I5sNBMQFC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.102.149.88
country_id: 294640
description:
2026-01-15 21:15:42 dovecot_login authenticator failed for H=([82.102.149.88]) [82.102.149.88]:57613: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.27.76.210
country_id: 3469034
description:
2026-01-15 21:16:11 dovecot_login authenticator failed for H=(187-8-89-120.customer.tdatabrasil.net.br) [177.27.76.210]:38841: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 15 21:18:15 host2 sshd[1584778]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 15 21:20:24 host2 sshd[1586294]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 137.184.145.163
country_id: 6252001
description:
Jan 15 21:25:08 host2 sshd[1589787]: Disconnected from invalid user ubuntu 137.184.145.163 port 40974 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.220
country_id: 130758
description:
2026-01-15 21:25:17 dovecot_login authenticator failed for H=(localhost) [62.60.130.220]:51365: 535 Incorrect authentication data (set_id=administracion)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 137.184.145.163
country_id: 6252001
description:
Jan 15 21:25:40 host2 sshd[1590222]: Disconnected from invalid user ubuntu 137.184.145.163 port 55218 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 202.51.214.99
country_id: 1643084
description:
Jan 15 21:25:46 host2 sshd[1590269]: Disconnected from invalid user ubuntu 202.51.214.99 port 59038 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 74.249.177.184
country_id: 6252001
description:
Jan 15 21:26:07 host2 dovecot[221878]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=74.249.177.184, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<q+ZAQ29IOIpK+bG4>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.91.166.34
country_id: 1643084
description:
Jan 15 21:26:37 host2 sshd[1590943]: Disconnected from invalid user ubuntu 36.91.166.34 port 54434 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.51.214.99
country_id: 1643084
description:
Jan 15 21:27:44 host2 sshd[1591595]: Disconnected from invalid user admin 202.51.214.99 port 36626 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 137.184.145.163
country_id: 6252001
description:
Jan 15 21:27:49 host2 sshd[1591698]: Disconnected from invalid user admin 137.184.145.163 port 59066 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan 15 21:30:54 host2 sshd[1593862]: Disconnected from invalid user user 2.57.121.25 port 33236 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.223.92.208
country_id: 3175395
description:
2026-01-15 21:30:58 dovecot_login authenticator failed for H=(ADMIN) [176.223.92.208]:62708: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.97.131.155
country_id: 6252001
description:
Jan 15 21:31:18 host2 sshd[1594180]: Disconnected from invalid user admin 152.97.131.155 port 48790 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.97.131.155
country_id: 6252001
description:
Jan 15 21:32:33 host2 sshd[1595118]: Disconnected from invalid user admin 152.97.131.155 port 47740 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.163.2.42
country_id: 6252001
description:
Jan 15 21:34:00 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=20.163.2.42, lip=66.85.158.92, TLS, session=<vgFyX29I7scUowIq>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.97.131.155
country_id: 6252001
description:
Jan 15 21:34:26 host2 sshd[1596366]: Disconnected from invalid user ubuntu 152.97.131.155 port 52654 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.230.228.16
country_id: 6252001
description:
2026-01-15 21:37:41 dovecot_plain authenticator failed for H=c-71-230-228-16.hsd1.de.comcast.net (undercon) [71.230.228.16]:59808: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.166
country_id: 1269750
description:
2026-01-15 21:38:10 dovecot_login authenticator failed for H=(nsg-static-089.96.71.182.airtel.in) [182.95.181.166]:36182: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.119
country_id: 6252001
description:
Jan 15 21:38:09 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 15 secs): user=<>, rip=147.185.133.119, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<X6dVbm9It8OTuYV3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan 15 21:38:26 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@seyawin.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<dHAib29IZrx100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.146.217.105
country_id: 1861060
description:
2026-01-15 21:38:31 dovecot_login authenticator failed for H=105.217.146.34.bc.googleusercontent.com [34.146.217.105]:55084: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.51.135
country_id: 3144096
description:
2026-01-15 21:39:01 dovecot_login authenticator failed for H=(cm-178.232.51.135.get.no) [178.232.51.135]:59280: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.119
country_id: 6252001
description:
Jan 15 21:39:27 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 8 secs): user=<>, rip=147.185.133.119, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<0Dr7cm9IlumTuYV3>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.119
country_id: 6252001
description:
Jan 15 21:47:05 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=147.185.133.119, lip=66.85.158.91, TLS, session=<ScA+jm9I7uqTuYV3>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.119
country_id: 6252001
description:
Jan 15 21:47:58 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=147.185.133.119, lip=66.85.158.91, TLS, session=<vt9ikW9ISO6TuYV3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.230.228.16
country_id: 6252001
description:
2026-01-15 21:48:19 dovecot_plain authenticator failed for H=c-71-230-228-16.hsd1.de.comcast.net (ammurs) [71.230.228.16]:41438: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.247.248.154
country_id: 3469034
description:
2026-01-15 21:50:11 dovecot_login authenticator failed for H=([170.247.248.154]) [170.247.248.154]:42248: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 15 21:50:47 host2 sshd[1608182]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.74.63.250
country_id: 3057568
description:
[2026-01-15 21:51:31 +0530] info [webmaild] 45.74.63.250 - hr@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.166.137.91
country_id: 6252001
description:
2026-01-15 21:57:56 dovecot_login authenticator failed for H=wsip-70-166-137-91.fv.ks.cox.net [70.166.137.91]:60716: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.181.196.96
country_id: 3469034
description:
2026-01-15 21:58:10 dovecot_login authenticator failed for H=(96.196.181.45.datasysteminfor.com.br) [45.181.196.96]:49769: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.162.181
country_id: 99237
description:
Jan 15 21:59:15 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=65.20.162.181, lip=66.85.158.91, TLS, session=<ioPDuG9I44FBFKK1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 168.0.224.100
country_id: 3469034
description:
Jan 15 21:59:35 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<careers>, method=PLAIN, rip=168.0.224.100, lip=66.85.158.91, TLS, session=<ZgbnuW9I752oAOBk>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 143.244.47.59
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [webmaild] 143.244.47.59 - washeera@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.207.5.46
country_id: 1269750
description:
Jan 15 22:03:43 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<env_eng>, method=PLAIN, rip=103.207.5.46, lip=66.85.158.91, TLS, session=<3HabyG9IXalnzwUu>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.240.96.172
country_id: 3469034
description:
Jan 15 22:03:21 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=191.240.96.172, lip=66.85.158.91, TLS, session=<1idNx29ICc+/8GCs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.237.47.214
country_id: 3996063
description:
2026-01-15 22:03:34 dovecot_login authenticator failed for H=(customer-187-237-47-214.uninet-ide.com.mx) [187.237.47.214]:39197: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.72.153.110
country_id: 290557
description:
2026-01-15 22:04:56 dovecot_login authenticator failed for H=([91.72.153.110]) [91.72.153.110]:57993: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.142.184.55
country_id: 1210997
description:
2026-01-15 22:11:38 dovecot_login authenticator failed for H=([103.133.175.82]) [103.142.184.55]:32901: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.70.126
country_id: 1269750
description:
2026-01-15 22:11:51 dovecot_login authenticator failed for H=([182.78.70.126]) [182.78.70.126]:36510: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.213.236.66
country_id: 6252001
description:
2026-01-15 22:12:43 dovecot_plain authenticator failed for H=c-73-213-236-66.hsd1.va.comcast.net (wardopleal) [73.213.236.66]:46454: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.85
country_id: 2186224
description:
2026-01-15 22:13:04 dovecot_login authenticator failed for H=([121.73.163.85]) [121.73.163.85]:34850: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.46.124.0
country_id: 3686110
description:
2026-01-15 22:13:23 dovecot_login authenticator failed for H=(azteca-comunicaciones.com) [201.46.124.0]:2727: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan 15 22:14:07 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@seyawin.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<sXXG7m9ICMN100Db>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.94
country_id: 6252001
description:
Jan 15 22:14:46 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=64.62.197.94, lip=66.85.158.92, session=<ojw78W9I/1xAPsVe>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 15 22:15:38 host2 sshd[1656706]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.118.49.18
country_id: 1269750
description:
2026-01-15 22:14:50 dovecot_login authenticator failed for H=([45.118.49.18]) [45.118.49.18]:52844: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.92
country_id: 6252001
description:
Jan 15 22:14:57 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.197.92, lip=66.85.158.92, TLS: Connection closed, session=<7XLn8W9IDK1APsVc>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.205.186.84
country_id: 146669
description:
[2025-12-26 17:26:14 +0530] info [webmaild] 185.205.186.84 - washeera@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.78
country_id: 1733045
description:
2026-01-15 22:17:42 dovecot_login authenticator failed for H=([49.124.151.78]) [49.124.151.78]:47324: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.194
country_id: 1269750
description:
2026-01-15 22:18:13 dovecot_login authenticator failed for H=([182.95.176.194]) [182.95.176.194]:57308: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.20
country_id: 6251999
description:
Jan 15 22:18:15 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=85.217.149.20, lip=66.85.158.92, session=<MIG8/W9IQKVV2ZUU>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.211
country_id: 6252001
description:
Jan 15 22:20:29 host2 pure-ftpd[1660830]: (?@198.235.24.211) [INFO] New connection from 198.235.24.211


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-15 22:20:30 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (breeria) [87.103.126.54]:50741: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 34.148.153.192
country_id: 6252001
description:
Jan 15 22:23:22 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (disconnected before auth was ready, waited 0 secs): user=<>, rip=34.148.153.192, lip=66.85.158.91, session=<LD4BEHBIiLAilJnA>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.223.92.208
country_id: 3175395
description:
2026-01-15 22:26:27 dovecot_login authenticator failed for H=(ADMIN) [176.223.92.208]:52534: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.39.46.41
country_id: 3469034
description:
Jan 15 22:30:11 host2 sshd[1668358]: Disconnected from invalid user sys 200.39.46.41 port 34074 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 107.155.55.174
country_id: 1880251
description:
Jan 15 22:30:47 host2 sshd[1668803]: Disconnected from invalid user apc 107.155.55.174 port 45816 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
country_id: 6252001
description:
2026-01-15 22:31:32 dovecot_plain authenticator failed for H=(ultion) [24.187.213.29]:54232: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 134.122.6.62
country_id: 6252001
description:
Jan 15 22:31:12 host2 sshd[1669094]: Disconnected from invalid user loader 134.122.6.62 port 48748 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.105.248.218
country_id: 6252001
description:
2026-01-15 22:32:19 dovecot_plain authenticator failed for H=(semord) [24.105.248.218]:57504: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 49.206.243.162
country_id: 1269750
description:
Jan 15 22:32:37 host2 sshd[1669941]: Disconnected from invalid user openvpn 49.206.243.162 port 13710 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 200.39.46.41
country_id: 3469034
description:
Jan 15 22:32:45 host2 sshd[1670007]: Disconnected from invalid user mosquitto 200.39.46.41 port 37832 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.211.209.191
country_id: 2464461
description:
Jan 15 22:33:14 host2 sshd[1670336]: Disconnected from invalid user db2admin 102.211.209.191 port 55482 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.190.42.55
country_id: 6252001
description:
Jan 15 22:32:49 host2 sshd[1670065]: Disconnected from invalid user resin 172.190.42.55 port 37822 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 207.154.204.178
country_id: 2921044
description:
Jan 15 22:34:27 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (no auth attempts in 30 secs): user=<>, rip=207.154.204.178, lip=66.85.158.92, TLS handshaking: Connection closed, session=<CZWqN3BI1KHPmsyy>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.190.42.55
country_id: 6252001
description:
Jan 15 22:33:56 host2 sshd[1670885]: Disconnected from invalid user peoplesoft 172.190.42.55 port 39982 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.211.209.191
country_id: 2464461
description:
Jan 15 22:34:15 host2 sshd[1671102]: Disconnected from invalid user nsroot 102.211.209.191 port 54732 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 62.3.56.187
country_id: 99237
description:
Jan 15 22:35:16 host2 sshd[1671981]: Disconnected from invalid user geovision 62.3.56.187 port 56260 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 134.122.6.62
country_id: 6252001
description:
Jan 15 22:36:04 host2 sshd[1672601]: Disconnected from invalid user sconsole 134.122.6.62 port 38838 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 193.26.115.111
country_id: 6252001
description:
Jan 15 22:36:26 host2 sshd[1672831]: Invalid user cloudtourssrilan_travel from 193.26.115.111 port 52100


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 193.26.115.111
country_id: 6252001
description:
Jan 15 22:37:23 host2 sshd[1673424]: Invalid user cloudtourssrilan_travel from 193.26.115.111 port 60165


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.30.14.221
country_id: 6252001
description:
2026-01-15 22:39:15 dovecot_login authenticator failed for H=pool-108-30-14-221.nycmny.fios.verizon.net [108.30.14.221]:47812: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 129.45.84.119
country_id: 2589581
description:
2026-01-15 22:39:37 dovecot_login authenticator failed for H=(host-119.84.45.129.djezzycloud.dz) [129.45.84.119]:55836: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 134.122.6.62
country_id: 6252001
description:
Jan 15 22:40:00 host2 sshd[1675278]: Disconnected from invalid user netscreen 134.122.6.62 port 59336 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 193.26.115.111
country_id: 6252001
description:
Jan 15 22:43:27 host2 sshd[1678106]: Invalid user cloudtourssrilan_travel from 193.26.115.111 port 53016


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.226.88.121
country_id: 2661886
description:
2026-01-15 22:43:40 dovecot_plain authenticator failed for H=81-226-88-121-no600.tbcn.telia.com (bearculty) [81.226.88.121]:57242: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 193.26.115.111
country_id: 6252001
description:
Jan 15 22:44:03 host2 sshd[1678624]: Invalid user cloudtourssrilan_travel from 193.26.115.111 port 59988


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 150.5.169.176
country_id: 1819730
description:
Jan 15 22:44:30 host2 sshd[1678887]: Disconnected from invalid user netgear 150.5.169.176 port 39670 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 150.5.169.176
country_id: 1819730
description:
Jan 15 22:45:07 host2 sshd[1679626]: Disconnected from invalid user sqlserver 150.5.169.176 port 38412 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.100.218
country_id: 1269750
description:
2026-01-15 22:45:43 dovecot_login authenticator failed for H=(nsg-corporate-4.114.185.122.airtel.in) [122.185.100.218]:47338: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.208.177.56
country_id: 6252001
description:
2026-01-15 22:46:19 dovecot_login authenticator failed for H=([74.208.177.56]) [74.208.177.56]:36642: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.240.154.125
country_id: 6252001
description:
Jan 15 22:51:39 host2 sshd[1684577]: Invalid user agronatureholdings from 162.240.154.125 port 29490


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.114
country_id: 6252001
description:
Jan 15 22:58:21 host2 pure-ftpd[1689235]: (?@147.185.132.114) [INFO] New connection from 147.185.132.114


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 15 22:58:32 host2 sshd[1689279]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.169.149
country_id: 3175395
description:
Jan 15 22:59:27 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=185.15.169.149, lip=66.85.158.91, TLS, session=<11XHj3BI3ry5D6mV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 122.187.229.235
country_id: 1269750
description:
Jan 15 23:00:03 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<training@v-deploy.com>, method=PLAIN, rip=122.187.229.235, lip=66.85.158.91, TLS, session=<1X8BknBIbpp6u+Xr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.252.146
country_id: 3865483
description:
Jan 15 23:00:03 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 28 secs): user=<careers>, method=PLAIN, rip=179.0.252.146, lip=66.85.158.91, TLS, session=<g8mIkXBIhYOzAPyS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.72.64.32
country_id: 6252001
description:
Jan 15 23:00:22 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<training>, method=PLAIN, rip=148.72.64.32, lip=66.85.158.91, TLS, session=<P0VJk3BIEpmUSEAg>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 207.90.244.28
country_id: 6252001
description:
Jan 15 23:00:29 host2 dovecot[221878]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=207.90.244.28, lip=66.85.158.92, session=<Yym+lHBIxtPPWvQc>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.20
country_id: 6252001
description:
Jan 15 23:01:28 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.20, lip=66.85.158.91, TLS handshaking: Connection closed, session=<cmZKmHBIgTRAPpwU>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 207.90.244.28
country_id: 6252001
description:
Jan 15 23:00:30 host2 dovecot[221878]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=207.90.244.28, lip=66.85.158.92, session=<8rXRlHBIHNTPWvQc>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 216.218.206.69
country_id: 6252001
description:
Jan 15 23:00:52 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=216.218.206.69, lip=66.85.158.91, session=<Dm8hlnBIHH3Y2s5F>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.10
country_id: 6252001
description:
Jan 15 23:01:46 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.10, lip=66.85.158.91, TLS handshaking: Connection closed, session=<Cm5bmXBIlthAPpwK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.89.116.5
country_id: 6252001
description:
2026-01-15 23:12:12 dovecot_login authenticator failed for H=(70-89-116.5-BusName-WA.hfc.comcastbusiness.net) [70.89.116.5]:57682: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.202.38.185
country_id: 2658434
description:
2026-01-15 23:12:39 dovecot_login authenticator failed for H=(dyn-cable-cust.185.38.202.213.quicknet.ch) [213.202.38.185]:53088: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.193.112.85
country_id: 6252001
description:
2026-01-15 23:12:39 dovecot_plain authenticator failed for H=c-98-193-112-85.hsd1.il.comcast.net (parcunpery) [98.193.112.85]:51256: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.168
country_id: 6252001
description:
Jan 15 23:14:10 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.168, lip=66.85.158.91, session=<Fc2uxXBIyTpAPpyo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.162
country_id: 6252001
description:
Jan 15 23:14:23 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=64.62.156.162, lip=66.85.158.91, TLS: Connection closed, session=<U1JxxnBIyIZAPpyi>


