# incident

plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.187.205
country_id: 337996
description:
2025-12-22 22:32:37 dovecot_login authenticator failed for H=([196.188.187.205]) [196.188.187.205]:56330: 535 Incorrect authentication data (set_id=training)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 150.95.31.158
country_id: 1605651
description:
2025-12-22 22:33:16 dovecot_plain authenticator failed for H=v150-95-31-158.a006.g.bkk1.static.cnode.io (localhost) [150.95.31.158]:53166: 535 Incorrect authentication data (set_id=test@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 150.95.31.158
country_id: 1605651
description:
2025-12-22 22:33:25 dovecot_plain authenticator failed for H=v150-95-31-158.a006.g.bkk1.static.cnode.io (localhost) [150.95.31.158]:39484: 535 Incorrect authentication data (set_id=test@kiriaswanu.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.55.36.22
country_id: 1643084
description:
Dec 22 22:35:25 host2 sshd[4032935]: Disconnected from invalid user webuser 103.55.36.22 port 48836 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.55.36.22
country_id: 1643084
description:
Dec 22 22:37:38 host2 sshd[4034737]: Disconnected from invalid user reza 103.55.36.22 port 38168 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.210.107.22
country_id: 3017382
description:
2025-12-22 22:37:55 dovecot_plain authenticator failed for H=vps-f35c4934.vps.ovh.net (localhost) [51.210.107.22]:42146: 535 Incorrect authentication data (set_id=support@sobaherbal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.31.210
country_id: 1269750
description:
2025-12-22 22:37:23 dovecot_login authenticator failed for H=(nsg-corporate-49.218.186.122.airtel.in) [103.251.31.210]:42768: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.204.108.39
country_id: 290557
description:
2025-12-22 22:37:36 dovecot_login authenticator failed for H=([94.204.108.39]) [94.204.108.39]:42476: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.230
country_id: 6252001
description:
Dec 22 22:38:50 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.230, lip=66.85.158.92, session=<6pYme41G7btBMQHm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.89.246.144
country_id: 6252001
description:
2025-12-22 22:38:58 dovecot_plain authenticator failed for H=(localhost) [47.89.246.144]:52856: 535 Incorrect authentication data (set_id=support@dataesite.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.222
country_id: 6252001
description:
Dec 22 22:39:02 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.222, lip=66.85.158.92, TLS: Connection closed, session=<9sPZe41GCA5BMQHe>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.55.36.22
country_id: 1643084
description:
Dec 22 22:38:23 host2 sshd[4035377]: Disconnected from invalid user samuel 103.55.36.22 port 53616 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.140.17
country_id: 798549
description:
Dec 22 22:45:36 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=85.217.140.17, lip=66.85.158.92, session=<HPVWk41GzOhV2YwR>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.79.233.136
country_id: 1880251
description:
2025-12-22 22:45:46 dovecot_plain authenticator failed for H=(localhost) [47.79.233.136]:35974: 535 Incorrect authentication data (set_id=support@dataesite.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.74.148
country_id: 1269750
description:
2025-12-22 22:48:54 dovecot_plain authenticator failed for H=(localhost) [139.59.74.148]:36348: 535 Incorrect authentication data (set_id=hr@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.89.246.144
country_id: 6252001
description:
2025-12-22 22:49:30 dovecot_plain authenticator failed for H=(localhost) [47.89.246.144]:57932: 535 Incorrect authentication data (set_id=support@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.101.122.102
country_id: 2921044
description:
2025-12-22 22:49:49 dovecot_plain authenticator failed for H=(localhost) [46.101.122.102]:48672: 535 Incorrect authentication data (set_id=no-reply@mathsmotorcysle.xyz)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 159.65.193.17
country_id: 2750405
description:
Dec 22 22:51:42 host2 pure-ftpd[4047677]: (?@159.65.193.17) [INFO] New connection from 159.65.193.17


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 134.209.106.127
country_id: 1880251
description:
2025-12-22 22:51:35 dovecot_plain authenticator failed for H=(localhost) [134.209.106.127]:44394: 535 Incorrect authentication data (set_id=hr@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.163.219
country_id: 3144096
description:
2025-12-22 22:53:15 dovecot_login authenticator failed for H=(219-163-97-62.cust.smartcall.no) [62.97.163.219]:35894: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.62
country_id: 1269750
description:
2025-12-22 22:53:00 dovecot_login authenticator failed for H=([182.95.181.62]) [182.95.181.62]:47010: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.44.140.24
country_id: 690791
description:
Dec 22 22:55:32 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=194.44.140.24, lip=66.85.158.91, TLS, session=</yzntY1GZubCLIwY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.8.118.93
country_id: 1269750
description:
Dec 22 22:55:53 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<gihan>, method=PLAIN, rip=103.8.118.93, lip=66.85.158.91, TLS, session=<0qwDt41G8ulnCHZd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.128.27.123
country_id: 1880251
description:
2025-12-22 22:57:26 dovecot_plain authenticator failed for H=(localhost) [178.128.27.123]:51330: 535 Incorrect authentication data (set_id=no-reply@mathsmotorcysle.xyz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 134.209.106.127
country_id: 1880251
description:
2025-12-22 22:59:06 dovecot_plain authenticator failed for H=(localhost) [134.209.106.127]:46636: 535 Incorrect authentication data (set_id=hr@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.38.0.41
country_id: 6252001
description:
2025-12-22 22:59:16 dovecot_login authenticator failed for H=([127.0.0.1]) [45.38.0.41]:4361: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.230.142
country_id: 1269750
description:
2025-12-22 22:59:25 dovecot_login authenticator failed for H=([127.0.0.1]) [182.95.230.142]:37630: 535 Incorrect authentication data (set_id=training)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.186
country_id: 2186224
description:
2025-12-22 23:00:46 dovecot_login authenticator failed for H=([121.73.163.186]) [121.73.163.186]:41188: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.111.110
country_id: 1269750
description:
2025-12-22 23:01:16 dovecot_login authenticator failed for H=(nsg-static-97.152.75.182-airtel.com) [27.123.111.110]:57608: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.53.45.126
country_id: 1643084
description:
2025-12-22 23:01:27 dovecot_plain authenticator failed for H=(localhost) [117.53.45.126]:51956: 535 Incorrect authentication data (set_id=test@ceylondigest.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 22 23:05:52 host2 pure-ftpd[4060237]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.238.107.118
country_id: 3865483
description:
Dec 22 23:07:08 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=45.238.107.118, lip=66.85.158.91, TLS, session=<OiE/341GOuEt7mt2>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.174.17.50
country_id: 3351879
description:
2025-12-22 23:06:27 dovecot_plain authenticator failed for H=(localhost) [105.174.17.50]:8118: 535 Incorrect authentication data (set_id=admin@seyawin.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.169.100
country_id: 3175395
description:
Dec 22 23:07:26 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=185.15.169.100, lip=66.85.158.91, TLS, session=<ITtt4I1G0aW5D6lk>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 192.111.135.19
country_id: 6252001
description:
[2025-12-22 23:07:32 +0530] info [webmaild] 192.111.135.19 - info@melanifinefood.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 22 23:09:05 host2 sshd[4062442]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.71.183.239
country_id: 6252001
description:
2025-12-22 23:08:37 dovecot_plain authenticator failed for H=(localhost) [167.71.183.239]:36068: 535 Incorrect authentication data (set_id=support@sivagnanamfoundation.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 142.54.226.210
country_id: 6252001
description:
[2025-12-22 23:09:00 +0530] info [webmaild] 142.54.226.210 - info@ceylondigest.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.108.89.210
country_id: 3932488
description:
2025-12-22 23:09:22 dovecot_plain authenticator failed for H=(localhost) [190.108.89.210]:46690: 535 Incorrect authentication data (set_id=no-reply@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.108.89.210
country_id: 3932488
description:
2025-12-22 23:09:29 dovecot_plain authenticator failed for H=(localhost) [190.108.89.210]:33544: 535 Incorrect authentication data (set_id=no-reply@anandaobauae.org)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 128.185.192.138
country_id: 1269750
description:
[2025-12-22 23:11:03 +0530] info [webmaild] 128.185.192.138 - info@secondcoffeeinternational.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 150.95.31.158
country_id: 1605651
description:
2025-12-22 23:15:35 dovecot_plain authenticator failed for H=v150-95-31-158.a006.g.bkk1.static.cnode.io (localhost) [150.95.31.158]:38892: 535 Incorrect authentication data (set_id=test@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.53.45.126
country_id: 1643084
description:
2025-12-22 23:15:44 dovecot_plain authenticator failed for H=(localhost) [117.53.45.126]:34042: 535 Incorrect authentication data (set_id=test@dataesite.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.74.148
country_id: 1269750
description:
2025-12-22 23:16:46 dovecot_plain authenticator failed for H=(localhost) [139.59.74.148]:41894: 535 Incorrect authentication data (set_id=hr@dataesite.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.89
country_id: 2635167
description:
Dec 22 23:18:52 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 6 secs): user=<>, rip=35.203.210.89, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<AzxICo5G/tsjy9JZ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.176.126
country_id: 1269750
description:
2025-12-22 23:19:06 dovecot_login authenticator failed for H=([27.123.119.235]) [122.185.176.126]:38624: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 22 23:19:16 host2 sshd[4069611]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.154.217.188
country_id: 690791
description:
2025-12-22 23:19:40 dovecot_login authenticator failed for H=ip-d9bc.d-net.kiev.ua [94.154.217.188]:56406: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.64.86
country_id: 1269750
description:
2025-12-22 23:19:46 dovecot_login authenticator failed for H=(nsg-corporate-80.50.185.122.airtel.in) [122.186.64.86]:42624: 535 Incorrect authentication data (set_id=v-deploy@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.89
country_id: 2635167
description:
Dec 22 23:19:49 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 3 secs): user=<>, rip=35.203.210.89, lip=66.85.158.92, TLS: read(size=403) failed: Connection reset by peer, session=<grGyDY5Gzu0jy9JZ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.84.34.85
country_id: 1210997
description:
2025-12-22 23:20:03 dovecot_login authenticator failed for H=(ppp075.bol-online.com) [202.84.34.85]:59488: 535 Incorrect authentication data (set_id=v-deploy)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.124.139.77
country_id: 3144096
description:
2025-12-22 23:19:26 dovecot_login authenticator failed for H=([188.124.139.77]) [188.124.139.77]:44453: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.161.159
country_id: 3144096
description:
2025-12-22 23:23:15 dovecot_login authenticator failed for H=(159-161-97-62.cust.smartcall.no) [62.97.161.159]:44080: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.188.158.216
country_id: 2510769
description:
2025-12-22 23:23:45 dovecot_login authenticator failed for H=([207.188.158.216]) [207.188.158.216]:56155: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.99.8.95
country_id: 6252001
description:
2025-12-22 23:23:46 dovecot_plain authenticator failed for H=(localhost) [167.99.8.95]:46036: 535 Incorrect authentication data (set_id=help@sobaherbal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.6.81.59
country_id: 1880251
description:
2025-12-22 23:24:14 dovecot_login authenticator failed for H=bb121-6-81-59.singnet.com.sg [121.6.81.59]:37992: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2025-12-22 23:25:01 dovecot_login authenticator failed for H=([197.219.228.242]) [197.219.228.242]:53252: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.89
country_id: 2635167
description:
Dec 22 23:25:03 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.203.210.89, lip=66.85.158.92, TLS, session=<qrNuII5G+ugjy9JZ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.166.235.107
country_id: 1880251
description:
2025-12-22 23:29:05 dovecot_plain authenticator failed for H=(localhost) [188.166.235.107]:52410: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.12.240.188
country_id: 6252001
description:
Dec 22 23:29:29 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.12.240.188, lip=66.85.158.92, session=<kpNEMI5GYpcUDPC8>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.83.30.199
country_id: 6252001
description:
2025-12-22 23:31:48 dovecot_login authenticator failed for H=ool-43531ec7.dyn.optonline.net [67.83.30.199]:34764: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.132.4.108
country_id: 3932488
description:
2025-12-22 23:34:26 dovecot_plain authenticator failed for H=(localhost) [161.132.4.108]:47264: 535 Incorrect authentication data (set_id=info@sobaherbal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.6
country_id: 1269750
description:
2025-12-22 23:35:52 dovecot_login authenticator failed for H=([182.95.181.6]) [182.95.181.6]:49860: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.232.203.22
country_id: 3017382
description:
2025-12-22 23:36:06 dovecot_login authenticator failed for H=([149.232.203.22]) [149.232.203.22]:60826: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.73.190.65
country_id: 2542007
description:
2025-12-22 23:37:21 dovecot_login authenticator failed for H=([105.73.190.65]) [105.73.190.65]:38102: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.146.144
country_id: 1819730
description:
2025-12-22 23:37:40 dovecot_login authenticator failed for H=(m121-202-146-144.smartone.com) [121.202.146.144]:47233: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.219.221.172
country_id: 2661886
description:
2025-12-22 23:39:49 dovecot_login authenticator failed for H=83-219-221-172.cust.bredband2.com ([127.0.0.1]) [83.219.221.172]:57020: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.132.40.41
country_id: 6252001
description:
2025-12-22 23:40:20 dovecot_login authenticator failed for H=([127.0.0.1]) [216.132.40.41]:33082: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.89.246.144
country_id: 6252001
description:
2025-12-22 23:41:13 dovecot_plain authenticator failed for H=(localhost) [47.89.246.144]:32828: 535 Incorrect authentication data (set_id=support@dataesite.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.101.122.102
country_id: 2921044
description:
2025-12-22 23:42:42 dovecot_plain authenticator failed for H=(localhost) [46.101.122.102]:49378: 535 Incorrect authentication data (set_id=no-reply@mathsmotorcysle.xyz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.30.170
country_id: 3144096
description:
2025-12-22 23:44:18 dovecot_login authenticator failed for H=([178.232.30.170]) [178.232.30.170]:47470: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.214.49.11
country_id: 3144096
description:
2025-12-22 23:44:35 dovecot_login authenticator failed for H=(cm-84.214.49.11.get.no) [84.214.49.11]:37706: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 150.95.31.158
country_id: 1605651
description:
2025-12-22 23:45:27 dovecot_plain authenticator failed for H=v150-95-31-158.a006.g.bkk1.static.cnode.io (localhost) [150.95.31.158]:40822: 535 Incorrect authentication data (set_id=test@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.89.246.144
country_id: 6252001
description:
2025-12-22 23:51:40 dovecot_plain authenticator failed for H=(localhost) [47.89.246.144]:37198: 535 Incorrect authentication data (set_id=support@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.89.177.227
country_id: 6252001
description:
2025-12-22 23:53:52 dovecot_plain authenticator failed for H=(localhost) [47.89.177.227]:4473: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.163.15.107
country_id: 6252001
description:
Dec 22 23:55:24 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=20.163.15.107, lip=66.85.158.91, session=<HZzujI5G1oAUow9r>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.116.22
country_id: 1861060
description:
Dec 22 23:55:51 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=139.162.116.22, lip=66.85.158.91, TLS: Connection closed, session=<XayLjo5GetiLonQW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.238.247.238
country_id: 3469034
description:
2025-12-22 23:59:54 dovecot_login authenticator failed for H=([189.44.251.249]) [186.238.247.238]:40173: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.64.86
country_id: 1269750
description:
2025-12-22 23:59:28 dovecot_login authenticator failed for H=(nsg-corporate-80.50.185.122.airtel.in) [122.186.64.86]:53712: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.79.5.11
country_id: 6252001
description:
Dec 23 00:03:52 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=45.79.5.11, lip=66.85.158.92, session=<64Q8q45GKIItTwUL>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.2
country_id: 6252001
description:
Dec 23 00:05:53 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.2, lip=66.85.158.92, TLS handshaking: Connection closed, session=<7Zluso5G2khAPsUC>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.2
country_id: 6252001
description:
Dec 23 00:06:12 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.2, lip=66.85.158.92, TLS handshaking: Connection closed, session=<HJ6Zs45GPKRAPsUC>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 23 00:08:21 host2 pure-ftpd[4112785]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.210.214.212
country_id: 3144096
description:
2025-12-23 00:10:42 dovecot_login authenticator failed for H=([127.0.0.1]) [84.210.214.212]:46796: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.96.237.78
country_id: 1269750
description:
2025-12-23 00:10:50 dovecot_login authenticator failed for H=([127.0.0.1]) [14.96.237.78]:55873: 535 Incorrect authentication data (set_id=training)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.128
country_id: 6252001
description:
Dec 23 00:11:22 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed (no auth attempts in 16 secs): user=<>, rip=66.132.153.128, lip=66.85.158.92, TLS handshaking: Connection closed, session=<S7gKxo5GEOdChJmA>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.120
country_id: 6252001
description:
Dec 23 00:13:18 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.120, lip=66.85.158.92, TLS: Connection closed, session=<9pXzzI5GpodChJl4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.22.218
country_id: 290557
description:
2025-12-23 00:16:56 dovecot_login authenticator failed for H=([5.32.22.218]) [5.32.22.218]:41067: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.84.34.85
country_id: 1210997
description:
2025-12-23 00:17:08 dovecot_login authenticator failed for H=(ppp075.bol-online.com) [202.84.34.85]:39018: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.108
country_id: 6252001
description:
Dec 23 00:18:52 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.108, lip=66.85.158.91, TLS handshaking: Connection closed, session=<wJfm4I5GoC5BMQFs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.122
country_id: 1269750
description:
2025-12-23 00:19:03 dovecot_login authenticator failed for H=([125.16.31.25]) [152.52.236.122]:57486: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.8.118.18
country_id: 1269750
description:
Dec 23 00:19:08 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=103.8.118.18, lip=66.85.158.91, TLS, session=<qYnG4I5GmLFnCHYS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.83.30.199
country_id: 6252001
description:
2025-12-23 00:19:13 dovecot_login authenticator failed for H=ool-43531ec7.dyn.optonline.net [67.83.30.199]:48823: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.108
country_id: 6252001
description:
Dec 23 00:19:13 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.108, lip=66.85.158.91, TLS handshaking: Connection closed, session=<to0k4o5GmrVBMQFs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.106.155.68
country_id: 798544
description:
Dec 23 00:19:26 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=193.106.155.68, lip=66.85.158.91, TLS, session=<hxPs4Y5GNbrBaptE>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.216.119.134
country_id: 1819730
description:
Dec 23 00:20:13 host2 sshd[4119528]: Disconnected from invalid user andrew 185.216.119.134 port 42802 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 192.111.131.4
country_id: 6252001
description:
[2025-12-23 00:20:32 +0530] info [webmaild] 192.111.131.4 - info@euroentertainmentlk.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.216.119.134
country_id: 1819730
description:
Dec 23 00:21:24 host2 sshd[4120282]: Disconnected from invalid user shiny 185.216.119.134 port 60112 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.216.119.134
country_id: 1819730
description:
Dec 23 00:22:41 host2 sshd[4120948]: Disconnected from invalid user kasia 185.216.119.134 port 55780 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 35.233.96.173
country_id: 2802361
description:
Dec 23 00:23:41 host2 pure-ftpd[4121473]: (?@35.233.96.173) [INFO] New connection from 35.233.96.173


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.195.8.95
country_id: 3469034
description:
Dec 23 00:23:52 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=186.195.8.95, lip=66.85.158.91, TLS, session=<Z8qs8Y5GTtC6wwhf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.74.148
country_id: 1269750
description:
2025-12-23 00:24:00 dovecot_plain authenticator failed for H=(localhost) [139.59.74.148]:33134: 535 Incorrect authentication data (set_id=hr@venee.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.18.222
country_id: 2300660
description:
Dec 23 00:24:36 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 33 secs): user=<gihan>, method=PLAIN, rip=41.139.18.222, lip=66.85.158.91, TLS, session=<6BZy845GfqgpixLe>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.220.97.188
country_id: 6252001
description:
2025-12-23 00:25:06 dovecot_login authenticator failed for H=c-98-220-97-188.hsd1.il.comcast.net [98.220.97.188]:40660: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.133.214.127
country_id: 1269750
description:
2025-12-23 00:26:19 dovecot_plain authenticator failed for H=(localhost) [103.133.214.127]:48984: 535 Incorrect authentication data (set_id=no-reply@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.11.153.57
country_id: 1643084
description:
2025-12-23 00:29:23 dovecot_plain authenticator failed for H=(localhost) [113.11.153.57]:43228: 535 Incorrect authentication data (set_id=support@sobaherbal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.0.62.84
country_id: 1269750
description:
2025-12-23 00:30:23 dovecot_plain authenticator failed for H=(LF21D45A3WC8) [101.0.62.84]:39729: 535 Incorrect authentication data (set_id=dinali.hettiarachchi@ksoft.lk)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 44.220.188.230
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 44.220.188.230: 250 connections per 30 seconds to 8443 port.


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.32
country_id: 6252001
description:
Dec 23 00:31:45 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.197.32, lip=66.85.158.92, session=<P131Do9GHKxAPsUg>


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 44.220.188.230
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 44.220.188.230: 436 connections per 30 seconds to 8443 port.


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.172
country_id: 6252001
description:
Dec 23 00:31:30 host2 pure-ftpd[4126656]: (?@205.210.31.172) [INFO] New connection from 205.210.31.172


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.32
country_id: 6252001
description:
Dec 23 00:32:11 host2 dovecot[3805015]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=64.62.197.32, lip=66.85.158.92, session=<Ei6HEI9Glp5APsUg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 132.148.72.41
country_id: 6252001
description:
2025-12-23 00:33:15 dovecot_plain authenticator failed for H=41.72.148.132.host.secureserver.net (localhost) [132.148.72.41]:57454: 535 Incorrect authentication data (set_id=support@dataesite.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.227.136.122
country_id: 1269750
description:
2025-12-23 00:34:14 dovecot_plain authenticator failed for H=(localhost) [64.227.136.122]:60492: 535 Incorrect authentication data (set_id=hr@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.232.179.250
country_id: 1269750
description:
2025-12-23 00:37:46 dovecot_plain authenticator failed for H=(localhost) [165.232.179.250]:48182: 535 Incorrect authentication data (set_id=admin@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.116.199.47
country_id: 1269750
description:
2025-12-23 00:39:59 dovecot_plain authenticator failed for H=(localhost) [66.116.199.47]:47654: 535 Incorrect authentication data (set_id=test@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.6.195.206
country_id: 6252001
description:
2025-12-23 00:40:17 dovecot_plain authenticator failed for H=(localhost) [50.6.195.206]:37076: 535 Incorrect authentication data (set_id=hr@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.138.59.242
country_id: 6252001
description:
2025-12-23 00:40:22 dovecot_plain authenticator failed for H=(localhost) [174.138.59.242]:37988: 535 Incorrect authentication data (set_id=admin@sivagnanamfoundation.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.201.26
country_id: 1269750
description:
2025-12-23 00:42:02 dovecot_login authenticator failed for H=([127.0.0.1]) [128.185.201.26]:42492: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.69.208.225
country_id: 6251999
description:
2025-12-23 00:41:37 dovecot_plain authenticator failed for H=gain.tiqqed.com (localhost) [158.69.208.225]:48598: 535 Incorrect authentication data (set_id=hr@melanifinefood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.166.235.107
country_id: 1880251
description:
2025-12-23 00:41:52 dovecot_plain authenticator failed for H=(localhost) [188.166.235.107]:45164: 535 Incorrect authentication data (set_id=support@melanifinefood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.78.177.159
country_id: 1643084
description:
2025-12-23 00:41:53 dovecot_login authenticator failed for H=([127.0.0.1]) [112.78.177.159]:54592: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.3.163.126
country_id: 6252001
description:
2025-12-23 00:43:38 dovecot_plain authenticator failed for H=(localhost) [192.3.163.126]:60204: 535 Incorrect authentication data (set_id=admin@mathsmotorcysle.xyz)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.44
country_id: 6252001
description:
Dec 23 00:44:02 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=205.210.31.44, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<KkPfOo9GdcrN0h8s>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.186.147.126
country_id: 1880251
description:
2025-12-23 00:47:15 dovecot_plain authenticator failed for H=126.147.186.35.bc.googleusercontent.com (localhost) [35.186.147.126]:34888: 535 Incorrect authentication data (set_id=hr@seyawin.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.253.82.89
country_id: 6252001
description:
2025-12-23 00:49:54 dovecot_plain authenticator failed for H=(localhost) [47.253.82.89]:34648: 535 Incorrect authentication data (set_id=no-reply@mathsmotorcysle.xyz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.89.246.144
country_id: 6252001
description:
2025-12-23 00:50:29 dovecot_plain authenticator failed for H=(localhost) [47.89.246.144]:56714: 535 Incorrect authentication data (set_id=support@kiriaswanu.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.109
country_id: 6252001
description:
Dec 23 00:52:01 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=198.235.24.109, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<Aw5qV49GIcDG6xht>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.30.97.33
country_id: 272103
description:
Dec 23 00:51:35 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=193.30.97.33, lip=66.85.158.91, session=<OzTIVY9GOMLBHmEh>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 23 00:53:45 host2 sshd[4145756]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2025-12-23 00:53:54 dovecot_login authenticator failed for H=c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:35560: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 168.232.62.166
country_id: 3469034
description:
Dec 23 00:54:03 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<gihan>, method=PLAIN, rip=168.232.62.166, lip=66.85.158.91, TLS, session=<vz6tXY9GnbKo6D6m>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.193.187.154
country_id: 1269750
description:
2025-12-23 00:53:42 dovecot_login authenticator failed for H=([113.193.187.154]) [113.193.187.154]:43468: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.169.28
country_id: 3175395
description:
Dec 23 00:53:43 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=185.15.169.28, lip=66.85.158.91, TLS, session=<IceNXI9G+c25D6kc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.99.8.95
country_id: 6252001
description:
2025-12-23 00:54:53 dovecot_plain authenticator failed for H=(localhost) [167.99.8.95]:54702: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.155.16.105
country_id: 1819730
description:
2025-12-23 00:55:44 dovecot_plain authenticator failed for H=(localhost) [43.155.16.105]:59774: 535 Incorrect authentication data (set_id=support@essenceceylontea.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.136
country_id: 6252001
description:
Dec 23 00:57:12 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.136, lip=66.85.158.91, session=<E0r6aY9GzeNBMQGI>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.132
country_id: 6252001
description:
Dec 23 00:57:26 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.132, lip=66.85.158.91, TLS: Connection closed, session=<1HHQao9GCkBBMQGE>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.0.166.123
country_id: 1605651
description:
2025-12-23 01:01:30 dovecot_login authenticator failed for H=([106.0.166.123]) [106.0.166.123]:41160: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.138.237.18
country_id: 1269750
description:
2025-12-23 01:01:35 dovecot_plain authenticator failed for H=(localhost) [103.138.237.18]:1508: 535 Incorrect authentication data (set_id=test@nsteeleng.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.69.209.171
country_id: 6251999
description:
2025-12-23 01:02:17 dovecot_plain authenticator failed for H=mark.tiqqedmail.com (localhost) [158.69.209.171]:41048: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 23 01:03:50 host2 sshd[4154754]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.72.184.60
country_id: 6252001
description:
2025-12-23 01:03:41 dovecot_login authenticator failed for H=24-72-184-24-72-184-60.cpe.sparklight.net [24.72.184.60]:53534: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.58.114
country_id: 1269750
description:
2025-12-23 01:04:02 dovecot_login authenticator failed for H=([182.95.58.114]) [182.95.58.114]:35682: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 23 01:04:28 host2 sshd[4154813]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.133.214.127
country_id: 1269750
description:
2025-12-23 01:06:18 dovecot_plain authenticator failed for H=(localhost) [103.133.214.127]:60512: 535 Incorrect authentication data (set_id=no-reply@melanifinefood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.132.4.108
country_id: 3932488
description:
2025-12-23 01:09:54 dovecot_plain authenticator failed for H=(localhost) [161.132.4.108]:43656: 535 Incorrect authentication data (set_id=admin@essenceceylontea.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 23 01:10:56 host2 pure-ftpd[4161414]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.253.82.89
country_id: 6252001
description:
2025-12-23 01:12:02 dovecot_plain authenticator failed for H=(localhost) [47.253.82.89]:34042: 535 Incorrect authentication data (set_id=no-reply@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.91.135.181
country_id: 6252001
description:
2025-12-23 01:13:19 dovecot_login authenticator failed for H=(70-91-135-181-ma-ne.hfc.comcastbusiness.net) [70.91.135.181]:51384: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.74.148
country_id: 1269750
description:
2025-12-23 01:16:43 dovecot_plain authenticator failed for H=(localhost) [139.59.74.148]:57396: 535 Incorrect authentication data (set_id=hr@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.216.62
country_id: 3996063
description:
2025-12-23 01:16:45 dovecot_login authenticator failed for H=(201.173.216.62-clientes-izzi.mx) [201.173.216.62]:41942: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2025-12-23 01:16:59 dovecot_login authenticator failed for H=([196.216.81.126]) [196.216.81.126]:38606: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.133.214.127
country_id: 1269750
description:
2025-12-23 01:19:24 dovecot_plain authenticator failed for H=(localhost) [103.133.214.127]:47368: 535 Incorrect authentication data (set_id=no-reply@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.11.153.57
country_id: 1643084
description:
2025-12-23 01:21:52 dovecot_plain authenticator failed for H=(localhost) [113.11.153.57]:54614: 535 Incorrect authentication data (set_id=support@sobaherbal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 132.148.72.41
country_id: 6252001
description:
2025-12-23 01:25:07 dovecot_plain authenticator failed for H=41.72.148.132.host.secureserver.net (localhost) [132.148.72.41]:46856: 535 Incorrect authentication data (set_id=support@dataesite.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.91
country_id: 6252001
description:
Dec 23 01:26:15 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=147.185.132.91, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<acHj0Y9GCtWTuYRb>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 121.206.124.248
country_id: 1814991
description:
[2025-12-23 01:26:28 +0530] info [cpaneld] 121.206.124.248 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.227.136.122
country_id: 1269750
description:
2025-12-23 01:26:39 dovecot_plain authenticator failed for H=(localhost) [64.227.136.122]:35214: 535 Incorrect authentication data (set_id=hr@essenceceylontea.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 192.111.137.33
country_id: 6252001
description:
[2025-12-23 01:29:11 +0530] info [webmaild] 192.111.137.33 - info@weeratrading.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.33.130
country_id: 1149361
description:
2025-12-23 01:29:29 dovecot_login authenticator failed for H=([149.54.33.130]) [149.54.33.130]:52351: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.136.72
country_id: 3996063
description:
2025-12-23 01:29:40 dovecot_login authenticator failed for H=(187.161.136.72-clientes-izzi.mx) [187.161.136.72]:60596: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.232.179.250
country_id: 1269750
description:
2025-12-23 01:29:57 dovecot_plain authenticator failed for H=(localhost) [165.232.179.250]:59480: 535 Incorrect authentication data (set_id=admin@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.116.199.47
country_id: 1269750
description:
2025-12-23 01:32:08 dovecot_plain authenticator failed for H=(localhost) [66.116.199.47]:52580: 535 Incorrect authentication data (set_id=test@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.138.59.242
country_id: 6252001
description:
2025-12-23 01:32:31 dovecot_plain authenticator failed for H=(localhost) [174.138.59.242]:24594: 535 Incorrect authentication data (set_id=admin@sivagnanamfoundation.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.6.195.206
country_id: 6252001
description:
2025-12-23 01:32:33 dovecot_plain authenticator failed for H=(localhost) [50.6.195.206]:60908: 535 Incorrect authentication data (set_id=hr@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.69.208.225
country_id: 6251999
description:
2025-12-23 01:33:16 dovecot_plain authenticator failed for H=gain.tiqqed.com (localhost) [158.69.208.225]:33674: 535 Incorrect authentication data (set_id=hr@melanifinefood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.69.208.225
country_id: 6251999
description:
2025-12-23 01:33:22 dovecot_plain authenticator failed for H=gain.tiqqed.com (localhost) [158.69.208.225]:46292: 535 Incorrect authentication data (set_id=hr@melanifinefood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.166.235.107
country_id: 1880251
description:
2025-12-23 01:33:46 dovecot_plain authenticator failed for H=(localhost) [188.166.235.107]:51204: 535 Incorrect authentication data (set_id=support@melanifinefood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.3.163.126
country_id: 6252001
description:
2025-12-23 01:35:49 dovecot_plain authenticator failed for H=(localhost) [192.3.163.126]:43798: 535 Incorrect authentication data (set_id=admin@mathsmotorcysle.xyz)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.164.135.22
country_id: 798544
description:
Dec 23 01:38:07 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=193.164.135.22, lip=66.85.158.91, TLS, session=<4ThQ+49GFZLBpIcW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 179.0.252.126
country_id: 3865483
description:
Dec 23 01:39:01 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=179.0.252.126, lip=66.85.158.91, TLS, session=<IAd//49Gh4GzAPx+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.59.132.17
country_id: 798544
description:
Dec 23 01:39:12 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=193.59.132.17, lip=66.85.158.91, TLS, session=<2xov/49GeO3BO4QR>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.87.117.58
country_id: 3469034
description:
Dec 23 01:38:28 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<contact>, method=PLAIN, rip=177.87.117.58, lip=66.85.158.91, TLS, session=<Bbhs/I9GCNuxV3U6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.85.106.73
country_id: 3469034
description:
Dec 23 01:38:54 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=187.85.106.73, lip=66.85.158.91, TLS, session=<7v8J/o9G3eO7VWpJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.60.62
country_id: 2300660
description:
Dec 23 01:38:57 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 43 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=41.139.60.62, lip=66.85.158.91, TLS handshaking: Connection closed, session=<6YC8/I9GdIQpizw+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.186.147.126
country_id: 1880251
description:
2025-12-23 01:39:19 dovecot_plain authenticator failed for H=126.147.186.35.bc.googleusercontent.com (localhost) [35.186.147.126]:42286: 535 Incorrect authentication data (set_id=hr@seyawin.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.255.215.57
country_id: 732800
description:
Dec 23 01:39:19 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<contact>, method=PLAIN, rip=185.255.215.57, lip=66.85.158.91, TLS, session=<5k+V/49G2Yu5/9c5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.253.82.89
country_id: 6252001
description:
2025-12-23 01:42:03 dovecot_plain authenticator failed for H=(localhost) [47.253.82.89]:50106: 535 Incorrect authentication data (set_id=no-reply@mathsmotorcysle.xyz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.89.246.144
country_id: 6252001
description:
2025-12-23 01:42:32 dovecot_plain authenticator failed for H=(localhost) [47.89.246.144]:37914: 535 Incorrect authentication data (set_id=support@kiriaswanu.com)


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 47.89.246.144
country_id: 6252001
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Remote IP Address]=[47.89.246.144] [Authentication Database]=[mail] [Username]=[support@kiriaswanu.com] (10/10 failures) (blocked until [Tue Dec 23 20:12:30 2025 UTC/Wed Dec 24 01:42:30 2025 LOCAL])


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.74.148
country_id: 1269750
description:
2025-12-23 01:44:38 dovecot_plain authenticator failed for H=(localhost) [139.59.74.148]:45388: 535 Incorrect authentication data (set_id=hr@venee.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.227.254.152
country_id: 3703430
description:
Dec 23 01:45:51 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=45.227.254.152, lip=66.85.158.91, session=<A3H8F5BGU/8t4/6Y>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.7.163.154
country_id: 1643084
description:
2025-12-23 01:47:24 dovecot_plain authenticator failed for H=(localhost) [114.7.163.154]:34588: 535 Incorrect authentication data (set_id=constact@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.11.153.57
country_id: 1643084
description:
2025-12-23 01:50:00 dovecot_plain authenticator failed for H=(localhost) [113.11.153.57]:60314: 535 Incorrect authentication data (set_id=support@sobaherbal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.207.124.74
country_id: 2921044
description:
2025-12-23 01:51:25 dovecot_plain authenticator failed for H=74.124.207.35.bc.googleusercontent.com ([26.26.26.1]) [35.207.124.74]:40202: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 132.148.72.41
country_id: 6252001
description:
2025-12-23 01:53:03 dovecot_plain authenticator failed for H=41.72.148.132.host.secureserver.net (localhost) [132.148.72.41]:53136: 535 Incorrect authentication data (set_id=support@dataesite.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.227.136.122
country_id: 1269750
description:
2025-12-23 01:54:29 dovecot_plain authenticator failed for H=(localhost) [64.227.136.122]:53162: 535 Incorrect authentication data (set_id=hr@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.232.179.250
country_id: 1269750
description:
2025-12-23 01:58:27 dovecot_plain authenticator failed for H=(localhost) [165.232.179.250]:34596: 535 Incorrect authentication data (set_id=admin@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.154.173
country_id: 1733045
description:
2025-12-23 01:58:32 dovecot_login authenticator failed for H=([49.124.154.173]) [49.124.154.173]:36966: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.210.192.240
country_id: 3144096
description:
2025-12-23 01:58:53 dovecot_login authenticator failed for H=(cm-84.210.192.240.get.no) [84.210.192.240]:58725: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.116.199.47
country_id: 1269750
description:
2025-12-23 01:59:50 dovecot_plain authenticator failed for H=(localhost) [66.116.199.47]:51076: 535 Incorrect authentication data (set_id=test@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.138.59.242
country_id: 6252001
description:
2025-12-23 02:00:23 dovecot_plain authenticator failed for H=(localhost) [174.138.59.242]:42394: 535 Incorrect authentication data (set_id=admin@sivagnanamfoundation.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.69.208.225
country_id: 6251999
description:
2025-12-23 02:01:06 dovecot_plain authenticator failed for H=gain.tiqqed.com (localhost) [158.69.208.225]:54382: 535 Incorrect authentication data (set_id=hr@melanifinefood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.6.195.206
country_id: 6252001
description:
2025-12-23 02:00:23 dovecot_plain authenticator failed for H=(localhost) [50.6.195.206]:36660: 535 Incorrect authentication data (set_id=hr@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.166.235.107
country_id: 1880251
description:
2025-12-23 02:01:24 dovecot_plain authenticator failed for H=(localhost) [188.166.235.107]:35996: 535 Incorrect authentication data (set_id=support@melanifinefood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.3.163.126
country_id: 6252001
description:
2025-12-23 02:03:35 dovecot_plain authenticator failed for H=(localhost) [192.3.163.126]:40464: 535 Incorrect authentication data (set_id=admin@mathsmotorcysle.xyz)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 184.170.248.1
country_id: 6252001
description:
[2025-12-23 02:06:37 +0530] info [webmaild] 184.170.248.1 - info@kiriaswanu.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.186.147.126
country_id: 1880251
description:
2025-12-23 02:07:10 dovecot_plain authenticator failed for H=126.147.186.35.bc.googleusercontent.com (localhost) [35.186.147.126]:40118: 535 Incorrect authentication data (set_id=hr@seyawin.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.77.179.121
country_id: 3469034
description:
Dec 23 02:08:00 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<gihan>, method=PLAIN, rip=200.77.179.121, lip=66.85.158.91, TLS, session=<sWcQZpBGZ8bITbN5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.186.147.126
country_id: 1880251
description:
2025-12-23 02:07:17 dovecot_plain authenticator failed for H=126.147.186.35.bc.googleusercontent.com (localhost) [35.186.147.126]:19198: 535 Incorrect authentication data (set_id=hr@seyawin.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.77.198
country_id: 3469034
description:
Dec 23 02:07:40 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=187.120.77.198, lip=66.85.158.91, TLS, session=<Xv3BZJBG6aK7eE3G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.181.165.13
country_id: 3865483
description:
Dec 23 02:09:12 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=45.181.165.13, lip=66.85.158.91, TLS, session=<tf8vapBGApYttaUN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.112.101.75
country_id: 3175395
description:
Dec 23 02:09:30 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=217.112.101.75, lip=66.85.158.91, TLS, session=<Jn2La5BGL6bZcGVL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.89.246.144
country_id: 6252001
description:
2025-12-23 02:10:22 dovecot_plain authenticator failed for H=(localhost) [47.89.246.144]:39572: 535 Incorrect authentication data (set_id=support@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 150.129.20.234
country_id: 1831722
description:
2025-12-23 02:12:12 dovecot_login authenticator failed for H=([150.129.20.234]) [150.129.20.234]:60444: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.202.58
country_id: 1269750
description:
2025-12-23 02:12:17 dovecot_login authenticator failed for H=(nsg-corporate-58.202.186.122.airtel.in) [122.186.202.58]:54342: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 23 02:13:12 host2 pure-ftpd[18533]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-23 02:12:33 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:33560: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.13.207.39
country_id: 3077311
description:
2025-12-23 02:12:36 dovecot_login authenticator failed for H=46-13-207-39.customers.tmcz.cz [46.13.207.39]:34255: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.206
country_id: 1269750
description:
2025-12-23 02:14:25 dovecot_login authenticator failed for H=([128.185.140.225]) [182.95.176.206]:36448: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.99.8.95
country_id: 6252001
description:
2025-12-23 02:14:43 dovecot_plain authenticator failed for H=(localhost) [167.99.8.95]:54846: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-23 02:20:41 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:60325: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.138.237.18
country_id: 1269750
description:
2025-12-23 02:21:19 dovecot_plain authenticator failed for H=(localhost) [103.138.237.18]:9427: 535 Incorrect authentication data (set_id=test@nsteeleng.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.69.209.171
country_id: 6251999
description:
2025-12-23 02:21:30 dovecot_plain authenticator failed for H=mark.tiqqedmail.com (localhost) [158.69.209.171]:60600: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.116.204.232
country_id: 1269750
description:
2025-12-23 02:22:35 dovecot_plain authenticator failed for H=(localhost) [66.116.204.232]:46962: 535 Incorrect authentication data (set_id=hr@sivagnanamfoundation.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 121.206.124.248
country_id: 1814991
description:
[2025-12-23 02:26:23 +0530] info [cpaneld] 121.206.124.248 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.132.4.108
country_id: 3932488
description:
2025-12-23 02:29:20 dovecot_plain authenticator failed for H=(localhost) [161.132.4.108]:54702: 535 Incorrect authentication data (set_id=admin@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.147.131.177
country_id: 1814991
description:
2025-12-23 02:32:20 dovecot_plain authenticator failed for H=(localhost) [8.147.131.177]:33964: 535 Incorrect authentication data (set_id=test@sivagnanamfoundation.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.247.248.154
country_id: 3469034
description:
2025-12-23 02:34:18 dovecot_login authenticator failed for H=([170.247.248.154]) [170.247.248.154]:51039: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.231.6
country_id: 1269750
description:
2025-12-23 02:34:41 dovecot_login authenticator failed for H=([125.20.231.225]) [128.185.231.6]:58376: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 23 02:37:46 host2 sshd[40188]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.29.174
country_id: 1643084
description:
2025-12-23 02:37:52 dovecot_plain authenticator failed for H=(localhost) [103.148.29.174]:47332: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.129.230.30
country_id: 1814991
description:
2025-12-23 02:41:07 dovecot_plain authenticator failed for H=(localhost) [8.129.230.30]:34668: 535 Incorrect authentication data (set_id=admin@nsteeleng.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.111.229
country_id: 3144096
description:
2025-12-23 02:42:50 dovecot_login authenticator failed for H=(cm-178.232.111.229.get.no) [178.232.111.229]:47277: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.152.40.8
country_id: 6252001
description:
Dec 23 02:42:58 host2 sshd[44220]: Disconnected from invalid user ec2-user 104.152.40.8 port 51808 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.50.155
country_id: 1269750
description:
2025-12-23 02:42:24 dovecot_login authenticator failed for H=(abts-north-static-155.50.160.122.airtelbroadband.in) [122.160.50.155]:41814: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 163.182.174.251
country_id: 6252001
description:
2025-12-23 02:42:27 dovecot_plain authenticator failed for H=163-182-174-251.static.as40244.net (localhost) [163.182.174.251]:50268: 535 Incorrect authentication data (set_id=hr@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.161.159
country_id: 3144096
description:
2025-12-23 02:43:23 dovecot_login authenticator failed for H=(159-161-97-62.cust.smartcall.no) [62.97.161.159]:37352: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.152.40.8
country_id: 6252001
description:
Dec 23 02:43:35 host2 sshd[44612]: Disconnected from invalid user steam 104.152.40.8 port 35892 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.69.209.171
country_id: 6251999
description:
2025-12-23 02:44:38 dovecot_plain authenticator failed for H=mark.tiqqedmail.com (localhost) [158.69.209.171]:53894: 535 Incorrect authentication data (set_id=info@mathsmotorcysle.xyz)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 104.152.40.8
country_id: 6252001
description:
Dec 23 02:44:46 host2 sshd[45251]: Disconnected from invalid user xy 104.152.40.8 port 60490 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.152.40.8
country_id: 6252001
description:
Dec 23 02:45:59 host2 sshd[46315]: Disconnected from invalid user testuser 104.152.40.8 port 56860 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.176.79.117
country_id: 1643084
description:
Dec 23 02:46:12 host2 sshd[46490]: Disconnected from invalid user k3 103.176.79.117 port 45436 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.200.205.179
country_id: 3686110
description:
Dec 23 02:45:37 host2 sshd[46090]: Disconnected from invalid user a 152.200.205.179 port 51058 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.84.153.185
country_id: 6252001
description:
Dec 23 02:46:26 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.84.153.185, lip=66.85.158.91, session=<XU+l8JBGEOwUVJm5>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.212.241.39
country_id: 1880251
description:
Dec 23 02:46:29 host2 sshd[46660]: Disconnected from invalid user surin 20.212.241.39 port 56870 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.185.18.67
country_id: 3469034
description:
2025-12-23 02:46:37 dovecot_login authenticator failed for H=(cyrela.static.gvt.net.br) [179.185.18.67]:42589: 535 Incorrect authentication data (set_id=prasanka@agronatureholdings.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.200.205.179
country_id: 3686110
description:
Dec 23 02:46:58 host2 sshd[47425]: Disconnected from invalid user liang 152.200.205.179 port 54884 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 23 02:47:51 host2 sshd[48263]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.200.205.179
country_id: 3686110
description:
Dec 23 02:47:35 host2 sshd[48021]: Disconnected from invalid user kt 152.200.205.179 port 58344 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.255.147.244
country_id: 1269750
description:
Dec 23 02:48:16 host2 sshd[48701]: Disconnected from invalid user deployer 103.255.147.244 port 52354 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.199.126
country_id: 1269750
description:
2025-12-23 02:47:27 dovecot_login authenticator failed for H=([182.79.31.107]) [152.52.199.126]:47832: 535 Incorrect authentication data (set_id=prasanka)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.200.205.179
country_id: 3686110
description:
Dec 23 02:48:51 host2 sshd[49155]: Disconnected from invalid user git 152.200.205.179 port 37446 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.255.147.244
country_id: 1269750
description:
Dec 23 02:48:51 host2 sshd[49138]: Disconnected from invalid user deployer 103.255.147.244 port 53800 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.74.122
country_id: 1149361
description:
2025-12-23 02:50:06 dovecot_login authenticator failed for H=([180.94.74.122]) [180.94.74.122]:46403: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.202.230.214
country_id: 798544
description:
2025-12-23 02:49:26 dovecot_login authenticator failed for H=host-91-202-230-214.static.oc3.zagan.visnet.pl [91.202.230.214]:52639: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.212.241.39
country_id: 1880251
description:
Dec 23 02:49:49 host2 sshd[49899]: Disconnected from invalid user nrk 20.212.241.39 port 40232 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.212.241.39
country_id: 1880251
description:
Dec 23 02:50:39 host2 sshd[50799]: Disconnected from invalid user deployer 20.212.241.39 port 57068 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 20.212.241.39
country_id: 1880251
description:
Dec 23 02:51:29 host2 sshd[51470]: Disconnected from invalid user deployer 20.212.241.39 port 54816 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 94.182.134.73
country_id: 130758
description:
Dec 23 02:55:12 host2 sshd[55756]: Disconnected from invalid user frappe 94.182.134.73 port 54654 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 94.182.134.73
country_id: 130758
description:
Dec 23 02:55:46 host2 sshd[56343]: Disconnected from invalid user developer 94.182.134.73 port 54688 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 94.182.134.73
country_id: 130758
description:
Dec 23 02:56:16 host2 sshd[56776]: Disconnected from invalid user sae 94.182.134.73 port 54722 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.74.148
country_id: 1269750
description:
2025-12-23 02:56:36 dovecot_plain authenticator failed for H=(localhost) [139.59.74.148]:56732: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 138.68.104.233
country_id: 2921044
description:
Dec 23 02:57:43 host2 sshd[58032]: Disconnected from invalid user user02 138.68.104.233 port 47120 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 210.79.142.221
country_id: 1643084
description:
Dec 23 02:57:56 host2 sshd[58210]: Disconnected from invalid user hari 210.79.142.221 port 34584 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 94.182.134.73
country_id: 130758
description:
Dec 23 03:00:02 host2 sshd[60161]: Received disconnect from 94.182.134.73 port 54984:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 94.182.134.73
country_id: 130758
description:
Dec 23 03:01:07 host2 sshd[61249]: Disconnected from invalid user admin 94.182.134.73 port 55054 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.11.153.57
country_id: 1643084
description:
2025-12-23 03:01:57 dovecot_plain authenticator failed for H=(localhost) [113.11.153.57]:43574: 535 Incorrect authentication data (set_id=info@sobaherbal.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 210.79.142.221
country_id: 1643084
description:
Dec 23 03:03:34 host2 sshd[63676]: Disconnected from invalid user tigergraph 210.79.142.221 port 40262 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 132.148.72.41
country_id: 6252001
description:
2025-12-23 03:05:08 dovecot_plain authenticator failed for H=41.72.148.132.host.secureserver.net (localhost) [132.148.72.41]:47958: 535 Incorrect authentication data (set_id=info@dataesite.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.13.49
country_id: 3144096
description:
2025-12-23 03:05:08 dovecot_login authenticator failed for H=([127.0.0.1]) [84.211.13.49]:37063: 535 Incorrect authentication data (set_id=chitral00@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.157.246.158
country_id: 2077456
description:
2025-12-23 03:05:28 dovecot_login authenticator failed for H=([127.0.0.1]) [120.157.246.158]:49428: 535 Incorrect authentication data (set_id=chitral00)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.227.136.122
country_id: 1269750
description:
2025-12-23 03:06:33 dovecot_plain authenticator failed for H=(localhost) [64.227.136.122]:55748: 535 Incorrect authentication data (set_id=info@essenceceylontea.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 210.79.142.221
country_id: 1643084
description:
Dec 23 03:08:16 host2 sshd[68135]: Disconnected from invalid user developer 210.79.142.221 port 59472 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 210.79.142.221
country_id: 1643084
description:
Dec 23 03:09:25 host2 sshd[69106]: Disconnected from invalid user admin 210.79.142.221 port 36416 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.232.179.250
country_id: 1269750
description:
2025-12-23 03:09:45 dovecot_plain authenticator failed for H=(localhost) [165.232.179.250]:38354: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.204.232.244
country_id: 1269750
description:
2025-12-23 03:11:14 dovecot_login authenticator failed for H=(broadband.actcorp.in) [49.204.232.244]:44038: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.116.199.47
country_id: 1269750
description:
2025-12-23 03:11:58 dovecot_plain authenticator failed for H=(localhost) [66.116.199.47]:44344: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.138.59.242
country_id: 6252001
description:
2025-12-23 03:12:25 dovecot_plain authenticator failed for H=(localhost) [174.138.59.242]:33582: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.6.195.206
country_id: 6252001
description:
2025-12-23 03:12:33 dovecot_plain authenticator failed for H=(localhost) [50.6.195.206]:48266: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.69.208.225
country_id: 6251999
description:
2025-12-23 03:13:06 dovecot_plain authenticator failed for H=gain.tiqqed.com (localhost) [158.69.208.225]:59608: 535 Incorrect authentication data (set_id=info@melanifinefood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.166.235.107
country_id: 1880251
description:
2025-12-23 03:13:49 dovecot_plain authenticator failed for H=(localhost) [188.166.235.107]:33444: 535 Incorrect authentication data (set_id=info@melanifinefood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.55.189.211
country_id: 6252001
description:
2025-12-23 03:15:31 dovecot_login authenticator failed for H=(wllk99-129-211.dsl.netins.net) [67.55.189.211]:38284: 535 Incorrect authentication data (set_id=prasanka@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.3.163.126
country_id: 6252001
description:
2025-12-23 03:15:39 dovecot_plain authenticator failed for H=(localhost) [192.3.163.126]:41998: 535 Incorrect authentication data (set_id=info@mathsmotorcysle.xyz)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 23 03:15:40 host2 pure-ftpd[74918]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.124.46
country_id: 1269750
description:
2025-12-23 03:16:17 dovecot_login authenticator failed for H=([122.184.124.46]) [122.184.124.46]:45854: 535 Incorrect authentication data (set_id=prasanka)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.186.147.126
country_id: 1880251
description:
2025-12-23 03:19:18 dovecot_plain authenticator failed for H=126.147.186.35.bc.googleusercontent.com (localhost) [35.186.147.126]:14816: 535 Incorrect authentication data (set_id=info@seyawin.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.89.246.144
country_id: 6252001
description:
2025-12-23 03:22:34 dovecot_plain authenticator failed for H=(localhost) [47.89.246.144]:34934: 535 Incorrect authentication data (set_id=info@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.120.182
country_id: 3144096
description:
2025-12-23 03:24:06 dovecot_login authenticator failed for H=(cm-178.232.120.182.get.no) [178.232.120.182]:37499: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.220.169.113
country_id: 2635167
description:
2025-12-23 03:24:29 dovecot_login authenticator failed for H=(165-220-169-113.cust.exede.net) [165.220.169.113]:48836: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.215.245.175
country_id: 3469034
description:
2025-12-23 03:25:30 dovecot_login authenticator failed for H=(visaotur.sdr.gvt.net.br) [186.215.245.175]:43890: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.227
country_id: 1819730
description:
2025-12-23 03:25:49 dovecot_login authenticator failed for H=227.42.246.220.static.netvigator.com [220.246.42.227]:61494: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.99.8.95
country_id: 6252001
description:
2025-12-23 03:27:03 dovecot_plain authenticator failed for H=(localhost) [167.99.8.95]:60674: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.69.209.171
country_id: 6251999
description:
2025-12-23 03:33:14 dovecot_plain authenticator failed for H=mark.tiqqedmail.com (localhost) [158.69.209.171]:56660: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.138.237.18
country_id: 1269750
description:
2025-12-23 03:33:29 dovecot_plain authenticator failed for H=(localhost) [103.138.237.18]:10829: 535 Incorrect authentication data (set_id=info@nsteeleng.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.69.209.171
country_id: 6251999
description:
2025-12-23 03:33:20 dovecot_plain authenticator failed for H=mark.tiqqedmail.com (localhost) [158.69.209.171]:60090: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 162.253.68.102
country_id: 6252001
description:
[2025-12-23 03:34:35 +0530] info [webmaild] 162.253.68.102 - info@vtradelanka.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.116.204.232
country_id: 1269750
description:
2025-12-23 03:35:06 dovecot_plain authenticator failed for H=(localhost) [66.116.204.232]:54938: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.12.107
country_id: 3144096
description:
2025-12-23 03:36:10 dovecot_login authenticator failed for H=([84.211.12.107]) [84.211.12.107]:46733: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.39.201
country_id: 3144096
description:
2025-12-23 03:40:27 dovecot_login authenticator failed for H=(cm-46.212.39.201.get.no) [46.212.39.201]:45072: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.91.135.181
country_id: 6252001
description:
2025-12-23 03:40:45 dovecot_login authenticator failed for H=(70-91-135-181-ma-ne.hfc.comcastbusiness.net) [70.91.135.181]:51108: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.132.4.108
country_id: 3932488
description:
2025-12-23 03:41:52 dovecot_plain authenticator failed for H=(localhost) [161.132.4.108]:44108: 535 Incorrect authentication data (set_id=info@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.23.72.254
country_id: 6252001
description:
2025-12-23 03:42:50 dovecot_login authenticator failed for H=([209.23.72.254]) [209.23.72.254]:39986: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.120.98
country_id: 1269750
description:
2025-12-23 03:43:01 dovecot_login authenticator failed for H=([125.19.175.94]) [122.184.120.98]:52238: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.5.63.166
country_id: 1694008
description:
2025-12-23 03:42:20 dovecot_login authenticator failed for H=([103.5.63.166]) [103.5.63.166]:37135: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.27.59.170
country_id: 6252001
description:
2025-12-23 03:42:24 dovecot_login authenticator failed for H=(136-27-59-170.cab.webpass.net) [136.27.59.170]:48090: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 35.91.124.142
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 35.91.124.142: 250 connections per 30 seconds to 80 port.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.147.131.177
country_id: 1814991
description:
2025-12-23 03:44:44 dovecot_plain authenticator failed for H=(localhost) [8.147.131.177]:42510: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.29.174
country_id: 1643084
description:
2025-12-23 03:49:40 dovecot_plain authenticator failed for H=(localhost) [103.148.29.174]:46142: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.129.230.30
country_id: 1814991
description:
2025-12-23 03:53:16 dovecot_plain authenticator failed for H=(localhost) [8.129.230.30]:40456: 535 Incorrect authentication data (set_id=info@nsteeleng.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.129.230.30
country_id: 1814991
description:
2025-12-23 03:53:23 dovecot_plain authenticator failed for H=(localhost) [8.129.230.30]:50736: 535 Incorrect authentication data (set_id=info@nsteeleng.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.0.119.2
country_id: 226074
description:
Dec 23 03:54:20 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=196.0.119.2, lip=66.85.158.91, TLS, session=<emkn4pFGBunEAHcC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.0.105.88
country_id: 2510769
description:
Dec 23 03:54:37 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<gihan>, method=PLAIN, rip=37.0.105.88, lip=66.85.158.91, TLS, session=<BOl+45FG8OYlAGlY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 163.182.174.251
country_id: 6252001
description:
2025-12-23 03:54:57 dovecot_plain authenticator failed for H=163-182-174-251.static.as40244.net (localhost) [163.182.174.251]:37956: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.117.56.152
country_id: 1643084
description:
Dec 23 03:56:04 host2 sshd[114942]: Disconnected from invalid user ozzy 103.117.56.152 port 46384 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.69.209.171
country_id: 6251999
description:
2025-12-23 03:56:09 dovecot_plain authenticator failed for H=mark.tiqqedmail.com (localhost) [158.69.209.171]:33146: 535 Incorrect authentication data (set_id=info@mathsmotorcysle.xyz)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.249.147
country_id: 3865483
description:
Dec 23 03:58:12 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 25 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=179.0.249.147, lip=66.85.158.91, TLS, session=<N8zR75FGr8uzAPmT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.102.57.18
country_id: 3077311
description:
Dec 23 03:58:30 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=5.102.57.18, lip=66.85.158.91, TLS, session=<orRU8ZFG164FZjkS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.188.10
country_id: 3144096
description:
2025-12-23 04:00:16 dovecot_login authenticator failed for H=(cm-178.232.188.10.get.no) [178.232.188.10]:38285: 535 Incorrect authentication data (set_id=v-deploy)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.69.15.132
country_id: 2510769
description:
2025-12-23 03:59:44 dovecot_login authenticator failed for H=(109-69-15-132.puntdacces.coop) [109.69.15.132]:48143: 535 Incorrect authentication data (set_id=v-deploy@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.74.148
country_id: 1269750
description:
2025-12-23 04:00:12 dovecot_plain authenticator failed for H=(localhost) [139.59.74.148]:46986: 535 Incorrect authentication data (set_id=admin@venee.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 164.92.106.89
country_id: 6252001
description:
Dec 23 04:00:38 host2 sshd[119929]: Disconnected from invalid user usman 164.92.106.89 port 42470 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.8.241.171
country_id: 2077456
description:
2025-12-23 04:02:06 dovecot_login authenticator failed for H=([161.8.241.171]) [161.8.241.171]:56860: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.117.56.152
country_id: 1643084
description:
Dec 23 04:02:09 host2 sshd[121598]: Disconnected from invalid user administrator 103.117.56.152 port 53184 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 164.92.106.89
country_id: 6252001
description:
Dec 23 04:01:48 host2 sshd[121292]: Disconnected from invalid user ehsan 164.92.106.89 port 56108 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.224.112
country_id: 1880251
description:
Dec 23 04:02:26 host2 sshd[121308]: Disconnected from invalid user bitrix 45.78.224.112 port 36738 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.117.56.152
country_id: 1643084
description:
Dec 23 04:02:48 host2 sshd[122208]: Disconnected from invalid user admin 103.117.56.152 port 54652 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.172.177.191
country_id: 1269750
description:
Dec 23 04:03:01 host2 sshd[122472]: Disconnected from invalid user ubuntu 52.172.177.191 port 48014 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.76.44.40
country_id: 1522867
description:
2025-12-23 04:02:19 dovecot_login authenticator failed for H=([5.76.44.40]) [5.76.44.40]:40456: 535 Incorrect authentication data (set_id=training)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.7.163.154
country_id: 1643084
description:
2025-12-23 04:03:44 dovecot_plain authenticator failed for H=(localhost) [114.7.163.154]:43072: 535 Incorrect authentication data (set_id=admin@essenceceylontea.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.140
country_id: 6252001
description:
Dec 23 04:03:51 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed (no auth attempts in 15 secs): user=<>, rip=66.132.153.140, lip=66.85.158.92, TLS handshaking: Connection closed, session=<Y9t6BZJGUpBChJmM>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.229.116.218
country_id: 6252001
description:
[2025-12-23 04:05:16 +0530] info [whostmgrd] 72.229.116.218 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 164.92.106.89
country_id: 6252001
description:
Dec 23 04:05:01 host2 sshd[124813]: Disconnected from invalid user nikola 164.92.106.89 port 41468 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.11.153.57
country_id: 1643084
description:
2025-12-23 04:05:30 dovecot_plain authenticator failed for H=(localhost) [113.11.153.57]:43334: 535 Incorrect authentication data (set_id=admin@sobaherbal.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.230.106
country_id: 1880251
description:
Dec 23 04:09:06 host2 sshd[129173]: Disconnected from invalid user nikola 45.78.230.106 port 40006 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 132.148.72.41
country_id: 6252001
description:
2025-12-23 04:08:40 dovecot_plain authenticator failed for H=41.72.148.132.host.secureserver.net (localhost) [132.148.72.41]:55986: 535 Incorrect authentication data (set_id=admin@dataesite.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.227.136.122
country_id: 1269750
description:
2025-12-23 04:10:07 dovecot_plain authenticator failed for H=(localhost) [64.227.136.122]:59936: 535 Incorrect authentication data (set_id=admin@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.74.148
country_id: 1269750
description:
2025-12-23 04:15:28 dovecot_plain authenticator failed for H=(localhost) [139.59.74.148]:51372: 535 Incorrect authentication data (set_id=support@venee.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.224.112
country_id: 1880251
description:
Dec 23 04:15:51 host2 sshd[137710]: Disconnected from invalid user prom 45.78.224.112 port 43616 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 23 04:17:47 host2 pure-ftpd[139887]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.230.106
country_id: 1880251
description:
Dec 23 04:18:51 host2 sshd[141117]: Disconnected from invalid user ubuntu 45.78.230.106 port 44798 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.212.194.62
country_id: 3017382
description:
[2025-12-23 04:20:08 +0530] info [cpaneld] 173.212.194.62 - lezzarot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarot (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.11.153.57
country_id: 1643084
description:
2025-12-23 04:20:45 dovecot_plain authenticator failed for H=(localhost) [113.11.153.57]:51914: 535 Incorrect authentication data (set_id=support@sobaherbal.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 23 04:21:40 host2 sshd[144976]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.138.184
country_id: 3144096
description:
2025-12-23 04:22:36 dovecot_login authenticator failed for H=(cm-178.232.138.184.get.no) [178.232.138.184]:59555: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.243.175
country_id: 732800
description:
2025-12-23 04:22:49 dovecot_login authenticator failed for H=([92.62.243.175]) [92.62.243.175]:52560: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.172.89.74
country_id: 3996063
description:
2025-12-23 04:23:22 dovecot_login authenticator failed for H=(201.172.89.74-clientes-izzi.mx) [201.172.89.74]:33405: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.172.26.3
country_id: 3996063
description:
2025-12-23 04:22:26 dovecot_login authenticator failed for H=(201.172.26.3-clientes-izzi.mx) [201.172.26.3]:59833: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 132.148.72.41
country_id: 6252001
description:
2025-12-23 04:23:50 dovecot_plain authenticator failed for H=41.72.148.132.host.secureserver.net (localhost) [132.148.72.41]:41038: 535 Incorrect authentication data (set_id=info@dataesite.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.124
country_id: 6252001
description:
Dec 23 04:24:21 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 3 secs): user=<>, rip=198.235.24.124, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<SGDHTpJGgMHG6xh8>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.227.136.122
country_id: 1269750
description:
2025-12-23 04:25:16 dovecot_plain authenticator failed for H=(localhost) [64.227.136.122]:38884: 535 Incorrect authentication data (set_id=info@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.227.136.122
country_id: 1269750
description:
2025-12-23 04:25:24 dovecot_plain authenticator failed for H=(localhost) [64.227.136.122]:36970: 535 Incorrect authentication data (set_id=info@essenceceylontea.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.213.71.144
country_id: 6252001
description:
[2025-12-23 04:25:36 +0530] info [whostmgrd] 216.213.71.144 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.96.233.67
country_id: 6251999
description:
2025-12-23 04:27:25 dovecot_login authenticator failed for H=208-96-233-67.resi.cgocable.ca [208.96.233.67]:33882: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.207.9.39
country_id: 1269750
description:
2025-12-23 04:27:37 dovecot_login authenticator failed for H=(49.207.9.39.actcorp.in) [49.207.9.39]:63084: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.232.179.250
country_id: 1269750
description:
2025-12-23 04:28:31 dovecot_plain authenticator failed for H=(localhost) [165.232.179.250]:55826: 535 Incorrect authentication data (set_id=support@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.239.43.189
country_id: 6252001
description:
2025-12-23 04:29:22 dovecot_plain authenticator failed for H=([10.29.18.199]) [84.239.43.189]:38641: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.239.43.189
country_id: 6252001
description:
2025-12-23 04:29:28 dovecot_login authenticator failed for H=([10.29.18.199]) [84.239.43.189]:38641: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.138.59.242
country_id: 6252001
description:
2025-12-23 04:31:17 dovecot_plain authenticator failed for H=(localhost) [174.138.59.242]:36506: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.116.199.47
country_id: 1269750
description:
2025-12-23 04:30:36 dovecot_plain authenticator failed for H=(localhost) [66.116.199.47]:53662: 535 Incorrect authentication data (set_id=support@venee.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 23 04:31:42 host2 sshd[157584]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.138.59.242
country_id: 6252001
description:
2025-12-23 04:31:23 dovecot_plain authenticator failed for H=(localhost) [174.138.59.242]:22166: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.6.195.206
country_id: 6252001
description:
2025-12-23 04:31:44 dovecot_plain authenticator failed for H=(localhost) [50.6.195.206]:41634: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.69.208.225
country_id: 6251999
description:
2025-12-23 04:31:51 dovecot_plain authenticator failed for H=gain.tiqqed.com (localhost) [158.69.208.225]:58182: 535 Incorrect authentication data (set_id=info@melanifinefood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.166.235.107
country_id: 1880251
description:
2025-12-23 04:32:05 dovecot_plain authenticator failed for H=(localhost) [188.166.235.107]:36102: 535 Incorrect authentication data (set_id=info@melanifinefood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.219.54
country_id: 1269750
description:
2025-12-23 04:32:47 dovecot_login authenticator failed for H=([128.185.219.54]) [128.185.219.54]:34046: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.160
country_id: 1269750
description:
2025-12-23 04:33:15 dovecot_login authenticator failed for H=(nsg-corporate-160.229.187.122.airtel.in) [122.187.229.160]:51212: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 20.127.195.188
country_id: 6252001
description:
Dec 23 04:35:44 host2 pure-ftpd[162230]: (?@20.127.195.188) [INFO] New connection from 20.127.195.188


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.116.22
country_id: 1861060
description:
Dec 23 04:36:53 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=139.162.116.22, lip=66.85.158.91, TLS: Connection closed, session=<r++me5JGWMSLonQW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.159.161.107
country_id: 294640
description:
2025-12-23 04:37:03 dovecot_login authenticator failed for H=([85.159.161.107]) [85.159.161.107]:43633: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.223.40.78
country_id: 3351879
description:
Dec 23 04:37:14 host2 sshd[164048]: Disconnected from invalid user emma 41.223.40.78 port 43886 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.201.212.54
country_id: 99237
description:
2025-12-23 04:37:17 dovecot_login authenticator failed for H=([62.201.212.54]) [62.201.212.54]:50952: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 41.223.40.78
country_id: 3351879
description:
Dec 23 04:37:56 host2 sshd[164824]: Disconnected from invalid user kasia 41.223.40.78 port 48036 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.186.147.126
country_id: 1880251
description:
2025-12-23 04:38:09 dovecot_plain authenticator failed for H=126.147.186.35.bc.googleusercontent.com (localhost) [35.186.147.126]:46426: 535 Incorrect authentication data (set_id=support@seyawin.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.112.148.66
country_id: 130758
description:
2025-12-23 04:38:56 dovecot_login authenticator failed for H=([185.112.148.66]) [185.112.148.66]:41128: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.111.109.194
country_id: 1269750
description:
2025-12-23 04:38:26 dovecot_login authenticator failed for H=([103.111.109.194]) [103.111.109.194]:39922: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.219.149.74
country_id: 2328926
description:
2025-12-23 04:40:00 dovecot_login authenticator failed for H=(netcomafrica.com) [41.219.149.74]:40961: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.224.102
country_id: 1269750
description:
2025-12-23 04:41:20 dovecot_login authenticator failed for H=([27.123.119.99]) [182.95.224.102]:58720: 535 Incorrect authentication data (set_id=hnt)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.231.6
country_id: 1269750
description:
2025-12-23 04:41:04 dovecot_login authenticator failed for H=([125.20.231.225]) [128.185.231.6]:58330: 535 Incorrect authentication data (set_id=hnt@essenceceylontea.com)


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 178.128.203.219
country_id: 2921044
description:
Dec 23 04:41:51 host2 pure-ftpd[168845]: (?@178.128.203.219) [INFO] New connection from 178.128.203.219


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.89.246.144
country_id: 6252001
description:
2025-12-23 04:41:36 dovecot_plain authenticator failed for H=(localhost) [47.89.246.144]:51562: 535 Incorrect authentication data (set_id=info@kiriaswanu.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 178.128.203.219
country_id: 2921044
description:
Dec 23 04:41:44 host2 pure-ftpd[168716]: (?@178.128.203.219) [INFO] New connection from 178.128.203.219


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.163.37.97
country_id: 6252001
description:
Dec 23 04:43:17 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.163.37.97, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<b0mJkpJGCpkUoyVh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.99.8.95
country_id: 6252001
description:
2025-12-23 04:49:03 dovecot_plain authenticator failed for H=(localhost) [167.99.8.95]:33932: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.80
country_id: 3144096
description:
2025-12-23 04:49:12 dovecot_login authenticator failed for H=(80-170-97-62.cust.smartcall.no) [62.97.170.80]:41126: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
country_id: 3144096
description:
2025-12-23 04:49:29 dovecot_login authenticator failed for H=(85-19-195-12.telia-isp.no) [85.19.195.12]:59740: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.202.250.46
country_id: 3469034
description:
2025-12-23 04:50:42 dovecot_login authenticator failed for H=([200.202.250.46]) [200.202.250.46]:50041: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.69.209.171
country_id: 6251999
description:
2025-12-23 04:52:08 dovecot_plain authenticator failed for H=mark.tiqqedmail.com (localhost) [158.69.209.171]:33070: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.90.94
country_id: 1269750
description:
2025-12-23 04:52:09 dovecot_login authenticator failed for H=([182.95.85.106]) [27.123.90.94]:33838: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.138.237.18
country_id: 1269750
description:
2025-12-23 04:52:12 dovecot_plain authenticator failed for H=(localhost) [103.138.237.18]:6003: 535 Incorrect authentication data (set_id=admin@nsteeleng.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 74.235.100.212
country_id: 6252001
description:
Dec 23 04:51:56 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=74.235.100.212, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<PC14sZJGOoFK62TU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.203.138
country_id: 1269750
description:
2025-12-23 04:52:35 dovecot_login authenticator failed for H=(nsg-corporate-201.0.185.122.airtel.in) [125.23.203.138]:52378: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.122
country_id: 6252001
description:
Dec 23 04:52:49 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed (no auth attempts in 16 secs): user=<>, rip=66.132.153.122, lip=66.85.158.91, TLS handshaking: Connection closed, session=<XjGWtJJGsH9ChJl6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.148.5
country_id: 1733045
description:
2025-12-23 04:53:09 dovecot_login authenticator failed for H=([49.124.148.5]) [49.124.148.5]:44732: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.29.11
country_id: 1880251
description:
Dec 23 04:53:11 host2 sshd[180646]: Disconnected from invalid user vyos 165.154.29.11 port 56618 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.29.11
country_id: 1880251
description:
Dec 23 04:53:52 host2 sshd[181114]: Disconnected from invalid user runner 165.154.29.11 port 42392 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.116.204.232
country_id: 1269750
description:
2025-12-23 04:53:40 dovecot_plain authenticator failed for H=(localhost) [66.116.204.232]:55594: 535 Incorrect authentication data (set_id=support@sivagnanamfoundation.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 165.154.29.11
country_id: 1880251
description:
Dec 23 04:55:14 host2 sshd[182536]: Disconnected from invalid user zk 165.154.29.11 port 42222 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.29.11
country_id: 1880251
description:
Dec 23 04:55:52 host2 sshd[183339]: Disconnected from invalid user steam 165.154.29.11 port 56256 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.29.11
country_id: 1880251
description:
Dec 23 04:56:29 host2 sshd[183846]: Disconnected from invalid user cyril 165.154.29.11 port 42060 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.132.4.108
country_id: 3932488
description:
2025-12-23 05:00:29 dovecot_plain authenticator failed for H=(localhost) [161.132.4.108]:54944: 535 Incorrect authentication data (set_id=support@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.147.131.177
country_id: 1814991
description:
2025-12-23 05:03:27 dovecot_plain authenticator failed for H=(localhost) [8.147.131.177]:53296: 535 Incorrect authentication data (set_id=admin@sivagnanamfoundation.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 192.111.129.146
country_id: 6252001
description:
[2025-12-23 05:03:38 +0530] info [webmaild] 192.111.129.146 - info@cloudtourssrilanka.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.93.84
country_id: 1269750
description:
2025-12-23 05:07:09 dovecot_login authenticator failed for H=([152.52.93.82]) [152.52.93.84]:10400: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.55.16
country_id: 3144096
description:
2025-12-23 05:07:17 dovecot_login authenticator failed for H=(cm-178.232.55.16.get.no) [178.232.55.16]:49909: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.27.83
country_id: 1643084
description:
2025-12-23 05:07:39 dovecot_login authenticator failed for H=(ip-arana.net.id.as132673) [103.90.27.83]:36264: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.250
country_id: 1036973
description:
2025-12-23 05:07:42 dovecot_login authenticator failed for H=([197.219.228.250]) [197.219.228.250]:38948: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.132.97.76
country_id: 2264397
description:
2025-12-23 05:09:16 dovecot_login authenticator failed for H=a94-132-97-76.cpe.netcabo.pt [94.132.97.76]:35106: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.29.174
country_id: 1643084
description:
2025-12-23 05:08:36 dovecot_plain authenticator failed for H=(localhost) [103.148.29.174]:39554: 535 Incorrect authentication data (set_id=support@sivagnanamfoundation.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 99.127.24.165
country_id: 6252001
description:
2025-12-23 05:09:47 dovecot_login authenticator failed for H=99-127-24-165.lightspeed.chrlnc.sbcglobal.net [99.127.24.165]:39098: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.129.230.30
country_id: 1814991
description:
2025-12-23 05:12:14 dovecot_plain authenticator failed for H=(localhost) [8.129.230.30]:34818: 535 Incorrect authentication data (set_id=support@nsteeleng.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.108
country_id: 6252001
description:
Dec 23 05:13:17 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.108, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<kbbT/ZJGZsPG6xhs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 163.182.174.251
country_id: 6252001
description:
2025-12-23 05:13:57 dovecot_plain authenticator failed for H=163-182-174-251.static.as40244.net (localhost) [163.182.174.251]:37218: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.69.209.171
country_id: 6251999
description:
2025-12-23 05:15:06 dovecot_plain authenticator failed for H=mark.tiqqedmail.com (localhost) [158.69.209.171]:34156: 535 Incorrect authentication data (set_id=info@mathsmotorcysle.xyz)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.165.15.132
country_id: 1733045
description:
Dec 23 05:16:08 host2 sshd[200145]: Disconnected from invalid user daniel 202.165.15.132 port 40368 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.149.116
country_id: 3996063
description:
2025-12-23 05:16:14 dovecot_login authenticator failed for H=([177.236.149.116]) [177.236.149.116]:37061: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.34.17.250
country_id: 99237
description:
2025-12-23 05:15:45 dovecot_login authenticator failed for H=([185.34.17.250]) [185.34.17.250]:41675: 535 Incorrect authentication data (set_id=prasanka@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.206.119
country_id: 1819730
description:
2025-12-23 05:16:02 dovecot_login authenticator failed for H=(m121-202-206-119.smartone.com) [121.202.206.119]:48600: 535 Incorrect authentication data (set_id=prasanka)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.132.127.172
country_id: 2750405
description:
2025-12-23 05:16:04 dovecot_plain authenticator failed for H=172-127-132-5.ftth.glasoperator.nl (localhost) [5.132.127.172]:52410: 535 Incorrect authentication data (set_id=info@melanifinefood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.136.183
country_id: 99237
description:
2025-12-23 05:16:58 dovecot_login authenticator failed for H=([65.20.136.183]) [65.20.136.183]:45670: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.56.202.86
country_id: 3469034
description:
2025-12-23 05:17:08 dovecot_login authenticator failed for H=([189.109.48.81]) [189.56.202.86]:35107: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.226.118.0
country_id: 3469034
description:
2025-12-23 05:17:13 dovecot_login authenticator failed for H=([38.226.118.9]) [38.226.118.0]:45434: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.203.124
country_id: 1880251
description:
Dec 23 05:18:10 host2 sshd[202255]: Disconnected from invalid user timemachine 45.78.203.124 port 47674 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.252.228
country_id: 3865483
description:
Dec 23 05:19:04 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=179.0.252.228, lip=66.85.158.91, TLS, session=<rWRUEZNGYcKzAPzk>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 23 05:20:04 host2 pure-ftpd[204084]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.72.100
country_id: 3469034
description:
Dec 23 05:19:31 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 23 secs): user=<info>, method=PLAIN, rip=187.120.72.100, lip=66.85.158.91, TLS, session=<UuC7EpNGzsK7eEhk>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 206.81.27.245
country_id: 2921044
description:
Dec 23 05:20:25 host2 sshd[204416]: Disconnected from invalid user element 206.81.27.245 port 37932 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.203.124
country_id: 1880251
description:
Dec 23 05:20:32 host2 sshd[204496]: Disconnected from invalid user sybase 45.78.203.124 port 50630 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.104.24.6
country_id: 3923057
description:
2025-12-23 05:22:04 dovecot_login authenticator failed for H=([190.104.24.6]) [190.104.24.6]:37552: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 36.91.166.34
country_id: 1643084
description:
Dec 23 05:21:55 host2 sshd[205716]: Disconnected from invalid user in 36.91.166.34 port 52734 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.183.103.121
country_id: 2635167
description:
2025-12-23 05:22:54 dovecot_login authenticator failed for H=(185-183-103-121.xdsl.5gdsl.com) [185.183.103.121]:55766: 535 Incorrect authentication data


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 206.81.27.245
country_id: 2921044
description:
Dec 23 05:22:50 host2 sshd[206526]: Disconnected from invalid user gustavo 206.81.27.245 port 39680 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.250.196
country_id: 3865483
description:
Dec 23 05:23:44 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=179.0.250.196, lip=66.85.158.91, TLS, session=</pvxIZNGX7yzAPrE>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 89.106.141.212
country_id: 2963597
description:
Dec 23 05:24:01 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<gihan>, method=PLAIN, rip=89.106.141.212, lip=66.85.158.91, TLS, session=<7ck3I5NGds9Zao3U>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 202.165.15.132
country_id: 1733045
description:
Dec 23 05:24:29 host2 sshd[207983]: Disconnected from invalid user tmp 202.165.15.132 port 34058 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 206.81.27.245
country_id: 2921044
description:
Dec 23 05:24:37 host2 sshd[208102]: Disconnected from invalid user subhana 206.81.27.245 port 42996 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.91.166.34
country_id: 1643084
description:
Dec 23 05:24:46 host2 sshd[208214]: Disconnected from invalid user tmp 36.91.166.34 port 49802 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.91.166.34
country_id: 1643084
description:
Dec 23 05:25:29 host2 sshd[208916]: Disconnected from invalid user ilya 36.91.166.34 port 34970 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.69.208.225
country_id: 6251999
description:
2025-12-23 05:25:40 dovecot_plain authenticator failed for H=gain.tiqqed.com (localhost) [158.69.208.225]:39436: 535 Incorrect authentication data (set_id=info@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.195.194
country_id: 1819730
description:
2025-12-23 05:25:44 dovecot_login authenticator failed for H=(m121-202-195-194.smartone.com) [121.202.195.194]:7917: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.253.122
country_id: 1269750
description:
2025-12-23 05:26:12 dovecot_login authenticator failed for H=([128.185.253.122]) [128.185.253.122]:50878: 535 Incorrect authentication data (set_id=awanish)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 44.220.185.253
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 44.220.185.253: 250 connections per 30 seconds to 2078 port.


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.182.207.45
country_id: 3469034
description:
Dec 23 05:26:59 host2 sshd[210330]: Disconnected from invalid user userftp 45.182.207.45 port 58182 [preauth]


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 44.220.185.253
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 44.220.185.253: 407 connections per 30 seconds to 2078 port.


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.182.207.45
country_id: 3469034
description:
Dec 23 05:28:17 host2 sshd[211827]: Disconnected from invalid user cms 45.182.207.45 port 47262 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.62
country_id: 1269750
description:
2025-12-23 05:28:55 dovecot_login authenticator failed for H=([182.95.181.62]) [182.95.181.62]:33526: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.34
country_id: 1269750
description:
2025-12-23 05:28:33 dovecot_login authenticator failed for H=(nsg-corporate-34.230.187.122.airtel.in) [122.187.230.34]:41507: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.253.122
country_id: 1269750
description:
2025-12-23 05:29:28 dovecot_login authenticator failed for H=([128.185.253.122]) [128.185.253.122]:49538: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.182.207.45
country_id: 3469034
description:
Dec 23 05:29:30 host2 sshd[212698]: Disconnected from invalid user safeuser 45.182.207.45 port 58668 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.252.85
country_id: 1210997
description:
2025-12-23 05:31:21 dovecot_login authenticator failed for H=([103.115.252.60]) [103.115.252.85]:39443: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.182.207.45
country_id: 3469034
description:
Dec 23 05:30:43 host2 sshd[213758]: Disconnected from invalid user andrey 45.182.207.45 port 44858 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.198.166.225
country_id: 1269750
description:
2025-12-23 05:31:39 dovecot_login authenticator failed for H=([103.250.160.76]) [117.198.166.225]:36182: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.49.97.15
country_id: 6252001
description:
2025-12-23 05:32:00 dovecot_login authenticator failed for H=(64-49-97-15.protekweb.com) [64.49.97.15]:36378: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.206.93.107
country_id: 3017382
description:
2025-12-23 05:32:19 dovecot_login authenticator failed for H=107.93.206.77.rev.sfr.net [77.206.93.107]:54648: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 159.16.201.242
country_id: 3996063
description:
2025-12-23 05:35:09 dovecot_login authenticator failed for H=([127.0.0.1]) [159.16.201.242]:56664: 535 Incorrect authentication data (set_id=inf@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.24
country_id: 2186224
description:
2025-12-23 05:35:27 dovecot_login authenticator failed for H=([127.0.0.1]) [121.73.169.24]:53626: 535 Incorrect authentication data (set_id=inf)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.195.101.102
country_id: 6252001
description:
[2025-12-23 05:35:38 +0530] info [webmaild] 72.195.101.102 - info@colourmarklabels.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-23 05:36:28 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:59745: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.125.83.34
country_id: 1880251
description:
2025-12-23 05:42:54 dovecot_login authenticator failed for H=([203.125.110.142]) [203.125.83.34]:60157: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 163.182.174.251
country_id: 6252001
description:
2025-12-23 05:43:08 dovecot_plain authenticator failed for H=163-182-174-251.static.as40244.net (localhost) [163.182.174.251]:59696: 535 Incorrect authentication data (set_id=support@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.55.16
country_id: 3144096
description:
2025-12-23 05:42:41 dovecot_login authenticator failed for H=([178.232.55.16]) [178.232.55.16]:57469: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.67.152.201
country_id: 1269750
description:
2025-12-23 05:44:09 dovecot_login authenticator failed for H=([103.67.152.201]) [103.67.152.201]:54154: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.75.202
country_id: 1149361
description:
2025-12-23 05:44:25 dovecot_login authenticator failed for H=([180.94.75.202]) [180.94.75.202]:35204: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.89.246.144
country_id: 6252001
description:
2025-12-23 05:46:04 dovecot_plain authenticator failed for H=(localhost) [47.89.246.144]:44072: 535 Incorrect authentication data (set_id=hr@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.69.209.171
country_id: 6251999
description:
2025-12-23 05:46:17 dovecot_plain authenticator failed for H=mark.tiqqedmail.com (localhost) [158.69.209.171]:47034: 535 Incorrect authentication data (set_id=help@mathsmotorcysle.xyz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.69.209.171
country_id: 6251999
description:
2025-12-23 05:46:24 dovecot_plain authenticator failed for H=mark.tiqqedmail.com (localhost) [158.69.209.171]:36942: 535 Incorrect authentication data (set_id=help@mathsmotorcysle.xyz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.60.78
country_id: 1269750
description:
2025-12-23 05:50:11 dovecot_login authenticator failed for H=(dsl-tn-dynamic-217.127.246.61.airtelbroadband.in) [122.186.60.78]:56720: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.157.158
country_id: 1269750
description:
2025-12-23 05:50:33 dovecot_login authenticator failed for H=([128.185.70.193]) [125.19.157.158]:46846: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.166.235.107
country_id: 1880251
description:
2025-12-23 05:51:16 dovecot_plain authenticator failed for H=(localhost) [188.166.235.107]:48462: 535 Incorrect authentication data (set_id=admin@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.166.235.107
country_id: 1880251
description:
2025-12-23 05:51:24 dovecot_plain authenticator failed for H=(localhost) [188.166.235.107]:60010: 535 Incorrect authentication data (set_id=admin@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.6.195.206
country_id: 6252001
description:
2025-12-23 05:58:33 dovecot_plain authenticator failed for H=(localhost) [50.6.195.206]:53386: 535 Incorrect authentication data (set_id=office@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.228.146
country_id: 1269750
description:
2025-12-23 05:58:37 dovecot_login authenticator failed for H=([125.20.228.146]) [125.20.228.146]:39194: 535 Incorrect authentication data (set_id=bostonlanka.com@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 86.111.91.69
country_id: 690791
description:
2025-12-23 05:59:38 dovecot_login authenticator failed for H=host-86-111-91-69.566f.la.net.ua [86.111.91.69]:61637: 535 Incorrect authentication data (set_id=bostonlanka.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 211.239.181.182
country_id: 1835841
description:
[2025-12-23 06:02:35 +0530] info [webmaild] 211.239.181.182 - info@essenceceylontea.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: User info@essenceceylontea.com has their account suspended. Login blocked.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.247.248.154
country_id: 3469034
description:
2025-12-23 06:03:03 dovecot_login authenticator failed for H=([170.247.248.154]) [170.247.248.154]:50984: 535 Incorrect authentication data (set_id=hnt@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.7.163.154
country_id: 1643084
description:
2025-12-23 06:03:30 dovecot_plain authenticator failed for H=(localhost) [114.7.163.154]:52296: 535 Incorrect authentication data (set_id=office@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.136.72
country_id: 3996063
description:
2025-12-23 06:03:25 dovecot_login authenticator failed for H=(187.161.136.72-clientes-izzi.mx) [187.161.136.72]:56749: 535 Incorrect authentication data (set_id=hnt)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 23 06:05:24 host2 sshd[248040]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.247.230.132
country_id: 2264397
description:
2025-12-23 06:06:48 dovecot_login authenticator failed for H=bl14-230-132.dsl.telepac.pt [85.247.230.132]:41016: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.215.1.201
country_id: 2635167
description:
2025-12-23 06:07:03 dovecot_login authenticator failed for H=([88.215.1.201]) [88.215.1.201]:54150: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.227.136.122
country_id: 1269750
description:
2025-12-23 06:09:08 dovecot_plain authenticator failed for H=(localhost) [64.227.136.122]:60456: 535 Incorrect authentication data (set_id=office@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.228.234
country_id: 1269750
description:
2025-12-23 06:09:10 dovecot_login authenticator failed for H=(nsg-static-234.228.76.182-airtel.com) [182.76.228.234]:39664: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.227.136.122
country_id: 1269750
description:
2025-12-23 06:09:16 dovecot_plain authenticator failed for H=(localhost) [64.227.136.122]:35646: 535 Incorrect authentication data (set_id=office@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.220.16.51
country_id: 1269750
description:
2025-12-23 06:09:38 dovecot_login authenticator failed for H=([103.220.16.51]) [103.220.16.51]:59398: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.23.68
country_id: 3144096
description:
2025-12-23 06:09:56 dovecot_login authenticator failed for H=([127.0.0.1]) [178.232.23.68]:42408: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.58.18
country_id: 1269750
description:
2025-12-23 06:10:14 dovecot_login authenticator failed for H=([127.0.0.1]) [182.95.58.18]:38140: 535 Incorrect authentication data (set_id=kasunp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.69.208.225
country_id: 6251999
description:
2025-12-23 06:10:38 dovecot_plain authenticator failed for H=gain.tiqqed.com (localhost) [158.69.208.225]:37314: 535 Incorrect authentication data (set_id=info@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.124.142.221
country_id: 3144096
description:
2025-12-23 06:10:51 dovecot_login authenticator failed for H=([188.124.142.221]) [188.124.142.221]:35367: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.148.190
country_id: 1733045
description:
2025-12-23 06:11:15 dovecot_login authenticator failed for H=([49.124.148.190]) [49.124.148.190]:50162: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.99.8.95
country_id: 6252001
description:
2025-12-23 06:12:33 dovecot_plain authenticator failed for H=(localhost) [167.99.8.95]:53544: 535 Incorrect authentication data (set_id=help@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.138.59.242
country_id: 6252001
description:
2025-12-23 06:12:57 dovecot_plain authenticator failed for H=(localhost) [174.138.59.242]:45248: 535 Incorrect authentication data (set_id=admin@sivagnanamfoundation.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.132.4.108
country_id: 3932488
description:
2025-12-23 06:13:01 dovecot_plain authenticator failed for H=(localhost) [161.132.4.108]:57772: 535 Incorrect authentication data (set_id=test@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 86.111.91.69
country_id: 690791
description:
2025-12-23 06:13:04 dovecot_login authenticator failed for H=host-86-111-91-69.566f.la.net.ua [86.111.91.69]:60619: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.248.169.6
country_id: 1643084
description:
[2025-12-23 06:13:17 +0530] info [webmaild] 23.248.169.6 - senthil@yashiholdings.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.74.148
country_id: 1269750
description:
2025-12-23 06:13:33 dovecot_plain authenticator failed for H=(localhost) [139.59.74.148]:55186: 535 Incorrect authentication data (set_id=office@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.168.241.32
country_id: 1269750
description:
2025-12-23 06:13:16 dovecot_login authenticator failed for H=([103.168.241.32]) [103.168.241.32]:33836: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.186.147.126
country_id: 1880251
description:
2025-12-23 06:14:18 dovecot_plain authenticator failed for H=126.147.186.35.bc.googleusercontent.com (localhost) [35.186.147.126]:55172: 535 Incorrect authentication data (set_id=help@seyawin.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.11.153.57
country_id: 1643084
description:
2025-12-23 06:15:08 dovecot_plain authenticator failed for H=(localhost) [113.11.153.57]:52686: 535 Incorrect authentication data (set_id=admin@sobaherbal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.47.37.18
country_id: 6252001
description:
2025-12-23 06:16:34 dovecot_login authenticator failed for H=([127.0.0.1]) [50.47.37.18]:40170: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.103.27.217
country_id: 390903
description:
2025-12-23 06:16:41 dovecot_login authenticator failed for H=owniyj.static.otenet.gr ([127.0.0.1]) [62.103.27.217]:41757: 535 Incorrect authentication data (set_id=kasunp)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 154.127.36.232
country_id: 2395170
description:
Dec 23 06:18:09 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=154.127.36.232, lip=66.85.158.91, TLS, session=<BfGz5JNGUYiafyTo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.80
country_id: 3144096
description:
2025-12-23 06:18:10 dovecot_login authenticator failed for H=(80-170-97-62.cust.smartcall.no) [62.97.170.80]:42409: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.69.208.225
country_id: 6251999
description:
2025-12-23 06:17:31 dovecot_plain authenticator failed for H=gain.tiqqed.com (localhost) [158.69.208.225]:52550: 535 Incorrect authentication data (set_id=info@melanifinefood.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.245.249.23
country_id: 3469034
description:
Dec 23 06:17:30 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=170.245.249.23, lip=66.85.158.91, TLS, session=<0JlL4pNG3Luq9fkX>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.240.36.91
country_id: 3469034
description:
Dec 23 06:17:49 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=191.240.36.91, lip=66.85.158.91, TLS, session=<7wWL45NGiN+/8CRb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.169.181
country_id: 3175395
description:
Dec 23 06:17:48 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<designdpt>, method=PLAIN, rip=185.15.169.181, lip=66.85.158.91, TLS, session=<drOI45NGTZ65D6m1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.166.235.107
country_id: 1880251
description:
2025-12-23 06:18:26 dovecot_plain authenticator failed for H=(localhost) [188.166.235.107]:59680: 535 Incorrect authentication data (set_id=admin@melanifinefood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.150.249
country_id: 1733045
description:
2025-12-23 06:18:28 dovecot_login authenticator failed for H=([49.124.150.249]) [49.124.150.249]:57212: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.88.19.82
country_id: 6252001
description:
2025-12-23 06:18:39 dovecot_plain authenticator failed for H=(localhost) [47.88.19.82]:57216: 535 Incorrect authentication data (set_id=contact@dataesite.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.104.142
country_id: 1269750
description:
2025-12-23 06:21:13 dovecot_login authenticator failed for H=([27.123.104.142]) [27.123.104.142]:47688: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.59.19.112
country_id: 298795
description:
2025-12-23 06:21:48 dovecot_login authenticator failed for H=([188.59.19.112]) [188.59.19.112]:57434: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.140.18.186
country_id: 1269750
description:
2025-12-23 06:22:04 dovecot_login authenticator failed for H=([103.140.18.186]) [103.140.18.186]:39924: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.177.113.17
country_id: 3175395
description:
Dec 23 06:22:25 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=195.177.113.17, lip=66.85.158.91, TLS, session=</u4A9JNGQoTDsXER>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 23 06:22:36 host2 pure-ftpd[263931]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.255.212.251
country_id: 732800
description:
Dec 23 06:22:43 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<gihan>, method=PLAIN, rip=185.255.212.251, lip=66.85.158.91, TLS, session=<WjYd9ZNG+9q5/9T7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.147.131.177
country_id: 1814991
description:
2025-12-23 06:24:00 dovecot_plain authenticator failed for H=(localhost) [8.147.131.177]:45610: 535 Incorrect authentication data (set_id=hr@sivagnanamfoundation.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.232.179.250
country_id: 1269750
description:
2025-12-23 06:25:27 dovecot_plain authenticator failed for H=(localhost) [165.232.179.250]:49764: 535 Incorrect authentication data (set_id=test@ceylondigest.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.30.97.33
country_id: 272103
description:
Dec 23 06:26:24 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@seyawin.com>, method=PLAIN, rip=193.30.97.33, lip=66.85.158.91, session=<aZwiA5RGgsPBHmEh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.237.113.106
country_id: 587116
description:
2025-12-23 06:27:47 dovecot_login authenticator failed for H=([127.0.0.1]) [109.237.113.106]:54094: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.185.170
country_id: 1269750
description:
2025-12-23 06:28:05 dovecot_login authenticator failed for H=([127.0.0.1]) [182.95.185.170]:32942: 535 Incorrect authentication data (set_id=kasunp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.53.197.53
country_id: 2921044
description:
2025-12-23 06:33:10 dovecot_plain authenticator failed for H=v2202507289313365218.goodsrv.de (localhost) [152.53.197.53]:58130: 535 Incorrect authentication data (set_id=help@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.53.197.53
country_id: 2921044
description:
2025-12-23 06:33:18 dovecot_plain authenticator failed for H=v2202507289313365218.goodsrv.de (localhost) [152.53.197.53]:43978: 535 Incorrect authentication data (set_id=help@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.219.196.17
country_id: 690791
description:
2025-12-23 06:33:48 dovecot_login authenticator failed for H=(91-219-196-17.planeta.dn.ua) [91.219.196.17]:54668: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.50.5.94
country_id: 1269750
description:
2025-12-23 06:34:03 dovecot_login authenticator failed for H=([103.50.5.94]) [103.50.5.94]:59025: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.170.50.2
country_id: 3932488
description:
2025-12-23 06:35:09 dovecot_login authenticator failed for H=([45.170.50.2]) [45.170.50.2]:49691: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.0.238.190
country_id: 3469034
description:
2025-12-23 06:35:26 dovecot_login authenticator failed for H=(177-0-238-190.bnut3703.dsl.brasiltelecom.net.br) [177.0.238.190]:46567: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 132.148.72.41
country_id: 6252001
description:
2025-12-23 06:37:12 dovecot_plain authenticator failed for H=41.72.148.132.host.secureserver.net (localhost) [132.148.72.41]:59138: 535 Incorrect authentication data (set_id=news@dataesite.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 132.148.72.41
country_id: 6252001
description:
2025-12-23 06:37:18 dovecot_plain authenticator failed for H=41.72.148.132.host.secureserver.net (localhost) [132.148.72.41]:58624: 535 Incorrect authentication data (set_id=news@dataesite.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.229.1.186
country_id: 6252001
description:
2025-12-23 06:39:27 dovecot_login authenticator failed for H=c-71-229-1-186.hsd1.al.comcast.net [71.229.1.186]:58072: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.64.64.8
country_id: 2264397
description:
2025-12-23 06:39:42 dovecot_login authenticator failed for H=bl23-64-8.dsl.telepac.pt [144.64.64.8]:4036: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.27.253.6
country_id: 1168579
description:
2025-12-23 06:39:58 dovecot_login authenticator failed for H=(58-27-253-6.wateen.net) [58.27.253.6]:24086: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.183.110.215
country_id: 798544
description:
2025-12-23 06:40:04 dovecot_login authenticator failed for H=178.183.110.215.mobile.static.t-mobile.pl [178.183.110.215]:60164: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.13
country_id: 1733045
description:
2025-12-23 06:40:23 dovecot_login authenticator failed for H=([49.124.153.13]) [49.124.153.13]:37098: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.120.182
country_id: 3144096
description:
2025-12-23 06:40:50 dovecot_login authenticator failed for H=(cm-178.232.120.182.get.no) [178.232.120.182]:45643: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.246.198
country_id: 1269750
description:
2025-12-23 06:41:12 dovecot_login authenticator failed for H=([152.52.246.198]) [152.52.246.198]:55236: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.133.161.162
country_id: 130758
description:
2025-12-23 06:41:34 dovecot_login authenticator failed for H=([85.133.161.162]) [85.133.161.162]:36212: 535 Incorrect authentication data (set_id=awanish)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 35.91.124.142
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 35.91.124.142: 250 connections per 30 seconds to 443 port.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.232.114.16
country_id: 3865483
description:
2025-12-23 06:46:59 dovecot_login authenticator failed for H=([127.0.0.1]) [24.232.114.16]:43807: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.7.17
country_id: 3144096
description:
2025-12-23 06:47:33 dovecot_login authenticator failed for H=([127.0.0.1]) [84.211.7.17]:55291: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 194.87.187.47
country_id: 2017370
description:
Dec 23 06:49:05 host2 sshd[289683]: Disconnected from invalid user kocom 194.87.187.47 port 34888 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 194.87.187.47
country_id: 2017370
description:
Dec 23 06:50:11 host2 sshd[290843]: Disconnected from invalid user testuser 194.87.187.47 port 48142 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.116.204.232
country_id: 1269750
description:
2025-12-23 06:50:33 dovecot_plain authenticator failed for H=(localhost) [66.116.204.232]:38848: 535 Incorrect authentication data (set_id=office@sivagnanamfoundation.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.138.237.18
country_id: 1269750
description:
2025-12-23 06:53:03 dovecot_plain authenticator failed for H=(localhost) [103.138.237.18]:13978: 535 Incorrect authentication data (set_id=test@nsteeleng.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 163.182.174.251
country_id: 6252001
description:
2025-12-23 06:54:09 dovecot_plain authenticator failed for H=163-182-174-251.static.as40244.net (localhost) [163.182.174.251]:54926: 535 Incorrect authentication data (set_id=support@anandaobauae.org)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.205.186.84
country_id: 146669
description:
[2025-12-23 06:55:54 +0530] info [webmaild] 185.205.186.84 - isuru@euroentertainmentlk.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.220
country_id: 6252001
description:
Dec 23 06:58:34 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=205.210.31.220, lip=66.85.158.92, TLS, session=<BL5SdpRGrPrN0h/c>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.29.174
country_id: 1643084
description:
2025-12-23 06:58:44 dovecot_plain authenticator failed for H=(localhost) [103.148.29.174]:45622: 535 Incorrect authentication data (set_id=sales@sivagnanamfoundation.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.74.148
country_id: 1269750
description:
2025-12-23 06:59:02 dovecot_plain authenticator failed for H=(localhost) [139.59.74.148]:57622: 535 Incorrect authentication data (set_id=office@mathsmotorcysle.xyz)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.124.97.102
country_id: 2245662
description:
Dec 23 07:00:17 host2 sshd[303569]: Disconnected from invalid user user 154.124.97.102 port 59599 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.144.247.233
country_id: 1819730
description:
Dec 23 07:02:36 host2 sshd[306423]: Disconnected from invalid user admin 103.144.247.233 port 34230 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.144.247.233
country_id: 1819730
description:
Dec 23 07:03:12 host2 sshd[307300]: Disconnected from invalid user test 103.144.247.233 port 46336 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.89.246.144
country_id: 6252001
description:
2025-12-23 07:04:55 dovecot_plain authenticator failed for H=(localhost) [47.89.246.144]:48814: 535 Incorrect authentication data (set_id=hr@kiriaswanu.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.124.97.102
country_id: 2245662
description:
Dec 23 07:04:21 host2 sshd[308512]: Disconnected from invalid user steam 154.124.97.102 port 35893 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.154.206.139
country_id: 6252001
description:
Dec 23 07:04:38 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=165.154.206.139, lip=66.85.158.92, session=<PakGjJRGIoqlms6L>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 165.154.206.139
country_id: 6252001
description:
Dec 23 07:04:39 host2 dovecot[3805015]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=165.154.206.139, lip=66.85.158.92, session=<ghUXjJRGsoqlms6L>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.129.230.30
country_id: 1814991
description:
2025-12-23 07:04:45 dovecot_plain authenticator failed for H=(localhost) [8.129.230.30]:44236: 535 Incorrect authentication data (set_id=office@nsteeleng.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.232.73.130
country_id: 1269750
description:
2025-12-23 07:06:03 dovecot_login authenticator failed for H=([1.7.229.162]) [136.232.73.130]:55838: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.124.97.102
country_id: 2245662
description:
Dec 23 07:05:26 host2 sshd[310145]: Disconnected from invalid user admin 154.124.97.102 port 57326 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.222.146
country_id: 3996063
description:
2025-12-23 07:06:17 dovecot_login authenticator failed for H=(187.161.222.146-clientes-izzi.mx) [187.161.222.146]:55540: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.124.97.102
country_id: 2245662
description:
Dec 23 07:06:34 host2 sshd[311558]: Disconnected from invalid user ftpuser 154.124.97.102 port 56246 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 35.216.156.249
country_id: 2658434
description:
Dec 23 07:08:56 host2 pure-ftpd[314663]: (?@35.216.156.249) [INFO] New connection from 35.216.156.249


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.10.125
country_id: 3144096
description:
2025-12-23 07:08:56 dovecot_login authenticator failed for H=([84.211.10.125]) [84.211.10.125]:55247: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 35.216.156.249
country_id: 2658434
description:
Dec 23 07:09:00 host2 pure-ftpd[314765]: (?@35.216.156.249) [INFO] New connection from 35.216.156.249


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.116.199.47
country_id: 1269750
description:
2025-12-23 07:08:31 dovecot_plain authenticator failed for H=(localhost) [66.116.199.47]:55934: 535 Incorrect authentication data (set_id=admin@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.136.38
country_id: 3996063
description:
2025-12-23 07:08:42 dovecot_login authenticator failed for H=(187.161.136.38-clientes-izzi.mx) [187.161.136.38]:43247: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.223.64
country_id: 1880251
description:
Dec 23 07:09:12 host2 sshd[314983]: Disconnected from invalid user admin 45.78.223.64 port 48256 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.164.1.102
country_id: 1605651
description:
2025-12-23 07:11:41 dovecot_plain authenticator failed for H=(localhost) [43.164.1.102]:44950: 535 Incorrect authentication data (set_id=contact@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.6.195.206
country_id: 6252001
description:
2025-12-23 07:12:30 dovecot_plain authenticator failed for H=(localhost) [50.6.195.206]:34158: 535 Incorrect authentication data (set_id=office@ceylondigest.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 135.119.112.96
country_id: 6252001
description:
Dec 23 07:15:14 host2 pure-ftpd[323177]: (?@135.119.112.96) [INFO] New connection from 135.119.112.96


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 118.193.44.203
country_id: 1819730
description:
Dec 23 07:15:33 host2 pure-ftpd[323591]: (?@118.193.44.203) [INFO] New connection from 118.193.44.203


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.223.64
country_id: 1880251
description:
Dec 23 07:15:43 host2 sshd[323602]: Disconnected from invalid user salim 45.78.223.64 port 45798 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.9.247.58
country_id: 3469034
description:
2025-12-23 07:17:01 dovecot_login authenticator failed for H=(200-153-121-1.customer.tdatabrasil.net.br) [187.9.247.58]:40756: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.252.26
country_id: 3865483
description:
Dec 23 07:17:12 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 25 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=179.0.252.26, lip=66.85.158.91, TLS, session=<SxB5t5RG6d2zAPwa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 95.0.32.90
country_id: 298795
description:
Dec 23 07:17:32 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=95.0.32.90, lip=66.85.158.91, TLS, session=<x2cOuZRGsY5fACBa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.166.235.107
country_id: 1880251
description:
2025-12-23 07:18:04 dovecot_plain authenticator failed for H=(localhost) [188.166.235.107]:53626: 535 Incorrect authentication data (set_id=admin@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.227.136.122
country_id: 1269750
description:
2025-12-23 07:19:12 dovecot_plain authenticator failed for H=(localhost) [64.227.136.122]:45812: 535 Incorrect authentication data (set_id=office@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.227.136.122
country_id: 1269750
description:
2025-12-23 07:19:20 dovecot_plain authenticator failed for H=(localhost) [64.227.136.122]:52168: 535 Incorrect authentication data (set_id=office@essenceceylontea.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.198.131.159
country_id: 6252001
description:
Dec 23 07:20:57 host2 sshd[329990]: Invalid user cloudtourssrilan_travel from 124.198.131.159 port 62799


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.222.157
country_id: 3996063
description:
2025-12-23 07:21:56 dovecot_login authenticator failed for H=(187.161.222.157-clientes-izzi.mx) [187.161.222.157]:42257: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.190.75.132
country_id: 3469034
description:
Dec 23 07:21:54 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<gihan>, method=PLAIN, rip=177.190.75.132, lip=66.85.158.91, TLS, session=<W0GcyJRGQ+2xvkuE>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.136.18
country_id: 3996063
description:
2025-12-23 07:22:07 dovecot_login authenticator failed for H=(187.161.136.18-clientes-izzi.mx) [187.161.136.18]:50266: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.250.223
country_id: 3865483
description:
Dec 23 07:21:33 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=179.0.250.223, lip=66.85.158.91, TLS, session=<YbBVx5RGSZazAPrf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.131.211.168
country_id: 690791
description:
2025-12-23 07:23:10 dovecot_login authenticator failed for H=([94.131.211.168]) [94.131.211.168]:53802: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.68.52.210
country_id: 1269750
description:
2025-12-23 07:22:26 dovecot_login authenticator failed for H=([103.68.52.210]) [103.68.52.210]:42664: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.138.59.242
country_id: 6252001
description:
2025-12-23 07:23:36 dovecot_plain authenticator failed for H=(localhost) [174.138.59.242]:18284: 535 Incorrect authentication data (set_id=admin@sivagnanamfoundation.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 23 07:25:08 host2 pure-ftpd[333956]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.99.8.95
country_id: 6252001
description:
2025-12-23 07:25:17 dovecot_plain authenticator failed for H=(localhost) [167.99.8.95]:23330: 535 Incorrect authentication data (set_id=help@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.132.4.108
country_id: 3932488
description:
2025-12-23 07:26:40 dovecot_plain authenticator failed for H=(localhost) [161.132.4.108]:58970: 535 Incorrect authentication data (set_id=test@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.59.4.36
country_id: 1269750
description:
2025-12-23 07:27:43 dovecot_login authenticator failed for H=(cityzone-36-4-59-103.cityzoneinfo.com) [103.59.4.36]:44550: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.140.54
country_id: 1269750
description:
2025-12-23 07:29:02 dovecot_login authenticator failed for H=(dsl-mp-dynamic-054.140.23.125.airtelbroadband.in) [125.23.140.54]:46702: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.113.10
country_id: 1269750
description:
2025-12-23 07:28:20 dovecot_login authenticator failed for H=([27.123.113.10]) [27.123.113.10]:39234: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.73.190.94
country_id: 2542007
description:
2025-12-23 07:28:41 dovecot_login authenticator failed for H=([105.73.190.94]) [105.73.190.94]:41750: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.27.76.210
country_id: 3469034
description:
2025-12-23 07:29:20 dovecot_login authenticator failed for H=(187-8-89-120.customer.tdatabrasil.net.br) [177.27.76.210]:38190: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.112.148.66
country_id: 130758
description:
2025-12-23 07:29:42 dovecot_login authenticator failed for H=([185.112.148.66]) [185.112.148.66]:39885: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.52
country_id: 6252001
description:
Dec 23 07:29:57 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.52, lip=66.85.158.91, TLS handshaking: Connection closed, session=<2q2R5pRGTnBBMQE0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.52
country_id: 6252001
description:
Dec 23 07:30:14 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.52, lip=66.85.158.91, TLS handshaking: Connection closed, session=</uSY55RGcMZBMQE0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.59
country_id: 6252001
description:
Dec 23 07:32:36 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=167.94.146.59, lip=66.85.158.91, TLS: Connection closed, session=</McP8JRG1v2nXpI7>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.178.141.222
country_id: 3017382
description:
Dec 23 07:34:05 host2 sshd[343096]: Disconnected from invalid user emma 51.178.141.222 port 44902 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 154.198.163.6
country_id: 241170
description:
Dec 23 07:34:36 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=154.198.163.6, lip=66.85.158.92, session=<vrU295RGYJ2axqMG>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 154.198.163.6
country_id: 241170
description:
Dec 23 07:36:06 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=154.198.163.6, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<1xaI/JRGaNSaxqMG>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.178.141.222
country_id: 3017382
description:
Dec 23 07:35:15 host2 sshd[344303]: Disconnected from invalid user infra 51.178.141.222 port 44634 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 13.68.214.34
country_id: 6252001
description:
2025-12-23 07:36:16 dovecot_login authenticator failed for H=([13.68.214.34]) [13.68.214.34]:34218: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.88.19.82
country_id: 6252001
description:
2025-12-23 07:36:22 dovecot_plain authenticator failed for H=(localhost) [47.88.19.82]:41776: 535 Incorrect authentication data (set_id=contact@dataesite.lk)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.251
country_id: 2635167
description:
Dec 23 07:36:37 host2 dovecot[3805015]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=87.236.176.251, lip=66.85.158.91, TLS, session=<cFBq/pRGGeVX7LD7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.162
country_id: 2635167
description:
Dec 23 07:36:38 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.162, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<NTx9/pRG74BX7LCi>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.166
country_id: 1269750
description:
2025-12-23 07:36:41 dovecot_login authenticator failed for H=([182.95.181.166]) [182.95.181.166]:45262: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.196.11.232
country_id: 2658434
description:
Dec 23 07:37:14 host2 sshd[345937]: Disconnected from invalid user jorge 185.196.11.232 port 35228 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.153
country_id: 2635167
description:
Dec 23 07:37:12 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=87.236.176.153, lip=66.85.158.91, TLS handshaking: Connection closed, session=<Ovx5AJVGmeNX7LCZ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.59.157
country_id: 3277605
description:
2025-12-23 07:37:16 dovecot_login authenticator failed for H=([195.222.59.157]) [195.222.59.157]:47750: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.11
country_id: 1733045
description:
2025-12-23 07:37:35 dovecot_login authenticator failed for H=([49.124.151.11]) [49.124.151.11]:52610: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.148
country_id: 2635167
description:
Dec 23 07:37:45 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed: read(size=679) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.148, lip=66.85.158.91, TLS handshaking: read(size=679) failed: Connection reset by peer, session=<v+91ApVGdexX7LCU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.186.147.126
country_id: 1880251
description:
2025-12-23 07:37:59 dovecot_plain authenticator failed for H=126.147.186.35.bc.googleusercontent.com (localhost) [35.186.147.126]:60872: 535 Incorrect authentication data (set_id=help@seyawin.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.168
country_id: 2635167
description:
Dec 23 07:38:18 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=87.236.176.168, lip=66.85.158.91, TLS handshaking: Connection closed, session=<BKByBJVG64hX7LCo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.166
country_id: 2635167
description:
Dec 23 07:38:52 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed: read(size=612) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.166, lip=66.85.158.91, TLS handshaking: read(size=612) failed: Connection reset by peer, session=<qyNvBpVGA6C594mm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.157
country_id: 2635167
description:
Dec 23 07:39:59 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=185.247.137.157, lip=66.85.158.91, TLS handshaking: Connection closed, session=<SHFsCpVGlZS594md>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.156
country_id: 2635167
description:
Dec 23 07:39:25 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=185.247.137.156, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=</5toCJVGNce594mc>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.159
country_id: 2635167
description:
Dec 23 07:41:05 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=87.236.176.159, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<289dDpVGO89X7LCf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.180
country_id: 2635167
description:
Dec 23 07:40:32 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=185.247.137.180, lip=66.85.158.91, TLS handshaking: Connection closed, session=<teRjDJVG0Zu594m0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.11.153.57
country_id: 1643084
description:
2025-12-23 07:41:31 dovecot_plain authenticator failed for H=(localhost) [113.11.153.57]:41790: 535 Incorrect authentication data (set_id=admin@sobaherbal.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.178
country_id: 2635167
description:
Dec 23 07:41:38 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=185.247.137.178, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<0FhaEJVGk5W594my>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.35
country_id: 1733045
description:
2025-12-23 07:43:13 dovecot_login authenticator failed for H=([49.124.153.35]) [49.124.153.35]:46724: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.12.159
country_id: 3144096
description:
2025-12-23 07:42:17 dovecot_login authenticator failed for H=(cm-84.211.12.159.get.no) [84.211.12.159]:42895: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 80.82.77.202
country_id: 2750405
description:
Dec 23 07:42:21 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=80.82.77.202, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<UtrhEpVGYOpQUk3K>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.253.122
country_id: 1269750
description:
2025-12-23 07:42:49 dovecot_login authenticator failed for H=([128.185.253.122]) [128.185.253.122]:52734: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.210.151.158
country_id: 3144096
description:
2025-12-23 07:42:49 dovecot_login authenticator failed for H=([84.210.151.158]) [84.210.151.158]:33297: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.157.142.117
country_id: 1227603
description:
[2025-12-23 07:42:54 +0530] info [cpaneld] 175.157.142.117 - jrdclk "GET / HTTP/1.1" DEFERRED LOGIN cpaneld: security token missing


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.157.142.117
country_id: 1227603
description:
[2025-12-23 07:44:30 +0530] info [cpaneld] 175.157.142.117 - jrdclk "GET / HTTP/1.1" DEFERRED LOGIN cpaneld: security token missing


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.166.235.107
country_id: 1880251
description:
2025-12-23 07:45:14 dovecot_plain authenticator failed for H=(localhost) [188.166.235.107]:49088: 535 Incorrect authentication data (set_id=admin@melanifinefood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.126.144.30
country_id: 6252001
description:
2025-12-23 07:46:03 dovecot_login authenticator failed for H=ool-457e901e.dyn.optonline.net [69.126.144.30]:52945: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.166.235.107
country_id: 1880251
description:
2025-12-23 07:45:23 dovecot_plain authenticator failed for H=(localhost) [188.166.235.107]:51288: 535 Incorrect authentication data (set_id=admin@melanifinefood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.61.131.129
country_id: 2510769
description:
2025-12-23 07:45:41 dovecot_login authenticator failed for H=129.red-83-61-131.dynamicip.rima-tde.net [83.61.131.129]:50899: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.232.179.250
country_id: 1269750
description:
2025-12-23 07:48:44 dovecot_plain authenticator failed for H=(localhost) [165.232.179.250]:49164: 535 Incorrect authentication data (set_id=test@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.53.197.53
country_id: 2921044
description:
2025-12-23 07:51:47 dovecot_plain authenticator failed for H=v2202507289313365218.goodsrv.de (localhost) [152.53.197.53]:50482: 535 Incorrect authentication data (set_id=help@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.101.16.250
country_id: 272103
description:
2025-12-23 07:53:18 dovecot_login authenticator failed for H=([185.101.16.250]) [185.101.16.250]:41833: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 132.148.72.41
country_id: 6252001
description:
2025-12-23 07:53:35 dovecot_plain authenticator failed for H=41.72.148.132.host.secureserver.net (localhost) [132.148.72.41]:33358: 535 Incorrect authentication data (set_id=news@dataesite.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.202.250.46
country_id: 3469034
description:
2025-12-23 07:53:47 dovecot_login authenticator failed for H=([200.202.250.46]) [200.202.250.46]:49379: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.27
country_id: 3144096
description:
2025-12-23 07:54:38 dovecot_login authenticator failed for H=(cm-84.213.189.27.get.no) [84.213.189.27]:60002: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.56.0.19
country_id: 3469034
description:
2025-12-23 07:54:59 dovecot_login authenticator failed for H=([200.148.171.233]) [189.56.0.19]:34304: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.56
country_id: 1733045
description:
2025-12-23 07:54:22 dovecot_login authenticator failed for H=([49.124.151.56]) [49.124.151.56]:47420: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.50.155
country_id: 1269750
description:
2025-12-23 07:54:23 dovecot_login authenticator failed for H=(abts-north-static-155.50.160.122.airtelbroadband.in) [122.160.50.155]:41826: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 188.166.169.197
country_id: 2635167
description:
Dec 23 07:56:38 host2 pure-ftpd[366202]: (?@188.166.169.197) [INFO] New connection from 188.166.169.197


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.116.199.47
country_id: 1269750
description:
2025-12-23 07:56:55 dovecot_plain authenticator failed for H=(localhost) [66.116.199.47]:49782: 535 Incorrect authentication data (set_id=admin@mathsmotorcysle.xyz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.147.131.177
country_id: 1814991
description:
2025-12-23 07:58:39 dovecot_plain authenticator failed for H=(localhost) [8.147.131.177]:51958: 535 Incorrect authentication data (set_id=hr@sivagnanamfoundation.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.74.148
country_id: 1269750
description:
2025-12-23 07:59:06 dovecot_plain authenticator failed for H=(localhost) [139.59.74.148]:38298: 535 Incorrect authentication data (set_id=office@venee.lk)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 188.166.169.197
country_id: 2635167
description:
Dec 23 08:01:47 host2 pure-ftpd[372896]: (?@188.166.169.197) [INFO] New connection from 188.166.169.197


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.39.92.35
country_id: 6252001
description:
[2025-12-23 08:01:53 +0530] info [cpaneld] 68.39.92.35 - dragon "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 192.111.129.146
country_id: 6252001
description:
[2025-12-23 08:02:22 +0530] info [webmaild] 192.111.129.146 - info@sysnytech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 163.182.174.251
country_id: 6252001
description:
2025-12-23 08:04:43 dovecot_plain authenticator failed for H=163-182-174-251.static.as40244.net (localhost) [163.182.174.251]:50706: 535 Incorrect authentication data (set_id=support@anandaobauae.org)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.227.254.156
country_id: 3703430
description:
Dec 23 08:06:25 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=45.227.254.156, lip=66.85.158.92, session=<TAr8aJVGD/4t4/6c>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.33.186.151
country_id: 3686110
description:
Dec 23 08:07:05 host2 sshd[378993]: Disconnected from invalid user guest 179.33.186.151 port 51658 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.33.186.151
country_id: 3686110
description:
Dec 23 08:07:57 host2 sshd[379964]: Disconnected from invalid user testuser 179.33.186.151 port 13353 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.199.118.234
country_id: 1880251
description:
2025-12-23 08:08:44 dovecot_login authenticator failed for H=(448990.cloudwaysapps.com) [128.199.118.234]:27294: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.239.164.55
country_id: 3996063
description:
2025-12-23 08:08:55 dovecot_login authenticator failed for H=([177.239.164.55]) [177.239.164.55]:59376: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 179.33.186.151
country_id: 3686110
description:
Dec 23 08:08:36 host2 sshd[380603]: Disconnected from invalid user hadoop 179.33.186.151 port 21016 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.192.52
country_id: 1819730
description:
Dec 23 08:09:32 host2 sshd[381487]: Disconnected from invalid user dev 152.32.192.52 port 45346 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.192.52
country_id: 1819730
description:
Dec 23 08:13:06 host2 sshd[385983]: Disconnected from invalid user admin 152.32.192.52 port 47686 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.248.30.205
country_id: 1269750
description:
2025-12-23 08:13:12 dovecot_login authenticator failed for H=([103.248.30.205]) [103.248.30.205]:47689: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.56.34.147
country_id: 6252001
description:
2025-12-23 08:13:13 dovecot_login authenticator failed for H=(136-56-34-147.googlefiber.net) [136.56.34.147]:57124: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.116.204.232
country_id: 1269750
description:
2025-12-23 08:13:21 dovecot_plain authenticator failed for H=(localhost) [66.116.204.232]:43778: 535 Incorrect authentication data (set_id=office@sivagnanamfoundation.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.198.173.137
country_id: 1819730
description:
2025-12-23 08:13:38 dovecot_login authenticator failed for H=137.173.198.203.static.netvigator.com (145.173.198.203.static.netvigator.com) [203.198.173.137]:33386: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.192.52
country_id: 1819730
description:
Dec 23 08:14:10 host2 sshd[386833]: Disconnected from invalid user hadoop 152.32.192.52 port 39106 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.89.116.5
country_id: 6252001
description:
2025-12-23 08:14:36 dovecot_login authenticator failed for H=(70-89-116.5-BusName-WA.hfc.comcastbusiness.net) [70.89.116.5]:35351: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.227.166
country_id: 1269750
description:
2025-12-23 08:15:03 dovecot_login authenticator failed for H=([128.185.227.166]) [128.185.227.166]:53404: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.103.1.102
country_id: 690791
description:
Dec 23 08:16:09 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=176.103.1.102, lip=66.85.158.91, TLS, session=<vlO8ipVGf+mwZwFm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.124.218
country_id: 337996
description:
2025-12-23 08:15:20 dovecot_login authenticator failed for H=([196.189.124.218]) [196.189.124.218]:38014: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.197.9.29
country_id: 3175395
description:
Dec 23 08:16:26 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=185.197.9.29, lip=66.85.158.91, TLS, session=<q//Ti5VGaY65xQkd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.168.234
country_id: 2186224
description:
2025-12-23 08:17:39 dovecot_login authenticator failed for H=([121.73.168.234]) [121.73.168.234]:60958: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.7
country_id: 1733045
description:
2025-12-23 08:18:17 dovecot_login authenticator failed for H=([49.124.151.7]) [49.124.151.7]:44122: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.10.140
country_id: 3144096
description:
2025-12-23 08:21:03 dovecot_login authenticator failed for H=([84.211.10.140]) [84.211.10.140]:48596: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.44.75.122
country_id: 690791
description:
Dec 23 08:21:04 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<gihan>, method=PLAIN, rip=194.44.75.122, lip=66.85.158.91, TLS, session=<2wZVnJVGmL/CLEt6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.104.42
country_id: 1269750
description:
2025-12-23 08:20:40 dovecot_login authenticator failed for H=([27.123.104.42]) [27.123.104.42]:49380: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.138.237.18
country_id: 1269750
description:
2025-12-23 08:20:40 dovecot_plain authenticator failed for H=(localhost) [103.138.237.18]:4619: 535 Incorrect authentication data (set_id=test@nsteeleng.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.28.190.188
country_id: 2510769
description:
Dec 23 08:20:45 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=139.28.190.188, lip=66.85.158.91, TLS, session=<5uJHm5VGZ7mLHL68>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.242.182.159
country_id: 2635167
description:
2025-12-23 08:21:43 dovecot_login authenticator failed for H=host-89-242-182-159.as13285.net [89.242.182.159]:37665: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 178.62.120.151
country_id: 2635167
description:
Dec 23 08:23:00 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=178.62.120.151, lip=66.85.158.91, session=<AT5CpJVGpuGyPniX>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.89.246.144
country_id: 6252001
description:
2025-12-23 08:23:24 dovecot_plain authenticator failed for H=(localhost) [47.89.246.144]:44610: 535 Incorrect authentication data (set_id=hr@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.14.195.218
country_id: 2510769
description:
2025-12-23 08:25:57 dovecot_login authenticator failed for H=218.red-88-14-195.dynamicip.rima-tde.net [88.14.195.218]:37836: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.255.255.26
country_id: 2661886
description:
2025-12-23 08:26:13 dovecot_login authenticator failed for H=94-255-255-26.cust.bredband2.com [94.255.255.26]:46414: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.174
country_id: 1269750
description:
2025-12-23 08:27:31 dovecot_login authenticator failed for H=([182.95.178.174]) [182.95.178.174]:40442: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 23 08:27:57 host2 pure-ftpd[398041]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.29.174
country_id: 1643084
description:
2025-12-23 08:28:26 dovecot_plain authenticator failed for H=(localhost) [103.148.29.174]:55258: 535 Incorrect authentication data (set_id=sales@sivagnanamfoundation.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.227.136.122
country_id: 1269750
description:
2025-12-23 08:29:06 dovecot_plain authenticator failed for H=(localhost) [64.227.136.122]:60756: 535 Incorrect authentication data (set_id=office@essenceceylontea.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 178.62.120.151
country_id: 2635167
description:
Dec 23 08:29:17 host2 dovecot[3805015]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=178.62.120.151, lip=66.85.158.91, session=<H5nFupVGMp2yPniX>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.14
country_id: 241170
description:
Dec 23 08:30:00 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.14, lip=66.85.158.91, session=<RmExvZVG6LPE+2YO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.244.235.242
country_id: 1269750
description:
2025-12-23 08:31:35 dovecot_login authenticator failed for H=(static.ill.117.248.107.130.bsnl.co.in) [115.244.235.242]:39104: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.216.196
country_id: 3996063
description:
2025-12-23 08:32:05 dovecot_login authenticator failed for H=(201.173.216.196-clientes-izzi.mx) [201.173.216.196]:51188: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.211.14.116
country_id: 1269750
description:
2025-12-23 08:31:19 dovecot_login authenticator failed for H=(static.ill.117.211.14.116.bsnl.co.in) [117.211.14.116]:51946: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.12.179
country_id: 1269750
description:
2025-12-23 08:32:27 dovecot_login authenticator failed for H=([128.185.12.179]) [128.185.12.179]:52860: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.154.252.34
country_id: 2635167
description:
Dec 23 08:33:39 host2 pure-ftpd[402952]: (?@165.154.252.34) [INFO] New connection from 165.154.252.34


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.138.59.242
country_id: 6252001
description:
2025-12-23 08:34:13 dovecot_plain authenticator failed for H=(localhost) [174.138.59.242]:59960: 535 Incorrect authentication data (set_id=admin@sivagnanamfoundation.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.140
country_id: 6252001
description:
Dec 23 08:33:21 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=66.132.153.140, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<jjZJyZVG5lBChJmM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.138.59.242
country_id: 6252001
description:
2025-12-23 08:34:19 dovecot_plain authenticator failed for H=(localhost) [174.138.59.242]:11598: 535 Incorrect authentication data (set_id=admin@sivagnanamfoundation.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.195
country_id: 6252001
description:
Dec 23 08:35:15 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=147.185.132.195, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<zysc0JVGDsiTuYTD>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.99.8.95
country_id: 6252001
description:
2025-12-23 08:38:04 dovecot_plain authenticator failed for H=(localhost) [167.99.8.95]:58718: 535 Incorrect authentication data (set_id=help@ceylondigest.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.214
country_id: 2635167
description:
Dec 23 08:39:03 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 45 secs): user=<>, rip=35.203.210.214, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<zBGz3ZVGGt4jy9LW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.214
country_id: 2635167
description:
Dec 23 08:39:45 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 14 secs): user=<>, rip=35.203.210.214, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<uXgo4JVGOPEjy9LW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.129.230.30
country_id: 1814991
description:
2025-12-23 08:41:07 dovecot_plain authenticator failed for H=(localhost) [8.129.230.30]:51268: 535 Incorrect authentication data (set_id=office@nsteeleng.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.132.4.108
country_id: 3932488
description:
2025-12-23 08:40:50 dovecot_plain authenticator failed for H=(localhost) [161.132.4.108]:42782: 535 Incorrect authentication data (set_id=test@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.129.230.30
country_id: 1814991
description:
2025-12-23 08:41:15 dovecot_plain authenticator failed for H=(localhost) [8.129.230.30]:33782: 535 Incorrect authentication data (set_id=office@nsteeleng.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.140.5
country_id: 798549
description:
Dec 23 08:44:37 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=85.217.140.5, lip=66.85.158.91, session=<4ryZ8ZVGBolV2YwF>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.180
country_id: 6252001
description:
Dec 23 08:44:53 host2 pure-ftpd[415135]: (?@147.185.132.180) [INFO] New connection from 147.185.132.180


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.166.235.107
country_id: 1880251
description:
2025-12-23 08:46:13 dovecot_plain authenticator failed for H=(localhost) [188.166.235.107]:44248: 535 Incorrect authentication data (set_id=admin@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.74.148
country_id: 1269750
description:
2025-12-23 08:46:43 dovecot_plain authenticator failed for H=(localhost) [139.59.74.148]:49220: 535 Incorrect authentication data (set_id=office@mathsmotorcysle.xyz)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.214
country_id: 2635167
description:
Dec 23 08:47:09 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=35.203.210.214, lip=66.85.158.91, TLS, session=<Wfmg+pVGsPEjy9LW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.166.235.107
country_id: 1880251
description:
2025-12-23 08:46:21 dovecot_plain authenticator failed for H=(localhost) [188.166.235.107]:60886: 535 Incorrect authentication data (set_id=admin@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.116.199.47
country_id: 1269750
description:
2025-12-23 08:50:22 dovecot_plain authenticator failed for H=(localhost) [66.116.199.47]:51522: 535 Incorrect authentication data (set_id=admin@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-23 08:53:08 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:59182: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.193
country_id: 2635167
description:
Dec 23 08:53:32 host2 dovecot[3805015]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=185.247.137.193, lip=66.85.158.92, TLS, session=<U3x+EZZG9Zy594nB>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.88.19.82
country_id: 6252001
description:
2025-12-23 08:54:08 dovecot_plain authenticator failed for H=(localhost) [47.88.19.82]:58500: 535 Incorrect authentication data (set_id=contact@dataesite.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.246.178
country_id: 1269750
description:
2025-12-23 08:56:29 dovecot_login authenticator failed for H=([182.79.95.139]) [152.52.246.178]:38096: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.170.100.253
country_id: 1269750
description:
2025-12-23 08:56:32 dovecot_login authenticator failed for H=(abts-mum-static-253.100.170.122.airtelbroadband.in) [122.170.100.253]:51264: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.227.70
country_id: 1269750
description:
2025-12-23 08:56:52 dovecot_login authenticator failed for H=([182.95.215.9]) [182.95.227.70]:33736: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.199
country_id: 6252001
description:
Dec 23 09:00:00 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.235.24.199, lip=66.85.158.92, session=<KTCeKJZGGPDG6xjH>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.231.6
country_id: 1269750
description:
2025-12-23 09:01:25 dovecot_login authenticator failed for H=([128.185.231.6]) [128.185.231.6]:50480: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.143.159
country_id: 99237
description:
2025-12-23 09:01:08 dovecot_login authenticator failed for H=([65.20.143.159]) [65.20.143.159]:42108: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.186.147.126
country_id: 1880251
description:
2025-12-23 09:01:31 dovecot_plain authenticator failed for H=126.147.186.35.bc.googleusercontent.com (localhost) [35.186.147.126]:12384: 535 Incorrect authentication data (set_id=help@seyawin.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.170.57.236
country_id: 6252001
description:
[2025-12-23 09:03:06 +0530] info [webmaild] 98.170.57.236 - info@sivagnanamfoundation.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.164.1.102
country_id: 1605651
description:
2025-12-23 09:04:14 dovecot_plain authenticator failed for H=(localhost) [43.164.1.102]:57644: 535 Incorrect authentication data (set_id=contact@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.126.146
country_id: 3144096
description:
2025-12-23 09:05:01 dovecot_login authenticator failed for H=(cm-178.232.126.146.get.no) [178.232.126.146]:57091: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.192.166
country_id: 1269750
description:
2025-12-23 09:05:15 dovecot_login authenticator failed for H=(aes-static-025.20.22.125.airtel.in) [128.185.192.166]:41618: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.103.100.170
country_id: 2542007
description:
2025-12-23 09:06:43 dovecot_plain authenticator failed for H=(DESKTOP-7JPG7RH.home) [102.103.100.170]:64625: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.11.153.57
country_id: 1643084
description:
2025-12-23 09:08:18 dovecot_plain authenticator failed for H=(localhost) [113.11.153.57]:60692: 535 Incorrect authentication data (set_id=admin@sobaherbal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.53.197.53
country_id: 2921044
description:
2025-12-23 09:08:46 dovecot_plain authenticator failed for H=v2202507289313365218.goodsrv.de (localhost) [152.53.197.53]:33266: 535 Incorrect authentication data (set_id=help@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 132.148.72.41
country_id: 6252001
description:
2025-12-23 09:09:45 dovecot_plain authenticator failed for H=41.72.148.132.host.secureserver.net (localhost) [132.148.72.41]:39822: 535 Incorrect authentication data (set_id=news@dataesite.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.166.235.107
country_id: 1880251
description:
2025-12-23 09:13:15 dovecot_plain authenticator failed for H=(localhost) [188.166.235.107]:45030: 535 Incorrect authentication data (set_id=admin@melanifinefood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 163.182.174.251
country_id: 6252001
description:
2025-12-23 09:15:00 dovecot_plain authenticator failed for H=163-182-174-251.static.as40244.net (localhost) [163.182.174.251]:41240: 535 Incorrect authentication data (set_id=support@anandaobauae.org)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.74.240.222
country_id: 2510769
description:
Dec 23 09:15:12 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=185.74.240.222, lip=66.85.158.91, TLS, session=<f9bjXZZGxsW5SvDe>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.210.37.16
country_id: 390903
description:
2025-12-23 09:14:49 dovecot_login authenticator failed for H=(149-210-37-16.mobile.nym.cosmote.net) [149.210.37.16]:59102: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.193.122.91
country_id: 690791
description:
2025-12-23 09:14:48 dovecot_login authenticator failed for H=(82.193.122.91.cl.ipnet.ua) [82.193.122.91]:44684: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.181.109.110
country_id: 3865483
description:
Dec 23 09:15:34 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=190.181.109.110, lip=66.85.158.91, TLS, session=<RpEdX5ZG/4u+tW1u>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.192.57.118
country_id: 1880251
description:
2025-12-23 09:15:56 dovecot_login authenticator failed for H=(bb151-192-57-118.singnet.com.sg) [151.192.57.118]:53027: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.156.46
country_id: 1269750
description:
2025-12-23 09:16:23 dovecot_login authenticator failed for H=([125.19.156.46]) [125.19.156.46]:36458: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.232.179.250
country_id: 1269750
description:
2025-12-23 09:17:40 dovecot_plain authenticator failed for H=(localhost) [165.232.179.250]:51626: 535 Incorrect authentication data (set_id=test@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.182.130
country_id: 1269750
description:
2025-12-23 09:18:33 dovecot_login authenticator failed for H=(mail1.i-megh.com) [182.95.182.130]:42760: 535 Incorrect authentication data (set_id=accounts@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.23.72.144
country_id: 6252001
description:
2025-12-23 09:18:47 dovecot_login authenticator failed for H=([209.23.72.144]) [209.23.72.144]:34998: 535 Incorrect authentication data (set_id=accounts)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.59.6.176
country_id: 298795
description:
2025-12-23 09:20:14 dovecot_login authenticator failed for H=([188.59.6.176]) [188.59.6.176]:59915: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.183.92.238
country_id: 3469034
description:
Dec 23 09:20:21 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<gihan>, method=PLAIN, rip=45.183.92.238, lip=66.85.158.91, TLS, session=<hfxBcJZGbYstt1zu>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.225.114
country_id: 1269750
description:
2025-12-23 09:19:42 dovecot_login authenticator failed for H=([128.185.247.231]) [182.95.225.114]:35906: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.5.108.126
country_id: 2186224
description:
Dec 23 09:20:00 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=103.5.108.126, lip=66.85.158.91, TLS, session=<dIrtbpZGQrtnBWx+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.98.71
country_id: 3144096
description:
2025-12-23 09:20:31 dovecot_login authenticator failed for H=(cm-46.212.98.71.get.no) [46.212.98.71]:35390: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.155.27.128
country_id: 2802361
description:
2025-12-23 09:20:31 dovecot_login authenticator failed for H=128.27.155.104.bc.googleusercontent.com [104.155.27.128]:65409: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.219.149.74
country_id: 2328926
description:
2025-12-23 09:20:39 dovecot_login authenticator failed for H=(netcomafrica.com) [41.219.149.74]:26680: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.220.236.203
country_id: 660013
description:
2025-12-23 09:20:59 dovecot_login authenticator failed for H=([62.220.236.203]) [62.220.236.203]:55402: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.210.105.202
country_id: 3175395
description:
2025-12-23 09:21:27 dovecot_login authenticator failed for H=95-210-105-202.ip.skylogicnet.com [95.210.105.202]:61386: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.85.38
country_id: 1269750
description:
2025-12-23 09:22:02 dovecot_login authenticator failed for H=([182.79.85.38]) [182.79.85.38]:45632: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.22
country_id: 1269750
description:
2025-12-23 09:21:45 dovecot_login authenticator failed for H=([122.184.136.185]) [182.95.181.22]:42838: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 143.198.32.224
country_id: 6251999
description:
Dec 23 09:24:03 host2 pure-ftpd[448529]: (?@143.198.32.224) [INFO] New connection from 143.198.32.224


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 23 09:24:41 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<OQ7bgJZGpKMDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 23 09:26:12 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS handshaking: Connection closed, session=<Ho5OhpZGxtoDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 23 09:26:56 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS handshaking: Connection closed, session=<B9voiJZGfoIDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 23 09:27:34 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (disconnected before auth was ready, waited 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<JWg1i5ZGjM0DhBfJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.16.99
country_id: 3144096
description:
2025-12-23 09:30:09 dovecot_login authenticator failed for H=([127.0.0.1]) [178.232.16.99]:33469: 535 Incorrect authentication data (set_id=kasunp)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 143.198.32.224
country_id: 6251999
description:
Dec 23 09:30:09 host2 pure-ftpd[453675]: (?@143.198.32.224) [INFO] New connection from 143.198.32.224


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 23 09:29:58 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS, session=<UnnGk5ZGIpkDhBfJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.84.31
country_id: 3996063
description:
2025-12-23 09:30:01 dovecot_login authenticator failed for H=([127.0.0.1]) [187.161.84.31]:54277: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 23 09:30:30 host2 pure-ftpd[453930]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 23 09:30:43 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (disconnected before auth was ready, waited 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<cph6lpZGzpIDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 23 09:32:13 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS handshaking: Connection closed, session=<PqzRm5ZG4JoDhBfJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.147.131.177
country_id: 1814991
description:
2025-12-23 09:33:17 dovecot_plain authenticator failed for H=(localhost) [8.147.131.177]:39414: 535 Incorrect authentication data (set_id=hr@sivagnanamfoundation.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 23 09:32:53 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS handshaking: Connection closed, session=<XoIwnpZGioYDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 23 09:34:18 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS, session=<lOQ9o5ZG/McDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 23 09:34:36 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS, session=<WUtRpJZGVIIDhBfJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.116.204.232
country_id: 1269750
description:
2025-12-23 09:35:53 dovecot_plain authenticator failed for H=(localhost) [66.116.204.232]:42276: 535 Incorrect authentication data (set_id=office@sivagnanamfoundation.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.163.61.91
country_id: 6252001
description:
Dec 23 09:37:16 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.163.61.91, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<enncrZZGKJ4Uoz1b>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 23 09:38:20 host2 sshd[459632]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.116.199.47
country_id: 1269750
description:
2025-12-23 09:39:09 dovecot_plain authenticator failed for H=(localhost) [66.116.199.47]:34266: 535 Incorrect authentication data (set_id=admin@mathsmotorcysle.xyz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.227.136.122
country_id: 1269750
description:
2025-12-23 09:39:41 dovecot_plain authenticator failed for H=(localhost) [64.227.136.122]:60472: 535 Incorrect authentication data (set_id=office@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.166
country_id: 1269750
description:
2025-12-23 09:40:21 dovecot_login authenticator failed for H=([182.95.181.166]) [182.95.181.166]:37956: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.111.114
country_id: 1269750
description:
2025-12-23 09:40:40 dovecot_login authenticator failed for H=([128.185.223.219]) [27.123.111.114]:49706: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.89.246.144
country_id: 6252001
description:
2025-12-23 09:42:51 dovecot_plain authenticator failed for H=(localhost) [47.89.246.144]:55708: 535 Incorrect authentication data (set_id=hr@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.159.188
country_id: 1733045
description:
2025-12-23 09:44:14 dovecot_login authenticator failed for H=([49.124.159.188]) [49.124.159.188]:49356: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.138.59.242
country_id: 6252001
description:
2025-12-23 09:44:23 dovecot_plain authenticator failed for H=(localhost) [174.138.59.242]:50056: 535 Incorrect authentication data (set_id=admin@sivagnanamfoundation.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.194
country_id: 1269750
description:
2025-12-23 09:43:30 dovecot_login authenticator failed for H=(nsg-static-217.97.72.182.airtel.in) [182.95.228.194]:45008: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.0.63.226
country_id: 3686110
description:
Dec 23 09:44:09 host2 sshd[463953]: Disconnected from invalid user julien 190.0.63.226 port 37942 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.75.42
country_id: 1149361
description:
2025-12-23 09:45:20 dovecot_login authenticator failed for H=([180.94.75.42]) [180.94.75.42]:55831: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.138.59.242
country_id: 6252001
description:
2025-12-23 09:44:30 dovecot_plain authenticator failed for H=(localhost) [174.138.59.242]:30526: 535 Incorrect authentication data (set_id=admin@sivagnanamfoundation.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.0.63.226
country_id: 3686110
description:
Dec 23 09:45:42 host2 sshd[465579]: Disconnected from invalid user eacadm 190.0.63.226 port 59274 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.161.232.9
country_id: 6252001
description:
2025-12-23 09:45:48 dovecot_login authenticator failed for H=ip98-161-232-9.ph.ph.cox.net [98.161.232.9]:36124: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 190.0.63.226
country_id: 3686110
description:
Dec 23 09:47:05 host2 sshd[466518]: Disconnected from invalid user hadi 190.0.63.226 port 55430 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.138.237.18
country_id: 1269750
description:
2025-12-23 09:48:13 dovecot_plain authenticator failed for H=(localhost) [103.138.237.18]:5047: 535 Incorrect authentication data (set_id=test@nsteeleng.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 147.50.227.79
country_id: 1605651
description:
Dec 23 09:48:15 host2 sshd[467618]: Disconnected from invalid user openhabian 147.50.227.79 port 46240 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.135.139
country_id: 1819730
description:
Dec 23 09:49:09 host2 sshd[468508]: Disconnected from invalid user onkar 152.32.135.139 port 44682 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.74.148
country_id: 1269750
description:
2025-12-23 09:49:14 dovecot_plain authenticator failed for H=(localhost) [139.59.74.148]:53106: 535 Incorrect authentication data (set_id=office@venee.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.92.14.191
country_id: 1819730
description:
Dec 23 09:49:27 host2 sshd[468761]: Disconnected from invalid user ria 154.92.14.191 port 39830 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.68.52.210
country_id: 1269750
description:
2025-12-23 09:48:32 dovecot_login authenticator failed for H=([103.68.52.210]) [103.68.52.210]:59690: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.85.202
country_id: 337996
description:
2025-12-23 09:48:57 dovecot_login authenticator failed for H=([196.191.212.235]) [213.55.85.202]:3976: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.149.27.208
country_id: 1819730
description:
Dec 23 09:49:33 host2 sshd[468846]: Disconnected from invalid user mc 103.149.27.208 port 50528 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.99.8.95
country_id: 6252001
description:
2025-12-23 09:50:05 dovecot_plain authenticator failed for H=(localhost) [167.99.8.95]:29134: 535 Incorrect authentication data (set_id=help@ceylondigest.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 147.50.227.79
country_id: 1605651
description:
Dec 23 09:50:14 host2 sshd[469561]: Disconnected from invalid user rootuser 147.50.227.79 port 42248 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.135.139
country_id: 1819730
description:
Dec 23 09:50:21 host2 sshd[469701]: Disconnected from invalid user anything 152.32.135.139 port 44358 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.30.170
country_id: 3144096
description:
2025-12-23 09:51:00 dovecot_login authenticator failed for H=([178.232.30.170]) [178.232.30.170]:60272: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.84.34.85
country_id: 1210997
description:
2025-12-23 09:51:17 dovecot_login authenticator failed for H=(ppp075.bol-online.com) [202.84.34.85]:57774: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.11
country_id: 241170
description:
Dec 23 09:51:21 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.11, lip=66.85.158.91, session=<p7ob4JZGBoLE+2YL>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.135.139
country_id: 1819730
description:
Dec 23 09:52:12 host2 sshd[471233]: Disconnected from invalid user eacadm 152.32.135.139 port 33046 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.92.14.191
country_id: 1819730
description:
Dec 23 09:52:31 host2 sshd[471552]: Disconnected from invalid user wafer 154.92.14.191 port 60130 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.149.27.208
country_id: 1819730
description:
Dec 23 09:53:22 host2 sshd[472149]: Disconnected from invalid user rootuser 103.149.27.208 port 38740 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.191.211.33
country_id: 6252001
description:
2025-12-23 09:53:27 dovecot_login authenticator failed for H=([65.191.211.33]) [65.191.211.33]:57206: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 40.124.175.174
country_id: 6252001
description:
Dec 23 09:56:08 host2 pure-ftpd[475392]: (?@40.124.175.174) [INFO] New connection from 40.124.175.174


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.69.15.132
country_id: 2510769
description:
2025-12-23 09:56:20 dovecot_login authenticator failed for H=(109-69-15-132.puntdacces.coop) [109.69.15.132]:53940: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.92.14.191
country_id: 1819730
description:
Dec 23 09:55:28 host2 sshd[474720]: Disconnected from invalid user web 154.92.14.191 port 52184 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.149.27.208
country_id: 1819730
description:
Dec 23 09:55:39 host2 sshd[475025]: Disconnected from invalid user kira 103.149.27.208 port 37882 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.87.18
country_id: 1269750
description:
2025-12-23 09:56:39 dovecot_login authenticator failed for H=([182.79.87.18]) [182.79.87.18]:50204: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.70.134
country_id: 1819730
description:
2025-12-23 09:57:37 dovecot_login authenticator failed for H=42-200-70-134.static.imsbiz.com [42.200.70.134]:48736: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.38.3.179
country_id: 2215636
description:
2025-12-23 09:57:49 dovecot_login authenticator failed for H=([102.38.3.179]) [102.38.3.179]:35374: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.66
country_id: 6252001
description:
Dec 23 09:59:17 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=147.185.132.66, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<2q+c/JZGZ8WTuYRC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.17
country_id: 241170
description:
Dec 23 10:00:05 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.17, lip=66.85.158.91, session=<oJRW/5ZG0LzE+2YR>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.16
country_id: 241170
description:
Dec 23 10:00:20 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.16, lip=66.85.158.91, session=<UZ1GAJdGirLE+2YQ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.90.33.23
country_id: 3469034
description:
Dec 23 10:01:05 host2 sshd[479874]: Disconnected from invalid user tom 189.90.33.23 port 39528 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.47.10.118
country_id: 3469034
description:
Dec 23 10:01:38 host2 sshd[480341]: Disconnected from invalid user hadi 189.47.10.118 port 43300 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 189.90.33.23
country_id: 3469034
description:
Dec 23 10:03:05 host2 sshd[481750]: Disconnected from invalid user couchdb 189.90.33.23 port 45722 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.90.33.23
country_id: 3469034
description:
Dec 23 10:02:24 host2 sshd[481055]: Disconnected from invalid user sybase 189.90.33.23 port 60050 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.90.33.23
country_id: 3469034
description:
Dec 23 10:03:46 host2 sshd[482351]: Disconnected from invalid user cron 189.90.33.23 port 59646 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.53.132.193
country_id: 3469034
description:
Dec 23 10:04:20 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=191.53.132.193, lip=66.85.158.91, TLS, session=<NzyaDZdGtei/NYTB>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.90.33.23
country_id: 3469034
description:
Dec 23 10:04:29 host2 sshd[483390]: Disconnected from invalid user smbuser 189.90.33.23 port 45370 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.36.202.177
country_id: 3469034
description:
Dec 23 10:04:40 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<gihan>, method=PLAIN, rip=138.36.202.177, lip=66.85.158.91, TLS, session=<gq/JDpdGJZiKJMqx>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.7.163.154
country_id: 1643084
description:
2025-12-23 10:08:01 dovecot_plain authenticator failed for H=(localhost) [114.7.163.154]:43354: 535 Incorrect authentication data (set_id=office@essenceceylontea.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.47.10.118
country_id: 3469034
description:
Dec 23 10:07:36 host2 sshd[487363]: Disconnected from invalid user user 189.47.10.118 port 40118 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.56.0.19
country_id: 3469034
description:
2025-12-23 10:07:38 dovecot_login authenticator failed for H=(189-56-0-19.customer.tdatabrasil.net.br) [189.56.0.19]:34246: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.237.191
country_id: 99237
description:
2025-12-23 10:07:53 dovecot_login authenticator failed for H=([65.20.237.191]) [65.20.237.191]:50995: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.88.19.82
country_id: 6252001
description:
2025-12-23 10:11:23 dovecot_plain authenticator failed for H=(localhost) [47.88.19.82]:55458: 535 Incorrect authentication data (set_id=contact@dataesite.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.88.19.82
country_id: 6252001
description:
2025-12-23 10:11:29 dovecot_plain authenticator failed for H=(localhost) [47.88.19.82]:44090: 535 Incorrect authentication data (set_id=contact@dataesite.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2025-12-23 10:12:08 dovecot_login authenticator failed for H=(144.121.245.65.lightower.net) [64.72.74.162]:53577: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.54
country_id: 3144096
description:
2025-12-23 10:12:09 dovecot_login authenticator failed for H=(54-170-97-62.cust.smartcall.no) [62.97.170.54]:59211: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 54.209.252.105
country_id: 6252001
description:
2025-12-23 10:13:21 dovecot_plain authenticator failed for H=ec2-54-209-252-105.compute-1.amazonaws.com (EC2AMAZ-5DRTN3Q.ec2.internal) [54.209.252.105]:55245: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.37.52
country_id: 798544
description:
2025-12-23 10:12:36 dovecot_login authenticator failed for H=89-67-37-52.dynamic.play.pl [89.67.37.52]:36337: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 189.47.10.118
country_id: 3469034
description:
Dec 23 10:12:37 host2 sshd[493766]: Disconnected from invalid user eacadm 189.47.10.118 port 52538 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.166.235.107
country_id: 1880251
description:
2025-12-23 10:12:53 dovecot_plain authenticator failed for H=(localhost) [188.166.235.107]:36576: 535 Incorrect authentication data (set_id=admin@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 13.68.214.34
country_id: 6252001
description:
2025-12-23 10:13:16 dovecot_login authenticator failed for H=([13.68.214.34]) [13.68.214.34]:42076: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 54.209.252.105
country_id: 6252001
description:
2025-12-23 10:13:27 dovecot_login authenticator failed for H=ec2-54-209-252-105.compute-1.amazonaws.com (EC2AMAZ-5DRTN3Q.ec2.internal) [54.209.252.105]:55245: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.80
country_id: 3144096
description:
2025-12-23 10:17:33 dovecot_login authenticator failed for H=(80-170-97-62.cust.smartcall.no) [62.97.170.80]:51866: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.37.52
country_id: 798544
description:
2025-12-23 10:18:00 dovecot_login authenticator failed for H=89-67-37-52.dynamic.play.pl [89.67.37.52]:44959: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.129.230.30
country_id: 1814991
description:
2025-12-23 10:18:32 dovecot_plain authenticator failed for H=(localhost) [8.129.230.30]:42002: 535 Incorrect authentication data (set_id=office@nsteeleng.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.75.122.7
country_id: 927384
description:
2025-12-23 10:19:39 dovecot_login authenticator failed for H=([41.75.122.7]) [41.75.122.7]:48326: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.70.126
country_id: 1269750
description:
2025-12-23 10:19:54 dovecot_login authenticator failed for H=([125.20.232.243]) [182.78.70.126]:41134: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.64.150
country_id: 1269750
description:
2025-12-23 10:20:38 dovecot_login authenticator failed for H=([125.23.229.42]) [182.78.64.150]:57858: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.186.147.126
country_id: 1880251
description:
2025-12-23 10:24:47 dovecot_plain authenticator failed for H=126.147.186.35.bc.googleusercontent.com (localhost) [35.186.147.126]:57328: 535 Incorrect authentication data (set_id=help@seyawin.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.191.124.201
country_id: 1269750
description:
2025-12-23 10:25:08 dovecot_login authenticator failed for H=([160.191.124.201]) [160.191.124.201]:45745: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.102.148.242
country_id: 6252001
description:
2025-12-23 10:24:43 dovecot_login authenticator failed for H=syn-098-102-148-242.biz.spectrum.com [98.102.148.242]:47628: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 23 10:25:55 host2 sshd[507142]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 132.148.72.41
country_id: 6252001
description:
2025-12-23 10:25:52 dovecot_plain authenticator failed for H=41.72.148.132.host.secureserver.net (localhost) [132.148.72.41]:53020: 535 Incorrect authentication data (set_id=news@dataesite.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.53.197.53
country_id: 2921044
description:
2025-12-23 10:26:47 dovecot_plain authenticator failed for H=v2202507289313365218.goodsrv.de (localhost) [152.53.197.53]:40176: 535 Incorrect authentication data (set_id=help@kiriaswanu.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.0.122.22
country_id: 226074
description:
Dec 23 10:32:42 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=196.0.122.22, lip=66.85.158.91, TLS, session=<7PDzcpdGuNfEAHoW>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 23 10:33:03 host2 pure-ftpd[513164]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.70.126.83
country_id: 1269750
description:
Dec 23 10:33:06 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info>, method=PLAIN, rip=103.70.126.83, lip=66.85.158.91, TLS, session=<w3NMdJdG/INnRn5T>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.163.187
country_id: 3144096
description:
2025-12-23 10:34:05 dovecot_login authenticator failed for H=(187-163-97-62.cust.smartcall.no) [62.97.163.187]:55716: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.147.89.158
country_id: 1269750
description:
2025-12-23 10:34:20 dovecot_login authenticator failed for H=([203.147.89.38]) [203.147.89.158]:42010: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.116.199.47
country_id: 1269750
description:
2025-12-23 10:34:25 dovecot_plain authenticator failed for H=(localhost) [66.116.199.47]:60018: 535 Incorrect authentication data (set_id=admin@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.132.127.172
country_id: 2750405
description:
2025-12-23 10:34:32 dovecot_plain authenticator failed for H=172-127-132-5.ftth.glasoperator.nl (localhost) [5.132.127.172]:48658: 535 Incorrect authentication data (set_id=info@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.64.105.206
country_id: 6252001
description:
Dec 23 10:34:42 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.64.105.206, lip=66.85.158.91, TLS handshaking: Connection closed, session=<YIhFe5dGEsIUQGnO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.11.153.57
country_id: 1643084
description:
2025-12-23 10:35:17 dovecot_plain authenticator failed for H=(localhost) [113.11.153.57]:38754: 535 Incorrect authentication data (set_id=admin@sobaherbal.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.12
country_id: 241170
description:
Dec 23 10:35:18 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.12, lip=66.85.158.91, session=<0iJTfZdGjI/E+2YM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.74.148
country_id: 1269750
description:
2025-12-23 10:39:13 dovecot_plain authenticator failed for H=(localhost) [139.59.74.148]:59242: 535 Incorrect authentication data (set_id=office@mathsmotorcysle.xyz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.166.235.107
country_id: 1880251
description:
2025-12-23 10:40:23 dovecot_plain authenticator failed for H=(localhost) [188.166.235.107]:39448: 535 Incorrect authentication data (set_id=admin@melanifinefood.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.40.125.62
country_id: 732800
description:
Dec 23 10:41:19 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=46.40.125.62, lip=66.85.158.91, TLS, session=</3n2kZdGa5UuKH0+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.166.235.107
country_id: 1880251
description:
2025-12-23 10:40:31 dovecot_plain authenticator failed for H=(localhost) [188.166.235.107]:47262: 535 Incorrect authentication data (set_id=admin@melanifinefood.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.234.135.154
country_id: 6290252
description:
Dec 23 10:41:37 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=91.234.135.154, lip=66.85.158.91, TLS, session=<TjgDk5dGt7db6oea>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 35.195.180.151
country_id: 2802361
description:
Dec 23 10:42:31 host2 pure-ftpd[521400]: (?@35.195.180.151) [INFO] New connection from 35.195.180.151


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 172.215.145.207
country_id: 6252001
description:
Dec 23 10:43:29 host2 pure-ftpd[522352]: (?@172.215.145.207) [INFO] New connection from 172.215.145.207


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.182.65.40
country_id: 3017382
description:
2025-12-23 10:46:00 dovecot_login authenticator failed for H=40.ip-217-182-65.eu [217.182.65.40]:33020: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.198.49
country_id: 3996063
description:
2025-12-23 10:46:25 dovecot_login authenticator failed for H=(187.161.198.49-clientes-izzi.mx) [187.161.198.49]:50650: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.64.94
country_id: 3469034
description:
2025-12-23 10:46:41 dovecot_login authenticator failed for H=([189.108.156.41]) [187.8.64.94]:49382: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.183.103.121
country_id: 2635167
description:
2025-12-23 10:46:57 dovecot_login authenticator failed for H=(185-183-103-121.xdsl.5gdsl.com) [185.183.103.121]:60086: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.112.141.230
country_id: 2750405
description:
2025-12-23 10:47:10 dovecot_login authenticator failed for H=50708de6.static.ziggozakelijk.nl [80.112.141.230]:45984: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.120.182
country_id: 3144096
description:
2025-12-23 10:48:35 dovecot_login authenticator failed for H=(cm-178.232.120.182.get.no) [178.232.120.182]:44437: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.206.119
country_id: 1819730
description:
2025-12-23 10:49:05 dovecot_login authenticator failed for H=(m121-202-206-119.smartone.com) [121.202.206.119]:48638: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.247
country_id: 1269750
description:
2025-12-23 10:50:02 dovecot_login authenticator failed for H=(nsg-corporate-247.228.187.122.airtel.in) [122.187.228.247]:33930: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.124.135.48
country_id: 3144096
description:
2025-12-23 10:49:40 dovecot_login authenticator failed for H=([188.124.135.48]) [188.124.135.48]:57221: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.168
country_id: 6252001
description:
Dec 23 10:49:41 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.168, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<PKPasJdGVdLG6xio>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.223.176.171
country_id: 6252001
description:
2025-12-23 10:51:23 dovecot_login authenticator failed for H=([50.223.176.171]) [50.223.176.171]:33884: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.188.98
country_id: 1269750
description:
2025-12-23 10:52:09 dovecot_login authenticator failed for H=([125.19.165.242]) [125.19.188.98]:38964: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.128.241.207
country_id: 2661886
description:
2025-12-23 10:53:32 dovecot_login authenticator failed for H=195-128-241-207.bredband.obenetwork.net [195.128.241.207]:59408: 535 Incorrect authentication data (set_id=lezzarotech.com@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.124.221.2
country_id: 2750405
description:
2025-12-23 10:53:45 dovecot_login authenticator failed for H=ip-213-124-221-2.ip.prioritytelecom.net [213.124.221.2]:47214: 535 Incorrect authentication data (set_id=maximsholdings.com@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.124.60.46
country_id: 1168579
description:
2025-12-23 10:53:51 dovecot_login authenticator failed for H=([203.124.60.46]) [203.124.60.46]:55464: 535 Incorrect authentication data (set_id=lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.106.196.150
country_id: 1880251
description:
2025-12-23 10:54:12 dovecot_login authenticator failed for H=(bb128-106-196-150.singnet.com.sg) [128.106.196.150]:16120: 535 Incorrect authentication data (set_id=maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.116.204.232
country_id: 1269750
description:
2025-12-23 10:56:54 dovecot_plain authenticator failed for H=(localhost) [66.116.204.232]:53666: 535 Incorrect authentication data (set_id=office@sivagnanamfoundation.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.164.1.102
country_id: 1605651
description:
2025-12-23 10:57:30 dovecot_plain authenticator failed for H=(localhost) [43.164.1.102]:44190: 535 Incorrect authentication data (set_id=contact@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.68.141
country_id: 294640
description:
2025-12-23 10:59:04 dovecot_login authenticator failed for H=(2-55-68-141.orange.net.il) [2.55.68.141]:44604: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.215.110.96
country_id: 3144096
description:
2025-12-23 10:59:15 dovecot_login authenticator failed for H=(cm-84.215.110.96.get.no) [84.215.110.96]:59336: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.188
country_id: 6252001
description:
Dec 23 11:04:24 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 4 secs): user=<>, rip=147.185.132.188, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<fcCD5ZdGR8yTuYS8>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.188
country_id: 6252001
description:
Dec 23 11:09:45 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.188, lip=66.85.158.92, TLS, session=<xMqf+JdGGOOTuYS8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.221.149.110
country_id: 690791
description:
Dec 23 11:09:28 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=37.221.149.110, lip=66.85.158.91, TLS, session=<NQqk9pdGW9Ql3ZVu>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.63.133.74
country_id: 3175395
description:
Dec 23 11:09:45 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<gihan>, method=PLAIN, rip=185.63.133.74, lip=66.85.158.91, TLS, session=<AvCq95dGv5K5P4VK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.147.131.177
country_id: 1814991
description:
2025-12-23 11:10:57 dovecot_plain authenticator failed for H=(localhost) [8.147.131.177]:54918: 535 Incorrect authentication data (set_id=hr@sivagnanamfoundation.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.202.9.133
country_id: 6252001
description:
Dec 23 11:12:00 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.202.9.133, lip=66.85.158.91, TLS: Connection closed, session=<rjurAJhG+KgjygmF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.138.237.18
country_id: 1269750
description:
2025-12-23 11:16:19 dovecot_plain authenticator failed for H=(localhost) [103.138.237.18]:12027: 535 Incorrect authentication data (set_id=test@nsteeleng.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.171
country_id: 1733045
description:
2025-12-23 11:23:59 dovecot_login authenticator failed for H=([49.124.152.171]) [49.124.152.171]:45422: 535 Incorrect authentication data (set_id=v-deploy.com@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.239.238.23
country_id: 732800
description:
2025-12-23 11:24:26 dovecot_login authenticator failed for H=([178.239.238.23]) [178.239.238.23]:52272: 535 Incorrect authentication data (set_id=v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.116.199.47
country_id: 1269750
description:
2025-12-23 11:25:57 dovecot_plain authenticator failed for H=(localhost) [66.116.199.47]:36968: 535 Incorrect authentication data (set_id=admin@mathsmotorcysle.xyz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.29.174
country_id: 1643084
description:
2025-12-23 11:27:43 dovecot_plain authenticator failed for H=(localhost) [103.148.29.174]:53024: 535 Incorrect authentication data (set_id=sales@sivagnanamfoundation.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.232.179.250
country_id: 1269750
description:
2025-12-23 11:30:58 dovecot_plain authenticator failed for H=(localhost) [165.232.179.250]:47678: 535 Incorrect authentication data (set_id=test@ceylondigest.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 23 11:32:45 host2 sshd[565040]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 23 11:35:39 host2 pure-ftpd[567826]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 159.89.113.201
country_id: 6251999
description:
Dec 23 11:41:17 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=159.89.113.201, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<iglqaZhG/pefWXHJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.245.168.66
country_id: 1819730
description:
2025-12-23 11:41:18 dovecot_login authenticator failed for H=([43.245.168.66]) [43.245.168.66]:44409: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.243.175
country_id: 732800
description:
2025-12-23 11:41:43 dovecot_login authenticator failed for H=(92.62.243.175.fibermax.bg) [92.62.243.175]:43289: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.140.92
country_id: 99237
description:
Dec 23 11:42:12 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=65.20.140.92, lip=66.85.158.91, TLS, session=<8Wela5hGn4VBFIxc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.207.36.250
country_id: 6290252
description:
Dec 23 11:42:12 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=109.207.36.250, lip=66.85.158.91, TLS, session=<XnSga5hGQ5BtzyT6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 151.232.56.144
country_id: 130758
description:
Dec 23 11:42:32 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<contact>, method=PLAIN, rip=151.232.56.144, lip=66.85.158.91, TLS, session=<pVLCbJhGWoKX6DiQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.197.9.173
country_id: 3175395
description:
Dec 23 11:42:33 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<contact>, method=PLAIN, rip=185.197.9.173, lip=66.85.158.91, TLS, session=<rdP5bJhGd4G5xQmt>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.74.148
country_id: 1269750
description:
2025-12-23 11:44:38 dovecot_plain authenticator failed for H=(localhost) [139.59.74.148]:54538: 535 Incorrect authentication data (set_id=office@venee.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.58.120.195
country_id: 6252001
description:
[2025-12-23 11:45:41 +0530] info [whostmgrd] 172.58.120.195 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.237.24.59
country_id: 6252001
description:
[2025-12-23 11:45:44 +0530] info [cpaneld] 167.237.24.59 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.15.149.254
country_id: 3469034
description:
2025-12-23 11:46:14 dovecot_login authenticator failed for H=(201-15-149-254.pltce300.ipd.brasiltelecom.net.br) [201.15.149.254]:47625: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.42.108.155
country_id: 6252001
description:
[2025-12-23 11:45:36 +0530] info [cpaneld] 47.42.108.155 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.66.209.12
country_id: 6252001
description:
[2025-12-23 11:45:40 +0530] info [cpaneld] 99.66.209.12 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.33.202.137
country_id: 6252001
description:
[2025-12-23 11:45:43 +0530] info [cpaneld] 73.33.202.137 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.241.0.57
country_id: 6252001
description:
[2025-12-23 11:45:46 +0530] info [cpaneld] 104.241.0.57 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 208.56.120.183
country_id: 6252001
description:
[2025-12-23 11:45:38 +0530] info [cpaneld] 208.56.120.183 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.89.14
country_id: 1269750
description:
2025-12-23 11:46:37 dovecot_login authenticator failed for H=([128.185.247.210]) [182.79.89.14]:34050: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.197.73.76
country_id: 1880251
description:
2025-12-23 11:46:33 dovecot_login authenticator failed for H=(76.73.197.124.unknown.m1.com.sg) [124.197.73.76]:54137: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.123
country_id: 6252001
description:
Dec 23 11:47:32 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.123, lip=66.85.158.91, TLS, session=<quW7f5hG1PSTuYR7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.227.245.154
country_id: 690791
description:
2025-12-23 11:48:09 dovecot_login authenticator failed for H=(213-227-245-154.static.vega-ua.net) [213.227.245.154]:22843: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.246.114.111
country_id: 1880251
description:
2025-12-23 11:48:22 dovecot_login authenticator failed for H=([124.246.114.111]) [124.246.114.111]:46186: 535 Incorrect authentication data (set_id=bostonlanka.com@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.147.248.44
country_id: 1269750
description:
2025-12-23 11:48:22 dovecot_login authenticator failed for H=([103.147.248.44]) [103.147.248.44]:39688: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.39.201
country_id: 3144096
description:
2025-12-23 11:48:46 dovecot_login authenticator failed for H=(cm-46.212.39.201.get.no) [46.212.39.201]:37457: 535 Incorrect authentication data (set_id=bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.47.146
country_id: 1819730
description:
2025-12-23 11:49:42 dovecot_login authenticator failed for H=146.47.246.220.static.netvigator.com [220.246.47.146]:64081: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.124.139.77
country_id: 3144096
description:
2025-12-23 11:50:15 dovecot_login authenticator failed for H=([188.124.139.77]) [188.124.139.77]:47688: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.255.73.42
country_id: 1269750
description:
[2025-12-23 11:53:57 +0530] info [webmaild] 103.255.73.42 - info@simple-engineering.lk "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: User info@simple-engineering.lk has their account suspended. Login blocked.


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.13
country_id: 241170
description:
Dec 23 11:56:05 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.13, lip=66.85.158.91, session=<oWo5nphG1IjE+2YN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.129.230.30
country_id: 1814991
description:
2025-12-23 11:59:34 dovecot_plain authenticator failed for H=(localhost) [8.129.230.30]:57010: 535 Incorrect authentication data (set_id=office@nsteeleng.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.30.97.33
country_id: 272103
description:
Dec 23 12:00:08 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=193.30.97.33, lip=66.85.158.91, session=<JceyrJhG5oXBHmEh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.6.81.59
country_id: 1880251
description:
2025-12-23 12:03:15 dovecot_login authenticator failed for H=bb121-6-81-59.singnet.com.sg [121.6.81.59]:60960: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.7.163.154
country_id: 1643084
description:
2025-12-23 12:03:50 dovecot_plain authenticator failed for H=(localhost) [114.7.163.154]:52138: 535 Incorrect authentication data (set_id=office@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.229.14
country_id: 1269750
description:
2025-12-23 12:03:45 dovecot_login authenticator failed for H=([152.52.229.14]) [152.52.229.14]:42324: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.151.46.98
country_id: 1861060
description:
2025-12-23 12:04:34 dovecot_login authenticator failed for H=(fp5cca5266.gifg408.ap.nuro.jp) [45.151.46.98]:33312: 535 Incorrect authentication data (set_id=prasanka@agronatureholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.120
country_id: 6252001
description:
Dec 23 12:04:50 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.120, lip=66.85.158.91, TLS: Connection closed, session=<r4edvZhG9mlChJl4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.66.119.139
country_id: 2661886
description:
2025-12-23 12:05:26 dovecot_login authenticator failed for H=78-66-119-139-no600.tbcn.telia.com [78.66.119.139]:54318: 535 Incorrect authentication data (set_id=prasanka)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-23 12:09:05 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:58614: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.53.133.167
country_id: 1694008
description:
Dec 23 12:10:10 host2 sshd[602832]: Disconnected from invalid user es 122.53.133.167 port 45884 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.15
country_id: 241170
description:
Dec 23 12:12:08 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.15, lip=66.85.158.91, session=<ZbmU15hGtqfE+2YP>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 122.53.133.167
country_id: 1694008
description:
Dec 23 12:11:53 host2 sshd[604378]: Disconnected from invalid user hdoop 122.53.133.167 port 45184 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.181.25.210
country_id: 3923057
description:
Dec 23 12:13:13 host2 sshd[605539]: Disconnected from invalid user auditor 190.181.25.210 port 39517 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.181.25.210
country_id: 3923057
description:
Dec 23 12:14:29 host2 sshd[606622]: Disconnected from invalid user rich 190.181.25.210 port 49238 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 190.181.25.210
country_id: 3923057
description:
Dec 23 12:15:12 host2 sshd[607483]: Disconnected from invalid user redmine 190.181.25.210 port 56133 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.53.133.167
country_id: 1694008
description:
Dec 23 12:15:24 host2 sshd[607667]: Disconnected from invalid user oem 122.53.133.167 port 43820 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.181.25.210
country_id: 3923057
description:
Dec 23 12:15:57 host2 sshd[608126]: Disconnected from invalid user ansible 190.181.25.210 port 34795 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.51.166
country_id: 1269750
description:
2025-12-23 12:16:06 dovecot_login authenticator failed for H=([125.23.112.209]) [182.95.51.166]:34242: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.184.83.17
country_id: 6252001
description:
2025-12-23 12:16:27 dovecot_login authenticator failed for H=h17.83.184.173.dynamic.ip.windstream.net [173.184.83.17]:56396: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.181.25.210
country_id: 3923057
description:
Dec 23 12:16:38 host2 sshd[608772]: Disconnected from invalid user joshua 190.181.25.210 port 41690 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.53.133.167
country_id: 1694008
description:
Dec 23 12:17:10 host2 sshd[609251]: Disconnected from invalid user admin 122.53.133.167 port 43118 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.56.202.86
country_id: 3469034
description:
2025-12-23 12:18:11 dovecot_login authenticator failed for H=(186-238-88-61.customer.tdatabrasil.net.br) [189.56.202.86]:48917: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.30
country_id: 3144096
description:
2025-12-23 12:18:15 dovecot_login authenticator failed for H=(30-170-97-62.cust.smartcall.no) [62.97.170.30]:45127: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.200
country_id: 6252001
description:
Dec 23 12:18:53 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.235.24.200, lip=66.85.158.91, session=<zXTg75hGqPDG6xjI>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.211.15.93
country_id: 1269750
description:
2025-12-23 12:19:02 dovecot_login authenticator failed for H=(static.ill.117.211.15.93.bsnl.co.in) [117.211.15.93]:47514: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.162
country_id: 2993457
description:
Dec 23 12:19:35 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=194.165.16.162, lip=66.85.158.91, session=<PIFZ8phGP//CpRCi>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.221.194
country_id: 3144096
description:
2025-12-23 12:20:06 dovecot_login authenticator failed for H=([178.232.221.194]) [178.232.221.194]:48703: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 23 12:20:26 host2 sshd[612412]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.244.106
country_id: 1269750
description:
2025-12-23 12:20:21 dovecot_login authenticator failed for H=([127.0.0.1]) [152.52.244.106]:56186: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.8.241.121
country_id: 2077456
description:
2025-12-23 12:20:28 dovecot_login authenticator failed for H=([161.8.241.121]) [161.8.241.121]:55233: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.231.114
country_id: 1269750
description:
2025-12-23 12:20:40 dovecot_login authenticator failed for H=([127.0.0.1]) [128.185.231.114]:34526: 535 Incorrect authentication data (set_id=kasunp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.116.199.47
country_id: 1269750
description:
2025-12-23 12:23:17 dovecot_plain authenticator failed for H=(localhost) [66.116.199.47]:43766: 535 Incorrect authentication data (set_id=admin@venee.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.18
country_id: 241170
description:
Dec 23 12:24:59 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.18, lip=66.85.158.91, session=<gwmRBZlGhsHE+2YS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.26.194.79
country_id: 3017382
description:
2025-12-23 12:27:36 dovecot_login authenticator failed for H=([217.26.194.79]) [217.26.194.79]:42746: 535 Incorrect authentication data (set_id=prasanka@agronatureholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.77.172.159
country_id: 3996063
description:
Dec 23 12:27:41 host2 sshd[618287]: Disconnected from invalid user mongodb 200.77.172.159 port 40814 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.40
country_id: 1733045
description:
2025-12-23 12:28:00 dovecot_login authenticator failed for H=([49.124.153.40]) [49.124.153.40]:58448: 535 Incorrect authentication data (set_id=prasanka)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 200.77.172.159
country_id: 3996063
description:
Dec 23 12:30:00 host2 sshd[619847]: Disconnected from invalid user tsbot 200.77.172.159 port 53222 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.77.172.159
country_id: 3996063
description:
Dec 23 12:30:38 host2 sshd[620606]: Disconnected from invalid user delete 200.77.172.159 port 39178 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.83.71.110
country_id: 3017382
description:
Dec 23 12:30:40 host2 sshd[620631]: Disconnected from invalid user vyos 51.83.71.110 port 43654 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.214.78
country_id: 1269750
description:
2025-12-23 12:31:18 dovecot_login authenticator failed for H=([125.20.249.39]) [128.185.214.78]:42670: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.59
country_id: 6252001
description:
Dec 23 12:32:42 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.59, lip=66.85.158.92, TLS, session=<KAxMIZlG/PbN0h87>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.191.55
country_id: 3144096
description:
2025-12-23 12:33:38 dovecot_login authenticator failed for H=(cm-84.213.191.55.get.no) [84.213.191.55]:42031: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.83.71.110
country_id: 3017382
description:
Dec 23 12:33:50 host2 sshd[623172]: Disconnected from invalid user xerox 51.83.71.110 port 59372 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.83.71.110
country_id: 3017382
description:
Dec 23 12:34:49 host2 sshd[623837]: Disconnected from invalid user client 51.83.71.110 port 54304 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.74.148
country_id: 1269750
description:
2025-12-23 12:35:01 dovecot_plain authenticator failed for H=(localhost) [139.59.74.148]:37840: 535 Incorrect authentication data (set_id=office@mathsmotorcysle.xyz)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.160.113.134
country_id: 6252001
description:
[2025-12-23 12:37:56 +0530] info [cpaneld] 67.160.113.134 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 23 12:37:38 host2 pure-ftpd[626174]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 35.150.154.35
country_id: 6252001
description:
[2025-12-23 12:37:49 +0530] info [cpaneld] 35.150.154.35 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.32.92.193
country_id: 6252001
description:
[2025-12-23 12:37:53 +0530] info [cpaneld] 47.32.92.193 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 63.153.13.111
country_id: 6252001
description:
[2025-12-23 12:37:55 +0530] info [cpaneld] 63.153.13.111 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 129.222.255.176
country_id: 6252001
description:
[2025-12-23 12:37:47 +0530] info [cpaneld] 129.222.255.176 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.92.41.184
country_id: 6252001
description:
[2025-12-23 12:37:50 +0530] info [cpaneld] 73.92.41.184 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.145.179.89
country_id: 6252001
description:
[2025-12-23 12:37:51 +0530] info [whostmgrd] 47.145.179.89 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.67.26.55
country_id: 6252001
description:
[2025-12-23 12:43:42 +0530] info [cpaneld] 173.67.26.55 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.213.164.108
country_id: 6252001
description:
[2025-12-23 12:43:44 +0530] info [cpaneld] 98.213.164.108 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.250.228.152
country_id: 6252001
description:
[2025-12-23 12:43:37 +0530] info [cpaneld] 73.250.228.152 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.124.74.226
country_id: 6252001
description:
[2025-12-23 12:43:38 +0530] info [cpaneld] 76.124.74.226 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.213.22.86
country_id: 6252001
description:
[2025-12-23 12:43:40 +0530] info [cpaneld] 72.213.22.86 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.239.192.142
country_id: 6252001
description:
[2025-12-23 12:43:41 +0530] info [whostmgrd] 73.239.192.142 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.185.250.99
country_id: 6252001
description:
[2025-12-23 12:43:43 +0530] info [cpaneld] 24.185.250.99 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.94.203.35
country_id: 3469034
description:
Dec 23 12:47:01 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=138.94.203.35, lip=66.85.158.91, TLS, session=<sHJkU5lG0qGKXssj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.74.181.139
country_id: 130758
description:
Dec 23 12:46:41 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=94.74.181.139, lip=66.85.158.91, TLS, session=<ckowUplGHd1eSrWL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.250
country_id: 1036973
description:
2025-12-23 12:49:03 dovecot_login authenticator failed for H=([197.219.228.250]) [197.219.228.250]:45506: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2025-12-23 12:49:27 dovecot_login authenticator failed for H=c-71-62-34-216.hsd1.va.comcast.net [71.62.34.216]:60968: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.220.22.170
country_id: 192950
description:
Dec 23 12:56:16 host2 sshd[642342]: Invalid user cloudtourssrilan_travel from 102.220.22.170 port 48682


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.228.32.39
country_id: 798544
description:
Dec 23 12:57:24 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=91.228.32.39, lip=66.85.158.91, TLS, session=<kEepeJlGYYtb5CAn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.189.201.233
country_id: 3469034
description:
Dec 23 12:57:45 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<gihan>, method=PLAIN, rip=179.189.201.233, lip=66.85.158.91, TLS, session=<aqTCeZlG5uGzvcnp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.92.249
country_id: 1168579
description:
2025-12-23 12:57:48 dovecot_login authenticator failed for H=(249.92.zcomnetworks.com.pk) [103.148.92.249]:42850: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.5.113.133
country_id: 3865483
description:
2025-12-23 12:58:18 dovecot_login authenticator failed for H=(host133.advance.com.ar) [200.5.113.133]:12470: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.127.90.34
country_id: 2440476
description:
2025-12-23 13:00:36 dovecot_login authenticator failed for H=([154.127.90.34]) [154.127.90.34]:50007: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.84.162.177
country_id: 1861060
description:
2025-12-23 13:01:01 dovecot_login authenticator failed for H=177.162.84.34.bc.googleusercontent.com [34.84.162.177]:50113: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.30.115.187
country_id: 3686110
description:
Dec 23 13:01:15 host2 sshd[646339]: Disconnected from invalid user team1 186.30.115.187 port 40792 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.30.115.187
country_id: 3686110
description:
Dec 23 13:03:13 host2 sshd[647611]: Disconnected from invalid user cosmos 186.30.115.187 port 38086 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 186.30.115.187
country_id: 3686110
description:
Dec 23 13:03:55 host2 sshd[648190]: Disconnected from invalid user none 186.30.115.187 port 50214 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 23 13:05:33 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<VFPClplGbNMDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 23 13:06:59 host2 dovecot[3805015]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<9cXnm5lGcMUDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 23 13:08:44 host2 dovecot[3805015]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<wbcfoplGoOIDhBfJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.224.62
country_id: 1269750
description:
2025-12-23 13:09:03 dovecot_login authenticator failed for H=([125.17.182.121]) [182.95.224.62]:34896: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.12.241.225
country_id: 6252001
description:
2025-12-23 13:09:14 dovecot_login authenticator failed for H=(syn-071-012-241-225.res.spectrum.com) [71.12.241.225]:48338: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 23 13:10:16 host2 dovecot[3805015]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<d9ijp5lGSsoDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 23 13:10:31 host2 dovecot[3805015]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<7JyLqJlG9L8DhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 23 13:11:52 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<PaZgrZlGKtADhBfJ>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 23 13:12:00 host2 dovecot[3805015]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<LsHVrZlGjLgDhBfJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.102.122
country_id: 1269750
description:
2025-12-23 13:13:26 dovecot_login authenticator failed for H=([125.18.219.209]) [27.123.102.122]:51728: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.128.202
country_id: 6252001
description:
2025-12-23 13:14:06 dovecot_login authenticator failed for H=([192.34.128.202]) [192.34.128.202]:60738: 535 Incorrect authentication data (set_id=training)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 23 13:14:17 host2 dovecot[3805015]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<xzX6tZlGyMQDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 23 13:14:34 host2 dovecot[3805015]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<QWkCt5lGhKoDhBfJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.231.202
country_id: 1269750
description:
2025-12-23 13:15:17 dovecot_login authenticator failed for H=([152.52.231.202]) [152.52.231.202]:59432: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.224.26
country_id: 1269750
description:
2025-12-23 13:15:58 dovecot_login authenticator failed for H=([152.52.224.26]) [152.52.224.26]:45016: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.199.223
country_id: 3144096
description:
2025-12-23 13:16:31 dovecot_login authenticator failed for H=(cm-178.232.199.223.get.no) [178.232.199.223]:46831: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.237.107
country_id: 3144096
description:
2025-12-23 13:18:45 dovecot_login authenticator failed for H=(cm-178.232.237.107.get.no) [178.232.237.107]:49000: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.44.194.197
country_id: 3175395
description:
Dec 23 13:19:19 host2 sshd[660748]: Disconnected from invalid user ocadmin 151.44.194.197 port 9335 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 151.44.194.197
country_id: 3175395
description:
Dec 23 13:21:46 host2 sshd[662716]: Disconnected from invalid user client 151.44.194.197 port 9509 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.103.188.111
country_id: 6252001
description:
[2025-12-23 13:24:06 +0530] info [cpaneld] 76.103.188.111 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.48.200.40
country_id: 6252001
description:
[2025-12-23 13:24:08 +0530] info [cpaneld] 73.48.200.40 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.185.10.248
country_id: 6252001
description:
[2025-12-23 13:24:10 +0530] info [whostmgrd] 67.185.10.248 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.63.197.20
country_id: 6252001
description:
[2025-12-23 13:24:13 +0530] info [cpaneld] 99.63.197.20 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 161.199.187.196
country_id: 6252001
description:
[2025-12-23 13:24:15 +0530] info [cpaneld] 161.199.187.196 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.149.204
country_id: 1733045
description:
2025-12-23 13:23:36 dovecot_login authenticator failed for H=([49.124.149.204]) [49.124.149.204]:52810: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.87.252.56
country_id: 6252001
description:
[2025-12-23 13:24:03 +0530] info [cpaneld] 76.87.252.56 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.197.30.247
country_id: 6252001
description:
[2025-12-23 13:24:12 +0530] info [cpaneld] 76.197.30.247 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.92.100
country_id: 3996063
description:
2025-12-23 13:24:10 dovecot_login authenticator failed for H=(201.173.92.100-clientes-izzi.mx) [201.173.92.100]:55299: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.240.121
country_id: 3144096
description:
2025-12-23 13:25:50 dovecot_login authenticator failed for H=(cm-178.232.240.121.get.no) [178.232.240.121]:39500: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.242.241.133
country_id: 6252001
description:
[2025-12-23 13:25:57 +0530] info [cpaneld] 69.242.241.133 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.176.11.232
country_id: 6252001
description:
[2025-12-23 13:25:58 +0530] info [cpaneld] 98.176.11.232 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.241.90.115
country_id: 6252001
description:
[2025-12-23 13:26:07 +0530] info [cpaneld] 75.241.90.115 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 209.50.165.139
country_id: 6252001
description:
[2025-12-23 13:25:39 +0530] info [cpaneld] 209.50.165.139 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.138.176.146
country_id: 6252001
description:
[2025-12-23 13:26:01 +0530] info [whostmgrd] 66.138.176.146 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.204.60.117
country_id: 6252001
description:
[2025-12-23 13:26:00 +0530] info [cpaneld] 73.204.60.117 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.80.132.91
country_id: 6252001
description:
[2025-12-23 13:26:06 +0530] info [cpaneld] 71.80.132.91 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.213.28.165
country_id: 6252001
description:
[2025-12-23 13:26:09 +0530] info [cpaneld] 71.213.28.165 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.0.107.158
country_id: 226074
description:
2025-12-23 13:26:15 dovecot_login authenticator failed for H=([196.0.107.158]) [196.0.107.158]:37486: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 23 13:27:26 host2 sshd[667114]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 13.233.156.64
country_id: 1269750
description:
Dec 23 13:27:43 host2 sshd[667292]: Disconnected from invalid user stack 13.233.156.64 port 36250 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.69.210.167
country_id: 6251999
description:
Dec 23 13:27:53 host2 sshd[667398]: Disconnected from invalid user bb 158.69.210.167 port 41440 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 13.233.156.64
country_id: 1269750
description:
Dec 23 13:28:57 host2 sshd[668093]: Disconnected from invalid user hadoopuser 13.233.156.64 port 39152 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 158.69.210.167
country_id: 6251999
description:
Dec 23 13:28:57 host2 sshd[668145]: Disconnected from invalid user itadmin 158.69.210.167 port 37190 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.121.193.126
country_id: 3595528
description:
2025-12-23 13:29:13 dovecot_login authenticator failed for H=(126.193.121.190.ispguatemala.com.gt) [190.121.193.126]:54790: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 129.226.150.85
country_id: 1880251
description:
Dec 23 13:28:29 host2 sshd[667801]: Disconnected from invalid user hadoopuser 129.226.150.85 port 60344 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.4.31.215
country_id: 2661886
description:
2025-12-23 13:29:29 dovecot_login authenticator failed for H=h-155-4-31-215.a2204.priv.bahnhof.se [155.4.31.215]:56068: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.153
country_id: 1733045
description:
2025-12-23 13:32:03 dovecot_login authenticator failed for H=([49.124.152.153]) [49.124.152.153]:40744: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.123.146.92
country_id: 2750405
description:
Dec 23 13:32:27 host2 sshd[671342]: Disconnected from invalid user clare 20.123.146.92 port 12126 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.122.202
country_id: 294640
description:
2025-12-23 13:32:30 dovecot_login authenticator failed for H=(31-154-122-202.orange.net.il) [2.55.122.202]:54312: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.123.146.93
country_id: 2750405
description:
Dec 23 13:33:24 host2 sshd[672032]: Disconnected from invalid user debian 20.123.146.93 port 60626 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.220.22.170
country_id: 192950
description:
Dec 23 13:34:29 host2 sshd[672924]: Invalid user cloudtourssrilan_travel from 102.220.22.170 port 50524


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.123.146.92
country_id: 2750405
description:
Dec 23 13:36:24 host2 sshd[674463]: Disconnected from invalid user julio 20.123.146.92 port 64566 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.214.44.117
country_id: 149590
description:
2025-12-23 13:37:50 dovecot_login authenticator failed for H=([102.214.44.117]) [102.214.44.117]:49586: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 20.123.146.92
country_id: 2750405
description:
Dec 23 13:37:31 host2 sshd[675217]: Disconnected from invalid user practice 20.123.146.92 port 65055 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.159
country_id: 3144096
description:
2025-12-23 13:38:28 dovecot_login authenticator failed for H=(cm-84.213.189.159.get.no) [84.213.189.159]:59306: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 23 13:39:05 host2 pure-ftpd[676501]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.123.146.92
country_id: 2750405
description:
Dec 23 13:39:47 host2 sshd[676881]: Disconnected from invalid user backupuser 20.123.146.92 port 55906 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 4.210.186.201
country_id: 2750405
description:
Dec 23 13:42:06 host2 sshd[678948]: Disconnected from invalid user qa 4.210.186.201 port 31886 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.201.138
country_id: 1269750
description:
2025-12-23 13:43:11 dovecot_login authenticator failed for H=([125.19.174.244]) [128.185.201.138]:45408: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.140
country_id: 6252001
description:
Dec 23 13:43:39 host2 dovecot[3805015]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 1 secs): user=<>, rip=66.132.153.140, lip=66.85.158.91, session=<Wez8HppGrqJChJmM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.220.168
country_id: 337996
description:
2025-12-23 13:43:56 dovecot_login authenticator failed for H=([196.190.220.168]) [196.190.220.168]:43892: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.52.194
country_id: 1269750
description:
2025-12-23 13:43:34 dovecot_login authenticator failed for H=([182.95.52.194]) [182.95.52.194]:55818: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.123.146.92
country_id: 2750405
description:
Dec 23 13:46:45 host2 sshd[683831]: Disconnected from invalid user prova 20.123.146.92 port 20956 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 20.123.146.94
country_id: 2750405
description:
Dec 23 13:47:57 host2 sshd[684759]: Disconnected from invalid user ann 20.123.146.94 port 45721 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.123.146.93
country_id: 2750405
description:
Dec 23 13:49:17 host2 sshd[685873]: Disconnected from invalid user forum 20.123.146.93 port 19715 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.183.46.135
country_id: 2635167
description:
Dec 23 13:50:23 host2 sshd[686833]: Disconnected from invalid user pula 68.183.46.135 port 58162 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 23 13:51:01 host2 sshd[687063]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.195.194
country_id: 1819730
description:
2025-12-23 13:52:58 dovecot_login authenticator failed for H=(m121-202-195-194.smartone.com) [121.202.195.194]:37163: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.120.182
country_id: 3144096
description:
2025-12-23 13:53:21 dovecot_login authenticator failed for H=(cm-178.232.120.182.get.no) [178.232.120.182]:58294: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 68.183.46.135
country_id: 2635167
description:
Dec 23 13:54:03 host2 sshd[689388]: Disconnected from invalid user cssserver 68.183.46.135 port 43666 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.188.120.232
country_id: 337996
description:
Dec 23 13:53:27 host2 sshd[688930]: Disconnected from invalid user cacheusr 196.188.120.232 port 54732 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.183.46.135
country_id: 2635167
description:
Dec 23 13:53:32 host2 sshd[688985]: Disconnected from invalid user abel 68.183.46.135 port 47788 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 4.210.186.201
country_id: 2750405
description:
Dec 23 13:55:15 host2 sshd[690805]: Disconnected from invalid user local 4.210.186.201 port 37528 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 196.188.120.232
country_id: 337996
description:
Dec 23 13:55:24 host2 sshd[690944]: Disconnected from invalid user cvs 196.188.120.232 port 53650 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.183.46.135
country_id: 2635167
description:
Dec 23 13:54:33 host2 sshd[690224]: Disconnected from invalid user marie 68.183.46.135 port 43932 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.0.122.122
country_id: 226074
description:
Dec 23 13:56:20 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 23 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=196.0.122.122, lip=66.85.158.91, TLS, session=<Hy0AS5pGccrEAHp6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 23 13:56:25 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<XBCpTJpGUNADhBfJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.85.144
country_id: 1269750
description:
2025-12-23 13:55:32 dovecot_login authenticator failed for H=(abts-north-static-144.85.160.122.airtelbroadband.in) [122.160.85.144]:50079: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.64.94
country_id: 3469034
description:
2025-12-23 13:55:58 dovecot_login authenticator failed for H=(189-108-129-173.customer.tdatabrasil.net.br) [187.8.64.94]:45247: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 23 13:56:37 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<+EZmTZpGbqsDhBfJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.238.106.189
country_id: 3865483
description:
Dec 23 13:56:41 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=45.238.106.189, lip=66.85.158.91, TLS, session=<cDOCTJpG1eYt7mq9>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.170.19.191
country_id: 6252001
description:
[2025-12-23 13:57:30 +0530] info [cpaneld] 73.170.19.191 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 65.186.83.157
country_id: 6252001
description:
[2025-12-23 13:57:35 +0530] info [cpaneld] 65.186.83.157 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.178.24
country_id: 6252001
description:
[2025-12-23 13:57:37 +0530] info [cpaneld] 172.56.178.24 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 100.16.76.113
country_id: 6252001
description:
[2025-12-23 13:57:31 +0530] info [cpaneld] 100.16.76.113 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 136.55.59.6
country_id: 6252001
description:
[2025-12-23 13:57:32 +0530] info [cpaneld] 136.55.59.6 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.88.62.38
country_id: 6252001
description:
[2025-12-23 13:57:34 +0530] info [whostmgrd] 99.88.62.38 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.62.47.202
country_id: 6252001
description:
[2025-12-23 13:57:36 +0530] info [cpaneld] 170.62.47.202 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 23 13:58:01 host2 dovecot[3805015]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<bW9gUppG7qgDhBfJ>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 211.25.245.56
country_id: 1733045
description:
Dec 23 14:00:53 host2 sshd[695410]: Disconnected from invalid user admin 211.25.245.56 port 45228 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.135.198.249
country_id: 2510769
description:
Dec 23 14:01:04 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<gihan>, method=PLAIN, rip=45.135.198.249, lip=66.85.158.91, TLS, session=<z85PXJpGAbIth8b5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 31.14.20.239
country_id: 798549
description:
Dec 23 14:00:46 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=31.14.20.239, lip=66.85.158.91, TLS, session=<WfU7W5pGUZMfDhTv>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.137
country_id: 6252001
description:
Dec 23 14:02:29 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.137, lip=66.85.158.91, TLS: Connection closed, session=<sT5jYppGvpxChJmJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.12.131.121
country_id: 2264397
description:
Dec 23 14:03:13 host2 sshd[697232]: Disconnected from invalid user vmail 45.12.131.121 port 46296 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.12.131.121
country_id: 2264397
description:
Dec 23 14:03:45 host2 sshd[697554]: Disconnected from invalid user ceshi 45.12.131.121 port 53150 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.12.131.121
country_id: 2264397
description:
Dec 23 14:05:22 host2 sshd[699013]: Disconnected from invalid user deb 45.12.131.121 port 50754 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 211.25.245.56
country_id: 1733045
description:
Dec 23 14:05:40 host2 sshd[699211]: Disconnected from invalid user afa 211.25.245.56 port 46672 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.167.210
country_id: 3144096
description:
2025-12-23 14:07:42 dovecot_login authenticator failed for H=(210-167-97-62.cust.smartcall.no) [62.97.167.210]:39086: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.221.194
country_id: 3144096
description:
2025-12-23 14:07:53 dovecot_login authenticator failed for H=(cm-178.232.221.194.get.no) [178.232.221.194]:58483: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.188.10
country_id: 3144096
description:
2025-12-23 14:10:44 dovecot_login authenticator failed for H=(cm-178.232.188.10.get.no) [178.232.188.10]:54371: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.113.10
country_id: 1269750
description:
2025-12-23 14:11:34 dovecot_login authenticator failed for H=([27.123.113.10]) [27.123.113.10]:35074: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.194.22
country_id: 1269750
description:
2025-12-23 14:11:39 dovecot_login authenticator failed for H=([182.95.22.249]) [128.185.194.22]:41430: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.147.96
country_id: 1733045
description:
2025-12-23 14:13:23 dovecot_login authenticator failed for H=([49.124.147.96]) [49.124.147.96]:52588: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.62
country_id: 1733045
description:
2025-12-23 14:13:40 dovecot_login authenticator failed for H=([49.124.151.62]) [49.124.151.62]:48276: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.149.211
country_id: 1733045
description:
2025-12-23 14:13:56 dovecot_login authenticator failed for H=([49.124.149.211]) [49.124.149.211]:50528: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 23 14:15:11 host2 sshd[709635]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.193.122.91
country_id: 690791
description:
2025-12-23 14:15:35 dovecot_login authenticator failed for H=(82.193.122.91.cl.ipnet.ua) [82.193.122.91]:34493: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.124.135.48
country_id: 3144096
description:
2025-12-23 14:15:46 dovecot_login authenticator failed for H=([188.124.135.48]) [188.124.135.48]:45869: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.177.78
country_id: 1269750
description:
2025-12-23 14:15:58 dovecot_login authenticator failed for H=([182.95.177.78]) [182.95.177.78]:41768: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.228.160
country_id: 149590
description:
2025-12-23 14:16:40 dovecot_login authenticator failed for H=(160.228-59-41.static-zone.ttcldata.net) [41.59.228.160]:60532: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.14
country_id: 6252001
description:
Dec 23 14:17:06 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=91.230.168.14, lip=66.85.158.92, TLS handshaking: Connection closed, session=<uwmllppGs7Nb5qgO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.0
country_id: 6252001
description:
Dec 23 14:17:17 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=91.230.168.0, lip=66.85.158.92, TLS: Connection closed, session=<xDJJl5pGyetb5qgA>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.11
country_id: 6252001
description:
Dec 23 14:17:25 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=91.230.168.11, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<LMPFl5pGFa9b5qgL>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.1
country_id: 6252001
description:
Dec 23 14:17:28 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.230.168.1, lip=66.85.158.92, TLS: Connection closed, session=<mi/0l5pGKblb5qgB>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.160.206
country_id: 1269750
description:
2025-12-23 14:20:25 dovecot_login authenticator failed for H=([125.19.160.206]) [125.19.160.206]:35926: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.153.103.91
country_id: 6252001
description:
[2025-12-23 14:20:33 +0530] info [cpaneld] 47.153.103.91 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.165.48.12
country_id: 6252001
description:
[2025-12-23 14:20:38 +0530] info [cpaneld] 67.165.48.12 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.128.151.92
country_id: 6252001
description:
2025-12-23 14:20:42 dovecot_login authenticator failed for H=c-73-128-151-92.hsd1.de.comcast.net [73.128.151.92]:45210: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.178.188.52
country_id: 6252001
description:
[2025-12-23 14:20:39 +0530] info [cpaneld] 72.178.188.52 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.131.224.44
country_id: 6252001
description:
[2025-12-23 14:20:41 +0530] info [cpaneld] 24.131.224.44 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 192.63.219.187
country_id: 6252001
description:
[2025-12-23 14:20:27 +0530] info [cpaneld] 192.63.219.187 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.147.127.222
country_id: 6252001
description:
[2025-12-23 14:20:31 +0530] info [cpaneld] 216.147.127.222 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.229.67.84
country_id: 6252001
description:
[2025-12-23 14:20:35 +0530] info [whostmgrd] 47.229.67.84 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.92.217
country_id: 3996063
description:
2025-12-23 14:23:26 dovecot_login authenticator failed for H=(201.173.92.217-clientes-izzi.mx) [201.173.92.217]:50157: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.214.98.168
country_id: 3144096
description:
2025-12-23 14:24:01 dovecot_login authenticator failed for H=([84.214.98.168]) [84.214.98.168]:59619: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.142.106.177
country_id: 298795
description:
2025-12-23 14:26:22 dovecot_login authenticator failed for H=([188.132.210.145]) [195.142.106.177]:12068: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.235.110
country_id: 1269750
description:
2025-12-23 14:26:45 dovecot_login authenticator failed for H=([128.185.160.185]) [128.185.235.110]:48210: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.221.130
country_id: 1269750
description:
2025-12-23 14:29:00 dovecot_login authenticator failed for H=(nsg-corporate-130.221.187.122.airtel.in) [122.187.221.130]:60314: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.56
country_id: 99237
description:
2025-12-23 14:30:04 dovecot_login authenticator failed for H=([65.20.133.56]) [65.20.133.56]:53841: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.39
country_id: 3017382
description:
Dec 23 14:34:41 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=91.196.152.39, lip=66.85.158.92, TLS handshaking: Connection closed, session=<pJqI1ZpGgZVbxJgn>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.120
country_id: 3017382
description:
Dec 23 14:34:52 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=91.196.152.120, lip=66.85.158.92, TLS: Connection closed, session=<3lIo1ppGh7BbxJh4>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.36
country_id: 3017382
description:
Dec 23 14:34:58 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=91.196.152.36, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<XMiL1ppGT7xbxJgk>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.32
country_id: 3017382
description:
Dec 23 14:35:01 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.196.152.32, lip=66.85.158.92, TLS: Connection closed, session=<99G71ppGO5RbxJgg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.37.62
country_id: 3144096
description:
2025-12-23 14:36:10 dovecot_login authenticator failed for H=([127.0.0.1]) [178.232.37.62]:55587: 535 Incorrect authentication data (set_id=art@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.13.203
country_id: 3144096
description:
2025-12-23 14:36:21 dovecot_login authenticator failed for H=([127.0.0.1]) [84.211.13.203]:42095: 535 Incorrect authentication data (set_id=art)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.231.213.73
country_id: 3175395
description:
Dec 23 14:36:42 host2 sshd[732257]: Disconnected from invalid user switch 95.231.213.73 port 58830 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 135.129.189.1
country_id: 6252001
description:
[2025-12-23 14:39:05 +0530] info [cpaneld] 135.129.189.1 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.166
country_id: 2993457
description:
Dec 23 14:39:06 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=194.165.16.166, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<Yq9Q5ZpGQQnCpRCm>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 136.227.192.155
country_id: 6252001
description:
[2025-12-23 14:39:04 +0530] info [cpaneld] 136.227.192.155 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.174.170.100
country_id: 6252001
description:
[2025-12-23 14:39:06 +0530] info [cpaneld] 174.174.170.100 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.222.88.228
country_id: 6252001
description:
[2025-12-23 14:39:08 +0530] info [whostmgrd] 98.222.88.228 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 96.245.168.194
country_id: 6252001
description:
[2025-12-23 14:39:09 +0530] info [cpaneld] 96.245.168.194 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.96.29.160
country_id: 6252001
description:
[2025-12-23 14:39:10 +0530] info [cpaneld] 74.96.29.160 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 63.238.131.44
country_id: 6252001
description:
[2025-12-23 14:39:11 +0530] info [cpaneld] 63.238.131.44 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.231.213.73
country_id: 3175395
description:
Dec 23 14:40:50 host2 sshd[736610]: Disconnected from invalid user newuser 95.231.213.73 port 55206 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 23 14:41:43 host2 pure-ftpd[737546]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 161.248.201.228
country_id: 1210997
description:
Dec 23 14:42:26 host2 sshd[738231]: Disconnected from invalid user tp 161.248.201.228 port 50896 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.248.201.228
country_id: 1210997
description:
Dec 23 14:44:23 host2 sshd[740188]: Disconnected from invalid user temp 161.248.201.228 port 51468 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 95.231.213.73
country_id: 3175395
description:
Dec 23 14:45:11 host2 sshd[741480]: Disconnected from invalid user vpnuser1 95.231.213.73 port 38620 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.206
country_id: 1269750
description:
2025-12-23 14:46:00 dovecot_login authenticator failed for H=([125.20.154.97]) [182.95.178.206]:51762: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.217.242.98
country_id: 6252001
description:
[2025-12-23 14:46:58 +0530] info [cpaneld] 73.217.242.98 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.57.191.131
country_id: 6252001
description:
[2025-12-23 14:47:01 +0530] info [cpaneld] 104.57.191.131 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.221.245.59
country_id: 6252001
description:
[2025-12-23 14:47:00 +0530] info [cpaneld] 172.221.245.59 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 35.138.237.124
country_id: 6252001
description:
[2025-12-23 14:47:02 +0530] info [cpaneld] 35.138.237.124 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.151.213.47
country_id: 6252001
description:
[2025-12-23 14:46:56 +0530] info [cpaneld] 73.151.213.47 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 130.51.195.190
country_id: 6252001
description:
[2025-12-23 14:46:57 +0530] info [cpaneld] 130.51.195.190 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.215.187.127
country_id: 6252001
description:
[2025-12-23 14:46:59 +0530] info [whostmgrd] 47.215.187.127 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.16.55.198
country_id: 6252001
description:
[2025-12-23 14:47:41 +0530] info [webmaild] 178.16.55.198 - 587hr@lezzarotech.com "GET /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.119.118
country_id: 1269750
description:
2025-12-23 14:50:26 dovecot_login authenticator failed for H=([125.18.210.161]) [182.95.119.118]:41246: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.36
country_id: 2635167
description:
Dec 23 14:50:37 host2 dovecot[3805015]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=185.247.137.36, lip=66.85.158.92, TLS, session=<eS6IDptG+5+594kk>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.154.160
country_id: 1733045
description:
2025-12-23 14:51:00 dovecot_login authenticator failed for H=([49.124.154.160]) [49.124.154.160]:43420: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.121.1.156
country_id: 6252001
description:
2025-12-23 14:53:19 dovecot_login authenticator failed for H=([127.0.0.1]) [24.121.1.156]:38440: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.102.252.82
country_id: 1819730
description:
2025-12-23 14:53:31 dovecot_login authenticator failed for H=pcd720082.netvigator.com ([127.0.0.1]) [218.102.252.82]:60540: 535 Incorrect authentication data (set_id=kasunp)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.125.246.24
country_id: 798544
description:
Dec 23 14:54:47 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=109.125.246.24, lip=66.85.158.91, TLS, session=<9xJqHJtGYaJtffYY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.67.155.129
country_id: 298795
description:
Dec 23 14:55:07 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=45.67.155.129, lip=66.85.158.91, TLS, session=<kW6SHZtGJrktQ5uB>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 23 14:56:57 host2 dovecot[3805015]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<v74oJZtG1MMDhpQ7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.165.170.41
country_id: 3895114
description:
Dec 23 14:59:25 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=45.165.170.41, lip=66.85.158.91, TLS, session=<E13pLJtGv94tpaop>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.153.135
country_id: 1819730
description:
2025-12-23 14:59:02 dovecot_login authenticator failed for H=(223-197-153-135.static.imsbiz.com) [223.197.153.135]:61274: 535 Incorrect authentication data (set_id=bostonlanka@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 23 14:59:20 host2 dovecot[3805015]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<Nza1LZtGdsMDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.38
country_id: 6252001
description:
Dec 23 14:59:31 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.38, lip=66.85.158.91, TLS, session=<CJtWLptGoPnN0h8m>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.161.73
country_id: 3144096
description:
2025-12-23 14:59:33 dovecot_login authenticator failed for H=(73-161-97-62.cust.smartcall.no) [62.97.161.73]:48443: 535 Incorrect authentication data (set_id=bostonlanka)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 23 14:59:38 host2 dovecot[3805015]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<9z28LptG0s4DhpQ7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.59.135.223
country_id: 1269750
description:
Dec 23 14:59:47 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<gihan>, method=PLAIN, rip=103.59.135.223, lip=66.85.158.91, TLS, session=<c9YaLptGVM9nO4ff>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.37.8
country_id: 798544
description:
2025-12-23 15:00:58 dovecot_login authenticator failed for H=89-67-37-8.dynamic.play.pl [89.67.37.8]:50155: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 23 15:00:30 host2 dovecot[3805015]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<X5DWMZtGtKIDhpQ7>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.123.53.88
country_id: 1269750
description:
Dec 23 15:00:38 host2 sshd[756550]: Disconnected from invalid user john1 103.123.53.88 port 36590 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.1.66.154
country_id: 1694008
description:
2025-12-23 15:02:06 dovecot_login authenticator failed for H=(122.55.57.177.pldt.net) [210.1.66.154]:60365: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.118.138
country_id: 3144096
description:
2025-12-23 15:02:25 dovecot_login authenticator failed for H=(cm-46.212.118.138.get.no) [46.212.118.138]:50520: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.125.83.34
country_id: 1880251
description:
2025-12-23 15:01:31 dovecot_login authenticator failed for H=([203.125.110.142]) [203.125.83.34]:63189: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.123.53.88
country_id: 1269750
description:
Dec 23 15:01:53 host2 sshd[757411]: Disconnected from invalid user jenkins 103.123.53.88 port 43796 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 23 15:02:38 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<gXZ0OZtGkqEDhpQ7>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 23 15:02:53 host2 dovecot[3805015]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<B01jOptGVqYDhpQ7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.247.189.189
country_id: 6252001
description:
2025-12-23 15:03:29 dovecot_login authenticator failed for H=([50.247.189.189]) [50.247.189.189]:3160: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.121.175.220
country_id: 3579143
description:
2025-12-23 15:03:49 dovecot_login authenticator failed for H=(client-adsl-93-121-175-220.mediaserv.net) [93.121.175.220]:35004: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 23 15:04:39 host2 dovecot[3805015]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<p7+vQJtGTLIDhpQ7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.181.19.144
country_id: 1527747
description:
2025-12-23 15:12:16 dovecot_login authenticator failed for H=([127.0.0.1]) [158.181.19.144]:50500: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.43.80
country_id: 953987
description:
Dec 23 15:13:19 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=102.64.43.80, lip=66.85.158.91, TLS, session=<+HaVXptGmt9mQCtQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.2
country_id: 1733045
description:
2025-12-23 15:14:55 dovecot_login authenticator failed for H=([49.124.151.2]) [49.124.151.2]:52358: 535 Incorrect authentication data (set_id=prasanka@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.70.19.11
country_id: 3469034
description:
2025-12-23 15:16:51 dovecot_login authenticator failed for H=(45-70-19-11.static.damsolutionsturbo.com.br) [45.70.19.11]:52055: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.103.253.48
country_id: 1820814
description:
2025-12-23 15:17:30 dovecot_login authenticator failed for H=(48-253.adsl.static.espeed.com.bn) [118.103.253.48]:42587: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.171.204.144
country_id: 6252001
description:
[2025-12-23 15:19:00 +0530] info [cpaneld] 70.171.204.144 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 138.229.132.218
country_id: 6252001
description:
[2025-12-23 15:19:04 +0530] info [whostmgrd] 138.229.132.218 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.17.23.71
country_id: 6252001
description:
[2025-12-23 15:19:07 +0530] info [cpaneld] 45.17.23.71 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.170.136.157
country_id: 6252001
description:
[2025-12-23 15:19:06 +0530] info [cpaneld] 97.170.136.157 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.34.17.69
country_id: 6252001
description:
[2025-12-23 15:19:05 +0530] info [cpaneld] 76.34.17.69 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.129.193.127
country_id: 6252001
description:
[2025-12-23 15:19:03 +0530] info [cpaneld] 69.129.193.127 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.162.161.243
country_id: 6252001
description:
[2025-12-23 15:19:02 +0530] info [cpaneld] 104.162.161.243 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.168.117
country_id: 3144096
description:
2025-12-23 15:20:06 dovecot_login authenticator failed for H=(cm-178.232.168.117.get.no) [178.232.168.117]:34840: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.227.166
country_id: 1269750
description:
2025-12-23 15:20:36 dovecot_login authenticator failed for H=([128.185.227.166]) [128.185.227.166]:40684: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.73.203.113
country_id: 2542007
description:
2025-12-23 15:20:36 dovecot_login authenticator failed for H=([105.73.203.113]) [105.73.203.113]:36909: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 23 15:22:05 host2 sshd[776439]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.200.10
country_id: 1269750
description:
2025-12-23 15:21:18 dovecot_login authenticator failed for H=([125.19.175.85]) [122.186.200.10]:50068: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.2.44.54
country_id: 1269750
description:
2025-12-23 15:22:44 dovecot_login authenticator failed for H=(static.bb.alp.61.2.44.54.bsnl.in) [61.2.44.54]:39236: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.17.124.75
country_id: 1269750
description:
2025-12-23 15:22:54 dovecot_login authenticator failed for H=(abts-kk-static-182.209.166.122.airtelbroadband.in) [125.17.124.75]:37892: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.47.169
country_id: 1819730
description:
2025-12-23 15:23:12 dovecot_login authenticator failed for H=169.47.246.220.static.netvigator.com [220.246.47.169]:59542: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.229.126
country_id: 1269750
description:
2025-12-23 15:23:18 dovecot_login authenticator failed for H=([125.21.7.97]) [128.185.229.126]:42636: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.128.184.28
country_id: 6252001
description:
[2025-12-23 15:28:01 +0530] info [cpaneld] 66.128.184.28 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.241.40.136
country_id: 6252001
description:
[2025-12-23 15:28:02 +0530] info [cpaneld] 23.241.40.136 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 35.148.218.124
country_id: 6252001
description:
[2025-12-23 15:28:03 +0530] info [cpaneld] 35.148.218.124 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.68.107.140
country_id: 6252001
description:
[2025-12-23 15:28:04 +0530] info [whostmgrd] 173.68.107.140 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.173.139.151
country_id: 6252001
description:
[2025-12-23 15:28:05 +0530] info [cpaneld] 71.173.139.151 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 162.207.59.43
country_id: 6252001
description:
[2025-12-23 15:28:06 +0530] info [cpaneld] 162.207.59.43 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.130.130.239
country_id: 6252001
description:
[2025-12-23 15:28:08 +0530] info [cpaneld] 64.130.130.239 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.16.55.198
country_id: 6252001
description:
[2025-12-23 15:29:40 +0530] info [webmaild] 178.16.55.198 - 587hr@lezzarotech.com "GET /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-23 15:33:33 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:58047: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 192.253.229.214
country_id: 6252001
description:
Dec 23 15:33:51 host2 pure-ftpd[788977]: (?@192.253.229.214) [INFO] New connection from 192.253.229.214


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.218.149
country_id: 1880251
description:
Dec 23 15:38:57 host2 sshd[793520]: Disconnected from invalid user admin 152.32.218.149 port 57874 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.249.205.94
country_id: 3625428
description:
Dec 23 15:39:30 host2 sshd[793993]: Disconnected from invalid user test3 201.249.205.94 port 33386 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.240.210
country_id: 1269750
description:
2025-12-23 15:40:13 dovecot_login authenticator failed for H=(nsg-corporate-210.240.187.122.airtel.in) [122.187.240.210]:54670: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.226.118
country_id: 1269750
description:
2025-12-23 15:40:31 dovecot_login authenticator failed for H=([27.123.119.219]) [182.95.226.118]:50530: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.98.176.164
country_id: 1643084
description:
Dec 23 15:41:09 host2 sshd[795975]: Disconnected from invalid user admin 103.98.176.164 port 49650 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.98.176.164
country_id: 1643084
description:
Dec 23 15:41:45 host2 sshd[796572]: Disconnected from invalid user west 103.98.176.164 port 56574 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.98.176.164
country_id: 1643084
description:
Dec 23 15:42:20 host2 sshd[797169]: Disconnected from invalid user testadmin 103.98.176.164 port 51250 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 201.249.205.94
country_id: 3625428
description:
Dec 23 15:43:00 host2 sshd[797740]: Disconnected from invalid user user 201.249.205.94 port 49068 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 23 15:44:17 host2 pure-ftpd[799193]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.70.126
country_id: 1269750
description:
2025-12-23 15:49:04 dovecot_login authenticator failed for H=(nsg-corporate-137.222.185.122.airtel.in) [182.78.70.126]:44194: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.191.12
country_id: 99237
description:
2025-12-23 15:48:41 dovecot_login authenticator failed for H=([65.20.191.12]) [65.20.191.12]:46067: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.220.90
country_id: 1269750
description:
2025-12-23 15:48:59 dovecot_login authenticator failed for H=(dsl-tn-dynamic-137.209.22.125.airtelbroadband.in) [128.185.220.90]:53704: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.84.155.190
country_id: 6252001
description:
2025-12-23 15:49:34 dovecot_login authenticator failed for H=(pool-162-84-155-190.nycmny.fios.verizon.net) [162.84.155.190]:51878: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.243.27.122
country_id: 1819730
description:
Dec 23 15:49:50 host2 sshd[805844]: Disconnected from invalid user opscode 103.243.27.122 port 55778 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 137.184.30.179
country_id: 6252001
description:
Dec 23 15:51:23 host2 sshd[807892]: Disconnected from invalid user vicente 137.184.30.179 port 53966 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.190.112.196
country_id: 6252001
description:
Dec 23 15:51:49 host2 sshd[808314]: Disconnected from invalid user abel 146.190.112.196 port 37930 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.185.18.67
country_id: 3469034
description:
2025-12-23 15:51:52 dovecot_login authenticator failed for H=(cyrela.static.gvt.net.br) [179.185.18.67]:40448: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.243.27.122
country_id: 1819730
description:
Dec 23 15:51:53 host2 sshd[808365]: Disconnected from invalid user testftp 103.243.27.122 port 55140 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.168.135.187
country_id: 1643084
description:
Dec 23 15:51:55 host2 sshd[808418]: Disconnected from invalid user jay 103.168.135.187 port 44630 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.243.27.122
country_id: 1819730
description:
Dec 23 15:52:31 host2 sshd[809224]: Disconnected from invalid user benoit 103.243.27.122 port 39262 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.190.112.196
country_id: 6252001
description:
Dec 23 15:54:41 host2 sshd[812147]: Disconnected from invalid user tsbot 146.190.112.196 port 38534 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.190.42.55
country_id: 6252001
description:
Dec 23 15:55:31 host2 sshd[813303]: Disconnected from invalid user carlos1 172.190.42.55 port 33646 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 146.190.112.196
country_id: 6252001
description:
Dec 23 15:55:52 host2 sshd[813627]: Disconnected from invalid user gogs 146.190.112.196 port 43202 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.190.112.196
country_id: 6252001
description:
Dec 23 15:56:26 host2 sshd[814143]: Disconnected from invalid user toro 146.190.112.196 port 53042 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 137.184.30.179
country_id: 6252001
description:
Dec 23 15:56:39 host2 sshd[814336]: Disconnected from invalid user toto 137.184.30.179 port 37970 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.190.42.55
country_id: 6252001
description:
Dec 23 15:56:46 host2 sshd[814431]: Disconnected from invalid user cynthia 172.190.42.55 port 39176 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.203.59.187
country_id: 290557
description:
Dec 23 15:56:58 host2 sshd[814592]: Disconnected from invalid user ansible 20.203.59.187 port 54382 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.190.42.55
country_id: 6252001
description:
Dec 23 15:57:23 host2 sshd[815007]: Disconnected from invalid user benoit 172.190.42.55 port 54128 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.203.59.187
country_id: 290557
description:
Dec 23 15:57:38 host2 sshd[815229]: Disconnected from invalid user matt 20.203.59.187 port 56634 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 80.82.77.202
country_id: 2750405
description:
Dec 23 16:00:13 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=80.82.77.202, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<EoVuB5xGYOpQUk3K>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.235.248.73
country_id: 3469034
description:
2025-12-23 16:08:43 dovecot_login authenticator failed for H=(186.235.248.73.girardi-rs.com.br) [186.235.248.73]:57580: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.11.34.221
country_id: 1210997
description:
2025-12-23 16:09:00 dovecot_login authenticator failed for H=(113-11-34-221-smile.com.bd) [113.11.34.221]:57912: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 23 16:09:54 host2 sshd[827793]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.243.175
country_id: 732800
description:
2025-12-23 16:11:53 dovecot_login authenticator failed for H=(92.62.243.175.fibermax.bg) [92.62.243.175]:39393: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 14.102.101.248
country_id: 1269750
description:
Dec 23 16:12:12 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 25 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=14.102.101.248, lip=66.85.158.91, TLS, session=<0YnNMJxGvcAOZmX4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.0.140
country_id: 2300660
description:
Dec 23 16:12:38 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 23 secs): user=<gihan>, method=PLAIN, rip=41.139.0.140, lip=66.85.158.91, TLS, session=<thVsMpxGxLMpiwCM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.248.201.94
country_id: 1269750
description:
2025-12-23 16:12:19 dovecot_login authenticator failed for H=([117.248.201.94]) [117.248.201.94]:44330: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.8.125.130
country_id: 3469034
description:
2025-12-23 16:12:32 dovecot_login authenticator failed for H=([189.8.125.130]) [189.8.125.130]:57253: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.59.178.27
country_id: 298795
description:
2025-12-23 16:15:12 dovecot_login authenticator failed for H=([188.59.178.27]) [188.59.178.27]:38167: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.226.13
country_id: 1269750
description:
2025-12-23 16:15:37 dovecot_login authenticator failed for H=(nsg-corporate-13.226.187.122.airtel.in) [122.187.226.13]:36339: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.171.51
country_id: 3175395
description:
Dec 23 16:16:39 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=185.15.171.51, lip=66.85.158.91, TLS, session=<G9EsQZxGMOK5D6sz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.89.137.240
country_id: 3469034
description:
Dec 23 16:16:59 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<designdpt>, method=PLAIN, rip=190.89.137.240, lip=66.85.158.91, TLS, session=<9LNVQpxGX9u+WYnw>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.242.74
country_id: 1269750
description:
2025-12-23 16:17:33 dovecot_login authenticator failed for H=([128.185.222.216]) [128.185.242.74]:48250: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.194.231
country_id: 3144096
description:
2025-12-23 16:18:10 dovecot_login authenticator failed for H=(cm-178.232.194.231.get.no) [178.232.194.231]:45023: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.106.196.4
country_id: 6252001
description:
Dec 23 16:18:32 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.106.196.4, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<zQjqSJxGGOkUasQE>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.145.94
country_id: 3996063
description:
2025-12-23 16:19:34 dovecot_login authenticator failed for H=([127.0.0.1]) [177.236.145.94]:54257: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.231.114
country_id: 1269750
description:
2025-12-23 16:19:48 dovecot_login authenticator failed for H=([127.0.0.1]) [128.185.231.114]:53554: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.16.52.51
country_id: 2921044
description:
[2025-12-23 16:22:37 +0530] info [webmaild] 178.16.52.51 - 587hr@lezzarotech.com "GET /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.166.253.226
country_id: 1269750
description:
2025-12-23 16:23:24 dovecot_login authenticator failed for H=(abts-kk-static-226.253.166.122.airtelbroadband.in) [122.166.253.226]:40389: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.141.252.55
country_id: 6252001
description:
2025-12-23 16:24:40 dovecot_login authenticator failed for H=([38.141.252.55]) [38.141.252.55]:40858: 535 Incorrect authentication data (set_id=accounts@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.23.72.121
country_id: 6252001
description:
2025-12-23 16:24:57 dovecot_login authenticator failed for H=([209.23.72.121]) [209.23.72.121]:51222: 535 Incorrect authentication data (set_id=accounts)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.8.5.53
country_id: 6252001
description:
[2025-12-23 16:29:22 +0530] info [cpaneld] 99.8.5.53 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.66.224.47
country_id: 6252001
description:
[2025-12-23 16:29:25 +0530] info [cpaneld] 99.66.224.47 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.57.16.238
country_id: 6252001
description:
[2025-12-23 16:29:24 +0530] info [whostmgrd] 104.57.16.238 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.132.56.217
country_id: 6252001
description:
[2025-12-23 16:29:27 +0530] info [cpaneld] 74.132.56.217 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.82.34.218
country_id: 6252001
description:
[2025-12-23 16:29:26 +0530] info [cpaneld] 73.82.34.218 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.105.33.168
country_id: 6252001
description:
[2025-12-23 16:29:18 +0530] info [cpaneld] 70.105.33.168 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 184.23.61.229
country_id: 6252001
description:
[2025-12-23 16:29:23 +0530] info [cpaneld] 184.23.61.229 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.220.199.98
country_id: 2077456
description:
2025-12-23 16:40:25 dovecot_login authenticator failed for H=111-220-199-98.dyn.ip.vocus.au [111.220.199.98]:50319: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.111.48
country_id: 3144096
description:
2025-12-23 16:40:43 dovecot_login authenticator failed for H=([46.212.111.48]) [46.212.111.48]:37526: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.246.94
country_id: 1269750
description:
2025-12-23 16:41:40 dovecot_login authenticator failed for H=(nsg-corporate-177.174.185.122.airtel.in) [152.52.246.94]:44128: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.215.110.96
country_id: 3144096
description:
2025-12-23 16:42:03 dovecot_login authenticator failed for H=(cm-84.215.110.96.get.no) [84.215.110.96]:56750: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.87.112.85
country_id: 3469034
description:
Dec 23 16:44:24 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=177.87.112.85, lip=66.85.158.91, TLS, session=<xtZNpJxGGbmxV3BV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.139.180.127
country_id: 3175395
description:
Dec 23 16:44:42 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<gihan>, method=PLAIN, rip=185.139.180.127, lip=66.85.158.91, TLS, session=<anSCpZxG2si5i7R/>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 23 16:46:40 host2 pure-ftpd[865130]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.120.50
country_id: 1269750
description:
2025-12-23 16:54:20 dovecot_login authenticator failed for H=(nsg-static-89.234.75.182-airtel.com) [182.95.120.50]:55280: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.248.30.205
country_id: 1269750
description:
2025-12-23 16:54:57 dovecot_login authenticator failed for H=([103.248.30.205]) [103.248.30.205]:45916: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.166.54.40
country_id: 453733
description:
2025-12-23 16:57:12 dovecot_login authenticator failed for H=40-54-166-83.dyn.estpak.ee [83.166.54.40]:38009: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.150.36
country_id: 99237
description:
2025-12-23 16:57:34 dovecot_login authenticator failed for H=([65.20.150.36]) [65.20.150.36]:51104: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 74.249.178.165
country_id: 6252001
description:
Dec 23 16:58:39 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=74.249.178.165, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<5bpo2JxGGrxK+bKl>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 199.58.186.189
country_id: 6252001
description:
[2025-12-23 16:59:06 +0530] info [webmaild] 199.58.186.189 - info@bostonlanka.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.124.229
country_id: 337996
description:
2025-12-23 17:02:17 dovecot_login authenticator failed for H=([196.189.124.229]) [196.189.124.229]:55694: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.97.74
country_id: 1269750
description:
2025-12-23 17:02:50 dovecot_login authenticator failed for H=([182.79.70.81]) [27.123.97.74]:53710: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 38.148.242.232
country_id: 6252001
description:
Dec 23 17:16:00 host2 pure-ftpd[897311]: (?@38.148.242.232) [INFO] New connection from 38.148.242.232


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 23 17:17:15 host2 sshd[898757]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.220.168
country_id: 337996
description:
2025-12-23 17:20:10 dovecot_login authenticator failed for H=([196.190.220.168]) [196.190.220.168]:39668: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.206.51
country_id: 3144096
description:
2025-12-23 17:20:24 dovecot_login authenticator failed for H=(cm-178.232.206.51.get.no) [178.232.206.51]:41764: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.22
country_id: 1269750
description:
2025-12-23 17:21:06 dovecot_login authenticator failed for H=([182.95.20.31]) [182.95.228.22]:54896: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.80
country_id: 3144096
description:
2025-12-23 17:21:34 dovecot_login authenticator failed for H=(80-170-97-62.cust.smartcall.no) [62.97.170.80]:54509: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.37.253.93
country_id: 6252001
description:
2025-12-23 17:23:43 dovecot_plain authenticator failed for H=([169.254.167.31]) [193.37.253.93]:55963: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 193.37.253.93
country_id: 6252001
description:
Dec 23 17:24:09 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (no auth attempts in 5 secs): user=<>, rip=193.37.253.93, lip=66.85.158.91, TLS handshaking: Connection closed, session=<QjyTM51Glg7BJf1d>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.215.245.175
country_id: 3469034
description:
2025-12-23 17:24:11 dovecot_login authenticator failed for H=(visaotur.sdr.gvt.net.br) [186.215.245.175]:50719: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.237.119.118
country_id: 6252001
description:
2025-12-23 17:24:44 dovecot_login authenticator failed for H=118-119-237-24.gci.net [24.237.119.118]:48250: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.115.201.137
country_id: 6252001
description:
[2025-12-23 17:27:10 +0530] info [cpaneld] 23.115.201.137 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.91.244.69
country_id: 6252001
description:
[2025-12-23 17:27:14 +0530] info [whostmgrd] 173.91.244.69 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.176.161.229
country_id: 6252001
description:
[2025-12-23 17:27:13 +0530] info [cpaneld] 76.176.161.229 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.94.85.50
country_id: 6252001
description:
[2025-12-23 17:27:16 +0530] info [cpaneld] 97.94.85.50 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.37.227.28
country_id: 6252001
description:
[2025-12-23 17:27:17 +0530] info [cpaneld] 47.37.227.28 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.151.70.150
country_id: 2750405
description:
2025-12-23 17:26:47 dovecot_login authenticator failed for H=31-151-70-150.dynamic.upc.nl [31.151.70.150]:44427: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.231.27.63
country_id: 6252001
description:
[2025-12-23 17:27:11 +0530] info [cpaneld] 104.231.27.63 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.11.48.208
country_id: 6252001
description:
[2025-12-23 17:27:20 +0530] info [cpaneld] 24.11.48.208 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.186.193.149
country_id: 1643084
description:
2025-12-23 17:27:23 dovecot_login authenticator failed for H=([103.186.193.149]) [103.186.193.149]:55590: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.109.154.54
country_id: 3469034
description:
2025-12-23 17:27:54 dovecot_login authenticator failed for H=([189.109.154.54]) [189.109.154.54]:42393: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.234.54
country_id: 1269750
description:
2025-12-23 17:28:02 dovecot_login authenticator failed for H=(nsg-corporate-54.234.187.122.airtel.in) [122.187.234.54]:33056: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 213.92.223.8
country_id: 798544
description:
Dec 23 17:33:17 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=213.92.223.8, lip=66.85.158.91, TLS, session=<9cE4U51GlobVXN8I>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.30.97.33
country_id: 272103
description:
Dec 23 17:34:07 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@seyawin.com>, method=PLAIN, rip=193.30.97.33, lip=66.85.158.91, session=<L/QSV51GeKXBHmEh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.64.94
country_id: 3469034
description:
2025-12-23 17:33:25 dovecot_login authenticator failed for H=([189.108.156.41]) [187.8.64.94]:57575: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.224.108.55
country_id: 3469034
description:
Dec 23 17:33:38 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=186.224.108.55, lip=66.85.158.91, TLS, session=<YRdgVJ1GZ6m64Gw3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.182.130
country_id: 1269750
description:
2025-12-23 17:33:56 dovecot_login authenticator failed for H=([182.95.182.130]) [182.95.182.130]:40446: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.38.98.14
country_id: 3017382
description:
Dec 23 17:35:41 host2 sshd[915281]: Disconnected from invalid user bot1 51.38.98.14 port 59336 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.37.231.46
country_id: 6252001
description:
Dec 23 17:35:57 host2 sshd[915458]: Disconnected from invalid user nexus 50.37.231.46 port 40708 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.129.122.185
country_id: 3923057
description:
Dec 23 17:36:04 host2 sshd[915556]: Disconnected from invalid user mapr 190.129.122.185 port 48070 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.8.108.39
country_id: 3469034
description:
Dec 23 17:36:08 host2 sshd[915609]: Disconnected from invalid user sunil 189.8.108.39 port 58908 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.38.98.14
country_id: 3017382
description:
Dec 23 17:36:15 host2 sshd[915664]: Disconnected from invalid user sftptest 51.38.98.14 port 46444 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.129.122.185
country_id: 3923057
description:
Dec 23 17:36:48 host2 sshd[915970]: Disconnected from invalid user python 190.129.122.185 port 38920 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.8.108.39
country_id: 3469034
description:
Dec 23 17:36:52 host2 sshd[916033]: Disconnected from invalid user jitendra 189.8.108.39 port 34920 [preauth]


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.78
country_id: 2635167
description:
Dec 23 17:37:19 host2 dovecot[3805015]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=185.247.137.78, lip=66.85.158.91, TLS, session=<+82pYp1Gtcu594lO>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.37.231.46
country_id: 6252001
description:
Dec 23 17:36:31 host2 sshd[915843]: Disconnected from invalid user sunil 50.37.231.46 port 51632 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.129.122.185
country_id: 3923057
description:
Dec 23 17:37:31 host2 sshd[916508]: Disconnected from invalid user rabbitmq 190.129.122.185 port 56474 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 50.37.231.46
country_id: 6252001
description:
Dec 23 17:37:42 host2 sshd[916671]: Disconnected from invalid user mapr 50.37.231.46 port 40366 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.94.135.131
country_id: 6252001
description:
[2025-12-23 17:39:07 +0530] info [whostmgrd] 66.94.135.131 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.251.161.33
country_id: 6252001
description:
[2025-12-23 17:39:08 +0530] info [cpaneld] 69.251.161.33 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.170.9.110
country_id: 6252001
description:
[2025-12-23 17:39:09 +0530] info [cpaneld] 73.170.9.110 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 134.56.160.112
country_id: 6252001
description:
[2025-12-23 17:39:11 +0530] info [cpaneld] 134.56.160.112 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.249.52.45
country_id: 6252001
description:
[2025-12-23 17:39:02 +0530] info [cpaneld] 71.249.52.45 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.60.7
country_id: 6252001
description:
[2025-12-23 17:39:04 +0530] info [cpaneld] 172.56.60.7 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.113.183.72
country_id: 6252001
description:
[2025-12-23 17:39:05 +0530] info [cpaneld] 99.113.183.72 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.72.143.2
country_id: 1269750
description:
2025-12-23 17:41:45 dovecot_login authenticator failed for H=(ws99-36-153-203.rcil.gov.in) [182.72.143.2]:41886: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.219.138.45
country_id: 3996063
description:
2025-12-23 17:42:20 dovecot_login authenticator failed for H=(189.219.138.45-clientes-izzi.mx) [189.219.138.45]:44353: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 23 17:49:10 host2 pure-ftpd[927490]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.49.147.210
country_id: 1605651
description:
2025-12-23 17:51:43 dovecot_login authenticator failed for H=([110.49.147.210]) [110.49.147.210]:42914: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.124.139.77
country_id: 3144096
description:
2025-12-23 17:51:57 dovecot_login authenticator failed for H=([188.124.139.77]) [188.124.139.77]:55104: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.140.18.186
country_id: 1269750
description:
2025-12-23 17:54:17 dovecot_login authenticator failed for H=([103.140.18.186]) [103.140.18.186]:53242: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.116.247.27
country_id: 1522867
description:
2025-12-23 17:54:30 dovecot_login authenticator failed for H=([212.116.247.27]) [212.116.247.27]:47482: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.26.79
country_id: 1269750
description:
Dec 23 17:55:16 host2 sshd[932661]: Disconnected from invalid user hadoop 139.59.26.79 port 54264 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.40.63
country_id: 1819730
description:
2025-12-23 17:57:12 dovecot_login authenticator failed for H=063.40.246.220.static.netvigator.com [220.246.40.63]:53890: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.73.190.65
country_id: 2542007
description:
2025-12-23 17:56:49 dovecot_login authenticator failed for H=([105.73.190.65]) [105.73.190.65]:34254: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.117.148
country_id: 1819730
description:
Dec 23 17:58:28 host2 sshd[935371]: Disconnected from invalid user admin 101.36.117.148 port 42896 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.172.88.155
country_id: 3996063
description:
2025-12-23 17:59:14 dovecot_login authenticator failed for H=(201.172.88.155-clientes-izzi.mx) [201.172.88.155]:40600: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.111.32.174
country_id: 1643084
description:
Dec 23 18:00:08 host2 sshd[936253]: Disconnected from invalid user admin2 27.111.32.174 port 50586 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 139.59.26.79
country_id: 1269750
description:
Dec 23 18:00:16 host2 sshd[936353]: Disconnected from invalid user admin 139.59.26.79 port 37142 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.41.137
country_id: 337996
description:
2025-12-23 17:59:44 dovecot_login authenticator failed for H=([196.190.43.138]) [196.190.41.137]:31125: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.117.148
country_id: 1819730
description:
Dec 23 18:00:27 host2 sshd[936560]: Disconnected from invalid user dcadmin 101.36.117.148 port 58700 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.223.101
country_id: 1880251
description:
Dec 23 18:00:35 host2 sshd[936624]: Disconnected from invalid user design 45.78.223.101 port 57598 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.32.253.235
country_id: 99237
description:
2025-12-23 18:00:54 dovecot_login authenticator failed for H=([213.32.253.235]) [213.32.253.235]:55257: 535 Incorrect authentication data (set_id=hnt@essenceceylontea.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.26.79
country_id: 1269750
description:
Dec 23 18:00:56 host2 sshd[936899]: Disconnected from invalid user git 139.59.26.79 port 35710 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.111.32.174
country_id: 1643084
description:
Dec 23 18:02:02 host2 sshd[937730]: Disconnected from invalid user mcbserver 27.111.32.174 port 60884 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.26.79
country_id: 1269750
description:
Dec 23 18:01:33 host2 sshd[937326]: Disconnected from invalid user robot 139.59.26.79 port 58262 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.36.117.148
country_id: 1819730
description:
Dec 23 18:01:37 host2 sshd[937369]: Disconnected from invalid user admin 101.36.117.148 port 60164 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.201.71.44
country_id: 6252001
description:
[2025-12-23 18:03:55 +0530] info [cpaneld] 71.201.71.44 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.32.144.82
country_id: 6252001
description:
[2025-12-23 18:03:58 +0530] info [cpaneld] 76.32.144.82 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.14.152.72
country_id: 6252001
description:
[2025-12-23 18:03:57 +0530] info [cpaneld] 76.14.152.72 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.130.2.46
country_id: 6252001
description:
[2025-12-23 18:03:48 +0530] info [cpaneld] 74.130.2.46 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.111.104.2
country_id: 6252001
description:
[2025-12-23 18:03:50 +0530] info [cpaneld] 73.111.104.2 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.2.55.83
country_id: 6252001
description:
[2025-12-23 18:03:51 +0530] info [cpaneld] 160.2.55.83 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.143.28.201
country_id: 6252001
description:
[2025-12-23 18:03:54 +0530] info [whostmgrd] 69.143.28.201 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.223.101
country_id: 1880251
description:
Dec 23 18:05:14 host2 sshd[940601]: Disconnected from invalid user test 45.78.223.101 port 51588 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 23 18:05:30 host2 sshd[940958]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.219.221.53
country_id: 6251999
description:
2025-12-23 18:06:29 dovecot_login authenticator failed for H=([207.219.221.53]) [207.219.221.53]:52091: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.126.146
country_id: 3144096
description:
2025-12-23 18:06:47 dovecot_login authenticator failed for H=(cm-178.232.126.146.get.no) [178.232.126.146]:56721: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.235.44
country_id: 1269750
description:
2025-12-23 18:07:35 dovecot_login authenticator failed for H=(beta.corporatecitizen.in) [103.29.235.44]:36344: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.59.26
country_id: 1269750
description:
2025-12-23 18:07:58 dovecot_login authenticator failed for H=([125.23.125.209]) [122.187.59.26]:60084: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 23 18:08:29 host2 sshd[942874]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.223.101
country_id: 1880251
description:
Dec 23 18:08:33 host2 sshd[942904]: Disconnected from invalid user gitlab 45.78.223.101 port 44144 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.227.254.155
country_id: 3703430
description:
Dec 23 18:09:20 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=45.227.254.155, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<13wn1Z1Gav4t4/6b>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.103.27.217
country_id: 390903
description:
2025-12-23 18:09:28 dovecot_login authenticator failed for H=owniyj.static.otenet.gr ([127.0.0.1]) [62.103.27.217]:54088: 535 Incorrect authentication data (set_id=arts@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.106
country_id: 1269750
description:
2025-12-23 18:09:55 dovecot_login authenticator failed for H=([127.0.0.1]) [182.95.228.106]:40882: 535 Incorrect authentication data (set_id=arts)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.227.181.57
country_id: 6252001
description:
Dec 23 18:17:24 host2 dovecot[3805015]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=165.227.181.57, lip=66.85.158.91, TLS, session=<JrMM8p1GuN2l47U5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.65.99
country_id: 3144096
description:
2025-12-23 18:19:05 dovecot_login authenticator failed for H=(cm-178.232.65.99.get.no) [178.232.65.99]:36630: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.220.30
country_id: 1269750
description:
2025-12-23 18:19:23 dovecot_login authenticator failed for H=(nsg-corporate-153.189.187.122.airtel.in) [125.19.220.30]:46094: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.201.138
country_id: 1269750
description:
2025-12-23 18:21:54 dovecot_login authenticator failed for H=([128.185.201.138]) [128.185.201.138]:57648: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.57
country_id: 1733045
description:
2025-12-23 18:22:41 dovecot_login authenticator failed for H=([49.124.151.57]) [49.124.151.57]:51538: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.249.97.118
country_id: 3469034
description:
Dec 23 18:31:10 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=167.249.97.118, lip=66.85.158.91, TLS, session=<hi8kIp5GGbSn+WF2>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.54.99
country_id: 953987
description:
Dec 23 18:31:33 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=102.129.54.99, lip=66.85.158.91, TLS, session=<kNdnI55G9qNmgTZj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 83.143.27.7
country_id: 933860
description:
Dec 23 18:35:57 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=83.143.27.7, lip=66.85.158.91, TLS, session=<NwEPM55GY9VTjxsH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.207.35.211
country_id: 6290252
description:
Dec 23 18:36:14 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<gihan>, method=PLAIN, rip=109.207.35.211, lip=66.85.158.91, TLS, session=<W01qNJ5GBKhtzyPT>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.15.87.157
country_id: 6252001
description:
[2025-12-23 18:39:23 +0530] info [cpaneld] 24.15.87.157 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.249.126.252
country_id: 6252001
description:
[2025-12-23 18:39:31 +0530] info [cpaneld] 98.249.126.252 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.252.6.93
country_id: 6252001
description:
[2025-12-23 18:39:32 +0530] info [cpaneld] 67.252.6.93 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.134.28.74
country_id: 6252001
description:
[2025-12-23 18:39:25 +0530] info [cpaneld] 72.134.28.74 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.90.7.84
country_id: 6252001
description:
[2025-12-23 18:39:27 +0530] info [cpaneld] 76.90.7.84 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.74.63.10
country_id: 6252001
description:
[2025-12-23 18:39:28 +0530] info [whostmgrd] 174.74.63.10 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.9.20.106
country_id: 6252001
description:
[2025-12-23 18:39:30 +0530] info [cpaneld] 24.9.20.106 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.113.225.118
country_id: 6252001
description:
[2025-12-23 18:43:36 +0530] info [cpaneld] 68.113.225.118 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.250.135.104
country_id: 6252001
description:
[2025-12-23 18:43:37 +0530] info [cpaneld] 108.250.135.104 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.121.104.14
country_id: 6252001
description:
[2025-12-23 18:43:38 +0530] info [cpaneld] 24.121.104.14 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.71.203.169
country_id: 6252001
description:
[2025-12-23 18:43:30 +0530] info [cpaneld] 75.71.203.169 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.188.242.176
country_id: 6252001
description:
[2025-12-23 18:43:31 +0530] info [cpaneld] 47.188.242.176 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 184.184.189.48
country_id: 6252001
description:
[2025-12-23 18:43:33 +0530] info [cpaneld] 184.184.189.48 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.168.237.155
country_id: 6252001
description:
[2025-12-23 18:43:34 +0530] info [whostmgrd] 76.168.237.155 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.21
country_id: 798549
description:
Dec 23 18:48:15 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=85.217.149.21, lip=66.85.158.92, session=<7f1eYJ5GOr9V2ZUV>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 23 18:51:48 host2 pure-ftpd[979063]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.241.87.197
country_id: 6252001
description:
Dec 23 18:51:58 host2 sshd[979251]: Disconnected from invalid user postgres 162.241.87.197 port 37574 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 192.241.155.116
country_id: 6252001
description:
Dec 23 18:54:57 host2 pure-ftpd[983194]: (?@192.241.155.116) [INFO] New connection from 192.241.155.116


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 192.241.155.116
country_id: 6252001
description:
Dec 23 18:54:56 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=192.241.155.116, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<gqc/eJ5G1OnA8Zt0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.93.84
country_id: 1269750
description:
2025-12-23 18:55:58 dovecot_login authenticator failed for H=([152.52.93.82]) [152.52.93.84]:10400: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.201.31
country_id: 3144096
description:
2025-12-23 18:56:17 dovecot_login authenticator failed for H=(cm-178.232.201.31.get.no) [178.232.201.31]:38144: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.241.87.197
country_id: 6252001
description:
Dec 23 18:56:18 host2 sshd[984922]: Disconnected from invalid user dev 162.241.87.197 port 36434 [preauth]


