SQLite format 3@ 9,9.v i{h6D HrtfXJ<. xj\N@2$ | n ` R D 6 (  r d V He h #kOFD h (NJA h b"M!5 h K# h'J h.I h=Hu h*GK hYF h-D hC g4B gAsq g@H^ g?I g=4 g}< gn; g T:p g@ 9F g28 g6 g 5 g14 g3o g2Dk gH1U gg/= g Y.) gڬ- gl,m g8+B g* gzw( gYb' gs& g~%j g1$@o g˓#Z g!D g] % gڴ g_i g8= gȧ g gpi g? g-g gŦ<w g+c g+N gē; g%.' gde g”: g ga g gj g& c g;8 gv t g ` g[K g6 gda5 g6=vgfHG03 rTDŽ&G |n׃@%_|.-Vdm<"BLACKy- ZGRAY         Hc : FW f B <    6 * $  l nhKE? rb 0 ( PJzt"9 3 X R L : @ | v p j d ^ ` Z T DDDDDDDDDD8888 : : : : : : : : : : : :MYg&JB ;~tm80"|tohE`Kl ?A:4lifb_[Np߈X܈DۈAֈ>ވO݈M[_وLՈ;Ԉ, x ʍ!<͈ExS Bg[6 CytG SC |VH: WQH <_.Z%|gi TVC$Z$~qm[{t.^xQbk+R&׉]3 <2`Md(ш!P@ψ҈& ӈ)       JV T { ; ^ M #  fEY ) n  o 9&j  : ]  [ * [  +  m  ( w L4 < ~ 7 l  Ko 3017382A 2077456M 1733045 27821132' 3923057  130758; 1269750KM 1819730N 1814991I% 3374766R 1835841Jz 6252001Hia 2328926! 1819730@ 6252001E  6252001@/ 1814991A/ 12109976 2017370DG 12697505I 3469034( 1835841= 1814991= 298795 2510769Im 1814991: 62520012T 1880251" 18149916y 1643084p 20173703) 690791~C 290557( 181499109 18358412 783754F 2077456V 2921044/6W 51537, 2635167O;R 1814991+ 6252001:6 6252001*L 1269750)S 2017370%p 1814991' 6251999@! 1835841' 3144096  1835841 y } 2017370 j 6252001H 2017370 1814991"R 2017370 1749822t 1269750>x 1835841e 1269750. 1269750: 2661886Ar 1835841+ 6252001( 1814991. 1835841Qr 1269750 V 6252001"42 933860"g\ 18610602\0 1527747MZ= 1562822D( 6252001 a 1814991x 1668284I" 1668284K 3625428g 1814991 C 1814991 3469034 ? 1814991~ 1668284Jd 1269750T 1269750 1269750NB 126975030 1269750@? 2963597hg BLACK 6 q <  Dq a6 .x78Z/{indexi ''?tablelast_synclistlast_synclist CREATE TABLE "last_synclist" ("name" VARCHAR(255) NOT NULL PRIMARY KEY, "timestamp" REAL)i;m ##!tableignore_listignore_list CREATE TABLE "ignore_list" ("ip" VARCHAR(255) NOT NULL, "network_address" INTEGER NOT NULL, "netmask" INTEGER NOT NULL, "version" INTEGER NOT NULL, PRIMARY KEY ("network_address", "netmask", "version"))5 I#indexsqlite_autoindex_ignore_list_1ignore_list )''tableiplistpurposeiplistpurposeCREATE TABLE "iplistpurpose" ("purpose" VARCHAR(255) NOT NULL, "iplist_id" INTEGER NOT NULL, PRIMARY KEY ("purpose", "iplist_id"))9M'indexsqlite_autoindex_iplistpurpose_1iplistpurpose %%AtableiplistrecordiplistrecordCREATE TABLE "iplistrecord" ("network_address" INTEGER NOT NULL, "netmask" INTEGER NOT NULL, "version" INTEGER NOT NULL, "iplist_id" INTEGER NOT NULL, PRIMARY KEY ("network_address", "netmask", "version", "iplist_id"))7K%indexsqlite_autoindex_iplistrecord_1iplistrecordYtableiplistiplistCREATE TABLE "iplist" ("ip" VARCHAR(255) NOT NULL, "listname" VARCHAR(255) NOT NULL CHECK (listname in ('WHITE','BLACK','GRAY','GRAY_SPLASHSCREEN')), "expiration" INTEGER, "imported_from" VARCHAR(255), "ctime" INTEGER, "deep" INTEGER, "comment" VARCHAR(255), "country_id" VARCHAR(255), "captcha_passed" INTEGER NOT NULL, "manual" INTEGER NOT NULL, "full_access" INTEGER, "auto_whitelisted" INTEGER, "network_address" INTEGER NOT NULL, "netmask" INTEGER NOT NULL, "version" INTEGER NOT NULL, "scope" VARCHAR(255) CHECK (scope in ('local','group')), PRIMARY KEY ("network_address", "netmask", "version", "listname"))+?indexsqlite_autoindex_iplist_1iplistd1indexincident_timestampincidentCREATE INDEX "incident_timestamp" ON "incident" ("timestamp")&tableincidentincidentCREATE TABLE "incident" ("id" INTEGER PRIMARY KEY, "plugin" VARCHAR(255), "rule" VARCHAR(255), "timestamp" REAL, "retries" INTEGER, "severity" INTEGER, "name" VARCHAR(255), "description" VARCHAR(255), "abuser" VARCHAR(255), "country_id" VARCHAR(255), "domain" TEXT)yx g*/ @ I J<B[indexiplist_ipiplistCREATE INDEX "iplist_ip" ON iplist (ip)Z/{indexiplist_expirationiplistCREATE INDEX "iplist_expiration" ON iplist (expiration)T+sindexiplist_listnameiplistCREATE INDEX "iplist_listname" ON iplist (listname)Z/{indexiplist_country_idiplistCREATE INDEX "iplist_country_id" ON iplist (country_id)c3indexincident_country_idincidentCREATE INDEX "incident_country_id" ON incident (country_id)M77indexignored_by_port_proto_country_idignored_by_port_protoCREATE INDEX "ignored_by_port_proto_country_id" ON ignored_by_port_proto (country_id)'I7[indexignoredbyport_port_proto_id_ipignored_by_port_protoCREATE UNIQUE INDEX "ignoredbyport_port_proto_id_ip" ON "ignored_by_port_proto" ("port_proto_id", "ip")C7;indexignoredbyport_port_proto_idignored_by_port_protoCREATE INDEX "ignoredbyport_port_proto_id" ON "ignored_by_port_proto" ("port_proto_id")277tableignored_by_port_protoignored_by_port_protoCREATE TABLE ignored_by_port_proto ( "id" INTEGER NOT NULL PRIMARY KEY, "port_proto_id" INTEGER NOT NULL, "ip" VARCHAR(255) NOT NULL, "comment" VARCHAR(255), "network_address" INTEGER NOT NULL, "netmask" INTEGER NOT NULL, "version" INTEGER NOT NULL, "country_id" VARCHAR(255), FOREIGN KEY ("port_proto_id") REFERENCES "blocked_port" ("id") ON DELETE CASCADE )9%-indexblockedport_port_protoblocked_portCREATE UNIQUE INDEX "blockedport_port_proto" ON "blocked_port" ("port", "proto")[%%ytableblocked_portblocked_portCREATE TABLE "blocked_port" ("id" INTEGER NOT NULL PRIMARY KEY, "port" INTEGER NOT NULL, "proto" VARCHAR(255) NOT NULL CHECK (proto in ('tcp', 'udp', 'all')), "comment" VARCHAR(255))$ --{tablemessages_to_sendmessages_to_sendCREATE TABLE "messages_to_send" ("id" INTEGER NOT NULL PRIMARY KEY, "timestamp" REAL NOT NULL, "message" BLOB NOT NULL)9 M'indexsqlite_autoindex_last_synclist_1last_synclist )20.169.151.131 rW~ 1 ? s 6S7#r. a1+ ossec5710gdAttempt to login using a non-existent userFeb 10 17:00:42 vm1 sshd[59945]: Invalid user july from 195.211.191.206 port 54498195.211.191.2062750405U  E+ ossec2501g8User authentication failure.Feb 10 16:59:58 vm1 sshd[59670]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=195.211.191.203195.211.191.20327504050  a7+ ossec5710g6Attempt to login using a non-existent userFeb 10 16:59:58 vm1 sshd[59670]: Invalid user monitor from 195.211.191.203 port 35294195.211.191.2032750405U  E+ ossec2501gUser authentication failure.Feb 10 16:59:31 vm1 sshd[59643]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=195.211.191.206195.211.191.2062750405. a1+ ossec5710gAttempt to login using a non-existent userFeb 10 16:59:30 vm1 sshd[59643]: Invalid user july from 195.211.191.206 port 54102195.211.191.2062750405*  CI+ ossec5716gSSHD authentication failed.Feb 10 16:59:21 vm1 sshd[59490]: Failed password for root from 195.211.191.197 port 44092 ssh2195.211.191.1972750405`  E3+ ossec2501gUser authentication failure.Feb 10 16:59:20 vm1 sshd[59490]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=195.211.191.197 user=root195.211.191.1972750405U  E+ ossec2501gUser authentication failure.Feb 10 16:58:50 vm1 sshd[59398]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=195.211.191.203195.211.191.20327504051 a7+ ossec5710gAttempt to login using a non-existent userFeb 10 16:58:49 vm1 sshd[59398]: Invalid user monitor from 195.211.191.203 port 58846195.211.191.2032750405`  E3+ ossec2501gUser authentication failure.Feb 10 16:58:08 vm1 sshd[59357]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=195.211.191.197 user=root195.211.191.1972750405*  CI+ ossec5716gSSHD authentication failed.Feb 10 16:58:10 vm1 sshd[59357]: Failed password for root from 195.211.191.197 port 48762 ssh2195.211.191.1972750405*  CI+ ossec5716gSSHD authentication failed.Feb 10 16:57:03 vm1 sshd[59168]: Failed password for root from 195.211.191.197 port 54138 ssh2195.211.191.1972750405`  E3+ ossec2501gUser authentication failure.Feb 10 16:57:01 vm1 sshd[59168]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=195.211.191.197 user=root195.211.191.1972750405  W+ ossec9708g]Dovecot Aborted Login with empty userFeb 10 16:30:43 vm1 dovecot[40634]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=185.247.137.201, lip=103.74.54.108, TLS, session=185.247.137.201298795(  _ %'modsec77350470gmIM360 WAF: Vulnerability scanner detectedIM360 WAF: Vulnerability scanner detected||RSV:6.65||T:APACHE||45.148.10.902750405103.74.54.108o  Iy ossec5403gFirst time user executed sudo.Feb 10 15:11:38 vm1 sudo[37649]: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=techno ; COMMAND=/bin/test -f /home/techno/.wp-toolkit-identifier$  S +'modsec77316757gŮIM360 WAF: Laravel .env file accessIM360 WAF: Laravel .env file access||RSV:6.65||T:APACHE||QS:||204.188.228.2036252001103.74.54.108#  S +'modsec77316757gsIM360 WAF: Laravel .env file accessIM360 WAF: Laravel .env file access||RSV:6.65||T:APACHE||QS:||185.241.208.143798544103.74.54.108V  {G+'modsec77317941gsIM360 WAF: Laravel Apps Leaking Secrets exploit attemptIM360 WAF: Laravel Apps Leaking Secrets exploit attempt||MV:androxgh0st||RSV:6.65||T:APACHE||185.241.208.143798544103.74.54.108&  3Q) ossec11301gPNew FTP connection.Feb 10 14:39:35 vm1 pure-ftpd[30566]: (?@167.94.145.100) [INFO] New connection from 167.94.145.100167.94.145.1006252001 _(\ G 7hp_'  3G# ossec11301gSNew FTP connection.Feb 11 00:59:16 vm1 pure-ftpd[157123]: (?@71.6.232.27) [INFO] New connection from 71.6.232.2771.6.232.276252001'&  3S) ossec11301gP<New FTP connection.Feb 11 00:45:07 vm1 pure-ftpd[154800]: (?@184.105.139.67) [INFO] New connection from 184.105.139.67184.105.139.676252001%  W) ossec9708gGDovecot Aborted Login with empty userFeb 11 00:08:31 vm1 dovecot[142234]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=118.193.33.130, lip=103.74.54.108, session=118.193.33.1301819730'$  3S) ossec11301gBvNew FTP connection.Feb 10 23:46:21 vm1 pure-ftpd[138983]: (?@198.235.24.135) [INFO] New connection from 198.235.24.135198.235.24.1356252001'#  3S) ossec11301g>New FTP connection.Feb 10 23:29:47 vm1 pure-ftpd[135875]: (?@147.45.112.158) [INFO] New connection from 147.45.112.158147.45.112.1582017370K"  U{' ossec11001g4zDeferred login on the cpanel service[2025-02-10 22:46:41 +0530] info [whostmgrd] 183.83.54.255 - root "GET /cpsess7838091482/json-api/loadavg HTTP/1.1" DEFERRED LOGIN whostmgrd: cookie ip check: IP address has changed: IP Address [103.74.54.249] != Current IP Address [183.83.54.255]183.83.54.2551269750&!  w9 ossec6070g0Attempt to upload malware through cPanel file managerFeb 10 22:31:06 vm1.technobases.in cpanel_fileman_hook[125341]: 0 BAILOUT malware detected when upload 'sainikschoolcoachinginjaipur.zip' in /home/techno/public_html/sainikschoolcoachinginjaipur.com for user techno# S ''modsec77316757g"IM360 WAF: Laravel .env file accessIM360 WAF: Laravel .env file access||RSV:6.67||T:APACHE||QS:||45.148.10.1862750405103.74.54.108'  3S) ossec11301gNew FTP connection.Feb 10 21:08:51 vm1 pure-ftpd[109865]: (?@205.210.31.102) [INFO] New connection from 205.210.31.102205.210.31.1026252001&  w9 ossec6070g(Attempt to upload malware through cPanel file managerFeb 10 21:02:55 vm1.technobases.in cpanel_fileman_hook[108794]: 0 BAILOUT malware detected when upload 'sainikschoolcoachinginjaipur.zip' in /home/techno/public_html/sainikschoolcoachinginjaipur.com for user techno\  -G' ossec13001g bExim Auth failed2025-02-10 19:51:22 dovecot_login authenticator failed for (User) [185.93.89.117]:45096: 535 Incorrect authentication data (set_id=fdssdgsdgs@technobases.in)185.93.89.117130758) _ %'modsec77350470g1IM360 WAF: Vulnerability scanner detectedIM360 WAF: Vulnerability scanner detected||RSV:6.65||T:APACHE||45.148.10.902750405103.74.54.108/  _ +/modsec77350470g7IM360 WAF: Vulnerability scanner detectedIM360 WAF: Vulnerability scanner detected||RSV:6.65||T:APACHE||162.216.149.1806252001103.74.54.108:4431 a7+ ossec5710g|Attempt to login using a non-existent userFeb 10 17:01:08 vm1 sshd[60054]: Invalid user monitor from 195.211.191.203 port 41626195.211.191.2032750405U  E+ ossec2501gUser authentication failure.Feb 10 17:01:56 vm1 sshd[60137]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=195.211.191.206195.211.191.2062750405. a1+ ossec5710gAttempt to login using a non-existent userFeb 10 17:01:55 vm1 sshd[60137]: Invalid user july from 195.211.191.206 port 52980195.211.191.2062750405U  E+ ossec2501g~User authentication failure.Feb 10 17:01:08 vm1 sshd[60054]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=195.211.191.203195.211.191.2032750405I  ai+ ossec5710g:Attempt to login using a non-existent userFeb 10 17:00:01 vm1 sshd[59670]: Failed password for invalid user monitor from 195.211.191.203 port 35294 ssh2195.211.191.2032750405U  E+ ossec2501gdUser authentication failure.Feb 10 17:00:43 vm1 sshd[59945]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=195.211.191.206195.211.191.2062750405 BS . 0 N8kB&7  w9 ossec6070gAttempt to upload malware through cPanel file managerFeb 11 08:18:41 vm1.technobases.in cpanel_fileman_hook[237958]: 0 BAILOUT malware detected when upload 'sainikschoolcoachinginjaipur.zip' in /home/techno/public_html/sainikschoolcoachinginjaipur.com for user techno&6  w9 ossec6070gAttempt to upload malware through cPanel file managerFeb 11 08:12:04 vm1.technobases.in cpanel_fileman_hook[236855]: 0 BAILOUT malware detected when upload 'sainikschoolcoachinginjaipur.zip' in /home/techno/public_html/sainikschoolcoachinginjaipur.com for user techno&5  w9 ossec6070gAttempt to upload malware through cPanel file managerFeb 11 08:05:42 vm1.technobases.in cpanel_fileman_hook[235684]: 0 BAILOUT malware detected when upload 'sainikschoolcoachinginjaipur.zip' in /home/techno/public_html/sainikschoolcoachinginjaipur.com for user techno&4  w9 ossec6070gAttempt to upload malware through cPanel file managerFeb 11 08:03:26 vm1.technobases.in cpanel_fileman_hook[235186]: 0 BAILOUT malware detected when upload 'sainikschoolcoachinginjaipur.zip' in /home/techno/public_html/sainikschoolcoachinginjaipur.com for user techno&3  w9 ossec6070gAttempt to upload malware through cPanel file managerFeb 11 07:58:13 vm1.technobases.in cpanel_fileman_hook[234021]: 0 BAILOUT malware detected when upload 'sainikschoolcoachinginjaipur.zip' in /home/techno/public_html/sainikschoolcoachinginjaipur.com for user techno&2  w9 ossec6070g0Attempt to upload malware through cPanel file managerFeb 11 07:51:35 vm1.technobases.in cpanel_fileman_hook[232733]: 0 BAILOUT malware detected when upload 'sainikschoolcoachinginjaipur.zip' in /home/techno/public_html/sainikschoolcoachinginjaipur.com for user techno1  5)) ossec11011geWHM SSO login failed[2025-02-11 07:43:56 +0530] info [whostmgrd] 106.206.184.72 PURGE root:Ilq7Q7QVKmEGDFDQ badpass [cookie ip check: IP address has changed: IP Address [223.233.124.104] != Current IP Address [106.206.184.72]]106.206.184.721269750/0  UA) ossec11001geDeferred login on the cpanel service[2025-02-11 07:43:56 +0530] info [whostmgrd] 106.206.184.72 - root "GET / HTTP/1.1" DEFERRED LOGIN whostmgrd: cookie ip check: IP address has changed: IP Address [223.233.124.104] != Current IP Address [106.206.184.72]106.206.184.721269750-/  _ )-modsec77350470g=IM360 WAF: Vulnerability scanner detectedIM360 WAF: Vulnerability scanner detected||RSV:6.67||T:APACHE||198.235.24.1046252001ns2.amerrugs.org-.  _ '/modsec77350470gIM360 WAF: Vulnerability scanner detectedIM360 WAF: Vulnerability scanner detected||RSV:6.67||T:APACHE||198.235.24.456252001103.74.54.108:443K-  U{' ossec11001gDeferred login on the cpanel service[2025-02-11 05:33:38 +0530] info [whostmgrd] 183.83.54.255 - root "GET /cpsess7838091482/json-api/loadavg HTTP/1.1" DEFERRED LOGIN whostmgrd: cookie ip check: IP address has changed: IP Address [103.74.54.249] != Current IP Address [183.83.54.255]183.83.54.2551269750-,  _ )-modsec77350470gIM360 WAF: Vulnerability scanner detectedIM360 WAF: Vulnerability scanner detected||RSV:6.67||T:APACHE||198.235.24.2396252001ns1.amerrugs.org/+  _ +/modsec77350470gIM360 WAF: Vulnerability scanner detectedIM360 WAF: Vulnerability scanner detected||RSV:6.67||T:APACHE||162.216.149.1006252001103.74.54.108:443*  W' ossec9708g|2Dovecot Aborted Login with empty userFeb 11 03:52:42 vm1 dovecot[142234]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 7 secs): user=<>, rip=87.236.176.58, lip=103.74.54.108, TLS, session=87.236.176.582635167!)  S ''modsec77316757gd IM360 WAF: Laravel .env file accessIM360 WAF: Laravel .env file access||RSV:6.67||T:APACHE||QS:||87.120.113.33732800103.74.54.108*(  3W+ ossec11301g\0New FTP connection.Feb 11 01:36:07 vm1 pure-ftpd[163876]: (?@172.169.191.207) [INFO] New connection from 172.169.191.207172.169.191.2076252001 + 3 ~ "sV +]H  E3% ossec2501gC{User authentication failure.Feb 11 18:02:58 vm1 sshd[362176]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.190.54.7 user=techno103.190.54.71269750!G  3K% ossec11301gCANew FTP connection.Feb 11 18:02:00 vm1 pure-ftpd[361973]: (?@103.190.54.7) [INFO] New connection from 103.190.54.7103.190.54.71269750$F  3O' ossec11301g,New FTP connection.Feb 11 16:26:58 vm1 pure-ftpd[332161]: (?@194.165.16.76) [INFO] New connection from 194.165.16.76194.165.16.762993457E  W% ossec9708gDovecot Aborted Login with empty userFeb 11 15:25:12 vm1 dovecot[314972]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=71.6.134.231, lip=103.74.54.108, TLS, session=<8Zwr0totgLdHBobn>71.6.134.2316252001 D  w ossec6070g)Attempt to upload malware through cPanel file managerFeb 11 15:15:12 vm1.technobases.in cpanel_fileman_hook[316864]: 0 BAILOUT malware detected when upload 'css.zip' in /home/techno/public_html/sainikschoolcoachinginjaipur.com for user technoC  w ossec6070gAttempt to upload malware through cPanel file managerFeb 11 15:14:28 vm1.technobases.in cpanel_fileman_hook[316586]: 0 BAILOUT malware detected when upload 'index.php' in /home/techno/public_html/sainikschoolcoachinginjaipur.com for user technoB  w ossec6070gAttempt to upload malware through cPanel file managerFeb 11 15:13:42 vm1.technobases.in cpanel_fileman_hook[316402]: 0 BAILOUT malware detected when upload 'cong.php' in /home/techno/public_html/sainikschoolcoachinginjaipur.com for user techno'A  w; ossec6070gAttempt to upload malware through cPanel file managerFeb 11 15:10:19 vm1.technobases.in cpanel_fileman_hook[315772]: 0 BAILOUT malware detected when upload 'sainikschoolcoachinginjaipur1.zip' in /home/techno/public_html/sainikschoolcoachinginjaipur.com for user techno&@  w9 ossec6070gAttempt to upload malware through cPanel file managerFeb 11 15:01:04 vm1.technobases.in cpanel_fileman_hook[312011]: 0 BAILOUT malware detected when upload 'sainikschoolcoachinginjaipur.zip' in /home/techno/public_html/sainikschoolcoachinginjaipur.com for user techno&?  w9 ossec6070gAttempt to upload malware through cPanel file managerFeb 11 14:53:01 vm1.technobases.in cpanel_fileman_hook[310433]: 0 BAILOUT malware detected when upload 'sainikschoolcoachinginjaipur.zip' in /home/techno/public_html/sainikschoolcoachinginjaipur.com for user techno+> _ +'modsec77350470gIM360 WAF: Vulnerability scanner detectedIM360 WAF: Vulnerability scanner detected||RSV:6.67||T:APACHE||195.178.110.163732800103.74.54.108+= _ +'modsec77350470gIM360 WAF: Vulnerability scanner detectedIM360 WAF: Vulnerability scanner detected||RSV:6.67||T:APACHE||195.178.110.163732800103.74.54.1082< CW) ossec11309g0FTP Authentication success.Feb 11 13:49:59 vm1 pure-ftpd[298501]: (?@106.206.184.72) [INFO] user@technobases.in is now logged in106.206.184.721269750(; 3S) ossec11301g0New FTP connection.Feb 11 13:49:59 vm1 pure-ftpd[298501]: (?@106.206.184.72) [INFO] New connection from 106.206.184.72106.206.184.721269750):  3W+ ossec11301gNew FTP connection.Feb 11 13:36:41 vm1 pure-ftpd[295788]: (?@185.247.137.237) [INFO] New connection from 185.247.137.237185.247.137.237298795J9  =# ossec13008gcMail Reciepient rejected2025-02-11 13:33:46 H=mail-am7eur03olkn2040.outbound.protection.outlook.com (EUR03-AM7-obe.outbound.protection.outlook.com) [40.92.59.40]:27168 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 CV=no F=<> rejected RCPT : Unrouteable address40.92.59.402750405&8  w9 ossec6070g7Attempt to upload malware through cPanel file managerFeb 11 10:25:18 vm1.technobases.in cpanel_fileman_hook[260460]: 0 BAILOUT malware detected when upload 'sainikschoolcoachinginjaipur.zip' in /home/techno/public_html/sainikschoolcoachinginjaipur.com for user techno XUu G g I*Qr1XV\  E+ ossec2501gvUser authentication failure.Feb 11 21:42:17 vm1 sshd[403137]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=195.211.191.210195.211.191.21027504051[ a7+ ossec5710gvAttempt to login using a non-existent userFeb 11 21:42:15 vm1 sshd[403137]: Invalid user user55 from 195.211.191.210 port 42264195.211.191.21027504051Z a7+ ossec5710gvfAttempt to login using a non-existent userFeb 11 21:40:12 vm1 sshd[402863]: Invalid user user55 from 195.211.191.210 port 47342195.211.191.2102750405VY  E+ ossec2501gvfUser authentication failure.Feb 11 21:40:13 vm1 sshd[402863]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=195.211.191.210195.211.191.2102750405\X -E% ossec13001gv`Exim Auth failed2025-02-11 21:40:07 dovecot_login authenticator failed for (amplifypowerglobal.com) [125.72.54.81]:58712: 535 Incorrect authentication data (set_id=nologin)125.72.54.811814991VW  E+ ossec2501guUser authentication failure.Feb 11 21:38:21 vm1 sshd[402482]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=195.211.191.210195.211.191.21027504051V a7+ ossec5710guAttempt to login using a non-existent userFeb 11 21:38:20 vm1 sshd[402482]: Invalid user user55 from 195.211.191.210 port 40284195.211.191.2102750405U  W% ossec9708gsuDovecot Aborted Login with empty userFeb 11 21:27:39 vm1 dovecot[359998]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 2 secs): user=<>, rip=71.6.134.235, lip=103.74.54.108, TLS, session=71.6.134.2356252001$T  3O' ossec11301goNew FTP connection.Feb 11 21:11:35 vm1 pure-ftpd[397757]: (?@40.85.155.197) [INFO] New connection from 40.85.155.19740.85.155.1976252001$S  3O' ossec11301gVNew FTP connection.Feb 11 19:24:14 vm1 pure-ftpd[377580]: (?@13.91.179.188) [INFO] New connection from 13.91.179.18813.91.179.1886252001'R  3S) ossec11301gKNew FTP connection.Feb 11 18:35:34 vm1 pure-ftpd[368848]: (?@167.94.138.164) [INFO] New connection from 167.94.138.164167.94.138.1646252001Q  W' ossec9708gIDovecot Aborted Login with empty userFeb 11 18:30:11 vm1 dovecot[359998]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=87.236.176.37, lip=103.74.54.108, TLS, session=87.236.176.372635167(P  EI% ossec5715gISSHD authentication success.Feb 11 18:26:33 vm1 sshd[367195]: Accepted password for root from 103.190.54.7 port 51296 ssh2103.190.54.71269750'O  CI% ossec5716gHvSSHD authentication failed.Feb 11 18:24:13 vm1 sshd[366537]: Failed password for techno from 103.190.54.7 port 51285 ssh2103.190.54.71269750]N  E3% ossec2501gH8User authentication failure.Feb 11 18:23:12 vm1 sshd[366537]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.190.54.7 user=techno103.190.54.71269750(M CI% ossec5716gH<SSHD authentication failed.Feb 11 18:23:14 vm1 sshd[366537]: Failed password for techno from 103.190.54.7 port 51285 ssh2103.190.54.71269750VL  -;% ossec13001gG Exim Auth failed2025-02-11 18:18:09 dovecot_login authenticator failed for (User) [204.76.203.4]:20704: 535 Incorrect authentication data (set_id=openx@technobases.in)204.76.203.42750405'K  CI% ossec5716gDSSHD authentication failed.Feb 11 18:07:38 vm1 sshd[362943]: Failed password for techno from 103.190.54.7 port 51273 ssh2103.190.54.71269750]J  E3% ossec2501gDUser authentication failure.Feb 11 18:07:37 vm1 sshd[362943]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.190.54.7 user=techno103.190.54.71269750(I CI% ossec5716gC}SSHD authentication failed.Feb 11 18:03:00 vm1 sshd[362176]: Failed password for techno from 103.190.54.7 port 51271 ssh2103.190.54.71269750 < 6 ^ +^mo  -c+ ossec13001gSExim Auth failed2025-02-12 13:24:43 dovecot_login authenticator failed for ([104.241.232.117]) [104.241.232.117]:48734: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)104.241.232.1176252001in Q9' ossec11000g1Login failed on the cpanel service[2025-02-12 10:56:30 +0530] info [whostmgrd] 103.74.54.249 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect103.74.54.2491269750bm  ==+ ossec13008g)Mail Reciepient rejected2025-02-12 10:24:59 H=(mail.shivelectricaltransformers.com) [165.154.208.227]:52709 F= rejected RCPT : Rejected relay attempt: '165.154.208.227' From: 'xrhjufrm@shivelectricaltransformers.com' To: 'validxxxg@gmail.com'165.154.208.2271668284$l  3O' ossec11301g New FTP connection.Feb 12 09:44:07 vm1 pure-ftpd[565378]: (?@91.238.181.34) [INFO] New connection from 91.238.181.3491.238.181.343017382Ck  A}) ossec11302gFTP Authentication failed.Feb 12 09:25:03 vm1 pure-ftpd[561848]: (?@122.162.189.55) [WARNING] Authentication failed for user [user@technobases.in]122.162.189.551269750'j  3S) ossec11301gNew FTP connection.Feb 12 09:24:48 vm1 pure-ftpd[561848]: (?@122.162.189.55) [INFO] New connection from 122.162.189.55122.162.189.551269750Ki A ) ossec11302gYFTP Authentication failed.Feb 12 09:23:58 vm1 pure-ftpd[561699]: (?@122.162.189.55) [WARNING] Authentication failed for user [test@s2seducationtrust.com]122.162.189.551269750(h 3S) ossec11301gMNew FTP connection.Feb 12 09:23:47 vm1 pure-ftpd[561699]: (?@122.162.189.55) [INFO] New connection from 122.162.189.55122.162.189.551269750'g  3S) ossec11301gNew FTP connection.Feb 12 09:17:08 vm1 pure-ftpd[560559]: (?@122.162.189.55) [INFO] New connection from 122.162.189.55122.162.189.551269750]f -C) ossec13001gExim Auth failed2025-02-12 08:40:22 dovecot_login authenticator failed for (thepsindustries.com) [42.193.105.109]:56560: 535 Incorrect authentication data (set_id=nologin)42.193.105.1091814991!e  3K% ossec11301g>New FTP connection.Feb 12 05:41:41 vm1 pure-ftpd[520910]: (?@82.197.76.37) [INFO] New connection from 82.197.76.3782.197.76.372542007Sd  -5% ossec13001gVExim Auth failed2025-02-12 02:42:53 dovecot_login authenticator failed for (User) [204.76.203.4]:3510: 535 Incorrect authentication data (set_id=hsp@technobases.in)204.76.203.42750405Vc  -;% ossec13001gExim Auth failed2025-02-12 02:41:30 dovecot_login authenticator failed for (User) [204.76.203.4]:33894: 535 Incorrect authentication data (set_id=hydro@technobases.in)204.76.203.42750405Ub  -9% ossec13001gExim Auth failed2025-02-12 02:40:09 dovecot_login authenticator failed for (User) [204.76.203.4]:63412: 535 Incorrect authentication data (set_id=idp2@technobases.in)204.76.203.42750405Ta  -7% ossec13001g[Exim Auth failed2025-02-12 02:38:43 dovecot_login authenticator failed for (User) [204.76.203.4]:28396: 535 Incorrect authentication data (set_id=iec@technobases.in)204.76.203.42750405W`  -=% ossec13001g Exim Auth failed2025-02-12 02:37:21 dovecot_login authenticator failed for (User) [204.76.203.4]:58200: 535 Incorrect authentication data (set_id=iframe@technobases.in)204.76.203.42750405'_  3S) ossec11301g{ New FTP connection.Feb 11 22:00:03 vm1 pure-ftpd[407401]: (?@162.142.125.34) [INFO] New connection from 162.142.125.34162.142.125.346252001(^ 3S) ossec11301gzNew FTP connection.Feb 11 21:59:35 vm1 pure-ftpd[407125]: (?@162.142.125.34) [INFO] New connection from 162.142.125.34162.142.125.346252001A]  gS) ossec11307g{Multiple connection attempts from same sourceFeb 11 21:59:55 vm1 pure-ftpd[407192]: (?@162.142.125.34) [INFO] New connection from 162.142.125.34162.142.125.346252001 d&9 O - d%} 3O' ossec11301gz+New FTP connection.Feb 12 16:08:33 vm1 pure-ftpd[645676]: (?@35.233.83.194) [INFO] New connection from 35.233.83.19435.233.83.1942802361!|  3K% ossec11301gjNew FTP connection.Feb 12 15:03:14 vm1 pure-ftpd[630439]: (?@52.189.76.43) [INFO] New connection from 52.189.76.4352.189.76.436252001j{  =Q' ossec13008gahMail Reciepient rejected2025-02-12 14:22:54 H=mta-70-53-208.sparkpostmail.com [156.70.53.208]:5785 X=TLS1.2:ECDHE-RSA-AES128-GCM-SHA256:128 CV=no F= rejected RCPT : Rejected relay attempt: '156.70.53.208' From: 'msprvs1=20138A-0qqcGv=bounces-265607-871@bounce.custcomm.yessecuritiesltd.email' To: 'arjun.singh@heipowersystem.com'156.70.53.2086252001Gz  =+ ossec13008g_$Mail Reciepient rejected2025-02-12 14:13:15 H=(mail.westerndancecompany.com) [165.154.226.214]:65434 F= rejected RCPT : Rejected relay attempt: '165.154.226.214' From: 'ekekt@westerndancecompany.com' To: 'validxxxg@gmail.com'165.154.226.2141668284Ty  -5' ossec13001g^Exim Auth failed2025-02-12 14:11:40 dovecot_login authenticator failed for ([36.112.80.222]) [36.112.80.222]:47896: 535 Incorrect authentication data (set_id=sales)36.112.80.2221814991jx  -_) ossec13001g^Exim Auth failed2025-02-12 14:11:27 dovecot_login authenticator failed for ([104.241.228.40]) [104.241.228.40]:49370: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)104.241.228.406252001kw  =S' ossec13008g]Mail Reciepient rejected2025-02-12 14:07:18 H=mta-203-34-17.sparkpostmail.com [168.203.34.17]:12433 X=TLS1.2:ECDHE-RSA-AES128-GCM-SHA256:128 CV=no F= rejected RCPT : Rejected relay attempt: '168.203.34.17' From: 'msprvs1=20138A-0qqcGv=bounces-265607-871@bounce.custcomm.yessecuritiesltd.email' To: 'arjun.singh@heipowersystem.com'168.203.34.176252001v  =+ ossec13008g]Mail Reciepient rejected2025-02-12 14:06:47 H=mail169.on.mlsend.com [185.249.220.169]:29181 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 CV=no F= rejected RCPT : Rejected relay attempt: '185.249.220.169' From: 'bounce-z8i1-2678336281208948509@mlsend.com' To: 'projects@heipowersystem.com'185.249.220.169798544Ju  A ) ossec11302gW FTP Authentication failed.Feb 12 13:38:39 vm1 pure-ftpd[612325]: (?@122.162.189.55) [WARNING] Authentication failed for user [user@s2seducationtrust.com]122.162.189.551269750't  3S) ossec11301gWNew FTP connection.Feb 12 13:38:35 vm1 pure-ftpd[612325]: (?@122.162.189.55) [INFO] New connection from 122.162.189.55122.162.189.551269750(s  =S! ossec13008gVMail Reciepient rejected2025-02-12 13:37:17 H=mta-70-4-7.indeed.com.sparkpostmail.com [156.70.4.7]:28007 X=TLS1.2:ECDHE-RSA-AES128-GCM-SHA256:128 CV=no F= rejected RCPT : Rejected relay attempt: '156.70.4.7' From: 'msprvs1=20138juQtTh6R=bounces-294276@bounces.indeed.com' To: 'hr@heipowersystem.com'156.70.4.76252001gr  -]% ossec13001gVExim Auth failed2025-02-12 13:37:09 dovecot_login authenticator failed for (5.181.195.26.customer.sinergiatel.it) [5.181.195.26]:44522: 535 Incorrect authentication data (set_id=sales)5.181.195.263175395jq  -_) ossec13001gVExim Auth failed2025-02-12 13:36:56 dovecot_login authenticator failed for ([14.139.107.146]) [14.139.107.146]:51124: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)14.139.107.1461269750Wp  -9) ossec13001gSExim Auth failed2025-02-12 13:25:05 dovecot_login authenticator failed for ([111.61.176.204]) [111.61.176.204]:20274: 535 Incorrect authentication data (set_id=sales)111.61.176.2041814991 %F   ; Mo%5 g9) ossec31130gAnti-bot protection. User passed successfully123.160.223.75 - - [12/Feb/2025:19:32:37 +0530] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9923477&pdata=gSuS9ZjB0-kA9WYkxSx6G7EJawdKZKUqyHMhYPJniFwDFPhf052DxIt-PUdR-MBxU68TClerqLdNWIQ7kFzbOEMtq6-E8jFUEDQM4KTQaI3xQ0d_bHCrTyvs2LkI4bbZKWZyoMZ1uP8MLDtKdjbr0Tql6mWP1D0ykanFiFdQhXgjJxYiBR3c9oWjRAnyrGEd4HotbDshezJCFnaqZmyA&id=7fa3b767c460b54a2be4d49030b349c7 HTTP/1.1" 302 0 103.74.54.108 "http://103.74.54.108:2082/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 11_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:123.160.223.75123.160.223.751814991_ -E+ ossec13001gyExim Auth failed2025-02-12 18:52:00 dovecot_login authenticator failed for (thepsindustries.com) [111.122.211.212]:46352: 535 Incorrect authentication data (set_id=nologin)111.122.211.2121814991j  -_) ossec13001gExim Auth failed2025-02-12 17:28:11 dovecot_login authenticator failed for ([202.117.92.118]) [202.117.92.118]:43740: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)202.117.92.1181814991N  --# ossec13001gExim Auth failed2025-02-12 17:28:30 dovecot_login authenticator failed for ([118.43.30.3]) [118.43.30.3]:41778: 535 Incorrect authentication data (set_id=sales)118.43.30.31835841j  -_) ossec13001gExim Auth failed2025-02-12 17:24:55 dovecot_login authenticator failed for ([117.131.97.138]) [117.131.97.138]:34178: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)117.131.97.1381814991Z  -=+ ossec13001gExim Auth failed2025-02-12 17:25:08 dovecot_login authenticator failed for ([104.241.233.233]) [104.241.233.233]:60220: 535 Incorrect authentication data (set_id=sales)104.241.233.2336252001j  -_) ossec13001gExim Auth failed2025-02-12 17:16:06 dovecot_login authenticator failed for ([111.61.177.187]) [111.61.177.187]:38056: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)111.61.177.1871814991W  -A# ossec13001gExim Auth failed2025-02-12 17:07:29 dovecot_login authenticator failed for (User) [80.94.95.73]:56060: 535 Incorrect authentication data (set_id=fssdfsdfs@technobases.in)80.94.95.73798549u  -s+ ossec13001g>Exim Auth failed2025-02-12 17:00:06 dovecot_login authenticator failed for (thepsindustries.com) [202.107.197.211]:46812: 535 Incorrect authentication data (set_id=postmaster@thepsindustries.com)202.107.197.2111814991\  -C) ossec13001g&Exim Auth failed2025-02-12 16:59:41 dovecot_login authenticator failed for (thepsindustries.com) [124.160.63.122]:18819: 535 Incorrect authentication data (set_id=nologin)124.160.63.1221814991w SQ) ossec11305gAttempt to access invalid directoryFeb 12 16:37:13 vm1 pure-ftpd[651053]: (user@hsnews.in@106.206.184.85) [INFO] Can't change directory to /old/wp-content/uploads/2024/02: No such file or directory106.206.184.851269750- CM) ossec11309gFTP Authentication success.Feb 12 16:37:13 vm1 pure-ftpd[651055]: (?@106.206.184.85) [INFO] user@hsnews.in is now logged in106.206.184.851269750( 3S) ossec11301gNew FTP connection.Feb 12 16:37:00 vm1 pure-ftpd[651053]: (?@106.206.184.85) [INFO] New connection from 106.206.184.85106.206.184.8512697507~  Ag' ossec11302gz/FTP Authentication failed.Feb 12 16:08:37 vm1 pure-ftpd[645678]: (?@35.233.83.194) [WARNING] Authentication failed for user [anonymous]35.233.83.1942802361 X - [ YXh  =M' ossec13008gXMail Reciepient rejected2025-02-12 23:15:58 H=(mail.sainikschoolcoachinginjaipur.com) [45.197.14.109]:54940 F= rejected RCPT : Rejected relay attempt: '45.197.14.109' From: 'ldmvjgqvibh@sainikschoolcoachinginjaipur.com' To: 'validxxxg@gmail.com'45.197.14.1096252001k  -e% ossec13001gȔExim Auth failed2025-02-12 21:43:07 dovecot_login authenticator failed for (thepsindustries.com) [125.72.54.81]:59764: 535 Incorrect authentication data (set_id=office@thepsindustries.com)125.72.54.811814991X  -?% ossec13001gfExim Auth failed2025-02-12 21:42:22 dovecot_login authenticator failed for (thepsindustries.com) [125.72.54.81]:55860: 535 Incorrect authentication data (set_id=nologin)125.72.54.811814991  W+ ossec9708gĩDovecot Aborted Login with empty userFeb 12 21:26:24 vm1 dovecot[644007]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=118.194.250.245, lip=103.74.54.108, session=118.194.250.2451605651'  3S) ossec11301găNew FTP connection.Feb 12 21:25:46 vm1 pure-ftpd[703201]: (?@216.218.206.66) [INFO] New connection from 216.218.206.66216.218.206.666252001=  gK) ossec31130g Anti-bot protection. User passed successfully123.160.223.74 - - [12/Feb/2025:19:37:04 +0530] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10119531&pdata=ICqX5CDwVzKUEFfxTkwCuY-wQwacp0HuMNzWoNSerEkE8olJFj4_9tc5CUkmWqT72FBRm4cZ0C4bKWVJi2esUWn7_HLBRlrrhvhjj877KwM-BYMp8Yx2hugD-4ZRwSdEniNQlw8mnvYBFMsF2oy6hPETEq7KFSNa8KMBwCW2tcDGrFX_iaFWFm9t2H0CJfCgmRAc_63n2srWf7wt6nHHLQ%3D%3D&id=7fa3b767c460b54a2be4d49030b349c7 HTTP/1.1" 302 0 webmentos.com "http://webmentos.com:2082/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 11_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:123.160.223.74123.160.223.741814991=  =s+ ossec13008gMail Reciepient rejected2025-02-12 19:36:56 H=(mail.thepsindustries.com) [165.154.226.249]:49233 F= rejected RCPT : Rejected relay attempt: '165.154.226.249' From: 'arthiu@thepsindustries.com' To: 'validxxxg@gmail.com'165.154.226.2491668284N  ]w) ossec31131gAnti-bot protection. User failed to pass123.160.223.75 - - [12/Feb/2025:19:36:44 +0530] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10065517&pdata=cp48K_Z1dT4l-C6UkofdYRLL_LaYLlg8p-OBc9UsbT6_aF_9apmAob_ge9bsE7VWmjDZFU-yBnFAZ3RmpSLTtFHSbIug28jfVcui5EkW6mNekIwg35niLpBmtCI8He9ELANLwg5wJSoUl91qorsHGO4d_VX8y86uy5L1CMrUZJkh_h-4-BRkuN7INi0onp56rFryoQ9eWPgbvIxImaMyOmqPFbcPE-0%3D&id=7fa3b767c460b54a2be4d49030b349c7 HTTP/1.1" 404 552 linux.sutionline.com "http://linux.sutionline.com:2082/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 11_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:123.160.223.75123.160.223.751814991O  ]y) ossec31131gAnti-bot protection. User failed to pass123.160.223.74 - - [12/Feb/2025:19:35:36 +0530] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9541272&pdata=MZNh1V2LKYL1-CARXRWvtq3LJqh4Lq83XJXxjt6UorNfuRqKxKSDYxWiE1AShnBDphZPDq39HlfnRFtAjeIQOYoLbngwo5H2WbMNlTe8vyRLN6UKgSXnHuNNUZOArSrUHHPO7nA_nHpKSS6JeTgmYs3wVPKMFo77xPQVPH8GZ5V9V2p2RSh5cRWHP-MwQsYTxpeITq2Z-C16WdZH3vdvdFJd26F4rJPI&id=7fa3b767c460b54a2be4d49030b349c7 HTTP/1.1" 404 552 www.acm.sutionline.com "http://www.acm.sutionline.com:2082/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 11_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:123.160.223.74123.160.223.741814991 7 j 10OjN7k$  =Q) ossec13008gyMail Reciepient rejected2025-02-13 10:19:37 H=(mail.sainikschoolcoachinginjaipur.com) [165.154.226.68]:58355 F= rejected RCPT : Rejected relay attempt: '165.154.226.68' From: 'ytmxxxusqsr@sainikschoolcoachinginjaipur.com' To: 'validxxxg@gmail.com'165.154.226.681668284$#  3O' ossec11301gmNew FTP connection.Feb 13 09:25:08 vm1 pure-ftpd[838673]: (?@27.58.125.206) [INFO] New connection from 27.58.125.20627.58.125.20612697506"  Cc' ossec11309gmFTP Authentication success.Feb 13 09:25:08 vm1 pure-ftpd[838673]: (?@27.58.125.206) [INFO] user@s2seducationtrust.com is now logged in27.58.125.20612697506!  Cc' ossec11309gmFTP Authentication success.Feb 13 09:24:44 vm1 pure-ftpd[838434]: (?@27.58.125.206) [INFO] user@s2seducationtrust.com is now logged in27.58.125.2061269750$  3O' ossec11301gmNew FTP connection.Feb 13 09:24:44 vm1 pure-ftpd[838434]: (?@27.58.125.206) [INFO] New connection from 27.58.125.20627.58.125.2061269750a  -K+ ossec13001gaExim Auth failed2025-02-13 08:36:47 dovecot_login authenticator failed for (ADMIN) [108.165.237.219]:61840: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)108.165.237.2196252001] -C) ossec13001gMExim Auth failed2025-02-13 07:10:16 dovecot_login authenticator failed for (thepsindustries.com) [60.167.170.146]:46466: 535 Incorrect authentication data (set_id=nologin)60.167.170.1461814991'  3S) ossec11301gLNew FTP connection.Feb 13 07:03:59 vm1 pure-ftpd[812044]: (?@172.168.40.247) [INFO] New connection from 172.168.40.247172.168.40.2476252001*  3W+ ossec11301g@lNew FTP connection.Feb 13 06:14:27 vm1 pure-ftpd[803097]: (?@185.211.212.131) [INFO] New connection from 185.211.212.131185.211.212.1312510769$  3O' ossec11301g*`New FTP connection.Feb 13 04:40:22 vm1 pure-ftpd[784812]: (?@205.210.31.58) [INFO] New connection from 205.210.31.58205.210.31.5862520015  =e) ossec13008g'Mail Reciepient rejected2025-02-13 04:28:50 H=(mail.nyaystambh.com) [165.154.226.19]:60732 F= rejected RCPT : Rejected relay attempt: '165.154.226.19' From: 'nlfnkbgvymv@nyaystambh.com' To: 'validxxxg@gmail.com'165.154.226.191668284=  =u) ossec13008g1Mail Reciepient rejected2025-02-13 02:10:16 H=(mail.heipowersystem.com) [165.154.226.68]:54321 F= rejected RCPT : Rejected relay attempt: '165.154.226.68' From: 'occmkzykz@heipowersystem.com' To: 'validxxxg@gmail.com'165.154.226.681668284+  =Q) ossec13008g Mail Reciepient rejected2025-02-13 01:48:19 H=(mail.nyaystambh.com) [165.154.227.39]:65214 F= rejected RCPT : Rejected relay attempt: '165.154.227.39' From: 'nuslgo@nyaystambh.com' To: 'validxxxg@gmail.com'165.154.227.391668284q  -o' ossec13001g>Exim Auth failed2025-02-13 01:15:02 dovecot_login authenticator failed for (thepsindustries.com) [221.229.216.1]:51010: 535 Incorrect authentication data (set_id=postmaster@thepsindustries.com)221.229.216.11814991Z  -A' ossec13001g&Exim Auth failed2025-02-13 01:14:38 dovecot_login authenticator failed for (thepsindustries.com) [221.229.216.1]:47950: 535 Incorrect authentication data (set_id=nologin)221.229.216.11814991O  =+ ossec13008gMail Reciepient rejected2025-02-12 23:31:27 H=(mail.westerndancecompany.com) [165.154.208.180]:56442 F= rejected RCPT : Rejected relay attempt: '165.154.208.180' From: 'cqctleqwh@westerndancecompany.com' To: 'validxxxg@gmail.com'165.154.208.1801668284 -    x WU;-46  C]) ossec11309g=FTP Authentication success.Feb 13 16:19:32 vm1 pure-ftpd[925345]: (?@152.59.108.148) [INFO] militry@technobases.in is now logged in152.59.108.1481269750'5  3S) ossec11301g=New FTP connection.Feb 13 16:19:31 vm1 pure-ftpd[925345]: (?@152.59.108.148) [INFO] New connection from 152.59.108.148152.59.108.1481269750'4  3S) ossec11301gKNew FTP connection.Feb 13 16:19:46 vm1 pure-ftpd[925422]: (?@171.79.181.109) [INFO] New connection from 171.79.181.109171.79.181.10912697503  Ui) ossec11001gCDeferred login on the cpanel service[2025-02-13 15:41:14 +0530] info [webmaild] 106.205.155.94 - kps@amplifypowerglobal.com "POST /cpsess8367873359/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [223.238.202.239] != Current IP Address [106.205.155.94]106.205.155.941269750%2  =C+ ossec13008gMail Reciepient rejected2025-02-13 15:35:45 H=(mail.hsnews.in) [165.154.226.104]:51899 F= rejected RCPT : Rejected relay attempt: '165.154.226.104' From: 'zojlrnvdy@hsnews.in' To: 'validxxxg@gmail.com'165.154.226.10416682841 3C! ossec11301gNew FTP connection.Feb 13 15:14:57 vm1 pure-ftpd[912207]: (?@5.101.0.66) [INFO] New connection from 5.101.0.665.101.0.6620173700  W) ossec9708g Dovecot Aborted Login with empty userFeb 13 14:57:37 vm1 dovecot[869041]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=87.236.176.196, lip=103.74.54.108, TLS, session=87.236.176.1962635167$/  3O' ossec11301g$New FTP connection.Feb 13 14:53:47 vm1 pure-ftpd[907946]: (?@120.237.18.55) [INFO] New connection from 120.237.18.55120.237.18.551814991$.  3O' ossec11301gNew FTP connection.Feb 13 14:21:12 vm1 pure-ftpd[901786]: (?@152.42.136.45) [INFO] New connection from 152.42.136.45152.42.136.452750405*-  3W+ ossec11301g2New FTP connection.Feb 13 13:50:02 vm1 pure-ftpd[895710]: (?@162.142.125.122) [INFO] New connection from 162.142.125.122162.142.125.1226252001(, 3S) ossec11301g.New FTP connection.Feb 13 13:45:40 vm1 pure-ftpd[895007]: (?@213.232.87.228) [INFO] New connection from 213.232.87.228213.232.87.2282750405+  W) ossec9708gDovecot Aborted Login with empty userFeb 13 13:44:00 vm1 dovecot[869041]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=185.247.137.70, lip=103.74.54.108, TLS, session=185.247.137.70298795!*  3K% ossec11301gNew FTP connection.Feb 13 13:22:41 vm1 pure-ftpd[890610]: (?@139.162.77.6) [INFO] New connection from 139.162.77.6139.162.77.61861060p)  -o% ossec13001gExim Auth failed2025-02-13 13:18:39 dovecot_login authenticator failed for (dynamic-ip-adsl.viettel.vn) [27.72.123.47]:51776: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)27.72.123.471562822y(  -' ossec13001gExim Auth failed2025-02-13 13:06:39 dovecot_login authenticator failed for 122x221x50x69.ap122.ftth.ucom.ne.jp [122.221.50.69]:59606: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)122.221.50.691861060S'  -5' ossec13001gExim Auth failed2025-02-13 13:06:17 dovecot_login authenticator failed for ([91.73.195.150]) [91.73.195.150]:49638: 535 Incorrect authentication data (set_id=sales)91.73.195.150290557`&  -S# ossec13001gExim Auth failed2025-02-13 13:05:50 dovecot_login authenticator failed for ([91.74.30.24]) [91.74.30.24]:56494: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)91.74.30.242905573% UG) ossec11001guDeferred login on the cpanel service[2025-02-13 11:55:56 +0530] info [webmaild] 157.38.120.212 - kps@amplifypowerglobal.com "GET /cPanel_magic_revision_0/webmail/jupiter/styles/preload_styles.min.css HTTP/1.1" DEFERRED LOGIN webmaild: security token missing157.38.120.2121269750 bDJ 9_t;bUH -9% ossec13001g Exim Auth failed2025-02-13 20:32:56 dovecot_login authenticator failed for (User) [80.94.95.228]:12972: 535 Incorrect authentication data (set_id=user@technobases.in)80.94.95.228798549UG -9% ossec13001g bExim Auth failed2025-02-13 20:31:53 dovecot_login authenticator failed for (User) [80.94.95.228]:55302: 535 Incorrect authentication data (set_id=root@technobases.in)80.94.95.228798549TF  -;# ossec13001gExim Auth failed2025-02-13 17:43:44 dovecot_login authenticator failed for (User) [80.94.95.73]:41782: 535 Incorrect authentication data (set_id=angela@technobases.in)80.94.95.73798549UE  -=# ossec13001gTExim Auth failed2025-02-13 17:40:59 dovecot_login authenticator failed for (User) [80.94.95.73]:34756: 535 Incorrect authentication data (set_id=andreea@technobases.in)80.94.95.73798549TD  -;# ossec13001gExim Auth failed2025-02-13 17:39:51 dovecot_login authenticator failed for (User) [80.94.95.73]:45508: 535 Incorrect authentication data (set_id=andrea@technobases.in)80.94.95.73798549SC  -9# ossec13001gExim Auth failed2025-02-13 17:38:12 dovecot_login authenticator failed for (User) [80.94.95.73]:56090: 535 Incorrect authentication data (set_id=andre@technobases.in)80.94.95.73798549gB  -[' ossec13001gExim Auth failed2025-02-13 17:38:47 dovecot_login authenticator failed for ([118.33.246.91]) [118.33.246.91]:57909: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)118.33.246.911835841VA  -?# ossec13001g`Exim Auth failed2025-02-13 17:36:54 dovecot_login authenticator failed for (User) [80.94.95.73]:38048: 535 Incorrect authentication data (set_id=anderson@technobases.in)80.94.95.73798549V@  -7) ossec13001g%Exim Auth failed2025-02-13 16:53:16 dovecot_login authenticator failed for ([218.92.201.232]) [218.92.201.226]:5626: 535 Incorrect authentication data (set_id=sales)218.92.201.2261814991a?  -S# ossec13001gExim Auth failed2025-02-13 16:53:05 dovecot_login authenticator failed for ([27.98.249.9]) [27.98.249.9]:47981: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)27.98.249.91814991x>  Ce) ossec11313gυFTP file uploaded to serverFeb 13 16:25:00 vm1 pure-ftpd[926189]: (militry@technobases.in@152.59.108.148) [NOTICE] /home/techno/public_html/milictry1//index.html uploaded (31827 bytes, 475.80KB/sec)152.59.108.1481269750x=  Ce) ossec11313gMFTP file uploaded to serverFeb 13 16:24:03 vm1 pure-ftpd[926189]: (militry@technobases.in@152.59.108.148) [NOTICE] /home/techno/public_html/milictry1//index.html uploaded (31795 bytes, 326.25KB/sec)152.59.108.1481269750x<  Ce) ossec11313gFTP file uploaded to serverFeb 13 16:23:08 vm1 pure-ftpd[926189]: (militry@technobases.in@152.59.108.148) [NOTICE] /home/techno/public_html/milictry1//index.html uploaded (31776 bytes, 476.10KB/sec)152.59.108.1481269750';  3S) ossec11301gNew FTP connection.Feb 13 16:21:50 vm1 pure-ftpd[926189]: (?@152.59.108.148) [INFO] New connection from 152.59.108.148152.59.108.1481269750w:  Cc) ossec11313gFTP file uploaded to serverFeb 13 16:22:03 vm1 pure-ftpd[926189]: (militry@technobases.in@152.59.108.148) [NOTICE] /home/techno/public_html/milictry1//index.html uploaded (31548 bytes, 13.15KB/sec)152.59.108.148126975049  C]) ossec11309gFTP Authentication success.Feb 13 16:21:52 vm1 pure-ftpd[926189]: (?@152.59.108.148) [INFO] militry@technobases.in is now logged in152.59.108.1481269750v8  Ca) ossec11313g[FTP file uploaded to serverFeb 13 16:20:02 vm1 pure-ftpd[925345]: (militry@technobases.in@152.59.108.148) [NOTICE] /home/techno/public_html/milictry1//index.html uploaded (31510 bytes, 1.96KB/sec)152.59.108.148126975087  Ce) ossec11309gOFTP Authentication success.Feb 13 16:19:50 vm1 pure-ftpd[925422]: (?@171.79.181.109) [INFO] user@s2seducationtrust.com is now logged in171.79.181.1091269750 E ` ~ 5 HY&HnTX  -7% ossec13001gmExim Auth failed2025-02-14 03:39:39 dovecot_login authenticator failed for (User) [204.76.203.4]:46578: 535 Incorrect authentication data (set_id=son@technobases.in)204.76.203.42750405VW  -;% ossec13001gmVExim Auth failed2025-02-14 03:38:22 dovecot_login authenticator failed for (User) [204.76.203.4]:11850: 535 Incorrect authentication data (set_id=sonic@technobases.in)204.76.203.42750405ZV  -C% ossec13001glExim Auth failed2025-02-14 03:36:53 dovecot_login authenticator failed for (User) [204.76.203.4]:41274: 535 Incorrect authentication data (set_id=southasia@technobases.in)204.76.203.42750405/U  =Y) ossec13008gR/Mail Reciepient rejected2025-02-14 01:42:30 H=(mail.technobases.in) [165.154.208.84]:58423 F= rejected RCPT : Rejected relay attempt: '165.154.208.84' From: 'xncpleap@technobases.in' To: 'validxxxg@gmail.com'165.154.208.841668284BT  =) ossec13008gP6Mail Reciepient rejected2025-02-14 01:34:05 H=(mail.fablixsolutions.com) [165.154.208.53]:49704 F= rejected RCPT : Rejected relay attempt: '165.154.208.53' From: 'nmuhbnmbvc@fablixsolutions.com' To: 'validxxxg@gmail.com'165.154.208.531668284%S  3Q' ossec11301gONew FTP connection.Feb 14 01:32:01 vm1 pure-ftpd[1031628]: (?@172.105.91.29) [INFO] New connection from 172.105.91.29172.105.91.292921044%R  =I' ossec13008gOMail Reciepient rejected2025-02-14 01:31:48 H=mail.parhoon-tarh.com (mail.pt.com) [46.167.155.82]:49724 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 CV=no F= rejected RCPT : The mail server could not deliver mail to info@webmentos.com. The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.46.167.155.82130758,Q 3Y+ ossec11301gO6New FTP connection.Feb 14 01:29:49 vm1 pure-ftpd[1031043]: (?@154.212.141.134) [INFO] New connection from 154.212.141.134154.212.141.1341819730>P  =w) ossec13008gLUMail Reciepient rejected2025-02-14 01:17:33 H=(mail.thepsindustries.com) [165.154.227.39]:49739 F= rejected RCPT : Rejected relay attempt: '165.154.227.39' From: 'hgpwyxhx@thepsindustries.com' To: 'validxxxg@gmail.com'165.154.227.391668284+O  3Y+ ossec11301gGlNew FTP connection.Feb 14 00:56:36 vm1 pure-ftpd[1024829]: (?@146.190.219.179) [INFO] New connection from 146.190.219.179146.190.219.1796252001N  3I# ossec11301g@New FTP connection.Feb 14 00:28:20 vm1 pure-ftpd[1019416]: (?@65.49.20.67) [INFO] New connection from 65.49.20.6765.49.20.676252001EM  =+ ossec13008gsMail Reciepient rejected2025-02-13 22:06:02 H=(mail.s2seducationtrust.com) [165.154.226.104]:52671 F= rejected RCPT : Rejected relay attempt: '165.154.226.104' From: 'qlpjpmd@s2seducationtrust.com' To: 'validxxxg@gmail.com'165.154.226.1041668284^L -E) ossec13001gvExim Auth failed2025-02-13 21:49:02 dovecot_login authenticator failed for (vandanabalbharti.com) [60.167.170.146]:43708: 535 Incorrect authentication data (set_id=nologin)60.167.170.1461814991!K  3K% ossec11301gXNew FTP connection.Feb 13 21:48:31 vm1 pure-ftpd[988800]: (?@172.169.4.32) [INFO] New connection from 172.169.4.32172.169.4.326252001 rejected RCPT : Rejected relay attempt: '165.154.247.226' From: 'yicbpmo@heipowersystem.com' To: 'validxxxg@gmail.com'165.154.247.22616056517I  -% ossec13001g lExim Auth failed2025-02-13 20:36:18 dovecot_login authenticator failed for (User) [80.94.95.228]:22738: 535 Incorrect authentication data80.94.95.228798549 |&N * Q @ dwT3,+v|vj Cc% ossec11313gFTP file uploaded to serverFeb 14 09:22:07 vm1 pure-ftpd[1120408]: (militry@technobases.in@152.58.71.33) [NOTICE] /home/techno/public_html/milictry1//index.html uploaded (31819 bytes, 511.41KB/sec)152.58.71.3312697501i  C[% ossec11309gFTP Authentication success.Feb 14 09:22:07 vm1 pure-ftpd[1120408]: (?@152.58.71.33) [INFO] militry@technobases.in is now logged in152.58.71.331269750"h  3M% ossec11301gNew FTP connection.Feb 14 09:22:07 vm1 pure-ftpd[1120408]: (?@152.58.71.33) [INFO] New connection from 152.58.71.33152.58.71.3312697501g  C[% ossec11309g!FTP Authentication success.Feb 14 09:18:48 vm1 pure-ftpd[1119819]: (?@152.58.71.33) [INFO] militry@technobases.in is now logged in152.58.71.331269750"f  3M% ossec11301g!New FTP connection.Feb 14 09:18:48 vm1 pure-ftpd[1119819]: (?@152.58.71.33) [INFO] New connection from 152.58.71.33152.58.71.331269750"e  3M% ossec11301gNew FTP connection.Feb 14 09:18:34 vm1 pure-ftpd[1119748]: (?@152.58.71.33) [INFO] New connection from 152.58.71.33152.58.71.3312697501d  C[% ossec11309gFTP Authentication success.Feb 14 09:18:35 vm1 pure-ftpd[1119748]: (?@152.58.71.33) [INFO] militry@technobases.in is now logged in152.58.71.331269750(c  3U) ossec11301g New FTP connection.Feb 14 08:44:20 vm1 pure-ftpd[1113344]: (?@87.236.176.244) [INFO] New connection from 87.236.176.24487.236.176.2442635167b  W) ossec9708gDovecot Aborted Login with empty userFeb 14 06:47:46 vm1 dovecot[945797]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=185.247.137.62, lip=103.74.54.108, TLS, session=<0Wo18Q8uH+a594k+>185.247.137.62298795a  W!+ ossec9708gDovecot Aborted Login with empty userFeb 14 06:22:23 vm1 dovecot[945797]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=185.247.137.231, lip=103.74.54.108, TLS, session=<1hx1lg8u6+a594nn>185.247.137.231298795i`  -a% ossec13001gExim Auth failed2025-02-14 05:53:17 dovecot_login authenticator failed for (fablixsolutions.com) [60.2.243.174]:33548: 535 Incorrect authentication data (set_id=info@fablixsolutions.com)60.2.243.1741814991X_  -?% ossec13001gExim Auth failed2025-02-14 05:51:58 dovecot_login authenticator failed for (fablixsolutions.com) [60.2.243.174]:60572: 535 Incorrect authentication data (set_id=nologin)60.2.243.1741814991 ^  [{% ossec12004gPossible Dovecot CVE-2019-11500 attemptFeb 14 05:31:25 vm1 dovecot[945797]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.14.247.228, lip=103.74.54.108, session=3.14.247.2286252001"]  3M% ossec11301gNew FTP connection.Feb 14 05:06:13 vm1 pure-ftpd[1073285]: (?@51.8.223.192) [INFO] New connection from 51.8.223.19251.8.223.1926252001/\  =Y) ossec13008gMail Reciepient rejected2025-02-14 05:05:41 H=(mail.technobases.in) [165.154.227.29]:55208 F= rejected RCPT : Rejected relay attempt: '165.154.227.29' From: 'plnmpymb@technobases.in' To: 'validxxxg@gmail.com'165.154.227.291668284 [  =;) ossec13008gsuMail Reciepient rejected2025-02-14 04:04:28 H=(mail.msnews24.in) [165.154.208.53]:51857 F= rejected RCPT : Rejected relay attempt: '165.154.208.53' From: 'adipl@msnews24.in' To: 'validxxxg@gmail.com'165.154.208.531668284TZ  -7% ossec13001gnHExim Auth failed2025-02-14 03:42:22 dovecot_login authenticator failed for (User) [204.76.203.4]:51598: 535 Incorrect authentication data (set_id=sng@technobases.in)204.76.203.42750405VY  -;% ossec13001gmExim Auth failed2025-02-14 03:41:00 dovecot_login authenticator failed for (User) [204.76.203.4]:16810: 535 Incorrect authentication data (set_id=solid@technobases.in)204.76.203.42750405 5K  N>EK51|  C[% ossec11309gFTP Authentication success.Feb 14 09:38:04 vm1 pure-ftpd[1123405]: (?@152.58.71.33) [INFO] militry@technobases.in is now logged in152.58.71.331269750%{  3Q' ossec11301gNew FTP connection.Feb 14 09:37:47 vm1 pure-ftpd[1123393]: (?@206.168.34.72) [INFO] New connection from 206.168.34.72206.168.34.726252001z  Cw% ossec11313gFTP file uploaded to serverFeb 14 09:38:04 vm1 pure-ftpd[1123405]: (militry@technobases.in@152.58.71.33) [NOTICE] /home/techno/public_html/milictry1//images/user_icon.png uploaded (30729 bytes, 747.12KB/sec)152.58.71.3312697501y  C[% ossec11309g$FTP Authentication success.Feb 14 09:35:54 vm1 pure-ftpd[1123130]: (?@152.58.71.33) [INFO] militry@technobases.in is now logged in152.58.71.331269750"x  3M% ossec11301g$New FTP connection.Feb 14 09:35:54 vm1 pure-ftpd[1123130]: (?@152.58.71.33) [INFO] New connection from 152.58.71.33152.58.71.3312697501w  C[% ossec11309gfFTP Authentication success.Feb 14 09:32:44 vm1 pure-ftpd[1122437]: (?@152.58.71.33) [INFO] militry@technobases.in is now logged in152.58.71.331269750uv  Cc% ossec11313gfFTP file uploaded to serverFeb 14 09:32:45 vm1 pure-ftpd[1122437]: (militry@technobases.in@152.58.71.33) [NOTICE] /home/techno/public_html/milictry1//index.html uploaded (31837 bytes, 475.18KB/sec)152.58.71.331269750"u  3M% ossec11301gfNew FTP connection.Feb 14 09:32:44 vm1 pure-ftpd[1122437]: (?@152.58.71.33) [INFO] New connection from 152.58.71.33152.58.71.331269750ut  Cc% ossec11313gFTP file uploaded to serverFeb 14 09:31:32 vm1 pure-ftpd[1122292]: (militry@technobases.in@152.58.71.33) [NOTICE] /home/techno/public_html/milictry1//index.html uploaded (32133 bytes, 614.47KB/sec)152.58.71.331269750"s  3M% ossec11301gNew FTP connection.Feb 14 09:31:31 vm1 pure-ftpd[1122292]: (?@152.58.71.33) [INFO] New connection from 152.58.71.33152.58.71.3312697501r  C[% ossec11309gFTP Authentication success.Feb 14 09:31:32 vm1 pure-ftpd[1122292]: (?@152.58.71.33) [INFO] militry@technobases.in is now logged in152.58.71.3312697501q  C[% ossec11309gpFTP Authentication success.Feb 14 09:28:38 vm1 pure-ftpd[1121574]: (?@152.58.71.33) [INFO] militry@technobases.in is now logged in152.58.71.331269750:p  ]O) ossec31131gjAnti-bot protection. User failed to pass123.160.223.74 - - [14/Feb/2025:09:28:33 +0530] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9923477&pdata=vC65QzonOY7kN2RDPlYxQ4zAZwpx9mvBCA8eImTRKPTRKGKOZr64eIpfMmwflNIGlseXvKLlaXGNadZjIJ1cWgNWtbuQ8mE9XxFip5JrdY1YIw-IdCFFsWp65zPqT9eCiqKI7Sat-qvuoHZgnH3uwyBoL0Pyv7o1ay5aIj7ggyU3LI2y3cnuq_ywQkRi8dzwuI9lBrtw9i17J-eWatTDFA%3D%3D&id=7fa3b767c460b54a2be4d49030b349c7 HTTP/1.1" 404 552 103.74.54.108 "https://103.74.54.108:2083/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 11_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:123.160.223.74123.160.223.741814991uo  Cc% ossec11313gpFTP file uploaded to serverFeb 14 09:28:39 vm1 pure-ftpd[1121574]: (militry@technobases.in@152.58.71.33) [NOTICE] /home/techno/public_html/milictry1//index.html uploaded (31979 bytes, 413.90KB/sec)152.58.71.331269750"n  3M% ossec11301gpNew FTP connection.Feb 14 09:28:38 vm1 pure-ftpd[1121574]: (?@152.58.71.33) [INFO] New connection from 152.58.71.33152.58.71.331269750vm Cc% ossec11313gRFTP file uploaded to serverFeb 14 09:23:52 vm1 pure-ftpd[1120606]: (militry@technobases.in@152.58.71.33) [NOTICE] /home/techno/public_html/milictry1//index.html uploaded (31825 bytes, 309.97KB/sec)152.58.71.331269750"l  3M% ossec11301gRNew FTP connection.Feb 14 09:23:51 vm1 pure-ftpd[1120606]: (?@152.58.71.33) [INFO] New connection from 152.58.71.33152.58.71.3312697501k  C[% ossec11309gRFTP Authentication success.Feb 14 09:23:51 vm1 pure-ftpd[1120606]: (?@152.58.71.33) [INFO] militry@technobases.in is now logged in152.58.71.331269750 Z  X ^e ,w1  C[% ossec11309gFTP Authentication success.Feb 14 10:12:58 vm1 pure-ftpd[1130052]: (?@152.58.71.33) [INFO] militry@technobases.in is now logged in152.58.71.3312697501  C[% ossec11309g8FTP Authentication success.Feb 14 10:06:07 vm1 pure-ftpd[1128743]: (?@152.58.71.33) [INFO] militry@technobases.in is now logged in152.58.71.331269750"  3M% ossec11301g8New FTP connection.Feb 14 10:06:07 vm1 pure-ftpd[1128743]: (?@152.58.71.33) [INFO] New connection from 152.58.71.33152.58.71.331269750u  Cc% ossec11313g:FTP file uploaded to serverFeb 14 10:06:08 vm1 pure-ftpd[1128743]: (militry@technobases.in@152.58.71.33) [NOTICE] /home/techno/public_html/milictry1//index.html uploaded (32288 bytes, 574.57KB/sec)152.58.71.331269750B  =}+ ossec13008gǪMail Reciepient rejected2025-02-14 10:03:45 H=(mail.heipowersystem.com) [165.154.228.156]:52999 F= rejected RCPT : Rejected relay attempt: '165.154.228.156' From: 'wklkjsmaxm@heipowersystem.com' To: 'validxxxg@gmail.com'165.154.228.1561643084u  Cc% ossec11313gŕFTP file uploaded to serverFeb 14 09:54:53 vm1 pure-ftpd[1126484]: (militry@technobases.in@152.58.71.33) [NOTICE] /home/techno/public_html/milictry1//index.html uploaded (32340 bytes, 618.58KB/sec)152.58.71.331269750"  3M% ossec11301gŕNew FTP connection.Feb 14 09:54:52 vm1 pure-ftpd[1126484]: (?@152.58.71.33) [INFO] New connection from 152.58.71.33152.58.71.3312697501  C[% ossec11309gŕFTP Authentication success.Feb 14 09:54:52 vm1 pure-ftpd[1126484]: (?@152.58.71.33) [INFO] militry@technobases.in is now logged in152.58.71.331269750u  Cc% ossec11313gcFTP file uploaded to serverFeb 14 09:45:29 vm1 pure-ftpd[1124971]: (militry@technobases.in@152.58.71.33) [NOTICE] /home/techno/public_html/milictry1//index.html uploaded (32023 bytes, 515.29KB/sec)152.58.71.3312697501  C[% ossec11309gaFTP Authentication success.Feb 14 09:45:28 vm1 pure-ftpd[1124971]: (?@152.58.71.33) [INFO] militry@technobases.in is now logged in152.58.71.331269750"  3M% ossec11301gaNew FTP connection.Feb 14 09:45:28 vm1 pure-ftpd[1124971]: (?@152.58.71.33) [INFO] New connection from 152.58.71.33152.58.71.331269750u  Cc% ossec11313gFTP file uploaded to serverFeb 14 09:42:49 vm1 pure-ftpd[1124330]: (militry@technobases.in@152.58.71.33) [NOTICE] /home/techno/public_html/milictry1//index.html uploaded (31996 bytes, 614.02KB/sec)152.58.71.331269750"  3M% ossec11301gNew FTP connection.Feb 14 09:42:48 vm1 pure-ftpd[1124330]: (?@152.58.71.33) [INFO] New connection from 152.58.71.33152.58.71.3312697501  C[% ossec11309gFTP Authentication success.Feb 14 09:42:48 vm1 pure-ftpd[1124330]: (?@152.58.71.33) [INFO] militry@technobases.in is now logged in152.58.71.331269750u  Cc% ossec11313g-FTP file uploaded to serverFeb 14 09:40:20 vm1 pure-ftpd[1123695]: (militry@technobases.in@152.58.71.33) [NOTICE] /home/techno/public_html/milictry1//index.html uploaded (31926 bytes, 366.60KB/sec)152.58.71.331269750u  Cc% ossec11313gFTP file uploaded to serverFeb 14 09:39:37 vm1 pure-ftpd[1123695]: (militry@technobases.in@152.58.71.33) [NOTICE] /home/techno/public_html/milictry1//index.html uploaded (31898 bytes, 760.62KB/sec)152.58.71.3312697501  C[% ossec11309gFTP Authentication success.Feb 14 09:39:36 vm1 pure-ftpd[1123695]: (?@152.58.71.33) [INFO] militry@technobases.in is now logged in152.58.71.331269750"~  3M% ossec11301gNew FTP connection.Feb 14 09:39:36 vm1 pure-ftpd[1123695]: (?@152.58.71.33) [INFO] New connection from 152.58.71.33152.58.71.331269750"}  3M% ossec11301gNew FTP connection.Feb 14 09:38:04 vm1 pure-ftpd[1123405]: (?@152.58.71.33) [INFO] New connection from 152.58.71.33152.58.71.331269750 >ZZ   d 38K>%#  3Q' ossec11301gΔNew FTP connection.Feb 14 10:33:14 vm1 pure-ftpd[1134084]: (?@152.59.116.23) [INFO] New connection from 152.59.116.23152.59.116.231269750%"  3Q' ossec11301gΔNew FTP connection.Feb 14 10:33:14 vm1 pure-ftpd[1134082]: (?@152.58.71.216) [INFO] New connection from 152.58.71.216152.58.71.2161269750! Cu' ossec11313gΔFTP file uploaded to serverFeb 14 10:33:15 vm1 pure-ftpd[1134082]: (militry@technobases.in@152.58.71.216) [NOTICE] /home/techno/public_html/milictry1//images/teacher.png uploaded (26256 bytes, 365.50KB/sec)152.58.71.21612697503  C]' ossec11309gΔFTP Authentication success.Feb 14 10:33:14 vm1 pure-ftpd[1134082]: (?@152.58.71.216) [INFO] militry@technobases.in is now logged in152.58.71.2161269750B  C{' ossec11309gΔFTP Authentication success.Feb 14 10:33:14 vm1 pure-ftpd[1134084]: (?@152.59.116.23) [INFO] user@sainikschoolcoachinginjaipur.com is now logged in152.59.116.231269750%  3Q' ossec11301g.New FTP connection.Feb 14 10:31:32 vm1 pure-ftpd[1133874]: (?@152.59.116.23) [INFO] New connection from 152.59.116.23152.59.116.231269750B  C{' ossec11309g.FTP Authentication success.Feb 14 10:31:32 vm1 pure-ftpd[1133874]: (?@152.59.116.23) [INFO] user@sainikschoolcoachinginjaipur.com is now logged in152.59.116.2312697504 C]' ossec11309gFTP Authentication success.Feb 14 10:31:10 vm1 pure-ftpd[1133778]: (?@152.58.71.216) [INFO] militry@technobases.in is now logged in152.58.71.2161269750w  Ce' ossec11313gFTP file uploaded to serverFeb 14 10:31:11 vm1 pure-ftpd[1133778]: (militry@technobases.in@152.58.71.216) [NOTICE] /home/techno/public_html/milictry1//index.html uploaded (32334 bytes, 617.59KB/sec)152.58.71.2161269750& 3Q' ossec11301gNew FTP connection.Feb 14 10:31:10 vm1 pure-ftpd[1133778]: (?@152.58.71.216) [INFO] New connection from 152.58.71.216152.58.71.2161269750b  E9' ossec11314g4FTP file deleted from serverFeb 14 10:31:39 vm1 pure-ftpd[1133871]: (militry@technobases.in@152.58.71.216) [NOTICE] Deleted /home/techno/public_html/milictry1//images/teacher.png152.58.71.2161269750C C{' ossec11309gFTP Authentication success.Feb 14 10:25:54 vm1 pure-ftpd[1132796]: (?@152.59.116.23) [INFO] user@sainikschoolcoachinginjaipur.com is now logged in152.59.116.231269750V -7' ossec13001gExim Auth failed2025-02-14 10:25:49 dovecot_login authenticator failed for (nyaystambh.com) [111.61.229.78]:62905: 535 Incorrect authentication data (set_id=nologin)111.61.229.781814991& 3Q' ossec11301gNew FTP connection.Feb 14 10:25:48 vm1 pure-ftpd[1132796]: (?@152.59.116.23) [INFO] New connection from 152.59.116.23152.59.116.231269750u  Cc% ossec11313gIFTP file uploaded to serverFeb 14 10:14:56 vm1 pure-ftpd[1130305]: (militry@technobases.in@152.58.71.33) [NOTICE] /home/techno/public_html/milictry1//index.html uploaded (32322 bytes, 115.62KB/sec)152.58.71.331269750t  Ca% ossec11313gFTP file uploaded to serverFeb 14 10:14:12 vm1 pure-ftpd[1130305]: (militry@technobases.in@152.58.71.33) [NOTICE] /home/techno/public_html/milictry1//index.html uploaded (32335 bytes, 56.35KB/sec)152.58.71.3312697501  C[% ossec11309gFTP Authentication success.Feb 14 10:14:10 vm1 pure-ftpd[1130305]: (?@152.58.71.33) [INFO] militry@technobases.in is now logged in152.58.71.331269750"  3M% ossec11301gNew FTP connection.Feb 14 10:14:07 vm1 pure-ftpd[1130305]: (?@152.58.71.33) [INFO] New connection from 152.58.71.33152.58.71.331269750|  Cq% ossec11313gFTP file uploaded to serverFeb 14 10:12:59 vm1 pure-ftpd[1130052]: (militry@technobases.in@152.58.71.33) [NOTICE] /home/techno/public_html/milictry1//images/teacher.png uploaded (6205 bytes, 153.50KB/sec)152.58.71.331269750"  3M% ossec11301gNew FTP connection.Feb 14 10:12:56 vm1 pure-ftpd[1130052]: (?@152.58.71.33) [INFO] New connection from 152.58.71.33152.58.71.331269750 z  } v mhc`YNG@=}V#94.23.7.188BLACKggBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests3017382^localU'193.70.81.103BLACKggggBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests3017382FQglocal o '41.250.223.79BLACKg,g|,Blacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests2542007)Olocal '193.41.206.24BLACKgIg]IBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests3017382)local~'81.161.238.46BLACKgCg\CBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests732800Q.local'13.74.220.119BLACKgb|g3|Blacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests2963597 Jwlocal~%20.2.217.114BLACKgFgBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests1819730rlocal%192.99.35.94BLACKg gBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests6251999c#^local)105.154.93.213BLACKggіBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests2542007i]local~'95.217.109.26BLACKgAgABlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests660013_mlocal~%52.169.90.21BLACKggBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests29635974Zlocalo'13.74.238.233BLACKgglBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests2963597 JlocalT)52.178.137.151BLACKgxgIBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests29635974localR)52.178.143.101BLACKgsgDBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests29635974elocalH'134.122.97.81BLACKgQg"Blacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests2635167zaQlocalF)149.130.215.43BLACKgMgBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests6252001+local~E%79.137.93.33BLACKg3gBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests3017382O]!localD'13.79.129.149BLACKgKZgZBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests2963597 Olocal~9+!k195.178.110.163GRAYgUImunify360g Automatically blocked due to distributed attack732800ònlocalz'!k45.148.10.186GRAYg#Imunify360g"Automatically blocked due to distributed attack2750405- localy%!k45.148.10.90GRAYg_Imunify360g3Automatically blocked due to distributed attack2750405- Zlocal +137.135.244.124BLACKgkgkBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests2963597|local 4-*l j c W Q I=$ %176.38.0.194BLACKggBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests690791&local+137.135.244.121BLACKggsBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests2963597ylocal)44.234.253.181BLACKgrgCBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests6252001,local +178.128.211.202BLACKgNgBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests1880251local~ %91.215.85.31BLACKg-gBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests2017370[Ulocal '193.70.81.116BLACKg,gBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests3017382FQtlocal~ %13.79.155.43BLACKgvgvBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests2963597 O+local'13.79.153.251BLACKggBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests2963597 Olocal\%192.95.30.12BLACKggɷBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests6251999_ localy[%!k3.14.247.228GRAYgImunify360gAutomatically blocked due to distributed attack6252001localZ+172.167.100.202BLACKgXgVXBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests2635167dlocalY)132.145.29.111BLACKg`g1Blacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests2635167olocal~X%84.239.43.18BLACKg6gBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests6252001T+localW+132.145.140.179BLACKg/gBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests6252001local'13.72.114.192BLACKg¢gBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests6252001 Hrlocal'149.202.86.86BLACKggBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests3017382VVlocal~+172.190.154.228BLACKgEgEBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests6252001local}+172.166.208.240BLACKggZBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests2635167local~|%94.72.119.61BLACKg`gS`Blacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests6252001^Hw=local{)194.247.173.99BLACKg/qgqBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests690791clocal~z%13.79.153.65BLACKggBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests2963597 OAlocaly)196.115.49.163BLACKgEgBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests2542007s1localx)129.213.150.89BLACKgHgHBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests6252001ՖYlocal}w#58.19.1.117BLACKggYBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests1814991:ulocalv+172.166.163.142BLACKgdg5Blacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests2635167local~u'65.21.232.254BLACKgOg Blacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests660013Alocal~t%23.94.53.110BLACKgHgBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests6252001^5nlocals+217.182.175.125BLACKgG|g|Blacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests3017382ٶ}local Eztnhb\VPJD>82,& ~xrlf`ZTNHB<60*$  | v%  j ^ R F 9 ,    v i \ O B 5 (     r e XR K > 1 $  { n a T G : -   w j ] P C 6 )   sfYL?2% |obUH;.!E8+xk^QD7*tgZM@3& }pcVI</"yl_ 1149361NMKMJMI=OO 1149361OO 1036973O}O7O 1168579N 1168579N 1168579N 1149361NQ 12109974 12109973 12109973 12109973s 12109972 12109972 12109972 12109972 121099720 1210997. 1210997, 1210997* 1210997) 1210997' 1210997'z 1210997'[ 1210997& 1210997&m 1210997&E 1210997&6 1210997&2 1210997$ 1210997$E 1210997# 1210997#. 1210997#$ 1210997# 1210997" 1210997" 1210997! 1210997! 1210997!r 1210997!j 1210997 1210997  1210997 1210997 1210997 1210997N 1210997L 1210997F 1210997 1210997D 1210997 1210997 1210997] 1210997X 1210997 1210997h 1210997e 1210997n 1210997g 1210997 1210997< 12109979 1210997) 1210997 12109972 1210997 1210997 1210997S 1210997 1210997k 1210997a 1210997 1210997 1210997 z 1210997  1210997 B 1210997 7 1210997 1210997 1168579M= 1168579L 1168579K} 1168579KE 1168579Hv 1168579G 1168579G 1168579G 1168579D= 1168579A 1168579? 1168579> 1168579> 1168579>" 1168579>! 1168579=v 1168579< 1168579< 1168579:m 1168579: 1168579: 1168579: 1168579: 1168579: 1168579: 1168579: 1168579: 1168579: 11685799 11685799 11685799 116857987 11685795 11685795 11685794: 11685793y 11685793n 11685793T 11685792 11685792 11685792 11685792 11685792 11685792 11685790 11685790 11685790 1168579/ 1168579/ 1168579. 1168579- 1168579-7 1168579,= 1168579*O 1168579*N 1168579) 1168579) 1168579( 1168579' 1168579%$ 1168579#K 1168579": 1168579" 1168579!g 1168579!2 1168579 1168579r 1168579u 1168579 1168579u 1168579Y 1168579 1168579 1168579 1168579G 1168579r 1168579k 1168579' 1168579 1168579 1168579 1168579 1168579 1168579 1168579 ` 1149361L 1149361F 1149361AX 1149361@ 11493617' 11493616G 11493614 1149361'; 1149361&\ 1149361% 1149361$Z 1149361!f 1149361S 1149361. 1149361 11493615 1149361 1149361 1149361o 1149361 1062947  1036973L[ 1036973J 1036973Ii 1036973?q 10369738 10369733 10369731 1036973)o 1036973'b 1036973& 1036973! 1036973  10369733 1036973 10369738 1036973 1036973 102358L 102358F= 102358A 102358/lKHKGIGI HXFF[FBE"DZDCXCWBQAAAm@@:@?]>>a==<<<1;:y:#99.8-8,7(66533G32M2:1p1$0000P0C0B00/--,,,++;+:**$))#)"(c'%l$"yvOD   /;DCBA@?8765432! 0 u h[N}pcVI<) /"ui~rfZNB6SG;/# ~qdWJ=0#  X  r e $    K > 1 { n a T G : - j ] P C 6 )    ZM@3&  wxk^QD7*tg s f Y L ? 2 %  |obUH;.!0=JWA4qd' ~ i \ O B 5 (    + 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1210997>c 1210997 1218197&1 1218197% 1218197%3 1218197h 1218197 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750~ 12697503 12697502 12697501 12697500 1269750/ 1269750. 1269750- 1269750, 1269750Z 1269750Y 1269750X 1269750W 1269750V 1269750U 1269750T 1269750S 1269750R 1269750Q 1269750P 1269750O 1269750N 1269750M 1269750L 1269750K 1269750J 1269750I 1269750H 1269750G 1269750F 1269750E 1269750D 1269750C 1269750B 1269750? 1269750} 1269750| 1269750{ 1269750z 1269750y 1269750x 1269750w 1269750v 1269750u 1269750t 1269750s 1269750r 1269750q 1269750p 1269750o 1269750n 1269750m 1269750l 1269750k 1269750j 1269750i 1269750h 1269750g 1269750f 1269750e 1269750d 1269750c 1269750b 1269750a 1269750` 1269750_ 1269750^ 1269750] 1269750\ 1269750[ 1269750 1269750 1269750 1269750 1269750+ 1269750* 1269750) 1269750( 1269750' 1269750& 1269750% 1269750$ 1269750# 1269750" 1269750! 1269750 1269750 1269750 1269750 1269750> 1269750= 1269750< 1269750; 1269750: 12697509 12697508 12697507 12697506 12697505 12697504 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1210997O| 1210997E 1210997M 1210997M 1210997L 1220409I 1210997I 1210997I 1227603 1227603x 1220409D3 1220409AY 1220409>k 1220409> 1269750k 1269750j 1269750i 1269750h 1269750g 1269750P 1269750O 1269750N 1269750M 1269750K 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 m[ > x|hmrm%6  3Q' ossec11301gNew FTP connection.Feb 14 10:43:39 vm1 pure-ftpd[1136200]: (?@152.58.71.216) [INFO] New connection from 152.58.71.216152.58.71.2161269750x5 Ce' ossec11313gРFTP file uploaded to serverFeb 14 10:42:00 vm1 pure-ftpd[1135958]: (militry@technobases.in@152.58.71.216) [NOTICE] /home/techno/public_html/milictry1//index.html uploaded (32472 bytes, 628.31KB/sec)152.58.71.2161269750%4  3Q' ossec11301gРNew FTP connection.Feb 14 10:41:59 vm1 pure-ftpd[1135958]: (?@152.58.71.216) [INFO] New connection from 152.58.71.216152.58.71.216126975033  C]' ossec11309gРFTP Authentication success.Feb 14 10:41:59 vm1 pure-ftpd[1135958]: (?@152.58.71.216) [INFO] militry@technobases.in is now logged in152.58.71.2161269750w2  Ce' ossec11313g>FTP file uploaded to serverFeb 14 10:40:20 vm1 pure-ftpd[1134645]: (militry@technobases.in@152.58.71.216) [NOTICE] /home/techno/public_html/milictry1//index.html uploaded (32404 bytes, 631.12KB/sec)152.58.71.2161269750w1  Ce' ossec11313gFTP file uploaded to serverFeb 14 10:39:33 vm1 pure-ftpd[1134645]: (militry@technobases.in@152.58.71.216) [NOTICE] /home/techno/public_html/milictry1//index.html uploaded (32417 bytes, 522.34KB/sec)152.58.71.2161269750%0  3Q' ossec11301gNew FTP connection.Feb 14 10:38:27 vm1 pure-ftpd[1135175]: (?@152.59.116.23) [INFO] New connection from 152.59.116.23152.59.116.231269750B/  C{' ossec11309gFTP Authentication success.Feb 14 10:38:28 vm1 pure-ftpd[1135175]: (?@152.59.116.23) [INFO] user@sainikschoolcoachinginjaipur.com is now logged in152.59.116.231269750x. Ce' ossec11313gϲFTP file uploaded to serverFeb 14 10:38:01 vm1 pure-ftpd[1134645]: (militry@technobases.in@152.58.71.216) [NOTICE] /home/techno/public_html/milictry1//index.html uploaded (32418 bytes, 571.18KB/sec)152.58.71.2161269750%-  3Q' ossec11301gzNew FTP connection.Feb 14 10:37:05 vm1 pure-ftpd[1134947]: (?@152.59.116.23) [INFO] New connection from 152.59.116.23152.59.116.231269750x, Ce' ossec11313gjFTP file uploaded to serverFeb 14 10:36:48 vm1 pure-ftpd[1134645]: (militry@technobases.in@152.58.71.216) [NOTICE] /home/techno/public_html/milictry1//index.html uploaded (32380 bytes, 314.18KB/sec)152.58.71.2161269750B+  C{' ossec11309gzFTP Authentication success.Feb 14 10:37:05 vm1 pure-ftpd[1134947]: (?@152.59.116.23) [INFO] user@sainikschoolcoachinginjaipur.com is now logged in152.59.116.231269750%*  3Q' ossec11301g<New FTP connection.Feb 14 10:36:02 vm1 pure-ftpd[1134792]: (?@152.59.116.23) [INFO] New connection from 152.59.116.23152.59.116.231269750B)  C{' ossec11309g<FTP Authentication success.Feb 14 10:36:02 vm1 pure-ftpd[1134792]: (?@152.59.116.23) [INFO] user@sainikschoolcoachinginjaipur.com is now logged in152.59.116.231269750x( Ce' ossec11313g:FTP file uploaded to serverFeb 14 10:36:01 vm1 pure-ftpd[1134645]: (militry@technobases.in@152.58.71.216) [NOTICE] /home/techno/public_html/milictry1//index.html uploaded (32325 bytes, 624.29KB/sec)152.58.71.2161269750w'  Ce' ossec11313gFTP file uploaded to serverFeb 14 10:35:22 vm1 pure-ftpd[1134645]: (militry@technobases.in@152.58.71.216) [NOTICE] /home/techno/public_html/milictry1//index.html uploaded (32312 bytes, 566.08KB/sec)152.58.71.21612697503&  C]' ossec11309gFTP Authentication success.Feb 14 10:35:21 vm1 pure-ftpd[1134645]: (?@152.58.71.216) [INFO] militry@technobases.in is now logged in152.58.71.2161269750%%  3Q' ossec11301gNew FTP connection.Feb 14 10:35:21 vm1 pure-ftpd[1134645]: (?@152.58.71.216) [INFO] New connection from 152.58.71.216152.58.71.2161269750x$ Ce' ossec11313gκFTP file uploaded to serverFeb 14 10:33:53 vm1 pure-ftpd[1134082]: (militry@technobases.in@152.58.71.216) [NOTICE] /home/techno/public_html/milictry1//index.html uploaded (32334 bytes, 329.44KB/sec)152.58.71.2161269750 IN B F qmrw|%H  3Q' ossec11301gNew FTP connection.Feb 14 10:56:18 vm1 pure-ftpd[1139141]: (?@152.58.71.216) [INFO] New connection from 152.58.71.216152.58.71.21612697503G  C]' ossec11309gFTP Authentication success.Feb 14 10:56:18 vm1 pure-ftpd[1139141]: (?@152.58.71.216) [INFO] militry@technobases.in is now logged in152.58.71.2161269750wF  Ce' ossec11313g[FTP file uploaded to serverFeb 14 10:53:38 vm1 pure-ftpd[1138028]: (militry@technobases.in@152.58.71.216) [NOTICE] /home/techno/public_html/milictry1//index.html uploaded (32550 bytes, 253.51KB/sec)152.58.71.2161269750wE  Ce' ossec11313gFTP file uploaded to serverFeb 14 10:52:38 vm1 pure-ftpd[1138028]: (militry@technobases.in@152.58.71.216) [NOTICE] /home/techno/public_html/milictry1//index.html uploaded (32542 bytes, 429.81KB/sec)152.58.71.2161269750wD  Ce' ossec11313gFTP file uploaded to serverFeb 14 10:51:42 vm1 pure-ftpd[1138028]: (militry@technobases.in@152.58.71.216) [NOTICE] /home/techno/public_html/milictry1//index.html uploaded (32456 bytes, 332.43KB/sec)152.58.71.2161269750%C  3Q' ossec11301gNew FTP connection.Feb 14 10:51:41 vm1 pure-ftpd[1138028]: (?@152.58.71.216) [INFO] New connection from 152.58.71.216152.58.71.21612697503B  C]' ossec11309gFTP Authentication success.Feb 14 10:51:41 vm1 pure-ftpd[1138028]: (?@152.58.71.216) [INFO] militry@technobases.in is now logged in152.58.71.2161269750 A 3I# ossec11301gһNew FTP connection.Feb 14 10:50:57 vm1 pure-ftpd[1137902]: (?@51.38.145.7) [INFO] New connection from 51.38.145.751.38.145.73017382@  =;' ossec13008gңMail Reciepient rejected2025-02-14 10:50:34 H=(mail.hsnews.in) [165.154.228.9]:52770 F= rejected RCPT : Rejected relay attempt: '165.154.228.9' From: 'tqzinfwpw@hsnews.in' To: 'validxxxg@gmail.com'165.154.228.91643084w?  Ce' ossec11313gMFTP file uploaded to serverFeb 14 10:49:08 vm1 pure-ftpd[1137164]: (militry@technobases.in@152.58.71.216) [NOTICE] /home/techno/public_html/milictry1//index.html uploaded (32542 bytes, 570.53KB/sec)152.58.71.21612697503>  C]' ossec11309gFTP Authentication success.Feb 14 10:48:17 vm1 pure-ftpd[1137164]: (?@152.58.71.216) [INFO] militry@technobases.in is now logged in152.58.71.2161269750x= Ce' ossec11313gFTP file uploaded to serverFeb 14 10:48:18 vm1 pure-ftpd[1137164]: (militry@technobases.in@152.58.71.216) [NOTICE] /home/techno/public_html/milictry1//index.html uploaded (32573 bytes, 315.27KB/sec)152.58.71.2161269750%<  3Q' ossec11301gNew FTP connection.Feb 14 10:48:17 vm1 pure-ftpd[1137164]: (?@152.58.71.216) [INFO] New connection from 152.58.71.216152.58.71.2161269750;  Cu' ossec11313gFTP file uploaded to serverFeb 14 10:46:59 vm1 pure-ftpd[1136961]: (militry@technobases.in@152.58.71.216) [NOTICE] /home/techno/public_html/milictry1//images/success.png uploaded (1104 bytes, 5288.87KB/sec)152.58.71.21612697503:  C]' ossec11309gFTP Authentication success.Feb 14 10:46:59 vm1 pure-ftpd[1136961]: (?@152.58.71.216) [INFO] militry@technobases.in is now logged in152.58.71.2161269750%9  3Q' ossec11301gNew FTP connection.Feb 14 10:46:59 vm1 pure-ftpd[1136961]: (?@152.58.71.216) [INFO] New connection from 152.58.71.216152.58.71.2161269750w8  Ce' ossec11313gFTP file uploaded to serverFeb 14 10:43:40 vm1 pure-ftpd[1136200]: (militry@technobases.in@152.58.71.216) [NOTICE] /home/techno/public_html/milictry1//index.html uploaded (32526 bytes, 453.09KB/sec)152.58.71.216126975037  C]' ossec11309gFTP Authentication success.Feb 14 10:43:40 vm1 pure-ftpd[1136200]: (?@152.58.71.216) [INFO] militry@technobases.in is now logged in152.58.71.2161269750  I @ +| wx[ Ce' ossec11313gִFTP file uploaded to serverFeb 14 11:07:55 vm1 pure-ftpd[1141360]: (militry@technobases.in@152.58.71.216) [NOTICE] /home/techno/public_html/milictry1//index.html uploaded (32686 bytes, 631.54KB/sec)152.58.71.2161269750wZ  Ce' ossec11313g|FTP file uploaded to serverFeb 14 11:06:59 vm1 pure-ftpd[1141360]: (militry@technobases.in@152.58.71.216) [NOTICE] /home/techno/public_html/milictry1//index.html uploaded (32707 bytes, 485.90KB/sec)152.58.71.21612697503Y  C]' ossec11309g|FTP Authentication success.Feb 14 11:06:58 vm1 pure-ftpd[1141360]: (?@152.58.71.216) [INFO] militry@technobases.in is now logged in152.58.71.2161269750%X  3Q' ossec11301g|New FTP connection.Feb 14 11:06:58 vm1 pure-ftpd[1141360]: (?@152.58.71.216) [INFO] New connection from 152.58.71.216152.58.71.2161269750xW Ce' ossec11313g՗FTP file uploaded to serverFeb 14 11:03:10 vm1 pure-ftpd[1140525]: (militry@technobases.in@152.58.71.216) [NOTICE] /home/techno/public_html/milictry1//index.html uploaded (32524 bytes, 628.45KB/sec)152.58.71.21612697503V  C]' ossec11309g՗FTP Authentication success.Feb 14 11:03:09 vm1 pure-ftpd[1140525]: (?@152.58.71.216) [INFO] militry@technobases.in is now logged in152.58.71.2161269750%U  3Q' ossec11301g՗New FTP connection.Feb 14 11:03:09 vm1 pure-ftpd[1140525]: (?@152.58.71.216) [INFO] New connection from 152.58.71.216152.58.71.2161269750+T  3Y+ ossec11301gENew FTP connection.Feb 14 11:01:49 vm1 pure-ftpd[1140293]: (?@106.219.120.171) [INFO] New connection from 106.219.120.171106.219.120.17112697501S  CU+ ossec11309gEFTP Authentication success.Feb 14 11:01:49 vm1 pure-ftpd[1140293]: (?@106.219.120.171) [INFO] user@msnews24.in is now logged in106.219.120.1711269750|R Cm' ossec11313gFTP file uploaded to serverFeb 14 11:00:03 vm1 pure-ftpd[1139905]: (militry@technobases.in@152.58.71.216) [NOTICE] /home/techno/public_html/milictry1//images/2.jpeg uploaded (148741 bytes, 467.78KB/sec)152.58.71.21612697503Q  C]' ossec11309gFTP Authentication success.Feb 14 11:00:03 vm1 pure-ftpd[1139905]: (?@152.58.71.216) [INFO] militry@technobases.in is now logged in152.58.71.2161269750%P  3Q' ossec11301gNew FTP connection.Feb 14 11:00:02 vm1 pure-ftpd[1139905]: (?@152.58.71.216) [INFO] New connection from 152.58.71.216152.58.71.21612697501O  CU+ ossec11309gԥFTP Authentication success.Feb 14 10:59:08 vm1 pure-ftpd[1139561]: (?@106.219.120.171) [INFO] user@msnews24.in is now logged in106.219.120.1711269750+N  3Y+ ossec11301gԡNew FTP connection.Feb 14 10:59:04 vm1 pure-ftpd[1139561]: (?@106.219.120.171) [INFO] New connection from 106.219.120.171106.219.120.1711269750xM Ce' ossec11313gUFTP file uploaded to serverFeb 14 10:57:48 vm1 pure-ftpd[1139318]: (militry@technobases.in@152.58.71.216) [NOTICE] /home/techno/public_html/milictry1//index.html uploaded (32555 bytes, 751.25KB/sec)152.58.71.2161269750%L  3Q' ossec11301g=New FTP connection.Feb 14 10:57:24 vm1 pure-ftpd[1139318]: (?@152.58.71.216) [INFO] New connection from 152.58.71.216152.58.71.21612697503K  C]' ossec11309g=FTP Authentication success.Feb 14 10:57:24 vm1 pure-ftpd[1139318]: (?@152.58.71.216) [INFO] militry@technobases.in is now logged in152.58.71.2161269750wJ  Ce' ossec11313g=FTP file uploaded to serverFeb 14 10:57:25 vm1 pure-ftpd[1139318]: (militry@technobases.in@152.58.71.216) [NOTICE] /home/techno/public_html/milictry1//index.html uploaded (32566 bytes, 544.65KB/sec)152.58.71.2161269750I  Cy' ossec11313gFTP file uploaded to serverFeb 14 10:56:19 vm1 pure-ftpd[1139141]: (militry@technobases.in@152.58.71.216) [NOTICE] /home/techno/public_html/milictry1//images/usercheck.png uploaded (14785 bytes, 576.80KB/sec)152.58.71.2161269750    i  ej Sxm Ce' ossec11313gٹFTP file uploaded to serverFeb 14 11:20:48 vm1 pure-ftpd[1144400]: (militry@technobases.in@152.58.71.216) [NOTICE] /home/techno/public_html/milictry1//index.html uploaded (33411 bytes, 499.26KB/sec)152.58.71.2161269750%l  3Q' ossec11301gٹNew FTP connection.Feb 14 11:20:47 vm1 pure-ftpd[1144400]: (?@152.58.71.216) [INFO] New connection from 152.58.71.216152.58.71.21612697503k  C]' ossec11309gٹFTP Authentication success.Feb 14 11:20:47 vm1 pure-ftpd[1144400]: (?@152.58.71.216) [INFO] militry@technobases.in is now logged in152.58.71.21612697503j  C]' ossec11309glFTP Authentication success.Feb 14 11:19:31 vm1 pure-ftpd[1143934]: (?@152.58.71.216) [INFO] militry@technobases.in is now logged in152.58.71.2161269750%i  3Q' ossec11301glNew FTP connection.Feb 14 11:19:31 vm1 pure-ftpd[1143934]: (?@152.58.71.216) [INFO] New connection from 152.58.71.216152.58.71.2161269750wh  Ce' ossec11313glFTP file uploaded to serverFeb 14 11:19:32 vm1 pure-ftpd[1143934]: (militry@technobases.in@152.58.71.216) [NOTICE] /home/techno/public_html/milictry1//index.html uploaded (33377 bytes, 496.70KB/sec)152.58.71.2161269750%g  3Q' ossec11301gNew FTP connection.Feb 14 11:18:09 vm1 pure-ftpd[1143680]: (?@152.58.71.216) [INFO] New connection from 152.58.71.216152.58.71.2161269750wf  Ce' ossec11313gFTP file uploaded to serverFeb 14 11:18:10 vm1 pure-ftpd[1143680]: (militry@technobases.in@152.58.71.216) [NOTICE] /home/techno/public_html/milictry1//index.html uploaded (32812 bytes, 633.26KB/sec)152.58.71.21612697503e  C]' ossec11309gFTP Authentication success.Feb 14 11:18:09 vm1 pure-ftpd[1143680]: (?@152.58.71.216) [INFO] militry@technobases.in is now logged in152.58.71.2161269750wd  Ce' ossec11313gآFTP file uploaded to serverFeb 14 11:16:09 vm1 pure-ftpd[1142803]: (militry@technobases.in@152.58.71.216) [NOTICE] /home/techno/public_html/milictry1//index.html uploaded (33175 bytes, 269.37KB/sec)152.58.71.2161269750xc Ce' ossec11313gXFTP file uploaded to serverFeb 14 11:14:56 vm1 pure-ftpd[1142803]: (militry@technobases.in@152.58.71.216) [NOTICE] /home/techno/public_html/milictry1//index.html uploaded (33188 bytes, 583.23KB/sec)152.58.71.2161269750wb  Ce' ossec11313g*FTP file uploaded to serverFeb 14 11:14:10 vm1 pure-ftpd[1142803]: (militry@technobases.in@152.58.71.216) [NOTICE] /home/techno/public_html/milictry1//index.html uploaded (33146 bytes, 532.01KB/sec)152.58.71.21612697503a  C]' ossec11309g*FTP Authentication success.Feb 14 11:14:09 vm1 pure-ftpd[1142803]: (?@152.58.71.216) [INFO] militry@technobases.in is now logged in152.58.71.2161269750%`  3Q' ossec11301g*New FTP connection.Feb 14 11:14:09 vm1 pure-ftpd[1142803]: (?@152.58.71.216) [INFO] New connection from 152.58.71.216152.58.71.2161269750x_ Ce' ossec11313gװFTP file uploaded to serverFeb 14 11:12:06 vm1 pure-ftpd[1141360]: (militry@technobases.in@152.58.71.216) [NOTICE] /home/techno/public_html/milictry1//index.html uploaded (32856 bytes, 489.62KB/sec)152.58.71.2161269750w^  Ce' ossec11313g׊FTP file uploaded to serverFeb 14 11:11:28 vm1 pure-ftpd[1141360]: (militry@technobases.in@152.58.71.216) [NOTICE] /home/techno/public_html/milictry1//index.html uploaded (32727 bytes, 527.39KB/sec)152.58.71.2161269750x] Ce' ossec11313g2FTP file uploaded to serverFeb 14 11:10:01 vm1 pure-ftpd[1141360]: (militry@technobases.in@152.58.71.216) [NOTICE] /home/techno/public_html/milictry1//index.html uploaded (32726 bytes, 531.91KB/sec)152.58.71.2161269750w\  Ce' ossec11313gFTP file uploaded to serverFeb 14 11:09:41 vm1 pure-ftpd[1141360]: (militry@technobases.in@152.58.71.216) [NOTICE] /home/techno/public_html/milictry1//index.html uploaded (32714 bytes, 630.96KB/sec)152.58.71.2161269750 5nzqh_V;MD2) ~ulcZQH?6-$  y p g ^ U C L : 1 (    } t k b Y P G > 5 , #    v l b X N : D & 0    | r h ^ T J @ 6 , "    n d x Z P F < 2 (   ~tj`VLB8.$zpf\RH>4*  vlbXND:0&|rh^TJ@6,"xndZPF<2( ~tj`VLB8.$ gР5 gР4 gР3 g>2 g1 g0 g/ gϲ. gz- gz+ gj, g<* g<) g:( g' g& g% gκ$ gΔ# gΔ" gΔ! gΔ gΔ g4 g. g. g g g g g g gI g g g g g g g: g8 g8 gǪ gŕ gŕ gŕ gc ga ga g g g g- g g g g g g g g$ g$ gf gf gf g g g gp gp gp gj gR gR gR g g g g! g! g g g g g g g g g g gsu gnH gm gm gmV gl gR/ gP6 gO gO gO6 gLU gGl g@ gs gv gX g t g l g g b g gT g g g g` g% g gυ gM g g g g g[ gO g= g= gK gC g g g g$ g g2 g. g g g g g g gu gy gm gm gm gm ga gM gL g@l g*` g' g1 g g> g& g gX gȔ gf gĩ gă g g g g g gy g g g g g g g> g& g gggz/~gz+}gj|gah{g_$zg^yg^xg]wg]vgW ugWtgVsgVrgVqgSpgSog1ng)mg lgkgjgYigMhgggfg>egVdgcgbg[ag `g{ _gz^g{]gv\gv[gvfZgvfYgv`XguWguVgsuUgoTgVSgKRgIQgIPgHvOgH8NgHg=g0<g0;g:gc9g78g7g6g5g4g3g02ge1ge0g=/g.g-g,g+g|2*gd )g\0(gS'gP<&gG%gBv$g>#g4z"g0!g" gg(g bg1g7g|ggg~g:gdgdg8g6ggggg g g g g gg]gmggŮgsgs gP *~tj`VLB8.$zpf\ R H > 4 *  vlbXND0:&|rh^TJ@6",nxdZPF<2( ~tj`VLB8.$zpf\R>H4*  vlXNbD:0& | r h ^ T J @ 6 , "    x n d Z P F < 2 (   ~ t j ` V L B 8 . $    z p f \RH>4*   v l b X N D : 0 &    gp gj g g g g~ g g g g g g{ gE gE gE g gu g g g g g gi gi gi g g g gs g% g% g% g g\ gJ gJ gJ g gZ gX gZ gf gf gf g g g g g g g g g g7 g g g gw gC gC gC g g g g g g' g' g g g gx g& g. g. g g g g gY g; g; g5 g g g g gy gF gD gD g g g g g  g  g  g` g` g^ g g g g g g gJ g g g g g g g g g g7 g g g gT gT gT g gް gޮ gޮ g^ g\ g\ gݏ gS gQ gQ g3 g g g g g~ g=} g| g{ gۧz gۥy gۥx gOw gv gu gt gms gmr gmq gp go gn gٹm gٹl gٹk glj gli glh gg gf ge gآd gXc g*b g*a gCg_ gCS^ gC ] gC\ g?V[ g:Z g:Y g7X g7W g3V g3U g2T g"S gJR gpQ gP gO gرN gM glL gZK gTJ gǙI gH gG gF gE g~fD g~.C gwB goA gaS@ gA? g?> g5= g.< g); g: g39 g38 g37 g6 g5 g4 ga3 g_2 g_1 g#0 g!/ g!. g- g, g+ g* g) gn( g M' g & g % g $ g # g " g ! g  g I g G g G g  g  g  g  g  g s g s g q g  g  g  g  g b g $ g  g  g  gx  g`` g*` gװ_ g׊^ g2] g\ gִ[ g|Z g|Y g|X g՗W g՗V g՗U gET gES gR gQ gP gԥO gԡN gUM g=L g=K g=J gI gH gG g[F gE gD gC gB gһA gң@ gM? g> g= g< g; g: g9 g8 g7 W I ;C%  3Q' ossec11301gNew FTP connection.Feb 14 11:34:32 vm1 pure-ftpd[1146987]: (?@152.58.71.216) [INFO] New connection from 152.58.71.216152.58.71.21612697503  C]' ossec11309gFTP Authentication success.Feb 14 11:34:33 vm1 pure-ftpd[1146987]: (?@152.58.71.216) [INFO] militry@technobases.in is now logged in152.58.71.21612697504~ C]' ossec11309gFTP Authentication success.Feb 14 11:30:52 vm1 pure-ftpd[1146358]: (?@152.58.71.216) [INFO] militry@technobases.in is now logged in152.58.71.2161269750}  C}' ossec11313g=FTP file uploaded to serverFeb 14 11:31:33 vm1 pure-ftpd[1146445]: (militry@technobases.in@152.58.71.216) [NOTICE] /home/techno/public_html/milictry1//images/headbanner.png uploaded (728516 bytes, 960.82KB/sec)152.58.71.2161269750&| 3Q' ossec11301gNew FTP connection.Feb 14 11:30:52 vm1 pure-ftpd[1146358]: (?@152.58.71.216) [INFO] New connection from 152.58.71.216152.58.71.2161269750g{  EC' ossec11314gFTP file deleted from serverFeb 14 11:30:53 vm1 pure-ftpd[1146358]: (militry@technobases.in@152.58.71.216) [NOTICE] Deleted /home/techno/public_html/milictry1//images/newbanner_01.png152.58.71.2161269750wz  Ce' ossec11313gۧFTP file uploaded to serverFeb 14 11:29:01 vm1 pure-ftpd[1145872]: (militry@technobases.in@152.58.71.216) [NOTICE] /home/techno/public_html/milictry1//index.html uploaded (33570 bytes, 647.16KB/sec)152.58.71.2161269750%y  3Q' ossec11301gۥNew FTP connection.Feb 14 11:28:59 vm1 pure-ftpd[1145872]: (?@152.58.71.216) [INFO] New connection from 152.58.71.216152.58.71.21612697503x  C]' ossec11309gۥFTP Authentication success.Feb 14 11:29:00 vm1 pure-ftpd[1145872]: (?@152.58.71.216) [INFO] militry@technobases.in is now logged in152.58.71.2161269750ww  Ce' ossec11313gOFTP file uploaded to serverFeb 14 11:27:34 vm1 pure-ftpd[1145416]: (militry@technobases.in@152.58.71.216) [NOTICE] /home/techno/public_html/milictry1//index.html uploaded (33564 bytes, 309.02KB/sec)152.58.71.2161269750xv Ce' ossec11313gFTP file uploaded to serverFeb 14 11:26:21 vm1 pure-ftpd[1145416]: (militry@technobases.in@152.58.71.216) [NOTICE] /home/techno/public_html/milictry1//index.html uploaded (33539 bytes, 405.85KB/sec)152.58.71.21612697503u  C]' ossec11309gFTP Authentication success.Feb 14 11:26:20 vm1 pure-ftpd[1145416]: (?@152.58.71.216) [INFO] militry@technobases.in is now logged in152.58.71.2161269750%t  3Q' ossec11301gNew FTP connection.Feb 14 11:26:20 vm1 pure-ftpd[1145416]: (?@152.58.71.216) [INFO] New connection from 152.58.71.216152.58.71.2161269750%s  3Q' ossec11301gmNew FTP connection.Feb 14 11:23:47 vm1 pure-ftpd[1144933]: (?@152.58.71.216) [INFO] New connection from 152.58.71.216152.58.71.21612697503r  C]' ossec11309gmFTP Authentication success.Feb 14 11:23:47 vm1 pure-ftpd[1144933]: (?@152.58.71.216) [INFO] militry@technobases.in is now logged in152.58.71.2161269750xq Ce' ossec11313gmFTP file uploaded to serverFeb 14 11:23:48 vm1 pure-ftpd[1144933]: (militry@technobases.in@152.58.71.216) [NOTICE] /home/techno/public_html/milictry1//index.html uploaded (33529 bytes, 543.66KB/sec)152.58.71.2161269750wp  Ce' ossec11313gFTP file uploaded to serverFeb 14 11:22:27 vm1 pure-ftpd[1144766]: (militry@technobases.in@152.58.71.216) [NOTICE] /home/techno/public_html/milictry1//index.html uploaded (33502 bytes, 539.30KB/sec)152.58.71.21612697503o  C]' ossec11309gFTP Authentication success.Feb 14 11:22:26 vm1 pure-ftpd[1144766]: (?@152.58.71.216) [INFO] militry@technobases.in is now logged in152.58.71.2161269750%n  3Q' ossec11301gNew FTP connection.Feb 14 11:22:26 vm1 pure-ftpd[1144766]: (?@152.58.71.216) [INFO] New connection from 152.58.71.216152.58.71.2161269750   d UZLx Ce' ossec11313gFTP file uploaded to serverFeb 14 11:54:14 vm1 pure-ftpd[1150878]: (militry@technobases.in@152.58.71.216) [NOTICE] /home/techno/public_html/milictry1//index.html uploaded (33200 bytes, 258.29KB/sec)152.58.71.2161269750w  Ce' ossec11313gTFTP file uploaded to serverFeb 14 11:53:15 vm1 pure-ftpd[1150878]: (militry@technobases.in@152.58.71.216) [NOTICE] /home/techno/public_html/milictry1//index.html uploaded (33219 bytes, 222.49KB/sec)152.58.71.2161269750%  3Q' ossec11301gTNew FTP connection.Feb 14 11:53:14 vm1 pure-ftpd[1150878]: (?@152.58.71.216) [INFO] New connection from 152.58.71.216152.58.71.21612697503  C]' ossec11309gTFTP Authentication success.Feb 14 11:53:15 vm1 pure-ftpd[1150878]: (?@152.58.71.216) [INFO] militry@technobases.in is now logged in152.58.71.2161269750w  Ce' ossec11313gFTP file uploaded to serverFeb 14 11:42:57 vm1 pure-ftpd[1148612]: (militry@technobases.in@152.58.71.216) [NOTICE] /home/techno/public_html/milictry1//index.html uploaded (33728 bytes, 313.03KB/sec)152.58.71.2161269750x Ce' ossec11313gްFTP file uploaded to serverFeb 14 11:41:58 vm1 pure-ftpd[1148612]: (militry@technobases.in@152.58.71.216) [NOTICE] /home/techno/public_html/milictry1//index.html uploaded (33704 bytes, 591.82KB/sec)152.58.71.2161269750%  3Q' ossec11301gޮNew FTP connection.Feb 14 11:41:57 vm1 pure-ftpd[1148612]: (?@152.58.71.216) [INFO] New connection from 152.58.71.216152.58.71.21612697503  C]' ossec11309gޮFTP Authentication success.Feb 14 11:41:57 vm1 pure-ftpd[1148612]: (?@152.58.71.216) [INFO] militry@technobases.in is now logged in152.58.71.2161269750w  Ce' ossec11313g^FTP file uploaded to serverFeb 14 11:40:36 vm1 pure-ftpd[1148358]: (militry@technobases.in@152.58.71.216) [NOTICE] /home/techno/public_html/milictry1//index.html uploaded (33680 bytes, 591.24KB/sec)152.58.71.21612697503  C]' ossec11309g\FTP Authentication success.Feb 14 11:40:35 vm1 pure-ftpd[1148358]: (?@152.58.71.216) [INFO] militry@technobases.in is now logged in152.58.71.2161269750%  3Q' ossec11301g\New FTP connection.Feb 14 11:40:35 vm1 pure-ftpd[1148358]: (?@152.58.71.216) [INFO] New connection from 152.58.71.216152.58.71.2161269750w  Ce' ossec11313gݏFTP file uploaded to serverFeb 14 11:37:10 vm1 pure-ftpd[1147420]: (militry@technobases.in@152.58.71.216) [NOTICE] /home/techno/public_html/milictry1//index.html uploaded (33570 bytes, 652.96KB/sec)152.58.71.2161269750  C' ossec11313gSFTP file uploaded to serverFeb 14 11:36:10 vm1 pure-ftpd[1147420]: (militry@technobases.in@152.58.71.216) [NOTICE] /home/techno/public_html/milictry1//images/newbanner_01.png uploaded (2475567 bytes, 1116.34KB/sec)152.58.71.2161269750%  3Q' ossec11301gQNew FTP connection.Feb 14 11:36:08 vm1 pure-ftpd[1147420]: (?@152.58.71.216) [INFO] New connection from 152.58.71.216152.58.71.21612697503  C]' ossec11309gQFTP Authentication success.Feb 14 11:36:08 vm1 pure-ftpd[1147420]: (?@152.58.71.216) [INFO] militry@technobases.in is now logged in152.58.71.2161269750b E7' ossec11314g3FTP file deleted from serverFeb 14 11:35:37 vm1 pure-ftpd[1146358]: (militry@technobases.in@152.58.71.216) [NOTICE] Deleted /home/techno/public_html/milictry1//images/fourth.png152.58.71.2161269750w  Ce' ossec11313gFTP file uploaded to serverFeb 14 11:35:07 vm1 pure-ftpd[1146987]: (militry@technobases.in@152.58.71.216) [NOTICE] /home/techno/public_html/milictry1//index.html uploaded (33562 bytes, 543.08KB/sec)152.58.71.2161269750  Cw' ossec11313gFTP file uploaded to serverFeb 14 11:34:34 vm1 pure-ftpd[1146987]: (militry@technobases.in@152.58.71.216) [NOTICE] /home/techno/public_html/milictry1//images/fourth.png uploaded (653413 bytes, 1250.58KB/sec)152.58.71.2161269750 D d M OQRD3%  C]' ossec11309gFTP Authentication success.Feb 14 12:17:09 vm1 pure-ftpd[1156156]: (?@152.58.71.216) [INFO] militry@technobases.in is now logged in152.58.71.2161269750y$ Cg' ossec11313gFTP file uploaded to serverFeb 14 12:17:07 vm1 pure-ftpd[1155983]: (militry@technobases.in@152.58.71.216) [NOTICE] /home/techno/public_html/milictry1//css/style.css uploaded (32465 bytes, 8.09KB/sec)152.58.71.2161269750%#  3Q' ossec11301gNew FTP connection.Feb 14 12:17:04 vm1 pure-ftpd[1156156]: (?@152.58.71.216) [INFO] New connection from 152.58.71.216152.58.71.2161269750v"  Cc' ossec11313gFTP file uploaded to serverFeb 14 12:16:19 vm1 pure-ftpd[1155983]: (militry@technobases.in@152.58.71.216) [NOTICE] /home/techno/public_html/milictry1//index.html uploaded (33461 bytes, 15.98KB/sec)152.58.71.21612697503!  C]' ossec11309gFTP Authentication success.Feb 14 12:15:56 vm1 pure-ftpd[1155983]: (?@152.58.71.216) [INFO] militry@technobases.in is now logged in152.58.71.2161269750%  3Q' ossec11301gNew FTP connection.Feb 14 12:15:53 vm1 pure-ftpd[1155983]: (?@152.58.71.216) [INFO] New connection from 152.58.71.216152.58.71.2161269750w  Ce' ossec11313gJFTP file uploaded to serverFeb 14 12:14:24 vm1 pure-ftpd[1155172]: (militry@technobases.in@152.58.71.216) [NOTICE] /home/techno/public_html/milictry1//index.html uploaded (33456 bytes, 538.94KB/sec)152.58.71.2161269750w  Ce' ossec11313gFTP file uploaded to serverFeb 14 12:13:25 vm1 pure-ftpd[1155172]: (militry@technobases.in@152.58.71.216) [NOTICE] /home/techno/public_html/milictry1//index.html uploaded (33457 bytes, 433.25KB/sec)152.58.71.21612697503  C]' ossec11309gFTP Authentication success.Feb 14 12:12:37 vm1 pure-ftpd[1155172]: (?@152.58.71.216) [INFO] militry@technobases.in is now logged in152.58.71.2161269750%  3Q' ossec11301gNew FTP connection.Feb 14 12:12:37 vm1 pure-ftpd[1155172]: (?@152.58.71.216) [INFO] New connection from 152.58.71.216152.58.71.2161269750z  Ck' ossec11313gFTP file uploaded to serverFeb 14 12:12:38 vm1 pure-ftpd[1155172]: (militry@technobases.in@152.58.71.216) [NOTICE] /home/techno/public_html/milictry1//css/style.css uploaded (32540 bytes, 573.27KB/sec)152.58.71.2161269750z  Ck' ossec11313gFTP file uploaded to serverFeb 14 12:08:41 vm1 pure-ftpd[1154105]: (militry@technobases.in@152.58.71.216) [NOTICE] /home/techno/public_html/milictry1//css/style.css uploaded (32469 bytes, 689.11KB/sec)152.58.71.2161269750%  3Q' ossec11301gNew FTP connection.Feb 14 12:08:19 vm1 pure-ftpd[1154105]: (?@152.58.71.216) [INFO] New connection from 152.58.71.216152.58.71.21612697503  C]' ossec11309gFTP Authentication success.Feb 14 12:08:19 vm1 pure-ftpd[1154105]: (?@152.58.71.216) [INFO] militry@technobases.in is now logged in152.58.71.21612697503  C]' ossec11309gFTP Authentication success.Feb 14 12:07:44 vm1 pure-ftpd[1154024]: (?@152.58.71.216) [INFO] militry@technobases.in is now logged in152.58.71.2161269750%  3Q' ossec11301gNew FTP connection.Feb 14 12:07:44 vm1 pure-ftpd[1154024]: (?@152.58.71.216) [INFO] New connection from 152.58.71.216152.58.71.2161269750x Ce' ossec11313g7FTP file uploaded to serverFeb 14 11:57:02 vm1 pure-ftpd[1150878]: (militry@technobases.in@152.58.71.216) [NOTICE] /home/techno/public_html/milictry1//index.html uploaded (33441 bytes, 293.48KB/sec)152.58.71.2161269750x Ce' ossec11313gFTP file uploaded to serverFeb 14 11:55:53 vm1 pure-ftpd[1150878]: (militry@technobases.in@152.58.71.216) [NOTICE] /home/techno/public_html/milictry1//index.html uploaded (33423 bytes, 282.59KB/sec)152.58.71.2161269750w  Ce' ossec11313gFTP file uploaded to serverFeb 14 11:54:58 vm1 pure-ftpd[1150878]: (militry@technobases.in@152.58.71.216) [NOTICE] /home/techno/public_html/milictry1//index.html uploaded (33441 bytes, 294.73KB/sec)152.58.71.2161269750 JW[ H IFJx8 Ce' ossec11313g5FTP file uploaded to serverFeb 14 12:31:07 vm1 pure-ftpd[1158355]: (militry@technobases.in@152.58.71.216) [NOTICE] /home/techno/public_html/milictry1//index.html uploaded (33521 bytes, 429.98KB/sec)152.58.71.2161269750%7  3Q' ossec11301gNew FTP connection.Feb 14 12:30:19 vm1 pure-ftpd[1159051]: (?@152.58.71.216) [INFO] New connection from 152.58.71.216152.58.71.216126975036  C]' ossec11309gFTP Authentication success.Feb 14 12:30:19 vm1 pure-ftpd[1159051]: (?@152.58.71.216) [INFO] militry@technobases.in is now logged in152.58.71.2161269750w5  Ce' ossec11313gFTP file uploaded to serverFeb 14 12:29:48 vm1 pure-ftpd[1158355]: (militry@technobases.in@152.58.71.216) [NOTICE] /home/techno/public_html/milictry1//index.html uploaded (33516 bytes, 586.39KB/sec)152.58.71.2161269750w4  Ce' ossec11313gFTP file uploaded to serverFeb 14 12:28:52 vm1 pure-ftpd[1158355]: (militry@technobases.in@152.58.71.216) [NOTICE] /home/techno/public_html/milictry1//index.html uploaded (33444 bytes, 540.07KB/sec)152.58.71.2161269750w3  Ce' ossec11313gyFTP file uploaded to serverFeb 14 12:28:00 vm1 pure-ftpd[1158355]: (militry@technobases.in@152.58.71.216) [NOTICE] /home/techno/public_html/milictry1//index.html uploaded (33436 bytes, 497.19KB/sec)152.58.71.2161269750w2  Ce' ossec11313gFFTP file uploaded to serverFeb 14 12:27:08 vm1 pure-ftpd[1158355]: (militry@technobases.in@152.58.71.216) [NOTICE] /home/techno/public_html/milictry1//index.html uploaded (33438 bytes, 380.63KB/sec)152.58.71.216126975031  C]' ossec11309gDFTP Authentication success.Feb 14 12:27:07 vm1 pure-ftpd[1158355]: (?@152.58.71.216) [INFO] militry@technobases.in is now logged in152.58.71.2161269750%0  3Q' ossec11301gDNew FTP connection.Feb 14 12:27:07 vm1 pure-ftpd[1158355]: (?@152.58.71.216) [INFO] New connection from 152.58.71.216152.58.71.2161269750w/  Ce' ossec11313gFTP file uploaded to serverFeb 14 12:26:05 vm1 pure-ftpd[1157940]: (militry@technobases.in@152.58.71.216) [NOTICE] /home/techno/public_html/milictry1//index.html uploaded (33494 bytes, 712.16KB/sec)152.58.71.2161269750w.  Ce' ossec11313gFTP file uploaded to serverFeb 14 12:25:21 vm1 pure-ftpd[1157940]: (militry@technobases.in@152.58.71.216) [NOTICE] /home/techno/public_html/milictry1//index.html uploaded (33566 bytes, 434.66KB/sec)152.58.71.2161269750%-  3Q' ossec11301gNew FTP connection.Feb 14 12:25:20 vm1 pure-ftpd[1157940]: (?@152.58.71.216) [INFO] New connection from 152.58.71.216152.58.71.21612697503,  C]' ossec11309gFTP Authentication success.Feb 14 12:25:20 vm1 pure-ftpd[1157940]: (?@152.58.71.216) [INFO] militry@technobases.in is now logged in152.58.71.2161269750%+  3Q' ossec11301g New FTP connection.Feb 14 12:21:53 vm1 pure-ftpd[1157156]: (?@152.58.71.216) [INFO] New connection from 152.58.71.216152.58.71.2161269750x* Ce' ossec11313g FTP file uploaded to serverFeb 14 12:21:54 vm1 pure-ftpd[1157156]: (militry@technobases.in@152.58.71.216) [NOTICE] /home/techno/public_html/milictry1//index.html uploaded (33533 bytes, 380.70KB/sec)152.58.71.21612697503)  C]' ossec11309g FTP Authentication success.Feb 14 12:21:53 vm1 pure-ftpd[1157156]: (?@152.58.71.216) [INFO] militry@technobases.in is now logged in152.58.71.21612697503(  C]' ossec11309g`FTP Authentication success.Feb 14 12:19:02 vm1 pure-ftpd[1156424]: (?@152.58.71.216) [INFO] militry@technobases.in is now logged in152.58.71.2161269750x' Ce' ossec11313g`FTP file uploaded to serverFeb 14 12:19:02 vm1 pure-ftpd[1156424]: (militry@technobases.in@152.58.71.216) [NOTICE] /home/techno/public_html/milictry1//index.html uploaded (33461 bytes, 637.28KB/sec)152.58.71.2161269750%&  3Q' ossec11301g^New FTP connection.Feb 14 12:19:01 vm1 pure-ftpd[1156424]: (?@152.58.71.216) [INFO] New connection from 152.58.71.216152.58.71.2161269750 ?W T M Q KHhV?3K  C]' ossec11309gFTP Authentication success.Feb 14 13:46:05 vm1 pure-ftpd[1173695]: (?@152.58.71.109) [INFO] militry@technobases.in is now logged in152.58.71.10912697503J  C]' ossec11309gFTP Authentication success.Feb 14 13:45:37 vm1 pure-ftpd[1173600]: (?@152.58.71.109) [INFO] militry@technobases.in is now logged in152.58.71.1091269750%I  3Q' ossec11301gNew FTP connection.Feb 14 13:45:37 vm1 pure-ftpd[1173600]: (?@152.58.71.109) [INFO] New connection from 152.58.71.109152.58.71.1091269750H  5!' ossec11011g'WHM SSO login failed[2025-02-14 13:17:50 +0530] info [whostmgrd] 117.98.72.110 PURGE root:odkoOMO0OuNYEDi1 badpass [cookie ip check: IP address has changed: IP Address [171.79.191.42] != Current IP Address [117.98.72.110]]117.98.72.1101269750*G  U9' ossec11001g'Deferred login on the cpanel service[2025-02-14 13:17:50 +0530] info [whostmgrd] 117.98.72.110 - root "GET / HTTP/1.1" DEFERRED LOGIN whostmgrd: cookie ip check: IP address has changed: IP Address [171.79.191.42] != Current IP Address [117.98.72.110]117.98.72.1101269750wF Cc' ossec11313gFTP file uploaded to serverFeb 14 12:51:02 vm1 pure-ftpd[1162958]: (militry@technobases.in@152.58.71.216) [NOTICE] /home/techno/public_html/milictry1//index.html uploaded (33491 bytes, 13.40KB/sec)152.58.71.21612697503E  C]' ossec11309gFTP Authentication success.Feb 14 12:50:51 vm1 pure-ftpd[1162958]: (?@152.58.71.216) [INFO] militry@technobases.in is now logged in152.58.71.2161269750%D  3Q' ossec11301gNew FTP connection.Feb 14 12:50:50 vm1 pure-ftpd[1162958]: (?@152.58.71.216) [INFO] New connection from 152.58.71.216152.58.71.2161269750vC Ca' ossec11313gxFTP file uploaded to serverFeb 14 12:49:18 vm1 pure-ftpd[1161960]: (militry@technobases.in@152.58.71.216) [NOTICE] /home/techno/public_html/milictry1//index.html uploaded (33479 bytes, 3.13KB/sec)152.58.71.2161269750%B  3Q' ossec11301g&New FTP connection.Feb 14 12:47:58 vm1 pure-ftpd[1162261]: (?@152.58.71.216) [INFO] New connection from 152.58.71.216152.58.71.21612697503A  C]' ossec11309g.FTP Authentication success.Feb 14 12:48:04 vm1 pure-ftpd[1162261]: (?@152.58.71.216) [INFO] militry@technobases.in is now logged in152.58.71.2161269750@ Cy' ossec11313g.FTP file uploaded to serverFeb 14 12:48:04 vm1 pure-ftpd[1161960]: (militry@technobases.in@152.58.71.216) [NOTICE] /home/techno/public_html/milictry1//images/banner_02.png uploaded (733164 bytes, 18.43KB/sec)152.58.71.2161269750x? Ce' ossec11313gFTP file uploaded to serverFeb 14 12:46:06 vm1 pure-ftpd[1161960]: (militry@technobases.in@152.58.71.216) [NOTICE] /home/techno/public_html/milictry1//index.html uploaded (33519 bytes, 360.78KB/sec)152.58.71.2161269750>  C}' ossec11313gFTP file uploaded to serverFeb 14 12:45:43 vm1 pure-ftpd[1161960]: (militry@technobases.in@152.58.71.216) [NOTICE] /home/techno/public_html/milictry1//images/banner_01.jpeg uploaded (134994 bytes, 548.80KB/sec)152.58.71.21612697503=  C]' ossec11309gFTP Authentication success.Feb 14 12:45:42 vm1 pure-ftpd[1161960]: (?@152.58.71.216) [INFO] militry@technobases.in is now logged in152.58.71.2161269750%<  3Q' ossec11301gNew FTP connection.Feb 14 12:45:42 vm1 pure-ftpd[1161960]: (?@152.58.71.216) [INFO] New connection from 152.58.71.216152.58.71.2161269750h; EC' ossec11314gYFTP file deleted from serverFeb 14 12:44:32 vm1 pure-ftpd[1161565]: (militry@technobases.in@152.58.71.216) [NOTICE] Deleted /home/techno/public_html/milictry1//images/newbanner_01.png152.58.71.21612697503:  C]' ossec11309g;FTP Authentication success.Feb 14 12:44:03 vm1 pure-ftpd[1161565]: (?@152.58.71.216) [INFO] militry@technobases.in is now logged in152.58.71.2161269750%9  3Q' ossec11301g;New FTP connection.Feb 14 12:44:02 vm1 pure-ftpd[1161565]: (?@152.58.71.216) [INFO] New connection from 152.58.71.216152.58.71.2161269750 Wd  ^ ci fv^  Cc' ossec11313gFTP file uploaded to serverFeb 14 13:59:17 vm1 pure-ftpd[1176125]: (militry@technobases.in@152.58.71.109) [NOTICE] /home/techno/public_html/milictry1//about.php uploaded (13900 bytes, 332.08KB/sec)152.58.71.10912697503]  C]' ossec11309gFTP Authentication success.Feb 14 13:59:16 vm1 pure-ftpd[1176125]: (?@152.58.71.109) [INFO] militry@technobases.in is now logged in152.58.71.1091269750%\  3Q' ossec11301gNew FTP connection.Feb 14 13:59:16 vm1 pure-ftpd[1176125]: (?@152.58.71.109) [INFO] New connection from 152.58.71.109152.58.71.1091269750v[  Cc' ossec11313gFTP file uploaded to serverFeb 14 13:58:03 vm1 pure-ftpd[1175821]: (militry@technobases.in@152.58.71.109) [NOTICE] /home/techno/public_html/milictry1//about.php uploaded (16943 bytes, 415.24KB/sec)152.58.71.10912697503Z  C]' ossec11309gFTP Authentication success.Feb 14 13:58:00 vm1 pure-ftpd[1175821]: (?@152.58.71.109) [INFO] militry@technobases.in is now logged in152.58.71.1091269750%Y  3Q' ossec11301gNew FTP connection.Feb 14 13:57:58 vm1 pure-ftpd[1175821]: (?@152.58.71.109) [INFO] New connection from 152.58.71.109152.58.71.1091269750vX  Cc' ossec11313gFTP file uploaded to serverFeb 14 13:54:54 vm1 pure-ftpd[1175277]: (militry@technobases.in@152.58.71.109) [NOTICE] /home/techno/public_html/milictry1//index.php uploaded (26114 bytes, 457.75KB/sec)152.58.71.10912697503W  C]' ossec11309gFTP Authentication success.Feb 14 13:54:53 vm1 pure-ftpd[1175277]: (?@152.58.71.109) [INFO] militry@technobases.in is now logged in152.58.71.1091269750%V  3Q' ossec11301gNew FTP connection.Feb 14 13:54:53 vm1 pure-ftpd[1175277]: (?@152.58.71.109) [INFO] New connection from 152.58.71.109152.58.71.1091269750tU  C_' ossec11313g7FTP file uploaded to serverFeb 14 13:52:14 vm1 pure-ftpd[1174677]: (militry@technobases.in@152.58.71.109) [NOTICE] /home/techno/public_html/milictry1//head.php uploaded (3180 bytes, 605.71KB/sec)152.58.71.1091269750uT C_' ossec11313gFTP file uploaded to serverFeb 14 13:50:54 vm1 pure-ftpd[1174677]: (militry@technobases.in@152.58.71.109) [NOTICE] /home/techno/public_html/milictry1//foot.php uploaded (4409 bytes, 880.00KB/sec)152.58.71.1091269750&S 3Q' ossec11301gNew FTP connection.Feb 14 13:50:53 vm1 pure-ftpd[1174677]: (?@152.58.71.109) [INFO] New connection from 152.58.71.109152.58.71.10912697504R C]' ossec11309gFTP Authentication success.Feb 14 13:50:53 vm1 pure-ftpd[1174677]: (?@152.58.71.109) [INFO] militry@technobases.in is now logged in152.58.71.1091269750oQ  CU' ossec11313gwFTP file uploaded to serverFeb 14 13:49:02 vm1 pure-ftpd[1173600]: (militry@technobases.in@152.58.71.109) [NOTICE] /home/techno/public_html/milictry1//foot.php uploaded (0 bytes, 0.00KB/sec)152.58.71.10912697503P  C]' ossec11309gCFTP Authentication success.Feb 14 13:48:10 vm1 pure-ftpd[1173976]: (?@152.58.71.109) [INFO] militry@technobases.in is now logged in152.58.71.1091269750wO  Ce' ossec11313gCFTP file uploaded to serverFeb 14 13:48:10 vm1 pure-ftpd[1173976]: (militry@technobases.in@152.58.71.109) [NOTICE] /home/techno/public_html/milictry1//index.html uploaded (30406 bytes, 487.40KB/sec)152.58.71.1091269750%N  3Q' ossec11301gCNew FTP connection.Feb 14 13:48:09 vm1 pure-ftpd[1173976]: (?@152.58.71.109) [INFO] New connection from 152.58.71.109152.58.71.1091269750oM  CU' ossec11313gFTP file uploaded to serverFeb 14 13:46:01 vm1 pure-ftpd[1173600]: (militry@technobases.in@152.58.71.109) [NOTICE] /home/techno/public_html/milictry1//head.php uploaded (0 bytes, 0.00KB/sec)152.58.71.1091269750%L  3Q' ossec11301gNew FTP connection.Feb 14 13:46:05 vm1 pure-ftpd[1173695]: (?@152.58.71.109) [INFO] New connection from 152.58.71.109152.58.71.1091269750 SW E K Q WZ S3q  C]' ossec11309gFTP Authentication success.Feb 14 14:17:01 vm1 pure-ftpd[1179794]: (?@152.58.71.109) [INFO] militry@technobases.in is now logged in152.58.71.1091269750%p  3Q' ossec11301gNew FTP connection.Feb 14 14:17:01 vm1 pure-ftpd[1179794]: (?@152.58.71.109) [INFO] New connection from 152.58.71.109152.58.71.1091269750wo Cc' ossec11313gFTP file uploaded to serverFeb 14 14:17:01 vm1 pure-ftpd[1179794]: (militry@technobases.in@152.58.71.109) [NOTICE] /home/techno/public_html/milictry1//about.php uploaded (11398 bytes, 531.58KB/sec)152.58.71.1091269750vn  Cc' ossec11313gsFTP file uploaded to serverFeb 14 14:14:33 vm1 pure-ftpd[1179000]: (militry@technobases.in@152.58.71.109) [NOTICE] /home/techno/public_html/milictry1//about.php uploaded (11071 bytes, 427.80KB/sec)152.58.71.1091269750wm Cc' ossec11313g%FTP file uploaded to serverFeb 14 14:13:15 vm1 pure-ftpd[1179000]: (militry@technobases.in@152.58.71.109) [NOTICE] /home/techno/public_html/milictry1//about.php uploaded (11030 bytes, 682.30KB/sec)152.58.71.10912697503l  C]' ossec11309g%FTP Authentication success.Feb 14 14:13:15 vm1 pure-ftpd[1179000]: (?@152.58.71.109) [INFO] militry@technobases.in is now logged in152.58.71.1091269750%k  3Q' ossec11301g%New FTP connection.Feb 14 14:13:14 vm1 pure-ftpd[1179000]: (?@152.58.71.109) [INFO] New connection from 152.58.71.109152.58.71.1091269750vj  Cc' ossec11313gFTP file uploaded to serverFeb 14 14:10:50 vm1 pure-ftpd[1178287]: (militry@technobases.in@152.58.71.109) [NOTICE] /home/techno/public_html/milictry1//about.php uploaded (10967 bytes, 527.48KB/sec)152.58.71.1091269750vi  Cc' ossec11313g\FTP file uploaded to serverFeb 14 14:09:56 vm1 pure-ftpd[1178287]: (militry@technobases.in@152.58.71.109) [NOTICE] /home/techno/public_html/milictry1//about.php uploaded (10973 bytes, 523.10KB/sec)152.58.71.10912697503h  C]' ossec11309gJFTP Authentication success.Feb 14 14:09:37 vm1 pure-ftpd[1178287]: (?@152.58.71.109) [INFO] militry@technobases.in is now logged in152.58.71.1091269750%g  3Q' ossec11301gJNew FTP connection.Feb 14 14:09:37 vm1 pure-ftpd[1178287]: (?@152.58.71.109) [INFO] New connection from 152.58.71.109152.58.71.1091269750vf  Cc' ossec11313gJFTP file uploaded to serverFeb 14 14:09:38 vm1 pure-ftpd[1178287]: (militry@technobases.in@152.58.71.109) [NOTICE] /home/techno/public_html/milictry1//about.php uploaded (14196 bytes, 454.82KB/sec)152.58.71.1091269750ve  Cc' ossec11313gFTP file uploaded to serverFeb 14 14:06:27 vm1 pure-ftpd[1177518]: (militry@technobases.in@152.58.71.109) [NOTICE] /home/techno/public_html/milictry1//index.php uploaded (26410 bytes, 422.73KB/sec)152.58.71.1091269750vd  Cc' ossec11313gZFTP file uploaded to serverFeb 14 14:05:37 vm1 pure-ftpd[1177518]: (militry@technobases.in@152.58.71.109) [NOTICE] /home/techno/public_html/milictry1//about.php uploaded (17209 bytes, 416.67KB/sec)152.58.71.1091269750%c  3Q' ossec11301gXNew FTP connection.Feb 14 14:05:36 vm1 pure-ftpd[1177518]: (?@152.58.71.109) [INFO] New connection from 152.58.71.109152.58.71.10912697503b  C]' ossec11309gZFTP Authentication success.Feb 14 14:05:36 vm1 pure-ftpd[1177518]: (?@152.58.71.109) [INFO] militry@technobases.in is now logged in152.58.71.1091269750wa  Ce' ossec11313gfFTP file uploaded to serverFeb 14 14:01:33 vm1 pure-ftpd[1176715]: (militry@technobases.in@152.58.71.109) [NOTICE] /home/techno/public_html/milictry1//about.php uploaded (10688 bytes, 1935.71KB/sec)152.58.71.10912697503`  C]' ossec11309gfFTP Authentication success.Feb 14 14:01:33 vm1 pure-ftpd[1176715]: (?@152.58.71.109) [INFO] militry@technobases.in is now logged in152.58.71.1091269750%_  3Q' ossec11301gfNew FTP connection.Feb 14 14:01:33 vm1 pure-ftpd[1176715]: (?@152.58.71.109) [INFO] New connection from 152.58.71.109152.58.71.1091269750 I  L Q XOK%  3Q' ossec11301gNew FTP connection.Feb 14 14:29:50 vm1 pure-ftpd[1182268]: (?@152.58.71.109) [INFO] New connection from 152.58.71.109152.58.71.10912697503  C]' ossec11309gFTP Authentication success.Feb 14 14:29:51 vm1 pure-ftpd[1182268]: (?@152.58.71.109) [INFO] militry@technobases.in is now logged in152.58.71.1091269750& 3Q' ossec11301gNew FTP connection.Feb 14 14:29:06 vm1 pure-ftpd[1182118]: (?@152.58.71.109) [INFO] New connection from 152.58.71.109152.58.71.10912697503  C]' ossec11309gFTP Authentication success.Feb 14 14:29:07 vm1 pure-ftpd[1182118]: (?@152.58.71.109) [INFO] militry@technobases.in is now logged in152.58.71.1091269750t  C_' ossec11313gFTP file uploaded to serverFeb 14 14:28:03 vm1 pure-ftpd[1181765]: (militry@technobases.in@152.58.71.109) [NOTICE] /home/techno/public_html/milictry1//about.php uploaded (12380 bytes, 7.01KB/sec)152.58.71.1091269750v Ca' ossec11313g{FTP file uploaded to serverFeb 14 14:27:31 vm1 pure-ftpd[1181765]: (militry@technobases.in@152.58.71.109) [NOTICE] /home/techno/public_html/milictry1//about.php uploaded (12380 bytes, 12.52KB/sec)152.58.71.1091269750v~  Cc' ossec11313gEFTP file uploaded to serverFeb 14 14:26:36 vm1 pure-ftpd[1181765]: (militry@technobases.in@152.58.71.109) [NOTICE] /home/techno/public_html/milictry1//about.php uploaded (12336 bytes, 392.70KB/sec)152.58.71.10912697503}  C]' ossec11309gEFTP Authentication success.Feb 14 14:26:35 vm1 pure-ftpd[1181765]: (?@152.58.71.109) [INFO] militry@technobases.in is now logged in152.58.71.1091269750%|  3Q' ossec11301gENew FTP connection.Feb 14 14:26:35 vm1 pure-ftpd[1181765]: (?@152.58.71.109) [INFO] New connection from 152.58.71.109152.58.71.10912697503{  C]' ossec11309gFTP Authentication success.Feb 14 14:23:25 vm1 pure-ftpd[1180959]: (?@152.58.71.109) [INFO] militry@technobases.in is now logged in152.58.71.1091269750%z  3Q' ossec11301guNew FTP connection.Feb 14 14:23:07 vm1 pure-ftpd[1180959]: (?@152.58.71.109) [INFO] New connection from 152.58.71.109152.58.71.1091269750uy  Ca' ossec11313gFTP file uploaded to serverFeb 14 14:23:32 vm1 pure-ftpd[1180959]: (militry@technobases.in@152.58.71.109) [NOTICE] /home/techno/public_html/milictry1//about.php uploaded (12341 bytes, 14.26KB/sec)152.58.71.1091269750wx Cc' ossec11313gFTP file uploaded to serverFeb 14 14:20:05 vm1 pure-ftpd[1180531]: (militry@technobases.in@152.58.71.109) [NOTICE] /home/techno/public_html/milictry1//about.php uploaded (11786 bytes, 743.81KB/sec)152.58.71.10912697503w  C]' ossec11309gFTP Authentication success.Feb 14 14:20:05 vm1 pure-ftpd[1180531]: (?@152.58.71.109) [INFO] militry@technobases.in is now logged in152.58.71.1091269750%v  3Q' ossec11301gNew FTP connection.Feb 14 14:20:04 vm1 pure-ftpd[1180531]: (?@152.58.71.109) [INFO] New connection from 152.58.71.109152.58.71.1091269750vu  Cc' ossec11313gFTP file uploaded to serverFeb 14 14:19:02 vm1 pure-ftpd[1180053]: (militry@technobases.in@152.58.71.109) [NOTICE] /home/techno/public_html/milictry1//about.php uploaded (11670 bytes, 558.40KB/sec)152.58.71.1091269750vt  Cc' ossec11313giFTP file uploaded to serverFeb 14 14:18:40 vm1 pure-ftpd[1180053]: (militry@technobases.in@152.58.71.109) [NOTICE] /home/techno/public_html/milictry1//about.php uploaded (11670 bytes, 441.55KB/sec)152.58.71.1091269750%s  3Q' ossec11301giNew FTP connection.Feb 14 14:18:40 vm1 pure-ftpd[1180053]: (?@152.58.71.109) [INFO] New connection from 152.58.71.109152.58.71.10912697503r  C]' ossec11309giFTP Authentication success.Feb 14 14:18:40 vm1 pure-ftpd[1180053]: (?@152.58.71.109) [INFO] militry@technobases.in is now logged in152.58.71.1091269750 K^ C J MDKu  Ca' ossec11313g sFTP file uploaded to serverFeb 14 14:48:42 vm1 pure-ftpd[1185987]: (militry@technobases.in@152.58.71.109) [NOTICE] /home/techno/public_html/milictry1//about.php uploaded (13200 bytes, 45.99KB/sec)152.58.71.10912697503  C]' ossec11309g sFTP Authentication success.Feb 14 14:48:40 vm1 pure-ftpd[1185987]: (?@152.58.71.109) [INFO] militry@technobases.in is now logged in152.58.71.1091269750%  3Q' ossec11301g qNew FTP connection.Feb 14 14:48:40 vm1 pure-ftpd[1185987]: (?@152.58.71.109) [INFO] New connection from 152.58.71.109152.58.71.1091269750%  3Q' ossec11301g New FTP connection.Feb 14 14:46:43 vm1 pure-ftpd[1185729]: (?@152.58.71.109) [INFO] New connection from 152.58.71.109152.58.71.10912697503  C]' ossec11309g FTP Authentication success.Feb 14 14:46:44 vm1 pure-ftpd[1185729]: (?@152.58.71.109) [INFO] militry@technobases.in is now logged in152.58.71.1091269750v  Cc' ossec11313g FTP file uploaded to serverFeb 14 14:46:45 vm1 pure-ftpd[1185729]: (militry@technobases.in@152.58.71.109) [NOTICE] /home/techno/public_html/milictry1//about.php uploaded (13167 bytes, 102.33KB/sec)152.58.71.1091269750w Cc' ossec11313g FTP file uploaded to serverFeb 14 14:44:53 vm1 pure-ftpd[1184912]: (militry@technobases.in@152.58.71.109) [NOTICE] /home/techno/public_html/milictry1//about.php uploaded (13118 bytes, 101.38KB/sec)152.58.71.1091269750w  Ce' ossec11313g bFTP file uploaded to serverFeb 14 14:44:08 vm1 pure-ftpd[1184912]: (militry@technobases.in@152.58.71.109) [NOTICE] /home/techno/public_html/milictry1//about.php uploaded (13043 bytes, 1229.70KB/sec)152.58.71.1091269750x Ce' ossec11313g $FTP file uploaded to serverFeb 14 14:43:06 vm1 pure-ftpd[1184912]: (militry@technobases.in@152.58.71.109) [NOTICE] /home/techno/public_html/milictry1//about.php uploaded (13043 bytes, 1252.68KB/sec)152.58.71.1091269750v  Cc' ossec11313g FTP file uploaded to serverFeb 14 14:42:34 vm1 pure-ftpd[1184912]: (militry@technobases.in@152.58.71.109) [NOTICE] /home/techno/public_html/milictry1//about.php uploaded (13043 bytes, 885.77KB/sec)152.58.71.10912697503  C]' ossec11309g FTP Authentication success.Feb 14 14:42:33 vm1 pure-ftpd[1184912]: (?@152.58.71.109) [INFO] militry@technobases.in is now logged in152.58.71.1091269750%  3Q' ossec11301g New FTP connection.Feb 14 14:42:32 vm1 pure-ftpd[1184912]: (?@152.58.71.109) [INFO] New connection from 152.58.71.109152.58.71.1091269750u  Ca' ossec11313gxFTP file uploaded to serverFeb 14 14:40:14 vm1 pure-ftpd[1184304]: (militry@technobases.in@152.58.71.109) [NOTICE] /home/techno/public_html/milictry1//about.php uploaded (12854 bytes, 30.22KB/sec)152.58.71.10912697503  C]' ossec11309gpFTP Authentication success.Feb 14 14:40:06 vm1 pure-ftpd[1184304]: (?@152.58.71.109) [INFO] militry@technobases.in is now logged in152.58.71.1091269750%  3Q' ossec11301gjNew FTP connection.Feb 14 14:40:00 vm1 pure-ftpd[1184304]: (?@152.58.71.109) [INFO] New connection from 152.58.71.109152.58.71.1091269750 Cs' ossec11313gFTP file uploaded to serverFeb 14 14:38:10 vm1 pure-ftpd[1183952]: (militry@technobases.in@152.58.71.109) [NOTICE] /home/techno/public_html/milictry1//images/School.png uploaded (339344 bytes, 12.59KB/sec)152.58.71.10912697504 C]' ossec11309gFTP Authentication success.Feb 14 14:37:02 vm1 pure-ftpd[1183763]: (?@152.58.71.109) [INFO] militry@technobases.in is now logged in152.58.71.1091269750& 3Q' ossec11301gNew FTP connection.Feb 14 14:36:56 vm1 pure-ftpd[1183763]: (?@152.58.71.109) [INFO] New connection from 152.58.71.109152.58.71.1091269750t  C_' ossec11313g~FTP file uploaded to serverFeb 14 14:31:48 vm1 pure-ftpd[1182268]: (militry@technobases.in@152.58.71.109) [NOTICE] /home/techno/public_html/milictry1//about.php uploaded (12388 bytes, 3.40KB/sec)152.58.71.1091269750 ^ T Z^t)  -s) ossec13001gExim Auth failed2025-02-14 15:06:05 dovecot_login authenticator failed for (amplifypowerglobal.com) [60.167.170.146]:56314: 535 Incorrect authentication data (set_id=admin@amplifypowerglobal.com)60.167.170.1461814991_(  -I) ossec13001gnExim Auth failed2025-02-14 15:05:41 dovecot_login authenticator failed for (amplifypowerglobal.com) [60.167.170.146]:54126: 535 Incorrect authentication data (set_id=nologin)60.167.170.1461814991v' Cc% ossec11313g MFTP file uploaded to serverFeb 14 15:00:51 vm1 pure-ftpd[1188303]: (militry@technobases.in@152.58.71.77) [NOTICE] /home/techno/public_html/milictry1//about.php uploaded (13124 bytes, 1175.28KB/sec)152.58.71.771269750& C{% ossec11313g FTP file uploaded to serverFeb 14 14:59:49 vm1 pure-ftpd[1188303]: (militry@technobases.in@152.58.71.77) [NOTICE] /home/techno/public_html/milictry1//images/sainik_06.png uploaded (466552 bytes, 1123.89KB/sec)152.58.71.7712697501%  C[% ossec11309g FTP Authentication success.Feb 14 14:59:48 vm1 pure-ftpd[1188303]: (?@152.58.71.77) [INFO] militry@technobases.in is now logged in152.58.71.771269750"$  3M% ossec11301g New FTP connection.Feb 14 14:59:48 vm1 pure-ftpd[1188303]: (?@152.58.71.77) [INFO] New connection from 152.58.71.77152.58.71.771269750w# Cc' ossec11313g FTP file uploaded to serverFeb 14 14:53:58 vm1 pure-ftpd[1187003]: (militry@technobases.in@152.58.71.109) [NOTICE] /home/techno/public_html/milictry1//about.php uploaded (13132 bytes, 231.02KB/sec)152.58.71.1091269750%"  3Q' ossec11301g New FTP connection.Feb 14 14:53:19 vm1 pure-ftpd[1187003]: (?@152.58.71.109) [INFO] New connection from 152.58.71.109152.58.71.1091269750w! Cc' ossec11313g FTP file uploaded to serverFeb 14 14:53:20 vm1 pure-ftpd[1187003]: (militry@technobases.in@152.58.71.109) [NOTICE] /home/techno/public_html/milictry1//about.php uploaded (13190 bytes, 255.55KB/sec)152.58.71.10912697503  C]' ossec11309g FTP Authentication success.Feb 14 14:53:19 vm1 pure-ftpd[1187003]: (?@152.58.71.109) [INFO] militry@technobases.in is now logged in152.58.71.1091269750v  Cc' ossec11313g IFTP file uploaded to serverFeb 14 14:52:16 vm1 pure-ftpd[1186828]: (militry@technobases.in@152.58.71.109) [NOTICE] /home/techno/public_html/milictry1//about.php uploaded (13175 bytes, 627.16KB/sec)152.58.71.10912697503  C]' ossec11309g GFTP Authentication success.Feb 14 14:52:15 vm1 pure-ftpd[1186828]: (?@152.58.71.109) [INFO] militry@technobases.in is now logged in152.58.71.1091269750%  3Q' ossec11301g GNew FTP connection.Feb 14 14:52:14 vm1 pure-ftpd[1186828]: (?@152.58.71.109) [INFO] New connection from 152.58.71.109152.58.71.1091269750v  Cc' ossec11313g FTP file uploaded to serverFeb 14 14:50:55 vm1 pure-ftpd[1186554]: (militry@technobases.in@152.58.71.109) [NOTICE] /home/techno/public_html/milictry1//about.php uploaded (13167 bytes, 166.24KB/sec)152.58.71.1091269750u  Ca' ossec11313g FTP file uploaded to serverFeb 14 14:50:37 vm1 pure-ftpd[1186554]: (militry@technobases.in@152.58.71.109) [NOTICE] /home/techno/public_html/milictry1//about.php uploaded (13201 bytes, 85.75KB/sec)152.58.71.10912697503  C]' ossec11309g FTP Authentication success.Feb 14 14:50:35 vm1 pure-ftpd[1186554]: (?@152.58.71.109) [INFO] militry@technobases.in is now logged in152.58.71.1091269750%  3Q' ossec11301g New FTP connection.Feb 14 14:50:35 vm1 pure-ftpd[1186554]: (?@152.58.71.109) [INFO] New connection from 152.58.71.109152.58.71.1091269750u  Ca' ossec11313g FTP file uploaded to serverFeb 14 14:49:02 vm1 pure-ftpd[1185987]: (militry@technobases.in@152.58.71.109) [NOTICE] /home/techno/public_html/milictry1//about.php uploaded (13201 bytes, 47.64KB/sec)152.58.71.1091269750 Z J P GNJj<  =M+ ossec13008g.Mail Reciepient rejected2025-02-14 17:23:11 H=(mail.sainikschoolcoachinginjaipur.com) [165.154.208.103]:57780 F= rejected RCPT : Rejected relay attempt: '165.154.208.103' From: 'wmochxxjb@sainikschoolcoachinginjaipur.com' To: 'validxxxg@gmail.com'165.154.208.1031668284E;  =+ ossec13008g)Mail Reciepient rejected2025-02-14 17:03:05 H=(mail.s2seducationtrust.com) [165.154.226.214]:63973 F= rejected RCPT : Rejected relay attempt: '165.154.226.214' From: 'sdsilry@s2seducationtrust.com' To: 'validxxxg@gmail.com'165.154.226.2141668284+:  3Y+ ossec11301gNew FTP connection.Feb 14 16:03:23 vm1 pure-ftpd[1201760]: (?@172.206.142.122) [INFO] New connection from 172.206.142.122172.206.142.1226252001v9  Ce% ossec11313g3FTP file uploaded to serverFeb 14 15:30:17 vm1 pure-ftpd[1194976]: (militry@technobases.in@152.58.71.51) [NOTICE] /home/techno/public_html/milictry1//contact.php uploaded (6790 bytes, 1105.88KB/sec)152.58.71.511269750"8  3M% ossec11301g3New FTP connection.Feb 14 15:30:17 vm1 pure-ftpd[1194976]: (?@152.58.71.51) [INFO] New connection from 152.58.71.51152.58.71.51126975017  C[% ossec11309g3FTP Authentication success.Feb 14 15:30:17 vm1 pure-ftpd[1194976]: (?@152.58.71.51) [INFO] militry@technobases.in is now logged in152.58.71.511269750u6  Cc% ossec11313gFTP file uploaded to serverFeb 14 15:28:33 vm1 pure-ftpd[1194425]: (militry@technobases.in@152.58.71.51) [NOTICE] /home/techno/public_html/milictry1//contact.php uploaded (9286 bytes, 567.48KB/sec)152.58.71.511269750"5  3M% ossec11301gNew FTP connection.Feb 14 15:28:32 vm1 pure-ftpd[1194425]: (?@152.58.71.51) [INFO] New connection from 152.58.71.51152.58.71.51126975014  C[% ossec11309gFTP Authentication success.Feb 14 15:28:33 vm1 pure-ftpd[1194425]: (?@152.58.71.51) [INFO] militry@technobases.in is now logged in152.58.71.511269750u3  Cc% ossec11313gaFTP file uploaded to serverFeb 14 15:26:47 vm1 pure-ftpd[1194179]: (militry@technobases.in@152.58.71.51) [NOTICE] /home/techno/public_html/milictry1//contact.php uploaded (9096 bytes, 345.30KB/sec)152.58.71.51126975012  C[% ossec11309g_FTP Authentication success.Feb 14 15:26:46 vm1 pure-ftpd[1194179]: (?@152.58.71.51) [INFO] militry@technobases.in is now logged in152.58.71.511269750"1  3M% ossec11301g_New FTP connection.Feb 14 15:26:46 vm1 pure-ftpd[1194179]: (?@152.58.71.51) [INFO] New connection from 152.58.71.51152.58.71.511269750u0  Cc% ossec11313g#FTP file uploaded to serverFeb 14 15:25:45 vm1 pure-ftpd[1194031]: (militry@technobases.in@152.58.71.51) [NOTICE] /home/techno/public_html/milictry1//contact.php uploaded (9138 bytes, 291.49KB/sec)152.58.71.5112697501/  C[% ossec11309g!FTP Authentication success.Feb 14 15:25:45 vm1 pure-ftpd[1194031]: (?@152.58.71.51) [INFO] militry@technobases.in is now logged in152.58.71.511269750".  3M% ossec11301g!New FTP connection.Feb 14 15:25:44 vm1 pure-ftpd[1194031]: (?@152.58.71.51) [INFO] New connection from 152.58.71.51152.58.71.5112697501-  C[% ossec11309gFTP Authentication success.Feb 14 15:23:50 vm1 pure-ftpd[1193493]: (?@152.58.71.51) [INFO] militry@technobases.in is now logged in152.58.71.511269750",  3M% ossec11301gNew FTP connection.Feb 14 15:23:50 vm1 pure-ftpd[1193493]: (?@152.58.71.51) [INFO] New connection from 152.58.71.51152.58.71.5112697501+  C[% ossec11309gFTP Authentication success.Feb 14 15:23:38 vm1 pure-ftpd[1193455]: (?@152.58.71.51) [INFO] militry@technobases.in is now logged in152.58.71.511269750"*  3M% ossec11301gNew FTP connection.Feb 14 15:23:38 vm1 pure-ftpd[1193455]: (?@152.58.71.51) [INFO] New connection from 152.58.71.51152.58.71.511269750 0 { n a T G : -   1 $     r e X K >I</"obUH;.!xk^QD7*zm`SF9, v i \ O B 5 ( 0=JdWq~4' uh[NAyl_RE8+0# tgZM@3& }pcV s f Y L ? 2 %  |~qdW  w j ] P C 6 )    8 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750! 1269750 1269750 1269750 1269750 1269750 1269750 1269750- 1269750, 1269750+ 1269750* 1269750' 1269750& 1269750% 1269750$ 1269750# 1269750" 1269750\ 12697509 12697508 12697507 12697506 12697505 12697504 12697503 12697502 12697501 12697500 1269750/ 1269750. 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750=8 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750~ 1269750_ 1269750^ 1269750] 12697502 12697501 12697500 1269750! 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 7) = X Cdmp75M  =e) ossec13008gMail Reciepient rejected2025-02-15 05:04:42 H=(mail.heipowersystem.com) [165.154.208.63]:63553 F= rejected RCPT : Rejected relay attempt: '165.154.208.63' From: 'prmmg@heipowersystem.com' To: 'validxxxg@gmail.com'165.154.208.631668284yL  -}) ossec13001glExim Auth failed2025-02-15 04:44:51 dovecot_login authenticator failed for (amplifypowerglobal.com) [42.193.105.109]:33688: 535 Incorrect authentication data (set_id=postmaster@amplifypowerglobal.com)42.193.105.1091814991%K  3Q' ossec11301gZNew FTP connection.Feb 15 04:44:33 vm1 pure-ftpd[1346106]: (?@52.249.38.225) [INFO] New connection from 52.249.38.22552.249.38.2256252001_J  -I) ossec13001gTExim Auth failed2025-02-15 04:44:27 dovecot_login authenticator failed for (amplifypowerglobal.com) [42.193.105.109]:55476: 535 Incorrect authentication data (set_id=nologin)42.193.105.1091814991"I  3M% ossec11301gǙNew FTP connection.Feb 15 04:15:43 vm1 pure-ftpd[1340843]: (?@103.203.59.5) [INFO] New connection from 103.203.59.5103.203.59.51814991gH  -]% ossec13001gExim Auth failed2025-02-15 03:25:26 dovecot_login authenticator failed for (gurukuljaipur.com) [125.72.54.81]:56702: 535 Incorrect authentication data (set_id=office@gurukuljaipur.com)125.72.54.811814991VG  -;% ossec13001gExim Auth failed2025-02-15 03:24:33 dovecot_login authenticator failed for (gurukuljaipur.com) [125.72.54.81]:53200: 535 Incorrect authentication data (set_id=nologin)125.72.54.811814991[F -A' ossec13001gExim Auth failed2025-02-15 00:55:48 dovecot_login authenticator failed for (fablixsolutions.com) [111.207.12.99]:41192: 535 Incorrect authentication data (set_id=nologin)111.207.12.991814991"E  3M% ossec11301gNew FTP connection.Feb 15 00:52:28 vm1 pure-ftpd[1302090]: (?@71.6.134.232) [INFO] New connection from 71.6.134.23271.6.134.2326252001kD  -e% ossec13001g~fExim Auth failed2025-02-14 23:03:26 dovecot_login authenticator failed for (fablixsolutions.com) [125.72.54.81]:38284: 535 Incorrect authentication data (set_id=office@fablixsolutions.com)125.72.54.811814991XC  -?% ossec13001g~.Exim Auth failed2025-02-14 23:02:28 dovecot_login authenticator failed for (fablixsolutions.com) [125.72.54.81]:34136: 535 Incorrect authentication data (set_id=nologin)125.72.54.811814991 B  =;) ossec13008gwMail Reciepient rejected2025-02-14 22:35:55 H=vps-cfa3fa2b.vps.ovh.ca (verifyemailaddress.com) [167.114.98.185]:60384 F= rejected RCPT : The mail server could not deliver mail to f7z_mtqi0u3xnt@webmentos.com. The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.167.114.98.1856251999aA -I+ ossec13001goExim Auth failed2025-02-14 22:00:52 dovecot_login authenticator failed for (s2seducationtrust.com) [111.122.211.212]:41742: 535 Incorrect authentication data (set_id=nologin)111.122.211.2121814991"@  3M% ossec11301gaSNew FTP connection.Feb 14 20:59:21 vm1 pure-ftpd[1257624]: (?@172.169.4.28) [INFO] New connection from 172.169.4.28172.169.4.286252001B?  =) ossec13008gAMail Reciepient rejected2025-02-14 18:45:32 H=(mail.s2seducationtrust.com) [165.154.227.89]:51223 F= rejected RCPT : Rejected relay attempt: '165.154.227.89' From: 'eigmxtf@s2seducationtrust.com' To: 'validxxxg@gmail.com'165.154.227.891668284%>  3Q' ossec11301g?New FTP connection.Feb 14 18:33:14 vm1 pure-ftpd[1230275]: (?@47.245.84.184) [INFO] New connection from 47.245.84.18447.245.84.1841880251*=  =Q' ossec13008g5Mail Reciepient rejected2025-02-14 17:50:40 H=(mail.technobases.in) [165.154.227.2]:53648 F= rejected RCPT : Rejected relay attempt: '165.154.227.2' From: 'muhxckr@technobases.in' To: 'validxxxg@gmail.com'165.154.227.21668284 T O  2 WgK(_  CK% ossec5716gCgSSHD authentication failed.Feb 15 13:03:58 vm1 sshd[1440213]: Failed password for techno from 103.190.54.7 port 49992 ssh2103.190.54.71269750(^  CK% ossec5716gCSSSHD authentication failed.Feb 15 13:03:38 vm1 sshd[1440213]: Failed password for techno from 103.190.54.7 port 49992 ssh2103.190.54.71269750(]  CK% ossec5716gC SSHD authentication failed.Feb 15 13:02:23 vm1 sshd[1440213]: Failed password for techno from 103.190.54.7 port 49992 ssh2103.190.54.71269750^\  E5% ossec2501gCUser authentication failure.Feb 15 13:02:21 vm1 sshd[1440213]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.190.54.7 user=techno103.190.54.71269750=[  =w' ossec13008g?VMail Reciepient rejected2025-02-15 12:46:38 H=(mail.fablixsolutions.com) [152.32.179.47]:51694 F= rejected RCPT : Rejected relay attempt: '152.32.179.47' From: 'jeygaelrn@fablixsolutions.com' To: 'validxxxg@gmail.com'152.32.179.471643084oZ  -k' ossec13001g:Exim Auth failed2025-02-15 12:26:58 dovecot_login authenticator failed for (heipowersystem.com) [111.56.54.202]:38884: 535 Incorrect authentication data (set_id=postmaster@heipowersystem.com)111.56.54.2021814991YY  -?' ossec13001g:Exim Auth failed2025-02-15 12:26:34 dovecot_login authenticator failed for (heipowersystem.com) [111.56.54.202]:36398: 535 Incorrect authentication data (set_id=nologin)111.56.54.2021814991pX  -o% ossec13001g7Exim Auth failed2025-02-15 12:14:53 dovecot_login authenticator failed for (vandanabalbharti.com) [119.96.131.8]:43922: 535 Incorrect authentication data (set_id=webmaster@vandanabalbharti.com)119.96.131.81814991YW  -A% ossec13001g7Exim Auth failed2025-02-15 12:14:29 dovecot_login authenticator failed for (vandanabalbharti.com) [119.96.131.8]:40718: 535 Incorrect authentication data (set_id=nologin)119.96.131.81814991lV  -i# ossec13001g3Exim Auth failed2025-02-15 11:57:00 dovecot_login authenticator failed for (vandanabalbharti.com) [14.18.77.99]:48052: 535 Incorrect authentication data (set_id=service@vandanabalbharti.com)14.18.77.991814991WU  -?# ossec13001g3Exim Auth failed2025-02-15 11:56:35 dovecot_login authenticator failed for (vandanabalbharti.com) [14.18.77.99]:44714: 535 Incorrect authentication data (set_id=nologin)14.18.77.991814991"T  3M% ossec11301g2New FTP connection.Feb 15 11:51:56 vm1 pure-ftpd[1427191]: (?@20.225.3.109) [INFO] New connection from 20.225.3.10920.225.3.1096252001;S  =o+ ossec13008g"Mail Reciepient rejected2025-02-15 10:43:40 H=(mail.gurukuljaipur.com) [165.154.213.186]:61277 F= rejected RCPT : Rejected relay attempt: '165.154.213.186' From: 'vfvbyrdu@gurukuljaipur.com' To: 'validxxxg@gmail.com'165.154.213.18634690344R  =a+ ossec13008gJMail Reciepient rejected2025-02-15 10:25:38 H=(mail.nyaystambh.com) [165.154.226.249]:52829 F= rejected RCPT : Rejected relay attempt: '165.154.226.249' From: 'unknraslr@nyaystambh.com' To: 'validxxxg@gmail.com'165.154.226.2491668284)Q 3U) ossec11301gpNew FTP connection.Feb 15 09:26:32 vm1 pure-ftpd[1398945]: (?@104.234.115.20) [INFO] New connection from 104.234.115.20104.234.115.206251999(P  3U) ossec11301gNew FTP connection.Feb 15 06:00:10 vm1 pure-ftpd[1360358]: (?@205.210.31.210) [INFO] New connection from 205.210.31.210205.210.31.2106252001(O  3U) ossec11301gNew FTP connection.Feb 15 05:28:56 vm1 pure-ftpd[1354458]: (?@104.152.52.235) [INFO] New connection from 104.152.52.235104.152.52.2356252001(N  3U) ossec11301gرNew FTP connection.Feb 15 05:28:39 vm1 pure-ftpd[1354256]: (?@104.152.52.200) [INFO] New connection from 104.152.52.200104.152.52.2006252001  > e z 6#&2R`io  -]) ossec13001gExim Auth failed2025-02-15 23:33:52 dovecot_login authenticator failed for (nyaystambh.com) [101.89.140.209]:47626: 535 Incorrect authentication data (set_id=postmaster@nyaystambh.com)101.89.140.2091814991Wn  -9) ossec13001gExim Auth failed2025-02-15 23:33:28 dovecot_login authenticator failed for (nyaystambh.com) [101.89.140.209]:44442: 535 Incorrect authentication data (set_id=nologin)101.89.140.2091814991nm  -g) ossec13001gExim Auth failed2025-02-15 23:15:56 dovecot_login authenticator failed for (fablixsolutions.com) [60.167.170.146]:50546: 535 Incorrect authentication data (set_id=admin@fablixsolutions.com)60.167.170.1461814991\l  -C) ossec13001gҽExim Auth failed2025-02-15 23:15:32 dovecot_login authenticator failed for (fablixsolutions.com) [60.167.170.146]:48088: 535 Incorrect authentication data (set_id=nologin)60.167.170.1461814991(k  3U) ossec11301gdNew FTP connection.Feb 15 23:09:46 vm1 pure-ftpd[1552137]: (?@198.235.24.116) [INFO] New connection from 198.235.24.116198.235.24.1166252001Dj  =+ ossec13008gMail Reciepient rejected2025-02-15 21:26:06 H=(mail.vandanabalbharti.com) [165.154.227.103]:64782 F= rejected RCPT : Rejected relay attempt: '165.154.227.103' From: 'pzxptszw@vandanabalbharti.com' To: 'validxxxg@gmail.com'165.154.227.1031668284yi  -}) ossec13001gWExim Auth failed2025-02-15 20:35:59 dovecot_login authenticator failed for (amplifypowerglobal.com) [124.160.63.122]:23443: 535 Incorrect authentication data (set_id=postmaster@amplifypowerglobal.com)124.160.63.1221814991ah  -K+ ossec13001g=Exim Auth failed2025-02-15 20:35:32 dovecot_login authenticator failed for (amplifypowerglobal.com) [202.107.197.211]:53376: 535 Incorrect authentication data (set_id=nologin)202.107.197.2111814991*g  =O) ossec13008gMail Reciepient rejected2025-02-15 20:21:02 H=(mail.msnews24.in) [165.154.226.42]:62295 F= rejected RCPT : Rejected relay attempt: '165.154.226.42' From: 'fbpzxgwxzm@msnews24.in' To: 'validxxxg@gmail.com'165.154.226.421668284@f  ={) ossec13008gzMail Reciepient rejected2025-02-15 19:45:21 H=(mail.fablixsolutions.com) [165.154.213.54]:54108 F= rejected RCPT : Rejected relay attempt: '165.154.213.54' From: 'ktcpgjqfw@fablixsolutions.com' To: 'validxxxg@gmail.com'165.154.213.543469034ge  -[' ossec13001gzExim Auth failed2025-02-15 19:36:50 dovecot_login authenticator failed for (nyaystambh.com) [111.56.54.202]:56146: 535 Incorrect authentication data (set_id=postmaster@nyaystambh.com)111.56.54.2021814991Ud  -7' ossec13001g^Exim Auth failed2025-02-15 19:36:21 dovecot_login authenticator failed for (nyaystambh.com) [111.56.54.202]:53554: 535 Incorrect authentication data (set_id=nologin)111.56.54.2021814991+c  3Y+ ossec11301gNew FTP connection.Feb 15 18:07:56 vm1 pure-ftpd[1496688]: (?@104.234.115.198) [INFO] New connection from 104.234.115.198104.234.115.1986251999+b  3Y+ ossec11301gNew FTP connection.Feb 15 18:07:45 vm1 pure-ftpd[1496672]: (?@104.234.115.198) [INFO] New connection from 104.234.115.198104.234.115.1986251999,a  =S) ossec13008gdMail Reciepient rejected2025-02-15 15:25:42 H=(mail.msnews24.in) [165.154.208.84]:49454 F= rejected RCPT : Rejected relay attempt: '165.154.208.84' From: 'zzaavbtrvpl@msnews24.in' To: 'validxxxg@gmail.com'165.154.208.8416682840`  =Y+ ossec13008g`Mail Reciepient rejected2025-02-15 15:06:28 H=(mail.nyaystambh.com) [165.154.213.232]:65347 F= rejected RCPT : Rejected relay attempt: '165.154.213.232' From: 'fziztaw@nyaystambh.com' To: 'validxxxg@gmail.com'165.154.213.2323469034  u    1%  3Q' ossec11301g<New FTP connection.Feb 16 06:46:49 vm1 pure-ftpd[1638730]: (?@104.248.43.13) [INFO] New connection from 104.248.43.13104.248.43.132921044T  -5' ossec13001g8GExim Auth failed2025-02-16 06:28:47 dovecot_login authenticator failed for ([218.146.45.68]) [218.146.45.68]:48466: 535 Incorrect authentication data (set_id=admin)218.146.45.681835841 ~  -!) ossec13001g8+Exim Auth failed2025-02-16 06:28:19 dovecot_login authenticator failed for (abts-mum-static-127.120.70.182.airtelbroadband.in) [182.70.120.127]:42402: 535 Incorrect authentication data (set_id=admin@heipowersystem.com)182.70.120.1271269750T}  -5' ossec13001g7yExim Auth failed2025-02-16 06:25:20 dovecot_login authenticator failed for ([218.201.62.71]) [218.201.62.71]:46338: 535 Incorrect authentication data (set_id=admin)218.201.62.711814991||  -% ossec13001g7iExim Auth failed2025-02-16 06:25:04 dovecot_login authenticator failed for host81-143-51-58.in-addr.btopenworld.com [81.143.51.58]:43479: 535 Incorrect authentication data (set_id=admin@heipowersystem.com)81.143.51.582635167f{  -U+ ossec13001g5Exim Auth failed2025-02-16 06:17:56 dovecot_login authenticator failed for (m121-202-152-221.smartone.com) [121.202.152.221]:22402: 535 Incorrect authentication data (set_id=admin)121.202.152.2211819730mz  -c+ ossec13001g5Exim Auth failed2025-02-16 06:17:38 dovecot_login authenticator failed for ([116.116.156.198]) [116.116.156.198]:34526: 535 Incorrect authentication data (set_id=admin@heipowersystem.com)116.116.156.1981814991my  -c+ ossec13001g5Exim Auth failed2025-02-16 06:17:39 dovecot_login authenticator failed for ([212.164.211.155]) [212.164.211.155]:39800: 535 Incorrect authentication data (set_id=admin@heipowersystem.com)212.164.211.1552017370?x  ={' ossec13008g%GMail Reciepient rejected2025-02-16 05:07:42 H=(mail.thepsindustries.com) [152.32.179.44]:55626 F= rejected RCPT : Rejected relay attempt: '152.32.179.44' From: 'gbpywpelus@thepsindustries.com' To: 'validxxxg@gmail.com'152.32.179.441643084(w  3U) ossec11301gQNew FTP connection.Feb 16 03:29:43 vm1 pure-ftpd[1600716]: (?@206.168.34.207) [INFO] New connection from 206.168.34.207206.168.34.2076252001nv  =U+ ossec13008gMail Reciepient rejected2025-02-16 02:36:09 H=(mail.sainikschoolcoachinginjaipur.com) [165.154.251.134]:50229 F= rejected RCPT : Rejected relay attempt: '165.154.251.134' From: 'gssgepxrxue@sainikschoolcoachinginjaipur.com' To: 'validxxxg@gmail.com'165.154.251.1341605651tu -s' ossec13001g*Exim Auth failed2025-02-16 02:20:49 dovecot_plain authenticator failed for ip85-215-236-96.pbiaas.com [85.215.236.96]:50555: 535 Incorrect authentication data (set_id=services@heipowersystem.com)85.215.236.9629210446t  Ag% ossec11302gFTP Authentication failed.Feb 16 02:03:02 vm1 pure-ftpd[1585109]: (?@213.32.32.82) [WARNING] Authentication failed for user [anonymous]213.32.32.823017382"s  3M% ossec11301gNew FTP connection.Feb 16 02:02:57 vm1 pure-ftpd[1585109]: (?@213.32.32.82) [INFO] New connection from 213.32.32.82213.32.32.823017382"r  3M% ossec11301gNew FTP connection.Feb 16 02:02:57 vm1 pure-ftpd[1585107]: (?@213.32.32.95) [INFO] New connection from 213.32.32.95213.32.32.953017382%q  3Q' ossec11301g&New FTP connection.Feb 16 00:55:25 vm1 pure-ftpd[1572823]: (?@198.235.24.41) [INFO] New connection from 198.235.24.41198.235.24.4162520018p  =m' ossec13008gMail Reciepient rejected2025-02-15 23:41:49 H=(mail.heipowersystem.com) [165.154.213.8]:60578 F= rejected RCPT : Rejected relay attempt: '165.154.213.8' From: 'irheiins@heipowersystem.com' To: 'validxxxg@gmail.com'165.154.213.83469034 4 P Rr/  =W+ ossec13008glMail Reciepient rejected2025-02-16 13:01:55 H=(mail.msnews24.in) [165.154.208.180]:50798 F= rejected RCPT : Rejected relay attempt: '165.154.208.180' From: 'mfbcdxstcwb@msnews24.in' To: 'validxxxg@gmail.com'165.154.208.1801668284 - ' ossec13001gMExim Auth failed2025-02-16 12:44:20 dovecot_plain authenticator failed for ip85-215-236-96.pbiaas.com [85.215.236.96]:64131: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)85.215.236.962921044  W) ossec9708gDovecot Aborted Login with empty userFeb 16 12:28:29 vm1 dovecot[945797]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=87.236.176.150, lip=103.74.54.108, TLS, session=<3Fxq7zwuU8JX7LCW>87.236.176.1502635167%  3Q' ossec11301gNew FTP connection.Feb 16 12:12:05 vm1 pure-ftpd[1700361]: (?@172.169.4.209) [INFO] New connection from 172.169.4.209172.169.4.2096252001Z -C# ossec13001gYExim Auth failed2025-02-16 11:44:49 dovecot_login authenticator failed for (amplifypowerglobal.com) [14.18.77.99]:60378: 535 Incorrect authentication data (set_id=nologin)14.18.77.991814991\ -E% ossec13001g~:Exim Auth failed2025-02-16 11:27:14 dovecot_login authenticator failed for (amplifypowerglobal.com) [119.96.131.8]:42888: 535 Incorrect authentication data (set_id=nologin)119.96.131.81814991(  CK% ossec5716gzwSSHD authentication failed.Feb 16 11:11:10 vm1 sshd[1688617]: Failed password for techno from 103.190.54.7 port 50405 ssh2103.190.54.71269750(  CK% ossec5716gzGSSHD authentication failed.Feb 16 11:10:22 vm1 sshd[1688617]: Failed password for techno from 103.190.54.7 port 50405 ssh2103.190.54.71269750^  E5% ossec2501gzEUser authentication failure.Feb 16 11:10:20 vm1 sshd[1688617]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.190.54.7 user=techno103.190.54.71269750^  =5+ ossec13008gsMail Reciepient rejected2025-02-16 10:39:47 H=(mail.shivelectricaltransformers.com) [165.154.208.180]:51502 F= rejected RCPT : Rejected relay attempt: '165.154.208.180' From: 'lkndqo@shivelectricaltransformers.com' To: 'validxxxg@gmail.com'165.154.208.1801668284"  3M% ossec11301gVNew FTP connection.Feb 16 08:39:47 vm1 pure-ftpd[1660022]: (?@139.162.77.6) [INFO] New connection from 139.162.77.6139.162.77.61861060E  =+ ossec13008gNMail Reciepient rejected2025-02-16 08:05:00 H=(mail.thepsindustries.com) [165.154.247.226]:52216 F= rejected RCPT : Rejected relay attempt: '165.154.247.226' From: 'pwkcjvlnaj@thepsindustries.com' To: 'validxxxg@gmail.com'165.154.247.2261605651B  gU) ossec11307gNMultiple connection attempts from same sourceFeb 16 08:04:11 vm1 pure-ftpd[1653268]: (?@167.94.138.126) [INFO] New connection from 167.94.138.126167.94.138.1266252001) 3U) ossec11301gN New FTP connection.Feb 16 08:03:56 vm1 pure-ftpd[1653164]: (?@167.94.138.126) [INFO] New connection from 167.94.138.126167.94.138.1266252001` -G+ ossec13001gGExim Auth failed2025-02-16 07:33:56 dovecot_login authenticator failed for (vandanabalbharti.com) [111.122.211.212]:25744: 535 Incorrect authentication data (set_id=nologin)111.122.211.2121814991]  -I% ossec13001g??Exim Auth failed2025-02-16 06:58:31 dovecot_login authenticator failed for (dynamic-ip-adsl.viettel.vn) [27.72.123.47]:47240: 535 Incorrect authentication data (set_id=admin)27.72.123.471562822g  -[' ossec13001g?5Exim Auth failed2025-02-16 06:58:20 dovecot_login authenticator failed for ([222.120.176.6]) [222.120.176.6]:48800: 535 Incorrect authentication data (set_id=admin@heipowersystem.com)222.120.176.61835841 ==  =cC (=g!  -[' ossec13001gExim Auth failed2025-02-16 20:48:08 dovecot_login authenticator failed for ([103.107.36.18]) [103.107.36.18]:39640: 535 Incorrect authentication data (set_id=admin@heipowersystem.com)103.107.36.181269750q  -o' ossec13001gExim Auth failed2025-02-16 20:40:42 dovecot_login authenticator failed for w175162.ppp.asahi-net.or.jp [121.1.175.162]:36032: 535 Incorrect authentication data (set_id=admin@heipowersystem.com)121.1.175.1621861060i  -]) ossec13001gExim Auth failed2025-02-16 20:40:22 dovecot_login authenticator failed for 222.42.246.220.static.netvigator.com [220.246.42.222]:52714: 535 Incorrect authentication data (set_id=admin)220.246.42.2221819730K  -+ ossec13001gExim Auth failed2025-02-16 20:40:12 dovecot_login authenticator failed for ([220.180.171.185]) [220.180.171.185]:44983: 535 Incorrect authentication data220.180.171.1851814991|  - # ossec13001gExim Auth failed2025-02-16 20:39:56 dovecot_login authenticator failed for static-98-110-70-2.cmdnnj.fios.verizon.net [98.110.70.2]:39333: 535 Incorrect authentication data (set_id=admin@heipowersystem.com)98.110.70.26252001f  =E+ ossec13008g+Mail Reciepient rejected2025-02-16 20:11:47 H=(mail.shivelectricaltransformers.com) [165.154.208.180]:50603 F= rejected RCPT : Rejected relay attempt: '165.154.208.180' From: 'lhqhnnnvzk@shivelectricaltransformers.com' To: 'validxxxg@gmail.com'165.154.208.1801668284  W' ossec9708gDovecot Aborted Login with empty userFeb 16 19:26:16 vm1 dovecot[945797]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 7 secs): user=<>, rip=87.236.176.45, lip=103.74.54.108, TLS, session=87.236.176.452635167V  -=% ossec13001gtExim Auth failed2025-02-16 18:39:07 dovecot_login authenticator failed for (User) [80.94.95.214]:47042: 535 Incorrect authentication data (set_id=admin1@technobases.in)80.94.95.214798549W -=% ossec13001g8Exim Auth failed2025-02-16 18:38:06 dovecot_login authenticator failed for (User) [80.94.95.214]:28192: 535 Incorrect authentication data (set_id=696969@technobases.in)80.94.95.214798549P  -1% ossec13001gExim Auth failed2025-02-16 18:37:41 dovecot_login authenticator failed for (User) [80.94.95.214]:1932: 535 Incorrect authentication data (set_id=0@technobases.in)80.94.95.214798549Y -A# ossec13001gExim Auth failed2025-02-16 16:37:13 dovecot_login authenticator failed for (s2seducationtrust.com) [14.18.77.99]:56950: 535 Incorrect authentication data (set_id=nologin)14.18.77.9918149912  =a' ossec13008g`Mail Reciepient rejected2025-02-16 16:22:14 H=(mail.nyaystambh.com) [165.154.228.9]:65014 F= rejected RCPT : Rejected relay attempt: '165.154.228.9' From: 'wmxgdhwdebp@nyaystambh.com' To: 'validxxxg@gmail.com'165.154.228.91643084  W% ossec9708gDovecot Aborted Login with empty userFeb 16 15:06:32 vm1 dovecot[945797]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 2 secs): user=<>, rip=71.6.134.233, lip=103.74.54.108, TLS, session=71.6.134.2336252001  =3) ossec13008gMail Reciepient rejected2025-02-16 14:06:59 H=(mail.hsnews.in) [165.154.213.22]:62373 F= rejected RCPT : Rejected relay attempt: '165.154.213.22' From: 'pzmyuj@hsnews.in' To: 'validxxxg@gmail.com'165.154.213.223469034] -A+ ossec13001gExim Auth failed2025-02-16 14:03:48 dovecot_login authenticator failed for (heipowersystem.com) [111.122.211.212]:7990: 535 Incorrect authentication data (set_id=nologin)111.122.211.2121814991^ -G' ossec13001gExim Auth failed2025-02-16 13:54:56 dovecot_login authenticator failed for (amplifypowerglobal.com) [111.207.12.99]:57462: 535 Incorrect authentication data (set_id=nologin)111.207.12.991814991 S / \ $qu#)1SZ2  -E# ossec13001g3Exim Auth failed2025-02-17 00:21:15 dovecot_login authenticator failed for 100.7.61.94.rev.vodafone.pt [94.61.7.100]:45322: 535 Incorrect authentication data (set_id=admin)94.61.7.1002264397t1  -u) ossec13001g3Exim Auth failed2025-02-17 00:21:08 dovecot_login authenticator failed for (178-165-63-216-kh.maxnet.ua) [178.165.63.216]:38296: 535 Incorrect authentication data (set_id=admin@heipowersystem.com)178.165.63.216690791v0  -w) ossec13001g3Exim Auth failed2025-02-17 00:21:05 dovecot_login authenticator failed for (m121-202-155-47.smartone.com) [121.202.155.47]:13670: 535 Incorrect authentication data (set_id=admin@heipowersystem.com)121.202.155.471819730/  3I# ossec11301g-(New FTP connection.Feb 16 23:53:35 vm1 pure-ftpd[1833572]: (?@65.49.1.101) [INFO] New connection from 65.49.1.10165.49.1.1016252001+.  3Y+ ossec11301g#New FTP connection.Feb 16 23:13:32 vm1 pure-ftpd[1826073]: (?@172.168.158.183) [INFO] New connection from 172.168.158.183172.168.158.1836252001+-  =O+ ossec13008g|Mail Reciepient rejected2025-02-16 22:38:11 H=(mail.msnews24.in) [165.154.226.249]:62422 F= rejected RCPT : Rejected relay attempt: '165.154.226.249' From: 'pcmzohokg@msnews24.in' To: 'validxxxg@gmail.com'165.154.226.2491668284,  W) ossec9708gDovecot Aborted Login with empty userFeb 16 21:44:14 vm1 dovecot[945797]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=185.247.137.92, lip=103.74.54.108, TLS, session=185.247.137.92298795(+  3U) ossec11301g New FTP connection.Feb 16 21:27:44 vm1 pure-ftpd[1806020]: (?@223.185.232.87) [INFO] New connection from 223.185.232.87223.185.232.871269750/*  CS) ossec11309g FTP Authentication success.Feb 16 21:27:44 vm1 pure-ftpd[1806020]: (?@223.185.232.87) [INFO] user@msnews24.in is now logged in223.185.232.871269750f)  -U+ ossec13001g 8Exim Auth failed2025-02-16 21:24:32 dovecot_login authenticator failed for (m121-202-200-120.smartone.com) [121.202.200.120]:64675: 535 Incorrect authentication data (set_id=admin)121.202.200.1201819730m(  -c+ ossec13001g Exim Auth failed2025-02-16 21:24:07 dovecot_login authenticator failed for ([111.171.127.190]) [111.171.127.190]:58269: 535 Incorrect authentication data (set_id=admin@heipowersystem.com)111.171.127.1901835841Y'  =-) ossec13008g Mail Reciepient rejected2025-02-16 21:23:42 H=(mail.shivelectricaltransformers.com) [165.154.227.89]:60685 F= rejected RCPT : Rejected relay attempt: '165.154.227.89' From: 'lebqs@shivelectricaltransformers.com' To: 'validxxxg@gmail.com'165.154.227.891668284#&  =?+ ossec13008g-Mail Reciepient rejected2025-02-16 21:07:16 H=(mail.msnews24.in) [165.154.208.180]:55094 F= rejected RCPT : Rejected relay attempt: '165.154.208.180' From: 'kgeoz@msnews24.in' To: 'validxxxg@gmail.com'165.154.208.1801668284(%  3U) ossec11301g@New FTP connection.Feb 16 21:03:19 vm1 pure-ftpd[1801207]: (?@205.210.31.218) [INFO] New connection from 205.210.31.218205.210.31.2186252001a$  -O' ossec13001gExim Auth failed2025-02-16 20:52:03 dovecot_login authenticator failed for host-85-237-57-200.dsl.sura.ru [85.237.57.200]:60030: 535 Incorrect authentication data (set_id=admin)85.237.57.2002017370v#  -w) ossec13001gExim Auth failed2025-02-16 20:51:44 dovecot_login authenticator failed for (m121-202-154-25.smartone.com) [121.202.154.25]:26592: 535 Incorrect authentication data (set_id=admin@heipowersystem.com)121.202.154.251819730n"  -g) ossec13001gExim Auth failed2025-02-16 20:48:18 dovecot_login authenticator failed for (175-182-64-203.adsl.dynamic.seed.net.tw) [175.182.64.203]:36806: 535 Incorrect authentication data (set_id=admin)175.182.64.2031668284 %( J U o M Xq3B  =a) ossec13008gMail Reciepient rejected2025-02-17 08:23:04 H=(mail.technobases.in) [165.154.208.70]:65488 F= rejected RCPT : Rejected relay attempt: '165.154.208.70' From: 'cdwqflxghw@technobases.in' To: 'validxxxg@gmail.com'165.154.208.701668284fA  -U+ ossec13001gExim Auth failed2025-02-17 07:50:49 dovecot_login authenticator failed for (nyaystambh.com) [111.122.211.212]:17452: 535 Incorrect authentication data (set_id=admin@nyaystambh.com)111.122.211.2121814991Y@  -;+ ossec13001gExim Auth failed2025-02-17 07:50:24 dovecot_login authenticator failed for (nyaystambh.com) [111.122.211.212]:15642: 535 Incorrect authentication data (set_id=nologin)111.122.211.2121814991D?  =+ ossec13008gMail Reciepient rejected2025-02-17 06:04:39 H=(mail.amplifypowerglobal.com) [165.154.233.146]:62998 F= rejected RCPT : Rejected relay attempt: '165.154.233.146' From: 'xbfgi@amplifypowerglobal.com' To: 'validxxxg@gmail.com'165.154.233.1461694008s>  -s' ossec13001gwExim Auth failed2025-02-17 05:10:58 dovecot_login authenticator failed for (vandanabalbharti.com) [221.229.216.1]:55276: 535 Incorrect authentication data (set_id=postmaster@vandanabalbharti.com)221.229.216.11814991[=  -C' ossec13001gwrExim Auth failed2025-02-17 05:10:34 dovecot_login authenticator failed for (vandanabalbharti.com) [221.229.216.1]:53004: 535 Incorrect authentication data (set_id=nologin)221.229.216.11814991"<  3M% ossec11301gbcNew FTP connection.Feb 17 03:40:41 vm1 pure-ftpd[1878469]: (?@139.162.77.6) [INFO] New connection from 139.162.77.6139.162.77.61861060R; -3# ossec13001gK5Exim Auth failed2025-02-17 02:01:48 dovecot_login authenticator failed for (nyaystambh.com) [14.18.77.99]:56248: 535 Incorrect authentication data (set_id=nologin)14.18.77.991814991c:  -Q) ossec13001g>Exim Auth failed2025-02-17 01:05:30 dovecot_login authenticator failed for (m121-202-152-13.smartone.com) [121.202.152.13]:27358: 535 Incorrect authentication data (set_id=admin)121.202.152.131819730q9  -o' ossec13001g=Exim Auth failed2025-02-17 01:05:17 dovecot_login authenticator failed for (hebei.18.121.in-addr.arpa) [121.18.148.10]:57092: 535 Incorrect authentication data (set_id=admin@heipowersystem.com)121.18.148.1018149918  W) ossec9708g7Dovecot Aborted Login with empty userFeb 17 00:39:23 vm1 dovecot[945797]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=87.236.176.189, lip=103.74.54.108, TLS, session=87.236.176.1892635167b7  -Q' ossec13001g6`Exim Auth failed2025-02-17 00:32:55 dovecot_login authenticator failed for (72.20.167.124.adsl-pool.sx.cn) [124.167.20.72]:49146: 535 Incorrect authentication data (set_id=admin)124.167.20.721814991q6  -s# ossec13001g6NExim Auth failed2025-02-17 00:32:38 dovecot_login authenticator failed for 110-4-0-180.static.pccw-hkt.com [110.4.0.180]:55663: 535 Incorrect authentication data (set_id=admin@heipowersystem.com)110.4.0.1801819730Z5  -=+ ossec13001g5Exim Auth failed2025-02-17 00:29:34 dovecot_login authenticator failed for ([203.123.219.137]) [203.123.219.137]:55613: 535 Incorrect authentication data (set_id=admin)203.123.219.1371835841y4  -' ossec13001g5Exim Auth failed2025-02-17 00:29:21 dovecot_login authenticator failed for c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:44530: 535 Incorrect authentication data (set_id=admin@heipowersystem.com)76.132.238.436252001W3  -9) ossec13001g3Exim Auth failed2025-02-17 00:21:21 dovecot_login authenticator failed for ([211.248.31.142]) [211.248.31.142]:37128: 535 Incorrect authentication data (set_id=admin)211.248.31.1421835841 >* ~ t j ` V L B 8 . $    z p f \4*   v l b X N D : 0 &    R H > 4 *  vlbXND:0&|rh^TJ@6,"xndZPF<2( ~tj`VLB8.$zpfRH\>4*  vlbXND:0& | r h ^ T J @ 6 , "    x n d Z P F < 2 (   ~tj`VLB8.$zpf\RH> g|^ gn] g\ g[ gZ gY gpX gpW gpV g U g T g S gR gQ gP gJO gN gM gL gK gJ gI gDH g.G g.F g.E gD gC gB gSA g@ g? g> g= g< g; gm: gm9 gm8 g7 g6 g5 g4 g3 g2 g1 g0 g]/ g). g6- gʿ, gʍ+ g_* g) g( gD' g & g% g$ g# gF" gw.! gw. gv gp8 gk gV gS} gR g<2 g8+ g g gR g  gn gP g g g g  g  g g g g g g g g g g g g/ g% g gM g g g g g6 g g޶ g` g` g` gۥ gۥ g g  g g‘ g‘ g‘ g g g g g g g g g) g) g gI gM g8 g g g g gF gF g g g g g g g g g g g g g g g g g g g gy gj g g g g gw gwr gbc gK5 g> g= g7 g6` g6N gzE gs gV gN gN gN gG g?? g?5 g< g8G g8+~ g7y} g7i| g5{ g5z g5y g%Gx gQw gv g*u gt gs gr g&q gp go gn gm gҽl gdk gj gWi g=h gg gzf gze g^d gc gb g g gr g g g g g g- g- g- g g~ gd} gd| gd{ gz gy gx gw gv gu gt gs gr gq gp g o g n g m g l g k g oj g oi g oh g _g g ;f g ;e g ;d g c g b g c` g c_ g5 g5 g3 g3 g3 g3 g-( g# g| g g  g  g 8 g  g  g- g@ g g g g g g g g g+ g gt g8 g g g` g g g g gl gM g g gY g~: g gzw gzG g aa O!, p  V Y C'knLOyV  Ce+ ossec11313gFTP file uploaded to serverFeb 17 09:39:43 vm1 pure-ftpd[1948200]: (militry@technobases.in@223.229.188.189) [NOTICE] /home/techno/public_html/milictry1//blog.php uploaded (10095 bytes, 184.33KB/sec)223.229.188.18912697507U  Ca+ ossec11309gFTP Authentication success.Feb 17 09:39:42 vm1 pure-ftpd[1948200]: (?@223.229.188.189) [INFO] militry@technobases.in is now logged in223.229.188.1891269750yT  Ce+ ossec11313gFTP file uploaded to serverFeb 17 09:36:40 vm1 pure-ftpd[1947665]: (militry@technobases.in@223.229.188.189) [NOTICE] /home/techno/public_html/milictry1//head.php uploaded (3145 bytes, 2281.60KB/sec)223.229.188.18912697507S  Ca+ ossec11309gFTP Authentication success.Feb 17 09:36:40 vm1 pure-ftpd[1947665]: (?@223.229.188.189) [INFO] militry@technobases.in is now logged in223.229.188.1891269750+R  3Y+ ossec11301gNew FTP connection.Feb 17 09:36:40 vm1 pure-ftpd[1947665]: (?@223.229.188.189) [INFO] New connection from 223.229.188.189223.229.188.1891269750yQ  Ce+ ossec11313gFTP file uploaded to serverFeb 17 09:33:11 vm1 pure-ftpd[1946914]: (militry@technobases.in@223.229.188.189) [NOTICE] /home/techno/public_html/milictry1//head.php uploaded (3168 bytes, 2525.52KB/sec)223.229.188.18912697508P Ca+ ossec11309gFTP Authentication success.Feb 17 09:32:20 vm1 pure-ftpd[1946904]: (?@223.229.188.189) [INFO] militry@technobases.in is now logged in223.229.188.1891269750,O 3Y+ ossec11301gNew FTP connection.Feb 17 09:32:19 vm1 pure-ftpd[1946904]: (?@223.229.188.189) [INFO] New connection from 223.229.188.189223.229.188.18912697508N Ca+ ossec11309gFTP Authentication success.Feb 17 09:31:11 vm1 pure-ftpd[1946585]: (?@223.229.188.189) [INFO] militry@technobases.in is now logged in223.229.188.1891269750,M 3Y+ ossec11301gNew FTP connection.Feb 17 09:31:11 vm1 pure-ftpd[1946585]: (?@223.229.188.189) [INFO] New connection from 223.229.188.189223.229.188.1891269750+L  3Y+ ossec11301gNew FTP connection.Feb 17 09:28:48 vm1 pure-ftpd[1946085]: (?@223.229.188.189) [INFO] New connection from 223.229.188.189223.229.188.18912697507K  Ca+ ossec11309gFTP Authentication success.Feb 17 09:28:48 vm1 pure-ftpd[1946085]: (?@223.229.188.189) [INFO] militry@technobases.in is now logged in223.229.188.1891269750(J  3U) ossec11301gNew FTP connection.Feb 17 09:18:24 vm1 pure-ftpd[1944179]: (?@220.197.51.121) [INFO] New connection from 220.197.51.121220.197.51.1211814991yI  Ce+ ossec11313gFTP file uploaded to serverFeb 17 09:08:03 vm1 pure-ftpd[1942164]: (militry@technobases.in@223.229.188.189) [NOTICE] /home/techno/public_html/milictry1//foot.php uploaded (4416 bytes, 3400.63KB/sec)223.229.188.18912697507H  Ca+ ossec11309gFTP Authentication success.Feb 17 09:08:03 vm1 pure-ftpd[1942164]: (?@223.229.188.189) [INFO] militry@technobases.in is now logged in223.229.188.1891269750+G  3Y+ ossec11301gNew FTP connection.Feb 17 09:08:03 vm1 pure-ftpd[1942164]: (?@223.229.188.189) [INFO] New connection from 223.229.188.189223.229.188.1891269750,F 3Y+ ossec11301gNew FTP connection.Feb 17 09:06:38 vm1 pure-ftpd[1941884]: (?@223.229.188.189) [INFO] New connection from 223.229.188.189223.229.188.18912697508E Ca+ ossec11309gFTP Authentication success.Feb 17 09:06:38 vm1 pure-ftpd[1941884]: (?@223.229.188.189) [INFO] militry@technobases.in is now logged in223.229.188.1891269750qD -m' ossec13001gyExim Auth failed2025-02-17 08:48:15 dovecot_plain authenticator failed for ip85-215-236-96.pbiaas.com [85.215.236.96]:62284: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)85.215.236.962921044[C -A' ossec13001gjExim Auth failed2025-02-17 08:35:13 dovecot_login authenticator failed for (thepsindustries.com) [58.240.171.59]:35484: 535 Incorrect authentication data (set_id=nologin)58.240.171.591814991 Q , .  G,qL,j 3Y+ ossec11301gNew FTP connection.Feb 17 10:29:04 vm1 pure-ftpd[1957701]: (?@223.229.188.189) [INFO] New connection from 223.229.188.189223.229.188.1891269750+i  3Y+ ossec11301gNew FTP connection.Feb 17 10:11:26 vm1 pure-ftpd[1954694]: (?@223.229.188.189) [INFO] New connection from 223.229.188.189223.229.188.18912697507h  Ca+ ossec11309gFTP Authentication success.Feb 17 10:11:26 vm1 pure-ftpd[1954694]: (?@223.229.188.189) [INFO] militry@technobases.in is now logged in223.229.188.18912697507g  Ca+ ossec11309gFTP Authentication success.Feb 17 10:07:01 vm1 pure-ftpd[1953696]: (?@223.229.188.189) [INFO] militry@technobases.in is now logged in223.229.188.1891269750+f  3Y+ ossec11301gNew FTP connection.Feb 17 10:07:01 vm1 pure-ftpd[1953696]: (?@223.229.188.189) [INFO] New connection from 223.229.188.189223.229.188.18912697507e  Ca+ ossec11309gFTP Authentication success.Feb 17 10:05:31 vm1 pure-ftpd[1953461]: (?@223.229.188.189) [INFO] militry@technobases.in is now logged in223.229.188.1891269750+d  3Y+ ossec11301gNew FTP connection.Feb 17 10:05:31 vm1 pure-ftpd[1953461]: (?@223.229.188.189) [INFO] New connection from 223.229.188.189223.229.188.1891269750,c 3Y+ ossec11301g)New FTP connection.Feb 17 10:03:44 vm1 pure-ftpd[1953034]: (?@223.229.188.189) [INFO] New connection from 223.229.188.189223.229.188.18912697508b Ca+ ossec11309g)FTP Authentication success.Feb 17 10:03:44 vm1 pure-ftpd[1953034]: (?@223.229.188.189) [INFO] militry@technobases.in is now logged in223.229.188.1891269750(a  CK% ossec5716gSSHD authentication failed.Feb 17 10:01:14 vm1 sshd[1952310]: Failed password for techno from 103.190.54.7 port 51014 ssh2103.190.54.71269750_` E5% ossec2501gIUser authentication failure.Feb 17 10:00:01 vm1 sshd[1952084]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.190.54.7 user=techno103.190.54.71269750)_ CK% ossec5716gMSSHD authentication failed.Feb 17 10:00:03 vm1 sshd[1952084]: Failed password for techno from 103.190.54.7 port 51007 ssh2103.190.54.71269750y^  Ce+ ossec11313g8FTP file uploaded to serverFeb 17 09:46:54 vm1 pure-ftpd[1949169]: (militry@technobases.in@223.229.188.189) [NOTICE] /home/techno/public_html/milictry1//foot.php uploaded (4417 bytes, 2477.68KB/sec)223.229.188.1891269750{] Cg+ ossec11313gFTP file uploaded to serverFeb 17 09:46:05 vm1 pure-ftpd[1949169]: (militry@technobases.in@223.229.188.189) [NOTICE] /home/techno/public_html/milictry1//blog.php uploaded (6348 bytes, 11231.71KB/sec)223.229.188.1891269750+\  3Y+ ossec11301gNew FTP connection.Feb 17 09:44:57 vm1 pure-ftpd[1949169]: (?@223.229.188.189) [INFO] New connection from 223.229.188.189223.229.188.1891269750z[ Ce+ ossec11313gFTP file uploaded to serverFeb 17 09:44:57 vm1 pure-ftpd[1949169]: (militry@technobases.in@223.229.188.189) [NOTICE] /home/techno/public_html/milictry1//blog.php uploaded (6353 bytes, 4076.11KB/sec)223.229.188.18912697507Z  Ca+ ossec11309gFTP Authentication success.Feb 17 09:44:57 vm1 pure-ftpd[1949169]: (?@223.229.188.189) [INFO] militry@technobases.in is now logged in223.229.188.1891269750+Y  3Y+ ossec11301gFNew FTP connection.Feb 17 09:42:54 vm1 pure-ftpd[1948886]: (?@223.229.188.189) [INFO] New connection from 223.229.188.189223.229.188.18912697507X  Ca+ ossec11309gFFTP Authentication success.Feb 17 09:42:54 vm1 pure-ftpd[1948886]: (?@223.229.188.189) [INFO] militry@technobases.in is now logged in223.229.188.1891269750+W  3Y+ ossec11301gNew FTP connection.Feb 17 09:39:42 vm1 pure-ftpd[1948200]: (?@223.229.188.189) [INFO] New connection from 223.229.188.189223.229.188.1891269750 O 78b@O(  3U) ossec11301g New FTP connection.Feb 17 13:32:37 vm1 pure-ftpd[1995277]: (?@106.219.122.63) [INFO] New connection from 106.219.122.63106.219.122.631269750  C1) ossec11313gFTP file uploaded to serverFeb 17 13:27:52 vm1 pure-ftpd[1994139]: (user@msnews24.in@106.219.122.63) [NOTICE] /home/techno/public_html/msnews24.in//v1/app/Http/Controllers/Apis/UserAuthController.php uploaded (5055 bytes, 1754.24KB/sec)106.219.122.631269750 C1) ossec11313gFTP file uploaded to serverFeb 17 13:26:50 vm1 pure-ftpd[1994139]: (user@msnews24.in@106.219.122.63) [NOTICE] /home/techno/public_html/msnews24.in//v1/app/Http/Controllers/Apis/UserAuthController.php uploaded (5115 bytes, 2239.08KB/sec)106.219.122.631269750  C1) ossec11313gFTP file uploaded to serverFeb 17 13:26:37 vm1 pure-ftpd[1994139]: (user@msnews24.in@106.219.122.63) [NOTICE] /home/techno/public_html/msnews24.in//v1/app/Http/Controllers/Apis/UserAuthController.php uploaded (5091 bytes, 2927.93KB/sec)106.219.122.631269750/  CS) ossec11309gFTP Authentication success.Feb 17 13:26:37 vm1 pure-ftpd[1994139]: (?@106.219.122.63) [INFO] user@msnews24.in is now logged in106.219.122.631269750(  3U) ossec11301gNew FTP connection.Feb 17 13:26:36 vm1 pure-ftpd[1994139]: (?@106.219.122.63) [INFO] New connection from 106.219.122.63106.219.122.631269750  C) ossec11313gFTP file uploaded to serverFeb 17 13:23:54 vm1 pure-ftpd[1993424]: (user@msnews24.in@106.219.122.63) [NOTICE] /home/techno/public_html/msnews24.in//v1/app/Http/Controllers/SmsController.php uploaded (637 bytes, 771.03KB/sec)106.219.122.6312697500 CS) ossec11309gFTP Authentication success.Feb 17 13:22:50 vm1 pure-ftpd[1993332]: (?@106.219.122.63) [INFO] user@msnews24.in is now logged in106.219.122.631269750) 3U) ossec11301gNew FTP connection.Feb 17 13:22:50 vm1 pure-ftpd[1993332]: (?@106.219.122.63) [INFO] New connection from 106.219.122.63106.219.122.631269750{ Ci) ossec11313gFTP file uploaded to serverFeb 17 12:48:06 vm1 pure-ftpd[1986691]: (user@msnews24.in@106.219.122.63) [NOTICE] /home/techno/public_html/msnews24.in//v1/routes/web.php uploaded (324 bytes, 423.05KB/sec)106.219.122.6312697500 CS) ossec11309gFTP Authentication success.Feb 17 12:47:25 vm1 pure-ftpd[1986677]: (?@106.219.122.63) [INFO] user@msnews24.in is now logged in106.219.122.631269750) 3U) ossec11301gNew FTP connection.Feb 17 12:47:25 vm1 pure-ftpd[1986677]: (?@106.219.122.63) [INFO] New connection from 106.219.122.63106.219.122.631269750 C) ossec11313g/FTP file uploaded to serverFeb 17 12:45:57 vm1 pure-ftpd[1982884]: (user@msnews24.in@106.219.122.63) [NOTICE] /home/techno/public_html/msnews24.in//v1/app/Http/Controllers/SmsController.php uploaded (592 bytes, 81.67KB/sec)106.219.122.631269750  C) ossec11313g%FTP file uploaded to serverFeb 17 12:45:47 vm1 pure-ftpd[1982884]: (user@msnews24.in@106.219.122.63) [NOTICE] /home/techno/public_html/msnews24.in//v1/app/Http/Controllers/SmsController.php uploaded (603 bytes, 84.37KB/sec)106.219.122.631269750  C) ossec11313gFTP file uploaded to serverFeb 17 12:43:41 vm1 pure-ftpd[1982884]: (user@msnews24.in@106.219.122.63) [NOTICE] /home/techno/public_html/msnews24.in//v1/app/Http/Controllers/SmsController.php uploaded (591 bytes, 84.95KB/sec)106.219.122.631269750~  C) ossec11313gMFTP file uploaded to serverFeb 17 12:42:10 vm1 pure-ftpd[1982884]: (user@msnews24.in@106.219.122.63) [NOTICE] /home/techno/public_html/msnews24.in//v1/app/Http/Controllers/SmsController.php uploaded (591 bytes, 81.83KB/sec)106.219.122.631269750} C) ossec11313gFTP file uploaded to serverFeb 17 12:40:56 vm1 pure-ftpd[1982884]: (user@msnews24.in@106.219.122.63) [NOTICE] /home/techno/public_html/msnews24.in//v1/app/Services/SmsBhartiService.php uploaded (1090 bytes, 141.95KB/sec)106.219.122.631269750 D , !l|  C) ossec11313gFTP file uploaded to serverFeb 17 12:40:15 vm1 pure-ftpd[1982884]: (user@msnews24.in@106.219.122.63) [NOTICE] /home/techno/public_html/msnews24.in//v1/app/Services/SmsBhartiService.php uploaded (1084 bytes, 128.27KB/sec)106.219.122.631269750i{  -a% ossec13001gExim Auth failed2025-02-17 12:39:41 dovecot_login authenticator failed for (heipowersystem.com) [125.72.54.81]:52984: 535 Incorrect authentication data (set_id=office@heipowersystem.com)125.72.54.811814991Wz  -=% ossec13001gExim Auth failed2025-02-17 12:38:48 dovecot_login authenticator failed for (heipowersystem.com) [125.72.54.81]:50254: 535 Incorrect authentication data (set_id=nologin)125.72.54.811814991qy  CW) ossec11313g6FTP file uploaded to serverFeb 17 12:33:17 vm1 pure-ftpd[1982884]: (user@msnews24.in@106.219.122.63) [NOTICE] /home/techno/public_html/msnews24.in//v1/.env uploaded (1453 bytes, 175.01KB/sec)106.219.122.631269750yx  Cg) ossec11313gFTP file uploaded to serverFeb 17 12:31:51 vm1 pure-ftpd[1982884]: (user@msnews24.in@106.219.122.63) [NOTICE] /home/techno/public_html/msnews24.in//v1/routes/web.php uploaded (283 bytes, 42.52KB/sec)106.219.122.631269750w  C) ossec11313g޶FTP file uploaded to serverFeb 17 12:31:08 vm1 pure-ftpd[1982884]: (user@msnews24.in@106.219.122.63) [NOTICE] /home/techno/public_html/msnews24.in//v1/app/Http/Controllers/SmsController.php uploaded (884 bytes, 128.43KB/sec)106.219.122.631269750/v  CS) ossec11309g`FTP Authentication success.Feb 17 12:29:42 vm1 pure-ftpd[1982884]: (?@106.219.122.63) [INFO] user@msnews24.in is now logged in106.219.122.631269750(u  3U) ossec11301g`New FTP connection.Feb 17 12:29:42 vm1 pure-ftpd[1982884]: (?@106.219.122.63) [INFO] New connection from 106.219.122.63106.219.122.631269750t  C) ossec11313g`FTP file uploaded to serverFeb 17 12:29:42 vm1 pure-ftpd[1982884]: (user@msnews24.in@106.219.122.63) [NOTICE] /home/techno/public_html/msnews24.in//v1/app/SmsBhartiService.php uploaded (1183 bytes, 134.64KB/sec)106.219.122.631269750(s  3U) ossec11301gۥNew FTP connection.Feb 17 12:18:04 vm1 pure-ftpd[1980440]: (?@106.219.122.63) [INFO] New connection from 106.219.122.63106.219.122.631269750/r  CS) ossec11309gۥFTP Authentication success.Feb 17 12:18:04 vm1 pure-ftpd[1980440]: (?@106.219.122.63) [INFO] user@msnews24.in is now logged in106.219.122.631269750(q  3U) ossec11301gNew FTP connection.Feb 17 11:07:33 vm1 pure-ftpd[1966060]: (?@43.248.108.157) [INFO] New connection from 43.248.108.15743.248.108.1571814991"p  3M% ossec11301g New FTP connection.Feb 17 10:33:03 vm1 pure-ftpd[1958578]: (?@103.203.59.5) [INFO] New connection from 103.203.59.5103.203.59.51814991o C+ ossec11313gFTP file uploaded to serverFeb 17 10:32:08 vm1 pure-ftpd[1958268]: (militry@technobases.in@223.229.188.189) [NOTICE] /home/techno/public_html/milictry1//images/sainik_07.jpg uploaded (91303 bytes, 3861.21KB/sec)223.229.188.1891269750yn Cc+ ossec11313g‘FTP file uploaded to serverFeb 17 10:31:03 vm1 pure-ftpd[1958268]: (militry@technobases.in@223.229.188.189) [NOTICE] /home/techno/public_html/milictry1//blog.php uploaded (6304 bytes, 135.73KB/sec)223.229.188.18912697507m  Ca+ ossec11309g‘FTP Authentication success.Feb 17 10:31:03 vm1 pure-ftpd[1958268]: (?@223.229.188.189) [INFO] militry@technobases.in is now logged in223.229.188.1891269750+l  3Y+ ossec11301g‘New FTP connection.Feb 17 10:31:03 vm1 pure-ftpd[1958268]: (?@223.229.188.189) [INFO] New connection from 223.229.188.189223.229.188.18912697508k Ca+ ossec11309gFTP Authentication success.Feb 17 10:29:04 vm1 pure-ftpd[1957701]: (?@223.229.188.189) [INFO] militry@technobases.in is now logged in223.229.188.1891269750 gM C j  %Kg<  =q+ ossec13008gVMail Reciepient rejected2025-02-17 21:02:20 H=(mail.heipowersystem.com) [165.154.213.166]:56961 F= rejected RCPT : Rejected relay attempt: '165.154.213.166' From: 'gktejjd@heipowersystem.com' To: 'validxxxg@gmail.com'165.154.213.1663469034h  =I+ ossec13008gS}Mail Reciepient rejected2025-02-17 20:49:24 H=(mail.shivelectricaltransformers.com) [165.154.226.135]:57320 F= rejected RCPT : Rejected relay attempt: '165.154.226.135' From: 'kicrtifevhf@shivelectricaltransformers.com' To: 'validxxxg@gmail.com'165.154.226.13516682844  =a+ ossec13008gRMail Reciepient rejected2025-02-17 20:46:21 H=(mail.nyaystambh.com) [165.154.213.186]:53414 F= rejected RCPT : Rejected relay attempt: '165.154.213.186' From: 'ssedwtpzj@nyaystambh.com' To: 'validxxxg@gmail.com'165.154.213.18634690344  =c) ossec13008g<2Mail Reciepient rejected2025-02-17 19:09:59 H=(mail.gurukuljaipur.com) [165.154.226.68]:64790 F= rejected RCPT : Rejected relay attempt: '165.154.226.68' From: 'zvxivv@gurukuljaipur.com' To: 'validxxxg@gmail.com'165.154.226.681668284=  =s+ ossec13008g8+Mail Reciepient rejected2025-02-17 18:52:50 H=(mail.gurukuljaipur.com) [165.154.226.135]:51513 F= rejected RCPT : Rejected relay attempt: '165.154.226.135' From: 'sxoxhghbe@gurukuljaipur.com' To: 'validxxxg@gmail.com'165.154.226.1351668284!  =;+ ossec13008gMail Reciepient rejected2025-02-17 16:38:17 H=(mail.hsnews.in) [165.154.226.214]:62374 F= rejected RCPT : Rejected relay attempt: '165.154.226.214' From: 'iiiokqq@hsnews.in' To: 'validxxxg@gmail.com'165.154.226.21416682848  =i+ ossec13008gMail Reciepient rejected2025-02-17 16:27:21 H=(mail.nyaystambh.com) [165.154.226.209]:54531 F= rejected RCPT : Rejected relay attempt: '165.154.226.209' From: 'rvvpoqshpdn@nyaystambh.com' To: 'validxxxg@gmail.com'165.154.226.2091668284*  3Y+ ossec11301gRNew FTP connection.Feb 17 16:15:36 vm1 pure-ftpd[2027350]: (?@185.247.137.175) [INFO] New connection from 185.247.137.175185.247.137.175298795(  3U) ossec11301g New FTP connection.Feb 17 15:36:02 vm1 pure-ftpd[2019351]: (?@205.210.31.203) [INFO] New connection from 205.210.31.203205.210.31.2036252001g  -[' ossec13001gnExim Auth failed2025-02-17 15:12:05 dovecot_login authenticator failed for (nyaystambh.com) [221.229.216.1]:56872: 535 Incorrect authentication data (set_id=postmaster@nyaystambh.com)221.229.216.11814991U  -7' ossec13001gPExim Auth failed2025-02-17 15:11:35 dovecot_login authenticator failed for (nyaystambh.com) [221.229.216.1]:54522: 535 Incorrect authentication data (set_id=nologin)221.229.216.11814991(  3U) ossec11301gNew FTP connection.Feb 17 14:01:04 vm1 pure-ftpd[2001278]: (?@206.168.34.198) [INFO] New connection from 206.168.34.198206.168.34.1986252001  W' ossec9708gDovecot Aborted Login with empty userFeb 17 13:52:05 vm1 dovecot[945797]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=152.32.225.11, lip=103.74.54.108, TLS, session=152.32.225.111819730:  =m+ ossec13008gMail Reciepient rejected2025-02-17 13:35:42 H=(mail.heipowersystem.com) [165.154.208.228]:53358 F= rejected RCPT : Rejected relay attempt: '165.154.208.228' From: 'cozozc@heipowersystem.com' To: 'validxxxg@gmail.com'165.154.208.2281668284/  CS) ossec11309g FTP Authentication success.Feb 17 13:32:38 vm1 pure-ftpd[1995277]: (?@106.219.122.63) [INFO] user@msnews24.in is now logged in106.219.122.631269750 R , pCSc6OBRl,  -g% ossec13001gʿExim Auth failed2025-02-18 05:18:14 dovecot_login authenticator failed for (vandanabalbharti.com) [125.72.54.81]:38554: 535 Incorrect authentication data (set_id=admin@vandanabalbharti.com)125.72.54.811814991Y+  -A% ossec13001gʍExim Auth failed2025-02-18 05:17:24 dovecot_login authenticator failed for (vandanabalbharti.com) [125.72.54.81]:34808: 535 Incorrect authentication data (set_id=nologin)125.72.54.811814991,*  =S) ossec13008g_Mail Reciepient rejected2025-02-18 05:03:49 H=(mail.msnews24.in) [165.154.226.38]:58376 F= rejected RCPT : Rejected relay attempt: '165.154.226.38' From: 'bdrdhsuchkn@msnews24.in' To: 'validxxxg@gmail.com'165.154.226.381668284c)  -Q) ossec13001gExim Auth failed2025-02-18 03:27:23 dovecot_plain authenticator failed for (localhost) [83.217.209.110]:50612: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)83.217.209.1102017370)(  =K+ ossec13008gMail Reciepient rejected2025-02-18 02:56:30 H=(mail.hsnews.in) [165.154.227.103]:64367 F= rejected RCPT : Rejected relay attempt: '165.154.227.103' From: 'gttaqdgykli@hsnews.in' To: 'validxxxg@gmail.com'165.154.227.1031668284l'  QA' ossec11000gDLogin failed on the cpanel service[2025-02-18 01:51:22 +0530] info [whostmgrd] 156.233.95.17 - technoba "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect156.233.95.173469034l&  -g% ossec13001g Exim Auth failed2025-02-18 01:24:51 dovecot_login authenticator failed for (heipowersystem.com) [119.96.131.8]:56066: 535 Incorrect authentication data (set_id=webmaster@heipowersystem.com)119.96.131.81814991W%  -=% ossec13001gExim Auth failed2025-02-18 01:24:27 dovecot_login authenticator failed for (heipowersystem.com) [119.96.131.8]:52924: 535 Incorrect authentication data (set_id=nologin)119.96.131.81814991($  3U) ossec11301gNew FTP connection.Feb 18 00:38:02 vm1 pure-ftpd[2128034]: (?@172.206.143.17) [INFO] New connection from 172.206.143.17172.206.143.176252001"#  3M% ossec11301gNew FTP connection.Feb 18 00:28:31 vm1 pure-ftpd[2126256]: (?@167.99.221.5) [INFO] New connection from 167.99.221.5167.99.221.52750405K"  =+ ossec13008gFMail Reciepient rejected2025-02-18 00:04:44 H=(mail.westerndancecompany.com) [165.154.251.134]:53477 F= rejected RCPT : Rejected relay attempt: '165.154.251.134' From: 'mtcjwyf@westerndancecompany.com' To: 'validxxxg@gmail.com'165.154.251.1341605651!  5)) ossec11011gw.WHM SSO login failed[2025-02-17 23:21:42 +0530] info [whostmgrd] 106.206.184.72 PURGE root:cgYRilaFNnhmvbv6 badpass [cookie ip check: IP address has changed: IP Address [223.229.188.189] != Current IP Address [106.206.184.72]]106.206.184.721269750R  U) ossec11001gw.Deferred login on the cpanel service[2025-02-17 23:21:42 +0530] info [whostmgrd] 106.206.184.72 - root "GET /cpsess7646168172/scripts4/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: cookie ip check: IP address has changed: IP Address [223.229.188.189] != Current IP Address [106.206.184.72]106.206.184.721269750+  3Y+ ossec11301gvNew FTP connection.Feb 17 23:20:22 vm1 pure-ftpd[2108570]: (?@147.185.132.252) [INFO] New connection from 147.185.132.252147.185.132.2526252001=  =w' ossec13008gp8Mail Reciepient rejected2025-02-17 22:51:59 H=(mail.fablixsolutions.com) [152.32.179.47]:54267 F= rejected RCPT : Rejected relay attempt: '152.32.179.47' From: 'havkewnxh@fablixsolutions.com' To: 'validxxxg@gmail.com'152.32.179.471643084` -G+ ossec13001gkExim Auth failed2025-02-17 22:30:04 dovecot_login authenticator failed for (vandanabalbharti.com) [202.107.197.211]:44090: 535 Incorrect authentication data (set_id=nologin)202.107.197.2111814991 w6 0 y ;$,upwu@  Ca' ossec11313gFTP file uploaded to serverFeb 18 09:23:01 vm1 pure-ftpd[2226703]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//foot.php uploaded (3583 bytes, 2772.71KB/sec)122.181.82.621269750%?  3Q' ossec11301gNew FTP connection.Feb 18 09:23:01 vm1 pure-ftpd[2226703]: (?@122.181.82.62) [INFO] New connection from 122.181.82.62122.181.82.6212697503>  C]' ossec11309gFTP Authentication success.Feb 18 09:23:01 vm1 pure-ftpd[2226703]: (?@122.181.82.62) [INFO] militry@technobases.in is now logged in122.181.82.621269750x= Ce' ossec11313gFTP file uploaded to serverFeb 18 09:21:04 vm1 pure-ftpd[2226437]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//index.php uploaded (27246 bytes, 1653.77KB/sec)122.181.82.621269750%<  3Q' ossec11301gNew FTP connection.Feb 18 09:21:04 vm1 pure-ftpd[2226437]: (?@122.181.82.62) [INFO] New connection from 122.181.82.62122.181.82.6212697503;  C]' ossec11309gFTP Authentication success.Feb 18 09:21:04 vm1 pure-ftpd[2226437]: (?@122.181.82.62) [INFO] militry@technobases.in is now logged in122.181.82.621269750t:  C_' ossec11313gmFTP file uploaded to serverFeb 18 09:20:04 vm1 pure-ftpd[2226146]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RIMC.php uploaded (4464 bytes, 607.08KB/sec)122.181.82.621269750%9  3Q' ossec11301gmNew FTP connection.Feb 18 09:20:04 vm1 pure-ftpd[2226146]: (?@122.181.82.62) [INFO] New connection from 122.181.82.62122.181.82.62126975038  C]' ossec11309gmFTP Authentication success.Feb 18 09:20:04 vm1 pure-ftpd[2226146]: (?@122.181.82.62) [INFO] militry@technobases.in is now logged in122.181.82.62126975037  C]' ossec11309gFTP Authentication success.Feb 18 09:17:52 vm1 pure-ftpd[2225672]: (?@122.181.82.62) [INFO] militry@technobases.in is now logged in122.181.82.621269750%6  3Q' ossec11301gNew FTP connection.Feb 18 09:17:52 vm1 pure-ftpd[2225672]: (?@122.181.82.62) [INFO] New connection from 122.181.82.62122.181.82.621269750u5  Ca' ossec11313gFTP file uploaded to serverFeb 18 09:18:08 vm1 pure-ftpd[2225672]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//head.php uploaded (3469 bytes, 1769.05KB/sec)122.181.82.621269750o4  CU' ossec11313gFTP file uploaded to serverFeb 18 09:17:39 vm1 pure-ftpd[2224722]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RIMC.php uploaded (0 bytes, 0.00KB/sec)122.181.82.621269750%3  3Q' ossec11301gNew FTP connection.Feb 18 09:12:53 vm1 pure-ftpd[2224731]: (?@122.181.82.62) [INFO] New connection from 122.181.82.62122.181.82.62126975032  C]' ossec11309gFTP Authentication success.Feb 18 09:12:53 vm1 pure-ftpd[2224731]: (?@122.181.82.62) [INFO] militry@technobases.in is now logged in122.181.82.621269750%1  3Q' ossec11301gNew FTP connection.Feb 18 09:12:45 vm1 pure-ftpd[2224722]: (?@122.181.82.62) [INFO] New connection from 122.181.82.62122.181.82.62126975030  C]' ossec11309gFTP Authentication success.Feb 18 09:12:46 vm1 pure-ftpd[2224722]: (?@122.181.82.62) [INFO] militry@technobases.in is now logged in122.181.82.621269750"/  3M% ossec11301g]New FTP connection.Feb 18 07:03:16 vm1 pure-ftpd[2200575]: (?@203.55.131.5) [INFO] New connection from 203.55.131.5203.55.131.56252001(.  3U) ossec11301g)New FTP connection.Feb 18 06:28:17 vm1 pure-ftpd[2194063]: (?@205.210.31.209) [INFO] New connection from 205.210.31.209205.210.31.2096252001-  W% ossec9708g6Dovecot Aborted Login with empty userFeb 18 06:11:25 vm1 dovecot[945797]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=71.6.134.232, lip=103.74.54.108, TLS, session=71.6.134.2326252001   Y W ^NZ3S  C]' ossec11309g FTP Authentication success.Feb 18 09:35:52 vm1 pure-ftpd[2229332]: (?@122.181.82.62) [INFO] militry@technobases.in is now logged in122.181.82.6212697503R  C]' ossec11309gFTP Authentication success.Feb 18 09:33:56 vm1 pure-ftpd[2228872]: (?@122.181.82.62) [INFO] militry@technobases.in is now logged in122.181.82.621269750%Q  3Q' ossec11301gNew FTP connection.Feb 18 09:33:56 vm1 pure-ftpd[2228872]: (?@122.181.82.62) [INFO] New connection from 122.181.82.62122.181.82.621269750tP  C_' ossec11313gFTP file uploaded to serverFeb 18 09:33:57 vm1 pure-ftpd[2228872]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RIMC.php uploaded (6186 bytes, 129.81KB/sec)122.181.82.621269750uO  Ca' ossec11313gJFTP file uploaded to serverFeb 18 09:32:16 vm1 pure-ftpd[2228272]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RIMC.php uploaded (5848 bytes, 3860.96KB/sec)122.181.82.621269750vN Ca' ossec11313gFTP file uploaded to serverFeb 18 09:30:50 vm1 pure-ftpd[2228272]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RIMC.php uploaded (5482 bytes, 3720.06KB/sec)122.181.82.621269750%M  3Q' ossec11301gNew FTP connection.Feb 18 09:30:50 vm1 pure-ftpd[2228272]: (?@122.181.82.62) [INFO] New connection from 122.181.82.62122.181.82.6212697503L  C]' ossec11309gFTP Authentication success.Feb 18 09:30:50 vm1 pure-ftpd[2228272]: (?@122.181.82.62) [INFO] militry@technobases.in is now logged in122.181.82.621269750uK  Ca' ossec11313gFTP file uploaded to serverFeb 18 09:29:25 vm1 pure-ftpd[2227892]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RIMC.php uploaded (5373 bytes, 3936.29KB/sec)122.181.82.6212697503J  C]' ossec11309gFTP Authentication success.Feb 18 09:29:25 vm1 pure-ftpd[2227892]: (?@122.181.82.62) [INFO] militry@technobases.in is now logged in122.181.82.621269750%I  3Q' ossec11301gNew FTP connection.Feb 18 09:29:25 vm1 pure-ftpd[2227892]: (?@122.181.82.62) [INFO] New connection from 122.181.82.62122.181.82.621269750uH  Ca' ossec11313gDFTP file uploaded to serverFeb 18 09:27:54 vm1 pure-ftpd[2227571]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RIMC.php uploaded (5045 bytes, 4021.86KB/sec)122.181.82.621269750%G  3Q' ossec11301g.New FTP connection.Feb 18 09:27:33 vm1 pure-ftpd[2227571]: (?@122.181.82.62) [INFO] New connection from 122.181.82.62122.181.82.621269750uF  Ca' ossec11313g.FTP file uploaded to serverFeb 18 09:27:33 vm1 pure-ftpd[2227571]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RIMC.php uploaded (5040 bytes, 8471.01KB/sec)122.181.82.6212697503E  C]' ossec11309g.FTP Authentication success.Feb 18 09:27:33 vm1 pure-ftpd[2227571]: (?@122.181.82.62) [INFO] militry@technobases.in is now logged in122.181.82.621269750%D  3Q' ossec11301gNew FTP connection.Feb 18 09:26:31 vm1 pure-ftpd[2227424]: (?@122.181.82.62) [INFO] New connection from 122.181.82.62122.181.82.6212697503C  C]' ossec11309gFTP Authentication success.Feb 18 09:26:31 vm1 pure-ftpd[2227424]: (?@122.181.82.62) [INFO] militry@technobases.in is now logged in122.181.82.621269750uB  Ca' ossec11313gFTP file uploaded to serverFeb 18 09:26:31 vm1 pure-ftpd[2227424]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RIMC.php uploaded (4639 bytes, 3759.66KB/sec)122.181.82.621269750sA  C]' ossec11313gSFTP file uploaded to serverFeb 18 09:23:55 vm1 pure-ftpd[2226703]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RIMC.php uploaded (4468 bytes, 97.88KB/sec)122.181.82.621269750 =~qdWJ=0# zm`SF9, v i \ O B 5 (     r e X K > 1 $  { n a T G : -   w j ] P C 6 )    s f Y L ? 2 %  |obUH;.!xk^QD7*tgZM@3& }pcVI</"yl_RE8+uh[NA4' ~qdWJ=0 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750~ 1269750} 1269750| 1269750{ 1269750z 1269750y 1269750x 1269750w 1269750v 1269750u 1269750t 1269750s 1269750r 1269750q 1269750p 1269750o 1269750n 1269750m 1269750l 1269750k 1269750j 1269750i 1269750h 1269750g 1269750f 1269750e 1269750d 1269750c 1269750b 1269750a 1269750` 1269750_ 1269750^ 1269750] 1269750[ 1269750Z 1269750Y 1269750X 1269750W 1269750V 1269750U 1269750T 1269750S 1269750R 1269750Q 1269750P 1269750O 1269750N 1269750M 1269750L 1269750K 1269750J 1269750I 1269750H 1269750G 1269750F 1269750E 1269750D 1269750C 1269750B 1269750A 1269750? 1269750= 1269750< 1269750; 1269750: 12697509 12697508 12697507 12697506 12697505 12697504 12697503 12697502 12697501 12697500 1269750/ 1269750. 1269750- 1269750, 1269750+ 1269750* 1269750) 1269750( 1269750' 1269750& 1269750% 1269750$ 1269750# 1269750" 1269750! 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750| 1269750{ 1269750z 1269750y 1269750x 1269750w 1269750v 1269750r 1269750q 1269750p 1269750o 1269750n 1269750m 1269750l 1269750k 1269750j 1269750i 1269750h 1269750g 1269750f 1269750e 1269750d 1269750c 1269750b 1269750a 1269750` 1269750_ 1269750^ 1269750] 1269750\ 1269750[ 1269750Z 1269750Y 1269750X 1269750W 1269750V 1269750U 1269750S 1269750R ^  U _g^3f  C]' ossec11309g ;FTP Authentication success.Feb 18 09:53:21 vm1 pure-ftpd[2232589]: (?@122.181.82.62) [INFO] militry@technobases.in is now logged in122.181.82.621269750ue  Ca' ossec11313g ;FTP file uploaded to serverFeb 18 09:53:21 vm1 pure-ftpd[2232589]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RIMC.php uploaded (8318 bytes, 4878.37KB/sec)122.181.82.621269750%d  3Q' ossec11301g ;New FTP connection.Feb 18 09:53:21 vm1 pure-ftpd[2232589]: (?@122.181.82.62) [INFO] New connection from 122.181.82.62122.181.82.6212697503c  C]' ossec11309g FTP Authentication success.Feb 18 09:46:38 vm1 pure-ftpd[2231430]: (?@122.181.82.62) [INFO] militry@technobases.in is now logged in122.181.82.621269750%b  3Q' ossec11301g New FTP connection.Feb 18 09:46:38 vm1 pure-ftpd[2231430]: (?@122.181.82.62) [INFO] New connection from 122.181.82.62122.181.82.621269750%a  3Q' ossec11301g aNew FTP connection.Feb 18 09:45:29 vm1 pure-ftpd[2231264]: (?@122.181.82.62) [INFO] New connection from 122.181.82.62122.181.82.621269750t`  C_' ossec11313g cFTP file uploaded to serverFeb 18 09:45:29 vm1 pure-ftpd[2231264]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RIMC.php uploaded (7521 bytes, 113.19KB/sec)122.181.82.6212697503_  C]' ossec11309g cFTP Authentication success.Feb 18 09:45:29 vm1 pure-ftpd[2231264]: (?@122.181.82.62) [INFO] militry@technobases.in is now logged in122.181.82.621269750^  3I# ossec11301g|New FTP connection.Feb 18 09:41:39 vm1 pure-ftpd[2230476]: (?@71.6.232.23) [INFO] New connection from 71.6.232.2371.6.232.236252001u]  Ca' ossec11313gnFTP file uploaded to serverFeb 18 09:41:26 vm1 pure-ftpd[2229959]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RIMC.php uploaded (6744 bytes, 3791.82KB/sec)122.181.82.621269750v\ Ca' ossec11313gFTP file uploaded to serverFeb 18 09:39:50 vm1 pure-ftpd[2229959]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RIMC.php uploaded (6463 bytes, 3689.03KB/sec)122.181.82.621269750%[  3Q' ossec11301gNew FTP connection.Feb 18 09:39:20 vm1 pure-ftpd[2229959]: (?@122.181.82.62) [INFO] New connection from 122.181.82.62122.181.82.6212697503Z  C]' ossec11309gFTP Authentication success.Feb 18 09:39:20 vm1 pure-ftpd[2229959]: (?@122.181.82.62) [INFO] militry@technobases.in is now logged in122.181.82.621269750uY  Ca' ossec11313gFTP file uploaded to serverFeb 18 09:39:20 vm1 pure-ftpd[2229959]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RIMC.php uploaded (6439 bytes, 4059.43KB/sec)122.181.82.621269750uX  Ca' ossec11313gpFTP file uploaded to serverFeb 18 09:37:12 vm1 pure-ftpd[2229622]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RIMC.php uploaded (6392 bytes, 4170.38KB/sec)122.181.82.621269750%W  3Q' ossec11301gpNew FTP connection.Feb 18 09:37:12 vm1 pure-ftpd[2229622]: (?@122.181.82.62) [INFO] New connection from 122.181.82.62122.181.82.6212697503V  C]' ossec11309gpFTP Authentication success.Feb 18 09:37:12 vm1 pure-ftpd[2229622]: (?@122.181.82.62) [INFO] militry@technobases.in is now logged in122.181.82.621269750%U  3Q' ossec11301g New FTP connection.Feb 18 09:35:52 vm1 pure-ftpd[2229332]: (?@122.181.82.62) [INFO] New connection from 122.181.82.62122.181.82.621269750uT  Ca' ossec11313g FTP file uploaded to serverFeb 18 09:35:52 vm1 pure-ftpd[2229332]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RIMC.php uploaded (6326 bytes, 3954.72KB/sec)122.181.82.621269750 ^^ V ]d a^3y  C]' ossec11309gFTP Authentication success.Feb 18 10:14:04 vm1 pure-ftpd[2236632]: (?@122.181.82.62) [INFO] militry@technobases.in is now logged in122.181.82.621269750%x  3Q' ossec11301gNew FTP connection.Feb 18 10:14:04 vm1 pure-ftpd[2236632]: (?@122.181.82.62) [INFO] New connection from 122.181.82.62122.181.82.621269750vw Ca' ossec11313gFTP file uploaded to serverFeb 18 10:12:00 vm1 pure-ftpd[2236222]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RIMC.php uploaded (9611 bytes, 5272.79KB/sec)122.181.82.621269750%v  3Q' ossec11301gNew FTP connection.Feb 18 10:11:59 vm1 pure-ftpd[2236222]: (?@122.181.82.62) [INFO] New connection from 122.181.82.62122.181.82.6212697503u  C]' ossec11309gFTP Authentication success.Feb 18 10:12:00 vm1 pure-ftpd[2236222]: (?@122.181.82.62) [INFO] militry@technobases.in is now logged in122.181.82.621269750vt Ca' ossec11313gFTP file uploaded to serverFeb 18 10:09:51 vm1 pure-ftpd[2235528]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RIMC.php uploaded (9202 bytes, 5248.77KB/sec)122.181.82.621269750us  Ca' ossec11313gFTP file uploaded to serverFeb 18 10:08:59 vm1 pure-ftpd[2235528]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RIMC.php uploaded (9131 bytes, 5531.81KB/sec)122.181.82.6212697503r  C]' ossec11309gFTP Authentication success.Feb 18 10:08:30 vm1 pure-ftpd[2235528]: (?@122.181.82.62) [INFO] militry@technobases.in is now logged in122.181.82.621269750uq  Ca' ossec11313gFTP file uploaded to serverFeb 18 10:08:30 vm1 pure-ftpd[2235528]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RIMC.php uploaded (9131 bytes, 4728.26KB/sec)122.181.82.621269750%p  3Q' ossec11301gNew FTP connection.Feb 18 10:08:30 vm1 pure-ftpd[2235528]: (?@122.181.82.62) [INFO] New connection from 122.181.82.62122.181.82.621269750uo  Ca' ossec11313g FTP file uploaded to serverFeb 18 10:01:15 vm1 pure-ftpd[2234033]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RIMC.php uploaded (9000 bytes, 4486.31KB/sec)122.181.82.621269750un  Ca' ossec11313g FTP file uploaded to serverFeb 18 10:00:33 vm1 pure-ftpd[2234033]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RIMC.php uploaded (8852 bytes, 4181.98KB/sec)122.181.82.621269750%m  3Q' ossec11301g New FTP connection.Feb 18 10:00:33 vm1 pure-ftpd[2234033]: (?@122.181.82.62) [INFO] New connection from 122.181.82.62122.181.82.6212697503l  C]' ossec11309g FTP Authentication success.Feb 18 10:00:33 vm1 pure-ftpd[2234033]: (?@122.181.82.62) [INFO] militry@technobases.in is now logged in122.181.82.621269750uk  Ca' ossec11313g FTP file uploaded to serverFeb 18 09:59:27 vm1 pure-ftpd[2233405]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RIMC.php uploaded (8789 bytes, 5315.18KB/sec)122.181.82.621269750tj  C_' ossec11313g oFTP file uploaded to serverFeb 18 09:58:31 vm1 pure-ftpd[2233405]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RIMC.php uploaded (8479 bytes, 165.68KB/sec)122.181.82.6212697503i  C]' ossec11309g oFTP Authentication success.Feb 18 09:58:31 vm1 pure-ftpd[2233405]: (?@122.181.82.62) [INFO] militry@technobases.in is now logged in122.181.82.621269750%h  3Q' ossec11301g oNew FTP connection.Feb 18 09:58:31 vm1 pure-ftpd[2233405]: (?@122.181.82.62) [INFO] New connection from 122.181.82.62122.181.82.621269750ug  Ca' ossec11313g _FTP file uploaded to serverFeb 18 09:53:58 vm1 pure-ftpd[2232589]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RIMC.php uploaded (8329 bytes, 4315.15KB/sec)122.181.82.621269750 O ] kv  Cc' ossec11313gFTP file uploaded to serverFeb 18 10:47:06 vm1 pure-ftpd[2242800]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RIMC.php uploaded (12676 bytes, 6344.97KB/sec)122.181.82.6212697503  C]' ossec11309gFTP Authentication success.Feb 18 10:47:06 vm1 pure-ftpd[2242800]: (?@122.181.82.62) [INFO] militry@technobases.in is now logged in122.181.82.621269750%  3Q' ossec11301gNew FTP connection.Feb 18 10:47:06 vm1 pure-ftpd[2242800]: (?@122.181.82.62) [INFO] New connection from 122.181.82.62122.181.82.621269750v  Cc' ossec11313grFTP file uploaded to serverFeb 18 10:45:28 vm1 pure-ftpd[2241882]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RIMC.php uploaded (12283 bytes, 5802.90KB/sec)122.181.82.621269750w Cc' ossec11313gFTP file uploaded to serverFeb 18 10:44:04 vm1 pure-ftpd[2241882]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RIMC.php uploaded (11964 bytes, 3750.83KB/sec)122.181.82.621269750v  Cc' ossec11313gFTP file uploaded to serverFeb 18 10:43:18 vm1 pure-ftpd[2241882]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RIMC.php uploaded (11909 bytes, 7982.21KB/sec)122.181.82.621269750v  Cc' ossec11313gFTP file uploaded to serverFeb 18 10:42:31 vm1 pure-ftpd[2241882]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RIMC.php uploaded (11594 bytes, 5703.70KB/sec)122.181.82.6212697503  C]' ossec11309gFTP Authentication success.Feb 18 10:42:31 vm1 pure-ftpd[2241882]: (?@122.181.82.62) [INFO] militry@technobases.in is now logged in122.181.82.621269750%  3Q' ossec11301gNew FTP connection.Feb 18 10:42:31 vm1 pure-ftpd[2241882]: (?@122.181.82.62) [INFO] New connection from 122.181.82.62122.181.82.621269750%  3Q' ossec11301g-New FTP connection.Feb 18 10:18:43 vm1 pure-ftpd[2237525]: (?@122.181.82.62) [INFO] New connection from 122.181.82.62122.181.82.621269750u  Ca' ossec11313g-FTP file uploaded to serverFeb 18 10:18:43 vm1 pure-ftpd[2237525]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RIMC.php uploaded (11540 bytes, 210.15KB/sec)122.181.82.6212697503  C]' ossec11309g-FTP Authentication success.Feb 18 10:18:43 vm1 pure-ftpd[2237525]: (?@122.181.82.62) [INFO] militry@technobases.in is now logged in122.181.82.621269750w Cc' ossec11313gFTP file uploaded to serverFeb 18 10:16:49 vm1 pure-ftpd[2236987]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RIMC.php uploaded (11312 bytes, 4381.88KB/sec)122.181.82.621269750v~  Cc' ossec11313gFTP file uploaded to serverFeb 18 10:16:04 vm1 pure-ftpd[2236987]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RIMC.php uploaded (10908 bytes, 6612.28KB/sec)122.181.82.621269750w}  Ce' ossec11313gdFTP file uploaded to serverFeb 18 10:15:23 vm1 pure-ftpd[2236987]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RIMC.php uploaded (10370 bytes, 18686.99KB/sec)122.181.82.621269750%|  3Q' ossec11301gdNew FTP connection.Feb 18 10:15:23 vm1 pure-ftpd[2236987]: (?@122.181.82.62) [INFO] New connection from 122.181.82.62122.181.82.6212697503{  C]' ossec11309gdFTP Authentication success.Feb 18 10:15:23 vm1 pure-ftpd[2236987]: (?@122.181.82.62) [INFO] militry@technobases.in is now logged in122.181.82.621269750vz  Cc' ossec11313gFTP file uploaded to serverFeb 18 10:14:05 vm1 pure-ftpd[2236632]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RIMC.php uploaded (10263 bytes, 6580.66KB/sec)122.181.82.621269750 W  Y_Nu  Ca' ossec11313gFTP file uploaded to serverFeb 18 11:03:05 vm1 pure-ftpd[2245509]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RIMC.php uploaded (15544 bytes, 824.27KB/sec)122.181.82.621269750u  Ca' ossec11313g_FTP file uploaded to serverFeb 18 11:02:13 vm1 pure-ftpd[2245509]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RIMC.php uploaded (15474 bytes, 807.96KB/sec)122.181.82.621269750t  C_' ossec11313g1FTP file uploaded to serverFeb 18 11:01:27 vm1 pure-ftpd[2245509]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RIMC.php uploaded (15300 bytes, 36.16KB/sec)122.181.82.621269750v Ca' ossec11313gFTP file uploaded to serverFeb 18 11:00:02 vm1 pure-ftpd[2245509]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RIMC.php uploaded (14858 bytes, 926.84KB/sec)122.181.82.621269750%  3Q' ossec11301gNew FTP connection.Feb 18 11:00:02 vm1 pure-ftpd[2245509]: (?@122.181.82.62) [INFO] New connection from 122.181.82.62122.181.82.6212697503  C]' ossec11309gFTP Authentication success.Feb 18 11:00:02 vm1 pure-ftpd[2245509]: (?@122.181.82.62) [INFO] militry@technobases.in is now logged in122.181.82.621269750%  3Q' ossec11301gNew FTP connection.Feb 18 10:58:32 vm1 pure-ftpd[2244801]: (?@122.181.82.62) [INFO] New connection from 122.181.82.62122.181.82.621269750v  Cc' ossec11313gFTP file uploaded to serverFeb 18 10:58:32 vm1 pure-ftpd[2244801]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RIMC.php uploaded (14540 bytes, 7733.52KB/sec)122.181.82.6212697503  C]' ossec11309gFTP Authentication success.Feb 18 10:58:32 vm1 pure-ftpd[2244801]: (?@122.181.82.62) [INFO] militry@technobases.in is now logged in122.181.82.621269750v  Cc' ossec11313gFTP file uploaded to serverFeb 18 10:54:57 vm1 pure-ftpd[2244181]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RIMC.php uploaded (14304 bytes, 5765.52KB/sec)122.181.82.621269750%  3Q' ossec11301gNew FTP connection.Feb 18 10:54:57 vm1 pure-ftpd[2244181]: (?@122.181.82.62) [INFO] New connection from 122.181.82.62122.181.82.6212697503  C]' ossec11309gFTP Authentication success.Feb 18 10:54:57 vm1 pure-ftpd[2244181]: (?@122.181.82.62) [INFO] militry@technobases.in is now logged in122.181.82.621269750v  Cc' ossec11313g4FTP file uploaded to serverFeb 18 10:53:00 vm1 pure-ftpd[2243540]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RIMC.php uploaded (13971 bytes, 7284.27KB/sec)122.181.82.621269750v  Cc' ossec11313gFTP file uploaded to serverFeb 18 10:52:01 vm1 pure-ftpd[2243540]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RIMC.php uploaded (13601 bytes, 6724.98KB/sec)122.181.82.621269750u  Ca' ossec11313gFTP file uploaded to serverFeb 18 10:51:19 vm1 pure-ftpd[2243540]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RIMC.php uploaded (13237 bytes, 197.98KB/sec)122.181.82.621269750v  Cc' ossec11313gFTP file uploaded to serverFeb 18 10:50:27 vm1 pure-ftpd[2243540]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RIMC.php uploaded (12896 bytes, 6485.21KB/sec)122.181.82.6212697503  C]' ossec11309gFTP Authentication success.Feb 18 10:50:27 vm1 pure-ftpd[2243540]: (?@122.181.82.62) [INFO] militry@technobases.in is now logged in122.181.82.621269750%  3Q' ossec11301gNew FTP connection.Feb 18 10:50:26 vm1 pure-ftpd[2243540]: (?@122.181.82.62) [INFO] New connection from 122.181.82.62122.181.82.621269750 O U fnt.  5') ossec11011gWHM SSO login failed[2025-02-18 11:21:44 +0530] info [whostmgrd] 106.206.152.65 PURGE root:O900DSYXByl8y_D0 badpass [cookie ip check: IP address has changed: IP Address [106.206.184.72] != Current IP Address [106.206.152.65]]106.206.152.651269750P- U) ossec11001gDeferred login on the cpanel service[2025-02-18 11:21:37 +0530] info [whostmgrd] 106.206.152.65 - root "GET /cpsess9881766301/json-api/loadavg HTTP/1.1" DEFERRED LOGIN whostmgrd: cookie ip check: IP address has changed: IP Address [106.206.184.72] != Current IP Address [106.206.152.65]106.206.152.651269750v,  Cc' ossec11313gFTP file uploaded to serverFeb 18 11:20:37 vm1 pure-ftpd[2250654]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RIMC.php uploaded (18568 bytes, 1070.35KB/sec)122.181.82.6212697503+  C]' ossec11309gFTP Authentication success.Feb 18 11:20:37 vm1 pure-ftpd[2250654]: (?@122.181.82.62) [INFO] militry@technobases.in is now logged in122.181.82.621269750%*  3Q' ossec11301gNew FTP connection.Feb 18 11:20:36 vm1 pure-ftpd[2250654]: (?@122.181.82.62) [INFO] New connection from 122.181.82.62122.181.82.621269750v)  Cc' ossec11313g8FTP file uploaded to serverFeb 18 11:18:39 vm1 pure-ftpd[2250024]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RIMC.php uploaded (17928 bytes, 1221.42KB/sec)122.181.82.621269750t(  C_' ossec11313gFTP file uploaded to serverFeb 18 11:17:41 vm1 pure-ftpd[2250024]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RIMC.php uploaded (17786 bytes, 42.04KB/sec)122.181.82.6212697503'  C]' ossec11309gFTP Authentication success.Feb 18 11:17:41 vm1 pure-ftpd[2250024]: (?@122.181.82.62) [INFO] militry@technobases.in is now logged in122.181.82.621269750%&  3Q' ossec11301gNew FTP connection.Feb 18 11:17:41 vm1 pure-ftpd[2250024]: (?@122.181.82.62) [INFO] New connection from 122.181.82.62122.181.82.621269750v%  Cc' ossec11313g'FTP file uploaded to serverFeb 18 11:09:49 vm1 pure-ftpd[2246749]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RIMC.php uploaded (17647 bytes, 1400.65KB/sec)122.181.82.621269750v$  Cc' ossec11313gFTP file uploaded to serverFeb 18 11:08:54 vm1 pure-ftpd[2246749]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RIMC.php uploaded (16922 bytes, 1204.47KB/sec)122.181.82.621269750u#  Ca' ossec11313gFTP file uploaded to serverFeb 18 11:08:04 vm1 pure-ftpd[2246749]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RIMC.php uploaded (16509 bytes, 943.79KB/sec)122.181.82.621269750u"  Ca' ossec11313gFTP file uploaded to serverFeb 18 11:07:04 vm1 pure-ftpd[2246749]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RIMC.php uploaded (16423 bytes, 826.07KB/sec)122.181.82.621269750%!  3Q' ossec11301g9New FTP connection.Feb 18 11:05:51 vm1 pure-ftpd[2246749]: (?@122.181.82.62) [INFO] New connection from 122.181.82.62122.181.82.621269750v Ca' ossec11313g9FTP file uploaded to serverFeb 18 11:05:52 vm1 pure-ftpd[2246749]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RIMC.php uploaded (16067 bytes, 762.85KB/sec)122.181.82.6212697503  C]' ossec11309g9FTP Authentication success.Feb 18 11:05:51 vm1 pure-ftpd[2246749]: (?@122.181.82.62) [INFO] militry@technobases.in is now logged in122.181.82.621269750v Ca' ossec11313gFTP file uploaded to serverFeb 18 11:04:01 vm1 pure-ftpd[2245509]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RIMC.php uploaded (15712 bytes, 965.33KB/sec)122.181.82.621269750 WO F L OW3A  C]' ossec11309g#FTP Authentication success.Feb 18 11:38:58 vm1 pure-ftpd[2254217]: (?@122.181.82.62) [INFO] militry@technobases.in is now logged in122.181.82.621269750%@  3Q' ossec11301g#New FTP connection.Feb 18 11:38:58 vm1 pure-ftpd[2254217]: (?@122.181.82.62) [INFO] New connection from 122.181.82.62122.181.82.621269750v?  Cc' ossec11313g#FTP file uploaded to serverFeb 18 11:38:58 vm1 pure-ftpd[2254217]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RIMC.php uploaded (21290 bytes, 1180.76KB/sec)122.181.82.621269750v>  Cc' ossec11313g"kFTP file uploaded to serverFeb 18 11:32:17 vm1 pure-ftpd[2252522]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RIMC.php uploaded (21223 bytes, 1500.98KB/sec)122.181.82.621269750w= Cc' ossec11313g"+FTP file uploaded to serverFeb 18 11:31:14 vm1 pure-ftpd[2252522]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RIMC.php uploaded (20955 bytes, 1562.96KB/sec)122.181.82.621269750v<  Cc' ossec11313g!FTP file uploaded to serverFeb 18 11:30:18 vm1 pure-ftpd[2252522]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RIMC.php uploaded (20846 bytes, 1142.46KB/sec)122.181.82.621269750t;  C_' ossec11313g!FTP file uploaded to serverFeb 18 11:29:38 vm1 pure-ftpd[2252522]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RIMC.php uploaded (20805 bytes, 46.94KB/sec)122.181.82.6212697503:  C]' ossec11309g!FTP Authentication success.Feb 18 11:29:37 vm1 pure-ftpd[2252522]: (?@122.181.82.62) [INFO] militry@technobases.in is now logged in122.181.82.621269750%9  3Q' ossec11301g!New FTP connection.Feb 18 11:29:37 vm1 pure-ftpd[2252522]: (?@122.181.82.62) [INFO] New connection from 122.181.82.62122.181.82.621269750v8  Cc' ossec11313g!CFTP file uploaded to serverFeb 18 11:27:20 vm1 pure-ftpd[2251967]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RIMC.php uploaded (20613 bytes, 1233.83KB/sec)122.181.82.621269750v7  Cc' ossec11313g! FTP file uploaded to serverFeb 18 11:26:27 vm1 pure-ftpd[2251967]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RIMC.php uploaded (20617 bytes, 1709.15KB/sec)122.181.82.62126975036  C]' ossec11309g! FTP Authentication success.Feb 18 11:26:27 vm1 pure-ftpd[2251967]: (?@122.181.82.62) [INFO] militry@technobases.in is now logged in122.181.82.621269750%5  3Q' ossec11301g! New FTP connection.Feb 18 11:26:27 vm1 pure-ftpd[2251967]: (?@122.181.82.62) [INFO] New connection from 122.181.82.62122.181.82.621269750v4  Cc' ossec11313g FTP file uploaded to serverFeb 18 11:24:55 vm1 pure-ftpd[2251524]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RIMC.php uploaded (19962 bytes, 1246.27KB/sec)122.181.82.62126975033  C]' ossec11309g FTP Authentication success.Feb 18 11:24:55 vm1 pure-ftpd[2251524]: (?@122.181.82.62) [INFO] militry@technobases.in is now logged in122.181.82.621269750%2  3Q' ossec11301g New FTP connection.Feb 18 11:24:55 vm1 pure-ftpd[2251524]: (?@122.181.82.62) [INFO] New connection from 122.181.82.62122.181.82.621269750%1  3Q' ossec11301g ,New FTP connection.Feb 18 11:22:43 vm1 pure-ftpd[2251151]: (?@122.181.82.62) [INFO] New connection from 122.181.82.62122.181.82.62126975030  C]' ossec11309g ,FTP Authentication success.Feb 18 11:22:43 vm1 pure-ftpd[2251151]: (?@122.181.82.62) [INFO] militry@technobases.in is now logged in122.181.82.621269750v/  Cc' ossec11313g ,FTP file uploaded to serverFeb 18 11:22:43 vm1 pure-ftpd[2251151]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RIMC.php uploaded (18924 bytes, 1073.14KB/sec)122.181.82.621269750  I H N T Z_NTm %S  3Q' ossec11301g&New FTP connection.Feb 18 11:50:27 vm1 pure-ftpd[2256759]: (?@122.181.82.62) [INFO] New connection from 122.181.82.62122.181.82.6212697503R  C]' ossec11309g&FTP Authentication success.Feb 18 11:50:27 vm1 pure-ftpd[2256759]: (?@122.181.82.62) [INFO] militry@technobases.in is now logged in122.181.82.621269750%Q  3Q' ossec11301g&hNew FTP connection.Feb 18 11:49:18 vm1 pure-ftpd[2256404]: (?@122.181.82.62) [INFO] New connection from 122.181.82.62122.181.82.621269750:P  =m+ ossec13008g&fMail Reciepient rejected2025-02-18 11:49:17 H=(mail.heipowersystem.com) [165.154.247.226]:65294 F= rejected RCPT : Rejected relay attempt: '165.154.247.226' From: 'ynyfpw@heipowersystem.com' To: 'validxxxg@gmail.com'165.154.247.2261605651vO  Cc' ossec11313g&hFTP file uploaded to serverFeb 18 11:49:18 vm1 pure-ftpd[2256404]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RIMC.php uploaded (23098 bytes, 1590.61KB/sec)122.181.82.6212697503N  C]' ossec11309g&hFTP Authentication success.Feb 18 11:49:18 vm1 pure-ftpd[2256404]: (?@122.181.82.62) [INFO] militry@technobases.in is now logged in122.181.82.621269750vM  Cc' ossec11313g%FTP file uploaded to serverFeb 18 11:46:05 vm1 pure-ftpd[2255767]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RIMC.php uploaded (22658 bytes, 1333.67KB/sec)122.181.82.621269750%L  3Q' ossec11301g%New FTP connection.Feb 18 11:46:05 vm1 pure-ftpd[2255767]: (?@122.181.82.62) [INFO] New connection from 122.181.82.62122.181.82.6212697503K  C]' ossec11309g%FTP Authentication success.Feb 18 11:46:05 vm1 pure-ftpd[2255767]: (?@122.181.82.62) [INFO] militry@technobases.in is now logged in122.181.82.621269750wJ Cc' ossec11313g%%FTP file uploaded to serverFeb 18 11:43:57 vm1 pure-ftpd[2254951]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RIMC.php uploaded (22264 bytes, 1347.10KB/sec)122.181.82.621269750vI  Cc' ossec11313g$FTP file uploaded to serverFeb 18 11:43:05 vm1 pure-ftpd[2254951]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RIMC.php uploaded (22178 bytes, 1314.77KB/sec)122.181.82.621269750vH  Cc' ossec11313g$FTP file uploaded to serverFeb 18 11:42:28 vm1 pure-ftpd[2254951]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RIMC.php uploaded (21944 bytes, 1256.22KB/sec)122.181.82.621269750vG  Cc' ossec11313g$FTP file uploaded to serverFeb 18 11:41:42 vm1 pure-ftpd[2254951]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RIMC.php uploaded (21874 bytes, 1541.78KB/sec)122.181.82.6212697503F  C]' ossec11309g$FTP Authentication success.Feb 18 11:41:41 vm1 pure-ftpd[2254951]: (?@122.181.82.62) [INFO] militry@technobases.in is now logged in122.181.82.621269750%E  3Q' ossec11301g$New FTP connection.Feb 18 11:41:41 vm1 pure-ftpd[2254951]: (?@122.181.82.62) [INFO] New connection from 122.181.82.62122.181.82.621269750tD  C_' ossec11313g$=FTP file uploaded to serverFeb 18 11:40:05 vm1 pure-ftpd[2254681]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RIMC.php uploaded (21638 bytes, 49.81KB/sec)122.181.82.621269750%C  3Q' ossec11301g$=New FTP connection.Feb 18 11:40:04 vm1 pure-ftpd[2254681]: (?@122.181.82.62) [INFO] New connection from 122.181.82.62122.181.82.6212697503B  C]' ossec11309g$=FTP Authentication success.Feb 18 11:40:04 vm1 pure-ftpd[2254681]: (?@122.181.82.62) [INFO] militry@technobases.in is now logged in122.181.82.621269750 Q W N T QEMS%f  3Q' ossec11301g)pNew FTP connection.Feb 18 12:02:15 vm1 pure-ftpd[2259126]: (?@122.181.82.62) [INFO] New connection from 122.181.82.62122.181.82.621269750ve  Cc' ossec11313g),FTP file uploaded to serverFeb 18 12:01:08 vm1 pure-ftpd[2258197]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RIMC.php uploaded (24981 bytes, 1756.33KB/sec)122.181.82.621269750td  C_' ossec11313g)FTP file uploaded to serverFeb 18 12:00:31 vm1 pure-ftpd[2258197]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RIMC.php uploaded (24759 bytes, 56.98KB/sec)122.181.82.6212697503c  C]' ossec11309g(FTP Authentication success.Feb 18 11:58:56 vm1 pure-ftpd[2258197]: (?@122.181.82.62) [INFO] militry@technobases.in is now logged in122.181.82.621269750wb Cc' ossec11313g(FTP file uploaded to serverFeb 18 11:58:56 vm1 pure-ftpd[2258197]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RIMC.php uploaded (24366 bytes, 1641.61KB/sec)122.181.82.621269750%a  3Q' ossec11301g(New FTP connection.Feb 18 11:58:56 vm1 pure-ftpd[2258197]: (?@122.181.82.62) [INFO] New connection from 122.181.82.62122.181.82.621269750v` Ca' ossec11313g(NFTP file uploaded to serverFeb 18 11:57:26 vm1 pure-ftpd[2257970]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RIMC.php uploaded (24271 bytes, 815.80KB/sec)122.181.82.6212697503_  C]' ossec11309g(NFTP Authentication success.Feb 18 11:57:25 vm1 pure-ftpd[2257970]: (?@122.181.82.62) [INFO] militry@technobases.in is now logged in122.181.82.621269750%^  3Q' ossec11301g(NNew FTP connection.Feb 18 11:57:25 vm1 pure-ftpd[2257970]: (?@122.181.82.62) [INFO] New connection from 122.181.82.62122.181.82.621269750v]  Cc' ossec11313g'FTP file uploaded to serverFeb 18 11:55:06 vm1 pure-ftpd[2257662]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RIMC.php uploaded (24051 bytes, 1761.99KB/sec)122.181.82.621269750%\  3Q' ossec11301g'New FTP connection.Feb 18 11:55:06 vm1 pure-ftpd[2257662]: (?@122.181.82.62) [INFO] New connection from 122.181.82.62122.181.82.6212697503[  C]' ossec11309g'FTP Authentication success.Feb 18 11:55:06 vm1 pure-ftpd[2257662]: (?@122.181.82.62) [INFO] militry@technobases.in is now logged in122.181.82.621269750vZ  Cc' ossec11313g'FTP file uploaded to serverFeb 18 11:53:59 vm1 pure-ftpd[2257351]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RIMC.php uploaded (23752 bytes, 1407.99KB/sec)122.181.82.621269750%Y  3Q' ossec11301g'New FTP connection.Feb 18 11:53:58 vm1 pure-ftpd[2257351]: (?@122.181.82.62) [INFO] New connection from 122.181.82.62122.181.82.6212697503X  C]' ossec11309g'FTP Authentication success.Feb 18 11:53:59 vm1 pure-ftpd[2257351]: (?@122.181.82.62) [INFO] militry@technobases.in is now logged in122.181.82.621269750%W  3Q' ossec11301g' New FTP connection.Feb 18 11:52:01 vm1 pure-ftpd[2256980]: (?@122.181.82.62) [INFO] New connection from 122.181.82.62122.181.82.621269750vV  Cc' ossec11313g' FTP file uploaded to serverFeb 18 11:52:01 vm1 pure-ftpd[2256980]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RIMC.php uploaded (23423 bytes, 1731.28KB/sec)122.181.82.6212697503U  C]' ossec11309g' FTP Authentication success.Feb 18 11:52:01 vm1 pure-ftpd[2256980]: (?@122.181.82.62) [INFO] militry@technobases.in is now logged in122.181.82.621269750tT  C_' ossec11313g&FTP file uploaded to serverFeb 18 11:50:28 vm1 pure-ftpd[2256759]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RIMC.php uploaded (23178 bytes, 53.72KB/sec)122.181.82.621269750 IO U Z ` e k c `f3x  C]' ossec11309g-FTP Authentication success.Feb 18 12:17:28 vm1 pure-ftpd[2262245]: (?@122.181.82.62) [INFO] militry@technobases.in is now logged in122.181.82.621269750vw  Cc' ossec11313g,}FTP file uploaded to serverFeb 18 12:15:16 vm1 pure-ftpd[2261947]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RIMC.php uploaded (27299 bytes, 1781.68KB/sec)122.181.82.621269750%v  3Q' ossec11301g,}New FTP connection.Feb 18 12:15:15 vm1 pure-ftpd[2261947]: (?@122.181.82.62) [INFO] New connection from 122.181.82.62122.181.82.6212697503u  C]' ossec11309g,}FTP Authentication success.Feb 18 12:15:15 vm1 pure-ftpd[2261947]: (?@122.181.82.62) [INFO] militry@technobases.in is now logged in122.181.82.621269750vt Ca' ossec11313g+FTP file uploaded to serverFeb 18 12:11:57 vm1 pure-ftpd[2261124]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RIMC.php uploaded (27023 bytes, 529.75KB/sec)122.181.82.621269750%s  3Q' ossec11301g+New FTP connection.Feb 18 12:11:25 vm1 pure-ftpd[2261124]: (?@122.181.82.62) [INFO] New connection from 122.181.82.62122.181.82.6212697503r  C]' ossec11309g+FTP Authentication success.Feb 18 12:11:25 vm1 pure-ftpd[2261124]: (?@122.181.82.62) [INFO] militry@technobases.in is now logged in122.181.82.621269750tq  C_' ossec11313g+FTP file uploaded to serverFeb 18 12:11:26 vm1 pure-ftpd[2261124]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RIMC.php uploaded (26992 bytes, 63.56KB/sec)122.181.82.621269750up  Ca' ossec11313g+-FTP file uploaded to serverFeb 18 12:09:39 vm1 pure-ftpd[2260667]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RIMC.php uploaded (26882 bytes, 920.19KB/sec)122.181.82.6212697503o  C]' ossec11309g+-FTP Authentication success.Feb 18 12:09:39 vm1 pure-ftpd[2260667]: (?@122.181.82.62) [INFO] militry@technobases.in is now logged in122.181.82.621269750%n  3Q' ossec11301g+-New FTP connection.Feb 18 12:09:39 vm1 pure-ftpd[2260667]: (?@122.181.82.62) [INFO] New connection from 122.181.82.62122.181.82.621269750vm  Cc' ossec11313g*FTP file uploaded to serverFeb 18 12:07:02 vm1 pure-ftpd[2259126]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RIMC.php uploaded (26783 bytes, 1973.97KB/sec)122.181.82.621269750wl Cc' ossec11313g*GFTP file uploaded to serverFeb 18 12:05:49 vm1 pure-ftpd[2259126]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RIMC.php uploaded (26161 bytes, 1921.45KB/sec)122.181.82.621269750vk  Cc' ossec11313g*%FTP file uploaded to serverFeb 18 12:05:15 vm1 pure-ftpd[2259126]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RIMC.php uploaded (25964 bytes, 1350.78KB/sec)122.181.82.621269750wj Cc' ossec11313g)FTP file uploaded to serverFeb 18 12:03:50 vm1 pure-ftpd[2259126]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RIMC.php uploaded (25527 bytes, 1668.59KB/sec)122.181.82.621269750vi  Cc' ossec11313g)FTP file uploaded to serverFeb 18 12:03:02 vm1 pure-ftpd[2259126]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RIMC.php uploaded (25439 bytes, 1046.45KB/sec)122.181.82.621269750vh  Cc' ossec11313g)pFTP file uploaded to serverFeb 18 12:02:15 vm1 pure-ftpd[2259126]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RIMC.php uploaded (25072 bytes, 1348.78KB/sec)122.181.82.6212697503g  C]' ossec11309g)pFTP Authentication success.Feb 18 12:02:15 vm1 pure-ftpd[2259126]: (?@122.181.82.62) [INFO] militry@technobases.in is now logged in122.181.82.621269750 KW] T 4A*2K3  C]' ossec11309gM%FTP Authentication success.Feb 18 14:34:37 vm1 pure-ftpd[2286983]: (?@122.181.82.62) [INFO] militry@technobases.in is now logged in122.181.82.621269750  Ug) ossec11001gK=Deferred login on the cpanel service[2025-02-18 14:26:27 +0530] info [webmaild] 157.38.129.155 - kps@amplifypowerglobal.com "POST /cpsess4593342815/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [157.38.130.124] != Current IP Address [157.38.129.155]157.38.129.1551269750u C_' ossec11313gE;FTP file uploaded to serverFeb 18 14:00:50 vm1 pure-ftpd[2280177]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RMS.php uploaded (4712 bytes, 3614.98KB/sec)122.181.82.621269750 C}' ossec11313gEFTP file uploaded to serverFeb 18 13:59:55 vm1 pure-ftpd[2280177]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//images/sainik_12.jpg uploaded (106634 bytes, 1878.61KB/sec)122.181.82.621269750%  3Q' ossec11301gDNew FTP connection.Feb 18 13:58:58 vm1 pure-ftpd[2280177]: (?@122.181.82.62) [INFO] New connection from 122.181.82.62122.181.82.621269750t  C_' ossec11313gDFTP file uploaded to serverFeb 18 13:58:58 vm1 pure-ftpd[2280177]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RMS.php uploaded (4726 bytes, 3849.21KB/sec)122.181.82.6212697503  C]' ossec11309gDFTP Authentication success.Feb 18 13:58:58 vm1 pure-ftpd[2280177]: (?@122.181.82.62) [INFO] militry@technobases.in is now logged in122.181.82.6212697503  C]' ossec11309gDFTP Authentication success.Feb 18 13:57:48 vm1 pure-ftpd[2280055]: (?@122.181.82.62) [INFO] militry@technobases.in is now logged in122.181.82.621269750%  3Q' ossec11301gDNew FTP connection.Feb 18 13:57:48 vm1 pure-ftpd[2280055]: (?@122.181.82.62) [INFO] New connection from 122.181.82.62122.181.82.621269750o CS' ossec11313gD-FTP file uploaded to serverFeb 18 13:56:20 vm1 pure-ftpd[2279839]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RMS.php uploaded (0 bytes, 0.00KB/sec)122.181.82.6212697504 C]' ossec11309gD#FTP Authentication success.Feb 18 13:56:11 vm1 pure-ftpd[2279839]: (?@122.181.82.62) [INFO] militry@technobases.in is now logged in122.181.82.621269750& 3Q' ossec11301gD#New FTP connection.Feb 18 13:56:10 vm1 pure-ftpd[2279839]: (?@122.181.82.62) [INFO] New connection from 122.181.82.62122.181.82.621269750 C{' ossec11313g/DFTP file uploaded to serverFeb 18 12:27:06 vm1 pure-ftpd[2263887]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//images/sainik_09.jpg uploaded (40542 bytes, 2345.35KB/sec)122.181.82.6212697503~  C]' ossec11309g/DFTP Authentication success.Feb 18 12:27:06 vm1 pure-ftpd[2263887]: (?@122.181.82.62) [INFO] militry@technobases.in is now logged in122.181.82.621269750%}  3Q' ossec11301g/DNew FTP connection.Feb 18 12:27:06 vm1 pure-ftpd[2263887]: (?@122.181.82.62) [INFO] New connection from 122.181.82.62122.181.82.6212697503|  C]' ossec11309g/.FTP Authentication success.Feb 18 12:26:44 vm1 pure-ftpd[2263869]: (?@122.181.82.62) [INFO] militry@technobases.in is now logged in122.181.82.621269750%{  3Q' ossec11301g/.New FTP connection.Feb 18 12:26:44 vm1 pure-ftpd[2263869]: (?@122.181.82.62) [INFO] New connection from 122.181.82.62122.181.82.621269750vz  Cc' ossec11313g-FTP file uploaded to serverFeb 18 12:17:29 vm1 pure-ftpd[2262245]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RIMC.php uploaded (27161 bytes, 1739.42KB/sec)122.181.82.621269750%y  3Q' ossec11301g-New FTP connection.Feb 18 12:17:28 vm1 pure-ftpd[2262245]: (?@122.181.82.62) [INFO] New connection from 122.181.82.62122.181.82.621269750  p k m k mb^\ZS~SRy JJJy'109.228.60.34BLACKg+'g'Blacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests2635167m<"local}x#77.68.12.96BLACKgŷ2g2Blacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests2635167MD `local~r%45.148.10.90BLACKg[g,Blacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests2750405- Zlocal|m'!k152.58.99.206GRAYgImunify360gAutomatically blocked due to distributed attack1269750:clocal~e%13.79.167.50BLACKg}gNBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests2963597 O2locald'52.169.91.160BLACKgb"g3"Blacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests29635974[localc'156.146.58.54BLACKgY$g*$Blacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests6252001:6local}b#65.0.123.26BLACKg=gBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests1269750A{locald}^#4.216.48.37BLACKguguBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests18610600%localM'52.164.123.56BLACKggBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests29635974{8localL'52.169.83.211BLACKgÁKgRKBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests29635974SlocalK'52.169.89.233BLACKg[g,Blacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests29635974Ylocal~J%51.104.3.160BLACKg/~g~Blacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests26351673hlocal~I%52.169.93.78BLACKg0g0Blacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests29635974]Nlocal F'159.223.43.95BLACKg~g~Blacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests1880251+_local}=)!k152.59.108.251GRAYg0Imunify360gAutomatically blocked due to distributed attack1269750;llocal{9%!k152.58.99.31GRAYglImunify360gkrAutomatically blocked due to distributed attack1269750:clocal}1)!k182.68.227.241GRAYgb Imunify360g`Automatically blocked due to distributed attack1269750Dlocal0'13.79.133.255BLACKggxBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests2963597 Olocaly+%!k3.17.203.110GRAYgX4Imunify360gWAutomatically blocked due to distributed attack6252001nlocal*)65.108.227.178BLACKg^gP^Blacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests660013Allocal~)%44.234.87.12BLACKgygJBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests6252001,W local)34.146.109.172BLACKgL g Blacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests1861060"mlocal'176.65.144.40BLACKg;g Blacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests2921044A(localz)146.190.139.80BLACKg{{gL{Blacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests6252001Plocal|j'!k152.59.108.70GRAYgqImunify360gEAutomatically blocked due to distributed attack1269750;lFlocalf'52.178.207.51BLACKgĊg[Blacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests296359743local *\~tj`VLB8.$zpf\H>4*   v l b X N D : 0 &    ~ t j ` V L B 8 . $    z p f \ R H > 4 *   vlbXND:0&|rh^TJ@6,"xndZPF<2( t~j`VLB.8$zpf\ | r h ^ T J @ 6 , "    x n d Z P F < 2 (   RRH>4*  vlbXND:0& gC gX g ge gA go gj g^ g gk g g g~ g} gg=| gg9{ gg9z gg9y gfx gfw gfv g_u g_t g]s g[r g[q g[p g[o gZn gZm gZl gZk gZhj gZi gZ$h gZg gZf gYe gYd gYc gYb gYa gY` gX_ gX^ gX] gX\ gX[ gXZ gWY gWX gWW gW V gWU gWT gWS gVaR gV_Q gV_P gVmO gV7N gV7M gVEL gV7K gUJ gUI gUH gUG gUEF gU!E gU!D gU!C gTyB gTYA gT@ gT? gT> gS= gS< gS; gR: gR9 gR8 gR7 gR6 gR5 gR4 gR3 gR2 gRH1 gR0 gR/ gR. gQ- gQ, gQ+ gQ* gQ8) gQ6( gQ6' gP& gP% gP$ gPL# gP" gO! gO gOj gOj gOj gN gN gN gN gN gN gN gN gN= gN? gN= gM gM gM gM9 gM' gM% gM% gK= gE; gE gD gD gD gD gD gD- gD# gD# g/D g/D g/D g/. g/. g- g- g- g,} g,} g,} g+ g+ g+ g+ g+- g+- g+- g* g*G g*% g) g) g)p g)p g)p g), g) g( g( g( g[ g[h g[h g[h gZ gZ gZ gYb gYb gYb gV gV gV gV gU gU gR gR gCs g?z g;) g; g+ g+ g( g! g g| g : g 8 g & g g g g g gc gG g gV g g g^ g(N g(N g(N g' g' g' g' g' g' g'  g'  g'  g& g& g& g&h g&h g&h g&f g% g% g% g%% g$ g$ g$ g$ g$ g$= g$= g$= g# g# g# g"k g"+ g! g! g! g! g!C g!  g[ g!  g!  g  g  g  g , g , g , g g g g g g8 g g g g' g g g g9 g9 g9 g g g_ g1 g g g g g g g g g g4 g g g g rW` g   X `W_{)r3  C]' ossec11309gOjFTP Authentication success.Feb 18 14:44:17 vm1 pure-ftpd[2289003]: (?@122.181.82.62) [INFO] militry@technobases.in is now logged in122.181.82.621269750%  3Q' ossec11301gOjNew FTP connection.Feb 18 14:44:17 vm1 pure-ftpd[2289003]: (?@122.181.82.62) [INFO] New connection from 122.181.82.62122.181.82.621269750t  C_' ossec11313gNFTP file uploaded to serverFeb 18 14:42:12 vm1 pure-ftpd[2288450]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RMS.php uploaded (6510 bytes, 3980.44KB/sec)122.181.82.621269750g  -_% ossec13001gNExim Auth failed2025-02-18 14:42:04 dovecot_login authenticator failed for ([89.211.42.163]) [80.76.161.99]:43587: 535 Incorrect authentication data (set_id=services@heipowersystem.com)80.76.161.99289688d  -W% ossec13001gNExim Auth failed2025-02-18 14:41:56 dovecot_login authenticator failed for ([211.151.86.9]) [211.151.86.9]:44154: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)211.151.86.91814991Z  -=+ ossec13001gNExim Auth failed2025-02-18 14:42:27 dovecot_login authenticator failed for ([220.189.239.206]) [220.189.239.206]:59026: 535 Incorrect authentication data (set_id=sales)220.189.239.2061814991`  -M' ossec13001gNExim Auth failed2025-02-18 14:42:23 dovecot_login authenticator failed for (49.206.244.235.actcorp.in) [49.206.241.22]:9136: 535 Incorrect authentication data (set_id=services)49.206.241.221269750t  C_' ossec11313gNFTP file uploaded to serverFeb 18 14:41:18 vm1 pure-ftpd[2288450]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RMS.php uploaded (6043 bytes, 4067.06KB/sec)122.181.82.621269750%  3Q' ossec11301gNNew FTP connection.Feb 18 14:41:18 vm1 pure-ftpd[2288450]: (?@122.181.82.62) [INFO] New connection from 122.181.82.62122.181.82.6212697503  C]' ossec11309gNFTP Authentication success.Feb 18 14:41:18 vm1 pure-ftpd[2288450]: (?@122.181.82.62) [INFO] militry@technobases.in is now logged in122.181.82.621269750%  3Q' ossec11301gN=New FTP connection.Feb 18 14:39:17 vm1 pure-ftpd[2287969]: (?@122.181.82.62) [INFO] New connection from 122.181.82.62122.181.82.621269750t  C_' ossec11313gN?FTP file uploaded to serverFeb 18 14:39:17 vm1 pure-ftpd[2287969]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RMS.php uploaded (5695 bytes, 2889.12KB/sec)122.181.82.6212697503  C]' ossec11309gN=FTP Authentication success.Feb 18 14:39:17 vm1 pure-ftpd[2287969]: (?@122.181.82.62) [INFO] militry@technobases.in is now logged in122.181.82.621269750t  C_' ossec11313gMFTP file uploaded to serverFeb 18 14:36:37 vm1 pure-ftpd[2287430]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RMS.php uploaded (5674 bytes, 3051.16KB/sec)122.181.82.621269750%  3Q' ossec11301gMNew FTP connection.Feb 18 14:36:36 vm1 pure-ftpd[2287430]: (?@122.181.82.62) [INFO] New connection from 122.181.82.62122.181.82.6212697503  C]' ossec11309gMFTP Authentication success.Feb 18 14:36:36 vm1 pure-ftpd[2287430]: (?@122.181.82.62) [INFO] militry@technobases.in is now logged in122.181.82.621269750u C_' ossec11313gM9FTP file uploaded to serverFeb 18 14:34:57 vm1 pure-ftpd[2286983]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RMS.php uploaded (5535 bytes, 2009.52KB/sec)122.181.82.621269750s  C]' ossec11313gM'FTP file uploaded to serverFeb 18 14:34:38 vm1 pure-ftpd[2286983]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RMS.php uploaded (5531 bytes, 103.02KB/sec)122.181.82.621269750%  3Q' ossec11301gM%New FTP connection.Feb 18 14:34:37 vm1 pure-ftpd[2286983]: (?@122.181.82.62) [INFO] New connection from 122.181.82.62122.181.82.621269750   ! ) (qx (s0  C]' ossec11313gRFTP file uploaded to serverFeb 18 14:55:40 vm1 pure-ftpd[2291279]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RMS.php uploaded (9570 bytes, 135.15KB/sec)122.181.82.6212697503/  C]' ossec11309gRFTP Authentication success.Feb 18 14:55:39 vm1 pure-ftpd[2291279]: (?@122.181.82.62) [INFO] militry@technobases.in is now logged in122.181.82.621269750%.  3Q' ossec11301gRNew FTP connection.Feb 18 14:55:39 vm1 pure-ftpd[2291279]: (?@122.181.82.62) [INFO] New connection from 122.181.82.62122.181.82.621269750t-  C_' ossec11313gQFTP file uploaded to serverFeb 18 14:54:31 vm1 pure-ftpd[2290967]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RMS.php uploaded (9498 bytes, 6820.44KB/sec)122.181.82.621269750%,  3Q' ossec11301gQNew FTP connection.Feb 18 14:54:31 vm1 pure-ftpd[2290967]: (?@122.181.82.62) [INFO] New connection from 122.181.82.62122.181.82.6212697503+  C]' ossec11309gQFTP Authentication success.Feb 18 14:54:31 vm1 pure-ftpd[2290967]: (?@122.181.82.62) [INFO] militry@technobases.in is now logged in122.181.82.621269750t*  C_' ossec11313gQFTP file uploaded to serverFeb 18 14:53:16 vm1 pure-ftpd[2290450]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RMS.php uploaded (9077 bytes, 4576.49KB/sec)122.181.82.621269750u) C_' ossec11313gQ8FTP file uploaded to serverFeb 18 14:51:58 vm1 pure-ftpd[2290450]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RMS.php uploaded (8563 bytes, 3098.14KB/sec)122.181.82.6212697503(  C]' ossec11309gQ6FTP Authentication success.Feb 18 14:51:58 vm1 pure-ftpd[2290450]: (?@122.181.82.62) [INFO] militry@technobases.in is now logged in122.181.82.621269750%'  3Q' ossec11301gQ6New FTP connection.Feb 18 14:51:58 vm1 pure-ftpd[2290450]: (?@122.181.82.62) [INFO] New connection from 122.181.82.62122.181.82.621269750t&  C_' ossec11313gPFTP file uploaded to serverFeb 18 14:49:26 vm1 pure-ftpd[2289990]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RMS.php uploaded (8063 bytes, 6805.28KB/sec)122.181.82.6212697503%  C]' ossec11309gPFTP Authentication success.Feb 18 14:49:26 vm1 pure-ftpd[2289990]: (?@122.181.82.62) [INFO] militry@technobases.in is now logged in122.181.82.621269750%$  3Q' ossec11301gPNew FTP connection.Feb 18 14:49:26 vm1 pure-ftpd[2289990]: (?@122.181.82.62) [INFO] New connection from 122.181.82.62122.181.82.621269750t#  C_' ossec11313gPLFTP file uploaded to serverFeb 18 14:48:03 vm1 pure-ftpd[2289003]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RMS.php uploaded (7703 bytes, 4255.09KB/sec)122.181.82.621269750s"  C]' ossec11313gPFTP file uploaded to serverFeb 18 14:47:15 vm1 pure-ftpd[2289003]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RMS.php uploaded (7644 bytes, 861.20KB/sec)122.181.82.621269750u! C_' ossec11313gOFTP file uploaded to serverFeb 18 14:45:51 vm1 pure-ftpd[2289003]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RMS.php uploaded (7159 bytes, 5319.90KB/sec)122.181.82.621269750s  C]' ossec11313gOFTP file uploaded to serverFeb 18 14:45:08 vm1 pure-ftpd[2289003]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RMS.php uploaded (6821 bytes, 139.84KB/sec)122.181.82.621269750t  C_' ossec11313gOjFTP file uploaded to serverFeb 18 14:44:17 vm1 pure-ftpd[2289003]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RMS.php uploaded (6745 bytes, 4675.50KB/sec)122.181.82.621269750   t +t{!x+B  3Y+ ossec11301gTyNew FTP connection.Feb 18 15:05:52 vm1 pure-ftpd[2293357]: (?@172.206.147.159) [INFO] New connection from 172.206.147.159172.206.147.1596252001uA  Ca' ossec11313gTYFTP file uploaded to serverFeb 18 15:05:19 vm1 pure-ftpd[2292940]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RMS.php uploaded (11624 bytes, 6930.41KB/sec)122.181.82.621269750v@ Ca' ossec11313gTFTP file uploaded to serverFeb 18 15:04:21 vm1 pure-ftpd[2292940]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RMS.php uploaded (11295 bytes, 6661.53KB/sec)122.181.82.6212697503?  C]' ossec11309gTFTP Authentication success.Feb 18 15:04:21 vm1 pure-ftpd[2292940]: (?@122.181.82.62) [INFO] militry@technobases.in is now logged in122.181.82.621269750%>  3Q' ossec11301gTNew FTP connection.Feb 18 15:04:21 vm1 pure-ftpd[2292940]: (?@122.181.82.62) [INFO] New connection from 122.181.82.62122.181.82.621269750v= Ca' ossec11313gSFTP file uploaded to serverFeb 18 15:00:04 vm1 pure-ftpd[2292196]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RMS.php uploaded (10488 bytes, 5376.58KB/sec)122.181.82.621269750%<  3Q' ossec11301gSNew FTP connection.Feb 18 15:00:03 vm1 pure-ftpd[2292196]: (?@122.181.82.62) [INFO] New connection from 122.181.82.62122.181.82.6212697503;  C]' ossec11309gSFTP Authentication success.Feb 18 15:00:04 vm1 pure-ftpd[2292196]: (?@122.181.82.62) [INFO] militry@technobases.in is now logged in122.181.82.621269750u:  Ca' ossec11313gRFTP file uploaded to serverFeb 18 14:58:57 vm1 pure-ftpd[2291824]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RMS.php uploaded (10412 bytes, 6694.01KB/sec)122.181.82.62126975039  C]' ossec11309gRFTP Authentication success.Feb 18 14:58:57 vm1 pure-ftpd[2291824]: (?@122.181.82.62) [INFO] militry@technobases.in is now logged in122.181.82.621269750%8  3Q' ossec11301gRNew FTP connection.Feb 18 14:58:57 vm1 pure-ftpd[2291824]: (?@122.181.82.62) [INFO] New connection from 122.181.82.62122.181.82.621269750l7  -e) ossec13001gRExim Auth failed2025-02-18 14:58:05 dovecot_login authenticator failed for ([87.200.188.170]) [87.200.188.170]:39632: 535 Incorrect authentication data (set_id=services@heipowersystem.com)87.200.188.170290557u6  Ca' ossec11313gRFTP file uploaded to serverFeb 18 14:57:51 vm1 pure-ftpd[2291669]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RMS.php uploaded (10114 bytes, 5044.68KB/sec)122.181.82.62126975035  C]' ossec11309gRFTP Authentication success.Feb 18 14:57:51 vm1 pure-ftpd[2291669]: (?@122.181.82.62) [INFO] militry@technobases.in is now logged in122.181.82.621269750%4  3Q' ossec11301gRNew FTP connection.Feb 18 14:57:51 vm1 pure-ftpd[2291669]: (?@122.181.82.62) [INFO] New connection from 122.181.82.62122.181.82.621269750|3  -' ossec13001gRExim Auth failed2025-02-18 14:58:33 dovecot_login authenticator failed for (triband-del-59.178.200.10.bol.net.in) [59.178.200.10]:56292: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)59.178.200.101269750f2  -W) ossec13001gRExim Auth failed2025-02-18 14:58:19 dovecot_login authenticator failed for (m121-202-153-50.smartone.com) [121.202.153.50]:42359: 535 Incorrect authentication data (set_id=services)121.202.153.501819730u1  Ca' ossec11313gRHFTP file uploaded to serverFeb 18 14:56:32 vm1 pure-ftpd[2291279]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RMS.php uploaded (10009 bytes, 6595.38KB/sec)122.181.82.621269750  ~qdWJ=0# zm`SF9, v i \ O B 5 (     r e X K > 1 $  { n a T G : -   w j ] P C 6 )    s f Y L ? 2 %  |obUH;.!xk^QD7*tgZM@3& }pcVI</"yl_RE8+uh[NA4' ~qdWJ=0 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750~ 1269750} 1269750| 1269750{ 1269750z 1269750y 1269750x 1269750w 1269750v 1269750u 1269750t 1269750s 1269750r 1269750q 1269750p 1269750o 1269750n 1269750m 1269750l 1269750k 1269750j 1269750i 1269750h 1269750g 1269750f 1269750e 1269750d 1269750c 1269750b 1269750a 1269750` 1269750_ 1269750^ 1269750] 1269750\ 1269750[ 1269750Z 1269750X 1269750W 1269750V 1269750U 1269750T 1269750S 1269750R 1269750Q 1269750P 1269750O 1269750N 1269750M 1269750L 1269750K 1269750J 1269750I 1269750H 1269750G 1269750F 1269750E 1269750D 1269750C 1269750B 1269750A 1269750@ 1269750? 1269750> 1269750= 1269750< 1269750; 1269750: 12697509 12697508 12697506 12697505 12697504 12697503 12697502 12697501 12697500 1269750/ 1269750. 1269750- 1269750, 1269750+ 1269750* 1269750) 1269750( 1269750' 1269750& 1269750% 1269750$ 1269750# 1269750" 1269750! 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 Q  N U [bh4VekT  [}% ossec12004gWPossible Dovecot CVE-2019-11500 attemptFeb 18 15:16:46 vm1 dovecot[2248659]: imap-login: Disconnected: Input buffer full (no auth attempts in 1 secs): user=<>, rip=3.17.203.110, lip=103.74.54.108, session=3.17.203.11062520013S  C]' ossec11309gWFTP Authentication success.Feb 18 15:16:47 vm1 pure-ftpd[2295521]: (?@122.181.82.62) [INFO] militry@technobases.in is now logged in122.181.82.621269750vR  Cc' ossec11313gVaFTP file uploaded to serverFeb 18 15:14:01 vm1 pure-ftpd[2294736]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RMS.php uploaded (13199 bytes, 12902.89KB/sec)122.181.82.621269750mQ  -e) ossec13001gV_Exim Auth failed2025-02-18 15:13:59 dovecot_login authenticator failed for ([39.165.154.222]) [39.165.154.222]:56460: 535 Incorrect authentication data (set_id=services@heipowersystem.com)39.165.154.2221814991ZP  -=+ ossec13001gV_Exim Auth failed2025-02-18 15:13:58 dovecot_login authenticator failed for ([119.206.117.105]) [119.206.117.105]:58538: 535 Incorrect authentication data (set_id=sales)119.206.117.1051835841PO  -3# ossec13001gVmExim Auth failed2025-02-18 15:14:13 dovecot_login authenticator failed for ([5.26.34.188]) [5.26.34.188]:52550: 535 Incorrect authentication data (set_id=services)5.26.34.188298795%N  3Q' ossec11301gV7New FTP connection.Feb 18 15:13:17 vm1 pure-ftpd[2294736]: (?@122.181.82.62) [INFO] New connection from 122.181.82.62122.181.82.6212697503M  C]' ossec11309gV7FTP Authentication success.Feb 18 15:13:17 vm1 pure-ftpd[2294736]: (?@122.181.82.62) [INFO] militry@technobases.in is now logged in122.181.82.621269750vL  -y' ossec13001gVEExim Auth failed2025-02-18 15:13:33 dovecot_login authenticator failed for 83-233-30-104.cust.bredband2.com [83.233.30.104]:60296: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)83.233.30.1042661886uK  Ca' ossec11313gV7FTP file uploaded to serverFeb 18 15:13:18 vm1 pure-ftpd[2294736]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RMS.php uploaded (13013 bytes, 7538.01KB/sec)122.181.82.621269750vJ Ca' ossec11313gUFTP file uploaded to serverFeb 18 15:11:02 vm1 pure-ftpd[2294302]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RMS.php uploaded (12822 bytes, 6565.68KB/sec)122.181.82.621269750uI  Ca' ossec11313gUFTP file uploaded to serverFeb 18 15:10:27 vm1 pure-ftpd[2294302]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RMS.php uploaded (12652 bytes, 7032.51KB/sec)122.181.82.6212697503H  C]' ossec11309gUFTP Authentication success.Feb 18 15:10:26 vm1 pure-ftpd[2294302]: (?@122.181.82.62) [INFO] militry@technobases.in is now logged in122.181.82.621269750%G  3Q' ossec11301gUNew FTP connection.Feb 18 15:10:26 vm1 pure-ftpd[2294302]: (?@122.181.82.62) [INFO] New connection from 122.181.82.62122.181.82.621269750vF  Cc' ossec11313gUEFTP file uploaded to serverFeb 18 15:09:16 vm1 pure-ftpd[2293921]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RMS.php uploaded (12439 bytes, 11747.79KB/sec)122.181.82.621269750%E  3Q' ossec11301gU!New FTP connection.Feb 18 15:08:39 vm1 pure-ftpd[2293921]: (?@122.181.82.62) [INFO] New connection from 122.181.82.62122.181.82.6212697503D  C]' ossec11309gU!FTP Authentication success.Feb 18 15:08:39 vm1 pure-ftpd[2293921]: (?@122.181.82.62) [INFO] militry@technobases.in is now logged in122.181.82.621269750tC  C_' ossec11313gU!FTP file uploaded to serverFeb 18 15:08:40 vm1 pure-ftpd[2293921]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RMS.php uploaded (12040 bytes, 256.83KB/sec)122.181.82.621269750 W]  N KSCtg C]' ossec11313gZFTP file uploaded to serverFeb 18 15:29:50 vm1 pure-ftpd[2297859]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RMS.php uploaded (15690 bytes, 39.31KB/sec)122.181.82.621269750&f 3Q' ossec11301gZNew FTP connection.Feb 18 15:29:49 vm1 pure-ftpd[2297859]: (?@122.181.82.62) [INFO] New connection from 122.181.82.62122.181.82.621269750te  C_' ossec11313gYFTP file uploaded to serverFeb 18 15:27:29 vm1 pure-ftpd[2297497]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RMS.php uploaded (15628 bytes, 976.93KB/sec)122.181.82.621269750%d  3Q' ossec11301gYNew FTP connection.Feb 18 15:27:28 vm1 pure-ftpd[2297497]: (?@122.181.82.62) [INFO] New connection from 122.181.82.62122.181.82.6212697503c  C]' ossec11309gYFTP Authentication success.Feb 18 15:27:28 vm1 pure-ftpd[2297497]: (?@122.181.82.62) [INFO] militry@technobases.in is now logged in122.181.82.621269750%b  3Q' ossec11301gYNew FTP connection.Feb 18 15:25:41 vm1 pure-ftpd[2297236]: (?@122.181.82.62) [INFO] New connection from 122.181.82.62122.181.82.621269750ua  Ca' ossec11313gYFTP file uploaded to serverFeb 18 15:25:42 vm1 pure-ftpd[2297236]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RMS.php uploaded (15402 bytes, 1193.44KB/sec)122.181.82.6212697503`  C]' ossec11309gYFTP Authentication success.Feb 18 15:25:41 vm1 pure-ftpd[2297236]: (?@122.181.82.62) [INFO] militry@technobases.in is now logged in122.181.82.621269750t_  C_' ossec11313gXFTP file uploaded to serverFeb 18 15:23:14 vm1 pure-ftpd[2296663]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RMS.php uploaded (14906 bytes, 899.79KB/sec)122.181.82.621269750%^  3Q' ossec11301gXNew FTP connection.Feb 18 15:23:13 vm1 pure-ftpd[2296663]: (?@122.181.82.62) [INFO] New connection from 122.181.82.62122.181.82.6212697503]  C]' ossec11309gXFTP Authentication success.Feb 18 15:23:13 vm1 pure-ftpd[2296663]: (?@122.181.82.62) [INFO] militry@technobases.in is now logged in122.181.82.621269750v\  Cc' ossec11313gXFTP file uploaded to serverFeb 18 15:21:09 vm1 pure-ftpd[2296370]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RMS.php uploaded (14772 bytes, 10304.17KB/sec)122.181.82.621269750%[  3Q' ossec11301gXNew FTP connection.Feb 18 15:21:08 vm1 pure-ftpd[2296370]: (?@122.181.82.62) [INFO] New connection from 122.181.82.62122.181.82.6212697503Z  C]' ossec11309gXFTP Authentication success.Feb 18 15:21:08 vm1 pure-ftpd[2296370]: (?@122.181.82.62) [INFO] militry@technobases.in is now logged in122.181.82.621269750tY  C_' ossec11313gWFTP file uploaded to serverFeb 18 15:19:10 vm1 pure-ftpd[2295922]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RMS.php uploaded (14421 bytes, 242.42KB/sec)122.181.82.6212697503X  C]' ossec11309gWFTP Authentication success.Feb 18 15:19:09 vm1 pure-ftpd[2295922]: (?@122.181.82.62) [INFO] militry@technobases.in is now logged in122.181.82.621269750%W  3Q' ossec11301gWNew FTP connection.Feb 18 15:19:09 vm1 pure-ftpd[2295922]: (?@122.181.82.62) [INFO] New connection from 122.181.82.62122.181.82.621269750vV Ca' ossec11313gW FTP file uploaded to serverFeb 18 15:16:48 vm1 pure-ftpd[2295521]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RMS.php uploaded (13274 bytes, 6737.34KB/sec)122.181.82.621269750%U  3Q' ossec11301gWNew FTP connection.Feb 18 15:16:47 vm1 pure-ftpd[2295521]: (?@122.181.82.62) [INFO] New connection from 122.181.82.62122.181.82.621269750 ` f l D@G[|+9x Cg' ossec11309gfFTP Authentication success.Feb 18 16:24:16 vm1 pure-ftpd[2307919]: (?@117.98.76.124) [INFO] user@amplifypowerglobal.com is now logged in117.98.76.1241269750&w 3Q' ossec11301gfNew FTP connection.Feb 18 16:24:16 vm1 pure-ftpd[2307919]: (?@117.98.76.124) [INFO] New connection from 117.98.76.124117.98.76.1241269750Mv U}' ossec11001gfDeferred login on the cpanel service[2025-02-18 16:23:02 +0530] info [whostmgrd] 117.98.76.124 - root "GET /cpsess0262072298/json-api/loadavg HTTP/1.1" DEFERRED LOGIN whostmgrd: cookie ip check: IP address has changed: IP Address [106.206.152.65] != Current IP Address [117.98.76.124]117.98.76.1241269750[u -C% ossec13001g_Exim Auth failed2025-02-18 15:52:59 dovecot_login authenticator failed for (s2seducationtrust.com) [125.72.54.81]:49166: 535 Incorrect authentication data (set_id=nologin)125.72.54.811814991Bt  =}+ ossec13008g_Mail Reciepient rejected2025-02-18 15:53:19 H=(mail.heipowersystem.com) [165.154.226.172]:49785 F= rejected RCPT : Rejected relay attempt: '165.154.226.172' From: 'nlqeycbpnh@heipowersystem.com' To: 'validxxxg@gmail.com'165.154.226.1721668284"s  3M% ossec11301g]New FTP connection.Feb 18 15:45:09 vm1 pure-ftpd[2300988]: (?@13.83.40.125) [INFO] New connection from 13.83.40.12513.83.40.1256252001ur  Ca' ossec11313g[FTP file uploaded to serverFeb 18 15:37:38 vm1 pure-ftpd[2299323]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RMS.php uploaded (15640 bytes, 1292.60KB/sec)122.181.82.621269750q Cu' ossec11313g[FTP file uploaded to serverFeb 18 15:36:10 vm1 pure-ftpd[2299323]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//images/pic_01.jpg uploaded (75936 bytes, 1548.34KB/sec)122.181.82.6212697503p  C]' ossec11309g[FTP Authentication success.Feb 18 15:36:10 vm1 pure-ftpd[2299323]: (?@122.181.82.62) [INFO] militry@technobases.in is now logged in122.181.82.621269750%o  3Q' ossec11301g[New FTP connection.Feb 18 15:36:10 vm1 pure-ftpd[2299323]: (?@122.181.82.62) [INFO] New connection from 122.181.82.62122.181.82.621269750tn  C_' ossec11313gZFTP file uploaded to serverFeb 18 15:33:00 vm1 pure-ftpd[2297859]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RMS.php uploaded (15720 bytes, 993.11KB/sec)122.181.82.621269750dm  E=' ossec11314gZFTP file deleted from serverFeb 18 15:33:23 vm1 pure-ftpd[2298177]: (militry@technobases.in@122.181.82.62) [NOTICE] Deleted /home/techno/public_html/milictry1//images/sainik_12.jpg122.181.82.621269750dl  E=' ossec11314gZFTP file deleted from serverFeb 18 15:32:07 vm1 pure-ftpd[2298177]: (militry@technobases.in@122.181.82.62) [NOTICE] Deleted /home/techno/public_html/milictry1//images/sainik_12.jpg122.181.82.621269750vk Ca' ossec11313gZFTP file uploaded to serverFeb 18 15:31:55 vm1 pure-ftpd[2297859]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RMS.php uploaded (15720 bytes, 1054.37KB/sec)122.181.82.621269750vj Ca' ossec11313gZhFTP file uploaded to serverFeb 18 15:31:12 vm1 pure-ftpd[2297859]: (militry@technobases.in@122.181.82.62) [NOTICE] /home/techno/public_html/milictry1//RMS.php uploaded (15720 bytes, 1128.37KB/sec)122.181.82.6212697504i C]' ossec11309gZFTP Authentication success.Feb 18 15:29:49 vm1 pure-ftpd[2297859]: (?@122.181.82.62) [INFO] militry@technobases.in is now logged in122.181.82.621269750dh  E=' ossec11314gZ$FTP file deleted from serverFeb 18 15:30:04 vm1 pure-ftpd[2298177]: (militry@technobases.in@122.181.82.62) [NOTICE] Deleted /home/techno/public_html/milictry1//images/sainik_12.jpg122.181.82.621269750 MD9 @  @ ds=&/MM| -' ossec13001gXExim Auth failed2025-02-18 23:37:19 dovecot_plain authenticator failed for ip85-215-236-96.pbiaas.com [85.215.236.96]:62498: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)85.215.236.962921044^ -G' ossec13001gExim Auth failed2025-02-18 23:05:49 dovecot_login authenticator failed for (amplifypowerglobal.com) [221.229.216.1]:60180: 535 Incorrect authentication data (set_id=nologin)221.229.216.11814991s  -s' ossec13001geExim Auth failed2025-02-18 22:12:13 dovecot_login authenticator failed for (vandanabalbharti.com) [111.61.229.78]:53400: 535 Incorrect authentication data (set_id=postmaster@vandanabalbharti.com)111.61.229.781814991[  -C' ossec13001gAExim Auth failed2025-02-18 22:11:37 dovecot_login authenticator failed for (vandanabalbharti.com) [111.61.229.78]:52722: 535 Incorrect authentication data (set_id=nologin)111.61.229.781814991(  3U) ossec11301goNew FTP connection.Feb 18 21:29:42 vm1 pure-ftpd[2364662]: (?@205.210.31.136) [INFO] New connection from 205.210.31.136205.210.31.1366252001Y  -;+ ossec13001gjExim Auth failed2025-02-18 21:16:49 dovecot_login authenticator failed for ([103.106.154.137]) [103.106.154.137]:43184: 535 Incorrect authentication data (set_id=info)103.106.154.1371269750~  -) ossec13001g^Exim Auth failed2025-02-18 21:16:38 dovecot_login authenticator failed for cm-171-100-86-184.revip10.asianet.co.th [171.100.86.184]:50035: 535 Incorrect authentication data (set_id=info@heipowersystem.com)171.100.86.1841605651) 3U) ossec11301gNew FTP connection.Feb 18 21:10:49 vm1 pure-ftpd[2361120]: (?@89.248.163.214) [INFO] New connection from 89.248.163.21489.248.163.21427504052  =]+ ossec13008gkMail Reciepient rejected2025-02-18 20:55:29 H=(mail.nyaystambh.com) [165.154.227.155]:56948 F= rejected RCPT : Rejected relay attempt: '165.154.227.155' From: 'kimxnmdk@nyaystambh.com' To: 'validxxxg@gmail.com'165.154.227.1551668284m  -g' ossec13001gExim Auth failed2025-02-18 20:39:52 dovecot_login authenticator failed for (gurukuljaipur.com) [111.56.54.202]:45698: 535 Incorrect authentication data (set_id=postmaster@gurukuljaipur.com)111.56.54.2021814991X  -=' ossec13001gExim Auth failed2025-02-18 20:39:23 dovecot_login authenticator failed for (gurukuljaipur.com) [111.56.54.202]:42772: 535 Incorrect authentication data (set_id=nologin)111.56.54.2021814991Z~  -A' ossec13001gExim Auth failed2025-02-18 19:23:36 dovecot_login authenticator failed for (thepsindustries.com) [58.240.171.59]:46000: 535 Incorrect authentication data (set_id=nologin)58.240.171.591814991}  =7) ossec13008gMail Reciepient rejected2025-02-18 18:53:18 H=(mail.hsnews.in) [165.154.232.55]:62050 F= rejected RCPT : Rejected relay attempt: '165.154.232.55' From: 'xtbzdvv@hsnews.in' To: 'validxxxg@gmail.com'165.154.232.551605651L|  U}' ossec11001gg=Deferred login on the cpanel service[2025-02-18 16:25:56 +0530] info [whostmgrd] 117.98.76.124 - root "GET /cpsess0262072298/json-api/loadavg HTTP/1.1" DEFERRED LOGIN whostmgrd: cookie ip check: IP address has changed: IP Address [106.206.152.65] != Current IP Address [117.98.76.124]117.98.76.1241269750%{  3Q' ossec11301gg9New FTP connection.Feb 18 16:25:52 vm1 pure-ftpd[2308252]: (?@117.98.76.124) [INFO] New connection from 117.98.76.124117.98.76.1241269750z  C' ossec11313gg9FTP file uploaded to serverFeb 18 16:25:52 vm1 pure-ftpd[2308252]: (user@amplifypowerglobal.com@117.98.76.124) [NOTICE] /home/techno/public_html/amplifypowerglobal.com//shop.php uploaded (19950 bytes, 242.83KB/sec)117.98.76.12412697508y  Cg' ossec11309gg9FTP Authentication success.Feb 18 16:25:52 vm1 pure-ftpd[2308252]: (?@117.98.76.124) [INFO] user@amplifypowerglobal.com is now logged in117.98.76.1241269750 /w A  bqQt/A  =}) ossec13008gMail Reciepient rejected2025-02-19 05:16:14 H=(mail.amplifypowerglobal.com) [165.154.226.68]:52853 F= rejected RCPT : Rejected relay attempt: '165.154.226.68' From: 'csgtl@amplifypowerglobal.com' To: 'validxxxg@gmail.com'165.154.226.681668284Y -=' ossec13001g|Exim Auth failed2025-02-19 04:53:39 dovecot_login authenticator failed for (gurukuljaipur.com) [221.229.216.1]:39034: 535 Incorrect authentication data (set_id=nologin)221.229.216.11814991B  gU) ossec11307g :Multiple connection attempts from same sourceFeb 19 03:57:05 vm1 pure-ftpd[2443467]: (?@206.168.34.197) [INFO] New connection from 206.168.34.197206.168.34.1976252001) 3U) ossec11301g 8New FTP connection.Feb 19 03:57:04 vm1 pure-ftpd[2443448]: (?@206.168.34.197) [INFO] New connection from 206.168.34.197206.168.34.1976252001) 3U) ossec11301g &New FTP connection.Feb 19 03:56:45 vm1 pure-ftpd[2443423]: (?@206.168.34.197) [INFO] New connection from 206.168.34.197206.168.34.1976252001L  =+ ossec13008gMail Reciepient rejected2025-02-19 02:43:16 H=(mail.amplifypowerglobal.com) [165.154.251.134]:50858 F= rejected RCPT : Rejected relay attempt: '165.154.251.134' From: 'ngbkdsnyh@amplifypowerglobal.com' To: 'validxxxg@gmail.com'165.154.251.1341605651e  -W' ossec13001gExim Auth failed2025-02-19 02:21:13 dovecot_login authenticator failed for (rokamauka.com) [58.240.171.59]:41086: 535 Incorrect authentication data (set_id=postmaster@rokamauka.com)58.240.171.591814991T  -5' ossec13001gExim Auth failed2025-02-19 02:20:50 dovecot_login authenticator failed for (rokamauka.com) [58.240.171.59]:50230: 535 Incorrect authentication data (set_id=nologin)58.240.171.591814991\ -C' ossec13001gExim Auth failed2025-02-19 02:09:12 dovecot_login authenticator failed for (vandanabalbharti.com) [111.207.12.99]:51114: 535 Incorrect authentication data (set_id=nologin)111.207.12.991814991(  3U) ossec11301gNew FTP connection.Feb 19 01:59:13 vm1 pure-ftpd[2421899]: (?@167.94.138.178) [INFO] New connection from 167.94.138.178167.94.138.1786252001i  -]) ossec13001gcExim Auth failed2025-02-19 01:49:46 dovecot_login authenticator failed for 226.149.48.116.static.netvigator.com [116.48.149.226]:52401: 535 Incorrect authentication data (set_id=sales)116.48.149.2261819730j  -_) ossec13001gGExim Auth failed2025-02-19 01:49:18 dovecot_login authenticator failed for ([121.168.210.98]) [121.168.210.98]:14353: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)121.168.210.981835841(  3U) ossec11301gNew FTP connection.Feb 19 01:34:03 vm1 pure-ftpd[2417452]: (?@124.31.107.124) [INFO] New connection from 124.31.107.124124.31.107.1241814991(  3U) ossec11301gVNew FTP connection.Feb 19 01:19:40 vm1 pure-ftpd[2414816]: (?@147.185.132.46) [INFO] New connection from 147.185.132.46147.185.132.4662520012  =]+ ossec13008gMail Reciepient rejected2025-02-19 01:00:08 H=(mail.nyaystambh.com) [165.154.226.135]:63064 F= rejected RCPT : Rejected relay attempt: '165.154.226.135' From: 'oruzibxd@nyaystambh.com' To: 'validxxxg@gmail.com'165.154.226.1351668284  ?1 ossec1008gProcess exiting (killed).Feb 19 00:09:02 vm1 spamd[2121585]: spamd: server killed by SIGTERM, shutting down5  ; ossec9703g^Dovecot is Starting Up.Feb 19 00:07:15 vm1 dovecot[2400574]: master: Dovecot v2.3.21.1 (d492236fa0) starting up for lmtp, imap, pop3 (core dumps disabled)C  77 ossec502gCOssec server started.ossec: Ossec started.  )|c\(,  3U) ossec11301gYbNew FTP connection.Feb 19 09:39:04 vm1 pure-ftpd[2506676]: (?@182.68.227.241) [INFO] New connection from 182.68.227.241182.68.227.2411269750+ Cy) ossec11313gVFTP file uploaded to serverFeb 19 09:27:26 vm1 pure-ftpd[2504573]: (militry@technobases.in@182.68.227.241) [NOTICE] /home/techno/public_html/milictry1//images/pic_02.jpg uploaded (209654 bytes, 2778.32KB/sec)182.68.227.24112697505*  C_) ossec11309gVFTP Authentication success.Feb 19 09:27:26 vm1 pure-ftpd[2504573]: (?@182.68.227.241) [INFO] militry@technobases.in is now logged in182.68.227.2411269750()  3U) ossec11301gVNew FTP connection.Feb 19 09:27:26 vm1 pure-ftpd[2504573]: (?@182.68.227.241) [INFO] New connection from 182.68.227.241182.68.227.2411269750v(  Ca) ossec11313gVFTP file uploaded to serverFeb 19 09:25:03 vm1 pure-ftpd[2504003]: (militry@technobases.in@182.68.227.241) [NOTICE] /home/techno/public_html/milictry1//RMS.php uploaded (15706 bytes, 796.40KB/sec)182.68.227.24112697506' C_) ossec11309gUFTP Authentication success.Feb 19 09:24:13 vm1 pure-ftpd[2503911]: (?@182.68.227.241) [INFO] militry@technobases.in is now logged in182.68.227.2411269750)& 3U) ossec11301gUNew FTP connection.Feb 19 09:24:13 vm1 pure-ftpd[2503911]: (?@182.68.227.241) [INFO] New connection from 182.68.227.241182.68.227.24112697505%  C_) ossec11309gRFTP Authentication success.Feb 19 09:10:00 vm1 pure-ftpd[2501326]: (?@182.68.227.241) [INFO] militry@technobases.in is now logged in182.68.227.2411269750($  3U) ossec11301gRNew FTP connection.Feb 19 09:10:00 vm1 pure-ftpd[2501326]: (?@182.68.227.241) [INFO] New connection from 182.68.227.241182.68.227.2411269750#  =7+ ossec13008gCsMail Reciepient rejected2025-02-19 08:05:29 H=(mail.hsnews.in) [165.154.213.136]:53251 F= rejected RCPT : Rejected relay attempt: '165.154.213.136' From: 'aorkjo@hsnews.in' To: 'validxxxg@gmail.com'165.154.213.1363469034D"  =) ossec13008g?zMail Reciepient rejected2025-02-19 07:48:33 H=(mail.westerndancecompany.com) [165.154.227.29]:53901 F= rejected RCPT : Rejected relay attempt: '165.154.227.29' From: 'jsrri@westerndancecompany.com' To: 'validxxxg@gmail.com'165.154.227.291668284o!  -i) ossec13001g;)Exim Auth failed2025-02-19 07:30:08 dovecot_login authenticator failed for (gurukuljaipur.com) [101.89.140.209]:55056: 535 Incorrect authentication data (set_id=postmaster@gurukuljaipur.com)101.89.140.2091814991Z  -?) ossec13001g;Exim Auth failed2025-02-19 07:29:45 dovecot_login authenticator failed for (gurukuljaipur.com) [101.89.140.209]:52076: 535 Incorrect authentication data (set_id=nologin)101.89.140.2091814991Z  -?) ossec13001g+Exim Auth failed2025-02-19 06:21:31 dovecot_login authenticator failed for ([119.200.229.33]) [119.200.229.33]:39237: 535 Incorrect authentication data (set_id=services)119.200.229.331835841g  -]% ossec13001g+Exim Auth failed2025-02-19 06:21:18 dovecot_login authenticator failed for ([211.151.86.9]) [211.151.86.9]:39054: 535 Incorrect authentication data (set_id=services@heipowersystem.com)211.151.86.91814991-  =U) ossec13008g(Mail Reciepient rejected2025-02-19 06:12:26 H=(mail.technobases.in) [165.154.227.39]:51939 F= rejected RCPT : Rejected relay attempt: '165.154.227.39' From: 'jnsxepe@technobases.in' To: 'validxxxg@gmail.com'165.154.227.3916682848  =k) ossec13008g!Mail Reciepient rejected2025-02-19 05:38:45 H=(mail.fablixsolutions.com) [165.154.233.84]:49178 F= rejected RCPT : Rejected relay attempt: '165.154.233.84' From: 'wbprw@fablixsolutions.com' To: 'validxxxg@gmail.com'165.154.233.841694008 8GM A .37<.28v?  Ca) ossec11313g]FTP file uploaded to serverFeb 19 09:58:46 vm1 pure-ftpd[2510005]: (militry@technobases.in@182.68.227.241) [NOTICE] /home/techno/public_html/milictry1//RMS.php uploaded (17879 bytes, 858.11KB/sec)182.68.227.2411269750x> Cc) ossec11313g]FTP file uploaded to serverFeb 19 09:57:24 vm1 pure-ftpd[2510005]: (militry@technobases.in@182.68.227.241) [NOTICE] /home/techno/public_html/milictry1//RMS.php uploaded (17797 bytes, 1074.82KB/sec)182.68.227.2411269750(=  3U) ossec11301g]New FTP connection.Feb 19 09:57:23 vm1 pure-ftpd[2510005]: (?@182.68.227.241) [INFO] New connection from 182.68.227.241182.68.227.24112697505<  C_) ossec11309g]FTP Authentication success.Feb 19 09:57:23 vm1 pure-ftpd[2510005]: (?@182.68.227.241) [INFO] militry@technobases.in is now logged in182.68.227.2411269750%;  3Q' ossec11301g]New FTP connection.Feb 19 09:58:01 vm1 pure-ftpd[2510241]: (?@167.94.146.54) [INFO] New connection from 167.94.146.54167.94.146.546252001w:  Cc) ossec11313g\FTP file uploaded to serverFeb 19 09:52:23 vm1 pure-ftpd[2508468]: (militry@technobases.in@182.68.227.241) [NOTICE] /home/techno/public_html/milictry1//RMS.php uploaded (17568 bytes, 1001.83KB/sec)182.68.227.2411269750x9 Cc) ossec11313g\2FTP file uploaded to serverFeb 19 09:51:05 vm1 pure-ftpd[2508468]: (militry@technobases.in@182.68.227.241) [NOTICE] /home/techno/public_html/milictry1//RMS.php uploaded (17359 bytes, 1086.83KB/sec)182.68.227.2411269750w8  Cc) ossec11313g\FTP file uploaded to serverFeb 19 09:50:31 vm1 pure-ftpd[2508468]: (militry@technobases.in@182.68.227.241) [NOTICE] /home/techno/public_html/milictry1//RMS.php uploaded (17160 bytes, 1278.44KB/sec)182.68.227.241126975057  C_) ossec11309g[FTP Authentication success.Feb 19 09:49:05 vm1 pure-ftpd[2508468]: (?@182.68.227.241) [INFO] militry@technobases.in is now logged in182.68.227.2411269750(6  3U) ossec11301g[New FTP connection.Feb 19 09:49:05 vm1 pure-ftpd[2508468]: (?@182.68.227.241) [INFO] New connection from 182.68.227.241182.68.227.2411269750v5 C_) ossec11313g[FTP file uploaded to serverFeb 19 09:49:06 vm1 pure-ftpd[2508468]: (militry@technobases.in@182.68.227.241) [NOTICE] /home/techno/public_html/milictry1//RMS.php uploaded (16851 bytes, 40.33KB/sec)182.68.227.2411269750w4  Cc) ossec11313g[hFTP file uploaded to serverFeb 19 09:47:43 vm1 pure-ftpd[2508274]: (militry@technobases.in@182.68.227.241) [NOTICE] /home/techno/public_html/milictry1//RMS.php uploaded (16535 bytes, 1079.66KB/sec)182.68.227.241126975053  C_) ossec11309g[hFTP Authentication success.Feb 19 09:47:43 vm1 pure-ftpd[2508274]: (?@182.68.227.241) [INFO] militry@technobases.in is now logged in182.68.227.2411269750(2  3U) ossec11301g[hNew FTP connection.Feb 19 09:47:43 vm1 pure-ftpd[2508274]: (?@182.68.227.241) [INFO] New connection from 182.68.227.241182.68.227.2411269750(1  3U) ossec11301gZNew FTP connection.Feb 19 09:45:30 vm1 pure-ftpd[2507871]: (?@182.68.227.241) [INFO] New connection from 182.68.227.241182.68.227.2411269750w0  Cc) ossec11313gZFTP file uploaded to serverFeb 19 09:45:30 vm1 pure-ftpd[2507871]: (militry@technobases.in@182.68.227.241) [NOTICE] /home/techno/public_html/milictry1//RMS.php uploaded (16437 bytes, 1018.52KB/sec)182.68.227.24112697505/  C_) ossec11309gZFTP Authentication success.Feb 19 09:45:30 vm1 pure-ftpd[2507871]: (?@182.68.227.241) [INFO] militry@technobases.in is now logged in182.68.227.2411269750v. C_) ossec11313gYbFTP file uploaded to serverFeb 19 09:39:05 vm1 pure-ftpd[2506676]: (militry@technobases.in@182.68.227.241) [NOTICE] /home/techno/public_html/milictry1//RMS.php uploaded (16011 bytes, 37.13KB/sec)182.68.227.24112697505-  C_) ossec11309gYbFTP Authentication success.Feb 19 09:39:04 vm1 pure-ftpd[2506676]: (?@182.68.227.241) [INFO] militry@technobases.in is now logged in182.68.227.2411269750    j [`eL)Q 3U) ossec11301g`New FTP connection.Feb 19 10:10:07 vm1 pure-ftpd[2512962]: (?@182.68.227.241) [INFO] New connection from 182.68.227.241182.68.227.2411269750EP C}) ossec11309g`FTP Authentication success.Feb 19 10:10:07 vm1 pure-ftpd[2512962]: (?@182.68.227.241) [INFO] user@sainikschoolcoachinginjaipur.com is now logged in182.68.227.2411269750WO A#) ossec11302g`FTP Authentication failed.Feb 19 10:09:33 vm1 pure-ftpd[2512701]: (?@182.68.227.241) [WARNING] Authentication failed for user [user@sainikschoolcoachinginjaipur.com]182.68.227.2411269750DN  C}) ossec11309g`|FTP Authentication success.Feb 19 10:09:22 vm1 pure-ftpd[2512686]: (?@182.68.227.241) [INFO] user@sainikschoolcoachinginjaipur.com is now logged in182.68.227.2411269750)M 3U) ossec11301g`|New FTP connection.Feb 19 10:09:21 vm1 pure-ftpd[2512686]: (?@182.68.227.241) [INFO] New connection from 182.68.227.241182.68.227.2411269750wL  Cc) ossec11313g`FTP file uploaded to serverFeb 19 10:07:48 vm1 pure-ftpd[2512124]: (militry@technobases.in@182.68.227.241) [NOTICE] /home/techno/public_html/milictry1//RMS.php uploaded (20079 bytes, 1496.92KB/sec)182.68.227.2411269750wK  Cc) ossec11313g_FTP file uploaded to serverFeb 19 10:06:50 vm1 pure-ftpd[2512124]: (militry@technobases.in@182.68.227.241) [NOTICE] /home/techno/public_html/milictry1//RMS.php uploaded (19828 bytes, 1372.12KB/sec)182.68.227.24112697505J  C_) ossec11309g_FTP Authentication success.Feb 19 10:06:50 vm1 pure-ftpd[2512124]: (?@182.68.227.241) [INFO] militry@technobases.in is now logged in182.68.227.2411269750(I  3U) ossec11301g_New FTP connection.Feb 19 10:06:49 vm1 pure-ftpd[2512124]: (?@182.68.227.241) [INFO] New connection from 182.68.227.241182.68.227.2411269750wH  Cc) ossec11313g_FTP file uploaded to serverFeb 19 10:05:23 vm1 pure-ftpd[2511491]: (militry@technobases.in@182.68.227.241) [NOTICE] /home/techno/public_html/milictry1//RMS.php uploaded (19761 bytes, 1357.84KB/sec)182.68.227.2411269750wG  Cc) ossec11313g_[FTP file uploaded to serverFeb 19 10:04:35 vm1 pure-ftpd[2511491]: (militry@technobases.in@182.68.227.241) [NOTICE] /home/techno/public_html/milictry1//RMS.php uploaded (19463 bytes, 1067.25KB/sec)182.68.227.2411269750wF  Cc) ossec11313g_+FTP file uploaded to serverFeb 19 10:03:46 vm1 pure-ftpd[2511491]: (militry@technobases.in@182.68.227.241) [NOTICE] /home/techno/public_html/milictry1//RMS.php uploaded (19374 bytes, 1044.79KB/sec)182.68.227.24112697505E  C_) ossec11309g_+FTP Authentication success.Feb 19 10:03:46 vm1 pure-ftpd[2511491]: (?@182.68.227.241) [INFO] militry@technobases.in is now logged in182.68.227.2411269750(D  3U) ossec11301g_+New FTP connection.Feb 19 10:03:46 vm1 pure-ftpd[2511491]: (?@182.68.227.241) [INFO] New connection from 182.68.227.241182.68.227.2411269750wC  Cc) ossec11313g^FTP file uploaded to serverFeb 19 10:02:34 vm1 pure-ftpd[2510005]: (militry@technobases.in@182.68.227.241) [NOTICE] /home/techno/public_html/milictry1//RMS.php uploaded (18986 bytes, 1175.56KB/sec)182.68.227.2411269750xB Cc) ossec11313g^FTP file uploaded to serverFeb 19 10:01:03 vm1 pure-ftpd[2510005]: (militry@technobases.in@182.68.227.241) [NOTICE] /home/techno/public_html/milictry1//RMS.php uploaded (18565 bytes, 1303.66KB/sec)182.68.227.2411269750vA  Ca) ossec11313g^]FTP file uploaded to serverFeb 19 10:00:20 vm1 pure-ftpd[2510005]: (militry@technobases.in@182.68.227.241) [NOTICE] /home/techno/public_html/milictry1//RMS.php uploaded (18254 bytes, 892.92KB/sec)182.68.227.2411269750u@  C_) ossec11313g^+FTP file uploaded to serverFeb 19 09:59:30 vm1 pure-ftpd[2510005]: (militry@technobases.in@182.68.227.241) [NOTICE] /home/techno/public_html/milictry1//RMS.php uploaded (18180 bytes, 40.23KB/sec)182.68.227.2411269750 Y:  5 | /v|:Y5e  C_) ossec11309gbFTP Authentication success.Feb 19 10:18:23 vm1 pure-ftpd[2514430]: (?@152.59.116.209) [INFO] militry@technobases.in is now logged in152.59.116.2091269750(d  3U) ossec11301gbNew FTP connection.Feb 19 10:18:22 vm1 pure-ftpd[2514430]: (?@152.59.116.209) [INFO] New connection from 152.59.116.209152.59.116.2091269750Rc  A% ossec11302gbFTP Authentication failed.Feb 19 10:18:08 vm1 pure-ftpd[2514421]: (?@152.58.99.31) [WARNING] Authentication failed for user [user@sainikschoolcoachinginjaipur.com]152.58.99.311269750"b  3M% ossec11301gbNew FTP connection.Feb 19 10:18:04 vm1 pure-ftpd[2514421]: (?@152.58.99.31) [INFO] New connection from 152.58.99.31152.58.99.311269750Sa A% ossec11302gbxFTP Authentication failed.Feb 19 10:17:50 vm1 pure-ftpd[2514312]: (?@152.58.99.31) [WARNING] Authentication failed for user [user@sainikschoolcoachinginjaipur.com]152.58.99.311269750@`  Cy% ossec11309gbbFTP Authentication success.Feb 19 10:17:28 vm1 pure-ftpd[2514291]: (?@152.58.99.31) [INFO] user@sainikschoolcoachinginjaipur.com is now logged in152.58.99.311269750#_ 3M% ossec11301gbbNew FTP connection.Feb 19 10:17:28 vm1 pure-ftpd[2514291]: (?@152.58.99.31) [INFO] New connection from 152.58.99.31152.58.99.311269750v^  Ca) ossec11313gbFTP file uploaded to serverFeb 19 10:16:21 vm1 pure-ftpd[2514131]: (militry@technobases.in@152.59.116.209) [NOTICE] /home/techno/public_html/milictry1//RMS.php uploaded (20534 bytes, 210.12KB/sec)152.59.116.20912697505]  C_) ossec11309gbFTP Authentication success.Feb 19 10:16:20 vm1 pure-ftpd[2514131]: (?@152.59.116.209) [INFO] militry@technobases.in is now logged in152.59.116.2091269750(\  3U) ossec11301gbNew FTP connection.Feb 19 10:16:19 vm1 pure-ftpd[2514131]: (?@152.59.116.209) [INFO] New connection from 152.59.116.209152.59.116.2091269750v[  Ca) ossec11313gaFTP file uploaded to serverFeb 19 10:15:11 vm1 pure-ftpd[2513709]: (militry@technobases.in@152.59.116.209) [NOTICE] /home/techno/public_html/milictry1//RMS.php uploaded (20393 bytes, 282.12KB/sec)152.59.116.2091269750wZ Ca) ossec11313gaFTP file uploaded to serverFeb 19 10:14:26 vm1 pure-ftpd[2513709]: (militry@technobases.in@152.59.116.209) [NOTICE] /home/techno/public_html/milictry1//RMS.php uploaded (20376 bytes, 208.61KB/sec)152.59.116.2091269750(Y  3U) ossec11301gaNew FTP connection.Feb 19 10:14:24 vm1 pure-ftpd[2513709]: (?@152.59.116.209) [INFO] New connection from 152.59.116.209152.59.116.20912697505X  C_) ossec11309gaFTP Authentication success.Feb 19 10:14:24 vm1 pure-ftpd[2513709]: (?@152.59.116.209) [INFO] militry@technobases.in is now logged in152.59.116.2091269750WW A#) ossec11302g`FTP Authentication failed.Feb 19 10:11:04 vm1 pure-ftpd[2513117]: (?@182.68.227.241) [WARNING] Authentication failed for user [user@sainikschoolcoachinginjaipur.com]182.68.227.2411269750ZV  I#) ossec11331g` Stealth FTP brute force attackFeb 19 10:11:23 vm1 pure-ftpd[2513157]: (?@182.68.227.241) [WARNING] Authentication failed for user [user@sainikschoolcoachinginjaipur.com]182.68.227.2411269750)U 3U) ossec11301g`New FTP connection.Feb 19 10:11:09 vm1 pure-ftpd[2513146]: (?@182.68.227.241) [INFO] New connection from 182.68.227.241182.68.227.2411269750{T  #) ossec11321g`Active Response. FTP brute force attack (Port 21 is protected)Feb 19 10:10:19 vm1 pure-ftpd[2512974]: (?@182.68.227.241) [WARNING] Authentication failed for user [user@sainikschoolcoachinginjaipur.com]182.68.227.2411269750S  S) ossec211321g`Preventing FTP brute force attempt.[Active Response] is disabled for rule 11321. Greylisting 182.68.227.241182.68.227.2411269750BR  gU) ossec11307g`Multiple connection attempts from same sourceFeb 19 10:10:15 vm1 pure-ftpd[2512974]: (?@182.68.227.241) [INFO] New connection from 182.68.227.241182.68.227.2411269750 Z `  1 7AOTZvw  Ca) ossec11313gdFTP file uploaded to serverFeb 19 10:27:44 vm1 pure-ftpd[2516648]: (militry@technobases.in@152.59.116.209) [NOTICE] /home/techno/public_html/milictry1//RMS.php uploaded (22916 bytes, 296.21KB/sec)152.59.116.2091269750wv Ca) ossec11313gd0FTP file uploaded to serverFeb 19 10:25:12 vm1 pure-ftpd[2516216]: (militry@technobases.in@152.59.116.209) [NOTICE] /home/techno/public_html/milictry1//RMS.php uploaded (22535 bytes, 208.32KB/sec)152.59.116.20912697505u  C_) ossec11309gd0FTP Authentication success.Feb 19 10:25:10 vm1 pure-ftpd[2516216]: (?@152.59.116.209) [INFO] militry@technobases.in is now logged in152.59.116.2091269750(t  3U) ossec11301gd.New FTP connection.Feb 19 10:25:10 vm1 pure-ftpd[2516216]: (?@152.59.116.209) [INFO] New connection from 152.59.116.209152.59.116.2091269750ws Ca) ossec11313gcFTP file uploaded to serverFeb 19 10:23:07 vm1 pure-ftpd[2515463]: (militry@technobases.in@152.59.116.209) [NOTICE] /home/techno/public_html/milictry1//RMS.php uploaded (22298 bytes, 241.69KB/sec)152.59.116.2091269750Ur -9% ossec13001gcExim Auth failed2025-02-19 10:23:05 dovecot_login authenticator failed for (User) [80.94.95.228]:24474: 535 Incorrect authentication data (set_id=nest@technobases.in)80.94.95.2287985495q  C_) ossec11309gcFTP Authentication success.Feb 19 10:22:15 vm1 pure-ftpd[2515463]: (?@152.59.116.209) [INFO] militry@technobases.in is now logged in152.59.116.2091269750(p  3U) ossec11301gcNew FTP connection.Feb 19 10:22:15 vm1 pure-ftpd[2515463]: (?@152.59.116.209) [INFO] New connection from 152.59.116.209152.59.116.2091269750o  5)) ossec11011gcWHM SSO login failed[2025-02-19 10:22:43 +0530] info [whostmgrd] 182.68.227.241 PURGE root:CdFlsOAWeljVANbp badpass [cookie ip check: IP address has changed: IP Address [106.207.154.165] != Current IP Address [182.68.227.241]]182.68.227.2411269750/n  UA) ossec11001gcDeferred login on the cpanel service[2025-02-19 10:22:43 +0530] info [whostmgrd] 182.68.227.241 - root "GET / HTTP/1.1" DEFERRED LOGIN whostmgrd: cookie ip check: IP address has changed: IP Address [106.207.154.165] != Current IP Address [182.68.227.241]182.68.227.2411269750vm  Ca) ossec11313gcFTP file uploaded to serverFeb 19 10:22:17 vm1 pure-ftpd[2515463]: (militry@technobases.in@152.59.116.209) [NOTICE] /home/techno/public_html/milictry1//RMS.php uploaded (22173 bytes, 239.39KB/sec)152.59.116.2091269750Rl  A% ossec11302gc^FTP Authentication failed.Feb 19 10:21:40 vm1 pure-ftpd[2515091]: (?@152.58.99.31) [WARNING] Authentication failed for user [user@sainikschoolcoachinginjaipur.com]152.58.99.311269750"k  3M% ossec11301gcXNew FTP connection.Feb 19 10:21:35 vm1 pure-ftpd[2515091]: (?@152.58.99.31) [INFO] New connection from 152.58.99.31152.58.99.311269750vj  Ca) ossec11313gcFTP file uploaded to serverFeb 19 10:20:29 vm1 pure-ftpd[2514575]: (militry@technobases.in@152.59.116.209) [NOTICE] /home/techno/public_html/milictry1//RMS.php uploaded (21630 bytes, 265.54KB/sec)152.59.116.20912697505i  C_) ossec11309gbFTP Authentication success.Feb 19 10:19:30 vm1 pure-ftpd[2514575]: (?@152.59.116.209) [INFO] militry@technobases.in is now logged in152.59.116.2091269750(h  3U) ossec11301gbNew FTP connection.Feb 19 10:19:30 vm1 pure-ftpd[2514575]: (?@152.59.116.209) [INFO] New connection from 152.59.116.209152.59.116.2091269750vg  Ca) ossec11313gbFTP file uploaded to serverFeb 19 10:19:32 vm1 pure-ftpd[2514575]: (militry@technobases.in@152.59.116.209) [NOTICE] /home/techno/public_html/milictry1//RMS.php uploaded (21503 bytes, 245.80KB/sec)152.59.116.2091269750vf  Ca) ossec11313gbFTP file uploaded to serverFeb 19 10:18:24 vm1 pure-ftpd[2514430]: (militry@technobases.in@152.59.116.209) [NOTICE] /home/techno/public_html/milictry1//RMS.php uploaded (21375 bytes, 229.92KB/sec)152.59.116.2091269750 G ; L`fOQ(  3U) ossec11301ghKNew FTP connection.Feb 19 10:42:43 vm1 pure-ftpd[2519771]: (?@152.59.116.209) [INFO] New connection from 152.59.116.209152.59.116.2091269750z  Ci) ossec11313ghMFTP file uploaded to serverFeb 19 10:42:44 vm1 pure-ftpd[2519771]: (militry@technobases.in@152.59.116.209) [NOTICE] /home/techno/public_html/milictry1//navodaya.php uploaded (4736 bytes, 458.56KB/sec)152.59.116.2091269750"  3M% ossec11301ghNew FTP connection.Feb 19 10:41:46 vm1 pure-ftpd[2519638]: (?@152.58.99.31) [INFO] New connection from 152.58.99.31152.58.99.311269750@  Cy% ossec11309ghFTP Authentication success.Feb 19 10:41:46 vm1 pure-ftpd[2519638]: (?@152.58.99.31) [INFO] user@sainikschoolcoachinginjaipur.com is now logged in152.58.99.311269750) 3U) ossec11301ggNew FTP connection.Feb 19 10:40:08 vm1 pure-ftpd[2519349]: (?@152.59.116.209) [INFO] New connection from 152.59.116.209152.59.116.2091269750v C_) ossec11313ggFTP file uploaded to serverFeb 19 10:40:24 vm1 pure-ftpd[2519362]: (militry@technobases.in@152.59.116.209) [NOTICE] /home/techno/public_html/milictry1//navodaya.php uploaded (0 bytes, 0.00KB/sec)152.59.116.20912697506 C_) ossec11309ggFTP Authentication success.Feb 19 10:40:08 vm1 pure-ftpd[2519349]: (?@152.59.116.209) [INFO] militry@technobases.in is now logged in152.59.116.2091269750# 3M% ossec11301ggsNew FTP connection.Feb 19 10:39:05 vm1 pure-ftpd[2519061]: (?@152.58.99.31) [INFO] New connection from 152.58.99.31152.58.99.311269750A Cy% ossec11309ggsFTP Authentication success.Feb 19 10:39:06 vm1 pure-ftpd[2519061]: (?@152.58.99.31) [INFO] user@sainikschoolcoachinginjaipur.com is now logged in152.58.99.311269750 C) ossec11313gfFTP file uploaded to serverFeb 19 10:36:35 vm1 pure-ftpd[2518603]: (militry@technobases.in@152.59.116.209) [NOTICE] /home/techno/public_html/milictry1//SainikSchoolCoaching.php uploaded (25507 bytes, 274.32KB/sec)152.59.116.20912697506 C_) ossec11309gfFTP Authentication success.Feb 19 10:36:34 vm1 pure-ftpd[2518603]: (?@152.59.116.209) [INFO] militry@technobases.in is now logged in152.59.116.2091269750) 3U) ossec11301gfNew FTP connection.Feb 19 10:36:34 vm1 pure-ftpd[2518603]: (?@152.59.116.209) [INFO] New connection from 152.59.116.209152.59.116.2091269750S A% ossec11302gfgFTP Authentication failed.Feb 19 10:34:37 vm1 pure-ftpd[2518094]: (?@152.58.99.31) [WARNING] Authentication failed for user [user@sainikschoolcoachinginjaipur.com]152.58.99.311269750@~  Cy% ossec11309gf]FTP Authentication success.Feb 19 10:34:27 vm1 pure-ftpd[2518080]: (?@152.58.99.31) [INFO] user@sainikschoolcoachinginjaipur.com is now logged in152.58.99.311269750#} 3M% ossec11301gf[New FTP connection.Feb 19 10:34:26 vm1 pure-ftpd[2518080]: (?@152.58.99.31) [INFO] New connection from 152.58.99.31152.58.99.3112697505|  C_) ossec11309ge+FTP Authentication success.Feb 19 10:29:20 vm1 pure-ftpd[2516994]: (?@152.59.116.209) [INFO] militry@technobases.in is now logged in152.59.116.2091269750({  3U) ossec11301ge)New FTP connection.Feb 19 10:29:20 vm1 pure-ftpd[2516994]: (?@152.59.116.209) [INFO] New connection from 152.59.116.209152.59.116.2091269750wz Ca) ossec11313gdFTP file uploaded to serverFeb 19 10:28:15 vm1 pure-ftpd[2516648]: (militry@technobases.in@152.59.116.209) [NOTICE] /home/techno/public_html/milictry1//RMS.php uploaded (23120 bytes, 263.19KB/sec)152.59.116.2091269750(y  3U) ossec11301gdNew FTP connection.Feb 19 10:27:42 vm1 pure-ftpd[2516648]: (?@152.59.116.209) [INFO] New connection from 152.59.116.209152.59.116.20912697505x  C_) ossec11309gdFTP Authentication success.Feb 19 10:27:43 vm1 pure-ftpd[2516648]: (?@152.59.116.209) [INFO] militry@technobases.in is now logged in152.59.116.2091269750 G + ~ ~ e{  Ck) ossec11313gk"FTP file uploaded to serverFeb 19 10:54:50 vm1 pure-ftpd[2521375]: (militry@technobases.in@152.59.116.209) [NOTICE] /home/techno/public_html/milictry1//navodaya.php uploaded (6844 bytes, 1218.09KB/sec)152.59.116.2091269750{ Ci) ossec11313gjFTP file uploaded to serverFeb 19 10:53:18 vm1 pure-ftpd[2521375]: (militry@technobases.in@152.59.116.209) [NOTICE] /home/techno/public_html/milictry1//navodaya.php uploaded (6482 bytes, 612.42KB/sec)152.59.116.2091269750{  Ck) ossec11313gjFTP file uploaded to serverFeb 19 10:52:35 vm1 pure-ftpd[2521375]: (militry@technobases.in@152.59.116.209) [NOTICE] /home/techno/public_html/milictry1//navodaya.php uploaded (6157 bytes, 1065.89KB/sec)152.59.116.2091269750| Ck) ossec11313gjPFTP file uploaded to serverFeb 19 10:51:18 vm1 pure-ftpd[2521375]: (militry@technobases.in@152.59.116.209) [NOTICE] /home/techno/public_html/milictry1//navodaya.php uploaded (5597 bytes, 1016.69KB/sec)152.59.116.2091269750(  3U) ossec11301gj:New FTP connection.Feb 19 10:50:56 vm1 pure-ftpd[2521375]: (?@152.59.116.209) [INFO] New connection from 152.59.116.209152.59.116.20912697505  C_) ossec11309gj:FTP Authentication success.Feb 19 10:50:56 vm1 pure-ftpd[2521375]: (?@152.59.116.209) [INFO] militry@technobases.in is now logged in152.59.116.2091269750{  Ck) ossec11313gj:FTP file uploaded to serverFeb 19 10:50:57 vm1 pure-ftpd[2521375]: (militry@technobases.in@152.59.116.209) [NOTICE] /home/techno/public_html/milictry1//navodaya.php uploaded (5580 bytes, 1007.79KB/sec)152.59.116.2091269750z  Ci) ossec11313giFTP file uploaded to serverFeb 19 10:49:51 vm1 pure-ftpd[2521062]: (militry@technobases.in@152.59.116.209) [NOTICE] /home/techno/public_html/milictry1//navodaya.php uploaded (5487 bytes, 505.61KB/sec)152.59.116.2091269750(  3U) ossec11301giNew FTP connection.Feb 19 10:49:50 vm1 pure-ftpd[2521062]: (?@152.59.116.209) [INFO] New connection from 152.59.116.209152.59.116.20912697505  C_) ossec11309giFTP Authentication success.Feb 19 10:49:50 vm1 pure-ftpd[2521062]: (?@152.59.116.209) [INFO] militry@technobases.in is now logged in152.59.116.2091269750z  Ci) ossec11313gi`FTP file uploaded to serverFeb 19 10:47:19 vm1 pure-ftpd[2520536]: (militry@technobases.in@152.59.116.209) [NOTICE] /home/techno/public_html/milictry1//navodaya.php uploaded (5161 bytes, 141.36KB/sec)152.59.116.2091269750| Ck) ossec11313gi.FTP file uploaded to serverFeb 19 10:46:29 vm1 pure-ftpd[2520536]: (militry@technobases.in@152.59.116.209) [NOTICE] /home/techno/public_html/milictry1//navodaya.php uploaded (5135 bytes, 5873.49KB/sec)152.59.116.2091269750) 3U) ossec11301gi.New FTP connection.Feb 19 10:46:28 vm1 pure-ftpd[2520536]: (?@152.59.116.209) [INFO] New connection from 152.59.116.209152.59.116.20912697506 C_) ossec11309gi.FTP Authentication success.Feb 19 10:46:28 vm1 pure-ftpd[2520536]: (?@152.59.116.209) [INFO] militry@technobases.in is now logged in152.59.116.2091269750y  Cg) ossec11313ghFTP file uploaded to serverFeb 19 10:44:44 vm1 pure-ftpd[2520176]: (militry@technobases.in@152.59.116.209) [NOTICE] /home/techno/public_html/milictry1//navodaya.php uploaded (5149 bytes, 90.86KB/sec)152.59.116.20912697505  C_) ossec11309ghFTP Authentication success.Feb 19 10:44:42 vm1 pure-ftpd[2520176]: (?@152.59.116.209) [INFO] militry@technobases.in is now logged in152.59.116.2091269750(  3U) ossec11301ghNew FTP connection.Feb 19 10:44:42 vm1 pure-ftpd[2520176]: (?@152.59.116.209) [INFO] New connection from 152.59.116.209152.59.116.20912697505  C_) ossec11309ghMFTP Authentication success.Feb 19 10:42:43 vm1 pure-ftpd[2519771]: (?@152.59.116.209) [INFO] militry@technobases.in is now logged in152.59.116.2091269750 O< + Q 4!h[O1  C % ossec11313gm-FTP file uploaded to serverFeb 19 11:03:30 vm1 pure-ftpd[2524100]: (user@westerndancecompany.com@152.58.99.31) [NOTICE] /home/techno/public_html/westerndancecompany.com//index.php uploaded (25424 bytes, 137.30KB/sec)152.58.99.31126975080 Cg% ossec11309glFTP Authentication success.Feb 19 11:02:44 vm1 pure-ftpd[2524004]: (?@152.58.99.31) [INFO] user@westerndancecompany.com is now logged in152.58.99.311269750#/ 3M% ossec11301glNew FTP connection.Feb 19 11:02:40 vm1 pure-ftpd[2524004]: (?@152.58.99.31) [INFO] New connection from 152.58.99.31152.58.99.311269750z.  Ci) ossec11313glFTP file uploaded to serverFeb 19 11:01:37 vm1 pure-ftpd[2523775]: (militry@technobases.in@152.59.116.209) [NOTICE] /home/techno/public_html/milictry1//navodaya.php uploaded (8283 bytes, 525.97KB/sec)152.59.116.2091269750(-  3U) ossec11301glNew FTP connection.Feb 19 11:01:36 vm1 pure-ftpd[2523775]: (?@152.59.116.209) [INFO] New connection from 152.59.116.209152.59.116.20912697505,  C_) ossec11309glFTP Authentication success.Feb 19 11:01:37 vm1 pure-ftpd[2523775]: (?@152.59.116.209) [INFO] militry@technobases.in is now logged in152.59.116.2091269750"+  3M% ossec11301glNew FTP connection.Feb 19 11:01:15 vm1 pure-ftpd[2523716]: (?@152.58.99.31) [INFO] New connection from 152.58.99.31152.58.99.311269750@*  Cy% ossec11309glFTP Authentication success.Feb 19 11:01:15 vm1 pure-ftpd[2523716]: (?@152.58.99.31) [INFO] user@sainikschoolcoachinginjaipur.com is now logged in152.58.99.311269750z)  Ci) ossec11313gl2FTP file uploaded to serverFeb 19 10:59:22 vm1 pure-ftpd[2523040]: (militry@technobases.in@152.59.116.209) [NOTICE] /home/techno/public_html/milictry1//navodaya.php uploaded (7654 bytes, 463.43KB/sec)152.59.116.2091269750{( Ci) ossec11313gkFTP file uploaded to serverFeb 19 10:58:24 vm1 pure-ftpd[2523040]: (militry@technobases.in@152.59.116.209) [NOTICE] /home/techno/public_html/milictry1//navodaya.php uploaded (7627 bytes, 685.27KB/sec)152.59.116.2091269750('  3U) ossec11301gkNew FTP connection.Feb 19 10:58:22 vm1 pure-ftpd[2523040]: (?@152.59.116.209) [INFO] New connection from 152.59.116.209152.59.116.20912697505&  C_) ossec11309gkFTP Authentication success.Feb 19 10:58:23 vm1 pure-ftpd[2523040]: (?@152.59.116.209) [INFO] militry@technobases.in is now logged in152.59.116.20912697505%  C_) ossec11309gkFTP Authentication success.Feb 19 10:57:04 vm1 pure-ftpd[2522745]: (?@152.59.116.209) [INFO] militry@technobases.in is now logged in152.59.116.2091269750{$  Ck) ossec11313gkFTP file uploaded to serverFeb 19 10:57:05 vm1 pure-ftpd[2522745]: (militry@technobases.in@152.59.116.209) [NOTICE] /home/techno/public_html/milictry1//navodaya.php uploaded (7491 bytes, 8369.65KB/sec)152.59.116.2091269750(#  3U) ossec11301gkNew FTP connection.Feb 19 10:57:04 vm1 pure-ftpd[2522745]: (?@152.59.116.209) [INFO] New connection from 152.59.116.209152.59.116.2091269750V"  I% ossec11331gkr Stealth FTP brute force attackFeb 19 10:56:09 vm1 pure-ftpd[2522584]: (?@152.58.99.31) [WARNING] Authentication failed for user [user@sainikschoolcoachinginjaipur.com]152.58.99.311269750#! 3M% ossec11301gkNNew FTP connection.Feb 19 10:55:33 vm1 pure-ftpd[2522463]: (?@152.58.99.31) [INFO] New connection from 152.58.99.31152.58.99.311269750@  Cy% ossec11309gkNFTP Authentication success.Feb 19 10:55:34 vm1 pure-ftpd[2522463]: (?@152.58.99.31) [INFO] user@sainikschoolcoachinginjaipur.com is now logged in152.58.99.311269750"  3M% ossec11301gkNew FTP connection.Feb 19 10:54:43 vm1 pure-ftpd[2522054]: (?@152.58.99.31) [INFO] New connection from 152.58.99.31152.58.99.311269750@  Cy% ossec11309gkFTP Authentication success.Feb 19 10:54:43 vm1 pure-ftpd[2522054]: (?@152.58.99.31) [INFO] user@sainikschoolcoachinginjaipur.com is now logged in152.58.99.311269750 ~qdWJ=0# zm`SF9, v i \ O B 5 (     r e X K > 1 $  { n a T G : -   w j ] P C 6 )    s f Y L ? 2 %  |obUH;.!xk^QD7*tgZM@3& }pcVI</"yl_RE8+uh[NA4' ~qdWJ=0 1 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 k 1269750 9 1269750 7 1269750 5 1269750 * 1269750 ' 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 D 1269750 + 1269750 $ 1269750  1269750 1269750  1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750  1269750 ~ 1269750 v 1269750 u 1269750 t 1269750 l 1269750 V 1269750 U 1269750 H 1269750 F 1269750 D 1269750 C 1269750 , 1269750  1269750 1269750  1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 p 1269750 K 1269750 5 1269750 3 1269750  1269750  1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750_ 1269750^ 1269750] 1269750Q 1269750N 1269750= 12697504 1269750+ 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750~ 1269750} 1269750| 1269750{ 1269750z 1269750y 1269750x 1269750w 1269750v 1269750u 1269750t 1269750s 1269750r 1269750q 1269750p 1269750o 1269750n 1269750m 1269750l 1269750k 1269750e 1269750d 1269750c 1269750b 1269750a 1269750_ 1269750^ 1269750] 1269750\ 1269750[ 1269750Z 1269750Y 1269750X 1269750W 1269750U 1269750P 1269750O 1269750N 1269750M 1269750L 1269750K 1269750J 1269750I 1269750H 1269750G 1269750F 1269750E 1269750D 1269750C 1269750B 1269750A 1269750@ 1269750> 1269750< 1269750; 12697507 12697506 12697505 12697504 12697503 12697502 12697501 12697500 1269750/ 1269750. 1269750- 1269750, 1269750+ 1269750* 1269750) 1269750 1269750 1269750 1269750 1269750 1269750 Y    X 02yGI5D  C_) ossec11309goMFTP Authentication success.Feb 19 11:12:36 vm1 pure-ftpd[2526002]: (?@152.59.116.209) [INFO] militry@technobases.in is now logged in152.59.116.2091269750zC  Ci) ossec11313gnFTP file uploaded to serverFeb 19 11:10:25 vm1 pure-ftpd[2525679]: (militry@technobases.in@152.59.116.209) [NOTICE] /home/techno/public_html/milictry1//navodaya.php uploaded (9953 bytes, 149.61KB/sec)152.59.116.2091269750(B  3U) ossec11301gnNew FTP connection.Feb 19 11:10:24 vm1 pure-ftpd[2525679]: (?@152.59.116.209) [INFO] New connection from 152.59.116.209152.59.116.20912697505A  C_) ossec11309gnFTP Authentication success.Feb 19 11:10:25 vm1 pure-ftpd[2525679]: (?@152.59.116.209) [INFO] militry@technobases.in is now logged in152.59.116.2091269750[@  -E' ossec13001gn-Exim Auth failed2025-02-19 11:07:49 dovecot_login authenticator failed for (dumy186.panafonet.gr) [62.74.225.186]:33849: 535 Incorrect authentication data (set_id=services)62.74.225.186390903z?  Ci) ossec11313gnFTP file uploaded to serverFeb 19 11:07:21 vm1 pure-ftpd[2524788]: (militry@technobases.in@152.59.116.209) [NOTICE] /home/techno/public_html/milictry1//navodaya.php uploaded (9045 bytes, 289.44KB/sec)152.59.116.2091269750l>  -e) ossec13001gmExim Auth failed2025-02-19 11:06:40 dovecot_login authenticator failed for ([87.200.188.170]) [87.200.188.170]:43952: 535 Incorrect authentication data (set_id=services@heipowersystem.com)87.200.188.1702905575=  C_) ossec11309gmFTP Authentication success.Feb 19 11:06:27 vm1 pure-ftpd[2524788]: (?@152.59.116.209) [INFO] militry@technobases.in is now logged in152.59.116.2091269750z<  Ci) ossec11313gmFTP file uploaded to serverFeb 19 11:06:27 vm1 pure-ftpd[2524788]: (militry@technobases.in@152.59.116.209) [NOTICE] /home/techno/public_html/milictry1//navodaya.php uploaded (8934 bytes, 779.53KB/sec)152.59.116.2091269750(;  3U) ossec11301gmNew FTP connection.Feb 19 11:06:26 vm1 pure-ftpd[2524788]: (?@152.59.116.209) [INFO] New connection from 152.59.116.209152.59.116.2091269750":  3M% ossec11301gmNew FTP connection.Feb 19 11:05:06 vm1 pure-ftpd[2524605]: (?@152.58.99.31) [INFO] New connection from 152.58.99.31152.58.99.311269750R9  A% ossec11302gmFTP Authentication failed.Feb 19 11:05:11 vm1 pure-ftpd[2524605]: (?@152.58.99.31) [WARNING] Authentication failed for user [user@sainikschoolcoachinginjaipur.com]152.58.99.311269750(8  3U) ossec11301gm_New FTP connection.Feb 19 11:04:20 vm1 pure-ftpd[2524327]: (?@152.59.116.209) [INFO] New connection from 152.59.116.209152.59.116.2091269750z7  Ci) ossec11313gm_FTP file uploaded to serverFeb 19 11:04:21 vm1 pure-ftpd[2524327]: (militry@technobases.in@152.59.116.209) [NOTICE] /home/techno/public_html/milictry1//navodaya.php uploaded (8789 bytes, 855.30KB/sec)152.59.116.20912697506  C % ossec11313gm[FTP file uploaded to serverFeb 19 11:04:16 vm1 pure-ftpd[2524100]: (user@westerndancecompany.com@152.58.99.31) [NOTICE] /home/techno/public_html/westerndancecompany.com//index.php uploaded (25431 bytes, 214.31KB/sec)152.58.99.31126975085 Cg% ossec11309gmgFTP Authentication success.Feb 19 11:04:30 vm1 pure-ftpd[2524338]: (?@152.58.99.31) [INFO] user@westerndancecompany.com is now logged in152.58.99.31126975054  C_) ossec11309gm_FTP Authentication success.Feb 19 11:04:21 vm1 pure-ftpd[2524327]: (?@152.59.116.209) [INFO] militry@technobases.in is now logged in152.59.116.2091269750R3  A% ossec11302gmFTP Authentication failed.Feb 19 11:05:01 vm1 pure-ftpd[2524382]: (?@152.58.99.31) [WARNING] Authentication failed for user [user@sainikschoolcoachinginjaipur.com]152.58.99.311269750#2 3M% ossec11301gmgNew FTP connection.Feb 19 11:04:29 vm1 pure-ftpd[2524338]: (?@152.58.99.31) [INFO] New connection from 152.58.99.31152.58.99.311269750 *\~tj`VLB8.$zpf\H>4*   v l b X N D : 0 &    ~ t j ` V L B 8 . $    R z H > p f \ * 4  vlbXND0:&|rh^TJ@6,"xndZPF<2( ~tj`VLB8$.zpf\ | r h ^ T J @ 6 , "    x n d Z P F < 2 (   RRH>4*  vlbXND:0& g gr gT g g g g) g' gu g g gz g g0 g g g g g g g g gV g g g~ g~ g} g} g}} g} g}e g}c g|l g|l g|l g|$ g{ g{ gz gz gz gz< gz< gz: gy gy gy gy gy gy gy gx gx gx gx~ gx} gx| gx{ gxz gwy gwx gww gwwv gwwu gwyt gw;s gw9r gw9q gvp gvo gvn gvm gv7l gv k gv j gv i guh gug guf gu?e gu?d gu=c gtb gta gt` gt _ gt^ gt] gs\ gs,[ gsZ gsY gsX gqW gqV gqU gq"T gq S gq"R gpQ gpP gpO gpcN gpcM gpcL gp#K goJ goI goH goG goMF goME goMD gnC gnB gnA gn-@ gn? gm> gm= gm< gm; gm: gm9 gm_8 gm_7 gm[6 gm3 gmg5 gmg2 gm_4 gm-1 gl0 gl/ gl. gl- gl, gl+ gl* gl2) gk( gk' gk& gk% gk$ gk# gkr" gkN! gkN gk" gk gk gj gj gjP gj: gj: gj: gi gi gi gi` gi. gi. gi. gh gh gh ghM g g g g g g g g g g g g g g g gm gk gk g g} gA g g g g g g g g g/ g g g g{ gY gR gR gF g g g g g ghM ghK gh gh gg gg gg ggs ggs gf gf gf gfg gf] gf[ ge+ ge) gd gd gd gd gd0 gd0 gd. gc gc gc gc gc gc gc gc^ gcX gc gb gb gb gb gb gb gb gb g  gbx gbb gbb gb gb gb ga ga ga ga g` g` g` g` g` g` g` g` g` g`| g`| g` g_ g_ g_ g_ g_[ g_+ g_+ g_+ g^ g^ g^] g^+ g] g] g] g] g] g\ g\2 g\ `TT T 8()p``|W Ck) ossec11313gqFTP file uploaded to serverFeb 19 11:23:29 vm1 pure-ftpd[2528128]: (militry@technobases.in@152.59.116.209) [NOTICE] /home/techno/public_html/milictry1//navodaya.php uploaded (13072 bytes, 313.84KB/sec)152.59.116.20912697505V  C_) ossec11309gqFTP Authentication success.Feb 19 11:23:28 vm1 pure-ftpd[2528128]: (?@152.59.116.209) [INFO] militry@technobases.in is now logged in152.59.116.2091269750(U  3U) ossec11301gqNew FTP connection.Feb 19 11:23:28 vm1 pure-ftpd[2528128]: (?@152.59.116.209) [INFO] New connection from 152.59.116.209152.59.116.2091269750{T  Ck) ossec11313gq"FTP file uploaded to serverFeb 19 11:20:24 vm1 pure-ftpd[2527680]: (militry@technobases.in@152.59.116.209) [NOTICE] /home/techno/public_html/milictry1//navodaya.php uploaded (12852 bytes, 403.67KB/sec)152.59.116.2091269750(S  3U) ossec11301gq New FTP connection.Feb 19 11:20:23 vm1 pure-ftpd[2527680]: (?@152.59.116.209) [INFO] New connection from 152.59.116.209152.59.116.20912697505R  C_) ossec11309gq"FTP Authentication success.Feb 19 11:20:23 vm1 pure-ftpd[2527680]: (?@152.59.116.209) [INFO] militry@technobases.in is now logged in152.59.116.2091269750{Q  Ck) ossec11313gpFTP file uploaded to serverFeb 19 11:18:43 vm1 pure-ftpd[2527166]: (militry@technobases.in@152.59.116.209) [NOTICE] /home/techno/public_html/milictry1//navodaya.php uploaded (12025 bytes, 571.83KB/sec)152.59.116.20912697505P  C_) ossec11309gpFTP Authentication success.Feb 19 11:18:42 vm1 pure-ftpd[2527166]: (?@152.59.116.209) [INFO] militry@technobases.in is now logged in152.59.116.2091269750(O  3U) ossec11301gpNew FTP connection.Feb 19 11:18:42 vm1 pure-ftpd[2527166]: (?@152.59.116.209) [INFO] New connection from 152.59.116.209152.59.116.2091269750{N  Ck) ossec11313gpcFTP file uploaded to serverFeb 19 11:17:14 vm1 pure-ftpd[2526934]: (militry@technobases.in@152.59.116.209) [NOTICE] /home/techno/public_html/milictry1//navodaya.php uploaded (11497 bytes, 542.97KB/sec)152.59.116.2091269750(M  3U) ossec11301gpcNew FTP connection.Feb 19 11:17:13 vm1 pure-ftpd[2526934]: (?@152.59.116.209) [INFO] New connection from 152.59.116.209152.59.116.20912697505L  C_) ossec11309gpcFTP Authentication success.Feb 19 11:17:13 vm1 pure-ftpd[2526934]: (?@152.59.116.209) [INFO] militry@technobases.in is now logged in152.59.116.2091269750{K  Ck) ossec11313gp#FTP file uploaded to serverFeb 19 11:16:09 vm1 pure-ftpd[2526686]: (militry@technobases.in@152.59.116.209) [NOTICE] /home/techno/public_html/milictry1//navodaya.php uploaded (11022 bytes, 650.30KB/sec)152.59.116.2091269750{J  Ck) ossec11313goFTP file uploaded to serverFeb 19 11:15:33 vm1 pure-ftpd[2526686]: (militry@technobases.in@152.59.116.209) [NOTICE] /home/techno/public_html/milictry1//navodaya.php uploaded (10573 bytes, 202.12KB/sec)152.59.116.20912697505I  C_) ossec11309goFTP Authentication success.Feb 19 11:15:33 vm1 pure-ftpd[2526686]: (?@152.59.116.209) [INFO] militry@technobases.in is now logged in152.59.116.2091269750(H  3U) ossec11301goNew FTP connection.Feb 19 11:15:32 vm1 pure-ftpd[2526686]: (?@152.59.116.209) [INFO] New connection from 152.59.116.209152.59.116.2091269750|G Ck) ossec11313goFTP file uploaded to serverFeb 19 11:13:27 vm1 pure-ftpd[2526002]: (militry@technobases.in@152.59.116.209) [NOTICE] /home/techno/public_html/milictry1//navodaya.php uploaded (10186 bytes, 491.27KB/sec)152.59.116.2091269750|F Ck) ossec11313goMFTP file uploaded to serverFeb 19 11:12:37 vm1 pure-ftpd[2526002]: (militry@technobases.in@152.59.116.209) [NOTICE] /home/techno/public_html/milictry1//navodaya.php uploaded (10165 bytes, 951.57KB/sec)152.59.116.2091269750(E  3U) ossec11301goMNew FTP connection.Feb 19 11:12:36 vm1 pure-ftpd[2526002]: (?@152.59.116.209) [INFO] New connection from 152.59.116.209152.59.116.2091269750 0T l  \>?0(j  3U) ossec11301gv New FTP connection.Feb 19 11:41:23 vm1 pure-ftpd[2531564]: (?@152.59.116.209) [INFO] New connection from 152.59.116.209152.59.116.2091269750{i  Ck) ossec11313gv FTP file uploaded to serverFeb 19 11:41:24 vm1 pure-ftpd[2531564]: (militry@technobases.in@152.59.116.209) [NOTICE] /home/techno/public_html/milictry1//navodaya.php uploaded (16894 bytes, 203.99KB/sec)152.59.116.2091269750{h  Ck) ossec11313guFTP file uploaded to serverFeb 19 11:39:28 vm1 pure-ftpd[2531093]: (militry@technobases.in@152.59.116.209) [NOTICE] /home/techno/public_html/milictry1//navodaya.php uploaded (16658 bytes, 180.03KB/sec)152.59.116.20912697505g  C_) ossec11309guFTP Authentication success.Feb 19 11:39:27 vm1 pure-ftpd[2531093]: (?@152.59.116.209) [INFO] militry@technobases.in is now logged in152.59.116.2091269750(f  3U) ossec11301guNew FTP connection.Feb 19 11:39:27 vm1 pure-ftpd[2531093]: (?@152.59.116.209) [INFO] New connection from 152.59.116.209152.59.116.2091269750{e  Ck) ossec11313gu?FTP file uploaded to serverFeb 19 11:37:57 vm1 pure-ftpd[2530895]: (militry@technobases.in@152.59.116.209) [NOTICE] /home/techno/public_html/milictry1//navodaya.php uploaded (16184 bytes, 174.53KB/sec)152.59.116.20912697505d  C_) ossec11309gu?FTP Authentication success.Feb 19 11:37:57 vm1 pure-ftpd[2530895]: (?@152.59.116.209) [INFO] militry@technobases.in is now logged in152.59.116.2091269750(c  3U) ossec11301gu=New FTP connection.Feb 19 11:37:56 vm1 pure-ftpd[2530895]: (?@152.59.116.209) [INFO] New connection from 152.59.116.209152.59.116.20912697505b  C_) ossec11309gtFTP Authentication success.Feb 19 11:36:21 vm1 pure-ftpd[2530547]: (?@152.59.116.209) [INFO] militry@technobases.in is now logged in152.59.116.2091269750(a  3U) ossec11301gtNew FTP connection.Feb 19 11:36:21 vm1 pure-ftpd[2530547]: (?@152.59.116.209) [INFO] New connection from 152.59.116.209152.59.116.2091269750|` Ck) ossec11313gtFTP file uploaded to serverFeb 19 11:36:23 vm1 pure-ftpd[2530547]: (militry@technobases.in@152.59.116.209) [NOTICE] /home/techno/public_html/milictry1//navodaya.php uploaded (15626 bytes, 215.44KB/sec)152.59.116.2091269750{_  Ck) ossec11313gt FTP file uploaded to serverFeb 19 11:33:11 vm1 pure-ftpd[2529983]: (militry@technobases.in@152.59.116.209) [NOTICE] /home/techno/public_html/milictry1//navodaya.php uploaded (15466 bytes, 143.83KB/sec)152.59.116.2091269750(^  3U) ossec11301gtNew FTP connection.Feb 19 11:33:10 vm1 pure-ftpd[2529983]: (?@152.59.116.209) [INFO] New connection from 152.59.116.209152.59.116.20912697505]  C_) ossec11309gtFTP Authentication success.Feb 19 11:33:10 vm1 pure-ftpd[2529983]: (?@152.59.116.209) [INFO] militry@technobases.in is now logged in152.59.116.2091269750-\  =S+ ossec13008gsMail Reciepient rejected2025-02-19 11:31:45 H=(mail.rokamauka.com) [165.154.226.249]:56689 F= rejected RCPT : Rejected relay attempt: '165.154.226.249' From: 'arsrbpw@rokamauka.com' To: 'validxxxg@gmail.com'165.154.226.2491668284{[  Ck) ossec11313gs,FTP file uploaded to serverFeb 19 11:29:08 vm1 pure-ftpd[2529040]: (militry@technobases.in@152.59.116.209) [NOTICE] /home/techno/public_html/milictry1//navodaya.php uploaded (13661 bytes, 156.53KB/sec)152.59.116.2091269750{Z  Ck) ossec11313gsFTP file uploaded to serverFeb 19 11:28:30 vm1 pure-ftpd[2529040]: (militry@technobases.in@152.59.116.209) [NOTICE] /home/techno/public_html/milictry1//navodaya.php uploaded (13473 bytes, 163.98KB/sec)152.59.116.20912697505Y  C_) ossec11309gsFTP Authentication success.Feb 19 11:28:29 vm1 pure-ftpd[2529040]: (?@152.59.116.209) [INFO] militry@technobases.in is now logged in152.59.116.2091269750(X  3U) ossec11301gsNew FTP connection.Feb 19 11:28:29 vm1 pure-ftpd[2529040]: (?@152.59.116.209) [INFO] New connection from 152.59.116.209152.59.116.2091269750 UGG H 8 pqSTU{}  Ck) ossec11313gxFTP file uploaded to serverFeb 19 11:51:56 vm1 pure-ftpd[2533667]: (militry@technobases.in@152.59.116.209) [NOTICE] /home/techno/public_html/milictry1//navodaya.php uploaded (19495 bytes, 252.00KB/sec)152.59.116.2091269750{|  Ck) ossec11313gxFTP file uploaded to serverFeb 19 11:50:05 vm1 pure-ftpd[2533412]: (militry@technobases.in@152.59.116.209) [NOTICE] /home/techno/public_html/milictry1//navodaya.php uploaded (18941 bytes, 195.01KB/sec)152.59.116.2091269750({  3U) ossec11301gxNew FTP connection.Feb 19 11:50:04 vm1 pure-ftpd[2533412]: (?@152.59.116.209) [INFO] New connection from 152.59.116.209152.59.116.20912697505z  C_) ossec11309gxFTP Authentication success.Feb 19 11:50:04 vm1 pure-ftpd[2533412]: (?@152.59.116.209) [INFO] militry@technobases.in is now logged in152.59.116.20912697505y  C_) ossec11309gwFTP Authentication success.Feb 19 11:48:33 vm1 pure-ftpd[2533027]: (?@152.59.116.209) [INFO] militry@technobases.in is now logged in152.59.116.2091269750{x  Ck) ossec11313gwFTP file uploaded to serverFeb 19 11:48:34 vm1 pure-ftpd[2533027]: (militry@technobases.in@152.59.116.209) [NOTICE] /home/techno/public_html/milictry1//navodaya.php uploaded (18679 bytes, 226.37KB/sec)152.59.116.2091269750(w  3U) ossec11301gwNew FTP connection.Feb 19 11:48:33 vm1 pure-ftpd[2533027]: (?@152.59.116.209) [INFO] New connection from 152.59.116.209152.59.116.2091269750(v  3U) ossec11301gwwNew FTP connection.Feb 19 11:47:26 vm1 pure-ftpd[2532848]: (?@152.59.116.209) [INFO] New connection from 152.59.116.209152.59.116.20912697505u  C_) ossec11309gwwFTP Authentication success.Feb 19 11:47:26 vm1 pure-ftpd[2532848]: (?@152.59.116.209) [INFO] militry@technobases.in is now logged in152.59.116.2091269750{t  Ck) ossec11313gwyFTP file uploaded to serverFeb 19 11:47:27 vm1 pure-ftpd[2532848]: (militry@technobases.in@152.59.116.209) [NOTICE] /home/techno/public_html/milictry1//navodaya.php uploaded (18336 bytes, 178.86KB/sec)152.59.116.2091269750{s  Ck) ossec11313gw;FTP file uploaded to serverFeb 19 11:46:25 vm1 pure-ftpd[2532591]: (militry@technobases.in@152.59.116.209) [NOTICE] /home/techno/public_html/milictry1//navodaya.php uploaded (18125 bytes, 196.13KB/sec)152.59.116.20912697505r  C_) ossec11309gw9FTP Authentication success.Feb 19 11:46:24 vm1 pure-ftpd[2532591]: (?@152.59.116.209) [INFO] militry@technobases.in is now logged in152.59.116.2091269750(q  3U) ossec11301gw9New FTP connection.Feb 19 11:46:24 vm1 pure-ftpd[2532591]: (?@152.59.116.209) [INFO] New connection from 152.59.116.209152.59.116.2091269750{p  Ck) ossec11313gvFTP file uploaded to serverFeb 19 11:45:20 vm1 pure-ftpd[2532431]: (militry@technobases.in@152.59.116.209) [NOTICE] /home/techno/public_html/milictry1//navodaya.php uploaded (17879 bytes, 193.31KB/sec)152.59.116.20912697505o  C_) ossec11309gvFTP Authentication success.Feb 19 11:45:19 vm1 pure-ftpd[2532431]: (?@152.59.116.209) [INFO] militry@technobases.in is now logged in152.59.116.2091269750(n  3U) ossec11301gvNew FTP connection.Feb 19 11:45:18 vm1 pure-ftpd[2532431]: (?@152.59.116.209) [INFO] New connection from 152.59.116.209152.59.116.2091269750{m  Ck) ossec11313gvFTP file uploaded to serverFeb 19 11:43:30 vm1 pure-ftpd[2531564]: (militry@technobases.in@152.59.116.209) [NOTICE] /home/techno/public_html/milictry1//navodaya.php uploaded (17503 bytes, 199.10KB/sec)152.59.116.2091269750|l Ck) ossec11313gv7FTP file uploaded to serverFeb 19 11:42:05 vm1 pure-ftpd[2531564]: (militry@technobases.in@152.59.116.209) [NOTICE] /home/techno/public_html/milictry1//navodaya.php uploaded (17023 bytes, 233.81KB/sec)152.59.116.20912697505k  C_) ossec11309gv FTP Authentication success.Feb 19 11:41:24 vm1 pure-ftpd[2531564]: (?@152.59.116.209) [INFO] militry@technobases.in is now logged in152.59.116.2091269750 G 9 :*qrb5  C_) ossec11309g{FTP Authentication success.Feb 19 12:05:47 vm1 pure-ftpd[2536714]: (?@152.59.116.209) [INFO] militry@technobases.in is now logged in152.59.116.2091269750(  3U) ossec11301g{New FTP connection.Feb 19 12:05:47 vm1 pure-ftpd[2536714]: (?@152.59.116.209) [INFO] New connection from 152.59.116.209152.59.116.20912697505  C_) ossec11309gzFTP Authentication success.Feb 19 12:00:42 vm1 pure-ftpd[2535454]: (?@152.59.116.209) [INFO] militry@technobases.in is now logged in152.59.116.2091269750{  Ck) ossec11313gzFTP file uploaded to serverFeb 19 12:00:43 vm1 pure-ftpd[2535454]: (militry@technobases.in@152.59.116.209) [NOTICE] /home/techno/public_html/milictry1//navodaya.php uploaded (22007 bytes, 225.05KB/sec)152.59.116.2091269750(  3U) ossec11301gzNew FTP connection.Feb 19 12:00:42 vm1 pure-ftpd[2535454]: (?@152.59.116.209) [INFO] New connection from 152.59.116.209152.59.116.2091269750{  Ck) ossec11313gz<FTP file uploaded to serverFeb 19 11:59:14 vm1 pure-ftpd[2535030]: (militry@technobases.in@152.59.116.209) [NOTICE] /home/techno/public_html/milictry1//navodaya.php uploaded (21674 bytes, 201.84KB/sec)152.59.116.20912697505  C_) ossec11309gz<FTP Authentication success.Feb 19 11:59:13 vm1 pure-ftpd[2535030]: (?@152.59.116.209) [INFO] militry@technobases.in is now logged in152.59.116.2091269750(  3U) ossec11301gz:New FTP connection.Feb 19 11:59:13 vm1 pure-ftpd[2535030]: (?@152.59.116.209) [INFO] New connection from 152.59.116.209152.59.116.20912697505  C_) ossec11309gyFTP Authentication success.Feb 19 11:57:53 vm1 pure-ftpd[2534771]: (?@152.59.116.209) [INFO] militry@technobases.in is now logged in152.59.116.2091269750{  Ck) ossec11313gyFTP file uploaded to serverFeb 19 11:57:54 vm1 pure-ftpd[2534771]: (militry@technobases.in@152.59.116.209) [NOTICE] /home/techno/public_html/milictry1//navodaya.php uploaded (21196 bytes, 180.46KB/sec)152.59.116.2091269750(  3U) ossec11301gyNew FTP connection.Feb 19 11:57:52 vm1 pure-ftpd[2534771]: (?@152.59.116.209) [INFO] New connection from 152.59.116.209152.59.116.2091269750{  Ck) ossec11313gyFTP file uploaded to serverFeb 19 11:56:52 vm1 pure-ftpd[2534608]: (militry@technobases.in@152.59.116.209) [NOTICE] /home/techno/public_html/milictry1//navodaya.php uploaded (21084 bytes, 273.20KB/sec)152.59.116.2091269750(  3U) ossec11301gyNew FTP connection.Feb 19 11:56:51 vm1 pure-ftpd[2534608]: (?@152.59.116.209) [INFO] New connection from 152.59.116.209152.59.116.20912697505  C_) ossec11309gyFTP Authentication success.Feb 19 11:56:51 vm1 pure-ftpd[2534608]: (?@152.59.116.209) [INFO] militry@technobases.in is now logged in152.59.116.2091269750{  Ck) ossec11313gyFTP file uploaded to serverFeb 19 11:54:19 vm1 pure-ftpd[2533667]: (militry@technobases.in@152.59.116.209) [NOTICE] /home/techno/public_html/milictry1//navodaya.php uploaded (20666 bytes, 237.46KB/sec)152.59.116.2091269750{  Ck) ossec11313gxFTP file uploaded to serverFeb 19 11:53:39 vm1 pure-ftpd[2533667]: (militry@technobases.in@152.59.116.209) [NOTICE] /home/techno/public_html/milictry1//navodaya.php uploaded (20119 bytes, 230.55KB/sec)152.59.116.2091269750{  Ck) ossec11313gxFTP file uploaded to serverFeb 19 11:52:56 vm1 pure-ftpd[2533667]: (militry@technobases.in@152.59.116.209) [NOTICE] /home/techno/public_html/milictry1//navodaya.php uploaded (19582 bytes, 223.41KB/sec)152.59.116.2091269750(  3U) ossec11301gxNew FTP connection.Feb 19 11:51:54 vm1 pure-ftpd[2533667]: (?@152.59.116.209) [INFO] New connection from 152.59.116.209152.59.116.20912697505~  C_) ossec11309gxFTP Authentication success.Feb 19 11:51:55 vm1 pure-ftpd[2533667]: (?@152.59.116.209) [INFO] militry@technobases.in is now logged in152.59.116.2091269750  _ 8 p aJ)# 3U) ossec11301gNew FTP connection.Feb 19 12:45:06 vm1 pure-ftpd[2543807]: (?@152.59.108.251) [INFO] New connection from 152.59.108.251152.59.108.2511269750D"  C}) ossec11309gFTP Authentication success.Feb 19 12:45:06 vm1 pure-ftpd[2543807]: (?@152.59.108.251) [INFO] user@sainikschoolcoachinginjaipur.com is now logged in152.59.108.2511269750(!  3U) ossec11301gNew FTP connection.Feb 19 12:43:13 vm1 pure-ftpd[2543389]: (?@152.59.108.251) [INFO] New connection from 152.59.108.251152.59.108.2511269750D  C}) ossec11309gFTP Authentication success.Feb 19 12:43:15 vm1 pure-ftpd[2543389]: (?@152.59.108.251) [INFO] user@sainikschoolcoachinginjaipur.com is now logged in152.59.108.2511269750O  U) ossec11001gVDeferred login on the cpanel service[2025-02-19 12:42:21 +0530] info [whostmgrd] 106.206.184.92 - root "GET /cpsess6120224901/json-api/loadavg HTTP/1.1" DEFERRED LOGIN whostmgrd: cookie ip check: IP address has changed: IP Address [182.68.227.241] != Current IP Address [106.206.184.92]106.206.184.921269750) 3U) ossec11301gNew FTP connection.Feb 19 12:20:03 vm1 pure-ftpd[2539537]: (?@152.59.108.251) [INFO] New connection from 152.59.108.251152.59.108.2511269750W A#) ossec11302gFTP Authentication failed.Feb 19 12:19:42 vm1 pure-ftpd[2539349]: (?@152.59.108.251) [WARNING] Authentication failed for user [user@sainikschoolcoachinginjaipur.com]152.59.108.2511269750D  C}) ossec11309g~FTP Authentication success.Feb 19 12:19:27 vm1 pure-ftpd[2539276]: (?@152.59.108.251) [INFO] user@sainikschoolcoachinginjaipur.com is now logged in152.59.108.2511269750) 3U) ossec11301g~New FTP connection.Feb 19 12:19:27 vm1 pure-ftpd[2539276]: (?@152.59.108.251) [INFO] New connection from 152.59.108.251152.59.108.2511269750V  A#) ossec11302g}FTP Authentication failed.Feb 19 12:14:07 vm1 pure-ftpd[2538355]: (?@152.59.108.251) [WARNING] Authentication failed for user [user@sainikschoolcoachinginjaipur.com]152.59.108.2511269750W A#) ossec11302g}FTP Authentication failed.Feb 19 12:13:11 vm1 pure-ftpd[2538227]: (?@152.59.108.251) [WARNING] Authentication failed for user [user@sainikschoolcoachinginjaipur.com]152.59.108.2511269750) 3U) ossec11301g}}New FTP connection.Feb 19 12:13:07 vm1 pure-ftpd[2538227]: (?@152.59.108.251) [INFO] New connection from 152.59.108.251152.59.108.2511269750D  C}) ossec11309g}FTP Authentication success.Feb 19 12:13:37 vm1 pure-ftpd[2538313]: (?@152.59.108.251) [INFO] user@sainikschoolcoachinginjaipur.com is now logged in152.59.108.2511269750D  C}) ossec11309g}eFTP Authentication success.Feb 19 12:12:42 vm1 pure-ftpd[2538159]: (?@152.59.108.251) [INFO] user@sainikschoolcoachinginjaipur.com is now logged in152.59.108.2511269750(  3U) ossec11301g}cNew FTP connection.Feb 19 12:12:42 vm1 pure-ftpd[2538159]: (?@152.59.108.251) [INFO] New connection from 152.59.108.251152.59.108.2511269750v  Ca) ossec11313g|lFTP file uploaded to serverFeb 19 12:08:35 vm1 pure-ftpd[2537338]: (militry@technobases.in@152.59.116.209) [NOTICE] /home/techno/public_html/milictry1//blog.php uploaded (3850 bytes, 656.27KB/sec)152.59.116.20912697505  C_) ossec11309g|lFTP Authentication success.Feb 19 12:08:35 vm1 pure-ftpd[2537338]: (?@152.59.116.209) [INFO] militry@technobases.in is now logged in152.59.116.2091269750(  3U) ossec11301g|lNew FTP connection.Feb 19 12:08:34 vm1 pure-ftpd[2537338]: (?@152.59.116.209) [INFO] New connection from 152.59.116.209152.59.116.2091269750q -m' ossec13001g|$Exim Auth failed2025-02-19 12:07:24 dovecot_plain authenticator failed for ip85-215-236-96.pbiaas.com [85.215.236.96]:61541: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)85.215.236.962921044 "H I N8RGV3 -;% ossec13001gTExim Auth failed2025-02-19 14:07:39 dovecot_login authenticator failed for (User) [80.94.95.228]:3740: 535 Incorrect authentication data (set_id=tuning@technobases.in)80.94.95.228798549u2  Ca' ossec11313gFTP file uploaded to serverFeb 19 14:06:30 vm1 pure-ftpd[2559296]: (militry@technobases.in@152.59.116.84) [NOTICE] /home/techno/public_html/milictry1//blog.php uploaded (6832 bytes, 1158.51KB/sec)152.59.116.84126975031  C]' ossec11309gFTP Authentication success.Feb 19 14:06:30 vm1 pure-ftpd[2559296]: (?@152.59.116.84) [INFO] militry@technobases.in is now logged in152.59.116.841269750%0  3Q' ossec11301gNew FTP connection.Feb 19 14:06:29 vm1 pure-ftpd[2559296]: (?@152.59.116.84) [INFO] New connection from 152.59.116.84152.59.116.8412697504/ C]' ossec11309g)FTP Authentication success.Feb 19 13:54:07 vm1 pure-ftpd[2556903]: (?@152.59.116.84) [INFO] militry@technobases.in is now logged in152.59.116.841269750&. 3Q' ossec11301g'New FTP connection.Feb 19 13:54:07 vm1 pure-ftpd[2556903]: (?@152.59.116.84) [INFO] New connection from 152.59.116.84152.59.116.841269750%-  3Q' ossec11301guNew FTP connection.Feb 19 13:21:16 vm1 pure-ftpd[2550521]: (?@13.64.108.135) [INFO] New connection from 13.64.108.13513.64.108.13562520019,  UU) ossec11001gDeferred login on the cpanel service[2025-02-19 13:05:05 +0530] info [whostmgrd] 106.206.184.92 - root "POST /xfercpanel HTTP/1.1" DEFERRED LOGIN whostmgrd: cookie ip check: IP address has changed: IP Address [182.68.227.241] != Current IP Address [106.206.184.92]106.206.184.921269750+  5') ossec11011gWHM SSO login failed[2025-02-19 13:05:05 +0530] info [whostmgrd] 106.206.184.92 PURGE root:CX65qeItkdbhR8Mw badpass [cookie ip check: IP address has changed: IP Address [182.68.227.241] != Current IP Address [106.206.184.92]]106.206.184.921269750P* U) ossec11001gzDeferred login on the cpanel service[2025-02-19 13:04:17 +0530] info [whostmgrd] 106.206.184.92 - root "GET /cpsess6120224901/json-api/loadavg HTTP/1.1" DEFERRED LOGIN whostmgrd: cookie ip check: IP address has changed: IP Address [182.68.227.241] != Current IP Address [106.206.184.92]106.206.184.921269750O)  U) ossec11001gDeferred login on the cpanel service[2025-02-19 13:00:50 +0530] info [whostmgrd] 106.206.184.92 - root "GET /cpsess6120224901/json-api/loadavg HTTP/1.1" DEFERRED LOGIN whostmgrd: cookie ip check: IP address has changed: IP Address [182.68.227.241] != Current IP Address [106.206.184.92]106.206.184.921269750P( U) ossec11001g0 Deferred login on the cpanel service[2025-02-19 12:58:47 +0530] info [whostmgrd] 106.206.184.92 - root "GET /cpsess6120224901/json-api/loadavg HTTP/1.1" DEFERRED LOGIN whostmgrd: cookie ip check: IP address has changed: IP Address [182.68.227.241] != Current IP Address [106.206.184.92]106.206.184.921269750('  3U) ossec11301gNew FTP connection.Feb 19 12:53:29 vm1 pure-ftpd[2545151]: (?@152.59.116.129) [INFO] New connection from 152.59.116.129152.59.116.1291269750O&  U) ossec11001gDeferred login on the cpanel service[2025-02-19 12:52:50 +0530] info [whostmgrd] 106.206.184.92 - root "GET /cpsess6120224901/json-api/loadavg HTTP/1.1" DEFERRED LOGIN whostmgrd: cookie ip check: IP address has changed: IP Address [182.68.227.241] != Current IP Address [106.206.184.92]106.206.184.921269750V%  A#) ossec11302gFTP Authentication failed.Feb 19 12:45:19 vm1 pure-ftpd[2543824]: (?@152.59.108.251) [WARNING] Authentication failed for user [user@sainikschoolcoachinginjaipur.com]152.59.108.2511269750Z$  I#) ossec11331g Stealth FTP brute force attackFeb 19 12:45:14 vm1 pure-ftpd[2543813]: (?@152.59.108.251) [WARNING] Authentication failed for user [user@sainikschoolcoachinginjaipur.com]152.59.108.2511269750 {'p * s  %*s${%F  3Q' ossec11301gNew FTP connection.Feb 19 14:16:58 vm1 pure-ftpd[2561738]: (?@152.59.116.84) [INFO] New connection from 152.59.116.84152.59.116.841269750vE  Cc' ossec11313gFTP file uploaded to serverFeb 19 14:16:59 vm1 pure-ftpd[2561738]: (militry@technobases.in@152.59.116.84) [NOTICE] /home/techno/public_html/milictry1//index.php uploaded (27318 bytes, 293.02KB/sec)152.59.116.8412697503D  C]' ossec11309gFTP Authentication success.Feb 19 14:16:59 vm1 pure-ftpd[2561738]: (?@152.59.116.84) [INFO] militry@technobases.in is now logged in152.59.116.841269750vC  Cc' ossec11313g/FTP file uploaded to serverFeb 19 14:15:33 vm1 pure-ftpd[2561186]: (militry@technobases.in@152.59.116.84) [NOTICE] /home/techno/public_html/milictry1//index.php uploaded (27258 bytes, 265.52KB/sec)152.59.116.841269750wB Cc' ossec11313gFTP file uploaded to serverFeb 19 14:14:07 vm1 pure-ftpd[2561186]: (militry@technobases.in@152.59.116.84) [NOTICE] /home/techno/public_html/milictry1//index.php uploaded (27262 bytes, 211.69KB/sec)152.59.116.841269750%A  3Q' ossec11301gNew FTP connection.Feb 19 14:14:06 vm1 pure-ftpd[2561186]: (?@152.59.116.84) [INFO] New connection from 152.59.116.84152.59.116.8412697503@  C]' ossec11309gFTP Authentication success.Feb 19 14:14:07 vm1 pure-ftpd[2561186]: (?@152.59.116.84) [INFO] militry@technobases.in is now logged in152.59.116.841269750w? Cc' ossec11313g{FTP file uploaded to serverFeb 19 14:12:32 vm1 pure-ftpd[2560706]: (militry@technobases.in@152.59.116.84) [NOTICE] /home/techno/public_html/milictry1//index.php uploaded (27285 bytes, 353.47KB/sec)152.59.116.841269750d>  E=' ossec11314gFFTP file deleted from serverFeb 19 14:11:40 vm1 pure-ftpd[2560574]: (militry@technobases.in@152.59.116.84) [NOTICE] Deleted /home/techno/public_html/milictry1//images/banner_02.png152.59.116.841269750=  C{' ossec11313gYFTP file uploaded to serverFeb 19 14:11:58 vm1 pure-ftpd[2560706]: (militry@technobases.in@152.59.116.84) [NOTICE] /home/techno/public_html/milictry1//images/banner_02.png uploaded (733164 bytes, 193.76KB/sec)152.59.116.841269750%<  3Q' ossec11301gRNew FTP connection.Feb 19 14:11:54 vm1 pure-ftpd[2560706]: (?@152.59.116.84) [INFO] New connection from 152.59.116.84152.59.116.8412697503;  C]' ossec11309gRFTP Authentication success.Feb 19 14:11:54 vm1 pure-ftpd[2560706]: (?@152.59.116.84) [INFO] militry@technobases.in is now logged in152.59.116.8412697503:  C]' ossec11309gFTP Authentication success.Feb 19 14:10:55 vm1 pure-ftpd[2560574]: (?@152.59.116.84) [INFO] militry@technobases.in is now logged in152.59.116.841269750%9  3Q' ossec11301gNew FTP connection.Feb 19 14:10:55 vm1 pure-ftpd[2560574]: (?@152.59.116.84) [INFO] New connection from 152.59.116.84152.59.116.841269750v8  Cc' ossec11313gFTP file uploaded to serverFeb 19 14:10:37 vm1 pure-ftpd[2560230]: (militry@technobases.in@152.59.116.84) [NOTICE] /home/techno/public_html/milictry1//index.php uploaded (27246 bytes, 329.97KB/sec)152.59.116.841269750v7  Cc' ossec11313gFTP file uploaded to serverFeb 19 14:09:53 vm1 pure-ftpd[2560230]: (militry@technobases.in@152.59.116.84) [NOTICE] /home/techno/public_html/milictry1//index.php uploaded (27298 bytes, 212.48KB/sec)152.59.116.841269750%6  3Q' ossec11301gNew FTP connection.Feb 19 14:09:53 vm1 pure-ftpd[2560230]: (?@152.59.116.84) [INFO] New connection from 152.59.116.84152.59.116.84126975035  C]' ossec11309gFTP Authentication success.Feb 19 14:09:53 vm1 pure-ftpd[2560230]: (?@152.59.116.84) [INFO] militry@technobases.in is now logged in152.59.116.841269750U4 -9% ossec13001grExim Auth failed2025-02-19 14:08:10 dovecot_login authenticator failed for (User) [80.94.95.228]:58528: 535 Incorrect authentication data (set_id=tsgw@technobases.in)80.94.95.228798549 D b TZ`fND%Y  3Q' ossec11301gNew FTP connection.Feb 19 14:56:55 vm1 pure-ftpd[2569248]: (?@152.59.116.84) [INFO] New connection from 152.59.116.84152.59.116.8412697503X  C]' ossec11309gFTP Authentication success.Feb 19 14:56:55 vm1 pure-ftpd[2569248]: (?@152.59.116.84) [INFO] militry@technobases.in is now logged in152.59.116.841269750&W 3Q' ossec11301gNew FTP connection.Feb 19 14:39:32 vm1 pure-ftpd[2566059]: (?@152.59.116.84) [INFO] New connection from 152.59.116.84152.59.116.8412697504V C]' ossec11309gFTP Authentication success.Feb 19 14:39:32 vm1 pure-ftpd[2566059]: (?@152.59.116.84) [INFO] militry@technobases.in is now logged in152.59.116.841269750%U  3Q' ossec11301gNew FTP connection.Feb 19 14:31:41 vm1 pure-ftpd[2564619]: (?@152.59.116.84) [INFO] New connection from 152.59.116.84152.59.116.8412697503T  C]' ossec11309gFTP Authentication success.Feb 19 14:31:42 vm1 pure-ftpd[2564619]: (?@152.59.116.84) [INFO] militry@technobases.in is now logged in152.59.116.841269750vS  Cc' ossec11313gFTP file uploaded to serverFeb 19 14:31:11 vm1 pure-ftpd[2564078]: (militry@technobases.in@152.59.116.84) [NOTICE] /home/techno/public_html/milictry1//index.php uploaded (27259 bytes, 355.23KB/sec)152.59.116.841269750vR  Cc' ossec11313gFTP file uploaded to serverFeb 19 14:30:22 vm1 pure-ftpd[2564078]: (militry@technobases.in@152.59.116.84) [NOTICE] /home/techno/public_html/milictry1//index.php uploaded (26975 bytes, 262.72KB/sec)152.59.116.841269750vQ  Cc' ossec11313gmFTP file uploaded to serverFeb 19 14:29:24 vm1 pure-ftpd[2564078]: (militry@technobases.in@152.59.116.84) [NOTICE] /home/techno/public_html/milictry1//index.php uploaded (26931 bytes, 305.58KB/sec)152.59.116.841269750%P  3Q' ossec11301gkNew FTP connection.Feb 19 14:29:23 vm1 pure-ftpd[2564078]: (?@152.59.116.84) [INFO] New connection from 152.59.116.84152.59.116.8412697503O  C]' ossec11309gkFTP Authentication success.Feb 19 14:29:23 vm1 pure-ftpd[2564078]: (?@152.59.116.84) [INFO] militry@technobases.in is now logged in152.59.116.841269750vN  Cc' ossec11313gFTP file uploaded to serverFeb 19 14:26:34 vm1 pure-ftpd[2562972]: (militry@technobases.in@152.59.116.84) [NOTICE] /home/techno/public_html/milictry1//index.php uploaded (27259 bytes, 352.43KB/sec)152.59.116.841269750wM Cc' ossec11313g}FTP file uploaded to serverFeb 19 14:25:24 vm1 pure-ftpd[2562972]: (militry@technobases.in@152.59.116.84) [NOTICE] /home/techno/public_html/milictry1//index.php uploaded (26931 bytes, 348.95KB/sec)152.59.116.841269750wL Cc' ossec11313gAFTP file uploaded to serverFeb 19 14:24:23 vm1 pure-ftpd[2562972]: (militry@technobases.in@152.59.116.84) [NOTICE] /home/techno/public_html/milictry1//index.php uploaded (27382 bytes, 524.06KB/sec)152.59.116.841269750K  C}' ossec11313gFTP file uploaded to serverFeb 19 14:23:50 vm1 pure-ftpd[2562972]: (militry@technobases.in@152.59.116.84) [NOTICE] /home/techno/public_html/milictry1//images/banner_03.png uploaded (2182854 bytes, 770.82KB/sec)152.59.116.8412697503J  C]' ossec11309gFTP Authentication success.Feb 19 14:23:47 vm1 pure-ftpd[2562972]: (?@152.59.116.84) [INFO] militry@technobases.in is now logged in152.59.116.841269750%I  3Q' ossec11301gNew FTP connection.Feb 19 14:23:47 vm1 pure-ftpd[2562972]: (?@152.59.116.84) [INFO] New connection from 152.59.116.84152.59.116.841269750vH  Cc' ossec11313gFTP file uploaded to serverFeb 19 14:18:29 vm1 pure-ftpd[2561738]: (militry@technobases.in@152.59.116.84) [NOTICE] /home/techno/public_html/milictry1//index.php uploaded (27246 bytes, 295.28KB/sec)152.59.116.841269750wG Cc' ossec11313gFTP file uploaded to serverFeb 19 14:17:22 vm1 pure-ftpd[2561738]: (militry@technobases.in@152.59.116.84) [NOTICE] /home/techno/public_html/milictry1//index.php uploaded (27318 bytes, 380.07KB/sec)152.59.116.841269750 Q  U [I@vl  Cc' ossec11313gQFTP file uploaded to serverFeb 19 15:37:13 vm1 pure-ftpd[2576772]: (militry@technobases.in@152.59.116.52) [NOTICE] /home/techno/public_html/milictry1//index.php uploaded (27313 bytes, 176.95KB/sec)152.59.116.521269750vk  Cc' ossec11313g%FTP file uploaded to serverFeb 19 15:36:28 vm1 pure-ftpd[2576772]: (militry@technobases.in@152.59.116.52) [NOTICE] /home/techno/public_html/milictry1//index.php uploaded (27281 bytes, 211.65KB/sec)152.59.116.521269750%j  3Q' ossec11301g%New FTP connection.Feb 19 15:36:27 vm1 pure-ftpd[2576772]: (?@152.59.116.52) [INFO] New connection from 152.59.116.52152.59.116.5212697503i  C]' ossec11309g%FTP Authentication success.Feb 19 15:36:28 vm1 pure-ftpd[2576772]: (?@152.59.116.52) [INFO] militry@technobases.in is now logged in152.59.116.5212697503h  C]' ossec11309gFTP Authentication success.Feb 19 15:35:03 vm1 pure-ftpd[2576535]: (?@152.59.116.52) [INFO] militry@technobases.in is now logged in152.59.116.521269750%g  3Q' ossec11301gNew FTP connection.Feb 19 15:35:02 vm1 pure-ftpd[2576535]: (?@152.59.116.52) [INFO] New connection from 152.59.116.52152.59.116.521269750%f  3Q' ossec11301gNew FTP connection.Feb 19 15:27:38 vm1 pure-ftpd[2574964]: (?@152.59.116.52) [INFO] New connection from 152.59.116.52152.59.116.5212697503e  C]' ossec11309gFTP Authentication success.Feb 19 15:27:38 vm1 pure-ftpd[2574964]: (?@152.59.116.52) [INFO] militry@technobases.in is now logged in152.59.116.521269750wd Cc' ossec11313gFTP file uploaded to serverFeb 19 15:27:39 vm1 pure-ftpd[2574964]: (militry@technobases.in@152.59.116.52) [NOTICE] /home/techno/public_html/milictry1//index.php uploaded (27269 bytes, 597.40KB/sec)152.59.116.521269750%c  3Q' ossec11301g New FTP connection.Feb 19 15:18:58 vm1 pure-ftpd[2573393]: (?@152.59.116.52) [INFO] New connection from 152.59.116.52152.59.116.5212697503b  C]' ossec11309g FTP Authentication success.Feb 19 15:18:58 vm1 pure-ftpd[2573393]: (?@152.59.116.52) [INFO] militry@technobases.in is now logged in152.59.116.521269750va  Cc' ossec11313g FTP file uploaded to serverFeb 19 15:18:58 vm1 pure-ftpd[2573393]: (militry@technobases.in@152.59.116.52) [NOTICE] /home/techno/public_html/milictry1//index.php uploaded (27285 bytes, 586.64KB/sec)152.59.116.5212697503`  C]' ossec11309gFTP Authentication success.Feb 19 15:17:47 vm1 pure-ftpd[2573175]: (?@152.59.116.52) [INFO] militry@technobases.in is now logged in152.59.116.521269750v_  Cc' ossec11313gFTP file uploaded to serverFeb 19 15:17:47 vm1 pure-ftpd[2573175]: (militry@technobases.in@152.59.116.52) [NOTICE] /home/techno/public_html/milictry1//index.php uploaded (27259 bytes, 587.81KB/sec)152.59.116.521269750%^  3Q' ossec11301gNew FTP connection.Feb 19 15:17:46 vm1 pure-ftpd[2573175]: (?@152.59.116.52) [INFO] New connection from 152.59.116.52152.59.116.521269750u] C_' ossec11313gFTP file uploaded to serverFeb 19 15:10:05 vm1 pure-ftpd[2571857]: (militry@technobases.in@152.59.116.52) [NOTICE] /home/techno/public_html/milictry1//head.php uploaded (3498 bytes, 222.20KB/sec)152.59.116.521269750%\  3Q' ossec11301gNew FTP connection.Feb 19 15:10:04 vm1 pure-ftpd[2571857]: (?@152.59.116.52) [INFO] New connection from 152.59.116.52152.59.116.5212697503[  C]' ossec11309gFTP Authentication success.Feb 19 15:10:04 vm1 pure-ftpd[2571857]: (?@152.59.116.52) [INFO] militry@technobases.in is now logged in152.59.116.521269750tZ  C_' ossec11313gFTP file uploaded to serverFeb 19 14:56:56 vm1 pure-ftpd[2569248]: (militry@technobases.in@152.59.116.84) [NOTICE] /home/techno/public_html/milictry1//head.php uploaded (3332 bytes, 638.26KB/sec)152.59.116.841269750 +G 5 ; -F+(~  3U) ossec11301gNew FTP connection.Feb 19 18:12:42 vm1 pure-ftpd[2606623]: (?@103.180.212.24) [INFO] New connection from 103.180.212.24103.180.212.241269750k}  =Q) ossec13008gMail Reciepient rejected2025-02-19 16:47:08 H=(mail.sainikschoolcoachinginjaipur.com) [165.154.208.63]:51556 F= rejected RCPT : Rejected relay attempt: '165.154.208.63' From: 'rrkvibdazpy@sainikschoolcoachinginjaipur.com' To: 'validxxxg@gmail.com'165.154.208.631668284R|  A% ossec11302gFTP Authentication failed.Feb 19 16:04:20 vm1 pure-ftpd[2582196]: (?@152.58.71.15) [WARNING] Authentication failed for user [user@sainikschoolcoachinginjaipur.com]152.58.71.151269750@{  Cy% ossec11309gFTP Authentication success.Feb 19 16:04:09 vm1 pure-ftpd[2582186]: (?@152.58.71.15) [INFO] user@sainikschoolcoachinginjaipur.com is now logged in152.58.71.151269750#z 3M% ossec11301gNew FTP connection.Feb 19 16:04:09 vm1 pure-ftpd[2582186]: (?@152.58.71.15) [INFO] New connection from 152.58.71.15152.58.71.151269750"y  3M% ossec11301g_New FTP connection.Feb 19 16:03:01 vm1 pure-ftpd[2582012]: (?@152.58.71.15) [INFO] New connection from 152.58.71.15152.58.71.1512697505x  Cc% ossec11309g_FTP Authentication success.Feb 19 16:03:01 vm1 pure-ftpd[2582012]: (?@152.58.71.15) [INFO] user@s2seducationtrust.com is now logged in152.58.71.151269750vw  Cc' ossec11313g FTP file uploaded to serverFeb 19 15:44:35 vm1 pure-ftpd[2578377]: (militry@technobases.in@152.59.116.52) [NOTICE] /home/techno/public_html/milictry1//index.php uploaded (27295 bytes, 133.29KB/sec)152.59.116.521269750wv Cc' ossec11313gFTP file uploaded to serverFeb 19 15:43:36 vm1 pure-ftpd[2578377]: (militry@technobases.in@152.59.116.52) [NOTICE] /home/techno/public_html/milictry1//index.php uploaded (27300 bytes, 407.63KB/sec)152.59.116.521269750%u  3Q' ossec11301gNew FTP connection.Feb 19 15:43:35 vm1 pure-ftpd[2578377]: (?@152.59.116.52) [INFO] New connection from 152.59.116.52152.59.116.5212697503t  C]' ossec11309gFTP Authentication success.Feb 19 15:43:35 vm1 pure-ftpd[2578377]: (?@152.59.116.52) [INFO] militry@technobases.in is now logged in152.59.116.521269750vs  Cc' ossec11313g%FTP file uploaded to serverFeb 19 15:40:44 vm1 pure-ftpd[2577825]: (militry@technobases.in@152.59.116.52) [NOTICE] /home/techno/public_html/milictry1//index.php uploaded (27263 bytes, 442.95KB/sec)152.59.116.5212697503r  C]' ossec11309g%FTP Authentication success.Feb 19 15:40:43 vm1 pure-ftpd[2577825]: (?@152.59.116.52) [INFO] militry@technobases.in is now logged in152.59.116.521269750%q  3Q' ossec11301g#New FTP connection.Feb 19 15:40:43 vm1 pure-ftpd[2577825]: (?@152.59.116.52) [INFO] New connection from 152.59.116.52152.59.116.521269750vp  Cc' ossec11313gFTP file uploaded to serverFeb 19 15:39:11 vm1 pure-ftpd[2577274]: (militry@technobases.in@152.59.116.52) [NOTICE] /home/techno/public_html/milictry1//index.php uploaded (27291 bytes, 574.42KB/sec)152.59.116.5212697504o C]' ossec11309gFTP Authentication success.Feb 19 15:38:05 vm1 pure-ftpd[2577059]: (?@152.59.116.52) [INFO] militry@technobases.in is now logged in152.59.116.521269750&n 3Q' ossec11301gNew FTP connection.Feb 19 15:38:05 vm1 pure-ftpd[2577059]: (?@152.59.116.52) [INFO] New connection from 152.59.116.52152.59.116.521269750 m  C ' ossec11313gFTP file uploaded to serverFeb 19 15:38:42 vm1 pure-ftpd[2577274]: (militry@technobases.in@152.59.116.52) [NOTICE] /home/techno/public_html/milictry1//images/Best Sainik School.png uploaded (647367 bytes, 157.65KB/sec)152.59.116.521269750  9 !0Okv7  -% ossec13001g Exim Auth failed2025-02-19 22:19:30 dovecot_login authenticator failed for (User) [80.94.95.214]:16626: 535 Incorrect authentication data80.94.95.214798549?  =y) ossec13008g Mail Reciepient rejected2025-02-19 22:16:42 H=(mail.vandanabalbharti.com) [165.154.208.70]:59249 F= rejected RCPT : Rejected relay attempt: '165.154.208.70' From: 'csrlnce@vandanabalbharti.com' To: 'validxxxg@gmail.com'165.154.208.701668284X -?% ossec13001g Exim Auth failed2025-02-19 22:16:07 dovecot_login authenticator failed for (User) [80.94.95.214]:33796: 535 Incorrect authentication data (set_id=admin01@technobases.in)80.94.95.214798549R -3% ossec13001g Exim Auth failed2025-02-19 22:15:09 dovecot_login authenticator failed for (User) [80.94.95.214]:23238: 535 Incorrect authentication data (set_id=0@technobases.in)80.94.95.214798549%  3Q' ossec11301gRNew FTP connection.Feb 19 21:48:25 vm1 pure-ftpd[2646085]: (?@195.37.190.67) [INFO] New connection from 195.37.190.67195.37.190.6729210447  =i) ossec13008giMail Reciepient rejected2025-02-19 21:18:55 H=(mail.heipowersystem.com) [165.154.226.19]:63188 F= rejected RCPT : Rejected relay attempt: '165.154.226.19' From: 'lfabfd@heipowersystem.com' To: 'validxxxg@gmail.com'165.154.226.191668284] -C) ossec13001gExim Auth failed2025-02-19 21:12:36 dovecot_login authenticator failed for (thepsindustries.com) [101.89.140.209]:50076: 535 Incorrect authentication data (set_id=nologin)101.89.140.2091814991m  -g' ossec13001gkExim Auth failed2025-02-19 20:53:22 dovecot_login authenticator failed for (thepsindustries.com) [111.207.12.99]:45148: 535 Incorrect authentication data (set_id=office@thepsindustries.com)111.207.12.991814991Z  -A' ossec13001gSExim Auth failed2025-02-19 20:52:58 dovecot_login authenticator failed for (thepsindustries.com) [111.207.12.99]:42040: 535 Incorrect authentication data (set_id=nologin)111.207.12.991814991s  -q) ossec13001gExim Auth failed2025-02-19 20:08:13 dovecot_login authenticator failed for (fablixsolutions.com) [42.193.105.109]:34576: 535 Incorrect authentication data (set_id=postmaster@fablixsolutions.com)42.193.105.1091814991\  -C) ossec13001gExim Auth failed2025-02-19 20:07:48 dovecot_login authenticator failed for (fablixsolutions.com) [42.193.105.109]:40768: 535 Incorrect authentication data (set_id=nologin)42.193.105.1091814991_  =9) ossec13008gMail Reciepient rejected2025-02-19 19:12:30 H=(mail.shivelectricaltransformers.com) [165.154.226.19]:52207 F= rejected RCPT : Rejected relay attempt: '165.154.226.19' From: 'dhsifuhq@shivelectricaltransformers.com' To: 'validxxxg@gmail.com'165.154.226.191668284K  =+ ossec13008gߥMail Reciepient rejected2025-02-19 19:11:57 H=(mail.saintsoldiercollege.com) [165.154.213.186]:62510 F= rejected RCPT : Rejected relay attempt: '165.154.213.186' From: 'eholpub@saintsoldiercollege.com' To: 'validxxxg@gmail.com'165.154.213.1863469034  =3+ ossec13008gMail Reciepient rejected2025-02-19 19:04:51 H=(mail.hsnews.in) [165.154.226.209]:61354 F= rejected RCPT : Rejected relay attempt: '165.154.226.209' From: 'xyngy@hsnews.in' To: 'validxxxg@gmail.com'165.154.226.2091668284S  =+ ossec13008gMail Reciepient rejected2025-02-19 18:43:27 H=(mail.westerndancecompany.com) [165.154.226.214]:57660 F= rejected RCPT : Rejected relay attempt: '165.154.226.214' From: 'tvniuiaoxmg@westerndancecompany.com' To: 'validxxxg@gmail.com'165.154.226.2141668284 \6 i  qMR\"!  3M% ossec11301gJNew FTP connection.Feb 20 09:32:17 vm1 pure-ftpd[2777241]: (?@152.58.71.73) [INFO] New connection from 152.58.71.73152.58.71.731269750o  CW% ossec11313gFFTP file uploaded to serverFeb 20 09:32:13 vm1 pure-ftpd[2776337]: (militry@technobases.in@152.58.71.73) [NOTICE] /home/techno/public_html/milictry1//index2.php uploaded (0 bytes, 0.00KB/sec)152.58.71.731269750# 3M% ossec11301g0New FTP connection.Feb 20 09:27:35 vm1 pure-ftpd[2776337]: (?@152.58.71.73) [INFO] New connection from 152.58.71.73152.58.71.7312697502 C[% ossec11309g0FTP Authentication success.Feb 20 09:27:35 vm1 pure-ftpd[2776337]: (?@152.58.71.73) [INFO] militry@technobases.in is now logged in152.58.71.731269750%  3Q' ossec11301goNew FTP connection.Feb 20 05:26:43 vm1 pure-ftpd[2733096]: (?@120.237.18.56) [INFO] New connection from 120.237.18.56120.237.18.561814991%  3Q' ossec11301gnlNew FTP connection.Feb 20 05:21:07 vm1 pure-ftpd[2732050]: (?@120.237.18.56) [INFO] New connection from 120.237.18.56120.237.18.561814991%  3Q' ossec11301gm2New FTP connection.Feb 20 05:15:53 vm1 pure-ftpd[2730340]: (?@120.237.18.56) [INFO] New connection from 120.237.18.56120.237.18.561814991%  3Q' ossec11301glNew FTP connection.Feb 20 05:13:23 vm1 pure-ftpd[2729730]: (?@147.185.132.9) [INFO] New connection from 147.185.132.9147.185.132.96252001(  3U) ossec11301glNew FTP connection.Feb 20 05:13:51 vm1 pure-ftpd[2729880]: (?@172.206.141.63) [INFO] New connection from 172.206.141.63172.206.141.636252001  W!) ossec9708gV|Dovecot Aborted Login with empty userFeb 20 03:38:59 vm1 dovecot[2400578]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 7 secs): user=<>, rip=87.236.176.123, lip=103.74.54.108, TLS, session=87.236.176.1232635167(  3U) ossec11301g9New FTP connection.Feb 20 01:35:57 vm1 pure-ftpd[2689236]: (?@184.105.139.70) [INFO] New connection from 184.105.139.70184.105.139.706252001(  3U) ossec11301g6 New FTP connection.Feb 20 01:20:34 vm1 pure-ftpd[2686516]: (?@180.97.220.181) [INFO] New connection from 180.97.220.181180.97.220.1811814991v -u) ossec13001g%*Exim Auth failed2025-02-20 00:08:34 dovecot_plain authenticator failed for ([167.71.160.221]) [167.71.160.221]:49554: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)167.71.160.2216252001  ?1 ossec1008g$RProcess exiting (killed).Feb 20 00:04:55 vm1 spamd[2402088]: spamd: server killed by SIGTERM, shutting downj  -c% ossec13001g!Exim Auth failed2025-02-19 23:54:19 dovecot_login authenticator failed for (gurukuljaipur.com) [119.96.131.8]:53166: 535 Incorrect authentication data (set_id=webmaster@gurukuljaipur.com)119.96.131.81814991V  -;% ossec13001g!Exim Auth failed2025-02-19 23:53:54 dovecot_login authenticator failed for (gurukuljaipur.com) [119.96.131.8]:49852: 535 Incorrect authentication data (set_id=nologin)119.96.131.81814991  W' ossec9708gDovecot Aborted Login with empty userFeb 19 23:33:22 vm1 dovecot[2400578]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=87.236.176.50, lip=103.74.54.108, TLS, session=87.236.176.502635167(  3U) ossec11301gNew FTP connection.Feb 19 23:21:16 vm1 pure-ftpd[2663402]: (?@198.235.24.108) [INFO] New connection from 198.235.24.108198.235.24.1086252001"  3M% ossec11301g\New FTP connection.Feb 19 22:56:51 vm1 pure-ftpd[2658773]: (?@139.162.77.6) [INFO] New connection from 139.162.77.6139.162.77.61861060   W#+ ossec9708g Dovecot Aborted Login with empty userFeb 19 22:28:08 vm1 dovecot[2400578]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=185.247.137.218, lip=103.74.54.108, TLS, session=185.247.137.218298795 KR Q OV Tu4  Cc% ossec11313gIFTP file uploaded to serverFeb 20 09:45:05 vm1 pure-ftpd[2779838]: (militry@technobases.in@152.58.71.73) [NOTICE] /home/techno/public_html/milictry1//index2.php uploaded (27370 bytes, 483.62KB/sec)152.58.71.731269750u3  Cc% ossec11313gFTP file uploaded to serverFeb 20 09:43:53 vm1 pure-ftpd[2779434]: (militry@technobases.in@152.58.71.73) [NOTICE] /home/techno/public_html/milictry1//index2.php uploaded (27320 bytes, 589.20KB/sec)152.58.71.731269750"2  3M% ossec11301gNew FTP connection.Feb 20 09:43:52 vm1 pure-ftpd[2779434]: (?@152.58.71.73) [INFO] New connection from 152.58.71.73152.58.71.73126975011  C[% ossec11309gFTP Authentication success.Feb 20 09:43:52 vm1 pure-ftpd[2779434]: (?@152.58.71.73) [INFO] militry@technobases.in is now logged in152.58.71.731269750u0  Cc% ossec11313gFTP file uploaded to serverFeb 20 09:42:08 vm1 pure-ftpd[2778995]: (militry@technobases.in@152.58.71.73) [NOTICE] /home/techno/public_html/milictry1//index2.php uploaded (27743 bytes, 485.77KB/sec)152.58.71.731269750u/  Cc% ossec11313gmFTP file uploaded to serverFeb 20 09:41:23 vm1 pure-ftpd[2778995]: (militry@technobases.in@152.58.71.73) [NOTICE] /home/techno/public_html/milictry1//index2.php uploaded (27743 bytes, 485.79KB/sec)152.58.71.731269750".  3M% ossec11301gkNew FTP connection.Feb 20 09:41:22 vm1 pure-ftpd[2778995]: (?@152.58.71.73) [INFO] New connection from 152.58.71.73152.58.71.7312697501-  C[% ossec11309gkFTP Authentication success.Feb 20 09:41:22 vm1 pure-ftpd[2778995]: (?@152.58.71.73) [INFO] militry@technobases.in is now logged in152.58.71.731269750u,  Cc% ossec11313g FTP file uploaded to serverFeb 20 09:39:45 vm1 pure-ftpd[2778565]: (militry@technobases.in@152.58.71.73) [NOTICE] /home/techno/public_html/milictry1//index2.php uploaded (27715 bytes, 491.42KB/sec)152.58.71.7312697501+  C[% ossec11309g FTP Authentication success.Feb 20 09:39:44 vm1 pure-ftpd[2778565]: (?@152.58.71.73) [INFO] militry@technobases.in is now logged in152.58.71.731269750"*  3M% ossec11301g New FTP connection.Feb 20 09:39:44 vm1 pure-ftpd[2778565]: (?@152.58.71.73) [INFO] New connection from 152.58.71.73152.58.71.731269750u)  Cc% ossec11313gFTP file uploaded to serverFeb 20 09:38:39 vm1 pure-ftpd[2778250]: (militry@technobases.in@152.58.71.73) [NOTICE] /home/techno/public_html/milictry1//index2.php uploaded (27689 bytes, 414.43KB/sec)152.58.71.731269750u(  Cc% ossec11313gFTP file uploaded to serverFeb 20 09:37:43 vm1 pure-ftpd[2778250]: (militry@technobases.in@152.58.71.73) [NOTICE] /home/techno/public_html/milictry1//index2.php uploaded (27736 bytes, 317.77KB/sec)152.58.71.7312697501'  C[% ossec11309gFTP Authentication success.Feb 20 09:37:43 vm1 pure-ftpd[2778250]: (?@152.58.71.73) [INFO] militry@technobases.in is now logged in152.58.71.731269750"&  3M% ossec11301gNew FTP connection.Feb 20 09:37:43 vm1 pure-ftpd[2778250]: (?@152.58.71.73) [INFO] New connection from 152.58.71.73152.58.71.731269750"%  3M% ossec11301gNew FTP connection.Feb 20 09:33:31 vm1 pure-ftpd[2777384]: (?@152.58.71.73) [INFO] New connection from 152.58.71.73152.58.71.7312697501$  C[% ossec11309gFTP Authentication success.Feb 20 09:33:31 vm1 pure-ftpd[2777384]: (?@152.58.71.73) [INFO] militry@technobases.in is now logged in152.58.71.731269750u#  Cc% ossec11313gFTP file uploaded to serverFeb 20 09:33:31 vm1 pure-ftpd[2777384]: (militry@technobases.in@152.58.71.73) [NOTICE] /home/techno/public_html/milictry1//index2.php uploaded (27295 bytes, 747.99KB/sec)152.58.71.7312697501"  C[% ossec11309gJFTP Authentication success.Feb 20 09:32:17 vm1 pure-ftpd[2777241]: (?@152.58.71.73) [INFO] militry@technobases.in is now logged in152.58.71.731269750 ~qdWJ=0# zm`SF9, v i \ O B 5 (     r e X K > 1 $  { n a T G : -   w j ] P C 6 )    s f Y L ? 2 %  |obUH;.!xk^QD7*tgZM@3& }pcVI</"yl_RE8+uh[NA4' ~qdWJ=0  1269750( 1269750! 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750| 1269750C 1269750? 1269750; 12697507 12697503 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750{ 1269750l 1269750^ 1269750W 1269750V 12697507 1269750* 1269750' 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750v 1269750t 1269750Z 1269750E 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750q 1269750c 1269750` 1269750\ 12697509 1269750' 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750Z 1269750P 1269750= 12697504 1269750+ 1269750' 1269750& 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750s 1269750? 12697505 1269750- 1269750& 1269750$ 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750t 1269750s 1269750o 1269750f 1269750X 1269750V 1269750J 1269750' 1269750" 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750S 1269750/ 1269750) 1269750% 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750c 1269750J 1269750? 1269750/ 1269750' 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750~ 1269750| 1269750= 12697501 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750l 1269750j 1269750@ 12697506 1269750$ 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750~ 1269750} 1269750b 1269750Z 1269750W 1269750V 1269750U 1269750F 12697503 1269750/ 1269750, 1269750+ 1269750' 1269750$ 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750y 1269750` 1269750Z 1269750V 1269750/ 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750  1269750 } 1269750 B 1269750 8 1269750 1 1269750 , 1269750  1269750  1269750 1269750 1269750 1269750 Z  j q  pv|!(vnH  CU% ossec11313g*FTP file uploaded to serverFeb 20 10:10:10 vm1 pure-ftpd[2784518]: (militry@technobases.in@152.58.71.73) [NOTICE] /home/techno/public_html/milictry1//head2.php uploaded (0 bytes, 0.00KB/sec)152.58.71.731269750#G 3M% ossec11301g*New FTP connection.Feb 20 10:10:09 vm1 pure-ftpd[2784518]: (?@152.58.71.73) [INFO] New connection from 152.58.71.73152.58.71.7312697502F C[% ossec11309g*FTP Authentication success.Feb 20 10:10:09 vm1 pure-ftpd[2784518]: (?@152.58.71.73) [INFO] militry@technobases.in is now logged in152.58.71.7312697501E  C[% ossec11309gFTP Authentication success.Feb 20 10:07:32 vm1 pure-ftpd[2783913]: (?@152.58.71.73) [INFO] militry@technobases.in is now logged in152.58.71.731269750vD Cc% ossec11313gFTP file uploaded to serverFeb 20 10:07:32 vm1 pure-ftpd[2783913]: (militry@technobases.in@152.58.71.73) [NOTICE] /home/techno/public_html/milictry1//index2.php uploaded (27348 bytes, 241.86KB/sec)152.58.71.731269750"C  3M% ossec11301gNew FTP connection.Feb 20 10:07:32 vm1 pure-ftpd[2783913]: (?@152.58.71.73) [INFO] New connection from 152.58.71.73152.58.71.731269750uB  Cc% ossec11313gFTP file uploaded to serverFeb 20 10:04:15 vm1 pure-ftpd[2783187]: (militry@technobases.in@152.58.71.73) [NOTICE] /home/techno/public_html/milictry1//index2.php uploaded (27365 bytes, 531.66KB/sec)152.58.71.7312697501A  C[% ossec11309gFTP Authentication success.Feb 20 10:04:15 vm1 pure-ftpd[2783187]: (?@152.58.71.73) [INFO] militry@technobases.in is now logged in152.58.71.731269750"@  3M% ossec11301gNew FTP connection.Feb 20 10:04:15 vm1 pure-ftpd[2783187]: (?@152.58.71.73) [INFO] New connection from 152.58.71.73152.58.71.731269750v? Cc% ossec11313gPFTP file uploaded to serverFeb 20 10:02:15 vm1 pure-ftpd[2782673]: (militry@technobases.in@152.58.71.73) [NOTICE] /home/techno/public_html/milictry1//index2.php uploaded (27918 bytes, 318.27KB/sec)152.58.71.731269750v> Cc% ossec11313gFTP file uploaded to serverFeb 20 10:01:09 vm1 pure-ftpd[2782673]: (militry@technobases.in@152.58.71.73) [NOTICE] /home/techno/public_html/milictry1//index2.php uploaded (27918 bytes, 295.68KB/sec)152.58.71.731269750"=  3M% ossec11301gNew FTP connection.Feb 20 10:01:08 vm1 pure-ftpd[2782673]: (?@152.58.71.73) [INFO] New connection from 152.58.71.73152.58.71.7312697501<  C[% ossec11309gFTP Authentication success.Feb 20 10:01:08 vm1 pure-ftpd[2782673]: (?@152.58.71.73) [INFO] militry@technobases.in is now logged in152.58.71.731269750";  3M% ossec11301gNew FTP connection.Feb 20 10:00:11 vm1 pure-ftpd[2782411]: (?@152.58.71.73) [INFO] New connection from 152.58.71.73152.58.71.731269750u:  Cc% ossec11313gFTP file uploaded to serverFeb 20 09:58:59 vm1 pure-ftpd[2782026]: (militry@technobases.in@152.58.71.73) [NOTICE] /home/techno/public_html/milictry1//index2.php uploaded (27838 bytes, 487.56KB/sec)152.58.71.731269750"9  3M% ossec11301gNew FTP connection.Feb 20 09:58:58 vm1 pure-ftpd[2782026]: (?@152.58.71.73) [INFO] New connection from 152.58.71.73152.58.71.73126975018  C[% ossec11309gFTP Authentication success.Feb 20 09:58:58 vm1 pure-ftpd[2782026]: (?@152.58.71.73) [INFO] militry@technobases.in is now logged in152.58.71.731269750\7  -O ossec13001gExim Auth failed2025-02-20 09:56:01 dovecot_login authenticator failed for ([5.32.61.6]) [5.32.61.6]:57677: 535 Incorrect authentication data (set_id=billing@heipowersystem.com)5.32.61.629055716  C[% ossec11309gIFTP Authentication success.Feb 20 09:45:04 vm1 pure-ftpd[2779838]: (?@152.58.71.73) [INFO] militry@technobases.in is now logged in152.58.71.731269750"5  3M% ossec11301gINew FTP connection.Feb 20 09:45:04 vm1 pure-ftpd[2779838]: (?@152.58.71.73) [INFO] New connection from 152.58.71.73152.58.71.731269750 Q  R z  ($-0u\  Cc% ossec11313gFTP file uploaded to serverFeb 20 10:29:54 vm1 pure-ftpd[2788203]: (militry@technobases.in@152.58.71.73) [NOTICE] /home/techno/public_html/milictry1//index2.php uploaded (27252 bytes, 378.75KB/sec)152.58.71.7312697501[  C[% ossec11309gFTP Authentication success.Feb 20 10:29:54 vm1 pure-ftpd[2788203]: (?@152.58.71.73) [INFO] militry@technobases.in is now logged in152.58.71.731269750"Z  3M% ossec11301gNew FTP connection.Feb 20 10:29:53 vm1 pure-ftpd[2788203]: (?@152.58.71.73) [INFO] New connection from 152.58.71.73152.58.71.731269750'Y  3U) ossec11301gNew FTP connection.Feb 20 10:26:38 vm1 pure-ftpd[2787664]: (?@185.247.137.27) [INFO] New connection from 185.247.137.27185.247.137.27298795sX  C_% ossec11313gmFTP file uploaded to serverFeb 20 10:19:47 vm1 pure-ftpd[2786337]: (militry@technobases.in@152.58.71.73) [NOTICE] /home/techno/public_html/milictry1//head2.php uploaded (2939 bytes, 552.49KB/sec)152.58.71.7312697501W  C[% ossec11309gkFTP Authentication success.Feb 20 10:19:47 vm1 pure-ftpd[2786337]: (?@152.58.71.73) [INFO] militry@technobases.in is now logged in152.58.71.731269750"V  3M% ossec11301gkNew FTP connection.Feb 20 10:19:46 vm1 pure-ftpd[2786337]: (?@152.58.71.73) [INFO] New connection from 152.58.71.73152.58.71.731269750sU  C_% ossec11313gFTP file uploaded to serverFeb 20 10:17:50 vm1 pure-ftpd[2785944]: (militry@technobases.in@152.58.71.73) [NOTICE] /home/techno/public_html/milictry1//head2.php uploaded (2906 bytes, 550.10KB/sec)152.58.71.7312697501T  C[% ossec11309gFTP Authentication success.Feb 20 10:17:49 vm1 pure-ftpd[2785944]: (?@152.58.71.73) [INFO] militry@technobases.in is now logged in152.58.71.731269750"S  3M% ossec11301gNew FTP connection.Feb 20 10:17:49 vm1 pure-ftpd[2785944]: (?@152.58.71.73) [INFO] New connection from 152.58.71.73152.58.71.731269750%R  3Q' ossec11301g!New FTP connection.Feb 20 10:14:16 vm1 pure-ftpd[2785252]: (?@152.59.101.56) [INFO] New connection from 152.59.101.56152.59.101.561269750sQ  C_% ossec11313gMFTP file uploaded to serverFeb 20 10:14:59 vm1 pure-ftpd[2785343]: (militry@technobases.in@152.58.71.73) [NOTICE] /home/techno/public_html/milictry1//head2.php uploaded (2364 bytes, 457.07KB/sec)152.58.71.7312697501P  C[% ossec11309gKFTP Authentication success.Feb 20 10:14:58 vm1 pure-ftpd[2785343]: (?@152.58.71.73) [INFO] militry@technobases.in is now logged in152.58.71.731269750"O  3M% ossec11301gKNew FTP connection.Feb 20 10:14:58 vm1 pure-ftpd[2785343]: (?@152.58.71.73) [INFO] New connection from 152.58.71.73152.58.71.731269750TN  A!' ossec11302g%FTP Authentication failed.Feb 20 10:14:20 vm1 pure-ftpd[2785252]: (?@152.59.101.56) [WARNING] Authentication failed for user [user@sainikschoolcoachinginjaipur.com]152.59.101.5612697501M  C[% ossec11309gFTP Authentication success.Feb 20 10:13:39 vm1 pure-ftpd[2785151]: (?@152.58.71.73) [INFO] militry@technobases.in is now logged in152.58.71.731269750vL Cc% ossec11313gFTP file uploaded to serverFeb 20 10:13:39 vm1 pure-ftpd[2785151]: (militry@technobases.in@152.58.71.73) [NOTICE] /home/techno/public_html/milictry1//index2.php uploaded (27372 bytes, 331.75KB/sec)152.58.71.731269750"K  3M% ossec11301gNew FTP connection.Feb 20 10:13:38 vm1 pure-ftpd[2785151]: (?@152.58.71.73) [INFO] New connection from 152.58.71.73152.58.71.731269750&J 3Q' ossec11301gNew FTP connection.Feb 20 10:13:35 vm1 pure-ftpd[2785147]: (?@152.59.101.56) [INFO] New connection from 152.59.101.56152.59.101.561269750+I CK' ossec11309gFTP Authentication success.Feb 20 10:13:35 vm1 pure-ftpd[2785147]: (?@152.59.101.56) [INFO] user@vet24.in is now logged in152.59.101.561269750 : ; B LS d2o C[% ossec11309g FTP Authentication success.Feb 20 10:39:31 vm1 pure-ftpd[2790189]: (?@152.58.71.73) [INFO] militry@technobases.in is now logged in152.58.71.731269750#n 3M% ossec11301g New FTP connection.Feb 20 10:39:31 vm1 pure-ftpd[2790189]: (?@152.58.71.73) [INFO] New connection from 152.58.71.73152.58.71.731269750um  Cc% ossec11313gFTP file uploaded to serverFeb 20 10:38:25 vm1 pure-ftpd[2789686]: (militry@technobases.in@152.58.71.73) [NOTICE] /home/techno/public_html/milictry1//index2.php uploaded (26989 bytes, 302.91KB/sec)152.58.71.731269750vl Cc% ossec11313gFTP file uploaded to serverFeb 20 10:37:24 vm1 pure-ftpd[2789686]: (militry@technobases.in@152.58.71.73) [NOTICE] /home/techno/public_html/milictry1//index2.php uploaded (27005 bytes, 261.85KB/sec)152.58.71.731269750vk Cc% ossec11313gJFTP file uploaded to serverFeb 20 10:36:17 vm1 pure-ftpd[2789686]: (militry@technobases.in@152.58.71.73) [NOTICE] /home/techno/public_html/milictry1//index2.php uploaded (27005 bytes, 577.60KB/sec)152.58.71.7312697501j  C[% ossec11309gJFTP Authentication success.Feb 20 10:36:17 vm1 pure-ftpd[2789686]: (?@152.58.71.73) [INFO] militry@technobases.in is now logged in152.58.71.731269750"i  3M% ossec11301gJNew FTP connection.Feb 20 10:36:16 vm1 pure-ftpd[2789686]: (?@152.58.71.73) [INFO] New connection from 152.58.71.73152.58.71.731269750uh  Cc% ossec11313gFTP file uploaded to serverFeb 20 10:34:21 vm1 pure-ftpd[2789104]: (militry@technobases.in@152.58.71.73) [NOTICE] /home/techno/public_html/milictry1//index2.php uploaded (26995 bytes, 438.91KB/sec)152.58.71.731269750"g  3M% ossec11301gNew FTP connection.Feb 20 10:34:20 vm1 pure-ftpd[2789104]: (?@152.58.71.73) [INFO] New connection from 152.58.71.73152.58.71.7312697501f  C[% ossec11309gFTP Authentication success.Feb 20 10:34:20 vm1 pure-ftpd[2789104]: (?@152.58.71.73) [INFO] militry@technobases.in is now logged in152.58.71.731269750ye  !' ossec11321g<Active Response. FTP brute force attack (Port 21 is protected)Feb 20 10:31:47 vm1 pure-ftpd[2788700]: (?@152.59.101.56) [WARNING] Authentication failed for user [user@sainikschoolcoachinginjaipur.com]152.59.101.561269750d  S' ossec211321g4*   v l b X N D : 0 &    ~ t j ` V L B 8 . $    z p f \ R H > 4 *  vXlbND:0&rh|^J@T6,"xndZPF<2( ~tj`VLB8.$zpf\ | r h ^ T J @ 6 , "    x n d Z P F < 2 (   RRH>4*  vlbXND:0& gR gR g' g g` gT gT gF g g g gF g g  g gwF gw: gu gv gr gr gr gr gr gr gp  gi gi gf\ gb g] gP gN gN g?g g'% g'  g# g g g gl g  g g g g gr gF gF gF g g g g g g g; g9 g9 g g g g- g- g- g gk gk gk g g g g g g g gH g g g gw gw gw g3 g g g gW gW gW g g g g g g g gY~ gY} gY| g{ g]z gqy g_x g]w gv gu gt gs gr gq gNp g o g n gm gl gJk gJj gJi gh gg gf g<e g<d g,c gb ga g _ g^ g] g` g\ g[ gZ gY gmX gkW gkV gU gT gS gMQ gKP gKO g%N g!R gM gL gK gJ gI g*H g*G g*F gE gD gC gB gA g@ gP? g> g= g< g; g: g9 g8 g7 g^ g\ g g  g g g g g g gܿ gܫ gܡ g܁ gy gU gC g7 g5 g) gq g g g g g gx gb g` gV gT g| g# g g g g g g g g g g gI6 gI5 gI4 g3 g2 g1 g0 gm/ gk. gk- g , g + g * g) g( g' g& g% g$ g# gJ" gJ! gF g0 g0 go gnl gm2 gl gl gV| g9 g6  g%* g$R g! g! g g g\ g  g  gh g  g  g  gR gi g gk gS g g g gߥ g g g g g g g g_ g_ g  g g g g% g% g# g g g g gQ g% g% g% g g g g g g  ^ T Z fY]aO  U) ossec11001gDeferred login on the cpanel service[2025-02-20 10:50:50 +0530] info [whostmgrd] 171.49.196.197 - root "GET /cpsess3959183216/json-api/loadavg HTTP/1.1" DEFERRED LOGIN whostmgrd: cookie ip check: IP address has changed: IP Address [106.206.184.92] != Current IP Address [171.49.196.197]171.49.196.1971269750x  Ci% ossec11313gFTP file uploaded to serverFeb 20 10:50:08 vm1 pure-ftpd[2792209]: (militry@technobases.in@152.58.71.73) [NOTICE] /home/techno/public_html/milictry1//css/style.css uploaded (32478 bytes, 482.46KB/sec)152.58.71.731269750x~  Ci% ossec11313gYFTP file uploaded to serverFeb 20 10:49:19 vm1 pure-ftpd[2792209]: (militry@technobases.in@152.58.71.73) [NOTICE] /home/techno/public_html/milictry1//css/style.css uploaded (32406 bytes, 483.82KB/sec)152.58.71.731269750"}  3M% ossec11301gYNew FTP connection.Feb 20 10:49:19 vm1 pure-ftpd[2792209]: (?@152.58.71.73) [INFO] New connection from 152.58.71.73152.58.71.7312697501|  C[% ossec11309gYFTP Authentication success.Feb 20 10:49:19 vm1 pure-ftpd[2792209]: (?@152.58.71.73) [INFO] militry@technobases.in is now logged in152.58.71.731269750x{  Ci% ossec11313gFTP file uploaded to serverFeb 20 10:46:22 vm1 pure-ftpd[2791418]: (militry@technobases.in@152.58.71.73) [NOTICE] /home/techno/public_html/milictry1//css/style.css uploaded (32422 bytes, 233.26KB/sec)152.58.71.7312697502z C[% ossec11309g]FTP Authentication success.Feb 20 10:45:08 vm1 pure-ftpd[2791418]: (?@152.58.71.73) [INFO] militry@technobases.in is now logged in152.58.71.731269750Oy  U) ossec11001gqDeferred login on the cpanel service[2025-02-20 10:45:28 +0530] info [whostmgrd] 171.49.196.197 - root "GET /cpsess3959183216/json-api/loadavg HTTP/1.1" DEFERRED LOGIN whostmgrd: cookie ip check: IP address has changed: IP Address [106.206.184.92] != Current IP Address [171.49.196.197]171.49.196.1971269750vx Cc% ossec11313g_FTP file uploaded to serverFeb 20 10:45:08 vm1 pure-ftpd[2791418]: (militry@technobases.in@152.58.71.73) [NOTICE] /home/techno/public_html/milictry1//index2.php uploaded (26908 bytes, 499.84KB/sec)152.58.71.731269750#w 3M% ossec11301g]New FTP connection.Feb 20 10:45:07 vm1 pure-ftpd[2791418]: (?@152.58.71.73) [INFO] New connection from 152.58.71.73152.58.71.731269750vv Cc% ossec11313gFTP file uploaded to serverFeb 20 10:43:10 vm1 pure-ftpd[2790963]: (militry@technobases.in@152.58.71.73) [NOTICE] /home/techno/public_html/milictry1//index2.php uploaded (27021 bytes, 437.03KB/sec)152.58.71.731269750"u  3M% ossec11301gNew FTP connection.Feb 20 10:43:09 vm1 pure-ftpd[2790963]: (?@152.58.71.73) [INFO] New connection from 152.58.71.73152.58.71.7312697501t  C[% ossec11309gFTP Authentication success.Feb 20 10:43:10 vm1 pure-ftpd[2790963]: (?@152.58.71.73) [INFO] militry@technobases.in is now logged in152.58.71.731269750vs Cc% ossec11313gFTP file uploaded to serverFeb 20 10:41:45 vm1 pure-ftpd[2790641]: (militry@technobases.in@152.58.71.73) [NOTICE] /home/techno/public_html/milictry1//index2.php uploaded (26909 bytes, 469.78KB/sec)152.58.71.7312697501r  C[% ossec11309gFTP Authentication success.Feb 20 10:41:45 vm1 pure-ftpd[2790641]: (?@152.58.71.73) [INFO] militry@technobases.in is now logged in152.58.71.731269750"q  3M% ossec11301gNew FTP connection.Feb 20 10:41:44 vm1 pure-ftpd[2790641]: (?@152.58.71.73) [INFO] New connection from 152.58.71.73152.58.71.731269750xp  Ci% ossec11313gNFTP file uploaded to serverFeb 20 10:40:38 vm1 pure-ftpd[2790211]: (militry@technobases.in@152.58.71.73) [NOTICE] /home/techno/public_html/milictry1//css/style.css uploaded (32373 bytes, 369.92KB/sec)152.58.71.731269750  Q X  ^ \`h1  C[% ossec11309gFTP Authentication success.Feb 20 11:05:17 vm1 pure-ftpd[2796250]: (?@152.58.71.73) [INFO] militry@technobases.in is now logged in152.58.71.731269750"  3M% ossec11301gNew FTP connection.Feb 20 11:05:16 vm1 pure-ftpd[2796250]: (?@152.58.71.73) [INFO] New connection from 152.58.71.73152.58.71.731269750v Cc% ossec11313gFTP file uploaded to serverFeb 20 11:05:17 vm1 pure-ftpd[2796250]: (militry@technobases.in@152.58.71.73) [NOTICE] /home/techno/public_html/milictry1//index2.php uploaded (27846 bytes, 235.73KB/sec)152.58.71.731269750y Ci% ossec11313gwFTP file uploaded to serverFeb 20 10:58:22 vm1 pure-ftpd[2794428]: (militry@technobases.in@152.58.71.73) [NOTICE] /home/techno/public_html/milictry1//css/style.css uploaded (32467 bytes, 570.41KB/sec)152.58.71.7312697501  C[% ossec11309gwFTP Authentication success.Feb 20 10:58:21 vm1 pure-ftpd[2794428]: (?@152.58.71.73) [INFO] militry@technobases.in is now logged in152.58.71.731269750"  3M% ossec11301gwNew FTP connection.Feb 20 10:58:21 vm1 pure-ftpd[2794428]: (?@152.58.71.73) [INFO] New connection from 152.58.71.73152.58.71.731269750x  Ci% ossec11313g3FTP file uploaded to serverFeb 20 10:57:13 vm1 pure-ftpd[2794117]: (militry@technobases.in@152.58.71.73) [NOTICE] /home/techno/public_html/milictry1//css/style.css uploaded (32459 bytes, 393.80KB/sec)152.58.71.731269750"  3M% ossec11301gNew FTP connection.Feb 20 10:56:37 vm1 pure-ftpd[2794117]: (?@152.58.71.73) [INFO] New connection from 152.58.71.73152.58.71.7312697501  C[% ossec11309gFTP Authentication success.Feb 20 10:56:38 vm1 pure-ftpd[2794117]: (?@152.58.71.73) [INFO] militry@technobases.in is now logged in152.58.71.731269750u  Cc% ossec11313gFTP file uploaded to serverFeb 20 10:56:38 vm1 pure-ftpd[2794117]: (militry@technobases.in@152.58.71.73) [NOTICE] /home/techno/public_html/milictry1//index2.php uploaded (27402 bytes, 593.09KB/sec)152.58.71.731269750u  Cc% ossec11313gWFTP file uploaded to serverFeb 20 10:53:34 vm1 pure-ftpd[2793082]: (militry@technobases.in@152.58.71.73) [NOTICE] /home/techno/public_html/milictry1//index2.php uploaded (27341 bytes, 479.20KB/sec)152.58.71.7312697501  C[% ossec11309gWFTP Authentication success.Feb 20 10:53:34 vm1 pure-ftpd[2793082]: (?@152.58.71.73) [INFO] militry@technobases.in is now logged in152.58.71.731269750"  3M% ossec11301gWNew FTP connection.Feb 20 10:53:33 vm1 pure-ftpd[2793082]: (?@152.58.71.73) [INFO] New connection from 152.58.71.73152.58.71.731269750P U) ossec11001gDeferred login on the cpanel service[2025-02-20 10:52:05 +0530] info [whostmgrd] 171.49.196.197 - root "GET /cpsess3959183216/json-api/loadavg HTTP/1.1" DEFERRED LOGIN whostmgrd: cookie ip check: IP address has changed: IP Address [106.206.184.92] != Current IP Address [171.49.196.197]171.49.196.1971269750u  Cc% ossec11313gFTP file uploaded to serverFeb 20 10:51:19 vm1 pure-ftpd[2792696]: (militry@technobases.in@152.58.71.73) [NOTICE] /home/techno/public_html/milictry1//index2.php uploaded (26940 bytes, 236.94KB/sec)152.58.71.731269750"  3M% ossec11301gNew FTP connection.Feb 20 10:51:18 vm1 pure-ftpd[2792696]: (?@152.58.71.73) [INFO] New connection from 152.58.71.73152.58.71.7312697501  C[% ossec11309gFTP Authentication success.Feb 20 10:51:18 vm1 pure-ftpd[2792696]: (?@152.58.71.73) [INFO] militry@technobases.in is now logged in152.58.71.731269750P U) ossec11001gDeferred login on the cpanel service[2025-02-20 10:51:08 +0530] info [whostmgrd] 171.49.196.197 - root "GET /cpsess3959183216/json-api/loadavg HTTP/1.1" DEFERRED LOGIN whostmgrd: cookie ip check: IP address has changed: IP Address [106.206.184.92] != Current IP Address [171.49.196.197]171.49.196.1971269750 Q Y  _RIQ1&  C[% ossec11309g9FTP Authentication success.Feb 20 15:09:04 vm1 pure-ftpd[2844742]: (?@152.58.99.12) [INFO] militry@technobases.in is now logged in152.58.99.121269750"%  3M% ossec11301g9New FTP connection.Feb 20 15:09:04 vm1 pure-ftpd[2844742]: (?@152.58.99.12) [INFO] New connection from 152.58.99.12152.58.99.121269750s$  C_% ossec11313gFTP file uploaded to serverFeb 20 14:58:16 vm1 pure-ftpd[2842743]: (militry@technobases.in@152.58.99.12) [NOTICE] /home/techno/public_html/milictry1//head.php uploaded (3448 bytes, 6271.32KB/sec)152.58.99.121269750"#  3M% ossec11301gNew FTP connection.Feb 20 14:58:15 vm1 pure-ftpd[2842743]: (?@152.58.99.12) [INFO] New connection from 152.58.99.12152.58.99.1212697501"  C[% ossec11309gFTP Authentication success.Feb 20 14:58:15 vm1 pure-ftpd[2842743]: (?@152.58.99.12) [INFO] militry@technobases.in is now logged in152.58.99.121269750u!  Cc% ossec11313g-FTP file uploaded to serverFeb 20 14:56:04 vm1 pure-ftpd[2842334]: (militry@technobases.in@152.58.99.12) [NOTICE] /home/techno/public_html/milictry1//index2.php uploaded (27274 bytes, 375.34KB/sec)152.58.99.121269750"  3M% ossec11301g-New FTP connection.Feb 20 14:56:03 vm1 pure-ftpd[2842334]: (?@152.58.99.12) [INFO] New connection from 152.58.99.12152.58.99.1212697501  C[% ossec11309g-FTP Authentication success.Feb 20 14:56:04 vm1 pure-ftpd[2842334]: (?@152.58.99.12) [INFO] militry@technobases.in is now logged in152.58.99.121269750+  3Y+ ossec11301gNew FTP connection.Feb 20 14:21:11 vm1 pure-ftpd[2836046]: (?@188.166.165.226) [INFO] New connection from 188.166.165.226188.166.165.2262921044z  Ck' ossec11313gkFTP file uploaded to serverFeb 20 11:19:30 vm1 pure-ftpd[2800242]: (militry@technobases.in@152.58.71.121) [NOTICE] /home/techno/public_html/milictry1//css/style.css uploaded (32464 bytes, 274.95KB/sec)152.58.71.1211269750%  3Q' ossec11301gkNew FTP connection.Feb 20 11:19:30 vm1 pure-ftpd[2800242]: (?@152.58.71.121) [INFO] New connection from 152.58.71.121152.58.71.12112697503  C]' ossec11309gkFTP Authentication success.Feb 20 11:19:30 vm1 pure-ftpd[2800242]: (?@152.58.71.121) [INFO] militry@technobases.in is now logged in152.58.71.1211269750%  3Q' ossec11301gNew FTP connection.Feb 20 11:18:03 vm1 pure-ftpd[2800055]: (?@152.58.71.121) [INFO] New connection from 152.58.71.121152.58.71.12112697503  C]' ossec11309gFTP Authentication success.Feb 20 11:18:03 vm1 pure-ftpd[2800055]: (?@152.58.71.121) [INFO] militry@technobases.in is now logged in152.58.71.1211269750w  Ce' ossec11313gFTP file uploaded to serverFeb 20 11:18:04 vm1 pure-ftpd[2800055]: (militry@technobases.in@152.58.71.121) [NOTICE] /home/techno/public_html/milictry1//index2.php uploaded (27261 bytes, 525.54KB/sec)152.58.71.1211269750u  Cc% ossec11313gFTP file uploaded to serverFeb 20 11:08:29 vm1 pure-ftpd[2796642]: (militry@technobases.in@152.58.71.73) [NOTICE] /home/techno/public_html/milictry1//index2.php uploaded (27351 bytes, 483.61KB/sec)152.58.71.731269750"  3M% ossec11301gNew FTP connection.Feb 20 11:07:43 vm1 pure-ftpd[2796642]: (?@152.58.71.73) [INFO] New connection from 152.58.71.73152.58.71.7312697501  C[% ossec11309gFTP Authentication success.Feb 20 11:07:44 vm1 pure-ftpd[2796642]: (?@152.58.71.73) [INFO] militry@technobases.in is now logged in152.58.71.731269750u  Cc% ossec11313gFTP file uploaded to serverFeb 20 11:07:44 vm1 pure-ftpd[2796642]: (militry@technobases.in@152.58.71.73) [NOTICE] /home/techno/public_html/milictry1//index2.php uploaded (27786 bytes, 444.40KB/sec)152.58.71.731269750u  Cc% ossec11313gHFTP file uploaded to serverFeb 20 11:06:05 vm1 pure-ftpd[2796250]: (militry@technobases.in@152.58.71.73) [NOTICE] /home/techno/public_html/milictry1//index2.php uploaded (27798 bytes, 536.79KB/sec)152.58.71.731269750 W Y V ] kW"9  3M% ossec11301gNew FTP connection.Feb 20 17:56:56 vm1 pure-ftpd[2876236]: (?@37.59.165.81) [INFO] New connection from 37.59.165.8137.59.165.813017382w8  -y) ossec13001gExim Auth failed2025-02-20 17:35:29 dovecot_login authenticator failed for (s2seducationtrust.com) [124.160.63.122]:12325: 535 Incorrect authentication data (set_id=postmaster@s2seducationtrust.com)124.160.63.1221814991`7  -I+ ossec13001glExim Auth failed2025-02-20 17:34:59 dovecot_login authenticator failed for (s2seducationtrust.com) [202.107.197.211]:60062: 535 Incorrect authentication data (set_id=nologin)202.107.197.2111814991q6  -o' ossec13001g Exim Auth failed2025-02-20 16:12:19 dovecot_login authenticator failed for (fablixsolutions.com) [111.56.54.202]:36586: 535 Incorrect authentication data (set_id=postmaster@fablixsolutions.com)111.56.54.2021814991Z5  -A' ossec13001gExim Auth failed2025-02-20 16:11:48 dovecot_login authenticator failed for (fablixsolutions.com) [111.56.54.202]:33434: 535 Incorrect authentication data (set_id=nologin)111.56.54.202181499184  Ai' ossec11302gFTP Authentication failed.Feb 20 15:54:34 vm1 pure-ftpd[2853308]: (?@51.81.181.165) [WARNING] Authentication failed for user [anonymous]51.81.181.1656252001%3  3Q' ossec11301gNew FTP connection.Feb 20 15:54:30 vm1 pure-ftpd[2853308]: (?@51.81.181.165) [INFO] New connection from 51.81.181.16551.81.181.1656252001v2 Cc% ossec11313gFTP file uploaded to serverFeb 20 15:15:17 vm1 pure-ftpd[2845688]: (militry@technobases.in@152.58.99.12) [NOTICE] /home/techno/public_html/milictry1//index2.php uploaded (27274 bytes, 262.86KB/sec)152.58.99.121269750v1 Cc% ossec11313grFTP file uploaded to serverFeb 20 15:14:16 vm1 pure-ftpd[2845688]: (militry@technobases.in@152.58.99.12) [NOTICE] /home/techno/public_html/milictry1//index2.php uploaded (29463 bytes, 497.10KB/sec)152.58.99.121269750"0  3M% ossec11301gFNew FTP connection.Feb 20 15:13:32 vm1 pure-ftpd[2845688]: (?@152.58.99.12) [INFO] New connection from 152.58.99.12152.58.99.121269750v/ Cc% ossec11313gFFTP file uploaded to serverFeb 20 15:13:33 vm1 pure-ftpd[2845688]: (militry@technobases.in@152.58.99.12) [NOTICE] /home/techno/public_html/milictry1//index2.php uploaded (29462 bytes, 479.24KB/sec)152.58.99.1212697501.  C[% ossec11309gFFTP Authentication success.Feb 20 15:13:33 vm1 pure-ftpd[2845688]: (?@152.58.99.12) [INFO] militry@technobases.in is now logged in152.58.99.121269750u-  Cc% ossec11313gFTP file uploaded to serverFeb 20 15:12:26 vm1 pure-ftpd[2845506]: (militry@technobases.in@152.58.99.12) [NOTICE] /home/techno/public_html/milictry1//index2.php uploaded (29458 bytes, 191.33KB/sec)152.58.99.121269750#, 3M% ossec11301gNew FTP connection.Feb 20 15:12:25 vm1 pure-ftpd[2845506]: (?@152.58.99.12) [INFO] New connection from 152.58.99.12152.58.99.1212697502+ C[% ossec11309gFTP Authentication success.Feb 20 15:12:25 vm1 pure-ftpd[2845506]: (?@152.58.99.12) [INFO] militry@technobases.in is now logged in152.58.99.121269750"*  3M% ossec11301gNew FTP connection.Feb 20 15:10:21 vm1 pure-ftpd[2845230]: (?@152.58.99.12) [INFO] New connection from 152.58.99.12152.58.99.1212697501)  C[% ossec11309gFTP Authentication success.Feb 20 15:10:22 vm1 pure-ftpd[2845230]: (?@152.58.99.12) [INFO] militry@technobases.in is now logged in152.58.99.121269750u(  Cc% ossec11313gFTP file uploaded to serverFeb 20 15:10:22 vm1 pure-ftpd[2845230]: (militry@technobases.in@152.58.99.12) [NOTICE] /home/techno/public_html/milictry1//index2.php uploaded (29480 bytes, 339.22KB/sec)152.58.99.121269750u'  Cc% ossec11313g;FTP file uploaded to serverFeb 20 15:09:06 vm1 pure-ftpd[2844742]: (militry@technobases.in@152.58.99.12) [NOTICE] /home/techno/public_html/milictry1//index2.php uploaded (29484 bytes, 141.59KB/sec)152.58.99.121269750 FU ~ 2 X m=.XJ  -;) ossec13001grExim Auth failed2025-02-20 23:51:25 dovecot_login authenticator failed for ([106.10.69.50]) [183.108.201.20]:37521: 535 Incorrect authentication data (set_id=no-reply)183.108.201.201835841lI  -c) ossec13001grExim Auth failed2025-02-20 23:51:16 dovecot_login authenticator failed for ([218.92.201.232]) [218.92.201.226]:2300: 535 Incorrect authentication data (set_id=no-reply@heipowersystem.com)218.92.201.2261814991pH  -i+ ossec13001grExim Auth failed2025-02-20 23:51:12 dovecot_login authenticator failed for ([103.106.154.133]) [103.106.154.133]:55429: 535 Incorrect authentication data (set_id=no-reply@heipowersystem.com)103.106.154.1331269750(G  3U) ossec11301gp New FTP connection.Feb 20 23:40:20 vm1 pure-ftpd[2940759]: (?@198.235.24.180) [INFO] New connection from 198.235.24.180198.235.24.1806252001`F  -O% ossec13001giExim Auth failed2025-02-20 23:13:52 dovecot_login authenticator failed for (nyaystambh.com) [125.72.54.81]:55762: 535 Incorrect authentication data (set_id=admin@nyaystambh.com)125.72.54.811814991SE  -5% ossec13001giExim Auth failed2025-02-20 23:12:54 dovecot_login authenticator failed for (nyaystambh.com) [125.72.54.81]:51314: 535 Incorrect authentication data (set_id=nologin)125.72.54.811814991PD U) ossec11001gf\Deferred login on the cpanel service[2025-02-20 22:59:00 +0530] info [whostmgrd] 223.185.235.44 - root "GET /cpsess3959183216/json-api/loadavg HTTP/1.1" DEFERRED LOGIN whostmgrd: cookie ip check: IP address has changed: IP Address [171.49.196.197] != Current IP Address [223.185.235.44]223.185.235.441269750%C  3Q' ossec11301gbNew FTP connection.Feb 20 22:43:48 vm1 pure-ftpd[2929058]: (?@198.235.24.19) [INFO] New connection from 198.235.24.19198.235.24.196252001ZB -?' ossec13001g]Exim Auth failed2025-02-20 22:23:13 dovecot_login authenticator failed for (heipowersystem.com) [221.229.216.1]:46878: 535 Incorrect authentication data (set_id=nologin)221.229.216.11814991%A  3Q' ossec11301gPNew FTP connection.Feb 20 21:26:18 vm1 pure-ftpd[2914706]: (?@167.94.146.63) [INFO] New connection from 167.94.146.63167.94.146.636252001g@  -]% ossec13001gNExim Auth failed2025-02-20 21:18:08 dovecot_login authenticator failed for (gurukuljaipur.com) [60.2.243.174]:45918: 535 Incorrect authentication data (set_id=office@gurukuljaipur.com)60.2.243.1741814991V?  -;% ossec13001gNExim Auth failed2025-02-20 21:17:41 dovecot_login authenticator failed for (gurukuljaipur.com) [60.2.243.174]:43480: 535 Incorrect authentication data (set_id=nologin)60.2.243.1741814991`>  ==' ossec13008g?gMail Reciepient rejected2025-02-20 20:12:45 H=o59.ptr2344.adityabirla.com [149.72.38.136]:29240 X=TLS1.3:TLS_AES_128_GCM_SHA256:128 CV=no F= temporarily rejected RCPT : Could not complete sender verify149.72.38.1366252001d=  -W% ossec13001g'%Exim Auth failed2025-02-20 18:29:15 dovecot_login authenticator failed for (nyaystambh.com) [119.96.131.8]:55872: 535 Incorrect authentication data (set_id=webmaster@nyaystambh.com)119.96.131.81814991S<  -5% ossec13001g' Exim Auth failed2025-02-20 18:28:51 dovecot_login authenticator failed for (nyaystambh.com) [119.96.131.8]:53102: 535 Incorrect authentication data (set_id=nologin)119.96.131.81814991m; -c) ossec13001g#Exim Auth failed2025-02-20 18:14:57 dovecot_login authenticator failed for (heipowersystem.com) [180.249.134.98]:64360: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)180.249.134.9816430846:  Ag% ossec11302gFTP Authentication failed.Feb 20 17:57:00 vm1 pure-ftpd[2876236]: (?@37.59.165.81) [WARNING] Authentication failed for user [anonymous]37.59.165.813017382  , )(=Z[  -?) ossec13001gTExim Auth failed2025-02-21 04:10:18 dovecot_login authenticator failed for ([45.118.136.243]) [45.118.136.243]:61573: 535 Incorrect authentication data (set_id=vikash.k)45.118.136.2431562822Z  - + ossec13001gTExim Auth failed2025-02-21 04:10:18 dovecot_login authenticator failed for (m121-202-153-186.smartone.com) [121.202.153.186]:40076: 535 Incorrect authentication data (set_id=field.service@heipowersystem.com)121.202.153.1861819730xY  -{) ossec13001gFExim Auth failed2025-02-21 04:10:05 dovecot_login authenticator failed for (m121-202-155-61.smartone.com) [121.202.155.61]:2367: 535 Incorrect authentication data (set_id=vikash.k@heipowersystem.com)121.202.155.611819730%X  3Q' ossec11301gNew FTP connection.Feb 21 03:33:11 vm1 pure-ftpd[2985217]: (?@206.168.34.51) [INFO] New connection from 206.168.34.51206.168.34.516252001gW  -[' ossec13001gExim Auth failed2025-02-21 02:29:41 dovecot_login authenticator failed for (pc0.zz.ha.cn) [218.28.77.206]:51906: 535 Incorrect authentication data (set_id=no-reply@heipowersystem.com)218.28.77.2061814991ZV  -?) ossec13001gExim Auth failed2025-02-21 02:30:02 dovecot_login authenticator failed for ([120.29.140.140]) [120.29.140.140]:35275: 535 Incorrect authentication data (set_id=no-reply)120.29.140.1401835841U  W!) ossec9708gFDovecot Aborted Login with empty userFeb 21 01:57:49 vm1 dovecot[2934170]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=185.142.236.35, lip=103.74.54.108, TLS, session=185.142.236.352750405[T -?) ossec13001gExim Auth failed2025-02-21 01:16:36 dovecot_login authenticator failed for (gurukuljaipur.com) [42.193.105.109]:38720: 535 Incorrect authentication data (set_id=nologin)42.193.105.1091814991ZS  -?) ossec13001g Exim Auth failed2025-02-21 01:05:40 dovecot_login authenticator failed for ([119.203.137.21]) [119.203.137.21]:50262: 535 Incorrect authentication data (set_id=no-reply)119.203.137.211835841jR  -a' ossec13001gExim Auth failed2025-02-21 01:05:07 dovecot_login authenticator failed for ([103.48.194.21]) [103.48.194.21]:42648: 535 Incorrect authentication data (set_id=no-reply@heipowersystem.com)103.48.194.211562822]Q  -C+ ossec13001gwFExim Auth failed2025-02-21 00:11:09 dovecot_login authenticator failed for ([154.144.255.210]) [154.144.255.210]:42310: 535 Incorrect authentication data (set_id=no-reply)154.144.255.2102542007mP  -e) ossec13001gw:Exim Auth failed2025-02-21 00:10:57 dovecot_login authenticator failed for ([218.150.170.10]) [218.150.170.10]:33300: 535 Incorrect authentication data (set_id=no-reply@heipowersystem.com)218.150.170.101835841xO  -{) ossec13001guExim Auth failed2025-02-21 00:05:19 dovecot_login authenticator failed for (m121-202-153-50.smartone.com) [121.202.153.50]:8030: 535 Incorrect authentication data (set_id=no-reply@heipowersystem.com)121.202.153.501819730N  ?1 ossec1008gvProcess exiting (killed).Feb 21 00:05:44 vm1 spamd[2672347]: spamd: server killed by SIGTERM, shutting downdM  -U) ossec13001grExim Auth failed2025-02-20 23:51:46 dovecot_login authenticator failed for (178-165-63-216-kh.maxnet.ua) [178.165.63.216]:41244: 535 Incorrect authentication data (set_id=no-reply)178.165.63.216690791}L  -+ ossec13001grExim Auth failed2025-02-20 23:51:40 dovecot_login authenticator failed for (abts-mum-static-007.14.170.122.airtelbroadband.in) [103.137.112.251]:52944: 535 Incorrect authentication data (set_id=no-reply)103.137.112.2511269750gK  -]% ossec13001grExim Auth failed2025-02-20 23:51:31 dovecot_login authenticator failed for ([61.81.151.97]) [61.81.151.97]:56608: 535 Incorrect authentication data (set_id=no-reply@heipowersystem.com)61.81.151.971835841 & 0 Q e c KXork  -q' ossec13001gExim Auth failed2025-02-21 05:34:36 dovecot_login authenticator failed for ([183.105.3.221]) [183.105.3.221]:57770: 535 Incorrect authentication data (set_id=sushil.choudhary@heipowersystem.com)183.105.3.2211835841]j  -C+ ossec13001gExim Auth failed2025-02-21 05:34:05 dovecot_login authenticator failed for ([103.106.154.141]) [103.106.154.141]:33969: 535 Incorrect authentication data (set_id=vikash.k)103.106.154.1411269750bi  -M+ ossec13001g#Exim Auth failed2025-02-21 05:34:50 dovecot_login authenticator failed for ([103.106.154.138]) [103.106.154.138]:47184: 535 Incorrect authentication data (set_id=field.service)103.106.154.1381269750oh  -k' ossec13001gExim Auth failed2025-02-21 05:34:03 dovecot_login authenticator failed for ([118.70.240.37]) [118.70.240.37]:59737: 535 Incorrect authentication data (set_id=field.service@heipowersystem.com)118.70.240.371562822zg  -' ossec13001gExim Auth failed2025-02-21 05:33:56 dovecot_login authenticator failed for bzq-109-67-154-24.red.bezeqint.net [109.67.154.24]:54378: 535 Incorrect authentication data (set_id=vikash.k@heipowersystem.com)109.67.154.24294640af  -M) ossec13001gExim Auth failed2025-02-21 05:07:28 dovecot_login authenticator failed for (static.vinacis.com) [180.93.172.213]:51588: 535 Incorrect authentication data (set_id=field.service)180.93.172.2131562822je  -_) ossec13001gExim Auth failed2025-02-21 05:07:06 dovecot_login authenticator failed for (131-255-135-74.otinternet.com.br) [131.255.135.74]:39224: 535 Incorrect authentication data (set_id=vikash.k)131.255.135.743469034ed  -S+ ossec13001gExim Auth failed2025-02-21 05:07:06 dovecot_login authenticator failed for ([112.123.199.111]) [112.123.199.111]:60640: 535 Incorrect authentication data (set_id=sushil.choudhary)112.123.199.1111814991oc  -k' ossec13001gExim Auth failed2025-02-21 05:06:56 dovecot_login authenticator failed for ([103.48.194.21]) [103.48.194.21]:33404: 535 Incorrect authentication data (set_id=field.service@heipowersystem.com)103.48.194.211562822b  -7% ossec13001gExim Auth failed2025-02-21 05:06:54 dovecot_login authenticator failed for (88x87x84x104.static-customer.volgograd.ertelecom.ru) [88.87.84.104]:58870: 535 Incorrect authentication data (set_id=sushil.choudhary@heipowersystem.com)88.87.84.1042017370~a  - ' ossec13001gExim Auth failed2025-02-21 05:06:45 dovecot_login authenticator failed for net-130-0-149-238.cust.vodafonedsl.it [130.0.149.238]:36309: 535 Incorrect authentication data (set_id=vikash.k@heipowersystem.com)130.0.149.2383175395h`  -_' ossec13001gRExim Auth failed2025-02-21 04:40:09 dovecot_login authenticator failed for 5.185.199.245.ipv4.public.orange.pl [5.185.199.245]:56042: 535 Incorrect authentication data (set_id=vikash.k)5.185.199.245798544[_  -E' ossec13001gRExim Auth failed2025-02-21 04:40:08 dovecot_login authenticator failed for ([80.250.155.12]) [80.250.155.12]:49562: 535 Incorrect authentication data (set_id=field.service)80.250.155.12294640r^  -o) ossec13001g'Exim Auth failed2025-02-21 04:39:26 dovecot_login authenticator failed for ([43.246.138.100]) [43.246.138.100]:49524: 535 Incorrect authentication data (set_id=field.service@heipowersystem.com)43.246.138.1001269750p]  -i+ ossec13001gExim Auth failed2025-02-21 04:39:10 dovecot_login authenticator failed for ([203.193.168.181]) [203.193.168.181]:60868: 535 Incorrect authentication data (set_id=vikash.k@heipowersystem.com)203.193.168.1811269750b\  -M+ ossec13001g`Exim Auth failed2025-02-21 04:10:30 dovecot_login authenticator failed for ([175.206.105.126]) [175.206.105.126]:47586: 535 Incorrect authentication data (set_id=field.service)175.206.105.1261835841 R%4 U w (8Rh[R|  -) ossec13001gUExim Auth failed2025-02-21 06:56:44 dovecot_login authenticator failed for 198-91-129-195.cpe.distributel.net [198.91.129.195]:35258: 535 Incorrect authentication data (set_id=sushil.choudhary@heipowersystem.com)198.91.129.1956251999 {  -' ossec13001gCExim Auth failed2025-02-21 06:56:26 dovecot_login authenticator failed for 69-172-79-198.static.imsbiz.com (173-248-234-145.static.imsbiz.com) [69.172.79.198]:63802: 535 Incorrect authentication data (set_id=vikash.k)69.172.79.1981819730fz  -]% ossec13001g7Exim Auth failed2025-02-21 06:56:14 dovecot_login authenticator failed for ([5.11.172.131]) [5.11.172.131]:54880: 535 Incorrect authentication data (set_id=vikash.k@heipowersystem.com)5.11.172.131298795by  -M+ ossec13001g5Exim Auth failed2025-02-21 06:56:12 dovecot_login authenticator failed for ([212.164.211.155]) [212.164.211.155]:44290: 535 Incorrect authentication data (set_id=field.service)212.164.211.1552017370lx  -g% ossec13001g)Exim Auth failed2025-02-21 06:56:00 dovecot_login authenticator failed for ([117.135.6.10]) [117.135.6.10]:36466: 535 Incorrect authentication data (set_id=field.service@heipowersystem.com)117.135.6.101814991\w -A) ossec13001gqExim Auth failed2025-02-21 06:48:39 dovecot_login authenticator failed for (heipowersystem.com) [42.193.105.109]:41582: 535 Incorrect authentication data (set_id=nologin)42.193.105.1091814991pv  -i+ ossec13001gExim Auth failed2025-02-21 06:29:12 dovecot_login authenticator failed for ([218.146.133.117]) [218.146.133.117]:33572: 535 Incorrect authentication data (set_id=vikash.k@heipowersystem.com)218.146.133.1171835841_u  -I) ossec13001gExim Auth failed2025-02-21 06:28:49 dovecot_login authenticator failed for ([103.248.40.194]) [103.248.40.194]:47104: 535 Incorrect authentication data (set_id=field.service)103.248.40.1941831722t  - + ossec13001gExim Auth failed2025-02-21 06:28:39 dovecot_login authenticator failed for (m121-202-153-211.smartone.com) [121.202.153.211]:13742: 535 Incorrect authentication data (set_id=field.service@heipowersystem.com)121.202.153.2111819730ns  -m% ossec13001gExim Auth failed2025-02-21 06:28:40 dovecot_login authenticator failed for ([5.11.164.134]) [5.11.164.134]:38235: 535 Incorrect authentication data (set_id=sushil.choudhary@heipowersystem.com)5.11.164.134298795+r  3Y+ ossec11301gNew FTP connection.Feb 21 06:24:31 vm1 pure-ftpd[3017732]: (?@162.142.125.118) [INFO] New connection from 162.142.125.118162.142.125.1186252001xq  -y+ ossec13001gxExim Auth failed2025-02-21 06:01:51 dovecot_login authenticator failed for ([218.149.235.152]) [218.149.235.152]:53390: 535 Incorrect authentication data (set_id=sushil.choudhary@heipowersystem.com)218.149.235.1521835841rp  -o) ossec13001gbExim Auth failed2025-02-21 06:01:30 dovecot_login authenticator failed for ([120.29.140.140]) [120.29.140.140]:36429: 535 Incorrect authentication data (set_id=field.service@heipowersystem.com)120.29.140.1401835841Zo  -?) ossec13001g`Exim Auth failed2025-02-21 06:01:27 dovecot_login authenticator failed for ([119.203.137.21]) [119.203.137.21]:44022: 535 Incorrect authentication data (set_id=vikash.k)119.203.137.211835841[n  -C) ossec13001gVExim Auth failed2025-02-21 06:01:17 dovecot_login authenticator failed for apn-87-251-227-249.static.gprs.plus.pl [87.251.227.249]:46182: 535 Incorrect authentication data87.251.227.249798544mm  -e) ossec13001gTExim Auth failed2025-02-21 06:01:15 dovecot_login authenticator failed for ([220.124.240.75]) [220.124.240.66]:52250: 535 Incorrect authentication data (set_id=vikash.k@heipowersystem.com)220.124.240.661835841Wl -=# ossec13001g|Exim Auth failed2025-02-21 05:53:22 dovecot_login authenticator failed for (thepsindustries.com) [14.18.77.99]:36908: 535 Incorrect authentication data (set_id=nologin)14.18.77.991814991  - )6SZ]g{  -% ossec13001gvExim Auth failed2025-02-21 08:18:22 dovecot_login authenticator failed for syn-071-041-202-012.biz.spectrum.com [71.41.202.12]:48674: 535 Incorrect authentication data (set_id=vikash.k@heipowersystem.com)71.41.202.126252001l  -g% ossec13001g^Exim Auth failed2025-02-21 08:17:58 dovecot_login authenticator failed for ([1.212.225.99]) [1.212.225.99]:34076: 535 Incorrect authentication data (set_id=field.service@heipowersystem.com)1.212.225.991835841u  -u) ossec13001g\Exim Auth failed2025-02-21 08:17:55 dovecot_login authenticator failed for ([220.124.240.75]) [220.124.240.66]:54564: 535 Incorrect authentication data (set_id=sushil.choudhary@heipowersystem.com)220.124.240.661835841"  3M% ossec11301gNew FTP connection.Feb 21 08:02:57 vm1 pure-ftpd[3036155]: (?@20.118.69.92) [INFO] New connection from 20.118.69.9220.118.69.926252001r  -o) ossec13001g Exim Auth failed2025-02-21 07:51:20 dovecot_login authenticator failed for (static-97.224.143.114-tataidc.co.in) [182.156.132.43]:43767: 535 Incorrect authentication data (set_id=field.service)182.156.132.431269750y  -% ossec13001gExim Auth failed2025-02-21 07:51:04 dovecot_login authenticator failed for (31-154-122-202.orange.net.il) [2.55.122.202]:60416: 535 Incorrect authentication data (set_id=field.service@heipowersystem.com)2.55.122.202294640u  -w' ossec13001gExim Auth failed2025-02-21 07:51:02 dovecot_login authenticator failed for lmontsouris-655-1-111-111.w90-63.abo.wanadoo.fr [90.63.203.111]:52258: 535 Incorrect authentication data (set_id=vikash.k)90.63.203.1113017382_  -K' ossec13001gExim Auth failed2025-02-21 07:51:01 dovecot_login authenticator failed for ([103.47.74.210]) [103.47.74.210]:42822: 535 Incorrect authentication data (set_id=sushil.choudhary)103.47.74.2101269750o  -m% ossec13001gExim Auth failed2025-02-21 07:50:52 dovecot_login authenticator failed for ([109.244.68.3]) [109.244.68.3]:62240: 535 Incorrect authentication data (set_id=sushil.choudhary@heipowersystem.com)109.244.68.31814991  -# ossec13001gExim Auth failed2025-02-21 07:50:34 dovecot_login authenticator failed for (70-90-99-29-ma-ne.hfc.comcastbusiness.net) [70.90.99.29]:47497: 535 Incorrect authentication data (set_id=vikash.k@heipowersystem.com)70.90.99.296252001Z  -?) ossec13001gExim Auth failed2025-02-21 07:24:21 dovecot_login authenticator failed for ([45.118.136.243]) [45.118.136.243]:53914: 535 Incorrect authentication data (set_id=vikash.k)45.118.136.2431562822j  -]+ ossec13001gܿExim Auth failed2025-02-21 07:24:06 dovecot_login authenticator failed for (197-255-205-237.netpagedns.net) [197.255.205.237]:56423: 535 Incorrect authentication data (set_id=vikash.k)197.255.205.2372413451o  -k' ossec13001gܡExim Auth failed2025-02-21 07:23:36 dovecot_login authenticator failed for ([212.75.154.16]) [212.75.154.16]:53493: 535 Incorrect authentication data (set_id=field.service@heipowersystem.com)212.75.154.162017370o  -m' ossec13001gܫExim Auth failed2025-02-21 07:23:47 dovecot_login authenticator failed for bzq-109-67-154-24.red.bezeqint.net [109.67.154.24]:54564: 535 Incorrect authentication data (set_id=sushil.choudhary)109.67.154.24294640~  -;+ ossec13001g܁Exim Auth failed2025-02-21 07:23:05 dovecot_login authenticator failed for (173-166-112-154-newengland.hfc.comcastbusiness.net) [173.166.112.154]:50965: 535 Incorrect authentication data (set_id=sushil.choudhary@heipowersystem.com)173.166.112.1546252001}  - ' ossec13001gyExim Auth failed2025-02-21 07:22:56 dovecot_login authenticator failed for (static.199.38.85.125.macminivault.com) [199.38.85.125]:49488: 535 Incorrect authentication data (set_id=vikash.k@heipowersystem.com)199.38.85.1256252001 #K V 4 I P @M]s}x  -y+ ossec13001gExim Auth failed2025-02-21 09:39:45 dovecot_login authenticator failed for ([180.188.253.150]) [180.188.253.150]:59746: 535 Incorrect authentication data (set_id=sushil.choudhary@heipowersystem.com)180.188.253.1501269750_  -I) ossec13001gqExim Auth failed2025-02-21 09:13:45 dovecot_login authenticator failed for ([221.165.172.38]) [221.165.172.38]:38644: 535 Incorrect authentication data (set_id=field.service)221.165.172.381835841  -' ossec13001g-Exim Auth failed2025-02-21 09:12:36 dovecot_login authenticator failed for 111-70-49-182.emome-ip.hinet.net [111.70.49.182]:33671: 535 Incorrect authentication data (set_id=sushil.choudhary@heipowersystem.com)111.70.49.1821668284v  -{% ossec13001g)Exim Auth failed2025-02-21 09:12:33 dovecot_login authenticator failed for (fa138.54.fix-addr.vsi.ru) [81.211.77.58]:50935: 535 Incorrect authentication data (set_id=field.service@heipowersystem.com)81.211.77.582017370P  -/% ossec13001gGExim Auth failed2025-02-21 09:13:02 dovecot_login authenticator failed for host59.sub-63-47-149.myvzw.com [63.47.149.59]:43650: 535 Incorrect authentication data63.47.149.596252001r  -o) ossec13001g;Exim Auth failed2025-02-21 09:12:51 dovecot_login authenticator failed for (131-255-135-74.otinternet.com.br) [131.255.135.74]:46958: 535 Incorrect authentication data (set_id=sushil.choudhary)131.255.135.743469034f  -Y' ossec13001gExim Auth failed2025-02-21 08:45:21 dovecot_login authenticator failed for (49.206.244.235.actcorp.in) [49.206.241.22]:63067: 535 Incorrect authentication data (set_id=field.service)49.206.241.221269750l  -a+ ossec13001gExim Auth failed2025-02-21 08:45:16 dovecot_login authenticator failed for (190-205-112-156.static.cantv.net) [190.205.112.156]:44184: 535 Incorrect authentication data (set_id=vikash.k)190.205.112.1563625428o  -k' ossec13001gExim Auth failed2025-02-21 08:45:11 dovecot_login authenticator failed for ([95.85.112.170]) [95.85.112.170]:11996: 535 Incorrect authentication data (set_id=field.service@heipowersystem.com)95.85.112.1701218197   -!+ ossec13001gExim Auth failed2025-02-21 08:45:08 dovecot_login authenticator failed for net-188-219-104-210.cust.vodafonedsl.it [188.219.104.210]:57091: 535 Incorrect authentication data (set_id=sushil.choudhary@heipowersystem.com)188.219.104.2103175395u  -u) ossec13001gExim Auth failed2025-02-21 08:45:40 dovecot_login authenticator failed for 123-193-152-64.dynamic.kbronet.com.tw [123.193.152.64]:60340: 535 Incorrect authentication data (set_id=sushil.choudhary)123.193.152.641668284g  -]% ossec13001gExim Auth failed2025-02-21 08:44:57 dovecot_login authenticator failed for ([102.53.15.17]) [102.53.15.17]:51324: 535 Incorrect authentication data (set_id=vikash.k@heipowersystem.com)102.53.15.172542007  W!) ossec9708gDovecot Aborted Login with empty userFeb 21 08:45:02 vm1 dovecot[2934170]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=185.247.137.32, lip=103.74.54.108, TLS, session=185.247.137.32298795q  -k+ ossec13001ghExim Auth failed2025-02-21 08:18:07 dovecot_login authenticator failed for (m121-202-152-134.smartone.com) [121.202.152.134]:58308: 535 Incorrect authentication data (set_id=sushil.choudhary)121.202.152.1341819730T  -7% ossec13001gExim Auth failed2025-02-21 08:18:40 dovecot_login authenticator failed for ([12.202.15.69]) [12.202.15.69]:40361: 535 Incorrect authentication data (set_id=vikash.k)12.202.15.696252001Y  -A% ossec13001g|Exim Auth failed2025-02-21 08:18:27 dovecot_login authenticator failed for ([211.151.86.9]) [211.151.86.9]:50508: 535 Incorrect authentication data (set_id=field.service)211.151.86.91814991  . 1 N V ~ ]J5.  C_) ossec11309g-FTP Authentication success.Feb 21 10:25:08 vm1 pure-ftpd[3062754]: (?@110.226.43.222) [INFO] militry@technobases.in is now logged in110.226.43.2221269750(-  3U) ossec11301g-New FTP connection.Feb 21 10:25:08 vm1 pure-ftpd[3062754]: (?@110.226.43.222) [INFO] New connection from 110.226.43.222110.226.43.2221269750), 3U) ossec11301gNew FTP connection.Feb 21 10:23:09 vm1 pure-ftpd[3062354]: (?@110.226.43.222) [INFO] New connection from 110.226.43.222110.226.43.22212697506+ C_) ossec11309gFTP Authentication success.Feb 21 10:23:10 vm1 pure-ftpd[3062354]: (?@110.226.43.222) [INFO] militry@technobases.in is now logged in110.226.43.2221269750(*  3U) ossec11301g New FTP connection.Feb 21 10:15:59 vm1 pure-ftpd[3061095]: (?@110.226.43.222) [INFO] New connection from 110.226.43.222110.226.43.22212697505)  C_) ossec11309g FTP Authentication success.Feb 21 10:15:59 vm1 pure-ftpd[3061095]: (?@110.226.43.222) [INFO] militry@technobases.in is now logged in110.226.43.2221269750o(  -g+ ossec13001gExim Auth failed2025-02-21 10:07:06 dovecot_login authenticator failed for (197-255-205-237.netpagedns.net) [197.255.205.237]:56625: 535 Incorrect authentication data (set_id=field.service)197.255.205.2372413451'  -' ossec13001gExim Auth failed2025-02-21 10:06:49 dovecot_login authenticator failed for host-62-106-37-249.dynamic.elmonet.fi [62.106.37.249]:38774: 535 Incorrect authentication data (set_id=sushil.choudhary@heipowersystem.com)62.106.37.249660013j&  -a' ossec13001gExim Auth failed2025-02-21 10:06:27 dovecot_login authenticator failed for ([217.32.209.50]) [217.32.209.51]:58547: 535 Incorrect authentication data (set_id=vikash.k@heipowersystem.com)217.32.209.512635167\%  -G% ossec13001gExim Auth failed2025-02-21 10:07:03 dovecot_login authenticator failed for ([61.81.151.97]) [61.81.151.97]:55096: 535 Incorrect authentication data (set_id=sushil.choudhary)61.81.151.971835841n$  -k' ossec13001gExim Auth failed2025-02-21 10:06:52 dovecot_login authenticator failed for ([91.72.153.110]) [91.72.153.110]:49246: 535 Incorrect authentication data (set_id=field.service@heipowersystem.com)91.72.153.110290557T#  -7% ossec13001gExim Auth failed2025-02-21 10:06:49 dovecot_login authenticator failed for ([61.97.17.208]) [61.97.17.208]:47186: 535 Incorrect authentication data (set_id=vikash.k)61.97.17.2081835841t"  -q+ ossec13001gExim Auth failed2025-02-21 09:40:20 dovecot_login authenticator failed for (bb128-106-196-150.singnet.com.sg) [128.106.196.150]:40328: 535 Incorrect authentication data (set_id=sushil.choudhary)128.106.196.1501880251_!  -K' ossec13001gExim Auth failed2025-02-21 09:40:08 dovecot_login authenticator failed for ([91.122.31.214]) [91.122.31.214]:48212: 535 Incorrect authentication data (set_id=sushil.choudhary)91.122.31.2142017370y  -}) ossec13001gExim Auth failed2025-02-21 09:39:37 dovecot_login authenticator failed for (m121-202-153-62.smartone.com) [121.202.153.62]:62887: 535 Incorrect authentication data (set_id=vikash.k@heipowersystem.com)121.202.153.621819730m  -c+ ossec13001gExim Auth failed2025-02-21 09:39:58 dovecot_login authenticator failed for (m121-202-152-134.smartone.com) [121.202.152.134]:9037: 535 Incorrect authentication data (set_id=field.service)121.202.152.1341819730]  -C+ ossec13001gExim Auth failed2025-02-21 09:39:56 dovecot_login authenticator failed for ([154.144.255.208]) [154.144.255.208]:46028: 535 Incorrect authentication data (set_id=vikash.k)154.144.255.2082542007|  -' ossec13001gExim Auth failed2025-02-21 09:39:47 dovecot_login authenticator failed for host-85-237-57-200.dsl.sura.ru [85.237.57.200]:33964: 535 Incorrect authentication data (set_id=field.service@heipowersystem.com)85.237.57.2002017370 - X @BJlzd-n?  -i' ossec13001g `Exim Auth failed2025-02-21 10:34:30 dovecot_login authenticator failed for 220-130-18-21.hinet-ip.hinet.net [220.130.18.21]:42442: 535 Incorrect authentication data (set_id=sushil.choudhary)220.130.18.211668284b>  -M+ ossec13001g HExim Auth failed2025-02-21 10:34:06 dovecot_login authenticator failed for ([103.106.154.133]) [103.106.154.133]:41131: 535 Incorrect authentication data (set_id=field.service)103.106.154.1331269750=  -' ossec13001g FExim Auth failed2025-02-21 10:34:04 dovecot_login authenticator failed for (55.60.251.198.dynamic.vianetdsl.com) [198.251.60.55]:44755: 535 Incorrect authentication data (set_id=sushil.choudhary@heipowersystem.com)198.251.60.556251999Q<  U) ossec11001g pDeferred login on the cpanel service[2025-02-21 10:34:46 +0530] info [whostmgrd] 110.226.43.222 - root "GET /cpsess3959183216/scripts4/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: cookie ip check: IP address has changed: IP Address [223.185.235.44] != Current IP Address [110.226.43.222]110.226.43.2221269750;  5') ossec11011g pWHM SSO login failed[2025-02-21 10:34:46 +0530] info [whostmgrd] 110.226.43.222 PURGE root:vva70YMHXdLcvSC1 badpass [cookie ip check: IP address has changed: IP Address [223.185.235.44] != Current IP Address [110.226.43.222]]110.226.43.2221269750n:  -k' ossec13001g 8Exim Auth failed2025-02-21 10:33:50 dovecot_login authenticator failed for ([91.72.153.110]) [91.72.153.110]:49159: 535 Incorrect authentication data (set_id=field.service@heipowersystem.com)91.72.153.110290557Z9  -?) ossec13001g 4Exim Auth failed2025-02-21 10:33:46 dovecot_login authenticator failed for ([117.156.174.28]) [117.156.174.28]:55655: 535 Incorrect authentication data (set_id=vikash.k)117.156.174.281814991t8  -w% ossec13001g &Exim Auth failed2025-02-21 10:33:33 dovecot_login authenticator failed for bb121-7-26-195.singnet.com.sg [121.7.26.195]:58340: 535 Incorrect authentication data (set_id=vikash.k@heipowersystem.com)121.7.26.1951880251z7  Ci) ossec11313g FTP file uploaded to serverFeb 21 10:33:18 vm1 pure-ftpd[3064195]: (militry@technobases.in@110.226.43.222) [NOTICE] /home/techno/public_html/milictry1//index2.php uploaded (27308 bytes, 1389.47KB/sec)110.226.43.222126975056  C_) ossec11309g FTP Authentication success.Feb 21 10:33:17 vm1 pure-ftpd[3064195]: (?@110.226.43.222) [INFO] militry@technobases.in is now logged in110.226.43.2221269750(5  3U) ossec11301g New FTP connection.Feb 21 10:33:17 vm1 pure-ftpd[3064195]: (?@110.226.43.222) [INFO] New connection from 110.226.43.222110.226.43.2221269750y4  Cg) ossec11313gFTP file uploaded to serverFeb 21 10:31:07 vm1 pure-ftpd[3063435]: (militry@technobases.in@110.226.43.222) [NOTICE] /home/techno/public_html/milictry1//index2.php uploaded (27335 bytes, 815.52KB/sec)110.226.43.2221269750y3  Cg) ossec11313gwFTP file uploaded to serverFeb 21 10:30:39 vm1 pure-ftpd[3063435]: (militry@technobases.in@110.226.43.222) [NOTICE] /home/techno/public_html/milictry1//index2.php uploaded (27314 bytes, 990.82KB/sec)110.226.43.222126975052  C_) ossec11309g+FTP Authentication success.Feb 21 10:29:23 vm1 pure-ftpd[3063435]: (?@110.226.43.222) [INFO] militry@technobases.in is now logged in110.226.43.2221269750(1  3U) ossec11301g+New FTP connection.Feb 21 10:29:23 vm1 pure-ftpd[3063435]: (?@110.226.43.222) [INFO] New connection from 110.226.43.222110.226.43.2221269750z0  Ci) ossec11313gHFTP file uploaded to serverFeb 21 10:29:50 vm1 pure-ftpd[3063435]: (militry@technobases.in@110.226.43.222) [NOTICE] /home/techno/public_html/milictry1//index2.php uploaded (27309 bytes, 1420.83KB/sec)110.226.43.2221269750z/  Ci) ossec11313g-FTP file uploaded to serverFeb 21 10:25:08 vm1 pure-ftpd[3062754]: (militry@technobases.in@110.226.43.222) [NOTICE] /home/techno/public_html/milictry1//index2.php uploaded (27252 bytes, 1443.01KB/sec)110.226.43.2221269750 G : [ 8Q~R  - ' ossec13001gExim Auth failed2025-02-21 11:01:04 dovecot_login authenticator failed for 83-233-30-104.cust.bredband2.com [83.233.30.104]:55478: 535 Incorrect authentication data (set_id=field.service@heipowersystem.com)83.233.30.1042661886pQ  -i+ ossec13001gExim Auth failed2025-02-21 11:00:52 dovecot_login authenticator failed for ([218.146.133.117]) [218.146.133.117]:33860: 535 Incorrect authentication data (set_id=vikash.k@heipowersystem.com)218.146.133.1171835841OP  I' ossec11331gE Stealth FTP brute force attackFeb 21 10:59:40 vm1 pure-ftpd[3069467]: (?@152.59.108.70) [WARNING] Authentication failed for user [user@westerndancecompany.com]152.59.108.701269750pO  ' ossec11321g;Active Response. FTP brute force attack (Port 21 is protected)Feb 21 10:59:31 vm1 pure-ftpd[3069363]: (?@152.59.108.70) [WARNING] Authentication failed for user [user@westerndancecompany.com]152.59.108.701269750N  S' ossec211321g;Preventing FTP brute force attempt.[Active Response] is disabled for rule 11321. Greylisting 152.59.108.70152.59.108.701269750?M  gQ' ossec11307g7Multiple connection attempts from same sourceFeb 21 10:59:25 vm1 pure-ftpd[3069365]: (?@152.59.108.70) [INFO] New connection from 152.59.108.70152.59.108.701269750&L 3Q' ossec11301g-New FTP connection.Feb 21 10:59:15 vm1 pure-ftpd[3069335]: (?@152.59.108.70) [INFO] New connection from 152.59.108.70152.59.108.701269750LK A' ossec11302g' FTP Authentication failed.Feb 21 10:59:09 vm1 pure-ftpd[3069321]: (?@152.59.108.70) [WARNING] Authentication failed for user [user@westerndancecompany.com]152.59.108.701269750&J 3Q' ossec11301gNew FTP connection.Feb 21 10:58:45 vm1 pure-ftpd[3069253]: (?@152.59.108.70) [INFO] New connection from 152.59.108.70152.59.108.701269750CI C{' ossec11309gFTP Authentication success.Feb 21 10:58:46 vm1 pure-ftpd[3069253]: (?@152.59.108.70) [INFO] user@sainikschoolcoachinginjaipur.com is now logged in152.59.108.701269750(H  3U) ossec11301g New FTP connection.Feb 21 10:53:58 vm1 pure-ftpd[3068075]: (?@110.226.43.222) [INFO] New connection from 110.226.43.222110.226.43.2221269750,G  CM) ossec11309g FTP Authentication success.Feb 21 10:53:58 vm1 pure-ftpd[3068075]: (?@110.226.43.222) [INFO] user@vet24.in is now logged in110.226.43.2221269750[F  E)) ossec11314g FTP file deleted from serverFeb 21 10:41:19 vm1 pure-ftpd[3065921]: (militry@technobases.in@110.226.43.222) [NOTICE] Deleted /home/techno/public_html/milictry1//head2.php110.226.43.22212697506E C_) ossec11309g FTP Authentication success.Feb 21 10:41:19 vm1 pure-ftpd[3065921]: (?@110.226.43.222) [INFO] militry@technobases.in is now logged in110.226.43.2221269750)D 3U) ossec11301g New FTP connection.Feb 21 10:41:18 vm1 pure-ftpd[3065921]: (?@110.226.43.222) [INFO] New connection from 110.226.43.222110.226.43.2221269750zC  Ci) ossec11313g FTP file uploaded to serverFeb 21 10:37:07 vm1 pure-ftpd[3064924]: (militry@technobases.in@110.226.43.222) [NOTICE] /home/techno/public_html/milictry1//index2.php uploaded (27268 bytes, 1171.53KB/sec)110.226.43.2221269750xB  Ce) ossec11313g FTP file uploaded to serverFeb 21 10:36:28 vm1 pure-ftpd[3064924]: (militry@technobases.in@110.226.43.222) [NOTICE] /home/techno/public_html/milictry1//index2.php uploaded (26622 bytes, 57.46KB/sec)110.226.43.2221269750(A  3U) ossec11301g New FTP connection.Feb 21 10:36:28 vm1 pure-ftpd[3064924]: (?@110.226.43.222) [INFO] New connection from 110.226.43.222110.226.43.22212697505@  C_) ossec11309g FTP Authentication success.Feb 21 10:36:28 vm1 pure-ftpd[3064924]: (?@110.226.43.222) [INFO] militry@technobases.in is now logged in110.226.43.2221269750 }pcVI</"yl_RE8+~qdWJ=0# zm`SF9, v i \ O B 5 (     r e X K > 1 $  { n a T G : -   w j ] P C 6 )    s f Y L ? 2 %  |obUH;.!xk^QD7*tgZM@3& uh[NA4' ~qdWJ=0z 1269750) 1269750) 1269750) 1269750) 1269750){ 1269750)c 1269750)b 1269750)M 1269750)I 1269750)* 1269750)( 1269750)& 1269750) 1269750) 1269750( 1269750( 1269750( 1269750( 1269750(} 1269750(R 1269750(C 1269750(2 12697508 12697507 12697503 1269750 1269750 1269750z 1269750_ 1269750E 1269750: 12697506 1269750) 1269750( 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750r 1269750V 1269750M 1269750K 1269750B 1269750A 1269750@ 1269750; 12697502 1269750( 1269750( 1269750( 1269750( 1269750( 1269750' 1269750' 1269750' 1269750' 1269750' 1269750' 1269750' 1269750' 1269750' 1269750'y 1269750'l 1269750'c 1269750'^ 1269750'Y 1269750'X 1269750'N 1269750'+ 1269750') 1269750' 1269750' 1269750' 1269750& 1269750& 1269750& 1269750& 1269750& 1269750& 1269750& 1269750& 1269750&j 1269750&Y 1269750&O 1269750&> 1269750&+ 1269750& 1269750& 1269750& 1269750& 1269750% 1269750% 1269750% 1269750% 1269750% 1269750% 1269750% 1269750%d 1269750%F 1269750%9 1269750%5 1269750%" 1269750% 1269750$ 1269750$R 1269750$O 1269750$N 1269750$B 1269750$7 1269750$6 1269750$4 1269750$/ 1269750$- 1269750$ 1269750$ 1269750$ 1269750$ 1269750# 1269750# 1269750# 1269750# 1269750# 1269750# 1269750# 1269750# 1269750#x 1269750#k 1269750#d 1269750#` 1269750#\ 1269750#- 1269750## 1269750" 1269750" 1269750" 1269750" 1269750" 1269750" 1269750" 1269750" 1269750" 1269750" 1269750"v 1269750"e 1269750"\ 1269750"T 1269750"? 1269750"9 1269750"- 1269750"* 1269750"' 1269750" 1269750" 1269750" 1269750" 1269750" 1269750" 1269750! 1269750! 1269750! 1269750! 1269750! 1269750! 1269750! 1269750! 1269750! 1269750! 1269750!} 1269750!M 1269750!H 1269750!G 1269750!? 1269750!= 1269750!5 1269750!4 1269750! 1269750! 1269750! 1269750! 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 r 1269750 o 1269750 G 1269750 > 1269750  1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750m 1269750b 1269750[ 1269750Y 1269750V 1269750R 1269750B 1269750@ 12697502 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750~ 1269750l 1269750i 1269750^ 1269750Y 1269750X 1269750I 1269750B 1269750@ 12697507 1269750+ 1269750$ 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750{ 1269750t 1269750\ 1269750K 1269750C 7 $ 5 | 8{%b 7Oe  I' ossec11331g Stealth FTP brute force attackFeb 21 11:13:40 vm1 pure-ftpd[3072576]: (?@152.58.99.206) [WARNING] Authentication failed for user [user@westerndancecompany.com]152.58.99.2061269750pd  ' ossec11321gActive Response. FTP brute force attack (Port 21 is protected)Feb 21 11:13:33 vm1 pure-ftpd[3072522]: (?@152.58.99.206) [WARNING] Authentication failed for user [user@westerndancecompany.com]152.58.99.2061269750c  S' ossec211321gPreventing FTP brute force attempt.[Active Response] is disabled for rule 11321. Greylisting 152.58.99.206152.58.99.2061269750Bb  C{' ossec11309gFTP Authentication success.Feb 21 11:13:29 vm1 pure-ftpd[3072527]: (?@152.58.99.206) [INFO] user@sainikschoolcoachinginjaipur.com is now logged in152.58.99.2061269750?a  gQ' ossec11307gMultiple connection attempts from same sourceFeb 21 11:13:29 vm1 pure-ftpd[3072527]: (?@152.58.99.206) [INFO] New connection from 152.58.99.206152.58.99.2061269750X` -?% ossec13001gxExim Auth failed2025-02-21 11:13:18 dovecot_login authenticator failed for (User) [80.94.95.228]:60436: 535 Incorrect authentication data (set_id=gamedev@technobases.in)80.94.95.228798549L_ A' ossec11302gp FTP Authentication failed.Feb 21 11:13:10 vm1 pure-ftpd[3072492]: (?@152.58.99.206) [WARNING] Authentication failed for user [user@westerndancecompany.com]152.58.99.2061269750&^ 3Q' ossec11301gl New FTP connection.Feb 21 11:13:07 vm1 pure-ftpd[3072494]: (?@152.58.99.206) [INFO] New connection from 152.58.99.206152.58.99.20612697509]  Ci' ossec11309gRFTP Authentication success.Feb 21 11:12:41 vm1 pure-ftpd[3072282]: (?@152.58.99.206) [INFO] user@westerndancecompany.com is now logged in152.58.99.2061269750%\  3Q' ossec11301gRNew FTP connection.Feb 21 11:12:41 vm1 pure-ftpd[3072282]: (?@152.58.99.206) [INFO] New connection from 152.58.99.206152.58.99.2061269750w[  Cc) ossec11313g~FTP file uploaded to serverFeb 21 11:09:09 vm1 pure-ftpd[3071170]: (militry@technobases.in@152.59.101.145) [NOTICE] /home/techno/public_html/milictry1//head.php uploaded (3448 bytes, 5916.64KB/sec)152.59.101.1451269750vZ  Ca) ossec11313gLFTP file uploaded to serverFeb 21 11:08:19 vm1 pure-ftpd[3071170]: (militry@technobases.in@152.59.101.145) [NOTICE] /home/techno/public_html/milictry1//head.php uploaded (3559 bytes, 232.51KB/sec)152.59.101.1451269750vY  Ca) ossec11313g0FTP file uploaded to serverFeb 21 11:07:50 vm1 pure-ftpd[3071170]: (militry@technobases.in@152.59.101.145) [NOTICE] /home/techno/public_html/milictry1//head.php uploaded (3388 bytes, 645.45KB/sec)152.59.101.1451269750(X  3U) ossec11301g.New FTP connection.Feb 21 11:07:49 vm1 pure-ftpd[3071170]: (?@152.59.101.145) [INFO] New connection from 152.59.101.145152.59.101.14512697505W  C_) ossec11309g.FTP Authentication success.Feb 21 11:07:49 vm1 pure-ftpd[3071170]: (?@152.59.101.145) [INFO] militry@technobases.in is now logged in152.59.101.1451269750kV  -c' ossec13001gExim Auth failed2025-02-21 11:02:12 dovecot_login authenticator failed for 24-119-144-86.cpe.sparklight.net [24.119.144.86]:35590: 535 Incorrect authentication data (set_id=field.service)24.119.144.866252001xU  -}' ossec13001gExim Auth failed2025-02-21 11:01:41 dovecot_login authenticator failed for (dsl-tn-010.249.247.61.airtelbroadband.in) [61.247.249.10]:53640: 535 Incorrect authentication data (set_id=sushil.choudhary)61.247.249.101269750rT  -q' ossec13001gExim Auth failed2025-02-21 11:01:17 dovecot_login authenticator failed for ([46.52.204.227]) [46.52.204.227]:40421: 535 Incorrect authentication data (set_id=sushil.choudhary@heipowersystem.com)46.52.204.2272017370fS  -Y' ossec13001gExim Auth failed2025-02-21 11:01:13 dovecot_login authenticator failed for 83-233-30-104.cust.bredband2.com [83.233.30.104]:56032: 535 Incorrect authentication data (set_id=vikash.k)83.233.30.1042661886 u$! 1 4 8 7 ~sy~!u(w  3U) ossec11301gMNew FTP connection.Feb 21 11:38:11 vm1 pure-ftpd[3077650]: (?@152.59.101.145) [INFO] New connection from 152.59.101.145152.59.101.1451269750zv Cg) ossec11313gMFTP file uploaded to serverFeb 21 11:38:12 vm1 pure-ftpd[3077650]: (militry@technobases.in@152.59.101.145) [NOTICE] /home/techno/public_html/milictry1//index2.php uploaded (27308 bytes, 352.14KB/sec)152.59.101.1451269750vu  Ca) ossec11313gFTP file uploaded to serverFeb 21 11:32:22 vm1 pure-ftpd[3076600]: (militry@technobases.in@152.59.101.145) [NOTICE] /home/techno/public_html/milictry1//head.php uploaded (3447 bytes, 324.99KB/sec)152.59.101.1451269750(t  3U) ossec11301gNew FTP connection.Feb 21 11:32:21 vm1 pure-ftpd[3076600]: (?@152.59.101.145) [INFO] New connection from 152.59.101.145152.59.101.14512697505s  C_) ossec11309gFTP Authentication success.Feb 21 11:32:22 vm1 pure-ftpd[3076600]: (?@152.59.101.145) [INFO] militry@technobases.in is now logged in152.59.101.1451269750wr Ca) ossec11313gwFTP file uploaded to serverFeb 21 11:30:21 vm1 pure-ftpd[3075873]: (militry@technobases.in@152.59.101.145) [NOTICE] /home/techno/public_html/milictry1//head.php uploaded (3447 bytes, 638.86KB/sec)152.59.101.1451269750vq  Ca) ossec11313g=FTP file uploaded to serverFeb 21 11:29:24 vm1 pure-ftpd[3075873]: (militry@technobases.in@152.59.101.145) [NOTICE] /home/techno/public_html/milictry1//head.php uploaded (3545 bytes, 764.75KB/sec)152.59.101.1451269750(p  3U) ossec11301g=New FTP connection.Feb 21 11:29:24 vm1 pure-ftpd[3075873]: (?@152.59.101.145) [INFO] New connection from 152.59.101.145152.59.101.14512697505o  C_) ossec11309g=FTP Authentication success.Feb 21 11:29:24 vm1 pure-ftpd[3075873]: (?@152.59.101.145) [INFO] militry@technobases.in is now logged in152.59.101.1451269750vn  Ca) ossec11313gFTP file uploaded to serverFeb 21 11:28:16 vm1 pure-ftpd[3075684]: (militry@technobases.in@152.59.101.145) [NOTICE] /home/techno/public_html/milictry1//head.php uploaded (3380 bytes, 323.20KB/sec)152.59.101.1451269750(m  3U) ossec11301gNew FTP connection.Feb 21 11:28:16 vm1 pure-ftpd[3075684]: (?@152.59.101.145) [INFO] New connection from 152.59.101.145152.59.101.14512697505l  C_) ossec11309gFTP Authentication success.Feb 21 11:28:16 vm1 pure-ftpd[3075684]: (?@152.59.101.145) [INFO] militry@technobases.in is now logged in152.59.101.1451269750}k  -+ ossec13001gExim Auth failed2025-02-21 11:28:14 dovecot_login authenticator failed for (abts-mum-static-007.14.170.122.airtelbroadband.in) [103.137.112.251]:54780: 535 Incorrect authentication data (set_id=vikash.k)103.137.112.2511269750xj  -y+ ossec13001gExim Auth failed2025-02-21 11:28:14 dovecot_login authenticator failed for ([112.123.199.111]) [112.123.199.111]:48946: 535 Incorrect authentication data (set_id=sushil.choudhary@heipowersystem.com)112.123.199.1111814991yi  -' ossec13001gExim Auth failed2025-02-21 11:28:48 dovecot_login authenticator failed for (cli-5b7ec443.ast.adamo.es) [91.126.196.67]:48032: 535 Incorrect authentication data (set_id=field.service@heipowersystem.com)91.126.196.672510769lh  -e' ossec13001gExim Auth failed2025-02-21 11:28:45 dovecot_login authenticator failed for (pppoe-static.mosoblast.rt.ru) [77.51.214.170]:47432: 535 Incorrect authentication data (set_id=sushil.choudhary)77.51.214.1702017370g  -+ ossec13001gExim Auth failed2025-02-21 11:28:02 dovecot_login authenticator failed for (190-205-112-156.static.cantv.net) [190.205.112.156]:53114: 535 Incorrect authentication data (set_id=vikash.k@heipowersystem.com)190.205.112.1563625428Xf -?% ossec13001gExim Auth failed2025-02-21 11:14:10 dovecot_login authenticator failed for (User) [80.94.95.228]:46610: 535 Incorrect authentication data (set_id=galerie@technobases.in)80.94.95.228798549 G 5 %'-ciw Ca) ossec11313gFTP file uploaded to serverFeb 21 11:54:17 vm1 pure-ftpd[3080730]: (militry@technobases.in@152.59.101.145) [NOTICE] /home/techno/public_html/milictry1//head.php uploaded (4860 bytes, 487.02KB/sec)152.59.101.14512697505  C_) ossec11309gFTP Authentication success.Feb 21 11:54:17 vm1 pure-ftpd[3080730]: (?@152.59.101.145) [INFO] militry@technobases.in is now logged in152.59.101.1451269750v  Ca) ossec11313gFTP file uploaded to serverFeb 21 11:53:06 vm1 pure-ftpd[3080577]: (militry@technobases.in@152.59.101.145) [NOTICE] /home/techno/public_html/milictry1//head.php uploaded (3371 bytes, 595.95KB/sec)152.59.101.1451269750(  3U) ossec11301gNew FTP connection.Feb 21 11:53:05 vm1 pure-ftpd[3080577]: (?@152.59.101.145) [INFO] New connection from 152.59.101.145152.59.101.14512697505  C_) ossec11309gFTP Authentication success.Feb 21 11:53:05 vm1 pure-ftpd[3080577]: (?@152.59.101.145) [INFO] militry@technobases.in is now logged in152.59.101.14512697505  C_) ossec11309g.FTP Authentication success.Feb 21 11:50:28 vm1 pure-ftpd[3080065]: (?@152.59.101.145) [INFO] militry@technobases.in is now logged in152.59.101.1451269750(  3U) ossec11301g.New FTP connection.Feb 21 11:50:28 vm1 pure-ftpd[3080065]: (?@152.59.101.145) [INFO] New connection from 152.59.101.145152.59.101.1451269750v  Ca) ossec11313g.FTP file uploaded to serverFeb 21 11:50:29 vm1 pure-ftpd[3080065]: (militry@technobases.in@152.59.101.145) [NOTICE] /home/techno/public_html/milictry1//head.php uploaded (4049 bytes, 727.11KB/sec)152.59.101.1451269750z Cg) ossec11313gFTP file uploaded to serverFeb 21 11:45:33 vm1 pure-ftpd[3079181]: (militry@technobases.in@152.59.101.145) [NOTICE] /home/techno/public_html/milictry1//index2.php uploaded (27311 bytes, 586.25KB/sec)152.59.101.14512697506 C_) ossec11309gFTP Authentication success.Feb 21 11:45:33 vm1 pure-ftpd[3079181]: (?@152.59.101.145) [INFO] militry@technobases.in is now logged in152.59.101.1451269750) 3U) ossec11301gNew FTP connection.Feb 21 11:45:32 vm1 pure-ftpd[3079181]: (?@152.59.101.145) [INFO] New connection from 152.59.101.145152.59.101.1451269750y  Cg) ossec11313ghFTP file uploaded to serverFeb 21 11:42:54 vm1 pure-ftpd[3078637]: (militry@technobases.in@152.59.101.145) [NOTICE] /home/techno/public_html/milictry1//index2.php uploaded (27378 bytes, 528.39KB/sec)152.59.101.1451269750(~  3U) ossec11301gfNew FTP connection.Feb 21 11:42:53 vm1 pure-ftpd[3078637]: (?@152.59.101.145) [INFO] New connection from 152.59.101.145152.59.101.14512697505}  C_) ossec11309gfFTP Authentication success.Feb 21 11:42:53 vm1 pure-ftpd[3078637]: (?@152.59.101.145) [INFO] militry@technobases.in is now logged in152.59.101.1451269750v|  Ca) ossec11313gFTP file uploaded to serverFeb 21 11:40:28 vm1 pure-ftpd[3077902]: (militry@technobases.in@152.59.101.145) [NOTICE] /home/techno/public_html/milictry1//head.php uploaded (4246 bytes, 755.01KB/sec)152.59.101.14512697505{  C_) ossec11309gFTP Authentication success.Feb 21 11:39:49 vm1 pure-ftpd[3077902]: (?@152.59.101.145) [INFO] militry@technobases.in is now logged in152.59.101.1451269750vz  Ca) ossec11313gFTP file uploaded to serverFeb 21 11:39:49 vm1 pure-ftpd[3077902]: (militry@technobases.in@152.59.101.145) [NOTICE] /home/techno/public_html/milictry1//head.php uploaded (4232 bytes, 819.82KB/sec)152.59.101.1451269750(y  3U) ossec11301gNew FTP connection.Feb 21 11:39:48 vm1 pure-ftpd[3077902]: (?@152.59.101.145) [INFO] New connection from 152.59.101.145152.59.101.14512697505x  C_) ossec11309gMFTP Authentication success.Feb 21 11:38:11 vm1 pure-ftpd[3077650]: (?@152.59.101.145) [INFO] militry@technobases.in is now logged in152.59.101.1451269750 *\~tj`VLB8.$zpf\H>4*   v l b X N D : 0 &    ~ t j ` V L B 8 . $    z p f H \ R > 4 *   vlbXND:0&|rh^TJ@6,"xZndPF<2( VL~tj`B8.$zpf\ | r h ^ T J @ 6 , "    x n d Z P F < 2 (   RRH>4*  vlbXND:0& gT g gv g: g~$ g~ gxy gm gj gh gh gh gg gg ga ga ga ga ga ga g] g] g\< g\0 gY  gY gY1 gY' gY gY gU* gU gU gU  gU gT gN gN gHg gHY gH} gH} gHy gHk gB gB gBh gB* gB& gB gB  g?A g?K g?E g= g= g9 g5 g5 g5 g5 g5 g5 g/G g/E g/[ g/7 g/3 g/+ g+ g+ g( g( g( g( g( g&e g&3 g& g& g& g% g%s g%s g%s g$D g$D g$D g# g# g#n g#l g#l g# g# g# g" g" g" g" g" g" g" g" g" g" g" g! g! g! g!4 g!4 g! g!  g r g n g g g5 g g g gu gh gP gD g g> g: g g g g g g. g. g. g g g gh gf~ gf} g| g{ gz gy gMx gMw gMv gu gt gs gwr g=q g=p g=o gi gh gn gm gl gk gj gg gf ge gd gc gb g+6 g5 g4 g3 g2 g/ g . g1 g- g0 g, g+ g* g) g( g' g& g'% gl! g\ gZ gN$ gN# gH" g g g g g gm gc g; g+ g g g g g g gz gx gh g` ga gx` gp_ gl^ gR] gR\ g~[ gLZ g0Y g.X g.W gV gU gT gS gR gQ gEP g;O g;N g7M g-L g'K gJ gI g H g G g F g E g D g C g B g A g @ g p< g p; g `? g H> g F= g 8: g 49 g &8 g17 g 7 g 6 g 5 g4 gw3 gH0 g+2 g+1 g-/ g-. g-- g, g+ g * g ) g( g% g$ g' g# g& g" g! g g g g g gq gG g; g- g) g g g g g g g g g|  p otzy  Cg) ossec11313g!FTP file uploaded to serverFeb 21 12:15:47 vm1 pure-ftpd[3084779]: (user@spexscart.com@152.59.101.145) [NOTICE] /home/techno/public_html/spexscart.com//Orderhistory.php uploaded (0 bytes, 0.00KB/sec)152.59.101.1451269750  Ue) ossec11001g! Deferred login on the cpanel service[2025-02-21 12:15:32 +0530] info [webmaild] 157.38.131.142 - kps@amplifypowerglobal.com "POST /cpsess2590345622/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [157.38.131.84] != Current IP Address [157.38.131.142]157.38.131.14212697501  CW) ossec11309g rFTP Authentication success.Feb 21 12:12:56 vm1 pure-ftpd[3084779]: (?@152.59.101.145) [INFO] user@spexscart.com is now logged in152.59.101.1451269750(  3U) ossec11301g nNew FTP connection.Feb 21 12:12:52 vm1 pure-ftpd[3084779]: (?@152.59.101.145) [INFO] New connection from 152.59.101.145152.59.101.1451269750v  Ca) ossec11313gFTP file uploaded to serverFeb 21 12:01:22 vm1 pure-ftpd[3081860]: (militry@technobases.in@152.59.101.145) [NOTICE] /home/techno/public_html/milictry1//head.php uploaded (3448 bytes, 621.04KB/sec)152.59.101.1451269750v  Ca) ossec11313gFTP file uploaded to serverFeb 21 12:00:48 vm1 pure-ftpd[3081860]: (militry@technobases.in@152.59.101.145) [NOTICE] /home/techno/public_html/milictry1//head.php uploaded (3591 bytes, 329.47KB/sec)152.59.101.1451269750w Ca) ossec11313g5FTP file uploaded to serverFeb 21 11:59:08 vm1 pure-ftpd[3081860]: (militry@technobases.in@152.59.101.145) [NOTICE] /home/techno/public_html/milictry1//head.php uploaded (3618 bytes, 571.71KB/sec)152.59.101.1451269750(  3U) ossec11301gNew FTP connection.Feb 21 11:58:30 vm1 pure-ftpd[3081860]: (?@152.59.101.145) [INFO] New connection from 152.59.101.145152.59.101.1451269750v  Ca) ossec11313gFTP file uploaded to serverFeb 21 11:58:31 vm1 pure-ftpd[3081860]: (militry@technobases.in@152.59.101.145) [NOTICE] /home/techno/public_html/milictry1//head.php uploaded (3611 bytes, 227.79KB/sec)152.59.101.14512697505  C_) ossec11309gFTP Authentication success.Feb 21 11:58:31 vm1 pure-ftpd[3081860]: (?@152.59.101.145) [INFO] militry@technobases.in is now logged in152.59.101.1451269750^  -G) ossec13001guExim Auth failed2025-02-21 11:55:56 dovecot_login authenticator failed for ([218.92.201.232]) [218.92.201.226]:6024: 535 Incorrect authentication data (set_id=field.service)218.92.201.2261814991b  -O) ossec13001ghExim Auth failed2025-02-21 11:55:43 dovecot_login authenticator failed for ([220.124.240.75]) [220.124.240.66]:49586: 535 Incorrect authentication data (set_id=sushil.choudhary)220.124.240.661835841l  -g% ossec13001gPExim Auth failed2025-02-21 11:55:20 dovecot_login authenticator failed for ([102.53.15.54]) [102.53.15.54]:58869: 535 Incorrect authentication data (set_id=field.service@heipowersystem.com)102.53.15.542542007f  -W) ossec13001gDExim Auth failed2025-02-21 11:55:07 dovecot_login authenticator failed for (undefined.hostname.localhost) [103.151.38.224]:52233: 535 Incorrect authentication data (set_id=vikash.k)103.151.38.2241269750(  3U) ossec11301gNew FTP connection.Feb 21 11:54:17 vm1 pure-ftpd[3080730]: (?@152.59.101.145) [INFO] New connection from 152.59.101.145152.59.101.1451269750o  -m% ossec13001g>Exim Auth failed2025-02-21 11:55:02 dovecot_login authenticator failed for ([109.244.68.3]) [109.244.68.3]:36140: 535 Incorrect authentication data (set_id=sushil.choudhary@heipowersystem.com)109.244.68.31814991m  -e) ossec13001g:Exim Auth failed2025-02-21 11:54:58 dovecot_login authenticator failed for ([121.189.226.81]) [121.189.226.81]:57062: 535 Incorrect authentication data (set_id=vikash.k@heipowersystem.com)121.189.226.811835841 <T > < 8)=JUR<1/  CW) ossec11309g#lFTP Authentication success.Feb 21 12:25:40 vm1 pure-ftpd[3087581]: (?@152.59.101.145) [INFO] user@spexscart.com is now logged in152.59.101.14512697501.  CW) ossec11309g#FTP Authentication success.Feb 21 12:24:13 vm1 pure-ftpd[3087175]: (?@152.59.101.145) [INFO] user@spexscart.com is now logged in152.59.101.1451269750(-  3U) ossec11301g#New FTP connection.Feb 21 12:24:13 vm1 pure-ftpd[3087175]: (?@152.59.101.145) [INFO] New connection from 152.59.101.145152.59.101.1451269750,  Cs) ossec11313g#FTP file uploaded to serverFeb 21 12:24:14 vm1 pure-ftpd[3087175]: (user@spexscart.com@152.59.101.145) [NOTICE] /home/techno/public_html/spexscart.com//order-history.php uploaded (5224 bytes, 481.73KB/sec)152.59.101.1451269750q+  -m) ossec13001g"Exim Auth failed2025-02-21 12:22:42 dovecot_login authenticator failed for 222.42.246.220.static.netvigator.com [220.246.42.222]:63703: 535 Incorrect authentication data (set_id=field.service)220.246.42.2221819730o*  -k' ossec13001g"Exim Auth failed2025-02-21 12:22:25 dovecot_login authenticator failed for ([118.70.240.36]) [118.70.240.37]:56942: 535 Incorrect authentication data (set_id=field.service@heipowersystem.com)118.70.240.371562822h)  -_% ossec13001g"Exim Auth failed2025-02-21 12:22:09 dovecot_login authenticator failed for (nsg-static-90.87.76.182-airtel.com) [182.76.87.90]:50192: 535 Incorrect authentication data (set_id=vikash.k)182.76.87.9012697501(  CW) ossec11309g"FTP Authentication success.Feb 21 12:22:07 vm1 pure-ftpd[3086791]: (?@152.59.101.145) [INFO] user@spexscart.com is now logged in152.59.101.1451269750('  3U) ossec11301g"New FTP connection.Feb 21 12:22:07 vm1 pure-ftpd[3086791]: (?@152.59.101.145) [INFO] New connection from 152.59.101.145152.59.101.1451269750u&  -u) ossec13001g"Exim Auth failed2025-02-21 12:22:00 dovecot_login authenticator failed for ([164.164.117.23]) [164.164.117.23]:49184: 535 Incorrect authentication data (set_id=sushil.choudhary@heipowersystem.com)164.164.117.2312697501%  CW) ossec11309g"FTP Authentication success.Feb 21 12:21:58 vm1 pure-ftpd[3086753]: (?@152.59.101.145) [INFO] user@spexscart.com is now logged in152.59.101.1451269750($  3U) ossec11301g"New FTP connection.Feb 21 12:21:57 vm1 pure-ftpd[3086753]: (?@152.59.101.145) [INFO] New connection from 152.59.101.145152.59.101.1451269750m#  -e) ossec13001g"Exim Auth failed2025-02-21 12:21:46 dovecot_login authenticator failed for ([117.158.243.50]) [117.158.243.50]:35684: 535 Incorrect authentication data (set_id=vikash.k@heipowersystem.com)117.158.243.501814991)" 3U) ossec11301g"New FTP connection.Feb 21 12:19:56 vm1 pure-ftpd[3086243]: (?@152.59.101.145) [INFO] New connection from 152.59.101.145152.59.101.14512697506! C_) ossec11309g"FTP Authentication success.Feb 21 12:19:56 vm1 pure-ftpd[3086243]: (?@152.59.101.145) [INFO] militry@technobases.in is now logged in152.59.101.1451269750~  Cq) ossec11313g!FTP file uploaded to serverFeb 21 12:18:26 vm1 pure-ftpd[3085958]: (user@spexscart.com@152.59.101.145) [NOTICE] /home/techno/public_html/spexscart.com//order-history.php uploaded (4915 bytes, 78.94KB/sec)152.59.101.14512697501  CW) ossec11309g!FTP Authentication success.Feb 21 12:18:25 vm1 pure-ftpd[3085958]: (?@152.59.101.145) [INFO] user@spexscart.com is now logged in152.59.101.1451269750(  3U) ossec11301g!New FTP connection.Feb 21 12:18:25 vm1 pure-ftpd[3085958]: (?@152.59.101.145) [INFO] New connection from 152.59.101.145152.59.101.14512697501  CW) ossec11309g!4FTP Authentication success.Feb 21 12:16:11 vm1 pure-ftpd[3085643]: (?@152.59.101.145) [INFO] user@spexscart.com is now logged in152.59.101.1451269750(  3U) ossec11301g!4New FTP connection.Feb 21 12:16:11 vm1 pure-ftpd[3085643]: (?@152.59.101.145) [INFO] New connection from 152.59.101.145152.59.101.1451269750 TQ L H )}zx@  -y+ ossec13001g(Exim Auth failed2025-02-21 12:48:53 dovecot_login authenticator failed for ([218.146.133.117]) [218.146.133.117]:54622: 535 Incorrect authentication data (set_id=sushil.choudhary@heipowersystem.com)218.146.133.1171835841?  Cs) ossec11313g&eFTP file uploaded to serverFeb 21 12:38:20 vm1 pure-ftpd[3089841]: (user@spexscart.com@152.59.101.145) [NOTICE] /home/techno/public_html/spexscart.com//order-history.php uploaded (5833 bytes, 505.66KB/sec)152.59.101.1451269750> Cs) ossec11313g&3FTP file uploaded to serverFeb 21 12:37:29 vm1 pure-ftpd[3089841]: (user@spexscart.com@152.59.101.145) [NOTICE] /home/techno/public_html/spexscart.com//order-history.php uploaded (5844 bytes, 581.16KB/sec)152.59.101.1451269750= Cs) ossec11313g&FTP file uploaded to serverFeb 21 12:36:40 vm1 pure-ftpd[3089841]: (user@spexscart.com@152.59.101.145) [NOTICE] /home/techno/public_html/spexscart.com//order-history.php uploaded (5872 bytes, 526.71KB/sec)152.59.101.1451269750(<  3U) ossec11301g&New FTP connection.Feb 21 12:36:39 vm1 pure-ftpd[3089841]: (?@152.59.101.145) [INFO] New connection from 152.59.101.145152.59.101.14512697501;  CW) ossec11309g&FTP Authentication success.Feb 21 12:36:39 vm1 pure-ftpd[3089841]: (?@152.59.101.145) [INFO] user@spexscart.com is now logged in152.59.101.1451269750:  Cs) ossec11313g%FTP file uploaded to serverFeb 21 12:35:07 vm1 pure-ftpd[3089178]: (user@spexscart.com@152.59.101.145) [NOTICE] /home/techno/public_html/spexscart.com//order-history.php uploaded (5820 bytes, 527.04KB/sec)152.59.101.1451269750(9  3U) ossec11301g%sNew FTP connection.Feb 21 12:34:18 vm1 pure-ftpd[3089178]: (?@152.59.101.145) [INFO] New connection from 152.59.101.145152.59.101.145126975018  CW) ossec11309g%sFTP Authentication success.Feb 21 12:34:18 vm1 pure-ftpd[3089178]: (?@152.59.101.145) [INFO] user@spexscart.com is now logged in152.59.101.14512697507 Cs) ossec11313g%sFTP file uploaded to serverFeb 21 12:34:18 vm1 pure-ftpd[3089178]: (user@spexscart.com@152.59.101.145) [NOTICE] /home/techno/public_html/spexscart.com//order-history.php uploaded (5840 bytes, 187.10KB/sec)152.59.101.14512697506 Cu) ossec11313g$DFTP file uploaded to serverFeb 21 12:29:15 vm1 pure-ftpd[3088120]: (user@spexscart.com@152.59.101.145) [NOTICE] /home/techno/public_html/spexscart.com//order-history.php uploaded (5775 bytes, 6408.67KB/sec)152.59.101.1451269750(5  3U) ossec11301g$DNew FTP connection.Feb 21 12:29:14 vm1 pure-ftpd[3088120]: (?@152.59.101.145) [INFO] New connection from 152.59.101.145152.59.101.145126975014  CW) ossec11309g$DFTP Authentication success.Feb 21 12:29:14 vm1 pure-ftpd[3088120]: (?@152.59.101.145) [INFO] user@spexscart.com is now logged in152.59.101.14512697503 Cs) ossec11313g#FTP file uploaded to serverFeb 21 12:27:36 vm1 pure-ftpd[3087581]: (user@spexscart.com@152.59.101.145) [NOTICE] /home/techno/public_html/spexscart.com//order-history.php uploaded (5747 bytes, 982.87KB/sec)152.59.101.14512697502 Cu) ossec11313g#FTP file uploaded to serverFeb 21 12:26:35 vm1 pure-ftpd[3087581]: (user@spexscart.com@152.59.101.145) [NOTICE] /home/techno/public_html/spexscart.com//order-history.php uploaded (5738 bytes, 1007.67KB/sec)152.59.101.14512697501  Cs) ossec11313g#nFTP file uploaded to serverFeb 21 12:25:40 vm1 pure-ftpd[3087581]: (user@spexscart.com@152.59.101.145) [NOTICE] /home/techno/public_html/spexscart.com//order-history.php uploaded (5733 bytes, 353.92KB/sec)152.59.101.1451269750(0  3U) ossec11301g#lNew FTP connection.Feb 21 12:25:39 vm1 pure-ftpd[3087581]: (?@152.59.101.145) [INFO] New connection from 152.59.101.145152.59.101.1451269750  # 4 X f xhP  -Y+ ossec13001g5Exim Auth failed2025-02-21 13:43:05 dovecot_login authenticator failed for m106153186191.v4.enabler.ne.jp [106.153.186.191]:33378: 535 Incorrect authentication data (set_id=vikash.k)106.153.186.1911861060lO  -g% ossec13001g5Exim Auth failed2025-02-21 13:42:52 dovecot_login authenticator failed for ([211.93.6.230]) [211.93.6.230]:41506: 535 Incorrect authentication data (set_id=field.service@heipowersystem.com)211.93.6.2301814991 N  -#% ossec13001g5Exim Auth failed2025-02-21 13:42:50 dovecot_login authenticator failed for (static.ip.81.22.19.176.kalaam-telecom.com) [81.22.19.176]:38084: 535 Incorrect authentication data (set_id=sushil.choudhary@heipowersystem.com)81.22.19.176290291M  -) ossec13001g5Exim Auth failed2025-02-21 13:42:47 dovecot_login authenticator failed for (customer-187-237-47-214.uninet-ide.com.mx) [187.237.47.214]:56945: 535 Incorrect authentication data (set_id=vikash.k@heipowersystem.com)187.237.47.2143996063oL  -k' ossec13001g/GExim Auth failed2025-02-21 13:16:14 dovecot_login authenticator failed for ([119.84.241.94]) [119.84.241.94]:47764: 535 Incorrect authentication data (set_id=field.service@heipowersystem.com)119.84.241.941814991tK  -w% ossec13001g/EExim Auth failed2025-02-21 13:16:11 dovecot_login authenticator failed for host81-143-51-58.in-addr.btopenworld.com [81.143.51.58]:33576: 535 Incorrect authentication data (set_id=sushil.choudhary)81.143.51.582635167YJ  -A% ossec13001g/[Exim Auth failed2025-02-21 13:16:35 dovecot_login authenticator failed for ([109.244.68.3]) [109.244.68.3]:18494: 535 Incorrect authentication data (set_id=field.service)109.244.68.31814991WI  -;' ossec13001g/7Exim Auth failed2025-02-21 13:15:59 dovecot_login authenticator failed for ([118.70.240.37]) [118.70.240.37]:36671: 535 Incorrect authentication data (set_id=vikash.k)118.70.240.371562822rH  -q' ossec13001g/3Exim Auth failed2025-02-21 13:15:55 dovecot_login authenticator failed for ([102.53.15.180]) [102.53.15.180]:60194: 535 Incorrect authentication data (set_id=sushil.choudhary@heipowersystem.com)102.53.15.1802542007jG  -a' ossec13001g/+Exim Auth failed2025-02-21 13:15:46 dovecot_login authenticator failed for ([118.188.18.25]) [118.188.18.25]:44577: 535 Incorrect authentication data (set_id=vikash.k@heipowersystem.com)118.188.18.251814991nF  -k% ossec13001g+Exim Auth failed2025-02-21 13:02:14 dovecot_login authenticator failed for (thepsindustries.com) [119.96.131.8]:50692: 535 Incorrect authentication data (set_id=webmaster@thepsindustries.com)119.96.131.81814991XE  -?% ossec13001g+Exim Auth failed2025-02-21 13:01:49 dovecot_login authenticator failed for (thepsindustries.com) [119.96.131.8]:47326: 535 Incorrect authentication data (set_id=nologin)119.96.131.81814991kD  -a) ossec13001g(Exim Auth failed2025-02-21 12:49:25 dovecot_login authenticator failed for (m121-202-153-62.smartone.com) [121.202.153.62]:34207: 535 Incorrect authentication data (set_id=field.service)121.202.153.621819730pC  -i+ ossec13001g(Exim Auth failed2025-02-21 12:49:10 dovecot_login authenticator failed for ([119.198.191.130]) [119.198.191.130]:38600: 535 Incorrect authentication data (set_id=vikash.k@heipowersystem.com)119.198.191.1301835841|B  -' ossec13001g(Exim Auth failed2025-02-21 12:49:08 dovecot_login authenticator failed for p7001156-ipoefx.ipoe.ocn.ne.jp [118.3.227.155]:60176: 535 Incorrect authentication data (set_id=field.service@heipowersystem.com)118.3.227.1551861060eA  -S+ ossec13001g(Exim Auth failed2025-02-21 12:49:03 dovecot_login authenticator failed for ([103.152.234.133]) [103.152.234.133]:52130: 535 Incorrect authentication data (set_id=sushil.choudhary)103.152.234.1331643084 4 Z ;  (omb  -i% ossec13001gH}Exim Auth failed2025-02-21 15:03:48 dovecot_login authenticator failed for (nsg-static-90.87.76.182-airtel.com) [182.76.87.90]:59102: 535 Incorrect authentication data (set_id=field.service)182.76.87.901269750Ya  -C# ossec13001gHyExim Auth failed2025-02-21 15:03:44 dovecot_login authenticator failed for ([59.0.60.158]) [59.0.60.158]:54380: 535 Incorrect authentication data (set_id=sushil.choudhary)59.0.60.1581835841q`  -o' ossec13001gHkExim Auth failed2025-02-21 15:03:31 dovecot_login authenticator failed for (www.safecleen.com) [58.49.113.138]:10718: 535 Incorrect authentication data (set_id=field.service@heipowersystem.com)58.49.113.1381814991(_  3U) ossec11301gBNew FTP connection.Feb 21 14:38:19 vm1 pure-ftpd[3113275]: (?@152.59.101.206) [INFO] New connection from 152.59.101.206152.59.101.20612697505^  C_) ossec11309gBFTP Authentication success.Feb 21 14:38:19 vm1 pure-ftpd[3113275]: (?@152.59.101.206) [INFO] militry@technobases.in is now logged in152.59.101.2061269750_]  -I) ossec13001gBhExim Auth failed2025-02-21 14:37:51 dovecot_login authenticator failed for ([117.156.197.40]) [117.156.197.40]:49845: 535 Incorrect authentication data (set_id=field.service)117.156.197.401814991o\  -k' ossec13001gB*Exim Auth failed2025-02-21 14:36:48 dovecot_login authenticator failed for ([41.216.169.13]) [41.216.169.13]:44380: 535 Incorrect authentication data (set_id=field.service@heipowersystem.com)41.216.169.132328926Y[  -C# ossec13001gB&Exim Auth failed2025-02-21 14:36:45 dovecot_login authenticator failed for ([59.46.26.98]) [59.46.26.98]:29209: 535 Incorrect authentication data (set_id=sushil.choudhary)59.46.26.981814991xZ  -% ossec13001gBExim Auth failed2025-02-21 14:36:30 dovecot_login authenticator failed for 77-85-52-109.ip.btc-net.bg [77.85.52.109]:36463: 535 Incorrect authentication data (set_id=sushil.choudhary@heipowersystem.com)77.85.52.109732800zY  -% ossec13001gB Exim Auth failed2025-02-21 14:36:17 dovecot_login authenticator failed for syn-173-095-024-068.biz.spectrum.com [173.95.24.68]:3941: 535 Incorrect authentication data (set_id=vikash.k@heipowersystem.com)173.95.24.686252001)X 3U) ossec11301g?ANew FTP connection.Feb 21 14:24:23 vm1 pure-ftpd[3110555]: (?@152.59.101.206) [INFO] New connection from 152.59.101.206152.59.101.20612697505W  C_) ossec11309g?KFTP Authentication success.Feb 21 14:24:33 vm1 pure-ftpd[3110564]: (?@152.59.101.206) [INFO] militry@technobases.in is now logged in152.59.101.20612697506V Aa) ossec11302g?EFTP Authentication failed.Feb 21 14:24:27 vm1 pure-ftpd[3110555]: (?@152.59.101.206) [WARNING] Authentication failed for user [mili]152.59.101.20612697505U  C_) ossec11309g=FTP Authentication success.Feb 21 14:18:19 vm1 pure-ftpd[3109370]: (?@152.59.101.206) [INFO] militry@technobases.in is now logged in152.59.101.2061269750(T  3U) ossec11301g=New FTP connection.Feb 21 14:18:19 vm1 pure-ftpd[3109370]: (?@152.59.101.206) [INFO] New connection from 152.59.101.206152.59.101.2061269750VS -7' ossec13001g9Exim Auth failed2025-02-21 13:58:07 dovecot_login authenticator failed for (nyaystambh.com) [111.207.12.99]:49154: 535 Incorrect authentication data (set_id=nologin)111.207.12.991814991VR  -=# ossec13001g5Exim Auth failed2025-02-21 13:43:27 dovecot_login authenticator failed for ([59.46.26.98]) [59.46.26.98]:42524: 535 Incorrect authentication data (set_id=field.service)59.46.26.981814991nQ  -g) ossec13001g5Exim Auth failed2025-02-21 13:43:07 dovecot_login authenticator failed for (m121-202-203-93.smartone.com) [121.202.203.93]:27787: 535 Incorrect authentication data (set_id=sushil.choudhary)121.202.203.931819730 (2 < 7 L Q Falir  -a% ossec13001gYExim Auth failed2025-02-21 16:14:19 dovecot_login authenticator failed for ([60.174.39.82]) [60.174.39.82]:44054: 535 Incorrect authentication data (set_id=postmaster@heipowersystem.com)60.174.39.821814991\q  -C) ossec13001gY1Exim Auth failed2025-02-21 16:15:04 dovecot_login authenticator failed for ([116.114.84.234]) [116.114.84.234]:39391: 535 Incorrect authentication data (set_id=postmaster)116.114.84.2341814991_p  -G+ ossec13001gY'Exim Auth failed2025-02-21 16:14:53 dovecot_login authenticator failed for ([103.152.234.133]) [103.152.234.133]:50172: 535 Incorrect authentication data (set_id=postmaster)103.152.234.1331643084{o  -) ossec13001gYExim Auth failed2025-02-21 16:14:30 dovecot_login authenticator failed for (m121-202-203-93.smartone.com) [121.202.203.93]:29526: 535 Incorrect authentication data (set_id=postmaster@heipowersystem.com)121.202.203.931819730Xn  -?' ossec13001gYExim Auth failed2025-02-21 16:14:31 dovecot_login authenticator failed for ([91.72.171.210]) [91.72.171.210]:57045: 535 Incorrect authentication data (set_id=postmaster)91.72.171.210290557um  -u) ossec13001gU*Exim Auth failed2025-02-21 15:57:52 dovecot_login authenticator failed for 123-193-152-64.dynamic.kbronet.com.tw [123.193.152.64]:40494: 535 Incorrect authentication data (set_id=sushil.choudhary)123.193.152.641668284_l  -I) ossec13001gUExim Auth failed2025-02-21 15:57:25 dovecot_login authenticator failed for ([203.129.206.14]) [203.129.206.14]:57488: 535 Incorrect authentication data (set_id=field.service)203.129.206.141269750qk  -q' ossec13001gUExim Auth failed2025-02-21 15:57:25 dovecot_login authenticator failed for ([91.73.195.150]) [91.73.195.150]:46374: 535 Incorrect authentication data (set_id=sushil.choudhary@heipowersystem.com)91.73.195.150290557aj  -O' ossec13001gU Exim Auth failed2025-02-21 15:57:22 dovecot_login authenticator failed for (hebei.18.121.in-addr.arpa) [121.18.148.10]:26508: 535 Incorrect authentication data (set_id=vikash.k)121.18.148.101814991i  -+ ossec13001gUExim Auth failed2025-02-21 15:57:15 dovecot_login authenticator failed for 165.199.148.122.sta.wbroadband.net.au [122.148.199.165]:56290: 535 Incorrect authentication data (set_id=field.service@heipowersystem.com)122.148.199.1652077456wh  -{' ossec13001gTExim Auth failed2025-02-21 15:57:00 dovecot_login authenticator failed for p7001156-ipoefx.ipoe.ocn.ne.jp [118.3.227.155]:53328: 535 Incorrect authentication data (set_id=vikash.k@heipowersystem.com)118.3.227.1551861060gg  -]% ossec13001gNExim Auth failed2025-02-21 15:30:57 dovecot_login authenticator failed for ([144.48.49.72]) [144.48.49.72]:34782: 535 Incorrect authentication data (set_id=vikash.k@heipowersystem.com)144.48.49.721269750f  - ) ossec13001gNExim Auth failed2025-02-21 15:30:56 dovecot_login authenticator failed for (m121-202-155-16.smartone.com) [121.202.155.16]:59074: 535 Incorrect authentication data (set_id=sushil.choudhary@heipowersystem.com)121.202.155.161819730re  -q' ossec13001gHgExim Auth failed2025-02-21 15:03:26 dovecot_login authenticator failed for ([119.84.241.94]) [119.84.241.94]:58840: 535 Incorrect authentication data (set_id=sushil.choudhary@heipowersystem.com)119.84.241.941814991rd  -s% ossec13001gHYExim Auth failed2025-02-21 15:03:13 dovecot_login authenticator failed for (85-19-195-12.telia-isp.no) [85.19.195.12]:57560: 535 Incorrect authentication data (set_id=vikash.k@heipowersystem.com)85.19.195.123144096Tc  -7% ossec13001gH}Exim Auth failed2025-02-21 15:03:48 dovecot_login authenticator failed for ([102.53.15.17]) [102.53.15.17]:41173: 535 Incorrect authentication data (set_id=vikash.k)102.53.15.172542007     6*U^Xe`o\  -G% ossec13001ghExim Auth failed2025-02-21 17:18:30 dovecot_login authenticator failed for ([61.73.190.98]) [61.73.190.98]:58320: 535 Incorrect authentication data (set_id=sushil.choudhary)61.73.190.981835841m  -e) ossec13001ghExim Auth failed2025-02-21 17:18:17 dovecot_login authenticator failed for (110.20.167.124.adsl-pool.sx.cn) [124.167.20.110]:51366: 535 Incorrect authentication data (set_id=field.service)124.167.20.1101814991  - ) ossec13001ghExim Auth failed2025-02-21 17:18:18 dovecot_login authenticator failed for (m121-202-197-86.smartone.com) [121.202.197.86]:56166: 535 Incorrect authentication data (set_id=sushil.choudhary@heipowersystem.com)121.202.197.861819730o  -k' ossec13001ggExim Auth failed2025-02-21 17:18:08 dovecot_login authenticator failed for ([118.38.239.52]) [118.38.239.52]:50664: 535 Incorrect authentication data (set_id=field.service@heipowersystem.com)118.38.239.521835841~  - + ossec13001ggExim Auth failed2025-02-21 17:18:02 dovecot_login authenticator failed for 178-220-118-201.static.isp.telekom.rs [178.220.118.201]:51404: 535 Incorrect authentication data (set_id=vikash.k@heipowersystem.com)178.220.118.2016290252s}  -s' ossec13001gaExim Auth failed2025-02-21 16:51:47 dovecot_login authenticator failed for dynamic-186-30-57-201.dynamic.etb.net.co [186.30.57.201]:57186: 535 Incorrect authentication data (set_id=field.service)186.30.57.2013686110Q|  -3# ossec13001gaExim Auth failed2025-02-21 16:51:37 dovecot_login authenticator failed for ([118.43.30.3]) [118.43.30.3]:58474: 535 Incorrect authentication data (set_id=vikash.k)118.43.30.31835841{  -' ossec13001gaExim Auth failed2025-02-21 16:51:14 dovecot_login authenticator failed for (dsl-tn-010.249.247.61.airtelbroadband.in) [61.247.249.10]:49942: 535 Incorrect authentication data (set_id=field.service@heipowersystem.com)61.247.249.101269750bz  -O) ossec13001gaExim Auth failed2025-02-21 16:51:10 dovecot_login authenticator failed for ([222.239.231.61]) [222.239.231.61]:55120: 535 Incorrect authentication data (set_id=sushil.choudhary)222.239.231.611835841{y  -' ossec13001gaExim Auth failed2025-02-21 16:50:58 dovecot_login authenticator failed for 82-137-74-207.ip.btc-net.bg [82.137.74.207]:35724: 535 Incorrect authentication data (set_id=sushil.choudhary@heipowersystem.com)82.137.74.207732800x  -' ossec13001gaExim Auth failed2025-02-21 16:50:46 dovecot_login authenticator failed for (82.214.21.175.adsl-pool.jlccptt.net.cn) [175.21.214.82]:36724: 535 Incorrect authentication data (set_id=vikash.k@heipowersystem.com)175.21.214.821814991nw  -g) ossec13001g]Exim Auth failed2025-02-21 16:34:09 dovecot_login authenticator failed for syn-173-095-123-220.biz.spectrum.com [173.95.123.220]:57006: 535 Incorrect authentication data (set_id=postmaster)173.95.123.2206252001v  - ) ossec13001g]Exim Auth failed2025-02-21 16:33:31 dovecot_login authenticator failed for (as135139-cbe.skylinkfibernet.com) [103.99.148.149]:48842: 535 Incorrect authentication data (set_id=postmaster@heipowersystem.com)103.99.148.1491269750_u  -G+ ossec13001g\<Exim Auth failed2025-02-21 16:28:03 dovecot_login authenticator failed for ([112.172.126.247]) [112.172.126.247]:56709: 535 Incorrect authentication data (set_id=postmaster)112.172.126.2471835841t  - ) ossec13001g\0Exim Auth failed2025-02-21 16:27:50 dovecot_login authenticator failed for c-73-106-172-226.hsd1.ga.comcast.net [73.106.172.226]:51646: 535 Incorrect authentication data (set_id=postmaster@heipowersystem.com)73.106.172.2266252001s  -! ossec13001gY Exim Auth failed2025-02-21 16:14:26 dovecot_login authenticator failed for 96-1-34-28-staticipeast.wireless.telus.com [96.1.34.28]:41851: 535 Incorrect authentication data (set_id=postmaster@heipowersystem.com)96.1.34.286251999  } 9 F i 3l  -i# ossec13001gExim Auth failed2025-02-21 20:33:39 dovecot_login authenticator failed for ([60.174.86.4]) [60.174.86.4]:46998: 535 Incorrect authentication data (set_id=sushil.choudhary@heipowersystem.com)60.174.86.41814991y  -' ossec13001gzExim Auth failed2025-02-21 20:06:41 dovecot_login authenticator failed for (46-160-91-231-kh.maxnet.ua) [46.160.91.231]:35653: 535 Incorrect authentication data (set_id=field.service@heipowersystem.com)46.160.91.231690791_  -K' ossec13001gxExim Auth failed2025-02-21 20:06:39 dovecot_login authenticator failed for ([95.85.112.170]) [95.85.112.170]:49805: 535 Incorrect authentication data (set_id=sushil.choudhary)95.85.112.1701218197  -7% ossec13001ghExim Auth failed2025-02-21 20:06:24 dovecot_login authenticator failed for (88x87x84x104.static-customer.volgograd.ertelecom.ru) [88.87.84.104]:52896: 535 Incorrect authentication data (set_id=sushil.choudhary@heipowersystem.com)88.87.84.1042017370]  -C+ ossec13001g`Exim Auth failed2025-02-21 20:06:15 dovecot_login authenticator failed for ([154.144.255.210]) [154.144.255.210]:42270: 535 Incorrect authentication data (set_id=vikash.k)154.144.255.2102542007j  -a' ossec13001gTExim Auth failed2025-02-21 20:06:04 dovecot_login authenticator failed for ([118.188.18.25]) [118.188.18.25]:32536: 535 Incorrect authentication data (set_id=vikash.k@heipowersystem.com)118.188.18.2518149912 UC+ ossec11001gDeferred login on the cpanel service[2025-02-21 18:59:21 +0530] info [webmaild] 223.238.207.205 - kps@amplifypowerglobal.com "POST /cpsess2139955175/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect223.238.207.20512697502 UC+ ossec11001gvDeferred login on the cpanel service[2025-02-21 18:58:21 +0530] info [webmaild] 223.238.207.205 - kps@amplifypowerglobal.com "POST /cpsess2139955175/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect223.238.207.20512697502 UC+ ossec11001g:Deferred login on the cpanel service[2025-02-21 18:57:21 +0530] info [webmaild] 223.238.207.205 - kps@amplifypowerglobal.com "POST /cpsess2139955175/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect223.238.207.2051269750Y  -?' ossec13001g~$Exim Auth failed2025-02-21 18:52:43 dovecot_login authenticator failed for ([181.197.38.12]) [181.197.38.12]:53322: 535 Incorrect authentication data (set_id=postmaster)181.197.38.123703430o  -i) ossec13001g~Exim Auth failed2025-02-21 18:52:16 dovecot_login authenticator failed for ([154.144.243.93]) [154.144.243.93]:56784: 535 Incorrect authentication data (set_id=postmaster@heipowersystem.com)154.144.243.932542007@  =y+ ossec13008gxyMail Reciepient rejected2025-02-21 18:28:32 H=(mail.heipowersystem.com) [165.154.233.146]:52946 F= rejected RCPT : Rejected relay attempt: '165.154.233.146' From: 'gfhnbfhzo@heipowersystem.com' To: 'validxxxg@gmail.com'165.154.233.1461694008  Uk+ ossec11001gmDeferred login on the cpanel service[2025-02-21 17:42:21 +0530] info [webmaild] 223.238.207.205 - kps@amplifypowerglobal.com "POST /cpsess2139955175/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [157.38.131.142] != Current IP Address [223.238.207.205]223.238.207.2051269750v  -y' ossec13001gjExim Auth failed2025-02-21 17:27:19 dovecot_login authenticator failed for (cli-5b7ec443.ast.adamo.es) [91.126.196.67]:59574: 535 Incorrect authentication data (set_id=postmaster@heipowersystem.com)91.126.196.672510769 - C Y ` ] f^xpV  -;' ossec13001g\Exim Auth failed2025-02-21 22:22:43 dovecot_login authenticator failed for ([94.204.66.222]) [94.204.66.222]:52186: 535 Incorrect authentication data (set_id=vikash.k)94.204.66.222290557p  -q# ossec13001gZExim Auth failed2025-02-21 22:22:40 dovecot_login authenticator failed for (98.4.27.218.adsl-pool.jlccptt.net.cn) [218.27.4.98]:25332: 535 Incorrect authentication data (set_id=sushil.choudhary)218.27.4.981814991  -' ossec13001gExim Auth failed2025-02-21 21:29:05 dovecot_login authenticator failed for bzq-109-67-154-24.red.bezeqint.net [109.67.154.24]:38594: 535 Incorrect authentication data (set_id=sushil.choudhary@heipowersystem.com)109.67.154.24294640[  -E' ossec13001gExim Auth failed2025-02-21 21:28:53 dovecot_login authenticator failed for ([91.72.148.106]) [91.72.148.106]:39073: 535 Incorrect authentication data (set_id=field.service)91.72.148.106290557Q  -3# ossec13001gExim Auth failed2025-02-21 21:28:36 dovecot_login authenticator failed for ([60.174.86.4]) [60.174.86.4]:39275: 535 Incorrect authentication data (set_id=vikash.k)60.174.86.41814991l  -g% ossec13001gExim Auth failed2025-02-21 21:28:28 dovecot_login authenticator failed for ([218.147.6.84]) [218.147.6.84]:57520: 535 Incorrect authentication data (set_id=field.service@heipowersystem.com)218.147.6.841835841  -) ossec13001gExim Auth failed2025-02-21 21:28:16 dovecot_login authenticator failed for (175-182-64-203.adsl.dynamic.seed.net.tw) [175.182.64.203]:32814: 535 Incorrect authentication data (set_id=vikash.k@heipowersystem.com)175.182.64.2031668284b  -M+ ossec13001gmExim Auth failed2025-02-21 21:01:56 dovecot_login authenticator failed for ([154.144.255.208]) [154.144.255.208]:39680: 535 Incorrect authentication data (set_id=field.service)154.144.255.2082542007  -) ossec13001gcExim Auth failed2025-02-21 21:01:46 dovecot_login authenticator failed for 222.42.246.220.static.netvigator.com [220.246.42.222]:61773: 535 Incorrect authentication data (set_id=field.service@heipowersystem.com)220.246.42.2221819730s  -q) ossec13001g;Exim Auth failed2025-02-21 21:01:07 dovecot_login authenticator failed for (customer-187-237-47-214.uninet-ide.com.mx) [187.237.47.214]:56780: 535 Incorrect authentication data (set_id=vikash.k)187.237.47.2143996063  - ) ossec13001g+Exim Auth failed2025-02-21 21:00:51 dovecot_login authenticator failed for c-73-106-172-226.hsd1.ga.comcast.net [73.106.172.226]:55644: 535 Incorrect authentication data (set_id=vikash.k@heipowersystem.com)73.106.172.2266252001u  -s+ ossec13001gExim Auth failed2025-02-21 20:33:33 dovecot_login authenticator failed for ([221.239.109.147]) [221.239.109.147]:16330: 535 Incorrect authentication data (set_id=field.service@heipowersystem.com)221.239.109.1471814991f  -Y' ossec13001gExim Auth failed2025-02-21 20:33:57 dovecot_login authenticator failed for (cli-5b7ec443.ast.adamo.es) [91.126.196.67]:55026: 535 Incorrect authentication data (set_id=field.service)91.126.196.672510769f  -W) ossec13001gExim Auth failed2025-02-21 20:33:53 dovecot_login authenticator failed for (m121-202-155-61.smartone.com) [121.202.155.61]:43162: 535 Incorrect authentication data (set_id=vikash.k)121.202.155.611819730b  -O) ossec13001gExim Auth failed2025-02-21 20:33:51 dovecot_login authenticator failed for ([222.128.80.201]) [222.128.80.201]:17446: 535 Incorrect authentication data (set_id=sushil.choudhary)222.128.80.2011814991i  -a' ossec13001gExim Auth failed2025-02-21 20:33:41 dovecot_login authenticator failed for ([91.72.153.110]) [91.72.153.110]:39445: 535 Incorrect authentication data (set_id=vikash.k@heipowersystem.com)91.72.153.110290557 :   ) } *:l1  -g% ossec13001gExim Auth failed2025-02-21 23:16:14 dovecot_login authenticator failed for ([218.147.6.84]) [218.147.6.84]:38698: 535 Incorrect authentication data (set_id=field.service@heipowersystem.com)218.147.6.841835841W0  -;' ossec13001gExim Auth failed2025-02-21 23:16:12 dovecot_login authenticator failed for ([118.38.239.52]) [118.38.239.52]:52146: 535 Incorrect authentication data (set_id=vikash.k)118.38.239.521835841_/  -K' ossec13001gExim Auth failed2025-02-21 23:17:01 dovecot_login authenticator failed for ([118.188.18.25]) [118.188.18.25]:38909: 535 Incorrect authentication data (set_id=sushil.choudhary)118.188.18.251814991f.  -[% ossec13001g Exim Auth failed2025-02-21 23:16:52 dovecot_login authenticator failed for bb121-7-26-195.singnet.com.sg [121.7.26.195]:49214: 535 Incorrect authentication data (set_id=field.service)121.7.26.1951880251-  -' ossec13001gExim Auth failed2025-02-21 23:16:15 dovecot_login authenticator failed for (cust-72-26-178-196.wireless.t6b.com) [72.26.178.196]:43780: 535 Incorrect authentication data (set_id=sushil.choudhary@heipowersystem.com)72.26.178.1966252001p,  -i+ ossec13001gExim Auth failed2025-02-21 23:15:53 dovecot_login authenticator failed for ([125.140.244.144]) [125.140.244.144]:39026: 535 Incorrect authentication data (set_id=vikash.k@heipowersystem.com)125.140.244.1441835841o+  -m% ossec13001gExim Auth failed2025-02-21 22:49:44 dovecot_login authenticator failed for (nsg-static-173.125.76.182-airtel.com) [182.76.87.90]:56770: 535 Incorrect authentication data (set_id=field.service)182.76.87.901269750 *  -' ossec13001gExim Auth failed2025-02-21 22:49:35 dovecot_login authenticator failed for (186-201-10-10.customer.tdatabrasil.net.br) [186.201.10.10]:39576: 535 Incorrect authentication data (set_id=field.service@heipowersystem.com)186.201.10.103469034b)  -O) ossec13001gExim Auth failed2025-02-21 22:49:23 dovecot_login authenticator failed for ([218.150.170.10]) [218.150.170.10]:50384: 535 Incorrect authentication data (set_id=sushil.choudhary)218.150.170.101835841t(  -s) ossec13001gExim Auth failed2025-02-21 22:49:12 dovecot_login authenticator failed for ([218.92.201.232]) [218.92.201.226]:7761: 535 Incorrect authentication data (set_id=sushil.choudhary@heipowersystem.com)218.92.201.2261814991]'  -C+ ossec13001gExim Auth failed2025-02-21 22:49:13 dovecot_login authenticator failed for ([220.189.239.206]) [220.189.239.206]:52658: 535 Incorrect authentication data (set_id=vikash.k)220.189.239.2061814991j&  -a' ossec13001gExim Auth failed2025-02-21 22:48:57 dovecot_login authenticator failed for ([118.70.240.37]) [118.70.240.37]:50733: 535 Incorrect authentication data (set_id=vikash.k@heipowersystem.com)118.70.240.371562822(%  3U) ossec11301g'New FTP connection.Feb 21 22:43:10 vm1 pure-ftpd[3206552]: (?@172.168.40.200) [INFO] New connection from 172.168.40.200172.168.40.2006252001d$  -Y# ossec13001gNExim Auth failed2025-02-21 22:22:30 dovecot_login authenticator failed for ([27.98.249.9]) [27.98.249.9]:44781: 535 Incorrect authentication data (set_id=vikash.k@heipowersystem.com)27.98.249.91814991#  - ) ossec13001gNExim Auth failed2025-02-21 22:22:29 dovecot_login authenticator failed for (m121-202-203-93.smartone.com) [121.202.203.93]:43262: 535 Incorrect authentication data (set_id=sushil.choudhary@heipowersystem.com)121.202.203.931819730q"  -o) ossec13001gHExim Auth failed2025-02-21 22:22:23 dovecot_login authenticator failed for ([168.167.55.230]) [168.167.55.230]:37596: 535 Incorrect authentication data (set_id=field.service@heipowersystem.com)168.167.55.230933860q!  -m) ossec13001glExim Auth failed2025-02-21 22:23:00 dovecot_login authenticator failed for c-73-106-172-226.hsd1.ga.comcast.net [73.106.172.226]:59796: 535 Incorrect authentication data (set_id=field.service)73.106.172.2266252001 ! + ' / A aVnUB -9# ossec13001g'Exim Auth failed2025-02-22 00:38:23 dovecot_login authenticator failed for (gurukuljaipur.com) [14.18.77.99]:41838: 535 Incorrect authentication data (set_id=nologin)14.18.77.991814991~A  -) ossec13001gKExim Auth failed2025-02-22 00:09:07 dovecot_login authenticator failed for (m121-202-155-16.smartone.com) [121.202.155.16]:25346: 535 Incorrect authentication data (set_id=field.service@heipowersystem.com)121.202.155.161819730b@  -O) ossec13001gnExim Auth failed2025-02-22 00:09:40 dovecot_login authenticator failed for ([218.92.201.232]) [218.92.201.226]:14716: 535 Incorrect authentication data (set_id=sushil.choudhary)218.92.201.2261814991r?  -q' ossec13001g`Exim Auth failed2025-02-22 00:09:26 dovecot_login authenticator failed for ([118.70.240.37]) [118.70.240.37]:47000: 535 Incorrect authentication data (set_id=sushil.choudhary@heipowersystem.com)118.70.240.371562822f>  -W) ossec13001g^Exim Auth failed2025-02-22 00:09:24 dovecot_login authenticator failed for (m121-202-197-86.smartone.com) [121.202.197.86]:14213: 535 Incorrect authentication data (set_id=vikash.k)121.202.197.861819730\=  -E' ossec13001gSExim Auth failed2025-02-22 00:09:15 dovecot_login authenticator failed for ([103.174.34.49]) [103.174.34.49]:57603: 535 Incorrect authentication data (set_id=field.service)103.174.34.491269750d<  -Y# ossec13001g=Exim Auth failed2025-02-22 00:08:52 dovecot_login authenticator failed for ([60.174.86.4]) [60.174.86.4]:41901: 535 Incorrect authentication data (set_id=vikash.k@heipowersystem.com)60.174.86.41814991;  ?1 ossec1008gLJProcess exiting (killed).Feb 22 00:05:51 vm1 spamd[2946845]: spamd: server killed by SIGTERM, shutting down":  3M% ossec11301gNew FTP connection.Feb 21 23:50:03 vm1 pure-ftpd[3219098]: (?@4.151.36.251) [INFO] New connection from 4.151.36.2514.151.36.2516252001W9  -;' ossec13001gCExim Auth failed2025-02-21 23:43:21 dovecot_login authenticator failed for ([222.120.176.6]) [222.120.176.6]:48008: 535 Incorrect authentication data (set_id=vikash.k)222.120.176.61835841\8  -G% ossec13001g;Exim Auth failed2025-02-21 23:43:13 dovecot_login authenticator failed for ([2.110.10.192]) [2.110.10.192]:58502: 535 Incorrect authentication data (set_id=sushil.choudhary)2.110.10.1922623032j7  -a' ossec13001g1Exim Auth failed2025-02-21 23:43:04 dovecot_login authenticator failed for ([212.75.154.16]) [212.75.154.16]:42583: 535 Incorrect authentication data (set_id=vikash.k@heipowersystem.com)212.75.154.162017370t6  -q+ ossec13001g+Exim Auth failed2025-02-21 23:42:57 dovecot_login authenticator failed for 122-148-252-147.sta.wbroadband.net.au [122.148.252.147]:39394: 535 Incorrect authentication data (set_id=field.service)122.148.252.14720774565  -% ossec13001gExim Auth failed2025-02-21 23:42:43 dovecot_login authenticator failed for 5.185.198.73.ipv4.public.orange.pl [5.185.198.73]:45670: 535 Incorrect authentication data (set_id=sushil.choudhary@heipowersystem.com)5.185.198.73798544r4  -o) ossec13001gExim Auth failed2025-02-21 23:42:44 dovecot_login authenticator failed for ([43.246.138.100]) [43.246.138.100]:36388: 535 Incorrect authentication data (set_id=field.service@heipowersystem.com)43.246.138.1001269750v3  -u+ ossec13001gExim Auth failed2025-02-21 23:33:14 dovecot_login authenticator failed for (amplifypowerglobal.com) [111.122.211.212]:21596: 535 Incorrect authentication data (set_id=admin@amplifypowerglobal.com)111.122.211.2121814991a2  -K+ ossec13001gExim Auth failed2025-02-21 23:32:49 dovecot_login authenticator failed for (amplifypowerglobal.com) [111.122.211.212]:17572: 535 Incorrect authentication data (set_id=nologin)111.122.211.2121814991 R F  !eK,RVP  -;% ossec13001g=xExim Auth failed2025-02-22 08:29:03 dovecot_login authenticator failed for syn-071-041-202-012.biz.spectrum.com [71.41.202.12]:52911: 535 Incorrect authentication data71.41.202.126252001O  W% ossec9708g6Dovecot Aborted Login with empty userFeb 22 08:00:32 vm1 dovecot[2934170]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=71.6.134.235, lip=103.74.54.108, TLS, session=71.6.134.23562520013N UG) ossec11001g4Deferred login on the cpanel service[2025-02-22 07:51:16 +0530] info [webmaild] 223.238.193.64 - kps@amplifypowerglobal.com "GET /cPanel_magic_revision_0/webmail/jupiter/styles/preload_styles.min.css HTTP/1.1" DEFERRED LOGIN webmaild: security token missing223.238.193.641269750_M -G) ossec13001g1Exim Auth failed2025-02-22 07:39:36 dovecot_login authenticator failed for (s2seducationtrust.com) [101.89.140.209]:58926: 535 Incorrect authentication data (set_id=nologin)101.89.140.2091814991nL  =U+ ossec13008g->Mail Reciepient rejected2025-02-22 07:19:49 H=(mail.sainikschoolcoachinginjaipur.com) [165.154.208.228]:52822 F= rejected RCPT : Rejected relay attempt: '165.154.208.228' From: 'ighflivyxbf@sainikschoolcoachinginjaipur.com' To: 'validxxxg@gmail.com'165.154.208.2281668284K  W+ ossec9708g#.Dovecot Aborted Login with empty userFeb 22 06:36:53 vm1 dovecot[2934170]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=165.154.182.168, lip=103.74.54.108, session=<17EKubAuIuulmrao>165.154.182.1686252001&J  =G) ossec13008gQMail Reciepient rejected2025-02-22 05:12:08 H=(mail.hsnews.in) [165.154.227.39]:65011 F= rejected RCPT : Rejected relay attempt: '165.154.227.39' From: 'ffbmhgtxmgp@hsnews.in' To: 'validxxxg@gmail.com'165.154.227.391668284jI  -a' ossec13001g}Exim Auth failed2025-02-22 04:43:00 dovecot_login authenticator failed for 013.143.48.116.static.netvigator.com [116.48.143.13]:63159: 535 Incorrect authentication data (set_id=purchase)116.48.143.131819730wH  -y) ossec13001gUExim Auth failed2025-02-22 04:42:21 dovecot_login authenticator failed for (132-178-53-194.mairnet.net) [194.53.178.132]:49682: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)194.53.178.13231753958G  =k) ossec13008gMail Reciepient rejected2025-02-22 04:22:32 H=(mail.fablixsolutions.com) [165.154.226.62]:55205 F= rejected RCPT : Rejected relay attempt: '165.154.226.62' From: 'wbyns@fablixsolutions.com' To: 'validxxxg@gmail.com'165.154.226.621668284%F  3Q' ossec11301gNew FTP connection.Feb 22 04:02:07 vm1 pure-ftpd[3269593]: (?@198.235.24.60) [INFO] New connection from 198.235.24.60198.235.24.606252001%E  3Q' ossec11301gvNew FTP connection.Feb 22 03:38:51 vm1 pure-ftpd[3265300]: (?@52.189.74.240) [INFO] New connection from 52.189.74.24052.189.74.2406252001fD  =E+ ossec13008gMail Reciepient rejected2025-02-22 02:26:31 H=(mail.shivelectricaltransformers.com) [165.154.210.114]:55362 F= rejected RCPT : Rejected relay attempt: '165.154.210.114' From: 'cijkxfjilf@shivelectricaltransformers.com' To: 'validxxxg@gmail.com'165.154.210.1141694008zC  -' ossec13001giExim Auth failed2025-02-22 01:13:36 dovecot_plain authenticator failed for (78-168-168-45.weblinknet.com.br) [45.168.168.78]:52822: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)45.168.168.783469034  !3E`ttO^  U) ossec11001gS;Deferred login on the cpanel service[2025-02-22 10:01:54 +0530] info [whostmgrd] 122.161.56.135 - root "GET /cpsess7910608658/scripts/editsets HTTP/1.1" DEFERRED LOGIN whostmgrd: cookie ip check: IP address has changed: IP Address [223.185.235.44] != Current IP Address [122.161.56.135]122.161.56.1351269750]  Uc' ossec11001gRDeferred login on the cpanel service[2025-02-22 09:59:42 +0530] info [webmaild] 223.225.57.41 - kps@amplifypowerglobal.com "POST /cpsess8362300640/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [223.238.193.64] != Current IP Address [223.225.57.41]223.225.57.411269750[\  -G% ossec13001gNExim Auth failed2025-02-22 09:42:13 dovecot_login authenticator failed for 77-85-52-109.ip.btc-net.bg [77.85.52.109]:35749: 535 Incorrect authentication data (set_id=oliver)77.85.52.109732800|[  -' ossec13001gNExim Auth failed2025-02-22 09:41:54 dovecot_login authenticator failed for (cust-72-26-178-196.wireless.t6b.com) [72.26.178.196]:41444: 535 Incorrect authentication data (set_id=oliver@heipowersystem.com)72.26.178.1966252001hZ  -]' ossec13001gB Exim Auth failed2025-02-22 08:48:34 dovecot_login authenticator failed for ([181.197.38.12]) [181.197.38.12]:49606: 535 Incorrect authentication data (set_id=oliver@heipowersystem.com)181.197.38.123703430aY  -Q% ossec13001g@Exim Auth failed2025-02-22 08:43:18 dovecot_login authenticator failed for 111-70-0-112.emome-ip.hinet.net [111.70.0.112]:43038: 535 Incorrect authentication data (set_id=oliver)111.70.0.1121668284jX  -a) ossec13001g@Exim Auth failed2025-02-22 08:42:51 dovecot_login authenticator failed for ([178.173.173.60]) [178.173.173.60]:48816: 535 Incorrect authentication data (set_id=oliver@heipowersystem.com)178.173.173.60130758jW  =O) ossec13008g?nMail Reciepient rejected2025-02-22 08:37:26 H=mgptr-233-122.piano.io [143.55.233.122]:56630 X=TLS1.3:TLS_AES_128_GCM_SHA256:128 CV=no F= rejected RCPT : Rejected relay attempt: '143.55.233.122' From: 'bounce+56b3cc.78b6342-arjun.singh=heipowersystem.com@mg-esp-prod-ap-us.yourstory.com' To: 'arjun.singh@heipowersystem.com'143.55.233.1226252001UV  -7' ossec13001g=zExim Auth failed2025-02-22 08:29:06 dovecot_login authenticator failed for ([95.85.112.170]) [95.85.112.170]:51236: 535 Incorrect authentication data (set_id=oliver)95.85.112.1701218197hU  -]' ossec13001g=Exim Auth failed2025-02-22 08:29:32 dovecot_login authenticator failed for ([175.202.82.16]) [175.202.82.16]:41868: 535 Incorrect authentication data (set_id=oliver@heipowersystem.com)175.202.82.161835841[T  -?+ ossec13001g=Exim Auth failed2025-02-22 08:29:17 dovecot_login authenticator failed for ([112.123.199.111]) [112.123.199.111]:36906: 535 Incorrect authentication data (set_id=oliver)112.123.199.1111814991S  - + ossec13001g=zExim Auth failed2025-02-22 08:29:06 dovecot_login authenticator failed for d-138-207-226-233.ct.cpe.atlanticbb.net [138.207.226.233]:65067: 535 Incorrect authentication data (set_id=oliver@heipowersystem.com)138.207.226.2336252001wR  -y) ossec13001g=nExim Auth failed2025-02-22 08:28:54 dovecot_login authenticator failed for (m121-202-153-62.smartone.com) [121.202.153.62]:52664: 535 Incorrect authentication data (set_id=oliver@heipowersystem.com)121.202.153.6218197306Q QO+ ossec11000g=XLogin failed on the cpanel service[2025-02-22 08:28:32 +0530] info [webmaild] 106.207.156.143 - support@amplifypowerglobal.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)106.207.156.1431269750 ~qdWJ=0# zm`SF9, v i \ O B 5 (     r e X K > 1 $  { n a T G : -   w j ] P C 6 )    s f Y L ? 2 %  |obUH;.!xk^QD7*tgZM@3& }pcVI</"yl_RE8+uh[NA4' ~qdWJ=0 1668284, 1668284* 1668284) 1668284' 1668284 1668284 1668284S 1668284 1668284 1668284 1668284+ 1668284$ 1668284 1668284 1668284 1668284W 1668284 1668284 1668284 1668284 1668284 1668284 1668284 1668284< 16682848 1668284% 1668284 1668284 1668284 1668284k 1668284f 1668284[ 1668284T 1668284P 1668284M 1668284 1668284 1668284 1668284 1668284 1668284 1668284 1668284_ 1668284G 1668284 1668284 1668284 1668284 1668284~ 1668284X 1668284W 16682842 1668284) 1668284 1668284 1668284 1668284 1668284 1668284 1668284` 1668284J 1668284. 1668284 1668284 1668284 1668284 1668284 1668284 1668284 1668284 1668284 1668284 1668284 1668284 1668284 1668284v 1668284Q 16682849 1668284% 1668284 1668284 1668284 1668284C 1668284B 1668284? 1668284 1668284 1668284 1668284 1668284 1668284 1668284 1668284 1668284 1668284 1668284 1668284Z 1668284Y 16682845 1668284! 1668284 1668284 1668284 1668284 1668284 1668284q 1668284X 16682841 1668284& 1668284" 1668284 1668284 1668284 1668284 1668284 1668284 1668284 1668284 1668284 1668284t 1668284e 1668284` 1668284V 16682849 1668284) 1668284& 1668284 1668284 1668284 1668284 1668284 1668284 1668284 1668284 1668284x 1668284_ 1668284T 1668284A 16682840 1668284. 1668284 1668284 1668284 1668284 1668284 1668284 1668284w 1668284r 1668284i 1668284e 1668284T 1668284O 1668284 1668284 1668284 1668284 1668284 1668284 1668284 1668284 1668284 1668284M 1668284 1668284 1668284 1668284 1668284 1668284 y 1668284 v 1668284 f 1668284 A 1668284 6 1668284  1668284 1668284 Y 1668284 = 1668284 6 1668284 $ 1668284  1668284  1668284 1668284 1668284 1668284 e 1668284 W 1668284 ' 1668284 1668284 1668284 1668284 1668284 1668284 i 1668284 c 1668284 O 1668284 4 1668284 + 1668284  1668284 1668284 1668284 1668284 1668284 1668284 1668284 1668284 1668284 1668284 1668284 h 1668284 b 1668284 O 1668284 J 1668284 F 1668284 ' 1668284  1668284  1668284  1668284  1668284  1668284 1668284 1668284 1668284 1668284 1668284 1668284 1668284 1668284 1668284 1668284 1668284{ 1668284v 1668284q 1668284j 1668284h 1668284f 1668284c 1668284a 1668284Y 1668284L ){p j f _ TKC90"~%%52.169.4.246BLACKg̸RgRBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests29635974local V)193.41.206.189BLACKgKogoBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests3017382)νlocal'52.169.89.232BLACKg.rgrBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests29635974Ylocal+217.142.186.155BLACKg gݯBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests1880251َlocal)52.164.218.141BLACKg g۹Blacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests29635974ڍlocal)150.136.69.140BLACKgXgXBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests6252001Elocal'13.250.46.201BLACKggBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests1880251 .local)196.127.14.119BLACKgٌgBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests2542007wlocal +150.136.222.122BLACKgʙgjBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests6252001zlocal '52.169.181.97BLACKgʗghBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests29635974alocal )128.199.21.147BLACKgXg)Blacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests1269750localy%!k81.70.28.141GRAYgImunify360gAutomatically blocked due to distributed attack1814991QFlocal'197.63.210.87BLACKg#cgcBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests357994?Wlocal'193.41.206.98BLACKggBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests3017382)blocal'13.79.157.149BLACKgvgvBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests2963597 Olocal'52.169.181.54BLACKg?gBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests296359746local'52.164.123.85BLACKg͖gBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests29635974{Ulocal)52.169.181.239BLACKgȾgBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests29635974local'52.164.218.25BLACKgȤAguABlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests29635974local)150.136.112.62BLACKg$gBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests6252001p>local~'167.86.125.25BLACKggBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests3017382V}local}'173.239.249.6BLACKg$g$Blacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests6252001local > C  tP}\l  -C) ossec13001gExim Auth failed2025-02-22 17:52:47 dovecot_login authenticator failed for (fablixsolutions.com) [101.89.140.209]:37032: 535 Incorrect authentication data (set_id=nologin)101.89.140.2091814991k  W!) ossec9708gDovecot Aborted Login with empty userFeb 22 17:48:38 vm1 dovecot[2934170]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=185.247.137.80, lip=103.74.54.108, TLS, session=185.247.137.80298795"j  =?) ossec13008gYMail Reciepient rejected2025-02-22 17:30:23 H=(mail.hsnews.in) [165.154.208.84]:64646 F= rejected RCPT : Rejected relay attempt: '165.154.208.84' From: 'nkwkuqdui@hsnews.in' To: 'validxxxg@gmail.com'165.154.208.841668284)i 3U) ossec11301gVNew FTP connection.Feb 22 17:09:01 vm1 pure-ftpd[3416397]: (?@164.92.235.151) [INFO] New connection from 164.92.235.151164.92.235.1512921044Ph  =) ossec13008gWMail Reciepient rejected2025-02-22 15:09:33 H=(mail.westerndancecompany.com) [165.154.208.70]:57816 F= rejected RCPT : Rejected relay attempt: '165.154.208.70' From: 'odjinrwpbzk@westerndancecompany.com' To: 'validxxxg@gmail.com'165.154.208.701668284Hg  = ) ossec13008gMail Reciepient rejected2025-02-22 15:04:08 H=(mail.s2seducationtrust.com) [165.154.210.93]:55233 F= rejected RCPT : Rejected relay attempt: '165.154.210.93' From: 'sqqsmtogym@s2seducationtrust.com' To: 'validxxxg@gmail.com'165.154.210.931694008/f  =W+ ossec13008gMail Reciepient rejected2025-02-22 14:42:12 H=(mail.spexscart.com) [165.154.226.172]:53521 F= rejected RCPT : Rejected relay attempt: '165.154.226.172' From: 'fijmraig@spexscart.com' To: 'validxxxg@gmail.com'165.154.226.1721668284 e  W#+ ossec9708g}Dovecot Aborted Login with empty userFeb 22 13:02:58 vm1 dovecot[2934170]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=185.247.137.176, lip=103.74.54.108, TLS, session=185.247.137.176298795Md  =+ ossec13008gxMail Reciepient rejected2025-02-22 12:41:46 H=(mail.westerndancecompany.com) [165.154.228.195]:61955 F= rejected RCPT : Rejected relay attempt: '165.154.228.195' From: 'nyhjeiob@westerndancecompany.com' To: 'validxxxg@gmail.com'165.154.228.1951643084Ec  =+ ossec13008gjMail Reciepient rejected2025-02-22 11:41:35 H=(mail.s2seducationtrust.com) [165.154.226.172]:58724 F= rejected RCPT : Rejected relay attempt: '165.154.226.172' From: 'zfwseif@s2seducationtrust.com' To: 'validxxxg@gmail.com'165.154.226.17216682841b  =]) ossec13008gcMail Reciepient rejected2025-02-22 11:12:19 H=(mail.nyaystambh.com) [165.154.233.80]:63942 F= rejected RCPT : Rejected relay attempt: '165.154.233.80' From: 'bssvmhskm@nyaystambh.com' To: 'validxxxg@gmail.com'165.154.233.801694008wa  -{' ossec13001gbExim Auth failed2025-02-22 11:08:01 dovecot_login authenticator failed for 220-130-18-21.hinet-ip.hinet.net [220.130.18.21]:34946: 535 Incorrect authentication data (set_id=oliver@heipowersystem.com)220.130.18.211668284(`  3U) ossec11301g[CNew FTP connection.Feb 22 10:36:09 vm1 pure-ftpd[3344406]: (?@167.94.138.203) [INFO] New connection from 167.94.138.203167.94.138.2036252001_  5') ossec11011gS;WHM SSO login failed[2025-02-22 10:01:54 +0530] info [whostmgrd] 122.161.56.135 PURGE root:JcaP0ZO4xmvuRt47 badpass [cookie ip check: IP address has changed: IP Address [223.185.235.44] != Current IP Address [122.161.56.135]]122.161.56.1351269750 3 ` A LmJ 2GRY+3t|  -s) ossec13001g\Exim Auth failed2025-02-22 22:24:50 dovecot_login authenticator failed for ([103.248.40.194]) [103.248.40.194]:53929: 535 Incorrect authentication data (set_id=vikaskhandelwal@heipowersystem.com)103.248.40.1941831722*{  =O) ossec13008gfMail Reciepient rejected2025-02-22 22:20:45 H=(mail.spexscart.com) [165.154.208.53]:63263 F= rejected RCPT : Rejected relay attempt: '165.154.208.53' From: 'qisbchj@spexscart.com' To: 'validxxxg@gmail.com'165.154.208.531668284uz  -w' ossec13001gExim Auth failed2025-02-22 22:10:18 dovecot_login authenticator failed for ([60.255.120.74]) [60.255.120.74]:57560: 535 Incorrect authentication data (set_id=shubhamkulshreshtha@heipowersystem.com)60.255.120.741814991qy  -o' ossec13001gExim Auth failed2025-02-22 22:09:35 dovecot_login authenticator failed for (186-201-10-10.customer.tdatabrasil.net.br) [186.201.10.10]:27856: 535 Incorrect authentication data (set_id=services)186.201.10.103469034gx  -]% ossec13001gExim Auth failed2025-02-22 22:09:20 dovecot_login authenticator failed for ([183.236.13.2]) [183.236.13.2]:36470: 535 Incorrect authentication data (set_id=services@heipowersystem.com)183.236.13.21814991jw  -_) ossec13001gExim Auth failed2025-02-22 22:06:40 dovecot_login authenticator failed for ([121.189.198.60]) [121.189.198.60]:60058: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)121.189.198.601835841&v  =G) ossec13008gMail Reciepient rejected2025-02-22 21:55:59 H=(mail.msnews24.in) [165.154.227.29]:58863 F= rejected RCPT : Rejected relay attempt: '165.154.227.29' From: 'nvzjvpax@msnews24.in' To: 'validxxxg@gmail.com'165.154.227.291668284u  W!) ossec9708gDovecot Aborted Login with empty userFeb 22 21:44:40 vm1 dovecot[2934170]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=87.236.176.165, lip=103.74.54.108, TLS, session=87.236.176.1652635167[t -?) ossec13001gExim Auth failed2025-02-22 20:35:37 dovecot_login authenticator failed for (gurukuljaipur.com) [60.167.170.146]:34654: 535 Incorrect authentication data (set_id=nologin)60.167.170.1461814991qs  -m) ossec13001giExim Auth failed2025-02-22 19:51:27 dovecot_login authenticator failed for (heipowersystem.com) [101.89.140.209]:49806: 535 Incorrect authentication data (set_id=postmaster@heipowersystem.com)101.89.140.2091814991[r  -A) ossec13001gQExim Auth failed2025-02-22 19:51:03 dovecot_login authenticator failed for (heipowersystem.com) [101.89.140.209]:46892: 535 Incorrect authentication data (set_id=nologin)101.89.140.2091814991cq  =A) ossec13008gڦMail Reciepient rejected2025-02-22 19:39:41 H=(mail.sainikschoolcoachinginjaipur.com) [165.154.227.29]:62183 F= rejected RCPT : Rejected relay attempt: '165.154.227.29' From: 'cjkfnne@sainikschoolcoachinginjaipur.com' To: 'validxxxg@gmail.com'165.154.227.291668284up  -w' ossec13001gExim Auth failed2025-02-22 18:46:08 dovecot_login authenticator failed for (s2seducationtrust.com) [111.56.54.202]:60774: 535 Incorrect authentication data (set_id=postmaster@s2seducationtrust.com)111.56.54.2021814991\o  -E' ossec13001gExim Auth failed2025-02-22 18:45:39 dovecot_login authenticator failed for (s2seducationtrust.com) [111.56.54.202]:58184: 535 Incorrect authentication data (set_id=nologin)111.56.54.2021814991%n  3Q' ossec11301gSNew FTP connection.Feb 22 18:08:42 vm1 pure-ftpd[3428347]: (?@104.152.52.80) [INFO] New connection from 104.152.52.80104.152.52.806252001sm  -q) ossec13001gExim Auth failed2025-02-22 17:53:11 dovecot_login authenticator failed for (fablixsolutions.com) [101.89.140.209]:40606: 535 Incorrect authentication data (set_id=postmaster@fablixsolutions.com)101.89.140.2091814991 a  ]  0-Pv?I  = + ossec13008gJMail Reciepient rejected2025-02-23 03:37:52 H=(mail.westerndancecompany.com) [165.154.208.103]:52542 F= rejected RCPT : Rejected relay attempt: '165.154.208.103' From: 'ugurvv@westerndancecompany.com' To: 'validxxxg@gmail.com'165.154.208.1031668284C  77 ossec502gFwOssec server started.ossec: Ossec started.3  =a) ossec13008g?OMail Reciepient rejected2025-02-23 02:49:09 H=(mail.technobases.in) [165.154.208.63]:61681 F= rejected RCPT : Rejected relay attempt: '165.154.208.63' From: 'aqodkrpdhh@technobases.in' To: 'validxxxg@gmail.com'165.154.208.631668284V  -;% ossec13001g9Exim Auth failed2025-02-23 02:25:41 dovecot_login authenticator failed for ([211.93.6.230]) [211.93.6.230]:26702: 535 Incorrect authentication data (set_id=khandelwal)211.93.6.2301814991Y  -?' ossec13001g9Exim Auth failed2025-02-23 02:25:32 dovecot_login authenticator failed for ([46.52.204.227]) [46.52.204.227]:34516: 535 Incorrect authentication data (set_id=khandelwal)46.52.204.2272017370  - ' ossec13001g9Exim Auth failed2025-02-23 02:25:04 dovecot_login authenticator failed for syn-074-218-095-154.biz.spectrum.com [74.218.95.154]:42917: 535 Incorrect authentication data (set_id=khandelwal@heipowersystem.com)74.218.95.1546252001a  -K+ ossec13001g8Exim Auth failed2025-02-23 02:22:07 dovecot_login authenticator failed for (ADMIN) [185.213.193.221]:57084: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)185.213.193.2216252001p  -m' ossec13001g79Exim Auth failed2025-02-23 02:14:39 dovecot_login authenticator failed for (124.82.236.45.cable.dyn.ridsa.com.ar) [45.236.82.124]:50850: 535 Incorrect authentication data (set_id=kulshreshtha)45.236.82.1243865483}  -) ossec13001g7Exim Auth failed2025-02-23 02:14:01 dovecot_login authenticator failed for (undefined.hostname.localhost) [103.151.38.224]:53745: 535 Incorrect authentication data (set_id=kulshreshtha@heipowersystem.com)103.151.38.2241269750'  3U) ossec11301g6New FTP connection.Feb 23 02:12:35 vm1 pure-ftpd[3523117]: (?@91.196.152.103) [INFO] New connection from 91.196.152.10391.196.152.103690791$  3Q' ossec11301g6New FTP connection.Feb 23 02:12:34 vm1 pure-ftpd[3523112]: (?@91.196.152.96) [INFO] New connection from 91.196.152.9691.196.152.966907919  Ak) ossec11302g6FTP Authentication failed.Feb 23 02:12:40 vm1 pure-ftpd[3523117]: (?@91.196.152.103) [WARNING] Authentication failed for user [anonymous]91.196.152.103690791b  -O) ossec13001g2Exim Auth failed2025-02-23 01:52:22 dovecot_plain authenticator failed for ([123.209.119.82]) [123.209.119.82]:47808: 535 Incorrect authentication data (set_id=vikas.khandelwal)123.209.119.822077456r  -q' ossec13001g1Exim Auth failed2025-02-23 01:52:09 dovecot_plain authenticator failed for ([117.173.18.71]) [117.173.18.71]:49294: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)117.173.18.711814991]  -G' ossec13001g!lExim Auth failed2025-02-23 00:41:39 dovecot_login authenticator failed for (ADMIN) [185.24.11.149]:54530: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)185.24.11.1492782113  ?1 ossec1008gProcess exiting (killed).Feb 23 00:05:31 vm1 spamd[3225375]: spamd: server killed by SIGTERM, shutting down"~  3M% ossec11301g{New FTP connection.Feb 22 22:50:59 vm1 pure-ftpd[3482830]: (?@4.156.21.177) [INFO] New connection from 4.156.21.1774.156.21.1776252001u}  -w' ossec13001gjExim Auth failed2025-02-22 22:25:04 dovecot_login authenticator failed for dynamic-186-30-57-201.dynamic.etb.net.co [186.30.57.201]:54304: 535 Incorrect authentication data (set_id=vikaskhandelwal)186.30.57.2013686110 T  ! D Vf*Ob5DK3  =a) ossec13008gMail Reciepient rejected2025-02-23 07:44:33 H=(mail.technobases.in) [165.154.227.89]:61174 F= rejected RCPT : Rejected relay attempt: '165.154.227.89' From: 'mnswsmxdyc@technobases.in' To: 'valxxx@mailsire.com'165.154.227.891668284u  -u) ossec13001gnExim Auth failed2025-02-23 07:35:33 dovecot_plain authenticator failed for (173-167-115-17-sfba.hfc.comcastbusiness.net) [173.167.115.17]:54566: 535 Incorrect authentication data (set_id=services)173.167.115.176252001m  -e) ossec13001g\Exim Auth failed2025-02-23 07:35:16 dovecot_plain authenticator failed for ([203.193.147.37]) [203.193.147.37]:59631: 535 Incorrect authentication data (set_id=services@heipowersystem.com)203.193.147.371269750)  =K+ ossec13008gMail Reciepient rejected2025-02-23 07:32:58 H=(mail.hsnews.in) [165.154.208.227]:51215 F= rejected RCPT : Rejected relay attempt: '165.154.208.227' From: 'flhohpgelru@hsnews.in' To: 'valxxx@mailsire.com'165.154.208.2271668284i  -a% ossec13001g~Exim Auth failed2025-02-23 07:19:31 dovecot_login authenticator failed for (heipowersystem.com) [60.2.243.174]:37168: 535 Incorrect authentication data (set_id=office@heipowersystem.com)60.2.243.1741814991W  -=% ossec13001g~Exim Auth failed2025-02-23 07:19:00 dovecot_login authenticator failed for (heipowersystem.com) [60.2.243.174]:35348: 535 Incorrect authentication data (set_id=nologin)60.2.243.17418149918  =k) ossec13008g{lMail Reciepient rejected2025-02-23 07:05:38 H=(mail.gurukuljaipur.com) [165.154.226.98]:59263 F= rejected RCPT : Rejected relay attempt: '165.154.226.98' From: 'vbqvwwpx@gurukuljaipur.com' To: 'valxxx@mailsire.com'165.154.226.981668284l  -a+ ossec13001gm7Exim Auth failed2025-02-23 06:05:02 dovecot_login authenticator failed for 165.199.148.122.sta.wbroadband.net.au [122.148.199.165]:33412: 535 Incorrect authentication data (set_id=vikas)122.148.199.1652077456j  -_) ossec13001gm#Exim Auth failed2025-02-23 06:04:42 dovecot_login authenticator failed for ([117.156.80.230]) [117.156.80.230]:46748: 535 Incorrect authentication data (set_id=vikas@heipowersystem.com)117.156.80.2301814991Y  -=) ossec13001gjnExim Auth failed2025-02-23 05:53:09 dovecot_login authenticator failed for ([190.121.195.38]) [190.121.195.38]:57520: 535 Incorrect authentication data (set_id=shubham)190.121.195.383595528i  -_' ossec13001gj`Exim Auth failed2025-02-23 05:52:56 dovecot_login authenticator failed for ([39.165.183.70]) [39.165.183.70]:55632: 535 Incorrect authentication data (set_id=shubham@heipowersystem.com)39.165.183.701814991f  -W) ossec13001g_Exim Auth failed2025-02-23 05:08:19 dovecot_plain authenticator failed for ([207.228.181.46]) [207.228.181.46]:52575: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)207.228.181.463573345s  -u% ossec13001g_Exim Auth failed2025-02-23 05:08:01 dovecot_plain authenticator failed for ([211.44.80.68]) [211.44.80.68]:38692: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)211.44.80.681835841a  ==) ossec13008gQMail Reciepient rejected2025-02-23 04:05:04 H=(mail.shivelectricaltransformers.com) [165.154.210.93]:58019 F= rejected RCPT : Rejected relay attempt: '165.154.210.93' From: 'mmrduworb@shivelectricaltransformers.com' To: 'validxxxg@gmail.com'165.154.210.931694008(  3U) ossec11301gNNew FTP connection.Feb 23 03:54:17 vm1 pure-ftpd[3543882]: (?@147.185.132.73) [INFO] New connection from 147.185.132.73147.185.132.736252001 7 r)~-  - % ossec13001gExim Auth failed2025-02-23 15:29:57 dovecot_plain authenticator failed for (50-82-12-128.client.mchsi.com) [50.82.12.128]:54534: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)50.82.12.1286252001q,  -q' ossec13001gExim Auth failed2025-02-23 15:29:41 dovecot_plain authenticator failed for ([82.209.247.54]) [82.209.247.54]:50448: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)82.209.247.54630336A+  =' ossec13008gMail Reciepient rejected2025-02-23 14:57:11 H=(mail.s2seducationtrust.com) [165.154.228.9]:52132 F= rejected RCPT : Rejected relay attempt: '165.154.228.9' From: 'ziyiljuj@s2seducationtrust.com' To: 'valxxx@mailsire.com'165.154.228.91643084j*  -a' ossec13001gExim Auth failed2025-02-23 14:57:11 dovecot_login authenticator failed for (heipowersystem.com) [58.242.166.26]:45606: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)58.242.166.261814991Y)  -?' ossec13001gExim Auth failed2025-02-23 14:56:32 dovecot_login authenticator failed for (heipowersystem.com) [58.242.166.26]:43640: 535 Incorrect authentication data (set_id=nologin)58.242.166.261814991o(  -i) ossec13001gaExim Auth failed2025-02-23 14:54:48 dovecot_login authenticator failed for (gurukuljaipur.com) [124.160.63.122]:17717: 535 Incorrect authentication data (set_id=postmaster@gurukuljaipur.com)124.160.63.1221814991\'  -A+ ossec13001gEExim Auth failed2025-02-23 14:54:20 dovecot_login authenticator failed for (gurukuljaipur.com) [202.107.197.211]:32922: 535 Incorrect authentication data (set_id=nologin)202.107.197.2111814991'&  3U) ossec11301gNew FTP connection.Feb 23 14:35:31 vm1 pure-ftpd[3668049]: (?@185.247.137.85) [INFO] New connection from 185.247.137.85185.247.137.85298795#%  =?+ ossec13008gMail Reciepient rejected2025-02-23 11:06:25 H=(mail.msnews24.in) [165.154.227.105]:60840 F= rejected RCPT : Rejected relay attempt: '165.154.227.105' From: 'vimyq@msnews24.in' To: 'valxxx@mailsire.com'165.154.227.1051668284&$  =G) ossec13008g"Mail Reciepient rejected2025-02-23 10:24:57 H=(mail.msnews24.in) [165.154.226.19]:50384 F= rejected RCPT : Rejected relay attempt: '165.154.226.19' From: 'piieuuwi@msnews24.in' To: 'valxxx@mailsire.com'165.154.226.191668284F#  =+ ossec13008gMail Reciepient rejected2025-02-23 10:02:12 H=(mail.amplifypowerglobal.com) [165.154.213.232]:57875 F= rejected RCPT : Rejected relay attempt: '165.154.213.232' From: 'ugkjho@amplifypowerglobal.com' To: 'valxxx@mailsire.com'165.154.213.2323469034S" -3% ossec13001gExim Auth failed2025-02-23 09:15:37 dovecot_login authenticator failed for (rokamauka.com) [119.96.131.8]:47584: 535 Incorrect authentication data (set_id=nologin)119.96.131.81814991%!  3Q' ossec11301g_New FTP connection.Feb 23 09:04:53 vm1 pure-ftpd[3604669]: (?@3.144.128.249) [INFO] New connection from 3.144.128.2493.144.128.2496252001& 3Q' ossec11301gGNew FTP connection.Feb 23 09:00:14 vm1 pure-ftpd[3603821]: (?@3.144.128.249) [INFO] New connection from 3.144.128.2493.144.128.2496252001W  -9) ossec13001gExim Auth failed2025-02-23 08:58:12 dovecot_plain authenticator failed for ([119.206.34.142]) [119.206.34.142]:57604: 535 Incorrect authentication data (set_id=sales)119.206.34.1421835841j  -_) ossec13001gExim Auth failed2025-02-23 08:58:01 dovecot_plain authenticator failed for ([183.167.196.62]) [183.167.196.62]:55751: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)183.167.196.621814991 / i u 34/N)/v>  -w) ossec13001gJ1Exim Auth failed2025-02-23 21:47:52 dovecot_login authenticator failed for (m121-202-155-34.smartone.com) [121.202.155.34]:56988: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)121.202.155.341819730(=  3U) ossec11301gDENew FTP connection.Feb 23 21:22:35 vm1 pure-ftpd[3748374]: (?@198.235.24.238) [INFO] New connection from 198.235.24.238198.235.24.2386252001p<  -i+ ossec13001g@Exim Auth failed2025-02-23 21:06:49 dovecot_plain authenticator failed for ([112.164.240.110]) [112.164.240.110]:40224: 535 Incorrect authentication data (set_id=services@heipowersystem.com)112.164.240.1101835841[;  -E% ossec13001g?Exim Auth failed2025-02-23 21:04:02 dovecot_login authenticator failed for (ADMIN) [89.37.63.107]:43326: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)89.37.63.1072661886":  3M% ossec11301g2QNew FTP connection.Feb 23 20:06:00 vm1 pure-ftpd[3733392]: (?@139.162.77.6) [INFO] New connection from 139.162.77.6139.162.77.61861060]9 -E' ossec13001g0 Exim Auth failed2025-02-23 19:56:18 dovecot_login authenticator failed for (s2seducationtrust.com) [111.207.12.99]:45898: 535 Incorrect authentication data (set_id=nologin)111.207.12.9918149918  -' ossec13001g(Exim Auth failed2025-02-23 19:25:09 dovecot_login authenticator failed for static-23-234-69-220.cust.tzulo.com (ADMIN) [23.234.69.220]:50092: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)23.234.69.2206252001{7  -+ ossec13001gExim Auth failed2025-02-23 18:47:08 dovecot_plain authenticator failed for (user-static-164-126-135-188.mobile.play-internet.pl) [164.126.135.188]:43438: 535 Incorrect authentication data (set_id=sales)164.126.135.188798544J6  =) ossec13008gMail Reciepient rejected2025-02-23 18:46:45 H=(mail.s2seducationtrust.com) [165.154.213.78]:57844 F= rejected RCPT : Rejected relay attempt: '165.154.213.78' From: 'ezqgepoxmtl@s2seducationtrust.com' To: 'valxxx@mailsire.com'165.154.213.783469034z5  -' ossec13001gExim Auth failed2025-02-23 18:46:19 dovecot_plain authenticator failed for (stale-fjorden-rt.hty-dsl.midtit.no) [217.22.38.208]:47949: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)217.22.38.2083144096 4  -!) ossec13001gExim Auth failed2025-02-23 18:42:37 dovecot_plain authenticator failed for mobile-166-201-208-67.mycingular.net [166.201.208.67]:58190: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)166.201.208.676252001c3  -S' ossec13001gExim Auth failed2025-02-23 18:42:50 dovecot_plain authenticator failed for ([60.29.100.218]) [60.29.100.218]:47432: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)60.29.100.2181814991C2  =+ ossec13008gMail Reciepient rejected2025-02-23 18:03:52 H=(mail.fablixsolutions.com) [165.154.251.134]:56849 F= rejected RCPT : Rejected relay attempt: '165.154.251.134' From: 'glmmeqzsr@fablixsolutions.com' To: 'valxxx@mailsire.com'165.154.251.1341605651)1  EK% ossec5715gSSHD authentication success.Feb 23 16:29:44 vm1 sshd[3690332]: Accepted password for root from 103.190.54.7 port 52301 ssh2103.190.54.71269750)0 CK% ossec5716gSSHD authentication failed.Feb 23 16:12:16 vm1 sshd[3687025]: Failed password for techno from 103.190.54.7 port 52295 ssh2103.190.54.71269750^/  E5% ossec2501gUser authentication failure.Feb 23 16:12:14 vm1 sshd[3687025]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.190.54.7 user=techno103.190.54.71269750.  -+ ossec13001gExim Auth failed2025-02-23 15:30:30 dovecot_plain authenticator failed for (m121-202-153-211.smartone.com) [121.202.153.211]:24626: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)121.202.153.2111819730 *\~tj`VLB8.$zpf\H>4*   v l b X N D : 0 &    ~ t j ` V L B 8 . $    z p f \ R H > 4 *  vlbXND:0&|rh^T@J6,"xndZPF<2( ~tj`VLB.8$zpf\ | r h ^ T J @ 6 , "    x n d Z P F < 2 (   RRH>4*  vlbXND:0& g9 6 gĆ 5 gv 4 gx 3 gf 2 g 1 g 0 g& / g . g - g , g + g * g ) gl ( g ' g & g % g $ gZ # gL " gf ! gv g  g:  g}3  g}%  gy  gw  gv  ge  gd  gdI  g^  g^  g\  g[  gX  gOl  gO`  gF  gF gF gF gC g@t g7$  g-  g%  g$  gE  ge  gr  g^  g g g g g g  gG g g g% g g g g# g g g? g% g gQ g g9 g gJ g= g g! g g g g g g g gQ gK gC g g g g gx gJ g8 gI g~ g~ gy gw gj gj~ gdq gWf gTU gT= gS9 gS) gN gN gMG gKY gKG gJ gJ gJG gJE gJ1 gDE g@ g? g2Q g0  g( g g g g g g g g g g g g g g g ga gE g g g" g g g_ gG g g g gn g\ g g~ g~ g{l gm7 gm# gjn gj` g_ g_ gQ gN gJ gFw g H a g ` g _ g\ ^ gM ] g \ g [ g Z g Y g X g W g V g U g T g S gy R g k Q g  P g O g N go M g| L gl K g J g6 I g H g G g% F g E g D g܂ C gt B g A g @ g؏ ? g׭ > gש = gף < gׇ ; g@ : gm 9 gU 8 gO 7 g?O g9 g9 g9 g8 g79 g7 g6 g6 g6 g2 g1 g!l g g{~ gj} g\| gf{ gz gy gx gw gv gu gt gis gQr gڦq gp go gSn gm gl gk gYj gVi gWh gg gf g}e gxd gjc g T b gcb gba g[C` gS;_ gS;^ gR] gN\ gN[ gB Z g@Y g@X g?nW g=U g=T g=zV g=zS g=xP g=nR g=XQ g6O g4N g1M g->L g#.K gQJ g}I gUH gG gF gvE gD giC g'B gn@ g`? g^> gS= gKA g=< gLJ; g: gC9 H [ s t x?]O  -C+ ossec13001gjExim Auth failed2025-02-24 00:07:44 dovecot_login authenticator failed for (fablixsolutions.com) [111.122.211.212]:7948: 535 Incorrect authentication data (set_id=nologin)111.122.211.2121814991N  ?1 ossec1008gj~Process exiting (killed).Feb 24 00:05:40 vm1 spamd[3498027]: spamd: server killed by SIGTERM, shutting down5M  =c+ ossec13008gdqMail Reciepient rejected2025-02-23 23:39:52 H=(mail.spexscart.com) [165.154.228.195]:62938 F= rejected RCPT : Rejected relay attempt: '165.154.228.195' From: 'yobefqzjhpr@spexscart.com' To: 'valxxx@mailsire.com'165.154.228.1951643084"L  3M% ossec11301gWfNew FTP connection.Feb 23 22:44:13 vm1 pure-ftpd[3764212]: (?@71.6.134.230) [INFO] New connection from 71.6.134.23071.6.134.2306252001dK  -S) ossec13001gTUExim Auth failed2025-02-23 22:31:08 dovecot_login authenticator failed for (nyaystambh.com) [124.160.63.122]:22687: 535 Incorrect authentication data (set_id=sales@nyaystambh.com)124.160.63.1221814991WJ  -9) ossec13001gT=Exim Auth failed2025-02-23 22:30:44 dovecot_login authenticator failed for (nyaystambh.com) [124.160.63.122]:23584: 535 Incorrect authentication data (set_id=nologin)124.160.63.1221814991yI  -}) ossec13001gS9Exim Auth failed2025-02-23 22:26:25 dovecot_plain authenticator failed for 83-233-242-245.cust.bredband2.com [83.233.242.245]:51324: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)83.233.242.2452661886&H  =G) ossec13008gS)Mail Reciepient rejected2025-02-23 22:26:09 H=(mail.msnews24.in) [165.154.233.84]:56518 F= rejected RCPT : Rejected relay attempt: '165.154.233.84' From: 'oyuqgucn@msnews24.in' To: 'valxxx@mailsire.com'165.154.233.841694008[G  -E% ossec13001gNExim Auth failed2025-02-23 22:06:41 dovecot_login authenticator failed for ([61.97.17.208]) [61.97.17.208]:43391: 535 Incorrect authentication data (set_id=vikaskhandelwal)61.97.17.2081835841F  - ) ossec13001gNExim Auth failed2025-02-23 22:06:26 dovecot_login authenticator failed for (m121-202-154-83.smartone.com) [121.202.154.83]:36741: 535 Incorrect authentication data (set_id=vikaskhandelwal@heipowersystem.com)121.202.154.831819730"E  3M% ossec11301gMGNew FTP connection.Feb 23 22:01:01 vm1 pure-ftpd[3755764]: (?@52.249.39.29) [INFO] New connection from 52.249.39.2952.249.39.296252001_D  -M% ossec13001gKYExim Auth failed2025-02-23 21:52:48 dovecot_login authenticator failed for ([211.151.86.9]) [211.151.86.9]:43548: 535 Incorrect authentication data (set_id=shubhamkulshreshtha)211.151.86.91814991{C  -+ ossec13001gKGExim Auth failed2025-02-23 21:52:31 dovecot_login authenticator failed for ([103.152.234.134]) [103.152.234.134]:49494: 535 Incorrect authentication data (set_id=shubhamkulshreshtha@heipowersystem.com)103.152.234.1341643084dB  -U' ossec13001gJExim Auth failed2025-02-23 21:51:17 dovecot_login authenticator failed for p7001156-ipoefx.ipoe.ocn.ne.jp [118.3.227.155]:33888: 535 Incorrect authentication data (set_id=services)118.3.227.1551861060iA  -a' ossec13001gJExim Auth failed2025-02-23 21:51:01 dovecot_login authenticator failed for ([80.250.155.12]) [80.250.155.12]:38286: 535 Incorrect authentication data (set_id=services@heipowersystem.com)80.250.155.12294640M@  --# ossec13001gJGExim Auth failed2025-02-23 21:48:13 dovecot_login authenticator failed for ([5.32.107.98]) [5.32.107.98]:58615: 535 Incorrect authentication data (set_id=sales)5.32.107.98290557c?  -W% ossec13001gJEExim Auth failed2025-02-23 21:48:12 dovecot_login authenticator failed for ([5.11.172.131]) [5.11.172.131]:54614: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)5.11.172.131298795  m y n ]65!urg_  -[' ossec13001gExim Auth failed2025-02-24 03:48:54 dovecot_login authenticator failed for ([163.142.186.8]) [163.142.186.8]:44897: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)163.142.186.81814991B^  gU) ossec11307gQMultiple connection attempts from same sourceFeb 24 03:21:10 vm1 pure-ftpd[3819529]: (?@206.168.34.112) [INFO] New connection from 206.168.34.112206.168.34.1126252001)] 3U) ossec11301gKNew FTP connection.Feb 24 03:21:05 vm1 pure-ftpd[3819520]: (?@206.168.34.112) [INFO] New connection from 206.168.34.112206.168.34.1126252001)\ 3U) ossec11301gCNew FTP connection.Feb 24 03:20:56 vm1 pure-ftpd[3819485]: (?@206.168.34.112) [INFO] New connection from 206.168.34.112206.168.34.1126252001%[  3Q' ossec11301gNew FTP connection.Feb 24 03:06:27 vm1 pure-ftpd[3816544]: (?@206.168.34.86) [INFO] New connection from 206.168.34.86206.168.34.866252001(Z  3U) ossec11301gNew FTP connection.Feb 24 02:45:27 vm1 pure-ftpd[3812520]: (?@206.168.34.198) [INFO] New connection from 206.168.34.198206.168.34.1986252001Y  -/% ossec13001gExim Auth failed2025-02-24 02:02:10 dovecot_login authenticator failed for net-2-32-137-250.cust.vodafonedsl.it (net-2-32-137-250.cust.dsl.teletu.it) [2.32.137.250]:48714: 535 Incorrect authentication data (set_id=khandelwal)2.32.137.2503175395}X  - % ossec13001gExim Auth failed2025-02-24 02:01:57 dovecot_login authenticator failed for syn-137-027-032-070.biz.spectrum.com [137.27.32.70]:42408: 535 Incorrect authentication data (set_id=khandelwal@heipowersystem.com)137.27.32.706252001EW  =+ ossec13008gxMail Reciepient rejected2025-02-24 01:52:15 H=(mail.thepsindustries.com) [165.154.228.156]:63377 F= rejected RCPT : Rejected relay attempt: '165.154.228.156' From: 'cowkewdwwg@thepsindustries.com' To: 'valxxx@mailsire.com'165.154.228.1561643084ZV  -C' ossec13001gJExim Auth failed2025-02-24 01:51:28 dovecot_login authenticator failed for ([91.72.171.210]) [91.72.171.210]:41556: 535 Incorrect authentication data (set_id=kulshreshtha)91.72.171.210290557 U  -)% ossec13001g8Exim Auth failed2025-02-24 01:51:11 dovecot_login authenticator failed for 128.16.3.213.static.wline.lns.sme.cust.swisscom.ch [213.3.16.128]:56103: 535 Incorrect authentication data (set_id=kulshreshtha@heipowersystem.com)213.3.16.1282658434,T  =S) ossec13008gIMail Reciepient rejected2025-02-24 01:34:23 H=(mail.msnews24.in) [165.154.213.22]:65472 F= rejected RCPT : Rejected relay attempt: '165.154.213.22' From: 'ucjezopbheq@msnews24.in' To: 'valxxx@mailsire.com'165.154.213.223469034WS  -9) ossec13001g~Exim Auth failed2025-02-24 01:32:30 dovecot_login authenticator failed for ([117.158.243.50]) [117.158.243.50]:59596: 535 Incorrect authentication data (set_id=sales)117.158.243.501814991pR  -m' ossec13001g~Exim Auth failed2025-02-24 01:32:10 dovecot_login authenticator failed for 83.106.54.198.in-addr.arpa [198.54.106.83]:60835: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)198.54.106.836252001)Q  =M) ossec13008gyMail Reciepient rejected2025-02-24 01:10:06 H=(mail.technobases.in) [165.154.210.93]:60290 F= rejected RCPT : Rejected relay attempt: '165.154.210.93' From: 'xmbmp@technobases.in' To: 'valxxx@mailsire.com'165.154.210.931694008bP  =A' ossec13008gwMail Reciepient rejected2025-02-24 01:02:20 H=(mail.shivelectricaltransformers.com) [165.154.227.2]:51897 F= rejected RCPT : Rejected relay attempt: '165.154.227.2' From: 'awyqyerbmjp@shivelectricaltransformers.com' To: 'valxxx@mailsire.com'165.154.227.21668284 |(K  &6Kl|lp  -c) ossec13001g?Exim Auth failed2025-02-24 08:02:30 dovecot_login authenticator failed for (heipowersystem.com) [60.167.170.146]:41056: 535 Incorrect authentication data (set_id=admin@heipowersystem.com)60.167.170.1461814991[o  -A) ossec13001g%Exim Auth failed2025-02-24 08:02:05 dovecot_login authenticator failed for (heipowersystem.com) [60.167.170.146]:39034: 535 Incorrect authentication data (set_id=nologin)60.167.170.1461814991gn  -[' ossec13001gExim Auth failed2025-02-24 07:57:09 dovecot_plain authenticator failed for ([45.117.10.134]) [45.117.10.134]:49766: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)45.117.10.1341814991lm  -e' ossec13001gQExim Auth failed2025-02-24 07:54:16 dovecot_login authenticator failed for (heipowersystem.com) [111.207.12.99]:55818: 535 Incorrect authentication data (set_id=service@heipowersystem.com)111.207.12.991814991`l  -O% ossec13001gExim Auth failed2025-02-24 07:53:13 dovecot_plain authenticator failed for ([74.95.13.185]) [74.95.13.185]:38209: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)74.95.13.1856252001Yk  -?' ossec13001g9Exim Auth failed2025-02-24 07:53:51 dovecot_login authenticator failed for (heipowersystem.com) [111.207.12.99]:52556: 535 Incorrect authentication data (set_id=nologin)111.207.12.991814991yj  -}) ossec13001gExim Auth failed2025-02-24 07:53:01 dovecot_plain authenticator failed for ([119.206.34.142]) [119.206.34.142]:39264: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)119.206.34.1421835841ni  -g) ossec13001gJExim Auth failed2025-02-24 07:32:49 dovecot_login authenticator failed for (m121-202-197-40.smartone.com) [121.202.197.40]:42217: 535 Incorrect authentication data (set_id=vikas.khandelwal)121.202.197.401819730th  -u) ossec13001g=Exim Auth failed2025-02-24 07:32:37 dovecot_login authenticator failed for ([81.181.129.233]) [81.181.129.233]:60659: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)81.181.129.233798549.g  =W) ossec13008gMail Reciepient rejected2025-02-24 07:22:09 H=(mail.spexscart.com) [165.154.233.84]:59991 F= rejected RCPT : Rejected relay attempt: '165.154.233.84' From: 'rflmnnsus@spexscart.com' To: 'valxxx@mailsire.com'165.154.233.841694008Wf  -9) ossec13001g!Exim Auth failed2025-02-24 05:36:56 dovecot_login authenticator failed for ([118.36.234.156]) [118.36.234.156]:51886: 535 Incorrect authentication data (set_id=vikas)118.36.234.1561835841me  -c+ ossec13001gExim Auth failed2025-02-24 05:36:44 dovecot_login authenticator failed for ([175.203.245.102]) [175.203.245.102]:52028: 535 Incorrect authentication data (set_id=vikas@heipowersystem.com)175.203.245.1021835841ed  -U) ossec13001gExim Auth failed2025-02-24 05:26:22 dovecot_login authenticator failed for (m121-202-203-93.smartone.com) [121.202.203.93]:30002: 535 Incorrect authentication data (set_id=shubham)121.202.203.931819730fc  -[% ossec13001gExim Auth failed2025-02-24 05:25:56 dovecot_login authenticator failed for ([211.93.6.230]) [211.93.6.230]:37684: 535 Incorrect authentication data (set_id=shubham@heipowersystem.com)211.93.6.2301814991(b  3U) ossec11301gNew FTP connection.Feb 24 05:13:30 vm1 pure-ftpd[3842048]: (?@47.254.215.105) [INFO] New connection from 47.254.215.10547.254.215.1051733045Ya -?% ossec13001gExim Auth failed2025-02-24 04:19:29 dovecot_login authenticator failed for (fablixsolutions.com) [119.96.131.8]:36376: 535 Incorrect authentication data (set_id=nologin)119.96.131.81814991T`  -5' ossec13001gExim Auth failed2025-02-24 03:49:30 dovecot_login authenticator failed for ([59.94.179.175]) [59.94.179.138]:54280: 535 Incorrect authentication data (set_id=sales)59.94.179.1381269750  0 ? p>4SVj  -_) ossec13001gExim Auth failed2025-02-24 12:12:39 dovecot_login authenticator failed for ([121.189.226.81]) [121.189.226.81]:39306: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)121.189.226.811835841(  3U) ossec11301gNew FTP connection.Feb 24 12:09:22 vm1 pure-ftpd[3920754]: (?@66.240.223.202) [INFO] New connection from 66.240.223.20266.240.223.2026252001y~  -}) ossec13001gExim Auth failed2025-02-24 12:07:14 dovecot_login authenticator failed for ([220.178.246.43]) [220.178.246.43]:37982: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)220.178.246.431814991]}  -K# ossec13001gExim Auth failed2025-02-24 11:47:35 dovecot_login authenticator failed for (hebei.22.121.in-addr.arpa) [121.22.99.2]:57720: 535 Incorrect authentication data (set_id=services)121.22.99.21814991g|  -]% ossec13001gExim Auth failed2025-02-24 11:47:02 dovecot_login authenticator failed for ([113.59.52.60]) [113.59.52.60]:39093: 535 Incorrect authentication data (set_id=services@heipowersystem.com)113.59.52.601814991{  W% ossec9708g Dovecot Aborted Login with empty userFeb 24 11:25:36 vm1 dovecot[2934170]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=203.55.131.3, lip=103.74.54.108, TLS, session=203.55.131.36252001.z U?' ossec11001gGDeferred login on the cpanel service[2025-02-24 10:57:34 +0530] info [webmaild] 223.225.57.41 - kps@amplifypowerglobal.com "POST /cpsess5902058057/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect223.225.57.4112697501y  =[+ ossec13008gMail Reciepient rejected2025-02-24 10:30:42 H=(mail.rokamauka.com) [165.154.226.135]:65222 F= rejected RCPT : Rejected relay attempt: '165.154.226.135' From: 'shlublrox@rokamauka.com' To: 'valxxx@mailsire.com'165.154.226.1351668284{x  -) ossec13001gExim Auth failed2025-02-24 10:22:47 dovecot_login authenticator failed for vps-f5bece10.vps.ovh.net [135.125.207.50]:52588: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)135.125.207.503017382kw  -_+ ossec13001g%Exim Auth failed2025-02-24 10:14:19 dovecot_plain authenticator failed for 158.160.200.177.netflexisp.com.br [177.200.160.158]:21207: 535 Incorrect authentication data (set_id=services)177.200.160.1583469034(v  3U) ossec11301gNew FTP connection.Feb 24 10:14:07 vm1 pure-ftpd[3899046]: (?@198.235.24.218) [INFO] New connection from 198.235.24.218198.235.24.2186252001mu  -e) ossec13001gExim Auth failed2025-02-24 10:14:02 dovecot_plain authenticator failed for ([91.244.113.178]) [91.244.113.178]:33253: 535 Incorrect authentication data (set_id=services@heipowersystem.com)91.244.113.1782017370(t  3U) ossec11301gNew FTP connection.Feb 24 09:55:07 vm1 pure-ftpd[3895214]: (?@185.224.128.97) [INFO] New connection from 185.224.128.97185.224.128.972750405cs  -U% ossec13001g#Exim Auth failed2025-02-24 09:06:02 dovecot_login authenticator failed for 111-70-32-53.emome-ip.hinet.net [111.70.32.53]:54283: 535 Incorrect authentication data (set_id=services)111.70.32.531668284pr  -i+ ossec13001gExim Auth failed2025-02-24 09:05:27 dovecot_login authenticator failed for ([112.172.126.247]) [112.172.126.247]:35410: 535 Incorrect authentication data (set_id=services@heipowersystem.com)112.172.126.2471835841Eq  =) ossec13008gMail Reciepient rejected2025-02-24 08:18:01 H=(mail.vandanabalbharti.com) [165.154.226.38]:60373 F= rejected RCPT : Rejected relay attempt: '165.154.226.38' From: 'abwkrsapno@vandanabalbharti.com' To: 'valxxx@mailsire.com'165.154.226.381668284 , ?HBOi  3I# ossec11301gXNew FTP connection.Feb 24 17:02:22 vm1 pure-ftpd[3975599]: (?@13.83.41.58) [INFO] New connection from 13.83.41.5813.83.41.586252001b  -O) ossec13001gOlExim Auth failed2025-02-24 16:22:28 dovecot_login authenticator failed for ([105.73.197.230]) [105.73.197.230]:51949: 535 Incorrect authentication data (set_id=vikas.khandelwal)105.73.197.2302542007o  -m% ossec13001gO`Exim Auth failed2025-02-24 16:22:14 dovecot_login authenticator failed for ([8.139.253.26]) [8.139.253.26]:42942: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)8.139.253.261814991) 3U) ossec11301gFNew FTP connection.Feb 24 15:45:15 vm1 pure-ftpd[3961471]: (?@185.180.141.42) [INFO] New connection from 185.180.141.42185.180.141.422264397) 3U) ossec11301gFNew FTP connection.Feb 24 15:45:17 vm1 pure-ftpd[3961473]: (?@185.180.141.44) [INFO] New connection from 185.180.141.44185.180.141.442264397(  3U) ossec11301gFNew FTP connection.Feb 24 15:45:15 vm1 pure-ftpd[3961469]: (?@185.180.141.45) [INFO] New connection from 185.180.141.45185.180.141.452264397) 3U) ossec11301gFNew FTP connection.Feb 24 15:45:24 vm1 pure-ftpd[3961489]: (?@185.180.141.43) [INFO] New connection from 185.180.141.43185.180.141.432264397j  -a' ossec13001gCExim Auth failed2025-02-24 15:33:12 dovecot_login authenticator failed for ([14.192.194.66]) [14.192.194.66]:33105: 535 Incorrect authentication data (set_id=services@heipowersystem.com)14.192.194.661733045(  3U) ossec11301g@tNew FTP connection.Feb 24 15:18:34 vm1 pure-ftpd[3956457]: (?@104.209.35.237) [INFO] New connection from 104.209.35.237104.209.35.2376252001, 3Y+ ossec11301g7$New FTP connection.Feb 24 14:38:51 vm1 pure-ftpd[3949098]: (?@104.234.115.175) [INFO] New connection from 104.234.115.175104.234.115.1756251999(  3U) ossec11301g-New FTP connection.Feb 24 13:58:44 vm1 pure-ftpd[3941476]: (?@147.45.112.183) [INFO] New connection from 147.45.112.183147.45.112.1832134431/  =Y) ossec13008g%Mail Reciepient rejected2025-02-24 13:24:58 H=(mail.technobases.in) [165.154.227.89]:63269 F= rejected RCPT : Rejected relay attempt: '165.154.227.89' From: 'rejtohrz@technobases.in' To: 'valxxx@mailsire.com'165.154.227.891668284_  =9) ossec13008g$Mail Reciepient rejected2025-02-24 13:19:29 H=(mail.shivelectricaltransformers.com) [165.154.226.42]:58371 F= rejected RCPT : Rejected relay attempt: '165.154.226.42' From: 'zyspegrb@shivelectricaltransformers.com' To: 'valxxx@mailsire.com'165.154.226.421668284S  =+ ossec13008gEMail Reciepient rejected2025-02-24 12:39:55 H=(mail.saintsoldiercollege.com) [165.154.213.185]:58755 F= rejected RCPT : Rejected relay attempt: '165.154.213.185' From: 'tebyewfsbow@saintsoldiercollege.com' To: 'valxxx@mailsire.com'165.154.213.1853469034P  =) ossec13008geMail Reciepient rejected2025-02-24 12:31:56 H=(mail.saintsoldiercollege.com) [165.154.227.39]:50476 F= rejected RCPT : Rejected relay attempt: '165.154.227.39' From: 'orsrjekhmec@saintsoldiercollege.com' To: 'valxxx@mailsire.com'165.154.227.391668284b  -Q' ossec13001grExim Auth failed2025-02-24 12:15:04 dovecot_login authenticator failed for (50.250.223.60.adsl-pool.sx.cn) [60.223.250.50]:48554: 535 Incorrect authentication data (set_id=sales)60.223.250.501814991j  -_) ossec13001g^Exim Auth failed2025-02-24 12:14:45 dovecot_login authenticator failed for ([103.163.199.21]) [106.213.81.115]:12108: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)106.213.81.1151269750 9 q f mR|!  -+ ossec13001gfExim Auth failed2025-02-24 21:08:13 dovecot_plain authenticator failed for ([203.123.219.137]) [203.123.219.137]:55076: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)203.123.219.1371835841}  -+ ossec13001gvExim Auth failed2025-02-24 21:08:30 dovecot_plain authenticator failed for 189.115.230.179.dynamic.adsl.gvt.net.br [189.115.230.179]:37078: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)189.115.230.1793469034  3I# ossec11301gNew FTP connection.Feb 24 20:41:17 vm1 pure-ftpd[4018318]: (?@65.49.1.177) [INFO] New connection from 65.49.1.17765.49.1.1776252001J  =) ossec13008g:Mail Reciepient rejected2025-02-24 20:33:21 H=(mail.saintsoldiercollege.com) [165.154.208.70]:59791 F= rejected RCPT : Rejected relay attempt: '165.154.208.70' From: 'fleuueqp@saintsoldiercollege.com' To: 'valxxx@mailsire.com'165.154.208.701668284^  -K% ossec13001g}3Exim Auth failed2025-02-24 19:37:47 dovecot_login authenticator failed for (24-148-98-11.ip.mhcable.com) [24.148.98.11]:50109: 535 Incorrect authentication data (set_id=sales)24.148.98.116252001g  -[' ossec13001g}%Exim Auth failed2025-02-24 19:37:32 dovecot_login authenticator failed for ([61.80.161.172]) [61.80.161.172]:43148: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)61.80.161.17218358414  =a+ ossec13008gyMail Reciepient rejected2025-02-24 19:22:44 H=(mail.nyaystambh.com) [165.154.227.105]:56829 F= rejected RCPT : Rejected relay attempt: '165.154.227.105' From: 'aobyfkrss@nyaystambh.com' To: 'valxxx@mailsire.com'165.154.227.1051668284l  -c) ossec13001gwExim Auth failed2025-02-24 19:11:48 dovecot_login authenticator failed for syn-172-118-123-044.res.spectrum.com [172.118.123.44]:37651: 535 Incorrect authentication data (set_id=services)172.118.123.446252001j  -a' ossec13001gvExim Auth failed2025-02-24 19:11:15 dovecot_login authenticator failed for ([14.48.250.209]) [14.48.250.209]:47300: 535 Incorrect authentication data (set_id=services@heipowersystem.com)14.48.250.2091835841_  -K' ossec13001geExim Auth failed2025-02-24 17:54:49 dovecot_plain authenticator failed for ([171.244.63.34]) [171.244.63.34]:14323: 535 Incorrect authentication data (set_id=vikas.khandelwal)171.244.63.341562822  -) ossec13001gdExim Auth failed2025-02-24 17:54:11 dovecot_plain authenticator failed for mobile-166-201-208-67.mycingular.net [166.201.208.67]:45264: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)166.201.208.676252001  W' ossec9708gdIDovecot Aborted Login with empty userFeb 24 17:51:27 vm1 dovecot[2934170]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=87.236.176.97, lip=103.74.54.108, TLS, session=87.236.176.972635167v  -w) ossec13001g^Exim Auth failed2025-02-24 17:28:45 dovecot_login authenticator failed for (m121-202-197-86.smartone.com) [121.202.197.86]:47418: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)121.202.197.861819730)  EK% ossec5715g^SSHD authentication success.Feb 24 17:27:38 vm1 sshd[3981108]: Accepted password for root from 103.190.54.7 port 53174 ssh2103.190.54.71269750Z  -=+ ossec13001g\ Exim Auth failed2025-02-24 17:16:21 dovecot_login authenticator failed for ([210.204.110.224]) [210.204.110.224]:36555: 535 Incorrect authentication data (set_id=sales)210.204.110.2241835841e  -[' ossec13001g[Exim Auth failed2025-02-24 17:15:57 dovecot_login authenticator failed for ([65.20.205.228]) [65.20.205.228]:58361: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)65.20.205.22899237 |> C P S&I97OZl|l3  -a+ ossec13001gxExim Auth failed2025-02-25 00:33:18 dovecot_login authenticator failed for (103.163.200.110.dynamic-mytachyon.in) [103.163.200.110]:6046: 535 Incorrect authentication data (set_id=sales)103.163.200.1101269750j2  -_) ossec13001gfExim Auth failed2025-02-25 00:33:01 dovecot_login authenticator failed for ([125.136.163.86]) [125.136.163.86]:60216: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)125.136.163.861835841:1  Ak) ossec11302gFTP Authentication failed.Feb 25 00:09:51 vm1 pure-ftpd[4062553]: (?@152.32.202.244) [WARNING] Authentication failed for user [anonymous]152.32.202.2441861060)0 3U) ossec11301gNew FTP connection.Feb 25 00:09:27 vm1 pure-ftpd[4062516]: (?@152.32.202.244) [INFO] New connection from 152.32.202.244152.32.202.2441861060/  ?1 ossec1008g&Process exiting (killed).Feb 25 00:06:21 vm1 spamd[3781003]: spamd: server killed by SIGTERM, shutting downd.  -Q+ ossec13001gExim Auth failed2025-02-24 23:40:32 dovecot_login authenticator failed for ([171.244.142.135]) [171.244.142.135]:9588: 535 Incorrect authentication data (set_id=vikas.khandelwal)171.244.142.1351562822~-  - ) ossec13001g Exim Auth failed2025-02-24 23:40:16 dovecot_login authenticator failed for 212-72-203-252.ip.btc-net.bg [212.72.203.252]:40994: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)212.72.203.252732800 ,  -%' ossec13001gExim Auth failed2025-02-24 23:39:58 dovecot_login authenticator failed for pool-99-251-252-98.cpe.net.cable.rogers.com [99.251.252.98]:41926: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)99.251.252.986251999Y+  -?) ossec13001gExim Auth failed2025-02-24 23:31:13 dovecot_plain authenticator failed for ([178.218.193.90]) [178.218.193.90]:38517: 535 Incorrect authentication data (set_id=services)178.218.193.90798544)*  =M) ossec13008gMail Reciepient rejected2025-02-24 23:31:05 H=(mail.technobases.in) [165.154.210.93]:53935 F= rejected RCPT : Rejected relay attempt: '165.154.210.93' From: 'dmfvf@technobases.in' To: 'valxxx@mailsire.com'165.154.210.931694008y)  -' ossec13001gExim Auth failed2025-02-24 23:30:59 dovecot_plain authenticator failed for 83-233-30-104.cust.bredband2.com [83.233.30.104]:44646: 535 Incorrect authentication data (set_id=services@heipowersystem.com)83.233.30.1042661886%(  3Q' ossec11301glNew FTP connection.Feb 24 23:20:34 vm1 pure-ftpd[4048643]: (?@198.235.24.49) [INFO] New connection from 198.235.24.49198.235.24.496252001F'  =) ossec13008gMail Reciepient rejected2025-02-24 22:40:55 H=(mail.s2seducationtrust.com) [165.154.227.89]:49833 F= rejected RCPT : Rejected relay attempt: '165.154.227.89' From: 'ixgshocry@s2seducationtrust.com' To: 'valxxx@mailsire.com'165.154.227.891668284"&  3M% ossec11301gNew FTP connection.Feb 24 22:38:55 vm1 pure-ftpd[4040742]: (?@64.62.197.78) [INFO] New connection from 64.62.197.7864.62.197.786252001+%  3Y+ ossec11301g New FTP connection.Feb 24 22:02:09 vm1 pure-ftpd[4033611]: (?@162.142.125.201) [INFO] New connection from 162.142.125.201162.142.125.2016252001"$  3M% ossec11301gNew FTP connection.Feb 24 22:01:27 vm1 pure-ftpd[4033482]: (?@139.162.77.6) [INFO] New connection from 139.162.77.6139.162.77.61861060W#  -9) ossec13001gZExim Auth failed2025-02-24 21:12:18 dovecot_plain authenticator failed for ([178.163.27.129]) [178.163.27.129]:52910: 535 Incorrect authentication data (set_id=sales)178.163.27.1292017370c"  -W% ossec13001gLExim Auth failed2025-02-24 21:12:03 dovecot_plain authenticator failed for ([197.87.10.83]) [197.87.10.83]:40266: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)197.87.10.83953987 A    B 2AmD  -e) ossec13001gExim Auth failed2025-02-25 02:25:30 dovecot_login authenticator failed for ([49.124.152.175]) [49.124.152.175]:56572: 535 Incorrect authentication data (set_id=services@heipowersystem.com)49.124.152.1751733045aC  -M) ossec13001g܂Exim Auth failed2025-02-25 02:24:25 dovecot_login authenticator failed for ([220.178.246.43]) [220.178.246.43]:42631: 535 Incorrect authentication data (set_id=vikaskhandelwal)220.178.246.431814991wB  -w+ ossec13001gtExim Auth failed2025-02-25 02:24:12 dovecot_login authenticator failed for ([222.185.255.229]) [222.185.255.227]:38676: 535 Incorrect authentication data (set_id=vikaskhandelwal@heipowersystem.com)222.185.255.2271814991bA  -Q' ossec13001gExim Auth failed2025-02-25 02:09:18 dovecot_login authenticator failed for ([181.197.38.12]) [181.197.38.12]:35432: 535 Incorrect authentication data (set_id=shubhamkulshreshtha)181.197.38.123703430x@  -{) ossec13001gExim Auth failed2025-02-25 02:08:49 dovecot_login authenticator failed for ([202.117.92.118]) [202.117.92.118]:58196: 535 Incorrect authentication data (set_id=shubhamkulshreshtha@heipowersystem.com)202.117.92.1181814991p?  -i+ ossec13001g؏Exim Auth failed2025-02-25 02:07:34 dovecot_login authenticator failed for ([103.152.234.134]) [103.152.234.134]:59476: 535 Incorrect authentication data (set_id=services@heipowersystem.com)103.152.234.1341643084W>  -9) ossec13001g׭Exim Auth failed2025-02-25 02:03:48 dovecot_login authenticator failed for ([79.170.189.164]) [79.170.189.164]:53535: 535 Incorrect authentication data (set_id=sales)79.170.189.1641220409c=  -Q) ossec13001gשExim Auth failed2025-02-25 02:03:44 dovecot_login authenticator failed for 122.103.187.50.ap.gmobb-fix.jp [122.103.187.50]:50763: 535 Incorrect authentication data (set_id=sales)122.103.187.501861060j<  -_) ossec13001gףExim Auth failed2025-02-25 02:03:37 dovecot_login authenticator failed for ([103.248.40.194]) [103.248.40.194]:60560: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)103.248.40.1941831722v;  -w) ossec13001gׇExim Auth failed2025-02-25 02:03:10 dovecot_login authenticator failed for (m121-202-154-40.smartone.com) [121.202.154.40]:52723: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)121.202.154.401819730,: 3Y+ ossec11301g@New FTP connection.Feb 25 01:49:10 vm1 pure-ftpd[4083838]: (?@154.212.141.156) [INFO] New connection from 154.212.141.156154.212.141.1561819730S9  -5' ossec13001gmExim Auth failed2025-02-25 00:50:12 dovecot_plain authenticator failed for ([78.142.41.167]) [78.142.41.167]:48080: 535 Incorrect authentication data (set_id=sales)78.142.41.1677328008  -' ossec13001gUExim Auth failed2025-02-25 00:49:48 dovecot_plain authenticator failed for (ip-107-12-61-200.static.silicanetworks.com) [200.61.12.107]:53126: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)200.61.12.1073865483c7  -S' ossec13001gOExim Auth failed2025-02-25 00:49:41 dovecot_login authenticator failed for ([186.177.88.62]) [186.177.88.62]:39924: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)186.177.88.623624060y6  -}) ossec13001g9Exim Auth failed2025-02-25 00:49:19 dovecot_login authenticator failed for ([167.71.192.183]) [167.71.192.183]:43528: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)167.71.192.1831880251y5  -}) ossec13001gĆExim Auth failed2025-02-25 00:42:05 dovecot_login authenticator failed for (nsg-static-218.129.72.182.airtel.in) [182.72.129.218]:50841: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)182.72.129.2181269750|4  -+ ossec13001gvExim Auth failed2025-02-25 00:41:49 dovecot_login authenticator failed for ([219.140.176.170]) [219.140.176.170]:58774: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)219.140.176.1701814991 \  V  <`4;\ rejected RCPT : Rejected relay attempt: '165.154.226.249' From: 'ottqmoquu@s2seducationtrust.com' To: 'valxxx@mailsire.com'165.154.226.2491668284(N  =K) ossec13008gMail Reciepient rejected2025-02-25 04:58:20 H=(mail.msnews24.in) [165.154.210.93]:58761 F= rejected RCPT : Rejected relay attempt: '165.154.210.93' From: 'fxzalbrna@msnews24.in' To: 'valxxx@mailsire.com'165.154.210.931694008XM -9) ossec13001goExim Auth failed2025-02-25 04:32:06 dovecot_login authenticator failed for (nyaystambh.com) [42.193.105.109]:35340: 535 Incorrect authentication data (set_id=nologin)42.193.105.1091814991ZL  -?) ossec13001g|Exim Auth failed2025-02-25 04:19:32 dovecot_plain authenticator failed for ([188.247.49.186]) [188.247.49.186]:54008: 535 Incorrect authentication data (set_id=purchase)188.247.49.1862017370jK  -a' ossec13001glExim Auth failed2025-02-25 04:19:16 dovecot_plain authenticator failed for ([49.207.177.75]) [49.207.177.75]:44720: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)49.207.177.751269750JJ  =) ossec13008g Mail Reciepient rejected2025-02-25 03:47:44 H=(mail.saintsoldiercollege.com) [165.154.227.29]:53113 F= rejected RCPT : Rejected relay attempt: '165.154.227.29' From: 'ajqalqdg@saintsoldiercollege.com' To: 'valxxx@mailsire.com'165.154.227.291668284(I  3U) ossec11301g6New FTP connection.Feb 25 03:31:25 vm1 pure-ftpd[4104063]: (?@147.45.112.188) [INFO] New connection from 147.45.112.188147.45.112.1882134431VH  -9) ossec13001gExim Auth failed2025-02-25 03:30:18 dovecot_login authenticator failed for ([185.167.58.121]) [185.167.58.121]:41070: 535 Incorrect authentication data (set_id=sales)185.167.58.121617790mG  -c+ ossec13001gExim Auth failed2025-02-25 03:30:07 dovecot_login authenticator failed for ([125.143.224.252]) [125.143.224.252]:54751: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)125.143.224.25218358415F  =c+ ossec13008g%Mail Reciepient rejected2025-02-25 03:18:21 H=(mail.spexscart.com) [165.154.226.249]:56750 F= rejected RCPT : Rejected relay attempt: '165.154.226.249' From: 'xgakkfpldot@spexscart.com' To: 'valxxx@mailsire.com'165.154.226.2491668284vE  -w) ossec13001gExim Auth failed2025-02-25 02:25:51 dovecot_login authenticator failed for awork013193.netvigator.com ([123.144.158.213]) [203.198.34.193]:39361: 535 Incorrect authentication data (set_id=services)203.198.34.1931819730 -Y 6 A ^ [-`g  -O% ossec13001g)sExim Auth failed2025-02-25 07:52:42 dovecot_login authenticator failed for ([27.72.103.74]) [27.72.103.74]:55794: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)27.72.103.741562822f  -' ossec13001g)aExim Auth failed2025-02-25 07:52:23 dovecot_login authenticator failed for (216-58-96-177.cpe.distributel.net) [216.58.96.177]:51746: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)216.58.96.1776251999ce  -Q) ossec13001g'`Exim Auth failed2025-02-25 07:43:52 dovecot_login authenticator failed for (m121-202-152-35.smartone.com) [121.202.152.35]:38025: 535 Incorrect authentication data (set_id=sales)121.202.152.351819730gd  -[' ossec13001g'HExim Auth failed2025-02-25 07:43:27 dovecot_login authenticator failed for ([180.109.38.60]) [180.109.38.60]:46197: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)180.109.38.601814991c  3I# ossec11301g&New FTP connection.Feb 25 07:38:27 vm1 pure-ftpd[4153056]: (?@71.6.232.23) [INFO] New connection from 71.6.232.2371.6.232.236252001mb  -g' ossec13001g TExim Auth failed2025-02-25 07:13:48 dovecot_login authenticator failed for 124-11-130-37.static.tfn.net.tw [124.11.130.37]:54415: 535 Incorrect authentication data (set_id=vikas.khandelwal)124.11.130.371668284}a  -) ossec13001g HExim Auth failed2025-02-25 07:13:35 dovecot_login authenticator failed for 220-245-169-21.tpgi.com.au [220.245.169.21]:47844: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)220.245.169.212077456}`  - ' ossec13001g Exim Auth failed2025-02-25 06:59:45 dovecot_plain authenticator failed for host-41-220-129-94.habari.co.tz ([197.250.7.50]) [41.220.129.94]:57354: 535 Incorrect authentication data (set_id=vikas.khandelwal)41.220.129.94149590x_  -y+ ossec13001gExim Auth failed2025-02-25 06:59:16 dovecot_plain authenticator failed for ([218.149.228.170]) [218.149.228.170]:45523: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)218.149.228.1701835841V^  -;% ossec13001g\Exim Auth failed2025-02-25 06:56:50 dovecot_login authenticator failed for ([221.0.78.199]) [221.0.78.199]:15793: 535 Incorrect authentication data (set_id=khandelwal)221.0.78.1991814991]  - ' ossec13001gMExim Auth failed2025-02-25 06:56:36 dovecot_login authenticator failed for syn-050-074-136-134.biz.spectrum.com [50.74.136.134]:50582: 535 Incorrect authentication data (set_id=khandelwal@heipowersystem.com)50.74.136.1346252001_\  -K' ossec13001gExim Auth failed2025-02-25 06:50:56 dovecot_login authenticator failed for ([101.58.144.50]) [101.58.144.50]:51106: 535 Incorrect authentication data (set_id=vikas.khandelwal)101.58.144.503175395q[  -q' ossec13001gExim Auth failed2025-02-25 06:50:45 dovecot_login authenticator failed for ([185.167.56.70]) [185.167.56.70]:42812: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)185.167.56.70617790QZ  I% ossec11331g Stealth FTP brute force attackFeb 25 06:49:53 vm1 pure-ftpd[4143341]: (?@81.70.28.141) [WARNING] Authentication failed for user [administrator@heipowersystem.com]81.70.28.1411814991 1 $  { n a T G : -   w j ] P C 6 )    s f Y L ? 2 %  |obUH;.!xk^QD7*tgZM@3& }pcVI</"yl_RE8+uh[NA4' ~qdWJ=0 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991v 1814991q 1814991p 1814991n 1814991l 1814991i 1814991g 1814991Z 1814991X 1814991R 1814991N 1814991K 1814991F 1814991A 18149917 1814991/ 1814991. 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991| 1814991y 1814991u 1814991i 1814991h 1814991b 1814991a 1814991^ 1814991N 1814991L 1814991J 1814991D 1814991< 1814991; 1814991: 18149919 18149917 18149913 1814991, 1814991) 1814991! 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991y 1814991m 1814991c 1814991` 1814991R 1814991L 1814991A 1814991? 1814991: 18149915 1814991- 1814991) 1814991( 1814991" 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991{ 1814991z 1814991t 1814991s 1814991r 1814991\ 1814991Y 1814991W 1814991K 1814991C 1814991B 18149910 1814991. 1814991' 1814991$ 1814991" 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 | 1814991 { 1814991 u 1814991 l 1814991 j 1814991 i 1814991 h 1814991 e 1814991 ] 1814991 [ 1814991 Z 1814991 V 1814991 R 1814991 Q 1814991 M 1814991 H 1814991 C 1814991 2 1814991 . 1814991 ) 1814991 & 1814991  1814991  1814991 1814991  1814991  1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991   , K L OePw  -1% ossec13001gWlExim Auth failed2025-02-25 11:08:51 dovecot_login authenticator failed for ([94.200.20.66]) [94.200.20.66]:41526: 535 Incorrect authentication data (set_id=vikas)94.200.20.66290557dv  -W% ossec13001gWXExim Auth failed2025-02-25 11:08:31 dovecot_login authenticator failed for ([61.97.17.208]) [61.97.17.208]:38181: 535 Incorrect authentication data (set_id=vikas@heipowersystem.com)61.97.17.2081835841Vu -;# ossec13001gVExim Auth failed2025-02-25 11:05:36 dovecot_login authenticator failed for (heipowersystem.com) [14.18.77.99]:35898: 535 Incorrect authentication data (set_id=nologin)14.18.77.991814991 t  -)% ossec13001gTwExim Auth failed2025-02-25 10:56:14 dovecot_login authenticator failed for net-2-32-137-250.cust.vodafonedsl.it (net-2-32-137-250.cust.dsl.teletu.it) [2.32.137.250]:42969: 535 Incorrect authentication data (set_id=shubham)2.32.137.2503175395zs  -% ossec13001gTYExim Auth failed2025-02-25 10:55:44 dovecot_login authenticator failed for syn-071-041-202-012.biz.spectrum.com [71.41.202.12]:37824: 535 Incorrect authentication data (set_id=shubham@heipowersystem.com)71.41.202.126252001Tr  -5' ossec13001gHExim Auth failed2025-02-25 10:06:34 dovecot_plain authenticator failed for ([217.24.185.98]) [217.24.185.98]:40986: 535 Incorrect authentication data (set_id=sales)217.24.185.982017370sq  -u% ossec13001gHExim Auth failed2025-02-25 10:06:14 dovecot_plain authenticator failed for wsip-70-169-19-52.hr.hr.cox.net [70.169.19.52]:42732: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)70.169.19.526252001Wp  -9) ossec13001gHExim Auth failed2025-02-25 10:03:09 dovecot_login authenticator failed for ([103.49.233.104]) [103.49.233.104]:41803: 535 Incorrect authentication data (set_id=sales)103.49.233.1041269750fo  -W) ossec13001gGExim Auth failed2025-02-25 10:03:00 dovecot_plain authenticator failed for ([130.250.134.35]) [130.250.134.35]:54326: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)130.250.134.356252001yn  -}) ossec13001gGExim Auth failed2025-02-25 10:02:45 dovecot_plain authenticator failed for ([49.124.152.179]) [49.124.152.179]:60110: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)49.124.152.1791733045{m  -) ossec13001gGExim Auth failed2025-02-25 10:03:00 dovecot_login authenticator failed for c-73-134-126-162.hsd1.md.comcast.net [73.134.126.162]:1437: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)73.134.126.1626252001]l  -C+ ossec13001gAExim Auth failed2025-02-25 09:37:08 dovecot_login authenticator failed for ([179.183.114.175]) [179.183.114.175]:48069: 535 Incorrect authentication data (set_id=services)179.183.114.1753469034jk  -a' ossec13001gAExim Auth failed2025-02-25 09:36:51 dovecot_login authenticator failed for ([49.124.149.49]) [49.124.149.49]:42464: 535 Incorrect authentication data (set_id=services@heipowersystem.com)49.124.149.491733045Uj  -7' ossec13001g6&Exim Auth failed2025-02-25 08:46:54 dovecot_login authenticator failed for (hn.kd.ny.adsl) [182.126.66.59]:48914: 535 Incorrect authentication data (set_id=services)182.126.66.591814991ii  -_' ossec13001g6Exim Auth failed2025-02-25 08:46:37 dovecot_login authenticator failed for ([171.244.63.34]) [171.244.63.34]:6756: 535 Incorrect authentication data (set_id=services@heipowersystem.com)171.244.63.341562822h  =3) ossec13008g5,Mail Reciepient rejected2025-02-25 08:42:43 H=(mail.hsnews.in) [165.154.226.19]:56967 F= rejected RCPT : Rejected relay attempt: '165.154.226.19' From: 'atgbol@hsnews.in' To: 'valxxx@mailsire.com'165.154.226.191668284   &  #-:W`lg  -]% ossec13001gExim Auth failed2025-02-26 11:39:11 dovecot_plain authenticator failed for ([1.247.245.61]) [1.247.245.61]:40288: 535 Incorrect authentication data (set_id=services@heipowersystem.com)1.247.245.611835841p  -s! ossec13001gvExim Auth failed2025-02-26 11:36:44 dovecot_plain authenticator failed for syn-074-062-059-002.biz.spectrum.com [74.62.59.2]:41673: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)74.62.59.26252001s  -u% ossec13001gdExim Auth failed2025-02-26 11:36:27 dovecot_plain authenticator failed for ([14.35.218.58]) [14.35.218.58]:54177: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)14.35.218.5818358412  =]+ ossec13008gNMail Reciepient rejected2025-02-26 11:36:04 H=(mail.nyaystambh.com) [165.154.210.114]:59317 F= rejected RCPT : Rejected relay attempt: '165.154.210.114' From: 'pkmmvuom@nyaystambh.com' To: 'valxxx@mailsire.com'165.154.210.1141694008)  3W+ ossec11301g0New FTP connection.Feb 26 11:05:43 vm1 pure-ftpd[260658]: (?@185.247.137.103) [INFO] New connection from 185.247.137.103185.247.137.103298795C  =+ ossec13008goMail Reciepient rejected2025-02-26 11:02:30 H=(mail.s2seducationtrust.com) [165.154.228.195]:49398 F= rejected RCPT : Rejected relay attempt: '165.154.228.195' From: 'pvotse@s2seducationtrust.com' To: 'valxxx@mailsire.com'165.154.228.1951643084(  EI% ossec5715gSSHD authentication success.Feb 26 10:47:08 vm1 sshd[256234]: Accepted password for root from 103.190.54.7 port 61454 ssh2103.190.54.71269750r  -o) ossec13001glExim Auth failed2025-02-25 12:40:08 dovecot_login authenticator failed for (s2seducationtrust.com) [60.167.170.146]:54240: 535 Incorrect authentication data (set_id=admin@s2seducationtrust.com)60.167.170.1461814991^  -G) ossec13001glExim Auth failed2025-02-25 12:39:43 dovecot_login authenticator failed for (s2seducationtrust.com) [60.167.170.146]:51938: 535 Incorrect authentication data (set_id=nologin)60.167.170.1461814991   3I% ossec11301ghNew FTP connection.Feb 25 12:21:55 vm1 pure-ftpd[14825]: (?@103.203.59.5) [INFO] New connection from 103.203.59.5103.203.59.51814991W~  -;' ossec13001ghExim Auth failed2025-02-25 12:19:59 dovecot_plain authenticator failed for ([106.227.87.29]) [106.227.87.29]:43338: 535 Incorrect authentication data (set_id=services)106.227.87.291814991w}  -{' ossec13001gh Exim Auth failed2025-02-25 12:19:47 dovecot_plain authenticator failed for ool-182ff371.dyn.optonline.net [24.47.243.113]:47492: 535 Incorrect authentication data (set_id=services@heipowersystem.com)24.47.243.1136252001#|  3M' ossec11301gh New FTP connection.Feb 25 12:19:43 vm1 pure-ftpd[14371]: (?@4.255.100.154) [INFO] New connection from 4.255.100.1544.255.100.1546252001q{  -q% ossec13001gbExim Auth failed2025-02-25 11:54:26 dovecot_login authenticator failed for vps-79f20bfc.vps.ovh.net (ip193.ip-87-98-249.eu) [51.75.24.107]:39867: 535 Incorrect authentication data (set_id=sales)51.75.24.1073017382wz  -w+ ossec13001gbExim Auth failed2025-02-25 11:54:16 dovecot_login authenticator failed for 206.sub-166-169-118.myvzw.com [166.169.118.206]:12927: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)166.169.118.2066252001cy  -S' ossec13001g`Exim Auth failed2025-02-25 11:49:27 dovecot_login authenticator failed for ([118.218.10.21]) [118.218.10.21]:60797: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)118.218.10.211835841x  - ' ossec13001g`Exim Auth failed2025-02-25 11:49:15 dovecot_login authenticator failed for (82.193.122.91.cl.ipnet.ua) [82.193.122.91]:42949: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)82.193.122.91690791 #~ = ? *~#}  -' ossec13001g>Exim Auth failed2025-02-26 12:48:22 dovecot_login authenticator failed for broadband-77-37-179-158.ip.moscow.rt.ru [77.37.179.158]:60798: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)77.37.179.15820173706  =g) ossec13008gMail Reciepient rejected2025-02-26 12:28:22 H=(mail.gurukuljaipur.com) [165.154.226.19]:56842 F= rejected RCPT : Rejected relay attempt: '165.154.226.19' From: 'lpzgevl@gurukuljaipur.com' To: 'valxxx@mailsire.com'165.154.226.191668284" 3K% ossec11301gNew FTP connection.Feb 26 12:20:05 vm1 pure-ftpd[275553]: (?@182.64.67.59) [INFO] New connection from 182.64.67.59182.64.67.5912697501 CY% ossec11309gFTP Authentication success.Feb 26 12:20:05 vm1 pure-ftpd[275553]: (?@182.64.67.59) [INFO] militry@technobases.in is now logged in182.64.67.591269750(  EI% ossec5715gSSHD authentication success.Feb 26 12:03:54 vm1 sshd[272096]: Accepted password for root from 103.190.54.7 port 61521 ssh2103.190.54.71269750*  3W+ ossec11301gNew FTP connection.Feb 26 11:59:14 vm1 pure-ftpd[271113]: (?@172.169.190.140) [INFO] New connection from 172.169.190.140172.169.190.1406252001_  -K' ossec13001gExim Auth failed2025-02-26 11:55:15 dovecot_login authenticator failed for ([96.94.173.238]) [96.94.173.238]:41486: 535 Incorrect authentication data (set_id=vikas.khandelwal)96.94.173.2386252001U  -7' ossec13001gExim Auth failed2025-02-26 11:55:02 dovecot_plain authenticator failed for ([189.108.224.67]) [191.210.73.33]:39828: 535 Incorrect authentication data (set_id=sales)191.210.73.333469034  -' ossec13001gExim Auth failed2025-02-26 11:54:58 dovecot_login authenticator failed for (160.228-59-41.static-zone.ttcldata.net) [41.59.228.160]:50086: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)41.59.228.160149590g  -[' ossec13001gExim Auth failed2025-02-26 11:54:39 dovecot_plain authenticator failed for ([89.101.36.159]) [89.101.36.159]:58593: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)89.101.36.15929635970  CY% ossec11309gFTP Authentication success.Feb 26 11:46:54 vm1 pure-ftpd[268903]: (?@182.64.67.59) [INFO] militry@technobases.in is now logged in182.64.67.591269750!  3K% ossec11301gNew FTP connection.Feb 26 11:46:54 vm1 pure-ftpd[268903]: (?@182.64.67.59) [INFO] New connection from 182.64.67.59182.64.67.591269750!  3K% ossec11301gNew FTP connection.Feb 26 11:43:48 vm1 pure-ftpd[268325]: (?@182.64.67.59) [INFO] New connection from 182.64.67.59182.64.67.5912697500  CY% ossec11309gFTP Authentication success.Feb 26 11:43:49 vm1 pure-ftpd[268325]: (?@182.64.67.59) [INFO] militry@technobases.in is now logged in182.64.67.5912697500  CY% ossec11309gFTP Authentication success.Feb 26 11:43:43 vm1 pure-ftpd[268224]: (?@182.64.67.59) [INFO] militry@technobases.in is now logged in182.64.67.591269750!  3K% ossec11301gNew FTP connection.Feb 26 11:43:43 vm1 pure-ftpd[268224]: (?@182.64.67.59) [INFO] New connection from 182.64.67.59182.64.67.591269750d  -W% ossec13001g4Exim Auth failed2025-02-26 11:39:54 dovecot_plain authenticator failed for ([59.41.197.10]) [59.41.197.10]:42933: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)59.41.197.101814991!  3K% ossec11301g0New FTP connection.Feb 26 11:39:50 vm1 pure-ftpd[267321]: (?@203.55.131.3) [INFO] New connection from 203.55.131.3203.55.131.36252001Y  -?' ossec13001gExim Auth failed2025-02-26 11:39:30 dovecot_plain authenticator failed for (www.safecleen.com) [58.49.113.138]:18950: 535 Incorrect authentication data (set_id=services)58.49.113.1381814991 F ! ) K V `VF +  -'% ossec13001g[Exim Auth failed2025-02-26 14:44:03 dovecot_login authenticator failed for (88x87x84x104.static-customer.volgograd.ertelecom.ru) [88.87.84.104]:36221: 535 Incorrect authentication data (set_id=services@heipowersystem.com)88.87.84.1042017370M* =) ossec13008g3Mail Reciepient rejected2025-02-26 14:34:50 H=([104.167.223.55]) [104.167.223.55]:62277 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 CV=no F= rejected RCPT : Rejected relay attempt: '104.167.223.55' From: 'support@use.com' To: 'iwantsmtps@hotmail.com'104.167.223.556252001E)  =) ossec13008gMail Reciepient rejected2025-02-26 14:21:11 H=(mail.amplifypowerglobal.com) [165.154.227.39]:55836 F= rejected RCPT : Rejected relay attempt: '165.154.227.39' From: 'acldhms@amplifypowerglobal.com' To: 'valxxx@mailsire.com'165.154.227.391668284Q(  -1% ossec13001gհExim Auth failed2025-02-26 14:19:51 dovecot_plain authenticator failed for ([39.88.252.77]) [39.88.252.77]:60492: 535 Incorrect authentication data (set_id=sales)39.88.252.771814991a'  -S# ossec13001gՠExim Auth failed2025-02-26 14:19:36 dovecot_plain authenticator failed for ([46.44.5.135]) [46.44.5.135]:54952: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)46.44.5.1352017370|&  -) ossec13001gӡExim Auth failed2025-02-26 14:11:05 dovecot_plain authenticator failed for 249.151.48.116.static.netvigator.com [116.48.151.249]:54277: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)116.48.151.2491819730i%  -]) ossec13001gӯExim Auth failed2025-02-26 14:11:18 dovecot_plain authenticator failed for syn-070-122-139-172.res.spectrum.com [70.122.139.172]:33686: 535 Incorrect authentication data (set_id=sales)70.122.139.1726252001m$  -e) ossec13001gqExim Auth failed2025-02-26 13:57:28 dovecot_plain authenticator failed for ([216.194.174.86]) [216.194.174.27]:14976: 535 Incorrect authentication data (set_id=services@heipowersystem.com)216.194.174.276252001T#  -5' ossec13001gExim Auth failed2025-02-26 13:16:07 dovecot_plain authenticator failed for ([59.37.171.161]) [59.37.171.161]:34350: 535 Incorrect authentication data (set_id=sales)59.37.171.1611814991r"  -w# ossec13001gƪExim Auth failed2025-02-26 13:15:46 dovecot_plain authenticator failed for (95.0.252.72.static.ttnet.com.tr) [95.0.252.72]:58276: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)95.0.252.72298795q!  -s% ossec13001gĵExim Auth failed2025-02-26 13:07:25 dovecot_login authenticator failed for (85-206-91-51.static.zebra.lt) [85.206.91.51]:50638: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)85.206.91.51597427Z  -?) ossec13001gvExim Auth failed2025-02-26 13:06:20 dovecot_plain authenticator failed for ([123.209.107.18]) [123.209.107.18]:55732: 535 Incorrect authentication data (set_id=services)123.209.107.182077456t  -u) ossec13001giExim Auth failed2025-02-26 13:06:09 dovecot_plain authenticator failed for ip-188-127-16-197.ennet.pl [188.127.16.197]:60640: 535 Incorrect authentication data (set_id=services@heipowersystem.com)188.127.16.197798544r  -w! ossec13001goExim Auth failed2025-02-26 12:57:43 dovecot_login authenticator failed for lfbn-cle-1-204-185.w2-3.abo.wanadoo.fr [2.3.51.185]:59879: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)2.3.51.1853017382y  -}) ossec13001gYExim Auth failed2025-02-26 12:57:20 dovecot_login authenticator failed for ([31.220.168.116]) [31.220.168.116]:44714: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)31.220.168.1162017370h  -Y+ ossec13001gPExim Auth failed2025-02-26 12:48:39 dovecot_login authenticator failed for 158.160.200.177.netflexisp.com.br [177.200.160.158]:14556: 535 Incorrect authentication data (set_id=sales)177.200.160.1583469034 C"1 C  $ - P%@curCJ<  =) ossec13008g~Mail Reciepient rejected2025-02-26 16:01:25 H=(mail.saintsoldiercollege.com) [165.154.233.80]:63700 F= rejected RCPT : Rejected relay attempt: '165.154.233.80' From: 'mqpjcgsv@saintsoldiercollege.com' To: 'valxxx@mailsire.com'165.154.233.801694008];  -C+ ossec13001gExim Auth failed2025-02-26 15:44:28 dovecot_plain authenticator failed for ([170.238.144.233]) [170.238.144.233]:50754: 535 Incorrect authentication data (set_id=services)170.238.144.2333469034:  - ) ossec13001gsExim Auth failed2025-02-26 15:44:10 dovecot_plain authenticator failed for syn-173-095-123-220.biz.spectrum.com [173.95.123.220]:40854: 535 Incorrect authentication data (set_id=services@heipowersystem.com)173.95.123.2206252001j9  -_) ossec13001gExim Auth failed2025-02-26 15:36:34 dovecot_plain authenticator failed for ([112.111.61.232]) [112.111.61.229]:60448: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)112.111.61.2291814991Y8  U) ossec11001gDeferred login on the cpanel service[2025-02-26 15:20:39 +0530] info [whostmgrd] 106.206.136.73 - root "GET / HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing106.206.136.731269750a7  -S# ossec13001gExim Auth failed2025-02-26 15:12:40 dovecot_plain authenticator failed for ([61.84.4.230]) [61.84.4.230]:47389: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)61.84.4.2301835841W6  -9) ossec13001gExim Auth failed2025-02-26 15:10:34 dovecot_login authenticator failed for ([197.242.170.10]) [197.242.170.10]:65265: 535 Incorrect authentication data (set_id=sales)197.242.170.101036973m5  -c+ ossec13001gExim Auth failed2025-02-26 15:10:15 dovecot_login authenticator failed for ([218.149.228.137]) [218.149.228.137]:60546: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)218.149.228.137183584134  A_' ossec11302gFTP Authentication failed.Feb 26 15:08:02 vm1 pure-ftpd[309098]: (?@212.241.28.32) [WARNING] Authentication failed for user [Admin]212.241.28.321527747$3  3O' ossec11301gNew FTP connection.Feb 26 15:07:56 vm1 pure-ftpd[309098]: (?@212.241.28.32) [INFO] New connection from 212.241.28.32212.241.28.321527747Y2  -=) ossec13001g߅Exim Auth failed2025-02-26 15:01:48 dovecot_plain authenticator failed for works.ssc-gr.info [160.251.121.70]:42256: 535 Incorrect authentication data (set_id=services)160.251.121.701861060s1  -s' ossec13001gwExim Auth failed2025-02-26 15:01:33 dovecot_plain authenticator failed for (49.207.177.75.actcorp.in) [49.207.177.75]:36802: 535 Incorrect authentication data (set_id=services@heipowersystem.com)49.207.177.751269750j0  -_) ossec13001gBExim Auth failed2025-02-26 14:56:25 dovecot_plain authenticator failed for ([111.53.185.163]) [111.53.185.163]:35790: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)111.53.185.1631814991-/  =S+ ossec13008g`Mail Reciepient rejected2025-02-26 14:48:22 H=(mail.rokamauka.com) [165.154.208.227]:63783 F= rejected RCPT : Rejected relay attempt: '165.154.208.227' From: 'sgiikrf@rokamauka.com' To: 'valxxx@mailsire.com'165.154.208.2271668284j.  -a' ossec13001gExim Auth failed2025-02-26 14:46:44 dovecot_plain authenticator failed for syn-076-176-206-019.res.spectrum.com [76.176.206.19]:51159: 535 Incorrect authentication data (set_id=services)76.176.206.196252001m-  -e) ossec13001gExim Auth failed2025-02-26 14:46:12 dovecot_plain authenticator failed for ([111.172.120.32]) [111.172.120.32]:38856: 535 Incorrect authentication data (set_id=services@heipowersystem.com)111.172.120.321814991Z,  -?) ossec13001gsExim Auth failed2025-02-26 14:44:26 dovecot_login authenticator failed for ([78.156.228.219]) [78.156.228.219]:39732: 535 Incorrect authentication data (set_id=services)78.156.228.2192017370   * < atL  -u) ossec13001gExim Auth failed2025-02-26 19:16:05 dovecot_login authenticator failed for ([89.253.183.242]) [89.253.183.242]:55424: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)89.253.183.242732800dK  -W% ossec13001gExim Auth failed2025-02-26 19:01:20 dovecot_plain authenticator failed for ([27.124.18.21]) [27.124.18.27]:33708: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)27.124.18.271269750pJ  -i+ ossec13001g Exim Auth failed2025-02-26 18:18:31 dovecot_plain authenticator failed for ([190.121.193.126]) [190.121.193.126]:37924: 535 Incorrect authentication data (set_id=services@heipowersystem.com)190.121.193.1263595528I  W) ossec9708gDovecot Aborted Login with empty userFeb 26 17:36:44 vm1 dovecot[312763]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=87.236.176.102, lip=103.74.54.108, TLS, session=87.236.176.1022635167oH  -g+ ossec13001gjExim Auth failed2025-02-26 17:34:58 dovecot_plain authenticator failed for ([171.244.142.135]) [171.244.142.135]:6973: 535 Incorrect authentication data (set_id=services@heipowersystem.com)171.244.142.1351562822G  W) ossec9708gDovecot Aborted Login with empty userFeb 26 17:27:36 vm1 dovecot[312763]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=87.236.176.127, lip=103.74.54.108, TLS, session=87.236.176.1272635167VF  -7) ossec13001goExim Auth failed2025-02-26 17:22:15 dovecot_plain authenticator failed for works.ssc-gr.info [160.251.121.70]:44448: 535 Incorrect authentication data (set_id=sales)160.251.121.701861060jE  -_) ossec13001gYExim Auth failed2025-02-26 17:21:53 dovecot_plain authenticator failed for ([111.93.177.228]) [111.93.177.228]:35808: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)111.93.177.2281269750TD  -7% ossec13001gExim Auth failed2025-02-26 17:11:33 dovecot_plain authenticator failed for ([87.117.32.22]) [87.117.32.22]:51812: 535 Incorrect authentication data (set_id=services)87.117.32.222017370WC  -;' ossec13001gExim Auth failed2025-02-26 17:11:19 dovecot_plain authenticator failed for ([188.43.204.45]) [188.43.204.45]:41086: 535 Incorrect authentication data (set_id=services)188.43.204.452017370jB  -a' ossec13001gExim Auth failed2025-02-26 17:10:44 dovecot_plain authenticator failed for ([103.65.227.12]) [103.65.227.12]:59843: 535 Incorrect authentication data (set_id=services@heipowersystem.com)103.65.227.121210997TA  -5' ossec13001gExim Auth failed2025-02-26 17:02:10 dovecot_plain authenticator failed for ([67.55.189.215]) [67.55.189.215]:51684: 535 Incorrect authentication data (set_id=sales)67.55.189.2156252001f@  -Y' ossec13001gExim Auth failed2025-02-26 17:01:49 dovecot_plain authenticator failed for ([118.39.230.40]) [118.39.230.40]:3739: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)118.39.230.401835841Y?  -=+ ossec13001grExim Auth failed2025-02-26 16:56:41 dovecot_login authenticator failed for ([196.191.212.232]) [196.191.212.232]:48640: 535 Incorrect authentication data (set_id=sales)196.191.212.232337996p>  -q# ossec13001gZExim Auth failed2025-02-26 16:56:16 dovecot_login authenticator failed for 37.151.71.8.dynamic.telecom.kz [37.151.71.8]:44449: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)37.151.71.81522867?=  =w+ ossec13008gMail Reciepient rejected2025-02-26 16:40:36 H=(mail.thepsindustries.com) [165.154.232.235]:51157 F= rejected RCPT : Rejected relay attempt: '165.154.232.235' From: 'epgryzc@thepsindustries.com' To: 'valxxx@mailsire.com'165.154.232.2351605651 ! * @ O c 1@evT]  -5' ossec13001gE9Exim Auth failed2025-02-26 22:15:43 dovecot_plain authenticator failed for ([186.177.88.60]) [186.177.88.60]:37036: 535 Incorrect authentication data (set_id=sales)186.177.88.603624060j\  -_) ossec13001gEExim Auth failed2025-02-26 22:15:02 dovecot_plain authenticator failed for ([158.140.39.128]) [158.140.39.128]:39290: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)158.140.39.1286252001T[  -7% ossec13001gBExim Auth failed2025-02-26 22:05:26 dovecot_login authenticator failed for ([60.172.1.210]) [60.172.1.210]:45976: 535 Incorrect authentication data (set_id=services)60.172.1.2101814991kZ  -e) ossec13001gBExim Auth failed2025-02-26 22:05:08 dovecot_login authenticator failed for ([185.255.47.190]) [185.255.47.190]:41878: 535 Incorrect authentication data (set_id=services@heipowersystem.com)185.255.47.19099237WY  -;' ossec13001gAExim Auth failed2025-02-26 22:01:46 dovecot_plain authenticator failed for ([49.124.153.36]) [49.124.153.36]:51750: 535 Incorrect authentication data (set_id=services)49.124.153.361733045mX  -e) ossec13001gAExim Auth failed2025-02-26 22:01:33 dovecot_plain authenticator failed for ([123.209.67.169]) [123.209.67.169]:43576: 535 Incorrect authentication data (set_id=services@heipowersystem.com)123.209.67.1692077456bW  -O) ossec13001g9hExim Auth failed2025-02-26 21:25:19 dovecot_plain authenticator failed for ([121.190.129.68]) [121.190.129.68]:33722: 535 Incorrect authentication data (set_id=vikas.khandelwal)121.190.129.681835841rV  -q' ossec13001g9TExim Auth failed2025-02-26 21:24:59 dovecot_plain authenticator failed for ([61.185.30.170]) [61.185.30.170]:59396: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)61.185.30.1701814991'U  3S) ossec11301g6WNew FTP connection.Feb 26 21:12:14 vm1 pure-ftpd[380633]: (?@194.165.16.165) [INFO] New connection from 194.165.16.165194.165.16.1652993457'T  3S) ossec11301g5New FTP connection.Feb 26 21:09:12 vm1 pure-ftpd[380140]: (?@147.45.112.188) [INFO] New connection from 147.45.112.188147.45.112.1882134431$S  3O' ossec11301g5New FTP connection.Feb 26 21:06:52 vm1 pure-ftpd[379645]: (?@167.94.138.40) [INFO] New connection from 167.94.138.40167.94.138.406252001@R  ={) ossec13008g-Mail Reciepient rejected2025-02-26 20:34:52 H=(mail.thepsindustries.com) [165.154.210.93]:53635 F= rejected RCPT : Rejected relay attempt: '165.154.210.93' From: 'gghrkcxva@thepsindustries.com' To: 'valxxx@mailsire.com'165.154.210.931694008mQ  -g' ossec13001g)Exim Auth failed2025-02-26 20:19:02 dovecot_login authenticator failed for d54c70cda.static.telenet.be [84.199.12.218]:49994: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)84.199.12.2182802361fP  -[% ossec13001g)Exim Auth failed2025-02-26 20:19:01 dovecot_plain authenticator failed for 78-67-176-43-no2814.tbcn.telia.com [78.67.176.43]:45812: 535 Incorrect authentication data (set_id=services)78.67.176.432661886sO  -u% ossec13001g)Exim Auth failed2025-02-26 20:18:51 dovecot_login authenticator failed for ([39.164.91.67]) [39.164.91.67]:35684: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)39.164.91.671814991mN  -e) ossec13001g)Exim Auth failed2025-02-26 20:18:50 dovecot_plain authenticator failed for ([168.126.90.210]) [168.126.90.210]:46386: 535 Incorrect authentication data (set_id=services@heipowersystem.com)168.126.90.2101835841jM  -_) ossec13001g'Exim Auth failed2025-02-26 20:10:11 dovecot_login authenticator failed for ([87.225.108.138]) [87.225.108.138]:51314: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)87.225.108.1382017370 \); E p f~fBWi\ n  -!% ossec13001gl^Exim Auth failed2025-02-27 01:02:46 dovecot_plain authenticator failed for 206.81.4.146.static.wline.lns.sme.cust.swisscom.ch [146.4.81.206]:40276: 535 Incorrect authentication data (set_id=services@heipowersystem.com)146.4.81.2062658434jm  -_) ossec13001gkdExim Auth failed2025-02-27 00:58:35 dovecot_plain authenticator failed for ([14.194.128.158]) [14.194.128.158]:34142: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)14.194.128.1581269750gl  -[' ossec13001gkTExim Auth failed2025-02-27 00:58:20 dovecot_plain authenticator failed for ([121.166.85.53]) [121.166.85.53]:55388: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)121.166.85.531835841 k  =;) ossec13008ghMail Reciepient rejected2025-02-27 00:48:22 H=(mail.hsnews.in) [165.154.213.78]:57284 F= rejected RCPT : Rejected relay attempt: '165.154.213.78' From: 'jmybyqqc@hsnews.in' To: 'valxxx@mailsire.com'165.154.213.7834690349j  =k+ ossec13008gfMail Reciepient rejected2025-02-27 00:39:12 H=(mail.gurukuljaipur.com) [165.154.226.209]:64045 F= rejected RCPT : Rejected relay attempt: '165.154.226.209' From: 'hbsqxbs@gurukuljaipur.com' To: 'valxxx@mailsire.com'165.154.226.2091668284Wi  -9) ossec13001geQExim Auth failed2025-02-27 00:32:39 dovecot_plain authenticator failed for ([125.136.163.86]) [125.136.163.86]:45442: 535 Incorrect authentication data (set_id=sales)125.136.163.861835841dh  -W% ossec13001ge6Exim Auth failed2025-02-27 00:32:13 dovecot_plain authenticator failed for ([95.79.57.221]) [95.79.57.221]:54868: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)95.79.57.2212017370g  ?/ ossec1008g_Process exiting (killed).Feb 27 00:08:30 vm1 spamd[154050]: spamd: server killed by SIGTERM, shutting downef  -Y% ossec13001g[Exim Auth failed2025-02-26 23:52:45 dovecot_plain authenticator failed for syn-097-092-033-136.res.spectrum.com [97.92.33.136]:60456: 535 Incorrect authentication data (set_id=sales)97.92.33.1366252001de  -W% ossec13001g[Exim Auth failed2025-02-26 23:52:21 dovecot_plain authenticator failed for ([58.18.90.114]) [58.18.90.114]:57989: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)58.18.90.1141814991gd  -Y) ossec13001gZdExim Auth failed2025-02-26 23:46:03 dovecot_login authenticator failed for (rokamauka.com) [42.193.105.109]:33030: 535 Incorrect authentication data (set_id=postmaster@rokamauka.com)42.193.105.1091814991Vc  -7) ossec13001gZLExim Auth failed2025-02-26 23:45:40 dovecot_login authenticator failed for (rokamauka.com) [42.193.105.109]:35288: 535 Incorrect authentication data (set_id=nologin)42.193.105.1091814991gb  -]% ossec13001gUExim Auth failed2025-02-26 23:26:52 dovecot_plain authenticator failed for ([59.41.197.10]) [59.41.197.10]:55771: 535 Incorrect authentication data (set_id=services@heipowersystem.com)59.41.197.101814991Qa  -1% ossec13001gSExim Auth failed2025-02-26 23:17:30 dovecot_login authenticator failed for ([50.99.36.130]) [50.99.36.130]:38334: 535 Incorrect authentication data (set_id=sales)50.99.36.1306251999r`  -s% ossec13001gSExim Auth failed2025-02-26 23:16:52 dovecot_login authenticator failed for ool-4a5ad51c.dyn.optonline.net [74.90.213.28]:45950: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)74.90.213.286252001j_  -_) ossec13001gHExim Auth failed2025-02-26 22:31:33 dovecot_login authenticator failed for ([186.96.101.123]) [186.96.101.123]:43048: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)186.96.101.1233686110S^  -5' ossec13001gHExim Auth failed2025-02-26 22:31:43 dovecot_login authenticator failed for ([185.167.56.70]) [185.167.56.70]:43904: 535 Incorrect authentication data (set_id=sales)185.167.56.70617790 *\~tj`VLB8.$zpf\H>4*   v l b X N D : 0 &    ~ t j ` V L B 8 . $    z p f \ R H > 4 *  vlbXND:0&|rh^TJ@6,"xndZPF<2( ~tj`VLB8.$zpf\ | r h ^ T J @ 6 , "    x n d Z P F < 2 (   RRH>4*  vlbXND:0& g a g: ` g/ _ g% ^ g ] g \ g [ g Z g Y g X g W g V gV U gT T gF S gF R g Q g P gA O gT N g6 M g: L gk K gU J gQ I gT H g& G g߹ F g E gy D gW C gC B g۶ A gۤ @ gۤ ? g@ > g = g; < g ; g= : gz 9 gx 8 g 7 g5 6 g 5 g 4 g 3 g 2 g 1 g3 0 g) / gƙ . gW - g/ , gv + g * g ) gQ ( g ' g5 & g % g9 $ g # g6 " g ! g g  g  g  g  g  gO  g  g  g  gb  gT  g  g  gy  g  g  g  gW  g) g] gK g g g8  g(  g  g  g  g  gk  g_  g gV g\ g1 g' g gd gV g g gO gz gxE gv gu gu gln glT gl^ gkd gkT gh gf geQ ge6 g_ g[ g[ gZd gZL gU gS gS gH gH gE9 gE gB gB gA gA g9h g9T g6W g5 g5 g- g) g) g) g) g' g g g g gj g go gY g g g g g gr gZ g g~ g gs g g g g gX gB g g g g g gn gL g g g  g ~ g } g | g { g z g y g x g w g v g u g t g s g r g q g p g o g n g m g? l g5 k g j g i g h g g gk f g d g e gh c g b g g g g g g߅ gw gB g` g g gs g[ g3 g gհ gՠ gӯ gӡ gq g gƪ gĵ gv gi go gY gP g> g g g g g g g g g g g g g g^ g g g4 g0 g g gv gd gN g0 go g gl gl gh  gh ~ gh } gh | gb { gb z g` y g` x gWl w gWX v gV u gTw t gTY s gH r gH q gH p gG o gG m gG n gA l gA k g6& j g6 i g5, h g)s g g)a f g'` e g'H d  , N Y  PZj{g}  -[' ossec13001g1Exim Auth failed2025-02-27 03:01:29 dovecot_plain authenticator failed for ([220.74.63.183]) [220.74.63.183]:44456: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)220.74.63.1831835841}|  -' ossec13001g'Exim Auth failed2025-02-27 02:48:29 dovecot_plain authenticator failed for syn-131-148-000-202.biz.spectrum.com [131.148.0.202]:61608: 535 Incorrect authentication data (set_id=services@heipowersystem.com)131.148.0.2026252001v{  -{% ossec13001gExim Auth failed2025-02-27 02:47:19 dovecot_plain authenticator failed for 111-70-12-84.emome-ip.hinet.net [111.70.12.84]:49335: 535 Incorrect authentication data (set_id=services@heipowersystem.com)111.70.12.841668284fz  -W) ossec13001gdExim Auth failed2025-02-27 02:45:15 dovecot_plain authenticator failed for (ws60-209.199.103.rcil.gov.in) [103.199.209.60]:55214: 535 Incorrect authentication data (set_id=services)103.199.209.601269750ky  -e) ossec13001gVExim Auth failed2025-02-27 02:45:01 dovecot_plain authenticator failed for ([213.32.253.235]) [213.32.253.235]:33696: 535 Incorrect authentication data (set_id=services@heipowersystem.com)213.32.253.23599237lx  -c) ossec13001gExim Auth failed2025-02-27 02:34:52 dovecot_login authenticator failed for (124-170-38-136.tpgi.com.au) [124.170.38.136]:60820: 535 Incorrect authentication data (set_id=vikas.khandelwal)124.170.38.1362077456rw  -q' ossec13001gExim Auth failed2025-02-27 02:34:34 dovecot_login authenticator failed for ([149.54.15.126]) [149.54.15.126]:53255: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)149.54.15.1261149361Ev  =+ ossec13008gOMail Reciepient rejected2025-02-27 02:23:35 H=(mail.thepsindustries.com) [165.154.226.214]:56600 F= rejected RCPT : Rejected relay attempt: '165.154.226.214' From: 'rojhjcihd@thepsindustries.com' To: 'goofile@fastmail.com'165.154.226.2141668284Pu  =) ossec13008gzMail Reciepient rejected2025-02-27 02:04:10 H=(mail.saintsoldiercollege.com) [165.154.226.38]:54590 F= rejected RCPT : Rejected relay attempt: '165.154.226.38' From: 'xorjnkcgbz@saintsoldiercollege.com' To: 'goofile@fastmail.com'165.154.226.381668284t  W) ossec9708gxEDovecot Aborted Login with empty userFeb 27 01:53:33 vm1 dovecot[312763]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 7 secs): user=<>, rip=87.236.176.117, lip=103.74.54.108, TLS, session=<0K3rWBEvd7VX7LB1>87.236.176.1172635167Fs  =+ ossec13008gvMail Reciepient rejected2025-02-27 01:47:11 H=(mail.heipowersystem.com) [165.154.226.150]:50910 F= rejected RCPT : Rejected relay attempt: '165.154.226.150' From: 'bfmkbmvymth@heipowersystem.com' To: 'goofile@fastmail.com'165.154.226.1501668284qr  -o' ossec13001guExim Auth failed2025-02-27 01:42:12 dovecot_login authenticator failed for (fablixsolutions.com) [221.229.216.1]:46296: 535 Incorrect authentication data (set_id=postmaster@fablixsolutions.com)221.229.216.11814991Zq  -A' ossec13001guExim Auth failed2025-02-27 01:41:46 dovecot_login authenticator failed for (fablixsolutions.com) [221.229.216.1]:43442: 535 Incorrect authentication data (set_id=nologin)221.229.216.11814991\p  -C+ ossec13001glnExim Auth failed2025-02-27 01:03:02 dovecot_plain authenticator failed for ([196.191.212.232]) [196.191.212.232]:37334: 535 Incorrect authentication data (set_id=services)196.191.212.232337996po  -i+ ossec13001glTExim Auth failed2025-02-27 01:02:35 dovecot_plain authenticator failed for ([195.239.164.190]) [195.239.164.190]:58177: 535 Incorrect authentication data (set_id=services@heipowersystem.com)195.239.164.1902017370 $   3 8=CX~}g  -[' ossec13001g)Exim Auth failed2025-02-27 04:05:21 dovecot_plain authenticator failed for ([125.20.46.114]) [125.20.46.114]:54194: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)125.20.46.1141269750T  -5' ossec13001g]Exim Auth failed2025-02-27 04:01:56 dovecot_plain authenticator failed for ([211.202.71.21]) [211.202.71.21]:57751: 535 Incorrect authentication data (set_id=sales)211.202.71.211835841g  -[' ossec13001gKExim Auth failed2025-02-27 04:01:39 dovecot_plain authenticator failed for ([58.115.60.116]) [58.115.60.116]:52117: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)58.115.60.1161668284i  -a' ossec13001gExim Auth failed2025-02-27 03:59:27 dovecot_plain authenticator failed for ([188.59.178.43]) [188.59.178.43]:46870: 535 Incorrect authentication data (set_id=services@heipowersystem.com)188.59.178.43298795}  -' ossec13001gExim Auth failed2025-02-27 03:58:49 dovecot_plain authenticator failed for s153-234-30-96.ssvec.az.wi-power.com [96.30.234.153]:50814: 535 Incorrect authentication data (set_id=services@heipowersystem.com)96.30.234.1536252001V  -9) ossec13001g8Exim Auth failed2025-02-27 03:39:58 dovecot_login authenticator failed for ([146.185.10.154]) [146.185.10.154]:56522: 535 Incorrect authentication data (set_id=sales)146.185.10.154660013g  -[' ossec13001g(Exim Auth failed2025-02-27 03:39:43 dovecot_login authenticator failed for ([49.124.151.11]) [49.124.151.11]:43866: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)49.124.151.111733045v  -y' ossec13001gExim Auth failed2025-02-27 03:37:05 dovecot_login authenticator failed for ([103.161.93.51]) [103.161.93.51]:50651: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)103.161.93.511269750w  -w+ ossec13001gExim Auth failed2025-02-27 03:37:18 dovecot_login authenticator failed for d142-179-145-166.abhsia.telus.net [142.179.145.166]:42178: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)142.179.145.1666251999w  -y) ossec13001gExim Auth failed2025-02-27 03:33:48 dovecot_login authenticator failed for (s2seducationtrust.com) [42.193.105.109]:55672: 535 Incorrect authentication data (set_id=postmaster@s2seducationtrust.com)42.193.105.1091814991^  -G) ossec13001gExim Auth failed2025-02-27 03:33:24 dovecot_login authenticator failed for (s2seducationtrust.com) [42.193.105.109]:36102: 535 Incorrect authentication data (set_id=nologin)42.193.105.1091814991i  -]) ossec13001gkExim Auth failed2025-02-27 03:28:02 dovecot_login authenticator failed for syn-172-100-186-071.res.spectrum.com [172.100.186.71]:58524: 535 Incorrect authentication data (set_id=sales)172.100.186.716252001m  -c+ ossec13001g_Exim Auth failed2025-02-27 03:27:50 dovecot_login authenticator failed for ([119.198.191.130]) [119.198.191.130]:49220: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)119.198.191.1301835841-  =S+ ossec13008g Mail Reciepient rejected2025-02-27 03:26:25 H=(mail.msnews24.in) [165.154.208.227]:50760 F= rejected RCPT : Rejected relay attempt: '165.154.208.227' From: 'htzfsusdv@msnews24.in' To: 'goofile@fastmail.com'165.154.208.2271668284j  -a' ossec13001gVExim Auth failed2025-02-27 03:19:10 dovecot_plain authenticator failed for ([123.182.89.19]) [123.182.89.19]:38125: 535 Incorrect authentication data (set_id=services@heipowersystem.com)123.182.89.191814991j~  -_) ossec13001g\Exim Auth failed2025-02-27 03:06:26 dovecot_plain authenticator failed for ([14.194.128.158]) [14.194.128.158]:52730: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)14.194.128.1581269750 0 2 D V b t D_tQ  -3% ossec13001gExim Auth failed2025-02-27 05:49:51 dovecot_login authenticator failed for (mail.bestoil.by) [86.57.254.73]:35549: 535 Incorrect authentication data (set_id=sales)86.57.254.73630336P  -1% ossec13001gExim Auth failed2025-02-27 05:49:40 dovecot_plain authenticator failed for ([5.77.211.193]) [5.77.211.193]:58823: 535 Incorrect authentication data (set_id=sales)5.77.211.193174982g  -[' ossec13001gExim Auth failed2025-02-27 05:49:31 dovecot_login authenticator failed for ([58.234.165.73]) [58.234.165.73]:37244: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)58.234.165.731835841a  -S# ossec13001gExim Auth failed2025-02-27 05:46:24 dovecot_plain authenticator failed for ([101.13.5.37]) [101.13.5.37]:35922: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)101.13.5.371668284S  -3' ossec13001gOExim Auth failed2025-02-27 05:44:06 dovecot_plain authenticator failed for (ctw.webcas.net) [125.69.76.148]:54097: 535 Incorrect authentication data (set_id=sales)125.69.76.1481814991l  -c+ ossec13001g Exim Auth failed2025-02-27 05:42:56 dovecot_plain authenticator failed for ([196.191.212.232]) [196.191.212.232]:40802: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)196.191.212.232337996'  3S) ossec11301gNew FTP connection.Feb 27 05:36:54 vm1 pure-ftpd[478311]: (?@20.150.199.130) [INFO] New connection from 20.150.199.13020.150.199.1306252001m  -e) ossec13001gExim Auth failed2025-02-27 05:28:19 dovecot_plain authenticator failed for ([216.194.174.86]) [216.194.174.27]:60624: 535 Incorrect authentication data (set_id=services@heipowersystem.com)216.194.174.276252001Z  -?) ossec13001gbExim Auth failed2025-02-27 05:23:04 dovecot_login authenticator failed for ([167.142.198.54]) [167.142.198.54]:59685: 535 Incorrect authentication data (set_id=services)167.142.198.546252001k  -c' ossec13001gTExim Auth failed2025-02-27 05:22:51 dovecot_login authenticator failed for ([177.174.89.105]) [177.174.89.99]:55618: 535 Incorrect authentication data (set_id=services@heipowersystem.com)177.174.89.993469034j  -a' ossec13001gExim Auth failed2025-02-27 05:21:08 dovecot_plain authenticator failed for ([46.173.45.180]) [46.173.45.180]:59684: 535 Incorrect authentication data (set_id=services@heipowersystem.com)46.173.45.1802017370p  -i+ ossec13001gExim Auth failed2025-02-27 05:20:39 dovecot_plain authenticator failed for ([163.204.112.147]) [163.204.112.147]:40966: 535 Incorrect authentication data (set_id=services@heipowersystem.com)163.204.112.1471814991j  -a' ossec13001gyExim Auth failed2025-02-27 05:19:13 dovecot_plain authenticator failed for ([112.91.232.86]) [112.91.232.86]:55760: 535 Incorrect authentication data (set_id=services@heipowersystem.com)112.91.232.861814991j  -a' ossec13001g Exim Auth failed2025-02-27 04:43:15 dovecot_plain authenticator failed for ([87.248.243.64]) [87.248.243.64]:56092: 535 Incorrect authentication data (set_id=services@heipowersystem.com)87.248.243.642017370z  -}+ ossec13001gExim Auth failed2025-02-27 04:24:32 dovecot_login authenticator failed for (abts-mum-static-007.14.170.122.airtelbroadband.in) [103.137.112.251]:37948: 535 Incorrect authentication data (set_id=sales)103.137.112.2511269750d  -W% ossec13001gExim Auth failed2025-02-27 04:24:01 dovecot_login authenticator failed for ([102.53.15.17]) [102.53.15.17]:50237: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)102.53.15.172542007d  -W% ossec13001gWExim Auth failed2025-02-27 04:06:06 dovecot_plain authenticator failed for ([92.47.46.174]) [92.47.46.174]:44526: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)92.47.46.1741522867 % 4 [ s ]l].  -C+ ossec13001gƙExim Auth failed2025-02-27 07:27:44 dovecot_plain authenticator failed for ([190.211.250.118]) [190.211.250.122]:51258: 535 Incorrect authentication data (set_id=services)190.211.250.1223895114i-  -]) ossec13001gWExim Auth failed2025-02-27 07:26:37 dovecot_plain authenticator failed for c188-151-25-169.bredband.tele2.se [188.151.25.169]:60788: 535 Incorrect authentication data (set_id=services)188.151.25.1692661886m,  -e) ossec13001g/Exim Auth failed2025-02-27 07:25:58 dovecot_plain authenticator failed for ([122.169.41.223]) [122.169.41.223]:44163: 535 Incorrect authentication data (set_id=services@heipowersystem.com)122.169.41.2231269750++  =O+ ossec13008gvMail Reciepient rejected2025-02-27 07:14:21 H=(mail.rokamauka.com) [165.154.227.155]:60163 F= rejected RCPT : Rejected relay attempt: '165.154.227.155' From: 'cyikt@rokamauka.com' To: 'goofile@fastmail.com'165.154.227.1551668284*  -% ossec13001gExim Auth failed2025-02-27 07:11:23 dovecot_plain authenticator failed for 8.136.233.35.bc.googleusercontent.com ([34.82.26.7]) [35.233.136.8]:5673: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)35.233.136.86252001$)  3O' ossec11301gNew FTP connection.Feb 27 07:02:42 vm1 pure-ftpd[494232]: (?@57.152.78.250) [INFO] New connection from 57.152.78.25057.152.78.2506252001m(  -e) ossec13001gQExim Auth failed2025-02-27 06:52:25 dovecot_plain authenticator failed for ([223.82.241.146]) [223.82.241.146]:55846: 535 Incorrect authentication data (set_id=services@heipowersystem.com)223.82.241.1461814991O'  =+ ossec13008g Mail Reciepient rejected2025-02-27 06:30:14 H=(mail.s2seducationtrust.com) [165.154.213.196]:56188 F= rejected RCPT : Rejected relay attempt: '165.154.213.196' From: 'laxgrvxwcmu@s2seducationtrust.com' To: 'goofile@fastmail.com'165.154.213.1963469034i&  -_) ossec13001g5Exim Auth failed2025-02-27 06:22:04 dovecot_plain authenticator failed for ([196.190.180.18]) [196.190.180.19]:39285: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)196.190.180.19337996j%  -_) ossec13001gExim Auth failed2025-02-27 06:20:22 dovecot_plain authenticator failed for ([112.111.61.229]) [112.111.61.229]:37590: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)112.111.61.2291814991d$  -W% ossec13001g9Exim Auth failed2025-02-27 06:17:52 dovecot_plain authenticator failed for ([135.26.71.15]) [135.26.71.15]:38464: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)135.26.71.156252001d#  -W% ossec13001gExim Auth failed2025-02-27 06:15:06 dovecot_plain authenticator failed for ([121.162.30.3]) [121.162.30.3]:57212: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)121.162.30.31835841U" -5' ossec13001g6Exim Auth failed2025-02-27 06:09:18 dovecot_login authenticator failed for (rokamauka.com) [111.207.12.99]:56390: 535 Incorrect authentication data (set_id=nologin)111.207.12.991814991m!  -e) ossec13001gExim Auth failed2025-02-27 06:03:25 dovecot_plain authenticator failed for ([123.209.119.82]) [123.209.119.82]:37652: 535 Incorrect authentication data (set_id=services@heipowersystem.com)123.209.119.822077456j  -a' ossec13001gExim Auth failed2025-02-27 06:03:09 dovecot_plain authenticator failed for ([38.20.111.164]) [38.20.111.164]:59397: 535 Incorrect authentication data (set_id=services@heipowersystem.com)38.20.111.1646251999i  -a' ossec13001gExim Auth failed2025-02-27 06:03:42 dovecot_plain authenticator failed for ([46.30.161.197]) [46.30.161.197]:56248: 535 Incorrect authentication data (set_id=services@heipowersystem.com)46.30.161.197690791 w & < N  ;Df "1Fhwm?  -e) ossec13001gۤExim Auth failed2025-02-27 08:57:31 dovecot_plain authenticator failed for ([210.99.124.119]) [210.99.124.119]:50316: 535 Incorrect authentication data (set_id=services@heipowersystem.com)210.99.124.1191835841Z>  -?) ossec13001g@Exim Auth failed2025-02-27 08:51:35 dovecot_plain authenticator failed for ([223.82.241.145]) [223.82.241.145]:57592: 535 Incorrect authentication data (set_id=services)223.82.241.1451814991g=  -]% ossec13001gExim Auth failed2025-02-27 08:50:53 dovecot_plain authenticator failed for ([58.33.109.90]) [58.33.109.90]:37241: 535 Incorrect authentication data (set_id=services@heipowersystem.com)58.33.109.901814991m<  -g' ossec13001g;Exim Auth failed2025-02-27 08:38:43 dovecot_plain authenticator failed for broadband-95-84-158-215.ip.moscow.rt.ru [95.84.158.215]:50789: 535 Incorrect authentication data (set_id=services)95.84.158.2152017370g;  -]% ossec13001gExim Auth failed2025-02-27 08:37:48 dovecot_plain authenticator failed for ([183.24.87.10]) [183.24.87.10]:52836: 535 Incorrect authentication data (set_id=services@heipowersystem.com)183.24.87.101814991':  3S) ossec11301g=New FTP connection.Feb 27 08:30:11 vm1 pure-ftpd[510391]: (?@15.235.224.239) [INFO] New connection from 15.235.224.23915.235.224.2391880251*9  3W+ ossec11301gzNew FTP connection.Feb 27 08:18:24 vm1 pure-ftpd[508202]: (?@172.172.245.144) [INFO] New connection from 172.172.245.144172.172.245.1446252001Z8  -=+ ossec13001gxExim Auth failed2025-02-27 08:18:24 dovecot_plain authenticator failed for ([125.139.124.120]) [125.139.124.120]:47180: 535 Incorrect authentication data (set_id=sales)125.139.124.1201835841s7  -s' ossec13001gExim Auth failed2025-02-27 08:15:22 dovecot_plain authenticator failed for 116-240-97-42.dyn.ip.vocus.au [116.240.97.42]:38639: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)116.240.97.422077456T6  -7% ossec13001g5Exim Auth failed2025-02-27 08:08:45 dovecot_plain authenticator failed for ([95.79.57.221]) [95.79.57.221]:55780: 535 Incorrect authentication data (set_id=services)95.79.57.2212017370k5  -c' ossec13001gExim Auth failed2025-02-27 08:07:00 dovecot_plain authenticator failed for ([223.80.109.135]) [27.223.100.90]:38362: 535 Incorrect authentication data (set_id=services@heipowersystem.com)27.223.100.901814991H4  = ) ossec13008gMail Reciepient rejected2025-02-27 08:07:20 H=(mail.saintsoldiercollege.com) [165.154.226.68]:62550 F= rejected RCPT : Rejected relay attempt: '165.154.226.68' From: 'otbhvi@saintsoldiercollege.com' To: 'goofile@fastmail.com'165.154.226.681668284j3  -a' ossec13001gExim Auth failed2025-02-27 07:42:09 dovecot_plain authenticator failed for broadband-46-242-107-60.ip.moscow.rt.ru [46.242.107.60]:57830: 535 Incorrect authentication data (set_id=sales)46.242.107.602017370f2  -W) ossec13001gExim Auth failed2025-02-27 07:41:29 dovecot_plain authenticator failed for c83-254-215-116.bredband.tele2.se [83.254.215.116]:42700: 535 Incorrect authentication data (set_id=sales)83.254.215.1162661886g1  -[' ossec13001gExim Auth failed2025-02-27 07:41:12 dovecot_plain authenticator failed for ([46.29.121.110]) [46.29.121.110]:37814: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)46.29.121.1103017382r0  -o) ossec13001g3Exim Auth failed2025-02-27 07:30:18 dovecot_login authenticator failed for (104.226.75.138.unknown.m1.com.sg) [138.75.226.104]:60505: 535 Incorrect authentication data (set_id=vikas.khandelwal)138.75.226.1041880251u/  -u) ossec13001g)Exim Auth failed2025-02-27 07:30:08 dovecot_login authenticator failed for ([124.112.45.222]) [124.112.45.222]:39857: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)124.112.45.2221814991 ~qdWJ=0# zm`SF9, v i \ O B 5 (     r e X K > 1 $  { n a T G : -   w j ] P C 6 )    s f Y L ? 2 %  |obUH;.!xk^QD7*tgZM@3& }pcVI</"yl_RE8+uh[NA4' ~qdWJ=0 1814991+ 1814991& 1814991! 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991} 1814991| 1814991z 1814991y 1814991w 1814991t 1814991o 1814991m 1814991d 1814991^ 1814991[ 1814991R 1814991P 1814991I 1814991E 1814991& 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991t 1814991r 1814991n 1814991m 1814991l 1814991j 1814991f 1814991d 1814991c 1814991_ 1814991^ 1814991[ 1814991W 1814991R 1814991Q 1814991I 1814991A 1814991@ 1814991: 18149913 1814991) 1814991( 1814991$ 1814991" 1814991! 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991e 1814991d 1814991c 1814991b 1814991a 1814991V 1814991N 1814991L 1814991J 1814991H 1814991D 1814991B 1814991A 18149913 1814991/ 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991x 1814991n 1814991h 1814991_ 1814991[ 1814991S 1814991L 1814991K 1814991G 1814991> 1814991: 18149919 18149916 18149914 18149911 1814991* 1814991( 1814991$ 1814991# 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991z 1814991v 1814991r 1814991l 1814991j 1814991f 1814991d 1814991\ 1814991X 1814991N 1814991> 1814991, 1814991+ 1814991& 1814991$ 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991~ 1814991w 1814991k 1814991W 1814991V 1814991U 1814991R 1814991P 1814991N 1814991C 1814991B 18149918 1814991* 1814991$ 1814991# . = \ PGYlAO  =}) ossec13008gAMail Reciepient rejected2025-02-27 10:12:39 H=(mail.heipowersystem.com) [165.154.226.98]:60960 F= rejected RCPT : Rejected relay attempt: '165.154.226.98' From: 'wntlxnoqzq@heipowersystem.com' To: 'goofile@fastmail.com'165.154.226.981668284sN  -s) ossec13001gTExim Auth failed2025-02-27 09:55:54 dovecot_login authenticator failed for (85.105.241.188.static.ttnet.com.tr) [85.105.241.188]:56656: 535 Incorrect authentication data (set_id=vikas.khandelwal)85.105.241.188298795uM  -u) ossec13001g6Exim Auth failed2025-02-27 09:55:25 dovecot_login authenticator failed for ([161.132.96.130]) [161.132.96.130]:44121: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)161.132.96.1303932488'L  3S) ossec11301g:New FTP connection.Feb 27 09:51:11 vm1 pure-ftpd[527407]: (?@176.65.137.176) [INFO] New connection from 176.65.137.176176.65.137.1762921044TK  -7% ossec13001gkExim Auth failed2025-02-27 09:47:46 dovecot_plain authenticator failed for ([76.77.25.247]) [76.77.25.247]:33502: 535 Incorrect authentication data (set_id=services)76.77.25.2476252001iJ  -a' ossec13001gUExim Auth failed2025-02-27 09:47:25 dovecot_plain authenticator failed for ([94.206.192.75]) [94.206.192.75]:44467: 535 Incorrect authentication data (set_id=services@heipowersystem.com)94.206.192.75290557jI  -_) ossec13001gQExim Auth failed2025-02-27 09:38:47 dovecot_plain authenticator failed for ([116.148.103.34]) [116.148.103.34]:51366: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)116.148.103.341814991H  Qs' ossec11000gTLogin failed on the cpanel service[2025-02-27 09:30:20 +0530] info [webmaild] 157.38.132.61 - info@shivelectricaltransformers.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect157.38.132.611269750'G  3S) ossec11301g&New FTP connection.Feb 27 09:25:17 vm1 pure-ftpd[521500]: (?@15.235.224.239) [INFO] New connection from 15.235.224.23915.235.224.2391880251mF  -c+ ossec13001g߹Exim Auth failed2025-02-27 09:14:56 dovecot_plain authenticator failed for ([103.146.233.123]) [103.146.233.123]:45795: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)103.146.233.1231269750jE  -_) ossec13001gExim Auth failed2025-02-27 09:11:47 dovecot_plain authenticator failed for ([49.124.142.134]) [49.124.142.134]:37290: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)49.124.142.1341733045~D  Ua' ossec11001gyDeferred login on the cpanel service[2025-02-27 09:05:19 +0530] info [webmaild] 157.38.132.61 - kps@amplifypowerglobal.com "POST /cpsess5047662845/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [157.38.133.32] != Current IP Address [157.38.132.61]157.38.132.611269750]C  -C+ ossec13001gWExim Auth failed2025-02-27 09:04:45 dovecot_login authenticator failed for ([103.146.233.100]) [103.146.233.100]:38623: 535 Incorrect authentication data (set_id=services)103.146.233.1001269750mB  -e) ossec13001gCExim Auth failed2025-02-27 09:04:25 dovecot_login authenticator failed for ([165.90.101.190]) [165.90.101.190]:46733: 535 Incorrect authentication data (set_id=services@heipowersystem.com)165.90.101.1903374766cA  -S' ossec13001g۶Exim Auth failed2025-02-27 08:57:49 dovecot_plain authenticator failed for c188-151-64-10.bredband.tele2.se [188.151.64.10]:47716: 535 Incorrect authentication data (set_id=sales)188.151.64.102661886g@  -[' ossec13001gۤExim Auth failed2025-02-27 08:57:32 dovecot_plain authenticator failed for ([61.108.83.138]) [61.108.83.138]:48642: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)61.108.83.1381835841     9 [ uV_  -7) ossec13001g/Exim Auth failed2025-02-27 11:29:11 dovecot_plain authenticator failed for zdomainaccess.com [216.70.114.230]:45954: 535 Incorrect authentication data (set_id=sales)216.70.114.2306252001j^  -a' ossec13001g%Exim Auth failed2025-02-27 11:29:00 dovecot_plain authenticator failed for ([46.173.45.180]) [46.173.45.180]:60774: 535 Incorrect authentication data (set_id=services@heipowersystem.com)46.173.45.1802017370m]  -c+ ossec13001gExim Auth failed2025-02-27 11:28:54 dovecot_plain authenticator failed for ([211.117.144.194]) [211.117.144.194]:41526: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)211.117.144.1941835841p\  -i+ ossec13001g Exim Auth failed2025-02-27 11:11:52 dovecot_plain authenticator failed for ([123.139.133.238]) [123.139.133.238]:49192: 535 Incorrect authentication data (set_id=services@heipowersystem.com)123.139.133.2381814991I[  = ) ossec13008gMail Reciepient rejected2025-02-27 11:01:36 H=(mail.vandanabalbharti.com) [165.154.213.22]:49230 F= rejected RCPT : Rejected relay attempt: '165.154.213.22' From: 'sqechaythgw@vandanabalbharti.com' To: 'goofile@fastmail.com'165.154.213.223469034cZ  -S' ossec13001gExim Auth failed2025-02-27 10:58:49 dovecot_login authenticator failed for ([191.59.251.95]) [191.59.251.95]:57334: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)191.59.251.953469034Y  -' ossec13001gExim Auth failed2025-02-27 10:58:30 dovecot_login authenticator failed for h87-96-158-252.cust.bredband2.com [87.96.158.252]:41320: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)87.96.158.2522661886aX  -S# ossec13001gExim Auth failed2025-02-27 10:50:00 dovecot_login authenticator failed for ([14.23.77.27]) [14.23.77.27]:59112: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)14.23.77.271814991jW  -a' ossec13001gExim Auth failed2025-02-27 10:49:35 dovecot_plain authenticator failed for ([111.48.214.96]) [111.48.214.96]:20416: 535 Incorrect authentication data (set_id=services@heipowersystem.com)111.48.214.961814991QV  -1% ossec13001gExim Auth failed2025-02-27 10:35:08 dovecot_plain authenticator failed for ([103.83.9.138]) [103.83.9.138]:45418: 535 Incorrect authentication data (set_id=sales)103.83.9.1381269750ZU  -=+ ossec13001gVExim Auth failed2025-02-27 10:34:21 dovecot_plain authenticator failed for ([103.149.154.146]) [103.149.154.146]:54096: 535 Incorrect authentication data (set_id=sales)103.149.154.1461269750]T  -C+ ossec13001gTExim Auth failed2025-02-27 10:34:20 dovecot_plain authenticator failed for ([211.245.222.217]) [211.245.222.217]:62901: 535 Incorrect authentication data (set_id=services)211.245.222.2171835841}S  -' ossec13001gFExim Auth failed2025-02-27 10:34:05 dovecot_plain authenticator failed for syn-097-070-129-101.res.spectrum.com [97.70.129.101]:38195: 535 Incorrect authentication data (set_id=services@heipowersystem.com)97.70.129.1016252001rR  -u# ossec13001gFExim Auth failed2025-02-27 10:34:04 dovecot_plain authenticator failed for 210.0.90.81.static.nexnet.net.au [210.0.90.81]:60250: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)210.0.90.812077456uQ  -u) ossec13001gExim Auth failed2025-02-27 10:23:30 dovecot_login authenticator failed for ([111.48.214.102]) [111.48.214.102]:21992: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)111.48.214.1021814991rP  -q' ossec13001gExim Auth failed2025-02-27 10:12:03 dovecot_plain authenticator failed for ([170.250.128.5]) [170.250.128.5]:41756: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)170.250.128.56252001 "' $ bqxdp  -W% ossec13001gExim Auth failed2025-02-27 12:10:02 dovecot_plain authenticator failed for ([117.143.14.7]) [117.143.14.7]:37916: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)117.143.14.71814991!o  3K% ossec11301gNew FTP connection.Feb 27 12:09:33 vm1 pure-ftpd[556493]: (?@139.162.77.6) [INFO] New connection from 139.162.77.6139.162.77.61861060Qn  -3# ossec13001gExim Auth failed2025-02-27 11:57:16 dovecot_plain authenticator failed for ([45.71.58.25]) [45.71.58.25]:35964: 535 Incorrect authentication data (set_id=services)45.71.58.253865483pm  -i+ ossec13001gExim Auth failed2025-02-27 11:56:56 dovecot_plain authenticator failed for ([175.145.232.217]) [175.145.232.217]:35060: 535 Incorrect authentication data (set_id=services@heipowersystem.com)175.145.232.2171733045Wl  -9) ossec13001g?Exim Auth failed2025-02-27 11:55:02 dovecot_plain authenticator failed for ([49.205.177.146]) [223.239.159.21]:53774: 535 Incorrect authentication data (set_id=sales)223.239.159.211269750gk  -[' ossec13001g5Exim Auth failed2025-02-27 11:54:53 dovecot_plain authenticator failed for ([124.228.32.34]) [124.228.32.34]:36699: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)124.228.32.341814991bj  -S% ossec13001gExim Auth failed2025-02-27 11:52:32 dovecot_plain authenticator failed for 95-30-217-31.broadband.corbina.ru [95.30.217.31]:57074: 535 Incorrect authentication data (set_id=sales)95.30.217.312017370si  -u% ossec13001gExim Auth failed2025-02-27 11:52:20 dovecot_plain authenticator failed for 111-70-32-50.emome-ip.hinet.net [111.70.32.50]:32904: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)111.70.32.501668284dh  -Y% ossec13001gExim Auth failed2025-02-27 11:49:43 dovecot_plain authenticator failed for static-193-217-1-27.cust.tele2.lt [193.217.1.27]:42865: 535 Incorrect authentication data (set_id=services)193.217.1.27597427mg  -e) ossec13001gExim Auth failed2025-02-27 11:49:27 dovecot_plain authenticator failed for ([60.171.237.143]) [60.171.237.143]:47469: 535 Incorrect authentication data (set_id=services@heipowersystem.com)60.171.237.1431814991'f  3S) ossec11301gkNew FTP connection.Feb 27 11:47:14 vm1 pure-ftpd[552018]: (?@167.94.138.192) [INFO] New connection from 167.94.138.192167.94.138.1926252001ge  -[' ossec13001gExim Auth failed2025-02-27 11:39:20 dovecot_plain authenticator failed for ([93.102.155.19]) [93.102.155.19]:53400: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)93.102.155.192264397nd  -e+ ossec13001gExim Auth failed2025-02-27 11:39:32 dovecot_plain authenticator failed for host-216-104-122-159.public.eastlink.ca [216.104.122.159]:55230: 535 Incorrect authentication data (set_id=sales)216.104.122.15962519996c  =e+ ossec13008ghMail Reciepient rejected2025-02-27 11:38:40 H=(mail.nyaystambh.com) [165.154.208.228]:52903 F= rejected RCPT : Rejected relay attempt: '165.154.208.228' From: 'egzvklfkd@nyaystambh.com' To: 'goofile@fastmail.com'165.154.208.2281668284b  -+ ossec13001g Exim Auth failed2025-02-27 11:37:07 dovecot_plain authenticator failed for (190-205-112-156.static.cantv.net) [190.205.112.156]:41024: 535 Incorrect authentication data (set_id=services@heipowersystem.com)190.205.112.1563625428wa  -{) ossec13001gExim Auth failed2025-02-27 11:36:34 dovecot_plain authenticator failed for 139.123.235.77.dyn.idknet.com [77.235.123.139]:33172: 535 Incorrect authentication data (set_id=services@heipowersystem.com)77.235.123.139617790Z`  -?) ossec13001g:Exim Auth failed2025-02-27 11:29:20 dovecot_plain authenticator failed for ([182.191.122.84]) [182.191.122.84]:49250: 535 Incorrect authentication data (set_id=services)182.191.122.841168579 "8 ] 5 JOax{X  -=' ossec13001g Exim Auth failed2025-02-27 12:45:24 dovecot_login authenticator failed for ([218.106.120.18]) [58.49.113.138]:12495: 535 Incorrect authentication data (set_id=services)58.49.113.1381814991m  -e) ossec13001gExim Auth failed2025-02-27 12:45:02 dovecot_login authenticator failed for ([222.116.33.185]) [222.116.33.185]:47657: 535 Incorrect authentication data (set_id=services@heipowersystem.com)222.116.33.1851835841W  -9) ossec13001gExim Auth failed2025-02-27 12:43:51 dovecot_plain authenticator failed for ([49.205.177.146]) [223.239.159.21]:56650: 535 Incorrect authentication data (set_id=sales)223.239.159.211269750m~  -c+ ossec13001gExim Auth failed2025-02-27 12:43:35 dovecot_plain authenticator failed for ([103.158.138.179]) [103.158.138.179]:35848: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)103.158.138.1791269750W}  -;' ossec13001gExim Auth failed2025-02-27 12:39:38 dovecot_plain authenticator failed for ([60.166.31.198]) [60.166.31.198]:49615: 535 Incorrect authentication data (set_id=services)60.166.31.1981814991y|  -# ossec13001gExim Auth failed2025-02-27 12:39:08 dovecot_plain authenticator failed for syn-071-090-034-032.res.spectrum.com [71.90.34.32]:45709: 535 Incorrect authentication data (set_id=services@heipowersystem.com)71.90.34.326252001e{  -U) ossec13001gExim Auth failed2025-02-27 12:39:01 dovecot_plain authenticator failed for ip79-132-125-226.ulk.host.ttk.ru [79.132.125.226]:53960: 535 Incorrect authentication data (set_id=sales)79.132.125.2262017370jz  -_) ossec13001gExim Auth failed2025-02-27 12:38:51 dovecot_plain authenticator failed for ([176.222.190.70]) [176.222.190.70]:54782: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)176.222.190.701522867wy  -# ossec13001g Exim Auth failed2025-02-27 12:22:39 dovecot_plain authenticator failed for (6.41.43.103.cust-fiber.enegan.it) [103.43.41.6]:40038: 535 Incorrect authentication data (set_id=services@heipowersystem.com)103.43.41.63175395gx  -]% ossec13001g Exim Auth failed2025-02-27 12:22:15 dovecot_plain authenticator failed for ([45.71.58.130]) [45.71.58.130]:40175: 535 Incorrect authentication data (set_id=services@heipowersystem.com)45.71.58.1303865483Qw  -1% ossec13001g Exim Auth failed2025-02-27 12:22:16 dovecot_plain authenticator failed for ([91.215.87.20]) [91.215.87.20]:56726: 535 Incorrect authentication data (set_id=sales)91.215.87.203582678jv  -_) ossec13001g Exim Auth failed2025-02-27 12:22:06 dovecot_plain authenticator failed for ([128.185.253.90]) [128.185.253.90]:60314: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)128.185.253.9012697505u C]) ossec11309g FTP Authentication success.Feb 27 12:17:32 vm1 pure-ftpd[558247]: (?@106.201.25.190) [INFO] militry@technobases.in is now logged in106.201.25.1901269750(t 3S) ossec11301g New FTP connection.Feb 27 12:17:32 vm1 pure-ftpd[558247]: (?@106.201.25.190) [INFO] New connection from 106.201.25.190106.201.25.1901269750Ws  -;' ossec13001g Exim Auth failed2025-02-27 12:14:14 dovecot_plain authenticator failed for ([101.58.144.50]) [101.58.144.50]:46957: 535 Incorrect authentication data (set_id=services)101.58.144.503175395fr  -]% ossec13001g Exim Auth failed2025-02-27 12:14:04 dovecot_plain authenticator failed for ([86.57.254.73]) [86.57.254.73]:40619: 535 Incorrect authentication data (set_id=services@heipowersystem.com)86.57.254.73630336Zq  -=+ ossec13001gExim Auth failed2025-02-27 12:10:16 dovecot_plain authenticator failed for ([113.108.180.218]) [113.108.180.218]:56202: 535 Incorrect authentication data (set_id=sales)113.108.180.2181814991 A P y t br:  =o) ossec13008gMail Reciepient rejected2025-02-27 13:19:17 H=(mail.gurukuljaipur.com) [165.154.208.63]:56678 F= rejected RCPT : Rejected relay attempt: '165.154.208.63' From: 'adkgrkjk@gurukuljaipur.com' To: 'goofile@fastmail.com'165.154.208.631668284i  -[+ ossec13001gExim Auth failed2025-02-27 13:19:14 dovecot_plain authenticator failed for ([190.211.250.118]) [190.211.250.122]:33697: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)190.211.250.1223895114y  -}) ossec13001gExim Auth failed2025-02-27 13:18:51 dovecot_plain authenticator failed for ([183.109.148.43]) [183.109.148.43]:36778: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)183.109.148.431835841y  -' ossec13001gjExim Auth failed2025-02-27 13:12:33 dovecot_login authenticator failed for 179-189-85-66.goldnettelecom.com.br [179.189.85.66]:50566: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)179.189.85.663469034j  -_) ossec13001g^Exim Auth failed2025-02-27 13:12:20 dovecot_login authenticator failed for ([118.43.235.137]) [118.43.235.137]:45056: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)118.43.235.1371835841q  -m) ossec13001gExim Auth failed2025-02-27 13:09:32 dovecot_plain authenticator failed for ip-062-143-219-127.um16.pools.vodafone-ip.de [62.143.219.127]:62163: 535 Incorrect authentication data (set_id=sales)62.143.219.1272921044d  -W% ossec13001gExim Auth failed2025-02-27 13:08:58 dovecot_plain authenticator failed for ([1.237.137.30]) [1.237.137.30]:43806: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)1.237.137.301835841b  -S% ossec13001gXExim Auth failed2025-02-27 13:07:59 dovecot_plain authenticator failed for host59.sub-63-47-149.myvzw.com [63.47.149.59]:57001: 535 Incorrect authentication data (set_id=services)63.47.149.596252001l  -e) ossec13001gBExim Auth failed2025-02-27 13:07:36 dovecot_plain authenticator failed for ([178.172.225.52]) [178.172.225.52]:51251: 535 Incorrect authentication data (set_id=services@heipowersystem.com)178.172.225.52630336  W!+ ossec9708gDovecot Aborted Login with empty userFeb 27 13:06:00 vm1 dovecot[312763]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=185.247.137.251, lip=103.74.54.108, TLS, session=185.247.137.251298795k  -c' ossec13001gExim Auth failed2025-02-27 13:01:19 dovecot_plain authenticator failed for ppp-210-86-167-42.revip.asianet.co.th [210.86.167.42]:58533: 535 Incorrect authentication data (set_id=services)210.86.167.421605651  - ) ossec13001gExim Auth failed2025-02-27 13:00:46 dovecot_plain authenticator failed for ppp-210-86-163-194.revip.asianet.co.th [210.86.163.194]:59505: 535 Incorrect authentication data (set_id=services@heipowersystem.com)210.86.163.1941605651S  -5' ossec13001gExim Auth failed2025-02-27 12:52:53 dovecot_plain authenticator failed for ([213.55.79.199]) [213.55.79.195]:34536: 535 Incorrect authentication data (set_id=sales)213.55.79.195337996m  -c+ ossec13001gExim Auth failed2025-02-27 12:52:29 dovecot_plain authenticator failed for ([190.211.250.118]) [190.211.250.122]:46927: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)190.211.250.1223895114Q  -3# ossec13001gnExim Auth failed2025-02-27 12:47:02 dovecot_plain authenticator failed for ([27.71.17.66]) [27.71.17.66]:48968: 535 Incorrect authentication data (set_id=services)27.71.17.661562822f  -]% ossec13001gLExim Auth failed2025-02-27 12:46:28 dovecot_plain authenticator failed for ([206.42.79.74]) [206.42.79.74]:56632: 535 Incorrect authentication data (set_id=services@heipowersystem.com)206.42.79.74203312 *  ! I A T Uz~*T"  -5' ossec13001g"yExim Auth failed2025-02-27 13:59:44 dovecot_plain authenticator failed for ([218.87.21.146]) [218.87.21.146]:51789: 535 Incorrect authentication data (set_id=sales)218.87.21.1461814991z!  -' ossec13001g"SExim Auth failed2025-02-27 13:59:06 dovecot_plain authenticator failed for syn-024-090-169-209.res.spectrum.com [24.90.169.209]:47516: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)24.90.169.2096252001T  -7% ossec13001g!Exim Auth failed2025-02-27 13:57:22 dovecot_plain authenticator failed for ([27.188.66.84]) [27.188.66.84]:44040: 535 Incorrect authentication data (set_id=services)27.188.66.841814991y  -% ossec13001g!Exim Auth failed2025-02-27 13:57:03 dovecot_plain authenticator failed for c-73-95-112-29.hsd1.co.comcast.net [73.95.112.29]:34976: 535 Incorrect authentication data (set_id=services@heipowersystem.com)73.95.112.296252001Q  -1% ossec13001g!Exim Auth failed2025-02-27 13:53:54 dovecot_login authenticator failed for ([116.212.19.9]) [116.212.19.9]:40330: 535 Incorrect authentication data (set_id=sales)116.212.19.91835841r  -u# ossec13001g Exim Auth failed2025-02-27 13:53:19 dovecot_login authenticator failed for 210.0.90.81.static.nexnet.net.au [210.0.90.81]:54750: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)210.0.90.812077456  - ) ossec13001gExim Auth failed2025-02-27 13:41:04 dovecot_plain authenticator failed for 166.46.246.220.static.netvigator.com [220.246.46.166]:55832: 535 Incorrect authentication data (set_id=services@heipowersystem.com)220.246.46.1661819730W  -9) ossec13001gExim Auth failed2025-02-27 13:38:34 dovecot_plain authenticator failed for ([203.129.206.14]) [203.129.206.14]:57322: 535 Incorrect authentication data (set_id=sales)203.129.206.141269750x  -y+ ossec13001gcExim Auth failed2025-02-27 13:38:03 dovecot_plain authenticator failed for (pool-176-226-241-177.is74.ru) [176.226.241.177]:36942: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)176.226.241.1772017370W  -;' ossec13001gGExim Auth failed2025-02-27 13:37:34 dovecot_plain authenticator failed for ([220.85.251.16]) [220.85.251.16]:33324: 535 Incorrect authentication data (set_id=services)220.85.251.161835841{  -+ ossec13001g;Exim Auth failed2025-02-27 13:37:22 dovecot_plain authenticator failed for (109-120-192-105.ip.btc-net.bg) [109.120.192.105]:51854: 535 Incorrect authentication data (set_id=services@heipowersystem.com)109.120.192.105732800i  -]) ossec13001gExim Auth failed2025-02-27 13:36:51 dovecot_plain authenticator failed for syn-172-100-186-071.res.spectrum.com [172.100.186.71]:43610: 535 Incorrect authentication data (set_id=sales)172.100.186.716252001  -) ossec13001gExim Auth failed2025-02-27 13:36:40 dovecot_plain authenticator failed for node-184t.pool-125-27.dynamic.totinternet.net [125.27.223.109]:2448: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)125.27.223.1091605651T  -5' ossec13001gExim Auth failed2025-02-27 13:22:51 dovecot_plain authenticator failed for ([59.48.175.202]) [59.48.175.202]:52475: 535 Incorrect authentication data (set_id=sales)59.48.175.2021814991u  -{# ossec13001gExim Auth failed2025-02-27 13:22:33 dovecot_plain authenticator failed for 36.74-67-87.adsl-dyn.isp.belgacom.be [87.67.74.36]:3352: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)87.67.74.362802361m  -e) ossec13001gpExim Auth failed2025-02-27 13:21:11 dovecot_plain authenticator failed for ([112.168.71.109]) [112.168.71.109]:60722: 535 Incorrect authentication data (set_id=services@heipowersystem.com)112.168.71.1091835841q  -o' ossec13001g4Exim Auth failed2025-02-27 13:20:12 dovecot_plain authenticator failed for d54c70cda.static.telenet.be [84.199.12.218]:39984: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)84.199.12.2182802361 _ t v N`QvW3  -;' ossec13001g*Exim Auth failed2025-02-27 14:35:05 dovecot_plain authenticator failed for ([57.128.19.228]) [57.128.19.228]:33404: 535 Incorrect authentication data (set_id=services)57.128.19.2283017382y2  -' ossec13001g*Exim Auth failed2025-02-27 14:34:33 dovecot_plain authenticator failed for 111-70-22-151.emome-ip.hinet.net [111.70.22.151]:41482: 535 Incorrect authentication data (set_id=services@heipowersystem.com)111.70.22.1511668284V1  -;' ossec13001g*aExim Auth failed2025-02-27 14:33:28 dovecot_plain authenticator failed for ([80.250.155.12]) [80.250.155.12]:36270: 535 Incorrect authentication data (set_id=services)80.250.155.12294640m0  -e) ossec13001g*/Exim Auth failed2025-02-27 14:32:38 dovecot_plain authenticator failed for ([167.250.118.53]) [167.250.118.53]:33704: 535 Incorrect authentication data (set_id=services@heipowersystem.com)167.250.118.533865483W/  -9) ossec13001g*+Exim Auth failed2025-02-27 14:32:34 dovecot_login authenticator failed for ([220.80.192.168]) [220.80.192.168]:44844: 535 Incorrect authentication data (set_id=sales)220.80.192.1681835841 .  -!) ossec13001g*Exim Auth failed2025-02-27 14:32:22 dovecot_login authenticator failed for (abts-mum-static-127.120.70.182.airtelbroadband.in) [182.70.120.127]:60100: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)182.70.120.1271269750j-  -_) ossec13001g)Exim Auth failed2025-02-27 14:30:55 dovecot_plain authenticator failed for ([60.166.158.148]) [60.166.158.148]:36272: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)60.166.158.1481814991',  3S) ossec11301g'New FTP connection.Feb 27 14:21:54 vm1 pure-ftpd[583924]: (?@209.38.206.136) [INFO] New connection from 209.38.206.136209.38.206.1362921044Z+  -?) ossec13001g'Exim Auth failed2025-02-27 14:19:18 dovecot_plain authenticator failed for ([183.100.18.224]) [183.100.18.224]:36194: 535 Incorrect authentication data (set_id=services)183.100.18.2241835841z*  -# ossec13001g'Exim Auth failed2025-02-27 14:19:06 dovecot_plain authenticator failed for 18.red-83-48-39.staticip.rima-tde.net [83.48.39.18]:47765: 535 Incorrect authentication data (set_id=services@heipowersystem.com)83.48.39.182510769j)  -_) ossec13001g&hExim Auth failed2025-02-27 14:16:31 dovecot_plain authenticator failed for ([222.239.231.61]) [222.239.231.61]:21634: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)222.239.231.611835841T(  -5' ossec13001g&xExim Auth failed2025-02-27 14:16:47 dovecot_plain authenticator failed for ([36.37.181.181]) [36.37.181.181]:56282: 535 Incorrect authentication data (set_id=sales)36.37.181.1811831722W'  -9) ossec13001g$Exim Auth failed2025-02-27 14:09:38 dovecot_plain authenticator failed for ([115.44.141.199]) [115.44.141.199]:57014: 535 Incorrect authentication data (set_id=sales)115.44.141.1991814991z&  -) ossec13001g$Exim Auth failed2025-02-27 14:09:17 dovecot_plain authenticator failed for 186-45-128-131.dynamic.tstt.net.tt [186.45.128.131]:42669: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)186.45.128.1313573591g%  -[' ossec13001g$Exim Auth failed2025-02-27 14:08:53 dovecot_plain authenticator failed for ([119.84.241.94]) [119.84.241.94]:53000: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)119.84.241.941814991$$  3O' ossec11301g$KNew FTP connection.Feb 27 14:07:29 vm1 pure-ftpd[580870]: (?@88.214.25.121) [INFO] New connection from 88.214.25.12188.214.25.1212921044u#  -w' ossec13001g"Exim Auth failed2025-02-27 14:01:06 dovecot_plain authenticator failed for 89-200-95-200.mobile.kpn.net [89.200.95.200]:43833: 535 Incorrect authentication data (set_id=services@heipowersystem.com)89.200.95.2002750405 $ 7 F e t }!*UQ|pZD  -?) ossec13001g6Exim Auth failed2025-02-27 15:27:10 dovecot_plain authenticator failed for ([60.219.112.190]) [60.219.112.190]:49278: 535 Incorrect authentication data (set_id=services)60.219.112.1901814991C  -) ossec13001g6Exim Auth failed2025-02-27 15:26:46 dovecot_plain authenticator failed for node-184t.pool-125-27.dynamic.totinternet.net [125.27.223.109]:35704: 535 Incorrect authentication data (set_id=services@heipowersystem.com)125.27.223.1091605651QB  -1% ossec13001g5Exim Auth failed2025-02-27 15:21:57 dovecot_plain authenticator failed for ([41.74.136.46]) [41.74.136.46]:35841: 535 Incorrect authentication data (set_id=sales)41.74.136.463374766A  - + ossec13001g5Exim Auth failed2025-02-27 15:21:46 dovecot_plain authenticator failed for 123-195-225-182.dynamic.kbronet.com.tw [123.195.225.182]:35738: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)123.195.225.1821668284Q@  -1% ossec13001g2Exim Auth failed2025-02-27 15:09:17 dovecot_plain authenticator failed for ([144.48.49.72]) [144.48.49.72]:44786: 535 Incorrect authentication data (set_id=sales)144.48.49.721269750s?  -o+ ossec13001g2Exim Auth failed2025-02-27 15:08:48 dovecot_plain authenticator failed for (nsg-corporate-220.225.187.122.airtel.in) [122.187.225.220]:54603: 535 Incorrect authentication data (set_id=services)122.187.225.2201269750a>  -S# ossec13001g2Exim Auth failed2025-02-27 15:08:47 dovecot_plain authenticator failed for ([41.63.235.6]) [41.63.235.6]:35104: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)41.63.235.63355338j=  -a' ossec13001g2Exim Auth failed2025-02-27 15:08:21 dovecot_plain authenticator failed for ([211.96.160.37]) [211.96.160.37]:49944: 535 Incorrect authentication data (set_id=services@heipowersystem.com)211.96.160.371814991'<  3S) ossec11301g1YNew FTP connection.Feb 27 15:03:11 vm1 pure-ftpd[592241]: (?@113.128.65.204) [INFO] New connection from 113.128.65.204113.128.65.2041814991Z;  -=+ ossec13001g1SExim Auth failed2025-02-27 15:03:06 dovecot_plain authenticator failed for ([112.172.126.247]) [112.172.126.247]:50287: 535 Incorrect authentication data (set_id=sales)112.172.126.2471835841s:  -u% ossec13001g1-Exim Auth failed2025-02-27 15:02:27 dovecot_plain authenticator failed for 46-162-74-47.cust.bredband2.com [46.162.74.47]:55020: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)46.162.74.472661886m9  -e) ossec13001g/Exim Auth failed2025-02-27 14:57:04 dovecot_plain authenticator failed for ([117.158.243.50]) [117.158.243.50]:55442: 535 Incorrect authentication data (set_id=services@heipowersystem.com)117.158.243.501814991]8  -C+ ossec13001g/Exim Auth failed2025-02-27 14:57:15 dovecot_plain authenticator failed for ([185.226.168.157]) [185.226.168.157]:46590: 535 Incorrect authentication data (set_id=services)185.226.168.1572510769m7  -e) ossec13001g/hExim Auth failed2025-02-27 14:54:56 dovecot_plain authenticator failed for ([186.138.219.91]) [186.138.219.91]:50807: 535 Incorrect authentication data (set_id=services@heipowersystem.com)186.138.219.913865483i6  -]) ossec13001g.TExim Auth failed2025-02-27 14:50:19 dovecot_plain authenticator failed for syn-172-248-047-114.res.spectrum.com [172.248.47.114]:46581: 535 Incorrect authentication data (set_id=sales)172.248.47.1146252001j5  -_) ossec13001g.HExim Auth failed2025-02-27 14:50:07 dovecot_plain authenticator failed for ([104.241.233.26]) [104.241.233.26]:45154: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)104.241.233.266252001j4  -_) ossec13001g,Exim Auth failed2025-02-27 14:44:13 dovecot_plain authenticator failed for ([50.190.139.137]) [50.190.139.137]:45639: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)50.190.139.1376252001 P  3 ? a _o((PTU  -5' ossec13001g?Exim Auth failed2025-02-27 16:04:31 dovecot_plain authenticator failed for ([94.102.51.218]) [94.102.51.218]:46456: 535 Incorrect authentication data (set_id=sales)94.102.51.2182750405|T  -) ossec13001g?Exim Auth failed2025-02-27 16:04:21 dovecot_plain authenticator failed for c-73-106-172-226.hsd1.ga.comcast.net [73.106.172.226]:38030: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)73.106.172.2266252001fS  -Y' ossec13001g?Exim Auth failed2025-02-27 16:03:48 dovecot_plain authenticator failed for 57-45-246-103.southernonline.net [103.246.45.57]:35432: 535 Incorrect authentication data (set_id=services)103.246.45.571269750lR  -e' ossec13001g?Exim Auth failed2025-02-27 16:03:37 dovecot_plain authenticator failed for rm0zqz.g-service.ru [84.22.155.211]:40534: 535 Incorrect authentication data (set_id=services@heipowersystem.com)84.22.155.2112017370VQ  -;' ossec13001g=FExim Auth failed2025-02-27 15:54:05 dovecot_plain authenticator failed for ([185.167.56.70]) [185.167.56.70]:43622: 535 Incorrect authentication data (set_id=services)185.167.56.70617790gP  -]% ossec13001g=<Exim Auth failed2025-02-27 15:53:54 dovecot_plain authenticator failed for ([61.77.220.62]) [61.77.220.62]:55932: 535 Incorrect authentication data (set_id=services@heipowersystem.com)61.77.220.621835841TO  -5' ossec13001g<Exim Auth failed2025-02-27 15:51:38 dovecot_plain authenticator failed for ([1.221.243.126]) [1.221.243.126]:36987: 535 Incorrect authentication data (set_id=sales)1.221.243.1261835841mN  -c+ ossec13001g<Exim Auth failed2025-02-27 15:51:08 dovecot_plain authenticator failed for ([115.247.159.106]) [115.247.159.106]:54344: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)115.247.159.1061269750[M -A' ossec13001g;Exim Auth failed2025-02-27 15:47:11 dovecot_login authenticator failed for (fablixsolutions.com) [111.207.12.99]:50552: 535 Incorrect authentication data (set_id=nologin)111.207.12.991814991lL  -c) ossec13001g;Exim Auth failed2025-02-27 15:47:10 dovecot_plain authenticator failed for ([114.250.93.159]) [114.250.93.159]:7155: 535 Incorrect authentication data (set_id=services@heipowersystem.com)114.250.93.1591814991~K  -+ ossec13001g:Exim Auth failed2025-02-27 15:40:23 dovecot_plain authenticator failed for syn-108-191-170-208.biz.spectrum.com [108.191.170.208]:35090: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)108.191.170.2086252001ZJ  -=+ ossec13001g:Exim Auth failed2025-02-27 15:40:37 dovecot_plain authenticator failed for ([175.156.139.195]) [175.156.139.195]:32864: 535 Incorrect authentication data (set_id=sales)175.156.139.1951880251pI  -i+ ossec13001g9yExim Auth failed2025-02-27 15:37:51 dovecot_plain authenticator failed for ([219.140.176.170]) [219.140.176.170]:55007: 535 Incorrect authentication data (set_id=services@heipowersystem.com)219.140.176.1701814991ZH  -?) ossec13001g9Exim Auth failed2025-02-27 15:38:03 dovecot_plain authenticator failed for ([185.130.158.98]) [185.130.158.98]:43912: 535 Incorrect authentication data (set_id=services)185.130.158.982635167G  - ) ossec13001g9_Exim Auth failed2025-02-27 15:37:26 dovecot_plain authenticator failed for 93.135.220.111.sta.wbroadband.net.au [111.220.135.93]:50576: 535 Incorrect authentication data (set_id=services@heipowersystem.com)111.220.135.932077456WF  -9) ossec13001g8RExim Auth failed2025-02-27 15:32:58 dovecot_plain authenticator failed for ([112.25.140.211]) [112.25.140.211]:54725: 535 Incorrect authentication data (set_id=sales)112.25.140.2111814991 E  -%) ossec13001g8FExim Auth failed2025-02-27 15:32:46 dovecot_plain authenticator failed for (abts-north-static-109.51.160.122.airtelbroadband.in) [122.160.51.109]:52705: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)122.160.51.1091269750 H2 D i   .=DYk5Hif  -_) ossec13001gJExim Auth failed2025-02-27 16:52:01 dovecot_plain authenticator failed for ([168.167.55.230]) [168.167.55.230]:48078: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)168.167.55.2309338602e  =]+ ossec13008gIMail Reciepient rejected2025-02-27 16:46:47 H=(mail.nyaystambh.com) [165.154.213.196]:62895 F= rejected RCPT : Rejected relay attempt: '165.154.213.196' From: 'oruniqc@nyaystambh.com' To: 'goofile@fastmail.com'165.154.213.1963469034jd  -a' ossec13001gHExim Auth failed2025-02-27 16:43:53 dovecot_plain authenticator failed for ([92.255.166.13]) [92.255.166.13]:50595: 535 Incorrect authentication data (set_id=services@heipowersystem.com)92.255.166.132017370gc  -]% ossec13001gHExim Auth failed2025-02-27 16:43:24 dovecot_plain authenticator failed for ([60.172.53.82]) [60.172.53.82]:57860: 535 Incorrect authentication data (set_id=services@heipowersystem.com)60.172.53.821814991ub  -y% ossec13001gGExim Auth failed2025-02-27 16:39:21 dovecot_plain authenticator failed for ool-4a5ad51c.dyn.optonline.net [74.90.213.28]:60800: 535 Incorrect authentication data (set_id=services@heipowersystem.com)74.90.213.286252001ma  -c+ ossec13001gGExim Auth failed2025-02-27 16:39:09 dovecot_plain authenticator failed for ([180.188.143.166]) [180.188.143.166]:40007: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)180.188.143.1661819730W`  -;' ossec13001gGExim Auth failed2025-02-27 16:39:39 dovecot_plain authenticator failed for ([61.108.83.138]) [61.108.83.138]:36262: 535 Incorrect authentication data (set_id=services)61.108.83.1381835841`_  -M' ossec13001gGExim Auth failed2025-02-27 16:39:32 dovecot_plain authenticator failed for p549b925f.dip0.t-ipconnect.de [84.155.146.95]:59681: 535 Incorrect authentication data (set_id=sales)84.155.146.952921044a^  -M) ossec13001gGExim Auth failed2025-02-27 16:39:23 dovecot_plain authenticator failed for 49.sub-166-239-227.myvzw.com [166.239.227.49]:46006: 535 Incorrect authentication data (set_id=sales)166.239.227.496252001W]  -;' ossec13001gDExim Auth failed2025-02-27 16:25:08 dovecot_plain authenticator failed for ([31.173.66.222]) [31.173.66.222]:40562: 535 Incorrect authentication data (set_id=services)31.173.66.2222017370p\  -i+ ossec13001gDExim Auth failed2025-02-27 16:24:56 dovecot_plain authenticator failed for ([176.212.190.170]) [176.212.190.170]:57242: 535 Incorrect authentication data (set_id=services@heipowersystem.com)176.212.190.1702017370Z[  -=+ ossec13001gCExim Auth failed2025-02-27 16:20:50 dovecot_plain authenticator failed for ([218.149.228.166]) [218.149.228.166]:58865: 535 Incorrect authentication data (set_id=sales)218.149.228.1661835841fZ  -[' ossec13001gCyExim Auth failed2025-02-27 16:20:33 dovecot_plain authenticator failed for ([151.252.197.3]) [151.252.197.3]:49826: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)151.252.197.3732800WY  -;' ossec13001gB#Exim Auth failed2025-02-27 16:14:50 dovecot_plain authenticator failed for ([91.126.196.67]) [91.126.196.67]:52218: 535 Incorrect authentication data (set_id=services)91.126.196.672510769jX  -a' ossec13001gBExim Auth failed2025-02-27 16:14:34 dovecot_plain authenticator failed for ([106.227.87.29]) [106.227.87.29]:57830: 535 Incorrect authentication data (set_id=services@heipowersystem.com)106.227.87.291814991\W -E% ossec13001gAwExim Auth failed2025-02-27 16:11:58 dovecot_login authenticator failed for (amplifypowerglobal.com) [150.5.145.36]:39466: 535 Incorrect authentication data (set_id=nologin)150.5.145.361880251jV  -_) ossec13001gA#Exim Auth failed2025-02-27 16:10:34 dovecot_plain authenticator failed for ([121.147.25.111]) [121.147.25.111]:51668: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)121.147.25.1111835841 H > N t  H$w  3O' ossec11301gRNew FTP connection.Feb 27 17:26:15 vm1 pure-ftpd[622389]: (?@60.188.247.77) [INFO] New connection from 60.188.247.7760.188.247.771814991,v  =S) ossec13008gR+Mail Reciepient rejected2025-02-27 17:23:14 H=(mail.rokamauka.com) [165.154.208.53]:62924 F= rejected RCPT : Rejected relay attempt: '165.154.208.53' From: 'ijoghdh@rokamauka.com' To: 'goofile@fastmail.com'165.154.208.531668284Yu  -C# ossec13001gQExim Auth failed2025-02-27 17:18:47 dovecot_login authenticator failed for ([61.51.81.78]) [61.51.81.78]:41776: 535 Incorrect authentication data (set_id=vikas.khandelwal)61.51.81.781814991t  -' ossec13001gQ Exim Auth failed2025-02-27 17:18:25 dovecot_login authenticator failed for 041.148.48.116.static.netvigator.com [116.48.148.41]:51080: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)116.48.148.411819730Vs  -7) ossec13001gPExim Auth failed2025-02-27 17:16:35 dovecot_plain authenticator failed for zdomainaccess.com [216.70.114.230]:45858: 535 Incorrect authentication data (set_id=sales)216.70.114.2306252001yr  -}) ossec13001gPExim Auth failed2025-02-27 17:16:18 dovecot_plain authenticator failed for 221-120-57-125.emome-ip.hinet.net [221.120.57.125]:36506: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)221.120.57.1251668284jq  -a' ossec13001gOtExim Auth failed2025-02-27 17:11:39 dovecot_plain authenticator failed for 079.42.246.220.static.netvigator.com [220.246.42.79]:64811: 535 Incorrect authentication data (set_id=services)220.246.42.791819730up  -{# ossec13001gObExim Auth failed2025-02-27 17:11:22 dovecot_plain authenticator failed for 210.0.90.81.static.nexnet.net.au [210.0.90.81]:50588: 535 Incorrect authentication data (set_id=services@heipowersystem.com)210.0.90.812077456do  -S) ossec13001gNExim Auth failed2025-02-27 17:09:02 dovecot_plain authenticator failed for 155-61-202-109.kamensktel.ru [109.202.61.155]:52294: 535 Incorrect authentication data (set_id=services)109.202.61.1552017370~n  - ' ossec13001gNExim Auth failed2025-02-27 17:08:35 dovecot_plain authenticator failed for ppp-210-86-167-42.revip.asianet.co.th [210.86.167.42]:59654: 535 Incorrect authentication data (set_id=services@heipowersystem.com)210.86.167.421605651Wm  -9) ossec13001gMJExim Auth failed2025-02-27 17:02:24 dovecot_plain authenticator failed for ([158.140.39.128]) [158.140.39.128]:52373: 535 Incorrect authentication data (set_id=sales)158.140.39.1286252001gl  -[' ossec13001gM@Exim Auth failed2025-02-27 17:02:14 dovecot_plain authenticator failed for ([89.101.36.159]) [89.101.36.159]:59184: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)89.101.36.1592963597Vk  -;' ossec13001gLrExim Auth failed2025-02-27 16:58:48 dovecot_plain authenticator failed for ([151.252.197.3]) [151.252.197.3]:33828: 535 Incorrect authentication data (set_id=services)151.252.197.3732800lj  -c) ossec13001gLaExim Auth failed2025-02-27 16:58:33 dovecot_plain authenticator failed for ([58.226.255.240]) [58.226.255.240]:2251: 535 Incorrect authentication data (set_id=services@heipowersystem.com)58.226.255.2401835841Qi  -1% ossec13001gKExim Auth failed2025-02-27 16:56:01 dovecot_plain authenticator failed for ([60.166.8.174]) [60.166.8.174]:49963: 535 Incorrect authentication data (set_id=sales)60.166.8.1741814991|h  -% ossec13001gKExim Auth failed2025-02-27 16:55:22 dovecot_plain authenticator failed for port-ip-88-150-6-165.reverse.mdcc-fun.de [88.150.6.165]:60159: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)88.150.6.1652921044ig  -]) ossec13001gJExim Auth failed2025-02-27 16:52:13 dovecot_plain authenticator failed for syn-173-172-152-018.res.spectrum.com [173.172.152.18]:48908: 535 Incorrect authentication data (set_id=sales)173.172.152.186252001 k A S u b l6Kjk{  -% ossec13001g\Exim Auth failed2025-02-27 18:07:34 dovecot_plain authenticator failed for syn-076-169-081-036.res.spectrum.com [76.169.81.36]:52290: 535 Incorrect authentication data (set_id=services@heipowersystem.com)76.169.81.366252001]  -C+ ossec13001g[&Exim Auth failed2025-02-27 18:01:33 dovecot_plain authenticator failed for ([171.221.199.222]) [171.221.199.222]:63600: 535 Incorrect authentication data (set_id=services)171.221.199.2221814991g  -]% ossec13001g[Exim Auth failed2025-02-27 18:01:03 dovecot_plain authenticator failed for ([41.77.23.109]) [41.77.23.109]:39731: 535 Incorrect authentication data (set_id=services@heipowersystem.com)41.77.23.1091062947Z  -=+ ossec13001gZExim Auth failed2025-02-27 17:59:34 dovecot_plain authenticator failed for ([123.210.128.249]) [123.210.128.249]:33696: 535 Incorrect authentication data (set_id=sales)123.210.128.2492077456g  -[' ossec13001gZExim Auth failed2025-02-27 17:59:04 dovecot_plain authenticator failed for ([211.202.71.21]) [211.202.71.21]:39343: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)211.202.71.211835841T  -7% ossec13001gY!Exim Auth failed2025-02-27 17:52:57 dovecot_plain authenticator failed for ([80.82.54.138]) [81.211.77.58]:53963: 535 Incorrect authentication data (set_id=services)81.211.77.582017370j  -a' ossec13001gYExim Auth failed2025-02-27 17:52:46 dovecot_plain authenticator failed for ([125.21.141.54]) [125.21.141.54]:59482: 535 Incorrect authentication data (set_id=services@heipowersystem.com)125.21.141.541269750W  -9) ossec13001gWExim Auth failed2025-02-27 17:46:31 dovecot_plain authenticator failed for ([112.111.61.232]) [112.111.61.229]:47880: 535 Incorrect authentication data (set_id=sales)112.111.61.2291814991a  -S# ossec13001gWExim Auth failed2025-02-27 17:46:20 dovecot_plain authenticator failed for ([61.51.81.78]) [61.51.81.78]:45750: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)61.51.81.781814991c  -Q+ ossec13001gUlExim Auth failed2025-02-27 17:37:08 dovecot_login authenticator failed for ([196.200.227.78]) [196.200.227.194]:41626: 535 Incorrect authentication data (set_id=vikas.khandelwal)196.200.227.194149590r~  -q' ossec13001gU^Exim Auth failed2025-02-27 17:36:53 dovecot_login authenticator failed for ([92.255.190.69]) [92.255.190.69]:33808: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)92.255.190.692017370}  -+) ossec13001gUExim Auth failed2025-02-27 17:35:20 dovecot_plain authenticator failed for customer-ip-193-151-51-223.ipv.net.pl ([91.227.103.222]) [193.151.51.223]:40868: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)193.151.51.223798544Z|  -?) ossec13001gTExim Auth failed2025-02-27 17:34:33 dovecot_plain authenticator failed for ([176.192.250.81]) [176.192.250.81]:54050: 535 Incorrect authentication data (set_id=services)176.192.250.812017370j{  -a' ossec13001gTExim Auth failed2025-02-27 17:34:19 dovecot_plain authenticator failed for ([95.85.112.170]) [95.85.112.170]:37839: 535 Incorrect authentication data (set_id=services@heipowersystem.com)95.85.112.1701218197Zz  -?) ossec13001gSExim Auth failed2025-02-27 17:30:28 dovecot_plain authenticator failed for ([47.189.156.222]) [47.189.156.222]:48454: 535 Incorrect authentication data (set_id=services)47.189.156.2226252001py  -i+ ossec13001gSExim Auth failed2025-02-27 17:30:06 dovecot_plain authenticator failed for ([210.104.222.189]) [210.104.222.189]:57900: 535 Incorrect authentication data (set_id=services@heipowersystem.com)210.104.222.1891835841ix  -]) ossec13001gSrExim Auth failed2025-02-27 17:28:41 dovecot_plain authenticator failed for ([103.65.227.71]) [114.130.181.74]:38102: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)114.130.181.741210997 Y"7 _ t z s  6=GYj  -a' ossec13001ggExim Auth failed2025-02-27 18:54:25 dovecot_plain authenticator failed for ([61.185.30.170]) [61.185.30.170]:42392: 535 Incorrect authentication data (set_id=services@heipowersystem.com)61.185.30.1701814991r  -o) ossec13001geExim Auth failed2025-02-27 18:46:11 dovecot_plain authenticator failed for node-184t.pool-125-27.dynamic.totinternet.net [125.27.223.109]:33039: 535 Incorrect authentication data (set_id=sales)125.27.223.1091605651u  -w' ossec13001geuExim Auth failed2025-02-27 18:45:32 dovecot_plain authenticator failed for 42-200-70-134.static.imsbiz.com [42.200.70.134]:60193: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)42.200.70.1341819730d  -Y# ossec13001gd2Exim Auth failed2025-02-27 18:40:09 dovecot_plain authenticator failed for ([112.72.4.98]) [112.72.4.98]:32204: 535 Incorrect authentication data (set_id=services@heipowersystem.com)112.72.4.982029969j  -a' ossec13001gdLExim Auth failed2025-02-27 18:40:36 dovecot_plain authenticator failed for ([106.86.209.86]) [106.86.209.86]:16518: 535 Incorrect authentication data (set_id=services@heipowersystem.com)106.86.209.861814991W  -9) ossec13001g`Exim Auth failed2025-02-27 18:26:00 dovecot_plain authenticator failed for ([211.114.40.155]) [211.114.40.155]:56431: 535 Incorrect authentication data (set_id=sales)211.114.40.1551835841a  -S# ossec13001g`Exim Auth failed2025-02-27 18:25:48 dovecot_plain authenticator failed for ([61.6.225.90]) [61.6.225.90]:35344: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)61.6.225.901820814W  -;' ossec13001g`Exim Auth failed2025-02-27 18:24:47 dovecot_plain authenticator failed for ([72.26.178.196]) [72.26.178.196]:34350: 535 Incorrect authentication data (set_id=services)72.26.178.1966252001g  -]% ossec13001g`Exim Auth failed2025-02-27 18:24:35 dovecot_plain authenticator failed for ([96.79.249.93]) [96.79.249.93]:34230: 535 Incorrect authentication data (set_id=services@heipowersystem.com)96.79.249.936252001|  -) ossec13001g`Exim Auth failed2025-02-27 18:22:16 dovecot_plain authenticator failed for customer-ip-193-151-51-223.ipv.net.pl ([91.227.103.222]) [193.151.51.223]:54428: 535 Incorrect authentication data (set_id=sales)193.151.51.223798544]  -K# ossec13001g`Exim Auth failed2025-02-27 18:22:16 dovecot_login authenticator failed for ([59.12.201.7]) [59.12.201.7]:48100: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)59.12.201.71835841  -+ ossec13001g_Exim Auth failed2025-02-27 18:22:05 dovecot_plain authenticator failed for (nsg-corporate-123.230.187.122.airtel.in) [122.187.230.123]:37376: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)122.187.230.1231269750v  -{% ossec13001g_Exim Auth failed2025-02-27 18:22:03 dovecot_login authenticator failed for ([103.177.205.100]) [58.84.60.120]:26626: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)58.84.60.1201269750g  -[' ossec13001g]Exim Auth failed2025-02-27 18:13:25 dovecot_login authenticator failed for ([212.3.154.183]) [212.3.154.183]:44558: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)212.3.154.1832017370T  -5' ossec13001g]Exim Auth failed2025-02-27 18:11:58 dovecot_plain authenticator failed for ([37.204.174.45]) [37.204.174.45]:60582: 535 Incorrect authentication data (set_id=sales)37.204.174.452017370g  -[' ossec13001g]Exim Auth failed2025-02-27 18:11:47 dovecot_plain authenticator failed for ([175.202.82.16]) [175.202.82.16]:36486: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)175.202.82.161835841Z  -?) ossec13001g\Exim Auth failed2025-02-27 18:08:03 dovecot_plain authenticator failed for ([121.167.89.157]) [121.167.89.157]:49571: 535 Incorrect authentication data (set_id=services)121.167.89.1571835841 *\~tj`VLB8.$zpf\H>4*   v l b X N D : 0 &    ~ t j ` V L B 8 . $    z p f \ R H > 4 *   vlbXND:0&|h^rTJ@6,"xndZPF<2( ~t`jVLB8.$zpf\ | r h ^ T J @ 6 , "    x n d Z P F < 2 (   RRH>4*  vlbXND:0& gV g! g g g g g g g g g gH g< g&  g ~ g] } gE | g { g z g y g x g w g v g u g t g s g r g q ga p g o g n g m g l gt k gF j g2 i gs h ga g g f g e g d gZ c g b g a gF ` gL _ g4 ^ g ] g \ g [ g, Z g Y g X g W g V g U g T g S g R g Q g P g O g N g( M g L g K g~ J g~3 I g} H g} G g} F g}w E g{ D g{ C g{7 B gz A gz @ gy8 ? gy6 > gyJ = gy, < gx ; gxz : gxl 9 gxb 8 gxH 7 gx> 6 gv 5 gv 4 gv5 3 gv! 2 gs~ 1 gst 0 gr / gr . grp - grd , gq + gq * gp` ) gpT ( gn ' gm? & gl % gl $ gkj # gk " gk ! gk^ gkN  gi  gi  gi  gi~  gg  gg  ge  geu  gd2  gdL  g`  g`  g`  g`  g`  g`  g_  g_ g] g] g] g\ g\  g[&  g[  gZ  gZ  gY!  gY  gW  gW gUl gU^ gU gT gT gS gS gSr gR gR+ gQ gQ gP gP gOt gOb gN gN gMJ gM@ gLr gLa gK gK gJ gJ gI gH gH gé g g g g g g g g& g g gy g- g g g g g gp gP g0 gd gX g g g g g gy g g g* g g g g g g gl gx g g gd gG gG gG gG gG gD gD gC gCy gB# gB gAw gA# g? g? g? g? g=F g=< g< g< g; g; g: g: g9 g9y g9_ g8R g8F g6 g6 g5 g5 g2 g2 g2 g2 g1Y g1S g1- g/ gú g/ g/h g.T g.H g, g* g* g*a g*/ g*+ g* g) g' g' g' g&x g&h g$ g$ g$ g$K g" g"y g"S g! g! g! g g g gc gG g; g g g g gp g4 g g g ^P[XP|t i g e d abNK@H*'51.79.231.174BLACKg.gBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests18802513Olocal))173.239.249.32BLACKg!=g=Blacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests6252001 local('52.169.180.84BLACKg/g/Blacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests29635974Tlocal~'%84.17.52.145BLACKg6g6Blacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests2658434T4local&)170.39.218.109BLACKg̻gBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests3017382'mlocal~@%84.17.52.172BLACKg g® Blacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests2658434T4local<'84.234.31.193BLACKgϡgrBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests2658434Tlocalw;!!k3.19.60.84GRAYgpImunify360goAutomatically blocked due to distributed attack6252001local/'170.64.223.90BLACKggBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests2077456@Zlocal.'13.79.156.154BLACKg͸PgPBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests2963597 Olocal-)164.152.20.174BLACKg͘xgixBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests6252001local,)52.169.181.227BLACKg͕gfBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests29635974local >%7 \ \ +S[ ,>j*  -a' ossec13001gqExim Auth failed2025-02-27 19:34:50 dovecot_plain authenticator failed for ([42.233.34.152]) [42.233.34.152]:19500: 535 Incorrect authentication data (set_id=services@heipowersystem.com)42.233.34.1521814991Z)  -=+ ossec13001gp`Exim Auth failed2025-02-27 19:32:07 dovecot_plain authenticator failed for ([175.117.144.158]) [175.117.144.158]:35432: 535 Incorrect authentication data (set_id=sales)175.117.144.1581835841w(  -{' ossec13001gpTExim Auth failed2025-02-27 19:31:55 dovecot_plain authenticator failed for h87-96-158-252.cust.bredband2.com [87.96.158.252]:40078: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)87.96.158.2522661886R'  =) ossec13008gnMail Reciepient rejected2025-02-27 19:24:25 H=(mail.westerndancecompany.com) [165.154.227.89]:57011 F= rejected RCPT : Rejected relay attempt: '165.154.227.89' From: 'snyyvreainx@westerndancecompany.com' To: 'goofile@fastmail.com'165.154.227.891668284t&  -w' ossec13001gm?Exim Auth failed2025-02-27 19:18:45 dovecot_plain authenticator failed for 89.113.153.95.dyn.idknet.com [95.153.113.89]:60734: 535 Incorrect authentication data (set_id=services@heipowersystem.com)95.153.113.89617790T%  -5' ossec13001glExim Auth failed2025-02-27 19:16:18 dovecot_plain authenticator failed for ([12.150.243.20]) [12.150.243.18]:21898: 535 Incorrect authentication data (set_id=sales)12.150.243.186252001f$  -[% ossec13001glExim Auth failed2025-02-27 19:16:08 dovecot_plain authenticator failed for ([182.76.125.174]) [182.76.87.90]:57030: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)182.76.87.901269750W#  -;' ossec13001gkjExim Auth failed2025-02-27 19:10:57 dovecot_login authenticator failed for ([31.134.243.37]) [31.134.243.37]:56991: 535 Incorrect authentication data (set_id=services)31.134.243.372017370W"  -9) ossec13001gkExim Auth failed2025-02-27 19:11:46 dovecot_plain authenticator failed for ([191.59.176.133]) [191.59.176.133]:59352: 535 Incorrect authentication data (set_id=sales)191.59.176.1333469034j!  -_) ossec13001gkExim Auth failed2025-02-27 19:11:28 dovecot_plain authenticator failed for ([67.213.230.122]) [67.213.230.122]:23133: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)67.213.230.1226252001Z  -?) ossec13001gk^Exim Auth failed2025-02-27 19:10:45 dovecot_login authenticator failed for ([60.171.237.143]) [60.171.237.143]:54188: 535 Incorrect authentication data (set_id=services)60.171.237.1431814991j  -a' ossec13001gkNExim Auth failed2025-02-27 19:10:30 dovecot_login authenticator failed for ([121.65.54.204]) [121.65.54.204]:56402: 535 Incorrect authentication data (set_id=services@heipowersystem.com)121.65.54.2041835841S  -5' ossec13001giExim Auth failed2025-02-27 19:04:32 dovecot_plain authenticator failed for ([94.204.237.10]) [94.204.237.10]:43440: 535 Incorrect authentication data (set_id=sales)94.204.237.10290557|  -) ossec13001giExim Auth failed2025-02-27 19:04:21 dovecot_plain authenticator failed for syn-173-095-123-220.biz.spectrum.com [173.95.123.220]:45361: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)173.95.123.2206252001W  -;' ossec13001giExim Auth failed2025-02-27 19:03:01 dovecot_plain authenticator failed for ([88.84.209.146]) [88.84.209.146]:55456: 535 Incorrect authentication data (set_id=services)88.84.209.1462017370j  -a' ossec13001gi~Exim Auth failed2025-02-27 19:02:44 dovecot_plain authenticator failed for ([124.246.92.77]) [124.246.92.77]:42127: 535 Incorrect authentication data (set_id=services@heipowersystem.com)124.246.92.771880251W  -;' ossec13001ggExim Auth failed2025-02-27 18:54:37 dovecot_plain authenticator failed for ([61.81.133.182]) [61.81.133.182]:46503: 535 Incorrect authentication data (set_id=services)61.81.133.1821835841 ( P b 4Otg;  -Y) ossec13001gxExim Auth failed2025-02-27 20:07:08 dovecot_plain authenticator failed for (116.68.197.124.unknown.m1.com.sg) [124.197.68.116]:50269: 535 Incorrect authentication data (set_id=sales)124.197.68.1161880251W:  -9) ossec13001gxzExim Auth failed2025-02-27 20:06:41 dovecot_plain authenticator failed for ([114.247.207.98]) [114.247.207.98]:44475: 535 Incorrect authentication data (set_id=sales)114.247.207.981814991a9  -S# ossec13001gxlExim Auth failed2025-02-27 20:06:27 dovecot_plain authenticator failed for ([58.69.17.18]) [58.69.17.18]:37480: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)58.69.17.181694008g8  -[' ossec13001gxbExim Auth failed2025-02-27 20:06:17 dovecot_plain authenticator failed for ([114.221.2.199]) [114.221.2.199]:53697: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)114.221.2.1991814991]7  -C+ ossec13001gxHExim Auth failed2025-02-27 20:05:51 dovecot_plain authenticator failed for ([182.163.122.133]) [182.163.122.133]:64373: 535 Incorrect authentication data (set_id=services)182.163.122.1331210997g6  -]% ossec13001gx>Exim Auth failed2025-02-27 20:05:40 dovecot_plain authenticator failed for ([27.72.103.74]) [27.72.103.74]:58913: 535 Incorrect authentication data (set_id=services@heipowersystem.com)27.72.103.741562822Z5  -?) ossec13001gvExim Auth failed2025-02-27 19:59:03 dovecot_plain authenticator failed for ([152.42.211.235]) [152.42.211.235]:42038: 535 Incorrect authentication data (set_id=services)152.42.211.2351880251}4  -' ossec13001gvExim Auth failed2025-02-27 19:58:48 dovecot_plain authenticator failed for syn-045-049-179-157.res.spectrum.com [45.49.179.157]:43485: 535 Incorrect authentication data (set_id=services@heipowersystem.com)45.49.179.1576252001\3  -E' ossec13001gv5Exim Auth failed2025-02-27 19:57:01 dovecot_plain authenticator failed for 126.64.125.78.rev.sfr.net [78.125.64.126]:58280: 535 Incorrect authentication data (set_id=sales)78.125.64.1263017382y2  -}) ossec13001gv!Exim Auth failed2025-02-27 19:56:40 dovecot_plain authenticator failed for 94-255-156-165.cust.bredband2.com [94.255.156.165]:36124: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)94.255.156.1652661886W1  -;' ossec13001gs~Exim Auth failed2025-02-27 19:45:26 dovecot_plain authenticator failed for ([88.201.163.65]) [88.201.163.65]:60070: 535 Incorrect authentication data (set_id=services)88.201.163.652017370~0  -) ossec13001gstExim Auth failed2025-02-27 19:45:16 dovecot_plain authenticator failed for c-73-134-126-162.hsd1.md.comcast.net [73.134.126.162]:4349: 535 Incorrect authentication data (set_id=services@heipowersystem.com)73.134.126.1626252001Z/  -=+ ossec13001grExim Auth failed2025-02-27 19:43:16 dovecot_plain authenticator failed for ([129.146.148.173]) [129.146.148.173]:38292: 535 Incorrect authentication data (set_id=sales)129.146.148.1736252001j.  -_) ossec13001grExim Auth failed2025-02-27 19:42:56 dovecot_plain authenticator failed for ([223.241.100.90]) [223.241.100.90]:46664: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)223.241.100.901814991T-  -5' ossec13001grpExim Auth failed2025-02-27 19:40:55 dovecot_login authenticator failed for ([60.255.120.74]) [60.255.120.74]:49514: 535 Incorrect authentication data (set_id=sales)60.255.120.741814991c,  -U% ossec13001grdExim Auth failed2025-02-27 19:40:44 dovecot_login authenticator failed for ([8.243.166.66]) [8.243.166.66]:4501: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)8.243.166.663686110m+  -e) ossec13001gqExim Auth failed2025-02-27 19:35:15 dovecot_plain authenticator failed for ([27.123.242.252]) [27.123.242.252]:44268: 535 Incorrect authentication data (set_id=services@heipowersystem.com)27.123.242.2521269750 f= k s  "4WfmL  -e) ossec13001gExim Auth failed2025-02-27 20:42:58 dovecot_plain authenticator failed for ([220.182.11.126]) [220.182.11.126]:41868: 535 Incorrect authentication data (set_id=services@heipowersystem.com)220.182.11.1261814991YK  -=) ossec13001gExim Auth failed2025-02-27 20:34:58 dovecot_plain authenticator failed for (static.as64098.net) [103.79.175.115]:39197: 535 Incorrect authentication data (set_id=sales)103.79.175.1152077456jJ  -_) ossec13001g~Exim Auth failed2025-02-27 20:34:17 dovecot_plain authenticator failed for ([190.185.162.26]) [190.185.162.26]:39642: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)190.185.162.263865483gI  -]% ossec13001g~3Exim Auth failed2025-02-27 20:31:06 dovecot_plain authenticator failed for ([135.26.71.15]) [135.26.71.15]:50632: 535 Incorrect authentication data (set_id=services@heipowersystem.com)135.26.71.156252001pH  -k) ossec13001g}Exim Auth failed2025-02-27 20:28:49 dovecot_login authenticator failed for 244.79-161-138.customer.lyse.net [79.161.138.244]:33670: 535 Incorrect authentication data (set_id=vikas.khandelwal)79.161.138.2443144096{G  -' ossec13001g}Exim Auth failed2025-02-27 20:28:37 dovecot_login authenticator failed for (82.193.122.91.cl.ipnet.ua) [82.193.122.91]:50295: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)82.193.122.91690791`F  -K) ossec13001g}Exim Auth failed2025-02-27 20:28:20 dovecot_plain authenticator failed for vps-f5bece10.vps.ovh.net [135.125.207.50]:33496: 535 Incorrect authentication data (set_id=services)135.125.207.503017382E  - ) ossec13001g}wExim Auth failed2025-02-27 20:27:58 dovecot_plain authenticator failed for 112.46.246.220.static.netvigator.com [220.246.46.112]:60583: 535 Incorrect authentication data (set_id=services@heipowersystem.com)220.246.46.1121819730dD  -U' ossec13001g{Exim Auth failed2025-02-27 20:21:22 dovecot_plain authenticator failed for (static-14.38.103.extranet.co.in) [59.94.179.175]:35748: 535 Incorrect authentication data (set_id=sales)59.94.179.1751269750zC  -' ossec13001g{Exim Auth failed2025-02-27 20:21:07 dovecot_plain authenticator failed for syn-068-184-049-166.res.spectrum.com [68.184.49.166]:53536: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)68.184.49.1666252001jB  -a' ossec13001g{7Exim Auth failed2025-02-27 20:18:21 dovecot_plain authenticator failed for ([103.65.227.12]) [103.65.227.12]:45241: 535 Incorrect authentication data (set_id=services@heipowersystem.com)103.65.227.121210997^A  -K% ossec13001gzExim Auth failed2025-02-27 20:16:39 dovecot_login authenticator failed for (rokamauka.com) [125.72.54.81]:38644: 535 Incorrect authentication data (set_id=admin@rokamauka.com)125.72.54.811814991R@  -3% ossec13001gzExim Auth failed2025-02-27 20:15:33 dovecot_login authenticator failed for (rokamauka.com) [125.72.54.81]:34544: 535 Incorrect authentication data (set_id=nologin)125.72.54.811814991t?  -u' ossec13001gy8Exim Auth failed2025-02-27 20:09:52 dovecot_login authenticator failed for (atm23-13-1.pae.gvt.net.br) [200.175.88.85]:46592: 535 Incorrect authentication data (set_id=services@heipowersystem.com)200.175.88.853469034N>  --# ossec13001gy6Exim Auth failed2025-02-27 20:09:48 dovecot_plain authenticator failed for ([50.81.70.80]) [50.81.70.80]:58572: 535 Incorrect authentication data (set_id=sales)50.81.70.806252001Z=  -?) ossec13001gyJExim Auth failed2025-02-27 20:10:10 dovecot_login authenticator failed for ([74.196.184.120]) [74.196.184.120]:51897: 535 Incorrect authentication data (set_id=services)74.196.184.1206252001a<  -S# ossec13001gy,Exim Auth failed2025-02-27 20:09:38 dovecot_plain authenticator failed for ([58.69.17.18]) [58.69.17.18]:37178: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)58.69.17.181694008 $ O ^  Dj]  -a' ossec13001gExim Auth failed2025-02-27 21:36:22 dovecot_plain authenticator failed for ([49.124.151.42]) [49.124.151.42]:35220: 535 Incorrect authentication data (set_id=services@heipowersystem.com)49.124.151.421733045V\  -9) ossec13001gExim Auth failed2025-02-27 21:25:27 dovecot_plain authenticator failed for ([87.236.141.106]) [87.236.141.106]:56374: 535 Incorrect authentication data (set_id=sales)87.236.141.106290291y[  -}) ossec13001gExim Auth failed2025-02-27 21:25:16 dovecot_plain authenticator failed for s75-152-225-154.ab.hsia.telus.net [75.152.225.154]:49895: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)75.152.225.1546251999'Z  3S) ossec11301g,New FTP connection.Feb 27 21:22:11 vm1 pure-ftpd[671858]: (?@198.235.24.120) [INFO] New connection from 198.235.24.120198.235.24.1206252001VY  -;' ossec13001gExim Auth failed2025-02-27 21:21:33 dovecot_plain authenticator failed for ([82.193.122.91]) [82.193.122.91]:42557: 535 Incorrect authentication data (set_id=services)82.193.122.91690791kX  -c' ossec13001gExim Auth failed2025-02-27 21:21:12 dovecot_plain authenticator failed for ([177.174.89.105]) [177.174.89.99]:33397: 535 Incorrect authentication data (set_id=services@heipowersystem.com)177.174.89.993469034`W  -M' ossec13001gExim Auth failed2025-02-27 21:17:33 dovecot_plain authenticator failed for 110-25-103-74.adsl.fetnet.net [110.25.103.74]:34141: 535 Incorrect authentication data (set_id=sales)110.25.103.741668284fV  -[' ossec13001gExim Auth failed2025-02-27 21:17:05 dovecot_plain authenticator failed for ([94.206.192.75]) [94.206.192.75]:43113: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)94.206.192.75290557mU  -c+ ossec13001gExim Auth failed2025-02-27 21:12:20 dovecot_plain authenticator failed for (172.183.199.112.unknown.m1.com.sg) [112.199.183.172]:43308: 535 Incorrect authentication data (set_id=services)112.199.183.1721880251pT  -i+ ossec13001gExim Auth failed2025-02-27 21:11:47 dovecot_plain authenticator failed for ([123.210.131.121]) [123.210.131.121]:53774: 535 Incorrect authentication data (set_id=services@heipowersystem.com)123.210.131.1212077456WS  -9) ossec13001gExim Auth failed2025-02-27 21:08:54 dovecot_plain authenticator failed for ([112.111.61.230]) [112.111.61.229]:56626: 535 Incorrect authentication data (set_id=sales)112.111.61.2291814991gR  -[' ossec13001gExim Auth failed2025-02-27 21:08:41 dovecot_plain authenticator failed for ([61.133.10.205]) [61.133.10.204]:51220: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)61.133.10.2041814991TQ  -5' ossec13001gExim Auth failed2025-02-27 20:55:30 dovecot_plain authenticator failed for ([77.242.167.77]) [77.242.167.77]:49720: 535 Incorrect authentication data (set_id=sales)77.242.167.772658434mP  -c+ ossec13001gExim Auth failed2025-02-27 20:55:08 dovecot_plain authenticator failed for ([178.178.194.128]) [178.178.194.128]:43810: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)178.178.194.1282017370QO  -1% ossec13001gExim Auth failed2025-02-27 20:47:25 dovecot_plain authenticator failed for ([61.150.88.22]) [61.150.88.22]:57119: 535 Incorrect authentication data (set_id=sales)61.150.88.221814991gN  -[' ossec13001gExim Auth failed2025-02-27 20:46:48 dovecot_plain authenticator failed for ([27.223.100.90]) [27.223.100.90]:34626: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)27.223.100.901814991mM  -e) ossec13001g(Exim Auth failed2025-02-27 20:43:43 dovecot_plain authenticator failed for ([207.134.96.117]) [207.134.96.117]:45655: 535 Incorrect authentication data (set_id=services@heipowersystem.com)207.134.96.1176251999 08  . C Qjy 0jn  -a' ossec13001g Exim Auth failed2025-02-27 22:25:40 dovecot_plain authenticator failed for ([106.86.209.86]) [106.86.209.86]:61612: 535 Incorrect authentication data (set_id=services@heipowersystem.com)106.86.209.861814991gm  -[' ossec13001gExim Auth failed2025-02-27 22:19:46 dovecot_plain authenticator failed for ([46.73.156.221]) [46.73.156.221]:56162: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)46.73.156.2212017370Pl  -1% ossec13001gExim Auth failed2025-02-27 22:19:05 dovecot_login authenticator failed for ([5.11.164.165]) [5.11.164.165]:45044: 535 Incorrect authentication data (set_id=sales)5.11.164.165298795gk  -[' ossec13001gtExim Auth failed2025-02-27 22:18:51 dovecot_login authenticator failed for ([95.66.153.194]) [95.66.153.194]:55463: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)95.66.153.1942017370cj  -S' ossec13001gFExim Auth failed2025-02-27 22:13:49 dovecot_login authenticator failed for ([57.128.19.228]) [57.128.19.228]:37256: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)57.128.19.2283017382i  - + ossec13001g2Exim Auth failed2025-02-27 22:13:28 dovecot_login authenticator failed for pcd429162.netvigator.com [203.218.219.162]:41280: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)203.218.219.1621819730Sh  -3' ossec13001gsExim Auth failed2025-02-27 22:10:19 dovecot_plain authenticator failed for ([58.250.157.83]) [58.250.157.83]:2048: 535 Incorrect authentication data (set_id=sales)58.250.157.831814991jg  -_) ossec13001gaExim Auth failed2025-02-27 22:10:00 dovecot_plain authenticator failed for ([73.231.102.189]) [73.231.102.189]:38592: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)73.231.102.1896252001mf  -e) ossec13001gExim Auth failed2025-02-27 21:59:48 dovecot_plain authenticator failed for ([220.77.182.171]) [220.77.182.171]:34682: 535 Incorrect authentication data (set_id=services@heipowersystem.com)220.77.182.1711835841ce  -S' ossec13001gExim Auth failed2025-02-27 21:55:49 dovecot_plain authenticator failed for 111-70-32-166.emome-ip.hinet.net [111.70.32.166]:55060: 535 Incorrect authentication data (set_id=sales)111.70.32.1661668284nd  -o# ossec13001gExim Auth failed2025-02-27 21:55:21 dovecot_plain authenticator failed for 89-67-38-27.dynamic.chello.pl [89.67.38.27]:51417: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)89.67.38.27798544gc  -[' ossec13001gZExim Auth failed2025-02-27 21:52:49 dovecot_plain authenticator failed for ([191.56.75.192]) [191.56.75.192]:55610: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)191.56.75.1923469034Sb  -7% ossec13001gExim Auth failed2025-02-27 21:46:48 dovecot_plain authenticator failed for ([20.46.45.121]) [20.46.45.121]:62123: 535 Incorrect authentication data (set_id=services)20.46.45.121290557ma  -e) ossec13001gExim Auth failed2025-02-27 21:46:34 dovecot_plain authenticator failed for ([162.252.18.246]) [162.252.18.246]:47246: 535 Incorrect authentication data (set_id=services@heipowersystem.com)162.252.18.2466252001>`  =w) ossec13008gFMail Reciepient rejected2025-02-27 21:43:57 H=(mail.gurukuljaipur.com) [165.154.213.22]:65355 F= rejected RCPT : Rejected relay attempt: '165.154.213.22' From: 'usynzifoey@gurukuljaipur.com' To: 'goofile@fastmail.com'165.154.213.223469034W_  -9) ossec13001gLExim Auth failed2025-02-27 21:39:46 dovecot_plain authenticator failed for ([50.188.204.213]) [50.188.204.213]:58588: 535 Incorrect authentication data (set_id=sales)50.188.204.2136252001i^  -_) ossec13001g4Exim Auth failed2025-02-27 21:39:22 dovecot_plain authenticator failed for ([146.19.200.215]) [146.19.200.215]:42936: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)146.19.200.215660013 3 V U d y <Nsq  -o' ossec13001g&Exim Auth failed2025-02-27 23:21:32 dovecot_plain authenticator failed for 63.sub-166-156-39.myvzw.com [166.156.39.63]:54825: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)166.156.39.636252001l~  -e) ossec13001gExim Auth failed2025-02-27 23:06:55 dovecot_plain authenticator failed for ([185.167.58.121]) [185.167.58.121]:60154: 535 Incorrect authentication data (set_id=services@heipowersystem.com)185.167.58.121617790W}  -9) ossec13001g]Exim Auth failed2025-02-27 23:05:23 dovecot_plain authenticator failed for ([105.73.190.210]) [105.73.190.210]:58801: 535 Incorrect authentication data (set_id=sales)105.73.190.2102542007j|  -_) ossec13001gEExim Auth failed2025-02-27 23:05:00 dovecot_plain authenticator failed for ([220.182.17.122]) [220.182.17.122]:53782: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)220.182.17.1221814991T{  -5' ossec13001gExim Auth failed2025-02-27 23:02:38 dovecot_plain authenticator failed for ([94.102.51.218]) [94.102.51.218]:50090: 535 Incorrect authentication data (set_id=sales)94.102.51.2182750405cz  -W% ossec13001gExim Auth failed2025-02-27 23:02:28 dovecot_plain authenticator failed for ([2.179.186.69]) [2.179.186.69]:38602: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)2.179.186.69130758ly  -e) ossec13001gExim Auth failed2025-02-27 22:57:54 dovecot_plain authenticator failed for ([94.202.156.237]) [94.202.156.237]:54197: 535 Incorrect authentication data (set_id=services@heipowersystem.com)94.202.156.237290557Tx  -7% ossec13001gExim Auth failed2025-02-27 22:49:44 dovecot_plain authenticator failed for ([58.18.90.250]) [58.18.90.250]:58565: 535 Incorrect authentication data (set_id=services)58.18.90.2501814991jw  -a' ossec13001gExim Auth failed2025-02-27 22:49:26 dovecot_plain authenticator failed for ([42.180.162.26]) [42.180.162.26]:47482: 535 Incorrect authentication data (set_id=services@heipowersystem.com)42.180.162.261814991Qv  -1% ossec13001gExim Auth failed2025-02-27 22:46:24 dovecot_plain authenticator failed for ([49.79.80.131]) [49.79.80.131]:57964: 535 Incorrect authentication data (set_id=sales)49.79.80.1311814991ou  -k' ossec13001gExim Auth failed2025-02-27 22:46:02 dovecot_plain authenticator failed for 126.64.125.78.rev.sfr.net [78.125.64.126]:44216: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)78.125.64.1263017382gt  -[' ossec13001gExim Auth failed2025-02-27 22:38:43 dovecot_plain authenticator failed for syn-172-090-128-097.res.spectrum.com [172.90.128.97]:61024: 535 Incorrect authentication data (set_id=sales)172.90.128.976252001ms  -c+ ossec13001gExim Auth failed2025-02-27 22:38:31 dovecot_plain authenticator failed for ([118.200.134.239]) [118.200.134.239]:33402: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)118.200.134.2391880251}r  -' ossec13001gExim Auth failed2025-02-27 22:37:21 dovecot_plain authenticator failed for syn-024-168-026-166.res.spectrum.com [24.168.26.166]:49534: 535 Incorrect authentication data (set_id=services@heipowersystem.com)24.168.26.1666252001Yq  -?) ossec13001gExim Auth failed2025-02-27 22:37:34 dovecot_plain authenticator failed for ([94.202.156.237]) [94.202.156.237]:48395: 535 Incorrect authentication data (set_id=services)94.202.156.237290557Yp -?% ossec13001gaExim Auth failed2025-02-27 22:31:19 dovecot_login authenticator failed for (fablixsolutions.com) [60.2.243.174]:57826: 535 Incorrect authentication data (set_id=nologin)60.2.243.1741814991lo  -c) ossec13001gExim Auth failed2025-02-27 22:25:53 dovecot_plain authenticator failed for syn-184-152-099-171.res.spectrum.com [184.152.99.171]:33654: 535 Incorrect authentication data (set_id=services)184.152.99.1716252001 =~qdWJ=0# zm`SF9, v i \ O B 5 (     r e X K > 1 $  { n a T G : -   w j ] P C 6 )    s f Y L ? 2 %  |obUH;.!xk^QD7*tgZM@3& }pcVI</"yl_RE8+uh[NA4' ~qdWJ=0 1814991q 1814991p 1814991j 1814991] 1814991V 1814991T 1814991P 1814991O 1814991M 1814991I 1814991H 1814991G 1814991E 1814991; 1814991/ 1814991. 1814991- 1814991) 1814991' 1814991& 1814991% 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991{ 1814991r 1814991o 1814991n 1814991k 1814991h 1814991] 1814991P 1814991N 1814991J 1814991I 1814991; 18149914 18149913 18149911 1814991- 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991z 1814991x 1814991w 1814991p 1814991h 1814991g 1814991c 1814991Q 1814991O 1814991N 1814991G 1814991F 1814991C 1814991< 1814991: 18149916 1814991- 1814991, 1814991$ 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991y 1814991u 1814991r 1814991q 1814991o 1814991m 1814991f 1814991d 1814991_ 1814991U 1814991Q 1814991P 1814991O 1814991H 1814991G 1814991A 1814991@ 1814991: 18149916 18149911 1814991/ 1814991, 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991t 1814991r 1814991q 1814991o 1814991m 1814991] 1814991X 1814991S 1814991R 1814991A 1814991? 1814991= 1814991: 18149919 18149916 18149915 18149911 18149910 1814991/ 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991~ 1814991} 1814991z 1814991w 1814991u 1814991s 1814991d 1814991[ 1814991X 1814991P 1814991J 1814991? 1814991= 18149916 18149914 (S h A V | "4Se  ?/ ossec1008gxProcess exiting (killed).Feb 28 00:05:34 vm1 spamd[415405]: spamd: server killed by SIGTERM, shutting downT  -5' ossec13001gExim Auth failed2025-02-27 23:58:44 dovecot_plain authenticator failed for ([221.157.85.22]) [221.157.85.22]:46812: 535 Incorrect authentication data (set_id=sales)221.157.85.221835841j  -_) ossec13001gExim Auth failed2025-02-27 23:58:22 dovecot_plain authenticator failed for ([221.181.232.62]) [221.181.232.62]:41231: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)221.181.232.621814991]  -C+ ossec13001gdExim Auth failed2025-02-27 23:56:43 dovecot_plain authenticator failed for ([178.178.194.128]) [178.178.194.128]:38910: 535 Incorrect authentication data (set_id=services)178.178.194.1282017370j  -a' ossec13001gVExim Auth failed2025-02-27 23:56:29 dovecot_plain authenticator failed for ([88.204.52.137]) [88.204.52.137]:51802: 535 Incorrect authentication data (set_id=services@heipowersystem.com)88.204.52.1372017370Z  -?) ossec13001g!Exim Auth failed2025-02-27 23:47:05 dovecot_plain authenticator failed for ([206.72.249.212]) [206.72.231.218]:62048: 535 Incorrect authentication data (set_id=services)206.72.231.2186252001m  -e) ossec13001gExim Auth failed2025-02-27 23:46:35 dovecot_plain authenticator failed for ([124.115.177.38]) [124.115.177.38]:60189: 535 Incorrect authentication data (set_id=services@heipowersystem.com)124.115.177.381814991T  -5' ossec13001gExim Auth failed2025-02-27 23:45:56 dovecot_plain authenticator failed for ([31.173.66.222]) [31.173.66.222]:49262: 535 Incorrect authentication data (set_id=sales)31.173.66.2222017370g  -[' ossec13001gExim Auth failed2025-02-27 23:45:38 dovecot_plain authenticator failed for ([217.22.36.147]) [217.22.36.147]:46889: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)217.22.36.1473144096T  -7% ossec13001gExim Auth failed2025-02-27 23:37:23 dovecot_plain authenticator failed for ([58.18.90.114]) [58.18.90.114]:52391: 535 Incorrect authentication data (set_id=services)58.18.90.1141814991l  -e) ossec13001gExim Auth failed2025-02-27 23:36:50 dovecot_plain authenticator failed for ([89.144.187.114]) [89.144.187.114]:58525: 535 Incorrect authentication data (set_id=services@heipowersystem.com)89.144.187.114130758V  -7) ossec13001gExim Auth failed2025-02-27 23:34:14 dovecot_plain authenticator failed for ([58.226.255.240]) [58.226.255.240]:3347: 535 Incorrect authentication data (set_id=sales)58.226.255.2401835841g  -[' ossec13001gExim Auth failed2025-02-27 23:34:01 dovecot_plain authenticator failed for ([188.227.66.92]) [188.227.66.92]:49780: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)188.227.66.922017370# =?) ossec13008gMail Reciepient rejected2025-02-27 23:32:00 H=([104.167.223.55]) [104.167.223.55]:60624 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 CV=no F= rejected RCPT : SMTP AUTH is required for message submission on port 587104.167.223.556252001g  -[' ossec13001gExim Auth failed2025-02-27 23:23:13 dovecot_plain authenticator failed for ([61.153.208.38]) [61.153.208.38]:59358: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)61.153.208.381814991Q  -1% ossec13001gHExim Auth failed2025-02-27 23:22:06 dovecot_plain authenticator failed for ([111.4.120.19]) [111.4.120.19]:42854: 535 Incorrect authentication data (set_id=sales)111.4.120.191814991T  -5' ossec13001g<Exim Auth failed2025-02-27 23:21:54 dovecot_plain authenticator failed for ([61.153.208.38]) [61.153.208.38]:14806: 535 Incorrect authentication data (set_id=sales)61.153.208.381814991 ^* 9 I \ l  $L^j!  -_) ossec13001gXExim Auth failed2025-02-28 00:47:44 dovecot_plain authenticator failed for ([43.143.231.208]) [43.143.231.208]:34142: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)43.143.231.2081814991T  -5' ossec13001gExim Auth failed2025-02-28 00:40:30 dovecot_plain authenticator failed for ([61.153.208.38]) [61.153.208.38]:18225: 535 Incorrect authentication data (set_id=sales)61.153.208.381814991c  -W% ossec13001gExim Auth failed2025-02-28 00:39:54 dovecot_plain authenticator failed for ([94.202.11.67]) [94.202.11.67]:55207: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)94.202.11.67290557c  -O+ ossec13001gExim Auth failed2025-02-28 00:40:39 dovecot_plain authenticator failed for ip212-227-250-132.pbiaas.com [212.227.250.132]:48926: 535 Incorrect authentication data (set_id=sales)212.227.250.1323017382m  -e) ossec13001gExim Auth failed2025-02-28 00:38:01 dovecot_plain authenticator failed for ([200.106.49.149]) [200.106.49.149]:54662: 535 Incorrect authentication data (set_id=services@heipowersystem.com)200.106.49.1493932488]  -C+ ossec13001gExim Auth failed2025-02-28 00:27:11 dovecot_plain authenticator failed for ([211.238.237.254]) [211.238.237.254]:44195: 535 Incorrect authentication data (set_id=services)211.238.237.2541835841s  -s' ossec13001gyExim Auth failed2025-02-28 00:26:55 dovecot_plain authenticator failed for 83.106.54.198.in-addr.arpa [198.54.106.83]:61093: 535 Incorrect authentication data (set_id=services@heipowersystem.com)198.54.106.836252001Z  -=+ ossec13001gExim Auth failed2025-02-28 00:24:54 dovecot_plain authenticator failed for ([104.193.103.213]) [104.193.103.213]:53024: 535 Incorrect authentication data (set_id=sales)104.193.103.2136252001  -) ossec13001gExim Auth failed2025-02-28 00:24:41 dovecot_plain authenticator failed for ip-062-143-219-127.um16.pools.vodafone-ip.de [62.143.219.127]:59209: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)62.143.219.1272921044j  -a' ossec13001gExim Auth failed2025-02-28 00:21:01 dovecot_plain authenticator failed for ([95.191.34.249]) [95.191.34.249]:48682: 535 Incorrect authentication data (set_id=services@heipowersystem.com)95.191.34.2492017370Y  -?) ossec13001g*Exim Auth failed2025-02-28 00:21:22 dovecot_plain authenticator failed for ([213.57.214.111]) [213.57.214.111]:61141: 535 Incorrect authentication data (set_id=services)213.57.214.111294640l  -c+ ossec13001gExim Auth failed2025-02-28 00:12:04 dovecot_plain authenticator failed for ([196.192.176.249]) [196.192.176.249]:47876: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)196.192.176.249953987i  -a% ossec13001g Exim Auth failed2025-02-28 00:12:19 dovecot_plain authenticator failed for port-ip-88-150-6-165.reverse.mdcc-fun.de [88.150.6.165]:59787: 535 Incorrect authentication data (set_id=sales)88.150.6.1652921044l  -c) ossec13001gExim Auth failed2025-02-28 00:11:35 dovecot_plain authenticator failed for 93.135.220.111.sta.wbroadband.net.au [111.220.135.93]:48382: 535 Incorrect authentication data (set_id=services)111.220.135.932077456m  -e) ossec13001gExim Auth failed2025-02-28 00:10:56 dovecot_plain authenticator failed for ([196.28.226.124]) [196.28.226.124]:42074: 535 Incorrect authentication data (set_id=services@heipowersystem.com)196.28.226.1241036973T  -5' ossec13001gExim Auth failed2025-02-28 00:09:59 dovecot_plain authenticator failed for ([60.15.194.158]) [60.15.194.158]:56742: 535 Incorrect authentication data (set_id=sales)60.15.194.1581814991z  -' ossec13001glExim Auth failed2025-02-28 00:09:38 dovecot_plain authenticator failed for syn-156-019-080-138.biz.spectrum.com [156.19.80.138]:58841: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)156.19.80.1386252001 !0 U \ Zj1  -_) ossec13001gExim Auth failed2025-02-28 01:19:03 dovecot_plain authenticator failed for ([46.236.190.103]) [46.236.190.103]:52678: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)46.236.190.1032017370m0  -e) ossec13001gExim Auth failed2025-02-28 01:18:59 dovecot_plain authenticator failed for ([220.182.11.126]) [220.182.11.126]:57475: 535 Incorrect authentication data (set_id=services@heipowersystem.com)220.182.11.1261814991m/  -e) ossec13001g&Exim Auth failed2025-02-28 01:12:29 dovecot_plain authenticator failed for ([49.124.152.240]) [49.124.152.240]:51410: 535 Incorrect authentication data (set_id=services@heipowersystem.com)49.124.152.2401733045*.  3W+ ossec11301gNew FTP connection.Feb 28 01:10:05 vm1 pure-ftpd[720539]: (?@147.185.132.114) [INFO] New connection from 147.185.132.114147.185.132.1146252001=-  =s+ ossec13008gMail Reciepient rejected2025-02-28 01:06:09 H=(mail.fablixsolutions.com) [165.154.233.146]:55540 F= rejected RCPT : Rejected relay attempt: '165.154.233.146' From: 'vlhfa@fablixsolutions.com' To: 'goofile@fastmail.com'165.154.233.1461694008~,  - % ossec13001gyExim Auth failed2025-02-28 01:05:21 dovecot_plain authenticator failed for vps-79f20bfc.vps.ovh.net ([87.98.249.193]) [51.75.24.107]:22574: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)51.75.24.10730173823+  =a) ossec13008g-Mail Reciepient rejected2025-02-28 01:04:05 H=(mail.technobases.in) [165.154.208.70]:62114 F= rejected RCPT : Rejected relay attempt: '165.154.208.70' From: 'heancstci@technobases.in' To: 'goofile@fastmail.com'165.154.208.701668284i*  -]) ossec13001gExim Auth failed2025-02-28 01:02:25 dovecot_plain authenticator failed for c-73-106-172-226.hsd1.ga.comcast.net [73.106.172.226]:52682: 535 Incorrect authentication data (set_id=sales)73.106.172.2266252001s)  -u% ossec13001gExim Auth failed2025-02-28 01:02:07 dovecot_plain authenticator failed for wsip-70-169-19-52.hr.hr.cox.net [70.169.19.52]:43770: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)70.169.19.526252001T(  -7% ossec13001gExim Auth failed2025-02-28 00:58:05 dovecot_plain authenticator failed for ([59.99.153.21]) [59.99.153.21]:22662: 535 Incorrect authentication data (set_id=services)59.99.153.211269750p'  -i+ ossec13001gExim Auth failed2025-02-28 00:57:55 dovecot_plain authenticator failed for ([182.224.231.102]) [182.224.231.102]:60224: 535 Incorrect authentication data (set_id=services@heipowersystem.com)182.224.231.1021835841T&  -5' ossec13001gExim Auth failed2025-02-28 00:52:42 dovecot_login authenticator failed for ([31.134.243.37]) [31.134.243.37]:37420: 535 Incorrect authentication data (set_id=sales)31.134.243.372017370u%  -u) ossec13001gpExim Auth failed2025-02-28 00:52:23 dovecot_login authenticator failed for (ipoe-static.mosoblast.rt.ru) [89.109.233.181]:55080: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)89.109.233.1812017370W$  -;' ossec13001gPExim Auth failed2025-02-28 00:51:52 dovecot_plain authenticator failed for ([103.174.34.49]) [103.174.34.49]:55612: 535 Incorrect authentication data (set_id=services)103.174.34.491269750m#  -e) ossec13001g0Exim Auth failed2025-02-28 00:51:20 dovecot_plain authenticator failed for ([49.124.154.175]) [49.124.154.175]:40682: 535 Incorrect authentication data (set_id=services@heipowersystem.com)49.124.154.1751733045["  -G# ossec13001gdExim Auth failed2025-02-28 00:47:55 dovecot_plain authenticator failed for host-2-98-157-37.as13285.net [2.98.157.37]:58506: 535 Incorrect authentication data (set_id=sales)2.98.157.372635167 "D Y k m | ;J]'B  3S) ossec11301gNew FTP connection.Feb 28 01:41:38 vm1 pure-ftpd[726900]: (?@18.218.189.206) [INFO] New connection from 18.218.189.20618.218.189.2066252001(A 3S) ossec11301gƝNew FTP connection.Feb 28 01:40:03 vm1 pure-ftpd[726646]: (?@18.218.189.206) [INFO] New connection from 18.218.189.20618.218.189.2066252001i@  -_' ossec13001g)Exim Auth failed2025-02-28 01:38:09 dovecot_login authenticator failed for (csub-24-224-69-119.mi-connection.com) [24.224.69.119]:42716: 535 Incorrect authentication data (set_id=sales)24.224.69.1196252001m?  -c+ ossec13001g Exim Auth failed2025-02-28 01:37:37 dovecot_login authenticator failed for ([123.209.108.180]) [123.209.108.180]:37084: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)123.209.108.1802077456(> 3S) ossec11301gNew FTP connection.Feb 28 01:37:22 vm1 pure-ftpd[726001]: (?@18.218.189.206) [INFO] New connection from 18.218.189.20618.218.189.2066252001|=  -' ossec13001gmExim Auth failed2025-02-28 01:35:00 dovecot_login authenticator failed for c-71-193-102-94.hsd1.tn.comcast.net [71.193.102.94]:56438: 535 Incorrect authentication data (set_id=services@heipowersystem.com)71.193.102.946252001`<  -O% ossec13001gʼnExim Auth failed2025-02-28 01:35:29 dovecot_plain authenticator failed for 1-34-162-249.hinet-ip.hinet.net [1.34.162.249]:55894: 535 Incorrect authentication data (set_id=sales)1.34.162.2491668284;  -+ ossec13001g}Exim Auth failed2025-02-28 01:35:16 dovecot_plain authenticator failed for 122-151-131-211.sta.wbroadband.net.au [122.151.131.211]:39296: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)122.151.131.2112077456p:  -i+ ossec13001gExim Auth failed2025-02-28 01:28:26 dovecot_login authenticator failed for (fablixsolutions.com) [202.107.197.211]:40558: 535 Incorrect authentication data (set_id=sales@fablixsolutions.com)202.107.197.2111814991\9  -C) ossec13001gExim Auth failed2025-02-28 01:28:01 dovecot_login authenticator failed for (fablixsolutions.com) [124.160.63.122]:20351: 535 Incorrect authentication data (set_id=nologin)124.160.63.1221814991V8  -7) ossec13001gúExim Auth failed2025-02-28 01:27:46 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.152.249]:50482: 535 Incorrect authentication data (set_id=sales)191.36.152.2493469034m7  -c+ ossec13001géExim Auth failed2025-02-28 01:27:28 dovecot_plain authenticator failed for ([178.178.194.136]) [178.178.194.136]:43812: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)178.178.194.1362017370z6  -' ossec13001g Exim Auth failed2025-02-28 01:24:51 dovecot_plain authenticator failed for syn-076-176-206-019.res.spectrum.com [76.176.206.19]:58008: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)76.176.206.196252001j5  -a' ossec13001gExim Auth failed2025-02-28 01:24:18 dovecot_plain authenticator failed for ([106.227.87.29]) [106.227.87.29]:34350: 535 Incorrect authentication data (set_id=services@heipowersystem.com)106.227.87.291814991g4  -]' ossec13001gExim Auth failed2025-02-28 01:24:28 dovecot_plain authenticator failed for bzq-109-67-154-24.red.bezeqint.net [109.67.154.24]:40410: 535 Incorrect authentication data (set_id=services)109.67.154.24294640Z3  -?) ossec13001gExim Auth failed2025-02-28 01:19:25 dovecot_plain authenticator failed for ([121.190.129.68]) [121.190.129.68]:43244: 535 Incorrect authentication data (set_id=services)121.190.129.681835841Z2  -=+ ossec13001gExim Auth failed2025-02-28 01:19:15 dovecot_plain authenticator failed for ([218.149.228.169]) [218.149.228.169]:58725: 535 Incorrect authentication data (set_id=sales)218.149.228.1691835841 : -Pq}TS  -7% ossec13001g̫Exim Auth failed2025-02-28 02:05:55 dovecot_plain authenticator failed for ([27.24.141.90]) [27.24.141.90]:36868: 535 Incorrect authentication data (set_id=services)27.24.141.901814991pR  -i+ ossec13001g̟Exim Auth failed2025-02-28 02:05:43 dovecot_plain authenticator failed for ([171.244.142.135]) [171.244.142.135]:18657: 535 Incorrect authentication data (set_id=services@heipowersystem.com)171.244.142.1351562822[Q -A' ossec13001g˕Exim Auth failed2025-02-28 02:01:15 dovecot_login authenticator failed for (thepsindustries.com) [58.240.171.59]:50858: 535 Incorrect authentication data (set_id=nologin)58.240.171.591814991YP  -?) ossec13001g8Exim Auth failed2025-02-28 01:59:44 dovecot_plain authenticator failed for ([168.167.55.230]) [168.167.55.230]:40383: 535 Incorrect authentication data (set_id=services)168.167.55.230933860iO  -_' ossec13001g,Exim Auth failed2025-02-28 01:59:32 dovecot_plain authenticator failed for ([58.250.157.83]) [58.250.157.83]:2049: 535 Incorrect authentication data (set_id=services@heipowersystem.com)58.250.157.831814991QN  -1% ossec13001gExim Auth failed2025-02-28 01:57:54 dovecot_plain authenticator failed for ([95.54.40.239]) [95.54.40.239]:51756: 535 Incorrect authentication data (set_id=sales)95.54.40.2392017370dM  -W% ossec13001gʺExim Auth failed2025-02-28 01:57:37 dovecot_plain authenticator failed for ([58.22.255.28]) [58.22.255.28]:47737: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)58.22.255.281814991cL  -W# ossec13001gbExim Auth failed2025-02-28 01:51:53 dovecot_plain authenticator failed for c-24-7-216-47.hsd1.mn.comcast.net [24.7.216.47]:54408: 535 Incorrect authentication data (set_id=services)24.7.216.476252001gK  -]% ossec13001gLExim Auth failed2025-02-28 01:51:32 dovecot_plain authenticator failed for ([76.77.25.247]) [76.77.25.247]:40289: 535 Incorrect authentication data (set_id=services@heipowersystem.com)76.77.25.2476252001/J  =Y) ossec13008gȎMail Reciepient rejected2025-02-28 01:48:20 H=(mail.technobases.in) [165.154.208.84]:55967 F= rejected RCPT : Rejected relay attempt: '165.154.208.84' From: 'lhzedch@technobases.in' To: 'goofile@fastmail.com'165.154.208.841668284oI  -k) ossec13001gFExim Auth failed2025-02-28 01:47:08 dovecot_login authenticator failed for 212-72-203-252.ip.btc-net.bg [212.72.203.252]:41693: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)212.72.203.252732800yH  -}) ossec13001g0Exim Auth failed2025-02-28 01:46:46 dovecot_login authenticator failed for ([163.179.124.31]) [163.179.124.31]:45849: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)163.179.124.311814991QG  -1% ossec13001gExim Auth failed2025-02-28 01:45:43 dovecot_plain authenticator failed for ([74.95.13.185]) [74.95.13.185]:57268: 535 Incorrect authentication data (set_id=sales)74.95.13.1856252001jF  -_) ossec13001gExim Auth failed2025-02-28 01:45:25 dovecot_plain authenticator failed for ([94.190.222.124]) [94.190.222.124]:61292: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)94.190.222.1241819730'E  3S) ossec11301g6New FTP connection.Feb 28 01:42:35 vm1 pure-ftpd[727053]: (?@18.218.189.206) [INFO] New connection from 18.218.189.20618.218.189.2066252001TD  -7% ossec13001gExim Auth failed2025-02-28 01:42:08 dovecot_plain authenticator failed for ([46.0.130.216]) [46.0.130.216]:49632: 535 Incorrect authentication data (set_id=services)46.0.130.2162017370jC  -a' ossec13001gExim Auth failed2025-02-28 01:41:44 dovecot_plain authenticator failed for ([217.24.185.98]) [217.24.185.98]:41834: 535 Incorrect authentication data (set_id=services@heipowersystem.com)217.24.185.982017370 ' L Q ` 3Bhjd  -_) ossec13001gٶExim Auth failed2025-02-28 03:01:33 dovecot_plain authenticator failed for ([220.182.11.126]) [220.182.11.126]:45266: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)220.182.11.1261814991Pc  -1% ossec13001g$Exim Auth failed2025-02-28 02:54:50 dovecot_plain authenticator failed for ([212.50.48.86]) [212.50.48.86]:46400: 535 Incorrect authentication data (set_id=sales)212.50.48.86298795cb  -W% ossec13001gExim Auth failed2025-02-28 02:54:30 dovecot_plain authenticator failed for ([91.74.186.57]) [91.74.186.57]:47354: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)91.74.186.57290557Va  -;' ossec13001gExim Auth failed2025-02-28 02:50:18 dovecot_plain authenticator failed for ([91.239.23.149]) [91.239.23.149]:43010: 535 Incorrect authentication data (set_id=services)91.239.23.149458258m`  -e) ossec13001gExim Auth failed2025-02-28 02:50:04 dovecot_plain authenticator failed for ([58.210.188.130]) [58.210.188.130]:38647: 535 Incorrect authentication data (set_id=services@heipowersystem.com)58.210.188.1301814991g_  -]% ossec13001guExim Auth failed2025-02-28 02:43:24 dovecot_plain authenticator failed for ([103.4.103.61]) [103.4.103.61]:52312: 535 Incorrect authentication data (set_id=services@heipowersystem.com)103.4.103.611168579W^  -;' ossec13001gՃExim Auth failed2025-02-28 02:43:38 dovecot_plain authenticator failed for ([103.226.28.14]) [103.226.28.14]:54706: 535 Incorrect authentication data (set_id=services)103.226.28.141269750]]  -K# ossec13001gExim Auth failed2025-02-28 02:37:10 dovecot_plain authenticator failed for 37.151.71.8.dynamic.telecom.kz [37.151.71.8]:45488: 535 Incorrect authentication data (set_id=sales)37.151.71.81522867g\  -[' ossec13001gExim Auth failed2025-02-28 02:36:48 dovecot_plain authenticator failed for ([112.168.38.78]) [112.168.38.78]:45325: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)112.168.38.781835841N[  --# ossec13001gRExim Auth failed2025-02-28 02:30:02 dovecot_plain authenticator failed for ([49.0.129.12]) [49.0.129.12]:57230: 535 Incorrect authentication data (set_id=sales)49.0.129.122029969jZ  -_) ossec13001gDExim Auth failed2025-02-28 02:29:48 dovecot_plain authenticator failed for ([125.23.204.106]) [125.23.204.106]:50644: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)125.23.204.1061269750WY  -;' ossec13001g@Exim Auth failed2025-02-28 02:25:28 dovecot_plain authenticator failed for ([188.43.204.45]) [188.43.204.45]:48969: 535 Incorrect authentication data (set_id=services)188.43.204.452017370mX  -e) ossec13001g2Exim Auth failed2025-02-28 02:25:13 dovecot_plain authenticator failed for ([111.93.177.228]) [111.93.177.228]:59666: 535 Incorrect authentication data (set_id=services@heipowersystem.com)111.93.177.2281269750wW  -{' ossec13001gмExim Auth failed2025-02-28 02:23:14 dovecot_plain authenticator failed for ool-18be35b4.dyn.optonline.net [24.190.53.180]:36920: 535 Incorrect authentication data (set_id=services@heipowersystem.com)24.190.53.1806252001WV  -9) ossec13001gϜExim Auth failed2025-02-28 02:18:26 dovecot_plain authenticator failed for ([123.209.107.18]) [123.209.107.18]:42428: 535 Incorrect authentication data (set_id=sales)123.209.107.182077456gU  -[' ossec13001gϐExim Auth failed2025-02-28 02:18:15 dovecot_plain authenticator failed for ([82.208.71.101]) [82.208.71.101]:53206: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)82.208.71.1012017370jT  -_) ossec13001g̵Exim Auth failed2025-02-28 02:06:04 dovecot_plain authenticator failed for ([60.173.105.206]) [60.173.105.206]:43622: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)60.173.105.2061814991 % 3 E m | D\`Yu  -=) ossec13001g>Exim Auth failed2025-02-28 03:33:42 dovecot_login authenticator failed for ([222.128.44.171]) [222.128.44.171]:2049: 535 Incorrect authentication data (set_id=services)222.128.44.1711814991Tt  -5' ossec13001g4Exim Auth failed2025-02-28 03:33:32 dovecot_plain authenticator failed for ([27.72.151.114]) [27.72.151.114]:45674: 535 Incorrect authentication data (set_id=sales)27.72.151.1141562822xs  -% ossec13001g*Exim Auth failed2025-02-28 03:33:21 dovecot_plain authenticator failed for syn-076-169-081-036.res.spectrum.com [76.169.81.36]:33452: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)76.169.81.366252001dr  -Y# ossec13001g&Exim Auth failed2025-02-28 03:33:17 dovecot_login authenticator failed for ([14.98.28.43]) [14.98.28.43]:57722: 535 Incorrect authentication data (set_id=services@heipowersystem.com)14.98.28.431269750Wq  -9) ossec13001gExim Auth failed2025-02-28 03:32:38 dovecot_plain authenticator failed for ([61.143.241.150]) [61.143.241.150]:45515: 535 Incorrect authentication data (set_id=sales)61.143.241.1501814991ap  -S# ossec13001gExim Auth failed2025-02-28 03:32:25 dovecot_plain authenticator failed for ([27.96.91.71]) [27.96.91.71]:39608: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)27.96.91.711269750To  -5' ossec13001g߶Exim Auth failed2025-02-28 03:27:09 dovecot_login authenticator failed for ([191.59.251.95]) [191.59.251.95]:51276: 535 Incorrect authentication data (set_id=sales)191.59.251.953469034un  -y% ossec13001gߜExim Auth failed2025-02-28 03:26:43 dovecot_login authenticator failed for 95-30-217-31.broadband.corbina.ru [95.30.217.31]:58840: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)95.30.217.312017370Ym  -?) ossec13001g~Exim Auth failed2025-02-28 03:26:13 dovecot_plain authenticator failed for ([94.204.230.214]) [94.204.230.214]:42934: 535 Incorrect authentication data (set_id=services)94.204.230.214290557ml  -e) ossec13001gjExim Auth failed2025-02-28 03:25:52 dovecot_plain authenticator failed for ([218.98.160.119]) [218.98.160.117]:55277: 535 Incorrect authentication data (set_id=services@heipowersystem.com)218.98.160.1171814991Uk  -;' ossec13001gExim Auth failed2025-02-28 03:14:42 dovecot_plain authenticator failed for ([65.20.169.151]) [65.20.169.151]:33625: 535 Incorrect authentication data (set_id=services)65.20.169.15199237mj  -e) ossec13001gܷExim Auth failed2025-02-28 03:14:23 dovecot_plain authenticator failed for ([123.209.119.82]) [123.209.119.82]:54604: 535 Incorrect authentication data (set_id=services@heipowersystem.com)123.209.119.822077456Ti  -5' ossec13001g1Exim Auth failed2025-02-28 03:12:08 dovecot_plain authenticator failed for ([46.72.252.233]) [46.72.252.233]:48467: 535 Incorrect authentication data (set_id=sales)46.72.252.2332017370jh  -_) ossec13001g%Exim Auth failed2025-02-28 03:11:56 dovecot_plain authenticator failed for ([168.121.46.162]) [168.121.46.162]:47354: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)168.121.46.1623932488fg  -W) ossec13001g۽Exim Auth failed2025-02-28 03:10:12 dovecot_plain authenticator failed for 208.95.143.157.bbcs.as8758.net [157.143.95.208]:40585: 535 Incorrect authentication data (set_id=services)157.143.95.2082658434f  -+ ossec13001g۳Exim Auth failed2025-02-28 03:10:02 dovecot_plain authenticator failed for net-188-219-104-210.cust.vodafonedsl.it [188.219.104.210]:46029: 535 Incorrect authentication data (set_id=services@heipowersystem.com)188.219.104.2103175395We  -9) ossec13001gExim Auth failed2025-02-28 03:01:48 dovecot_plain authenticator failed for ([177.19.150.182]) [177.19.150.182]:53166: 535 Incorrect authentication data (set_id=sales)177.19.150.1823469034  ' G h c 47cd  -S) ossec13001gExim Auth failed2025-02-28 04:07:11 dovecot_plain authenticator failed for 155-61-202-109.kamensktel.ru [109.202.61.155]:41384: 535 Incorrect authentication data (set_id=services)109.202.61.1552017370i  -a' ossec13001gExim Auth failed2025-02-28 04:07:01 dovecot_plain authenticator failed for ([94.204.78.117]) [94.204.78.117]:45780: 535 Incorrect authentication data (set_id=services@heipowersystem.com)94.204.78.117290557Q  -3% ossec13001gExim Auth failed2025-02-28 04:01:01 dovecot_login authenticator failed for (User) [80.94.95.214]:53284: 535 Incorrect authentication data (set_id=0@technobases.in)80.94.95.214798549P  -1% ossec13001gpExim Auth failed2025-02-28 04:00:06 dovecot_login authenticator failed for ([94.205.82.33]) [94.205.82.33]:59403: 535 Incorrect authentication data (set_id=sales)94.205.82.33290557y  -}) ossec13001g`Exim Auth failed2025-02-28 03:59:50 dovecot_login authenticator failed for 83-233-242-245.cust.bredband2.com [83.233.242.245]:55424: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)83.233.242.2452661886W  -9) ossec13001gExim Auth failed2025-02-28 03:57:47 dovecot_plain authenticator failed for ([216.126.67.221]) [216.126.67.221]:54900: 535 Incorrect authentication data (set_id=sales)216.126.67.2216251999m  -c+ ossec13001gExim Auth failed2025-02-28 03:57:35 dovecot_plain authenticator failed for ([183.109.195.179]) [183.109.195.179]:33074: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)183.109.195.1791835841W  -?% ossec13001gtExim Auth failed2025-02-28 03:55:54 dovecot_login authenticator failed for (User) [87.120.93.10]:13324: 535 Incorrect authentication data (set_id=admin01@technobases.in)87.120.93.10732800U~  -;% ossec13001gOExim Auth failed2025-02-28 03:55:19 dovecot_login authenticator failed for (User) [87.120.93.10]:45982: 535 Incorrect authentication data (set_id=admin@technobases.in)87.120.93.10732800V}  -=% ossec13001gExim Auth failed2025-02-28 03:54:29 dovecot_login authenticator failed for (User) [87.120.93.10]:35978: 535 Incorrect authentication data (set_id=696969@technobases.in)87.120.93.10732800Q|  -3% ossec13001gExim Auth failed2025-02-28 03:53:43 dovecot_login authenticator failed for (User) [87.120.93.10]:36066: 535 Incorrect authentication data (set_id=0@technobases.in)87.120.93.10732800{  - + ossec13001gExim Auth failed2025-02-28 03:53:19 dovecot_plain authenticator failed for net-188-219-104-210.cust.vodafonedsl.it [188.219.104.210]:43448: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)188.219.104.2103175395[z  -G% ossec13001gExim Auth failed2025-02-28 03:49:49 dovecot_login authenticator failed for (User) [87.120.93.10]:54600: 535 Incorrect authentication data (set_id=fsafdfdsfds@technobases.in)87.120.93.10732800\y  -C+ ossec13001g{Exim Auth failed2025-02-28 03:47:31 dovecot_plain authenticator failed for ([196.200.227.194]) [196.200.227.194]:51966: 535 Incorrect authentication data (set_id=services)196.200.227.194149590gx  -]% ossec13001giExim Auth failed2025-02-28 03:47:12 dovecot_plain authenticator failed for ([103.4.103.61]) [103.4.103.61]:42234: 535 Incorrect authentication data (set_id=services@heipowersystem.com)103.4.103.611168579Ww  -;' ossec13001gExim Auth failed2025-02-28 03:34:56 dovecot_plain authenticator failed for ([27.45.236.182]) [27.45.236.182]:50542: 535 Incorrect authentication data (set_id=services)27.45.236.1821814991v  -+) ossec13001grExim Auth failed2025-02-28 03:34:34 dovecot_plain authenticator failed for ip4-193-93-156-147.blue-net.com.pl ([193.93.156.149]) [193.93.156.147]:60034: 535 Incorrect authentication data (set_id=services@heipowersystem.com)193.93.156.147798544 g 0 B j  37Zgo  -k' ossec13001gtExim Auth failed2025-02-28 05:08:28 dovecot_plain authenticator failed for 126.64.125.78.rev.sfr.net [78.125.64.126]:36574: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)78.125.64.1263017382Y  -A% ossec13001gLExim Auth failed2025-02-28 05:03:31 dovecot_plain authenticator failed for vps-79f20bfc.vps.ovh.net [51.75.24.107]:30728: 535 Incorrect authentication data (set_id=sales)51.75.24.1073017382x  -{) ossec13001g:Exim Auth failed2025-02-28 05:03:12 dovecot_plain authenticator failed for 89-179-241-253.static.corbina.ru [89.179.241.253]:58190: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)89.179.241.2532017370Z  -?) ossec13001gExim Auth failed2025-02-28 04:56:27 dovecot_plain authenticator failed for ([182.135.66.179]) [182.135.66.179]:43800: 535 Incorrect authentication data (set_id=services)182.135.66.1791814991c  -Y# ossec13001gExim Auth failed2025-02-28 04:55:55 dovecot_plain authenticator failed for ([5.30.215.71]) [5.30.215.71]:59475: 535 Incorrect authentication data (set_id=services@heipowersystem.com)5.30.215.71290557l  -c) ossec13001gExim Auth failed2025-02-28 04:45:36 dovecot_plain authenticator failed for syn-172-100-186-071.res.spectrum.com [172.100.186.71]:38190: 535 Incorrect authentication data (set_id=services)172.100.186.716252001p  -i+ ossec13001gExim Auth failed2025-02-28 04:45:19 dovecot_plain authenticator failed for ([121.152.119.174]) [121.152.119.174]:60674: 535 Incorrect authentication data (set_id=services@heipowersystem.com)121.152.119.1741835841W  -;' ossec13001g*Exim Auth failed2025-02-28 04:33:06 dovecot_plain authenticator failed for ([37.28.177.141]) [37.28.177.141]:39976: 535 Incorrect authentication data (set_id=services)37.28.177.1412017370p  -i+ ossec13001g"Exim Auth failed2025-02-28 04:32:57 dovecot_plain authenticator failed for ([178.178.194.136]) [178.178.194.136]:37660: 535 Incorrect authentication data (set_id=services@heipowersystem.com)178.178.194.1362017370v  -y' ossec13001gExim Auth failed2025-02-28 04:31:01 dovecot_plain authenticator failed for 111-70-23-250.emome-ip.hinet.net [111.70.23.250]:57597: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)111.70.23.2501668284V  -;' ossec13001g;Exim Auth failed2025-02-28 04:29:06 dovecot_plain authenticator failed for ([185.167.56.24]) [185.167.56.24]:44516: 535 Incorrect authentication data (set_id=services)185.167.56.24617790g  -]% ossec13001g$Exim Auth failed2025-02-28 04:28:42 dovecot_plain authenticator failed for ([50.43.62.166]) [50.43.62.166]:39638: 535 Incorrect authentication data (set_id=services@heipowersystem.com)50.43.62.1666252001T  -5' ossec13001gExim Auth failed2025-02-28 04:18:58 dovecot_plain authenticator failed for ([27.45.236.104]) [27.45.236.104]:34208: 535 Incorrect authentication data (set_id=sales)27.45.236.1041814991j  -_) ossec13001gExim Auth failed2025-02-28 04:18:42 dovecot_plain authenticator failed for ([223.82.241.146]) [223.82.241.146]:50812: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)223.82.241.1461814991k  -a) ossec13001gExim Auth failed2025-02-28 04:17:49 dovecot_plain authenticator failed for 47-158-210-137.lsan.ca.frontiernet.net [47.158.210.137]:34098: 535 Incorrect authentication data (set_id=sales)47.158.210.1376252001v  -y' ossec13001gExim Auth failed2025-02-28 04:17:38 dovecot_plain authenticator failed for c188-151-64-10.bredband.tele2.se [188.151.64.10]:47302: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)188.151.64.102661886c  -Y# ossec13001gcExim Auth failed2025-02-28 04:16:58 dovecot_plain authenticator failed for ([5.30.215.71]) [5.30.215.71]:36178: 535 Incorrect authentication data (set_id=services@heipowersystem.com)5.30.215.71290557 +"1 S e w  $6av+W(  -9) ossec13001gAExim Auth failed2025-02-28 05:54:33 dovecot_plain authenticator failed for ([1.71.191.42]) [61.134.212.242]:62652: 535 Incorrect authentication data (set_id=services)61.134.212.2421814991a'  -U! ossec13001g#Exim Auth failed2025-02-28 05:54:02 dovecot_plain authenticator failed for ([27.0.61.49]) [27.0.61.49]:55582: 535 Incorrect authentication data (set_id=services@heipowersystem.com)27.0.61.491269750f&  -Y' ossec13001gExim Auth failed2025-02-28 05:49:42 dovecot_plain authenticator failed for 179-189-85-66.goldnettelecom.com.br [179.189.85.66]:48694: 535 Incorrect authentication data (set_id=sales)179.189.85.663469034j%  -_) ossec13001g Exim Auth failed2025-02-28 05:49:24 dovecot_plain authenticator failed for ([203.221.63.196]) [203.221.63.196]:50495: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)203.221.63.1962077456c$  -U% ossec13001g]Exim Auth failed2025-02-28 05:46:28 dovecot_plain authenticator failed for 111-70-3-198.emome-ip.hinet.net [111.70.3.198]:48028: 535 Incorrect authentication data (set_id=services)111.70.3.1981668284j#  -a' ossec13001gQExim Auth failed2025-02-28 05:46:15 dovecot_plain authenticator failed for ([222.75.248.46]) [222.75.248.46]:36496: 535 Incorrect authentication data (set_id=services@heipowersystem.com)222.75.248.461814991Z"  -=+ ossec13001gExim Auth failed2025-02-28 05:39:55 dovecot_plain authenticator failed for ([220.120.224.227]) [220.120.224.227]:49376: 535 Incorrect authentication data (set_id=sales)220.120.224.2271835841g!  -[' ossec13001gExim Auth failed2025-02-28 05:39:43 dovecot_plain authenticator failed for ([91.122.31.214]) [91.122.31.214]:47797: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)91.122.31.2142017370Q  -1% ossec13001gTExim Auth failed2025-02-28 05:37:46 dovecot_plain authenticator failed for ([63.65.203.82]) [63.65.203.82]:51588: 535 Incorrect authentication data (set_id=sales)63.65.203.826252001j  -_) ossec13001g>Exim Auth failed2025-02-28 05:37:25 dovecot_plain authenticator failed for (mail.salee.co.kr) [220.90.239.158]:56711: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)220.90.239.1581835841v  -w) ossec13001gExim Auth failed2025-02-28 05:28:23 dovecot_plain authenticator failed for (azteca-comunicaciones.com) [186.148.187.91]:37960: 535 Incorrect authentication data (set_id=services@heipowersystem.com)186.148.187.913686110U  =#+ ossec13008gMail Reciepient rejected2025-02-28 05:22:20 H=(mail.westerndancecompany.com) [165.154.226.214]:58921 F= rejected RCPT : Rejected relay attempt: '165.154.226.214' From: 'nxejatpapbv@westerndancecompany.com' To: 'goofile@fastmail.com'165.154.226.2141668284j  -a' ossec13001gExim Auth failed2025-02-28 05:18:31 dovecot_plain authenticator failed for broadband-77-37-179-158.ip.moscow.rt.ru [77.37.179.158]:54204: 535 Incorrect authentication data (set_id=sales)77.37.179.1582017370j  -_) ossec13001gExim Auth failed2025-02-28 05:18:02 dovecot_plain authenticator failed for ([222.68.155.105]) [222.68.155.105]:58795: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)222.68.155.1051814991Z  -?) ossec13001gExim Auth failed2025-02-28 05:10:41 dovecot_plain authenticator failed for ([222.143.30.155]) [222.143.30.155]:38598: 535 Incorrect authentication data (set_id=services)222.143.30.1551814991m  -e) ossec13001gExim Auth failed2025-02-28 05:10:26 dovecot_plain authenticator failed for ([176.192.250.81]) [176.192.250.81]:55280: 535 Incorrect authentication data (set_id=services@heipowersystem.com)176.192.250.812017370Z  -=+ ossec13001gExim Auth failed2025-02-28 05:08:56 dovecot_plain authenticator failed for ([182.163.122.133]) [182.163.122.133]:15495: 535 Incorrect authentication data (set_id=sales)182.163.122.1331210997 )<, Y LcVI<wj]PC6)sfY?2% |obUH;.! 1 $  xk^D7{naTG:- tgZM*  @3&       }p s f X v i \ O B 5 (     r eQL > ~qdWJ=0#  { n a T G : K > 1 $  w j ] P C 6 ) -   zm`SF9/ 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991! 1814991 1814991 m 1814991 d 1814991 R 1814991 D 1814991 B 1814991 8 1814991 . 1814991 , 1814991  1814991  1814991  1814991  1814991  1814991 1814991 1814991 F 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991  1814991Q 1814991M 1814991! 1814991G 1814991> 1814991< 18149910 1814991- 1814991) 1814991 1814991! 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991l 1814991g 1814991Z 1814991! 1814991"c 1814991 1814991 1814991 1814991 1814991w 1814991p 1814991m 1814991a 1814991! 1814991A 1814991< 1814991; 1814991! 1814991& 1814991# 1814991 1814991" 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 $ 1814991 # 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991" 1814991 1814991 1814991 1814991 1814991 1814991 1814991" 1814991 1814991 1814991 1814991 1814991 1814991 1814991" 1814991 1814991"h 1814991 1814991"q 1814991 1814991 1814991 N 1814991 J 1814991 I 1814991 & [ 1814991 ) 1814991"r 1814991" 1814991" 1814991" 1814991" 1814991" 1814991" 1814991" 1814991" 1814991" 1814991" 1814991" 1814991" 1814991" 1814991"{9 1814991" 1814991" 1814991" 1814991" 1814991" 1814991" 1814991" 1814991" 1814991 1814991! 1814991! 1814991! 1814991! 1814991! 1814991! 1814991! 1814991! 1814991! 1814991! 1814991! 1814991! 1814991! 1814991! 1814991! 1814991! 1814991! 1814991!w 1814991!s 1814991!h 1814991!W 1814991!E 1814991!7 1814991!- 1814991!* 1814991!( 1814991!& 1814991!% 1814991!" 1814991! 1814991! 1814991 1814991 1814991 1814991 1814991 1814991"] 1814991"[ 1814991"Z 1814991"Q 1814991"P 1814991"K 1814991"J 1814991"= 1814991"< 1814991"/ 1814991", 1814991") 1814991"% 1814991" 1814991" 1814991 1814991 1814991 1814991 1814991 1814991 k 4 I  3J\$@kQ9  -1% ossec13001gExim Auth failed2025-02-28 06:45:08 dovecot_plain authenticator failed for ([103.68.38.78]) [103.68.38.78]:53620: 535 Incorrect authentication data (set_id=sales)103.68.38.781269750`8  -S# ossec13001gExim Auth failed2025-02-28 06:44:42 dovecot_plain authenticator failed for ([5.31.16.135]) [5.31.16.135]:46145: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)5.31.16.135290557k7  -a) ossec13001g Exim Auth failed2025-02-28 06:38:26 dovecot_plain authenticator failed for ([125.16.12.73]) [128.185.253.90]:38972: 535 Incorrect authentication data (set_id=services@heipowersystem.com)128.185.253.901269750E6  =+ ossec13008g wMail Reciepient rejected2025-02-28 06:33:51 H=(mail.thepsindustries.com) [165.154.226.214]:53252 F= rejected RCPT : Rejected relay attempt: '165.154.226.214' From: 'bzkwtdysc@thepsindustries.com' To: 'goofile@fastmail.com'165.154.226.2141668284j5  -c% ossec13001g Exim Auth failed2025-02-28 06:30:30 dovecot_plain authenticator failed for (nsg-static-172.125.76.182-airtel.com) [182.76.87.90]:47204: 535 Incorrect authentication data (set_id=services)182.76.87.901269750e4  -]% ossec13001g Exim Auth failed2025-02-28 06:30:11 dovecot_plain authenticator failed for ([65.20.128.78]) [65.20.128.78]:33186: 535 Incorrect authentication data (set_id=services@heipowersystem.com)65.20.128.7899237T3  -5' ossec13001g Exim Auth failed2025-02-28 06:26:23 dovecot_plain authenticator failed for ([1.244.246.221]) [1.244.246.221]:51614: 535 Incorrect authentication data (set_id=sales)1.244.246.2211835841g2  -[' ossec13001g Exim Auth failed2025-02-28 06:25:55 dovecot_plain authenticator failed for ([49.124.151.71]) [49.124.151.71]:54238: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)49.124.151.711733045i1  -a' ossec13001g*Exim Auth failed2025-02-28 06:15:30 dovecot_plain authenticator failed for ([94.205.250.78]) [94.205.250.78]:50871: 535 Incorrect authentication data (set_id=services@heipowersystem.com)94.205.250.78290557g0  -[' ossec13001gExim Auth failed2025-02-28 06:10:48 dovecot_plain authenticator failed for syn-024-090-169-209.res.spectrum.com [24.90.169.209]:51535: 535 Incorrect authentication data (set_id=sales)24.90.169.2096252001m/  -c+ ossec13001gExim Auth failed2025-02-28 06:10:37 dovecot_plain authenticator failed for ([171.244.142.135]) [171.244.142.135]:41958: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)171.244.142.1351562822.  -# ossec13001gExim Auth failed2025-02-28 06:01:30 dovecot_plain authenticator failed for 96-1-40-151-staticipeast.wireless.telus.com [96.1.40.151]:33983: 535 Incorrect authentication data (set_id=services@heipowersystem.com)96.1.40.1516251999W-  -9) ossec13001gExim Auth failed2025-02-28 05:59:56 dovecot_plain authenticator failed for ([192.34.128.202]) [192.34.128.202]:59414: 535 Incorrect authentication data (set_id=sales)192.34.128.2026252001',  3S) ossec11301gSNew FTP connection.Feb 28 05:59:06 vm1 pure-ftpd[780719]: (?@147.45.112.188) [INFO] New connection from 147.45.112.188147.45.112.1882134431g+  -[' ossec13001gmExim Auth failed2025-02-28 05:59:32 dovecot_plain authenticator failed for ([77.242.167.77]) [77.242.167.77]:40662: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)77.242.167.772658434S*  -5% ossec13001g3Exim Auth failed2025-02-28 05:58:34 dovecot_login authenticator failed for ([182.76.125.173]) [182.76.87.90]:59228: 535 Incorrect authentication data (set_id=sales)182.76.87.901269750q)  -q% ossec13001gExim Auth failed2025-02-28 05:57:49 dovecot_login authenticator failed for bb121-7-26-195.singnet.com.sg [121.7.26.195]:43126: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)121.7.26.1951880251 *\~tj`VLB8.$zpf\H>4*   v l b X N D : 0 &    ~ t j ` V L B 8 . $    z p f \ R H > 4 *  vlbXND:0&|rh^TJ@6,"xndZPF<2( ~tj`VLB8.$zpf\ | r h ^ T J @ 6 , "    x n d Z P F < 2 (   RRH>4*  vlbXND:0& gJr gJ gIu gI] gID gH gF{ gFq gER gEH gE4 gE" gD| gDn gB gB g@ g? g? g? g> g>y g< g< g e g$ d g$ c g#1 b g#' a g# ` g"5 _ g") ^ g! ] g! \ g! [ g!w Z g!e Y g X g W gS V g U g T gp S g R g Q g P g8 O g& N gV M g L g K gY J g? I g/ H g G g F g E gZ D g: C g B gW A g} @ gg ? g > g = g < g ; g` : g 9 g 8 g 7 g w 6 g 5 g 4 g 3 g 2 g* 1 g 0 g / g . g - gm + gS , g3 * g ) gA ( g# ' g & g % g] $ gQ # g " g ! gT g>  g  g  g  g  g  g  g  gt  gL  g:  g  g  g  g  g*  g"  g  g` g_ g^7 g^! g]E g]1 g\ g\ g\( gY gY gY gYr gX gX gX gX% gX gW gW gVu gV% gV gU gT gS2 gS$ gR gQ gP gP gO gOi gOS gNU gN+ gN gN gK gK gJ gJ gJ| g; g$ g g g g  gc  g  g  g  gp  g`  g  g gt gO g g g g g{ gi g gr g> g4 g* g& g g g߶ gߜ g~ gj g gܷ g1 g% g۽ g۳ g gٶ g` g$ g g g gՃ gu g g gR gD g@ g2 gм gϜ gϐ g̵ g̫ g̟ g˕ g8 g, g gʺ gb gL gȎ gF g0 g g g6 g g g gƝ g) g g gʼn g} gm g  #9?KtcI  -Y# ossec13001g?Exim Auth failed2025-02-28 07:32:38 dovecot_plain authenticator failed for ([95.0.252.76]) [95.0.252.76]:38364: 535 Incorrect authentication data (set_id=services@heipowersystem.com)95.0.252.76298795gH  -[' ossec13001g/Exim Auth failed2025-02-28 07:32:21 dovecot_plain authenticator failed for syn-131-148-000-202.biz.spectrum.com [131.148.0.202]:55923: 535 Incorrect authentication data (set_id=sales)131.148.0.2026252001mG  -c+ ossec13001gExim Auth failed2025-02-28 07:32:05 dovecot_plain authenticator failed for ([182.224.231.102]) [182.224.231.102]:50258: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)182.224.231.1021835841]F  -I% ossec13001gExim Auth failed2025-02-28 07:27:12 dovecot_plain authenticator failed for ti0004q160-7861.bb.online.no [95.34.158.19]:39014: 535 Incorrect authentication data (set_id=sales)95.34.158.193144096iE  -]) ossec13001gExim Auth failed2025-02-28 07:26:57 dovecot_plain authenticator failed for ([117.72.66.209]) [27.224.105.206]:31912: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)27.224.105.2061814991SD  -7% ossec13001gZExim Auth failed2025-02-28 07:20:18 dovecot_plain authenticator failed for ([20.46.45.121]) [20.46.45.121]:63049: 535 Incorrect authentication data (set_id=services)20.46.45.121290557pC  -i+ ossec13001g:Exim Auth failed2025-02-28 07:19:46 dovecot_plain authenticator failed for ([125.130.249.158]) [125.130.249.158]:56209: 535 Incorrect authentication data (set_id=services@heipowersystem.com)125.130.249.1581835841vB  -{% ossec13001gExim Auth failed2025-02-28 07:09:39 dovecot_plain authenticator failed for c-71-229-1-186.hsd1.al.comcast.net [71.229.1.186]:37862: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)71.229.1.1866252001fA  -[' ossec13001gWExim Auth failed2025-02-28 06:58:55 dovecot_plain authenticator failed for ([188.59.88.234]) [188.59.88.234]:52218: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)188.59.88.234298795W@  -;' ossec13001g}Exim Auth failed2025-02-28 06:59:31 dovecot_plain authenticator failed for ([64.52.161.161]) [64.52.161.161]:42750: 535 Incorrect authentication data (set_id=services)64.52.161.1616252001p?  -i+ ossec13001ggExim Auth failed2025-02-28 06:59:11 dovecot_plain authenticator failed for ([115.144.115.150]) [115.144.115.150]:52379: 535 Incorrect authentication data (set_id=services@heipowersystem.com)115.144.115.1501835841W>  -;' ossec13001gExim Auth failed2025-02-28 06:53:41 dovecot_plain authenticator failed for ([92.255.190.69]) [92.255.190.69]:38578: 535 Incorrect authentication data (set_id=services)92.255.190.692017370s=  -w# ossec13001gExim Auth failed2025-02-28 06:53:30 dovecot_plain authenticator failed for 111-70-9-41.emome-ip.hinet.net [111.70.9.41]:38988: 535 Incorrect authentication data (set_id=services@heipowersystem.com)111.70.9.411668284W<  -9) ossec13001gExim Auth failed2025-02-28 06:48:02 dovecot_plain authenticator failed for ([111.48.214.102]) [111.48.214.102]:63212: 535 Incorrect authentication data (set_id=sales)111.48.214.1021814991 ;  -%) ossec13001gExim Auth failed2025-02-28 06:47:51 dovecot_plain authenticator failed for ip4-193-93-156-147.blue-net.com.pl ([193.93.156.149]) [193.93.156.147]:43974: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)193.93.156.147798544M:  =+ ossec13008g`Mail Reciepient rejected2025-02-28 06:46:15 H=(mail.westerndancecompany.com) [165.154.210.114]:65104 F= rejected RCPT : Rejected relay attempt: '165.154.210.114' From: 'mgkjrhp@westerndancecompany.com' To: 'goofile@fastmail.com'165.154.210.1141694008 # K Z p  ~Y  - % ossec13001g!eExim Auth failed2025-02-28 08:07:24 dovecot_login authenticator failed for 111-70-19-63.emome-ip.hinet.net [111.70.19.63]:52115: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)111.70.19.631668284\X  -E' ossec13001gExim Auth failed2025-02-28 08:00:49 dovecot_plain authenticator failed for verholancev100.fvds.ru [91.132.57.103]:45318: 535 Incorrect authentication data (set_id=services)91.132.57.1032750405jW  -a' ossec13001gExim Auth failed2025-02-28 08:00:35 dovecot_plain authenticator failed for ([60.29.100.218]) [60.29.100.218]:57123: 535 Incorrect authentication data (set_id=services@heipowersystem.com)60.29.100.2181814991vV  -y' ossec13001gSExim Auth failed2025-02-28 07:58:33 dovecot_plain authenticator failed for h77-94-125-250.static.bashtel.ru [77.94.125.250]:50162: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)77.94.125.2502017370]U  -C+ ossec13001gExim Auth failed2025-02-28 07:57:29 dovecot_plain authenticator failed for ([119.164.217.166]) [119.164.217.166]:13289: 535 Incorrect authentication data (set_id=services)119.164.217.1661814991pT  -i+ ossec13001gExim Auth failed2025-02-28 07:57:15 dovecot_plain authenticator failed for ([176.212.190.170]) [176.212.190.170]:59052: 535 Incorrect authentication data (set_id=services@heipowersystem.com)176.212.190.1702017370;S  =q) ossec13008gpMail Reciepient rejected2025-02-28 07:50:31 H=(mail.heipowersystem.com) [165.154.213.22]:59820 F= rejected RCPT : Rejected relay attempt: '165.154.213.22' From: 'fuzjias@heipowersystem.com' To: 'goofile@fastmail.com'165.154.213.223469034dR  -W% ossec13001gExim Auth failed2025-02-28 07:46:58 dovecot_plain authenticator failed for ([2.192.150.40]) [2.192.150.40]:57512: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)2.192.150.403175395SQ  -3' ossec13001gExim Auth failed2025-02-28 07:46:55 dovecot_plain authenticator failed for visaustralia.com [216.70.104.41]:44062: 535 Incorrect authentication data (set_id=sales)216.70.104.416252001jP  -_) ossec13001gExim Auth failed2025-02-28 07:46:44 dovecot_plain authenticator failed for ([120.82.196.131]) [120.82.196.131]:46796: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)120.82.196.1311814991ZO  -?) ossec13001g8Exim Auth failed2025-02-28 07:45:19 dovecot_plain authenticator failed for ([123.209.200.21]) [123.209.200.21]:36826: 535 Incorrect authentication data (set_id=services)123.209.200.212077456fN  -]% ossec13001g&Exim Auth failed2025-02-28 07:45:01 dovecot_plain authenticator failed for ([45.93.94.125]) [45.93.94.125]:49618: 535 Incorrect authentication data (set_id=services@heipowersystem.com)45.93.94.125294640mM  -c+ ossec13001gVExim Auth failed2025-02-28 07:41:33 dovecot_plain authenticator failed for ([162.247.220.232]) [162.247.220.232]:46260: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)162.247.220.2323580718TL  -7% ossec13001gExim Auth failed2025-02-28 07:39:51 dovecot_plain authenticator failed for ([117.143.14.7]) [117.143.14.7]:34164: 535 Incorrect authentication data (set_id=services)117.143.14.71814991kK  -c' ossec13001gExim Auth failed2025-02-28 07:39:30 dovecot_plain authenticator failed for ([189.108.224.67]) [191.210.73.33]:49793: 535 Incorrect authentication data (set_id=services@heipowersystem.com)191.210.73.333469034jJ  -a' ossec13001gYExim Auth failed2025-02-28 07:33:05 dovecot_plain authenticator failed for ([116.86.62.245]) [116.86.62.245]:36545: 535 Incorrect authentication data (set_id=services@heipowersystem.com)116.86.62.2451880251 =# N # K NVq=Tj  -5' ossec13001g&VExim Auth failed2025-02-28 08:28:29 dovecot_plain authenticator failed for ([88.84.209.146]) [88.84.209.146]:57138: 535 Incorrect authentication data (set_id=sales)88.84.209.1462017370ji  -_) ossec13001g&LExim Auth failed2025-02-28 08:28:20 dovecot_plain authenticator failed for ([121.190.129.68]) [121.190.129.68]:51522: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)121.190.129.681835841ch  -S' ossec13001g%HExim Auth failed2025-02-28 08:23:59 dovecot_plain authenticator failed for p5098d833.dip0.t-ipconnect.de [80.152.216.51]:26604: 535 Incorrect authentication data (set_id=services)80.152.216.512921044mg  -e) ossec13001g%,Exim Auth failed2025-02-28 08:23:32 dovecot_plain authenticator failed for ([222.114.84.175]) [222.114.84.175]:36562: 535 Incorrect authentication data (set_id=services@heipowersystem.com)222.114.84.1751835841ff  -[% ossec13001g$JExim Auth failed2025-02-28 08:19:44 dovecot_plain authenticator failed for c-24-19-45-106.hsd1.wa.comcast.net [24.19.45.106]:59364: 535 Incorrect authentication data (set_id=services)24.19.45.1066252001ee  -]% ossec13001g$>Exim Auth failed2025-02-28 08:19:33 dovecot_plain authenticator failed for ([46.161.196.5]) [46.161.196.5]:41006: 535 Incorrect authentication data (set_id=services@heipowersystem.com)46.161.196.599237Td  -5' ossec13001g$Exim Auth failed2025-02-28 08:19:00 dovecot_plain authenticator failed for ([118.218.10.21]) [118.218.10.21]:34596: 535 Incorrect authentication data (set_id=sales)118.218.10.211835841gc  -[' ossec13001g$ Exim Auth failed2025-02-28 08:18:43 dovecot_plain authenticator failed for ([177.207.248.5]) [177.207.248.5]:54161: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)177.207.248.53469034ab  -O' ossec13001g#1Exim Auth failed2025-02-28 08:15:04 dovecot_login authenticator failed for (pppoe-static.mosoblast.rt.ru) [77.51.214.170]:47239: 535 Incorrect authentication data (set_id=sales)77.51.214.1702017370ta  -s) ossec13001g#'Exim Auth failed2025-02-28 08:14:54 dovecot_login authenticator failed for 17.sub-166-248-194.myvzw.com [166.248.194.17]:57798: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)166.248.194.176252001y`  -}) ossec13001g#Exim Auth failed2025-02-28 08:14:28 dovecot_login authenticator failed for ([117.158.243.50]) [117.158.243.50]:42566: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)117.158.243.501814991T_  -5' ossec13001g"5Exim Auth failed2025-02-28 08:10:53 dovecot_plain authenticator failed for ([182.213.57.49]) [182.213.57.49]:35912: 535 Incorrect authentication data (set_id=sales)182.213.57.491835841c^  -W% ossec13001g")Exim Auth failed2025-02-28 08:10:41 dovecot_plain authenticator failed for ([185.167.56.2]) [185.167.56.2]:55900: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)185.167.56.2617790@]  =y+ ossec13008g!Mail Reciepient rejected2025-02-28 08:09:19 H=(mail.heipowersystem.com) [165.154.228.156]:53344 F= rejected RCPT : Rejected relay attempt: '165.154.228.156' From: 'roglvwdw@heipowersystem.com' To: 'goofile@fastmail.com'165.154.228.1561643084Q\  -3# ossec13001g!Exim Auth failed2025-02-28 08:08:20 dovecot_plain authenticator failed for ([58.18.42.74]) [58.18.42.74]:39994: 535 Incorrect authentication data (set_id=services)58.18.42.741814991p[  -i+ ossec13001g!Exim Auth failed2025-02-28 08:08:06 dovecot_plain authenticator failed for ([163.204.112.147]) [163.204.112.147]:41756: 535 Incorrect authentication data (set_id=services@heipowersystem.com)163.204.112.1471814991eZ  -S+ ossec13001g!wExim Auth failed2025-02-28 08:07:43 dovecot_login authenticator failed for ([185.235.212.105]) [185.235.212.105]:59043: 535 Incorrect authentication data (set_id=vikas.khandelwal)185.235.212.1053202326 ~  !sjz  -a' ossec13001g+Exim Auth failed2025-02-28 08:51:29 dovecot_plain authenticator failed for ([103.65.227.12]) [103.65.227.12]:36786: 535 Incorrect authentication data (set_id=services@heipowersystem.com)103.65.227.121210997dy  -W% ossec13001g+Exim Auth failed2025-02-28 08:50:35 dovecot_plain authenticator failed for ([36.33.201.45]) [36.33.201.45]:44708: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)36.33.201.451814991*x a-' ossec5710g*Attempt to login using a non-existent userFeb 28 08:48:20 vm1 sshd[815947]: Invalid user nid from 54.159.59.224 port 5645554.159.59.2246252001Rw  E' ossec2501g*User authentication failure.Feb 28 08:48:21 vm1 sshd[815947]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.159.59.22454.159.59.2246252001jv  Q;) ossec11000g*Login failed on the cpanel service[2025-02-28 08:47:43 +0530] info [whostmgrd] 180.252.117.21 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect180.252.117.211643084Su  -5' ossec13001g)Exim Auth failed2025-02-28 08:43:43 dovecot_plain authenticator failed for ([188.59.178.35]) [188.59.178.35]:50979: 535 Incorrect authentication data (set_id=sales)188.59.178.35298795gt  -[' ossec13001g)Exim Auth failed2025-02-28 08:43:15 dovecot_plain authenticator failed for ([186.177.28.83]) [186.177.28.83]:51244: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)186.177.28.833624060^s  =5+ ossec13008g)kMail Reciepient rejected2025-02-28 08:41:38 H=(mail.shivelectricaltransformers.com) [165.154.213.136]:56848 F= rejected RCPT : Rejected relay attempt: '165.154.213.136' From: 'qhjyt@shivelectricaltransformers.com' To: 'goofile@fastmail.com'165.154.213.1363469034jr  -a' ossec13001g)AExim Auth failed2025-02-28 08:40:57 dovecot_plain authenticator failed for syn-045-049-179-157.res.spectrum.com [45.49.179.157]:50622: 535 Incorrect authentication data (set_id=services)45.49.179.1576252001mq  -e) ossec13001g)7Exim Auth failed2025-02-28 08:40:46 dovecot_plain authenticator failed for ([222.68.155.105]) [222.68.155.105]:33893: 535 Incorrect authentication data (set_id=services@heipowersystem.com)222.68.155.1051814991]p -E' ossec13001g(OExim Auth failed2025-02-28 08:36:53 dovecot_login authenticator failed for (s2seducationtrust.com) [221.229.216.1]:42630: 535 Incorrect authentication data (set_id=nologin)221.229.216.11814991zo  -' ossec13001g()Exim Auth failed2025-02-28 08:36:16 dovecot_login authenticator failed for b217-29-190-97.pppoe.mark-itt.net [217.29.190.97]:50308: 535 Incorrect authentication data (set_id=services@heipowersystem.com)217.29.190.972017370dn  -W% ossec13001g'Exim Auth failed2025-02-28 08:33:37 dovecot_plain authenticator failed for ([50.99.36.130]) [50.99.36.130]:53438: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)50.99.36.1306251999Wm  -;' ossec13001g'Exim Auth failed2025-02-28 08:31:21 dovecot_plain authenticator failed for ([159.75.92.136]) [159.75.92.136]:41208: 535 Incorrect authentication data (set_id=services)159.75.92.1361814991pl  -i+ ossec13001g&Exim Auth failed2025-02-28 08:31:08 dovecot_plain authenticator failed for ([123.209.117.171]) [123.209.117.171]:35046: 535 Incorrect authentication data (set_id=services@heipowersystem.com)123.209.117.1712077456~k  Ua' ossec11001g&Deferred login on the cpanel service[2025-02-28 08:29:20 +0530] info [webmaild] 157.38.133.33 - kps@amplifypowerglobal.com "POST /cpsess4666922852/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [157.38.132.61] != Current IP Address [157.38.133.33]157.38.133.331269750 ="! - < V [ <>=}  -+ ossec13001g2Exim Auth failed2025-02-28 09:20:35 dovecot_plain authenticator failed for (165-220-169-113.cust.exede.net) [165.220.169.113]:48499: 535 Incorrect authentication data (set_id=services@heipowersystem.com)165.220.169.1132635167z  -' ossec13001g0yExim Auth failed2025-02-28 09:11:45 dovecot_plain authenticator failed for c-85-228-121-10.bbcust.telenor.se [85.228.121.10]:42044: 535 Incorrect authentication data (set_id=services@heipowersystem.com)85.228.121.102661886W  -9) ossec13001g0cExim Auth failed2025-02-28 09:11:22 dovecot_plain authenticator failed for ([131.161.184.58]) [131.161.184.58]:55620: 535 Incorrect authentication data (set_id=sales)131.161.184.583865483j  -_) ossec13001g0WExim Auth failed2025-02-28 09:11:10 dovecot_plain authenticator failed for ([74.196.184.120]) [74.196.184.120]:35096: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)74.196.184.1206252001_  -O% ossec13001g0OExim Auth failed2025-02-28 09:11:01 dovecot_login authenticator failed for ([196.0.89.118]) [196.0.89.118]:60147: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)196.0.89.118226074|  -+ ossec13001g0+Exim Auth failed2025-02-28 09:10:27 dovecot_login authenticator failed for ([103.186.221.174]) [103.186.221.174]:49350: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)103.186.221.1741269750W  -9) ossec13001g/Exim Auth failed2025-02-28 09:08:33 dovecot_plain authenticator failed for ([60.171.237.143]) [60.171.237.143]:46377: 535 Incorrect authentication data (set_id=sales)60.171.237.1431814991d  -W% ossec13001g/Exim Auth failed2025-02-28 09:08:15 dovecot_plain authenticator failed for ([1.247.245.61]) [1.247.245.61]:55004: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)1.247.245.611835841f  -]# ossec13001g.Exim Auth failed2025-02-28 09:04:22 dovecot_plain authenticator failed for syn-071-091-077-097.res.spectrum.com [71.91.77.97]:54448: 535 Incorrect authentication data (set_id=services)71.91.77.976252001j  -a' ossec13001g.Exim Auth failed2025-02-28 09:03:56 dovecot_plain authenticator failed for ([103.65.227.12]) [103.65.227.12]:58357: 535 Incorrect authentication data (set_id=services@heipowersystem.com)103.65.227.121210997T  -5' ossec13001g.@Exim Auth failed2025-02-28 09:02:16 dovecot_plain authenticator failed for ([61.133.10.205]) [61.133.10.204]:49238: 535 Incorrect authentication data (set_id=sales)61.133.10.2041814991w  -y) ossec13001g.6Exim Auth failed2025-02-28 09:02:06 dovecot_plain authenticator failed for (154.205.26.218.internet.sx.cn) [218.26.205.154]:41756: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)218.26.205.1541814991b  -O) ossec13001g.Exim Auth failed2025-02-28 09:01:29 dovecot_login authenticator failed for 83-151-229-183.dsl.cnl.uk.net [83.151.229.183]:39971: 535 Incorrect authentication data (set_id=sales)83.151.229.1832635167m~  -c+ ossec13001g.Exim Auth failed2025-02-28 09:01:18 dovecot_login authenticator failed for ([104.193.103.213]) [104.193.103.213]:42320: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)104.193.103.2136252001p}  -k) ossec13001g,Exim Auth failed2025-02-28 08:55:20 dovecot_plain authenticator failed for broadband-188-255-34-171.ip.moscow.rt.ru [188.255.34.171]:51262: 535 Incorrect authentication data (set_id=services)188.255.34.1712017370}|  -+ ossec13001g,~Exim Auth failed2025-02-28 08:54:44 dovecot_plain authenticator failed for (165-220-154-126.cust.exede.net) [165.220.154.126]:36592: 535 Incorrect authentication data (set_id=services@heipowersystem.com)165.220.154.1263175395Z{  -?) ossec13001g+Exim Auth failed2025-02-28 08:51:46 dovecot_plain authenticator failed for ([221.161.16.240]) [221.161.16.240]:41294: 535 Incorrect authentication data (set_id=services)221.161.16.2401835841 . C M _ 1@hZ  -=+ ossec13001g;hExim Auth failed2025-02-28 09:58:24 dovecot_plain authenticator failed for ([211.221.130.246]) [211.221.130.246]:40296: 535 Incorrect authentication data (set_id=sales)211.221.130.2461835841T  -3) ossec13001g;`Exim Auth failed2025-02-28 09:58:16 dovecot_plain authenticator failed for p278251-obmd01.tokyo.ocn.ne.jp [180.41.109.250]:42078: 535 Incorrect authentication data180.41.109.2501861060m  -c+ ossec13001g;JExim Auth failed2025-02-28 09:57:53 dovecot_plain authenticator failed for ([119.198.191.130]) [119.198.191.130]:43505: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)119.198.191.1301835841P  -1% ossec13001g9+Exim Auth failed2025-02-28 09:48:51 dovecot_plain authenticator failed for ([94.205.82.33]) [94.205.82.33]:33573: 535 Incorrect authentication data (set_id=sales)94.205.82.33290557a  -S# ossec13001g9!Exim Auth failed2025-02-28 09:48:40 dovecot_plain authenticator failed for ([70.90.99.29]) [70.90.99.29]:33912: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)70.90.99.296252001s  -q) ossec13001g9 Exim Auth failed2025-02-28 09:48:18 dovecot_plain authenticator failed for (azteca-comunicaciones.com) [186.148.187.91]:45038: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)186.148.187.913686110f  -Y' ossec13001g8Exim Auth failed2025-02-28 09:46:46 dovecot_plain authenticator failed for (rw-00130-94.59.137.rcil.gov.in) [137.59.94.130]:49542: 535 Incorrect authentication data (set_id=services)137.59.94.1301269750m  -e) ossec13001g8Exim Auth failed2025-02-28 09:46:38 dovecot_plain authenticator failed for ([178.178.222.58]) [178.178.222.58]:42276: 535 Incorrect authentication data (set_id=services@heipowersystem.com)178.178.222.582017370b  -W% ossec13001g6Exim Auth failed2025-02-28 09:39:19 dovecot_plain authenticator failed for ([46.161.196.5]) [46.161.196.5]:53826: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)46.161.196.599237m  -e) ossec13001g5|Exim Auth failed2025-02-28 09:33:07 dovecot_plain authenticator failed for ([117.32.132.170]) [117.32.132.170]:44920: 535 Incorrect authentication data (set_id=services@heipowersystem.com)117.32.132.1701814991m  -e) ossec13001g4Exim Auth failed2025-02-28 09:29:09 dovecot_plain authenticator failed for ([200.106.49.149]) [200.106.49.149]:40326: 535 Incorrect authentication data (set_id=services@heipowersystem.com)200.106.49.1493932488W  -;' ossec13001g4Exim Auth failed2025-02-28 09:29:25 dovecot_plain authenticator failed for ([1.221.243.126]) [1.221.243.126]:35622: 535 Incorrect authentication data (set_id=services)1.221.243.1261835841j  -_) ossec13001g3Exim Auth failed2025-02-28 09:25:45 dovecot_plain authenticator failed for 57-132-150-162.dyn.grandenetworks.net [57.132.150.162]:54820: 535 Incorrect authentication data (set_id=sales)57.132.150.1626252001r  -s% ossec13001g3Exim Auth failed2025-02-28 09:25:35 dovecot_plain authenticator failed for 89-109-4-133.dynamic.mts-nn.ru [89.109.4.133]:50873: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)89.109.4.1332017370g  -[' ossec13001g3Exim Auth failed2025-02-28 09:24:50 dovecot_plain authenticator failed for syn-068-184-049-166.res.spectrum.com [68.184.49.166]:46106: 535 Incorrect authentication data (set_id=sales)68.184.49.1666252001d  -W% ossec13001g3Exim Auth failed2025-02-28 09:24:40 dovecot_plain authenticator failed for ([36.33.201.45]) [36.33.201.45]:46006: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)36.33.201.451814991f  -W) ossec13001g2Exim Auth failed2025-02-28 09:21:07 dovecot_plain authenticator failed for (ws60-209.199.103.rcil.gov.in) [103.199.209.60]:47892: 535 Incorrect authentication data (set_id=services)103.199.209.601269750 * L ;PbW-  -;' ossec13001gE4Exim Auth failed2025-02-28 10:40:11 dovecot_plain authenticator failed for ([112.173.61.81]) [112.173.61.81]:56700: 535 Incorrect authentication data (set_id=services)112.173.61.811835841m,  -e) ossec13001gE"Exim Auth failed2025-02-28 10:39:53 dovecot_plain authenticator failed for ([186.138.219.91]) [186.138.219.91]:43753: 535 Incorrect authentication data (set_id=services@heipowersystem.com)186.138.219.913865483T+  -5' ossec13001gD|Exim Auth failed2025-02-28 10:37:08 dovecot_plain authenticator failed for ([31.173.66.222]) [31.173.66.222]:37464: 535 Incorrect authentication data (set_id=sales)31.173.66.2222017370e*  -[' ossec13001gDnExim Auth failed2025-02-28 10:36:53 dovecot_plain authenticator failed for ([65.20.235.206]) [65.20.235.206]:40593: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)65.20.235.20699237R)  -7% ossec13001gBExim Auth failed2025-02-28 10:26:55 dovecot_plain authenticator failed for ([65.20.171.20]) [65.20.171.20]:59899: 535 Incorrect authentication data (set_id=services)65.20.171.2099237j(  -a' ossec13001gBExim Auth failed2025-02-28 10:26:34 dovecot_plain authenticator failed for ([170.250.128.5]) [170.250.128.5]:44096: 535 Incorrect authentication data (set_id=services@heipowersystem.com)170.250.128.56252001g'  -[' ossec13001g@Exim Auth failed2025-02-28 10:20:47 dovecot_plain authenticator failed for ([176.62.82.235]) [176.62.82.235]:51454: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)176.62.82.2352017370T&  -5' ossec13001g?Exim Auth failed2025-02-28 10:16:05 dovecot_plain authenticator failed for ([91.126.196.67]) [91.126.196.67]:47152: 535 Incorrect authentication data (set_id=sales)91.126.196.672510769d%  -W% ossec13001g?Exim Auth failed2025-02-28 10:15:55 dovecot_plain authenticator failed for ([1.237.137.30]) [1.237.137.30]:57268: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)1.237.137.301835841y$  -}) ossec13001g?Exim Auth failed2025-02-28 10:13:44 dovecot_plain authenticator failed for 110-25-105-223.adsl.fetnet.net [110.25.105.223]:33555: 535 Incorrect authentication data (set_id=services@heipowersystem.com)110.25.105.2231668284v#  -u+ ossec13001g>Exim Auth failed2025-02-28 10:11:52 dovecot_login authenticator failed for (s2seducationtrust.com) [111.122.211.212]:18938: 535 Incorrect authentication data (set_id=service@s2seducationtrust.com)111.122.211.2121814991`"  -I+ ossec13001g>yExim Auth failed2025-02-28 10:11:27 dovecot_login authenticator failed for (s2seducationtrust.com) [111.122.211.212]:15310: 535 Incorrect authentication data (set_id=nologin)111.122.211.2121814991I! A ' ossec11302g<FTP Authentication failed.Feb 28 10:04:10 vm1 pure-ftpd[832240]: (?@122.177.1.185) [WARNING] Authentication failed for user [user@s2seducationtrust.com]122.177.1.1851269750% 3O' ossec11301g<New FTP connection.Feb 28 10:04:05 vm1 pure-ftpd[832240]: (?@122.177.1.185) [INFO] New connection from 122.177.1.185122.177.1.1851269750Z  -?) ossec13001g  -9) ossec13001gNExim Auth failed2025-02-28 11:18:12 dovecot_plain authenticator failed for ([223.82.241.133]) [223.82.241.133]:44074: 535 Incorrect authentication data (set_id=sales)223.82.241.1331814991g=  -[' ossec13001gN Exim Auth failed2025-02-28 11:17:54 dovecot_plain authenticator failed for ([217.22.36.147]) [217.22.36.147]:43882: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)217.22.36.1473144096]<  -C+ ossec13001gKExim Auth failed2025-02-28 11:07:42 dovecot_plain authenticator failed for ([119.206.117.105]) [119.206.117.105]:57704: 535 Incorrect authentication data (set_id=services)119.206.117.1051835841m;  -e) ossec13001gKExim Auth failed2025-02-28 11:07:19 dovecot_plain authenticator failed for ([122.170.14.161]) [122.170.14.161]:33367: 535 Incorrect authentication data (set_id=services@heipowersystem.com)122.170.14.1611269750W:  -9) ossec13001gJExim Auth failed2025-02-28 11:03:20 dovecot_plain authenticator failed for ([95.105.113.109]) [95.105.113.109]:43894: 535 Incorrect authentication data (set_id=sales)95.105.113.1092017370g9  -[' ossec13001gJExim Auth failed2025-02-28 11:03:08 dovecot_plain authenticator failed for ([112.4.150.142]) [112.4.150.142]:38434: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)112.4.150.1421814991Q8  -1% ossec13001gJ|Exim Auth failed2025-02-28 11:02:43 dovecot_login authenticator failed for ([223.171.62.3]) [223.171.62.3]:36240: 535 Incorrect authentication data (set_id=sales)223.171.62.31835841g7  -[' ossec13001gJrExim Auth failed2025-02-28 11:02:33 dovecot_login authenticator failed for ([118.38.239.52]) [118.38.239.52]:55810: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)118.38.239.521835841g6  -]% ossec13001gJExim Auth failed2025-02-28 11:00:38 dovecot_plain authenticator failed for ([74.95.13.185]) [74.95.13.185]:50268: 535 Incorrect authentication data (set_id=services@heipowersystem.com)74.95.13.1856252001Z5  -?) ossec13001gIuExim Auth failed2025-02-28 10:58:20 dovecot_login authenticator failed for ([116.148.103.34]) [116.148.103.34]:55790: 535 Incorrect authentication data (set_id=services)116.148.103.341814991l4  -e) ossec13001gI]Exim Auth failed2025-02-28 10:57:57 dovecot_login authenticator failed for ([94.204.208.189]) [94.204.208.189]:34710: 535 Incorrect authentication data (set_id=services@heipowersystem.com)94.204.208.189290557g3  -]% ossec13001gIDExim Auth failed2025-02-28 10:57:30 dovecot_login authenticator failed for ([180.7.189.60]) [180.7.189.60]:37716: 535 Incorrect authentication data (set_id=services@heipowersystem.com)180.7.189.601861060c2  -W% ossec13001gHExim Auth failed2025-02-28 10:56:00 dovecot_plain authenticator failed for ([45.93.94.125]) [45.93.94.125]:40290: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)45.93.94.125294640p1  -k) ossec13001gF{Exim Auth failed2025-02-28 10:45:38 dovecot_plain authenticator failed for pool-96-249-234-242.nrflva.fios.verizon.net [96.249.234.242]:54632: 535 Incorrect authentication data (set_id=sales)96.249.234.24262520010  -) ossec13001gFqExim Auth failed2025-02-28 10:45:27 dovecot_plain authenticator failed for (145.37.212.118.adsl-pool.jx.chinaunicom.com) [118.212.37.145]:32773: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)118.212.37.1451814991Z/  -?) ossec13001gERExim Auth failed2025-02-28 10:40:41 dovecot_plain authenticator failed for ([194.53.178.132]) [194.53.178.132]:58670: 535 Incorrect authentication data (set_id=services)194.53.178.1323175395o.  -i+ ossec13001gEHExim Auth failed2025-02-28 10:40:31 dovecot_plain authenticator failed for ([196.200.227.194]) [196.200.227.194]:50402: 535 Incorrect authentication data (set_id=services@heipowersystem.com)196.200.227.194149590 5%1 G l Xj95O  - ' ossec13001gWExim Auth failed2025-02-28 11:59:21 dovecot_plain authenticator failed for broadband-95-84-158-215.ip.moscow.rt.ru [95.84.158.215]:57622: 535 Incorrect authentication data (set_id=services@heipowersystem.com)95.84.158.2152017370$N  3O' ossec11301gVuNew FTP connection.Feb 28 11:53:48 vm1 pure-ftpd[855928]: (?@20.221.66.212) [INFO] New connection from 20.221.66.21220.221.66.2126252001jM  -a' ossec13001gV%Exim Auth failed2025-02-28 11:52:28 dovecot_plain authenticator failed for syn-108-189-041-081.biz.spectrum.com [108.189.41.81]:49845: 535 Incorrect authentication data (set_id=services)108.189.41.816252001jL  -a' ossec13001gVExim Auth failed2025-02-28 11:52:12 dovecot_plain authenticator failed for ([31.133.71.204]) [31.133.71.204]:52776: 535 Incorrect authentication data (set_id=services@heipowersystem.com)31.133.71.2042017370]K  -C+ ossec13001gUExim Auth failed2025-02-28 11:48:04 dovecot_plain authenticator failed for ([121.178.185.141]) [121.178.185.141]:45230: 535 Incorrect authentication data (set_id=services)121.178.185.1411835841pJ  -i+ ossec13001gTExim Auth failed2025-02-28 11:47:16 dovecot_plain authenticator failed for ([103.219.154.156]) [103.219.154.156]:51490: 535 Incorrect authentication data (set_id=services@heipowersystem.com)103.219.154.1562750405TI  -5' ossec13001gS2Exim Auth failed2025-02-28 11:39:53 dovecot_plain authenticator failed for ([182.135.66.27]) [182.135.66.27]:51928: 535 Incorrect authentication data (set_id=sales)182.135.66.271814991jH  -_) ossec13001gS$Exim Auth failed2025-02-28 11:39:39 dovecot_plain authenticator failed for ([220.182.11.126]) [220.182.11.126]:55393: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)220.182.11.1261814991IG  = + ossec13008gRMail Reciepient rejected2025-02-28 11:38:00 H=(mail.saintsoldiercollege.com) [165.154.213.166]:61069 F= rejected RCPT : Rejected relay attempt: '165.154.213.166' From: 'vxsuc@saintsoldiercollege.com' To: 'goofile@fastmail.com'165.154.213.1663469034|F  -% ossec13001gQExim Auth failed2025-02-28 11:34:28 dovecot_plain authenticator failed for 7.248.146.34.bc.googleusercontent.com [34.146.248.7]:57660: 535 Incorrect authentication data (set_id=services@heipowersystem.com)34.146.248.71861060YE  -?) ossec13001gPExim Auth failed2025-02-28 11:30:04 dovecot_plain authenticator failed for ([94.202.156.237]) [94.202.156.237]:60783: 535 Incorrect authentication data (set_id=services)94.202.156.237290557D  - ' ossec13001gPExim Auth failed2025-02-28 11:29:43 dovecot_plain authenticator failed for (static-146.220.149.202-tataidc.co.in) [114.143.75.66]:56452: 535 Incorrect authentication data (set_id=services@heipowersystem.com)114.143.75.661269750cC  -W% ossec13001gOExim Auth failed2025-02-28 11:24:17 dovecot_login authenticator failed for ([2.179.186.69]) [2.179.186.69]:54521: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)2.179.186.69130758WB  -9) ossec13001gOiExim Auth failed2025-02-28 11:23:44 dovecot_plain authenticator failed for ([219.251.253.62]) [219.251.253.62]:57399: 535 Incorrect authentication data (set_id=sales)219.251.253.621835841fA  -Y' ossec13001gOSExim Auth failed2025-02-28 11:23:22 dovecot_plain authenticator failed for ([118.39.230.40]) [118.39.230.40]:3569: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)118.39.230.401835841p@  -i+ ossec13001gNUExim Auth failed2025-02-28 11:19:08 dovecot_plain authenticator failed for ([162.247.220.232]) [162.247.220.232]:33743: 535 Incorrect authentication data (set_id=services@heipowersystem.com)162.247.220.2323580718W?  -9) ossec13001gN+Exim Auth failed2025-02-28 11:18:26 dovecot_plain authenticator failed for ([46.146.227.191]) [46.146.227.191]:52190: 535 Incorrect authentication data (set_id=sales)46.146.227.1912017370 1 R a <>MuW`  -;' ossec13001g^7Exim Auth failed2025-02-28 12:26:53 dovecot_plain authenticator failed for ([220.85.251.16]) [220.85.251.16]:48684: 535 Incorrect authentication data (set_id=services)220.85.251.161835841q_  -q% ossec13001g^!Exim Auth failed2025-02-28 12:26:33 dovecot_plain authenticator failed for (9.72.116.151.hathway.com) [116.72.9.151]:55018: 535 Incorrect authentication data (set_id=services@heipowersystem.com)116.72.9.1511269750Z^  -=+ ossec13001g]EExim Auth failed2025-02-28 12:22:52 dovecot_plain authenticator failed for ([103.231.163.154]) [103.231.163.154]:15917: 535 Incorrect authentication data (set_id=sales)103.231.163.1541210997j]  -_) ossec13001g]1Exim Auth failed2025-02-28 12:22:32 dovecot_plain authenticator failed for ([191.59.176.133]) [191.59.176.133]:36016: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)191.59.176.1333469034T\  -5' ossec13001g\Exim Auth failed2025-02-28 12:21:36 dovecot_plain authenticator failed for ([176.62.82.235]) [176.62.82.235]:51668: 535 Incorrect authentication data (set_id=sales)176.62.82.2352017370m[  -c+ ossec13001g\Exim Auth failed2025-02-28 12:21:26 dovecot_plain authenticator failed for ([178.178.194.136]) [178.178.194.136]:35644: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)178.178.194.1362017370zZ  -# ossec13001g\(Exim Auth failed2025-02-28 12:18:08 dovecot_plain authenticator failed for 18.red-83-48-39.staticip.rima-tde.net [83.48.39.18]:16456: 535 Incorrect authentication data (set_id=services@heipowersystem.com)83.48.39.182510769TY  -5' ossec13001gYExim Auth failed2025-02-28 12:07:55 dovecot_plain authenticator failed for ([118.122.38.74]) [118.122.38.74]:49748: 535 Incorrect authentication data (set_id=sales)118.122.38.741814991TX  -7% ossec13001gYExim Auth failed2025-02-28 12:06:50 dovecot_plain authenticator failed for ([14.39.41.171]) [14.39.41.171]:41752: 535 Incorrect authentication data (set_id=services)14.39.41.1711835841dW  -W% ossec13001gYExim Auth failed2025-02-28 12:07:36 dovecot_plain authenticator failed for ([60.173.218.7]) [60.173.218.7]:56809: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)60.173.218.71814991gV  -]% ossec13001gYrExim Auth failed2025-02-28 12:06:32 dovecot_plain authenticator failed for ([74.95.13.185]) [74.95.13.185]:46865: 535 Incorrect authentication data (set_id=services@heipowersystem.com)74.95.13.1856252001UU  -9) ossec13001gXExim Auth failed2025-02-28 12:02:59 dovecot_plain authenticator failed for ([213.32.253.235]) [213.32.253.235]:51853: 535 Incorrect authentication data (set_id=sales)213.32.253.23599237ET  -' ossec13001gXExim Auth failed2025-02-28 12:02:58 dovecot_plain authenticator failed for ([213.91.84.250]) [213.91.84.250]:42900: 535 Incorrect authentication data213.91.84.2503277605mS  -c+ ossec13001gXExim Auth failed2025-02-28 12:02:32 dovecot_plain authenticator failed for ([113.110.228.157]) [113.110.228.157]:38784: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)113.110.228.1571814991[R  -I# ossec13001gX%Exim Auth failed2025-02-28 12:01:00 dovecot_plain authenticator failed for 89-67-38-27.dynamic.chello.pl [89.67.38.27]:32810: 535 Incorrect authentication data (set_id=sales)89.67.38.27798544gQ  -[' ossec13001gXExim Auth failed2025-02-28 12:00:45 dovecot_plain authenticator failed for ([209.173.10.75]) [209.173.10.75]:39374: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)209.173.10.756252001`P  -M' ossec13001gWExim Auth failed2025-02-28 11:59:31 dovecot_plain authenticator failed for (106.51.68.128.actcorp.in) [202.122.16.50]:56204: 535 Incorrect authentication data (set_id=services)202.122.16.501269750 $ 6 E g c m|`gq  -[' ossec13001ggKExim Auth failed2025-02-28 13:05:38 dovecot_plain authenticator failed for ([85.26.221.136]) [85.26.221.136]:55095: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)85.26.221.1362017370fp  -Y' ossec13001gfExim Auth failed2025-02-28 13:00:29 dovecot_plain authenticator failed for ([39.152.120.40]) [39.152.120.40]:3490: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)39.152.120.401814991Jo  A ' ossec11302gdFTP Authentication failed.Feb 28 12:54:06 vm1 pure-ftpd[869258]: (?@122.177.1.185) [WARNING] Authentication failed for user [user@westerndancecompany.com]122.177.1.1851269750$n  3O' ossec11301gdNew FTP connection.Feb 28 12:54:02 vm1 pure-ftpd[869258]: (?@122.177.1.185) [INFO] New connection from 122.177.1.185122.177.1.1851269750Tm  -7% ossec13001gdpExim Auth failed2025-02-28 12:53:27 dovecot_plain authenticator failed for ([186.73.22.20]) [186.73.22.20]:56834: 535 Incorrect authentication data (set_id=services)186.73.22.203703430ll  -e) ossec13001gdRExim Auth failed2025-02-28 12:52:57 dovecot_plain authenticator failed for ([178.218.193.90]) [178.218.193.90]:49917: 535 Incorrect authentication data (set_id=services@heipowersystem.com)178.218.193.90798544ek  -W' ossec13001gcExim Auth failed2025-02-28 12:50:55 dovecot_plain authenticator failed for 90-230-168-26-no600.tbcn.telia.com [90.230.168.26]:45736: 535 Incorrect authentication data (set_id=sales)90.230.168.262661886dj  -W% ossec13001gcExim Auth failed2025-02-28 12:50:40 dovecot_plain authenticator failed for ([61.42.133.74]) [61.42.133.74]:39797: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)61.42.133.741835841Wi  -;' ossec13001gbExim Auth failed2025-02-28 12:47:02 dovecot_plain authenticator failed for ([46.173.45.180]) [46.173.45.180]:52186: 535 Incorrect authentication data (set_id=services)46.173.45.1802017370mh  -e) ossec13001gbExim Auth failed2025-02-28 12:46:52 dovecot_plain authenticator failed for ([121.188.193.78]) [121.188.193.78]:46799: 535 Incorrect authentication data (set_id=services@heipowersystem.com)121.188.193.781835841rg  -q' ossec13001gb Exim Auth failed2025-02-28 12:43:14 dovecot_plain authenticator failed for (ip-107-12-61-200.static.silicanetworks.com) [200.61.12.107]:60706: 535 Incorrect authentication data (set_id=services)200.61.12.1073865483f  - ' ossec13001gaExim Auth failed2025-02-28 12:42:49 dovecot_plain authenticator failed for broadband-188-32-170-20.ip.moscow.rt.ru [188.32.170.20]:58032: 535 Incorrect authentication data (set_id=services@heipowersystem.com)188.32.170.202017370Ze  -=+ ossec13001gaExim Auth failed2025-02-28 12:41:42 dovecot_plain authenticator failed for ([201.183.225.156]) [201.183.225.156]:40620: 535 Incorrect authentication data (set_id=sales)201.183.225.1563658394md  -c+ ossec13001gaExim Auth failed2025-02-28 12:41:22 dovecot_plain authenticator failed for ([171.244.142.135]) [171.244.142.135]:49951: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)171.244.142.1351562822jc  -]+ ossec13001g`Exim Auth failed2025-02-28 12:34:56 dovecot_plain authenticator failed for (165-220-169-113.cust.exede.net) [165.220.169.113]:41501: 535 Incorrect authentication data (set_id=services)165.220.169.1132635167mb  -e) ossec13001g`Exim Auth failed2025-02-28 12:34:39 dovecot_plain authenticator failed for ([116.114.84.234]) [116.114.84.234]:46761: 535 Incorrect authentication data (set_id=services@heipowersystem.com)116.114.84.2341814991ga  -[' ossec13001g_Exim Auth failed2025-02-28 12:34:00 dovecot_plain authenticator failed for ([58.234.165.73]) [58.234.165.73]:54318: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)58.234.165.731835841 0~qdWJ=0# zm`SF9, v i \ O B 5 (     r e X K > 1 $  { n a T G : -   w j ] P C 6 )    s f Y L ? 2 %  |obUH;.!xk^QD7*tgZM@3& }pcVI</"yl_RE8+uh[NA4' ~qdWJ=0 1835841> 18358414 1835841, 1835841+ 1835841& 1835841$ 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841{ 1835841V 1835841S 1835841R 1835841K 1835841I 1835841F 1835841@ 18358413 18358410 1835841* 1835841) 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841r 1835841j 1835841h 1835841f 1835841_ 1835841O 1835841> 1835841< 18358417 18358416 1835841% 1835841" 1835841! 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841u 1835841q 1835841k 1835841V 1835841K 1835841F 1835841> 1835841, 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841} 1835841y 1835841p 1835841n 1835841` 1835841Z 1835841M 18358414 18358411 1835841' 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841w 1835841e 1835841b 1835841` 1835841U 1835841Q 1835841; 18358417 18358410 1835841- 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841e 1835841c 1835841b 1835841` 1835841R 1835841I 1835841F 1835841A 1835841@ 18358418 18358411 1835841- 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841| 1835841x 1835841u 1835841t 1835841s 1835841h 1835841_ 1835841\ 1835841Y 1835841K 1835841: 18358416 18358410 1835841+ 1835841) 1835841( 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841{ 1835841_ 1835841^ 1835841O 1835841L 1835841I 1835841H 1835841E 1835841# 1835841" 1835841 1835841 1835841 1835841 1835841 1835841 +: b t "8]rj  -a' ossec13001go/Exim Auth failed2025-02-28 13:39:19 dovecot_plain authenticator failed for ([95.189.99.107]) [95.189.99.107]:45534: 535 Incorrect authentication data (set_id=services@heipowersystem.com)95.189.99.1072017370T  -5' ossec13001gmExim Auth failed2025-02-28 13:33:06 dovecot_plain authenticator failed for ([103.187.79.19]) [103.187.79.19]:59144: 535 Incorrect authentication data (set_id=sales)103.187.79.191269750g  -[' ossec13001gmExim Auth failed2025-02-28 13:32:31 dovecot_plain authenticator failed for ([222.100.159.2]) [222.100.159.2]:36146: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)222.100.159.21835841Z  -?) ossec13001glExim Auth failed2025-02-28 13:29:43 dovecot_plain authenticator failed for ([123.209.107.18]) [123.209.107.18]:52010: 535 Incorrect authentication data (set_id=services)123.209.107.182077456g~  -]% ossec13001glExim Auth failed2025-02-28 13:29:12 dovecot_plain authenticator failed for ([74.95.13.185]) [74.95.13.185]:42360: 535 Incorrect authentication data (set_id=services@heipowersystem.com)74.95.13.1856252001W}  -9) ossec13001glExim Auth failed2025-02-28 13:28:44 dovecot_plain authenticator failed for ([111.48.140.240]) [111.48.140.240]:25032: 535 Incorrect authentication data (set_id=sales)111.48.140.2401814991f|  -[' ossec13001glExim Auth failed2025-02-28 13:28:33 dovecot_plain authenticator failed for ([196.46.199.11]) [196.46.199.11]:50518: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)196.46.199.11895949S{  -5' ossec13001gkExim Auth failed2025-02-28 13:23:50 dovecot_plain authenticator failed for ([46.30.161.197]) [46.30.161.197]:44028: 535 Incorrect authentication data (set_id=sales)46.30.161.197690791jz  -_) ossec13001gkExim Auth failed2025-02-28 13:23:40 dovecot_plain authenticator failed for ([182.70.120.127]) [182.70.120.127]:34530: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)182.70.120.1271269750\y  -A+ ossec13001gk*Exim Auth failed2025-02-28 13:22:08 dovecot_plain authenticator failed for ([125.21.146.174]) [115.242.200.126]:52904: 535 Incorrect authentication data (set_id=services)115.242.200.1261269750ix  -a' ossec13001gk Exim Auth failed2025-02-28 13:21:58 dovecot_plain authenticator failed for ([77.139.82.133]) [77.139.82.133]:58707: 535 Incorrect authentication data (set_id=services@heipowersystem.com)77.139.82.133294640gw  -]% ossec13001giExim Auth failed2025-02-28 13:15:48 dovecot_plain authenticator failed for ([88.87.84.104]) [88.87.84.104]:37336: 535 Incorrect authentication data (set_id=services@heipowersystem.com)88.87.84.1042017370Qv  -1% ossec13001ghOExim Auth failed2025-02-28 13:09:59 dovecot_plain authenticator failed for ([62.16.40.223]) [62.16.40.223]:56062: 535 Incorrect authentication data (set_id=sales)62.16.40.2232017370ju  -_) ossec13001ghEExim Auth failed2025-02-28 13:09:49 dovecot_plain authenticator failed for ([124.112.45.222]) [124.112.45.222]:37642: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)124.112.45.2221814991Tt  -7% ossec13001ggExim Auth failed2025-02-28 13:06:36 dovecot_plain authenticator failed for ([106.51.57.89]) [106.51.57.89]:54678: 535 Incorrect authentication data (set_id=services)106.51.57.891269750ms  -e) ossec13001ggoExim Auth failed2025-02-28 13:06:15 dovecot_plain authenticator failed for ([103.180.240.96]) [103.180.240.96]:44078: 535 Incorrect authentication data (set_id=services@heipowersystem.com)103.180.240.961282988Qr  -1% ossec13001ggiExim Auth failed2025-02-28 13:06:08 dovecot_plain authenticator failed for ([193.93.237.8]) [193.93.237.8]:53264: 535 Incorrect authentication data (set_id=sales)193.93.237.82017370 a! 3 [ " 7b(Ea`  -S# ossec13001gwExim Auth failed2025-02-28 14:13:10 dovecot_plain authenticator failed for ([5.31.16.135]) [5.31.16.135]:36702: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)5.31.16.135290557V  -9) ossec13001gvExim Auth failed2025-02-28 14:08:51 dovecot_plain authenticator failed for ([94.204.230.214]) [94.204.230.214]:53709: 535 Incorrect authentication data (set_id=sales)94.204.230.214290557  -) ossec13001guExim Auth failed2025-02-28 14:08:22 dovecot_plain authenticator failed for (145.37.212.118.adsl-pool.jx.chinaunicom.com) [118.212.37.145]:38354: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)118.212.37.1451814991m  -c+ ossec13001guExim Auth failed2025-02-28 14:07:31 dovecot_plain authenticator failed for ([123.210.152.243]) [123.210.152.243]:42560: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)123.210.152.2432077456g  -[' ossec13001gtExim Auth failed2025-02-28 14:02:04 dovecot_plain authenticator failed for ([181.197.38.12]) [181.197.38.12]:46586: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)181.197.38.123703430W  -9) ossec13001gtExim Auth failed2025-02-28 14:02:13 dovecot_plain authenticator failed for ([103.106.154.10]) [103.106.154.10]:43810: 535 Incorrect authentication data (set_id=sales)103.106.154.101269750]  -C+ ossec13001gtHExim Auth failed2025-02-28 14:01:03 dovecot_plain authenticator failed for ([163.179.123.208]) [163.179.123.208]:50640: 535 Incorrect authentication data (set_id=services)163.179.123.2081814991p  -i+ ossec13001gt<Exim Auth failed2025-02-28 14:00:51 dovecot_plain authenticator failed for ([125.130.249.158]) [125.130.249.158]:50188: 535 Incorrect authentication data (set_id=services@heipowersystem.com)125.130.249.1581835841*  3W+ ossec11301gsNew FTP connection.Feb 28 13:59:38 vm1 pure-ftpd[883039]: (?@172.172.245.136) [INFO] New connection from 172.172.245.136172.172.245.1366252001Q  -1% ossec13001grExim Auth failed2025-02-28 13:53:49 dovecot_plain authenticator failed for ([2.192.150.40]) [2.192.150.40]:59682: 535 Incorrect authentication data (set_id=sales)2.192.150.403175395g  -[' ossec13001grExim Auth failed2025-02-28 13:53:40 dovecot_plain authenticator failed for ([49.124.151.25]) [49.124.151.25]:47092: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)49.124.151.251733045d  -Y# ossec13001grhExim Auth failed2025-02-28 13:53:02 dovecot_plain authenticator failed for ([70.90.99.29]) [70.90.99.29]:55212: 535 Incorrect authentication data (set_id=services@heipowersystem.com)70.90.99.296252001M  =+ ossec13008gr6Mail Reciepient rejected2025-02-28 13:52:13 H=(mail.westerndancecompany.com) [165.154.226.172]:51591 F= rejected RCPT : Rejected relay attempt: '165.154.226.172' From: 'xroaeij@westerndancecompany.com' To: 'goofile@fastmail.com'165.154.226.1721668284T  -7% ossec13001goExim Auth failed2025-02-28 13:41:48 dovecot_plain authenticator failed for ([58.16.49.250]) [58.16.49.250]:53679: 535 Incorrect authentication data (set_id=services)58.16.49.2501814991j  -a' ossec13001goExim Auth failed2025-02-28 13:41:37 dovecot_plain authenticator failed for ([49.124.153.38]) [49.124.153.38]:49512: 535 Incorrect authentication data (set_id=services@heipowersystem.com)49.124.153.381733045j  -_) ossec13001goyExim Auth failed2025-02-28 13:40:33 dovecot_plain authenticator failed for ([111.48.140.240]) [111.48.140.240]:42630: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)111.48.140.2401814991m  -g' ossec13001go=Exim Auth failed2025-02-28 13:39:33 dovecot_plain authenticator failed for 230.red-213-96-11.staticip.rima-tde.net [213.96.11.230]:51640: 535 Incorrect authentication data (set_id=services)213.96.11.2302510769 5%1 S i #5j$  -a' ossec13001gExim Auth failed2025-02-28 14:49:15 dovecot_plain authenticator failed for ([65.175.24.142]) [65.175.24.142]:58873: 535 Incorrect authentication data (set_id=services@heipowersystem.com)65.175.24.1426252001j#  -a' ossec13001g)Exim Auth failed2025-02-28 14:47:29 dovecot_plain authenticator failed for syn-097-089-202-226.biz.spectrum.com [97.89.202.226]:48592: 535 Incorrect authentication data (set_id=services)97.89.202.2266252001 "  -' ossec13001g Exim Auth failed2025-02-28 14:47:01 dovecot_plain authenticator failed for wllk-bri-66-ip-66-43-253-231.wireless.netins.net [66.43.253.231]:56732: 535 Incorrect authentication data (set_id=services@heipowersystem.com)66.43.253.2316252001a!  -S# ossec13001g~gExim Auth failed2025-02-28 14:44:15 dovecot_plain authenticator failed for (6.41.43.103.cust-fiber.enegan.it) [103.43.41.6]:44156: 535 Incorrect authentication data (set_id=sales)103.43.41.63175395|  -) ossec13001g~YExim Auth failed2025-02-28 14:44:01 dovecot_plain authenticator failed for 249.151.48.116.static.netvigator.com [116.48.151.249]:62113: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)116.48.151.2491819730u  -u) ossec13001g|mExim Auth failed2025-02-28 14:35:47 dovecot_plain authenticator failed for ns1019254.ip-15-204-208.us [15.204.208.192]:38500: 535 Incorrect authentication data (set_id=services@heipowersystem.com)15.204.208.1926252001P  -1% ossec13001g{jExim Auth failed2025-02-28 14:31:30 dovecot_plain authenticator failed for ([94.205.82.33]) [94.205.82.33]:54765: 535 Incorrect authentication data (set_id=sales)94.205.82.33290557v  -y' ossec13001g{VExim Auth failed2025-02-28 14:31:09 dovecot_plain authenticator failed for 216.106.67.50.reverse.socket.net [216.106.67.50]:42736: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)216.106.67.506252001   [{% ossec12004gzPossible Dovecot CVE-2019-11500 attemptFeb 28 14:29:29 vm1 dovecot[312763]: pop3-login: Disconnected: Input buffer full (no auth attempts in 1 secs): user=<>, rip=3.135.184.36, lip=103.74.54.108, session=3.135.184.366252001j  -a' ossec13001gz:Exim Auth failed2025-02-28 14:26:25 dovecot_plain authenticator failed for ([158.140.32.93]) [158.140.32.93]:50619: 535 Incorrect authentication data (set_id=services@heipowersystem.com)158.140.32.936252001P  -1% ossec13001gyExim Auth failed2025-02-28 14:21:37 dovecot_plain authenticator failed for ([20.46.45.121]) [20.46.45.121]:56024: 535 Incorrect authentication data (set_id=sales)20.46.45.121290557m  -c+ ossec13001gyExim Auth failed2025-02-28 14:21:17 dovecot_plain authenticator failed for ([121.152.119.174]) [121.152.119.174]:33298: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)121.152.119.1741835841W  -;' ossec13001gx~Exim Auth failed2025-02-28 14:19:00 dovecot_plain authenticator failed for ([220.74.63.183]) [220.74.63.183]:44676: 535 Incorrect authentication data (set_id=services)220.74.63.1831835841f  -]% ossec13001gxiExim Auth failed2025-02-28 14:18:41 dovecot_plain authenticator failed for ([41.24.28.218]) [41.24.28.218]:64879: 535 Incorrect authentication data (set_id=services@heipowersystem.com)41.24.28.218953987Z  -?) ossec13001gwExim Auth failed2025-02-28 14:15:53 dovecot_plain authenticator failed for ([191.59.184.106]) [191.59.184.106]:51704: 535 Incorrect authentication data (set_id=services)191.59.184.1063469034p  -i+ ossec13001gwExim Auth failed2025-02-28 14:15:29 dovecot_plain authenticator failed for ([102.207.152.163]) [102.207.152.163]:57521: 535 Incorrect authentication data (set_id=services@heipowersystem.com)102.207.152.1633374766W  -9) ossec13001gw+Exim Auth failed2025-02-28 14:13:23 dovecot_plain authenticator failed for ([183.167.198.31]) [183.167.198.31]:37087: 535 Incorrect authentication data (set_id=sales)183.167.198.311814991 "M S V z YkZ4  -=+ ossec13001gkExim Auth failed2025-02-28 15:18:26 dovecot_plain authenticator failed for ([112.172.126.247]) [112.172.126.247]:46332: 535 Incorrect authentication data (set_id=sales)112.172.126.2471835841f3  -Y' ossec13001g_Exim Auth failed2025-02-28 15:18:15 dovecot_plain authenticator failed for ([77.106.78.215]) [77.106.78.215]:8501: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)77.106.78.2152017370j2  -a' ossec13001g!Exim Auth failed2025-02-28 15:17:12 dovecot_plain authenticator failed for ([106.227.87.29]) [106.227.87.29]:47608: 535 Incorrect authentication data (set_id=services@heipowersystem.com)106.227.87.2918149911  Ui+ ossec11001gIDeferred login on the cpanel service[2025-02-28 15:13:35 +0530] info [webmaild] 223.238.203.116 - kps@amplifypowerglobal.com "POST /cpsess5714850623/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [157.38.133.33] != Current IP Address [223.238.203.116]223.238.203.1161269750g0  -[' ossec13001gVExim Auth failed2025-02-28 15:09:33 dovecot_login authenticator failed for ([170.250.128.5]) [170.250.128.5]:48468: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)170.250.128.56252001Z/  -=+ ossec13001g%Exim Auth failed2025-02-28 15:08:43 dovecot_plain authenticator failed for ([102.207.152.163]) [102.207.152.163]:33478: 535 Incorrect authentication data (set_id=sales)102.207.152.1633374766y.  -}) ossec13001g!Exim Auth failed2025-02-28 15:08:40 dovecot_login authenticator failed for ([163.179.123.60]) [163.179.123.60]:38617: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)163.179.123.601814991-  -+ ossec13001gExim Auth failed2025-02-28 15:08:22 dovecot_plain authenticator failed for 137.173.198.203.static.netvigator.com [203.198.173.137]:49545: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)203.198.173.1371819730m,  -e) ossec13001gExim Auth failed2025-02-28 15:06:42 dovecot_plain authenticator failed for ([202.149.219.78]) [202.149.219.78]:40384: 535 Incorrect authentication data (set_id=services@heipowersystem.com)202.149.219.781269750}+  -' ossec13001gExim Auth failed2025-02-28 15:02:25 dovecot_plain authenticator failed for broadband-95-84-158-215.ip.moscow.rt.ru [95.84.158.215]:55198: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)95.84.158.2152017370Z*  -=+ ossec13001gExim Auth failed2025-02-28 15:02:37 dovecot_plain authenticator failed for ([104.193.103.213]) [104.193.103.213]:58020: 535 Incorrect authentication data (set_id=sales)104.193.103.2136252001X)  -;) ossec13001gExim Auth failed2025-02-28 14:57:53 dovecot_plain authenticator failed for ([112.6.247.12]) [120.224.163.23]:46142: 535 Incorrect authentication data (set_id=services)120.224.163.231814991y(  -# ossec13001gExim Auth failed2025-02-28 14:57:42 dovecot_plain authenticator failed for syn-070-120-006-086.res.spectrum.com [70.120.6.86]:58716: 535 Incorrect authentication data (set_id=services@heipowersystem.com)70.120.6.866252001v'  -y' ossec13001g<Exim Auth failed2025-02-28 14:56:20 dovecot_plain authenticator failed for 216.106.67.50.reverse.socket.net [216.106.67.50]:44372: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)216.106.67.506252001Q&  -1% ossec13001gTExim Auth failed2025-02-28 14:56:43 dovecot_plain authenticator failed for ([58.22.255.28]) [58.22.255.28]:38826: 535 Incorrect authentication data (set_id=sales)58.22.255.281814991Z%  -?) ossec13001gLExim Auth failed2025-02-28 14:52:18 dovecot_plain authenticator failed for syn-075-135-141-150.res.spectrum.com [75.135.141.150]:40171: 535 Incorrect authentication data75.135.141.1506252001 + T c x  !6MD  =' ossec13008gMail Reciepient rejected2025-02-28 15:46:56 H=(mail.westerndancecompany.com) [165.154.228.9]:58886 F= rejected RCPT : Rejected relay attempt: '165.154.228.9' From: 'gbfhvuuiyt@westerndancecompany.com' To: 'goofile@fastmail.com'165.154.228.91643084gC  -[' ossec13001g Exim Auth failed2025-02-28 15:46:43 dovecot_plain authenticator failed for ([39.152.196.78]) [39.152.196.78]:46737: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)39.152.196.781814991jB  -c% ossec13001g[Exim Auth failed2025-02-28 15:43:45 dovecot_plain authenticator failed for (nsg-static-173.125.76.182-airtel.com) [182.76.87.90]:35962: 535 Incorrect authentication data (set_id=services)182.76.87.901269750yA  -}) ossec13001gQExim Auth failed2025-02-28 15:43:35 dovecot_plain authenticator failed for 110-25-105-242.adsl.fetnet.net [110.25.105.242]:42597: 535 Incorrect authentication data (set_id=services@heipowersystem.com)110.25.105.2421668284f@  -[% ossec13001g?Exim Auth failed2025-02-28 15:43:18 dovecot_plain authenticator failed for 32.104.29.34.bc.googleusercontent.com [34.29.104.32]:41772: 535 Incorrect authentication data (set_id=sales)34.29.104.326252001k?  -a+ ossec13001g+Exim Auth failed2025-02-28 15:42:57 dovecot_plain authenticator failed for ([196.200.227.78]) [196.200.227.194]:54268: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)196.200.227.194149590W>  -;' ossec13001gExim Auth failed2025-02-28 15:32:41 dovecot_plain authenticator failed for ([121.157.28.10]) [121.157.28.10]:59518: 535 Incorrect authentication data (set_id=services)121.157.28.101835841b=  -O) ossec13001gExim Auth failed2025-02-28 15:32:32 dovecot_login authenticator failed for ([191.59.176.133]) [191.59.176.133]:41018: 535 Incorrect authentication data (set_id=vikas.khandelwal)191.59.176.1333469034p<  -i+ ossec13001gExim Auth failed2025-02-28 15:32:19 dovecot_plain authenticator failed for ([218.149.228.149]) [218.149.228.149]:47896: 535 Incorrect authentication data (set_id=services@heipowersystem.com)218.149.228.1491835841;  -' ossec13001gExim Auth failed2025-02-28 15:32:00 dovecot_login authenticator failed for 202-4-196-180.static.pccw-hkt.com [202.4.196.180]:36171: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)202.4.196.1801819730T:  -5' ossec13001gExim Auth failed2025-02-28 15:29:18 dovecot_plain authenticator failed for ([191.59.231.90]) [191.59.231.90]:53728: 535 Incorrect authentication data (set_id=sales)191.59.231.903469034g9  -[' ossec13001gExim Auth failed2025-02-28 15:29:00 dovecot_plain authenticator failed for ([61.81.133.182]) [61.81.133.182]:37977: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)61.81.133.1821835841m8  -c+ ossec13001gExim Auth failed2025-02-28 15:24:06 dovecot_plain authenticator failed for ([115.245.172.214]) [115.245.172.214]:57854: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)115.245.172.2141269750S7  -5' ossec13001gExim Auth failed2025-02-28 15:24:20 dovecot_plain authenticator failed for ([91.239.23.149]) [91.239.23.149]:41024: 535 Incorrect authentication data (set_id=sales)91.239.23.149458258f6  -W) ossec13001g Exim Auth failed2025-02-28 15:21:08 dovecot_plain authenticator failed for 110-25-105-223.adsl.fetnet.net [110.25.105.223]:54038: 535 Incorrect authentication data (set_id=services)110.25.105.2231668284g5  -]% ossec13001gExim Auth failed2025-02-28 15:20:52 dovecot_plain authenticator failed for ([59.7.203.177]) [59.7.203.177]:33904: 535 Incorrect authentication data (set_id=services@heipowersystem.com)59.7.203.1771835841  1  1\gU  -[' ossec13001g+Exim Auth failed2025-02-28 16:21:22 dovecot_plain authenticator failed for ([14.48.227.118]) [14.48.227.118]:42311: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)14.48.227.1181835841ZT  -=+ ossec13001gExim Auth failed2025-02-28 16:15:45 dovecot_plain authenticator failed for ([181.123.188.192]) [181.123.188.192]:40790: 535 Incorrect authentication data (set_id=sales)181.123.188.1923437598mS  -c+ ossec13001gExim Auth failed2025-02-28 16:15:34 dovecot_plain authenticator failed for ([162.247.220.232]) [162.247.220.232]:56600: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)162.247.220.2323580718eR  -W' ossec13001g>Exim Auth failed2025-02-28 16:13:09 dovecot_login authenticator failed for (rokamauka.com) [221.229.216.1]:59552: 535 Incorrect authentication data (set_id=postmaster@rokamauka.com)221.229.216.11814991TQ  -5' ossec13001g$Exim Auth failed2025-02-28 16:12:43 dovecot_login authenticator failed for (rokamauka.com) [221.229.216.1]:56042: 535 Incorrect authentication data (set_id=nologin)221.229.216.11814991QP  -1% ossec13001gdExim Auth failed2025-02-28 16:09:31 dovecot_plain authenticator failed for ([31.173.9.222]) [31.173.9.222]:41254: 535 Incorrect authentication data (set_id=sales)31.173.9.2222017370hO  -]' ossec13001g<Exim Auth failed2025-02-28 16:08:52 dovecot_plain authenticator failed for ([189.108.224.67]) [191.210.73.33]:50970: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)191.210.73.333469034lN  -c) ossec13001gExim Auth failed2025-02-28 16:07:01 dovecot_plain authenticator failed for 144.46.246.220.static.netvigator.com [220.246.46.144]:50724: 535 Incorrect authentication data (set_id=services)220.246.46.1441819730jM  -_) ossec13001gExim Auth failed2025-02-28 16:07:24 dovecot_login authenticator failed for ([60.191.239.186]) [60.191.239.186]:47790: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)60.191.239.1861814991pL  -i+ ossec13001gExim Auth failed2025-02-28 16:06:39 dovecot_plain authenticator failed for ([121.178.185.141]) [121.178.185.141]:54036: 535 Incorrect authentication data (set_id=services@heipowersystem.com)121.178.185.1411835841VK  -9) ossec13001gExim Auth failed2025-02-28 15:58:21 dovecot_plain authenticator failed for ([185.101.16.250]) [185.101.16.250]:47034: 535 Incorrect authentication data (set_id=sales)185.101.16.250272103jJ  -_) ossec13001gExim Auth failed2025-02-28 15:58:12 dovecot_plain authenticator failed for ([207.219.221.53]) [207.219.221.53]:59869: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)207.219.221.536251999ZI  -?) ossec13001gExim Auth failed2025-02-28 15:53:10 dovecot_login authenticator failed for ([109.70.203.114]) [109.70.203.114]:59198: 535 Incorrect authentication data (set_id=services)109.70.203.1143175395mH  -e) ossec13001gyExim Auth failed2025-02-28 15:52:48 dovecot_login authenticator failed for ([222.85.107.135]) [222.85.107.135]:59265: 535 Incorrect authentication data (set_id=services@heipowersystem.com)222.85.107.1351814991'G  3S) ossec11301gNew FTP connection.Feb 28 15:50:07 vm1 pure-ftpd[906302]: (?@157.230.84.129) [INFO] New connection from 157.230.84.129157.230.84.1296252001WF  -;' ossec13001gExim Auth failed2025-02-28 15:50:03 dovecot_plain authenticator failed for ([191.59.231.90]) [191.59.231.90]:36998: 535 Incorrect authentication data (set_id=services)191.59.231.903469034pE  -i+ ossec13001gExim Auth failed2025-02-28 15:49:40 dovecot_plain authenticator failed for ([211.198.178.191]) [211.198.178.191]:58362: 535 Incorrect authentication data (set_id=services@heipowersystem.com)211.198.178.1911835841 x@ L h n  "<WXxf  -% ossec13001g Exim Auth failed2025-02-28 17:03:31 dovecot_plain authenticator failed for 61-216-7-163.hinet-ip.hinet.net ([61.216.7.165]) [61.216.7.163]:39787: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)61.216.7.1631668284Te  -7% ossec13001gExim Auth failed2025-02-28 17:02:27 dovecot_plain authenticator failed for ([219.159.57.4]) [219.159.57.4]:36983: 535 Incorrect authentication data (set_id=services)219.159.57.41814991{d  -' ossec13001gExim Auth failed2025-02-28 17:02:04 dovecot_plain authenticator failed for 90-230-168-26-no600.tbcn.telia.com [90.230.168.26]:34622: 535 Incorrect authentication data (set_id=services@heipowersystem.com)90.230.168.262661886ac  -S# ossec13001g]Exim Auth failed2025-02-28 17:00:36 dovecot_plain authenticator failed for ([70.90.99.29]) [70.90.99.29]:39140: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)70.90.99.296252001bb  -S% ossec13001gExim Auth failed2025-02-28 16:56:58 dovecot_plain authenticator failed for host59.sub-63-47-149.myvzw.com [63.47.149.59]:33980: 535 Incorrect authentication data (set_id=services)63.47.149.596252001ga  -]% ossec13001g[Exim Auth failed2025-02-28 16:56:17 dovecot_plain authenticator failed for ([121.162.30.3]) [121.162.30.3]:57648: 535 Incorrect authentication data (set_id=services@heipowersystem.com)121.162.30.31835841Z`  -=+ ossec13001gExim Auth failed2025-02-28 16:50:03 dovecot_plain authenticator failed for ([220.120.224.227]) [220.120.224.227]:52416: 535 Incorrect authentication data (set_id=sales)220.120.224.2271835841j_  -_) ossec13001gExim Auth failed2025-02-28 16:49:50 dovecot_plain authenticator failed for ([123.209.119.82]) [123.209.119.82]:46648: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)123.209.119.822077456Z^  -?) ossec13001gExim Auth failed2025-02-28 16:41:30 dovecot_plain authenticator failed for ([112.184.56.199]) [112.184.56.199]:46232: 535 Incorrect authentication data (set_id=services)112.184.56.1991835841m]  -e) ossec13001gExim Auth failed2025-02-28 16:41:12 dovecot_plain authenticator failed for ([111.48.208.197]) [111.48.208.197]:21442: 535 Incorrect authentication data (set_id=services@heipowersystem.com)111.48.208.1971814991W\  -9) ossec13001gExim Auth failed2025-02-28 16:40:27 dovecot_plain authenticator failed for ([129.21.246.142]) [129.21.246.142]:53830: 535 Incorrect authentication data (set_id=sales)129.21.246.1426252001g[  -[' ossec13001gExim Auth failed2025-02-28 16:40:06 dovecot_plain authenticator failed for ([111.14.104.61]) [111.14.104.61]:53530: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)111.14.104.611814991vZ  -y' ossec13001gxExim Auth failed2025-02-28 16:35:26 dovecot_login authenticator failed for ([222.180.4.150]) [222.180.4.150]:45860: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)222.180.4.1501814991`Y  -O% ossec13001gExim Auth failed2025-02-28 16:35:47 dovecot_login authenticator failed for ([120.157.2.90]) [120.157.2.90]:44482: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)120.157.2.902077456pX  -i+ ossec13001gExim Auth failed2025-02-28 16:27:46 dovecot_plain authenticator failed for ([197.149.125.227]) [197.149.125.227]:42616: 535 Incorrect authentication data (set_id=services@heipowersystem.com)197.149.125.2272328926TW  -5' ossec13001gUExim Auth failed2025-02-28 16:26:20 dovecot_login authenticator failed for ([1.244.246.221]) [1.244.246.221]:40792: 535 Incorrect authentication data (set_id=sales)1.244.246.2211835841dV  -W% ossec13001gCExim Auth failed2025-02-28 16:26:02 dovecot_login authenticator failed for ([202.200.15.1]) [202.200.14.2]:37186: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)202.200.14.21814991 *\~tj`VLB8.$zpf\H>4*   v l b X N D : 0 &    ~ t j ` V L B 8 . $    z p f \ R H > 4 *  vlbXND:0&|r^hTJ@6,"xndZPF<2( ~tj`VBL8.$f\zp | r h ^ T J @ 6 , "    x n d Z P F < 2 (   RRH>4*  vlbXND:0& gs g] gۅ gy gy g] gّ gف gٱ g٣ gV gZ g2 gd g g g g g g g+ gU gA g g g g gж gТ g` gT g g gϠ gφ g| gr g2 g gm g[ gw gK g g g gȶ g g g| g^ gƂ gn g g g g gß gÕ g g g¹ gš g g( g g g gi g] g g gM g g gx gt g g g* g g g g` gL g> g gQ g7 g) g g ge g g g g g g g  g ~ g } g | g { g z g y gI x g w g v g u g t g s g r g q g p gG o g n gy m g% l g k gD j g8 i g, h g" g g f g e g d g] c g b g[ a g ` g _ g ^ g ] g \ g [ g Y gx Z g X gU W gC V g+ U g T g S g> R g$ Q gd P g< O g M g N g L g K g J g I gy H g G g F g E g D g C g[ B gQ A g? @ g+ ? g > g = g < g ; g : g 9 g g g} ge g g g= g/ gS g2 g g g0 g g2 g, g g g g gS gK gI g9 g g g g g g g g gj g` gF g2 g g߾ gF g4 gݙ g݂ gG g 7 g 8 g 6 g 5 gk 4 g_ 3 g! 2 gI 1 gV 0 g% / g! . g - g , g * g + g ) g ( gT & g< ' gL % g $ g) # g " g~g ! g~Y g|m  g{j  g{V  gz  gz:  gy  gy  gx~  gxi  gw  gw  gw+  gw  gv  gu  gu  gt  g gt  gtH gt< gs gr gr grh  gr6  go  go  goy  go=  go/  gm  gm gl gl gl gl gk gk gk* gk gi ghO ghE gg ggo ggi ggK gf gd gd gdp gdR gc gc gb gb gb ga ga .< ^ s &&4J\bTw  -5' ossec13001gExim Auth failed2025-02-28 17:58:47 dovecot_plain authenticator failed for ([219.248.65.30]) [219.248.65.30]:54440: 535 Incorrect authentication data (set_id=sales)219.248.65.301835841vv  -w) ossec13001gExim Auth failed2025-02-28 17:58:01 dovecot_plain authenticator failed for 110-25-105-223.adsl.fetnet.net [110.25.105.223]:33750: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)110.25.105.2231668284ju  -a' ossec13001gExim Auth failed2025-02-28 17:52:49 dovecot_plain authenticator failed for ([218.22.52.106]) [218.22.52.106]:48544: 535 Incorrect authentication data (set_id=services@heipowersystem.com)218.22.52.1061814991ft  -Y' ossec13001gExim Auth failed2025-02-28 17:53:12 dovecot_plain authenticator failed for 216.106.67.50.reverse.socket.net [216.106.67.50]:50032: 535 Incorrect authentication data (set_id=services)216.106.67.506252001ns  -i' ossec13001gExim Auth failed2025-02-28 17:45:16 dovecot_plain authenticator failed for pool-99-251-252-98.cpe.net.cable.rogers.com [99.251.252.98]:47546: 535 Incorrect authentication data (set_id=sales)99.251.252.986251999|r  -) ossec13001gExim Auth failed2025-02-28 17:44:50 dovecot_plain authenticator failed for syn-173-172-152-018.res.spectrum.com [173.172.152.18]:36900: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)173.172.152.186252001Qq  -1% ossec13001gExim Auth failed2025-02-28 17:35:41 dovecot_plain authenticator failed for ([1.237.137.30]) [1.237.137.30]:47731: 535 Incorrect authentication data (set_id=sales)1.237.137.301835841mp  -c+ ossec13001gExim Auth failed2025-02-28 17:35:20 dovecot_plain authenticator failed for ([220.124.225.252]) [220.124.225.252]:59308: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)220.124.225.2521835841do  -Y# ossec13001gGExim Auth failed2025-02-28 17:34:22 dovecot_plain authenticator failed for ([47.91.88.67]) [47.91.88.67]:53612: 535 Incorrect authentication data (set_id=services@heipowersystem.com)47.91.88.672921044en  -Y% ossec13001gExim Auth failed2025-02-28 17:27:13 dovecot_plain authenticator failed for syn-076-169-081-036.res.spectrum.com [76.169.81.36]:57996: 535 Incorrect authentication data (set_id=sales)76.169.81.366252001cm  -W% ossec13001gyExim Auth failed2025-02-28 17:26:40 dovecot_plain authenticator failed for ([37.25.33.108]) [37.25.33.108]:37809: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)37.25.33.108294640]l  -C+ ossec13001g%Exim Auth failed2025-02-28 17:25:15 dovecot_plain authenticator failed for ([113.110.228.157]) [113.110.228.157]:57562: 535 Incorrect authentication data (set_id=services)113.110.228.1571814991jk  -a' ossec13001gExim Auth failed2025-02-28 17:24:58 dovecot_plain authenticator failed for ([201.173.16.21]) [201.173.16.21]:34021: 535 Incorrect authentication data (set_id=services@heipowersystem.com)201.173.16.213996063gj  -[' ossec13001gDExim Auth failed2025-02-28 17:21:31 dovecot_plain authenticator failed for ([180.168.119.2]) [180.168.119.2]:55446: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)180.168.119.21814991Zi  -?) ossec13001g8Exim Auth failed2025-02-28 17:17:03 dovecot_plain authenticator failed for ([106.55.161.136]) [106.55.161.136]:38582: 535 Incorrect authentication data (set_id=services)106.55.161.1361814991nh  -g) ossec13001g,Exim Auth failed2025-02-28 17:16:51 dovecot_plain authenticator failed for ([101.230.251.217]) [180.154.53.221]:45649: 535 Incorrect authentication data (set_id=services@heipowersystem.com)180.154.53.2211814991Ng  --# ossec13001g"Exim Auth failed2025-02-28 17:03:53 dovecot_plain authenticator failed for ([27.71.27.81]) [27.71.27.81]:63855: 535 Incorrect authentication data (set_id=sales)27.71.27.811562822 j! 5 M _ b h%:Ij[  -C' ossec13001g Exim Auth failed2025-02-28 18:37:25 dovecot_login authenticator failed for (vandanabalbharti.com) [111.56.54.202]:53520: 535 Incorrect authentication data (set_id=nologin)111.56.54.2021814991m  -c+ ossec13001gExim Auth failed2025-02-28 18:35:09 dovecot_plain authenticator failed for ([190.205.112.156]) [190.205.112.156]:52623: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)190.205.112.1563625428g  -[' ossec13001geExim Auth failed2025-02-28 18:34:36 dovecot_plain authenticator failed for ([49.124.153.20]) [49.124.153.20]:37280: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)49.124.153.201733045Z  -?) ossec13001gExim Auth failed2025-02-28 18:27:53 dovecot_plain authenticator failed for ([111.172.120.32]) [111.172.120.32]:35728: 535 Incorrect authentication data (set_id=services)111.172.120.321814991l  -c) ossec13001gExim Auth failed2025-02-28 18:27:26 dovecot_plain authenticator failed for ([45.201.140.227]) [45.201.140.227]:7188: 535 Incorrect authentication data (set_id=services@heipowersystem.com)45.201.140.2271831722Z  -?) ossec13001gExim Auth failed2025-02-28 18:26:56 dovecot_plain authenticator failed for ([117.176.123.33]) [117.176.123.33]:41958: 535 Incorrect authentication data (set_id=services)117.176.123.331814991m  -e) ossec13001gExim Auth failed2025-02-28 18:26:44 dovecot_plain authenticator failed for ([111.48.214.102]) [111.48.214.102]:31246: 535 Incorrect authentication data (set_id=services@heipowersystem.com)111.48.214.1021814991V  -;' ossec13001gExim Auth failed2025-02-28 18:23:20 dovecot_login authenticator failed for ([80.250.155.12]) [80.250.155.12]:56232: 535 Incorrect authentication data (set_id=services)80.250.155.12294640m  -e) ossec13001gExim Auth failed2025-02-28 18:22:45 dovecot_login authenticator failed for ([49.124.131.160]) [49.124.131.160]:55716: 535 Incorrect authentication data (set_id=services@heipowersystem.com)49.124.131.1601733045W  -9) ossec13001gExim Auth failed2025-02-28 18:20:25 dovecot_plain authenticator failed for ([182.70.250.169]) [182.70.250.169]:49699: 535 Incorrect authentication data (set_id=sales)182.70.250.1691269750v~  -}# ossec13001gExim Auth failed2025-02-28 18:20:04 dovecot_plain authenticator failed for syn-071-090-034-032.res.spectrum.com [71.90.34.32]:53376: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)71.90.34.326252001y}  -}) ossec13001gExim Auth failed2025-02-28 18:16:09 dovecot_plain authenticator failed for (ws60-209.199.103.rcil.gov.in) [103.199.209.60]:44926: 535 Incorrect authentication data (set_id=services@heipowersystem.com)103.199.209.601269750j|  -_) ossec13001gExim Auth failed2025-02-28 18:14:51 dovecot_plain authenticator failed for ([112.111.61.232]) [112.111.61.229]:53070: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)112.111.61.2291814991d{  -W% ossec13001gExim Auth failed2025-02-28 18:11:35 dovecot_plain authenticator failed for ([36.33.27.114]) [36.33.27.114]:39118: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)36.33.27.1141814991hz  -]' ossec13001gExim Auth failed2025-02-28 18:05:46 dovecot_plain authenticator failed for 90-230-168-26-no600.tbcn.telia.com [90.230.168.26]:57254: 535 Incorrect authentication data (set_id=services)90.230.168.262661886my  -e) ossec13001gExim Auth failed2025-02-28 18:05:37 dovecot_plain authenticator failed for ([59.102.188.188]) [59.102.188.188]:54655: 535 Incorrect authentication data (set_id=services@heipowersystem.com)59.102.188.1881668284jx  -a' ossec13001gIExim Auth failed2025-02-28 18:00:00 dovecot_plain authenticator failed for ([121.154.90.17]) [121.154.90.17]:35066: 535 Incorrect authentication data (set_id=services@heipowersystem.com)121.154.90.171835841   x $I[e{N  --# ossec13001gExim Auth failed2025-02-28 19:01:53 dovecot_plain authenticator failed for ([61.169.6.99]) [61.169.6.99]:41136: 535 Incorrect authentication data (set_id=sales)61.169.6.991814991f  -[' ossec13001gExim Auth failed2025-02-28 19:01:24 dovecot_plain authenticator failed for ([94.205.250.78]) [94.205.250.78]:61746: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)94.205.250.78290557f  -]% ossec13001gxExim Auth failed2025-02-28 19:00:32 dovecot_plain authenticator failed for ([5.30.191.129]) [5.30.191.129]:37258: 535 Incorrect authentication data (set_id=services@heipowersystem.com)5.30.191.129290557r  -q' ossec13001gtExim Auth failed2025-02-28 18:56:11 dovecot_login authenticator failed for ([46.21.240.186]) [46.21.240.186]:52890: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)46.21.240.1862017370j  -a' ossec13001gExim Auth failed2025-02-28 18:52:16 dovecot_plain authenticator failed for ([121.154.90.17]) [121.154.90.17]:36074: 535 Incorrect authentication data (set_id=services@heipowersystem.com)121.154.90.171835841W  -;' ossec13001gExim Auth failed2025-02-28 18:52:29 dovecot_plain authenticator failed for ([124.228.32.34]) [124.228.32.34]:41099: 535 Incorrect authentication data (set_id=services)124.228.32.341814991j  -_) ossec13001g*Exim Auth failed2025-02-28 18:50:40 dovecot_plain authenticator failed for ([166.195.197.38]) [166.195.197.38]:34027: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)166.195.197.386252001P  -1% ossec13001gExim Auth failed2025-02-28 18:50:22 dovecot_login authenticator failed for ([94.205.83.14]) [94.205.83.14]:35483: 535 Incorrect authentication data (set_id=sales)94.205.83.14290557g  -[' ossec13001gExim Auth failed2025-02-28 18:49:59 dovecot_login authenticator failed for ([46.52.204.227]) [46.52.204.227]:58183: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)46.52.204.2272017370z  -' ossec13001gExim Auth failed2025-02-28 18:48:17 dovecot_plain authenticator failed for (stale-fjorden-rt.hty-dsl.midtit.no) [217.22.38.208]:51007: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)217.22.38.2083144096\  -C) ossec13001g`Exim Auth failed2025-02-28 18:47:18 dovecot_login authenticator failed for (thepsindustries.com) [124.160.63.122]:21082: 535 Incorrect authentication data (set_id=nologin)124.160.63.1221814991T  -7% ossec13001gLExim Auth failed2025-02-28 18:46:59 dovecot_plain authenticator failed for ([49.79.80.131]) [49.79.80.131]:58578: 535 Incorrect authentication data (set_id=services)49.79.80.1311814991m  -e) ossec13001g>Exim Auth failed2025-02-28 18:46:45 dovecot_plain authenticator failed for ([111.171.125.94]) [111.171.125.94]:51168: 535 Incorrect authentication data (set_id=services@heipowersystem.com)111.171.125.941835841$  3O' ossec11301gNew FTP connection.Feb 28 18:46:09 vm1 pure-ftpd[945083]: (?@206.168.34.52) [INFO] New connection from 206.168.34.52206.168.34.526252001t  -s) ossec13001gQExim Auth failed2025-02-28 18:38:32 dovecot_plain authenticator failed for ip-062-143-219-127.um16.pools.vodafone-ip.de [62.143.219.127]:63576: 535 Incorrect authentication data (set_id=services)62.143.219.1272921044m  -e) ossec13001g7Exim Auth failed2025-02-28 18:38:07 dovecot_plain authenticator failed for ([218.98.160.117]) [218.98.160.117]:17576: 535 Incorrect authentication data (set_id=services@heipowersystem.com)218.98.160.1171814991s  -s' ossec13001g)Exim Auth failed2025-02-28 18:37:53 dovecot_login authenticator failed for (vandanabalbharti.com) [111.56.54.202]:56610: 535 Incorrect authentication data (set_id=postmaster@vandanabalbharti.com)111.56.54.2021814991 | L X .Z|Z*  -?) ossec13001gExim Auth failed2025-02-28 19:45:42 dovecot_plain authenticator failed for ([112.194.139.55]) [112.194.139.55]:39368: 535 Incorrect authentication data (set_id=services)112.194.139.551814991P)  -1% ossec13001gßExim Auth failed2025-02-28 19:39:34 dovecot_plain authenticator failed for ([185.167.58.9]) [185.167.58.9]:44114: 535 Incorrect authentication data (set_id=sales)185.167.58.9617790d(  -W% ossec13001gÕExim Auth failed2025-02-28 19:39:25 dovecot_plain authenticator failed for ([27.188.66.84]) [27.188.66.84]:49844: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)27.188.66.841814991j'  -_) ossec13001gExim Auth failed2025-02-28 19:39:02 dovecot_plain authenticator failed for ([116.104.50.190]) [116.104.50.190]:44594: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)116.104.50.1901562822n&  -k% ossec13001gExim Auth failed2025-02-28 19:36:02 dovecot_plain authenticator failed for (189-44-2-250.customer.tdatabrasil.net.br) [189.44.2.250]:60002: 535 Incorrect authentication data (set_id=services)189.44.2.2503469034%  -' ossec13001g¹Exim Auth failed2025-02-28 19:35:43 dovecot_plain authenticator failed for modemcable039.132-202-24.mc.videotron.ca [24.202.132.39]:55496: 535 Incorrect authentication data (set_id=services@heipowersystem.com)24.202.132.396251999d$  -W% ossec13001gšExim Auth failed2025-02-28 19:35:13 dovecot_plain authenticator failed for ([27.72.103.74]) [27.72.103.74]:61597: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)27.72.103.741562822m#  -c+ ossec13001gExim Auth failed2025-02-28 19:28:13 dovecot_plain authenticator failed for ([212.120.163.110]) [212.120.163.110]:54960: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)212.120.163.1102017370{"  -) ossec13001g(Exim Auth failed2025-02-28 19:24:47 dovecot_plain authenticator failed for 50708de6.static.ziggozakelijk.nl [80.112.141.230]:46992: 535 Incorrect authentication data (set_id=services@heipowersystem.com)80.112.141.2302750405Z!  -=+ ossec13001gExim Auth failed2025-02-28 19:18:07 dovecot_plain authenticator failed for ([175.206.105.126]) [175.206.105.126]:53486: 535 Incorrect authentication data (set_id=sales)175.206.105.1261835841f  -[% ossec13001gExim Auth failed2025-02-28 19:17:55 dovecot_plain authenticator failed for ([182.76.125.173]) [182.76.87.90]:37912: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)182.76.87.901269750g  -]% ossec13001gExim Auth failed2025-02-28 19:15:57 dovecot_plain authenticator failed for ([58.16.49.250]) [58.16.49.250]:53071: 535 Incorrect authentication data (set_id=services@heipowersystem.com)58.16.49.2501814991N  --# ossec13001giExim Auth failed2025-02-28 19:13:04 dovecot_plain authenticator failed for ([59.0.60.158]) [59.0.60.158]:56080: 535 Incorrect authentication data (set_id=sales)59.0.60.1581835841p  -k) ossec13001g]Exim Auth failed2025-02-28 19:12:53 dovecot_plain authenticator failed for vps-f5bece10.vps.ovh.net [135.125.207.50]:39154: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)135.125.207.503017382$  3O' ossec11301gNew FTP connection.Feb 28 19:09:42 vm1 pure-ftpd[950204]: (?@20.65.192.151) [INFO] New connection from 20.65.192.15120.65.192.1516252001i  -_' ossec13001gExim Auth failed2025-02-28 19:09:35 dovecot_plain authenticator failed for ([77.106.78.215]) [77.106.78.215]:6207: 535 Incorrect authentication data (set_id=services@heipowersystem.com)77.106.78.2152017370  W+ ossec9708gMDovecot Aborted Login with empty userFeb 28 19:04:04 vm1 dovecot[312763]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 2 secs): user=<>, rip=165.154.173.204, lip=103.74.54.108, session=165.154.173.2046252001 o @ O q w ,>So`;  -O% ossec13001gmExim Auth failed2025-02-28 20:21:25 dovecot_plain authenticator failed for 111-70-3-198.emome-ip.hinet.net [111.70.3.198]:43800: 535 Incorrect authentication data (set_id=sales)111.70.3.1981668284g:  -[' ossec13001g[Exim Auth failed2025-02-28 20:21:07 dovecot_plain authenticator failed for ([49.124.153.12]) [49.124.153.12]:56198: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)49.124.153.121733045j9  -a' ossec13001gwExim Auth failed2025-02-28 20:13:03 dovecot_plain authenticator failed for ([103.183.11.30]) [103.183.11.30]:45840: 535 Incorrect authentication data (set_id=services@heipowersystem.com)103.183.11.301643084g8  -[' ossec13001gKExim Auth failed2025-02-28 20:12:18 dovecot_plain authenticator failed for ([188.227.66.92]) [188.227.66.92]:52432: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)188.227.66.922017370Z7  -?) ossec13001gExim Auth failed2025-02-28 20:02:51 dovecot_plain authenticator failed for ([183.100.18.224]) [183.100.18.224]:55296: 535 Incorrect authentication data (set_id=services)183.100.18.2241835841}6  -' ossec13001gExim Auth failed2025-02-28 20:02:39 dovecot_plain authenticator failed for syn-172-090-128-097.res.spectrum.com [172.90.128.97]:64815: 535 Incorrect authentication data (set_id=services@heipowersystem.com)172.90.128.976252001Q5  -1% ossec13001gExim Auth failed2025-02-28 20:01:34 dovecot_plain authenticator failed for ([58.22.255.28]) [58.22.255.28]:55391: 535 Incorrect authentication data (set_id=sales)58.22.255.281814991x4  -}' ossec13001gȶExim Auth failed2025-02-28 20:01:17 dovecot_plain authenticator failed for (109.cpe-186-68-83.gye.satnet.net) [186.68.83.109]:57724: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)186.68.83.1093658394Q3  -1% ossec13001gExim Auth failed2025-02-28 19:58:16 dovecot_plain authenticator failed for ([103.95.156.1]) [42.1.117.226]:55021: 535 Incorrect authentication data (set_id=sales)42.1.117.2261562822v2  -}# ossec13001gExim Auth failed2025-02-28 19:57:59 dovecot_plain authenticator failed for as007174.dynamic.ppp.asahi-net.or.jp [150.9.7.174]:48392: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)150.9.7.1741861060]1  -C+ ossec13001g|Exim Auth failed2025-02-28 19:56:02 dovecot_plain authenticator failed for ([171.244.142.135]) [171.244.142.135]:61255: 535 Incorrect authentication data (set_id=services)171.244.142.1351562822v0  -{% ossec13001g^Exim Auth failed2025-02-28 19:55:33 dovecot_plain authenticator failed for 89-160-38-13.cust.bredband2.com [89.160.38.13]:38388: 535 Incorrect authentication data (set_id=services@heipowersystem.com)89.160.38.132661886Z/  -?) ossec13001gƂExim Auth failed2025-02-28 19:51:52 dovecot_plain authenticator failed for ([125.136.163.86]) [125.136.163.86]:51586: 535 Incorrect authentication data (set_id=services)125.136.163.861835841m.  -e) ossec13001gnExim Auth failed2025-02-28 19:51:33 dovecot_plain authenticator failed for ([216.194.174.103]) [216.194.174.27]:5294: 535 Incorrect authentication data (set_id=services@heipowersystem.com)216.194.174.276252001Z-  -=+ ossec13001gExim Auth failed2025-02-28 19:45:55 dovecot_plain authenticator failed for ([175.156.139.195]) [175.156.139.195]:41830: 535 Incorrect authentication data (set_id=sales)175.156.139.1951880251m,  -e) ossec13001gExim Auth failed2025-02-28 19:44:58 dovecot_plain authenticator failed for ([49.205.177.146]) [223.239.159.21]:56974: 535 Incorrect authentication data (set_id=services@heipowersystem.com)223.239.159.211269750m+  -c+ ossec13001gExim Auth failed2025-02-28 19:45:46 dovecot_plain authenticator failed for ([190.211.250.118]) [190.211.250.122]:53895: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)190.211.250.1223895114  " . F [ +M`L  -S# ossec13001gAExim Auth failed2025-02-28 20:50:33 dovecot_plain authenticator failed for ([2.55.64.191]) [2.55.64.191]:47786: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)2.55.64.191294640$K  3O' ossec11301gNew FTP connection.Feb 28 20:49:29 vm1 pure-ftpd[971444]: (?@44.220.188.32) [INFO] New connection from 44.220.188.3244.220.188.3262520017J  Ag' ossec11302gFTP Authentication failed.Feb 28 20:49:33 vm1 pure-ftpd[971444]: (?@44.220.188.32) [WARNING] Authentication failed for user [anonymous]44.220.188.326252001ZI  -?) ossec13001gExim Auth failed2025-02-28 20:41:20 dovecot_plain authenticator failed for ([114.247.207.98]) [114.247.207.98]:55775: 535 Incorrect authentication data (set_id=services)114.247.207.981814991jH  -a' ossec13001g Exim Auth failed2025-02-28 20:41:08 dovecot_plain authenticator failed for ([203.147.98.39]) [203.147.98.39]:48882: 535 Incorrect authentication data (set_id=services@heipowersystem.com)203.147.98.392077456WG  -;' ossec13001gжExim Auth failed2025-02-28 20:35:25 dovecot_plain authenticator failed for ([49.124.149.20]) [49.124.149.20]:60470: 535 Incorrect authentication data (set_id=services)49.124.149.201733045yF  -' ossec13001gТExim Auth failed2025-02-28 20:35:05 dovecot_plain authenticator failed for (rw-00130-94.59.137.rcil.gov.in) [137.59.94.130]:36928: 535 Incorrect authentication data (set_id=services@heipowersystem.com)137.59.94.1301269750TE  -5' ossec13001g`Exim Auth failed2025-02-28 20:33:59 dovecot_plain authenticator failed for ([31.173.20.146]) [31.173.20.146]:60040: 535 Incorrect authentication data (set_id=sales)31.173.20.1462017370gD  -[' ossec13001gTExim Auth failed2025-02-28 20:33:47 dovecot_plain authenticator failed for ([118.122.38.74]) [118.122.38.74]:40004: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)118.122.38.741814991`C  -K) ossec13001gExim Auth failed2025-02-28 20:31:54 dovecot_plain authenticator failed for (azteca-comunicaciones.com) [186.148.187.91]:46220: 535 Incorrect authentication data (set_id=sales)186.148.187.913686110jB  -_) ossec13001gExim Auth failed2025-02-28 20:31:36 dovecot_plain authenticator failed for ([197.255.138.31]) [197.255.138.31]:47468: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)197.255.138.313374766QA  -1% ossec13001gϠExim Auth failed2025-02-28 20:30:48 dovecot_login authenticator failed for ([43.154.94.85]) [43.154.94.85]:50814: 535 Incorrect authentication data (set_id=sales)43.154.94.851819730g@  -[' ossec13001gφExim Auth failed2025-02-28 20:30:21 dovecot_login authenticator failed for ([110.52.91.145]) [110.52.91.145]:32842: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)110.52.91.1451814991d?  -U' ossec13001g|Exim Auth failed2025-02-28 20:30:11 dovecot_plain authenticator failed for ool-45734cba.dyn.optonline.net [69.115.76.186]:56288: 535 Incorrect authentication data (set_id=services)69.115.76.1866252001p>  -i+ ossec13001grExim Auth failed2025-02-28 20:30:00 dovecot_plain authenticator failed for ([123.210.152.243]) [123.210.152.243]:33816: 535 Incorrect authentication data (set_id=services@heipowersystem.com)123.210.152.2432077456f=  -W) ossec13001g2Exim Auth failed2025-02-28 20:28:56 dovecot_login authenticator failed for ([158.140.39.128]) [158.140.39.128]:47186: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)158.140.39.1286252001p<  -q# ossec13001g Exim Auth failed2025-02-28 20:28:38 dovecot_login authenticator failed for ([59.7.57.174]) [59.7.57.174]:44470: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)59.7.57.1741835841 > P \ ZimV\  -7) ossec13001gّExim Auth failed2025-02-28 21:13:11 dovecot_login authenticator failed for (rokamauka.com) [124.160.63.122]:10532: 535 Incorrect authentication data (set_id=nologin)124.160.63.1221814991T[  -7% ossec13001gفExim Auth failed2025-02-28 21:12:56 dovecot_login authenticator failed for ([114.242.175.187]) [36.112.75.46]:11192: 535 Incorrect authentication data (set_id=sales)36.112.75.461814991lZ  -c) ossec13001gٱExim Auth failed2025-02-28 21:13:43 dovecot_plain authenticator failed for syn-172-100-186-071.res.spectrum.com [172.100.186.71]:34388: 535 Incorrect authentication data (set_id=services)172.100.186.716252001tY  -y# ossec13001g٣Exim Auth failed2025-02-28 21:13:30 dovecot_plain authenticator failed for h77-53-61-95.cust.bredband2.com [77.53.61.95]:37561: 535 Incorrect authentication data (set_id=services@heipowersystem.com)77.53.61.952661886TX  -5' ossec13001gVExim Auth failed2025-02-28 21:12:14 dovecot_plain authenticator failed for ([49.124.151.35]) [49.124.151.35]:39290: 535 Incorrect authentication data (set_id=sales)49.124.151.351733045xW  -# ossec13001gZExim Auth failed2025-02-28 21:12:18 dovecot_login authenticator failed for (98.4.27.218.adsl-pool.jlccptt.net.cn) [218.27.4.98]:34990: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)218.27.4.981814991mV  -c+ ossec13001g2Exim Auth failed2025-02-28 21:11:37 dovecot_plain authenticator failed for ([117.141.148.187]) [117.141.148.187]:59133: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)117.141.148.1871814991IU  = + ossec13008gdMail Reciepient rejected2025-02-28 21:08:11 H=(mail.s2seducationtrust.com) [165.154.227.103]:61248 F= rejected RCPT : Rejected relay attempt: '165.154.227.103' From: 'wabchbcs@s2seducationtrust.com' To: 'goofile@fastmail.com'165.154.227.1031668284hT  -_% ossec13001g Exim Auth failed2025-02-28 21:07:04 dovecot_plain authenticator failed for syn-075-080-065-214.biz.spectrum.com [75.80.65.214]:54970: 535 Incorrect authentication data (set_id=services)75.80.65.2146252001mS  -e) ossec13001gExim Auth failed2025-02-28 21:06:48 dovecot_plain authenticator failed for ([167.250.118.53]) [167.250.118.53]:53381: 535 Incorrect authentication data (set_id=services@heipowersystem.com)167.250.118.533865483}R  -+ ossec13001gExim Auth failed2025-02-28 21:06:26 dovecot_plain authenticator failed for (165-220-154-126.cust.exede.net) [165.220.154.126]:50978: 535 Incorrect authentication data (set_id=services@heipowersystem.com)165.220.154.1263175395SQ  -5% ossec13001gExim Auth failed2025-02-28 21:01:51 dovecot_plain authenticator failed for ([27.71.20.180]) [27.71.20.180]:8292: 535 Incorrect authentication data (set_id=services)27.71.20.1801562822pP  -i+ ossec13001gExim Auth failed2025-02-28 21:01:13 dovecot_plain authenticator failed for ([102.223.195.154]) [102.223.195.154]:53706: 535 Incorrect authentication data (set_id=services@heipowersystem.com)102.223.195.1542434508jO  -_) ossec13001gExim Auth failed2025-02-28 20:54:09 dovecot_plain authenticator failed for ([213.230.64.246]) [213.230.64.246]:44306: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)213.230.64.2461512440QN  -1% ossec13001g+Exim Auth failed2025-02-28 20:54:26 dovecot_plain authenticator failed for ([59.22.68.213]) [59.22.68.213]:39663: 535 Incorrect authentication data (set_id=sales)59.22.68.2131835841iM  -]) ossec13001gUExim Auth failed2025-02-28 20:50:53 dovecot_plain authenticator failed for syn-070-127-232-248.res.spectrum.com [70.127.232.248]:46328: 535 Incorrect authentication data (set_id=sales)70.127.232.2486252001 i= E s w )9Ki^m  -K% ossec13001gjExim Auth failed2025-02-28 21:42:25 dovecot_plain authenticator failed for bb121-7-26-195.singnet.com.sg [121.7.26.195]:58062: 535 Incorrect authentication data (set_id=sales)121.7.26.1951880251jl  -_) ossec13001g`Exim Auth failed2025-02-28 21:42:15 dovecot_plain authenticator failed for ([191.59.206.191]) [191.59.206.191]:52678: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)191.59.206.1913469034'k  3S) ossec11301gFNew FTP connection.Feb 28 21:41:50 vm1 pure-ftpd[982319]: (?@194.165.16.166) [INFO] New connection from 194.165.16.166194.165.16.1662993457Aj  =}) ossec13008g2Mail Reciepient rejected2025-02-28 21:41:28 H=(mail.heipowersystem.com) [165.154.213.54]:55373 F= rejected RCPT : Rejected relay attempt: '165.154.213.54' From: 'czaodmvknl@heipowersystem.com' To: 'goofile@fastmail.com'165.154.213.543469034Wi  -;' ossec13001gExim Auth failed2025-02-28 21:40:01 dovecot_plain authenticator failed for ([49.124.151.24]) [49.124.151.24]:50900: 535 Incorrect authentication data (set_id=services)49.124.151.241733045jh  -a' ossec13001g߾Exim Auth failed2025-02-28 21:39:33 dovecot_plain authenticator failed for ([41.216.169.13]) [41.216.169.13]:33292: 535 Incorrect authentication data (set_id=services@heipowersystem.com)41.216.169.132328926mg  -e) ossec13001gFExim Auth failed2025-02-28 21:37:32 dovecot_login authenticator failed for (nsg-static-218.129.72.182.airtel.in) [182.72.129.218]:55879: 535 Incorrect authentication data (set_id=services)182.72.129.2181269750pf  -i+ ossec13001g4Exim Auth failed2025-02-28 21:37:15 dovecot_login authenticator failed for ([112.172.126.247]) [112.172.126.247]:54804: 535 Incorrect authentication data (set_id=services@heipowersystem.com)112.172.126.2471835841ee  -W' ossec13001gݙExim Auth failed2025-02-28 21:30:25 dovecot_plain authenticator failed for 124-11-130-37.static.tfn.net.tw [124.11.130.37]:36591: 535 Incorrect authentication data (set_id=services)124.11.130.371668284gd  -]% ossec13001g݂Exim Auth failed2025-02-28 21:30:01 dovecot_plain authenticator failed for ([27.71.20.180]) [27.71.20.180]:23603: 535 Incorrect authentication data (set_id=services@heipowersystem.com)27.71.20.1801562822gc  -[' ossec13001gGExim Auth failed2025-02-28 21:29:03 dovecot_plain authenticator failed for ([46.21.240.186]) [46.21.240.186]:58124: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)46.21.240.1862017370]b  -C+ ossec13001gsExim Auth failed2025-02-28 21:21:15 dovecot_plain authenticator failed for ([103.113.177.216]) [103.113.177.216]:42402: 535 Incorrect authentication data (set_id=services)103.113.177.2161605651xa  -{) ossec13001g]Exim Auth failed2025-02-28 21:20:52 dovecot_plain authenticator failed for p38012-obmd01.osaka.ocn.ne.jp [153.141.225.12]:40520: 535 Incorrect authentication data (set_id=services@heipowersystem.com)153.141.225.121861060N`  --# ossec13001gۅExim Auth failed2025-02-28 21:21:32 dovecot_plain authenticator failed for ([112.94.6.54]) [112.94.6.54]:28740: 535 Incorrect authentication data (set_id=sales)112.94.6.541814991t_  -s) ossec13001gyExim Auth failed2025-02-28 21:21:21 dovecot_plain authenticator failed for (124-170-38-136.tpgi.com.au) [124.170.38.136]:48919: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)124.170.38.1362077456Q^  -1% ossec13001gyExim Auth failed2025-02-28 21:17:03 dovecot_plain authenticator failed for ([180.7.180.24]) [180.7.180.24]:50150: 535 Incorrect authentication data (set_id=sales)180.7.180.241861060j]  -_) ossec13001g]Exim Auth failed2025-02-28 21:16:36 dovecot_plain authenticator failed for ([138.75.118.229]) [138.75.118.229]:52722: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)138.75.118.2291880251 o1 C [ g w);MoZ~  -=+ ossec13001g,Exim Auth failed2025-02-28 22:06:59 dovecot_plain authenticator failed for ([175.156.154.149]) [175.156.154.149]:58742: 535 Incorrect authentication data (set_id=sales)175.156.154.1491880251j}  -a' ossec13001gExim Auth failed2025-02-28 22:05:55 dovecot_plain authenticator failed for ([61.108.83.138]) [61.108.83.138]:42571: 535 Incorrect authentication data (set_id=services@heipowersystem.com)61.108.83.1381835841j|  -_) ossec13001g Exim Auth failed2025-02-28 22:06:46 dovecot_plain authenticator failed for ([112.111.61.229]) [112.111.61.229]:44186: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)112.111.61.2291814991T{  -7% ossec13001g Exim Auth failed2025-02-28 22:06:24 dovecot_plain authenticator failed for ([27.72.103.74]) [27.72.103.74]:52266: 535 Incorrect authentication data (set_id=services)27.72.103.741562822'z  3S) ossec11301gNew FTP connection.Feb 28 22:05:02 vm1 pure-ftpd[987180]: (?@199.45.154.153) [INFO] New connection from 199.45.154.153199.45.154.1536252001Vy  -;' ossec13001gSExim Auth failed2025-02-28 21:59:07 dovecot_plain authenticator failed for ([188.59.88.234]) [188.59.88.234]:33495: 535 Incorrect authentication data (set_id=services)188.59.88.234298795mx  -e) ossec13001gKExim Auth failed2025-02-28 21:58:58 dovecot_plain authenticator failed for ([124.155.205.64]) [124.155.205.64]:59812: 535 Incorrect authentication data (set_id=services@heipowersystem.com)124.155.205.641880251Cw  =+ ossec13008gIMail Reciepient rejected2025-02-28 21:58:57 H=(mail.thepsindustries.com) [165.154.227.105]:60351 F= rejected RCPT : Rejected relay attempt: '165.154.227.105' From: 'zoxbqezd@thepsindustries.com' To: 'goofile@fastmail.com'165.154.227.1051668284gv  -[' ossec13001g9Exim Auth failed2025-02-28 21:58:41 dovecot_plain authenticator failed for ([49.124.151.54]) [49.124.151.54]:50184: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)49.124.151.541733045^u  -I' ossec13001gExim Auth failed2025-02-28 21:56:38 dovecot_plain authenticator failed for d54c70cda.static.telenet.be [84.199.12.218]:44800: 535 Incorrect authentication data (set_id=sales)84.199.12.2182802361t  - + ossec13001gExim Auth failed2025-02-28 21:56:29 dovecot_plain authenticator failed for net-188-219-104-210.cust.vodafonedsl.it [188.219.104.210]:55473: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)188.219.104.2103175395Ss  -7% ossec13001gExim Auth failed2025-02-28 21:52:08 dovecot_plain authenticator failed for ([196.0.34.106]) [196.0.34.106]:60537: 535 Incorrect authentication data (set_id=services)196.0.34.106226074pr  -i+ ossec13001gExim Auth failed2025-02-28 21:51:45 dovecot_plain authenticator failed for ([197.149.125.227]) [197.149.125.227]:47718: 535 Incorrect authentication data (set_id=services@heipowersystem.com)197.149.125.2272328926dq  -Q+ ossec13001gExim Auth failed2025-02-28 21:49:17 dovecot_plain authenticator failed for p98174-obmd01.tokyo.ocn.ne.jp [124.101.254.174]:59455: 535 Incorrect authentication data (set_id=sales)124.101.254.1741861060jp  -_) ossec13001gExim Auth failed2025-02-28 21:49:02 dovecot_plain authenticator failed for ([220.77.182.171]) [220.77.182.171]:50300: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)220.77.182.1711835841]o  -C+ ossec13001gExim Auth failed2025-02-28 21:47:33 dovecot_plain authenticator failed for ([103.186.221.174]) [103.186.221.174]:43402: 535 Incorrect authentication data (set_id=services)103.186.221.1741269750jn  -a' ossec13001gExim Auth failed2025-02-28 21:47:24 dovecot_plain authenticator failed for ([219.248.65.30]) [219.248.65.30]:34967: 535 Incorrect authentication data (set_id=services@heipowersystem.com)219.248.65.301835841 y 54Yhm  -c+ ossec13001gExim Auth failed2025-02-28 22:40:16 dovecot_plain authenticator failed for ([211.117.144.194]) [211.117.144.194]:51336: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)211.117.144.1941835841i  -]) ossec13001gExim Auth failed2025-02-28 22:36:32 dovecot_plain authenticator failed for 227.42.246.220.static.netvigator.com [220.246.42.227]:60261: 535 Incorrect authentication data (set_id=sales)220.246.42.2271819730f  -[' ossec13001gExim Auth failed2025-02-28 22:36:21 dovecot_plain authenticator failed for ([185.167.56.24]) [185.167.56.24]:39986: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)185.167.56.24617790W  -;' ossec13001g}Exim Auth failed2025-02-28 22:33:57 dovecot_plain authenticator failed for ([58.238.181.96]) [58.238.181.96]:35669: 535 Incorrect authentication data (set_id=services)58.238.181.961835841m  -e) ossec13001geExim Auth failed2025-02-28 22:33:32 dovecot_plain authenticator failed for ([119.200.229.33]) [119.200.229.33]:39378: 535 Incorrect authentication data (set_id=services@heipowersystem.com)119.200.229.331835841W  -;' ossec13001gExim Auth failed2025-02-28 22:25:48 dovecot_plain authenticator failed for ([180.7.191.212]) [180.7.191.212]:57284: 535 Incorrect authentication data (set_id=services)180.7.191.2121861060}  - % ossec13001gExim Auth failed2025-02-28 22:25:26 dovecot_plain authenticator failed for broadband-5-228-34-254.ip.moscow.rt.ru [5.228.34.254]:58506: 535 Incorrect authentication data (set_id=services@heipowersystem.com)5.228.34.2542017370]  -K# ossec13001g=Exim Auth failed2025-02-28 22:24:21 dovecot_plain authenticator failed for 1-34-128-40.hinet-ip.hinet.net [1.34.128.40]:58357: 535 Incorrect authentication data (set_id=sales)1.34.128.401668284}  -' ossec13001g/Exim Auth failed2025-02-28 22:24:05 dovecot_plain authenticator failed for ipb21949c7.dynamic.kabel-deutschland.de [178.25.73.199]:57436: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)178.25.73.1992921044W  -;' ossec13001gSExim Auth failed2025-02-28 22:20:25 dovecot_plain authenticator failed for ([112.132.89.72]) [112.132.89.72]:60891: 535 Incorrect authentication data (set_id=services)112.132.89.721814991j  -a' ossec13001g2Exim Auth failed2025-02-28 22:19:54 dovecot_plain authenticator failed for ([59.13.237.163]) [59.13.237.163]:38040: 535 Incorrect authentication data (set_id=services@heipowersystem.com)59.13.237.1631835841j  -_) ossec13001gExim Auth failed2025-02-28 22:19:01 dovecot_plain authenticator failed for ([125.136.163.86]) [125.136.163.86]:46088: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)125.136.163.861835841T  -5' ossec13001gExim Auth failed2025-02-28 22:19:33 dovecot_plain authenticator failed for ([111.124.47.11]) [111.124.47.11]:58992: 535 Incorrect authentication data (set_id=sales)111.124.47.111814991g  -[' ossec13001g0Exim Auth failed2025-02-28 22:15:36 dovecot_login authenticator failed for syn-071-066-157-177.biz.spectrum.com [71.66.157.177]:58161: 535 Incorrect authentication data (set_id=sales)71.66.157.1776252001d  -W% ossec13001gExim Auth failed2025-02-28 22:15:14 dovecot_login authenticator failed for ([58.22.255.28]) [58.22.255.28]:40247: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)58.22.255.281814991  Ui) ossec11001g2Deferred login on the cpanel service[2025-02-28 22:07:05 +0530] info [webmaild] 223.238.195.97 - kps@amplifypowerglobal.com "POST /cpsess1946006019/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [223.238.203.116] != Current IP Address [223.238.195.97]223.238.195.971269750 C&8 M N N x  CY  -?) ossec13001gExim Auth failed2025-02-28 23:04:55 dovecot_plain authenticator failed for ([94.204.230.214]) [94.204.230.214]:37880: 535 Incorrect authentication data (set_id=services)94.204.230.214290557m  -e) ossec13001gExim Auth failed2025-02-28 23:04:22 dovecot_plain authenticator failed for ([213.255.219.43]) [213.255.219.43]:59891: 535 Incorrect authentication data (set_id=services@heipowersystem.com)213.255.219.432782113a  -O' ossec13001gExim Auth failed2025-02-28 23:03:57 dovecot_plain authenticator failed for p168053-obmd01.tokyo.ocn.ne.jp [153.141.61.53]:48520: 535 Incorrect authentication data (set_id=sales)153.141.61.531861060g  -[' ossec13001g{Exim Auth failed2025-02-28 23:03:46 dovecot_plain authenticator failed for ([146.88.78.123]) [146.88.78.123]:46383: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)146.88.78.1231694008b  -O) ossec13001gYExim Auth failed2025-02-28 22:58:56 dovecot_login authenticator failed for ([222.119.98.157]) [222.119.98.157]:42658: 535 Incorrect authentication data (set_id=vikas.khandelwal)222.119.98.1571835841  -1# ossec13001gCExim Auth failed2025-02-28 22:58:34 dovecot_login authenticator failed for (70.246.50.116.ids.service.static.eastern-tele.com) [58.69.17.18]:38322: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)58.69.17.181694008Z  -?) ossec13001gsExim Auth failed2025-02-28 22:55:05 dovecot_plain authenticator failed for ([124.246.94.219]) [124.246.94.219]:44667: 535 Incorrect authentication data (set_id=services)124.246.94.2191880251}  -+ ossec13001ggExim Auth failed2025-02-28 22:54:54 dovecot_plain authenticator failed for (165-220-169-113.cust.exede.net) [165.220.169.113]:60378: 535 Incorrect authentication data (set_id=services@heipowersystem.com)165.220.169.1132635167e  -U) ossec13001g%Exim Auth failed2025-02-28 22:53:48 dovecot_plain authenticator failed for (198-100-138-79.douglasfast.net) [198.100.138.79]:34259: 535 Incorrect authentication data (set_id=sales)198.100.138.796252001d  -W% ossec13001gExim Auth failed2025-02-28 22:53:37 dovecot_plain authenticator failed for ([103.68.38.78]) [103.68.38.78]:47164: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)103.68.38.781269750i  -_' ossec13001gExim Auth failed2025-02-28 22:46:56 dovecot_plain authenticator failed for c-71-193-102-94.hsd1.tn.comcast.net [71.193.102.94]:47128: 535 Incorrect authentication data (set_id=services)71.193.102.946252001R  -5' ossec13001gExim Auth failed2025-02-28 22:47:32 dovecot_plain authenticator failed for ([65.20.205.197]) [65.20.205.197]:41146: 535 Incorrect authentication data (set_id=sales)65.20.205.19799237|  -) ossec13001gExim Auth failed2025-02-28 22:46:48 dovecot_plain authenticator failed for 144.46.246.220.static.netvigator.com [220.246.46.144]:60380: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)220.246.46.1441819730{  -% ossec13001gnExim Auth failed2025-02-28 22:46:29 dovecot_plain authenticator failed for syn-072-017-090-246.biz.spectrum.com [72.17.90.246]:44278: 535 Incorrect authentication data (set_id=services@heipowersystem.com)72.17.90.2466252001g  -W+ ossec13001g:Exim Auth failed2025-02-28 22:41:21 dovecot_plain authenticator failed for p46245-obmd01.osaka.ocn.ne.jp [153.141.233.245]:45637: 535 Incorrect authentication data (set_id=services)153.141.233.2451861060j  -a' ossec13001g*Exim Auth failed2025-02-28 22:41:05 dovecot_plain authenticator failed for ([220.92.25.189]) [220.92.25.189]:37757: 535 Incorrect authentication data (set_id=services@heipowersystem.com)220.92.25.1891835841V  -7) ossec13001gExim Auth failed2025-02-28 22:40:36 dovecot_plain authenticator failed for ([222.242.204.22]) [222.242.204.22]:3557: 535 Incorrect authentication data (set_id=sales)222.242.204.221814991  ) L ^ N]vj0  -_) ossec13001gExim Auth failed2025-02-28 23:38:18 dovecot_plain authenticator failed for ([111.75.243.251]) [111.75.243.251]:46950: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)111.75.243.2511814991]/  -C+ ossec13001gyExim Auth failed2025-02-28 23:33:36 dovecot_plain authenticator failed for ([115.242.200.126]) [115.242.200.126]:34616: 535 Incorrect authentication data (set_id=services)115.242.200.1261269750m.  -e) ossec13001gUExim Auth failed2025-02-28 23:32:59 dovecot_plain authenticator failed for ([112.111.61.231]) [112.111.61.229]:46302: 535 Incorrect authentication data (set_id=services@heipowersystem.com)112.111.61.2291814991c-  -Q) ossec13001gExim Auth failed2025-02-28 23:32:01 dovecot_plain authenticator failed for ip72-199-156-231.sd.sd.cox.net [72.199.156.231]:59222: 535 Incorrect authentication data (set_id=sales)72.199.156.2316252001m,  -c+ ossec13001g Exim Auth failed2025-02-28 23:31:45 dovecot_plain authenticator failed for ([121.178.185.141]) [121.178.185.141]:57414: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)121.178.185.1411835841%+  3Q' ossec11301ggNew FTP connection.Feb 28 23:29:01 vm1 pure-ftpd[1004728]: (?@20.171.25.155) [INFO] New connection from 20.171.25.15520.171.25.1556252001S*  -5' ossec13001gIExim Auth failed2025-02-28 23:28:31 dovecot_plain authenticator failed for ([94.202.148.15]) [94.202.148.15]:41196: 535 Incorrect authentication data (set_id=sales)94.202.148.15290557y)  -}) ossec13001g;Exim Auth failed2025-02-28 23:28:17 dovecot_plain authenticator failed for 46-162-112-159.cust.bredband2.com [46.162.112.159]:54414: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)46.162.112.1592661886[(  -A) ossec13001gExim Auth failed2025-02-28 23:22:33 dovecot_plain authenticator failed for ([159.223.250.131]) [161.35.200.202]:45440: 535 Incorrect authentication data (set_id=services)161.35.200.2022921044j'  -a' ossec13001gExim Auth failed2025-02-28 23:22:24 dovecot_plain authenticator failed for ([111.48.214.96]) [111.48.214.96]:14438: 535 Incorrect authentication data (set_id=services@heipowersystem.com)111.48.214.961814991j&  -a' ossec13001gExim Auth failed2025-02-28 23:21:29 dovecot_plain authenticator failed for ([61.108.83.138]) [61.108.83.138]:58960: 535 Incorrect authentication data (set_id=services@heipowersystem.com)61.108.83.1381835841T%  -5' ossec13001gFExim Auth failed2025-02-28 23:15:41 dovecot_plain authenticator failed for ([116.88.187.44]) [116.88.187.44]:40986: 535 Incorrect authentication data (set_id=sales)116.88.187.441880251j$  -_) ossec13001g<Exim Auth failed2025-02-28 23:15:31 dovecot_plain authenticator failed for ([221.199.172.66]) [221.199.172.66]:42100: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)221.199.172.661814991Y#  -?) ossec13001gExim Auth failed2025-02-28 23:12:53 dovecot_plain authenticator failed for ([94.204.208.189]) [94.204.208.189]:41508: 535 Incorrect authentication data (set_id=services)94.204.208.189290557W"  -9) ossec13001gExim Auth failed2025-02-28 23:12:52 dovecot_plain authenticator failed for ([218.98.160.117]) [218.98.160.117]:15328: 535 Incorrect authentication data (set_id=sales)218.98.160.1171814991}!  -' ossec13001gExim Auth failed2025-02-28 23:12:44 dovecot_plain authenticator failed for syn-071-012-241-225.res.spectrum.com [71.12.241.225]:33552: 535 Incorrect authentication data (set_id=services@heipowersystem.com)71.12.241.2256252001w  -w+ ossec13001gExim Auth failed2025-02-28 23:12:30 dovecot_plain authenticator failed for p56107-obmd01.osaka.ocn.ne.jp [153.141.243.107]:33270: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)153.141.243.1071861060 !U a H N p!l@  -c) ossec13001gExim Auth failed2025-03-01 00:01:07 dovecot_plain authenticator failed for 0x3ec67866.ejb.customer.dk.telia.net [62.198.120.102]:39565: 535 Incorrect authentication data (set_id=services)62.198.120.1022623032{?  -% ossec13001gExim Auth failed2025-03-01 00:00:59 dovecot_plain authenticator failed for syn-072-017-090-246.biz.spectrum.com [72.17.90.246]:46892: 535 Incorrect authentication data (set_id=services@heipowersystem.com)72.17.90.2466252001c>  -Y# ossec13001gExim Auth failed2025-02-28 23:59:47 dovecot_plain authenticator failed for ([95.0.252.72]) [95.0.252.72]:38910: 535 Incorrect authentication data (set_id=services@heipowersystem.com)95.0.252.72298795y=  -}) ossec13001g6Exim Auth failed2025-02-28 23:58:05 dovecot_plain authenticator failed for s75-152-225-154.ab.hsia.telus.net [75.152.225.154]:52210: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)75.152.225.1546251999b<  -Q' ossec13001gPExim Auth failed2025-02-28 23:58:32 dovecot_plain authenticator failed for 24-220-250-67-dynamic.midco.net [24.220.250.67]:53380: 535 Incorrect authentication data (set_id=sales)24.220.250.676252001T;  -5' ossec13001gFExim Auth failed2025-02-28 23:54:05 dovecot_login authenticator failed for ([85.26.221.136]) [85.26.221.136]:51134: 535 Incorrect authentication data (set_id=sales)85.26.221.1362017370m:  -c+ ossec13001g:Exim Auth failed2025-02-28 23:53:54 dovecot_login authenticator failed for ([175.156.139.195]) [175.156.139.195]:41621: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)175.156.139.1951880251a9  -M) ossec13001gExim Auth failed2025-02-28 23:51:44 dovecot_plain authenticator failed for (124-170-38-136.tpgi.com.au) [124.170.38.136]:44381: 535 Incorrect authentication data (set_id=sales)124.170.38.1362077456d8  -W% ossec13001gExim Auth failed2025-02-28 23:51:33 dovecot_plain authenticator failed for ([221.162.9.13]) [221.162.9.13]:34680: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)221.162.9.131835841Z7  -?) ossec13001g~Exim Auth failed2025-02-28 23:46:29 dovecot_plain authenticator failed for ([119.200.229.33]) [119.200.229.33]:45470: 535 Incorrect authentication data (set_id=services)119.200.229.331835841v6  -{% ossec13001gbExim Auth failed2025-02-28 23:46:02 dovecot_plain authenticator failed for 46-162-74-47.cust.bredband2.com [46.162.74.47]:49246: 535 Incorrect authentication data (set_id=services@heipowersystem.com)46.162.74.472661886C5  =+ ossec13008gMail Reciepient rejected2025-02-28 23:43:06 H=(mail.fablixsolutions.com) [165.154.233.146]:62970 F= rejected RCPT : Rejected relay attempt: '165.154.233.146' From: 'pykpzpls@fablixsolutions.com' To: 'goofile@fastmail.com'165.154.233.1461694008N4  -/! ossec13001gExim Auth failed2025-02-28 23:43:02 dovecot_plain authenticator failed for ([45.6.80.40]) [45.6.80.40]:51906: 535 Incorrect authentication data (set_id=services)45.6.80.403469034p3  -i+ ossec13001gExim Auth failed2025-02-28 23:42:36 dovecot_plain authenticator failed for ([103.219.154.156]) [103.219.154.156]:40676: 535 Incorrect authentication data (set_id=services@heipowersystem.com)103.219.154.1562750405$2  3Q' ossec11301gsNew FTP connection.Feb 28 23:42:01 vm1 pure-ftpd[1007502]: (?@193.32.162.38) [INFO] New connection from 193.32.162.38193.32.162.387985491  -+ ossec13001gExim Auth failed2025-02-28 23:38:28 dovecot_plain authenticator failed for lnsm1-torontoxn-142-116-116-160.internet.virginmobile.ca [142.116.116.160]:50228: 535 Incorrect authentication data (set_id=sales)142.116.116.1606251999 k  'F,Q[klQ  -e' ossec13001gExim Auth failed2025-03-01 00:29:52 dovecot_plain authenticator failed for (csub-24-224-69-119.mi-connection.com) [24.224.69.119]:56634: 535 Incorrect authentication data (set_id=services)24.224.69.1196252001rP  -u# ossec13001gExim Auth failed2025-03-01 00:29:25 dovecot_plain authenticator failed for p70008-obmd01.osaka.ocn.ne.jp [180.7.117.7]:51569: 535 Incorrect authentication data (set_id=services@heipowersystem.com)180.7.117.71861060WO  -9) ossec13001gExim Auth failed2025-03-01 00:22:29 dovecot_plain authenticator failed for ([183.100.18.224]) [183.100.18.224]:42816: 535 Incorrect authentication data (set_id=sales)183.100.18.2241835841jN  -_) ossec13001gExim Auth failed2025-03-01 00:22:17 dovecot_plain authenticator failed for ([213.230.64.246]) [213.230.64.246]:37156: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)213.230.64.2461512440(M  =K) ossec13008gMail Reciepient rejected2025-03-01 00:17:34 H=(mail.hsnews.in) [165.154.226.38]:53845 F= rejected RCPT : Rejected relay attempt: '165.154.226.38' From: 'pqbqanhhwpz@hsnews.in' To: 'goofile@fastmail.com'165.154.226.381668284]L  -C+ ossec13001guExim Auth failed2025-03-01 00:16:13 dovecot_plain authenticator failed for ([191.241.247.150]) [191.241.247.150]:55532: 535 Incorrect authentication data (set_id=services)191.241.247.1503469034jK  -a' ossec13001gcExim Auth failed2025-03-01 00:15:54 dovecot_plain authenticator failed for ([124.160.45.26]) [124.160.45.26]:51786: 535 Incorrect authentication data (set_id=services@heipowersystem.com)124.160.45.261814991_J  -M% ossec13001gExim Auth failed2025-03-01 00:14:13 dovecot_plain authenticator failed for (W12KWEB2) [65.98.25.131]:16071: 535 Incorrect authentication data (set_id=info@vandanabalbharti.com)65.98.25.1316252001hI  -[) ossec13001gExim Auth failed2025-03-01 00:12:14 dovecot_plain authenticator failed for (136-34-165-114.googlefiber.net) [136.34.165.114]:45835: 535 Incorrect authentication data (set_id=services)136.34.165.1146252001WH  -9) ossec13001gExim Auth failed2025-03-01 00:12:13 dovecot_plain authenticator failed for ([119.200.229.33]) [119.200.229.33]:49548: 535 Incorrect authentication data (set_id=sales)119.200.229.331835841lG  -c) ossec13001gyExim Auth failed2025-03-01 00:12:01 dovecot_plain authenticator failed for (static.as64098.net) [103.79.175.115]:49198: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)103.79.175.1152077456F  -+ ossec13001gqExim Auth failed2025-03-01 00:11:53 dovecot_plain authenticator failed for (mobile-166-195-195-160.mycingular.net) [166.195.195.160]:58312: 535 Incorrect authentication data (set_id=services@heipowersystem.com)166.195.195.1606252001WE  -9) ossec13001giExim Auth failed2025-03-01 00:07:28 dovecot_plain authenticator failed for ([78.156.228.219]) [78.156.228.219]:51760: 535 Incorrect authentication data (set_id=sales)78.156.228.2192017370D  ?/ ossec1008gVProcess exiting (killed).Mar 1 00:07:10 vm1 spamd[707160]: spamd: server killed by SIGTERM, shutting downgC  -[' ossec13001g=Exim Auth failed2025-03-01 00:06:43 dovecot_plain authenticator failed for ([27.223.100.92]) [27.223.100.90]:57126: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)27.223.100.901814991fB  -W) ossec13001gxExim Auth failed2025-03-01 00:03:27 dovecot_login authenticator failed for ([111.48.140.240]) [111.48.140.240]:28000: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)111.48.140.2401814991 A  -'' ossec13001gjExim Auth failed2025-03-01 00:03:14 dovecot_login authenticator failed for (160.228-59-41.static-zone.ttcldata.net) [41.59.228.160]:53924: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)41.59.228.160149590 8  6 N I^28vb  -w) ossec13001gKExim Auth failed2025-03-01 01:15:13 dovecot_plain authenticator failed for p281103-obmd01.tokyo.ocn.ne.jp [153.141.42.102]:44515: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)153.141.42.1021861060Za  -?) ossec13001gYExim Auth failed2025-03-01 01:11:11 dovecot_plain authenticator failed for ([103.129.201.82]) [103.129.201.81]:36688: 535 Incorrect authentication data (set_id=services)103.129.201.811210997a`  -U! ossec13001gDExim Auth failed2025-03-01 01:10:51 dovecot_plain authenticator failed for ([27.0.61.49]) [27.0.61.49]:43160: 535 Incorrect authentication data (set_id=services@heipowersystem.com)27.0.61.491269750]_  -I% ossec13001gbExim Auth failed2025-03-01 01:07:06 dovecot_plain authenticator failed for ti0004q160-7861.bb.online.no [95.34.158.19]:55616: 535 Incorrect authentication data (set_id=sales)95.34.158.193144096f^  -[' ossec13001gFExim Auth failed2025-03-01 01:06:38 dovecot_plain authenticator failed for ([185.167.56.70]) [185.167.56.70]:33936: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)185.167.56.70617790y]  -' ossec13001gExim Auth failed2025-03-01 01:03:23 dovecot_plain authenticator failed for (201.173.16.21-clientes-izzi.mx) [201.173.16.21]:47195: 535 Incorrect authentication data (set_id=services@heipowersystem.com)201.173.16.213996063W\  -9) ossec13001g Exim Auth failed2025-03-01 01:01:22 dovecot_plain authenticator failed for ([124.112.45.222]) [124.112.45.222]:41018: 535 Incorrect authentication data (set_id=sales)124.112.45.2221814991d[  -W% ossec13001gExim Auth failed2025-03-01 01:01:00 dovecot_plain authenticator failed for ([2.63.169.110]) [2.63.169.110]:35498: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)2.63.169.1102017370ZZ  -?) ossec13001gExim Auth failed2025-03-01 00:59:54 dovecot_plain authenticator failed for ([122.180.242.91]) [122.180.242.91]:44364: 535 Incorrect authentication data (set_id=services)122.180.242.911269750gY  -]% ossec13001gExim Auth failed2025-03-01 00:59:44 dovecot_plain authenticator failed for ([219.159.57.4]) [219.159.57.4]:47517: 535 Incorrect authentication data (set_id=services@heipowersystem.com)219.159.57.41814991X  - ) ossec13001g Exim Auth failed2025-03-01 00:46:34 dovecot_plain authenticator failed for ppp-210-86-163-194.revip.asianet.co.th [210.86.163.194]:64518: 535 Incorrect authentication data (set_id=services@heipowersystem.com)210.86.163.1941605651dW  -Y# ossec13001g ?Exim Auth failed2025-03-01 00:40:54 dovecot_plain authenticator failed for ([119.32.11.3]) [119.32.11.3]:22372: 535 Incorrect authentication data (set_id=services@heipowersystem.com)119.32.11.31814991fV  -Y' ossec13001g Exim Auth failed2025-03-01 00:38:59 dovecot_plain authenticator failed for ([103.98.21.22]) [125.99.242.32]:42917: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)125.99.242.321269750qU  -k+ ossec13001gExim Auth failed2025-03-01 00:34:14 dovecot_plain authenticator failed for (mobile-166-195-195-160.mycingular.net) [166.195.195.160]:51107: 535 Incorrect authentication data (set_id=services)166.195.195.1606252001pT  -i+ ossec13001gExim Auth failed2025-03-01 00:33:52 dovecot_plain authenticator failed for ([178.178.194.128]) [178.178.194.128]:55916: 535 Incorrect authentication data (set_id=services@heipowersystem.com)178.178.194.1282017370S  -' ossec13001gNExim Auth failed2025-03-01 00:32:38 dovecot_plain authenticator failed for 131-106-31-52.s1842.c3-0.eas-cbr5.atw-eas.pa.cable.rcncustomer.com [131.106.31.52]:32946: 535 Incorrect authentication data (set_id=sales)131.106.31.526252001jR  -_) ossec13001gDExim Auth failed2025-03-01 00:32:27 dovecot_plain authenticator failed for ([94.181.187.192]) [94.181.187.192]:53046: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)94.181.187.1922017370 & !-Rjjs  -a' ossec13001gExim Auth failed2025-03-01 01:39:53 dovecot_plain authenticator failed for ([218.22.52.106]) [218.22.52.106]:54177: 535 Incorrect authentication data (set_id=services@heipowersystem.com)218.22.52.1061814991fr  -Y' ossec13001gExim Auth failed2025-03-01 01:39:01 dovecot_plain authenticator failed for ([58.250.157.83]) [58.250.157.83]:2050: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)58.250.157.831814991dq  -U' ossec13001gExim Auth failed2025-03-01 01:39:16 dovecot_plain authenticator failed for h77-53-235-246.cust.bredband2.com [77.53.235.246]:42986: 535 Incorrect authentication data (set_id=sales)77.53.235.2462661886Wp  -;' ossec13001gExim Auth failed2025-03-01 01:33:26 dovecot_plain authenticator failed for ([191.59.251.95]) [191.59.251.95]:32782: 535 Incorrect authentication data (set_id=services)191.59.251.953469034po  -i+ ossec13001gxExim Auth failed2025-03-01 01:33:02 dovecot_plain authenticator failed for ([201.183.225.156]) [201.183.225.156]:42238: 535 Incorrect authentication data (set_id=services@heipowersystem.com)201.183.225.1563658394Tn  -5' ossec13001gRExim Auth failed2025-03-01 01:32:26 dovecot_plain authenticator failed for ([188.227.66.92]) [188.227.66.92]:53384: 535 Incorrect authentication data (set_id=sales)188.227.66.922017370vm  -y' ossec13001gJExim Auth failed2025-03-01 01:32:17 dovecot_plain authenticator failed for 83-233-30-104.cust.bredband2.com [83.233.30.104]:48496: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)83.233.30.1042661886^l  -M# ossec13001gExim Auth failed2025-03-01 01:29:52 dovecot_plain authenticator failed for host-2-98-157-37.as13285.net [2.98.157.37]:39716: 535 Incorrect authentication data (set_id=services)2.98.157.372635167pk  -i+ ossec13001gExim Auth failed2025-03-01 01:29:31 dovecot_plain authenticator failed for ([103.115.254.158]) [103.115.254.158]:34964: 535 Incorrect authentication data (set_id=services@heipowersystem.com)103.115.254.1581210997Cj  =) ossec13008gMail Reciepient rejected2025-03-01 01:27:15 H=(mail.vandanabalbharti.com) [165.154.233.80]:59671 F= rejected RCPT : Rejected relay attempt: '165.154.233.80' From: 'nxfsyfpd@vandanabalbharti.com' To: 'goofile@fastmail.com'165.154.233.801694008Wi  -9) ossec13001gExim Auth failed2025-03-01 01:26:09 dovecot_plain authenticator failed for ([121.147.25.111]) [121.147.25.111]:54842: 535 Incorrect authentication data (set_id=sales)121.147.25.1111835841dh  -W% ossec13001gExim Auth failed2025-03-01 01:25:58 dovecot_plain authenticator failed for ([31.173.9.222]) [31.173.9.222]:33512: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)31.173.9.2222017370Zg  -?) ossec13001g%Exim Auth failed2025-03-01 01:18:52 dovecot_plain authenticator failed for ([119.200.229.33]) [119.200.229.33]:50298: 535 Incorrect authentication data (set_id=services)119.200.229.331835841ff  -]% ossec13001gExim Auth failed2025-03-01 01:18:40 dovecot_plain authenticator failed for ([37.25.33.108]) [37.25.33.108]:58568: 535 Incorrect authentication data (set_id=services@heipowersystem.com)37.25.33.108294640de  -W% ossec13001gExim Auth failed2025-03-01 01:17:59 dovecot_plain authenticator failed for ([27.2.214.145]) [27.2.214.145]:57205: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)27.2.214.1451562822d  3I# ossec11301gkNew FTP connection.Mar 1 01:15:46 vm1 pure-ftpd[1028147]: (?@20.83.52.21) [INFO] New connection from 20.83.52.2120.83.52.216252001Vc  -9) ossec13001g[Exim Auth failed2025-03-01 01:15:29 dovecot_plain authenticator failed for ([185.167.58.121]) [185.167.58.121]:36044: 535 Incorrect authentication data (set_id=sales)185.167.58.121617790 l"7 9 ? R z  -X\ll  -e) ossec13001g Exim Auth failed2025-03-01 02:17:43 dovecot_plain authenticator failed for ([196.188.187.85]) [196.188.187.85]:59028: 535 Incorrect authentication data (set_id=services@heipowersystem.com)196.188.187.85337996x  -y+ ossec13001g Exim Auth failed2025-03-01 02:17:35 dovecot_login authenticator failed for p101203-obmd01.tokyo.ocn.ne.jp [124.101.235.203]:49573: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)124.101.235.2031861060Q  -1% ossec13001g ZExim Auth failed2025-03-01 02:15:13 dovecot_plain authenticator failed for ([219.139.41.6]) [219.139.41.6]:49560: 535 Incorrect authentication data (set_id=sales)219.139.41.61814991j  -_) ossec13001g HExim Auth failed2025-03-01 02:14:56 dovecot_plain authenticator failed for ([49.124.142.137]) [49.124.142.137]:41516: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)49.124.142.1371733045m  -c+ ossec13001g <Exim Auth failed2025-03-01 02:14:43 dovecot_plain authenticator failed for ([191.241.247.150]) [191.241.247.150]:42794: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)191.241.247.1503469034] -C) ossec13001gExim Auth failed2025-03-01 02:03:57 dovecot_login authenticator failed for (thepsindustries.com) [42.193.105.109]:40312: 535 Incorrect authentication data (set_id=nologin)42.193.105.1091814991T~  -5' ossec13001gExim Auth failed2025-03-01 02:03:48 dovecot_plain authenticator failed for ([175.202.82.16]) [175.202.82.16]:53200: 535 Incorrect authentication data (set_id=sales)175.202.82.161835841j}  -_) ossec13001gExim Auth failed2025-03-01 02:03:36 dovecot_plain authenticator failed for ([37.204.170.200]) [37.204.170.200]:50023: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)37.204.170.2002017370g|  -[' ossec13001gExim Auth failed2025-03-01 02:03:25 dovecot_plain authenticator failed for ([219.248.65.30]) [219.248.65.30]:40336: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)219.248.65.301835841j{  -a' ossec13001gExim Auth failed2025-03-01 01:59:26 dovecot_plain authenticator failed for ([218.4.205.242]) [218.4.205.242]:57159: 535 Incorrect authentication data (set_id=services@heipowersystem.com)218.4.205.2421814991jz  -a' ossec13001gWExim Auth failed2025-03-01 01:53:51 dovecot_plain authenticator failed for ([111.175.39.76]) [111.175.39.76]:52599: 535 Incorrect authentication data (set_id=services@heipowersystem.com)111.175.39.761814991Ty  -7% ossec13001gcExim Auth failed2025-03-01 01:54:03 dovecot_plain authenticator failed for ([59.99.153.21]) [59.99.153.21]:44616: 535 Incorrect authentication data (set_id=services)59.99.153.211269750ix  -]) ossec13001gExim Auth failed2025-03-01 01:52:26 dovecot_plain authenticator failed for syn-173-172-152-018.res.spectrum.com [173.172.152.18]:39072: 535 Incorrect authentication data (set_id=sales)173.172.152.186252001vw  -y' ossec13001gExim Auth failed2025-03-01 01:52:16 dovecot_plain authenticator failed for h77-94-125-250.static.bashtel.ru [77.94.125.250]:52111: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)77.94.125.2502017370zv  -) ossec13001gExim Auth failed2025-03-01 01:50:31 dovecot_login authenticator failed for (46x146x227x191.static-business.perm.ertelecom.ru) [46.146.227.191]:54670: 535 Incorrect authentication data (set_id=services)46.146.227.1912017370gu  -]% ossec13001gExim Auth failed2025-03-01 01:50:20 dovecot_login authenticator failed for ([49.124.153.4]) [49.124.153.4]:41188: 535 Incorrect authentication data (set_id=services@heipowersystem.com)49.124.153.41733045Zt  -?) ossec13001g$Exim Auth failed2025-03-01 01:40:11 dovecot_plain authenticator failed for ([116.10.127.167]) [116.10.127.167]:53941: 535 Incorrect authentication data (set_id=services)116.10.127.1671814991 :C J ` u  B:W  -;' ossec13001g(Exim Auth failed2025-03-01 02:47:56 dovecot_plain authenticator failed for ([211.109.75.67]) [211.109.75.69]:54954: 535 Incorrect authentication data (set_id=services)211.109.75.691835841|  -' ossec13001g'Exim Auth failed2025-03-01 02:47:27 dovecot_plain authenticator failed for 179-189-85-66.goldnettelecom.com.br [179.189.85.66]:34494: 535 Incorrect authentication data (set_id=services@heipowersystem.com)179.189.85.663469034Q  -1% ossec13001g'Exim Auth failed2025-03-01 02:45:54 dovecot_plain authenticator failed for ([14.99.61.248]) [14.99.61.248]:35518: 535 Incorrect authentication data (set_id=sales)14.99.61.2481269750j  -_) ossec13001g'|Exim Auth failed2025-03-01 02:45:40 dovecot_plain authenticator failed for ([180.166.162.78]) [180.166.162.78]:50629: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)180.166.162.781814991f  =E+ ossec13008g'Mail Reciepient rejected2025-03-01 02:43:52 H=(mail.shivelectricaltransformers.com) [165.154.247.226]:52700 F= rejected RCPT : Rejected relay attempt: '165.154.247.226' From: 'xvnjetlkl@shivelectricaltransformers.com' To: 'goofile@fastmail.com'165.154.247.2261605651Z  -?) ossec13001g%Exim Auth failed2025-03-01 02:37:56 dovecot_plain authenticator failed for ([209.38.100.151]) [209.38.100.151]:38776: 535 Incorrect authentication data (set_id=services)209.38.100.1512750405c  -Y# ossec13001g%Exim Auth failed2025-03-01 02:37:46 dovecot_plain authenticator failed for ([95.0.252.76]) [95.0.252.76]:40490: 535 Incorrect authentication data (set_id=services@heipowersystem.com)95.0.252.76298795N  --# ossec13001g$kExim Auth failed2025-03-01 02:32:35 dovecot_plain authenticator failed for ([101.13.3.72]) [101.13.3.72]:35332: 535 Incorrect authentication data (set_id=sales)101.13.3.721668284v  -y' ossec13001g$ZExim Auth failed2025-03-01 02:32:16 dovecot_plain authenticator failed for 111-70-23-235.emome-ip.hinet.net [111.70.23.235]:44348: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)111.70.23.2351668284P  -3# ossec13001g$Exim Auth failed2025-03-01 02:31:14 dovecot_plain authenticator failed for ([95.0.252.76]) [95.0.252.76]:46554: 535 Incorrect authentication data (set_id=services)95.0.252.76298795l  -e) ossec13001g#Exim Auth failed2025-03-01 02:30:46 dovecot_plain authenticator failed for ([185.181.41.120]) [185.181.41.120]:33513: 535 Incorrect authentication data (set_id=services@heipowersystem.com)185.181.41.120617790Z  -=+ ossec13001g!kExim Auth failed2025-03-01 02:19:46 dovecot_plain authenticator failed for ([175.156.139.195]) [175.156.139.195]:60372: 535 Incorrect authentication data (set_id=sales)175.156.139.1951880251g  -[' ossec13001g!JExim Auth failed2025-03-01 02:19:13 dovecot_plain authenticator failed for ([201.173.16.21]) [201.173.16.21]:57273: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)201.173.16.213996063f  -W) ossec13001g!5Exim Auth failed2025-03-01 02:18:52 dovecot_login authenticator failed for 118-119-237-24.gci.net [24.237.119.118]:37889: 535 Incorrect authentication data (set_id=vikas.khandelwal)24.237.119.1186252001u  -u) ossec13001g!Exim Auth failed2025-03-01 02:18:30 dovecot_login authenticator failed for ([125.136.163.86]) [125.136.163.86]:47066: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)125.136.163.861835841W  -;' ossec13001g! Exim Auth failed2025-03-01 02:18:10 dovecot_plain authenticator failed for ([211.202.71.21]) [211.202.71.21]:38502: 535 Incorrect authentication data (set_id=services)211.202.71.211835841^  -K% ossec13001g Exim Auth failed2025-03-01 02:17:52 dovecot_login authenticator failed for bb121-7-26-195.singnet.com.sg [121.7.26.195]:35154: 535 Incorrect authentication data (set_id=sales)121.7.26.1951880251 *\~tj`VLB8.$zpf\H>4*   v l b X N D : 0 &    ~ t j ` V L B 8 . $    z p f \ R H > 4 *   vblXND:0&|r^hTJ@,6"xndZPF<2( ~tjV`LB8.$zpf\ | r h ^ T J @ 6 , "    x n d Z P F < 2 (   RRH>4*  vlbXND:0& gv gu gsn gr gr gr gqy gq[ go goY go go  gn2 gn gmv gm gm gl0 gjE gj5 gf gf gf gf gd gc gc gc gc ga ga ga ga g_ g_ g^ g^f g[ g[ g[N g[. gYM gY) gY gV gVj gVN gU gT gT| gS gS gS" gS gR  gR gO gO gO gO  gM gM gL gL gK gJ gJ gJ gJ gHw gH# gH gG2 gGO gF, gF gD gD& gD4 gB gB gA% g@i g@] g>> g> g= g= g: g: g9[ g93 g8 g7 g7 g6 g6 g60 g6 g6 g6  g5 g5 g3 g3) g0s g0[ g0E g0; g/ g/ g, g, g, g+ g+ g* g* g) g)' g( g' g' g'| g' g% g% g$k g$Z g$ g# g!k g!J g!5 g! g!  g  g  g  g Z g H g < g g~ g} g| g{ gcy gWz gx gw gv gu g$t gs gq gr gp gxo gRn gJm gl gk gj gi gh g%g gf ge gkd g‘c8 g‘U7 g6 g5 go4 g_3 gŽK2 gŽ51 g$0 g/ gŠ?. gŠ3- gˆ, gˆ+ gˆ9* g‡) g‡( g†' gƒ& gƒf% gƒd$ gƒT# gƒP" g! g gY gG g# g~ g} g} g}$ g} g| g| g{ gy gyq gyU gy= gws gwg gv. g[c gKb gYa gD` gb_ gF^ g] g \ g[ gZ gY g X g ?W g V gU gT gNS gDR gQ gP gO gN gM guL gcK gJ gI gH gyG gqF giE gVD g=C gxB gjA g@ g? g> gP< g6= gF; g:: g’9 g9 g8 g~7 gb6 g5 g4 g3 gs2 g1 g0 gy/ gU. g- g , gg+ gI* g;) g( g' g& gF% g<$ g# g" g! g g g g g{ gY gC gs gg g% g g g g gn g: g* 0| n a X > 1 $  r~qdWJ=o  ! G : - H;bU l}pcVI</" T {  K 0xk^QD7* tgZM@     zm`SF9, v i \ O B 5 (uh[NA4' y3_RE8+&. e s f Y L ? 2 %  w j ] P C 6 )    ~qdWJ=0#  1835841 18358414 1835841$ 1835841# 1835841 1835841 1835841 1835841 1835841 1835841 1835841q 1835841k 1835841j 1835841g 1835841d 1835841c 1835841U 1835841N 1835841L 18358419 18358414 18358412 1835841% 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841t 1835841s 1835841o 1835841f 1835841b 1835841 1835841[ 1835841T 1835841J 1835841I 1835841> 18358419 1835841+ 1835841& 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841G 1835841F 1835841C 1835841@ 18358417 1835841' 1835841# 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841b 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 18358419 1835841_ 1835841 1835841 1835841 1835841 1835841 1835841} 1835841y 1835841v 1835841` 1835841Q 1835841 1835841L 1835841F 1835841C 1835841; 18358419 18358415 1835841+ 1835841( 1835841 1835841x 1835841 1835841l 1835841e 1835841c 1835841` 1835841Y 1835841M 1835841E 1835841B 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841| 1835841w 1835841u 1835841g 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841$ 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841| 1835841y 1835841m 1835841i 1835841h 1835841g 1835841f 1835841^ 1835841X 1835841R 1835841Q 1835841@ 1835841, 1835841+ 1835841a 1835841P 1835841N 1835841$ 1835841 1835841 1835841 +@ U d ^  $CKpc&  -W% ossec13001g3Exim Auth failed2025-03-01 03:35:09 dovecot_plain authenticator failed for ([20.46.45.121]) [20.46.45.121]:53734: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)20.46.45.121290557W%  -9) ossec13001g3)Exim Auth failed2025-03-01 03:35:28 dovecot_plain authenticator failed for ([218.93.229.230]) [218.93.229.230]:47109: 535 Incorrect authentication data (set_id=sales)218.93.229.2301814991t$  -u' ossec13001g0sExim Auth failed2025-03-01 03:23:53 dovecot_login authenticator failed for (amplifypowerglobal.com) [111.207.12.99]:34844: 535 Incorrect authentication data (set_id=service@amplifypowerglobal.com)111.207.12.991814991]#  -G' ossec13001g0[Exim Auth failed2025-03-01 03:23:29 dovecot_login authenticator failed for (amplifypowerglobal.com) [111.207.12.99]:59786: 535 Incorrect authentication data (set_id=nologin)111.207.12.991814991a"  -Q% ossec13001g0EExim Auth failed2025-03-01 03:23:08 dovecot_plain authenticator failed for p81092-obmd01.osaka.ocn.ne.jp [180.7.128.91]:59566: 535 Incorrect authentication data (set_id=services)180.7.128.911861060a!  -U! ossec13001g0;Exim Auth failed2025-03-01 03:22:57 dovecot_plain authenticator failed for ([59.8.11.36]) [59.8.11.36]:56325: 535 Incorrect authentication data (set_id=services@heipowersystem.com)59.8.11.361835841k  -e% ossec13001g/Exim Auth failed2025-03-01 03:20:48 dovecot_plain authenticator failed for vps-79f20bfc.vps.ovh.net ([87.98.249.193]) [51.75.24.107]:12067: 535 Incorrect authentication data (set_id=sales)51.75.24.1073017382a  -S# ossec13001g/Exim Auth failed2025-03-01 03:20:39 dovecot_plain authenticator failed for ([154.65.31.6]) [154.65.31.6]:34367: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)154.65.31.62395170N  --# ossec13001g,Exim Auth failed2025-03-01 03:08:50 dovecot_plain authenticator failed for ([101.13.5.49]) [101.13.5.49]:38028: 535 Incorrect authentication data (set_id=sales)101.13.5.491668284j  -_) ossec13001g,Exim Auth failed2025-03-01 03:08:38 dovecot_plain authenticator failed for ([222.117.88.230]) [222.117.88.230]:41706: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)222.117.88.2301835841z  -# ossec13001g,Exim Auth failed2025-03-01 03:07:16 dovecot_plain authenticator failed for 18.red-83-48-39.staticip.rima-tde.net [83.48.39.18]:65064: 535 Incorrect authentication data (set_id=services@heipowersystem.com)83.48.39.182510769Z  -?) ossec13001g+Exim Auth failed2025-03-01 03:03:52 dovecot_plain authenticator failed for ([157.122.199.19]) [157.122.199.19]:46968: 535 Incorrect authentication data (set_id=services)157.122.199.191814991  -' ossec13001g+Exim Auth failed2025-03-01 03:03:40 dovecot_plain authenticator failed for (76.89.132.112.adsl-pool.ah.cnuninet.net) [112.132.89.76]:32778: 535 Incorrect authentication data (set_id=services@heipowersystem.com)112.132.89.761814991m  -c+ ossec13001g*Exim Auth failed2025-03-01 03:00:01 dovecot_plain authenticator failed for ([121.141.194.159]) [121.141.194.159]:53898: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)121.141.194.1591835841g  -[' ossec13001g*Exim Auth failed2025-03-01 03:00:17 dovecot_plain authenticator failed for ([101.58.144.50]) [101.58.144.50]:39407: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)101.58.144.503175395g  -[' ossec13001g)Exim Auth failed2025-03-01 02:52:30 dovecot_plain authenticator failed for ([58.42.226.215]) [58.42.226.215]:40327: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)58.42.226.2151814991Q  -1% ossec13001g)'Exim Auth failed2025-03-01 02:52:46 dovecot_plain authenticator failed for ([49.79.80.131]) [49.79.80.131]:43490: 535 Incorrect authentication data (set_id=sales)49.79.80.1311814991 | + * U ^ f w+Sb|b7  -S% ossec13001g=Exim Auth failed2025-03-01 04:20:48 dovecot_plain authenticator failed for p391077-obmd01.tokyo.ocn.ne.jp [60.45.179.76]:37226: 535 Incorrect authentication data (set_id=services)60.45.179.761861060m6  -e) ossec13001g=Exim Auth failed2025-03-01 04:20:25 dovecot_plain authenticator failed for ([121.147.25.111]) [121.147.25.111]:33810: 535 Incorrect authentication data (set_id=services@heipowersystem.com)121.147.25.1111835841T5  -5' ossec13001g:Exim Auth failed2025-03-01 04:05:08 dovecot_plain authenticator failed for ([162.142.97.98]) [162.142.97.98]:58607: 535 Incorrect authentication data (set_id=sales)162.142.97.986252001g4  -[' ossec13001g:Exim Auth failed2025-03-01 04:04:45 dovecot_plain authenticator failed for ([85.26.221.136]) [85.26.221.136]:40476: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)85.26.221.1362017370T3  -7% ossec13001g9[Exim Auth failed2025-03-01 04:01:54 dovecot_plain authenticator failed for ([222.99.10.11]) [222.99.10.11]:62966: 535 Incorrect authentication data (set_id=services)222.99.10.111835841l2  -e) ossec13001g93Exim Auth failed2025-03-01 04:01:13 dovecot_plain authenticator failed for ([102.215.188.37]) [102.215.188.37]:54520: 535 Incorrect authentication data (set_id=services@heipowersystem.com)102.215.188.37192950g1  -[' ossec13001g8Exim Auth failed2025-03-01 04:00:23 dovecot_plain authenticator failed for ([186.179.80.12]) [186.179.80.12]:57496: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)186.179.80.123895114Z0  -?) ossec13001g7Exim Auth failed2025-03-01 03:55:09 dovecot_plain authenticator failed for ([222.116.33.185]) [222.116.33.185]:48028: 535 Incorrect authentication data (set_id=services)222.116.33.1851835841g/  -]% ossec13001g7Exim Auth failed2025-03-01 03:54:45 dovecot_plain authenticator failed for ([110.14.68.11]) [110.14.68.11]:41708: 535 Incorrect authentication data (set_id=services@heipowersystem.com)110.14.68.111835841a.  -O' ossec13001g6Exim Auth failed2025-03-01 03:50:05 dovecot_login authenticator failed for p159091-obmd01.tokyo.ocn.ne.jp [153.141.52.91]:57093: 535 Incorrect authentication data (set_id=sales)153.141.52.911861060k-  -c' ossec13001g6Exim Auth failed2025-03-01 03:49:44 dovecot_login authenticator failed for www.michels-schwab.de [217.86.146.64]:53238: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)217.86.146.642921044t,  -w% ossec13001g60Exim Auth failed2025-03-01 03:48:23 dovecot_login authenticator failed for syn-067-053-114-086.biz.spectrum.com [67.53.114.86]:34843: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)67.53.114.866252001s+  -u% ossec13001g6Exim Auth failed2025-03-01 03:48:00 dovecot_login authenticator failed for ([222.99.10.11]) [222.99.10.11]:52116: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)222.99.10.111835841Q*  -1% ossec13001g6Exim Auth failed2025-03-01 03:47:58 dovecot_plain authenticator failed for ([27.124.18.19]) [27.124.18.27]:47794: 535 Incorrect authentication data (set_id=sales)27.124.18.271269750})  -' ossec13001g6 Exim Auth failed2025-03-01 03:47:47 dovecot_plain authenticator failed for broadband-95-84-158-215.ip.moscow.rt.ru [95.84.158.215]:53517: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)95.84.158.2152017370](  -C+ ossec13001g5Exim Auth failed2025-03-01 03:47:06 dovecot_plain authenticator failed for ([171.221.199.222]) [171.221.199.222]:26579: 535 Incorrect authentication data (set_id=services)171.221.199.2221814991p'  -i+ ossec13001g5Exim Auth failed2025-03-01 03:46:47 dovecot_plain authenticator failed for ([197.149.125.227]) [197.149.125.227]:36302: 535 Incorrect authentication data (set_id=services@heipowersystem.com)197.149.125.2272328926 Q 1 - L \ A gEQpH  -m' ossec13001gHwExim Auth failed2025-03-01 05:06:23 dovecot_plain authenticator failed for (106.51.68.128.actcorp.in) [202.122.16.50]:48590: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)202.122.16.501269750QG  -3# ossec13001gH#Exim Auth failed2025-03-01 05:04:58 dovecot_plain authenticator failed for ([27.71.27.81]) [27.71.27.81]:53931: 535 Incorrect authentication data (set_id=services)27.71.27.811562822gF  -]% ossec13001gHExim Auth failed2025-03-01 05:04:37 dovecot_plain authenticator failed for ([27.124.18.21]) [27.124.18.27]:37282: 535 Incorrect authentication data (set_id=services@heipowersystem.com)27.124.18.271269750jE  -_) ossec13001gG2Exim Auth failed2025-03-01 05:00:57 dovecot_plain authenticator failed for ([171.217.70.151]) [171.217.70.151]:58990: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)171.217.70.1511814991ZD  -=+ ossec13001gGOExim Auth failed2025-03-01 05:01:26 dovecot_plain authenticator failed for ([114.243.136.120]) [114.243.136.120]:40505: 535 Incorrect authentication data (set_id=sales)114.243.136.1201814991YC  -=) ossec13001gF,Exim Auth failed2025-03-01 04:56:36 dovecot_login authenticator failed for (vipturbo.com.br) [191.36.152.249]:49589: 535 Incorrect authentication data (set_id=services)191.36.152.2493469034gB  -]% ossec13001gFExim Auth failed2025-03-01 04:56:20 dovecot_login authenticator failed for ([58.122.255.2]) [58.122.255.2]:44302: 535 Incorrect authentication data (set_id=services@heipowersystem.com)58.122.255.21835841mA  -e) ossec13001gDExim Auth failed2025-03-01 04:49:30 dovecot_plain authenticator failed for ([124.246.94.135]) [124.246.94.135]:33419: 535 Incorrect authentication data (set_id=services@heipowersystem.com)124.246.94.1351880251~@  -) ossec13001gD&Exim Auth failed2025-03-01 04:47:57 dovecot_plain authenticator failed for 47-158-210-137.lsan.ca.frontiernet.net [47.158.210.137]:52530: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)47.158.210.1376252001W?  -9) ossec13001gD4Exim Auth failed2025-03-01 04:48:10 dovecot_plain authenticator failed for ([111.48.214.102]) [111.48.214.102]:63974: 535 Incorrect authentication data (set_id=sales)111.48.214.1021814991V>  -;' ossec13001gBExim Auth failed2025-03-01 04:42:31 dovecot_plain authenticator failed for ([94.204.78.117]) [94.204.78.117]:35597: 535 Incorrect authentication data (set_id=services)94.204.78.117290557=  -;' ossec13001gBExim Auth failed2025-03-01 04:41:56 dovecot_plain authenticator failed for host-88-43-231-186.business.telecomitalia.it ([88.43.231.188]) [88.43.231.186]:40340: 535 Incorrect authentication data (set_id=services@heipowersystem.com)88.43.231.1863175395l<  -a+ ossec13001gA%Exim Auth failed2025-03-01 04:35:09 dovecot_plain authenticator failed for ([114.143.224.97]) [182.156.135.216]:12221: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)182.156.135.2161269750];  -C+ ossec13001g@iExim Auth failed2025-03-01 04:32:01 dovecot_plain authenticator failed for ([175.156.139.195]) [175.156.139.195]:50262: 535 Incorrect authentication data (set_id=services)175.156.139.1951880251:  - ' ossec13001g@]Exim Auth failed2025-03-01 04:31:47 dovecot_plain authenticator failed for ip4d16b6e6.dynamic.kabel-deutschland.de [77.22.182.230]:53382: 535 Incorrect authentication data (set_id=services@heipowersystem.com)77.22.182.2302921044T9  -5' ossec13001g>>Exim Auth failed2025-03-01 04:22:45 dovecot_plain authenticator failed for ([187.92.254.42]) [187.92.254.42]:54425: 535 Incorrect authentication data (set_id=sales)187.92.254.423469034s8  -u% ossec13001g>Exim Auth failed2025-03-01 04:22:00 dovecot_plain authenticator failed for 89-160-38-13.cust.bredband2.com [89.160.38.13]:49898: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)89.160.38.132661886 : 6 X y %7FkjY  -a' ossec13001gS"Exim Auth failed2025-03-01 05:51:53 dovecot_plain authenticator failed for broadband-95-84-186-218.ip.moscow.rt.ru [95.84.186.218]:56416: 535 Incorrect authentication data (set_id=sales)95.84.186.2182017370dX  -W% ossec13001gSExim Auth failed2025-03-01 05:51:41 dovecot_plain authenticator failed for ([58.22.255.28]) [58.22.255.28]:45349: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)58.22.255.281814991WW  -;' ossec13001gR Exim Auth failed2025-03-01 05:47:14 dovecot_plain authenticator failed for ([89.101.36.159]) [89.101.36.159]:38954: 535 Incorrect authentication data (set_id=services)89.101.36.1592963597mV  -e) ossec13001gRExim Auth failed2025-03-01 05:47:04 dovecot_plain authenticator failed for ([106.55.161.136]) [106.55.161.136]:42990: 535 Incorrect authentication data (set_id=services@heipowersystem.com)106.55.161.1361814991jU  -a' ossec13001gOExim Auth failed2025-03-01 05:37:36 dovecot_plain authenticator failed for ([61.133.10.205]) [61.133.10.204]:40418: 535 Incorrect authentication data (set_id=services@heipowersystem.com)61.133.10.2041814991WT  -9) ossec13001gOExim Auth failed2025-03-01 05:37:22 dovecot_plain authenticator failed for ([49.124.152.242]) [49.124.152.242]:33362: 535 Incorrect authentication data (set_id=sales)49.124.152.2421733045gS  -[' ossec13001gOExim Auth failed2025-03-01 05:37:00 dovecot_plain authenticator failed for ([103.174.34.49]) [103.174.34.49]:51269: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)103.174.34.491269750jR  -_) ossec13001gO Exim Auth failed2025-03-01 05:34:25 dovecot_login authenticator failed for ([216.194.174.80]) [216.194.174.27]:59731: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)216.194.174.276252001TQ  -5' ossec13001gMExim Auth failed2025-03-01 05:28:32 dovecot_plain authenticator failed for ([12.189.234.28]) [12.189.234.28]:32903: 535 Incorrect authentication data (set_id=sales)12.189.234.286252001jP  -_) ossec13001gMExim Auth failed2025-03-01 05:28:08 dovecot_plain authenticator failed for ([111.171.125.94]) [111.171.125.94]:42181: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)111.171.125.941835841|O  -% ossec13001gLExim Auth failed2025-03-01 05:24:36 dovecot_plain authenticator failed for 32.104.29.34.bc.googleusercontent.com [34.29.104.32]:40006: 535 Incorrect authentication data (set_id=services@heipowersystem.com)34.29.104.326252001VN  -9' ossec13001gLExim Auth failed2025-03-01 05:24:48 dovecot_plain authenticator failed for ([223.210.27.53]) [223.210.27.53]:9132: 535 Incorrect authentication data (set_id=services)223.210.27.531814991[M -A' ossec13001gKExim Auth failed2025-03-01 05:20:13 dovecot_login authenticator failed for (thepsindustries.com) [58.240.171.59]:35378: 535 Incorrect authentication data (set_id=nologin)58.240.171.591814991ZL  -?) ossec13001gJExim Auth failed2025-03-01 05:17:05 dovecot_plain authenticator failed for ([95.105.113.109]) [95.105.113.109]:60682: 535 Incorrect authentication data (set_id=services)95.105.113.1092017370K  - ' ossec13001gJExim Auth failed2025-03-01 05:16:53 dovecot_plain authenticator failed for 230.red-213-96-11.staticip.rima-tde.net [213.96.11.230]:58495: 535 Incorrect authentication data (set_id=services@heipowersystem.com)213.96.11.2302510769QJ  -1% ossec13001gJExim Auth failed2025-03-01 05:16:08 dovecot_plain authenticator failed for ([180.7.188.10]) [180.7.188.10]:58018: 535 Incorrect authentication data (set_id=sales)180.7.188.101861060mI  -c+ ossec13001gJExim Auth failed2025-03-01 05:15:35 dovecot_plain authenticator failed for ([121.178.185.141]) [121.178.185.141]:40802: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)121.178.185.1411835841 . : _ ? N dvgi  -]% ossec13001g^fExim Auth failed2025-03-01 06:39:57 dovecot_plain authenticator failed for ([5.59.141.152]) [5.59.141.152]:55034: 535 Incorrect authentication data (set_id=services@heipowersystem.com)5.59.141.15220173702h  =]+ ossec13008g[Mail Reciepient rejected2025-03-01 06:28:49 H=(mail.nyaystambh.com) [165.154.227.155]:55280 F= rejected RCPT : Rejected relay attempt: '165.154.227.155' From: 'egiijql@nyaystambh.com' To: 'goofile@fastmail.com'165.154.227.1551668284g  -% ossec13001g[Exim Auth failed2025-03-01 06:28:24 dovecot_plain authenticator failed for 61-216-7-163.hinet-ip.hinet.net ([61.216.7.165]) [61.216.7.163]:52154: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)61.216.7.1631668284]f  -C+ ossec13001g[NExim Auth failed2025-03-01 06:26:45 dovecot_plain authenticator failed for ([103.123.114.215]) [103.123.114.215]:55620: 535 Incorrect authentication data (set_id=services)103.123.114.2151168579e  - ' ossec13001g[.Exim Auth failed2025-03-01 06:26:13 dovecot_plain authenticator failed for broadband-5-228-183-178.ip.moscow.rt.ru [5.228.183.178]:59244: 535 Incorrect authentication data (set_id=services@heipowersystem.com)5.228.183.1782017370|d  -) ossec13001gYMExim Auth failed2025-03-01 06:18:12 dovecot_plain authenticator failed for 125-228-54-149.hinet-ip.hinet.net [125.228.54.149]:49440: 535 Incorrect authentication data (set_id=services@heipowersystem.com)125.228.54.1491668284Sc  -1) ossec13001gY)Exim Auth failed2025-03-01 06:17:36 dovecot_plain authenticator failed for ([70.39.23.1]) [167.142.198.54]:37435: 535 Incorrect authentication data (set_id=sales)167.142.198.546252001ob  -k' ossec13001gYExim Auth failed2025-03-01 06:17:17 dovecot_plain authenticator failed for 126.64.125.78.rev.sfr.net [78.125.64.126]:57050: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)78.125.64.1263017382ja  -_) ossec13001gVExim Auth failed2025-03-01 06:08:08 dovecot_plain authenticator failed for ([168.126.90.210]) [168.126.90.210]:56671: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)168.126.90.2101835841f`  -[% ossec13001gVjExim Auth failed2025-03-01 06:05:53 dovecot_plain authenticator failed for static-84-242-88-70.bb.vodafone.cz [84.242.88.70]:56480: 535 Incorrect authentication data (set_id=services)84.242.88.703077311m_  -e) ossec13001gVNExim Auth failed2025-03-01 06:05:26 dovecot_plain authenticator failed for ([49.124.148.189]) [49.124.148.189]:35560: 535 Incorrect authentication data (set_id=services@heipowersystem.com)49.124.148.1891733045^  W' ossec9708gUDovecot Aborted Login with empty userMar 1 06:00:10 vm1 dovecot[312763]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 7 secs): user=<>, rip=87.236.176.87, lip=103.74.54.108, TLS, session=<1p+VBj0v5cRX7LBX>87.236.176.872635167W]  -;' ossec13001gTExim Auth failed2025-03-01 05:58:03 dovecot_plain authenticator failed for ([146.88.78.123]) [146.88.78.123]:37414: 535 Incorrect authentication data (set_id=services)146.88.78.1231694008p\  -i+ ossec13001gT|Exim Auth failed2025-03-01 05:57:39 dovecot_plain authenticator failed for ([102.223.195.154]) [102.223.195.154]:54480: 535 Incorrect authentication data (set_id=services@heipowersystem.com)102.223.195.1542434508c[  -Q) ossec13001gSExim Auth failed2025-03-01 05:54:44 dovecot_plain authenticator failed for a109-51-222-234.cpe.netcabo.pt [109.51.222.234]:41384: 535 Incorrect authentication data (set_id=sales)109.51.222.2342264397gZ  -[' ossec13001gSExim Auth failed2025-03-01 05:54:34 dovecot_plain authenticator failed for ([162.142.97.98]) [162.142.97.98]:60708: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)162.142.97.986252001 J&; W |  5Jgz  -]% ossec13001gj5Exim Auth failed2025-03-01 07:30:20 dovecot_plain authenticator failed for ([14.35.218.58]) [14.35.218.58]:40895: 535 Incorrect authentication data (set_id=services@heipowersystem.com)14.35.218.581835841ay  -Q% ossec13001gfExim Auth failed2025-03-01 07:15:54 dovecot_plain authenticator failed for h77-53-111-65.cust.bredband2.com [77.53.111.65]:54098: 535 Incorrect authentication data (set_id=sales)77.53.111.652661886jx  -_) ossec13001gfExim Auth failed2025-03-01 07:15:39 dovecot_plain authenticator failed for ([213.230.64.246]) [213.230.64.246]:59894: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)213.230.64.2461512440Ww  -;' ossec13001gfExim Auth failed2025-03-01 07:14:52 dovecot_plain authenticator failed for ([203.190.150.4]) [203.190.150.4]:57978: 535 Incorrect authentication data (set_id=services)203.190.150.41269750gv  -]% ossec13001gfExim Auth failed2025-03-01 07:14:41 dovecot_plain authenticator failed for ([59.1.214.102]) [59.1.214.102]:49244: 535 Incorrect authentication data (set_id=services@heipowersystem.com)59.1.214.1021835841:u  =m+ ossec13008gdMail Reciepient rejected2025-03-01 07:06:29 H=(mail.technobases.in) [165.154.213.196]:62145 F= rejected RCPT : Rejected relay attempt: '165.154.213.196' From: 'qhcdzdgxwex@technobases.in' To: 'goofile@fastmail.com'165.154.213.1963469034dt  -W% ossec13001gcExim Auth failed2025-03-01 07:03:15 dovecot_plain authenticator failed for ([14.37.206.76]) [14.37.206.76]:36505: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)14.37.206.761835841Ts  -5' ossec13001gcExim Auth failed2025-03-01 07:03:41 dovecot_plain authenticator failed for ([77.106.78.215]) [77.106.78.215]:16504: 535 Incorrect authentication data (set_id=sales)77.106.78.2152017370lr  -c) ossec13001gcExim Auth failed2025-03-01 07:02:21 dovecot_plain authenticator failed for syn-070-127-232-248.res.spectrum.com [70.127.232.248]:48057: 535 Incorrect authentication data (set_id=services)70.127.232.2486252001pq  -i+ ossec13001gcExim Auth failed2025-03-01 07:02:10 dovecot_plain authenticator failed for ([197.149.125.227]) [197.149.125.227]:54092: 535 Incorrect authentication data (set_id=services@heipowersystem.com)197.149.125.2272328926rp  -q' ossec13001gaExim Auth failed2025-03-01 06:54:20 dovecot_plain authenticator failed for ip-078-043-249-192.um18.pools.vodafone-ip.de [78.43.249.192]:51592: 535 Incorrect authentication data (set_id=services)78.43.249.1922921044mo  -e) ossec13001gaExim Auth failed2025-03-01 06:53:57 dovecot_plain authenticator failed for ([187.92.119.246]) [187.92.119.246]:45692: 535 Incorrect authentication data (set_id=services@heipowersystem.com)187.92.119.2463469034an  -S# ossec13001gaExim Auth failed2025-03-01 06:53:30 dovecot_plain authenticator failed for ([70.90.99.29]) [70.90.99.29]:45567: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)70.90.99.296252001Wm  -9) ossec13001gaExim Auth failed2025-03-01 06:53:44 dovecot_plain authenticator failed for ([183.109.148.43]) [183.109.148.43]:35042: 535 Incorrect authentication data (set_id=sales)183.109.148.431835841`l  -M' ossec13001g_Exim Auth failed2025-03-01 06:45:25 dovecot_plain authenticator failed for (160.72.153.14.lightower.net) [160.72.153.14]:37007: 535 Incorrect authentication data (set_id=sales)160.72.153.146252001gk  -[' ossec13001g_Exim Auth failed2025-03-01 06:44:50 dovecot_plain authenticator failed for ([58.51.122.230]) [58.51.122.230]:38026: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)58.51.122.2301814991Vj  -9' ossec13001g^Exim Auth failed2025-03-01 06:40:24 dovecot_plain authenticator failed for ([58.250.157.83]) [58.250.157.83]:2051: 535 Incorrect authentication data (set_id=services)58.250.157.831814991 %  ' M\qSF@ezS  -5' ossec13001grExim Auth failed2025-03-01 08:07:33 dovecot_plain authenticator failed for ([87.200.68.214]) [87.200.68.214]:36274: 535 Incorrect authentication data (set_id=sales)87.200.68.214290557%  3Q' ossec11301grNew FTP connection.Mar 1 08:07:18 vm1 pure-ftpd[1115361]: (?@167.94.138.35) [INFO] New connection from 167.94.138.35167.94.138.356252001g  -[' ossec13001grExim Auth failed2025-03-01 08:07:11 dovecot_plain authenticator failed for ([144.121.19.38]) [144.121.19.38]:55215: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)144.121.19.386252001W  -;' ossec13001gqyExim Auth failed2025-03-01 08:01:21 dovecot_plain authenticator failed for ([181.197.38.12]) [181.197.38.12]:44578: 535 Incorrect authentication data (set_id=services)181.197.38.123703430  - + ossec13001gq[Exim Auth failed2025-03-01 08:00:51 dovecot_plain authenticator failed for 165.199.148.122.sta.wbroadband.net.au [122.148.199.165]:59627: 535 Incorrect authentication data (set_id=services@heipowersystem.com)122.148.199.1652077456   [w! ossec12004goPossible Dovecot CVE-2019-11500 attemptMar 1 07:53:42 vm1 dovecot[312763]: pop3-login: Disconnected: Input buffer full (no auth attempts in 1 secs): user=<>, rip=3.19.60.84, lip=103.74.54.108, session=<8gmbnD4vIrEDEzxU>3.19.60.846252001  W% ossec9708goYDovecot Aborted Login with empty userMar 1 07:52:15 vm1 dovecot[312763]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=203.55.131.4, lip=103.74.54.108, TLS, session=<94Fxlz4vyO3LN4ME>203.55.131.46252001g  -[' ossec13001goExim Auth failed2025-03-01 07:51:11 dovecot_plain authenticator failed for 0x3ec64ba8.aal.customer.dk.telia.net [62.198.75.168]:59088: 535 Incorrect authentication data (set_id=sales)62.198.75.1682623032m  -c+ ossec13001go Exim Auth failed2025-03-01 07:50:57 dovecot_plain authenticator failed for ([190.211.250.118]) [190.211.250.122]:39837: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)190.211.250.1223895114V  -;' ossec13001gn2Exim Auth failed2025-03-01 07:47:21 dovecot_plain authenticator failed for ([185.167.56.34]) [185.167.56.34]:46644: 535 Incorrect authentication data (set_id=services)185.167.56.34617790p  -i+ ossec13001gnExim Auth failed2025-03-01 07:46:50 dovecot_plain authenticator failed for ([118.220.149.129]) [118.220.149.129]:58676: 535 Incorrect authentication data (set_id=services@heipowersystem.com)118.220.149.1291835841j  -_) ossec13001gmvExim Auth failed2025-03-01 07:44:13 dovecot_plain authenticator failed for ([213.230.64.246]) [213.230.64.246]:33248: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)213.230.64.2461512440Y~  -?) ossec13001gmExim Auth failed2025-03-01 07:42:43 dovecot_plain authenticator failed for ([31.141.253.119]) [31.141.253.119]:57720: 535 Incorrect authentication data (set_id=services)31.141.253.119298795z}  -# ossec13001gmExim Auth failed2025-03-01 07:42:32 dovecot_plain authenticator failed for 18.red-83-48-39.staticip.rima-tde.net [83.48.39.18]:49211: 535 Incorrect authentication data (set_id=services@heipowersystem.com)83.48.39.182510769=|  =s+ ossec13008gl0Mail Reciepient rejected2025-03-01 07:38:46 H=(mail.gurukuljaipur.com) [165.154.228.156]:56721 F= rejected RCPT : Rejected relay attempt: '165.154.228.156' From: 'cfmhfxql@gurukuljaipur.com' To: 'goofile@fastmail.com'165.154.228.1561643084W{  -;' ossec13001gjEExim Auth failed2025-03-01 07:30:37 dovecot_plain authenticator failed for ([124.228.32.34]) [124.228.32.34]:48537: 535 Incorrect authentication data (set_id=services)124.228.32.341814991 >' < U c ">]  -C+ ossec13001g}Exim Auth failed2025-03-01 08:54:39 dovecot_plain authenticator failed for ([211.238.237.254]) [211.238.237.254]:39133: 535 Incorrect authentication data (set_id=services)211.238.237.2541835841  - ) ossec13001g}Exim Auth failed2025-03-01 08:54:23 dovecot_plain authenticator failed for syn-076-178-103-119.res.spectrum.com [76.178.103.119]:43570: 535 Incorrect authentication data (set_id=services@heipowersystem.com)76.178.103.1196252001b  -O) ossec13001g}$Exim Auth failed2025-03-01 08:51:08 dovecot_plain authenticator failed for ([111.48.140.240]) [111.48.140.240]:15872: 535 Incorrect authentication data (set_id=vikas.khandelwal)111.48.140.2401814991  -1# ossec13001g}Exim Auth failed2025-03-01 08:50:49 dovecot_plain authenticator failed for (70.246.50.116.ids.service.static.eastern-tele.com) [58.69.17.18]:48888: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)58.69.17.181694008g  -[' ossec13001g|Exim Auth failed2025-03-01 08:49:35 dovecot_plain authenticator failed for ([27.223.100.92]) [27.223.100.90]:46050: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)27.223.100.901814991`  -O% ossec13001g|Exim Auth failed2025-03-01 08:49:48 dovecot_plain authenticator failed for 1-34-162-249.hinet-ip.hinet.net [1.34.162.249]:53513: 535 Incorrect authentication data (set_id=sales)1.34.162.2491668284a  -U! ossec13001g{Exim Auth failed2025-03-01 08:46:02 dovecot_plain authenticator failed for ([59.9.38.92]) [59.9.38.92]:59630: 535 Incorrect authentication data (set_id=services@heipowersystem.com)59.9.38.921835841T  -5' ossec13001gyUExim Auth failed2025-03-01 08:34:52 dovecot_plain authenticator failed for ([85.26.221.136]) [85.26.221.136]:53087: 535 Incorrect authentication data (set_id=sales)85.26.221.1362017370l  -c) ossec13001gyExim Auth failed2025-03-01 08:35:34 dovecot_plain authenticator failed for syn-075-191-221-158.res.spectrum.com [75.191.221.158]:39674: 535 Incorrect authentication data (set_id=services)75.191.221.1586252001y  -' ossec13001gyqExim Auth failed2025-03-01 08:35:20 dovecot_plain authenticator failed for 60-249-207-53.hinet-ip.hinet.net [60.249.207.53]:43214: 535 Incorrect authentication data (set_id=services@heipowersystem.com)60.249.207.531668284j  -_) ossec13001gy=Exim Auth failed2025-03-01 08:34:29 dovecot_plain authenticator failed for ([61.150.123.106]) [61.150.123.106]:33732: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)61.150.123.1061814991\  -C+ ossec13001gwsExim Auth failed2025-03-01 08:26:50 dovecot_plain authenticator failed for ([196.189.126.185]) [196.189.126.185]:54006: 535 Incorrect authentication data (set_id=services)196.189.126.185337996n  -g) ossec13001gwgExim Auth failed2025-03-01 08:26:38 dovecot_plain authenticator failed for ([216.194.174.103]) [216.194.174.27]:12342: 535 Incorrect authentication data (set_id=services@heipowersystem.com)216.194.174.276252001c  -S' ossec13001gv.Exim Auth failed2025-03-01 08:21:25 dovecot_plain authenticator failed for (173-29-118-52.client.mchsi.com) [173.29.118.52]:58387: 535 Incorrect authentication data (set_id=sales)173.29.118.526252001g  -[' ossec13001gvExim Auth failed2025-03-01 08:21:04 dovecot_plain authenticator failed for ([103.65.227.12]) [103.65.227.12]:59040: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)103.65.227.121210997j  -_) ossec13001guExim Auth failed2025-03-01 08:16:29 dovecot_plain authenticator failed for ([151.49.116.193]) [151.49.116.193]:45616: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)151.49.116.1933175395g  -]% ossec13001gsnExim Auth failed2025-03-01 08:09:41 dovecot_plain authenticator failed for ([113.192.1.27]) [113.192.1.26]:37712: 535 Incorrect authentication data (set_id=services@heipowersystem.com)113.192.1.261643084 Er u .#L[E+  5') ossec11011gˆWHM SSO login failed[2025-03-01 09:40:39 +0530] info [whostmgrd] 106.206.152.67 PURGE root:1lA2uKe_jxIvAizT badpass [cookie ip check: IP address has changed: IP Address [106.206.152.81] != Current IP Address [106.206.152.67]]106.206.152.671269750m*  -e) ossec13001gˆ9Exim Auth failed2025-03-01 09:38:24 dovecot_plain authenticator failed for ([207.219.221.99]) [207.219.221.99]:36755: 535 Incorrect authentication data (set_id=services@heipowersystem.com)207.219.221.996251999S)  -3' ossec13001g‡Exim Auth failed2025-03-01 09:36:40 dovecot_plain authenticator failed for ([58.250.157.83]) [58.250.157.83]:2052: 535 Incorrect authentication data (set_id=sales)58.250.157.831814991j(  -_) ossec13001g‡Exim Auth failed2025-03-01 09:36:08 dovecot_plain authenticator failed for ([111.48.214.102]) [111.48.214.102]:41250: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)111.48.214.1021814991j'  -a' ossec13001g†Exim Auth failed2025-03-01 09:28:56 dovecot_plain authenticator failed for ([103.99.148.77]) [103.99.148.77]:46724: 535 Incorrect authentication data (set_id=services@heipowersystem.com)103.99.148.771269750+&  =O+ ossec13008gƒMail Reciepient rejected2025-03-01 09:18:59 H=(mail.msnews24.in) [165.154.213.185]:59310 F= rejected RCPT : Rejected relay attempt: '165.154.213.185' From: 'crejxdzd@msnews24.in' To: 'goofile@fastmail.com'165.154.213.1853469034c%  -W# ossec13001gƒfExim Auth failed2025-03-01 09:17:48 dovecot_plain authenticator failed for as007174.dynamic.ppp.asahi-net.or.jp [150.9.7.174]:36150: 535 Incorrect authentication data (set_id=sales)150.9.7.1741861060T$  -7% ossec13001gƒdExim Auth failed2025-03-01 09:17:46 dovecot_plain authenticator failed for ([98.70.127.17]) [98.70.127.17]:42032: 535 Incorrect authentication data (set_id=services)98.70.127.171269750j#  -_) ossec13001gƒTExim Auth failed2025-03-01 09:17:30 dovecot_plain authenticator failed for ([211.252.98.159]) [211.252.98.159]:60794: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)211.252.98.1591835841j"  -a' ossec13001gƒPExim Auth failed2025-03-01 09:17:27 dovecot_plain authenticator failed for ([61.173.105.26]) [61.173.105.26]:60602: 535 Incorrect authentication data (set_id=services@heipowersystem.com)61.173.105.261814991c!  -Q) ossec13001gExim Auth failed2025-03-01 09:10:09 dovecot_plain authenticator failed for ool-44c586a4.dyn.optonline.net [68.197.134.164]:36490: 535 Incorrect authentication data (set_id=sales)68.197.134.1646252001i  -]) ossec13001gExim Auth failed2025-03-01 09:09:52 dovecot_plain authenticator failed for ([222.67.133.193]) [222.67.133.193]:7167: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)222.67.133.1931814991T  -7% ossec13001gYExim Auth failed2025-03-01 09:09:05 dovecot_plain authenticator failed for ([60.174.35.18]) [60.174.35.18]:41476: 535 Incorrect authentication data (set_id=services)60.174.35.181814991y  -' ossec13001gGExim Auth failed2025-03-01 09:08:47 dovecot_plain authenticator failed for 111-70-23-235.emome-ip.hinet.net [111.70.23.235]:50598: 535 Incorrect authentication data (set_id=services@heipowersystem.com)111.70.23.2351668284%  3Q' ossec11301g#New FTP connection.Mar 1 08:59:37 vm1 pure-ftpd[1125098]: (?@87.236.176.33) [INFO] New connection from 87.236.176.3387.236.176.332635167a  -S# ossec13001g~Exim Auth failed2025-03-01 08:57:09 dovecot_plain authenticator failed for ([59.0.60.158]) [59.0.60.158]:59486: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)59.0.60.1581835841 , % 7 IXw,g<  -[' ossec13001g”NExim Auth failed2025-03-01 10:29:57 dovecot_plain authenticator failed for syn-131-148-000-202.biz.spectrum.com [131.148.0.202]:60176: 535 Incorrect authentication data (set_id=sales)131.148.0.2026252001g;  -[' ossec13001g”8Exim Auth failed2025-03-01 10:29:36 dovecot_plain authenticator failed for ([173.29.118.52]) [173.29.118.52]:59506: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)173.29.118.526252001Z: -A% ossec13001g”Exim Auth failed2025-03-01 10:29:05 dovecot_login authenticator failed for (vandanabalbharti.com) [119.96.131.8]:34346: 535 Incorrect authentication data (set_id=nologin)119.96.131.81814991i9  -a' ossec13001g’Exim Auth failed2025-03-01 10:23:52 dovecot_plain authenticator failed for ([78.142.41.167]) [78.142.41.167]:33540: 535 Incorrect authentication data (set_id=services@heipowersystem.com)78.142.41.167732800W8  -;' ossec13001g‘cExim Auth failed2025-03-01 10:17:31 dovecot_plain authenticator failed for ([31.173.66.222]) [31.173.66.222]:53182: 535 Incorrect authentication data (set_id=services)31.173.66.2222017370p7  -i+ ossec13001g‘UExim Auth failed2025-03-01 10:17:17 dovecot_plain authenticator failed for ([175.145.232.217]) [175.145.232.217]:58030: 535 Incorrect authentication data (set_id=services@heipowersystem.com)175.145.232.2171733045i6  -]) ossec13001gExim Auth failed2025-03-01 10:14:04 dovecot_plain authenticator failed for 166.46.246.220.static.netvigator.com [220.246.46.166]:65266: 535 Incorrect authentication data (set_id=sales)220.246.46.1661819730j5  -_) ossec13001gExim Auth failed2025-03-01 10:13:42 dovecot_plain authenticator failed for ([220.182.17.122]) [220.182.17.122]:53358: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)220.182.17.1221814991]4  -C+ ossec13001goExim Auth failed2025-03-01 10:09:10 dovecot_plain authenticator failed for ([190.211.250.118]) [190.211.250.122]:43985: 535 Incorrect authentication data (set_id=services)190.211.250.1223895114m3  -e) ossec13001g_Exim Auth failed2025-03-01 10:08:54 dovecot_plain authenticator failed for ([27.107.168.206]) [27.107.168.206]:58430: 535 Incorrect authentication data (set_id=services@heipowersystem.com)27.107.168.2061269750j2  -a' ossec13001gŽKExim Auth failed2025-03-01 10:04:18 dovecot_plain authenticator failed for broadband-95-84-158-215.ip.moscow.rt.ru [95.84.158.215]:60050: 535 Incorrect authentication data (set_id=sales)95.84.158.2152017370j1  -_) ossec13001gŽ5Exim Auth failed2025-03-01 10:03:56 dovecot_plain authenticator failed for ([222.117.88.230]) [222.117.88.230]:53868: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)222.117.88.2301835841Q0  -3# ossec13001g$Exim Auth failed2025-03-01 09:59:24 dovecot_plain authenticator failed for ([31.173.0.46]) [31.173.0.46]:52824: 535 Incorrect authentication data (set_id=services)31.173.0.462017370j/  -a' ossec13001gExim Auth failed2025-03-01 09:59:08 dovecot_plain authenticator failed for ([219.91.172.21]) [219.91.172.21]:32794: 535 Incorrect authentication data (set_id=services@heipowersystem.com)219.91.172.211269750T.  -5' ossec13001gŠ?Exim Auth failed2025-03-01 09:47:02 dovecot_plain authenticator failed for ([103.48.194.21]) [103.48.194.21]:47054: 535 Incorrect authentication data (set_id=sales)103.48.194.211562822g-  -[' ossec13001gŠ3Exim Auth failed2025-03-01 09:46:50 dovecot_plain authenticator failed for ([119.84.241.94]) [119.84.241.94]:36378: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)119.84.241.941814991Q,  U) ossec11001gˆDeferred login on the cpanel service[2025-03-01 09:40:39 +0530] info [whostmgrd] 106.206.152.67 - root "GET /cpsess1323816733/scripts4/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: cookie ip check: IP address has changed: IP Address [106.206.152.81] != Current IP Address [106.206.152.67]106.206.152.671269750 A' L G f ~ >Pc%A`M  -M' ossec13001g£Exim Auth failed2025-03-01 11:36:46 dovecot_plain authenticator failed for 83.106.54.198.in-addr.arpa [198.54.106.83]:57119: 535 Incorrect authentication data (set_id=services)198.54.106.836252001gL  -]% ossec13001g£Exim Auth failed2025-03-01 11:36:36 dovecot_plain authenticator failed for ([58.16.49.250]) [58.16.49.250]:48001: 535 Incorrect authentication data (set_id=services@heipowersystem.com)58.16.49.2501814991OK  =+ ossec13008g¡Mail Reciepient rejected2025-03-01 11:26:51 H=(mail.westerndancecompany.com) [165.154.228.156]:60617 F= rejected RCPT : Rejected relay attempt: '165.154.228.156' From: 'fitqfjhc@westerndancecompany.com' To: 'goofile@fastmail.com'165.154.228.1561643084iJ  -]) ossec13001gžExim Auth failed2025-03-01 11:13:48 dovecot_plain authenticator failed for 94-255-178-175.cust.bredband2.com [94.255.178.175]:37880: 535 Incorrect authentication data (set_id=services)94.255.178.1752661886jI  -a' ossec13001gžExim Auth failed2025-03-01 11:13:38 dovecot_plain authenticator failed for ([94.181.23.131]) [94.181.23.131]:56977: 535 Incorrect authentication data (set_id=services@heipowersystem.com)94.181.23.1312017370]H  -C+ ossec13001gšExim Auth failed2025-03-01 10:58:12 dovecot_plain authenticator failed for ([178.178.194.128]) [178.178.194.128]:34772: 535 Incorrect authentication data (set_id=services)178.178.194.1282017370wG  -y) ossec13001gšExim Auth failed2025-03-01 10:57:46 dovecot_plain authenticator failed for (124-170-38-136.tpgi.com.au) [124.170.38.136]:54394: 535 Incorrect authentication data (set_id=services@heipowersystem.com)124.170.38.1362077456TF  -7% ossec13001g™Exim Auth failed2025-03-01 10:54:01 dovecot_plain authenticator failed for ([182.76.71.82]) [182.76.71.82]:34760: 535 Incorrect authentication data (set_id=services)182.76.71.821269750pE  -i+ ossec13001g™Exim Auth failed2025-03-01 10:53:51 dovecot_plain authenticator failed for ([106.246.227.218]) [106.246.227.218]:45264: 535 Incorrect authentication data (set_id=services@heipowersystem.com)106.246.227.2181835841BD  -% ossec13001g™Exim Auth failed2025-03-01 10:53:14 dovecot_plain authenticator failed for ([180.7.188.10]) [180.7.188.10]:42813: 535 Incorrect authentication data180.7.188.101861060NC  --# ossec13001g˜1Exim Auth failed2025-03-01 10:46:33 dovecot_plain authenticator failed for ([14.49.137.4]) [14.49.137.4]:40319: 535 Incorrect authentication data (set_id=sales)14.49.137.41835841dB  -W% ossec13001g˜%Exim Auth failed2025-03-01 10:46:21 dovecot_plain authenticator failed for ([179.185.1.97]) [179.185.1.97]:60531: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)179.185.1.973469034]A  -C+ ossec13001g˜Exim Auth failed2025-03-01 10:46:02 dovecot_plain authenticator failed for ([118.122.196.230]) [118.122.196.230]:40531: 535 Incorrect authentication data (set_id=services)118.122.196.2301814991@  -% ossec13001g—Exim Auth failed2025-03-01 10:45:28 dovecot_plain authenticator failed for vps-79f20bfc.vps.ovh.net ([87.98.249.193]) [51.75.24.107]:56024: 535 Incorrect authentication data (set_id=services@heipowersystem.com)51.75.24.1073017382W?  -9) ossec13001g–Exim Auth failed2025-03-01 10:40:56 dovecot_plain authenticator failed for ([220.182.17.122]) [220.182.17.122]:50872: 535 Incorrect authentication data (set_id=sales)220.182.17.1221814991d>  -W% ossec13001g–Exim Auth failed2025-03-01 10:40:17 dovecot_plain authenticator failed for ([90.173.78.90]) [90.173.78.90]:41737: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)90.173.78.902510769m=  -e) ossec13001g”Exim Auth failed2025-03-01 10:32:19 dovecot_plain authenticator failed for ([119.207.56.116]) [119.207.56.116]:36019: 535 Incorrect authentication data (set_id=services@heipowersystem.com)119.207.56.1161835841 P ! F ^ s | x %PQ]  -1% ossec13001g­hExim Auth failed2025-03-01 12:17:04 dovecot_plain authenticator failed for ([110.35.63.27]) [110.35.63.27]:59676: 535 Incorrect authentication data (set_id=sales)110.35.63.271835841i\  -_) ossec13001g­\Exim Auth failed2025-03-01 12:16:52 dovecot_plain authenticator failed for ([102.215.188.37]) [102.215.188.37]:33576: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)102.215.188.37192950t[  -u' ossec13001g­<Exim Auth failed2025-03-01 12:16:19 dovecot_plain authenticator failed for 2.sub-166-139-150.myvzw.com [166.139.150.2]:41651: 535 Incorrect authentication data (set_id=services@heipowersystem.com)166.139.150.26252001jZ  U5+ ossec11001g¬Deferred login on the cpanel service[2025-03-01 12:14:29 +0530] info [cpaneld] 106.219.143.134 - techno "GET /cpsess1888506894/frontend/jupiter/email_accounts/index.html HTTP/1.1" DEFERRED LOGIN cpaneld: cookie ip check: IP address has changed: IP Address [106.206.152.67] != Current IP Address [106.219.143.134]106.219.143.1341269750"Y  3M% ossec11301g«New FTP connection.Mar 1 12:10:44 vm1 pure-ftpd[1160488]: (?@139.162.77.6) [INFO] New connection from 139.162.77.6139.162.77.61861060gX  -[' ossec13001g«Exim Auth failed2025-03-01 12:09:06 dovecot_plain authenticator failed for ([102.221.65.24]) [102.221.65.24]:46506: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)102.221.65.242413451QW  -1% ossec13001g«Exim Auth failed2025-03-01 12:09:41 dovecot_plain authenticator failed for ([106.51.57.89]) [106.51.57.89]:50834: 535 Incorrect authentication data (set_id=sales)106.51.57.891269750V  5++ ossec11011g§WHM SSO login failed[2025-03-01 11:53:45 +0530] info [whostmgrd] 106.219.143.134 PURGE root:24hK4K3UVEERP4uJ badpass [cookie ip check: IP address has changed: IP Address [106.206.152.67] != Current IP Address [106.219.143.134]]106.219.143.1341269750U  Uc+ ossec11001g§Deferred login on the cpanel service[2025-03-01 11:53:45 +0530] info [whostmgrd] 106.219.143.134 - root "GET /cpsess1323816733/scripts4/listaccts?=undefined&login=1&post_login=63334910761939 HTTP/1.1" DEFERRED LOGIN whostmgrd: cookie ip check: IP address has changed: IP Address [106.206.152.67] != Current IP Address [106.219.143.134]106.219.143.1341269750sT  -u% ossec13001g§QExim Auth failed2025-03-01 11:51:03 dovecot_plain authenticator failed for 111-70-42-37.emome-ip.hinet.net [111.70.42.37]:38035: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)111.70.42.371668284gS  -[' ossec13001g§Exim Auth failed2025-03-01 11:49:45 dovecot_plain authenticator failed for 202-4-196-180.static.pccw-hkt.com [202.4.196.180]:46315: 535 Incorrect authentication data (set_id=services)202.4.196.1801819730dR  -Y# ossec13001g¦Exim Auth failed2025-03-01 11:49:28 dovecot_plain authenticator failed for ([1.193.163.2]) [1.193.163.2]:51326: 535 Incorrect authentication data (set_id=services@heipowersystem.com)1.193.163.21814991WQ  -9) ossec13001g¦]Exim Auth failed2025-03-01 11:46:59 dovecot_plain authenticator failed for ([94.181.187.192]) [94.181.187.192]:54120: 535 Incorrect authentication data (set_id=sales)94.181.187.1922017370gP  -[' ossec13001g¦5Exim Auth failed2025-03-01 11:46:20 dovecot_plain authenticator failed for ([59.13.237.163]) [59.13.237.163]:38086: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)59.13.237.1631835841kO  -e% ossec13001g¥PExim Auth failed2025-03-01 11:42:31 dovecot_plain authenticator failed for 111-70-3-198.emome-ip.hinet.net [111.70.3.198]:47827: 535 Incorrect authentication data (set_id=vikas.khandelwal)111.70.3.1981668284N  -' ossec13001g¥FExim Auth failed2025-03-01 11:42:21 dovecot_plain authenticator failed for 217-76-83-103.cust.bredband2.com [217.76.83.103]:50972: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)217.76.83.1032661886   4 _ q >GStjn  -a' ossec13001g¶Exim Auth failed2025-03-01 12:56:21 dovecot_plain authenticator failed for ([49.245.10.228]) [49.245.10.228]:60272: 535 Incorrect authentication data (set_id=services@heipowersystem.com)49.245.10.2281880251Xm -?# ossec13001g¶Exim Auth failed2025-03-01 12:56:03 dovecot_login authenticator failed for (vandanabalbharti.com) [14.18.77.99]:58270: 535 Incorrect authentication data (set_id=nologin)14.18.77.991814991[l  -C' ossec13001g¶{Exim Auth failed2025-03-01 12:55:45 dovecot_login authenticator failed for vps-926fddc5.vps.ovh.net [79.137.82.102]:43210: 535 Incorrect authentication data (set_id=sales)79.137.82.1023017382pk  -k) ossec13001g¶qExim Auth failed2025-03-01 12:55:36 dovecot_login authenticator failed for vps-f5bece10.vps.ovh.net [135.125.207.50]:38254: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)135.125.207.503017382sj  -u% ossec13001g¶%Exim Auth failed2025-03-01 12:54:20 dovecot_login authenticator failed for ([211.44.80.68]) [211.44.80.68]:53074: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)211.44.80.681835841Qi  -3# ossec13001gµ4Exim Auth failed2025-03-01 12:50:19 dovecot_plain authenticator failed for ([101.13.5.49]) [101.13.5.49]:37188: 535 Incorrect authentication data (set_id=services)101.13.5.491668284jh  -a' ossec13001gµExim Auth failed2025-03-01 12:49:55 dovecot_plain authenticator failed for ([95.85.112.170]) [95.85.112.170]:20048: 535 Incorrect authentication data (set_id=services@heipowersystem.com)95.85.112.1701218197Tg  -5' ossec13001g³Exim Auth failed2025-03-01 12:43:29 dovecot_plain authenticator failed for ([121.166.85.53]) [121.166.85.53]:43236: 535 Incorrect authentication data (set_id=sales)121.166.85.531835841ef  -S+ ossec13001g³Exim Auth failed2025-03-01 12:43:05 dovecot_plain authenticator failed for (tgw-rp.ru) [109.106.136.152]:59910: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)109.106.136.1522017370fe  -Y' ossec13001g°Exim Auth failed2025-03-01 12:32:11 dovecot_plain authenticator failed for 111-70-39-135.emome-ip.hinet.net [111.70.39.135]:45390: 535 Incorrect authentication data (set_id=services)111.70.39.1351668284ld  -e) ossec13001g°Exim Auth failed2025-03-01 12:31:58 dovecot_plain authenticator failed for ([102.215.188.37]) [102.215.188.37]:40483: 535 Incorrect authentication data (set_id=services@heipowersystem.com)102.215.188.37192950Qc  -1% ossec13001g°Exim Auth failed2025-03-01 12:31:12 dovecot_plain authenticator failed for ([42.236.91.93]) [42.236.91.93]:11310: 535 Incorrect authentication data (set_id=sales)42.236.91.931814991jb  -_) ossec13001g°Exim Auth failed2025-03-01 12:30:49 dovecot_plain authenticator failed for ([164.164.117.23]) [164.164.117.23]:49640: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)164.164.117.231269750Qa  -1% ossec13001g°%Exim Auth failed2025-03-01 12:28:44 dovecot_plain authenticator failed for ([59.22.68.213]) [59.22.68.213]:45540: 535 Incorrect authentication data (set_id=sales)59.22.68.2131835841g`  -[' ossec13001g°Exim Auth failed2025-03-01 12:28:26 dovecot_plain authenticator failed for ([39.172.61.145]) [39.172.61.145]:37870: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)39.172.61.1451814991i_  -a% ossec13001g¯wExim Auth failed2025-03-01 12:25:51 dovecot_plain authenticator failed for 7.248.146.34.bc.googleusercontent.com [34.146.248.7]:39692: 535 Incorrect authentication data (set_id=services)34.146.248.71861060p^  -i+ ossec13001g¯mExim Auth failed2025-03-01 12:25:41 dovecot_plain authenticator failed for ([176.226.241.177]) [176.226.241.177]:60744: 535 Incorrect authentication data (set_id=services@heipowersystem.com)176.226.241.1772017370 0uh[NA4'VI</@* s f Y L ? 2 % w j ] Pzm`F9# J=0qdW3& }pc ,S~0 |obUH;.!xk^QD7  "~dtWJg=ZM  v i \ O B 5 (    qyl_RE8+  C 6 )    { n a T G : -    r e X K > 1 $  1835841"I 1835841$X 1835841$= 1835841$< 1835841$" 1835841%X 1835841# 1835841$( 1835841# 1835841# 1835841# 1835841# 1835841%o 1835841%n 1835841%\ 1835841"l 1835841"` 1835841"^ 1835841"S 1835841| 1835841x 1835841u 1835841t 1835841p 1835841n 1835841h 1835841&; 1835841&: 1835841&9 1835841&5 1835841&4 1835841&) 1835841&& 1835841% 1835841% 1835841% 1835841% 1835841% 1835841% 1835841% 1835841% 1835841% 1835841% 1835841% 1835841% 1835841%w 1835841%v 1835841%t 1835841%r 1835841#} 1835841#u 1835841#n 1835841#l 1835841#h 1835841#e 1835841# 1835841# 1835841# 1835841# 1835841 1835841 1835841 1835841 1835841! 1835841! 1835841! 1835841! 1835841! 1835841!u 1835841!t 1835841!n 1835841!] 1835841!C 1835841 1835841!9 1835841!6 1835841!1 1835841!, 1835841!' 1835841! 1835841 1835841$h 1835841$\ 1835841$G 1835841$. 1835841$, 1835841$ 1835841$ 1835841$ 1835841# 1835841# 1835841# 1835841# 1835841# 1835841# 1835841# 1835841# 1835841#( 1835841 1835841# 1835841# 1835841# 1835841# 1835841" 1835841" 1835841" 1835841" 1835841" 1835841" 1835841" 1835841" 1835841" 1835841" 1835841" 1835841" 1835841" 1835841" 1835841" 1835841" 1835841" 1835841" 1835841" 1835841"~ 1835841"s 1835841"p 1835841#c 1835841#X 1835841#U 1835841#I 1835841#F 1835841#C 1835841#B 1835841#A 1835841#; 1835841#0 1835841# 1835841# 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841! 1835841  1835841  1835841 1835841! 1835841& 1835841&y 1835841&t 1835841&o 1835841&k 1835841&_ 1835841&[ 1835841&J 1835841&G 1835841&B 1835841 O 1835841 K 1835841 : 1835841 1 1835841  1835841  1835841  1835841  1835841 1835841$~ 1835841$| 1835841$m 1835841& 1835841& 1835841& 1835841& 1835841& 1835841& 1835841& 1835841& 1835841& 1835841& 1835841& 1835841& 1835841! 1835841! 1835841! 1835841& 1835841& 1835841& 1835841& 1835841' 1835841& 1835841& 1835841! 1835841%E 1835841%A 1835841%= 1835841%< 1835841%/ 1835841%) 1835841% 1835841% 1835841% 1835841% 1835841% 1835841% 1835841% 1835841$ 1835841$ 1835841$ 1835841$ 1835841$ 1835841$ 1835841$ 1835841$ 1835841$ 1835841$ 1835841$ 1835841$ 1835841$ 1835841$ 1835841$ 1835841$ 1835841$ 1835841 | 1835841! 1835841 y 1835841 q 1835841" 1835841 j 1835841 b 1835841 [ 1835841 Y 1835841 1835841 1835841 1835841 1835841%H 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841" 1835841 1835841 1835841 1835841! 1835841! 1835841"D 1835841"A 1835841%N 1835841" - B H s $ 6++=_n~  -') ossec13001g[Exim Auth failed2025-03-01 13:37:55 dovecot_login authenticator failed for (abts-mum-static-132.97.170.122.airtelbroadband.in) [122.170.97.132]:53635: 535 Incorrect authentication data (set_id=services@heipowersystem.com)122.170.97.1321269750W}  -;' ossec13001gExim Auth failed2025-03-01 13:36:41 dovecot_plain authenticator failed for ([142.79.232.38]) [142.79.232.38]:52138: 535 Incorrect authentication data (set_id=services)142.79.232.381269750f|  -]% ossec13001g Exim Auth failed2025-03-01 13:36:32 dovecot_plain authenticator failed for ([149.0.19.108]) [149.0.19.108]:59584: 535 Incorrect authentication data (set_id=services@heipowersystem.com)149.0.19.108298795Y{  -=+ ossec13001g¿wExim Auth failed2025-03-01 13:34:06 dovecot_plain authenticator failed for ([196.191.212.232]) [196.191.212.232]:50796: 535 Incorrect authentication data (set_id=sales)196.191.212.232337996mz  -c+ ossec13001g¿kExim Auth failed2025-03-01 13:33:55 dovecot_plain authenticator failed for ([121.152.119.174]) [121.152.119.174]:47764: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)121.152.119.1741835841Zy  -=+ ossec13001g¾Exim Auth failed2025-03-01 13:31:32 dovecot_plain authenticator failed for ([116.228.195.251]) [116.228.195.251]:15000: 535 Incorrect authentication data (set_id=sales)116.228.195.2511814991jx  -_) ossec13001g¾Exim Auth failed2025-03-01 13:31:03 dovecot_plain authenticator failed for ([189.218.168.30]) [189.218.168.30]:59994: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)189.218.168.303996063|w  -+ ossec13001g¾GExim Auth failed2025-03-01 13:29:01 dovecot_plain authenticator failed for 123-195-225-182.dynamic.kbronet.com.tw [123.195.225.182]:51564: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)123.195.225.1821668284v  -) ossec13001g¾1Exim Auth failed2025-03-01 13:28:39 dovecot_plain authenticator failed for (198-100-138-79.douglasfast.net) [198.100.138.79]:36090: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)198.100.138.796252001ju  -a' ossec13001g½Exim Auth failed2025-03-01 13:27:32 dovecot_plain authenticator failed for ([48.218.170.53]) [48.218.170.53]:34798: 535 Incorrect authentication data (set_id=services@heipowersystem.com)48.218.170.531861060Kt  =+ ossec13008g½Mail Reciepient rejected2025-03-01 13:23:50 H=(mail.saintsoldiercollege.com) [165.154.210.114]:62978 F= rejected RCPT : Rejected relay attempt: '165.154.210.114' From: 'sjxiwt@saintsoldiercollege.com' To: 'goofile@fastmail.com'165.154.210.1141694008Qs  -1% ossec13001g»Exim Auth failed2025-03-01 13:19:10 dovecot_plain authenticator failed for ([88.87.84.104]) [88.87.84.104]:48736: 535 Incorrect authentication data (set_id=sales)88.87.84.1042017370vr  -y' ossec13001g»Exim Auth failed2025-03-01 13:18:38 dovecot_plain authenticator failed for 111-70-49-105.emome-ip.hinet.net [111.70.49.105]:54828: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)111.70.49.1051668284gq  -]% ossec13001gº4Exim Auth failed2025-03-01 13:11:39 dovecot_plain authenticator failed for ([76.77.25.247]) [76.77.25.247]:50967: 535 Incorrect authentication data (set_id=services@heipowersystem.com)76.77.25.2476252001gp  -[' ossec13001g¹Exim Auth failed2025-03-01 13:06:55 dovecot_plain authenticator failed for 0x3ec64ba8.aal.customer.dk.telia.net [62.198.75.168]:38706: 535 Incorrect authentication data (set_id=sales)62.198.75.1682623032do  -W% ossec13001g¹ Exim Auth failed2025-03-01 13:06:40 dovecot_plain authenticator failed for ([191.59.165.4]) [191.59.165.4]:60240: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)191.59.165.43469034 "8 J _ t &K]{r  -u# ossec13001gʢExim Auth failed2025-03-01 14:21:45 dovecot_plain authenticator failed for 95-31-6-109.static.corbina.ru [95.31.6.109]:56592: 535 Incorrect authentication data (set_id=services@heipowersystem.com)95.31.6.1092017370w  -# ossec13001gtExim Auth failed2025-03-01 14:20:58 dovecot_plain authenticator failed for 18.red-83-48-39.staticip.rima-tde.net [83.48.39.18]:35788: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)83.48.39.182510769^  -M# ossec13001gDžExim Auth failed2025-03-01 14:08:28 dovecot_plain authenticator failed for host-2-98-157-37.as13285.net [2.98.157.37]:38074: 535 Incorrect authentication data (set_id=services)2.98.157.372635167j  -a' ossec13001g}Exim Auth failed2025-03-01 14:08:19 dovecot_plain authenticator failed for ([111.48.214.96]) [111.48.214.96]:32438: 535 Incorrect authentication data (set_id=services@heipowersystem.com)111.48.214.961814991W  -9) ossec13001gSExim Auth failed2025-03-01 14:07:37 dovecot_plain authenticator failed for ([178.216.220.91]) [178.216.220.91]:51166: 535 Incorrect authentication data (set_id=sales)178.216.220.912017370j  -_) ossec13001gGExim Auth failed2025-03-01 14:07:26 dovecot_plain authenticator failed for ([186.200.85.114]) [186.200.85.114]:37393: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)186.200.85.1143469034U  -7' ossec13001gExim Auth failed2025-03-01 14:02:00 dovecot_plain authenticator failed for ([218.106.120.18]) [58.49.113.138]:18851: 535 Incorrect authentication data (set_id=sales)58.49.113.1381814991j  -_) ossec13001gExim Auth failed2025-03-01 14:01:45 dovecot_plain authenticator failed for ([137.184.184.74]) [137.184.184.74]:52496: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)137.184.184.746252001_  -M' ossec13001gExim Auth failed2025-03-01 13:58:14 dovecot_plain authenticator failed for (185-189-123-105.laser.ir) [37.235.18.145]:40221: 535 Incorrect authentication data (set_id=services)37.235.18.145130758j  -a' ossec13001gExim Auth failed2025-03-01 13:58:05 dovecot_plain authenticator failed for ([200.61.12.107]) [200.61.12.107]:50978: 535 Incorrect authentication data (set_id=services@heipowersystem.com)200.61.12.1073865483i  -a' ossec13001gExim Auth failed2025-03-01 13:44:26 dovecot_plain authenticator failed for ([77.139.82.133]) [77.139.82.133]:58951: 535 Incorrect authentication data (set_id=services@heipowersystem.com)77.139.82.133294640W  -9) ossec13001gExim Auth failed2025-03-01 13:44:25 dovecot_plain authenticator failed for ([125.23.204.106]) [125.23.204.106]:36886: 535 Incorrect authentication data (set_id=sales)125.23.204.1061269750g  -[' ossec13001gExim Auth failed2025-03-01 13:44:11 dovecot_plain authenticator failed for ([203.190.150.4]) [203.190.150.4]:42130: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)203.190.150.41269750g  -]% ossec13001gExim Auth failed2025-03-01 13:44:36 dovecot_plain authenticator failed for h-46-59-44-182.a980.priv.bahnhof.se [46.59.44.182]:43502: 535 Incorrect authentication data (set_id=services)46.59.44.1822661886j  -_) ossec13001gqExim Auth failed2025-03-01 13:42:33 dovecot_plain authenticator failed for (static-78.219.149.202-tataidc.co.in) [202.149.219.78]:41080: 535 Incorrect authentication data (set_id=sales)202.149.219.781269750f  -[' ossec13001giExim Auth failed2025-03-01 13:42:24 dovecot_plain authenticator failed for ([94.206.192.75]) [94.206.192.75]:35320: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)94.206.192.75290557Z  -?) ossec13001geExim Auth failed2025-03-01 13:38:05 dovecot_login authenticator failed for ([37.151.212.229]) [37.151.212.229]:42904: 535 Incorrect authentication data (set_id=services)37.151.212.2291522867 ^% , > l o .1L^j  -_) ossec13001gڨExim Auth failed2025-03-01 15:30:06 dovecot_plain authenticator failed for ([112.111.61.231]) [112.111.61.229]:53682: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)112.111.61.2291814991a  -O' ossec13001gڊExim Auth failed2025-03-01 15:29:37 dovecot_plain authenticator failed for 2.sub-166-139-150.myvzw.com [166.139.150.2]:60853: 535 Incorrect authentication data (set_id=services)166.139.150.26252001y  -' ossec13001gjExim Auth failed2025-03-01 15:29:04 dovecot_plain authenticator failed for 111-70-49-105.emome-ip.hinet.net [111.70.49.105]:34051: 535 Incorrect authentication data (set_id=services@heipowersystem.com)111.70.49.1051668284Z  -?) ossec13001g7Exim Auth failed2025-03-01 15:23:59 dovecot_plain authenticator failed for ([138.75.118.229]) [138.75.118.229]:37680: 535 Incorrect authentication data (set_id=services)138.75.118.2291880251g  -]% ossec13001g#Exim Auth failed2025-03-01 15:23:38 dovecot_plain authenticator failed for ([187.92.76.49]) [201.91.84.89]:54296: 535 Incorrect authentication data (set_id=services@heipowersystem.com)201.91.84.893469034T  -5' ossec13001gؕExim Auth failed2025-03-01 15:21:16 dovecot_plain authenticator failed for ([220.74.63.183]) [220.74.63.183]:48918: 535 Incorrect authentication data (set_id=sales)220.74.63.1831835841j  -_) ossec13001g؉Exim Auth failed2025-03-01 15:21:04 dovecot_plain authenticator failed for ([115.44.141.199]) [115.44.141.199]:60232: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)115.44.141.1991814991W  -9) ossec13001gSExim Auth failed2025-03-01 15:15:54 dovecot_plain authenticator failed for ([121.168.210.98]) [121.168.210.98]:63749: 535 Incorrect authentication data (set_id=sales)121.168.210.981835841v  -y' ossec13001gGExim Auth failed2025-03-01 15:15:42 dovecot_plain authenticator failed for h77-94-125-250.static.bashtel.ru [77.94.125.250]:36480: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)77.94.125.2502017370Y  -=) ossec13001g֩Exim Auth failed2025-03-01 15:13:03 dovecot_plain authenticator failed for works.ssc-gr.info [160.251.121.70]:50046: 535 Incorrect authentication data (set_id=services)160.251.121.701861060y  -' ossec13001g֙Exim Auth failed2025-03-01 15:12:47 dovecot_plain authenticator failed for h77-94-125-250.static.bashtel.ru [77.94.125.250]:58068: 535 Incorrect authentication data (set_id=services@heipowersystem.com)77.94.125.2502017370N  --# ossec13001g̈́Exim Auth failed2025-03-01 14:34:04 dovecot_plain authenticator failed for ([43.252.8.34]) [43.252.8.34]:41612: 535 Incorrect authentication data (set_id=sales)43.252.8.341643084j  -_) ossec13001gzExim Auth failed2025-03-01 14:33:54 dovecot_plain authenticator failed for ([207.219.221.53]) [207.219.221.53]:50165: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)207.219.221.536251999P  -3# ossec13001gExim Auth failed2025-03-01 14:32:21 dovecot_plain authenticator failed for ([5.31.16.135]) [5.31.16.135]:54816: 535 Incorrect authentication data (set_id=services)5.31.16.135290557  - ) ossec13001gExim Auth failed2025-03-01 14:32:11 dovecot_plain authenticator failed for syn-173-095-123-220.biz.spectrum.com [173.95.123.220]:42014: 535 Incorrect authentication data (set_id=services@heipowersystem.com)173.95.123.2206252001  W) ossec9708gDovecot Aborted Login with empty userMar 1 14:26:57 vm1 dovecot[312763]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=87.236.176.116, lip=103.74.54.108, TLS, session=87.236.176.1162635167W  -;' ossec13001gʮExim Auth failed2025-03-01 14:21:57 dovecot_plain authenticator failed for ([191.59.251.95]) [191.59.251.95]:33524: 535 Incorrect authentication data (set_id=services)191.59.251.953469034 - C h t  1Jom1  -e) ossec13001gLExim Auth failed2025-03-01 16:19:47 dovecot_plain authenticator failed for ([187.76.173.246]) [187.76.173.246]:34374: 535 Incorrect authentication data (set_id=services@heipowersystem.com)187.76.173.2463469034y0  -' ossec13001gExim Auth failed2025-03-01 16:18:09 dovecot_plain authenticator failed for wsip-174-79-91-142.br.br.cox.net [174.79.91.142]:61823: 535 Incorrect authentication data (set_id=services@heipowersystem.com)174.79.91.1426252001]/  -C+ ossec13001gExim Auth failed2025-03-01 16:18:20 dovecot_plain authenticator failed for ([123.209.117.171]) [123.209.117.171]:45856: 535 Incorrect authentication data (set_id=services)123.209.117.1712077456W.  -9) ossec13001gExim Auth failed2025-03-01 16:09:32 dovecot_plain authenticator failed for ([221.199.172.66]) [221.199.172.66]:38382: 535 Incorrect authentication data (set_id=sales)221.199.172.661814991c-  -W% ossec13001gExim Auth failed2025-03-01 16:09:21 dovecot_plain authenticator failed for ([2.55.114.171]) [2.55.114.171]:52704: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)2.55.114.171294640T,  -5' ossec13001gJExim Auth failed2025-03-01 16:06:56 dovecot_plain authenticator failed for ([180.129.88.20]) [180.129.88.20]:39078: 535 Incorrect authentication data (set_id=sales)180.129.88.201880251g+  -[' ossec13001g6Exim Auth failed2025-03-01 16:06:36 dovecot_plain authenticator failed for ([27.45.236.182]) [27.45.236.182]:58818: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)27.45.236.1821814991V*  -;% ossec13001gExim Auth failed2025-03-01 16:06:09 dovecot_plain authenticator failed for ([182.76.125.170]) [182.76.87.90]:35490: 535 Incorrect authentication data (set_id=services)182.76.87.901269750l)  -e' ossec13001gExim Auth failed2025-03-01 16:06:00 dovecot_plain authenticator failed for rm0zqz.g-service.ru [84.22.155.211]:41360: 535 Incorrect authentication data (set_id=services@heipowersystem.com)84.22.155.2112017370f(  -W) ossec13001gExim Auth failed2025-03-01 15:56:03 dovecot_plain authenticator failed for 122-116-32-136.hinet-ip.hinet.net [122.116.32.136]:58556: 535 Incorrect authentication data (set_id=sales)122.116.32.1361668284j'  -_) ossec13001gExim Auth failed2025-03-01 15:55:46 dovecot_plain authenticator failed for ([187.92.119.246]) [187.92.119.246]:54489: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)187.92.119.2463469034Z&  -?) ossec13001gExim Auth failed2025-03-01 15:48:30 dovecot_plain authenticator failed for ([168.126.90.210]) [168.126.90.210]:58719: 535 Incorrect authentication data (set_id=services)168.126.90.2101835841p%  -i+ ossec13001gExim Auth failed2025-03-01 15:48:14 dovecot_plain authenticator failed for ([115.242.200.126]) [115.242.200.126]:34364: 535 Incorrect authentication data (set_id=services@heipowersystem.com)115.242.200.1261269750W$  -;' ossec13001gލExim Auth failed2025-03-01 15:46:44 dovecot_plain authenticator failed for ([165.90.119.85]) [165.90.119.85]:34085: 535 Incorrect authentication data (set_id=services)165.90.119.853374766f#  -[% ossec13001gqExim Auth failed2025-03-01 15:46:15 dovecot_plain authenticator failed for ([59.7.203.177]) [59.7.203.177]:4559: 535 Incorrect authentication data (set_id=services@heipowersystem.com)59.7.203.1771835841h"  -[) ossec13001gݺExim Auth failed2025-03-01 15:43:13 dovecot_plain authenticator failed for ([125.16.12.73]) [128.185.253.90]:46422: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)128.185.253.901269750c!  -S' ossec13001gڸExim Auth failed2025-03-01 15:30:23 dovecot_plain authenticator failed for 111-70-41-195.emome-ip.hinet.net [111.70.41.195]:60255: 535 Incorrect authentication data (set_id=sales)111.70.41.1951668284 6 a t EZqrA  -u# ossec13001gExim Auth failed2025-03-01 16:56:41 dovecot_plain authenticator failed for (70.246.50.116.ids.service.static.eastern-tele.com) [58.69.17.18]:43284: 535 Incorrect authentication data (set_id=sales)58.69.17.181694008y@  -}) ossec13001gExim Auth failed2025-03-01 16:56:30 dovecot_plain authenticator failed for 122-116-32-136.hinet-ip.hinet.net [122.116.32.136]:39203: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)122.116.32.1361668284h?  -_% ossec13001gExim Auth failed2025-03-01 16:55:45 dovecot_plain authenticator failed for syn-072-017-090-246.biz.spectrum.com [72.17.90.246]:56908: 535 Incorrect authentication data (set_id=services)72.17.90.2466252001g>  -]% ossec13001gExim Auth failed2025-03-01 16:55:05 dovecot_plain authenticator failed for ([218.70.9.114]) [218.70.9.114]:33954: 535 Incorrect authentication data (set_id=services@heipowersystem.com)218.70.9.1141814991i=  -]) ossec13001gExim Auth failed2025-03-01 16:43:00 dovecot_plain authenticator failed for 0x3ec67866.ejb.customer.dk.telia.net [62.198.120.102]:40113: 535 Incorrect authentication data (set_id=sales)62.198.120.1022623032j<  -_) ossec13001gExim Auth failed2025-03-01 16:42:40 dovecot_plain authenticator failed for ([73.231.102.189]) [73.231.102.189]:47450: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)73.231.102.1896252001e;  -S+ ossec13001gExim Auth failed2025-03-01 16:42:31 dovecot_plain authenticator failed for 220-235-212-152.tpgi.com.au [220.235.212.152]:40822: 535 Incorrect authentication data (set_id=services)220.235.212.1522077456g:  -]% ossec13001gExim Auth failed2025-03-01 16:42:19 dovecot_plain authenticator failed for ([90.173.78.90]) [90.173.78.90]:49188: 535 Incorrect authentication data (set_id=services@heipowersystem.com)90.173.78.902510769N9  =) ossec13008gMail Reciepient rejected2025-03-01 16:39:23 H=(mail.westerndancecompany.com) [165.154.213.54]:55182 F= rejected RCPT : Rejected relay attempt: '165.154.213.54' From: 'tuozhombk@westerndancecompany.com' To: 'goofile@fastmail.com'165.154.213.543469034q8  -q% ossec13001g5Exim Auth failed2025-03-01 16:36:28 dovecot_plain authenticator failed for 61-216-7-163.hinet-ip.hinet.net ([61.216.7.165]) [61.216.7.163]:60661: 535 Incorrect authentication data (set_id=sales)61.216.7.1631668284v7  -}# ossec13001g)Exim Auth failed2025-03-01 16:36:17 dovecot_plain authenticator failed for as007174.dynamic.ppp.asahi-net.or.jp [150.9.7.174]:58016: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)150.9.7.1741861060j6  -_) ossec13001gEExim Auth failed2025-03-01 16:28:12 dovecot_login authenticator failed for ([119.45.170.229]) [119.45.170.229]:46296: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)119.45.170.2291814991i5  -_' ossec13001gWExim Auth failed2025-03-01 16:28:30 dovecot_login authenticator failed for (static-146.220.149.202-tataidc.co.in) [114.143.75.66]:44008: 535 Incorrect authentication data (set_id=sales)114.143.75.661269750Q4  -1% ossec13001gExim Auth failed2025-03-01 16:26:59 dovecot_plain authenticator failed for ([1.224.58.243]) [1.224.58.243]:60583: 535 Incorrect authentication data (set_id=sales)1.224.58.2431835841e3  -S+ ossec13001gExim Auth failed2025-03-01 16:26:30 dovecot_plain authenticator failed for (tgw-rp.ru) [109.106.136.152]:60384: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)109.106.136.1522017370]2  -C+ ossec13001gZExim Auth failed2025-03-01 16:20:02 dovecot_plain authenticator failed for ([124.225.185.148]) [124.225.185.148]:41500: 535 Incorrect authentication data (set_id=services)124.225.185.1481814991 *\~tj`VLB8.$zpf\H>4*   v l b X N D : 0 &    ~ t j ` V L B 8 . $    z p f \ R H > 4 *  vblXND:0&|rh^TJ@6,"ndxZPF<2( ~tj`VLB8.$zpf\ | r h ^ T J @ 6 , "    x n d Z P F < 2 (   RRH>4*  vlbXND:0& gAq8 gAi7 g?Z6 g?5 g?4 g?3 g=2 g<1 g<0 g" g4(! g4 g4  g4 g3+ g3 g0y g0q g0 g0W g/( g/ g- g,2 g," g)w g)] g) g)' g'm g'X g'< g% g% g# g" g! g g g g g gu gi g g gw g  g g g g gl g@ g4 g gZ g< g g g g gy gg gI g  g  g  g  g  g  gu ge g/ g gH g g g g g gO gE g7 g g  g g g4 g g g g gO g7 g g g g g g g gQ gA g go g g g g g g g g g g5 g) gW gE g g gZ gL g g g g gJ g6 g g g g g g gލ gq gݺ gڸ gڨ gڊ gj g7 g# gؕ g؉ gS gG g֩ g֙ g̈́ gz g g g gʮ gʢ gbSc g`db g`Va g`F` g__ g_^ g_$] g]`\ g]V[ g]Z g\Y gZX gZW gZmV gXtU gXdT gVR gVS gVQ gVP gSO gSN gRM gRL gRK gQJ gPI gNH gM~G gKF gHE gHD gHqC gHeB gFA gF? gF> gF= gFx@ gE< gE.; gE: gB9 gt gDž g} gS gG g g g g g g g g gq gi ge g[~ g} g | g¿w{ g¿kz g¾y g¾x g¾Gw g¾1v g½u g½t g»s g»r gº4q g¹p g¹ o g¶n g¶m g¶{l g¶qk g¶%j gµ4i gµh g³g g³f g°e gbcd g°d g°c g°b g°%a g°` g¯w_ g¯m^ g­h] g­\\ g­<[ g¬Z g«Y g«W g«X g§V g§U g§QT g§S g¦R g¦]Q g¦5P g¥PO g¥FN g£M g£L g¡K gžJ gžI gšH gšG g™F g™E g™D g˜1C g˜%B g˜A g—@ g–? g–> g”= g”N< g”8; 7 C b t ":UjdR  -W% ossec13001gExim Auth failed2025-03-01 17:52:51 dovecot_plain authenticator failed for ([110.34.70.28]) [110.34.70.28]:46517: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)110.34.70.281835841mQ  -e) ossec13001gExim Auth failed2025-03-01 17:46:48 dovecot_plain authenticator failed for ([168.126.90.210]) [168.126.90.210]:45492: 535 Incorrect authentication data (set_id=services@heipowersystem.com)168.126.90.2101835841XP  -=' ossec13001gExim Auth failed2025-03-01 17:46:59 dovecot_plain authenticator failed for ([177.174.89.105]) [177.174.89.99]:44415: 535 Incorrect authentication data (set_id=services)177.174.89.993469034gO  -[' ossec13001gExim Auth failed2025-03-01 17:44:04 dovecot_plain authenticator failed for ([103.99.148.77]) [103.99.148.77]:51660: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)103.99.148.771269750aN  -S% ossec13001gOExim Auth failed2025-03-01 17:40:55 dovecot_plain authenticator failed for host-5-58-201-106.bitternet.ua [5.58.201.106]:55202: 535 Incorrect authentication data (set_id=services)5.58.201.106690791dM  -Y# ossec13001g7Exim Auth failed2025-03-01 17:40:30 dovecot_plain authenticator failed for ([46.44.5.135]) [46.44.5.135]:50636: 535 Incorrect authentication data (set_id=services@heipowersystem.com)46.44.5.1352017370WL  -9) ossec13001gExim Auth failed2025-03-01 17:35:49 dovecot_plain authenticator failed for ([151.49.116.193]) [151.49.116.193]:44469: 535 Incorrect authentication data (set_id=sales)151.49.116.1933175395dK  -W% ossec13001gExim Auth failed2025-03-01 17:35:41 dovecot_plain authenticator failed for ([1.224.58.243]) [1.224.58.243]:32882: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)1.224.58.2431835841jJ  -_) ossec13001gExim Auth failed2025-03-01 17:22:15 dovecot_plain authenticator failed for ([60.175.146.138]) [60.175.146.138]:60696: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)60.175.146.1381814991ZI  -?) ossec13001gExim Auth failed2025-03-01 17:18:11 dovecot_plain authenticator failed for ([111.48.208.197]) [111.48.208.197]:10482: 535 Incorrect authentication data (set_id=services)111.48.208.1971814991gH  -]% ossec13001gExim Auth failed2025-03-01 17:18:00 dovecot_plain authenticator failed for ([76.77.25.247]) [76.77.25.247]:37413: 535 Incorrect authentication data (set_id=services@heipowersystem.com)76.77.25.2476252001TG  -5' ossec13001gExim Auth failed2025-03-01 17:12:30 dovecot_plain authenticator failed for ([14.34.217.155]) [14.34.217.155]:51034: 535 Incorrect authentication data (set_id=sales)14.34.217.1551835841jF  -]+ ossec13001gExim Auth failed2025-03-01 17:12:18 dovecot_plain authenticator failed for ([125.20.5.209]) [128.185.246.150]:58688: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)128.185.246.1501269750]E  -C+ ossec13001gQExim Auth failed2025-03-01 17:06:48 dovecot_plain authenticator failed for ([103.146.233.121]) [103.146.233.121]:53624: 535 Incorrect authentication data (set_id=services)103.146.233.1211269750pD  -i+ ossec13001gAExim Auth failed2025-03-01 17:06:33 dovecot_plain authenticator failed for ([115.247.159.106]) [115.247.159.106]:46886: 535 Incorrect authentication data (set_id=services@heipowersystem.com)115.247.159.1061269750WC  -;' ossec13001gExim Auth failed2025-03-01 16:59:24 dovecot_plain authenticator failed for ([88.201.163.65]) [88.201.163.65]:49422: 535 Incorrect authentication data (set_id=services)88.201.163.652017370jB  -a' ossec13001goExim Auth failed2025-03-01 16:58:46 dovecot_plain authenticator failed for ([200.175.88.85]) [200.175.88.85]:60684: 535 Incorrect authentication data (set_id=services@heipowersystem.com)200.175.88.853469034 R"4 F n z 'CY*9Rcc  -W# ossec13001geExim Auth failed2025-03-01 18:45:15 dovecot_plain authenticator failed for ([203.177.65.26]) [58.69.17.18]:42618: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)58.69.17.181694008mb  -e) ossec13001g/Exim Auth failed2025-03-01 18:44:21 dovecot_plain authenticator failed for ([186.148.187.91]) [186.148.187.91]:55675: 535 Incorrect authentication data (set_id=services@heipowersystem.com)186.148.187.913686110ja  -_) ossec13001gExim Auth failed2025-03-01 18:39:50 dovecot_plain authenticator failed for ([123.209.119.82]) [123.209.119.82]:33398: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)123.209.119.822077456=`  =s+ ossec13008gHMail Reciepient rejected2025-03-01 18:36:15 H=(mail.fablixsolutions.com) [165.154.213.130]:55779 F= rejected RCPT : Rejected relay attempt: '165.154.213.130' From: 'sfckj@fablixsolutions.com' To: 'goofile@fastmail.com'165.154.213.1303469034f_  -]% ossec13001gExim Auth failed2025-03-01 18:34:46 dovecot_plain authenticator failed for ([37.25.33.108]) [37.25.33.108]:38753: 535 Incorrect authentication data (set_id=services@heipowersystem.com)37.25.33.108294640`^  -Q# ossec13001gExim Auth failed2025-03-01 18:31:10 dovecot_plain authenticator failed for 37.151.71.8.dynamic.telecom.kz [37.151.71.8]:56231: 535 Incorrect authentication data (set_id=services)37.151.71.81522867g]  -]% ossec13001gExim Auth failed2025-03-01 18:30:54 dovecot_plain authenticator failed for ([27.72.103.74]) [27.72.103.74]:56163: 535 Incorrect authentication data (set_id=services@heipowersystem.com)27.72.103.741562822X\  -;) ossec13001gExim Auth failed2025-03-01 18:21:41 dovecot_plain authenticator failed for ([159.223.250.131]) [161.35.200.202]:46624: 535 Incorrect authentication data (set_id=sales)161.35.200.2022921044g[  -[' ossec13001gExim Auth failed2025-03-01 18:21:28 dovecot_plain authenticator failed for ([183.105.3.221]) [183.105.3.221]:52174: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)183.105.3.2211835841XZ  -;) ossec13001gOExim Auth failed2025-03-01 18:15:03 dovecot_plain authenticator failed for 28.244.inn361.ru [193.169.28.244]:60047: 535 Incorrect authentication data (set_id=services)193.169.28.2442017370cY  -Y# ossec13001gEExim Auth failed2025-03-01 18:14:53 dovecot_plain authenticator failed for ([91.221.7.13]) [91.221.7.13]:54530: 535 Incorrect authentication data (set_id=services@heipowersystem.com)91.221.7.13690791ZX  -?) ossec13001g7Exim Auth failed2025-03-01 18:10:21 dovecot_plain authenticator failed for ([73.231.102.189]) [73.231.102.189]:43022: 535 Incorrect authentication data (set_id=services)73.231.102.1896252001pW  -i+ ossec13001gExim Auth failed2025-03-01 18:09:41 dovecot_plain authenticator failed for ([197.255.203.245]) [197.255.203.245]:58657: 535 Incorrect authentication data (set_id=services@heipowersystem.com)197.255.203.2452413451TV  -7% ossec13001g Exim Auth failed2025-03-01 17:56:49 dovecot_plain authenticator failed for ([85.152.57.60]) [85.152.57.60]:44070: 535 Incorrect authentication data (set_id=services)85.152.57.602510769jU  -a' ossec13001gExim Auth failed2025-03-01 17:56:23 dovecot_plain authenticator failed for ([125.20.46.114]) [125.20.46.114]:34904: 535 Incorrect authentication data (set_id=services@heipowersystem.com)125.20.46.1141269750jT  -a' ossec13001gExim Auth failed2025-03-01 17:56:14 dovecot_plain authenticator failed for ([114.30.180.58]) [114.30.180.58]:52576: 535 Incorrect authentication data (set_id=services@heipowersystem.com)114.30.180.581835841ZS  -=+ ossec13001g4Exim Auth failed2025-03-01 17:53:15 dovecot_plain authenticator failed for ([220.248.188.139]) [220.248.188.139]:45196: 535 Incorrect authentication data (set_id=sales)220.248.188.1391814991 % G G Y l /Q)t 3U) ossec11301gNew FTP connection.Mar 1 19:34:25 vm1 pure-ftpd[1243275]: (?@89.248.163.214) [INFO] New connection from 89.248.163.21489.248.163.2142750405Zs  -=+ ossec13001gZExim Auth failed2025-03-01 19:32:01 dovecot_plain authenticator failed for ([185.235.212.105]) [185.235.212.105]:34228: 535 Incorrect authentication data (set_id=sales)185.235.212.1053202326gr  -[' ossec13001g<Exim Auth failed2025-03-01 19:31:30 dovecot_plain authenticator failed for ([103.161.93.51]) [103.161.93.51]:65012: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)103.161.93.511269750Wq  -;' ossec13001gExim Auth failed2025-03-01 19:22:23 dovecot_plain authenticator failed for ([124.246.92.77]) [124.246.92.77]:48332: 535 Incorrect authentication data (set_id=services)124.246.92.771880251fp  -]% ossec13001gExim Auth failed2025-03-01 19:21:57 dovecot_plain authenticator failed for ([41.24.28.218]) [41.24.28.218]:51421: 535 Incorrect authentication data (set_id=services@heipowersystem.com)41.24.28.218953987o  =7+ ossec13008gMail Reciepient rejected2025-03-01 19:21:08 H=(mail.hsnews.in) [165.154.213.166]:58783 F= rejected RCPT : Rejected relay attempt: '165.154.213.166' From: 'crmma@hsnews.in' To: 'goofile@fastmail.com'165.154.213.1663469034Wn  -9) ossec13001gExim Auth failed2025-03-01 19:15:40 dovecot_plain authenticator failed for ([58.248.169.140]) [58.248.169.140]:38388: 535 Incorrect authentication data (set_id=sales)58.248.169.1401814991jm  -_) ossec13001gyExim Auth failed2025-03-01 19:15:27 dovecot_plain authenticator failed for ([221.10.221.104]) [221.10.221.104]:36723: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)221.10.221.1041814991Wl  -;' ossec13001ggExim Auth failed2025-03-01 19:15:10 dovecot_plain authenticator failed for ([142.79.232.38]) [142.79.232.38]:57533: 535 Incorrect authentication data (set_id=services)142.79.232.381269750gk  -]% ossec13001gIExim Auth failed2025-03-01 19:14:39 dovecot_plain authenticator failed for ([160.30.185.3]) [160.30.185.3]:44722: 535 Incorrect authentication data (set_id=services@heipowersystem.com)160.30.185.31252634Wj  -9) ossec13001g Exim Auth failed2025-03-01 19:07:43 dovecot_plain authenticator failed for ([27.123.242.252]) [27.123.242.252]:60442: 535 Incorrect authentication data (set_id=sales)27.123.242.2521269750ii  -_) ossec13001g Exim Auth failed2025-03-01 19:07:19 dovecot_plain authenticator failed for ([196.190.180.18]) [196.190.180.19]:42977: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)196.190.180.19337996jh  -a' ossec13001g Exim Auth failed2025-03-01 19:00:39 dovecot_plain authenticator failed for dhcp-4-bc-9f-5c-8b-29.cpe.i-zoom.net [24.244.93.203]:34523: 535 Incorrect authentication data (set_id=services)24.244.93.2036251999|g  -' ossec13001g Exim Auth failed2025-03-01 19:00:15 dovecot_plain authenticator failed for c-71-193-102-94.hsd1.tn.comcast.net [71.193.102.94]:53084: 535 Incorrect authentication data (set_id=services@heipowersystem.com)71.193.102.946252001Zf  -=+ ossec13001g Exim Auth failed2025-03-01 18:50:55 dovecot_plain authenticator failed for ([118.122.196.230]) [118.122.196.230]:58408: 535 Incorrect authentication data (set_id=sales)118.122.196.2301814991ge  -[' ossec13001g Exim Auth failed2025-03-01 18:50:44 dovecot_plain authenticator failed for ([186.179.80.12]) [186.179.80.12]:53028: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)186.179.80.123895114ld  -a+ ossec13001guExim Auth failed2025-03-01 18:45:32 dovecot_plain authenticator failed for 165.199.148.122.sta.wbroadband.net.au [122.148.199.165]:55961: 535 Incorrect authentication data (set_id=sales)122.148.199.1652077456 I' L   6 Ql7Ij  -a' ossec13001gExim Auth failed2025-03-01 20:22:03 dovecot_login authenticator failed for ([61.108.83.138]) [61.108.83.138]:58205: 535 Incorrect authentication data (set_id=services@heipowersystem.com)61.108.83.1381835841_  -K' ossec13001gExim Auth failed2025-03-01 20:17:16 dovecot_login authenticator failed for ([183.47.48.178]) [183.47.48.178]:46961: 535 Incorrect authentication data (set_id=vikas.khandelwal)183.47.48.1781814991r  -q' ossec13001gExim Auth failed2025-03-01 20:16:55 dovecot_login authenticator failed for ([14.48.227.118]) [14.48.227.118]:41034: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)14.48.227.1181835841r  -q' ossec13001gExim Auth failed2025-03-01 20:17:31 dovecot_login authenticator failed for syn-068-184-049-166.res.spectrum.com [68.184.49.166]:59814: 535 Incorrect authentication data (set_id=vikas.khandelwal)68.184.49.1666252001T  -7% ossec13001guExim Auth failed2025-03-01 20:02:20 dovecot_plain authenticator failed for ([110.35.63.27]) [110.35.63.27]:58846: 535 Incorrect authentication data (set_id=services)110.35.63.271835841f  -]% ossec13001giExim Auth failed2025-03-01 20:02:09 dovecot_plain authenticator failed for ([94.205.83.14]) [94.205.83.14]:47003: 535 Incorrect authentication data (set_id=services@heipowersystem.com)94.205.83.14290557W  -9) ossec13001gExim Auth failed2025-03-01 19:58:26 dovecot_login authenticator failed for ([112.111.61.230]) [112.111.61.229]:33310: 535 Incorrect authentication data (set_id=sales)112.111.61.2291814991l~  -a+ ossec13001gExim Auth failed2025-03-01 19:58:15 dovecot_login authenticator failed for ([171.244.142.135]) [171.244.142.135]:5401: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)171.244.142.1351562822U}  -3+ ossec13001gwExim Auth failed2025-03-01 19:58:07 dovecot_login authenticator failed for p99220-obmd01.tokyo.ocn.ne.jp [124.101.255.220]:46167: 535 Incorrect authentication data124.101.255.2201861060a|  -M) ossec13001g Exim Auth failed2025-03-01 19:56:20 dovecot_plain authenticator failed for (124-170-38-136.tpgi.com.au) [124.170.38.136]:59353: 535 Incorrect authentication data (set_id=sales)124.170.38.1362077456a{  -S# ossec13001gExim Auth failed2025-03-01 19:56:03 dovecot_plain authenticator failed for ([46.44.5.135]) [46.44.5.135]:50790: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)46.44.5.1352017370Wz  -;' ossec13001gExim Auth failed2025-03-01 19:42:36 dovecot_plain authenticator failed for ([27.223.100.94]) [27.223.100.90]:41614: 535 Incorrect authentication data (set_id=services)27.223.100.901814991my  -e) ossec13001gExim Auth failed2025-03-01 19:42:10 dovecot_plain authenticator failed for ([191.210.87.101]) [191.210.87.101]:49915: 535 Incorrect authentication data (set_id=services@heipowersystem.com)191.210.87.1013469034Fx  =+ ossec13008gMail Reciepient rejected2025-03-01 19:38:52 H=(mail.heipowersystem.com) [165.154.213.196]:56796 F= rejected RCPT : Rejected relay attempt: '165.154.213.196' From: 'wlatomkjkye@heipowersystem.com' To: 'goofile@fastmail.com'165.154.213.1963469034Ww  -9) ossec13001glExim Auth failed2025-03-01 19:36:34 dovecot_plain authenticator failed for ([124.221.104.33]) [124.221.104.33]:59770: 535 Incorrect authentication data (set_id=sales)124.221.104.331814991jv  -_) ossec13001g@Exim Auth failed2025-03-01 19:35:52 dovecot_plain authenticator failed for ([183.100.18.224]) [183.100.18.224]:45866: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)183.100.18.2241835841gu  -[' ossec13001g4Exim Auth failed2025-03-01 19:35:38 dovecot_plain authenticator failed for ([175.202.82.16]) [175.202.82.16]:44394: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)175.202.82.161835841 % C M " !5\m  -e) ossec13001g-Exim Auth failed2025-03-01 21:24:29 dovecot_plain authenticator failed for ([176.192.250.81]) [176.192.250.81]:60404: 535 Incorrect authentication data (set_id=services@heipowersystem.com)176.192.250.812017370S  -1) ossec13001g,2Exim Auth failed2025-03-01 21:18:00 dovecot_plain authenticator failed for ([70.39.23.1]) [167.142.198.54]:57069: 535 Incorrect authentication data (set_id=sales)167.142.198.546252001g  -[' ossec13001g,"Exim Auth failed2025-03-01 21:17:45 dovecot_plain authenticator failed for ([31.133.71.204]) [31.133.71.204]:52696: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)31.133.71.2042017370W  -;' ossec13001g)wExim Auth failed2025-03-01 21:06:23 dovecot_plain authenticator failed for ([31.133.71.204]) [31.133.71.204]:59622: 535 Incorrect authentication data (set_id=services)31.133.71.2042017370g  -]% ossec13001g)]Exim Auth failed2025-03-01 21:05:56 dovecot_plain authenticator failed for ([85.19.195.12]) [85.19.195.12]:45678: 535 Incorrect authentication data (set_id=services@heipowersystem.com)85.19.195.123144096v  -w) ossec13001g)Exim Auth failed2025-03-01 21:04:54 dovecot_plain authenticator failed for 208.95.143.157.bbcs.as8758.net [157.143.95.208]:40815: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)157.143.95.2082658434Q  -1% ossec13001g)'Exim Auth failed2025-03-01 21:05:03 dovecot_plain authenticator failed for ([85.152.57.60]) [85.152.57.60]:57614: 535 Incorrect authentication data (set_id=sales)85.152.57.602510769U  -3+ ossec13001g'mExim Auth failed2025-03-01 20:57:39 dovecot_plain authenticator failed for p52112-obmd01.osaka.ocn.ne.jp [153.141.239.112]:40126: 535 Incorrect authentication data153.141.239.1121861060h  -_' ossec13001g'XExim Auth failed2025-03-01 20:57:19 dovecot_plain authenticator failed for ([185.189.123.105]) [37.235.18.145]:48534: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)37.235.18.145130758}  -' ossec13001g'<Exim Auth failed2025-03-01 20:56:51 dovecot_plain authenticator failed for syn-131-148-000-202.biz.spectrum.com [131.148.0.202]:51765: 535 Incorrect authentication data (set_id=services@heipowersystem.com)131.148.0.2026252001'  =G+ ossec13008g%Mail Reciepient rejected2025-03-01 20:50:35 H=(mail.hsnews.in) [165.154.251.128]:63338 F= rejected RCPT : Rejected relay attempt: '165.154.251.128' From: 'axyffsfls@hsnews.in' To: 'goofile@fastmail.com'165.154.251.1281605651L  =) ossec13008g%Mail Reciepient rejected2025-03-01 20:47:47 H=(mail.westerndancecompany.com) [165.154.226.38]:49521 F= rejected RCPT : Rejected relay attempt: '165.154.226.38' From: 'iqbdkzsi@westerndancecompany.com' To: 'goofile@fastmail.com'165.154.226.381668284"  3M% ossec11301g#New FTP connection.Mar 1 20:41:44 vm1 pure-ftpd[1255505]: (?@13.89.125.19) [INFO] New connection from 13.89.125.1913.89.125.196252001^ -E) ossec13001g"Exim Auth failed2025-03-01 20:34:51 dovecot_login authenticator failed for (vandanabalbharti.com) [42.193.105.109]:50156: 535 Incorrect authentication data (set_id=nologin)42.193.105.1091814991"  3M% ossec11301g!New FTP connection.Mar 1 20:32:23 vm1 pure-ftpd[1253779]: (?@47.251.13.59) [INFO] New connection from 47.251.13.5947.251.13.5962520011  =[+ ossec13008gMail Reciepient rejected2025-03-01 20:25:05 H=(mail.rokamauka.com) [165.154.213.136]:58923 F= rejected RCPT : Rejected relay attempt: '165.154.213.136' From: 'wokgfizd@rokamauka.com' To: 'goofile@fastmail.com'165.154.213.1363469034 C, ; Z +q1Cj'  -a' ossec13001g8Exim Auth failed2025-03-01 22:11:44 dovecot_plain authenticator failed for ([114.30.180.58]) [114.30.180.58]:50966: 535 Incorrect authentication data (set_id=services@heipowersystem.com)114.30.180.581835841]&  -C+ ossec13001g7Exim Auth failed2025-03-01 22:04:34 dovecot_plain authenticator failed for ([154.144.230.118]) [154.144.230.118]:24342: 535 Incorrect authentication data (set_id=services)154.144.230.1182542007a%  -U! ossec13001g7 Exim Auth failed2025-03-01 22:04:19 dovecot_plain authenticator failed for ([45.6.80.40]) [45.6.80.40]:34312: 535 Incorrect authentication data (set_id=services@heipowersystem.com)45.6.80.403469034Q$  -1% ossec13001g6Exim Auth failed2025-03-01 22:03:33 dovecot_plain authenticator failed for ([106.51.57.89]) [106.51.57.89]:53360: 535 Incorrect authentication data (set_id=sales)106.51.57.891269750j#  -_) ossec13001g6Exim Auth failed2025-03-01 22:03:17 dovecot_plain authenticator failed for ([123.209.200.21]) [123.209.200.21]:44882: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)123.209.200.212077456j"  -a' ossec13001g4>Exim Auth failed2025-03-01 21:52:20 dovecot_plain authenticator failed for ([58.234.165.73]) [58.234.165.73]:39432: 535 Incorrect authentication data (set_id=services@heipowersystem.com)58.234.165.731835841Z!  -?) ossec13001g4(Exim Auth failed2025-03-01 21:51:59 dovecot_login authenticator failed for ([183.167.198.31]) [183.167.198.31]:59709: 535 Incorrect authentication data (set_id=services)183.167.198.311814991g  -]% ossec13001g4Exim Auth failed2025-03-01 21:51:45 dovecot_login authenticator failed for ([202.200.14.2]) [202.200.14.2]:33981: 535 Incorrect authentication data (set_id=services@heipowersystem.com)202.200.14.218149916  Ag% ossec11302g4 FTP Authentication failed.Mar 1 21:51:29 vm1 pure-ftpd[1267960]: (?@51.81.111.14) [WARNING] Authentication failed for user [anonymous]51.81.111.146252001"  3M% ossec11301g4New FTP connection.Mar 1 21:51:22 vm1 pure-ftpd[1267960]: (?@51.81.111.14) [INFO] New connection from 51.81.111.1451.81.111.146252001U  -5) ossec13001g3+Exim Auth failed2025-03-01 21:47:46 dovecot_plain authenticator failed for ([125.16.12.73]) [128.185.253.90]:44356: 535 Incorrect authentication data (set_id=sales)128.185.253.901269750j  -_) ossec13001g3Exim Auth failed2025-03-01 21:47:29 dovecot_plain authenticator failed for ([122.170.14.161]) [122.170.14.161]:48409: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)122.170.14.1611269750f  -]% ossec13001g0yExim Auth failed2025-03-01 21:36:17 dovecot_plain authenticator failed for ([94.205.83.14]) [94.205.83.14]:52906: 535 Incorrect authentication data (set_id=services@heipowersystem.com)94.205.83.14290557T  -5' ossec13001g0qExim Auth failed2025-03-01 21:36:08 dovecot_plain authenticator failed for ([49.124.149.50]) [49.124.149.50]:42968: 535 Incorrect authentication data (set_id=sales)49.124.149.501733045]  -C+ ossec13001g0Exim Auth failed2025-03-01 21:36:28 dovecot_plain authenticator failed for ([197.255.138.197]) [197.255.138.197]:52673: 535 Incorrect authentication data (set_id=services)197.255.138.1973374766m  -c+ ossec13001g0WExim Auth failed2025-03-01 21:35:41 dovecot_plain authenticator failed for ([213.195.113.234]) [213.195.113.234]:42202: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)213.195.113.2342510769W  -9) ossec13001g/(Exim Auth failed2025-03-01 21:30:40 dovecot_plain authenticator failed for ([94.181.187.192]) [94.181.187.192]:55190: 535 Incorrect authentication data (set_id=sales)94.181.187.1922017370u  -w' ossec13001g/Exim Auth failed2025-03-01 21:30:23 dovecot_plain authenticator failed for 46.79-160-128.customer.lyse.net [79.160.128.46]:46752: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)79.160.128.463144096 \"4 \ k co1\Q8  -1% ossec13001gAqExim Auth failed2025-03-01 22:48:41 dovecot_plain authenticator failed for ([2.63.169.110]) [2.63.169.110]:52434: 535 Incorrect authentication data (set_id=sales)2.63.169.1102017370j7  -_) ossec13001gAiExim Auth failed2025-03-01 22:48:32 dovecot_plain authenticator failed for ([222.160.99.210]) [222.160.99.210]:38759: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)222.160.99.2101814991%6  3Q' ossec11301g?ZNew FTP connection.Mar 1 22:39:44 vm1 pure-ftpd[1276818]: (?@103.156.20.15) [INFO] New connection from 103.156.20.15103.156.20.151269750S5  -5' ossec13001g?Exim Auth failed2025-03-01 22:38:41 dovecot_plain authenticator failed for ([185.167.56.24]) [185.167.56.24]:47852: 535 Incorrect authentication data (set_id=sales)185.167.56.24617790m4  -e) ossec13001g?Exim Auth failed2025-03-01 22:38:35 dovecot_plain authenticator failed for ([220.77.245.227]) [220.77.245.227]:50342: 535 Incorrect authentication data (set_id=services@heipowersystem.com)220.77.245.2271835841m3  -c+ ossec13001g?Exim Auth failed2025-03-01 22:38:31 dovecot_plain authenticator failed for ([157.122.132.209]) [157.122.132.209]:53186: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)157.122.132.2091814991j2  -a' ossec13001g=Exim Auth failed2025-03-01 22:30:02 dovecot_plain authenticator failed for ([65.175.24.142]) [65.175.24.142]:34467: 535 Incorrect authentication data (set_id=services@heipowersystem.com)65.175.24.1426252001p1  -o% ossec13001g<Exim Auth failed2025-03-01 22:27:52 dovecot_login authenticator failed for syn-072-017-090-246.biz.spectrum.com [72.17.90.246]:43096: 535 Incorrect authentication data (set_id=vikas.khandelwal)72.17.90.2466252001L0  =) ossec13008g<Mail Reciepient rejected2025-03-01 22:27:39 H=(mail.westerndancecompany.com) [165.154.227.89]:60319 F= rejected RCPT : Rejected relay attempt: '165.154.227.89' From: 'ybiurhlj@westerndancecompany.com' To: 'goofile@fastmail.com'165.154.227.891668284/  -) ossec13001g  -i' ossec13001gFExim Auth failed2025-03-01 23:10:26 dovecot_plain authenticator failed for pool-99-251-252-98.cpe.net.cable.rogers.com [99.251.252.98]:34478: 535 Incorrect authentication data (set_id=sales)99.251.252.986251999d=  -W% ossec13001gFExim Auth failed2025-03-01 23:10:15 dovecot_plain authenticator failed for ([14.39.41.171]) [14.39.41.171]:53532: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)14.39.41.1711835841`< -G+ ossec13001gEExim Auth failed2025-03-01 23:06:56 dovecot_login authenticator failed for (vandanabalbharti.com) [111.122.211.212]:65214: 535 Incorrect authentication data (set_id=nologin)111.122.211.2121814991];  -C+ ossec13001gE.Exim Auth failed2025-03-01 23:04:37 dovecot_plain authenticator failed for ([180.110.237.199]) [180.110.237.199]:18652: 535 Incorrect authentication data (set_id=services)180.110.237.1991814991g:  -]% ossec13001gEExim Auth failed2025-03-01 23:03:56 dovecot_plain authenticator failed for ([60.173.218.7]) [60.173.218.7]:44049: 535 Incorrect authentication data (set_id=services@heipowersystem.com)60.173.218.71814991p9  -i+ ossec13001gBExim Auth failed2025-03-01 22:53:42 dovecot_plain authenticator failed for ([114.104.158.173]) [114.104.158.172]:53471: 535 Incorrect authentication data (set_id=services@heipowersystem.com)114.104.158.1721814991  ! C Y x ,Gv WZ  -;' ossec13001g]Exim Auth failed2025-03-02 00:46:34 dovecot_plain authenticator failed for ([1.252.204.203]) [1.252.204.203]:64285: 535 Incorrect authentication data (set_id=services)1.252.204.2031835841mY  -e) ossec13001g\Exim Auth failed2025-03-02 00:46:12 dovecot_plain authenticator failed for ([50.188.204.213]) [50.188.204.213]:55429: 535 Incorrect authentication data (set_id=services@heipowersystem.com)50.188.204.2136252001mX  -e) ossec13001gZExim Auth failed2025-03-02 00:36:42 dovecot_plain authenticator failed for broadband-188-255-34-171.ip.moscow.rt.ru [188.255.34.171]:55502: 535 Incorrect authentication data (set_id=sales)188.255.34.1712017370W  - ) ossec13001gZExim Auth failed2025-03-02 00:36:28 dovecot_plain authenticator failed for (mobile-166-195-193-083.mycingular.net) [166.195.193.83]:51878: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)166.195.193.836252001(V  3U) ossec11301gZmNew FTP connection.Mar 2 00:35:16 vm1 pure-ftpd[1299112]: (?@164.90.230.102) [INFO] New connection from 164.90.230.102164.90.230.1022921044MU  --# ossec13001gXtExim Auth failed2025-03-02 00:26:51 dovecot_plain authenticator failed for ([5.30.177.55]) [5.30.177.55]:34972: 535 Incorrect authentication data (set_id=sales)5.30.177.55290557aT  -S# ossec13001gXdExim Auth failed2025-03-02 00:26:36 dovecot_plain authenticator failed for ([101.13.3.72]) [101.13.3.72]:48810: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)101.13.3.721668284mS  -c+ ossec13001gVExim Auth failed2025-03-02 00:19:56 dovecot_plain authenticator failed for ([182.163.122.133]) [182.163.122.133]:50897: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)182.163.122.1331210997ZR  -=+ ossec13001gVExim Auth failed2025-03-02 00:20:20 dovecot_plain authenticator failed for ([165.154.202.101]) [165.154.202.101]:19170: 535 Incorrect authentication data (set_id=sales)165.154.202.1016252001mQ  -e) ossec13001gVExim Auth failed2025-03-02 00:19:44 dovecot_plain authenticator failed for ([103.115.31.219]) [103.115.31.219]:60152: 535 Incorrect authentication data (set_id=services@heipowersystem.com)103.115.31.2191643084~P  -) ossec13001gVExim Auth failed2025-03-02 00:19:15 dovecot_plain authenticator failed for (107-175-76-146-host.colocrossing.com) [107.175.76.146]:46694: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)107.175.76.1466252001O  ?1 ossec1008gSProcess exiting (killed).Mar 2 00:06:09 vm1 spamd[1013630]: spamd: server killed by SIGTERM, shutting down]N  -C+ ossec13001gSExim Auth failed2025-03-02 00:03:54 dovecot_plain authenticator failed for ([222.189.211.114]) [222.189.211.114]:46858: 535 Incorrect authentication data (set_id=services)222.189.211.1141814991fM  -]% ossec13001gRExim Auth failed2025-03-02 00:03:26 dovecot_plain authenticator failed for ([45.93.94.125]) [45.93.94.125]:46102: 535 Incorrect authentication data (set_id=services@heipowersystem.com)45.93.94.125294640ZL  -=+ ossec13001gRExim Auth failed2025-03-02 00:02:59 dovecot_plain authenticator failed for ([111.193.226.252]) [111.193.226.252]:11710: 535 Incorrect authentication data (set_id=sales)111.193.226.2521814991jK  -_) ossec13001gRExim Auth failed2025-03-02 00:02:42 dovecot_plain authenticator failed for ([222.119.124.66]) [222.119.124.66]:34620: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)222.119.124.661835841mJ  -e) ossec13001gQExim Auth failed2025-03-01 23:59:07 dovecot_plain authenticator failed for ([222.160.99.210]) [222.160.99.210]:42798: 535 Incorrect authentication data (set_id=services@heipowersystem.com)222.160.99.2101814991 > B W n w  !3_nqk  -q% ossec13001ggExim Auth failed2025-03-02 01:31:48 dovecot_plain authenticator failed for host-92-16-181-44.as13285.net [92.16.181.44]:57741: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)92.16.181.442635167Zj  -?) ossec13001gg6Exim Auth failed2025-03-02 01:29:50 dovecot_plain authenticator failed for ([182.70.120.127]) [182.70.120.127]:39984: 535 Incorrect authentication data (set_id=services)182.70.120.1271269750mi  -e) ossec13001ggExim Auth failed2025-03-02 01:29:11 dovecot_plain authenticator failed for ([111.48.140.240]) [111.48.140.240]:63196: 535 Incorrect authentication data (set_id=services@heipowersystem.com)111.48.140.2401814991Ph  -/% ossec13001geExim Auth failed2025-03-02 01:24:19 dovecot_plain authenticator failed for ([36.48.70.211]) [36.48.70.211]:5016: 535 Incorrect authentication data (set_id=sales)36.48.70.2111814991jg  -_) ossec13001geExim Auth failed2025-03-02 01:23:55 dovecot_plain authenticator failed for ([221.146.201.37]) [221.146.201.37]:57173: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)221.146.201.371835841gf  -[' ossec13001ge#Exim Auth failed2025-03-02 01:20:59 dovecot_plain authenticator failed for ([118.218.10.21]) [118.218.10.21]:53225: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)118.218.10.211835841je  -a' ossec13001gdExim Auth failed2025-03-02 01:16:36 dovecot_plain authenticator failed for ([58.238.181.96]) [58.238.181.96]:43258: 535 Incorrect authentication data (set_id=services@heipowersystem.com)58.238.181.961835841Nd  --# ossec13001gbcExim Auth failed2025-03-02 01:09:14 dovecot_plain authenticator failed for ([50.81.70.80]) [50.81.70.80]:49172: 535 Incorrect authentication data (set_id=sales)50.81.70.806252001ac  -S# ossec13001gbSExim Auth failed2025-03-02 01:08:58 dovecot_plain authenticator failed for ([5.166.68.89]) [5.166.68.89]:52282: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)5.166.68.892017370Wb  -9) ossec13001g`dExim Auth failed2025-03-02 01:00:43 dovecot_plain authenticator failed for ([27.128.162.146]) [27.128.162.146]:49872: 535 Incorrect authentication data (set_id=sales)27.128.162.1461814991ga  -[' ossec13001g`VExim Auth failed2025-03-02 01:00:29 dovecot_plain authenticator failed for ([27.223.100.92]) [27.223.100.90]:56410: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)27.223.100.901814991s`  -u% ossec13001g`FExim Auth failed2025-03-02 01:00:13 dovecot_login authenticator failed for (50-82-12-128.client.mchsi.com) [50.82.12.128]:41002: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)50.82.12.1286252001e_  -W' ossec13001g_Exim Auth failed2025-03-02 00:58:48 dovecot_plain authenticator failed for 124-11-130-37.static.tfn.net.tw [124.11.130.37]:46528: 535 Incorrect authentication data (set_id=services)124.11.130.371668284g^  -]% ossec13001g_Exim Auth failed2025-03-02 00:58:37 dovecot_plain authenticator failed for ([36.48.70.211]) [36.48.70.211]:50522: 535 Incorrect authentication data (set_id=services@heipowersystem.com)36.48.70.2111814991x]  -{) ossec13001g_$Exim Auth failed2025-03-02 00:55:24 dovecot_login authenticator failed for works.ssc-gr.info [160.251.121.70]:36058: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)160.251.121.701861060W\  -9) ossec13001g]`Exim Auth failed2025-03-02 00:47:51 dovecot_plain authenticator failed for ([178.178.222.58]) [178.178.222.58]:42338: 535 Incorrect authentication data (set_id=sales)178.178.222.582017370c[  -W# ossec13001g]VExim Auth failed2025-03-02 00:47:41 dovecot_plain authenticator failed for ([203.177.65.26]) [58.69.17.18]:36282: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)58.69.17.181694008 H 6 ^ x 2t>Hr}  -q' ossec13001gxExim Auth failed2025-03-02 02:41:45 dovecot_plain authenticator failed for 133.232.88.63.static.zoot.jp [133.232.88.63]:47671: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)133.232.88.631861060T|  -5' ossec13001gvExim Auth failed2025-03-02 02:36:42 dovecot_login authenticator failed for ([111.53.129.92]) [111.53.129.92]:49736: 535 Incorrect authentication data (set_id=admin)111.53.129.921814991d{  -Y% ossec13001gvExim Auth failed2025-03-02 02:36:29 dovecot_login authenticator failed for ([89.211.42.163]) [80.76.161.99]:27667: 535 Incorrect authentication data (set_id=admin@heipowersystem.com)80.76.161.99289688Zz  -?) ossec13001gtGExim Auth failed2025-03-02 02:25:35 dovecot_plain authenticator failed for ([46.138.247.195]) [46.138.247.195]:54034: 535 Incorrect authentication data (set_id=services)46.138.247.1952017370my  -e) ossec13001gt=Exim Auth failed2025-03-02 02:25:24 dovecot_plain authenticator failed for ([111.172.120.32]) [111.172.120.32]:48896: 535 Incorrect authentication data (set_id=services@heipowersystem.com)111.172.120.321814991cx  -U% ossec13001grExim Auth failed2025-03-02 02:18:57 dovecot_plain authenticator failed for 111-70-32-47.emome-ip.hinet.net [111.70.32.47]:48234: 535 Incorrect authentication data (set_id=services)111.70.32.471668284pw  -i+ ossec13001grExim Auth failed2025-03-02 02:18:23 dovecot_plain authenticator failed for ([119.198.191.130]) [119.198.191.130]:52589: 535 Incorrect authentication data (set_id=services@heipowersystem.com)119.198.191.1301835841Zv  -=+ ossec13001goExim Auth failed2025-03-02 02:07:09 dovecot_plain authenticator failed for ([123.210.131.121]) [123.210.131.121]:53842: 535 Incorrect authentication data (set_id=sales)123.210.131.1212077456ju  -_) ossec13001goExim Auth failed2025-03-02 02:06:57 dovecot_plain authenticator failed for ([119.45.170.229]) [119.45.170.229]:34202: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)119.45.170.2291814991:t  Ak) ossec11302gn FTP Authentication failed.Mar 2 01:58:56 vm1 pure-ftpd[1314076]: (?@137.74.181.247) [WARNING] Authentication failed for user [anonymous]137.74.181.2473017382(s  3U) ossec11301gnNew FTP connection.Mar 2 01:58:51 vm1 pure-ftpd[1314073]: (?@137.74.181.249) [INFO] New connection from 137.74.181.249137.74.181.2493017382(r  3U) ossec11301gnNew FTP connection.Mar 2 01:58:51 vm1 pure-ftpd[1314076]: (?@137.74.181.247) [INFO] New connection from 137.74.181.247137.74.181.2473017382jq  -a' ossec13001glExim Auth failed2025-03-02 01:52:26 dovecot_plain authenticator failed for ([65.175.24.142]) [65.175.24.142]:50159: 535 Incorrect authentication data (set_id=services@heipowersystem.com)65.175.24.1426252001bp  -S% ossec13001glExim Auth failed2025-03-02 01:52:36 dovecot_plain authenticator failed for ool-4a5ad51c.dyn.optonline.net [74.90.213.28]:52444: 535 Incorrect authentication data (set_id=services)74.90.213.286252001To  -5' ossec13001gkExim Auth failed2025-03-02 01:49:39 dovecot_plain authenticator failed for ([149.54.15.162]) [149.54.15.162]:41102: 535 Incorrect authentication data (set_id=sales)149.54.15.1621149361^n  -O! ossec13001gkExim Auth failed2025-03-02 01:49:23 dovecot_plain authenticator failed for ([59.9.38.92]) [59.9.38.92]:51442: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)59.9.38.921835841Zm  -?) ossec13001gi)Exim Auth failed2025-03-02 01:38:08 dovecot_plain authenticator failed for ([216.194.174.27]) [216.194.174.27]:52014: 535 Incorrect authentication data (set_id=services)216.194.174.276252001l  -+ ossec13001giExim Auth failed2025-03-02 01:37:57 dovecot_plain authenticator failed for (nsg-corporate-210.240.187.122.airtel.in) [122.187.240.210]:54997: 535 Incorrect authentication data (set_id=services@heipowersystem.com)122.187.240.2101269750 %= Y ,>Shj  -_) ossec13001gËAExim Auth failed2025-03-02 04:03:36 dovecot_plain authenticator failed for ([121.168.210.98]) [121.168.210.98]:55550: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)121.168.210.981835841Z  -?) ossec13001gÉQExim Auth failed2025-03-02 03:55:20 dovecot_plain authenticator failed for ([191.59.206.191]) [191.59.206.191]:52230: 535 Incorrect authentication data (set_id=services)191.59.206.1913469034p  -i+ ossec13001gÉEExim Auth failed2025-03-02 03:55:08 dovecot_plain authenticator failed for ([103.231.163.154]) [103.231.163.154]:21635: 535 Incorrect authentication data (set_id=services@heipowersystem.com)103.231.163.1541210997N  --# ossec13001gÈExim Auth failed2025-03-02 03:53:11 dovecot_plain authenticator failed for ([50.81.70.80]) [50.81.70.80]:34356: 535 Incorrect authentication data (set_id=sales)50.81.70.806252001g  -[' ossec13001gÈExim Auth failed2025-03-02 03:53:00 dovecot_plain authenticator failed for ([50.171.64.170]) [50.171.64.170]:36252: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)50.171.64.1706252001g  -]% ossec13001gÆExim Auth failed2025-03-02 03:44:38 dovecot_plain authenticator failed for ([74.95.13.185]) [74.95.13.185]:60642: 535 Incorrect authentication data (set_id=services@heipowersystem.com)74.95.13.1856252001j  -_) ossec13001gÅ Exim Auth failed2025-03-02 03:37:08 dovecot_plain authenticator failed for ([125.136.163.86]) [125.136.163.86]:40968: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)125.136.163.861835841f  -]% ossec13001gÄpExim Auth failed2025-03-02 03:34:31 dovecot_plain authenticator failed for ([149.0.19.108]) [149.0.19.108]:42804: 535 Incorrect authentication data (set_id=services@heipowersystem.com)149.0.19.108298795g  -[' ossec13001gÃExim Auth failed2025-03-02 03:30:52 dovecot_plain authenticator failed for ([111.48.214.96]) [111.48.214.96]:32836: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)111.48.214.961814991T  -5' ossec13001gÁ}Exim Auth failed2025-03-02 03:21:56 dovecot_plain authenticator failed for ([114.216.5.134]) [114.216.5.134]:36758: 535 Incorrect authentication data (set_id=sales)114.216.5.1341814991z  -) ossec13001gÁHExim Auth failed2025-03-02 03:21:04 dovecot_plain authenticator failed for bb115-66-228-194.singnet.com.sg [115.66.228.194]:33728: 535 Incorrect authentication data (set_id=services@heipowersystem.com)115.66.228.1941880251w  -y) ossec13001gÁkExim Auth failed2025-03-02 03:21:38 dovecot_plain authenticator failed for ip-142-90-218-227.user.start.ca [142.90.218.227]:56056: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)142.90.218.2276251999Z  -?) ossec13001gÁUExim Auth failed2025-03-02 03:21:16 dovecot_plain authenticator failed for ([223.220.167.38]) [223.220.167.38]:52310: 535 Incorrect authentication data (set_id=services)223.220.167.381814991%  3Q' ossec11301g~New FTP connection.Mar 2 03:07:05 vm1 pure-ftpd[1326765]: (?@104.152.52.25) [INFO] New connection from 104.152.52.25104.152.52.256252001`  -U! ossec13001g{MExim Auth failed2025-03-02 02:55:33 dovecot_plain authenticator failed for ([2.55.74.30]) [2.55.74.30]:43140: 535 Incorrect authentication data (set_id=services@heipowersystem.com)2.55.74.30294640d  -W% ossec13001gz Exim Auth failed2025-03-02 02:50:09 dovecot_plain authenticator failed for ([222.99.10.11]) [222.99.10.11]:52818: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)222.99.10.111835841W~  -9) ossec13001gz!Exim Auth failed2025-03-02 02:50:32 dovecot_plain authenticator failed for ([73.231.102.189]) [73.231.102.189]:47238: 535 Incorrect authentication data (set_id=sales)73.231.102.1896252001 u+8 V k :LROuV  -;' ossec13001gÑCExim Auth failed2025-03-02 04:29:14 dovecot_plain authenticator failed for ([185.167.56.70]) [185.167.56.70]:49142: 535 Incorrect authentication data (set_id=services)185.167.56.70617790  - ) ossec13001gÑ!Exim Auth failed2025-03-02 04:28:39 dovecot_plain authenticator failed for 144.46.246.220.static.netvigator.com [220.246.46.144]:63743: 535 Incorrect authentication data (set_id=services@heipowersystem.com)220.246.46.1441819730v  -y' ossec13001gÐExim Auth failed2025-03-02 04:27:27 dovecot_plain authenticator failed for 111-70-41-195.emome-ip.hinet.net [111.70.41.195]:51674: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)111.70.41.1951668284j  -_) ossec13001gÐExim Auth failed2025-03-02 04:27:46 dovecot_plain authenticator failed for ([118.123.116.93]) [118.123.116.93]:45363: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)118.123.116.931814991T  -7% ossec13001gÏdExim Auth failed2025-03-02 04:21:16 dovecot_login authenticator failed for ([27.72.103.74]) [27.72.103.74]:51686: 535 Incorrect authentication data (set_id=services)27.72.103.741562822m  -e) ossec13001gÏZExim Auth failed2025-03-02 04:21:05 dovecot_login authenticator failed for ([119.62.156.161]) [119.62.156.161]:35950: 535 Incorrect authentication data (set_id=services@heipowersystem.com)119.62.156.1611814991j  -_) ossec13001gÎExim Auth failed2025-03-02 04:17:37 dovecot_plain authenticator failed for ([119.200.229.33]) [119.200.229.33]:34874: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)119.200.229.331835841d  -U' ossec13001gÎxExim Auth failed2025-03-02 04:17:19 dovecot_plain authenticator failed for bb119-74-38-254.singnet.com.sg [119.74.38.254]:39346: 535 Incorrect authentication data (set_id=services)119.74.38.2541880251y  -' ossec13001gÎnExim Auth failed2025-03-02 04:17:09 dovecot_plain authenticator failed for (173-29-118-52.client.mchsi.com) [173.29.118.52]:49705: 535 Incorrect authentication data (set_id=services@heipowersystem.com)173.29.118.526252001c  -S' ossec13001gÎExim Auth failed2025-03-02 04:17:48 dovecot_plain authenticator failed for 37-46-160-175.customers.ownit.se [37.46.160.175]:33794: 535 Incorrect authentication data (set_id=sales)37.46.160.1752661886W  -;' ossec13001gÌExim Auth failed2025-03-02 04:08:55 dovecot_plain authenticator failed for ([111.175.39.76]) [111.175.39.76]:55225: 535 Incorrect authentication data (set_id=services)111.175.39.761814991m  -e) ossec13001gÌXExim Auth failed2025-03-02 04:08:15 dovecot_plain authenticator failed for ([45.225.194.121]) [45.225.194.121]:43092: 535 Incorrect authentication data (set_id=services@heipowersystem.com)45.225.194.1213469034^  -M% ossec13001gÌ%Exim Auth failed2025-03-02 04:07:25 dovecot_plain authenticator failed for host-5-58-201-106.bitternet.ua [5.58.201.106]:37026: 535 Incorrect authentication data (set_id=sales)5.58.201.106690791g  -[' ossec13001gËExim Auth failed2025-03-02 04:06:42 dovecot_plain authenticator failed for ([223.210.27.53]) [223.210.27.53]:14534: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)223.210.27.531814991^  -I' ossec13001gËExim Auth failed2025-03-02 04:05:19 dovecot_plain authenticator failed for ([77.106.78.215]) [77.106.78.215]:7800: 535 Incorrect authentication data (set_id=vikas.khandelwal)77.106.78.2152017370o  -m% ossec13001gËExim Auth failed2025-03-02 04:04:45 dovecot_plain authenticator failed for ([59.99.153.21]) [59.99.153.21]:39790: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)59.99.153.211269750Q  -1% ossec13001gËQExim Auth failed2025-03-02 04:03:52 dovecot_plain authenticator failed for ([27.124.18.19]) [27.124.18.27]:60036: 535 Incorrect authentication data (set_id=sales)27.124.18.271269750 >: = ! L ^t52>p1  -i+ ossec13001gÛExim Auth failed2025-03-02 05:13:56 dovecot_login authenticator failed for (heipowersystem.com) [111.122.211.212]:58682: 535 Incorrect authentication data (set_id=service@heipowersystem.com)111.122.211.21218149910  - ) ossec13001gÛExim Auth failed2025-03-02 05:12:56 dovecot_plain authenticator failed for 112.46.246.220.static.netvigator.com [220.246.46.112]:59819: 535 Incorrect authentication data (set_id=services@heipowersystem.com)220.246.46.1121819730]/  -C+ ossec13001gÛExim Auth failed2025-03-02 05:13:32 dovecot_login authenticator failed for (heipowersystem.com) [111.122.211.212]:54886: 535 Incorrect authentication data (set_id=nologin)111.122.211.2121814991W.  -;' ossec13001gÛExim Auth failed2025-03-02 05:13:06 dovecot_plain authenticator failed for ([31.173.66.222]) [31.173.66.222]:38806: 535 Incorrect authentication data (set_id=services)31.173.66.2222017370a-  -S# ossec13001gÚsExim Auth failed2025-03-02 05:08:27 dovecot_plain authenticator failed for ([60.8.120.74]) [60.8.50.150]:39870: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)60.8.50.1501814991`,  -K) ossec13001gÙExim Auth failed2025-03-02 05:05:59 dovecot_plain authenticator failed for 245.134.20.178.in-addr.arpa [178.20.134.245]:49732: 535 Incorrect authentication data (set_id=sales)178.20.134.2452017370d+  -W% ossec13001gÙExim Auth failed2025-03-02 05:05:38 dovecot_plain authenticator failed for ([2.192.150.40]) [2.192.150.40]:60830: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)2.192.150.403175395Z*  -?) ossec13001gÙExim Auth failed2025-03-02 05:05:27 dovecot_plain authenticator failed for ([112.168.71.109]) [112.168.71.109]:51074: 535 Incorrect authentication data (set_id=services)112.168.71.1091835841p)  -i+ ossec13001gÙExim Auth failed2025-03-02 05:05:13 dovecot_plain authenticator failed for ([212.120.163.110]) [212.120.163.110]:55652: 535 Incorrect authentication data (set_id=services@heipowersystem.com)212.120.163.1102017370f(  -Y' ossec13001g×Exim Auth failed2025-03-02 04:56:15 dovecot_plain authenticator failed for 111-70-32-119.emome-ip.hinet.net [111.70.32.119]:46174: 535 Incorrect authentication data (set_id=services)111.70.32.1191668284j'  -a' ossec13001g×Exim Auth failed2025-03-02 04:55:58 dovecot_plain authenticator failed for ([103.69.244.39]) [103.69.244.39]:36664: 535 Incorrect authentication data (set_id=services@heipowersystem.com)103.69.244.391269750Q&  -1% ossec13001gÕExim Auth failed2025-03-02 04:49:21 dovecot_plain authenticator failed for ([59.1.214.102]) [59.1.214.102]:37360: 535 Incorrect authentication data (set_id=sales)59.1.214.1021835841g%  -[' ossec13001gÕExim Auth failed2025-03-02 04:48:50 dovecot_plain authenticator failed for 013.143.48.116.static.netvigator.com [116.48.143.13]:55909: 535 Incorrect authentication data (set_id=sales)116.48.143.131819730g$  -[' ossec13001gÕExim Auth failed2025-03-02 04:48:37 dovecot_plain authenticator failed for ([188.227.66.92]) [188.227.66.92]:56928: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)188.227.66.922017370C#  77 ossec502gÔOssec server started.ossec: Ossec started.y"  -# ossec13001gÓWExim Auth failed2025-03-02 04:38:07 dovecot_plain authenticator failed for syn-071-090-034-032.res.spectrum.com [71.90.34.32]:51858: 535 Incorrect authentication data (set_id=services@heipowersystem.com)71.90.34.326252001Q!  -1% ossec13001gÓEExim Auth failed2025-03-02 04:37:49 dovecot_plain authenticator failed for ([59.41.197.10]) [59.41.197.10]:46843: 535 Incorrect authentication data (set_id=sales)59.41.197.101814991m  -c+ ossec13001gÓ'Exim Auth failed2025-03-02 04:37:19 dovecot_plain authenticator failed for ([203.123.219.137]) [203.123.219.137]:57517: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)203.123.219.1371835841 $  = >7ItyA  -' ossec13001gæDExim Auth failed2025-03-02 05:58:51 dovecot_plain authenticator failed for (201.173.16.21-clientes-izzi.mx) [201.173.16.21]:51129: 535 Incorrect authentication data (set_id=services@heipowersystem.com)201.173.16.213996063`@  -M' ossec13001gå Exim Auth failed2025-03-02 05:54:00 dovecot_plain authenticator failed for 116-240-97-42.dyn.ip.vocus.au [116.240.97.42]:45397: 535 Incorrect authentication data (set_id=sales)116.240.97.422077456k?  -_+ ossec13001gåExim Auth failed2025-03-02 05:53:44 dovecot_plain authenticator failed for ([182.76.69.209]) [128.185.228.134]:53224: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)128.185.228.1341269750j>  -a' ossec13001gãExim Auth failed2025-03-02 05:48:55 dovecot_plain authenticator failed for ([173.29.118.52]) [173.29.118.52]:51341: 535 Incorrect authentication data (set_id=services@heipowersystem.com)173.29.118.526252001Q=  -1% ossec13001gãvExim Auth failed2025-03-02 05:46:53 dovecot_plain authenticator failed for ([87.117.32.22]) [87.117.32.22]:51658: 535 Incorrect authentication data (set_id=sales)87.117.32.222017370j<  -_) ossec13001gã_Exim Auth failed2025-03-02 05:46:30 dovecot_plain authenticator failed for ([190.121.193.46]) [190.121.193.46]:38668: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)190.121.193.463595528;  -+ ossec13001gáYExim Auth failed2025-03-02 05:37:52 dovecot_plain authenticator failed for 123-195-225-182.dynamic.kbronet.com.tw [123.195.225.182]:36940: 535 Incorrect authentication data (set_id=services@heipowersystem.com)123.195.225.1821668284W:  -;' ossec13001gáoExim Auth failed2025-03-02 05:38:13 dovecot_plain authenticator failed for ([180.168.119.2]) [180.168.119.2]:49336: 535 Incorrect authentication data (set_id=services)180.168.119.21814991W9  -;' ossec13001gàExim Auth failed2025-03-02 05:35:02 dovecot_plain authenticator failed for ([50.171.64.170]) [50.171.64.170]:33874: 535 Incorrect authentication data (set_id=services)50.171.64.1706252001p8  -i+ ossec13001gàExim Auth failed2025-03-02 05:34:50 dovecot_plain authenticator failed for ([190.211.250.118]) [190.211.250.122]:55966: 535 Incorrect authentication data (set_id=services@heipowersystem.com)190.211.250.12238951147  -' ossec13001gàMExim Auth failed2025-03-02 05:33:24 dovecot_plain authenticator failed for wllk-bri-66-ip-66-43-253-231.wireless.netins.net [66.43.253.231]:33909: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)66.43.253.2316252001G6  = ) ossec13008gÞMail Reciepient rejected2025-03-02 05:27:23 H=(mail.amplifypowerglobal.com) [165.154.227.89]:58610 F= rejected RCPT : Rejected relay attempt: '165.154.227.89' From: 'koyhwgj@amplifypowerglobal.com' To: 'goofile@fastmail.com'165.154.227.891668284[5  -E% ossec13001gÞExim Auth failed2025-03-02 05:26:22 dovecot_plain authenticator failed for (ppp075.bol-online.com) [202.84.34.85]:47258: 535 Incorrect authentication data (set_id=services)202.84.34.8512109974  -+ ossec13001gÞExim Auth failed2025-03-02 05:26:12 dovecot_plain authenticator failed for 189.115.230.179.dynamic.adsl.gvt.net.br [189.115.230.179]:60550: 535 Incorrect authentication data (set_id=services@heipowersystem.com)189.115.230.1793469034T3  -5' ossec13001gÞvExim Auth failed2025-03-02 05:25:33 dovecot_plain authenticator failed for ([103.47.74.210]) [103.47.74.210]:42344: 535 Incorrect authentication data (set_id=sales)103.47.74.21012697502  - ) ossec13001gÞlExim Auth failed2025-03-02 05:25:24 dovecot_plain authenticator failed for broadband-178-140-95-221.ip.moscow.rt.ru [178.140.95.221]:59542: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)178.140.95.2212017370     8Jiq|Q  -) ossec13001gîExim Auth failed2025-03-02 06:35:00 dovecot_plain authenticator failed for syn-172-100-186-071.res.spectrum.com [172.100.186.71]:42548: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)172.100.186.716252001XP  -=' ossec13001gíExim Auth failed2025-03-02 06:29:43 dovecot_plain authenticator failed for (www.nettlinx.com) [202.53.94.242]:37228: 535 Incorrect authentication data (set_id=services)202.53.94.2421269750O  - ) ossec13001gívExim Auth failed2025-03-02 06:29:34 dovecot_plain authenticator failed for syn-075-191-221-158.res.spectrum.com [75.191.221.158]:35583: 535 Incorrect authentication data (set_id=services@heipowersystem.com)75.191.221.1586252001pN  -i+ ossec13001gí*Exim Auth failed2025-03-02 06:28:18 dovecot_plain authenticator failed for broadband-178-140-152-209.ip.moscow.rt.ru [178.140.152.209]:49932: 535 Incorrect authentication data (set_id=sales)178.140.152.2092017370dM  -W% ossec13001gíExim Auth failed2025-03-02 06:28:01 dovecot_plain authenticator failed for ([27.24.141.90]) [27.24.141.90]:38278: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)27.24.141.901814991ML  --# ossec13001gêExim Auth failed2025-03-02 06:17:58 dovecot_login authenticator failed for ([5.30.177.55]) [5.30.177.55]:54252: 535 Incorrect authentication data (set_id=sales)5.30.177.55290557tK  -w' ossec13001gêExim Auth failed2025-03-02 06:17:38 dovecot_login authenticator failed for (46.30.161.197.access.ipnet.ua) [46.30.161.197]:39287: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)46.30.161.197690791]J  -K% ossec13001géExim Auth failed2025-03-02 06:13:06 dovecot_plain authenticator failed for host-5-58-201-106.bitternet.ua [5.58.201.106]:3779: 535 Incorrect authentication data (set_id=sales)5.58.201.106690791jI  -_) ossec13001géExim Auth failed2025-03-02 06:12:45 dovecot_plain authenticator failed for ([49.124.152.179]) [49.124.152.179]:48028: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)49.124.152.1791733045ZH  -?) ossec13001géExim Auth failed2025-03-02 06:11:02 dovecot_plain authenticator failed for ([125.136.163.86]) [125.136.163.86]:58044: 535 Incorrect authentication data (set_id=services)125.136.163.861835841|G  -' ossec13001géExim Auth failed2025-03-02 06:10:49 dovecot_plain authenticator failed for 179-189-85-66.goldnettelecom.com.br [179.189.85.66]:55792: 535 Incorrect authentication data (set_id=services@heipowersystem.com)179.189.85.663469034gF  -]% ossec13001gçExim Auth failed2025-03-02 06:04:22 dovecot_plain authenticator failed for ([110.34.70.28]) [110.34.70.28]:54773: 535 Incorrect authentication data (set_id=services@heipowersystem.com)110.34.70.281835841cE  -U% ossec13001gçDExim Auth failed2025-03-02 06:03:07 dovecot_plain authenticator failed for c-71-229-1-186.hsd1.al.comcast.net [71.229.1.186]:34826: 535 Incorrect authentication data (set_id=sales)71.229.1.1866252001lD  -c+ ossec13001gç2Exim Auth failed2025-03-02 06:02:49 dovecot_plain authenticator failed for ([196.189.126.185]) [196.189.126.185]:59102: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)196.189.126.185337996CC  =+ ossec13008gæMail Reciepient rejected2025-03-02 06:01:30 H=(mail.fablixsolutions.com) [165.154.208.103]:60439 F= rejected RCPT : Rejected relay attempt: '165.154.208.103' From: 'vchmpkya@fablixsolutions.com' To: 'goofile@fastmail.com'165.154.208.1031668284]B  -C+ ossec13001gæNExim Auth failed2025-03-02 05:59:01 dovecot_plain authenticator failed for ([180.188.139.189]) [180.188.139.189]:53574: 535 Incorrect authentication data (set_id=services)180.188.139.1891819730 . V ^ ^ Ta  -7% ossec13001gù;Exim Auth failed2025-03-02 07:19:45 dovecot_plain authenticator failed for ([95.79.57.221]) [95.79.57.221]:52240: 535 Incorrect authentication data (set_id=services)95.79.57.2212017370w`  -{' ossec13001gù/Exim Auth failed2025-03-02 07:19:35 dovecot_plain authenticator failed for 81.60.194.189.dyn.user.ono.com [81.60.194.189]:51647: 535 Incorrect authentication data (set_id=services@heipowersystem.com)81.60.194.1892510769j_  -_) ossec13001g÷Exim Auth failed2025-03-02 07:12:44 dovecot_plain authenticator failed for ([222.160.99.210]) [222.160.99.210]:50332: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)222.160.99.2101814991P^  =+ ossec13008göMail Reciepient rejected2025-03-02 07:08:22 H=(mail.amplifypowerglobal.com) [165.154.227.105]:54368 F= rejected RCPT : Rejected relay attempt: '165.154.227.105' From: 'umrsxfjvid@amplifypowerglobal.com' To: 'goofile@fastmail.com'165.154.227.1051668284a]  -S# ossec13001gõ^Exim Auth failed2025-03-02 07:03:16 dovecot_plain authenticator failed for ([1.70.158.32]) [1.70.158.32]:54737: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)1.70.158.321814991o\  -g+ ossec13001gônExim Auth failed2025-03-02 06:59:16 dovecot_login authenticator failed for 122-148-252-147.sta.wbroadband.net.au [122.148.252.147]:59661: 535 Incorrect authentication data (set_id=services)122.148.252.1472077456d[  -Y# ossec13001gôbExim Auth failed2025-03-02 06:59:04 dovecot_login authenticator failed for ([60.174.86.4]) [60.174.86.4]:33318: 535 Incorrect authentication data (set_id=services@heipowersystem.com)60.174.86.41814991gZ  -]% ossec13001gôExim Auth failed2025-03-02 06:57:54 dovecot_plain authenticator failed for ([182.76.71.82]) [182.76.71.82]:47834: 535 Incorrect authentication data (set_id=services@heipowersystem.com)182.76.71.821269750_Y  -K' ossec13001góExim Auth failed2025-03-02 06:56:09 dovecot_plain authenticator failed for ([42.177.209.66]) [42.177.209.66]:34642: 535 Incorrect authentication data (set_id=vikas.khandelwal)42.177.209.661814991uX  -u) ossec13001góExim Auth failed2025-03-02 06:55:58 dovecot_plain authenticator failed for ([220.119.126.81]) [220.119.126.81]:34712: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)220.119.126.811835841ZW  -=+ ossec13001gñExim Auth failed2025-03-02 06:47:46 dovecot_plain authenticator failed for ([121.168.164.245]) [121.168.164.245]:36129: 535 Incorrect authentication data (set_id=sales)121.168.164.2451835841|V  -) ossec13001gñExim Auth failed2025-03-02 06:47:34 dovecot_plain authenticator failed for syn-172-248-047-114.res.spectrum.com [172.248.47.114]:57703: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)172.248.47.1146252001tU  -u' ossec13001gñExim Auth failed2025-03-02 06:47:15 dovecot_plain authenticator failed for p159091-obmd01.tokyo.ocn.ne.jp [153.141.52.91]:34319: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)153.141.52.911861060TT  -7% ossec13001gñExim Auth failed2025-03-02 06:44:59 dovecot_plain authenticator failed for ([58.18.90.250]) [58.18.90.250]:59073: 535 Incorrect authentication data (set_id=services)58.18.90.2501814991gS  -]% ossec13001gñExim Auth failed2025-03-02 06:44:43 dovecot_plain authenticator failed for ([85.19.195.12]) [85.19.195.12]:56212: 535 Incorrect authentication data (set_id=services@heipowersystem.com)85.19.195.123144096cR  -Q) ossec13001gîExim Auth failed2025-03-02 06:35:28 dovecot_plain authenticator failed for ip72-199-156-231.sd.sd.cox.net [72.199.156.231]:53914: 535 Incorrect authentication data (set_id=sales)72.199.156.2316252001 [0 -     j ] P C 6 )   s f Y ? 2 %  |oUH;.!k a 1 $ X K 0y} v i \ O B 5 (    qd'NARE8+zm`SF9,l_x pcVI</b"Q L  =D7*4 : T G { n > r e~qdWJ=0# WJ~ uh[tgZM@3& ^ w 1835841*? 1835841. 183584123 18358412( 1835841+ 1835841+ 18358412^ 1835841, 1835841. 1835841, 18358412 18358412w 18358412d 1835841. 1835841,& 18358412 18358412 18358412 18358412 1835841,- 1835841. 1835841,2 1835841,.4 18358412 18358412 18358412 1835841. 1835841- 1835841- 1835841- 1835841,? 1835841-C 1835841-* 1835841,d 1835841,^ 1835841,A 1835841,@ 1835841-F 1835841-D 1835841*V 1835841-Z 1835841*E 1835841- 1835841- 1835841* 1835841*q 1835841*p 1835841*m 1835841-\ 1835841*f 1835841.g 1835841.d 1835841.^ 1835841. 1835841- 1835841- 1835841- 1835841- 1835841- 1835841*A 18358412^ 1835841' 1835841' 1835841' 1835841' 1835841' 1835841' 1835841' 1835841/& 1835841/ 1835841. 1835841. 1835841. 1835841. 1835841. 1835841.h w 1835841) 1835841-] 1835841) 1835841) 1835841) 1835841) 1835841) 1835841) 1835841) 1835841-j 1835841)w 1835841)e 1835841)d 1835841)a 1835841)S 1835841)P 1835841)O 1835841)N 1835841)> 1835841. 1835841) 1835841) 1835841( 1835841( 1835841( 1835841.' 1835841. 1835841( 1835841.2 1835841( 1835841( 1835841.[ 1835841( 1835841( 1835841( 1835841( 1835841( 1835841.m 1835841( 1835841( 1835841( 1835841( 1835841(q 1835841.o 1835841(f 1835841(b 1835841(a 1835841(^ 1835841(V 1835841(S 1835841.~ 1835841.q 1835841(, 1835841(& 1835841( 1835841( 1835841( 1835841( 1835841( 1835841'[ 1835841'j 1835841'Q 1835841'L 1835841'J 1835841'# 1835841' 1835841' 1835841' 1835841. 1835841. 1835841. 1835841) 18358410 1835841/ 1835841/ 1835841/ 1835841/ 1835841/ 1835841/ 1835841/o 1835841/? 1835841/. 1835841/) 1835841/( 1835841'w 1835841'o 1835841) 1835841) 18358410- 1835841* 1835841) 18358410K 183584100 1835841*, 1835841* 1835841+ 1835841+ 1835841+ 1835841+ 1835841-k 1835841+ 1835841+ 1835841+ 1835841+ 1835841+ 1835841+ 1835841+y 1835841+q 1835841+P 1835841+K 1835841+H 1835841+0 1835841+( 1835841- 1835841-p 1835841* 1835841* 1835841* 1835841* 1835841* 1835841* 1835841* 1835841* 1835841* 1835841- 1835841* 1835841, 1835841, 1835841, 1835841, 1835841, 1835841, 1835841, 1835841- 1835841, 1835841,y 1835841,x 1835841,w 1835841,u 1835841,s 1835841- 1835841- 18358412& 18358412% 18358411 18358411 18358411 18358411 18358411v 18358411g 18358411Y 18358411X 18358411R 18358411A 183584111 18358410 18358410 18358410 18358410 18358410 18358410v 18358410m @ L e m .=egr  -]% ossec13001gExim Auth failed2025-03-02 08:17:37 dovecot_plain authenticator failed for (nsg-static-172.125.76.182-airtel.com) [182.76.87.90]:45168: 535 Incorrect authentication data (set_id=sales)182.76.87.901269750Zq  -?) ossec13001gExim Auth failed2025-03-02 08:17:36 dovecot_plain authenticator failed for ([111.48.140.240]) [111.48.140.240]:40486: 535 Incorrect authentication data (set_id=services)111.48.140.2401814991Tp  -5' ossec13001gExim Auth failed2025-03-02 08:09:53 dovecot_plain authenticator failed for 111-70-49-103.emome-ip.hinet.net [111.70.49.103]:36916: 535 Incorrect authentication data111.70.49.1031668284mo  -e) ossec13001gExim Auth failed2025-03-02 08:09:08 dovecot_plain authenticator failed for ([111.48.208.197]) [111.48.208.197]:20180: 535 Incorrect authentication data (set_id=services@heipowersystem.com)111.48.208.1971814991an  -S# ossec13001gExim Auth failed2025-03-02 08:09:14 dovecot_plain authenticator failed for ([27.71.17.66]) [27.71.17.66]:18582: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)27.71.17.661562822jm  -_) ossec13001g™Exim Auth failed2025-03-02 07:59:45 dovecot_plain authenticator failed for ([109.70.203.114]) [109.70.203.114]:38364: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)109.70.203.1143175395Wl  -;' ossec13001gExim Auth failed2025-03-02 07:50:49 dovecot_plain authenticator failed for ([121.157.28.10]) [121.157.28.10]:43374: 535 Incorrect authentication data (set_id=services)121.157.28.101835841mk  -c+ ossec13001gYExim Auth failed2025-03-02 07:50:07 dovecot_plain authenticator failed for ([121.170.218.142]) [121.170.218.142]:57276: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)121.170.218.1421835841jj  -a' ossec13001gkExim Auth failed2025-03-02 07:50:25 dovecot_plain authenticator failed for ([49.245.99.168]) [49.245.99.168]:37271: 535 Incorrect authentication data (set_id=services@heipowersystem.com)49.245.99.1681880251Ti  -5' ossec13001geExim Auth failed2025-03-02 07:50:20 dovecot_plain authenticator failed for ([163.30.90.143]) [163.30.90.143]:53480: 535 Incorrect authentication data (set_id=sales)163.30.90.1431668284h  Qs% ossec11000gþLogin failed on the cpanel service[2025-03-02 07:40:06 +0530] info [cpaneld] 23.248.169.6 - heipower "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipower (has_cpuser_file failed)23.248.169.61643084Ng  --# ossec13001gýExim Auth failed2025-03-02 07:38:21 dovecot_plain authenticator failed for ([81.22.58.11]) [81.22.58.11]:33439: 535 Incorrect authentication data (set_id=sales)81.22.58.112017370tf  -s) ossec13001gý~Exim Auth failed2025-03-02 07:37:57 dovecot_plain authenticator failed for (124-170-38-136.tpgi.com.au) [124.170.38.136]:60122: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)124.170.38.1362077456ce  -Y# ossec13001güExim Auth failed2025-03-02 07:34:52 dovecot_plain authenticator failed for ([5.30.215.71]) [5.30.215.71]:56898: 535 Incorrect authentication data (set_id=services@heipowersystem.com)5.30.215.71290557pd  -i+ ossec13001gúExim Auth failed2025-03-02 07:26:45 dovecot_plain authenticator failed for ([171.244.142.135]) [171.244.142.135]:18863: 535 Incorrect authentication data (set_id=services@heipowersystem.com)171.244.142.1351562822Tc  -5' ossec13001gúExim Auth failed2025-03-02 07:23:08 dovecot_plain authenticator failed for ([114.221.2.199]) [114.221.2.199]:56691: 535 Incorrect authentication data (set_id=sales)114.221.2.1991814991db  -W% ossec13001gùExim Auth failed2025-03-02 07:22:54 dovecot_plain authenticator failed for ([31.173.8.170]) [31.173.8.170]:59064: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)31.173.8.1702017370 *\~tj`VLB8.$zpf\H>4*   v l b X N D : 0 &    ~ t j ` V L B 8 . $    z p f \ R H > 4 *  vlbXND:0&|rh^TJ@6,"xndZPF<2( ~tj`VLB8.$pzf\ | r h ^ T J @ 6 , "    x n d Z P F < 2 (   RRH>4*  vlbXND:0& g c g b ga g` g_ g^ g] g\ g[ gZ gY gX gcW gXV gFU gJT gZS gR gQ ghP g]O gQN guM g_L gK gJ gI gH gG gF gRE g$D gEC g4B gA ga@ gY? gQ> gK= g[< g; gY: gE9 g"8 g7 g6 g5 g4 g=3 g;2 g1 gy0 gm/ g<. g"- g, g+ g* g) g3( g!' g1& g% g$ g# g" g! gވ gކ g| gr gܜ g܌ gd gI gڋ g> g* g g g g, g g  g g5 g g3 g% gѧ gѓ gx gc g g g` gn g gz gb gX g˻ g˭ gʑ g g gȽ g g| ge gƸ gƸ gƚ g g g g g g™ g gY gk ge gþ gý gý~ gü gú gú gù gù; gù/ g÷ gö gõ^ gôn gôb gô gó gó gñ gñ gñ gñ gñ gî gî gí gív gí* gí gê gê gé gé gé gé gç gçD gç2 gæ gæN gæD gå  gå gã gãv gã_ gáo gáY g$| g$. g$$ g$ g$ g" g"k g!= g!- g + g g g g g g g~ g?} g7| g-{ gz gy gx gw g&v g@u g&t gs gr gq gp go gn gm gl gk gj gi g h g g g f g Te g d gà gà gàM gÞ gÞ gÞ gÞv gÞl gÛ gÛ gÛ gÛ gÚs gÙ gÙ gÙ gÙ g× g× gÕ gÕ gÕ gÔ gÓW gÓE gÓ' gÑC gÑ! gÐ gÐ gÏd gÏZ gÎ gÎ gÎx gÎn gÌ gÌX gÌ% gË gË gË g$ gËQ gËA gÉQ gÉE gÈ gÈ gÆ gÅ  gÄp gà gÁ} gÁk gÁU gÁH g~ g{M gz!~ gz  gx} gv| gv{ gtGz gt=y grx grw gov gou gn t gns gnr glp glq gko gkn gi)m gil ggk gg6j ggi geh geg ge#f   &5`]lk  -_+ ossec13001gExim Auth failed2025-03-02 08:47:23 dovecot_plain authenticator failed for ([182.76.69.209]) [128.185.228.134]:42976: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)128.185.228.1341269750}  -' ossec13001gzExim Auth failed2025-03-02 08:46:08 dovecot_plain authenticator failed for syn-156-019-080-138.biz.spectrum.com [156.19.80.138]:33616: 535 Incorrect authentication data (set_id=services@heipowersystem.com)156.19.80.1386252001c  -U% ossec13001gbExim Auth failed2025-03-02 08:45:45 dovecot_plain authenticator failed for c-68-37-35-155.hsd1.mi.comcast.net [68.37.35.155]:50984: 535 Incorrect authentication data (set_id=sales)68.37.35.1556252001g  -[' ossec13001gXExim Auth failed2025-03-02 08:45:34 dovecot_plain authenticator failed for ([49.124.151.70]) [49.124.151.70]:57562: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)49.124.151.701733045T~  -7% ossec13001g˻Exim Auth failed2025-03-02 08:38:42 dovecot_plain authenticator failed for ([113.192.1.27]) [113.192.1.26]:45942: 535 Incorrect authentication data (set_id=services)113.192.1.261643084m}  -e) ossec13001g˭Exim Auth failed2025-03-02 08:38:29 dovecot_plain authenticator failed for ([110.49.145.233]) [110.49.145.233]:33302: 535 Incorrect authentication data (set_id=services@heipowersystem.com)110.49.145.2331605651|  - ) ossec13001gʑExim Auth failed2025-03-02 08:33:44 dovecot_plain authenticator failed for 144.46.246.220.static.netvigator.com [220.246.46.144]:55538: 535 Incorrect authentication data (set_id=services@heipowersystem.com)220.246.46.1441819730Q{  -1% ossec13001gExim Auth failed2025-03-02 08:26:07 dovecot_plain authenticator failed for ([87.117.32.22]) [87.117.32.22]:58852: 535 Incorrect authentication data (set_id=sales)87.117.32.222017370mz  -e) ossec13001gExim Auth failed2025-03-02 08:26:08 dovecot_plain authenticator failed for ([46.146.227.191]) [46.146.227.191]:59420: 535 Incorrect authentication data (set_id=services@heipowersystem.com)46.146.227.1912017370dy  -W% ossec13001gȽExim Auth failed2025-03-02 08:25:56 dovecot_plain authenticator failed for ([27.72.103.74]) [27.72.103.74]:57056: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)27.72.103.741562822fx  -Y' ossec13001gExim Auth failed2025-03-02 08:26:18 dovecot_plain authenticator failed for 217-76-83-103.cust.bredband2.com [217.76.83.103]:44606: 535 Incorrect authentication data (set_id=services)217.76.83.1032661886tw  -w% ossec13001g|Exim Auth failed2025-03-02 08:24:51 dovecot_login authenticator failed for (amplifypowerglobal.com) [119.96.131.8]:43936: 535 Incorrect authentication data (set_id=webmaster@amplifypowerglobal.com)119.96.131.81814991[v  -E% ossec13001geExim Auth failed2025-03-02 08:24:27 dovecot_login authenticator failed for (amplifypowerglobal.com) [119.96.131.8]:40968: 535 Incorrect authentication data (set_id=nologin)119.96.131.81814991ju  -a' ossec13001gƸExim Auth failed2025-03-02 08:17:19 dovecot_plain authenticator failed for ([59.14.179.108]) [59.14.179.108]:42836: 535 Incorrect authentication data (set_id=services@heipowersystem.com)59.14.179.1081835841jt  -_) ossec13001gƸExim Auth failed2025-03-02 08:17:19 dovecot_plain authenticator failed for ([39.129.133.184]) [39.129.133.184]:36642: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)39.129.133.1841814991Qs  =+ ossec13008gƚMail Reciepient rejected2025-03-02 08:16:48 H=(mail.saintsoldiercollege.com) [165.154.213.136]:57113 F= rejected RCPT : Rejected relay attempt: '165.154.213.136' From: 'blemkfjli@saintsoldiercollege.com' To: 'goofile@fastmail.com'165.154.213.1363469034 # 8 a   =Km  W' ossec9708gDovecot Aborted Login with empty userMar 2 09:21:59 vm1 dovecot[312763]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 7 secs): user=<>, rip=87.236.176.54, lip=103.74.54.108, TLS, session=87.236.176.542635167]  -C+ ossec13001g,Exim Auth failed2025-03-02 09:18:58 dovecot_plain authenticator failed for ([178.178.194.136]) [178.178.194.136]:37898: 535 Incorrect authentication data (set_id=services)178.178.194.1362017370Z  -=+ ossec13001gExim Auth failed2025-03-02 09:18:33 dovecot_plain authenticator failed for ([114.215.211.223]) [114.215.211.223]:42952: 535 Incorrect authentication data (set_id=sales)114.215.211.2231814991g  -]% ossec13001g Exim Auth failed2025-03-02 09:18:27 dovecot_plain authenticator failed for ([58.18.90.250]) [58.18.90.250]:57896: 535 Incorrect authentication data (set_id=services@heipowersystem.com)58.18.90.2501814991j  -_) ossec13001gExim Auth failed2025-03-02 09:18:12 dovecot_plain authenticator failed for mail-02.03.perm.ru [46.146.210.180]:46562: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)46.146.210.1802017370`  -Q# ossec13001g5Exim Auth failed2025-03-02 09:14:53 dovecot_login authenticator failed for (rokamauka.com) [14.18.77.99]:47556: 535 Incorrect authentication data (set_id=webmaster@rokamauka.com)14.18.77.991814991P  -1# ossec13001gExim Auth failed2025-03-02 09:14:29 dovecot_login authenticator failed for (rokamauka.com) [14.18.77.99]:44484: 535 Incorrect authentication data (set_id=nologin)14.18.77.991814991Z  -?) ossec13001g3Exim Auth failed2025-03-02 09:10:35 dovecot_plain authenticator failed for ([220.178.246.43]) [220.178.246.43]:46192: 535 Incorrect authentication data (set_id=services)220.178.246.431814991n  -k% ossec13001g%Exim Auth failed2025-03-02 09:10:21 dovecot_plain authenticator failed for vps-79f20bfc.vps.ovh.net [51.75.24.107]:8117: 535 Incorrect authentication data (set_id=services@heipowersystem.com)51.75.24.1073017382W  -;' ossec13001gѧExim Auth failed2025-03-02 09:03:58 dovecot_plain authenticator failed for ([46.29.121.110]) [46.29.121.110]:20294: 535 Incorrect authentication data (set_id=services)46.29.121.1103017382j  -a' ossec13001gѓExim Auth failed2025-03-02 09:03:38 dovecot_plain authenticator failed for ([49.245.10.228]) [49.245.10.228]:59436: 535 Incorrect authentication data (set_id=services@heipowersystem.com)49.245.10.2281880251* EK% ossec5715gxSSHD authentication success.Mar 2 08:58:56 vm1 sshd[1393205]: Accepted password for root from 103.190.54.7 port 62765 ssh2103.190.54.71269750)  EK% ossec5715gcSSHD authentication success.Mar 2 08:58:32 vm1 sshd[1393072]: Accepted password for root from 103.190.54.7 port 62764 ssh2103.190.54.71269750S  -7% ossec13001gExim Auth failed2025-03-02 08:56:22 dovecot_plain authenticator failed for ([45.93.94.125]) [45.93.94.125]:45694: 535 Incorrect authentication data (set_id=services)45.93.94.125294640g  -]% ossec13001gExim Auth failed2025-03-02 08:55:57 dovecot_plain authenticator failed for ([27.71.20.180]) [27.71.20.180]:44541: 535 Incorrect authentication data (set_id=services@heipowersystem.com)27.71.20.1801562822p  -i+ ossec13001g`Exim Auth failed2025-03-02 08:49:59 dovecot_plain authenticator failed for ([115.242.200.126]) [115.242.200.126]:36408: 535 Incorrect authentication data (set_id=services@heipowersystem.com)115.242.200.1261269750e  -U) ossec13001gnExim Auth failed2025-03-02 08:50:13 dovecot_plain authenticator failed for 157.101.169.56.static.zoot.jp [157.101.169.56]:39082: 535 Incorrect authentication data (set_id=services)157.101.169.561861060   H e g  (P_aZ#  -=+ ossec13001gExim Auth failed2025-03-02 10:13:36 dovecot_plain authenticator failed for ([125.140.244.144]) [125.140.244.144]:49082: 535 Incorrect authentication data (set_id=sales)125.140.244.1441835841T"  -7% ossec13001gExim Auth failed2025-03-02 10:13:27 dovecot_plain authenticator failed for ([61.81.151.97]) [61.81.151.97]:54416: 535 Incorrect authentication data (set_id=services)61.81.151.971835841y!  -}) ossec13001gExim Auth failed2025-03-02 10:05:28 dovecot_plain authenticator failed for ip72-199-156-231.sd.sd.cox.net [72.199.156.231]:43463: 535 Incorrect authentication data (set_id=services@heipowersystem.com)72.199.156.2316252001f  -Y' ossec13001gވExim Auth failed2025-03-02 09:58:55 dovecot_plain authenticator failed for wsip-174-79-91-142.br.br.cox.net [174.79.91.142]:50715: 535 Incorrect authentication data (set_id=services)174.79.91.1426252001Z  -=+ ossec13001gކExim Auth failed2025-03-02 09:58:54 dovecot_plain authenticator failed for ([197.149.125.227]) [197.149.125.227]:46206: 535 Incorrect authentication data (set_id=sales)197.149.125.2272328926z  -# ossec13001g|Exim Auth failed2025-03-02 09:58:44 dovecot_plain authenticator failed for 18.red-83-48-39.staticip.rima-tde.net [83.48.39.18]:33858: 535 Incorrect authentication data (set_id=services@heipowersystem.com)83.48.39.182510769m  -c+ ossec13001grExim Auth failed2025-03-02 09:58:33 dovecot_plain authenticator failed for ([181.174.200.138]) [181.174.200.138]:48335: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)181.174.200.1383865483T  -5' ossec13001gܜExim Auth failed2025-03-02 09:50:43 dovecot_plain authenticator failed for ([223.171.55.59]) [223.171.55.59]:53292: 535 Incorrect authentication data (set_id=sales)223.171.55.591835841g  -W+ ossec13001g܌Exim Auth failed2025-03-02 09:50:26 dovecot_plain authenticator failed for (165-220-169-113.cust.exede.net) [165.220.169.113]:34788: 535 Incorrect authentication data (set_id=sales)165.220.169.1132635167j  -_) ossec13001gdExim Auth failed2025-03-02 09:49:47 dovecot_plain authenticator failed for ([74.196.184.120]) [74.196.184.120]:38025: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)74.196.184.1206252001b  ==+ ossec13008gIMail Reciepient rejected2025-03-02 09:45:05 H=(mail.shivelectricaltransformers.com) [165.154.228.156]:60864 F= rejected RCPT : Rejected relay attempt: '165.154.228.156' From: 'xtlohjr@shivelectricaltransformers.com' To: 'goofile@fastmail.com'165.154.228.1561643084z  -% ossec13001gڋExim Auth failed2025-03-02 09:41:55 dovecot_plain authenticator failed for broadband-188-32-68-79.ip.moscow.rt.ru [188.32.68.79]:46689: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)188.32.68.792017370_  -O# ossec13001g>Exim Auth failed2025-03-02 09:32:05 dovecot_plain authenticator failed for 95-31-6-109.static.corbina.ru [95.31.6.109]:59402: 535 Incorrect authentication data (set_id=services)95.31.6.1092017370T  -5' ossec13001g*Exim Auth failed2025-03-02 09:31:45 dovecot_plain authenticator failed for ([58.42.226.215]) [58.42.226.215]:46716: 535 Incorrect authentication data (set_id=sales)58.42.226.2151814991h  -[) ossec13001gExim Auth failed2025-03-02 09:31:34 dovecot_plain authenticator failed for ([47.98.191.121]) [58.100.105.222]:1595: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)58.100.105.2221814991p  -i+ ossec13001gExim Auth failed2025-03-02 09:31:33 dovecot_plain authenticator failed for ([185.235.212.105]) [185.235.212.105]:15625: 535 Incorrect authentication data (set_id=services@heipowersystem.com)185.235.212.1053202326  '$-Xdi3  -a' ossec13001g=Exim Auth failed2025-03-02 10:53:09 dovecot_plain authenticator failed for ([85.130.181.81]) [85.130.181.81]:51057: 535 Incorrect authentication data (set_id=services@heipowersystem.com)85.130.181.81294640X2  -?% ossec13001g;Exim Auth failed2025-03-02 10:53:07 dovecot_plain authenticator failed for (ppp075.bol-online.com) [202.84.34.85]:41402: 535 Incorrect authentication data (set_id=sales)202.84.34.851210997p1  -m' ossec13001gExim Auth failed2025-03-02 10:52:34 dovecot_plain authenticator failed for (106.51.68.128.actcorp.in) [202.122.16.50]:58780: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)202.122.16.501269750Q0  -3# ossec13001gyExim Auth failed2025-03-02 10:41:20 dovecot_plain authenticator failed for ([49.0.129.12]) [49.0.129.12]:38950: 535 Incorrect authentication data (set_id=services)49.0.129.122029969j/  -a' ossec13001gmExim Auth failed2025-03-02 10:41:08 dovecot_plain authenticator failed for ([223.210.27.53]) [223.210.27.53]:13922: 535 Incorrect authentication data (set_id=services@heipowersystem.com)223.210.27.531814991Z.  -?) ossec13001g<Exim Auth failed2025-03-02 10:36:03 dovecot_plain authenticator failed for ([58.210.188.130]) [58.210.188.130]:52089: 535 Incorrect authentication data (set_id=services)58.210.188.1301814991x-  -}' ossec13001g"Exim Auth failed2025-03-02 10:35:38 dovecot_plain authenticator failed for 42-200-70-134.static.imsbiz.com [42.200.70.134]:40916: 535 Incorrect authentication data (set_id=services@heipowersystem.com)42.200.70.1341819730+,  =O+ ossec13008gMail Reciepient rejected2025-03-02 10:30:11 H=(mail.rokamauka.com) [165.154.213.136]:53398 F= rejected RCPT : Rejected relay attempt: '165.154.213.136' From: 'ezslm@rokamauka.com' To: 'goofile@fastmail.com'165.154.213.1363469034+  - ) ossec13001gExim Auth failed2025-03-02 10:29:10 dovecot_plain authenticator failed for syn-035-130-133-206.biz.spectrum.com [35.130.133.206]:54166: 535 Incorrect authentication data (set_id=services@heipowersystem.com)35.130.133.2066252001T*  -7% ossec13001gExim Auth failed2025-03-02 10:24:42 dovecot_plain authenticator failed for ([50.82.12.128]) [50.82.12.128]:39216: 535 Incorrect authentication data (set_id=services)50.82.12.1286252001|)  -) ossec13001gExim Auth failed2025-03-02 10:24:31 dovecot_plain authenticator failed for 125-228-225-91.hinet-ip.hinet.net [125.228.225.91]:48260: 535 Incorrect authentication data (set_id=services@heipowersystem.com)125.228.225.911668284l(  -c) ossec13001g3Exim Auth failed2025-03-02 10:18:50 dovecot_plain authenticator failed for c-73-106-172-226.hsd1.ga.comcast.net [73.106.172.226]:53050: 535 Incorrect authentication data (set_id=services)73.106.172.2266252001c'  -Y# ossec13001g!Exim Auth failed2025-03-02 10:18:33 dovecot_plain authenticator failed for ([5.30.177.55]) [5.30.177.55]:57219: 535 Incorrect authentication data (set_id=services@heipowersystem.com)5.30.177.55290557.&  =U+ ossec13008g1Mail Reciepient rejected2025-03-02 10:14:33 H=(mail.nyaystambh.com) [165.154.226.214]:56625 F= rejected RCPT : Rejected relay attempt: '165.154.226.214' From: 'lsasu@nyaystambh.com' To: 'goofile@fastmail.com'165.154.226.2141668284m%  -e) ossec13001gExim Auth failed2025-03-02 10:13:15 dovecot_plain authenticator failed for ([49.124.152.231]) [49.124.152.231]:47232: 535 Incorrect authentication data (set_id=services@heipowersystem.com)49.124.152.2311733045$  -) ossec13001gExim Auth failed2025-03-02 10:12:52 dovecot_plain authenticator failed for (200-205-223-1.customer.tdatabrasil.net.br) [187.93.153.166]:48288: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)187.93.153.1663469034 0 D i { .=CervD  -}# ossec13001g$Exim Auth failed2025-03-02 11:31:07 dovecot_plain authenticator failed for syn-071-091-077-097.res.spectrum.com [71.91.77.97]:45170: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)71.91.77.976252001gC  -]% ossec13001gEExim Auth failed2025-03-02 11:31:40 dovecot_plain authenticator failed for ([96.79.249.93]) [96.79.249.93]:46608: 535 Incorrect authentication data (set_id=services@heipowersystem.com)96.79.249.936252001MB  --# ossec13001g4Exim Auth failed2025-03-02 11:31:23 dovecot_plain authenticator failed for ([2.54.88.244]) [2.54.88.244]:53002: 535 Incorrect authentication data (set_id=sales)2.54.88.244294640WA  -9) ossec13001gExim Auth failed2025-03-02 11:28:33 dovecot_login authenticator failed for ([122.228.225.20]) [122.228.225.20]:42874: 535 Incorrect authentication data (set_id=admin)122.228.225.201814991o@  -m' ossec13001gaExim Auth failed2025-03-02 11:27:53 dovecot_login authenticator failed for (62-73-121-209.btc-net.bg) [62.73.121.209]:41579: 535 Incorrect authentication data (set_id=admin@heipowersystem.com)62.73.121.209732800Z?  -?) ossec13001gYExim Auth failed2025-03-02 11:23:28 dovecot_plain authenticator failed for ([45.225.194.121]) [45.225.194.121]:34712: 535 Incorrect authentication data (set_id=services)45.225.194.1213469034v>  -w) ossec13001gQExim Auth failed2025-03-02 11:23:20 dovecot_plain authenticator failed for a109-51-222-234.cpe.netcabo.pt [109.51.222.234]:34350: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)109.51.222.2342264397m=  -e) ossec13001gKExim Auth failed2025-03-02 11:23:15 dovecot_plain authenticator failed for ([103.97.213.151]) [103.97.213.151]:50683: 535 Incorrect authentication data (set_id=services@heipowersystem.com)103.97.213.1511269750P<  -1% ossec13001g[Exim Auth failed2025-03-02 11:23:31 dovecot_plain authenticator failed for ([196.0.34.106]) [196.0.34.106]:40545: 535 Incorrect authentication data (set_id=sales)196.0.34.106226074$;  3Q' ossec11301gNew FTP connection.Mar 2 11:17:03 vm1 pure-ftpd[1420846]: (?@185.39.207.72) [INFO] New connection from 185.39.207.72185.39.207.72390903\:  -A+ ossec13001gYExim Auth failed2025-03-02 11:14:55 dovecot_plain authenticator failed for ([171.244.142.135]) [171.244.142.135]:6813: 535 Incorrect authentication data (set_id=services)171.244.142.1351562822m9  -e) ossec13001gEExim Auth failed2025-03-02 11:14:36 dovecot_plain authenticator failed for ([59.102.188.188]) [59.102.188.188]:49835: 535 Incorrect authentication data (set_id=services@heipowersystem.com)59.102.188.1881668284j8  -_) ossec13001g"Exim Auth failed2025-03-02 11:14:01 dovecot_plain authenticator failed for ([196.28.226.124]) [196.28.226.124]:57926: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)196.28.226.1241036973W7  -9) ossec13001gExim Auth failed2025-03-02 11:05:15 dovecot_plain authenticator failed for ([182.139.39.150]) [182.139.39.150]:33992: 535 Incorrect authentication data (set_id=sales)182.139.39.1501814991h6  -_% ossec13001gExim Auth failed2025-03-02 11:04:56 dovecot_plain authenticator failed for syn-097-092-033-136.res.spectrum.com [97.92.33.136]:48944: 535 Incorrect authentication data (set_id=services)97.92.33.1366252001a5  -S# ossec13001gExim Auth failed2025-03-02 11:04:47 dovecot_plain authenticator failed for ([38.79.83.28]) [38.79.83.28]:51582: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)38.79.83.286252001g4  -]% ossec13001gExim Auth failed2025-03-02 11:04:45 dovecot_plain authenticator failed for ([27.72.103.74]) [27.72.103.74]:58300: 535 Incorrect authentication data (set_id=services@heipowersystem.com)27.72.103.741562822 ,%: > ` r u ,mU  -e) ossec13001gFExim Auth failed2025-03-02 12:14:21 dovecot_plain authenticator failed for ([207.219.221.99]) [207.219.221.99]:60300: 535 Incorrect authentication data (set_id=services@heipowersystem.com)207.219.221.996251999xT  -% ossec13001gJExim Auth failed2025-03-02 12:10:08 dovecot_plain authenticator failed for 128-72-81-95.broadband.corbina.ru [128.72.81.95]:51584: 535 Incorrect authentication data (set_id=services@heipowersystem.com)128.72.81.952017370vS  -{% ossec13001gZExim Auth failed2025-03-02 12:10:25 dovecot_plain authenticator failed for 128.16.3.213.static.wline.lns.sme.cust.swisscom.ch [213.3.16.128]:44366: 535 Incorrect authentication data (set_id=services)213.3.16.1282658434ZR  -?) ossec13001gExim Auth failed2025-03-02 12:07:13 dovecot_plain authenticator failed for ([221.209.48.204]) [221.209.48.203]:38646: 535 Incorrect authentication data (set_id=services)221.209.48.2031814991Q  - + ossec13001gExim Auth failed2025-03-02 12:06:47 dovecot_plain authenticator failed for (172.183.199.112.unknown.m1.com.sg) [112.199.183.172]:54757: 535 Incorrect authentication data (set_id=services@heipowersystem.com)112.199.183.1721880251P  - ) ossec13001ghExim Auth failed2025-03-02 12:06:23 dovecot_plain authenticator failed for syn-173-095-123-220.biz.spectrum.com [173.95.123.220]:44092: 535 Incorrect authentication data (set_id=services@heipowersystem.com)173.95.123.2206252001gO  -]% ossec13001g]Exim Auth failed2025-03-02 12:01:57 dovecot_plain authenticator failed for ([222.99.10.11]) [222.99.10.11]:51281: 535 Incorrect authentication data (set_id=services@heipowersystem.com)222.99.10.111835841dN  -Y# ossec13001gQExim Auth failed2025-03-02 12:01:45 dovecot_plain authenticator failed for ([119.32.11.3]) [119.32.11.3]:18019: 535 Incorrect authentication data (set_id=services@heipowersystem.com)119.32.11.31814991TM  -7% ossec13001guExim Auth failed2025-03-02 11:58:05 dovecot_plain authenticator failed for ([76.77.25.108]) [76.77.25.108]:55342: 535 Incorrect authentication data (set_id=services)76.77.25.1086252001pL  -i+ ossec13001g_Exim Auth failed2025-03-02 11:57:42 dovecot_plain authenticator failed for ([211.238.237.254]) [211.238.237.254]:52871: 535 Incorrect authentication data (set_id=services@heipowersystem.com)211.238.237.2541835841ZK  -?) ossec13001gExim Auth failed2025-03-02 11:46:24 dovecot_plain authenticator failed for ([116.10.127.167]) [116.10.127.167]:37902: 535 Incorrect authentication data (set_id=services)116.10.127.1671814991yJ  -' ossec13001gExim Auth failed2025-03-02 11:45:52 dovecot_plain authenticator failed for 89-253-90-113.customers.ownit.se [89.253.90.113]:55759: 535 Incorrect authentication data (set_id=services@heipowersystem.com)89.253.90.1132661886jI  -_) ossec13001gExim Auth failed2025-03-02 11:45:45 dovecot_plain authenticator failed for ([222.119.124.66]) [222.119.124.66]:48369: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)222.119.124.661835841ZH  -=+ ossec13001gExim Auth failed2025-03-02 11:42:42 dovecot_login authenticator failed for ([211.198.178.191]) [211.198.178.191]:57826: 535 Incorrect authentication data (set_id=sales)211.198.178.1911835841xG  -{) ossec13001gExim Auth failed2025-03-02 11:42:30 dovecot_login authenticator failed for (136-34-165-114.googlefiber.net) [136.34.165.114]:50990: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)136.34.165.1146252001gF  -]% ossec13001gExim Auth failed2025-03-02 11:38:25 dovecot_plain authenticator failed for ([115.46.88.68]) [115.46.88.68]:56480: 535 Incorrect authentication data (set_id=services@heipowersystem.com)115.46.88.681814991WE  -;' ossec13001gRExim Auth failed2025-03-02 11:31:52 dovecot_plain authenticator failed for ([1.244.246.221]) [1.244.246.221]:45626: 535 Incorrect authentication data (set_id=services)1.244.246.2211835841 + + H [ p -Oe  =+ ossec13008g TMail Reciepient rejected2025-03-02 13:10:02 H=(mail.westerndancecompany.com) [165.154.226.150]:51257 F= rejected RCPT : Rejected relay attempt: '165.154.226.150' From: 'dakpsxcg@westerndancecompany.com' To: 'goofile@fastmail.com'165.154.226.1501668284Wd  -;' ossec13001g Exim Auth failed2025-03-02 13:04:37 dovecot_plain authenticator failed for ([151.40.26.236]) [151.40.26.236]:42394: 535 Incorrect authentication data (set_id=services)151.40.26.2363175395zc  -) ossec13001g Exim Auth failed2025-03-02 13:04:22 dovecot_plain authenticator failed for (207.122.87.116.starhub.net.sg) [116.87.122.207]:37242: 535 Incorrect authentication data (set_id=services@heipowersystem.com)116.87.122.2071880251mb  -c+ ossec13001g Exim Auth failed2025-03-02 13:04:03 dovecot_plain authenticator failed for ([104.193.103.213]) [104.193.103.213]:45034: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)104.193.103.2136252001ja  -_) ossec13001gExim Auth failed2025-03-02 12:55:08 dovecot_plain authenticator failed for ([49.124.152.149]) [49.124.152.149]:42488: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)49.124.152.1491733045Q`  -3# ossec13001gExim Auth failed2025-03-02 12:55:42 dovecot_plain authenticator failed for ([101.13.1.58]) [101.13.1.58]:51790: 535 Incorrect authentication data (set_id=services)101.13.1.581668284p_  -i+ ossec13001gExim Auth failed2025-03-02 12:55:25 dovecot_plain authenticator failed for ([121.152.119.174]) [121.152.119.174]:45992: 535 Incorrect authentication data (set_id=services@heipowersystem.com)121.152.119.1741835841]^  -C+ ossec13001gExim Auth failed2025-03-02 12:47:47 dovecot_plain authenticator failed for ([175.206.105.126]) [175.206.105.126]:36404: 535 Incorrect authentication data (set_id=services)175.206.105.1261835841m]  -e) ossec13001gExim Auth failed2025-03-02 12:47:13 dovecot_plain authenticator failed for ([45.201.140.227]) [45.201.140.227]:45566: 535 Incorrect authentication data (set_id=services@heipowersystem.com)45.201.140.2271831722l\  -c) ossec13001gExim Auth failed2025-03-02 12:38:22 dovecot_plain authenticator failed for syn-172-100-186-071.res.spectrum.com [172.100.186.71]:33988: 535 Incorrect authentication data (set_id=services)172.100.186.716252001g[  -[' ossec13001gExim Auth failed2025-03-02 12:38:06 dovecot_plain authenticator failed for ([177.207.248.5]) [177.207.248.5]:46032: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)177.207.248.53469034iZ  -_' ossec13001gExim Auth failed2025-03-02 12:37:38 dovecot_plain authenticator failed for ([58.250.157.83]) [58.250.157.83]:2053: 535 Incorrect authentication data (set_id=services@heipowersystem.com)58.250.157.831814991_Y  -I) ossec13001gExim Auth failed2025-03-02 12:26:05 dovecot_plain authenticator failed for ns1019254.ip-15-204-208.us [15.204.208.192]:38018: 535 Incorrect authentication data (set_id=sales)15.204.208.1926252001gX  -[' ossec13001gExim Auth failed2025-03-02 12:25:42 dovecot_plain authenticator failed for ([59.46.185.130]) [59.46.185.130]:59615: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)59.46.185.1301814991W  [) ossec12004gcPossible Dovecot CVE-2019-11500 attemptMar 2 12:23:21 vm1 dovecot[312763]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=18.191.225.152, lip=103.74.54.108, session=18.191.225.1526252001QV  -3# ossec13001gXExim Auth failed2025-03-02 12:14:40 dovecot_plain authenticator failed for ([101.13.5.37]) [101.13.5.37]:34560: 535 Incorrect authentication data (set_id=services)101.13.5.371668284 v 4 I @ h ;<?dvjv  -_) ossec13001g&Exim Auth failed2025-03-02 13:56:13 dovecot_plain authenticator failed for ([221.199.172.66]) [221.199.172.66]:60366: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)221.199.172.661814991Wu  -;' ossec13001g@Exim Auth failed2025-03-02 13:48:06 dovecot_plain authenticator failed for ([191.59.254.45]) [191.59.254.45]:47534: 535 Incorrect authentication data (set_id=services)191.59.254.453469034yt  -' ossec13001g&Exim Auth failed2025-03-02 13:47:42 dovecot_plain authenticator failed for 60-249-207-53.hinet-ip.hinet.net [60.249.207.53]:35978: 535 Incorrect authentication data (set_id=services@heipowersystem.com)60.249.207.531668284{s  -) ossec13001gExim Auth failed2025-03-02 13:41:53 dovecot_plain authenticator failed for 89-179-241-253.static.corbina.ru [89.179.241.253]:52630: 535 Incorrect authentication data (set_id=services@heipowersystem.com)89.179.241.2532017370Qr  -3# ossec13001gExim Auth failed2025-03-02 13:33:56 dovecot_plain authenticator failed for ([49.0.129.12]) [49.0.129.12]:50496: 535 Incorrect authentication data (set_id=services)49.0.129.122029969jq  -a' ossec13001gExim Auth failed2025-03-02 13:33:45 dovecot_plain authenticator failed for ([45.117.10.134]) [45.117.10.134]:42492: 535 Incorrect authentication data (set_id=services@heipowersystem.com)45.117.10.1341814991rp  -u# ossec13001gExim Auth failed2025-03-02 13:28:52 dovecot_login authenticator failed for (amplifypowerglobal.com) [14.18.77.99]:33262: 535 Incorrect authentication data (set_id=webmaster@amplifypowerglobal.com)14.18.77.991814991Qo  -3# ossec13001gExim Auth failed2025-03-02 13:28:25 dovecot_plain authenticator failed for ([187.9.3.190]) [187.9.3.190]:38437: 535 Incorrect authentication data (set_id=services)187.9.3.1903469034Yn  -C# ossec13001gExim Auth failed2025-03-02 13:28:24 dovecot_login authenticator failed for (amplifypowerglobal.com) [14.18.77.99]:58184: 535 Incorrect authentication data (set_id=nologin)14.18.77.991814991jm  -a' ossec13001gExim Auth failed2025-03-02 13:28:07 dovecot_plain authenticator failed for ([24.115.19.225]) [24.115.19.225]:36758: 535 Incorrect authentication data (set_id=services@heipowersystem.com)24.115.19.2256252001Pl  -/% ossec13001gExim Auth failed2025-03-02 13:24:00 dovecot_plain authenticator failed for ([1.71.191.42]) [223.11.0.152]:29801: 535 Incorrect authentication data (set_id=sales)223.11.0.1521814991Tk  -7% ossec13001gExim Auth failed2025-03-02 13:23:52 dovecot_plain authenticator failed for ([96.79.249.93]) [96.79.249.93]:59697: 535 Incorrect authentication data (set_id=services)96.79.249.936252001j  -# ossec13001gExim Auth failed2025-03-02 13:23:40 dovecot_plain authenticator failed for cpc81914-leic18-2-0-cust77.8-1.cable.virginm.net [82.0.107.78]:38850: 535 Incorrect authentication data (set_id=services@heipowersystem.com)82.0.107.782635167gi  -[' ossec13001gExim Auth failed2025-03-02 13:23:35 dovecot_plain authenticator failed for ([183.216.70.66]) [183.216.70.66]:52438: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)183.216.70.661814991]h  -C+ ossec13001g Exim Auth failed2025-03-02 13:16:48 dovecot_plain authenticator failed for ([171.244.142.135]) [171.244.142.135]:38809: 535 Incorrect authentication data (set_id=services)171.244.142.1351562822jg  -a' ossec13001g Exim Auth failed2025-03-02 13:16:35 dovecot_plain authenticator failed for ([183.47.48.178]) [183.47.48.178]:51909: 535 Incorrect authentication data (set_id=services@heipowersystem.com)183.47.48.1781814991yf  -' ossec13001g Exim Auth failed2025-03-02 13:11:37 dovecot_plain authenticator failed for 216.106.67.50.reverse.socket.net [216.106.67.50]:53982: 535 Incorrect authentication data (set_id=services@heipowersystem.com)216.106.67.506252001   1 S hwRgW  -;' ossec13001g!=Exim Auth failed2025-03-02 14:43:32 dovecot_plain authenticator failed for ([50.171.64.170]) [50.171.64.170]:44890: 535 Incorrect authentication data (set_id=services)50.171.64.1706252001g  -]% ossec13001g!-Exim Auth failed2025-03-02 14:43:16 dovecot_plain authenticator failed for ([103.83.9.138]) [103.83.9.138]:49632: 535 Incorrect authentication data (set_id=services@heipowersystem.com)103.83.9.1381269750%  3Q' ossec11301g +New FTP connection.Mar 2 14:38:57 vm1 pure-ftpd[1462473]: (?@167.94.138.60) [INFO] New connection from 167.94.138.60167.94.138.606252001\  -A+ ossec13001gExim Auth failed2025-03-02 14:37:00 dovecot_plain authenticator failed for ([125.21.146.174]) [115.242.200.126]:53444: 535 Incorrect authentication data (set_id=services)115.242.200.1261269750v  -{% ossec13001gExim Auth failed2025-03-02 14:36:40 dovecot_plain authenticator failed for 111-70-3-198.emome-ip.hinet.net [111.70.3.198]:33383: 535 Incorrect authentication data (set_id=services@heipowersystem.com)111.70.3.1981668284j  -_) ossec13001gExim Auth failed2025-03-02 14:36:37 dovecot_plain authenticator failed for ([191.59.206.191]) [191.59.206.191]:34426: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)191.59.206.1913469034j  -a' ossec13001gExim Auth failed2025-03-02 14:28:19 dovecot_plain authenticator failed for syn-071-012-241-225.res.spectrum.com [71.12.241.225]:60308: 535 Incorrect authentication data (set_id=services)71.12.241.2256252001g  -]% ossec13001gExim Auth failed2025-03-02 14:27:41 dovecot_plain authenticator failed for ([60.172.53.82]) [60.172.53.82]:56162: 535 Incorrect authentication data (set_id=services@heipowersystem.com)60.172.53.821814991W  -;' ossec13001gExim Auth failed2025-03-02 14:19:43 dovecot_plain authenticator failed for ([58.57.154.146]) [58.57.154.146]:52884: 535 Incorrect authentication data (set_id=services)58.57.154.1461814991m~  -e) ossec13001gExim Auth failed2025-03-02 14:19:25 dovecot_plain authenticator failed for ([128.185.224.87]) [152.52.243.154]:36328: 535 Incorrect authentication data (set_id=services@heipowersystem.com)152.52.243.1541269750g}  -Y) ossec13001g?Exim Auth failed2025-03-02 14:09:26 dovecot_plain authenticator failed for (116.68.197.124.unknown.m1.com.sg) [124.197.68.116]:55973: 535 Incorrect authentication data (set_id=sales)124.197.68.1161880251Z|  -?) ossec13001g7Exim Auth failed2025-03-02 14:09:19 dovecot_plain authenticator failed for ([14.194.128.158]) [14.194.128.158]:52664: 535 Incorrect authentication data (set_id=services)14.194.128.1581269750j{  -a' ossec13001g-Exim Auth failed2025-03-02 14:09:09 dovecot_plain authenticator failed for ([222.100.159.2]) [222.100.159.2]:45084: 535 Incorrect authentication data (set_id=services@heipowersystem.com)222.100.159.21835841gz  -[' ossec13001gExim Auth failed2025-03-02 14:08:41 dovecot_plain authenticator failed for ([210.245.95.11]) [210.245.95.11]:58180: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)210.245.95.111562822^y  -K% ossec13001gExim Auth failed2025-03-02 14:06:25 dovecot_plain authenticator failed for bb121-7-209-18.singnet.com.sg [121.7.209.18]:59162: 535 Incorrect authentication data (set_id=sales)121.7.209.181880251ix  -]) ossec13001gExim Auth failed2025-03-02 14:06:16 dovecot_plain authenticator failed for ([124.43.78.147]) [112.134.136.33]:63909: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)112.134.136.331227603#w  =?+ ossec13008gMail Reciepient rejected2025-03-02 14:02:19 H=(mail.hsnews.in) [165.154.247.226]:54743 F= rejected RCPT : Rejected relay attempt: '165.154.247.226' From: 'qyrnzbt@hsnews.in' To: 'goofile@fastmail.com'165.154.247.2261605651 j5 H n ~ ,WXjj|  -% ossec13001g,Exim Auth failed2025-03-02 15:33:09 dovecot_plain authenticator failed for port-ip-88-150-6-165.reverse.mdcc-fun.de [88.150.6.165]:63270: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)88.150.6.1652921044j  -a' ossec13001g)Exim Auth failed2025-03-02 15:20:05 dovecot_plain authenticator failed for ([12.189.234.28]) [12.189.234.28]:36877: 535 Incorrect authentication data (set_id=services@heipowersystem.com)12.189.234.286252001{  -' ossec13001g) Exim Auth failed2025-03-02 15:16:52 dovecot_login authenticator failed for (82.193.122.91.cl.ipnet.ua) [82.193.122.91]:47655: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)82.193.122.91690791Q  -3# ossec13001g(Exim Auth failed2025-03-02 15:15:37 dovecot_plain authenticator failed for ([59.8.66.225]) [59.8.66.225]:53292: 535 Incorrect authentication data (set_id=services)59.8.66.2251835841m  -e) ossec13001g(Exim Auth failed2025-03-02 15:15:20 dovecot_plain authenticator failed for ([95.105.113.109]) [95.105.113.109]:59368: 535 Incorrect authentication data (set_id=services@heipowersystem.com)95.105.113.1092017370Z  -?) ossec13001g&Exim Auth failed2025-03-02 15:06:35 dovecot_plain authenticator failed for ([101.168.42.221]) [101.168.42.221]:57136: 535 Incorrect authentication data (set_id=services)101.168.42.2212077456m  -e) ossec13001g&Exim Auth failed2025-03-02 15:06:24 dovecot_plain authenticator failed for ([106.55.161.136]) [106.55.161.136]:45280: 535 Incorrect authentication data (set_id=services@heipowersystem.com)106.55.161.1361814991W  -;' ossec13001g%@Exim Auth failed2025-03-02 15:00:40 dovecot_plain authenticator failed for ([59.46.185.130]) [59.46.185.130]:41145: 535 Incorrect authentication data (set_id=services)59.46.185.1301814991}  -' ossec13001g%.Exim Auth failed2025-03-02 15:00:21 dovecot_plain authenticator failed for syn-071-066-157-177.biz.spectrum.com [71.66.157.177]:50802: 535 Incorrect authentication data (set_id=services@heipowersystem.com)71.66.157.1776252001T  -7' ossec13001g$Exim Auth failed2025-03-02 14:57:44 dovecot_login authenticator failed for ([89.38.102.187]) [89.38.102.187]:45878: 535 Incorrect authentication data (set_id=bo_msk)89.38.102.187130758m  -g' ossec13001g$|Exim Auth failed2025-03-02 14:57:22 dovecot_login authenticator failed for ([123.182.89.19]) [123.182.89.19]:36974: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)123.182.89.191814991i  -]) ossec13001g$.Exim Auth failed2025-03-02 14:56:04 dovecot_plain authenticator failed for 94-255-178-175.cust.bredband2.com [94.255.178.175]:53994: 535 Incorrect authentication data (set_id=services)94.255.178.1752661886l  -c) ossec13001g$$Exim Auth failed2025-03-02 14:55:55 dovecot_plain authenticator failed for ([124.43.78.147]) [112.134.136.33]:64495: 535 Incorrect authentication data (set_id=services@heipowersystem.com)112.134.136.331227603V  -7) ossec13001g$Exim Auth failed2025-03-02 14:55:48 dovecot_plain authenticator failed for ([222.128.44.171]) [222.128.44.171]:2052: 535 Incorrect authentication data (set_id=sales)222.128.44.1711814991i  -_) ossec13001g$Exim Auth failed2025-03-02 14:55:35 dovecot_plain authenticator failed for ([94.204.208.189]) [94.204.208.189]:51372: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)94.204.208.189290557Z  -?) ossec13001g"Exim Auth failed2025-03-02 14:48:55 dovecot_plain authenticator failed for ([202.156.63.212]) [202.156.63.212]:35646: 535 Incorrect authentication data (set_id=services)202.156.63.2121880251i  -_' ossec13001g"kExim Auth failed2025-03-02 14:48:35 dovecot_plain authenticator failed for visaustralia.com [216.70.104.41]:42148: 535 Incorrect authentication data (set_id=services@heipowersystem.com)216.70.104.416252001  5 D V x ,WcU)  -7' ossec13001g4Exim Auth failed2025-03-02 16:07:04 dovecot_login authenticator failed for ([94.102.51.218]) [94.102.51.218]:55624: 535 Incorrect authentication data (set_id=bo_msk)94.102.51.2182750405p(  -k) ossec13001g4Exim Auth failed2025-03-02 16:06:48 dovecot_login authenticator failed for ([118.70.227.203]) [118.70.227.203]:36710: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)118.70.227.2031562822Z'  -?) ossec13001g4Exim Auth failed2025-03-02 16:06:32 dovecot_plain authenticator failed for ([122.228.225.21]) [122.228.225.21]:52240: 535 Incorrect authentication data (set_id=services)122.228.225.211814991p&  -i+ ossec13001g4Exim Auth failed2025-03-02 16:06:09 dovecot_plain authenticator failed for ([123.209.108.180]) [123.209.108.180]:45538: 535 Incorrect authentication data (set_id=services@heipowersystem.com)123.209.108.1802077456Q%  -3# ossec13001g3Exim Auth failed2025-03-02 16:02:47 dovecot_plain authenticator failed for ([8.209.221.7]) [8.209.221.7]:57900: 535 Incorrect authentication data (set_id=services)8.209.221.71861060m$  -e) ossec13001g3Exim Auth failed2025-03-02 16:02:35 dovecot_plain authenticator failed for ([27.123.242.252]) [27.123.242.252]:54378: 535 Incorrect authentication data (set_id=services@heipowersystem.com)27.123.242.2521269750^#  -G) ossec13001g2Exim Auth failed2025-03-02 15:57:49 dovecot_plain authenticator failed for 118-119-237-24.gci.net [24.237.119.118]:48327: 535 Incorrect authentication data (set_id=services)24.237.119.1186252001p"  -i+ ossec13001g2Exim Auth failed2025-03-02 15:57:10 dovecot_plain authenticator failed for ([123.209.108.180]) [123.209.108.180]:59274: 535 Incorrect authentication data (set_id=services@heipowersystem.com)123.209.108.1802077456g!  -[' ossec13001g0Exim Auth failed2025-03-02 15:50:08 dovecot_plain authenticator failed for ([175.202.82.16]) [175.202.82.16]:56950: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)175.202.82.161835841S  -7% ossec13001g0Exim Auth failed2025-03-02 15:50:38 dovecot_plain authenticator failed for ([5.11.164.165]) [5.11.164.165]:39991: 535 Incorrect authentication data (set_id=services)5.11.164.165298795T  -5' ossec13001g0Exim Auth failed2025-03-02 15:50:29 dovecot_plain authenticator failed for ([120.78.172.20]) [120.78.172.20]:60998: 535 Incorrect authentication data (set_id=sales)120.78.172.201814991g  -]% ossec13001g0Exim Auth failed2025-03-02 15:50:25 dovecot_plain authenticator failed for ([14.39.41.171]) [14.39.41.171]:44196: 535 Incorrect authentication data (set_id=services@heipowersystem.com)14.39.41.1711835841Z  -?) ossec13001g/Exim Auth failed2025-03-02 15:42:34 dovecot_plain authenticator failed for ([122.166.70.100]) [122.166.70.100]:39794: 535 Incorrect authentication data (set_id=services)122.166.70.1001269750j  -a' ossec13001g/ Exim Auth failed2025-03-02 15:42:23 dovecot_plain authenticator failed for ([220.74.63.183]) [220.74.63.183]:37872: 535 Incorrect authentication data (set_id=services@heipowersystem.com)220.74.63.1831835841m  -c+ ossec13001g/Exim Auth failed2025-03-02 15:42:44 dovecot_plain authenticator failed for ([171.221.199.222]) [171.221.199.222]:35353: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)171.221.199.2221814991T  -7% ossec13001g,Exim Auth failed2025-03-02 15:33:26 dovecot_plain authenticator failed for ([39.164.91.67]) [39.164.91.67]:36090: 535 Incorrect authentication data (set_id=services)39.164.91.671814991o  -i+ ossec13001g,Exim Auth failed2025-03-02 15:33:08 dovecot_plain authenticator failed for ([196.189.126.185]) [196.189.126.185]:60748: 535 Incorrect authentication data (set_id=services@heipowersystem.com)196.189.126.185337996 =zm`SF9, v i \ O B 5 (     r e X K > 1 $  { n a T G : -   w j ] P C 6 )    s f Y L ? 2 %  |obUH;.!xk^QD7*tgZM@3& }pcVI</"yl_RE8+dWJ~quh[NA4' ~qdWJ=0# =0 12697505 12697504 12697504 12697504 12697504 12697504 12697504 12697504 12697504 12697504 12697504 12697504 12697504 12697504 12697504 12697504 12697504 12697504 12697504 12697504 12697504 12697504 12697504 12697504 12697504 12697504 12697504 12697504 12697504 12697504 12697504 12697504 12697504 12697504 12697504 12697504 12697504 12697504 12697504 12697504 12697504 12697504~ 12697504{ 12697504z 12697504w 12697504v 12697504T 12697504R 12697504M 12697504@ 126975045 126975043 126975042 12697504, 12697504& 12697504 12697504 12697504 12697504 12697503 12697503 12697503 12697503 12697503 12697503 12697503 12697503x 12697503W 12697503@ 12697503 12697503 12697503 12697503 12697503 12697502 12697502 12697502 12697502 12697502 12697502 12697502 12697502 12697502 12697502 12697502 12697502 12697502_ 12697502Y 12697502O 12697502F 12697502+ 12697502 12697502 12697502 12697501 12697501 12697501 12697501 12697501 12697501 12697501 12697501 12697501 12697501 12697501 12697501 12697501 12697501 12697501 12697501W 12697501L 12697501> 12697501, 12697501 12697501 12697501 12697500 12697500 12697500 12697500 12697500 12697500t 12697500a 12697500` 12697500^ 12697500T 12697500O 12697500N 126975009 126975006 126975004 126975002 12697500/ 1269750/ 1269750/ 1269750/ 1269750/ 1269750/ 1269750/ 1269750/ 1269750/ 1269750/ 1269750/ 1269750/w 1269750/p 1269750/\ 1269750/M 1269750/K 1269750/+ 1269750/" 1269750/ 1269750. 1269750. 1269750. 1269750. 1269750.y 1269750.j 1269750.T 1269750.3 1269750./ 1269750. 1269750. 1269750. 1269750. 1269750- 1269750- 1269750- 1269750- 1269750- 1269750- 1269750- 1269750-v 1269750-L 1269750-K 1269750-/ 1269750-+ 1269750, 1269750, 1269750, 1269750, 1269750, 1269750, 1269750, 1269750,| 1269750,p 1269750,m 1269750,j 1269750,X 1269750,S 1269750,( 1269750,' 1269750,$ 1269750, 1269750, 1269750, 1269750, 1269750, 1269750+ 1269750+ 1269750+ 1269750+ 1269750+ 1269750+ 1269750+ 1269750+ 1269750+v 1269750+p 1269750+j 1269750+i 1269750+c 1269750+b 1269750+G 1269750+" 1269750+ 1269750+ 1269750+ 1269750+ 1269750+ 1269750+ 1269750+ 1269750+ 1269750+ 1269750+ 1269750+ 1269750+ 1269750+ 1269750+ 1269750+ 1269750+ 1269750+ 1269750+ 1269750+ 1269750* 1269750* 1269750* 1269750* 1269750* 1269750* 1269750* 1269750*v 1269750*i 1269750*e 1269750*Z 1269750*G 1269750*< 1269750*3 1269750* 1269750* 1269750) 1269750) 12697505 12697505 12697505 12697505 12697505 12697505 12697505 12697505 12697505 12697505 12697504 12697504 12697504 12697504 12697504 12697504 12697504 12697504 12697504 12697504 12697504   '  #5Jf~j9  -a' ossec13001g=FExim Auth failed2025-03-02 16:43:09 dovecot_plain authenticator failed for ([211.109.75.66]) [211.109.75.69]:63836: 535 Incorrect authentication data (set_id=services@heipowersystem.com)211.109.75.691835841W8  -9) ossec13001g;Exim Auth failed2025-03-02 16:36:54 dovecot_plain authenticator failed for ([112.25.140.211]) [112.25.140.211]:50617: 535 Incorrect authentication data (set_id=sales)112.25.140.2111814991U7  -3+ ossec13001g;Exim Auth failed2025-03-02 16:36:47 dovecot_plain authenticator failed for (tgw-rp.ru) [109.106.136.152]:49962: 535 Incorrect authentication data (set_id=services)109.106.136.1522017370d6  -W% ossec13001g;Exim Auth failed2025-03-02 16:36:41 dovecot_login authenticator failed for ([211.44.80.68]) [211.44.80.68]:33706: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)211.44.80.681835841`5  -U! ossec13001g;Exim Auth failed2025-03-02 16:36:37 dovecot_plain authenticator failed for ([2.55.74.30]) [2.55.74.30]:52338: 535 Incorrect authentication data (set_id=services@heipowersystem.com)2.55.74.30294640g4  -[' ossec13001g;Exim Auth failed2025-03-02 16:36:30 dovecot_plain authenticator failed for ([37.28.177.141]) [37.28.177.141]:34878: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)37.28.177.1412017370j3  -a' ossec13001g9Exim Auth failed2025-03-02 16:29:11 dovecot_plain authenticator failed for ([180.129.88.20]) [180.129.88.20]:35552: 535 Incorrect authentication data (set_id=services@heipowersystem.com)180.129.88.201880251T2  -5' ossec13001g9Exim Auth failed2025-03-02 16:29:05 dovecot_plain authenticator failed for ([182.213.57.49]) [182.213.57.49]:55351: 535 Incorrect authentication data (set_id=sales)182.213.57.491835841g1  -[' ossec13001g9Exim Auth failed2025-03-02 16:28:52 dovecot_plain authenticator failed for ([121.157.28.10]) [121.157.28.10]:46097: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)121.157.28.101835841Q0  -/' ossec13001g9Exim Auth failed2025-03-02 16:28:39 dovecot_plain authenticator failed for p84162-obmd01.osaka.ocn.ne.jp [180.7.155.161]:54381: 535 Incorrect authentication data180.7.155.1611861060R/ U) ossec11001g97Deferred login on the cpanel service[2025-03-02 16:25:50 +0530] info [whostmgrd] 106.219.143.69 - root "GET /cpsess7102935277/scripts4/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: cookie ip check: IP address has changed: IP Address [106.219.143.42] != Current IP Address [106.219.143.69]106.219.143.691269750.  5') ossec11011g97WHM SSO login failed[2025-03-02 16:25:50 +0530] info [whostmgrd] 106.219.143.69 PURGE root:KRPzg3qW5Ply3pot badpass [cookie ip check: IP address has changed: IP Address [106.219.143.42] != Current IP Address [106.219.143.69]]106.219.143.691269750t-  -s) ossec13001g7Exim Auth failed2025-03-02 16:19:58 dovecot_plain authenticator failed for ip-062-143-219-127.um16.pools.vodafone-ip.de [62.143.219.127]:63385: 535 Incorrect authentication data (set_id=services)62.143.219.1272921044p,  -i+ ossec13001g7Exim Auth failed2025-03-02 16:19:44 dovecot_plain authenticator failed for ([190.121.193.126]) [190.121.193.126]:60198: 535 Incorrect authentication data (set_id=services@heipowersystem.com)190.121.193.1263595528i+  -c# ossec13001g7Exim Auth failed2025-03-02 16:19:34 dovecot_plain authenticator failed for static-98-110-70-2.cmdnnj.fios.verizon.net [98.110.70.2]:50162: 535 Incorrect authentication data (set_id=sales)98.110.70.26252001|*  -) ossec13001g7Exim Auth failed2025-03-02 16:19:14 dovecot_plain authenticator failed for 109.46.246.220.static.netvigator.com [220.246.46.109]:58656: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)220.246.46.1091819730 e%4 F R t p &8JVemJ  -e) ossec13001gGExim Auth failed2025-03-02 17:28:42 dovecot_plain authenticator failed for ([60.175.146.138]) [60.175.146.138]:51204: 535 Incorrect authentication data (set_id=services@heipowersystem.com)60.175.146.1381814991pI  -q# ossec13001gFExim Auth failed2025-03-02 17:22:32 dovecot_plain authenticator failed for 1-34-128-40.hinet-ip.hinet.net [1.34.128.40]:42524: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)1.34.128.401668284jH  -a' ossec13001gFlExim Auth failed2025-03-02 17:22:11 dovecot_plain authenticator failed for ([132.247.87.75]) [132.247.87.75]:33198: 535 Incorrect authentication data (set_id=services@heipowersystem.com)132.247.87.753996063jG  -a' ossec13001gDExim Auth failed2025-03-02 17:14:55 dovecot_plain authenticator failed for ([48.218.170.53]) [48.218.170.53]:44750: 535 Incorrect authentication data (set_id=services@heipowersystem.com)48.218.170.531861060pF  -i+ ossec13001gBwExim Auth failed2025-03-02 17:05:18 dovecot_plain authenticator failed for ([175.203.245.102]) [175.203.245.102]:59004: 535 Incorrect authentication data (set_id=services@heipowersystem.com)175.203.245.1021835841jE  -_) ossec13001gBmExim Auth failed2025-03-02 17:05:08 dovecot_plain authenticator failed for ([112.25.140.211]) [112.25.140.211]:32780: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)112.25.140.2111814991OD  -1% ossec13001gBExim Auth failed2025-03-02 17:05:36 dovecot_plain authenticator failed for ([65.20.251.53]) [65.20.251.53]:57162: 535 Incorrect authentication data (set_id=sales)65.20.251.5399237lC  -c) ossec13001gBExim Auth failed2025-03-02 17:05:34 dovecot_plain authenticator failed for syn-104-231-212-078.res.spectrum.com [104.231.212.78]:63351: 535 Incorrect authentication data (set_id=services)104.231.212.786252001ZB  -?) ossec13001gAkExim Auth failed2025-03-02 17:00:50 dovecot_login authenticator failed for ([186.138.219.91]) [186.138.219.91]:42455: 535 Incorrect authentication data (set_id=services)186.138.219.913865483gA  -]% ossec13001gAGExim Auth failed2025-03-02 17:00:15 dovecot_login authenticator failed for ([80.234.36.12]) [80.234.36.12]:34280: 535 Incorrect authentication data (set_id=services@heipowersystem.com)80.234.36.122017370X@  -;) ossec13001g@Exim Auth failed2025-03-02 16:57:09 dovecot_login authenticator failed for ([123.209.200.21]) [123.209.200.21]:53510: 535 Incorrect authentication data (set_id=bo_msk)123.209.200.212077456?  -% ossec13001g@{Exim Auth failed2025-03-02 16:56:50 dovecot_login authenticator failed for (nsg-static-171.125.76.182-airtel.com) [182.76.87.90]:57786: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)182.76.87.901269750Z>  -?) ossec13001g?Exim Auth failed2025-03-02 16:52:38 dovecot_plain authenticator failed for ([112.111.61.232]) [112.111.61.229]:57520: 535 Incorrect authentication data (set_id=services)112.111.61.2291814991p=  -i+ ossec13001g?cExim Auth failed2025-03-02 16:52:09 dovecot_plain authenticator failed for ([191.241.247.150]) [191.241.247.150]:44434: 535 Incorrect authentication data (set_id=services@heipowersystem.com)191.241.247.1503469034j<  -a' ossec13001g>Exim Auth failed2025-03-02 16:48:29 dovecot_plain authenticator failed for ([27.72.151.114]) [27.72.151.114]:55364: 535 Incorrect authentication data (set_id=services@heipowersystem.com)27.72.151.1141562822m;  -e) ossec13001g=Exim Auth failed2025-03-02 16:45:42 dovecot_login authenticator failed for ([183.99.228.131]) [183.99.228.131]:58716: 535 Incorrect authentication data (set_id=services@heipowersystem.com)183.99.228.1311835841W:  -;' ossec13001g=`Exim Auth failed2025-03-02 16:43:35 dovecot_plain authenticator failed for ([89.101.36.159]) [89.101.36.159]:34020: 535 Incorrect authentication data (set_id=services)89.101.36.1592963597 ". P \ 8M_N[  --# ossec13001gOEExim Auth failed2025-03-02 17:59:55 dovecot_plain authenticator failed for ([31.173.0.46]) [31.173.0.46]:37992: 535 Incorrect authentication data (set_id=sales)31.173.0.462017370ZZ  -?) ossec13001gO?Exim Auth failed2025-03-02 17:59:50 dovecot_plain authenticator failed for ([115.44.141.199]) [115.44.141.199]:31676: 535 Incorrect authentication data (set_id=services)115.44.141.1991814991jY  -a' ossec13001gO/Exim Auth failed2025-03-02 17:59:34 dovecot_plain authenticator failed for ([191.59.254.45]) [191.59.254.45]:47342: 535 Incorrect authentication data (set_id=services@heipowersystem.com)191.59.254.453469034gX  -[' ossec13001gO+Exim Auth failed2025-03-02 17:59:29 dovecot_plain authenticator failed for ([124.246.92.77]) [124.246.92.77]:46085: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)124.246.92.771880251aW  -O) ossec13001gOExim Auth failed2025-03-02 17:59:13 dovecot_login authenticator failed for ([185.167.58.121]) [185.167.58.121]:54294: 535 Incorrect authentication data (set_id=vikas.khandelwal)185.167.58.121617790uV  -u) ossec13001gOExim Auth failed2025-03-02 17:59:02 dovecot_login authenticator failed for ([222.117.88.230]) [222.117.88.230]:42890: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)222.117.88.2301835841TU  -7% ossec13001gMExim Auth failed2025-03-02 17:50:43 dovecot_plain authenticator failed for ([103.4.103.61]) [103.4.103.61]:33209: 535 Incorrect authentication data (set_id=services)103.4.103.611168579^T  -I' ossec13001gMExim Auth failed2025-03-02 17:50:40 dovecot_plain authenticator failed for 2.sub-166-139-150.myvzw.com [166.139.150.2]:56430: 535 Incorrect authentication data (set_id=sales)166.139.150.26252001pS  -i+ ossec13001gMExim Auth failed2025-03-02 17:50:33 dovecot_plain authenticator failed for ([163.179.105.241]) [163.179.105.241]:39890: 535 Incorrect authentication data (set_id=services@heipowersystem.com)163.179.105.2411814991dR  -W% ossec13001gMExim Auth failed2025-03-02 17:50:23 dovecot_plain authenticator failed for ([106.51.57.89]) [106.51.57.89]:55804: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)106.51.57.891269750dQ  -U' ossec13001gLExim Auth failed2025-03-02 17:48:55 dovecot_login authenticator failed for 111-70-32-166.emome-ip.hinet.net [111.70.32.166]:45963: 535 Incorrect authentication data (set_id=bo_msk)111.70.32.1661668284lP  -g' ossec13001gLxExim Auth failed2025-03-02 17:47:59 dovecot_login authenticator failed for ([94.202.148.15]) [94.202.148.15]:49347: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)94.202.148.15290557TO  -7% ossec13001gJExim Auth failed2025-03-02 17:37:48 dovecot_plain authenticator failed for ([116.212.19.9]) [116.212.19.9]:50674: 535 Incorrect authentication data (set_id=services)116.212.19.91835841pN  -i+ ossec13001gJ Exim Auth failed2025-03-02 17:37:36 dovecot_plain authenticator failed for ([125.143.247.123]) [125.143.247.123]:42670: 535 Incorrect authentication data (set_id=services@heipowersystem.com)125.143.247.1231835841ZM  -?) ossec13001gI9Exim Auth failed2025-03-02 17:34:08 dovecot_plain authenticator failed for ([78.132.137.230]) [78.132.137.230]:49460: 535 Incorrect authentication data (set_id=services)78.132.137.2302017370pL  -i+ ossec13001gI/Exim Auth failed2025-03-02 17:33:58 dovecot_plain authenticator failed for ([116.228.195.251]) [116.228.195.251]:47845: 535 Incorrect authentication data (set_id=services@heipowersystem.com)116.228.195.2511814991ZK  -?) ossec13001gHExim Auth failed2025-03-02 17:28:57 dovecot_plain authenticator failed for ([61.143.241.150]) [61.143.241.150]:34200: 535 Incorrect authentication data (set_id=services)61.143.241.1501814991 : I CXduYl  -;+ ossec13001gUExim Auth failed2025-03-02 18:26:35 dovecot_login authenticator failed for (nyaystambh.com) [111.122.211.212]:22796: 535 Incorrect authentication data (set_id=nologin)111.122.211.2121814991pk  -i+ ossec13001gTExim Auth failed2025-03-02 18:23:33 dovecot_plain authenticator failed for ([116.116.108.165]) [116.116.108.165]:39995: 535 Incorrect authentication data (set_id=services@heipowersystem.com)116.116.108.1651814991dj  -U' ossec13001gSExim Auth failed2025-03-02 18:19:52 dovecot_login authenticator failed for 83-233-30-104.cust.bredband2.com [83.233.30.104]:52266: 535 Incorrect authentication data (set_id=bo_msk)83.233.30.1042661886[i  -C' ossec13001gSExim Auth failed2025-03-02 18:19:24 dovecot_plain authenticator failed for www.michels-schwab.de [217.86.146.64]:51506: 535 Incorrect authentication data (set_id=services)217.86.146.642921044kh  -c' ossec13001gSExim Auth failed2025-03-02 18:19:09 dovecot_plain authenticator failed for ([223.75.231.193]) [58.49.113.138]:10094: 535 Incorrect authentication data (set_id=services@heipowersystem.com)58.49.113.1381814991pg  -k) ossec13001gSExim Auth failed2025-03-02 18:19:23 dovecot_login authenticator failed for ([117.53.254.144]) [117.53.254.144]:50254: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)117.53.254.1441835841gf  -]% ossec13001gRExim Auth failed2025-03-02 18:14:29 dovecot_plain authenticator failed for ([103.4.103.61]) [103.4.103.61]:43188: 535 Incorrect authentication data (set_id=services@heipowersystem.com)103.4.103.611168579Re  -3% ossec13001gQExim Auth failed2025-03-02 18:10:43 dovecot_login authenticator failed for ([59.2.141.155]) [59.2.141.155]:53656: 535 Incorrect authentication data (set_id=bo_msk)59.2.141.1551835841sd  -o+ ossec13001gQExim Auth failed2025-03-02 18:10:32 dovecot_login authenticator failed for ([138.118.215.123]) [138.118.215.123]:41038: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)138.118.215.1233865483ic  -]) ossec13001gQExim Auth failed2025-03-02 18:07:23 dovecot_plain authenticator failed for 109.46.246.220.static.netvigator.com [220.246.46.109]:61191: 535 Incorrect authentication data (set_id=sales)220.246.46.1091819730gb  -[' ossec13001gPExim Auth failed2025-03-02 18:07:12 dovecot_plain authenticator failed for ([146.88.78.123]) [146.88.78.123]:39342: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)146.88.78.1231694008\a -C' ossec13001gPExim Auth failed2025-03-02 18:07:08 dovecot_login authenticator failed for (vandanabalbharti.com) [221.229.216.1]:35106: 535 Incorrect authentication data (set_id=nologin)221.229.216.11814991Q`  -3# ossec13001gQExim Auth failed2025-03-02 18:07:48 dovecot_plain authenticator failed for ([101.13.3.72]) [101.13.3.72]:59476: 535 Incorrect authentication data (set_id=services)101.13.3.721668284(_  3U) ossec11301gQNew FTP connection.Mar 2 18:07:35 vm1 pure-ftpd[1506492]: (?@147.45.112.185) [INFO] New connection from 147.45.112.185147.45.112.1852134431m^  -e) ossec13001gQExim Auth failed2025-03-02 18:07:35 dovecot_plain authenticator failed for ([110.49.145.233]) [110.49.145.233]:52398: 535 Incorrect authentication data (set_id=services@heipowersystem.com)110.49.145.2331605651T]  -5' ossec13001gP3Exim Auth failed2025-03-02 18:03:55 dovecot_plain authenticator failed for ([89.175.49.147]) [89.175.49.147]:56864: 535 Incorrect authentication data (set_id=sales)89.175.49.1472017370j\  -_) ossec13001gP#Exim Auth failed2025-03-02 18:03:37 dovecot_plain authenticator failed for ([166.195.197.38]) [166.195.197.38]:51487: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)166.195.197.386252001 E& : V p EV}  -;' ossec13001g^@Exim Auth failed2025-03-02 19:03:52 dovecot_plain authenticator failed for ([185.167.59.53]) [185.167.59.53]:50340: 535 Incorrect authentication data (set_id=services)185.167.59.53617790f|  -[' ossec13001g^2Exim Auth failed2025-03-02 19:03:37 dovecot_plain authenticator failed for ([94.206.192.75]) [94.206.192.75]:43027: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)94.206.192.75290557l{  -c) ossec13001g^&Exim Auth failed2025-03-02 19:03:26 dovecot_plain authenticator failed for ([200.205.223.1]) [187.93.153.166]:50722: 535 Incorrect authentication data (set_id=services@heipowersystem.com)187.93.153.1663469034_z  -K' ossec13001g]Exim Auth failed2025-03-02 19:01:12 dovecot_login authenticator failed for ([39.152.120.40]) [39.152.120.40]:25748: 535 Incorrect authentication data (set_id=vikas.khandelwal)39.152.120.401814991oy  -m% ossec13001g]Exim Auth failed2025-03-02 19:00:58 dovecot_login authenticator failed for ([191.59.165.4]) [191.59.165.4]:43628: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)191.59.165.43469034yx  -}) ossec13001g\8Exim Auth failed2025-03-02 18:55:12 dovecot_plain authenticator failed for 46-162-112-159.cust.bredband2.com [46.162.112.159]:49238: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)46.162.112.1592661886Yw  -=) ossec13001g\JExim Auth failed2025-03-02 18:55:30 dovecot_plain authenticator failed for ([222.128.44.171]) [222.128.44.171]:2053: 535 Incorrect authentication data (set_id=services)222.128.44.1711814991Uv  -7' ossec13001g\DExim Auth failed2025-03-02 18:55:23 dovecot_plain authenticator failed for ([223.75.231.193]) [58.49.113.138]:11296: 535 Incorrect authentication data (set_id=sales)58.49.113.1381814991ju  -a' ossec13001g\>Exim Auth failed2025-03-02 18:55:18 dovecot_plain authenticator failed for ([149.54.15.162]) [149.54.15.162]:59269: 535 Incorrect authentication data (set_id=services@heipowersystem.com)149.54.15.1621149361=t  =w' ossec13008gXMail Reciepient rejected2025-03-02 18:39:58 H=(mail.s2seducationtrust.com) [165.154.227.2]:53598 F= rejected RCPT : Rejected relay attempt: '165.154.227.2' From: 'zntce@s2seducationtrust.com' To: 'goofile@fastmail.com'165.154.227.21668284ps  -q# ossec13001gX7Exim Auth failed2025-03-02 18:38:07 dovecot_login authenticator failed for (s2seducationtrust.com) [14.18.77.99]:45704: 535 Incorrect authentication data (set_id=webmaster@s2seducationtrust.com)14.18.77.991814991Xr  -A# ossec13001gXExim Auth failed2025-03-02 18:37:34 dovecot_login authenticator failed for (s2seducationtrust.com) [14.18.77.99]:43244: 535 Incorrect authentication data (set_id=nologin)14.18.77.991814991Qq  -3# ossec13001gWExim Auth failed2025-03-02 18:37:10 dovecot_plain authenticator failed for ([1.28.87.246]) [1.28.87.246]:59720: 535 Incorrect authentication data (set_id=services)1.28.87.2461814991`p  -U! ossec13001gWExim Auth failed2025-03-02 18:36:33 dovecot_plain authenticator failed for ([149.0.16.4]) [149.0.16.4]:34814: 535 Incorrect authentication data (set_id=services@heipowersystem.com)149.0.16.4298795ho  -[) ossec13001gWExim Auth failed2025-03-02 18:36:27 dovecot_plain authenticator failed for c-73-134-126-162.hsd1.md.comcast.net [73.134.126.162]:2314: 535 Incorrect authentication data (set_id=sales)73.134.126.1626252001jn  -_) ossec13001gWExim Auth failed2025-03-02 18:36:16 dovecot_plain authenticator failed for ([175.206.113.91]) [175.206.113.91]:57848: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)175.206.113.911835841hm  -Y+ ossec13001gUExim Auth failed2025-03-02 18:27:01 dovecot_login authenticator failed for (nyaystambh.com) [111.122.211.212]:27042: 535 Incorrect authentication data (set_id=service@nyaystambh.com)111.122.211.2121814991  1 &)Acoc  -W% ossec13001geExim Auth failed2025-03-02 19:32:56 dovecot_plain authenticator failed for ([94.200.95.18]) [94.200.95.18]:56696: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)94.200.95.18290557p  -k) ossec13001gdExim Auth failed2025-03-02 19:31:28 dovecot_login authenticator failed for ([41.159.145.190]) [41.159.145.190]:39234: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)41.159.145.1902400553Z  -?) ossec13001gcExim Auth failed2025-03-02 19:27:52 dovecot_plain authenticator failed for ([220.182.11.126]) [220.182.11.126]:58009: 535 Incorrect authentication data (set_id=services)220.182.11.1261814991d  -W% ossec13001gcExim Auth failed2025-03-02 19:27:46 dovecot_plain authenticator failed for ([76.72.14.152]) [76.72.14.152]:60098: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)76.72.14.1526252001y  -' ossec13001gcExim Auth failed2025-03-02 19:27:38 dovecot_plain authenticator failed for 111-70-49-182.emome-ip.hinet.net [111.70.49.182]:33982: 535 Incorrect authentication data (set_id=services@heipowersystem.com)111.70.49.1821668284Q  -3# ossec13001gbExim Auth failed2025-03-02 19:23:32 dovecot_plain authenticator failed for ([59.7.57.174]) [59.7.57.174]:39136: 535 Incorrect authentication data (set_id=services)59.7.57.1741835841  -' ossec13001gbExim Auth failed2025-03-02 19:23:09 dovecot_plain authenticator failed for (ip-107-12-61-200.static.silicanetworks.com) [200.61.12.107]:56662: 535 Incorrect authentication data (set_id=services@heipowersystem.com)200.61.12.1073865483t  -u' ossec13001gbExim Auth failed2025-03-02 19:22:52 dovecot_plain authenticator failed for d54c70cda.static.telenet.be [84.199.12.218]:44658: 535 Incorrect authentication data (set_id=services@heipowersystem.com)84.199.12.2182802361a  -K+ ossec13001gbExim Auth failed2025-03-02 19:22:29 dovecot_plain authenticator failed for (106.51.70.231.actcorp.in) [180.151.254.218]:37492: 535 Incorrect authentication data (set_id=sales)180.151.254.2181269750m  -c+ ossec13001gbExim Auth failed2025-03-02 19:22:19 dovecot_plain authenticator failed for ([116.113.253.178]) [116.113.253.178]:49848: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)116.113.253.1781814991`  -S# ossec13001ga/Exim Auth failed2025-03-02 19:16:22 dovecot_plain authenticator failed for ([95.0.252.72]) [95.0.252.72]:52470: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)95.0.252.72298795c  -S' ossec13001gaAExim Auth failed2025-03-02 19:16:41 dovecot_plain authenticator failed for (160.72.153.14.lightower.net) [160.72.153.14]:52782: 535 Incorrect authentication data (set_id=services)160.72.153.146252001j  -a' ossec13001ga1Exim Auth failed2025-03-02 19:16:24 dovecot_plain authenticator failed for ([27.40.100.174]) [27.40.100.174]:59733: 535 Incorrect authentication data (set_id=services@heipowersystem.com)27.40.100.1741814991"  3M% ossec11301g_New FTP connection.Mar 2 19:10:51 vm1 pure-ftpd[1519478]: (?@20.168.123.0) [INFO] New connection from 20.168.123.020.168.123.06252001Z  -?) ossec13001g_Exim Auth failed2025-03-02 19:10:43 dovecot_plain authenticator failed for ([110.77.137.236]) [110.77.137.236]:34196: 535 Incorrect authentication data (set_id=services)110.77.137.2361605651g  -[' ossec13001g_Exim Auth failed2025-03-02 19:10:34 dovecot_plain authenticator failed for ([158.140.32.93]) [158.140.32.93]:40664: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)158.140.32.936252001~  -) ossec13001g_Exim Auth failed2025-03-02 19:10:26 dovecot_plain authenticator failed for (mobile-166-195-193-083.mycingular.net) [166.195.193.83]:38336: 535 Incorrect authentication data (set_id=services@heipowersystem.com)166.195.193.836252001 *\~tj`VLB8.$zpf\H>4*   v l b X N D : 0 &    ~ t j ` V L B 8 . $    z p f \ R H > 4 *   v:lbXND0&|rh^TJ@6,"xndZPF<2( ~tj`VLB8.$zpf\ | r h ^ T J @ 6 , "    x n d Z P F < 2 (   RRH>4*  vlbXND:0& gĉ@ gć gć gć gĆu gĆm gĆa gą gą gą gĄ gĄ gĄ gĄ gă< gă2 gĂ~ gĂ} gĂ| gĂ{ gāz gāy gāx gāw gāv gĀu gt gs gr gq g#p go g~n g~m g~l g~Uk g~9j g}i g}h g}g g}f g|e g|d g|c g|b g|a g{` g{_ gz^ gz] gz\ gz[ gyZ gxqY gxqX gxeW gxSV gxU gwT gwS gvR gvQ gvP gvO gv+N gv!M gvL gu_K gu[J guSI gugH gsG gsF gsE gr D gqC gqB goA go@ go? go> gn@= gn`< gn; gm: gm9 gm8 gmr7 gl6 gl|5 glr4 gj3 gj2 gj1 gj0 gj/ gj. gj- gi, gi]+ gi{* gi{) giy( gio' gic& gh% gh$ gh# gh" ghw! gg gg gg ggc ggW gg9 gg gg gg gg gfF gf8 gf  gf ge< ge, ge& ge ge gd gc gc gc gb gb gb gb gb gaA ga1 ga/ g_ g_ g_ g_ g^@ g^2 g^& g] g] g\J g\D g\> g\8 gX gX7 gX gW gW gW gW gU gU gT gS gS gS gS gR gQ gē gē gēh gēD gē* gē" gē gĒ gĒ gĒ gĒ4 gĒ2 gĒ gĒ gđ` gđT gđP gđ> gđ8 gĐ! gĐ gď gď gď gď  gď gč gč gčo gčW gč gČ gČi gČ^ gČX gČN gĊ gĊ gĊ gĊ gĉ gĉ gĉF gQ gQ gQ gQ gQ gP gP gP3 gP# gOE gO? gO/ gO+ gO gO gM gM gM gM gL gLx gJ gJ  gI9 gI/ gH gG gF gFl gD gB gB gBw gBm gAk gAG g@ g@{ g? g?c g> g= gē g=` g=F g; g; g; g; g; g9 g9 g9 g9 g97 g97 g7 g7 g7 g7 g4 g4 g4 g4 g3 g3 g2 g2 g0 g0 g0 g0 g/ g/ g/  g, g, g, g) g)  g( g( g& g& g%@  < P R g ^q}  - # ossec13001ggExim Auth failed2025-03-02 19:44:58 dovecot_plain authenticator failed for 96-1-40-151-staticipeast.wireless.telus.com [96.1.40.151]:37860: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)96.1.40.1516251999a  -K+ ossec13001ggcExim Auth failed2025-03-02 19:42:50 dovecot_login authenticator failed for (106.51.70.231.actcorp.in) [180.151.254.218]:57758: 535 Incorrect authentication data (set_id=sales)180.151.254.2181269750a  -S# ossec13001ggWExim Auth failed2025-03-02 19:42:38 dovecot_login authenticator failed for ([59.12.201.7]) [59.12.201.7]:36388: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)59.12.201.71835841V  -9' ossec13001gg9Exim Auth failed2025-03-02 19:42:08 dovecot_plain authenticator failed for ([58.250.157.83]) [58.250.157.83]:2054: 535 Incorrect authentication data (set_id=services)58.250.157.831814991  -% ossec13001ggExim Auth failed2025-03-02 19:41:16 dovecot_plain authenticator failed for 61-216-7-163.hinet-ip.hinet.net ([61.216.7.165]) [61.216.7.163]:48429: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)61.216.7.1631668284u  -u) ossec13001ggExim Auth failed2025-03-02 19:41:33 dovecot_plain authenticator failed for (m121-202-154-62.smartone.com) [121.202.154.62]:3738: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)121.202.154.621819730j  -a' ossec13001ggExim Auth failed2025-03-02 19:41:33 dovecot_plain authenticator failed for ([191.59.254.45]) [191.59.254.45]:56940: 535 Incorrect authentication data (set_id=services@heipowersystem.com)191.59.254.453469034T  -5' ossec13001ggExim Auth failed2025-03-02 19:41:32 dovecot_plain authenticator failed for ([27.40.100.238]) [27.40.100.238]:59792: 535 Incorrect authentication data (set_id=sales)27.40.100.2381814991i  -[+ ossec13001gfFExim Auth failed2025-03-02 19:38:06 dovecot_login authenticator failed for ([119.206.117.105]) [119.206.117.105]:40508: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)119.206.117.1051835841  -' ossec13001gf8Exim Auth failed2025-03-02 19:37:52 dovecot_login authenticator failed for 111-70-22-153.emome-ip.hinet.net [111.70.22.153]:43157: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)111.70.22.1531668284g  -]% ossec13001gf Exim Auth failed2025-03-02 19:37:05 dovecot_plain authenticator failed for ([160.30.185.3]) [160.30.185.3]:54380: 535 Incorrect authentication data (set_id=services@heipowersystem.com)160.30.185.31252634z  -% ossec13001gfExim Auth failed2025-03-02 19:37:19 dovecot_plain authenticator failed for broadband-5-228-92-193.ip.moscow.rt.ru [5.228.92.193]:49869: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)5.228.92.1932017370h  -]' ossec13001ge<Exim Auth failed2025-03-02 19:33:40 dovecot_plain authenticator failed for 119-46-148-53.static.asianet.co.th [119.46.148.53]:51783: 535 Incorrect authentication data (set_id=services)119.46.148.531605651W  -9) ossec13001ge,Exim Auth failed2025-03-02 19:33:24 dovecot_plain authenticator failed for ([117.158.243.50]) [117.158.243.50]:60030: 535 Incorrect authentication data (set_id=sales)117.158.243.501814991z  -% ossec13001ge&Exim Auth failed2025-03-02 19:33:17 dovecot_plain authenticator failed for h-46-59-44-182.a980.priv.bahnhof.se [46.59.44.182]:54526: 535 Incorrect authentication data (set_id=services@heipowersystem.com)46.59.44.1822661886g  -]% ossec13001geExim Auth failed2025-03-02 19:33:02 dovecot_plain authenticator failed for ([218.68.0.210]) [218.68.0.210]:36172: 535 Incorrect authentication data (set_id=services@heipowersystem.com)218.68.0.2101814991 K  * B jsq ,K]/  -C+ ossec13001gjExim Auth failed2025-03-02 19:54:29 dovecot_plain authenticator failed for ([115.242.200.126]) [115.242.200.126]:40574: 535 Incorrect authentication data (set_id=services)115.242.200.1261269750j.  -a' ossec13001gjExim Auth failed2025-03-02 19:54:07 dovecot_plain authenticator failed for ([186.177.88.60]) [186.177.88.60]:54856: 535 Incorrect authentication data (set_id=services@heipowersystem.com)186.177.88.603624060l-  -a+ ossec13001gjExim Auth failed2025-03-02 19:54:07 dovecot_plain authenticator failed for 122-151-131-211.sta.wbroadband.net.au [122.151.131.211]:55249: 535 Incorrect authentication data (set_id=sales)122.151.131.2112077456c,  -W% ossec13001giExim Auth failed2025-03-02 19:53:58 dovecot_plain authenticator failed for ([5.11.191.145]) [5.11.191.145]:51644: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)5.11.191.145298795j+  -a' ossec13001gi]Exim Auth failed2025-03-02 19:51:16 dovecot_plain authenticator failed for ([115.140.89.82]) [115.140.89.82]:39298: 535 Incorrect authentication data (set_id=services@heipowersystem.com)115.140.89.821835841R*  -3% ossec13001gi{Exim Auth failed2025-03-02 19:51:46 dovecot_login authenticator failed for ([49.79.80.131]) [49.79.80.131]:49452: 535 Incorrect authentication data (set_id=bo_msk)49.79.80.1311814991Z)  -?) ossec13001gi{Exim Auth failed2025-03-02 19:51:46 dovecot_plain authenticator failed for ([222.119.124.66]) [222.119.124.66]:57737: 535 Incorrect authentication data (set_id=services)222.119.124.661835841Z(  -=+ ossec13001giyExim Auth failed2025-03-02 19:51:45 dovecot_plain authenticator failed for ([221.149.233.245]) [221.149.233.245]:58923: 535 Incorrect authentication data (set_id=sales)221.149.233.2451835841~'  - % ossec13001gioExim Auth failed2025-03-02 19:51:34 dovecot_login authenticator failed for (nsg-static-90.87.76.182-airtel.com) [182.76.87.90]:53674: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)182.76.87.901269750s&  -u% ossec13001gicExim Auth failed2025-03-02 19:51:22 dovecot_plain authenticator failed for 111-70-0-112.emome-ip.hinet.net [111.70.0.112]:52130: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)111.70.0.1121668284T%  -5' ossec13001ghExim Auth failed2025-03-02 19:49:04 dovecot_plain authenticator failed for ([88.201.163.65]) [88.201.163.65]:50296: 535 Incorrect authentication data (set_id=sales)88.201.163.652017370d$  -W% ossec13001ghExim Auth failed2025-03-02 19:48:52 dovecot_plain authenticator failed for ([60.11.20.130]) [60.11.20.130]:32956: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)60.11.20.1301814991W#  -;' ossec13001ghExim Auth failed2025-03-02 19:48:51 dovecot_plain authenticator failed for ([61.185.30.170]) [61.185.30.170]:60497: 535 Incorrect authentication data (set_id=services)61.185.30.1701814991s"  -w# ossec13001ghExim Auth failed2025-03-02 19:48:37 dovecot_plain authenticator failed for 111-70-32-2.emome-ip.hinet.net [111.70.32.2]:46489: 535 Incorrect authentication data (set_id=services@heipowersystem.com)111.70.32.21668284!  W) ossec9708ghwDovecot Aborted Login with empty userMar 2 19:47:26 vm1 dovecot[312763]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 4 secs): user=<>, rip=185.247.137.47, lip=103.74.54.108, TLS, session=<9d71slwvt4+594kv>185.247.137.47298795m  -e) ossec13001ggExim Auth failed2025-03-02 19:45:26 dovecot_plain authenticator failed for 123-193-152-64.dynamic.kbronet.com.tw [123.193.152.64]:48288: 535 Incorrect authentication data (set_id=services)123.193.152.641668284n  -g) ossec13001ggExim Auth failed2025-03-02 19:45:14 dovecot_plain authenticator failed for ([101.230.251.217]) [180.154.53.221]:62583: 535 Incorrect authentication data (set_id=services@heipowersystem.com)180.154.53.2211814991 | @ h z } (@V|V@  -9) ossec13001goExim Auth failed2025-03-02 20:17:48 dovecot_plain authenticator failed for ([146.19.200.215]) [146.19.200.215]:33022: 535 Incorrect authentication data (set_id=sales)146.19.200.215660013f?  -[% ossec13001goExim Auth failed2025-03-02 20:17:38 dovecot_plain authenticator failed for ([59.96.62.29]) [49.47.195.35]:56522: 535 Incorrect authentication data (set_id=services@heipowersystem.com)49.47.195.351269750d>  -W% ossec13001goExim Auth failed2025-03-02 20:17:27 dovecot_plain authenticator failed for ([27.72.103.74]) [27.72.103.74]:64526: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)27.72.103.741562822r=  -o+ ossec13001gn@Exim Auth failed2025-03-02 20:12:08 dovecot_login authenticator failed for ([154.205.146.118]) [154.205.146.118]:56696: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)154.205.146.118290291`<  -S# ossec13001gn`Exim Auth failed2025-03-02 20:12:40 dovecot_login authenticator failed for (95.0.252.72.static.ttnet.com.tr) [95.0.252.72]:53646: 535 Incorrect authentication data (set_id=bo_msk)95.0.252.72298795k;  -a) ossec13001gnExim Auth failed2025-03-02 20:11:12 dovecot_plain authenticator failed for 47-158-210-137.lsan.ca.frontiernet.net [47.158.210.137]:53058: 535 Incorrect authentication data (set_id=sales)47.158.210.1376252001m:  -c+ ossec13001gmExim Auth failed2025-03-02 20:10:48 dovecot_plain authenticator failed for ([175.203.245.102]) [175.203.245.102]:43476: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)175.203.245.1021835841l9  -e) ossec13001gmExim Auth failed2025-03-02 20:09:07 dovecot_plain authenticator failed for ([87.236.141.106]) [87.236.141.106]:50011: 535 Incorrect authentication data (set_id=services@heipowersystem.com)87.236.141.106290291^8  -O! ossec13001gmExim Auth failed2025-03-02 20:09:06 dovecot_plain authenticator failed for ([1.25.18.18]) [1.25.18.18]:60322: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)1.25.18.181814991j7  -_) ossec13001gmrExim Auth failed2025-03-02 20:08:41 dovecot_plain authenticator failed for ([49.124.150.253]) [49.124.150.253]:48568: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)49.124.150.2531733045W6  -9) ossec13001glExim Auth failed2025-03-02 20:04:45 dovecot_plain authenticator failed for ([111.171.125.94]) [111.171.125.94]:36390: 535 Incorrect authentication data (set_id=sales)111.171.125.941835841y5  -# ossec13001gl|Exim Auth failed2025-03-02 20:04:36 dovecot_plain authenticator failed for syn-070-120-006-086.res.spectrum.com [70.120.6.86]:53280: 535 Incorrect authentication data (set_id=services@heipowersystem.com)70.120.6.866252001j4  -_) ossec13001glrExim Auth failed2025-03-02 20:04:26 dovecot_plain authenticator failed for ([167.142.198.54]) [167.142.198.54]:54220: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)167.142.198.546252001T3  -5' ossec13001gjExim Auth failed2025-03-02 19:56:37 dovecot_plain authenticator failed for ([49.124.151.57]) [49.124.151.57]:49410: 535 Incorrect authentication data (set_id=sales)49.124.151.571733045W2  -;' ossec13001gjExim Auth failed2025-03-02 19:56:32 dovecot_plain authenticator failed for ([12.200.230.61]) [12.200.230.61]:60994: 535 Incorrect authentication data (set_id=services)12.200.230.616252001s1  -u% ossec13001gjExim Auth failed2025-03-02 19:56:11 dovecot_plain authenticator failed for 111-70-13-24.emome-ip.hinet.net [111.70.13.24]:54778: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)111.70.13.241668284j0  -a' ossec13001gjExim Auth failed2025-03-02 19:56:09 dovecot_plain authenticator failed for ([211.202.71.21]) [211.202.71.21]:44617: 535 Incorrect authentication data (set_id=services@heipowersystem.com)211.202.71.211835841 ~qdWJ=0# zm`SF9, v i \ O B 5 (     r e X K > 1 $  { n a T G : -   w j ] P C 6 )    s f Y L ? 2 %  |obUH;.!xk^QD7*tgZM@3& }pcVI</"yl_RE8+uh[NA4' ~qdWJ=0 2017370 2017370 2017370 2017370 2017370n 2017370d 2017370` 2017370_ 2017370S 2017370P 2017370= 20173708 20173705 20173704 20173701 2017370' 2017370" 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370~ 2017370h 2017370b 2017370[ 2017370K 20173705 2017370+ 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370s 2017370p 2017370h 2017370L 2017370F 2017370D 2017370) 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370q 2017370l 2017370j 2017370i 2017370\ 2017370M 2017370L 2017370> 2017370; 2017370: 20173709 20173701 2017370$ 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370v 2017370u 2017370l 2017370] 2017370Z 2017370Q 2017370K 2017370H 2017370$ 2017370# 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370o 2017370h 2017370g 2017370Y 2017370X 2017370N 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370| 2017370m 2017370h 2017370_ 2017370^ 2017370\ 2017370@ 20173708 20173700 2017370, 2017370* 2017370) 2017370# 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370{ 2017370u 2017370j 2017370Z 2017370N 2017370< 20173702 2017370/ 2017370. 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370} 2017370u 2017370t 2017370o 2017370a 2017370_ 2017370] 2017370[ 2017370Q 2017370L 20173706 20173703 20173702 20173700 2017370" 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370v 2017370m 2017370i 2017370% 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370s 2017370T 2017370 2017370 2017370 2017370 2017370 2017370 ~qdWJ=0# zm`SF9, v i \ O B 5 (     r e X K > 1 $  { n a T G : -   w j ] P C 6 )    s f Y L ? 2 %  |obUH;.!xk^QD7*tgZM@3& }pcVI</"yl_RE8+uh[NA4' ~qdWJ=0 2017370%W 2017370%. 2017370%# 2017370% 2017370$ 2017370$ 2017370$ 2017370$ 2017370$ 2017370$ 2017370$ 2017370$ 2017370$ 2017370$ 2017370$ 2017370$ 2017370$ 2017370$r 2017370$p 2017370$e 2017370$T 2017370$5 2017370$* 2017370$& 2017370$ 2017370$ 2017370# 2017370# 2017370# 2017370# 2017370# 2017370# 2017370# 2017370# 2017370# 2017370# 2017370#i 2017370#Y 2017370#P 2017370#H 2017370#G 2017370#= 2017370#5 2017370#3 2017370#& 2017370# 2017370# 2017370# 2017370" 2017370" 2017370" 2017370" 2017370" 2017370" 2017370" 2017370"z 2017370"t 2017370"o 2017370"m 2017370"f 2017370"d 2017370"a 2017370"U 2017370"G 2017370"F 2017370"5 2017370"3 2017370"+ 2017370" 2017370" 2017370" 2017370" 2017370! 2017370! 2017370! 2017370! 2017370! 2017370! 2017370! 2017370! 2017370! 2017370! 2017370! 2017370! 2017370! 2017370! 2017370! 2017370! 2017370!o 2017370!e 2017370!c 2017370!_ 2017370![ 2017370!J 2017370!D 2017370!@ 2017370! 2017370! 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370  2017370 w 2017370 p 2017370 k 2017370 h 2017370 X 2017370 U 2017370 ; 2017370 7 2017370 3 2017370 " 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370s 2017370S 2017370= 2017370% 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370z 2017370h 2017370` 2017370W 2017370M 2017370H 2017370= 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370o 2017370e 2017370d 2017370b 2017370W 2017370J 20173706 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370s 2017370q 2017370i 2017370f 2017370e 2017370a 2017370Z 2017370W 2017370R 2017370M 2017370< 20173709 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 N#; P M \ Z '6NdQ  -U' ossec13001gvExim Auth failed2025-03-02 20:49:06 dovecot_plain authenticator failed for h88-129-31-231.cust.bredband2.com [88.129.31.231]:51646: 535 Incorrect authentication data (set_id=sales)88.129.31.2312661886mP  -e) ossec13001gvExim Auth failed2025-03-02 20:48:52 dovecot_plain authenticator failed for ([124.112.45.222]) [124.112.45.222]:42092: 535 Incorrect authentication data (set_id=services@heipowersystem.com)124.112.45.2221814991gO  -[' ossec13001gvExim Auth failed2025-03-02 20:48:38 dovecot_plain authenticator failed for ([191.59.254.45]) [191.59.254.45]:37476: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)191.59.254.453469034RN  -3% ossec13001gv+Exim Auth failed2025-03-02 20:45:54 dovecot_login authenticator failed for ([58.18.90.250]) [58.18.90.250]:46631: 535 Incorrect authentication data (set_id=bo_msk)58.18.90.2501814991tM  -w' ossec13001gv!Exim Auth failed2025-03-02 20:45:44 dovecot_login authenticator failed for cl-185-254-44-30.b4net.lt [185.254.44.30]:45096: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)185.254.44.30597427|L  -) ossec13001gvExim Auth failed2025-03-02 20:45:33 dovecot_login authenticator failed for p160149-obmd01.osaka.ocn.ne.jp [61.112.103.148]:54034: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)61.112.103.1481861060WK  -9) ossec13001gu_Exim Auth failed2025-03-02 20:42:30 dovecot_plain authenticator failed for ([222.117.88.230]) [222.117.88.230]:60342: 535 Incorrect authentication data (set_id=sales)222.117.88.2301835841jJ  -a' ossec13001gu[Exim Auth failed2025-03-02 20:42:25 dovecot_plain authenticator failed for ([112.196.60.13]) [112.196.60.13]:39818: 535 Incorrect authentication data (set_id=services@heipowersystem.com)112.196.60.131269750xI  -}' ossec13001guSExim Auth failed2025-03-02 20:42:17 dovecot_plain authenticator failed for (109.cpe-186-68-83.gye.satnet.net) [186.68.83.109]:45910: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)186.68.83.1093658394ZH  -?) ossec13001gugExim Auth failed2025-03-02 20:42:37 dovecot_plain authenticator failed for ([151.49.116.193]) [151.49.116.193]:41005: 535 Incorrect authentication data (set_id=services)151.49.116.1933175395SG  -5' ossec13001gsExim Auth failed2025-03-02 20:34:47 dovecot_plain authenticator failed for ([91.239.23.149]) [91.239.23.149]:44122: 535 Incorrect authentication data (set_id=sales)91.239.23.149458258~F  -) ossec13001gsExim Auth failed2025-03-02 20:34:36 dovecot_plain authenticator failed for (107-175-76-146-host.colocrossing.com) [107.175.76.146]:40940: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)107.175.76.1466252001mE  -e) ossec13001gsExim Auth failed2025-03-02 20:34:31 dovecot_plain authenticator failed for ([168.121.46.162]) [168.121.46.162]:59990: 535 Incorrect authentication data (set_id=services@heipowersystem.com)168.121.46.1623932488D  - ' ossec13001gr Exim Auth failed2025-03-02 20:28:21 dovecot_login authenticator failed for c-98-220-97-188.hsd1.il.comcast.net [98.220.97.188]:49190: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)98.220.97.1886252001gC  -]% ossec13001gqExim Auth failed2025-03-02 20:27:24 dovecot_plain authenticator failed for ([58.18.90.250]) [58.18.90.250]:39310: 535 Incorrect authentication data (set_id=services@heipowersystem.com)58.18.90.2501814991dB  -W% ossec13001gqExim Auth failed2025-03-02 20:26:55 dovecot_plain authenticator failed for ([8.139.253.26]) [8.139.253.26]:26142: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)8.139.253.261814991YA  -?) ossec13001goExim Auth failed2025-03-02 20:17:53 dovecot_plain authenticator failed for ([94.201.236.143]) [94.201.236.143]:56571: 535 Incorrect authentication data (set_id=services)94.201.236.143290557 q%( G S e x  HTc^qib  -a' ossec13001g|Exim Auth failed2025-03-02 21:13:29 dovecot_plain authenticator failed for ([87.200.73.165]) [87.200.73.165]:50844: 535 Incorrect authentication data (set_id=services@heipowersystem.com)87.200.73.165290557a  - + ossec13001g|Exim Auth failed2025-03-02 21:13:24 dovecot_plain authenticator failed for 189.115.230.179.dynamic.adsl.gvt.net.br [189.115.230.179]:38679: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)189.115.230.1793469034m`  -c+ ossec13001g{Exim Auth failed2025-03-02 21:10:28 dovecot_plain authenticator failed for ([123.209.117.171]) [123.209.117.171]:51856: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)123.209.117.1712077456p_  -i+ ossec13001g{Exim Auth failed2025-03-02 21:09:56 dovecot_plain authenticator failed for ([119.206.117.105]) [119.206.117.105]:39308: 535 Incorrect authentication data (set_id=services@heipowersystem.com)119.206.117.1051835841T^  -7% ossec13001gzExim Auth failed2025-03-02 21:06:20 dovecot_plain authenticator failed for ([96.79.249.93]) [96.79.249.93]:58597: 535 Incorrect authentication data (set_id=services)96.79.249.936252001T]  -5' ossec13001gzExim Auth failed2025-03-02 21:06:02 dovecot_plain authenticator failed for ([101.58.144.50]) [101.58.144.50]:46356: 535 Incorrect authentication data (set_id=sales)101.58.144.503175395m\  -e) ossec13001gzExim Auth failed2025-03-02 21:05:57 dovecot_plain authenticator failed for ([183.109.148.43]) [183.109.148.43]:45098: 535 Incorrect authentication data (set_id=services@heipowersystem.com)183.109.148.431835841n[  -i' ossec13001gzExim Auth failed2025-03-02 21:05:47 dovecot_plain authenticator failed for vps-926fddc5.vps.ovh.net [79.137.82.102]:54934: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)79.137.82.1023017382TZ  -3) ossec13001gyExim Auth failed2025-03-02 21:00:33 dovecot_plain authenticator failed for p281103-obmd01.tokyo.ocn.ne.jp [153.141.42.102]:58399: 535 Incorrect authentication data153.141.42.1021861060ZY  -=+ ossec13001gxqExim Auth failed2025-03-02 20:55:37 dovecot_plain authenticator failed for ([211.238.237.254]) [211.238.237.254]:52509: 535 Incorrect authentication data (set_id=sales)211.238.237.2541835841cX  -U% ossec13001gxqExim Auth failed2025-03-02 20:55:37 dovecot_plain authenticator failed for 111-70-32-47.emome-ip.hinet.net [111.70.32.47]:44755: 535 Incorrect authentication data (set_id=services)111.70.32.471668284iW  -]) ossec13001gxeExim Auth failed2025-03-02 20:55:24 dovecot_plain authenticator failed for ([114.250.93.159]) [114.250.93.159]:6049: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)114.250.93.1591814991jV  -a' ossec13001gxSExim Auth failed2025-03-02 20:55:06 dovecot_plain authenticator failed for ([183.47.48.178]) [183.47.48.178]:53505: 535 Incorrect authentication data (set_id=services@heipowersystem.com)183.47.48.1781814991pU  -k) ossec13001gxExim Auth failed2025-03-02 20:54:06 dovecot_login authenticator failed for ([58.222.226.190]) [58.222.226.190]:38089: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)58.222.226.1901814991]T  -G) ossec13001gwExim Auth failed2025-03-02 20:53:04 dovecot_login authenticator failed for (88-223-193-232.init.lt) [88.223.193.232]:48050: 535 Incorrect authentication data (set_id=bo_msk)88.223.193.232597427yS  -' ossec13001gwExim Auth failed2025-03-02 20:52:35 dovecot_login authenticator failed for (160.72.153.14.lightower.net) [160.72.153.14]:51725: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)160.72.153.146252001WR  -;' ossec13001gvExim Auth failed2025-03-02 20:49:15 dovecot_plain authenticator failed for ([111.48.214.96]) [111.48.214.96]:64092: 535 Incorrect authentication data (set_id=services)111.48.214.961814991  ? W l Q`js  -c% ossec13001gExim Auth failed2025-03-02 21:27:00 dovecot_login authenticator failed for ([1.224.58.243]) [1.224.58.243]:53404: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)1.224.58.2431835841rr  -s% ossec13001gExim Auth failed2025-03-02 21:26:33 dovecot_plain authenticator failed for ool-4a5ad51c.dyn.optonline.net [74.90.213.28]:52764: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)74.90.213.286252001yq  -}) ossec13001gExim Auth failed2025-03-02 21:26:27 dovecot_plain authenticator failed for 110-25-105-223.adsl.fetnet.net [110.25.105.223]:40691: 535 Incorrect authentication data (set_id=services@heipowersystem.com)110.25.105.2231668284Wp  -;' ossec13001g#Exim Auth failed2025-03-02 21:24:10 dovecot_plain authenticator failed for ([180.129.88.20]) [180.129.88.20]:59228: 535 Incorrect authentication data (set_id=services)180.129.88.201880251mo  -e) ossec13001gExim Auth failed2025-03-02 21:24:00 dovecot_plain authenticator failed for ([186.138.219.91]) [186.138.219.91]:39810: 535 Incorrect authentication data (set_id=services@heipowersystem.com)186.138.219.913865483%n  3Q' ossec11301g~New FTP connection.Mar 2 21:23:11 vm1 pure-ftpd[1546532]: (?@4.246.231.236) [INFO] New connection from 4.246.231.2364.246.231.2366252001nm  -g) ossec13001g~Exim Auth failed2025-03-02 21:22:11 dovecot_login authenticator failed for broadband-188-255-34-171.ip.moscow.rt.ru [188.255.34.171]:58232: 535 Incorrect authentication data (set_id=bo_msk)188.255.34.1712017370sl  -o+ ossec13001g~Exim Auth failed2025-03-02 21:21:43 dovecot_login authenticator failed for ([179.183.114.175]) [179.183.114.175]:41742: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)179.183.114.1753469034jk  -a' ossec13001g~UExim Auth failed2025-03-02 21:20:43 dovecot_plain authenticator failed for ([163.142.186.8]) [163.142.186.8]:47388: 535 Incorrect authentication data (set_id=services@heipowersystem.com)163.142.186.81814991mj  -c+ ossec13001g~9Exim Auth failed2025-03-02 21:20:16 dovecot_plain authenticator failed for ([103.219.154.156]) [103.219.154.156]:40142: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)103.219.154.1562750405Qi  -1% ossec13001g}Exim Auth failed2025-03-02 21:18:07 dovecot_plain authenticator failed for ([95.54.40.239]) [95.54.40.239]:59672: 535 Incorrect authentication data (set_id=sales)95.54.40.2392017370Qh  -3# ossec13001g}Exim Auth failed2025-03-02 21:17:39 dovecot_plain authenticator failed for ([59.12.201.7]) [59.12.201.7]:48982: 535 Incorrect authentication data (set_id=services)59.12.201.71835841gg  -[' ossec13001g}Exim Auth failed2025-03-02 21:17:34 dovecot_plain authenticator failed for ([102.221.64.10]) [102.221.64.10]:56414: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)102.221.64.102413451df  -Y# ossec13001g}Exim Auth failed2025-03-02 21:17:27 dovecot_plain authenticator failed for ([8.209.221.7]) [8.209.221.7]:44710: 535 Incorrect authentication data (set_id=services@heipowersystem.com)8.209.221.71861060We  -9) ossec13001g|Exim Auth failed2025-03-02 21:13:53 dovecot_plain authenticator failed for ([110.49.145.233]) [110.49.145.233]:44560: 535 Incorrect authentication data (set_id=sales)110.49.145.2331605651zd  -% ossec13001g|Exim Auth failed2025-03-02 21:13:12 dovecot_plain authenticator failed for 17.red-88-18-126.staticip.rima-tde.net [88.18.126.17]:45278: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)88.18.126.172510769dc  -W% ossec13001g|Exim Auth failed2025-03-02 21:13:34 dovecot_plain authenticator failed for ([144.48.49.72]) [144.48.49.72]:48064: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)144.48.49.721269750 $- N ` r  (=Lajd  -W% ossec13001gĄExim Auth failed2025-03-02 21:48:54 dovecot_plain authenticator failed for ([59.22.68.213]) [59.22.68.213]:44121: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)59.22.68.2131835841W  -;' ossec13001gĄExim Auth failed2025-03-02 21:48:36 dovecot_plain authenticator failed for ([183.171.146.7]) [183.171.146.7]:56890: 535 Incorrect authentication data (set_id=services)183.171.146.71733045s  -u% ossec13001gĄExim Auth failed2025-03-02 21:48:30 dovecot_plain authenticator failed for 111-70-42-37.emome-ip.hinet.net [111.70.42.37]:46809: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)111.70.42.371668284g  -]% ossec13001gĄExim Auth failed2025-03-02 21:48:24 dovecot_plain authenticator failed for ([1.212.225.99]) [1.212.225.99]:49870: 535 Incorrect authentication data (set_id=services@heipowersystem.com)1.212.225.991835841m  -e) ossec13001gă<Exim Auth failed2025-03-02 21:41:39 dovecot_plain authenticator failed for ([182.191.122.84]) [182.191.122.84]:37626: 535 Incorrect authentication data (set_id=services@heipowersystem.com)182.191.122.841168579g  -[' ossec13001gă2Exim Auth failed2025-03-02 21:41:29 dovecot_plain authenticator failed for ([124.160.45.26]) [124.160.45.26]:47550: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)124.160.45.261814991a~  -S# ossec13001gĂExim Auth failed2025-03-02 21:38:52 dovecot_plain authenticator failed for ([112.94.6.54]) [112.94.6.54]:11396: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)112.94.6.541814991W}  -;' ossec13001gĂExim Auth failed2025-03-02 21:39:37 dovecot_plain authenticator failed for ([24.244.93.239]) [24.244.93.239]:47206: 535 Incorrect authentication data (set_id=services)24.244.93.2396251999g|  -]% ossec13001gĂExim Auth failed2025-03-02 21:39:26 dovecot_plain authenticator failed for ([220.81.9.218]) [220.81.9.218]:32940: 535 Incorrect authentication data (set_id=services@heipowersystem.com)220.81.9.2181835841i{  -]) ossec13001gĂExim Auth failed2025-03-02 21:39:04 dovecot_plain authenticator failed for syn-075-191-221-158.res.spectrum.com [75.191.221.158]:52563: 535 Incorrect authentication data (set_id=sales)75.191.221.1586252001Sz  -7% ossec13001gāExim Auth failed2025-03-02 21:34:58 dovecot_plain authenticator failed for ([95.173.2.140]) [95.173.2.140]:55912: 535 Incorrect authentication data (set_id=services)95.173.2.140298795Wy  -9) ossec13001gāExim Auth failed2025-03-02 21:34:33 dovecot_plain authenticator failed for ([74.196.184.120]) [74.196.184.120]:58380: 535 Incorrect authentication data (set_id=sales)74.196.184.1206252001jx  -a' ossec13001gāExim Auth failed2025-03-02 21:34:30 dovecot_plain authenticator failed for ([14.53.126.112]) [14.53.126.112]:34728: 535 Incorrect authentication data (set_id=services@heipowersystem.com)14.53.126.1121835841jw  -_) ossec13001gāExim Auth failed2025-03-02 21:34:17 dovecot_plain authenticator failed for ([39.129.133.184]) [39.129.133.184]:33718: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)39.129.133.1841814991[v  -?+ ossec13001gāExim Auth failed2025-03-02 21:32:07 dovecot_login authenticator failed for ([178.178.194.192]) [178.178.194.192]:51818: 535 Incorrect authentication data (set_id=bo_msk)178.178.194.1922017370su  -o+ ossec13001gĀExim Auth failed2025-03-02 21:31:57 dovecot_login authenticator failed for ([221.149.233.245]) [221.149.233.245]:37871: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)221.149.233.2451835841Xt  -;) ossec13001gExim Auth failed2025-03-02 21:27:31 dovecot_login authenticator failed for ([222.119.124.66]) [222.119.124.66]:55014: 535 Incorrect authentication data (set_id=bo_msk)222.119.124.661835841 m E I U m y#HmW  -;' ossec13001gĊExim Auth failed2025-03-02 22:13:16 dovecot_plain authenticator failed for ([49.124.151.21]) [49.124.151.21]:56606: 535 Incorrect authentication data (set_id=services)49.124.151.211733045W  -9) ossec13001gĊExim Auth failed2025-03-02 22:12:53 dovecot_plain authenticator failed for ([152.42.211.235]) [152.42.211.235]:45172: 535 Incorrect authentication data (set_id=sales)152.42.211.2351880251g  -[' ossec13001gĊExim Auth failed2025-03-02 22:12:41 dovecot_plain authenticator failed for ([218.108.45.83]) [218.108.45.83]:41249: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)218.108.45.831814991j  -a' ossec13001gĊExim Auth failed2025-03-02 22:12:47 dovecot_plain authenticator failed for ([181.197.38.12]) [181.197.38.12]:45674: 535 Incorrect authentication data (set_id=services@heipowersystem.com)181.197.38.123703430R  -3% ossec13001gĉExim Auth failed2025-03-02 22:09:01 dovecot_login authenticator failed for ([38.74.201.90]) [38.74.201.90]:55387: 535 Incorrect authentication data (set_id=bo_msk)38.74.201.906252001m  -g' ossec13001gĉExim Auth failed2025-03-02 22:08:50 dovecot_login authenticator failed for ([106.227.87.29]) [106.227.87.29]:34152: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)106.227.87.291814991  - ) ossec13001gĉFExim Auth failed2025-03-02 22:07:25 dovecot_plain authenticator failed for cm-110-171-21-108.revip7.asianet.co.th [110.171.21.108]:41067: 535 Incorrect authentication data (set_id=services@heipowersystem.com)110.171.21.1081605651g  -[' ossec13001gĉ@Exim Auth failed2025-03-02 22:07:19 dovecot_plain authenticator failed for ([119.207.83.89]) [119.207.83.89]:36764: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)119.207.83.891835841d  -W% ossec13001gćExim Auth failed2025-03-02 22:00:12 dovecot_plain authenticator failed for ([59.34.17.130]) [59.34.17.130]:51354: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)59.34.17.1301814991Z  -?) ossec13001gćExim Auth failed2025-03-02 22:00:05 dovecot_plain authenticator failed for ([119.200.229.33]) [119.200.229.33]:58199: 535 Incorrect authentication data (set_id=services)119.200.229.331835841p  -i+ ossec13001gćExim Auth failed2025-03-02 21:59:54 dovecot_plain authenticator failed for ([121.152.119.174]) [121.152.119.174]:41868: 535 Incorrect authentication data (set_id=services@heipowersystem.com)121.152.119.1741835841d  -Y# ossec13001gĆuExim Auth failed2025-03-02 21:55:24 dovecot_login authenticator failed for 18.red-83-48-39.staticip.rima-tde.net [83.48.39.18]:7326: 535 Incorrect authentication data (set_id=bo_msk)83.48.39.182510769p  -k) ossec13001gĆmExim Auth failed2025-03-02 21:55:16 dovecot_login authenticator failed for ([171.217.70.151]) [171.217.70.151]:51898: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)171.217.70.1511814991x  -{) ossec13001gĆaExim Auth failed2025-03-02 21:55:03 dovecot_login authenticator failed for (clientes.redenilf.com.br) [200.225.120.32]:39681: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)200.225.120.323469034W  -9) ossec13001gąExim Auth failed2025-03-02 21:52:05 dovecot_plain authenticator failed for ([191.210.87.101]) [191.210.87.101]:36640: 535 Incorrect authentication data (set_id=sales)191.210.87.1013469034u  -y% ossec13001gąExim Auth failed2025-03-02 21:51:47 dovecot_plain authenticator failed for 89-109-4-133.dynamic.mts-nn.ru [89.109.4.133]:42862: 535 Incorrect authentication data (set_id=services@heipowersystem.com)89.109.4.1332017370c  -W% ossec13001gąExim Auth failed2025-03-02 21:51:46 dovecot_plain authenticator failed for ([20.46.45.121]) [20.46.45.121]:53809: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)20.46.45.121290557 ? 7 L G P t },?i&  -]) ossec13001gĐ!Exim Auth failed2025-03-02 22:36:41 dovecot_plain authenticator failed for syn-035-130-133-206.biz.spectrum.com [35.130.133.206]:57975: 535 Incorrect authentication data (set_id=sales)35.130.133.2066252001m%  -c+ ossec13001gĐExim Auth failed2025-03-02 22:36:29 dovecot_plain authenticator failed for ([119.206.117.105]) [119.206.117.105]:39580: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)119.206.117.1051835841`$  -U! ossec13001gďExim Auth failed2025-03-02 22:36:07 dovecot_plain authenticator failed for ([149.0.16.4]) [149.0.16.4]:50864: 535 Incorrect authentication data (set_id=services@heipowersystem.com)149.0.16.4298795r#  -q' ossec13001gďExim Auth failed2025-03-02 22:34:59 dovecot_plain authenticator failed for ([220.92.25.189]) [220.92.25.189]:50879: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)220.92.25.1891835841\"  -A+ ossec13001gďExim Auth failed2025-03-02 22:32:14 dovecot_plain authenticator failed for ([181.174.200.138]) [181.174.200.138]:1606: 535 Incorrect authentication data (set_id=services)181.174.200.1383865483i!  -_) ossec13001gď Exim Auth failed2025-03-02 22:32:01 dovecot_plain authenticator failed for ([87.236.141.106]) [87.236.141.106]:59052: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)87.236.141.106290291m  -e) ossec13001gďExim Auth failed2025-03-02 22:31:55 dovecot_plain authenticator failed for ([124.155.205.64]) [124.155.205.64]:33616: 535 Incorrect authentication data (set_id=services@heipowersystem.com)124.155.205.641880251j  -a' ossec13001gčExim Auth failed2025-03-02 22:26:19 dovecot_plain authenticator failed for ([142.79.232.38]) [142.79.232.38]:54278: 535 Incorrect authentication data (set_id=services@heipowersystem.com)142.79.232.381269750j  -_) ossec13001gčExim Auth failed2025-03-02 22:25:48 dovecot_plain authenticator failed for ([203.129.206.14]) [203.129.206.14]:53052: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)203.129.206.141269750h  -[) ossec13001gčoExim Auth failed2025-03-02 22:25:09 dovecot_login authenticator failed for (94.124.156.175.unknown.m1.com.sg) [175.156.124.94]:40194: 535 Incorrect authentication data (set_id=bo_msk)175.156.124.941880251s  -o+ ossec13001gčWExim Auth failed2025-03-02 22:24:46 dovecot_login authenticator failed for ([123.209.117.171]) [123.209.117.171]:57788: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)123.209.117.1712077456X  -;) ossec13001gčExim Auth failed2025-03-02 22:23:24 dovecot_login authenticator failed for ([213.255.219.43]) [213.255.219.43]:41567: 535 Incorrect authentication data (set_id=bo_msk)213.255.219.432782113s  -o+ ossec13001gČExim Auth failed2025-03-02 22:23:15 dovecot_login authenticator failed for ([181.174.200.138]) [181.174.200.138]:30072: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)181.174.200.1383865483  -' ossec13001gČiExim Auth failed2025-03-02 22:20:48 dovecot_plain authenticator failed for host-88-43-231-186.business.telecomitalia.it ([88.43.231.188]) [88.43.231.186]:43688: 535 Incorrect authentication data (set_id=sales)88.43.231.1863175395g  -[' ossec13001gČ^Exim Auth failed2025-03-02 22:20:38 dovecot_plain authenticator failed for ([116.88.187.44]) [116.88.187.44]:38108: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)116.88.187.441880251Q  -3# ossec13001gČXExim Auth failed2025-03-02 22:20:32 dovecot_plain authenticator failed for ([61.6.225.90]) [61.6.225.90]:35710: 535 Incorrect authentication data (set_id=services)61.6.225.901820814p  -i+ ossec13001gČNExim Auth failed2025-03-02 22:20:22 dovecot_plain authenticator failed for ([123.209.117.171]) [123.209.117.171]:45886: 535 Incorrect authentication data (set_id=services@heipowersystem.com)123.209.117.1712077456   1 Y W [a6  -U! ossec13001gēDExim Auth failed2025-03-02 22:50:03 dovecot_login authenticator failed for ([1.25.18.18]) [1.25.18.18]:49218: 535 Incorrect authentication data (set_id=services@heipowersystem.com)1.25.18.181814991x5  -}' ossec13001gē*Exim Auth failed2025-03-02 22:49:37 dovecot_plain authenticator failed for 24-220-250-67-dynamic.midco.net [24.220.250.67]:49076: 535 Incorrect authentication data (set_id=services@heipowersystem.com)24.220.250.676252001_4  -M% ossec13001gē"Exim Auth failed2025-03-02 22:49:30 dovecot_plain authenticator failed for 89-109-4-133.dynamic.mts-nn.ru [89.109.4.133]:59252: 535 Incorrect authentication data (set_id=sales)89.109.4.1332017370m3  -c+ ossec13001gēExim Auth failed2025-03-02 22:49:04 dovecot_plain authenticator failed for ([190.121.193.126]) [190.121.193.126]:52378: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)190.121.193.1263595528X2  -;) ossec13001gĒExim Auth failed2025-03-02 22:48:07 dovecot_login authenticator failed for ([191.210.87.101]) [191.210.87.101]:33352: 535 Incorrect authentication data (set_id=bo_msk)191.210.87.10134690341  -% ossec13001gĒExim Auth failed2025-03-02 22:47:47 dovecot_login authenticator failed for (nsg-static-174.125.76.182-airtel.com) [182.76.87.90]:51446: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)182.76.87.901269750}0  -' ossec13001gĒExim Auth failed2025-03-02 22:47:38 dovecot_login authenticator failed for b217-29-190-97.pppoe.mark-itt.net [217.29.190.97]:53204: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)217.29.190.972017370h/  -]' ossec13001gĒ4Exim Auth failed2025-03-02 22:45:31 dovecot_plain authenticator failed for 90-230-168-26-no600.tbcn.telia.com [90.230.168.26]:58560: 535 Incorrect authentication data (set_id=services)90.230.168.262661886T.  -5' ossec13001gĒ2Exim Auth failed2025-03-02 22:45:29 dovecot_plain authenticator failed for ([194.33.87.111]) [194.33.87.111]:56380: 535 Incorrect authentication data (set_id=sales)194.33.87.1112017370x-  -% ossec13001gĒExim Auth failed2025-03-02 22:45:05 dovecot_plain authenticator failed for 95-30-217-31.broadband.corbina.ru [95.30.217.31]:59538: 535 Incorrect authentication data (set_id=services@heipowersystem.com)95.30.217.312017370~,  -) ossec13001gĒExim Auth failed2025-03-02 22:44:45 dovecot_plain authenticator failed for (107-175-76-146-host.colocrossing.com) [107.175.76.146]:49388: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)107.175.76.1466252001T+  -5' ossec13001gđ`Exim Auth failed2025-03-02 22:41:59 dovecot_plain authenticator failed for ([211.109.75.66]) [211.109.75.69]:49870: 535 Incorrect authentication data (set_id=sales)211.109.75.691835841d*  -W% ossec13001gđTExim Auth failed2025-03-02 22:41:46 dovecot_plain authenticator failed for ([202.84.34.85]) [202.84.34.85]:45260: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)202.84.34.851210997t)  -w% ossec13001gđPExim Auth failed2025-03-02 22:41:42 dovecot_plain authenticator failed for 61-216-7-163.hinet-ip.hinet.net ([61.216.7.165]) [61.216.7.163]:51600: 535 Incorrect authentication data (set_id=services)61.216.7.1631668284}(  -' ossec13001gđ>Exim Auth failed2025-03-02 22:41:25 dovecot_plain authenticator failed for syn-045-049-179-157.res.spectrum.com [45.49.179.157]:41871: 535 Incorrect authentication data (set_id=services@heipowersystem.com)45.49.179.1576252001j'  -_) ossec13001gđ8Exim Auth failed2025-03-02 22:41:18 dovecot_plain authenticator failed for ([168.126.90.210]) [168.126.90.210]:58904: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)168.126.90.2101835841 5": \ ~ k } g5^G  -I' ossec13001gėExim Auth failed2025-03-02 23:06:30 dovecot_plain authenticator failed for vps-926fddc5.vps.ovh.net [79.137.82.102]:39096: 535 Incorrect authentication data (set_id=services)79.137.82.1023017382F  - ) ossec13001gėExim Auth failed2025-03-02 23:06:21 dovecot_plain authenticator failed for net-188-152-225-58.cust.vodafonedsl.it [188.152.225.58]:40473: 535 Incorrect authentication data (set_id=services@heipowersystem.com)188.152.225.583175395dE  -W% ossec13001gė Exim Auth failed2025-03-02 23:06:11 dovecot_plain authenticator failed for ([27.124.18.19]) [27.124.18.27]:49726: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)27.124.18.271269750XD  -;) ossec13001gĖExim Auth failed2025-03-02 23:05:10 dovecot_login authenticator failed for ([61.150.123.106]) [61.150.123.106]:38183: 535 Incorrect authentication data (set_id=bo_msk)61.150.123.1061814991pC  -k) ossec13001gĖExim Auth failed2025-03-02 23:04:52 dovecot_login authenticator failed for ([114.250.93.159]) [114.250.93.159]:61019: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)114.250.93.1591814991gB  -]% ossec13001gĕ2Exim Auth failed2025-03-02 22:58:18 dovecot_plain authenticator failed for ([14.37.206.76]) [14.37.206.76]:39189: 535 Incorrect authentication data (set_id=services@heipowersystem.com)14.37.206.761835841QA  -3% ossec13001gĕ-Exim Auth failed2025-03-02 22:58:11 dovecot_login authenticator failed for ([194.28.91.40]) [194.28.91.40]:48568: 535 Incorrect authentication data (set_id=bo_msk)194.28.91.40690791t@  -s) ossec13001gĕ'Exim Auth failed2025-03-02 22:58:06 dovecot_plain authenticator failed for 70.sub-166-155-210.myvzw.com [166.155.210.70]:50952: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)166.155.210.706252001|?  -' ossec13001gĕExim Auth failed2025-03-02 22:57:30 dovecot_login authenticator failed for 111-70-25-206.emome-ip.hinet.net [111.70.25.206]:37967: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)111.70.25.2061668284W>  -;' ossec13001gĔExim Auth failed2025-03-02 22:55:55 dovecot_plain authenticator failed for ([223.171.55.59]) [223.171.55.59]:35878: 535 Incorrect authentication data (set_id=services)223.171.55.591835841=  --+ ossec13001gĔExim Auth failed2025-03-02 22:55:45 dovecot_plain authenticator failed for static-200-105-141-170.acelerate.net ([200.105.141.161]) [200.105.141.170]:49092: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)200.105.141.1703923057j<  -a' ossec13001gĔExim Auth failed2025-03-02 22:55:38 dovecot_plain authenticator failed for ([58.18.212.238]) [58.18.212.238]:46270: 535 Incorrect authentication data (set_id=services@heipowersystem.com)58.18.212.2381814991;  -)) ossec13001gēExim Auth failed2025-03-02 22:51:56 dovecot_plain authenticator failed for ip-179.48.229.117.fiberlinkpe.net.br ([179.48.229.118]) [179.48.229.117]:34574: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)179.48.229.1173469034Z:  -?) ossec13001gēExim Auth failed2025-03-02 22:52:33 dovecot_plain authenticator failed for ([60.171.237.143]) [60.171.237.143]:40984: 535 Incorrect authentication data (set_id=services)60.171.237.1431814991Z9  -=+ ossec13001gēExim Auth failed2025-03-02 22:52:17 dovecot_plain authenticator failed for ([125.140.244.144]) [125.140.244.144]:57870: 535 Incorrect authentication data (set_id=sales)125.140.244.1441835841d8  -Y# ossec13001gēExim Auth failed2025-03-02 22:52:05 dovecot_plain authenticator failed for ([70.90.99.29]) [70.90.99.29]:32978: 535 Incorrect authentication data (set_id=services@heipowersystem.com)70.90.99.296252001Z7  -?) ossec13001gēhExim Auth failed2025-03-02 22:50:39 dovecot_login authenticator failed for ([175.205.191.27]) [175.205.191.27]:50214: 535 Incorrect authentication data (set_id=services)175.205.191.271835841 %y (OUnviX  -]) ossec13001gĚExim Auth failed2025-03-02 23:22:06 dovecot_plain authenticator failed for syn-035-130-133-206.biz.spectrum.com [35.130.133.206]:59567: 535 Incorrect authentication data (set_id=sales)35.130.133.2066252001tW  -q+ ossec13001gĚExim Auth failed2025-03-02 23:21:54 dovecot_plain authenticator failed for (448990.cloudwaysapps.com) [128.199.118.234]:32284: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)128.199.118.2341880251cV  -S' ossec13001gęExim Auth failed2025-03-02 23:18:37 dovecot_plain authenticator failed for ([58.57.154.146]) [58.57.154.146]:51120: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)58.57.154.1461814991vU  -y' ossec13001gęExim Auth failed2025-03-02 23:18:15 dovecot_plain authenticator failed for ([120.24.83.156]) [223.104.199.0]:62467: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)223.104.199.01814991UT  -7' ossec13001gęRExim Auth failed2025-03-02 23:15:53 dovecot_login authenticator failed for ([112.196.60.13]) [112.196.60.13]:49022: 535 Incorrect authentication data (set_id=bo_msk)112.196.60.131269750sS  -o+ ossec13001gę>Exim Auth failed2025-03-02 23:15:33 dovecot_login authenticator failed for ([222.112.246.217]) [222.112.246.217]:40211: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)222.112.246.2171835841TR  -5' ossec13001gę*Exim Auth failed2025-03-02 23:15:13 dovecot_plain authenticator failed for ([14.48.227.118]) [14.48.227.118]:38349: 535 Incorrect authentication data (set_id=sales)14.48.227.1181835841mQ  -c+ ossec13001gę Exim Auth failed2025-03-02 23:15:02 dovecot_plain authenticator failed for ([123.209.117.171]) [123.209.117.171]:53402: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)123.209.117.1712077456ZP  -=+ ossec13001gĘExim Auth failed2025-03-02 23:13:38 dovecot_plain authenticator failed for ([194.226.155.198]) [194.226.155.198]:55324: 535 Incorrect authentication data (set_id=sales)194.226.155.1982017370pO  -k) ossec13001gĘExim Auth failed2025-03-02 23:13:38 dovecot_plain authenticator failed for broadband-188-255-34-171.ip.moscow.rt.ru [188.255.34.171]:58402: 535 Incorrect authentication data (set_id=services)188.255.34.1712017370jN  -_) ossec13001gĘExim Auth failed2025-03-02 23:13:23 dovecot_plain authenticator failed for ([49.205.177.146]) [223.239.159.21]:52256: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)223.239.159.211269750}M  - % ossec13001gĘExim Auth failed2025-03-02 23:13:06 dovecot_plain authenticator failed for broadband-188-32-68-79.ip.moscow.rt.ru [188.32.68.79]:40312: 535 Incorrect authentication data (set_id=services@heipowersystem.com)188.32.68.792017370fL  -W) ossec13001gĘExim Auth failed2025-03-02 23:12:24 dovecot_plain authenticator failed for (host-185-26-197-131.net4life.it) [185.26.197.131]:53644: 535 Incorrect authentication data (set_id=sales)185.26.197.1313175395uK  -y% ossec13001gĘwExim Auth failed2025-03-02 23:12:14 dovecot_plain authenticator failed for 95-30-217-31.broadband.corbina.ru [95.30.217.31]:59582: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)95.30.217.312017370iJ  -a' ossec13001gĘ3Exim Auth failed2025-03-02 23:11:06 dovecot_plain authenticator failed for ([94.204.78.117]) [94.204.78.117]:35854: 535 Incorrect authentication data (set_id=services@heipowersystem.com)94.204.78.117290557(I  3U) ossec11301gėiNew FTP connection.Mar 2 23:07:44 vm1 pure-ftpd[1567595]: (?@147.185.132.84) [INFO] New connection from 147.185.132.84147.185.132.846252001WH  -9) ossec13001gė+Exim Auth failed2025-03-02 23:06:42 dovecot_plain authenticator failed for ([95.165.217.194]) [95.165.217.194]:55026: 535 Incorrect authentication data (set_id=sales)95.165.217.1942017370  9 K Z c o h  -=) ossec13001gĠExim Auth failed2025-03-02 23:47:55 dovecot_login authenticator failed for (pardes-hana-hotnet145-arris1-213-57-214-111.hotnet.net.il) [213.57.214.111]:59538: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)213.57.214.111294640Wg  -;' ossec13001gĠExim Auth failed2025-03-02 23:47:08 dovecot_plain authenticator failed for ([121.157.28.10]) [121.157.28.10]:39103: 535 Incorrect authentication data (set_id=services)121.157.28.101835841of  -g+ ossec13001gĠExim Auth failed2025-03-02 23:46:34 dovecot_plain authenticator failed for ([171.244.142.135]) [171.244.142.135]:5797: 535 Incorrect authentication data (set_id=services@heipowersystem.com)171.244.142.1351562822je  -_) ossec13001gĠExim Auth failed2025-03-02 23:46:47 dovecot_plain authenticator failed for ([187.76.173.246]) [187.76.173.246]:37855: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)187.76.173.2463469034kd  -c' ossec13001gğ!Exim Auth failed2025-03-02 23:40:41 dovecot_login authenticator failed for broadband-46-242-66-149.ip.moscow.rt.ru [46.242.66.149]:54940: 535 Incorrect authentication data (set_id=bo_msk)46.242.66.1492017370mc  -g' ossec13001gğExim Auth failed2025-03-02 23:40:31 dovecot_login authenticator failed for ([49.124.151.64]) [49.124.151.64]:37924: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)49.124.151.641733045Zb  -=+ ossec13001gĞExim Auth failed2025-03-02 23:39:03 dovecot_plain authenticator failed for ([183.109.195.179]) [183.109.195.179]:34956: 535 Incorrect authentication data (set_id=sales)183.109.195.1791835841va  -y' ossec13001gĞExim Auth failed2025-03-02 23:38:51 dovecot_plain authenticator failed for 216.106.67.50.reverse.socket.net [216.106.67.50]:55414: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)216.106.67.506252001l`  -g% ossec13001gĝOExim Auth failed2025-03-02 23:32:53 dovecot_login authenticator failed for (189-44-2-250.customer.tdatabrasil.net.br) [189.44.2.250]:45449: 535 Incorrect authentication data (set_id=bo_msk)189.44.2.2503469034p_  -k) ossec13001gĝAExim Auth failed2025-03-02 23:32:40 dovecot_login authenticator failed for ([87.225.108.138]) [87.225.108.138]:50536: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)87.225.108.1382017370s^  -w# ossec13001gĝExim Auth failed2025-03-02 23:32:00 dovecot_plain authenticator failed for 37.151.71.8.dynamic.telecom.kz [37.151.71.8]:55039: 535 Incorrect authentication data (set_id=services@heipowersystem.com)37.151.71.81522867m]  -c+ ossec13001gĜExim Auth failed2025-03-02 23:31:21 dovecot_plain authenticator failed for ([115.144.115.150]) [115.144.115.150]:57834: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)115.144.115.1501835841j\  -c% ossec13001gĜExim Auth failed2025-03-02 23:31:15 dovecot_login authenticator failed for ([90.173.78.90]) [90.173.78.90]:48146: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)90.173.78.902510769Z[  -=+ ossec13001gĜExim Auth failed2025-03-02 23:31:32 dovecot_plain authenticator failed for ([128.185.246.150]) [128.185.246.150]:51238: 535 Incorrect authentication data (set_id=sales)128.185.246.1501269750tZ  -w% ossec13001gĜExim Auth failed2025-03-02 23:31:29 dovecot_login authenticator failed for 128.16.3.213.static.wline.lns.sme.cust.swisscom.ch [213.3.16.128]:47963: 535 Incorrect authentication data (set_id=bo_msk)213.3.16.1282658434mY  -e) ossec13001gĚExim Auth failed2025-03-02 23:22:23 dovecot_plain authenticator failed for ([27.128.162.146]) [27.128.162.146]:53330: 535 Incorrect authentication data (set_id=services@heipowersystem.com)27.128.162.1461814991   / W o $<Lq`y  -Q# ossec13001gĤExim Auth failed2025-03-03 00:04:39 dovecot_plain authenticator failed for 37.151.71.8.dynamic.telecom.kz [37.151.71.8]:53062: 535 Incorrect authentication data (set_id=services)37.151.71.81522867Wx  -9) ossec13001gĤExim Auth failed2025-03-03 00:04:14 dovecot_plain authenticator failed for ([61.191.163.102]) [61.191.163.102]:53978: 535 Incorrect authentication data (set_id=sales)61.191.163.1021814991lw  -e) ossec13001gĤExim Auth failed2025-03-03 00:04:08 dovecot_plain authenticator failed for ([82.102.165.200]) [82.102.165.200]:39438: 535 Incorrect authentication data (set_id=services@heipowersystem.com)82.102.165.200294640dv  -W% ossec13001gĤExim Auth failed2025-03-03 00:04:01 dovecot_plain authenticator failed for ([182.76.71.82]) [182.76.71.82]:45702: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)182.76.71.821269750gu  -[' ossec13001gĤfExim Auth failed2025-03-03 00:03:09 dovecot_login authenticator failed for (nyaystambh.com) [221.229.216.1]:53098: 535 Incorrect authentication data (set_id=postmaster@nyaystambh.com)221.229.216.11814991ft  -Y' ossec13001gĤZExim Auth failed2025-03-03 00:02:58 dovecot_login authenticator failed for 90-230-168-26-no600.tbcn.telia.com [90.230.168.26]:33310: 535 Incorrect authentication data (set_id=bo_msk)90.230.168.262661886Us  -7' ossec13001gĤLExim Auth failed2025-03-03 00:02:43 dovecot_login authenticator failed for (nyaystambh.com) [221.229.216.1]:49862: 535 Incorrect authentication data (set_id=nologin)221.229.216.11814991mr  -g' ossec13001gĤBExim Auth failed2025-03-03 00:02:34 dovecot_login authenticator failed for ([58.234.165.73]) [58.234.165.73]:52000: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)58.234.165.731835841Wq  -;' ossec13001gģExim Auth failed2025-03-02 23:59:21 dovecot_plain authenticator failed for ([116.86.62.245]) [116.86.62.245]:38058: 535 Incorrect authentication data (set_id=services)116.86.62.2451880251gp  -]% ossec13001gģrExim Auth failed2025-03-02 23:59:06 dovecot_plain authenticator failed for ([14.35.218.58]) [14.35.218.58]:37586: 535 Incorrect authentication data (set_id=services@heipowersystem.com)14.35.218.581835841bo  -Q' ossec13001gģpExim Auth failed2025-03-02 23:59:03 dovecot_plain authenticator failed for 42-200-70-134.static.imsbiz.com [42.200.70.134]:38266: 535 Incorrect authentication data (set_id=sales)42.200.70.1341819730dn  -W% ossec13001gģfExim Auth failed2025-03-02 23:58:53 dovecot_plain authenticator failed for ([110.14.68.11]) [110.14.68.11]:45902: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)110.14.68.111835841Tm  -5' ossec13001gĢExim Auth failed2025-03-02 23:53:12 dovecot_plain authenticator failed for ([43.139.182.85]) [43.139.182.85]:57766: 535 Incorrect authentication data (set_id=sales)43.139.182.851814991]l  -C+ ossec13001gĢExim Auth failed2025-03-02 23:53:01 dovecot_plain authenticator failed for ([118.220.149.129]) [118.220.149.129]:38858: 535 Incorrect authentication data (set_id=services)118.220.149.1291835841zk  -) ossec13001gġExim Auth failed2025-03-02 23:52:52 dovecot_plain authenticator failed for (177-94-206-187.dsl.telesp.net.br) [177.94.206.187]:34224: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)177.94.206.1873469034j  -' ossec13001gġExim Auth failed2025-03-02 23:52:49 dovecot_plain authenticator failed for pool-99-251-252-98.cpe.net.cable.rogers.com [99.251.252.98]:36046: 535 Incorrect authentication data (set_id=services@heipowersystem.com)99.251.252.986251999fi  -U+ ossec13001gĠExim Auth failed2025-03-02 23:48:26 dovecot_login authenticator failed for p243194-obmd01.tokyo.ocn.ne.jp [153.141.152.194]:40343: 535 Incorrect authentication data (set_id=bo_msk)153.141.152.1941861060 vz { )zW  -;' ossec13001gĨExim Auth failed2025-03-03 00:21:27 dovecot_plain authenticator failed for ([223.171.55.59]) [223.171.55.59]:41086: 535 Incorrect authentication data (set_id=services)223.171.55.591835841m  -e) ossec13001gĨExim Auth failed2025-03-03 00:21:03 dovecot_plain authenticator failed for ([207.219.221.53]) [207.219.221.53]:45974: 535 Incorrect authentication data (set_id=services@heipowersystem.com)207.219.221.536251999g  -[' ossec13001gĨExim Auth failed2025-03-03 00:20:58 dovecot_plain authenticator failed for ([1.244.246.221]) [1.244.246.221]:59784: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)1.244.246.2211835841x  -}' ossec13001għExim Auth failed2025-03-03 00:17:14 dovecot_plain authenticator failed for 124-11-130-37.static.tfn.net.tw [124.11.130.37]:60806: 535 Incorrect authentication data (set_id=services@heipowersystem.com)124.11.130.371668284W  -9) ossec13001għExim Auth failed2025-03-03 00:16:55 dovecot_plain authenticator failed for ([175.214.52.214]) [175.214.52.214]:23549: 535 Incorrect authentication data (set_id=sales)175.214.52.2141835841j  -_) ossec13001għExim Auth failed2025-03-03 00:16:38 dovecot_plain authenticator failed for ([220.178.246.43]) [220.178.246.43]:50535: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)220.178.246.431814991+  3Y+ ossec11301għ_New FTP connection.Mar 3 00:15:49 vm1 pure-ftpd[1582431]: (?@173.255.221.189) [INFO] New connection from 173.255.221.189173.255.221.1896252001m  -c+ ossec13001għ[Exim Auth failed2025-03-03 00:15:46 dovecot_login authenticator failed for 165.199.148.122.sta.wbroadband.net.au [122.148.199.165]:33961: 535 Incorrect authentication data (set_id=bo_msk)122.148.199.1652077456i  -c% ossec13001għMExim Auth failed2025-03-03 00:15:31 dovecot_login authenticator failed for ([94.204.90.91]) [94.204.90.91]:51719: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)94.204.90.91290557W  -;' ossec13001gĦExim Auth failed2025-03-03 00:13:40 dovecot_plain authenticator failed for ([211.109.75.68]) [211.109.75.69]:57692: 535 Incorrect authentication data (set_id=services)211.109.75.691835841a  -S# ossec13001gĦExim Auth failed2025-03-03 00:13:38 dovecot_plain authenticator failed for ([8.209.221.7]) [8.209.221.7]:45406: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)8.209.221.71861060l  -e) ossec13001gĦExim Auth failed2025-03-03 00:13:24 dovecot_plain authenticator failed for ([94.202.156.237]) [94.202.156.237]:59429: 535 Incorrect authentication data (set_id=services@heipowersystem.com)94.202.156.237290557Z~  -?) ossec13001gĦExim Auth failed2025-03-03 00:10:01 dovecot_plain authenticator failed for ([221.146.201.37]) [221.146.201.37]:35575: 535 Incorrect authentication data (set_id=services)221.146.201.371835841b}  -Q' ossec13001gĥExim Auth failed2025-03-03 00:09:42 dovecot_plain authenticator failed for 24-220-250-67-dynamic.midco.net [24.220.250.67]:52542: 535 Incorrect authentication data (set_id=sales)24.220.250.676252001{|  -) ossec13001gĥExim Auth failed2025-03-03 00:09:32 dovecot_plain authenticator failed for (136-34-165-114.googlefiber.net) [136.34.165.114]:36390: 535 Incorrect authentication data (set_id=services@heipowersystem.com)136.34.165.1146252001x{  -}' ossec13001gĥExim Auth failed2025-03-03 00:09:29 dovecot_plain authenticator failed for (109.cpe-186-68-83.gye.satnet.net) [186.68.83.109]:53072: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)186.68.83.1093658394z  ?1 ossec1008gĥProcess exiting (killed).Mar 3 00:05:57 vm1 spamd[1293691]: spamd: server killed by SIGTERM, shutting down P, 6 O a y  %"PN  -/! ossec13001gīBExim Auth failed2025-03-03 00:32:24 dovecot_plain authenticator failed for ([27.0.61.49]) [27.0.61.49]:46610: 535 Incorrect authentication data (set_id=services)27.0.61.491269750  -+ ossec13001gīBExim Auth failed2025-03-03 00:32:24 dovecot_plain authenticator failed for (103.163.200.110.dynamic-mytachyon.in) [103.163.200.110]:2324: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)103.163.200.1101269750d  -W% ossec13001gī2Exim Auth failed2025-03-03 00:32:10 dovecot_plain authenticator failed for ([27.24.141.90]) [27.24.141.90]:34014: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)27.24.141.901814991m  -e) ossec13001gī2Exim Auth failed2025-03-03 00:32:10 dovecot_plain authenticator failed for ([129.21.246.142]) [129.21.246.142]:47084: 535 Incorrect authentication data (set_id=services@heipowersystem.com)129.21.246.1426252001i  -]) ossec13001gĪExim Auth failed2025-03-03 00:30:58 dovecot_plain authenticator failed for 46-162-112-159.cust.bredband2.com [46.162.112.159]:42304: 535 Incorrect authentication data (set_id=services)46.162.112.1592661886j  -a' ossec13001gĪExim Auth failed2025-03-03 00:30:48 dovecot_plain authenticator failed for ([170.250.128.5]) [170.250.128.5]:37952: 535 Incorrect authentication data (set_id=services@heipowersystem.com)170.250.128.56252001T  -7% ossec13001gĪExim Auth failed2025-03-03 00:30:03 dovecot_plain authenticator failed for ([144.48.49.72]) [144.48.49.72]:45393: 535 Incorrect authentication data (set_id=services)144.48.49.721269750c  -S' ossec13001gĪExim Auth failed2025-03-03 00:29:46 dovecot_plain authenticator failed for 216.106.67.50.reverse.socket.net [216.106.67.50]:40180: 535 Incorrect authentication data (set_id=sales)216.106.67.506252001  -) ossec13001gĪExim Auth failed2025-03-03 00:29:34 dovecot_plain authenticator failed for (175-182-64-203.adsl.dynamic.seed.net.tw) [175.182.64.203]:53176: 535 Incorrect authentication data (set_id=services@heipowersystem.com)175.182.64.2031668284j  -_) ossec13001gĪExim Auth failed2025-03-03 00:29:22 dovecot_plain authenticator failed for ([123.209.200.21]) [123.209.200.21]:41600: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)123.209.200.212077456g  -[' ossec13001gĪ Exim Auth failed2025-03-03 00:27:35 dovecot_plain authenticator failed for syn-071-012-241-225.res.spectrum.com [71.12.241.225]:55386: 535 Incorrect authentication data (set_id=sales)71.12.241.2256252001d  -Q+ ossec13001gĪExim Auth failed2025-03-03 00:27:21 dovecot_plain authenticator failed for (126-209-236-109.sv-en.ru) [109.236.209.126]:50952: 535 Incorrect authentication data (set_id=services)109.236.209.1262017370j  -a' ossec13001gĪExim Auth failed2025-03-03 00:27:10 dovecot_plain authenticator failed for ([1.252.204.203]) [1.252.204.203]:57728: 535 Incorrect authentication data (set_id=services@heipowersystem.com)1.252.204.2031835841c  -W% ossec13001gĪExim Auth failed2025-03-03 00:27:08 dovecot_plain authenticator failed for ([5.30.191.129]) [5.30.191.129]:54340: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)5.30.191.129290557r  -u# ossec13001gĩZExim Auth failed2025-03-03 00:24:16 dovecot_plain authenticator failed for (70.246.50.116.ids.service.static.eastern-tele.com) [58.69.17.18]:57664: 535 Incorrect authentication data (set_id=sales)58.69.17.181694008f  -Y' ossec13001gĩPExim Auth failed2025-03-03 00:24:07 dovecot_plain authenticator failed for ([187.218.57.50]) [129.222.65.35]:3071: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)129.222.65.353996063f  -[% ossec13001gĩ5Exim Auth failed2025-03-03 00:23:41 dovecot_plain authenticator failed for ([8.139.253.26]) [8.139.253.26]:9472: 535 Incorrect authentication data (set_id=services@heipowersystem.com)8.139.253.261814991 ] * W R z y##5]T,  -7% ossec13001gĮ3Exim Auth failed2025-03-03 00:44:57 dovecot_plain authenticator failed for ([59.41.197.10]) [59.41.197.10]:47231: 535 Incorrect authentication data (set_id=services)59.41.197.101814991j+  -_) ossec13001gĮ1Exim Auth failed2025-03-03 00:44:55 dovecot_plain authenticator failed for ([112.15.117.200]) [112.15.117.200]:38806: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)112.15.117.2001814991|*  -' ossec13001gĮ#Exim Auth failed2025-03-03 00:44:42 dovecot_plain authenticator failed for c-98-220-97-188.hsd1.il.comcast.net [98.220.97.188]:39362: 535 Incorrect authentication data (set_id=services@heipowersystem.com)98.220.97.1886252001T)  -7% ossec13001gĭFExim Auth failed2025-03-03 00:41:02 dovecot_plain authenticator failed for ([27.124.18.21]) [27.124.18.27]:36846: 535 Incorrect authentication data (set_id=services)27.124.18.271269750f(  -Y' ossec13001gĭ:Exim Auth failed2025-03-03 00:40:49 dovecot_plain authenticator failed for 179-189-85-66.goldnettelecom.com.br [179.189.85.66]:57066: 535 Incorrect authentication data (set_id=sales)179.189.85.663469034p'  -i+ ossec13001gĭ0Exim Auth failed2025-03-03 00:40:40 dovecot_plain authenticator failed for ([103.123.114.215]) [103.123.114.215]:42414: 535 Incorrect authentication data (set_id=services@heipowersystem.com)103.123.114.2151168579v&  -u+ ossec13001gĭ&Exim Auth failed2025-03-03 00:40:30 dovecot_login authenticator failed for (amplifypowerglobal.com) [202.107.197.211]:39060: 535 Incorrect authentication data (set_id=sales@amplifypowerglobal.com)202.107.197.2111814991i%  -_' ossec13001gĭ$Exim Auth failed2025-03-03 00:40:27 dovecot_plain authenticator failed for ([128.185.221.134]) [27.123.81.134]:60366: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)27.123.81.1341269750_$  -I) ossec13001gĭExim Auth failed2025-03-03 00:40:06 dovecot_login authenticator failed for (amplifypowerglobal.com) [124.160.63.122]:36074: 535 Incorrect authentication data (set_id=nologin)124.160.63.1221814991R#  -3% ossec13001gĬExim Auth failed2025-03-03 00:39:17 dovecot_login authenticator failed for ([92.47.46.174]) [92.47.46.174]:34204: 535 Incorrect authentication data (set_id=bo_msk)92.47.46.1741522867}"  -' ossec13001gĬExim Auth failed2025-03-03 00:39:09 dovecot_login authenticator failed for (95.105.66.123.dynamic.ufanet.ru) [95.105.66.123]:37110: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)95.105.66.1232017370T!  -5' ossec13001gĬ>Exim Auth failed2025-03-03 00:36:37 dovecot_login authenticator failed for ([163.30.90.143]) [163.30.90.143]:50732: 535 Incorrect authentication data (set_id=sales)163.30.90.1431668284  -% ossec13001gĬ,Exim Auth failed2025-03-03 00:36:20 dovecot_login authenticator failed for (96-79-249-93-static.hfc.comcastbusiness.net) [96.79.249.93]:47016: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)96.79.249.936252001O  -/# ossec13001gĬ Exim Auth failed2025-03-03 00:35:47 dovecot_login authenticator failed for ([59.0.60.158]) [59.0.60.158]:35400: 535 Incorrect authentication data (set_id=bo_msk)59.0.60.1581835841p  -k) ossec13001gīExim Auth failed2025-03-03 00:35:30 dovecot_login authenticator failed for ([220.178.246.43]) [220.178.246.43]:41944: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)220.178.246.431814991X  -;) ossec13001gīExim Auth failed2025-03-03 00:35:22 dovecot_login authenticator failed for ([123.209.200.21]) [123.209.200.21]:57992: 535 Incorrect authentication data (set_id=bo_msk)123.209.200.212077456  -) ossec13001gīExim Auth failed2025-03-03 00:35:06 dovecot_login authenticator failed for syn-035-130-111-146.biz.spectrum.com [35.130.111.146]:42953: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)35.130.111.1466252001 %8 L d v nwR<  -7% ossec13001gİOExim Auth failed2025-03-03 00:53:58 dovecot_plain authenticator failed for ([46.161.196.5]) [46.161.196.5]:35732: 535 Incorrect authentication data (set_id=services)46.161.196.599237 ;  -%) ossec13001gİCExim Auth failed2025-03-03 00:53:46 dovecot_plain authenticator failed for (ip-103-133.222-205.cloudteknologinusantara.co.id) [125.163.69.149]:35228: 535 Incorrect authentication data (set_id=services@heipowersystem.com)125.163.69.1491643084T:  -5' ossec13001gİ?Exim Auth failed2025-03-03 00:53:42 dovecot_plain authenticator failed for ([50.249.167.45]) [50.249.167.45]:59888: 535 Incorrect authentication data (set_id=sales)50.249.167.456252001w9  -y) ossec13001gİ+Exim Auth failed2025-03-03 00:53:22 dovecot_plain authenticator failed for (207.122.87.116.starhub.net.sg) [116.87.122.207]:52566: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)116.87.122.2071880251p8  -k) ossec13001gįaExim Auth failed2025-03-03 00:50:00 dovecot_login authenticator failed for ([112.168.71.109]) [112.168.71.109]:49156: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)112.168.71.1091835841U7  -7' ossec13001gįwExim Auth failed2025-03-03 00:50:23 dovecot_login authenticator failed for ([154.127.43.35]) [154.127.43.35]:48769: 535 Incorrect authentication data (set_id=bo_msk)154.127.43.352395170T6  -5' ossec13001gįIExim Auth failed2025-03-03 00:49:37 dovecot_plain authenticator failed for ([31.134.243.37]) [31.134.243.37]:44845: 535 Incorrect authentication data (set_id=sales)31.134.243.372017370s5  -u% ossec13001gį-Exim Auth failed2025-03-03 00:49:08 dovecot_plain authenticator failed for 1-34-162-249.hinet-ip.hinet.net [1.34.162.249]:49302: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)1.34.162.2491668284;4  =o+ ossec13008gĮMail Reciepient rejected2025-03-03 00:47:25 H=(mail.gurukuljaipur.com) [165.154.210.114]:61221 F= rejected RCPT : Rejected relay attempt: '165.154.210.114' From: 'yscfbtm@gurukuljaipur.com' To: 'goofile@fastmail.com'165.154.210.1141694008m3  -g' ossec13001gĮExim Auth failed2025-03-03 00:47:14 dovecot_plain authenticator failed for broadband-46-242-66-149.ip.moscow.rt.ru [46.242.66.149]:55188: 535 Incorrect authentication data (set_id=services)46.242.66.1492017370T2  -5' ossec13001gĮExim Auth failed2025-03-03 00:46:54 dovecot_plain authenticator failed for ([31.173.20.146]) [31.173.20.146]:52410: 535 Incorrect authentication data (set_id=sales)31.173.20.1462017370j1  -a' ossec13001gĮExim Auth failed2025-03-03 00:46:48 dovecot_plain authenticator failed for ([220.74.63.183]) [220.74.63.183]:49920: 535 Incorrect authentication data (set_id=services@heipowersystem.com)220.74.63.1831835841d0  -W% ossec13001gĮExim Auth failed2025-03-03 00:46:43 dovecot_plain authenticator failed for ([80.234.36.12]) [80.234.36.12]:37786: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)80.234.36.122017370h/  -_% ossec13001gĮExim Auth failed2025-03-03 00:46:39 dovecot_login authenticator failed for (nsg-static-173.125.76.182-airtel.com) [182.76.87.90]:49348: 535 Incorrect authentication data (set_id=bo_msk)182.76.87.901269750i.  -c% ossec13001gĮExim Auth failed2025-03-03 00:46:28 dovecot_login authenticator failed for ([5.11.164.165]) [5.11.164.165]:38725: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)5.11.164.165298795W-  -9) ossec13001gĮ;Exim Auth failed2025-03-03 00:45:06 dovecot_plain authenticator failed for ([175.214.52.214]) [175.214.52.214]:27785: 535 Incorrect authentication data (set_id=sales)175.214.52.2141835841 *\~tj`VLB8.$zpf\H>4*   v l b X N D : 0 &    ~ t j ` V L B 8 . $    z p f \ R H > 4 *  vlNbXD:0&|rh^T@J6,"xndZPF<2( ~tj`VLB8.$f\zp | r h ^ T J @ 6 , "    x n d Z P F < 2 (   RRH>4*  vlbXND:0& g҆ g҆ gҜ gҐ g gў gѐ gw gц g} gЕ gЉ g{ gu ge gO g? g g g= g3 g- g g g gl gj gR gL gJ g gɼ gɸ gɲ gɰ gɬ g g g g g g gƹ g g g gŻ g g g g g g g, g g g g g g)~ g'} g;| g3{ g3z gy gx gw gv gAu g7t g)s g!r gĿq gĿp gĿso gĿwn gľm gľl gľk gľj gľi gľh gľg gľf gľ#e gľd gľc gĽ`b gĽNa gĽN` gļR_ gļ8^ gļ.] gĻZ\ gĻN[ gĻ8Z gĻ@Y gĺX gĺW gĺV gĺvU gĹT gĺS gĺ R gĸQ gĸP gĸO gĸN gķiM gķ_L gķwK gķkJ gĵI gĵH gĵG gĶF gĵJE gĴ.D gĴC gĴ>B gĴ4A gIJ@ gIJ|? gIJp> gIJn= gİO< gİC; gİ?: gİ+9 gįw7 gįa8 gįI6 gį-5 gĮ4 gĮ3 gĮ2 gĮ1 gĮ0 gĮ/ gĮ. gĮ;- gĮ3, gĮ1+ gĮ#* gĭF) gĭ:( gĭ0' gĭ&& gĭ$% gĭ$ gĬ# gĬ" gĬ>! gĬ, gĬ  gī gī gī gīB gīB gī2 gī2 gĪ gĪ gĪ gĪ gĪ gĪ gĪ  gĪ g g gF g4 g, g  g g g g. g g g g gٷ gٌ gc gc gE ga gW g gֻ gu go ge g g gՄ gp g` gZ g g g gԼ gԮ g( g gX gV gH gD gĪ gĪ gĩZ gĩP gĩ5 gĨ gĨ gĨ għ għ għ għ_ għ[ għM gĦ gĦ gĦ gĦ gĥ gĥ gĥ gĥ gĤ gĤ gĤ gĤ gĤf gĤZ gĤL gĤB gģ gģr gģp gģf gĢ gĢ gġ gġ gĠ gĠ gĠ gĠ g gĠ gğ! gğ gĞ gĞ gĝO gĝA gĝ gĜ gĜ gĜ gĜ gĚ gĚ gĚ gę gę gęR gę> gę* gę  gĘ gĘ gĘ gĘ gĘ gĘw gĘ3 gėi gė+ gė gė gė  gĖ gĖ gĕ2 gĕ- gĕ' gĕ gĔ gĔ gĔ i 8JYuM  -s+ ossec13001gķiExim Auth failed2025-03-03 01:24:15 dovecot_plain authenticator failed for 220-235-212-152.tpgi.com.au [220.235.212.152]:43439: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)220.235.212.1522077456L  - ' ossec13001gķ_Exim Auth failed2025-03-03 01:24:06 dovecot_plain authenticator failed for broadband-95-84-186-218.ip.moscow.rt.ru [95.84.186.218]:57278: 535 Incorrect authentication data (set_id=services@heipowersystem.com)95.84.186.2182017370ZK  -E% ossec13001gķwExim Auth failed2025-03-03 01:24:30 dovecot_plain authenticator failed for 77-85-52-109.ip.btc-net.bg [77.85.52.109]:47726: 535 Incorrect authentication data (set_id=sales)77.85.52.109732800ZJ  -?) ossec13001gķkExim Auth failed2025-03-03 01:24:18 dovecot_plain authenticator failed for ([216.126.67.221]) [216.126.67.221]:41514: 535 Incorrect authentication data (set_id=services)216.126.67.2216251999TI  -7% ossec13001gĵExim Auth failed2025-03-03 01:18:12 dovecot_plain authenticator failed for ([14.37.206.76]) [14.37.206.76]:60829: 535 Incorrect authentication data (set_id=services)14.37.206.761835841mH  -e) ossec13001gĵExim Auth failed2025-03-03 01:18:00 dovecot_plain authenticator failed for ([167.142.198.54]) [167.142.198.54]:60978: 535 Incorrect authentication data (set_id=services@heipowersystem.com)167.142.198.546252001jG  -_) ossec13001gĵExim Auth failed2025-03-03 01:17:55 dovecot_plain authenticator failed for ([166.195.197.38]) [166.195.197.38]:39049: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)166.195.197.386252001TF  -5' ossec13001gĶExim Auth failed2025-03-03 01:18:19 dovecot_plain authenticator failed for ([211.109.75.68]) [211.109.75.69]:52447: 535 Incorrect authentication data (set_id=sales)211.109.75.691835841pE  -k) ossec13001gĵJExim Auth failed2025-03-03 01:15:13 dovecot_login authenticator failed for ([129.21.246.142]) [129.21.246.142]:48152: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)129.21.246.1426252001mD  -e) ossec13001gĴ.Exim Auth failed2025-03-03 01:10:29 dovecot_plain authenticator failed for ([103.115.31.219]) [103.115.31.219]:59340: 535 Incorrect authentication data (set_id=services@heipowersystem.com)103.115.31.2191643084tC  -u' ossec13001gĴExim Auth failed2025-03-03 01:10:08 dovecot_plain authenticator failed for ool-45734cba.dyn.optonline.net [69.115.76.186]:55122: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)69.115.76.1866252001]B  -C+ ossec13001gĴ>Exim Auth failed2025-03-03 01:10:45 dovecot_plain authenticator failed for ([185.235.212.105]) [185.235.212.105]:18354: 535 Incorrect authentication data (set_id=services)185.235.212.1053202326TA  -5' ossec13001gĴ4Exim Auth failed2025-03-03 01:10:36 dovecot_plain authenticator failed for ([59.13.237.163]) [59.13.237.163]:38226: 535 Incorrect authentication data (set_id=sales)59.13.237.1631835841W@  -9) ossec13001gIJExim Auth failed2025-03-03 01:03:27 dovecot_plain authenticator failed for ([222.239.231.61]) [222.239.231.61]:15105: 535 Incorrect authentication data (set_id=sales)222.239.231.611835841d?  -W% ossec13001gIJ|Exim Auth failed2025-03-03 01:03:15 dovecot_plain authenticator failed for ([197.5.144.31]) [197.5.144.31]:50824: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)197.5.144.312464461">  3M% ossec11301gIJpNew FTP connection.Mar 3 01:03:03 vm1 pure-ftpd[1591783]: (?@103.203.59.5) [INFO] New connection from 103.203.59.5103.203.59.51814991m=  -e) ossec13001gIJnExim Auth failed2025-03-03 01:03:01 dovecot_plain authenticator failed for ([67.213.230.122]) [67.213.230.122]:41291: 535 Incorrect authentication data (set_id=services@heipowersystem.com)67.213.230.1226252001 ( J x  03<di^  -a' ossec13001gļ8Exim Auth failed2025-03-03 01:44:47 dovecot_plain authenticator failed for ([46.30.161.197]) [46.30.161.197]:47990: 535 Incorrect authentication data (set_id=services@heipowersystem.com)46.30.161.197690791x]  -}' ossec13001gļ.Exim Auth failed2025-03-03 01:44:38 dovecot_plain authenticator failed for 89-179-99-200.broadband.corbina.ru [89.179.99.200]:50906: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)89.179.99.2002017370T\  -7% ossec13001gĻZExim Auth failed2025-03-03 01:41:05 dovecot_plain authenticator failed for ([218.22.0.200]) [218.22.0.200]:50894: 535 Incorrect authentication data (set_id=services)218.22.0.2001814991T[  -5' ossec13001gĻNExim Auth failed2025-03-03 01:40:54 dovecot_plain authenticator failed for ([46.52.204.227]) [46.52.204.227]:38682: 535 Incorrect authentication data (set_id=sales)46.52.204.2272017370sZ  -u% ossec13001gĻ8Exim Auth failed2025-03-03 01:40:32 dovecot_plain authenticator failed for 111-70-42-37.emome-ip.hinet.net [111.70.42.37]:51951: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)111.70.42.371668284yY  -}) ossec13001gĻ@Exim Auth failed2025-03-03 01:40:39 dovecot_plain authenticator failed for 110-25-104-102.adsl.fetnet.net [110.25.104.102]:33342: 535 Incorrect authentication data (set_id=services@heipowersystem.com)110.25.104.1021668284UX -5' ossec13001gĺExim Auth failed2025-03-03 01:39:21 dovecot_login authenticator failed for (rokamauka.com) [111.56.54.202]:37234: 535 Incorrect authentication data (set_id=nologin)111.56.54.2021814991pW  -k) ossec13001gĺExim Auth failed2025-03-03 01:38:00 dovecot_login authenticator failed for ([203.221.63.196]) [203.221.63.196]:36565: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)203.221.63.1962077456UV  -7' ossec13001gĺExim Auth failed2025-03-03 01:37:30 dovecot_login authenticator failed for ([49.124.151.36]) [49.124.151.36]:48914: 535 Incorrect authentication data (set_id=bo_msk)49.124.151.361733045hU  -c% ossec13001gĺvExim Auth failed2025-03-03 01:37:16 dovecot_login authenticator failed for ([46.161.196.5]) [46.161.196.5]:41134: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)46.161.196.599237fT  -[' ossec13001gĹExim Auth failed2025-03-03 01:35:14 dovecot_plain authenticator failed for ([78.142.41.167]) [78.142.41.167]:42242: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)78.142.41.167732800WS  -9) ossec13001gĺExim Auth failed2025-03-03 01:35:40 dovecot_plain authenticator failed for ([27.107.168.206]) [27.107.168.206]:37182: 535 Incorrect authentication data (set_id=sales)27.107.168.2061269750mR  -e) ossec13001gĺ Exim Auth failed2025-03-03 01:35:31 dovecot_plain authenticator failed for ([168.126.90.210]) [168.126.90.210]:58309: 535 Incorrect authentication data (set_id=services@heipowersystem.com)168.126.90.2101835841NQ  --# ossec13001gĸExim Auth failed2025-03-03 01:30:55 dovecot_plain authenticator failed for ([5.166.68.89]) [5.166.68.89]:48154: 535 Incorrect authentication data (set_id=sales)5.166.68.892017370ZP  -?) ossec13001gĸExim Auth failed2025-03-03 01:30:47 dovecot_plain authenticator failed for ([50.188.204.213]) [50.188.204.213]:45387: 535 Incorrect authentication data (set_id=services)50.188.204.2136252001fO  -]% ossec13001gĸExim Auth failed2025-03-03 01:30:31 dovecot_plain authenticator failed for ([149.0.19.108]) [149.0.19.108]:42128: 535 Incorrect authentication data (set_id=services@heipowersystem.com)149.0.19.108298795jN  -_) ossec13001gĸExim Auth failed2025-03-03 01:30:29 dovecot_plain authenticator failed for ([112.91.124.138]) [112.91.124.138]:44933: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)112.91.124.1381814991 %7 I t >czo  -% ossec13001gĿsExim Auth failed2025-03-03 01:58:34 dovecot_plain authenticator failed for broadband-5-228-34-254.ip.moscow.rt.ru [5.228.34.254]:52002: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)5.228.34.2542017370nn  -g+ ossec13001gĿwExim Auth failed2025-03-03 01:58:39 dovecot_plain authenticator failed for ([196.200.227.78]) [196.200.227.194]:49434: 535 Incorrect authentication data (set_id=services@heipowersystem.com)196.200.227.194149590`m  -M' ossec13001gľExim Auth failed2025-03-03 01:56:37 dovecot_plain authenticator failed for 83.106.54.198.in-addr.arpa [198.54.106.83]:54482: 535 Incorrect authentication data (set_id=services)198.54.106.836252001Wl  -9) ossec13001gľExim Auth failed2025-03-03 01:56:26 dovecot_plain authenticator failed for ([111.172.120.32]) [111.172.120.32]:51430: 535 Incorrect authentication data (set_id=sales)111.172.120.321814991Uk  -7' ossec13001gľExim Auth failed2025-03-03 01:56:15 dovecot_login authenticator failed for ([203.124.36.67]) [203.124.36.67]:49284: 535 Incorrect authentication data (set_id=bo_msk)203.124.36.671168579jj  -a' ossec13001gľExim Auth failed2025-03-03 01:56:02 dovecot_plain authenticator failed for ([119.84.241.94]) [119.84.241.94]:53818: 535 Incorrect authentication data (set_id=services@heipowersystem.com)119.84.241.941814991ni  -i' ossec13001gľExim Auth failed2025-03-03 01:56:02 dovecot_plain authenticator failed for vps-926fddc5.vps.ovh.net [79.137.82.102]:47822: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)79.137.82.1023017382oh  -i) ossec13001gľExim Auth failed2025-03-03 01:55:54 dovecot_login authenticator failed for zdomainaccess.com [216.70.114.230]:38108: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)216.70.114.2306252001Ug  -7' ossec13001gľExim Auth failed2025-03-03 01:52:53 dovecot_login authenticator failed for ([132.247.87.75]) [132.247.87.75]:54985: 535 Incorrect authentication data (set_id=bo_msk)132.247.87.753996063Zf  -=+ ossec13001gľExim Auth failed2025-03-03 01:52:49 dovecot_plain authenticator failed for ([117.141.148.187]) [117.141.148.187]:37137: 535 Incorrect authentication data (set_id=sales)117.141.148.1871814991me  -e) ossec13001gľ#Exim Auth failed2025-03-03 01:52:58 dovecot_plain authenticator failed for ([220.90.239.158]) [220.90.239.158]:61647: 535 Incorrect authentication data (set_id=services@heipowersystem.com)220.90.239.1581835841sd  -o+ ossec13001gľExim Auth failed2025-03-03 01:52:37 dovecot_login authenticator failed for ([114.215.211.223]) [114.215.211.223]:54520: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)114.215.211.2231814991gc  -[' ossec13001gľExim Auth failed2025-03-03 01:52:28 dovecot_plain authenticator failed for ([211.109.75.66]) [211.109.75.69]:58709: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)211.109.75.691835841Qb  -1% ossec13001gĽ`Exim Auth failed2025-03-03 01:49:43 dovecot_plain authenticator failed for ([116.212.19.9]) [116.212.19.9]:59782: 535 Incorrect authentication data (set_id=sales)116.212.19.91835841ja  -a' ossec13001gĽNExim Auth failed2025-03-03 01:49:26 dovecot_plain authenticator failed for ([46.52.204.227]) [46.52.204.227]:39315: 535 Incorrect authentication data (set_id=services@heipowersystem.com)46.52.204.2272017370j`  -_) ossec13001gĽNExim Auth failed2025-03-03 01:49:26 dovecot_plain authenticator failed for ([111.171.125.94]) [111.171.125.94]:55996: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)111.171.125.941835841W_  -;' ossec13001gļRExim Auth failed2025-03-03 01:45:14 dovecot_plain authenticator failed for ([85.26.221.136]) [85.26.221.136]:49037: 535 Incorrect authentication data (set_id=services)85.26.221.1362017370 (8 P k  +@loO  -/# ossec13001gExim Auth failed2025-03-03 02:12:56 dovecot_login authenticator failed for ([27.71.27.81]) [27.71.27.81]:17717: 535 Incorrect authentication data (set_id=bo_msk)27.71.27.811562822y  -}) ossec13001gExim Auth failed2025-03-03 02:12:45 dovecot_login authenticator failed for (azteca-comunicaciones.com) [186.148.187.91]:37371: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)186.148.187.913686110P~  -3# ossec13001g)Exim Auth failed2025-03-03 02:05:53 dovecot_plain authenticator failed for ([91.221.7.13]) [91.221.7.13]:60280: 535 Incorrect authentication data (set_id=services)91.221.7.13690791g}  -[' ossec13001g'Exim Auth failed2025-03-03 02:05:51 dovecot_plain authenticator failed for ([217.24.185.98]) [217.24.185.98]:46608: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)217.24.185.982017370o|  -o# ossec13001g;Exim Auth failed2025-03-03 02:06:10 dovecot_plain authenticator failed for cpc81914-leic18-2-0-cust77.8-1.cable.virginm.net [82.0.107.78]:50370: 535 Incorrect authentication data (set_id=sales)82.0.107.782635167j{  -c% ossec13001g3Exim Auth failed2025-03-03 02:06:02 dovecot_login authenticator failed for ([49.124.151.6]) [49.124.151.6]:48848: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)49.124.151.61733045[z -A' ossec13001g3Exim Auth failed2025-03-03 02:06:02 dovecot_login authenticator failed for (thepsindustries.com) [58.240.171.59]:32850: 535 Incorrect authentication data (set_id=nologin)58.240.171.591814991y  - ) ossec13001gExim Auth failed2025-03-03 02:05:40 dovecot_plain authenticator failed for 93.135.220.111.sta.wbroadband.net.au [111.220.135.93]:33548: 535 Incorrect authentication data (set_id=services@heipowersystem.com)111.220.135.932077456ux  -y% ossec13001gExim Auth failed2025-03-03 02:03:54 dovecot_plain authenticator failed for host16.sub-63-46-105.myvzw.com [63.46.105.16]:59134: 535 Incorrect authentication data (set_id=services@heipowersystem.com)63.46.105.166252001_w  -M% ossec13001gExim Auth failed2025-03-03 02:03:43 dovecot_plain authenticator failed for (6-62-170-152.fibertel.com.ar) [152.170.62.6]:48829: 535 Incorrect authentication data (set_id=sales)152.170.62.63865483gv  -[' ossec13001gExim Auth failed2025-03-03 02:03:29 dovecot_plain authenticator failed for ([117.173.18.71]) [117.173.18.71]:35382: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)117.173.18.711814991Tu  -5' ossec13001gAExim Auth failed2025-03-03 02:02:01 dovecot_plain authenticator failed for ([94.181.23.131]) [94.181.23.131]:49520: 535 Incorrect authentication data (set_id=sales)94.181.23.1312017370Zt  -?) ossec13001g7Exim Auth failed2025-03-03 02:01:51 dovecot_plain authenticator failed for ([195.122.224.64]) [195.122.224.64]:34296: 535 Incorrect authentication data (set_id=services)195.122.224.642017370as  -S# ossec13001g)Exim Auth failed2025-03-03 02:01:37 dovecot_plain authenticator failed for ([27.71.27.81]) [27.71.27.81]:40984: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)27.71.27.811562822dr  -Y# ossec13001g!Exim Auth failed2025-03-03 02:01:28 dovecot_plain authenticator failed for ([1.70.158.32]) [1.70.158.32]:45251: 535 Incorrect authentication data (set_id=services@heipowersystem.com)1.70.158.321814991lq  -c) ossec13001gĿExim Auth failed2025-03-03 01:59:05 dovecot_plain authenticator failed for c-73-106-172-226.hsd1.ga.comcast.net [73.106.172.226]:36326: 535 Incorrect authentication data (set_id=services)73.106.172.2266252001Tp  -5' ossec13001gĿExim Auth failed2025-03-03 01:58:51 dovecot_plain authenticator failed for ([171.244.63.34]) [171.244.63.34]:25934: 535 Incorrect authentication data (set_id=sales)171.244.63.341562822 * U z .Fe|  -' ossec13001gExim Auth failed2025-03-03 02:34:21 dovecot_login authenticator failed for 111-70-49-103.emome-ip.hinet.net [111.70.49.103]:45281: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)111.70.49.1031668284b  -U# ossec13001gExim Auth failed2025-03-03 02:30:02 dovecot_login authenticator failed for (nyaystambh.com) [14.18.77.99]:39584: 535 Incorrect authentication data (set_id=webmaster@nyaystambh.com)14.18.77.991814991Q  -3# ossec13001gƹExim Auth failed2025-03-03 02:29:36 dovecot_login authenticator failed for (nyaystambh.com) [14.18.77.99]:36424: 535 Incorrect authentication data (set_id=nologin)14.18.77.991814991]  -C+ ossec13001gExim Auth failed2025-03-03 02:25:55 dovecot_plain authenticator failed for ([183.109.195.179]) [183.109.195.179]:33918: 535 Incorrect authentication data (set_id=services)183.109.195.1791835841d  -U' ossec13001gExim Auth failed2025-03-03 02:25:48 dovecot_plain authenticator failed for h88-129-31-231.cust.bredband2.com [88.129.31.231]:55401: 535 Incorrect authentication data (set_id=sales)88.129.31.2312661886g  -]% ossec13001gExim Auth failed2025-03-03 02:25:41 dovecot_plain authenticator failed for ([14.99.61.248]) [14.99.61.248]:49560: 535 Incorrect authentication data (set_id=services@heipowersystem.com)14.99.61.2481269750y  -}) ossec13001gŻExim Auth failed2025-03-03 02:25:22 dovecot_plain authenticator failed for 125-228-225-91.hinet-ip.hinet.net [125.228.225.91]:33939: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)125.228.225.911668284c  -S' ossec13001gExim Auth failed2025-03-03 02:18:01 dovecot_plain authenticator failed for 111-70-23-236.emome-ip.hinet.net [111.70.23.236]:36039: 535 Incorrect authentication data (set_id=sales)111.70.23.2361668284R  -3% ossec13001gExim Auth failed2025-03-03 02:17:54 dovecot_login authenticator failed for ([27.71.20.180]) [27.71.20.180]:26617: 535 Incorrect authentication data (set_id=bo_msk)27.71.20.1801562822S  -7# ossec13001gExim Auth failed2025-03-03 02:17:45 dovecot_plain authenticator failed for ([203.177.65.26]) [58.69.17.18]:37910: 535 Incorrect authentication data (set_id=services)58.69.17.181694008l  -e' ossec13001gExim Auth failed2025-03-03 02:17:44 dovecot_login authenticator failed for ([58.250.157.83]) [58.250.157.83]:2055: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)58.250.157.831814991n  -g) ossec13001gExim Auth failed2025-03-03 02:17:35 dovecot_plain authenticator failed for ([101.230.251.217]) [180.154.53.221]:28188: 535 Incorrect authentication data (set_id=services@heipowersystem.com)180.154.53.2211814991j  -_) ossec13001gExim Auth failed2025-03-03 02:17:35 dovecot_plain authenticator failed for ([124.112.45.222]) [124.112.45.222]:53203: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)124.112.45.2221814991W  -;' ossec13001g,Exim Auth failed2025-03-03 02:14:27 dovecot_plain authenticator failed for ([58.229.51.206]) [58.229.51.206]:38980: 535 Incorrect authentication data (set_id=services)58.229.51.2061835841Q  -1% ossec13001gExim Auth failed2025-03-03 02:14:12 dovecot_plain authenticator failed for ([14.37.206.76]) [14.37.206.76]:56013: 535 Incorrect authentication data (set_id=sales)14.37.206.761835841j  -a' ossec13001gExim Auth failed2025-03-03 02:14:02 dovecot_plain authenticator failed for ([31.173.66.222]) [31.173.66.222]:48396: 535 Incorrect authentication data (set_id=services@heipowersystem.com)31.173.66.2222017370d  -W% ossec13001gExim Auth failed2025-03-03 02:13:48 dovecot_plain authenticator failed for ([202.200.15.1]) [202.200.14.2]:43344: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)202.200.14.21814991 $) Q  8 8 ;DKo~z!  -+ ossec13001gExim Auth failed2025-03-03 02:55:23 dovecot_plain authenticator failed for 137.173.198.203.static.netvigator.com [203.198.173.137]:46258: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)203.198.173.1371819730W  -;' ossec13001glExim Auth failed2025-03-03 02:49:39 dovecot_plain authenticator failed for ([92.255.190.69]) [92.255.190.69]:55682: 535 Incorrect authentication data (set_id=services)92.255.190.692017370X  -;) ossec13001gjExim Auth failed2025-03-03 02:49:37 dovecot_login authenticator failed for ([220.182.17.122]) [220.182.17.122]:43588: 535 Incorrect authentication data (set_id=bo_msk)220.182.17.1221814991j  -_) ossec13001gRExim Auth failed2025-03-03 02:49:13 dovecot_plain authenticator failed for ([124.112.45.222]) [124.112.45.222]:50390: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)124.112.45.2221814991  - ' ossec13001gLExim Auth failed2025-03-03 02:49:07 dovecot_login authenticator failed for syn-071-012-241-225.res.spectrum.com [71.12.241.225]:58174: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)71.12.241.2256252001m  -e) ossec13001gJExim Auth failed2025-03-03 02:49:05 dovecot_plain authenticator failed for ([41.215.213.197]) [41.215.213.197]:60125: 535 Incorrect authentication data (set_id=services@heipowersystem.com)41.215.213.1973374766X  -;) ossec13001gExim Auth failed2025-03-03 02:42:43 dovecot_login authenticator failed for ([207.219.221.99]) [207.219.221.99]:48116: 535 Incorrect authentication data (set_id=bo_msk)207.219.221.996251999u  -{# ossec13001gɼExim Auth failed2025-03-03 02:42:27 dovecot_plain authenticator failed for (70.246.50.116.ids.service.static.eastern-tele.com) [58.69.17.18]:35300: 535 Incorrect authentication data (set_id=services)58.69.17.181694008s  -u% ossec13001gɸExim Auth failed2025-03-03 02:42:22 dovecot_plain authenticator failed for 128.16.3.213.static.wline.lns.sme.cust.swisscom.ch [213.3.16.128]:57352: 535 Incorrect authentication data (set_id=sales)213.3.16.1282658434y  -' ossec13001gɲExim Auth failed2025-03-03 02:42:16 dovecot_plain authenticator failed for (rw-00130-94.59.137.rcil.gov.in) [137.59.94.130]:49200: 535 Incorrect authentication data (set_id=services@heipowersystem.com)137.59.94.1301269750|  -) ossec13001gɰExim Auth failed2025-03-03 02:42:15 dovecot_login authenticator failed for (m121-202-154-62.smartone.com) [121.202.154.62]:25764: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)121.202.154.621819730^  -O! ossec13001gɬExim Auth failed2025-03-03 02:42:11 dovecot_plain authenticator failed for ([45.6.80.40]) [45.6.80.40]:38766: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)45.6.80.4034690343  =a) ossec13008gMail Reciepient rejected2025-03-03 02:35:34 H=(mail.nyaystambh.com) [165.154.213.78]:49772 F= rejected RCPT : Rejected relay attempt: '165.154.213.78' From: 'ulpwtzrza@nyaystambh.com' To: 'goofile@fastmail.com'165.154.213.783469034T  -5' ossec13001gExim Auth failed2025-03-03 02:34:17 dovecot_plain authenticator failed for ([14.46.114.239]) [14.46.114.239]:34998: 535 Incorrect authentication data (set_id=sales)14.46.114.2391835841w  -{' ossec13001gExim Auth failed2025-03-03 02:34:05 dovecot_plain authenticator failed for h77-53-235-246.cust.bredband2.com [77.53.235.246]:48748: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)77.53.235.2462661886X  -;) ossec13001gExim Auth failed2025-03-03 02:34:36 dovecot_login authenticator failed for ([185.232.39.165]) [185.232.39.165]:55597: 535 Incorrect authentication data (set_id=bo_msk)185.232.39.1652510769 u' @ R t } '>R`ug2  -]% ossec13001gwExim Auth failed2025-03-03 03:15:26 dovecot_plain authenticator failed for ([42.48.118.55]) [42.48.118.55]:43628: 535 Incorrect authentication data (set_id=services@heipowersystem.com)42.48.118.551814991n1  -k% ossec13001gцExim Auth failed2025-03-03 03:15:40 dovecot_plain authenticator failed for vps-79f20bfc.vps.ovh.net ([87.98.249.193]) [51.75.24.107]:14214: 535 Incorrect authentication data (set_id=services)51.75.24.1073017382h0  -_% ossec13001g}Exim Auth failed2025-03-03 03:15:32 dovecot_plain authenticator failed for 158-27-58-67.gci.net [67.58.27.158]:51611: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)67.58.27.1586252001e/  -W' ossec13001gЕExim Auth failed2025-03-03 03:11:40 dovecot_plain authenticator failed for 124-11-130-37.static.tfn.net.tw [124.11.130.37]:45345: 535 Incorrect authentication data (set_id=services)124.11.130.371668284g.  -]% ossec13001gЉExim Auth failed2025-03-03 03:11:28 dovecot_plain authenticator failed for ([58.16.49.250]) [58.16.49.250]:53552: 535 Incorrect authentication data (set_id=services@heipowersystem.com)58.16.49.2501814991j-  -_) ossec13001g{Exim Auth failed2025-03-03 03:11:15 dovecot_plain authenticator failed for ([191.210.87.101]) [191.210.87.101]:38417: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)191.210.87.1013469034Z,  -?) ossec13001guExim Auth failed2025-03-03 03:06:52 dovecot_plain authenticator failed for ([49.124.152.223]) [49.124.152.223]:47498: 535 Incorrect authentication data (set_id=services)49.124.152.2231733045y+  -' ossec13001geExim Auth failed2025-03-03 03:06:37 dovecot_plain authenticator failed for 111-70-22-153.emome-ip.hinet.net [111.70.22.153]:45370: 535 Incorrect authentication data (set_id=services@heipowersystem.com)111.70.22.1531668284W*  -9) ossec13001gOExim Auth failed2025-03-03 03:06:14 dovecot_plain authenticator failed for ([121.190.129.68]) [121.190.129.68]:46907: 535 Incorrect authentication data (set_id=sales)121.190.129.681835841j)  -_) ossec13001g?Exim Auth failed2025-03-03 03:05:57 dovecot_plain authenticator failed for ([221.167.21.148]) [221.167.21.148]:54484: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)221.167.21.1481835841U(  -7' ossec13001gExim Auth failed2025-03-03 03:04:27 dovecot_login authenticator failed for ([115.42.173.64]) [115.42.173.64]:51768: 535 Incorrect authentication data (set_id=bo_msk)115.42.173.641880251s'  -o+ ossec13001gExim Auth failed2025-03-03 03:04:17 dovecot_login authenticator failed for ([223.197.164.188]) [223.197.164.188]:60860: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)223.197.164.1881819730Z&  -?) ossec13001g=Exim Auth failed2025-03-03 03:01:39 dovecot_plain authenticator failed for ([95.165.217.194]) [95.165.217.194]:55598: 535 Incorrect authentication data (set_id=services)95.165.217.1942017370j%  -a' ossec13001g3Exim Auth failed2025-03-03 03:01:29 dovecot_plain authenticator failed for ([46.52.204.227]) [46.52.204.227]:46158: 535 Incorrect authentication data (set_id=services@heipowersystem.com)46.52.204.2272017370c$  -S' ossec13001g-Exim Auth failed2025-03-03 03:01:24 dovecot_plain authenticator failed for 89-253-90-113.customers.ownit.se [89.253.90.113]:39663: 535 Incorrect authentication data (set_id=sales)89.253.90.1132661886g#  -[' ossec13001gExim Auth failed2025-03-03 03:01:04 dovecot_plain authenticator failed for ([121.157.28.10]) [121.157.28.10]:58236: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)121.157.28.101835841j"  -a' ossec13001gExim Auth failed2025-03-03 02:55:52 dovecot_plain authenticator failed for ([115.140.89.82]) [115.140.89.82]:43085: 535 Incorrect authentication data (set_id=services@heipowersystem.com)115.140.89.821835841 p' H m 0BR??dppC  -k) ossec13001gExim Auth failed2025-03-03 03:30:15 dovecot_login authenticator failed for ([36.110.161.134]) [36.110.161.134]:39851: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)36.110.161.1341814991WB  -9) ossec13001gExim Auth failed2025-03-03 03:29:59 dovecot_plain authenticator failed for ([192.34.128.202]) [192.34.128.202]:35022: 535 Incorrect authentication data (set_id=sales)192.34.128.2026252001|A  -) ossec13001gԼExim Auth failed2025-03-03 03:29:24 dovecot_plain authenticator failed for 122-116-32-136.hinet-ip.hinet.net [122.116.32.136]:48588: 535 Incorrect authentication data (set_id=services@heipowersystem.com)122.116.32.1361668284@  -+) ossec13001gԮExim Auth failed2025-03-03 03:29:09 dovecot_plain authenticator failed for customer-ip-193-151-51-223.ipv.net.pl ([91.227.103.222]) [193.151.51.223]:33822: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)193.151.51.223798544l?  -c) ossec13001g(Exim Auth failed2025-03-03 03:26:55 dovecot_plain authenticator failed for ([222.128.44.171]) [222.128.44.171]:2054: 535 Incorrect authentication data (set_id=services@heipowersystem.com)222.128.44.1711814991j>  -_) ossec13001gExim Auth failed2025-03-03 03:26:31 dovecot_plain authenticator failed for ([49.124.152.143]) [49.124.152.143]:49540: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)49.124.152.1431733045]=  -C+ ossec13001gXExim Auth failed2025-03-03 03:23:27 dovecot_plain authenticator failed for ([220.120.227.186]) [220.120.227.186]:60488: 535 Incorrect authentication data (set_id=services)220.120.227.1861835841T<  -5' ossec13001gVExim Auth failed2025-03-03 03:23:25 dovecot_plain authenticator failed for ([14.34.217.155]) [14.34.217.155]:53497: 535 Incorrect authentication data (set_id=sales)14.34.217.1551835841^;  -Q ossec13001gHExim Auth failed2025-03-03 03:23:11 dovecot_plain authenticator failed for ([4.4.89.74]) [4.4.89.74]:42440: 535 Incorrect authentication data (set_id=services@heipowersystem.com)4.4.89.746252001j:  -_) ossec13001gDExim Auth failed2025-03-03 03:23:08 dovecot_plain authenticator failed for mail-02.03.perm.ru [46.146.210.180]:62580: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)46.146.210.1802017370f9  -]% ossec13001g҆Exim Auth failed2025-03-03 03:19:57 dovecot_plain authenticator failed for ([91.92.130.86]) [91.92.130.86]:57356: 535 Incorrect authentication data (set_id=services@heipowersystem.com)91.92.130.86130758q8  -s# ossec13001g҆Exim Auth failed2025-03-03 03:19:57 dovecot_plain authenticator failed for h77-53-61-95.cust.bredband2.com [77.53.61.95]:40916: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)77.53.61.952661886Q7  -1% ossec13001gҜExim Auth failed2025-03-03 03:20:19 dovecot_plain authenticator failed for ([66.11.25.195]) [66.11.25.195]:49880: 535 Incorrect authentication data (set_id=sales)66.11.25.1956252001W6  -;' ossec13001gҐExim Auth failed2025-03-03 03:20:06 dovecot_plain authenticator failed for ([103.48.194.21]) [103.48.194.21]:39302: 535 Incorrect authentication data (set_id=services)103.48.194.211562822[5  -?+ ossec13001gExim Auth failed2025-03-03 03:16:43 dovecot_login authenticator failed for ([114.243.136.120]) [114.243.136.120]:42762: 535 Incorrect authentication data (set_id=bo_msk)114.243.136.1201814991g4  -_# ossec13001gўExim Auth failed2025-03-03 03:16:04 dovecot_login authenticator failed for ([58.69.17.18]) [58.69.17.18]:42584: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)58.69.17.181694008j3  -a' ossec13001gѐExim Auth failed2025-03-03 03:15:51 dovecot_plain authenticator failed for broadband-5-228-183-178.ip.moscow.rt.ru [5.228.183.178]:32575: 535 Incorrect authentication data (set_id=sales)5.228.183.1782017370 A-? N p   2AmT  -e) ossec13001gcExim Auth failed2025-03-03 03:44:58 dovecot_plain authenticator failed for ([103.106.154.10]) [103.106.154.10]:41044: 535 Incorrect authentication data (set_id=services@heipowersystem.com)103.106.154.101269750ZS  -=+ ossec13001gcExim Auth failed2025-03-03 03:44:59 dovecot_plain authenticator failed for ([222.189.211.114]) [222.189.211.114]:52170: 535 Incorrect authentication data (set_id=sales)222.189.211.1141814991vR  -y' ossec13001gEExim Auth failed2025-03-03 03:44:28 dovecot_plain authenticator failed for 111-70-32-210.emome-ip.hinet.net [111.70.32.210]:53860: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)111.70.32.2101668284kQ  -c' ossec13001gaExim Auth failed2025-03-03 03:40:40 dovecot_plain authenticator failed for p5098d833.dip0.t-ipconnect.de [80.152.216.51]:25199: 535 Incorrect authentication data (set_id=vikas.khandelwal)80.152.216.512921044P  -1% ossec13001gWExim Auth failed2025-03-03 03:40:31 dovecot_plain authenticator failed for 128.16.3.213.static.wline.lns.sme.cust.swisscom.ch [213.3.16.128]:48266: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)213.3.16.1282658434UO  -7' ossec13001gExim Auth failed2025-03-03 03:38:13 dovecot_login authenticator failed for ([191.59.254.45]) [191.59.254.45]:47540: 535 Incorrect authentication data (set_id=bo_msk)191.59.254.453469034jN  -c% ossec13001gֻExim Auth failed2025-03-03 03:37:54 dovecot_login authenticator failed for ([41.231.85.75]) [41.231.85.75]:52707: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)41.231.85.752464461|M  -) ossec13001goExim Auth failed2025-03-03 03:36:39 dovecot_plain authenticator failed for syn-098-156-255-186.res.spectrum.com [98.156.255.186]:32822: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)98.156.255.1866252001mL  -e) ossec13001geExim Auth failed2025-03-03 03:36:28 dovecot_plain authenticator failed for ([222.119.98.157]) [222.119.98.157]:33101: 535 Incorrect authentication data (set_id=services@heipowersystem.com)222.119.98.1571835841gK  -]% ossec13001guExim Auth failed2025-03-03 03:36:44 dovecot_plain authenticator failed for h-46-59-44-182.a980.priv.bahnhof.se [46.59.44.182]:57580: 535 Incorrect authentication data (set_id=services)46.59.44.1822661886cJ  -W# ossec13001gExim Auth failed2025-03-03 03:34:29 dovecot_plain authenticator failed for syn-070-120-006-086.res.spectrum.com [70.120.6.86]:62083: 535 Incorrect authentication data (set_id=sales)70.120.6.866252001cI  -U% ossec13001gExim Auth failed2025-03-03 03:34:07 dovecot_plain authenticator failed for ([27.71.20.180]) [27.71.20.180]:4696: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)27.71.20.1801562822mH  -e) ossec13001gՄExim Auth failed2025-03-03 03:32:43 dovecot_plain authenticator failed for ([222.117.88.230]) [222.117.88.230]:52728: 535 Incorrect authentication data (set_id=services@heipowersystem.com)222.117.88.2301835841ZG  -=+ ossec13001gpExim Auth failed2025-03-03 03:32:24 dovecot_plain authenticator failed for ([175.145.232.217]) [175.145.232.217]:46538: 535 Incorrect authentication data (set_id=sales)175.145.232.2171733045mF  -e) ossec13001g`Exim Auth failed2025-03-03 03:32:07 dovecot_plain authenticator failed for ([60.223.239.134]) [60.223.239.134]:42952: 535 Incorrect authentication data (set_id=services@heipowersystem.com)60.223.239.1341814991jE  -_) ossec13001gZExim Auth failed2025-03-03 03:32:01 dovecot_plain authenticator failed for ([39.152.114.206]) [39.152.114.206]:20215: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)39.152.114.2061814991OD  -/# ossec13001gExim Auth failed2025-03-03 03:30:57 dovecot_login authenticator failed for ([101.13.5.37]) [101.13.5.37]:34144: 535 Incorrect authentication data (set_id=bo_msk)101.13.5.371668284 YP k z } )SV~je  -_) ossec13001gExim Auth failed2025-03-03 04:17:45 dovecot_plain authenticator failed for ([198.100.138.79]) [198.100.138.79]:50658: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)198.100.138.796252001Td  -5' ossec13001gExim Auth failed2025-03-03 04:13:09 dovecot_plain authenticator failed for ([1.227.228.136]) [1.227.228.136]:51089: 535 Incorrect authentication data (set_id=sales)1.227.228.1361835841yc  -}) ossec13001gExim Auth failed2025-03-03 04:12:32 dovecot_plain authenticator failed for 202-188-035-194.ip-addr.vsenet.de [194.35.188.202]:41937: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)194.35.188.2022921044Rb  -3% ossec13001gFExim Auth failed2025-03-03 04:05:50 dovecot_login authenticator failed for ([14.39.41.171]) [14.39.41.171]:52386: 535 Incorrect authentication data (set_id=bo_msk)14.39.41.1711835841Za  -?) ossec13001g Exim Auth failed2025-03-03 04:04:50 dovecot_plain authenticator failed for ([109.70.203.114]) [109.70.203.114]:43768: 535 Incorrect authentication data (set_id=services)109.70.203.1143175395o`  -k) ossec13001g4Exim Auth failed2025-03-03 04:05:31 dovecot_login authenticator failed for ([185.101.16.250]) [185.101.16.250]:33412: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)185.101.16.250272103_  -# ossec13001g,Exim Auth failed2025-03-03 04:05:24 dovecot_login authenticator failed for static-98-110-70-2.cmdnnj.fios.verizon.net [98.110.70.2]:48127: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)98.110.70.26252001p^  -i+ ossec13001gExim Auth failed2025-03-03 04:04:35 dovecot_plain authenticator failed for ([115.247.159.106]) [115.247.159.106]:43072: 535 Incorrect authentication data (set_id=services@heipowersystem.com)115.247.159.1061269750`]  -M) ossec13001gExim Auth failed2025-03-03 04:04:36 dovecot_plain authenticator failed for 212-72-203-252.ip.btc-net.bg [212.72.203.252]:49079: 535 Incorrect authentication data (set_id=sales)212.72.203.252732800h\  -_) ossec13001gExim Auth failed2025-03-03 04:04:25 dovecot_plain authenticator failed for ([213.32.253.235]) [213.32.253.235]:43394: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)213.32.253.23599237Z[  -?) ossec13001g.Exim Auth failed2025-03-03 03:56:53 dovecot_plain authenticator failed for ([200.106.49.149]) [200.106.49.149]:50512: 535 Incorrect authentication data (set_id=services)200.106.49.1493932488WZ  -9) ossec13001gExim Auth failed2025-03-03 03:56:34 dovecot_plain authenticator failed for ([168.126.90.210]) [168.126.90.210]:38952: 535 Incorrect authentication data (set_id=sales)168.126.90.2101835841yY  -}) ossec13001gExim Auth failed2025-03-03 03:56:24 dovecot_plain authenticator failed for 110-25-105-223.adsl.fetnet.net [110.25.105.223]:38314: 535 Incorrect authentication data (set_id=services@heipowersystem.com)110.25.105.2231668284mX  -c+ ossec13001gExim Auth failed2025-03-03 03:56:21 dovecot_plain authenticator failed for ([124.115.219.254]) [124.115.219.254]:39502: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)124.115.219.2541814991aW  -Q% ossec13001gExim Auth failed2025-03-03 03:51:19 dovecot_login authenticator failed for (50-82-12-128.client.mchsi.com) [50.82.12.128]:33488: 535 Incorrect authentication data (set_id=bo_msk)50.82.12.1286252001V  -+ ossec13001gٷExim Auth failed2025-03-03 03:50:39 dovecot_login authenticator failed for (pool-192-188-123-181.telecel.com.py) [181.123.188.192]:59610: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)181.123.188.1923437598#U 3M% ossec11301gٌNew FTP connection.Mar 3 03:49:53 vm1 pure-ftpd[1626274]: (?@106.75.50.44) [INFO] New connection from 106.75.50.44106.75.50.441814991 O5 J s  (*'OTv  -5' ossec13001g\Exim Auth failed2025-03-03 04:31:47 dovecot_plain authenticator failed for ([49.124.149.52]) [49.124.149.52]:50262: 535 Incorrect authentication data (set_id=sales)49.124.149.521733045u  - ) ossec13001gZExim Auth failed2025-03-03 04:31:45 dovecot_plain authenticator failed for syn-075-191-221-158.res.spectrum.com [75.191.221.158]:49558: 535 Incorrect authentication data (set_id=services@heipowersystem.com)75.191.221.1586252001zt  -% ossec13001gNExim Auth failed2025-03-03 04:31:34 dovecot_plain authenticator failed for (nsg-static-173.125.76.182-airtel.com) [182.76.87.90]:40316: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)182.76.87.901269750ks  -_+ ossec13001g^Exim Auth failed2025-03-03 04:27:33 dovecot_login authenticator failed for (200-217-53-25.host.telemar.net.br) [200.216.168.226]:35167: 535 Incorrect authentication data (set_id=bo_msk)200.216.168.2263469034pr  -k) ossec13001gNExim Auth failed2025-03-03 04:27:18 dovecot_login authenticator failed for ([112.25.140.211]) [112.25.140.211]:57808: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)112.25.140.2111814991mq  -g' ossec13001g"Exim Auth failed2025-03-03 04:26:34 dovecot_plain authenticator failed for broadband-77-37-174-248.ip.moscow.rt.ru [77.37.174.248]:50360: 535 Incorrect authentication data (set_id=services)77.37.174.2482017370jp  -a' ossec13001gExim Auth failed2025-03-03 04:26:19 dovecot_plain authenticator failed for ([72.26.178.196]) [72.26.178.196]:34760: 535 Incorrect authentication data (set_id=services@heipowersystem.com)72.26.178.1966252001go  -[' ossec13001gExim Auth failed2025-03-03 04:26:14 dovecot_plain authenticator failed for ([46.173.45.180]) [46.173.45.180]:54156: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)46.173.45.1802017370Qn  -3% ossec13001gExim Auth failed2025-03-03 04:26:12 dovecot_login authenticator failed for ([197.87.10.83]) [197.87.10.83]:53819: 535 Incorrect authentication data (set_id=bo_msk)197.87.10.83953987mm  -g' ossec13001gExim Auth failed2025-03-03 04:25:40 dovecot_login authenticator failed for ([58.238.181.96]) [58.238.181.96]:38910: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)58.238.181.961835841ll  -c) ossec13001gExim Auth failed2025-03-03 04:24:13 dovecot_plain authenticator failed for vps-f5bece10.vps.ovh.net [135.125.207.50]:44426: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)135.125.207.503017382 k  -' ossec13001gwExim Auth failed2025-03-03 04:23:43 dovecot_plain authenticator failed for syn-024-090-169-209.res.spectrum.com [24.90.169.209]:47778: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)24.90.169.2096252001Wj  -;' ossec13001gExim Auth failed2025-03-03 04:19:52 dovecot_plain authenticator failed for ([111.48.214.96]) [111.48.214.96]:31188: 535 Incorrect authentication data (set_id=services)111.48.214.961814991Si  -5' ossec13001gExim Auth failed2025-03-03 04:19:41 dovecot_plain authenticator failed for ([94.204.78.117]) [94.204.78.117]:39288: 535 Incorrect authentication data (set_id=sales)94.204.78.117290557gh  -]% ossec13001gExim Auth failed2025-03-03 04:19:34 dovecot_plain authenticator failed for ([27.72.103.74]) [27.72.103.74]:65093: 535 Incorrect authentication data (set_id=services@heipowersystem.com)27.72.103.741562822`g  -S# ossec13001gqExim Auth failed2025-03-03 04:19:20 dovecot_plain authenticator failed for ([5.30.177.55]) [5.30.177.55]:49999: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)5.30.177.55290557cf  -Q) ossec13001g+Exim Auth failed2025-03-03 04:18:10 dovecot_plain authenticator failed for a109-51-222-234.cpe.netcabo.pt [109.51.222.234]:52500: 535 Incorrect authentication data (set_id=sales)109.51.222.2342264397 v 2 V h z 5Eqdvj  -a' ossec13001gExim Auth failed2025-03-03 04:50:25 dovecot_plain authenticator failed for ([92.255.190.69]) [92.255.190.69]:36780: 535 Incorrect authentication data (set_id=services@heipowersystem.com)92.255.190.692017370   -!% ossec13001gExim Auth failed2025-03-03 04:46:31 dovecot_plain authenticator failed for 206.81.4.146.static.wline.lns.sme.cust.swisscom.ch [146.4.81.206]:51899: 535 Incorrect authentication data (set_id=services@heipowersystem.com)146.4.81.2062658434P  -1% ossec13001gExim Auth failed2025-03-03 04:46:31 dovecot_plain authenticator failed for ([185.167.58.9]) [185.167.58.9]:38274: 535 Incorrect authentication data (set_id=sales)185.167.58.9617790l  -c+ ossec13001gExim Auth failed2025-03-03 04:46:19 dovecot_plain authenticator failed for ([154.205.146.118]) [154.205.146.118]:37372: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)154.205.146.118290291e  -S+ ossec13001gExim Auth failed2025-03-03 04:46:42 dovecot_plain authenticator failed for 220-235-212-152.tpgi.com.au [220.235.212.152]:42578: 535 Incorrect authentication data (set_id=services)220.235.212.1522077456W  -;' ossec13001gExim Auth failed2025-03-03 04:42:17 dovecot_plain authenticator failed for ([222.180.4.150]) [222.180.4.150]:59023: 535 Incorrect authentication data (set_id=services)222.180.4.1501814991S  -5' ossec13001gExim Auth failed2025-03-03 04:42:05 dovecot_plain authenticator failed for ([94.206.192.75]) [94.206.192.75]:34117: 535 Incorrect authentication data (set_id=sales)94.206.192.75290557p  -i+ ossec13001gExim Auth failed2025-03-03 04:42:03 dovecot_plain authenticator failed for ([207.219.221.101]) [207.219.221.101]:36072: 535 Incorrect authentication data (set_id=services@heipowersystem.com)207.219.221.1016251999j  -_) ossec13001gExim Auth failed2025-03-03 04:41:50 dovecot_plain authenticator failed for ([49.205.177.146]) [223.239.159.21]:43262: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)223.239.159.211269750n~  -g) ossec13001gExim Auth failed2025-03-03 04:41:25 dovecot_login authenticator failed for broadband-188-255-34-171.ip.moscow.rt.ru [188.255.34.171]:58988: 535 Incorrect authentication data (set_id=bo_msk)188.255.34.1712017370p}  -k) ossec13001gExim Auth failed2025-03-03 04:41:16 dovecot_login authenticator failed for ([218.234.104.42]) [218.234.104.42]:50142: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)218.234.104.421835841^|  -I' ossec13001gExim Auth failed2025-03-03 04:37:46 dovecot_plain authenticator failed for 2.sub-166-139-150.myvzw.com [166.139.150.2]:33341: 535 Incorrect authentication data (set_id=sales)166.139.150.26252001j{  -a' ossec13001gExim Auth failed2025-03-03 04:37:44 dovecot_plain authenticator failed for ([211.109.75.66]) [211.109.75.69]:63389: 535 Incorrect authentication data (set_id=services@heipowersystem.com)211.109.75.691835841jz  -_) ossec13001gExim Auth failed2025-03-03 04:37:19 dovecot_plain authenticator failed for ([111.48.208.197]) [111.48.208.197]:44566: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)111.48.208.1971814991Xy  -;) ossec13001gvExim Auth failed2025-03-03 04:36:30 dovecot_login authenticator failed for ([200.106.49.149]) [200.106.49.149]:49306: 535 Incorrect authentication data (set_id=bo_msk)200.106.49.1493932488jx  -c% ossec13001glExim Auth failed2025-03-03 04:36:20 dovecot_login authenticator failed for ([59.41.197.10]) [59.41.197.10]:51266: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)59.41.197.101814991\w  -G% ossec13001ghExim Auth failed2025-03-03 04:32:00 dovecot_plain authenticator failed for vps-79f20bfc.vps.ovh.net [51.75.24.107]:13778: 535 Incorrect authentication data (set_id=services)51.75.24.1073017382 ~qdWJ=0# zm`SF9, v i \ O B 5 (     r e X K > 1 $  { n a T G : -   w j ] P C 6 )    s f Y L ? 2 %  |obUH;.!xk^QD7*tgZM@3& }pcVI</"yl_RE8+uh[NA4' ~qdWJ=0 20173703& 20173703# 20173703 20173702 20173702 20173702 20173702 20173702 20173702 20173702 20173702 20173702 20173702 20173702 20173702 20173702 20173702 20173702s 20173702Z 20173702L 20173702E 20173702" 20173702! 20173702 20173702 20173701 20173701 20173701 20173701 20173701 20173701 20173701 20173701 20173701 20173701 20173701y 20173701; 201737018 20173701& 20173700 20173700 20173700 20173700 20173700 20173700u 20173700. 20173700+ 20173700! 20173700 20173700 2017370/ 2017370/ 2017370/ 2017370/ 2017370/ 2017370/ 2017370/ 2017370/ 2017370/ 2017370/ 2017370/ 2017370/ 2017370/y 2017370/c 2017370/[ 2017370/W 2017370/V 2017370/B 2017370/A 2017370/2 2017370/ 2017370/ 2017370/ 2017370. 2017370. 2017370. 2017370. 2017370. 2017370. 2017370. 2017370. 2017370. 2017370. 2017370. 2017370. 2017370.} 2017370.k 2017370.c 2017370.W 2017370.K 2017370.H 2017370.@ 2017370.1 2017370.- 2017370." 2017370. 2017370. 2017370. 2017370- 2017370- 2017370- 2017370- 2017370- 2017370- 2017370- 2017370- 2017370- 2017370- 2017370- 2017370- 2017370- 2017370- 2017370- 2017370-u 2017370-m 2017370-X 2017370-U 2017370-O 2017370-) 2017370- 2017370- 2017370- 2017370- 2017370- 2017370, 2017370, 2017370, 2017370, 2017370, 2017370, 2017370, 2017370, 2017370, 2017370,v 2017370,c 2017370,N 2017370,K 2017370,I 2017370,9 2017370,8 2017370,) 2017370, 2017370, 2017370, 2017370, 2017370, 2017370+ 2017370+ 2017370+ 2017370+ 2017370+ 2017370+ 2017370+ 2017370+ 2017370+} 2017370+x 2017370+n 2017370+X 2017370+D 2017370+6 2017370+- 2017370+ 2017370* 2017370* 2017370* 2017370* 2017370* 2017370* 2017370* 2017370* 2017370* 2017370* 2017370*z 2017370*y 2017370*x 2017370*Y 2017370*W 2017370*S 2017370*/ 2017370* 2017370* 2017370) 2017370) 2017370) 2017370) 2017370) 2017370) 2017370) 2017370) 2017370) 2017370) 2017370) 2017370) 2017370) 2017370) 2017370)t 2017370)l 2017370)< 2017370)0 2017370)! 2017370) 2017370) 2017370( 2017370( 2017370( 2017370( 2017370( 2017370( 2017370( 2017370( 2017370(v 2017370(T 2017370(P 2017370(M 2017370(G 2017370(= 2017370(! 2017370( 2017370( 2017370( 2017370' 2017370' 2017370' 2017370' 2017370' 2017370' 2017370' 2017370' 2017370' 2017370'} 2017370'` 2017370'Z 2017370'= 2017370', 2017370' 2017370& 2017370& 2017370& 2017370& 2017370& 2017370& 2017370& 2017370& 2017370& 2017370& 2017370& 2017370&w 2017370&M 2017370& 2017370& 2017370% 2017370% 2017370% 2017370% 2017370% 2017370% 2017370% 2017370% 2017370% 2017370% 2017370% 2017370% 2017370%s %7 Y \ t t ,WfW  -;' ossec13001gbExim Auth failed2025-03-03 04:57:28 dovecot_plain authenticator failed for ([103.174.34.49]) [103.174.34.49]:57061: 535 Incorrect authentication data (set_id=services)103.174.34.491269750m  -e) ossec13001gXExim Auth failed2025-03-03 04:57:18 dovecot_plain authenticator failed for ([41.159.145.190]) [41.159.145.190]:60575: 535 Incorrect authentication data (set_id=services@heipowersystem.com)41.159.145.1902400553Q  -1% ossec13001gExim Auth failed2025-03-03 04:55:30 dovecot_login authenticator failed for ([103.78.23.30]) [103.78.23.30]:49006: 535 Incorrect authentication data (set_id=sales)103.78.23.301269750f  -[' ossec13001gExim Auth failed2025-03-03 04:55:08 dovecot_login authenticator failed for ([91.72.171.210]) [91.72.171.210]:47128: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)91.72.171.210290557Z  -=+ ossec13001gExim Auth failed2025-03-03 04:55:06 dovecot_login authenticator failed for ([125.139.124.120]) [125.139.124.120]:35632: 535 Incorrect authentication data (set_id=sales)125.139.124.1201835841W  -9) ossec13001gExim Auth failed2025-03-03 04:54:55 dovecot_login authenticator failed for ([211.228.113.27]) [211.228.113.27]:34622: 535 Incorrect authentication data (set_id=sales)211.228.113.271835841m  -k% ossec13001gExim Auth failed2025-03-03 04:54:53 dovecot_login authenticator failed for 77-85-52-109.ip.btc-net.bg [77.85.52.109]:57803: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)77.85.52.109732800v  -y' ossec13001gExim Auth failed2025-03-03 04:54:43 dovecot_login authenticator failed for (173-29-118-52.client.mchsi.com) [173.29.118.52]:49277: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)173.29.118.526252001j  -_) ossec13001gExim Auth failed2025-03-03 04:54:31 dovecot_login authenticator failed for ([222.239.231.61]) [222.239.231.61]:52482: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)222.239.231.611835841]  -C+ ossec13001gExim Auth failed2025-03-03 04:54:24 dovecot_plain authenticator failed for ([222.112.246.217]) [222.112.246.217]:54530: 535 Incorrect authentication data (set_id=services)222.112.246.2171835841g  -[' ossec13001gExim Auth failed2025-03-03 04:54:15 dovecot_plain authenticator failed for ([58.16.215.241]) [58.16.215.241]:44984: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)58.16.215.2411814991|  -) ossec13001gExim Auth failed2025-03-03 04:54:03 dovecot_plain authenticator failed for 221-120-42-196.emome-ip.hinet.net [221.120.42.196]:59787: 535 Incorrect authentication data (set_id=services@heipowersystem.com)221.120.42.1961668284d  -W% ossec13001gExim Auth failed2025-03-03 04:53:55 dovecot_login authenticator failed for c-73-95-112-29.hsd1.co.comcast.net [73.95.112.29]:56514: 535 Incorrect authentication data (set_id=bo_msk)73.95.112.296252001y  -' ossec13001gyExim Auth failed2025-03-03 04:53:37 dovecot_login authenticator failed for p5098d833.dip0.t-ipconnect.de [80.152.216.51]:27092: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)80.152.216.512921044Z  -=+ ossec13001gExim Auth failed2025-03-03 04:50:24 dovecot_plain authenticator failed for ([223.239.130.245]) [223.239.130.245]:15098: 535 Incorrect authentication data (set_id=sales)223.239.130.2451269750j  -_) ossec13001gExim Auth failed2025-03-03 04:50:15 dovecot_plain authenticator failed for ([112.25.140.211]) [112.25.140.211]:40977: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)112.25.140.2111814991W  -;' ossec13001gExim Auth failed2025-03-03 04:50:36 dovecot_plain authenticator failed for ([49.124.151.64]) [49.124.151.64]:42610: 535 Incorrect authentication data (set_id=services)49.124.151.641733045  7  # EN^`r Z(  -?) ossec13001gExim Auth failed2025-03-03 05:07:02 dovecot_login authenticator failed for ([222.186.68.154]) [222.186.68.154]:42822: 535 Incorrect authentication data (set_id=services)222.186.68.1541814991T'  -5' ossec13001gExim Auth failed2025-03-03 05:07:24 dovecot_plain authenticator failed for ([103.47.74.210]) [103.47.74.210]:34958: 535 Incorrect authentication data (set_id=sales)103.47.74.2101269750h&  -]' ossec13001gExim Auth failed2025-03-03 05:07:09 dovecot_plain authenticator failed for ([177.174.89.105]) [177.174.89.99]:54938: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)177.174.89.993469034g%  -]% ossec13001gExim Auth failed2025-03-03 05:06:41 dovecot_login authenticator failed for ([102.53.15.18]) [102.53.15.18]:49615: 535 Incorrect authentication data (set_id=services@heipowersystem.com)102.53.15.182542007U$  -7' ossec13001gzExim Auth failed2025-03-03 05:06:26 dovecot_login authenticator failed for ([183.47.48.178]) [183.47.48.178]:53155: 535 Incorrect authentication data (set_id=bo_msk)183.47.48.1781814991j#  -c% ossec13001g`Exim Auth failed2025-03-03 05:06:00 dovecot_login authenticator failed for ([36.48.70.211]) [36.48.70.211]:39922: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)36.48.70.2111814991z"  -% ossec13001g*Exim Auth failed2025-03-03 05:05:05 dovecot_plain authenticator failed for (nsg-static-171.125.76.182-airtel.com) [182.76.87.90]:33002: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)182.76.87.901269750l!  -e) ossec13001g*Exim Auth failed2025-03-03 05:05:06 dovecot_plain authenticator failed for ([87.236.141.106]) [87.236.141.106]:39943: 535 Incorrect authentication data (set_id=services@heipowersystem.com)87.236.141.106290291s  -w% ossec13001gExim Auth failed2025-03-03 05:03:04 dovecot_plain authenticator failed for host-5-58-201-106.bitternet.ua [5.58.201.106]:8781: 535 Incorrect authentication data (set_id=services@heipowersystem.com)5.58.201.106690791Z  -=+ ossec13001gExim Auth failed2025-03-03 05:02:54 dovecot_plain authenticator failed for ([123.160.245.147]) [123.160.245.147]:49954: 535 Incorrect authentication data (set_id=sales)123.160.245.1471814991g  -[' ossec13001gExim Auth failed2025-03-03 05:02:42 dovecot_plain authenticator failed for ([46.173.45.180]) [46.173.45.180]:58948: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)46.173.45.1802017370]  -C+ ossec13001g.Exim Auth failed2025-03-03 05:00:53 dovecot_plain authenticator failed for ([125.140.244.144]) [125.140.244.144]:58698: 535 Incorrect authentication data (set_id=services)125.140.244.1441835841m  -e) ossec13001gExim Auth failed2025-03-03 05:00:35 dovecot_plain authenticator failed for ([123.209.107.18]) [123.209.107.18]:40936: 535 Incorrect authentication data (set_id=services@heipowersystem.com)123.209.107.182077456S  =+ ossec13008gMail Reciepient rejected2025-03-03 05:00:15 H=(mail.westerndancecompany.com) [165.154.226.249]:53568 F= rejected RCPT : Rejected relay attempt: '165.154.226.249' From: 'dzwovyiqnp@westerndancecompany.com' To: 'goofile@fastmail.com'165.154.226.2491668284W  -9) ossec13001gpExim Auth failed2025-03-03 04:57:42 dovecot_plain authenticator failed for ([128.185.224.87]) [152.52.243.154]:42918: 535 Incorrect authentication data (set_id=sales)152.52.243.1541269750j  -_) ossec13001gfExim Auth failed2025-03-03 04:57:33 dovecot_plain authenticator failed for ([119.62.156.161]) [119.62.156.161]:50172: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)119.62.156.1611814991 L  1 C F O [m +L[9  -C' ossec13001gExim Auth failed2025-03-03 05:34:28 dovecot_login authenticator failed for (vandanabalbharti.com) [111.207.12.99]:40328: 535 Incorrect authentication data (set_id=nologin)111.207.12.991814991l8  -g' ossec13001gExim Auth failed2025-03-03 05:30:01 dovecot_login authenticator failed for ([87.200.73.165]) [87.200.73.165]:43503: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)87.200.73.165290557j7  -a' ossec13001g^Exim Auth failed2025-03-03 05:27:16 dovecot_plain authenticator failed for ([183.105.3.221]) [183.105.3.221]:48896: 535 Incorrect authentication data (set_id=services@heipowersystem.com)183.105.3.2211835841j6  -_) ossec13001gTExim Auth failed2025-03-03 05:27:06 dovecot_plain authenticator failed for ([106.55.161.136]) [106.55.161.136]:41646: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)106.55.161.1361814991a5  -O' ossec13001gmExim Auth failed2025-03-03 05:27:33 dovecot_plain authenticator failed for d54c70cda.static.telenet.be [84.199.12.218]:46778: 535 Incorrect authentication data (set_id=services)84.199.12.2182802361T4  -5' ossec13001gmExim Auth failed2025-03-03 05:27:33 dovecot_plain authenticator failed for ([58.16.215.241]) [58.16.215.241]:35722: 535 Incorrect authentication data (set_id=sales)58.16.215.2411814991V3  -;' ossec13001gExim Auth failed2025-03-03 05:17:38 dovecot_plain authenticator failed for ([77.139.82.133]) [77.139.82.133]:50655: 535 Incorrect authentication data (set_id=services)77.139.82.1332946402  - ' ossec13001gExim Auth failed2025-03-03 05:17:28 dovecot_plain authenticator failed for broadband-188-32-170-20.ip.moscow.rt.ru [188.32.170.20]:55492: 535 Incorrect authentication data (set_id=services@heipowersystem.com)188.32.170.202017370W1  -9) ossec13001g Exim Auth failed2025-03-03 05:17:22 dovecot_plain authenticator failed for ([125.32.250.223]) [125.32.250.223]:39654: 535 Incorrect authentication data (set_id=sales)125.32.250.2231814991j0  -_) ossec13001gExim Auth failed2025-03-03 05:17:00 dovecot_plain authenticator failed for ([222.119.124.66]) [222.119.124.66]:50589: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)222.119.124.661835841p/  -m' ossec13001gExim Auth failed2025-03-03 05:12:04 dovecot_login authenticator failed for (pppoe-static.mosoblast.rt.ru) [77.51.214.170]:59975: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)77.51.214.1702017370s.  -o+ ossec13001gExim Auth failed2025-03-03 05:11:59 dovecot_login authenticator failed for ([178.178.194.128]) [178.178.194.128]:58912: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)178.178.194.1282017370y-  -}) ossec13001gExim Auth failed2025-03-03 05:11:55 dovecot_login authenticator failed for ([220.80.192.168]) [220.80.192.168]:51830: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)220.80.192.1681835841j,  -_) ossec13001gExim Auth failed2025-03-03 05:12:38 dovecot_login authenticator failed for syn-172-100-186-071.res.spectrum.com [172.100.186.71]:54984: 535 Incorrect authentication data (set_id=bo_msk)172.100.186.716252001j+  -_) ossec13001gExim Auth failed2025-03-03 05:12:11 dovecot_login authenticator failed for 226.149.48.116.static.netvigator.com [116.48.149.226]:55520: 535 Incorrect authentication data (set_id=bo_msk)116.48.149.2261819730j*  -c% ossec13001gExim Auth failed2025-03-03 05:11:47 dovecot_login authenticator failed for ([36.33.27.114]) [36.33.27.114]:58174: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)36.33.27.1141814991o)  -g+ ossec13001gExim Auth failed2025-03-03 05:09:04 dovecot_plain authenticator failed for ([103.231.163.154]) [103.231.163.154]:2016: 535 Incorrect authentication data (set_id=services@heipowersystem.com)103.231.163.1541210997 Q! 3 O [ u |C:NQyJ  -}) ossec13001gExim Auth failed2025-03-03 05:46:07 dovecot_login authenticator failed for (183.83.188.236.actcorp.in) [183.83.188.236]:59478: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)183.83.188.2361269750hI  -[) ossec13001gExim Auth failed2025-03-03 05:46:16 dovecot_login authenticator failed for 198-91-129-195.cpe.distributel.net [198.91.129.195]:52660: 535 Incorrect authentication data (set_id=bo_msk)198.91.129.1956251999TH  -7% ossec13001gCExim Auth failed2025-03-03 05:43:53 dovecot_plain authenticator failed for ([113.192.1.27]) [113.192.1.26]:37629: 535 Incorrect authentication data (set_id=services)113.192.1.261643084gG  -]% ossec13001g8Exim Auth failed2025-03-03 05:43:43 dovecot_plain authenticator failed for ([101.230.0.49]) [124.74.9.190]:61164: 535 Incorrect authentication data (set_id=services@heipowersystem.com)124.74.9.1901814991jF  -_) ossec13001g*Exim Auth failed2025-03-03 05:43:30 dovecot_plain authenticator failed for ([45.225.194.121]) [45.225.194.121]:42834: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)45.225.194.1213469034(E  3U) ossec11301gNew FTP connection.Mar 3 05:41:03 vm1 pure-ftpd[1650297]: (?@104.152.52.228) [INFO] New connection from 104.152.52.228104.152.52.2286252001(D  3U) ossec11301gNew FTP connection.Mar 3 05:40:43 vm1 pure-ftpd[1650187]: (?@104.152.52.106) [INFO] New connection from 104.152.52.106104.152.52.1066252001MC  =+ ossec13008gBMail Reciepient rejected2025-03-03 05:39:36 H=(mail.s2seducationtrust.com) [165.154.226.249]:63596 F= rejected RCPT : Rejected relay attempt: '165.154.226.249' From: 'nritxoiieu@s2seducationtrust.com' To: 'goofile@fastmail.com'165.154.226.2491668284dB  -U' ossec13001g2Exim Auth failed2025-03-03 05:39:21 dovecot_login authenticator failed for 111-70-32-180.emome-ip.hinet.net [111.70.32.180]:57104: 535 Incorrect authentication data (set_id=bo_msk)111.70.32.1801668284A  -) ossec13001g Exim Auth failed2025-03-03 05:39:04 dovecot_login authenticator failed for syn-098-102-148-242.biz.spectrum.com [98.102.148.242]:52844: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)98.102.148.2426252001o@  -g+ ossec13001gpExim Auth failed2025-03-03 05:36:07 dovecot_plain authenticator failed for 165.199.148.122.sta.wbroadband.net.au [122.148.199.165]:47686: 535 Incorrect authentication data (set_id=services)122.148.199.1652077456b?  -Q' ossec13001gbExim Auth failed2025-03-03 05:35:53 dovecot_plain authenticator failed for 124-11-130-37.static.tfn.net.tw [124.11.130.37]:35665: 535 Incorrect authentication data (set_id=sales)124.11.130.371668284p>  -m' ossec13001g&Exim Auth failed2025-03-03 05:34:53 dovecot_login authenticator failed for (vandanabalbharti.com) [111.207.12.99]:43770: 535 Incorrect authentication data (set_id=service@vandanabalbharti.com)111.207.12.991814991`=  -Q# ossec13001g^Exim Auth failed2025-03-03 05:35:49 dovecot_plain authenticator failed for 37.151.71.8.dynamic.telecom.kz [37.151.71.8]:34230: 535 Incorrect authentication data (set_id=services)37.151.71.81522867j<  -a' ossec13001gXExim Auth failed2025-03-03 05:35:43 dovecot_plain authenticator failed for ([37.28.177.141]) [37.28.177.141]:60520: 535 Incorrect authentication data (set_id=services@heipowersystem.com)37.28.177.1412017370m;  -e) ossec13001gNExim Auth failed2025-03-03 05:35:33 dovecot_plain authenticator failed for ([112.176.249.35]) [112.176.249.35]:47003: 535 Incorrect authentication data (set_id=services@heipowersystem.com)112.176.249.351835841j:  -_) ossec13001gLExim Auth failed2025-03-03 05:35:30 dovecot_plain authenticator failed for ([58.210.188.130]) [58.210.188.130]:22399: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)58.210.188.1301814991 8 * R o "1/8s[  -o+ ossec13001gExim Auth failed2025-03-03 06:08:09 dovecot_login authenticator failed for ([163.142.184.114]) [163.142.184.114]:58484: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)163.142.184.1141814991bZ  -S% ossec13001gExim Auth failed2025-03-03 06:03:12 dovecot_plain authenticator failed for 89-109-4-133.dynamic.mts-nn.ru [89.109.4.133]:56301: 535 Incorrect authentication data (set_id=services)89.109.4.1332017370Y  -=' ossec13001gExim Auth failed2025-03-03 06:02:58 dovecot_plain authenticator failed for 131-106-31-52.s1842.c3-0.eas-cbr5.atw-eas.pa.cable.rcncustomer.com [131.106.31.52]:46298: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)131.106.31.526252001mX  -e) ossec13001gExim Auth failed2025-03-03 06:02:50 dovecot_plain authenticator failed for ([111.93.177.228]) [111.93.177.228]:47778: 535 Incorrect authentication data (set_id=services@heipowersystem.com)111.93.177.2281269750tW  -y# ossec13001gExim Auth failed2025-03-03 06:00:20 dovecot_login authenticator failed for static-98-110-70-2.cmdnnj.fios.verizon.net [98.110.70.2]:45118: 535 Incorrect authentication data (set_id=vikas.khandelwal)98.110.70.26252001uV  -y% ossec13001gExim Auth failed2025-03-03 06:00:09 dovecot_login authenticator failed for (broadband.actcorp.in) [106.51.29.53]:47894: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)106.51.29.531269750gU  -]% ossec13001gyExim Auth failed2025-03-03 05:57:37 dovecot_plain authenticator failed for ([1.212.225.99]) [1.212.225.99]:52086: 535 Incorrect authentication data (set_id=services@heipowersystem.com)1.212.225.991835841dT  -U' ossec13001gqExim Auth failed2025-03-03 05:57:29 dovecot_plain authenticator failed for 62.174.139.16.static.user.ono.com [62.174.139.16]:51362: 535 Incorrect authentication data (set_id=sales)62.174.139.162510769dS  -W% ossec13001g_Exim Auth failed2025-03-03 05:57:10 dovecot_plain authenticator failed for ([59.34.17.130]) [59.34.17.130]:38334: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)59.34.17.1301814991NR  --# ossec13001gExim Auth failed2025-03-03 05:53:47 dovecot_plain authenticator failed for ([8.209.221.7]) [8.209.221.7]:57026: 535 Incorrect authentication data (set_id=sales)8.209.221.71861060jQ  -_) ossec13001gwExim Auth failed2025-03-03 05:53:18 dovecot_plain authenticator failed for ([175.119.20.149]) [175.119.20.149]:33647: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)175.119.20.1491835841]P  -C+ ossec13001gExim Auth failed2025-03-03 05:51:07 dovecot_plain authenticator failed for ([123.209.117.171]) [123.209.117.171]:33852: 535 Incorrect authentication data (set_id=services)123.209.117.1712077456_O  -K' ossec13001gExim Auth failed2025-03-03 05:51:05 dovecot_login authenticator failed for d54c70cda.static.telenet.be [84.199.12.218]:46022: 535 Incorrect authentication data (set_id=bo_msk)84.199.12.2182802361TN  -5' ossec13001gExim Auth failed2025-03-03 05:50:50 dovecot_plain authenticator failed for ([92.255.190.69]) [92.255.190.69]:39040: 535 Incorrect authentication data (set_id=sales)92.255.190.692017370pM  -i+ ossec13001gExim Auth failed2025-03-03 05:50:43 dovecot_plain authenticator failed for ([123.209.105.123]) [123.209.105.123]:33368: 535 Incorrect authentication data (set_id=services@heipowersystem.com)123.209.105.1232077456pL  -k) ossec13001gExim Auth failed2025-03-03 05:50:37 dovecot_login authenticator failed for ([61.191.163.102]) [61.191.163.102]:35194: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)61.191.163.1021814991jK  -_) ossec13001gExim Auth failed2025-03-03 05:50:30 dovecot_plain authenticator failed for ([183.167.196.62]) [183.167.196.62]:52720: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)183.167.196.621814991 2  9 d v 2Zl  -?) ossec13001gExim Auth failed2025-03-03 06:25:52 dovecot_plain authenticator failed for ([123.209.194.49]) [123.209.194.49]:33236: 535 Incorrect authentication data (set_id=services)123.209.194.492077456|k  -) ossec13001gExim Auth failed2025-03-03 06:25:24 dovecot_plain authenticator failed for ip-179.48.229.117.fiberlinkpe.net.br ([179.48.229.118]) [179.48.229.117]:54576: 535 Incorrect authentication data (set_id=sales)179.48.229.1173469034{j  -' ossec13001gExim Auth failed2025-03-03 06:25:18 dovecot_plain authenticator failed for 89-179-99-200.broadband.corbina.ru [89.179.99.200]:53556: 535 Incorrect authentication data (set_id=services@heipowersystem.com)89.179.99.2002017370zi  -' ossec13001gExim Auth failed2025-03-03 06:25:12 dovecot_plain authenticator failed for syn-172-090-128-097.res.spectrum.com [172.90.128.97]:53431: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)172.90.128.976252001Zh  -?) ossec13001g9Exim Auth failed2025-03-03 06:22:07 dovecot_plain authenticator failed for ([111.48.208.197]) [111.48.208.197]:17176: 535 Incorrect authentication data (set_id=services)111.48.208.1971814991mg  -c+ ossec13001g7Exim Auth failed2025-03-03 06:22:06 dovecot_plain authenticator failed for ([103.219.154.156]) [103.219.154.156]:42626: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)103.219.154.1562750405jf  -c% ossec13001gExim Auth failed2025-03-03 06:21:41 dovecot_plain authenticator failed for ([103.177.205.100]) [58.84.61.189]:12508: 535 Incorrect authentication data (set_id=services@heipowersystem.com)58.84.61.1891269750Ne  -/! ossec13001gUExim Auth failed2025-03-03 06:18:19 dovecot_plain authenticator failed for ([59.8.11.36]) [59.8.11.36]:50783: 535 Incorrect authentication data (set_id=services)59.8.11.361835841bd  -M+ ossec13001g=Exim Auth failed2025-03-03 06:17:56 dovecot_plain authenticator failed for 220-235-212-152.tpgi.com.au [220.235.212.152]:37176: 535 Incorrect authentication data (set_id=sales)220.235.212.1522077456pc  -i+ ossec13001g1Exim Auth failed2025-03-03 06:17:44 dovecot_plain authenticator failed for ([123.209.105.123]) [123.209.105.123]:36866: 535 Incorrect authentication data (set_id=services@heipowersystem.com)123.209.105.1232077456jb  -_) ossec13001g1Exim Auth failed2025-03-03 06:17:43 dovecot_plain authenticator failed for (mail.salee.co.kr) [220.90.239.158]:63729: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)220.90.239.1581835841Qa  -3% ossec13001g\Exim Auth failed2025-03-03 06:14:11 dovecot_login authenticator failed for ([194.28.91.40]) [194.28.91.40]:33373: 535 Incorrect authentication data (set_id=bo_msk)194.28.91.40690791Z`  -?) ossec13001gHExim Auth failed2025-03-03 06:13:51 dovecot_plain authenticator failed for ([114.202.80.152]) [114.202.80.152]:42667: 535 Incorrect authentication data (set_id=services)114.202.80.1521835841p_  -k) ossec13001g>Exim Auth failed2025-03-03 06:13:41 dovecot_login authenticator failed for ([124.112.45.222]) [124.112.45.222]:46001: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)124.112.45.2221814991d^  -U' ossec13001g<Exim Auth failed2025-03-03 06:13:40 dovecot_plain authenticator failed for h88-129-31-231.cust.bredband2.com [88.129.31.231]:48802: 535 Incorrect authentication data (set_id=sales)88.129.31.2312661886]  -% ossec13001g4Exim Auth failed2025-03-03 06:13:32 dovecot_plain authenticator failed for 206.81.4.146.static.wline.lns.sme.cust.swisscom.ch [146.4.81.206]:34447: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)146.4.81.2062658434\  - ) ossec13001g$Exim Auth failed2025-03-03 06:13:16 dovecot_plain authenticator failed for c-73-106-172-226.hsd1.ga.comcast.net [73.106.172.226]:53274: 535 Incorrect authentication data (set_id=services@heipowersystem.com)73.106.172.2266252001 *\~tj`VLB8.$zpf\H>4*   v l b X N D : 0 &    ~ t j ` V L B 8 . $    z p f \ R H > 4 *  vlbND:X0&|rh^TJ@6,"xndZPF<2( ~tj`VLB8.$pz\f | r h ^ T J @ 6 , "    x n d Z P F < 2 (   RRH>4*  vlbXND:0& g g gZ gz gh gf gz g\ g+ g g g gE g! g g1 g- g) g g g g g} gs g g g gq gS gK gW g g g gy g g g g g g g g g g g g g g g g g g g gS g/ g9 g O g C g  g  g  g  g h g X g L g B g  g  g  g  g  g b g L g g g g g g g g g g g g g g gz gh g^ gj g gx gv gp g* g( g& g  g g g~ g} g| g{ g$z gy gx gw gv gu gt gs gr gq gp go gn gm gl gk gj gi g9h g7g gf gUe g=d g1c g1b g\a gH` g>_ g<^ g4] g$\ g[ gZ gY gX gW gV gyU gqT g_S gR gwQ gP gO gN gM gL gK gI gJ gCH g8G g*F gE gD gBC g2B g A gp@ gb? g^= gX< gN; gL: g+E g* g* g( g( g(X g(> g( g' g' g' g' g'x g'n g'b g'Z g& g& g& g& g& g& g% g$ g$ g$9 g$ g# g# g" g" g  g  g  g gx gM g7 g g g g g g&> g9 g8 gm5 gm4 g^7 gT6 g3 g2 g 1 g0 g, g+ g/ g. g- g* g) g' g& g( g% gz$ g`# g*" g*! g g g g. g g gp gf gb gX g g g g g g g+O g g g g g gy g g g g g g g g g g g g g g g g g gv gl gh g\ gZ gN g^ gN g" g g g g g gw g g g gq G! - H m 9NJJG}  - ) ossec13001gExim Auth failed2025-03-03 06:36:24 dovecot_plain authenticator failed for customer-ip-193-151-51-223.ipv.net.pl ([91.227.103.222]) [193.151.51.223]:46892: 535 Incorrect authentication data (set_id=services)193.151.51.223798544||  -% ossec13001gExim Auth failed2025-03-03 06:36:20 dovecot_plain authenticator failed for port-ip-88-150-6-165.reverse.mdcc-fun.de [88.150.6.165]:62991: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)88.150.6.1652921044{  - ' ossec13001gExim Auth failed2025-03-03 06:36:15 dovecot_plain authenticator failed for broadband-5-228-183-178.ip.moscow.rt.ru [5.228.183.178]:23426: 535 Incorrect authentication data (set_id=services@heipowersystem.com)5.228.183.1782017370gz  -[' ossec13001g$Exim Auth failed2025-03-03 06:34:34 dovecot_plain authenticator failed for syn-097-070-129-101.res.spectrum.com [97.70.129.101]:33473: 535 Incorrect authentication data (set_id=sales)97.70.129.1016252001Vy  -;' ossec13001gExim Auth failed2025-03-03 06:34:23 dovecot_plain authenticator failed for ([91.219.196.17]) [91.219.196.17]:56780: 535 Incorrect authentication data (set_id=services)91.219.196.17690791gx  -]% ossec13001gExim Auth failed2025-03-03 06:34:12 dovecot_plain authenticator failed for ([218.68.0.210]) [218.68.0.210]:56191: 535 Incorrect authentication data (set_id=services@heipowersystem.com)218.68.0.2101814991gw  -[' ossec13001gExim Auth failed2025-03-03 06:33:55 dovecot_plain authenticator failed for ([112.173.61.81]) [112.173.61.81]:54950: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)112.173.61.811835841pv  -i+ ossec13001gExim Auth failed2025-03-03 06:31:53 dovecot_plain authenticator failed for ([185.235.212.105]) [185.235.212.105]:36786: 535 Incorrect authentication data (set_id=services@heipowersystem.com)185.235.212.1053202326Uu  -7' ossec13001gExim Auth failed2025-03-03 06:32:07 dovecot_login authenticator failed for ([82.208.99.163]) [82.208.99.163]:56320: 535 Incorrect authentication data (set_id=bo_msk)82.208.99.1632017370St  -5% ossec13001gExim Auth failed2025-03-03 06:32:03 dovecot_plain authenticator failed for ([59.96.62.29]) [49.47.195.35]:41624: 535 Incorrect authentication data (set_id=services)49.47.195.351269750s  -) ossec13001gExim Auth failed2025-03-03 06:31:58 dovecot_login authenticator failed for (static-206.168.107.27-tataidc.co.in) [27.107.168.206]:34172: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)27.107.168.2061269750Ur  -7' ossec13001gExim Auth failed2025-03-03 06:29:01 dovecot_login authenticator failed for ([203.124.36.67]) [203.124.36.67]:49515: 535 Incorrect authentication data (set_id=bo_msk)203.124.36.671168579Wq  -;' ossec13001gExim Auth failed2025-03-03 06:28:47 dovecot_plain authenticator failed for ([181.197.38.12]) [181.197.38.12]:47366: 535 Incorrect authentication data (set_id=services)181.197.38.123703430ap  -O' ossec13001gExim Auth failed2025-03-03 06:28:34 dovecot_plain authenticator failed for (mamanguape.static.gvt.net.br) [177.207.248.5]:49556: 535 Incorrect authentication data (set_id=sales)177.207.248.53469034po  -k) ossec13001gExim Auth failed2025-03-03 06:28:32 dovecot_login authenticator failed for ([111.93.177.228]) [111.93.177.228]:51700: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)111.93.177.2281269750mn  -e) ossec13001gExim Auth failed2025-03-03 06:28:24 dovecot_plain authenticator failed for ([218.98.160.117]) [218.98.160.117]:24928: 535 Incorrect authentication data (set_id=services@heipowersystem.com)218.98.160.1171814991jm  -_) ossec13001gExim Auth failed2025-03-03 06:28:21 dovecot_plain authenticator failed for ([189.218.168.30]) [189.218.168.30]:50921: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)189.218.168.303996063 % % 4 G l  =bqX  -;) ossec13001gExim Auth failed2025-03-03 06:55:02 dovecot_login authenticator failed for ([207.228.181.34]) [207.228.181.34]:34621: 535 Incorrect authentication data (set_id=bo_msk)207.228.181.343573345m  -g' ossec13001gExim Auth failed2025-03-03 06:54:50 dovecot_login authenticator failed for ([94.181.23.131]) [94.181.23.131]:39959: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)94.181.23.1312017370W  -;' ossec13001gzExim Auth failed2025-03-03 06:48:49 dovecot_plain authenticator failed for ([72.26.178.196]) [72.26.178.196]:48098: 535 Incorrect authentication data (set_id=services)72.26.178.1966252001N  --# ossec13001ghExim Auth failed2025-03-03 06:48:31 dovecot_plain authenticator failed for ([61.169.6.99]) [61.169.6.99]:44908: 535 Incorrect authentication data (set_id=sales)61.169.6.991814991z  -' ossec13001g^Exim Auth failed2025-03-03 06:48:21 dovecot_plain authenticator failed for syn-024-090-169-209.res.spectrum.com [24.90.169.209]:52023: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)24.90.169.2096252001g  -]% ossec13001gjExim Auth failed2025-03-03 06:48:34 dovecot_plain authenticator failed for ([141.94.18.69]) [141.94.18.69]:58512: 535 Incorrect authentication data (set_id=services@heipowersystem.com)141.94.18.693017382Z  -=+ ossec13001gExim Auth failed2025-03-03 06:40:39 dovecot_plain authenticator failed for ([211.198.178.191]) [211.198.178.191]:60618: 535 Incorrect authentication data (set_id=sales)211.198.178.1911835841`  -O% ossec13001gxExim Auth failed2025-03-03 06:40:16 dovecot_plain authenticator failed for ti0004q160-7861.bb.online.no [95.34.158.19]:58308: 535 Incorrect authentication data (set_id=services)95.34.158.193144096j  -_) ossec13001gvExim Auth failed2025-03-03 06:40:14 dovecot_plain authenticator failed for ([106.55.161.136]) [106.55.161.136]:57450: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)106.55.161.1361814991j  -a' ossec13001gpExim Auth failed2025-03-03 06:40:06 dovecot_plain authenticator failed for ([218.4.214.115]) [218.4.214.115]:37230: 535 Incorrect authentication data (set_id=services@heipowersystem.com)218.4.214.1151814991R  -3% ossec13001g*Exim Auth failed2025-03-03 06:38:57 dovecot_login authenticator failed for ([1.212.225.99]) [1.212.225.99]:44898: 535 Incorrect authentication data (set_id=bo_msk)1.212.225.991835841W  -;' ossec13001g(Exim Auth failed2025-03-03 06:38:54 dovecot_plain authenticator failed for ([107.91.33.184]) [107.91.33.184]:54915: 535 Incorrect authentication data (set_id=services)107.91.33.1846252001i  -]) ossec13001g&Exim Auth failed2025-03-03 06:38:52 dovecot_plain authenticator failed for syn-070-122-139-172.res.spectrum.com [70.122.139.172]:49184: 535 Incorrect authentication data (set_id=sales)70.122.139.1726252001m  -g) ossec13001g Exim Auth failed2025-03-03 06:38:26 dovecot_plain authenticator failed for ([185.134.179.106]) [185.101.16.250]:51657: 535 Incorrect authentication data (set_id=services@heipowersystem.com)185.101.16.250272103|  -+ ossec13001gExim Auth failed2025-03-03 06:38:09 dovecot_plain authenticator failed for (190-205-112-156.static.cantv.net) [190.205.112.156]:24186: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)190.205.112.1563625428m  -g' ossec13001gExim Auth failed2025-03-03 06:37:54 dovecot_login authenticator failed for ([50.249.167.45]) [50.249.167.45]:54946: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)50.249.167.456252001f~  -U+ ossec13001gExim Auth failed2025-03-03 06:38:30 dovecot_login authenticator failed for p238220-obmd01.tokyo.ocn.ne.jp [153.141.147.220]:37276: 535 Incorrect authentication data (set_id=bo_msk)153.141.147.2201861060 c' N q * ) 8` 5Mcf  -[% ossec13001g Exim Auth failed2025-03-03 07:15:38 dovecot_plain authenticator failed for static-84-242-88-70.bb.vodafone.cz [84.242.88.70]:50772: 535 Incorrect authentication data (set_id=services)84.242.88.703077311d  -W% ossec13001g Exim Auth failed2025-03-03 07:15:19 dovecot_plain authenticator failed for ([110.14.68.11]) [110.14.68.11]:37718: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)110.14.68.111835841g  -_% ossec13001g Exim Auth failed2025-03-03 07:15:12 dovecot_plain authenticator failed for ([89.211.42.163]) [37.186.54.71]:63272: 535 Incorrect authentication data (set_id=services@heipowersystem.com)37.186.54.71289688Q  -1% ossec13001g bExim Auth failed2025-03-03 07:14:01 dovecot_login authenticator failed for ([8.139.253.26]) [8.139.253.26]:8090: 535 Incorrect authentication data (set_id=bo_msk)8.139.253.261814991p  -k) ossec13001g LExim Auth failed2025-03-03 07:13:39 dovecot_login authenticator failed for ([200.106.49.149]) [200.106.49.149]:59824: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)200.106.49.1493932488[  -?+ ossec13001gExim Auth failed2025-03-03 07:11:03 dovecot_login authenticator failed for ([103.158.138.179]) [103.158.138.179]:49522: 535 Incorrect authentication data (set_id=bo_msk)103.158.138.1791269750m  -g' ossec13001gExim Auth failed2025-03-03 07:10:43 dovecot_login authenticator failed for ([175.202.82.16]) [175.202.82.16]:40448: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)175.202.82.161835841# 3M% ossec11301gNew FTP connection.Mar 3 07:10:22 vm1 pure-ftpd[1668967]: (?@106.75.50.44) [INFO] New connection from 106.75.50.44106.75.50.441814991T  -7% ossec13001gExim Auth failed2025-03-03 07:07:28 dovecot_plain authenticator failed for ([84.21.165.17]) [84.21.165.17]:59572: 535 Incorrect authentication data (set_id=services)84.21.165.172017370W  -9) ossec13001gExim Auth failed2025-03-03 07:07:19 dovecot_plain authenticator failed for ([207.219.221.53]) [207.219.221.53]:59448: 535 Incorrect authentication data (set_id=sales)207.219.221.536251999  -/) ossec13001gExim Auth failed2025-03-03 07:07:01 dovecot_plain authenticator failed for ip-179.48.229.117.fiberlinkpe.net.br ([179.48.229.118]) [179.48.229.117]:36594: 535 Incorrect authentication data (set_id=services@heipowersystem.com)179.48.229.1173469034}  -' ossec13001gExim Auth failed2025-03-03 07:06:57 dovecot_plain authenticator failed for broadband-188-32-170-20.ip.moscow.rt.ru [188.32.170.20]:55842: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)188.32.170.202017370C  =) ossec13008gMail Reciepient rejected2025-03-03 07:06:53 H=(mail.vandanabalbharti.com) [165.154.210.93]:56001 F= rejected RCPT : Rejected relay attempt: '165.154.210.93' From: 'ejdjvtzd@vandanabalbharti.com' To: 'goofile@fastmail.com'165.154.210.931694008Y  -?) ossec13001gExim Auth failed2025-03-03 06:58:55 dovecot_plain authenticator failed for ([178.218.193.90]) [178.218.193.90]:51880: 535 Incorrect authentication data (set_id=services)178.218.193.90798544U  -7' ossec13001gExim Auth failed2025-03-03 06:58:44 dovecot_plain authenticator failed for ([223.80.109.135]) [27.223.100.90]:59842: 535 Incorrect authentication data (set_id=sales)27.223.100.901814991j  -a' ossec13001gExim Auth failed2025-03-03 06:58:36 dovecot_plain authenticator failed for ([92.255.166.13]) [92.255.166.13]:34402: 535 Incorrect authentication data (set_id=services@heipowersystem.com)92.255.166.132017370g  -[' ossec13001gExim Auth failed2025-03-03 06:58:21 dovecot_plain authenticator failed for ([41.224.62.206]) [41.224.62.206]:48422: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)41.224.62.2062464461 [( 4 Y h  !FCUS[t0  -u' ossec13001gExim Auth failed2025-03-03 07:40:14 dovecot_plain authenticator failed for (111-86-33-194.intelcom-ug.ru) [194.33.87.111]:60680: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)194.33.87.1112017370~/  - ' ossec13001gExim Auth failed2025-03-03 07:36:10 dovecot_login authenticator failed for 90-230-168-26-no600.tbcn.telia.com [90.230.168.26]:37240: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)90.230.168.262661886j.  -a' ossec13001gSExim Auth failed2025-03-03 07:35:06 dovecot_plain authenticator failed for ([146.88.78.123]) [146.88.78.123]:45342: 535 Incorrect authentication data (set_id=services@heipowersystem.com)146.88.78.1231694008-  - ) ossec13001g/Exim Auth failed2025-03-03 07:34:30 dovecot_plain authenticator failed for (mobile-166-195-193-083.mycingular.net) [166.195.193.83]:39143: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)166.195.193.836252001W,  -9) ossec13001g9Exim Auth failed2025-03-03 07:34:41 dovecot_plain authenticator failed for ([121.189.226.81]) [121.189.226.81]:49402: 535 Incorrect authentication data (set_id=sales)121.189.226.811835841e+  -U) ossec13001g OExim Auth failed2025-03-03 07:30:45 dovecot_login authenticator failed for (207.122.87.116.starhub.net.sg) [116.87.122.207]:54088: 535 Incorrect authentication data (set_id=bo_msk)116.87.122.2071880251s*  -o+ ossec13001g CExim Auth failed2025-03-03 07:30:34 dovecot_login authenticator failed for ([106.246.227.218]) [106.246.227.218]:33246: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)106.246.227.2181835841Q)  -3# ossec13001g Exim Auth failed2025-03-03 07:29:07 dovecot_plain authenticator failed for ([1.31.80.166]) [1.31.80.166]:33441: 535 Incorrect authentication data (set_id=services)1.31.80.1661814991W(  -9) ossec13001g Exim Auth failed2025-03-03 07:29:02 dovecot_plain authenticator failed for ([191.59.177.235]) [191.59.177.235]:37494: 535 Incorrect authentication data (set_id=sales)191.59.177.2353469034j'  -a' ossec13001g Exim Auth failed2025-03-03 07:28:50 dovecot_plain authenticator failed for ([46.21.240.186]) [46.21.240.186]:50151: 535 Incorrect authentication data (set_id=services@heipowersystem.com)46.21.240.1862017370d&  -W% ossec13001g Exim Auth failed2025-03-03 07:28:45 dovecot_plain authenticator failed for ([90.173.78.90]) [90.173.78.90]:41453: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)90.173.78.902510769]%  -G' ossec13001g hExim Auth failed2025-03-03 07:22:39 dovecot_plain authenticator failed for (made-again.tmesis.com) [24.187.213.29]:36680: 535 Incorrect authentication data (set_id=services)24.187.213.296252001m$  -e) ossec13001g XExim Auth failed2025-03-03 07:22:23 dovecot_plain authenticator failed for ([187.76.173.246]) [187.76.173.246]:45241: 535 Incorrect authentication data (set_id=services@heipowersystem.com)187.76.173.2463469034W#  -9) ossec13001g LExim Auth failed2025-03-03 07:22:12 dovecot_plain authenticator failed for ([45.225.194.121]) [45.225.194.121]:39664: 535 Incorrect authentication data (set_id=sales)45.225.194.1213469034p"  -m' ossec13001g BExim Auth failed2025-03-03 07:22:01 dovecot_plain authenticator failed for (106.51.68.128.actcorp.in) [202.122.16.50]:50112: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)202.122.16.501269750T!  -7% ossec13001g Exim Auth failed2025-03-03 07:16:40 dovecot_login authenticator failed for ([117.135.6.10]) [117.135.6.10]:58558: 535 Incorrect authentication data (set_id=services)117.135.6.101814991|  -) ossec13001g Exim Auth failed2025-03-03 07:16:06 dovecot_login authenticator failed for 220-135-116-94.hinet-ip.hinet.net [220.135.116.94]:51146: 535 Incorrect authentication data (set_id=services@heipowersystem.com)220.135.116.941668284 : r f [uZWTMGG:::::: n+188.166.219.127BLACKgotg@tBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests1880251localm)173.239.249.42BLACKgU5g&5Blacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests6252001*local}l#84.239.5.15BLACKg(gBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests6252001Tlocal}k#13.250.9.37BLACKggBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests1880251 %localj)52.164.121.210BLACKggȤBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests29635974ylocali'13.79.156.134BLACKgɀgȚBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests2963597 Olocalh+103.244.251.164BLACKg[g,Blacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests1831722glocalg'52.164.121.91BLACKg:g Blacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests29635974y[local~f%13.94.98.135BLACKg2$g$Blacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests2963597 ^blocal\['13.69.217.124BLACKgԳEgDŽEBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests2963597 E|local~Z%13.69.209.12BLACKgng?Blacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests2963597 E localY'45.76.255.173BLACKg~g~Blacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests6252001-Llocal}R#52.169.95.1BLACKg1gBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests29635974_local b{P)!k18.191.225.152GRAYgImunify360gcAutomatically blocked due to distributed attack6252001local~O%84.17.52.248BLACKggؿBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests2658434T4localL)195.15.242.133BLACKggBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests2658434local lG'84.234.31.211BLACKg̥gÝBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests2658434Tlocal|F!3.15.15.12BLACKgЯgÀBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests6252001 localE+188.213.128.195BLACKgmg>Blacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests2658434Հlocal~C'13.79.154.153BLACKg4gBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests2963597 Olocal~B%52.169.71.29BLACKg;g·;Blacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests29635974GlocalA'37.156.47.169BLACKggµBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests2658434%/localU+172.167.192.196BLACKgrGgCGBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests2635167localT'52.169.180.19BLACKgNgBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests29635974local = _ r  #EMEgZA  -?) ossec13001gExim Auth failed2025-03-03 07:54:21 dovecot_plain authenticator failed for ([165.90.101.190]) [165.90.101.190]:58519: 535 Incorrect authentication data (set_id=services)165.90.101.1903374766Z@  -=+ ossec13001gExim Auth failed2025-03-03 07:54:08 dovecot_plain authenticator failed for ([119.198.191.130]) [119.198.191.130]:44160: 535 Incorrect authentication data (set_id=sales)119.198.191.1301835841?  -+ ossec13001gExim Auth failed2025-03-03 07:54:03 dovecot_plain authenticator failed for 189.115.230.179.dynamic.adsl.gvt.net.br [189.115.230.179]:60565: 535 Incorrect authentication data (set_id=services@heipowersystem.com)189.115.230.1793469034t>  -s) ossec13001gExim Auth failed2025-03-03 07:53:55 dovecot_plain authenticator failed for (124-170-38-136.tpgi.com.au) [124.170.38.136]:54769: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)124.170.38.1362077456Z=  -=+ ossec13001gExim Auth failed2025-03-03 07:49:41 dovecot_plain authenticator failed for ([218.149.228.170]) [218.149.228.170]:40103: 535 Incorrect authentication data (set_id=sales)218.149.228.1701835841c<  -W% ossec13001gExim Auth failed2025-03-03 07:49:23 dovecot_plain authenticator failed for ([154.73.19.69]) [154.73.19.69]:42285: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)154.73.19.69953987p;  -k) ossec13001gExim Auth failed2025-03-03 07:49:22 dovecot_plain authenticator failed for (nsg-corporate-34.230.187.122.airtel.in) [122.187.230.34]:49014: 535 Incorrect authentication data (set_id=services)122.187.230.341269750j:  -a' ossec13001gExim Auth failed2025-03-03 07:49:09 dovecot_plain authenticator failed for ([14.49.197.174]) [14.49.197.174]:36201: 535 Incorrect authentication data (set_id=services@heipowersystem.com)14.49.197.1741835841[9  -?+ ossec13001gExim Auth failed2025-03-03 07:49:00 dovecot_login authenticator failed for ([121.178.185.141]) [121.178.185.141]:49606: 535 Incorrect authentication data (set_id=bo_msk)121.178.185.1411835841j8  -c% ossec13001gExim Auth failed2025-03-03 07:48:44 dovecot_login authenticator failed for ([58.18.90.114]) [58.18.90.114]:55786: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)58.18.90.1141814991f7  -Y' ossec13001gExim Auth failed2025-03-03 07:45:26 dovecot_plain authenticator failed for 179-189-85-66.goldnettelecom.com.br [179.189.85.66]:33690: 535 Incorrect authentication data (set_id=sales)179.189.85.663469034]6  -C+ ossec13001gExim Auth failed2025-03-03 07:45:24 dovecot_plain authenticator failed for ([124.115.229.202]) [124.115.229.202]:45307: 535 Incorrect authentication data (set_id=services)124.115.229.2021814991j5  -_) ossec13001gExim Auth failed2025-03-03 07:45:12 dovecot_plain authenticator failed for ([60.175.146.138]) [60.175.146.138]:33047: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)60.175.146.1381814991i4  -a' ossec13001gExim Auth failed2025-03-03 07:45:10 dovecot_plain authenticator failed for ([91.239.23.149]) [91.239.23.149]:44424: 535 Incorrect authentication data (set_id=services@heipowersystem.com)91.239.23.149458258Z3  -?) ossec13001gExim Auth failed2025-03-03 07:40:44 dovecot_plain authenticator failed for ([183.167.198.31]) [183.167.198.31]:35616: 535 Incorrect authentication data (set_id=services)183.167.198.311814991Q2  -1% ossec13001gExim Auth failed2025-03-03 07:40:39 dovecot_plain authenticator failed for ([182.76.87.90]) [182.76.87.90]:46238: 535 Incorrect authentication data (set_id=sales)182.76.87.901269750j1  -a' ossec13001gExim Auth failed2025-03-03 07:40:25 dovecot_plain authenticator failed for ([46.52.204.227]) [46.52.204.227]:38892: 535 Incorrect authentication data (set_id=services@heipowersystem.com)46.52.204.2272017370 z% L n 69RqzsR  -s' ossec13001gExim Auth failed2025-03-03 08:06:01 dovecot_plain authenticator failed for p5098d833.dip0.t-ipconnect.de [80.152.216.51]:30165: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)80.152.216.512921044]Q  -C+ ossec13001gExim Auth failed2025-03-03 08:06:39 dovecot_plain authenticator failed for ([109.124.195.218]) [109.124.195.218]:54798: 535 Incorrect authentication data (set_id=services)109.124.195.2182017370cP  -Q) ossec13001gExim Auth failed2025-03-03 08:06:15 dovecot_plain authenticator failed for 208.95.143.157.bbcs.as8758.net [157.143.95.208]:60532: 535 Incorrect authentication data (set_id=sales)157.143.95.2082658434yO  -# ossec13001gExim Auth failed2025-03-03 08:06:11 dovecot_plain authenticator failed for syn-071-091-077-097.res.spectrum.com [71.91.77.97]:60441: 535 Incorrect authentication data (set_id=services@heipowersystem.com)71.91.77.976252001UN  -7' ossec13001g}Exim Auth failed2025-03-03 08:05:40 dovecot_login authenticator failed for ([120.78.172.20]) [120.78.172.20]:33108: 535 Incorrect authentication data (set_id=bo_msk)120.78.172.201814991jM  -c% ossec13001gsExim Auth failed2025-03-03 08:05:30 dovecot_login authenticator failed for ([59.22.68.213]) [59.22.68.213]:60015: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)59.22.68.2131835841ZL  -?) ossec13001gExim Auth failed2025-03-03 08:03:54 dovecot_plain authenticator failed for ([196.28.226.124]) [196.28.226.124]:46176: 535 Incorrect authentication data (set_id=services)196.28.226.1241036973}K  - % ossec13001gExim Auth failed2025-03-03 08:03:16 dovecot_plain authenticator failed for (nsg-static-170.125.76.182-airtel.com) [182.76.87.90]:48428: 535 Incorrect authentication data (set_id=services@heipowersystem.com)182.76.87.901269750gJ  -[' ossec13001gExim Auth failed2025-03-03 08:03:10 dovecot_plain authenticator failed for ([49.124.153.35]) [49.124.153.35]:47230: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)49.124.153.351733045]I  -C+ ossec13001gqExim Auth failed2025-03-03 08:01:11 dovecot_plain authenticator failed for ([222.236.155.146]) [222.236.155.146]:33324: 535 Incorrect authentication data (set_id=services)222.236.155.1461835841mH  -e) ossec13001gSExim Auth failed2025-03-03 08:00:42 dovecot_plain authenticator failed for ([191.210.87.101]) [191.210.87.101]:42711: 535 Incorrect authentication data (set_id=services@heipowersystem.com)191.210.87.1013469034yG  -) ossec13001gKExim Auth failed2025-03-03 08:00:34 dovecot_plain authenticator failed for (static.109.226.15.123.ccc.net.il) [109.226.15.123]:43349: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)109.226.15.123294640TF  -5' ossec13001gWExim Auth failed2025-03-03 08:00:46 dovecot_plain authenticator failed for ([112.132.89.72]) [112.132.89.72]:55871: 535 Incorrect authentication data (set_id=sales)112.132.89.721814991ZE  -=+ ossec13001gExim Auth failed2025-03-03 07:57:22 dovecot_plain authenticator failed for ([111.193.226.252]) [111.193.226.252]:43346: 535 Incorrect authentication data (set_id=sales)111.193.226.2521814991UD  -;' ossec13001gExim Auth failed2025-03-03 07:57:19 dovecot_plain authenticator failed for ([65.20.235.206]) [65.20.235.206]:54877: 535 Incorrect authentication data (set_id=services)65.20.235.20699237iC  -_) ossec13001gExim Auth failed2025-03-03 07:57:10 dovecot_plain authenticator failed for ([196.46.203.188]) [196.46.203.188]:42404: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)196.46.203.188895949jB  -a' ossec13001gyExim Auth failed2025-03-03 07:57:04 dovecot_plain authenticator failed for ([124.160.45.26]) [124.160.45.26]:46814: 535 Incorrect authentication data (set_id=services@heipowersystem.com)124.160.45.261814991 oI{naTG:- . w X K 1 $  ~qdWJ=0# zm`SF9, v i \ O B 5 (  Itxk^QDsfYL?2% pc 3Z*  r e&7Mg |  bUH);6CP]wj f Y j ] P C { n a TV}@ ? 2 G : -   !o $   L s 6 )    ></ 20173708 2017370B 2017370; 2017370; 2017370B 2017370; 2017370B 2017370<< 2017370; 2017370; 2017370; 2017370; 2017370; 2017370C 2017370C 2017370 2017370 20173708 2017370D4 2017370Cf 2017370C9 20173708' 2017370>( 20173708G 201737088 2017370DQ 2017370= 2017370Dl 2017370=I 2017370=B 2017370< 2017370< 2017370=o 20173708r 20173708o 20173708j 20173708^ 20173708\ 20173708S 20173708N 2017370< 2017370< 2017370Dx 2017370= 2017370= 2017370= 2017370= 2017370= 2017370D{ 2017370= 2017370D 20173703 2017370> 2017370> 2017370> 2017370> 2017370>@ 2017370>= 2017370>< 2017370>- 2017370; 2017370; 2017370;x 2017370;u 2017370;P 2017370;B 2017370;3 2017370: 2017370: 2017370:0 2017370: 2017370: 2017370: 20173709 20173709 20173709 20173709 20173709 20173709| 20173709k 20173709h 20173709U 20173709 20173708 20173708{ 2017370>p 2017370>_ 2017370> 2017370> 2017370? 2017370? 2017370?N 2017370? 2017370@ 2017370@~ 2017370@w 2017370@j 2017370@b 2017370@Z 2017370@! 2017370@ 2017370? 2017370? 2017370? 2017370? 2017370? 2017370? 20173703 20173703 20173703 20173703 20173703 20173703z 20173703k 20173703b 20173703> L 2017370C 2017370C s 2017370@ 2017370@ A 2017370A > 2017370Ag 2017370Ad 2017370AU 2017370AA 20173704 20173704 20173704 20173703 2017370D 2017370D 2017370D 2017370C 2017370C 2017370C 2017370C 2017370C 2017370C 2017370C 2017370C 2017370C 2017370C 2017370B 2017370B 2017370Bg 2017370BJ 2017370BH 2017370B: 2017370B2 2017370B' 2017370B 2017370B 2017370A 2017370A 2017370A 2017370Ax 20173704y 20173704_ 20173704[ 20173704L 20173704! 20173704 2017370< 2017370< 2017370< 2017370< 2017370< 2017370< 2017370< 2017370< 2017370< 2017370>? 2017370>> 2017370> 2017370> 20173707 20173707 20173707 20173707 20173707 20173707{ 20173707 20173707 20173706 20173706 20173706 20173706 20173706 20173706 20173706 20173706 20173706| 20173706` 20173706[ 20173706D 20173706 20173706 20173705 20173705 20173705 20173705 20173705 20173705 20173705 20173705 20173705 20173705 20173705 20173705~ 20173705w 20173705W 20173705Q 20173705B 20173705> 20173705) 20173705 20173705 20173705 20173705 20173705 20173704 20173704 20173704 20173704 20173704 20173704 2017370D# 20173707 20173707 20173707 20173707 20173707 2017370D1 9 (.Rl{jc  -_) ossec13001gExim Auth failed2025-03-03 08:32:39 dovecot_login authenticator failed for syn-173-172-152-018.res.spectrum.com [173.172.152.18]:60276: 535 Incorrect authentication data (set_id=bo_msk)173.172.152.186252001rb  -q' ossec13001gZExim Auth failed2025-03-03 08:22:10 dovecot_login authenticator failed for ([41.74.140.107]) [41.74.140.107]:51605: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)41.74.140.1073374766Oa  -/# ossec13001gzExim Auth failed2025-03-03 08:22:42 dovecot_login authenticator failed for ([38.79.83.28]) [38.79.83.28]:58522: 535 Incorrect authentication data (set_id=bo_msk)38.79.83.286252001m`  -g' ossec13001ghExim Auth failed2025-03-03 08:22:23 dovecot_login authenticator failed for ([182.213.57.49]) [182.213.57.49]:35462: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)182.213.57.491835841b_  -O) ossec13001gfExim Auth failed2025-03-03 08:22:21 dovecot_login authenticator failed for ([192.199.58.185]) [192.199.58.185]:50964: 535 Incorrect authentication data (set_id=vikas.khandelwal)192.199.58.1856251999X^  -;) ossec13001gzExim Auth failed2025-03-03 08:18:25 dovecot_login authenticator failed for ([202.156.63.212]) [202.156.63.212]:57292: 535 Incorrect authentication data (set_id=bo_msk)202.156.63.2121880251v]  -}# ossec13001g\Exim Auth failed2025-03-03 08:17:56 dovecot_login authenticator failed for 1-34-128-40.hinet-ip.hinet.net [1.34.128.40]:39602: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)1.34.128.401668284Z\  -?) ossec13001g+Exim Auth failed2025-03-03 08:12:51 dovecot_plain authenticator failed for ([117.175.160.58]) [117.175.160.58]:33154: 535 Incorrect authentication data (set_id=services)117.175.160.581814991k[  -e) ossec13001gExim Auth failed2025-03-03 08:12:30 dovecot_plain authenticator failed for ([185.255.47.190]) [185.255.47.190]:59706: 535 Incorrect authentication data (set_id=services@heipowersystem.com)185.255.47.19099237rZ  -u# ossec13001gExim Auth failed2025-03-03 08:11:02 dovecot_plain authenticator failed for 210.0.90.81.static.nexnet.net.au [210.0.90.81]:57382: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)210.0.90.812077456iY  -a' ossec13001gExim Auth failed2025-03-03 08:10:48 dovecot_plain authenticator failed for ([94.201.79.121]) [94.201.79.121]:35729: 535 Incorrect authentication data (set_id=services@heipowersystem.com)94.201.79.121290557lX  -c) ossec13001gEExim Auth failed2025-03-03 08:09:01 dovecot_plain authenticator failed for syn-173-172-152-018.res.spectrum.com [173.172.152.18]:34322: 535 Incorrect authentication data (set_id=services)173.172.152.186252001VW  -7) ossec13001g!Exim Auth failed2025-03-03 08:08:25 dovecot_plain authenticator failed for (136-34-165-114.googlefiber.net) [136.34.165.114]:50015: 535 Incorrect authentication data136.34.165.1146252001gV  -[' ossec13001gExim Auth failed2025-03-03 08:08:16 dovecot_plain authenticator failed for ([187.92.254.42]) [187.92.254.42]:50112: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)187.92.254.423469034(U  3U) ossec11301g1New FTP connection.Mar 3 08:08:40 vm1 pure-ftpd[1680970]: (?@66.240.236.109) [INFO] New connection from 66.240.236.10966.240.236.1096252001ZT  -?) ossec13001g-Exim Auth failed2025-03-03 08:08:37 dovecot_plain authenticator failed for (client.fttb.2day.kz) [176.222.190.70]:55322: 535 Incorrect authentication data (set_id=sales)176.222.190.701522867eS  -]% ossec13001g)Exim Auth failed2025-03-03 08:08:32 dovecot_plain authenticator failed for ([65.20.251.53]) [65.20.251.53]:55359: 535 Incorrect authentication data (set_id=services@heipowersystem.com)65.20.251.5399237 |   ? k w 3Lam|mt  -e) ossec13001g#Exim Auth failed2025-03-03 09:07:06 dovecot_plain authenticator failed for ([123.209.107.18]) [123.209.107.18]:42038: 535 Incorrect authentication data (set_id=services@heipowersystem.com)123.209.107.182077456ps  -k) ossec13001g#Exim Auth failed2025-03-03 09:06:33 dovecot_login authenticator failed for ([191.59.177.235]) [191.59.177.235]:34042: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)191.59.177.2353469034gr  -[' ossec13001g"Exim Auth failed2025-03-03 09:02:12 dovecot_plain authenticator failed for (24.115.19.225.res-cmts.sm3.ptd.net) [24.115.19.225]:50892: 535 Incorrect authentication data (set_id=sales)24.115.19.2256252001cq  -W% ossec13001g"Exim Auth failed2025-03-03 09:01:57 dovecot_plain authenticator failed for ([37.25.34.200]) [37.25.34.200]:41281: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)37.25.34.200294640Wp  -;' ossec13001g Exim Auth failed2025-03-03 08:54:45 dovecot_plain authenticator failed for ([221.157.85.22]) [221.157.85.22]:54790: 535 Incorrect authentication data (set_id=services)221.157.85.221835841mo  -e) ossec13001g Exim Auth failed2025-03-03 08:54:27 dovecot_plain authenticator failed for ([219.139.39.106]) [219.139.39.106]:37806: 535 Incorrect authentication data (set_id=services@heipowersystem.com)219.139.39.1061814991dn  -W% ossec13001g Exim Auth failed2025-03-03 08:50:57 dovecot_plain authenticator failed for ([222.180.2.62]) [222.180.2.62]:57907: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)222.180.2.621814991jm  -a' ossec13001gxExim Auth failed2025-03-03 08:48:15 dovecot_plain authenticator failed for ([183.47.48.178]) [183.47.48.178]:33205: 535 Incorrect authentication data (set_id=services@heipowersystem.com)183.47.48.1781814991Kl  -+ ossec13001gExim Auth failed2025-03-03 08:48:32 dovecot_plain authenticator failed for ([4.4.89.74]) [4.4.89.74]:55752: 535 Incorrect authentication data (set_id=services)4.4.89.746252001lk  -i# ossec13001g7Exim Auth failed2025-03-03 08:42:55 dovecot_plain authenticator failed for ([27.96.91.71]) [27.96.91.71]:40160: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)27.96.91.711269750_j  -K' ossec13001gMExim Auth failed2025-03-03 08:43:16 dovecot_plain authenticator failed for ([49.159.225.71]) [49.159.225.71]:46418: 535 Incorrect authentication data (set_id=vikas.khandelwal)49.159.225.711668284pi  -k) ossec13001gExim Auth failed2025-03-03 08:37:11 dovecot_login authenticator failed for ([222.239.231.61]) [222.239.231.61]:58502: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)222.239.231.611835841Ph  -1% ossec13001gExim Auth failed2025-03-03 08:35:57 dovecot_plain authenticator failed for ([37.25.34.200]) [37.25.34.200]:52823: 535 Incorrect authentication data (set_id=sales)37.25.34.200294640Zg  -?) ossec13001gExim Auth failed2025-03-03 08:35:54 dovecot_plain authenticator failed for ([117.158.88.106]) [117.158.88.106]:18598: 535 Incorrect authentication data (set_id=services)117.158.88.1061814991mf  -e) ossec13001gExim Auth failed2025-03-03 08:35:42 dovecot_plain authenticator failed for ([182.72.129.218]) [182.72.129.218]:53533: 535 Incorrect authentication data (set_id=services@heipowersystem.com)182.72.129.2181269750ze  -' ossec13001gExim Auth failed2025-03-03 08:35:38 dovecot_plain authenticator failed for syn-156-019-080-138.biz.spectrum.com [156.19.80.138]:42497: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)156.19.80.1386252001pd  -k) ossec13001gExim Auth failed2025-03-03 08:32:30 dovecot_login authenticator failed for ([221.162.49.254]) [221.162.49.254]:37803: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)221.162.49.2541835841 L ) J Y ` .:Lj  -c% ossec13001g'Exim Auth failed2025-03-03 09:22:54 dovecot_login authenticator failed for ([160.30.185.3]) [160.30.185.3]:60329: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)160.30.185.31252634p  -i+ ossec13001g'Exim Auth failed2025-03-03 09:22:49 dovecot_plain authenticator failed for ([222.236.155.146]) [222.236.155.146]:45052: 535 Incorrect authentication data (set_id=services@heipowersystem.com)222.236.155.1461835841`  -O% ossec13001g'xExim Auth failed2025-03-03 09:22:22 dovecot_login authenticator failed for (6-62-170-152.fibertel.com.ar) [152.170.62.6]:54119: 535 Incorrect authentication data (set_id=bo_msk)152.170.62.63865483Z  -?) ossec13001g'nExim Auth failed2025-03-03 09:22:12 dovecot_plain authenticator failed for ([218.155.40.158]) [218.155.40.158]:52885: 535 Incorrect authentication data (set_id=services)218.155.40.1581835841i  -]) ossec13001g'bExim Auth failed2025-03-03 09:22:00 dovecot_plain authenticator failed for ([70.39.23.1]) [167.142.198.54]:50104: 535 Incorrect authentication data (set_id=services@heipowersystem.com)167.142.198.546252001o  -i) ossec13001g'ZExim Auth failed2025-03-03 09:21:52 dovecot_login authenticator failed for ([58.210.188.130]) [58.210.188.130]:7739: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)58.210.188.1301814991{  -+ ossec13001g&Exim Auth failed2025-03-03 09:19:51 dovecot_login authenticator failed for (abts-kk-static-226.253.166.122.airtelbroadband.in) [122.166.253.226]:52355: 535 Incorrect authentication data (set_id=bo_msk)122.166.253.2261269750V~  -9) ossec13001g&Exim Auth failed2025-03-03 09:19:04 dovecot_plain authenticator failed for ([89.144.187.114]) [89.144.187.114]:34864: 535 Incorrect authentication data (set_id=sales)89.144.187.114130758g}  -[' ossec13001g&Exim Auth failed2025-03-03 09:18:52 dovecot_plain authenticator failed for ([94.102.51.218]) [94.102.51.218]:20578: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)94.102.51.2182750405j|  -c% ossec13001g&Exim Auth failed2025-03-03 09:19:37 dovecot_login authenticator failed for ([219.139.41.6]) [219.139.41.6]:42097: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)219.139.41.61814991Z{  -=+ ossec13001g&Exim Auth failed2025-03-03 09:19:33 dovecot_plain authenticator failed for ([222.236.155.146]) [222.236.155.146]:39095: 535 Incorrect authentication data (set_id=sales)222.236.155.1461835841uz  -w' ossec13001g&Exim Auth failed2025-03-03 09:19:21 dovecot_plain authenticator failed for 46.79-160-128.customer.lyse.net [79.160.128.46]:44812: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)79.160.128.463144096my  -g' ossec13001g%Exim Auth failed2025-03-03 09:12:10 dovecot_login authenticator failed for ([39.152.193.72]) [39.152.193.72]:44243: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)39.152.193.721814991[x  -?+ ossec13001g$Exim Auth failed2025-03-03 09:11:12 dovecot_login authenticator failed for ([178.178.127.114]) [178.178.127.114]:55133: 535 Incorrect authentication data (set_id=bo_msk)178.178.127.1142017370pw  -k) ossec13001g$Exim Auth failed2025-03-03 09:11:03 dovecot_login authenticator failed for ([49.124.152.242]) [49.124.152.242]:56754: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)49.124.152.2421733045Zv  -=+ ossec13001g$9Exim Auth failed2025-03-03 09:08:31 dovecot_plain authenticator failed for ([123.210.152.243]) [123.210.152.243]:34610: 535 Incorrect authentication data (set_id=sales)123.210.152.2432077456u  - + ossec13001g$Exim Auth failed2025-03-03 09:08:04 dovecot_plain authenticator failed for (static.ill.117.250.165.114.bsnl.co.in) [117.250.165.114]:51711: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)117.250.165.1141269750 '4 "8Zpj  -a' ossec13001g0LExim Auth failed2025-03-03 10:00:03 dovecot_plain authenticator failed for ([124.246.92.77]) [124.246.92.77]:40371: 535 Incorrect authentication data (set_id=services@heipowersystem.com)124.246.92.771880251m  -g) ossec13001g.Exim Auth failed2025-03-03 09:52:25 dovecot_plain authenticator failed for ([185.134.179.106]) [185.101.16.250]:40734: 535 Incorrect authentication data (set_id=services@heipowersystem.com)185.101.16.250272103i  -]) ossec13001g-yExim Auth failed2025-03-03 09:48:00 dovecot_plain authenticator failed for syn-172-248-047-114.res.spectrum.com [172.248.47.114]:60421: 535 Incorrect authentication data (set_id=sales)172.248.47.1146252001f  -Y' ossec13001g-mExim Auth failed2025-03-03 09:47:49 dovecot_plain authenticator failed for ([187.218.57.50]) [129.222.65.35]:9843: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)129.222.65.353996063Z  -?) ossec13001g+Exim Auth failed2025-03-03 09:40:24 dovecot_plain authenticator failed for (client.fttb.2day.kz) [176.222.190.70]:41704: 535 Incorrect authentication data (set_id=sales)176.222.190.701522867f  -[% ossec13001g+Exim Auth failed2025-03-03 09:40:13 dovecot_plain authenticator failed for ([182.76.125.174]) [182.76.87.90]:56780: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)182.76.87.901269750h  -_% ossec13001g+OExim Auth failed2025-03-03 09:38:46 dovecot_plain authenticator failed for syn-137-027-032-070.biz.spectrum.com [137.27.32.70]:39116: 535 Incorrect authentication data (set_id=services)137.27.32.706252001i  -a' ossec13001g+EExim Auth failed2025-03-03 09:38:36 dovecot_plain authenticator failed for ([87.120.67.149]) [87.120.67.149]:37517: 535 Incorrect authentication data (set_id=services@heipowersystem.com)87.120.67.149732800Z  -?) ossec13001g*Exim Auth failed2025-03-03 09:37:11 dovecot_login authenticator failed for ([120.82.196.137]) [120.82.196.137]:36411: 535 Incorrect authentication data (set_id=services)120.82.196.1371814991j  -a' ossec13001g*Exim Auth failed2025-03-03 09:36:59 dovecot_login authenticator failed for ([220.85.251.16]) [220.85.251.16]:52422: 535 Incorrect authentication data (set_id=services@heipowersystem.com)220.85.251.161835841W  -9) ossec13001g(Exim Auth failed2025-03-03 09:27:38 dovecot_plain authenticator failed for ([49.124.148.191]) [49.124.148.191]:58246: 535 Incorrect authentication data (set_id=sales)49.124.148.1911733045i  -[+ ossec13001g(Exim Auth failed2025-03-03 09:27:17 dovecot_plain authenticator failed for (tagsdev.click) [199.188.103.179]:53996: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)199.188.103.1796252001x  -% ossec13001g(XExim Auth failed2025-03-03 09:26:08 dovecot_plain authenticator failed for (45.201.33.36.adsl-pool.ah.cnuninet.net) [36.33.201.45]:57174: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)36.33.201.451814991y  -}) ossec13001g(>Exim Auth failed2025-03-03 09:25:40 dovecot_plain authenticator failed for ([186.138.219.91]) [186.138.219.91]:57550: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)186.138.219.913865483(  3U) ossec11301g(New FTP connection.Mar 3 09:25:08 vm1 pure-ftpd[1696846]: (?@194.165.16.162) [INFO] New connection from 194.165.16.162194.165.16.1622993457o  -g+ ossec13001g'Exim Auth failed2025-03-03 09:23:18 dovecot_plain authenticator failed for 122-151-131-211.sta.wbroadband.net.au [122.151.131.211]:54317: 535 Incorrect authentication data (set_id=services)122.151.131.2112077456U  -7' ossec13001g'Exim Auth failed2025-03-03 09:23:16 dovecot_login authenticator failed for ([61.133.10.205]) [61.133.10.204]:42780: 535 Incorrect authentication data (set_id=bo_msk)61.133.10.2041814991 h"7 _ X  ";;\hp'  -k) ossec13001g5Exim Auth failed2025-03-03 10:22:45 dovecot_login authenticator failed for ([218.234.104.42]) [218.234.104.42]:48836: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)218.234.104.421835841[&  -?+ ossec13001g4Exim Auth failed2025-03-03 10:18:44 dovecot_login authenticator failed for ([103.146.233.100]) [103.146.233.100]:55336: 535 Incorrect authentication data (set_id=bo_msk)103.146.233.1001269750|%  -) ossec13001g4Exim Auth failed2025-03-03 10:18:31 dovecot_login authenticator failed for 110-25-106-243.adsl.fetnet.net [110.25.106.243]:52481: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)110.25.106.2431668284c$  -S' ossec13001g4%Exim Auth failed2025-03-03 10:16:29 dovecot_plain authenticator failed for 57-45-246-103.southernonline.net [103.246.45.57]:35170: 535 Incorrect authentication data (set_id=sales)103.246.45.571269750m#  -g' ossec13001g4#Exim Auth failed2025-03-03 10:16:25 dovecot_plain authenticator failed for broadband-188-32-170-20.ip.moscow.rt.ru [188.32.170.20]:56380: 535 Incorrect authentication data (set_id=services)188.32.170.202017370j"  -_) ossec13001g4Exim Auth failed2025-03-03 10:16:19 dovecot_plain authenticator failed for ([41.159.145.190]) [41.159.145.190]:49521: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)41.159.145.1902400553j!  -a' ossec13001g4Exim Auth failed2025-03-03 10:16:14 dovecot_plain authenticator failed for ([200.61.12.107]) [200.61.12.107]:58398: 535 Incorrect authentication data (set_id=services@heipowersystem.com)200.61.12.1073865483  - ) ossec13001g2VExim Auth failed2025-03-03 10:08:45 dovecot_plain authenticator failed for 144.46.246.220.static.netvigator.com [220.246.46.144]:57494: 535 Incorrect authentication data (set_id=services@heipowersystem.com)220.246.46.1441819730j  -_) ossec13001g1Exim Auth failed2025-03-03 10:05:40 dovecot_plain authenticator failed for ([49.124.148.192]) [49.124.148.192]:58272: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)49.124.148.1921733045U  -7' ossec13001g1Exim Auth failed2025-03-03 10:05:29 dovecot_login authenticator failed for ([116.86.62.245]) [116.86.62.245]:35441: 535 Incorrect authentication data (set_id=bo_msk)116.86.62.2451880251j  -c% ossec13001g1Exim Auth failed2025-03-03 10:05:14 dovecot_login authenticator failed for ([112.91.67.18]) [112.91.67.18]:44218: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)112.91.67.181814991T  -3) ossec13001g1~Exim Auth failed2025-03-03 10:05:10 dovecot_plain authenticator failed for p158131-obmd01.osaka.ocn.ne.jp [61.112.101.130]:37348: 535 Incorrect authentication data61.112.101.1301861060U  -7' ossec13001g1DExim Auth failed2025-03-03 10:04:11 dovecot_login authenticator failed for ([103.69.244.39]) [103.69.244.39]:49990: 535 Incorrect authentication data (set_id=bo_msk)103.69.244.391269750  -+ ossec13001g1<Exim Auth failed2025-03-03 10:04:03 dovecot_login authenticator failed for cpe-148-163-232-103.wireline.com.au [103.232.163.148]:58576: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)103.232.163.1482077456T  -5' ossec13001g0Exim Auth failed2025-03-03 10:02:44 dovecot_plain authenticator failed for ([24.224.69.119]) [24.224.69.119]:39598: 535 Incorrect authentication data (set_id=sales)24.224.69.1196252001g  -[' ossec13001g0Exim Auth failed2025-03-03 10:02:13 dovecot_plain authenticator failed for ([58.16.215.241]) [58.16.215.241]:42778: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)58.16.215.2411814991Z  -?) ossec13001g0ZExim Auth failed2025-03-03 10:00:16 dovecot_plain authenticator failed for ([183.100.18.224]) [183.100.18.224]:44944: 535 Incorrect authentication data (set_id=services)183.100.18.2241835841 $ 6 X ;Jbwm8  -g' ossec13001gnExim Auth failed2025-03-03 11:00:20 dovecot_plain authenticator failed for ([114.247.207.98]) [114.247.207.98]:47375: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)114.247.207.981814991j@  -a' ossec13001g>Exim Auth failed2025-03-03 11:00:40 dovecot_plain authenticator failed for broadband-95-84-186-218.ip.moscow.rt.ru [95.84.186.218]:58446: 535 Incorrect authentication data (set_id=sales)95.84.186.2182017370j?  -a' ossec13001g=Exim Auth failed2025-03-03 10:56:30 dovecot_plain authenticator failed for ([125.21.141.54]) [125.21.141.54]:49821: 535 Incorrect authentication data (set_id=services@heipowersystem.com)125.21.141.541269750]>  -E) ossec13001g=nExim Auth failed2025-03-03 10:56:04 dovecot_plain authenticator failed for vps-45cb66f2.vps.ovh.net [135.125.204.13]:48096: 535 Incorrect authentication data (set_id=sales)135.125.204.133017382t=  -s) ossec13001g=dExim Auth failed2025-03-03 10:55:55 dovecot_plain authenticator failed for 17.sub-166-248-194.myvzw.com [166.248.194.17]:61052: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)166.248.194.176252001T<  -7% ossec13001g=Exim Auth failed2025-03-03 10:56:41 dovecot_plain authenticator failed for ([141.94.18.69]) [141.94.18.69]:36648: 535 Incorrect authentication data (set_id=services)141.94.18.693017382y;  -{+ ossec13001g<Exim Auth failed2025-03-03 10:53:21 dovecot_plain authenticator failed for ip212-227-250-132.pbiaas.com [212.227.250.132]:48892: 535 Incorrect authentication data (set_id=services@heipowersystem.com)212.227.250.1323017382Z:  -?) ossec13001g<Exim Auth failed2025-03-03 10:53:31 dovecot_plain authenticator failed for ([103.180.240.96]) [103.180.240.96]:35394: 535 Incorrect authentication data (set_id=services)103.180.240.961282988O9  -/# ossec13001g 1 $  { n a T G : -   w j ] P C 6 )    s f Y L ? 2 %  |obUH;.!xk^QD7*tgZM@3& }pcVI</"yl_RE8+uh[~NA4' ~qdWJ=01 1269750>Z 1269750>Y 1269750>O 1269750>N 1269750>0 1269750>* 1269750>' 1269750> 1269750> 1269750> 1269750= 1269750= 1269750= 1269750= 1269750= 1269750= 1269750= 1269750= 1269750=O 1269750=C 1269750=> 1269750= 1269750= 1269750= 1269750= 1269750< 1269750< 1269750< 1269750< 1269750< 1269750< 1269750< 1269750< 1269750< 1269750< 1269750< 1269750< 1269750< 1269750< 1269750< 1269750 126975065 126975062 126975061 12697506/ 12697506. 12697506+ 12697506* 12697506 12697506 12697506 12697505 12697505 12697505 12697505 12697505 12697505 12697505 12697505 12697505 12697505 12697505 12697505 12697505v 12697505p 12697505X 12697505G 12697505F 126975059 126975058 126975057 126975056 126975053 126975052 126975051 126975050 12697505/ 12697505' 12697505 12697505 12697505 (L [ 6PxjZ  -a' ossec13001gJExim Auth failed2025-03-03 11:52:55 dovecot_plain authenticator failed for ([115.140.89.82]) [115.140.89.82]:33584: 535 Incorrect authentication data (set_id=services@heipowersystem.com)115.140.89.821835841qY  -s# ossec13001gJExim Auth failed2025-03-03 11:52:31 dovecot_plain authenticator failed for bb121-6-81-59.singnet.com.sg [121.6.81.59]:57393: 535 Incorrect authentication data (set_id=services@heipowersystem.com)121.6.81.591880251TX  -5' ossec13001gJCExim Auth failed2025-03-03 11:50:50 dovecot_plain authenticator failed for ([118.26.153.84]) [118.26.153.84]:39326: 535 Incorrect authentication data (set_id=sales)118.26.153.841819730bW  -W% ossec13001gJ7Exim Auth failed2025-03-03 11:50:38 dovecot_plain authenticator failed for ([46.161.196.5]) [46.161.196.5]:52620: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)46.161.196.599237[V  -?+ ossec13001gIqExim Auth failed2025-03-03 11:47:19 dovecot_login authenticator failed for ([171.221.199.222]) [171.221.199.222]:22125: 535 Incorrect authentication data (set_id=bo_msk)171.221.199.2221814991iU  -c% ossec13001gIaExim Auth failed2025-03-03 11:47:03 dovecot_login authenticator failed for ([194.28.91.40]) [194.28.91.40]:34940: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)194.28.91.40690791zT  -' ossec13001gHiExim Auth failed2025-03-03 11:42:55 dovecot_login authenticator failed for 27.49.156.220.rev.iijmobile.jp [220.156.49.27]:43548: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)220.156.49.271861060rS  -s% ossec13001gHExim Auth failed2025-03-03 11:41:27 dovecot_plain authenticator failed for ool-4a5ad51c.dyn.optonline.net [74.90.213.28]:47354: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)74.90.213.286252001lR  -c) ossec13001gG2Exim Auth failed2025-03-03 11:37:45 dovecot_plain authenticator failed for 212.42.246.220.static.netvigator.com [220.246.42.212]:49759: 535 Incorrect authentication data (set_id=services)220.246.42.2121819730dQ  -Y# ossec13001gGExim Auth failed2025-03-03 11:37:14 dovecot_plain authenticator failed for ([101.13.5.37]) [101.13.5.37]:43862: 535 Incorrect authentication data (set_id=services@heipowersystem.com)101.13.5.371668284WP  -9) ossec13001gFExim Auth failed2025-03-03 11:33:09 dovecot_plain authenticator failed for ([74.196.184.120]) [74.196.184.120]:37825: 535 Incorrect authentication data (set_id=sales)74.196.184.1206252001gO  -[' ossec13001gFExim Auth failed2025-03-03 11:32:58 dovecot_plain authenticator failed for ([116.88.187.44]) [116.88.187.44]:52388: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)116.88.187.441880251jN  -a' ossec13001gEExim Auth failed2025-03-03 11:28:49 dovecot_plain authenticator failed for ([180.168.119.2]) [180.168.119.2]:54052: 535 Incorrect authentication data (set_id=services@heipowersystem.com)180.168.119.21814991UM  -7' ossec13001gDExim Auth failed2025-03-03 11:26:46 dovecot_login authenticator failed for ([1.227.228.136]) [1.227.228.136]:35648: 535 Incorrect authentication data (set_id=bo_msk)1.227.228.1361835841mL  -g' ossec13001gD{Exim Auth failed2025-03-03 11:26:11 dovecot_login authenticator failed for ([58.57.154.146]) [58.57.154.146]:28188: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)58.57.154.1461814991XK  -;) ossec13001gBExim Auth failed2025-03-03 11:18:10 dovecot_login authenticator failed for ([74.196.184.120]) [74.196.184.120]:44498: 535 Incorrect authentication data (set_id=bo_msk)74.196.184.1206252001TJ  -5' ossec13001gBExim Auth failed2025-03-03 11:18:08 dovecot_plain authenticator failed for ([222.86.58.117]) [222.86.58.117]:48583: 535 Incorrect authentication data (set_id=sales)222.86.58.1171814991  # E g  Cnlk  -g' ossec13001gO\Exim Auth failed2025-03-03 12:12:35 dovecot_login authenticator failed for ([94.205.250.78]) [94.205.250.78]:60235: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)94.205.250.78290557dj  -W% ossec13001gNExim Auth failed2025-03-03 12:09:10 dovecot_plain authenticator failed for ([41.74.136.46]) [41.74.136.46]:47943: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)41.74.136.463374766Qi  -1% ossec13001gNExim Auth failed2025-03-03 12:09:19 dovecot_plain authenticator failed for ([90.173.78.90]) [90.173.78.90]:58151: 535 Incorrect authentication data (set_id=sales)90.173.78.902510769Th  -7% ossec13001gNrExim Auth failed2025-03-03 12:08:41 dovecot_plain authenticator failed for ([80.234.36.12]) [80.234.36.12]:47186: 535 Incorrect authentication data (set_id=services)80.234.36.122017370mg  -e) ossec13001gNjExim Auth failed2025-03-03 12:08:32 dovecot_plain authenticator failed for ([49.124.131.160]) [49.124.131.160]:33838: 535 Incorrect authentication data (set_id=services@heipowersystem.com)49.124.131.1601733045^f  -K% ossec13001gMExim Auth failed2025-03-03 12:06:09 dovecot_login authenticator failed for bb121-7-26-195.singnet.com.sg [121.7.26.195]:44840: 535 Incorrect authentication data (set_id=sales)121.7.26.1951880251Ye -9+ ossec13001gMExim Auth failed2025-03-03 12:06:06 dovecot_login authenticator failed for (rokamauka.com) [111.122.211.212]:39552: 535 Incorrect authentication data (set_id=nologin)111.122.211.2121814991gd  -[' ossec13001gMExim Auth failed2025-03-03 12:05:43 dovecot_login authenticator failed for ([120.24.83.156]) [223.104.199.0]:62489: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)223.104.199.01814991yc  -}) ossec13001gLExim Auth failed2025-03-03 12:01:26 dovecot_login authenticator failed for ([223.220.167.38]) [223.220.167.38]:49710: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)223.220.167.381814991`b  -O% ossec13001gLExim Auth failed2025-03-03 12:01:39 dovecot_login authenticator failed for ([60.172.1.210]) [60.172.1.210]:42134: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)60.172.1.2101814991pa  -k) ossec13001gLiExim Auth failed2025-03-03 12:00:00 dovecot_login authenticator failed for ([114.247.207.98]) [114.247.207.98]:36005: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)114.247.207.981814991X`  -;) ossec13001gLExim Auth failed2025-03-03 12:00:35 dovecot_login authenticator failed for ([121.189.198.60]) [121.189.198.60]:42916: 535 Incorrect authentication data (set_id=bo_msk)121.189.198.601835841Z_  -?) ossec13001gL1Exim Auth failed2025-03-03 11:59:05 dovecot_plain authenticator failed for ([178.177.200.26]) [178.177.200.26]:35272: 535 Incorrect authentication data (set_id=services)178.177.200.262017370Z^  -?) ossec13001gLDExim Auth failed2025-03-03 11:59:22 dovecot_plain authenticator failed for ([178.163.27.129]) [178.163.27.129]:56238: 535 Incorrect authentication data (set_id=services)178.163.27.1292017370[]  -G# ossec13001gL;Exim Auth failed2025-03-03 11:59:15 dovecot_plain authenticator failed for bb121-6-81-59.singnet.com.sg [121.6.81.59]:47294: 535 Incorrect authentication data (set_id=sales)121.6.81.591880251x\  -% ossec13001gLExim Auth failed2025-03-03 11:58:42 dovecot_plain authenticator failed for 95-31-29-128.broadband.corbina.ru [95.31.29.128]:46584: 535 Incorrect authentication data (set_id=services@heipowersystem.com)95.31.29.1282017370~[  -) ossec13001gLExim Auth failed2025-03-03 11:58:38 dovecot_plain authenticator failed for 47-158-210-137.lsan.ca.frontiernet.net [47.158.210.137]:56176: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)47.158.210.1376252001   $ 0QaHsv{  -' ossec13001gVExim Auth failed2025-03-03 12:43:03 dovecot_login authenticator failed for (cust-72-26-178-196.wireless.t6b.com) [72.26.178.196]:56386: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)72.26.178.1966252001%z  3Q' ossec11301gUNew FTP connection.Mar 3 12:40:49 vm1 pure-ftpd[1737963]: (?@198.235.24.89) [INFO] New connection from 198.235.24.89198.235.24.896252001Qy  -1% ossec13001gUExim Auth failed2025-03-03 12:40:49 dovecot_plain authenticator failed for ([14.37.79.247]) [14.37.79.247]:49364: 535 Incorrect authentication data (set_id=sales)14.37.79.2471835841yx  -' ossec13001gUExim Auth failed2025-03-03 12:40:35 dovecot_plain authenticator failed for dhcp-4-bc-9f-52-b7-f.cpe.i-zoom.net [24.244.93.233]:39604: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)24.244.93.2336251999Qw  -/' ossec13001gTExim Auth failed2025-03-03 12:35:04 dovecot_plain authenticator failed for p85219-obmd01.osaka.ocn.ne.jp [180.7.156.218]:35763: 535 Incorrect authentication data180.7.156.2181861060Iv  = ) ossec13008gTMail Reciepient rejected2025-03-03 12:35:02 H=(mail.uttamclassesjaipur.com) [165.154.208.84]:60236 F= rejected RCPT : Rejected relay attempt: '165.154.208.84' From: 'zhxrxjde@uttamclassesjaipur.com' To: 'goofile@fastmail.com'165.154.208.841668284Hu  -) ossec13001gTExim Auth failed2025-03-03 12:34:46 dovecot_plain authenticator failed for ([102.212.105.34]) [102.212.105.34]:41158: 535 Incorrect authentication data102.212.105.342328926lt  -c+ ossec13001gSExim Auth failed2025-03-03 12:31:31 dovecot_plain authenticator failed for ([196.189.126.185]) [196.189.126.185]:53956: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)196.189.126.185337996[s  -?+ ossec13001gS%Exim Auth failed2025-03-03 12:28:44 dovecot_login authenticator failed for ([122.187.227.144]) [122.187.227.144]:40156: 535 Incorrect authentication data (set_id=bo_msk)122.187.227.1441269750pr  -k) ossec13001gSExim Auth failed2025-03-03 12:28:12 dovecot_login authenticator failed for ([195.222.57.183]) [195.222.57.183]:57856: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)195.222.57.1833277605]q  -C+ ossec13001gR?Exim Auth failed2025-03-03 12:24:54 dovecot_plain authenticator failed for ([181.174.200.138]) [181.174.200.138]:10171: 535 Incorrect authentication data (set_id=services)181.174.200.1383865483jp  -_) ossec13001gRsExim Auth failed2025-03-03 12:25:46 dovecot_plain authenticator failed for ([175.205.191.27]) [175.205.191.27]:52412: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)175.205.191.271835841|o  -) ossec13001gRExim Auth failed2025-03-03 12:24:19 dovecot_plain authenticator failed for 94-255-178-175.cust.bredband2.com [94.255.178.175]:34244: 535 Incorrect authentication data (set_id=services@heipowersystem.com)94.255.178.1752661886Un  -7' ossec13001gQExim Auth failed2025-03-03 12:23:33 dovecot_login authenticator failed for ([59.13.237.163]) [59.13.237.163]:38260: 535 Incorrect authentication data (set_id=bo_msk)59.13.237.1631835841m  -' ossec13001gQExim Auth failed2025-03-03 12:22:55 dovecot_login authenticator failed for broadband-188-32-170-20.ip.moscow.rt.ru [188.32.170.20]:56578: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)188.32.170.202017370)l  =K+ ossec13008gOMail Reciepient rejected2025-03-03 12:14:30 H=(mail.hsnews.in) [165.154.213.130]:62386 F= rejected RCPT : Rejected relay attempt: '165.154.213.130' From: 'gvoigtjabz@hsnews.in' To: 'goofile@fastmail.com'165.154.213.1303469034 7 I q o 'i  -c% ossec13001g\^Exim Auth failed2025-03-03 13:08:06 dovecot_login authenticator failed for ([185.167.56.2]) [185.167.56.2]:47992: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)185.167.56.2617790V  -9' ossec13001g\xExim Auth failed2025-03-03 13:08:31 dovecot_login authenticator failed for ([189.108.224.67]) [191.210.73.33]:34941: 535 Incorrect authentication data (set_id=bo_msk)191.210.73.333469034K  =) ossec13008g\HMail Reciepient rejected2025-03-03 13:07:42 H=(mail.uttamclassesjaipur.com) [165.154.210.93]:50853 F= rejected RCPT : Rejected relay attempt: '165.154.210.93' From: 'qocikdbul@uttamclassesjaipur.com' To: 'goofile@fastmail.com'165.154.210.931694008E  =) ossec13008g\DMail Reciepient rejected2025-03-03 13:07:39 H=(mail.uttamclassesjaipur.com) [165.154.213.54]:50159 F= rejected RCPT : Rejected relay attempt: '165.154.213.54' From: 'lqihsf@uttamclassesjaipur.com' To: 'goofile@fastmail.com'165.154.213.543469034[  -?+ ossec13001g\"Exim Auth failed2025-03-03 13:07:04 dovecot_login authenticator failed for ([183.109.195.179]) [183.109.195.179]:59660: 535 Incorrect authentication data (set_id=bo_msk)183.109.195.1791835841m  -g' ossec13001g\Exim Auth failed2025-03-03 13:06:52 dovecot_login authenticator failed for ([1.244.246.221]) [1.244.246.221]:49716: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)1.244.246.2211835841T  -5' ossec13001g[sExim Auth failed2025-03-03 13:04:10 dovecot_plain authenticator failed for ([223.210.27.53]) [223.210.27.53]:19966: 535 Incorrect authentication data (set_id=sales)223.210.27.531814991m  -c+ ossec13001g[^Exim Auth failed2025-03-03 13:03:48 dovecot_plain authenticator failed for ([116.113.253.178]) [116.113.253.178]:47858: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)116.113.253.1781814991w  -}' ossec13001gYExim Auth failed2025-03-03 12:57:10 dovecot_plain authenticator failed for bzq-109-67-154-24.red.bezeqint.net [109.67.154.24]:54658: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)109.67.154.24294640W  -9) ossec13001gYExim Auth failed2025-03-03 12:57:26 dovecot_plain authenticator failed for ([213.230.64.246]) [213.230.64.246]:53568: 535 Incorrect authentication data (set_id=sales)213.230.64.2461512440U  -7' ossec13001gYkExim Auth failed2025-03-03 12:55:29 dovecot_login authenticator failed for ([210.12.68.242]) [210.12.68.242]:53503: 535 Incorrect authentication data (set_id=bo_msk)210.12.68.2421814991~  -) ossec13001gYaExim Auth failed2025-03-03 12:55:19 dovecot_login authenticator failed for 89-179-241-253.static.corbina.ru [89.179.241.253]:54982: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)89.179.241.2532017370T  -7% ossec13001gWExim Auth failed2025-03-03 12:48:18 dovecot_plain authenticator failed for ([5.59.141.152]) [5.59.141.152]:50604: 535 Incorrect authentication data (set_id=services)5.59.141.1522017370j~  -a' ossec13001gWExim Auth failed2025-03-03 12:48:02 dovecot_plain authenticator failed for ([48.218.170.53]) [48.218.170.53]:33894: 535 Incorrect authentication data (set_id=services@heipowersystem.com)48.218.170.531861060W}  -;' ossec13001gWExim Auth failed2025-03-03 12:45:25 dovecot_plain authenticator failed for ([211.109.75.67]) [211.109.75.69]:52722: 535 Incorrect authentication data (set_id=services)211.109.75.691835841j|  -a' ossec13001gVExim Auth failed2025-03-03 12:44:57 dovecot_plain authenticator failed for ([31.173.66.222]) [31.173.66.222]:51130: 535 Incorrect authentication data (set_id=services@heipowersystem.com)31.173.66.2222017370 G X q # Chzu  -u) ossec13001geExim Auth failed2025-03-03 13:47:06 dovecot_plain authenticator failed for ([186.208.76.154]) [186.208.76.154]:42714: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)186.208.76.1543469034j  -a' ossec13001gdExim Auth failed2025-03-03 13:44:54 dovecot_plain authenticator failed for ([103.48.194.21]) [103.48.194.21]:51840: 535 Incorrect authentication data (set_id=services@heipowersystem.com)103.48.194.211562822W  -;' ossec13001ge Exim Auth failed2025-03-03 13:45:06 dovecot_plain authenticator failed for ([202.62.130.20]) [202.62.130.20]:41091: 535 Incorrect authentication data (set_id=services)202.62.130.202077456Y  -?) ossec13001gd:Exim Auth failed2025-03-03 13:41:37 dovecot_plain authenticator failed for ([196.46.203.139]) [196.46.203.139]:41637: 535 Incorrect authentication data (set_id=services)196.46.203.139895949  - ) ossec13001gd*Exim Auth failed2025-03-03 13:41:21 dovecot_plain authenticator failed for syn-070-122-139-172.res.spectrum.com [70.122.139.172]:52099: 535 Incorrect authentication data (set_id=services@heipowersystem.com)70.122.139.1726252001g  -[' ossec13001gbExim Auth failed2025-03-03 13:34:24 dovecot_plain authenticator failed for ([46.29.121.110]) [46.29.121.110]:57972: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)46.29.121.1103017382g  -_# ossec13001gbAExim Auth failed2025-03-03 13:33:12 dovecot_login authenticator failed for ([222.87.43.4]) [222.87.43.4]:35379: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)222.87.43.41814991  -) ossec13001gaExim Auth failed2025-03-03 13:31:50 dovecot_login authenticator failed for (broadband-37.204-170-200.ip.moscow.rt.ru) [37.204.170.200]:35536: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)37.204.170.2002017370R  -3% ossec13001gaExim Auth failed2025-03-03 13:32:03 dovecot_login authenticator failed for ([101.230.0.49]) [124.74.9.190]:50498: 535 Incorrect authentication data (set_id=bo_msk)124.74.9.1901814991q  -u# ossec13001ga-Exim Auth failed2025-03-03 13:28:36 dovecot_plain authenticator failed for 89-67-38-27.dynamic.chello.pl [89.67.38.27]:59339: 535 Incorrect authentication data (set_id=services@heipowersystem.com)89.67.38.27798544Z  -=+ ossec13001g`YExim Auth failed2025-03-03 13:25:04 dovecot_login authenticator failed for ([111.193.226.252]) [111.193.226.252]:6354: 535 Incorrect authentication data (set_id=bo_msk)111.193.226.2521814991g  -_# ossec13001g`IExim Auth failed2025-03-03 13:24:48 dovecot_login authenticator failed for ([59.0.60.158]) [59.0.60.158]:34282: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)59.0.60.1581835841T  -5' ossec13001g_EExim Auth failed2025-03-03 13:20:27 dovecot_plain authenticator failed for ([58.16.215.241]) [58.16.215.241]:45138: 535 Incorrect authentication data (set_id=sales)58.16.215.2411814991c  -W% ossec13001g_9Exim Auth failed2025-03-03 13:20:15 dovecot_plain authenticator failed for ([5.30.191.129]) [5.30.191.129]:56298: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)5.30.191.129290557k  -c' ossec13001g\Exim Auth failed2025-03-03 13:10:13 dovecot_plain authenticator failed for www.michels-schwab.de [217.86.146.64]:46208: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)217.86.146.642921044T  -5' ossec13001g\Exim Auth failed2025-03-03 13:10:35 dovecot_plain authenticator failed for ([222.100.159.2]) [222.100.159.2]:59659: 535 Incorrect authentication data (set_id=sales)222.100.159.21835841] -C) ossec13001g\Exim Auth failed2025-03-03 13:09:16 dovecot_login authenticator failed for (thepsindustries.com) [60.167.170.146]:52854: 535 Incorrect authentication data (set_id=nologin)60.167.170.1461814991 *\~tj`VLB8.$zpf\H>4*   v l b X N D : 0 &    ~ t j ` V L B 8 . $    z p f \ R H > 4 *  vNlbXD:0&|rh^TJ@6,"xndZPF<2( ~tj`VLB8.$zpf\ | r h ^ T J @ 6 , "    x n d Z P F < 2 (   RRH>4*  vlbXND:0& gŖ gŖ gœ gœ gœ\ gœR gŒ gŒ gő gő gŏ gŏ+ gŏ! gŎ gŎ  gō gō gŌ gŌ gŌ gʼn gʼn gʼnD gʼn< gň gň gň gň gň gņ} gŅM gŅ5 gŅ5 gŅ+ gń gń gń gŃ gŃ gŃ gŃ gŁ gŁ gŁ  gŁ gŀ gŀ gŀ gŀc g} g} g} g} g| g| g|l g|B g| g| g{ g{ g{0 gy gx gx gxo gxa gw gv gv gv gvy gv gu gs gsz gsx gs\ gr gr gq gqq gp7 gp go go go} gn gn gn gn gnX gnJ gn: gn gl gl gkX gjk gjK gj< gi gi gi gi gi gi gha ghC gh/ gg gg  ge ge ge ge gd ge  gd: gd* gb gbA ga ga ga- g`Y g`I g_E g_9 g\ g\ g\ g\x g\^ g\H g\D g\" g\ g[s g[^ gY gY gYk gYa gW gW~ gW} gV| gV{ gUz gUy gUx gTw gTv gTu gSt gS%s gSr gRsp gR?q gRo gQn gQm gOl gO\k gNi gNj gNrh gNjg gMf gŦX: gť9 gť-8 gť7 gţ6 gţe5 gţU4 gŢ3 gŢ~2 gŢh1 gš@0 gš,/ gš . gš- gš, gŠ + gş* gş) gş( gş$' gş% gŞ& gŞ)$ gŞ# gŜ)" gŜ!! gŜ gŜ gŜ gś gř gř^ gřV gřT gř gř gŘ gŗ gŗ gŗ gŗ gŗ gŖ gMe gMd gLb gLc gL` gLia gLD^ gL;] gL1_ gL\ gL[ gJZ gJY gJCX gJ7W gIqV gIaU gHiT gHS gG2R gGQ gFP gFO gEN gDM gD{L gBK gBJ gBI gBH gAoF gAcG g@E g@D g?C g?B g>@ g>nA g=< g=? g=n> g=d= gŦj; g<: g<; g rejected RCPT : Rejected relay attempt: '165.154.213.22' From: 'lgmhfs@uttamclassesjaipur.com' To: 'goofile@fastmail.com'165.154.213.223469034W,  -;' ossec13001gjKExim Auth failed2025-03-03 14:07:31 dovecot_plain authenticator failed for ([221.157.85.22]) [221.157.85.22]:56310: 535 Incorrect authentication data (set_id=services)221.157.85.221835841y+  -}) ossec13001gj<Exim Auth failed2025-03-03 14:07:14 dovecot_plain authenticator failed for (ws60-209.199.103.rcil.gov.in) [103.199.209.60]:40024: 535 Incorrect authentication data (set_id=services@heipowersystem.com)103.199.209.601269750m*  -g' ossec13001giExim Auth failed2025-03-03 14:05:05 dovecot_login authenticator failed for ([14.53.126.112]) [14.53.126.112]:40642: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)14.53.126.1121835841U)  -7' ossec13001giExim Auth failed2025-03-03 14:05:41 dovecot_login authenticator failed for ([182.135.66.27]) [182.135.66.27]:33314: 535 Incorrect authentication data (set_id=bo_msk)182.135.66.271814991g(  -W+ ossec13001giExim Auth failed2025-03-03 14:05:37 dovecot_plain authenticator failed for (165-220-169-113.cust.exede.net) [165.220.169.113]:51407: 535 Incorrect authentication data (set_id=sales)165.220.169.1132635167d'  -W% ossec13001giExim Auth failed2025-03-03 14:05:16 dovecot_plain authenticator failed for ([191.59.165.4]) [191.59.165.4]:38552: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)191.59.165.43469034W&  -;' ossec13001giExim Auth failed2025-03-03 14:04:26 dovecot_plain authenticator failed for ([61.173.105.26]) [61.173.105.26]:57700: 535 Incorrect authentication data (set_id=services)61.173.105.261814991m%  -e) ossec13001giExim Auth failed2025-03-03 14:04:11 dovecot_plain authenticator failed for ([175.119.20.149]) [175.119.20.149]:56603: 535 Incorrect authentication data (set_id=services@heipowersystem.com)175.119.20.1491835841d$  -W% ossec13001ghaExim Auth failed2025-03-03 13:59:21 dovecot_plain authenticator failed for ([110.35.63.27]) [110.35.63.27]:55774: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)110.35.63.271835841W#  -;) ossec13001ghCExim Auth failed2025-03-03 13:58:50 dovecot_login authenticator failed for ([94.201.236.143]) [94.201.236.143]:52545: 535 Incorrect authentication data (set_id=bo_msk)94.201.236.143290557p"  -k) ossec13001gh/Exim Auth failed2025-03-03 13:58:29 dovecot_login authenticator failed for ([195.222.57.183]) [195.222.57.183]:57602: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)195.222.57.1833277605m!  -g' ossec13001ggExim Auth failed2025-03-03 13:53:30 dovecot_login authenticator failed for ([181.197.38.12]) [181.197.38.12]:39512: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)181.197.38.123703430O  -/# ossec13001gg Exim Auth failed2025-03-03 13:53:38 dovecot_login authenticator failed for ([47.91.88.67]) [47.91.88.67]:46954: 535 Incorrect authentication data (set_id=bo_msk)47.91.88.672921044Z  -=+ ossec13001geExim Auth failed2025-03-03 13:47:54 dovecot_plain authenticator failed for ([221.149.233.246]) [221.149.233.246]:41700: 535 Incorrect authentication data (set_id=sales)221.149.233.2461835841g  -[' ossec13001geExim Auth failed2025-03-03 13:47:42 dovecot_plain authenticator failed for ([213.128.4.213]) [213.128.4.213]:57014: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)213.128.4.2132017370e  -S+ ossec13001geExim Auth failed2025-03-03 13:47:16 dovecot_plain authenticator failed for ([117.196.209.244]) [117.196.209.244]:58632: 535 Incorrect authentication data (set_id=vikas.khandelwal)117.196.209.2441269750 Wi "PVk~s>  -o+ ossec13001gqqExim Auth failed2025-03-03 14:38:00 dovecot_login authenticator failed for ([115.247.159.106]) [115.247.159.106]:54046: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)115.247.159.1061269750i=  -]) ossec13001gp7Exim Auth failed2025-03-03 14:32:47 dovecot_plain authenticator failed for 122-116-32-136.hinet-ip.hinet.net [122.116.32.136]:55165: 535 Incorrect authentication data (set_id=services)122.116.32.1361668284g<  -]% ossec13001gpExim Auth failed2025-03-03 14:32:20 dovecot_plain authenticator failed for ([74.95.13.185]) [74.95.13.185]:56493: 535 Incorrect authentication data (set_id=services@heipowersystem.com)74.95.13.1856252001v;  -y' ossec13001goExim Auth failed2025-03-03 14:30:07 dovecot_plain authenticator failed for ([48.218.170.53]) [48.218.170.53]:36510: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)48.218.170.531861060N:  --# ossec13001goExim Auth failed2025-03-03 14:29:58 dovecot_plain authenticator failed for ([8.209.221.7]) [8.209.221.7]:40652: 535 Incorrect authentication data (set_id=sales)8.209.221.71861060j9  -_) ossec13001go}Exim Auth failed2025-03-03 14:29:41 dovecot_plain authenticator failed for ([121.189.198.60]) [121.189.198.60]:36964: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)121.189.198.601835841X8  -;) ossec13001gnExim Auth failed2025-03-03 14:27:20 dovecot_login authenticator failed for ([178.178.222.58]) [178.178.222.58]:50056: 535 Incorrect authentication data (set_id=bo_msk)178.178.222.582017370p7  -k) ossec13001gnExim Auth failed2025-03-03 14:27:03 dovecot_login authenticator failed for ([178.163.27.129]) [178.163.27.129]:56632: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)178.163.27.1292017370m6  -g' ossec13001gnExim Auth failed2025-03-03 14:25:52 dovecot_plain authenticator failed for broadband-77-37-179-158.ip.moscow.rt.ru [77.37.179.158]:51918: 535 Incorrect authentication data (set_id=services)77.37.179.1582017370k5  -e) ossec13001gnExim Auth failed2025-03-03 14:25:42 dovecot_plain authenticator failed for ([185.255.47.190]) [185.255.47.190]:51444: 535 Incorrect authentication data (set_id=services@heipowersystem.com)185.255.47.19099237l4  -c) ossec13001gnXExim Auth failed2025-03-03 14:24:48 dovecot_login authenticator failed for (107-175-76-146-host.colocrossing.com) [107.175.76.146]:54966: 535 Incorrect authentication data (set_id=bo_msk)107.175.76.14662520013  -) ossec13001gnJExim Auth failed2025-03-03 14:24:34 dovecot_login authenticator failed for syn-173-095-123-220.biz.spectrum.com [173.95.123.220]:33481: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)173.95.123.2206252001f2  -[% ossec13001gn:Exim Auth failed2025-03-03 14:24:18 dovecot_plain authenticator failed for 7.248.146.34.bc.googleusercontent.com [34.146.248.7]:35460: 535 Incorrect authentication data (set_id=sales)34.146.248.71861060m1  -c+ ossec13001gnExim Auth failed2025-03-03 14:23:40 dovecot_plain authenticator failed for ([123.209.118.166]) [123.209.118.166]:33686: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)123.209.118.1662077456T0  -5' ossec13001glExim Auth failed2025-03-03 14:18:27 dovecot_plain authenticator failed for ([115.42.173.64]) [115.42.173.64]:59464: 535 Incorrect authentication data (set_id=sales)115.42.173.641880251j/  -_) ossec13001glExim Auth failed2025-03-03 14:18:07 dovecot_plain authenticator failed for ([45.225.194.121]) [45.225.194.121]:56042: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)45.225.194.1213469034%.  3Q' ossec11301gkXNew FTP connection.Mar 3 14:11:58 vm1 pure-ftpd[1757024]: (?@206.168.34.53) [INFO] New connection from 206.168.34.53206.168.34.536252001 $ 5LauYN  -;+ ossec13001gxoExim Auth failed2025-03-03 15:07:50 dovecot_plain authenticator failed for ([190.205.112.156]) [190.205.112.156]:5274: 535 Incorrect authentication data (set_id=sales)190.205.112.1563625428hM  -_) ossec13001gxaExim Auth failed2025-03-03 15:07:37 dovecot_plain authenticator failed for ([185.255.47.190]) [185.255.47.190]:56040: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)185.255.47.19099237gL  -]% ossec13001gwExim Auth failed2025-03-03 15:04:32 dovecot_plain authenticator failed for ([160.30.185.3]) [160.30.185.3]:51135: 535 Incorrect authentication data (set_id=services@heipowersystem.com)160.30.185.31252634RK  -3% ossec13001gvExim Auth failed2025-03-03 15:00:19 dovecot_login authenticator failed for ([36.48.70.211]) [36.48.70.211]:44072: 535 Incorrect authentication data (set_id=bo_msk)36.48.70.2111814991jJ  -c% ossec13001gvExim Auth failed2025-03-03 15:00:08 dovecot_login authenticator failed for ([59.34.17.130]) [59.34.17.130]:56282: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)59.34.17.1301814991hI  -]' ossec13001gvExim Auth failed2025-03-03 15:00:08 dovecot_plain authenticator failed for 89-179-99-200.broadband.corbina.ru [89.179.99.200]:49918: 535 Incorrect authentication data (set_id=services)89.179.99.2002017370gH  -]% ossec13001gvyExim Auth failed2025-03-03 14:59:28 dovecot_plain authenticator failed for ([186.73.22.20]) [186.73.22.20]:51050: 535 Incorrect authentication data (set_id=services@heipowersystem.com)186.73.22.203703430eG  -W' ossec13001gvExim Auth failed2025-03-03 14:57:43 dovecot_plain authenticator failed for (109.cpe-186-68-83.gye.satnet.net) [186.68.83.109]:36928: 535 Incorrect authentication data (set_id=sales)186.68.83.1093658394cF  -W% ossec13001guExim Auth failed2025-03-03 14:57:20 dovecot_plain authenticator failed for ([5.11.164.165]) [5.11.164.165]:34415: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)5.11.164.165298795lE  -c) ossec13001gsExim Auth failed2025-03-03 14:46:52 dovecot_plain authenticator failed for syn-070-127-232-248.res.spectrum.com [70.127.232.248]:44903: 535 Incorrect authentication data (set_id=services)70.127.232.2486252001}D  -' ossec13001gszExim Auth failed2025-03-03 14:46:41 dovecot_plain authenticator failed for syn-097-070-129-101.res.spectrum.com [97.70.129.101]:60804: 535 Incorrect authentication data (set_id=services@heipowersystem.com)97.70.129.1016252001hC  -]' ossec13001gsxExim Auth failed2025-03-03 14:46:38 dovecot_login authenticator failed for 119-46-148-53.static.asianet.co.th [119.46.148.53]:59703: 535 Incorrect authentication data (set_id=services)119.46.148.531605651nB  -g) ossec13001gs\Exim Auth failed2025-03-03 14:46:10 dovecot_login authenticator failed for ([159.223.250.131]) [161.35.200.202]:42442: 535 Incorrect authentication data (set_id=services@heipowersystem.com)161.35.200.2022921044gA  -[' ossec13001grExim Auth failed2025-03-03 14:44:28 dovecot_plain authenticator failed for ([206.138.17.73]) [206.138.17.73]:33974: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)206.138.17.733572887J@  = + ossec13008grMail Reciepient rejected2025-03-03 14:43:57 H=(mail.uttamclassesjaipur.com) [165.154.213.186]:54632 F= rejected RCPT : Rejected relay attempt: '165.154.213.186' From: 'ngeiqci@uttamclassesjaipur.com' To: 'goofile@fastmail.com'165.154.213.1863469034X?  -;) ossec13001gqExim Auth failed2025-03-03 14:38:24 dovecot_login authenticator failed for ([125.136.163.86]) [125.136.163.86]:35150: 535 Incorrect authentication data (set_id=bo_msk)125.136.163.861835841 K$ & 2 D V &KW^  -;' ossec13001g}Exim Auth failed2025-03-03 15:31:34 dovecot_plain authenticator failed for ([1.227.228.136]) [1.227.228.136]:43331: 535 Incorrect authentication data (set_id=services)1.227.228.1361835841Y]  -=) ossec13001g}Exim Auth failed2025-03-03 15:31:24 dovecot_plain authenticator failed for (static.as64098.net) [103.79.175.115]:60421: 535 Incorrect authentication data (set_id=sales)103.79.175.1152077456a\  -U! ossec13001g}Exim Auth failed2025-03-03 15:31:21 dovecot_plain authenticator failed for ([45.6.80.40]) [45.6.80.40]:59254: 535 Incorrect authentication data (set_id=services@heipowersystem.com)45.6.80.403469034y[  -}) ossec13001g}Exim Auth failed2025-03-03 15:31:07 dovecot_plain authenticator failed for 202-188-035-194.ip-addr.vsenet.de [194.35.188.202]:43220: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)194.35.188.2022921044Z  - + ossec13001g|Exim Auth failed2025-03-03 15:25:40 dovecot_login authenticator failed for static-200-105-141-170.acelerate.net ([200.105.141.161]) [200.105.141.170]:41392: 535 Incorrect authentication data (set_id=bo_msk)200.105.141.1703923057cY  -O+ ossec13001g|Exim Auth failed2025-03-03 15:25:28 dovecot_login authenticator failed for (azteca-comunicaciones.com) [186.148.187.146]:41602: 535 Incorrect authentication data (set_id=bo_msk)186.148.187.1463686110mX  -g' ossec13001g|lExim Auth failed2025-03-03 15:24:51 dovecot_login authenticator failed for ([191.59.231.90]) [191.59.231.90]:57738: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)191.59.231.903469034CW  =) ossec13008g|BMail Reciepient rejected2025-03-03 15:24:09 H=(mail.uttamclassesjaipur.com) [165.154.226.62]:62436 F= rejected RCPT : Rejected relay attempt: '165.154.226.62' From: 'gfiuj@uttamclassesjaipur.com' To: 'goofile@fastmail.com'165.154.226.621668284xV  -}' ossec13001g|Exim Auth failed2025-03-03 15:23:27 dovecot_plain authenticator failed for 42-200-70-134.static.imsbiz.com [42.200.70.134]:54532: 535 Incorrect authentication data (set_id=services@heipowersystem.com)42.200.70.1341819730NU  =+ ossec13008g|Mail Reciepient rejected2025-03-03 15:23:08 H=(mail.uttamclassesjaipur.com) [165.154.227.155]:51457 F= rejected RCPT : Rejected relay attempt: '165.154.227.155' From: 'ysoczuowg@uttamclassesjaipur.com' To: 'goofile@fastmail.com'165.154.227.1551668284jT  -_) ossec13001g{Exim Auth failed2025-03-03 15:21:12 dovecot_plain authenticator failed for ([116.148.103.34]) [116.148.103.34]:30688: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)116.148.103.341814991jS  -_) ossec13001g{Exim Auth failed2025-03-03 15:20:56 dovecot_plain authenticator failed for ([119.45.170.229]) [119.45.170.229]:37164: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)119.45.170.2291814991pR  -k) ossec13001g{0Exim Auth failed2025-03-03 15:19:35 dovecot_login authenticator failed for ([73.231.102.189]) [73.231.102.189]:41464: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)73.231.102.1896252001zQ  -' ossec13001gyExim Auth failed2025-03-03 15:12:44 dovecot_login authenticator failed for p381190-obmd01.tokyo.ocn.ne.jp [60.38.209.189]:41768: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)60.38.209.1891861060jP  -_) ossec13001gxExim Auth failed2025-03-03 15:08:46 dovecot_login authenticator failed for syn-173-095-123-220.biz.spectrum.com [173.95.123.220]:56645: 535 Incorrect authentication data (set_id=bo_msk)173.95.123.2206252001jO  -c% ossec13001gxExim Auth failed2025-03-03 15:08:11 dovecot_login authenticator failed for ([182.76.71.82]) [182.76.71.82]:37026: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)182.76.71.821269750 W  F[ZlKWpn  -k) ossec13001gŅ+Exim Auth failed2025-03-03 16:02:10 dovecot_login authenticator failed for ([125.23.204.106]) [125.23.204.106]:36510: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)125.23.204.1061269750Lm  =+ ossec13008gńMail Reciepient rejected2025-03-03 16:00:03 H=(mail.uttamclassesjaipur.com) [165.154.228.195]:61153 F= rejected RCPT : Rejected relay attempt: '165.154.228.195' From: 'myevrnej@uttamclassesjaipur.com' To: 'goofile@fastmail.com'165.154.228.1951643084jl  -a' ossec13001gńExim Auth failed2025-03-03 15:59:40 dovecot_plain authenticator failed for syn-024-090-169-209.res.spectrum.com [24.90.169.209]:46269: 535 Incorrect authentication data (set_id=services)24.90.169.2096252001k  - ) ossec13001gńExim Auth failed2025-03-03 15:59:24 dovecot_plain authenticator failed for net-188-152-225-58.cust.vodafonedsl.it [188.152.225.58]:44652: 535 Incorrect authentication data (set_id=services@heipowersystem.com)188.152.225.583175395Zj  -=+ ossec13001gŃExim Auth failed2025-03-03 15:56:56 dovecot_plain authenticator failed for ([221.149.233.245]) [221.149.233.245]:43091: 535 Incorrect authentication data (set_id=sales)221.149.233.2451835841ji  -a' ossec13001gŃExim Auth failed2025-03-03 15:56:07 dovecot_plain authenticator failed for syn-035-130-111-098.biz.spectrum.com [35.130.111.98]:54960: 535 Incorrect authentication data (set_id=services)35.130.111.986252001}h  -' ossec13001gŃExim Auth failed2025-03-03 15:55:56 dovecot_plain authenticator failed for syn-071-012-241-225.res.spectrum.com [71.12.241.225]:48994: 535 Incorrect authentication data (set_id=services@heipowersystem.com)71.12.241.2256252001gg  -[' ossec13001gŃExim Auth failed2025-03-03 15:56:38 dovecot_plain authenticator failed for ([211.109.75.68]) [211.109.75.69]:51849: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)211.109.75.691835841Sf  -7% ossec13001gŁExim Auth failed2025-03-03 15:47:30 dovecot_plain authenticator failed for ([94.204.96.91]) [94.204.96.91]:53833: 535 Incorrect authentication data (set_id=services)94.204.96.91290557re  -u# ossec13001gŁExim Auth failed2025-03-03 15:47:15 dovecot_plain authenticator failed for 95-31-6-109.static.corbina.ru [95.31.6.109]:52922: 535 Incorrect authentication data (set_id=services@heipowersystem.com)95.31.6.1092017370Wd  -9) ossec13001gŁ Exim Auth failed2025-03-03 15:44:33 dovecot_plain authenticator failed for ([95.105.113.109]) [95.105.113.109]:51016: 535 Incorrect authentication data (set_id=sales)95.105.113.1092017370yc  -% ossec13001gŁExim Auth failed2025-03-03 15:44:22 dovecot_login authenticator failed for 111-70-7-189.emome-ip.hinet.net [111.70.7.189]:50329: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)111.70.7.1891668284fb  -[' ossec13001gŀExim Auth failed2025-03-03 15:44:21 dovecot_plain authenticator failed for ([94.204.100.40]) [94.204.100.40]:45934: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)94.204.100.40290557da  -S) ossec13001gŀExim Auth failed2025-03-03 15:42:54 dovecot_plain authenticator failed for (91-220-216-178.omsk.mts.ru) [178.216.220.91]:56988: 535 Incorrect authentication data (set_id=services)178.216.220.912017370m`  -e) ossec13001gŀExim Auth failed2025-03-03 15:42:44 dovecot_plain authenticator failed for ([112.111.61.231]) [112.111.61.229]:58956: 535 Incorrect authentication data (set_id=services@heipowersystem.com)112.111.61.2291814991N_  =+ ossec13008gŀcMail Reciepient rejected2025-03-03 15:41:47 H=(mail.uttamclassesjaipur.com) [165.154.232.235]:54631 F= rejected RCPT : Rejected relay attempt: '165.154.232.235' From: 'nhpfvcznz@uttamclassesjaipur.com' To: 'goofile@fastmail.com'165.154.232.2351605651 B 3 ":9N`\hBL~  =+ ossec13008gŌMail Reciepient rejected2025-03-03 16:34:27 H=(mail.uttamclassesjaipur.com) [165.154.208.196]:50974 F= rejected RCPT : Rejected relay attempt: '165.154.208.196' From: 'qyrghkln@uttamclassesjaipur.com' To: 'goofile@fastmail.com'165.154.208.1961668284R}  -3% ossec13001gŌExim Auth failed2025-03-03 16:33:43 dovecot_login authenticator failed for ([50.24.152.80]) [50.24.152.80]:40022: 535 Incorrect authentication data (set_id=bo_msk)50.24.152.806252001p|  -k) ossec13001gŌExim Auth failed2025-03-03 16:33:31 dovecot_login authenticator failed for ([161.35.200.202]) [161.35.200.202]:48118: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)161.35.200.2022921044{  - ) ossec13001gʼnExim Auth failed2025-03-03 16:22:21 dovecot_plain authenticator failed for (nsg-corporate-34.230.187.122.airtel.in) [122.187.230.34]:38618: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)122.187.230.341269750jz  -a' ossec13001gʼnExim Auth failed2025-03-03 16:21:43 dovecot_plain authenticator failed for ([103.99.148.77]) [103.99.148.77]:56758: 535 Incorrect authentication data (set_id=services@heipowersystem.com)103.99.148.771269750gy  -Y) ossec13001gʼnDExim Auth failed2025-03-03 16:19:39 dovecot_login authenticator failed for (189.218.168.30-clientes-izzi.mx) [189.218.168.30]:46278: 535 Incorrect authentication data (set_id=bo_msk)189.218.168.303996063}x  -) ossec13001gʼn<Exim Auth failed2025-03-03 16:19:30 dovecot_login authenticator failed for ip-142-90-218-227.user.start.ca [142.90.218.227]:36164: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)142.90.218.2276251999dw  -Y# ossec13001gňExim Auth failed2025-03-03 16:18:22 dovecot_plain authenticator failed for ([101.13.3.72]) [101.13.3.72]:33300: 535 Incorrect authentication data (set_id=services@heipowersystem.com)101.13.3.721668284ov  -i) ossec13001gňExim Auth failed2025-03-03 16:17:48 dovecot_login authenticator failed for (59-102-188-188.nty.dynamic.tbcnet.net.tw) [59.102.188.188]:53421: 535 Incorrect authentication data (set_id=sales)59.102.188.1881668284su  -u% ossec13001gňExim Auth failed2025-03-03 16:17:25 dovecot_login authenticator failed for 111-70-7-189.emome-ip.hinet.net [111.70.7.189]:39735: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)111.70.7.1891668284St  -3' ossec13001gňExim Auth failed2025-03-03 16:17:20 dovecot_plain authenticator failed for ([223.82.88.108]) [223.82.88.108]:1188: 535 Incorrect authentication data (set_id=sales)223.82.88.1081814991vs  -y' ossec13001gňExim Auth failed2025-03-03 16:17:01 dovecot_plain authenticator failed for 111-70-21-178.emome-ip.hinet.net [111.70.21.178]:54749: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)111.70.21.1781668284Rr  =+ ossec13008gņ}Mail Reciepient rejected2025-03-03 16:07:48 H=(mail.uttamclassesjaipur.com) [165.154.227.105]:58323 F= rejected RCPT : Rejected relay attempt: '165.154.227.105' From: 'gojmclouorp@uttamclassesjaipur.com' To: 'goofile@fastmail.com'165.154.227.1051668284Zq  -=+ ossec13001gŅMExim Auth failed2025-03-03 16:02:43 dovecot_plain authenticator failed for ([175.206.105.126]) [175.206.105.126]:46582: 535 Incorrect authentication data (set_id=sales)175.206.105.1261835841kp  -c' ossec13001gŅ5Exim Auth failed2025-03-03 16:02:19 dovecot_login authenticator failed for broadband-46-242-66-149.ip.moscow.rt.ru [46.242.66.149]:56864: 535 Incorrect authentication data (set_id=bo_msk)46.242.66.1492017370|o  -) ossec13001gŅ5Exim Auth failed2025-03-03 16:02:20 dovecot_plain authenticator failed for syn-070-127-232-248.res.spectrum.com [70.127.232.248]:35734: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)70.127.232.2486252001 Wl %MYzS  -7% ossec13001gŖExim Auth failed2025-03-03 17:16:21 dovecot_plain authenticator failed for ([91.74.186.57]) [91.74.186.57]:55955: 535 Incorrect authentication data (set_id=services)91.74.186.57290557j  -a' ossec13001gŖExim Auth failed2025-03-03 17:16:06 dovecot_plain authenticator failed for ([112.91.253.43]) [112.91.253.43]:46240: 535 Incorrect authentication data (set_id=services@heipowersystem.com)112.91.253.431814991[  -?+ ossec13001gœExim Auth failed2025-03-03 17:04:10 dovecot_login authenticator failed for ([180.188.143.166]) [180.188.143.166]:37127: 535 Incorrect authentication data (set_id=bo_msk)180.188.143.1661819730p  -k) ossec13001gœExim Auth failed2025-03-03 17:03:52 dovecot_login authenticator failed for ([220.77.182.171]) [220.77.182.171]:39092: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)220.77.182.1711835841T  -5' ossec13001gœ\Exim Auth failed2025-03-03 17:02:44 dovecot_plain authenticator failed for ([197.211.47.66]) [197.211.47.66]:33976: 535 Incorrect authentication data (set_id=sales)197.211.47.662328926j  -_) ossec13001gœRExim Auth failed2025-03-03 17:02:34 dovecot_plain authenticator failed for ([111.48.214.102]) [111.48.214.102]:28872: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)111.48.214.1021814991R  -3% ossec13001gŒExim Auth failed2025-03-03 17:00:07 dovecot_login authenticator failed for ([36.33.201.45]) [36.33.201.45]:50800: 535 Incorrect authentication data (set_id=bo_msk)36.33.201.451814991p  -k) ossec13001gŒExim Auth failed2025-03-03 16:59:52 dovecot_login authenticator failed for ([219.139.39.106]) [219.139.39.106]:36922: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)219.139.39.1061814991d  -S) ossec13001gőExim Auth failed2025-03-03 16:55:47 dovecot_plain authenticator failed for 17.sub-166-248-194.myvzw.com [166.248.194.17]:65474: 535 Incorrect authentication data (set_id=services)166.248.194.176252001  - ) ossec13001gőExim Auth failed2025-03-03 16:55:25 dovecot_plain authenticator failed for syn-098-102-148-242.biz.spectrum.com [98.102.148.242]:59938: 535 Incorrect authentication data (set_id=services@heipowersystem.com)98.102.148.2426252001  - ) ossec13001gŏExim Auth failed2025-03-03 16:46:35 dovecot_login authenticator failed for 221-120-42-196.emome-ip.hinet.net [221.120.42.196]:46475: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)221.120.42.1961668284Z  -=+ ossec13001gŏ+Exim Auth failed2025-03-03 16:44:50 dovecot_plain authenticator failed for ([175.156.139.195]) [175.156.139.195]:52876: 535 Incorrect authentication data (set_id=sales)175.156.139.1951880251v  -w) ossec13001gŏ!Exim Auth failed2025-03-03 16:44:40 dovecot_plain authenticator failed for 110-25-105-223.adsl.fetnet.net [110.25.105.223]:54625: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)110.25.105.2231668284j  -_) ossec13001gŎExim Auth failed2025-03-03 16:40:20 dovecot_plain authenticator failed for ([163.179.124.13]) [163.179.124.13]:35337: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)163.179.124.131814991W  -;' ossec13001gŎ Exim Auth failed2025-03-03 16:40:01 dovecot_plain authenticator failed for ([200.11.109.32]) [200.11.109.32]:40138: 535 Incorrect authentication data (set_id=services)200.11.109.323469034g  -]% ossec13001gōExim Auth failed2025-03-03 16:39:49 dovecot_plain authenticator failed for ([218.22.0.200]) [218.22.0.200]:50128: 535 Incorrect authentication data (set_id=services@heipowersystem.com)218.22.0.2001814991%  3Q' ossec11301gōNew FTP connection.Mar 3 16:38:03 vm1 pure-ftpd[1787467]: (?@20.98.142.152) [INFO] New connection from 20.98.142.15220.98.142.1526252001  ( 1 8 ] ghd  -W% ossec13001gŜExim Auth failed2025-03-03 17:39:56 dovecot_plain authenticator failed for ([160.30.185.3]) [160.30.185.3]:45936: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)160.30.185.31252634{  -+ ossec13001gŜExim Auth failed2025-03-03 17:39:37 dovecot_plain authenticator failed for (pool-176-226-241-177.is74.ru) [176.226.241.177]:51250: 535 Incorrect authentication data (set_id=services@heipowersystem.com)176.226.241.1772017370C  =) ossec13008gśMail Reciepient rejected2025-03-03 17:39:20 H=(mail.uttamclassesjaipur.com) [165.154.226.42]:54423 F= rejected RCPT : Rejected relay attempt: '165.154.226.42' From: 'rgwiu@uttamclassesjaipur.com' To: 'goofile@fastmail.com'165.154.226.421668284R  =+ ossec13008gřMail Reciepient rejected2025-03-03 17:29:09 H=(mail.uttamclassesjaipur.com) [165.154.247.226]:51932 F= rejected RCPT : Rejected relay attempt: '165.154.247.226' From: 'mlgylggdzjj@uttamclassesjaipur.com' To: 'goofile@fastmail.com'165.154.247.2261605651p  -k) ossec13001gřVExim Auth failed2025-03-03 17:28:14 dovecot_login authenticator failed for ([209.38.100.151]) [209.38.100.151]:53442: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)209.38.100.1512750405g  -_# ossec13001gřTExim Auth failed2025-03-03 17:28:11 dovecot_login authenticator failed for ([1.241.64.92]) [1.241.64.92]:34102: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)1.241.64.921835841T  -7' ossec13001gř^Exim Auth failed2025-03-03 17:28:22 dovecot_login authenticator failed for ([87.200.68.214]) [87.200.68.214]:57610: 535 Incorrect authentication data (set_id=bo_msk)87.200.68.214290557e  -S+ ossec13001gřExim Auth failed2025-03-03 17:26:54 dovecot_plain authenticator failed for (tgw-rp.ru) [109.106.136.152]:56574: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)109.106.136.1522017370W  -9) ossec13001gřExim Auth failed2025-03-03 17:27:10 dovecot_plain authenticator failed for ([60.219.112.190]) [60.219.112.190]:50506: 535 Incorrect authentication data (set_id=sales)60.219.112.1901814991Z -?' ossec13001gŘExim Auth failed2025-03-03 17:22:51 dovecot_login authenticator failed for (heipowersystem.com) [111.56.54.202]:41612: 535 Incorrect authentication data (set_id=nologin)111.56.54.2021814991W  -;) ossec13001gŗExim Auth failed2025-03-03 17:21:53 dovecot_login authenticator failed for ([94.204.230.214]) [94.204.230.214]:46440: 535 Incorrect authentication data (set_id=bo_msk)94.204.230.214290557u  -{# ossec13001gŗExim Auth failed2025-03-03 17:21:44 dovecot_login authenticator failed for p85005-obmd01.osaka.ocn.ne.jp [180.7.156.4]:57574: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)180.7.156.41861060s  -o+ ossec13001gŗExim Auth failed2025-03-03 17:21:45 dovecot_login authenticator failed for ([121.178.185.141]) [121.178.185.141]:43264: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)121.178.185.1411835841]  -C+ ossec13001gŗExim Auth failed2025-03-03 17:21:27 dovecot_plain authenticator failed for ([115.242.200.126]) [115.242.200.126]:55556: 535 Incorrect authentication data (set_id=services)115.242.200.1261269750q  -q% ossec13001gŗExim Auth failed2025-03-03 17:21:01 dovecot_plain authenticator failed for (9.72.116.151.hathway.com) [116.72.9.151]:57540: 535 Incorrect authentication data (set_id=services@heipowersystem.com)116.72.9.1511269750~  -) ossec13001gŖExim Auth failed2025-03-03 17:17:59 dovecot_plain authenticator failed for 47-158-210-137.lsan.ca.frontiernet.net [47.158.210.137]:46560: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)47.158.210.1376252001 F Q d 4FmR/  -3% ossec13001gš,Exim Auth failed2025-03-03 18:01:39 dovecot_login authenticator failed for ([160.30.185.3]) [160.30.185.3]:48068: 535 Incorrect authentication data (set_id=bo_msk)160.30.185.31252634@.  =}' ossec13008gš Mail Reciepient rejected2025-03-03 18:01:27 H=(mail.uttamclassesjaipur.com) [165.154.227.2]:50238 F= rejected RCPT : Rejected relay attempt: '165.154.227.2' From: 'nhfqh@uttamclassesjaipur.com' To: 'goofile@fastmail.com'165.154.227.21668284g-  -[' ossec13001gšExim Auth failed2025-03-03 18:01:19 dovecot_plain authenticator failed for ([177.207.248.5]) [177.207.248.5]:44468: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)177.207.248.53469034p,  -k) ossec13001gšExim Auth failed2025-03-03 18:01:14 dovecot_login authenticator failed for ([114.202.80.152]) [114.202.80.152]:41587: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)114.202.80.1521835841T+  -7% ossec13001gŠ Exim Auth failed2025-03-03 17:56:48 dovecot_plain authenticator failed for ([182.76.71.82]) [182.76.71.82]:37458: 535 Incorrect authentication data (set_id=services)182.76.71.821269750f*  -]% ossec13001gşExim Auth failed2025-03-03 17:56:21 dovecot_plain authenticator failed for ([5.77.209.140]) [5.77.209.140]:33946: 535 Incorrect authentication data (set_id=services@heipowersystem.com)5.77.209.140174982U)  -7' ossec13001gşExim Auth failed2025-03-03 17:55:51 dovecot_login authenticator failed for ([222.180.4.150]) [222.180.4.150]:53891: 535 Incorrect authentication data (set_id=bo_msk)222.180.4.1501814991j(  -c% ossec13001gşExim Auth failed2025-03-03 17:55:35 dovecot_login authenticator failed for ([58.18.90.250]) [58.18.90.250]:57219: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)58.18.90.2501814991U'  -7' ossec13001gş$Exim Auth failed2025-03-03 17:52:59 dovecot_login authenticator failed for ([125.21.141.54]) [125.21.141.54]:52636: 535 Incorrect authentication data (set_id=bo_msk)125.21.141.541269750z&  UW) ossec11001gŞDeferred login on the cpanel service[2025-03-03 17:52:19 +0530] info [webmaild] 223.238.203.93 - kps@amplifypowerglobal.com "GET /cpsess4363365682/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [157.38.65.6] != Current IP Address [223.238.203.93]223.238.203.931269750%  - ' ossec13001gşExim Auth failed2025-03-03 17:52:49 dovecot_login authenticator failed for syn-035-130-111-098.biz.spectrum.com [35.130.111.98]:44446: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)35.130.111.986252001Q$  -1% ossec13001gŞ)Exim Auth failed2025-03-03 17:48:48 dovecot_plain authenticator failed for ([58.18.90.114]) [58.18.90.114]:40796: 535 Incorrect authentication data (set_id=sales)58.18.90.1141814991i#  -_) ossec13001gŞExim Auth failed2025-03-03 17:48:37 dovecot_plain authenticator failed for ([81.181.129.233]) [81.181.129.233]:33687: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)81.181.129.233798549q"  -m) ossec13001gŜ)Exim Auth failed2025-03-03 17:40:15 dovecot_plain authenticator failed for (32.195.136.122.adsl-pool.jlccptt.net.cn) [122.136.195.32]:47115: 535 Incorrect authentication data (set_id=services)122.136.195.321814991T!  -5' ossec13001gŜ!Exim Auth failed2025-03-03 17:40:08 dovecot_plain authenticator failed for ([59.46.185.130]) [59.46.185.130]:33493: 535 Incorrect authentication data (set_id=sales)59.46.185.1301814991^  -I' ossec13001gŜExim Auth failed2025-03-03 17:39:57 dovecot_plain authenticator failed for 151.114.15.93.rev.sfr.net [93.15.114.151]:4148: 535 Incorrect authentication data (set_id=services)93.15.114.1513017382 %(  0 ; R k}T>  -5' ossec13001gŦExim Auth failed2025-03-03 18:25:28 dovecot_plain authenticator failed for ([175.202.82.16]) [175.202.82.16]:45788: 535 Incorrect authentication data (set_id=sales)175.202.82.161835841j=  -_) ossec13001gŦExim Auth failed2025-03-03 18:25:11 dovecot_plain authenticator failed for ([128.185.253.90]) [128.185.253.90]:53286: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)128.185.253.901269750m<  -c+ ossec13001gŦExim Auth failed2025-03-03 18:24:43 dovecot_login authenticator failed for ([182.163.122.133]) [182.163.122.133]:58273: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)182.163.122.1331210997T;  -7% ossec13001gŦjExim Auth failed2025-03-03 18:24:00 dovecot_plain authenticator failed for ([85.19.195.12]) [85.19.195.12]:58382: 535 Incorrect authentication data (set_id=services)85.19.195.123144096m:  -e) ossec13001gŦXExim Auth failed2025-03-03 18:23:42 dovecot_plain authenticator failed for ([112.111.61.230]) [112.111.61.229]:34814: 535 Incorrect authentication data (set_id=services@heipowersystem.com)112.111.61.2291814991j9  -c% ossec13001gťExim Auth failed2025-03-03 18:22:15 dovecot_login authenticator failed for ([202.84.34.85]) [202.84.34.85]:59926: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)202.84.34.851210997F8  =+ ossec13008gť-Mail Reciepient rejected2025-03-03 18:18:44 H=(mail.uttamclassesjaipur.com) [165.154.213.186]:52995 F= rejected RCPT : Rejected relay attempt: '165.154.213.186' From: 'pudtk@uttamclassesjaipur.com' To: 'goofile@fastmail.com'165.154.213.1863469034H7  = + ossec13008gťMail Reciepient rejected2025-03-03 18:18:25 H=(mail.uttamclassesjaipur.com) [165.154.232.235]:50487 F= rejected RCPT : Rejected relay attempt: '165.154.232.235' From: 'wbpcbo@uttamclassesjaipur.com' To: 'goofile@fastmail.com'165.154.232.2351605651M6  =) ossec13008gţMail Reciepient rejected2025-03-03 18:11:56 H=(mail.uttamclassesjaipur.com) [165.154.232.55]:64156 F= rejected RCPT : Rejected relay attempt: '165.154.232.55' From: 'mcqpniokah@uttamclassesjaipur.com' To: 'goofile@fastmail.com'165.154.232.551605651e5  -W' ossec13001gţeExim Auth failed2025-03-03 18:11:08 dovecot_plain authenticator failed for 42-200-70-134.static.imsbiz.com [42.200.70.134]:58888: 535 Incorrect authentication data (set_id=services)42.200.70.1341819730q4  -q% ossec13001gţUExim Auth failed2025-03-03 18:10:51 dovecot_plain authenticator failed for (9.72.116.151.hathway.com) [116.72.9.151]:46356: 535 Incorrect authentication data (set_id=services@heipowersystem.com)116.72.9.1511269750g3  -_# ossec13001gŢExim Auth failed2025-03-03 18:09:08 dovecot_login authenticator failed for ([1.31.80.166]) [1.31.80.166]:38186: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)1.31.80.1661814991 2  -) ossec13001gŢ~Exim Auth failed2025-03-03 18:07:18 dovecot_login authenticator failed for (200-205-223-1.customer.tdatabrasil.net.br) [187.93.153.166]:48498: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)187.93.153.1663469034y1  -' ossec13001gŢhExim Auth failed2025-03-03 18:06:55 dovecot_plain authenticator failed for c-98-220-97-188.hsd1.il.comcast.net [98.220.97.188]:50996: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)98.220.97.1886252001W0  -9) ossec13001gš@Exim Auth failed2025-03-03 18:01:59 dovecot_plain authenticator failed for ([151.49.116.193]) [151.49.116.193]:47583: 535 Incorrect authentication data (set_id=sales)151.49.116.1933175395 &2 A h @Rw|O  -' ossec13001gŬExim Auth failed2025-03-03 18:50:14 dovecot_login authenticator failed for 89-233-245-84.cust.bredband2.com [89.233.245.84]:42032: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)89.233.245.842661886TN  -7% ossec13001gŬ9Exim Auth failed2025-03-03 18:48:48 dovecot_login authenticator failed for ([2.63.169.110]) [2.63.169.110]:43920: 535 Incorrect authentication data (set_id=services)2.63.169.1102017370WM  -;' ossec13001gŬ)Exim Auth failed2025-03-03 18:48:33 dovecot_login authenticator failed for ([12.200.230.61]) [12.200.230.61]:60776: 535 Incorrect authentication data (set_id=services)12.200.230.616252001jL  -a' ossec13001gŬExim Auth failed2025-03-03 18:48:17 dovecot_login authenticator failed for ([57.128.19.228]) [57.128.19.228]:55422: 535 Incorrect authentication data (set_id=services@heipowersystem.com)57.128.19.2283017382ZK  -?) ossec13001gūExim Auth failed2025-03-03 18:45:42 dovecot_plain authenticator failed for ([222.239.231.61]) [222.239.231.61]:10932: 535 Incorrect authentication data (set_id=services)222.239.231.611835841yJ  -' ossec13001gūsExim Auth failed2025-03-03 18:45:30 dovecot_plain authenticator failed for 111-70-32-191.emome-ip.hinet.net [111.70.32.191]:58892: 535 Incorrect authentication data (set_id=services@heipowersystem.com)111.70.32.1911668284gI  -]% ossec13001gūaExim Auth failed2025-03-03 18:45:13 dovecot_plain authenticator failed for ([112.91.67.18]) [112.91.67.18]:60236: 535 Incorrect authentication data (set_id=services@heipowersystem.com)112.91.67.181814991dH  -U' ossec13001gū?Exim Auth failed2025-03-03 18:44:38 dovecot_login authenticator failed for 78-82-109-248.customers.ownit.se [78.82.109.248]:58722: 535 Incorrect authentication data (set_id=bo_msk)78.82.109.2482661886gG  -_# ossec13001gū+Exim Auth failed2025-03-03 18:44:17 dovecot_login authenticator failed for ([49.0.129.12]) [49.0.129.12]:56252: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)49.0.129.122029969gF  -[' ossec13001gŪ|Exim Auth failed2025-03-03 18:41:24 dovecot_plain authenticator failed for ([1.227.228.136]) [1.227.228.136]:34419: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)1.227.228.1361835841ZE  -=+ ossec13001gŪExim Auth failed2025-03-03 18:41:36 dovecot_plain authenticator failed for ([123.209.117.171]) [123.209.117.171]:46618: 535 Incorrect authentication data (set_id=sales)123.209.117.1712077456gD  -[' ossec13001gũZExim Auth failed2025-03-03 18:36:34 dovecot_plain authenticator failed for ([180.129.88.20]) [180.129.88.20]:46659: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)180.129.88.201880251WC  -9) ossec13001gũdExim Auth failed2025-03-03 18:36:44 dovecot_plain authenticator failed for ([49.124.152.143]) [49.124.152.143]:48770: 535 Incorrect authentication data (set_id=sales)49.124.152.1431733045UB  -7' ossec13001gŨ.Exim Auth failed2025-03-03 18:31:33 dovecot_login authenticator failed for ([181.197.38.12]) [181.197.38.12]:37000: 535 Incorrect authentication data (set_id=bo_msk)181.197.38.123703430mA  -g' ossec13001gŨ Exim Auth failed2025-03-03 18:30:58 dovecot_login authenticator failed for ([218.4.205.242]) [218.4.205.242]:33567: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)218.4.205.2421814991p@  -i+ ossec13001gŧjExim Auth failed2025-03-03 18:28:16 dovecot_plain authenticator failed for ([180.110.237.199]) [180.110.237.199]:35647: 535 Incorrect authentication data (set_id=services@heipowersystem.com)180.110.237.1991814991V?  -7) ossec13001gŧzExim Auth failed2025-03-03 18:28:33 dovecot_plain authenticator failed for ([70.39.23.1]) [167.142.198.54]:52492: 535 Incorrect authentication data (set_id=services)167.142.198.546252001 1 0 = < T P t !31~_  -+ ossec13001gųExim Auth failed2025-03-03 19:20:10 dovecot_plain authenticator failed for (208.235.164.124.adsl-pool.sx.cn) [124.164.235.208]:52008: 535 Incorrect authentication data (set_id=services@heipowersystem.com)124.164.235.2081814991j^  -_) ossec13001gŲExim Auth failed2025-03-03 19:17:19 dovecot_plain authenticator failed for ([183.167.196.62]) [183.167.196.62]:50290: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)183.167.196.621814991d]  -U' ossec13001gŲExim Auth failed2025-03-03 19:17:29 dovecot_plain authenticator failed for 62.174.139.16.static.user.ono.com [62.174.139.16]:51834: 535 Incorrect authentication data (set_id=sales)62.174.139.162510769P\  -3% ossec13001gŲ|Exim Auth failed2025-03-03 19:15:32 dovecot_login authenticator failed for ([65.20.128.78]) [65.20.128.78]:45009: 535 Incorrect authentication data (set_id=bo_msk)65.20.128.7899237l[  -e' ossec13001gŲcExim Auth failed2025-03-03 19:15:05 dovecot_login authenticator failed for ([120.24.83.156]) [223.104.199.0]:8900: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)223.104.199.01814991[Z  -?+ ossec13001gŲExim Auth failed2025-03-03 19:13:35 dovecot_login authenticator failed for ([103.186.221.174]) [103.186.221.174]:38590: 535 Incorrect authentication data (set_id=bo_msk)103.186.221.1741269750oY  -k' ossec13001gűExim Auth failed2025-03-03 19:13:08 dovecot_login authenticator failed for rm0zqz.g-service.ru [84.22.155.211]:53590: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)84.22.155.2112017370xX  -% ossec13001gŰExim Auth failed2025-03-03 19:07:10 dovecot_plain authenticator failed for 95-31-29-128.broadband.corbina.ru [95.31.29.128]:39310: 535 Incorrect authentication data (set_id=services@heipowersystem.com)95.31.29.1282017370UW  -7' ossec13001gŰFExim Auth failed2025-03-03 19:06:05 dovecot_login authenticator failed for (nyaystambh.com) [58.242.166.26]:54404: 535 Incorrect authentication data (set_id=nologin)58.242.166.261814991XV  -;) ossec13001gůRExim Auth failed2025-03-03 19:02:00 dovecot_login authenticator failed for ([183.99.228.131]) [183.99.228.131]:56263: 535 Incorrect authentication data (set_id=bo_msk)183.99.228.1311835841U  - ) ossec13001gů@Exim Auth failed2025-03-03 19:01:43 dovecot_login authenticator failed for (94.124.156.175.unknown.m1.com.sg) [175.156.124.94]:38118: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)175.156.124.941880251dT  -U' ossec13001gŮjExim Auth failed2025-03-03 18:58:09 dovecot_plain authenticator failed for (12.22.129.180.unknown.m1.com.sg) [180.129.22.12]:55185: 535 Incorrect authentication data (set_id=sales)180.129.22.121880251}S  - % ossec13001gŮKExim Auth failed2025-03-03 18:57:39 dovecot_plain authenticator failed for vps-79f20bfc.vps.ovh.net ([87.98.249.193]) [51.75.24.107]:6201: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)51.75.24.1073017382oR  -g+ ossec13001gŭExim Auth failed2025-03-03 18:55:35 dovecot_plain authenticator failed for ([111.193.226.252]) [111.193.226.252]:8772: 535 Incorrect authentication data (set_id=services@heipowersystem.com)111.193.226.2521814991lQ  -i# ossec13001gŬExim Auth failed2025-03-03 18:51:45 dovecot_plain authenticator failed for ([1.70.158.32]) [1.70.158.32]:36768: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)1.70.158.321814991\P  -G% ossec13001gŬExim Auth failed2025-03-03 18:50:28 dovecot_login authenticator failed for (9.72.116.151.hathway.com) [116.72.9.151]:53546: 535 Incorrect authentication data (set_id=bo_msk)116.72.9.1511269750   * 9cos qo  -q% ossec13001gŷ<Exim Auth failed2025-03-03 19:35:48 dovecot_plain authenticator failed for 128-72-81-95.broadband.corbina.ru [128.72.81.95]:57302: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)128.72.81.952017370vn  -y' ossec13001gŷExim Auth failed2025-03-03 19:35:17 dovecot_plain authenticator failed for ([27.40.100.250]) [27.40.100.250]:55156: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)27.40.100.2501814991Qm  -1% ossec13001gŶExim Auth failed2025-03-03 19:34:00 dovecot_login authenticator failed for ([60.174.35.18]) [60.174.35.18]:52913: 535 Incorrect authentication data (set_id=sales)60.174.35.181814991Nl  --# ossec13001gŶExim Auth failed2025-03-03 19:33:56 dovecot_login authenticator failed for ([27.98.249.9]) [27.98.249.9]:34214: 535 Incorrect authentication data (set_id=sales)27.98.249.91814991Wk  -9) ossec13001gŶExim Auth failed2025-03-03 19:33:55 dovecot_login authenticator failed for ([221.165.172.38]) [221.165.172.38]:34456: 535 Incorrect authentication data (set_id=sales)221.165.172.381835841jj  -_) ossec13001gŶExim Auth failed2025-03-03 19:33:48 dovecot_login authenticator failed for ([60.175.146.138]) [60.175.146.138]:53121: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)60.175.146.1381814991xi  -% ossec13001gŶExim Auth failed2025-03-03 19:33:44 dovecot_login authenticator failed for net-2-32-137-250.cust.vodafonedsl.it [2.32.137.250]:48747: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)2.32.137.2503175395ph  -k) ossec13001gŶExim Auth failed2025-03-03 19:33:45 dovecot_login authenticator failed for (31-220-168-116.rdtc.ru) [31.220.168.116]:58662: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)31.220.168.1162017370Rg  -3% ossec13001gŶ(Exim Auth failed2025-03-03 19:31:10 dovecot_login authenticator failed for ([87.117.32.22]) [87.117.32.22]:56166: 535 Incorrect authentication data (set_id=bo_msk)87.117.32.222017370mf  -g' ossec13001gŶExim Auth failed2025-03-03 19:30:55 dovecot_login authenticator failed for ([58.42.226.215]) [58.42.226.215]:56774: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)58.42.226.2151814991me  -g' ossec13001gŶExim Auth failed2025-03-03 19:30:36 dovecot_login authenticator failed for ([191.59.254.45]) [191.59.254.45]:52772: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)191.59.254.453469034Wd  -9) ossec13001gŵExim Auth failed2025-03-03 19:29:24 dovecot_plain authenticator failed for ([117.146.83.251]) [117.146.83.251]:35511: 535 Incorrect authentication data (set_id=sales)117.146.83.2511814991dc  -W% ossec13001gŵExim Auth failed2025-03-03 19:29:11 dovecot_plain authenticator failed for ([117.143.14.7]) [117.143.14.7]:43504: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)117.143.14.71814991Pb  -3# ossec13001gŵ%Exim Auth failed2025-03-03 19:26:53 dovecot_plain authenticator failed for ([95.0.252.76]) [95.0.252.76]:47188: 535 Incorrect authentication data (set_id=services)95.0.252.76298795wa  -}% ossec13001gŵExim Auth failed2025-03-03 19:26:41 dovecot_plain authenticator failed for h77-53-111-65.cust.bredband2.com [77.53.111.65]:38342: 535 Incorrect authentication data (set_id=services@heipowersystem.com)77.53.111.652661886O`  =+ ossec13008gŴMail Reciepient rejected2025-03-03 19:25:29 H=(mail.westerndancecompany.com) [165.154.208.103]:54195 F= rejected RCPT : Rejected relay attempt: '165.154.208.103' From: 'ygxeamxi@westerndancecompany.com' To: 'goofile@fastmail.com'165.154.208.1031668284 x / . S { 42SxW  -9) ossec13001g$Exim Auth failed2025-03-03 20:13:48 dovecot_plain authenticator failed for ([123.209.107.18]) [123.209.107.18]:56612: 535 Incorrect authentication data (set_id=sales)123.209.107.182077456[  -G# ossec13001gExim Auth failed2025-03-03 20:13:40 dovecot_plain authenticator failed for 96-1-40-151-staticipeast.wireless.telus.com [96.1.40.151]:45212: 535 Incorrect authentication data96.1.40.1516251999~~  -) ossec13001gExim Auth failed2025-03-03 20:13:16 dovecot_plain authenticator failed for net-188-152-225-58.cust.vodafonedsl.it [188.152.225.58]:53173: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)188.152.225.583175395g}  -[' ossec13001gžExim Auth failed2025-03-03 20:08:32 dovecot_plain authenticator failed for ([191.59.231.90]) [191.59.231.90]:50402: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)191.59.231.903469034W|  -9) ossec13001gžExim Auth failed2025-03-03 20:08:44 dovecot_plain authenticator failed for ([37.151.212.229]) [37.151.212.229]:52089: 535 Incorrect authentication data (set_id=sales)37.151.212.2291522867j{  -a' ossec13001gŽExim Auth failed2025-03-03 20:00:53 dovecot_plain authenticator failed for ([187.218.57.50]) [149.19.169.81]:12067: 535 Incorrect authentication data (set_id=services@heipowersystem.com)149.19.169.813996063cz  -W# ossec13001gżExim Auth failed2025-03-03 19:56:09 dovecot_plain authenticator failed for ([203.177.65.26]) [58.69.17.18]:56872: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)58.69.17.181694008cy  -S' ossec13001gŻ Exim Auth failed2025-03-03 19:52:01 dovecot_login authenticator failed for ([88.103.187.12]) [88.103.187.12]:47968: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)88.103.187.123077311x  -) ossec13001gźExim Auth failed2025-03-03 19:51:36 dovecot_login authenticator failed for (ip-20-192.datautama.net.id) [112.109.20.192]:56227: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)112.109.20.1921643084Uw  -7' ossec13001gźWExim Auth failed2025-03-03 19:49:02 dovecot_login authenticator failed for ([154.127.90.34]) [154.127.90.34]:46979: 535 Incorrect authentication data (set_id=bo_msk)154.127.90.342440476av  -W ossec13001gźKExim Auth failed2025-03-03 19:48:49 dovecot_login authenticator failed for ([4.4.89.74]) [4.4.89.74]:55656: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)4.4.89.746252001Tu  -7% ossec13001gŹExim Auth failed2025-03-03 19:46:26 dovecot_login authenticator failed for ([1.212.225.99]) [1.212.225.99]:50642: 535 Incorrect authentication data (set_id=services)1.212.225.991835841Wt  -9) ossec13001gŹExim Auth failed2025-03-03 19:46:22 dovecot_plain authenticator failed for ([220.161.52.149]) [220.161.52.149]:48730: 535 Incorrect authentication data (set_id=sales)220.161.52.1491814991}s  - ' ossec13001gŹExim Auth failed2025-03-03 19:46:14 dovecot_login authenticator failed for host-62-106-37-249.dynamic.elmonet.fi [62.106.37.249]:44958: 535 Incorrect authentication data (set_id=services@heipowersystem.com)62.106.37.249660013jr  -_) ossec13001gŹExim Auth failed2025-03-03 19:46:04 dovecot_plain authenticator failed for ([43.143.231.208]) [43.143.231.208]:33394: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)43.143.231.2081814991Zq  -?) ossec13001gŹExim Auth failed2025-03-03 19:43:24 dovecot_plain authenticator failed for ([222.117.88.230]) [222.117.88.230]:41726: 535 Incorrect authentication data (set_id=services)222.117.88.2301835841p  - + ossec13001gŸExim Auth failed2025-03-03 19:43:12 dovecot_plain authenticator failed for syn-108-191-170-208.biz.spectrum.com [108.191.170.208]:44596: 535 Incorrect authentication data (set_id=services@heipowersystem.com)108.191.170.2086252001 < M J o { %GDamX  -;) ossec13001gPExim Auth failed2025-03-03 20:44:22 dovecot_login authenticator failed for ([206.72.249.212]) [206.72.231.218]:52427: 535 Incorrect authentication data (set_id=bo_msk)206.72.231.2186252001p  -k) ossec13001g4Exim Auth failed2025-03-03 20:43:55 dovecot_login authenticator failed for ([211.106.126.27]) [211.106.126.27]:40592: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)211.106.126.271835841_  -K' ossec13001gdExim Auth failed2025-03-03 20:40:26 dovecot_login authenticator failed for ([103.174.34.49]) [103.174.34.49]:53415: 535 Incorrect authentication data (set_id=vikas.khandelwal)103.174.34.491269750  - ' ossec13001gTExim Auth failed2025-03-03 20:40:11 dovecot_login authenticator failed for (46.30.161.197.access.ipnet.ua) [46.30.161.197]:40520: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)46.30.161.197690791Z  -?) ossec13001gFExim Auth failed2025-03-03 20:39:56 dovecot_plain authenticator failed for ([181.189.61.189]) [181.189.61.189]:40928: 535 Incorrect authentication data (set_id=services)181.189.61.1893469034g  -]% ossec13001g8Exim Auth failed2025-03-03 20:39:43 dovecot_plain authenticator failed for ([193.93.237.8]) [193.93.237.8]:50848: 535 Incorrect authentication data (set_id=services@heipowersystem.com)193.93.237.82017370Q  -1% ossec13001gīExim Auth failed2025-03-03 20:33:07 dovecot_plain authenticator failed for ([60.172.1.210]) [60.172.1.210]:58742: 535 Incorrect authentication data (set_id=sales)60.172.1.2101814991n  -k% ossec13001gĉExim Auth failed2025-03-03 20:32:32 dovecot_plain authenticator failed for (9.72.116.151.hathway.com) [116.72.9.151]:45610: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)116.72.9.1511269750b  -S% ossec13001gyExim Auth failed2025-03-03 20:28:01 dovecot_plain authenticator failed for ool-4a5ad51c.dyn.optonline.net [74.90.213.28]:52760: 535 Incorrect authentication data (set_id=services)74.90.213.286252001d  -Y# ossec13001giExim Auth failed2025-03-03 20:27:44 dovecot_plain authenticator failed for ([101.13.5.49]) [101.13.5.49]:43050: 535 Incorrect authentication data (set_id=services@heipowersystem.com)101.13.5.491668284R  -3% ossec13001gUExim Auth failed2025-03-03 20:27:24 dovecot_login authenticator failed for ([41.76.80.100]) [41.76.80.100]:37416: 535 Incorrect authentication data (set_id=bo_msk)41.76.80.1002328926p  -k) ossec13001g3Exim Auth failed2025-03-03 20:26:51 dovecot_login authenticator failed for ([138.75.118.229]) [138.75.118.229]:49349: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)138.75.118.2291880251W  -;' ossec13001gExim Auth failed2025-03-03 20:20:32 dovecot_plain authenticator failed for ([82.208.71.101]) [82.208.71.101]:50468: 535 Incorrect authentication data (set_id=services)82.208.71.1012017370  - ) ossec13001gExim Auth failed2025-03-03 20:20:18 dovecot_plain authenticator failed for syn-070-122-139-172.res.spectrum.com [70.122.139.172]:45272: 535 Incorrect authentication data (set_id=services@heipowersystem.com)70.122.139.1726252001k Q;) ossec11000gLogin failed on the cpanel service[2025-03-03 20:15:33 +0530] info [whostmgrd] 106.206.136.79 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect106.206.136.791269750R  -3% ossec13001gZExim Auth failed2025-03-03 20:14:42 dovecot_login authenticator failed for ([36.48.70.211]) [36.48.70.211]:43410: 535 Incorrect authentication data (set_id=bo_msk)36.48.70.2111814991j  -c% ossec13001g4Exim Auth failed2025-03-03 20:14:03 dovecot_login authenticator failed for ([59.2.141.155]) [59.2.141.155]:35962: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)59.2.141.1551835841 s$ H Z  -9asj"  -_) ossec13001gExim Auth failed2025-03-03 21:03:49 dovecot_plain authenticator failed for ([103.129.201.82]) [103.129.201.81]:42858: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)103.129.201.811210997T!  -7% ossec13001g˥Exim Auth failed2025-03-03 21:02:53 dovecot_plain authenticator failed for ([14.39.41.171]) [14.39.41.171]:53352: 535 Incorrect authentication data (set_id=services)14.39.41.1711835841p  -q% ossec13001gˏExim Auth failed2025-03-03 21:02:31 dovecot_plain authenticator failed for 77-85-52-109.ip.btc-net.bg [77.85.52.109]:36966: 535 Incorrect authentication data (set_id=services@heipowersystem.com)77.85.52.109732800T  -7' ossec13001gQExim Auth failed2025-03-03 20:57:12 dovecot_login authenticator failed for ([188.59.88.234]) [188.59.88.234]:53120: 535 Incorrect authentication data (set_id=bo_msk)188.59.88.234298795t  -s) ossec13001gMExim Auth failed2025-03-03 20:57:09 dovecot_login authenticator failed for (amplifypowerglobal.com) [42.193.105.109]:55402: 535 Incorrect authentication data (set_id=sales@amplifypowerglobal.com)42.193.105.1091814991  -) ossec13001g;Exim Auth failed2025-03-03 20:56:50 dovecot_login authenticator failed for syn-070-122-139-172.res.spectrum.com [70.122.139.172]:57189: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)70.122.139.1726252001_  -I) ossec13001g7Exim Auth failed2025-03-03 20:56:45 dovecot_login authenticator failed for (amplifypowerglobal.com) [42.193.105.109]:36086: 535 Incorrect authentication data (set_id=nologin)42.193.105.1091814991T  -5' ossec13001gExim Auth failed2025-03-03 20:55:30 dovecot_plain authenticator failed for ([197.211.47.66]) [197.211.47.66]:53130: 535 Incorrect authentication data (set_id=sales)197.211.47.662328926g  -[' ossec13001gExim Auth failed2025-03-03 20:55:14 dovecot_plain authenticator failed for ([222.86.58.117]) [222.86.58.117]:39375: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)222.86.58.1171814991m  -e) ossec13001gExim Auth failed2025-03-03 20:50:58 dovecot_plain authenticator failed for ([124.246.94.219]) [124.246.94.219]:45723: 535 Incorrect authentication data (set_id=services@heipowersystem.com)124.246.94.2191880251e  -S+ ossec13001gbExim Auth failed2025-03-03 20:48:58 dovecot_login authenticator failed for ([109.124.195.218]) [109.124.195.218]:58474: 535 Incorrect authentication data (set_id=vikas.khandelwal)109.124.195.2182017370x  -y+ ossec13001gTExim Auth failed2025-03-03 20:48:44 dovecot_login authenticator failed for ([165.154.202.101]) [165.154.202.101]:64416: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)165.154.202.1016252001W  -;' ossec13001gPExim Auth failed2025-03-03 20:48:39 dovecot_plain authenticator failed for ([49.245.99.168]) [49.245.99.168]:41933: 535 Incorrect authentication data (set_id=services)49.245.99.1681880251j  -a' ossec13001g*Exim Auth failed2025-03-03 20:48:02 dovecot_plain authenticator failed for ([222.100.159.2]) [222.100.159.2]:33464: 535 Incorrect authentication data (set_id=services@heipowersystem.com)222.100.159.21835841X  -;) ossec13001g$Exim Auth failed2025-03-03 20:47:56 dovecot_login authenticator failed for ([154.203.67.113]) [154.203.67.113]:41303: 535 Incorrect authentication data (set_id=bo_msk)154.203.67.1133374766m  -g' ossec13001gExim Auth failed2025-03-03 20:47:25 dovecot_login authenticator failed for ([221.157.85.22]) [221.157.85.22]:60272: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)221.157.85.221835841g  -[' ossec13001gZExim Auth failed2025-03-03 20:44:33 dovecot_plain authenticator failed for ([154.127.90.34]) [154.127.90.34]:56584: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)154.127.90.342440476 <  8 J ^ j0<p3  -i+ ossec13001gӑExim Auth failed2025-03-03 21:36:40 dovecot_plain authenticator failed for ([175.117.144.158]) [175.117.144.158]:52908: 535 Incorrect authentication data (set_id=services@heipowersystem.com)175.117.144.1581835841R2  -3% ossec13001gyExim Auth failed2025-03-03 21:27:43 dovecot_login authenticator failed for ([85.152.57.60]) [85.152.57.60]:50979: 535 Incorrect authentication data (set_id=bo_msk)85.152.57.602510769w1  -}% ossec13001gdExim Auth failed2025-03-03 21:27:23 dovecot_login authenticator failed for bb121-7-26-195.singnet.com.sg [121.7.26.195]:49454: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)121.7.26.1951880251Z0  -?) ossec13001g+Exim Auth failed2025-03-03 21:26:25 dovecot_plain authenticator failed for ([58.210.188.130]) [58.210.188.130]:50253: 535 Incorrect authentication data (set_id=services)58.210.188.1301814991l/  -e) ossec13001gExim Auth failed2025-03-03 21:26:06 dovecot_plain authenticator failed for ([196.188.187.85]) [196.188.187.85]:55560: 535 Incorrect authentication data (set_id=services@heipowersystem.com)196.188.187.85337996k.  -c' ossec13001gExim Auth failed2025-03-03 21:21:16 dovecot_login authenticator failed for broadband-77-37-174-248.ip.moscow.rt.ru [77.37.174.248]:53074: 535 Incorrect authentication data (set_id=bo_msk)77.37.174.2482017370p-  -k) ossec13001gExim Auth failed2025-03-03 21:20:53 dovecot_login authenticator failed for ([221.140.188.44]) [221.140.188.44]:60268: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)221.140.188.441835841j,  -_) ossec13001g\Exim Auth failed2025-03-03 21:18:44 dovecot_plain authenticator failed for (94.124.156.175.unknown.m1.com.sg) [175.156.124.94]:44316: 535 Incorrect authentication data (set_id=services)175.156.124.941880251m+  -e) ossec13001gJExim Auth failed2025-03-03 21:18:25 dovecot_plain authenticator failed for ([59.102.188.188]) [59.102.188.188]:48311: 535 Incorrect authentication data (set_id=services@heipowersystem.com)59.102.188.1881668284U*  -7' ossec13001g<Exim Auth failed2025-03-03 21:18:11 dovecot_login authenticator failed for ([50.249.167.45]) [50.249.167.45]:39973: 535 Incorrect authentication data (set_id=bo_msk)50.249.167.456252001p)  -k) ossec13001g2Exim Auth failed2025-03-03 21:18:01 dovecot_login authenticator failed for ([49.124.152.248]) [49.124.152.248]:35080: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)49.124.152.2481733045h(  -Y+ ossec13001gExim Auth failed2025-03-03 21:16:27 dovecot_plain authenticator failed for 136.169.144.176.dynamic.ufanet.ru [136.169.144.176]:58268: 535 Incorrect authentication data (set_id=sales)136.169.144.1762017370j'  -_) ossec13001gExim Auth failed2025-03-03 21:16:09 dovecot_plain authenticator failed for ([114.247.207.98]) [114.247.207.98]:54398: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)114.247.207.981814991a&  -Q% ossec13001gVExim Auth failed2025-03-03 21:14:20 dovecot_login authenticator failed for 111-70-13-24.emome-ip.hinet.net [111.70.13.24]:56888: 535 Incorrect authentication data (set_id=bo_msk)111.70.13.241668284|%  -) ossec13001gLExim Auth failed2025-03-03 21:14:10 dovecot_login authenticator failed for 208.95.143.157.bbcs.as8758.net [157.143.95.208]:53534: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)157.143.95.2082658434o$  -k' ossec13001gBExim Auth failed2025-03-03 21:09:45 dovecot_login authenticator failed for rm0zqz.g-service.ru [84.22.155.211]:51196: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)84.22.155.2112017370l#  -g% ossec13001g̋Exim Auth failed2025-03-03 21:06:42 dovecot_plain authenticator failed for vps-79f20bfc.vps.ovh.net [51.75.24.107]:20858: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)51.75.24.1073017382 "" L a o  #NKDPumD  -g' ossec13001gExim Auth failed2025-03-03 22:03:51 dovecot_login authenticator failed for ([223.210.27.53]) [223.210.27.53]:56960: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)223.210.27.531814991WC  -;) ossec13001gٿExim Auth failed2025-03-03 22:03:02 dovecot_login authenticator failed for ([178.218.193.90]) [178.218.193.90]:34974: 535 Incorrect authentication data (set_id=bo_msk)178.218.193.90798544pB  -k) ossec13001gٷExim Auth failed2025-03-03 22:02:54 dovecot_login authenticator failed for ([221.140.188.44]) [221.140.188.44]:54486: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)221.140.188.441835841A  -+ ossec13001gExim Auth failed2025-03-03 22:00:13 dovecot_plain authenticator failed for broadband-178-140-152-209.ip.moscow.rt.ru [178.140.152.209]:57820: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)178.140.152.2092017370@  - ) ossec13001gZExim Auth failed2025-03-03 21:57:06 dovecot_login authenticator failed for 195-159-217-71.customer.powertech.no [195.159.217.71]:53326: 535 Incorrect authentication data (set_id=services@heipowersystem.com)195.159.217.713144096Q?  -3# ossec13001gTExim Auth failed2025-03-03 21:56:59 dovecot_plain authenticator failed for ([59.0.60.158]) [59.0.60.158]:57322: 535 Incorrect authentication data (set_id=services)59.0.60.1581835841Z>  -?) ossec13001ghExim Auth failed2025-03-03 21:57:19 dovecot_login authenticator failed for ([117.156.80.230]) [117.156.80.230]:43333: 535 Incorrect authentication data (set_id=services)117.156.80.2301814991d=  -Y# ossec13001gHExim Auth failed2025-03-03 21:56:47 dovecot_plain authenticator failed for ([101.13.5.37]) [101.13.5.37]:59258: 535 Incorrect authentication data (set_id=services@heipowersystem.com)101.13.5.371668284[<  -?+ ossec13001gvExim Auth failed2025-03-03 21:53:17 dovecot_login authenticator failed for ([175.117.144.158]) [175.117.144.158]:54062: 535 Incorrect authentication data (set_id=bo_msk)175.117.144.1581835841n;  -i' ossec13001gdExim Auth failed2025-03-03 21:53:00 dovecot_login authenticator failed for (www.nettlinx.com) [202.53.94.242]:37014: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)202.53.94.2421269750A:  -% ossec13001g^Exim Auth failed2025-03-03 21:52:53 dovecot_login authenticator failed for ([58.131.97.5]) [180.88.96.37]:15114: 535 Incorrect authentication data180.88.96.371814991l9  -c) ossec13001g֠Exim Auth failed2025-03-03 21:49:44 dovecot_plain authenticator failed for syn-173-095-123-220.biz.spectrum.com [173.95.123.220]:55474: 535 Incorrect authentication data (set_id=services)173.95.123.2206252001n8 -e) ossec13001g֌Exim Auth failed2025-03-03 21:49:23 dovecot_plain authenticator failed for ([216.194.174.86]) [216.194.174.27]:21306: 535 Incorrect authentication data (set_id=services@heipowersystem.com)216.194.174.276252001g7  -[' ossec13001gռExim Auth failed2025-03-03 21:45:55 dovecot_plain authenticator failed for ([122.160.139.7]) [122.160.139.7]:40891: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)122.160.139.71269750R6  -3% ossec13001gExim Auth failed2025-03-03 21:37:38 dovecot_login authenticator failed for ([202.200.14.2]) [202.200.14.2]:39903: 535 Incorrect authentication data (set_id=bo_msk)202.200.14.21814991|5  -' ossec13001gӹExim Auth failed2025-03-03 21:37:21 dovecot_login authenticator failed for 216.106.67.50.reverse.socket.net [216.106.67.50]:56598: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)216.106.67.506252001Z4  -?) ossec13001gөExim Auth failed2025-03-03 21:37:04 dovecot_plain authenticator failed for ([175.125.68.208]) [175.125.68.208]:46189: 535 Incorrect authentication data (set_id=services)175.125.68.2081835841 *\~tj`VLB8.$zpf\H>4*   v l b X N D : 0 &    ~ t j ` V L B 8 . $    z p f \ R H > * 4  vlbXND:0&|rh^TJ@6,"xnZPFd<2( ~tj`VLB8.$zpf\ | r h ^ T J @ 6 , "    x n d Z P F < 2 (   RRH>4*  vlbXND:0& gQ: g9 g8 gd7 gV6 g5 g4 g3 g2 g1 gG0 gQ/ g . g- g7, g-+ g* g) g( g' g& gR% g<$ g# g" g! g g g g g g g g g7 g) g g g g  g w g  g  g M g  g $ g  g  g  g | g d g N g ~ g g g g g g g gy g g g g g g g g gV gF g g  g gi g[ gY gK gI g gk gy g g g g g g ge g g g  g g gU g} ga g  g g g g g g g g gA g7 g g g g  gܚ gM gA g g g g gٿ gٷ g gZ gT gh gH gv gd g^ g֠ g֌ gռ g gӹ gө gӑ gy gd g+ g g g g\ gJ g< g2 g g gV gL gB g̋ g g˥ gˏ gQ gM g; g7 g g g gb gT gP g* g$ g gZ gP g,e g+d g+uc g*Xb g*L` g*F_ g*8a g)*^ g(] g([ g(\ g'Z g'Y g'hX g&W g&V g&_U g&]T g&[S g&7R g&Q g&P g%O g%N g#M g#gL g#YK g"J g"<I g"(H g G g F g E gD gC guB geA gK@ g? g> g= g< g{; g4 gd gT gF g8 gī gĉ gy gi gU g3 g g g gZ g4 g$ g g~ gž| gž} gŽ{ gżz gŻ y gźx gźWw gźKv gŹu gŹt gŹs gŹr gŹq gŸp gŷ<o gŷn gŶm gŶl gŶk gŶj gŶi gŶh gŶ(g g,f gŶf gŶe gŵd gŵc gŵ%b gŵa gŴ` gų_ gŲ] gŲ^ gŲ|\ gŲc[ gŲZ gűY gŰX gŰFW gůRV gů@U gŮjT gŮKS gŭR gŬQ gŬP gŬO gŬ9N gŬ)M gŬL gūK gūsJ gūaI gū?H gū+G gŪE gŪ|F gũdC gũZD gŨ.B gŨ A gŧz? gŧj@ gŦ> gŦ=   ; M r C@Od U  E7 ossec5740gssh connection reset by peerMar 3 22:59:22 vm1 sshd[1866893]: error: send_error: write: Connection reset by peerlT  -c) ossec13001gExim Auth failed2025-03-03 22:46:53 dovecot_plain authenticator failed for zdomainaccess.com [216.70.114.230]:47444: 535 Incorrect authentication data (set_id=services@heipowersystem.com)216.70.114.2306252001US  -7' ossec13001gExim Auth failed2025-03-03 22:42:07 dovecot_login authenticator failed for ([49.124.145.62]) [49.124.145.62]:53774: 535 Incorrect authentication data (set_id=bo_msk)49.124.145.621733045gR  -_# ossec13001gExim Auth failed2025-03-03 22:41:53 dovecot_login authenticator failed for ([119.32.11.3]) [119.32.11.3]:25492: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)119.32.11.31814991mQ  -c+ ossec13001gExim Auth failed2025-03-03 22:38:06 dovecot_plain authenticator failed for ([190.211.250.118]) [190.211.250.122]:50447: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)190.211.250.1223895114P  - ) ossec13001gAExim Auth failed2025-03-03 22:35:04 dovecot_plain authenticator failed for syn-098-102-148-242.biz.spectrum.com [98.102.148.242]:36334: 535 Incorrect authentication data (set_id=services@heipowersystem.com)98.102.148.2426252001(O  3U) ossec11301g7New FTP connection.Mar 3 22:34:53 vm1 pure-ftpd[1862238]: (?@198.235.24.123) [INFO] New connection from 198.235.24.123198.235.24.1236252001NN  --# ossec13001gExim Auth failed2025-03-03 22:25:06 dovecot_plain authenticator failed for ([47.91.88.67]) [47.91.88.67]:44768: 535 Incorrect authentication data (set_id=sales)47.91.88.672921044mM  -c+ ossec13001gExim Auth failed2025-03-03 22:24:51 dovecot_plain authenticator failed for ([193.158.248.248]) [193.158.248.248]:41702: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)193.158.248.2482921044WL  -;' ossec13001gExim Auth failed2025-03-03 22:21:33 dovecot_plain authenticator failed for ([151.40.26.236]) [151.40.26.236]:54412: 535 Incorrect authentication data (set_id=services)151.40.26.2363175395pK  -i+ ossec13001g Exim Auth failed2025-03-03 22:21:20 dovecot_plain authenticator failed for ([103.219.154.156]) [103.219.154.156]:51146: 535 Incorrect authentication data (set_id=services@heipowersystem.com)103.219.154.1562750405mJ  -e) ossec13001gܚExim Auth failed2025-03-03 22:15:13 dovecot_plain authenticator failed for ([220.80.224.223]) [220.80.224.223]:38257: 535 Incorrect authentication data (set_id=services@heipowersystem.com)220.80.224.2231835841WI  -9) ossec13001gMExim Auth failed2025-03-03 22:09:41 dovecot_plain authenticator failed for ([222.67.133.193]) [222.67.133.193]:48834: 535 Incorrect authentication data (set_id=sales)222.67.133.1931814991jH  -_) ossec13001gAExim Auth failed2025-03-03 22:09:28 dovecot_plain authenticator failed for ([175.205.191.27]) [175.205.191.27]:55314: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)175.205.191.271835841OG  -/# ossec13001gExim Auth failed2025-03-03 22:07:52 dovecot_login authenticator failed for ([112.94.6.54]) [112.94.6.54]:42938: 535 Incorrect authentication data (set_id=bo_msk)112.94.6.541814991mF  -g' ossec13001gExim Auth failed2025-03-03 22:07:30 dovecot_login authenticator failed for ([218.4.205.242]) [218.4.205.242]:37833: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)218.4.205.2421814991}E  -) ossec13001gExim Auth failed2025-03-03 22:04:00 dovecot_login authenticator failed for customer-ip-193-151-51-223.ipv.net.pl ([91.227.103.222]) [193.151.51.223]:60304: 535 Incorrect authentication data (set_id=bo_msk)193.151.51.223798544 3tgZML?2% {n A 4 ' @3 u 8 +   h [ N zm`SF9, v i \s >1~~qdWJ=0  6) PC j] Rw E#aTG:-   x k { n a T G :K . _ !   e X K > 1 $  |obUH;.!xk^QD7*fY$qdW{naTG:-  2017370G 2017370G 2017370E? 2017370E 2017370E 2017370D 2077456 O 2017370E@ 2077456  2077456 2077456 l 2017370Fm 2017370Fl 2017370Fa 2017370F* 2017370F( 2017370F 2017370E 2017370E 2077456 2077456 2077456 2077456 2077456 2077456 2077456` 2077456- 2077456 2077456 2077456 2077456 2077456 2077456 2077456 2077456v 2077456# 2077456 2077456 2077456 2077456 2077456 2077456G 2077456 2077456G 20774569 2077456 2077456 2077456 2077456 _ 2077456 Y 2017370F 2017370F 2017370F 2017370F 2017370F 2017370F 2017370F 2017370F 2017370F 2017370F 2017370F 2017370F 2077456W 2077456M 2017370J 2077456 2077456 2077456y 2017370K 2077456M 2077456@ 2017370K 2077456P 2017370M 2017370Mk 2017370Mf 2017370Md 2017370N 2017370M 2017370M 2017370N 2017370N 2017370N 2017370N 2017370N 2017370N 2017370O 2017370ON 2017370O 2017370O 2017370O 2017370O 2017370Ol 2017370OL 2017370O? 2017370O/ 2017370O$ 2017370G( 2017370G% 2017370G 2017370G 2017370G 2017370G 2017370F 2017370F 2017370K- 2017370K 2077456c 2017370KZ 2017370KO 2017370KF 2077456d 2017370K 2017370K[ 203312 2077456 2077456 2077456l 2017370K 2017370K 2017370Li 2017370Lb 2017370K 2017370K r 2017370L 2017370L 2017370L 2017370L{ 2017370GT 2017370G2 2017370G, 2017370G) 2017370H 2017370H| 2017370Hc 2017370G 2017370N 2017370N 2017370N/ 2017370N( 2017370N" 2017370M 2017370M 2017370M 2017370M 2017370M 2029969  2017370HV 2017370H+ 2017370H* 2017370H 2017370N 2017370N 203312F 2029969)1 2029969! 2029969} 2029969T 2029969 2029969 2029969G 2029969r 20299690 2029969 2077456 a 2077456 2077456 20774566 2077456 203312%S 2029969>L 20299698 20299694# 2029969/{ 2029969- 2029969) 2077456 % 2077456 2077456 2077456 2077456 2077456 2077456 T 2077456 K 2077456  2077456 2077456 2077456 2077456 R 2077456 7 2077456 ! 2077456 2077456 2077456 2017370J 2017370J 2017370J 2017370J 2017370J 2017370J 2017370Jm 2017370Jg 2017370JK 2017370JJ 2017370JC 2017370J" 2017370J 2017370J 2017370J 2017370J 2017370I 2017370I 2017370I 2017370I 2017370I 2017370I 2017370I 2017370I 2017370I 2017370I 2017370I 2017370I 2017370I[ 2017370IS 2017370IB 2017370I 2017370H 2017370H 2017370H 2017370N 2017370LT 2017370L0 2017370L 2017370L 2017370L 2017370K 2017370K 2017370Mc 2017370M] 2017370MV 2017370MF 2017370M 2017370M 2017370L 2017370L 2017370M O j '3EUcWf  -9) ossec13001gExim Auth failed2025-03-04 00:32:48 dovecot_plain authenticator failed for ([46.236.190.103]) [46.236.190.103]:51466: 535 Incorrect authentication data (set_id=sales)46.236.190.1032017370Te  -7% ossec13001gExim Auth failed2025-03-04 00:32:46 dovecot_plain authenticator failed for ([14.35.218.58]) [14.35.218.58]:57006: 535 Incorrect authentication data (set_id=services)14.35.218.581835841nd  -k' ossec13001gExim Auth failed2025-03-04 00:32:39 dovecot_plain authenticator failed for (ppp11-lumwana.zamnet.zm) [196.46.199.11]:54536: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)196.46.199.11895949lc  -e) ossec13001gExim Auth failed2025-03-04 00:32:23 dovecot_plain authenticator failed for ([87.236.141.106]) [87.236.141.106]:47315: 535 Incorrect authentication data (set_id=services@heipowersystem.com)87.236.141.106290291jb  -_) ossec13001geExim Auth failed2025-03-04 00:30:52 dovecot_plain authenticator failed for ([27.107.168.206]) [27.107.168.206]:52594: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)27.107.168.2061269750pa  -i+ ossec13001gExim Auth failed2025-03-04 00:27:13 dovecot_plain authenticator failed for ([125.139.124.120]) [125.139.124.120]:57564: 535 Incorrect authentication data (set_id=services@heipowersystem.com)125.139.124.1201835841[`  -?+ ossec13001gExim Auth failed2025-03-04 00:25:17 dovecot_login authenticator failed for ([178.178.194.192]) [178.178.194.192]:45910: 535 Incorrect authentication data (set_id=bo_msk)178.178.194.1922017370r_  -m+ ossec13001g Exim Auth failed2025-03-04 00:25:08 dovecot_login authenticator failed for ([223.239.130.245]) [223.239.130.245]:6534: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)223.239.130.2451269750j^  -c% ossec13001gExim Auth failed2025-03-04 00:19:47 dovecot_login authenticator failed for ([5.59.141.152]) [5.59.141.152]:52240: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)5.59.141.1522017370d]  -Y# ossec13001gExim Auth failed2025-03-04 00:15:36 dovecot_plain authenticator failed for ([46.44.5.135]) [46.44.5.135]:56770: 535 Incorrect authentication data (set_id=services@heipowersystem.com)46.44.5.1352017370i\  -_) ossec13001gUExim Auth failed2025-03-04 00:09:16 dovecot_plain authenticator failed for ([196.188.187.85]) [196.188.187.85]:57284: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)196.188.187.85337996b[  -O) ossec13001g}Exim Auth failed2025-03-03 23:57:08 dovecot_plain authenticator failed for ([191.210.87.101]) [191.210.87.101]:47488: 535 Incorrect authentication data (set_id=vikas.khandelwal)191.210.87.1013469034uZ  -u) ossec13001gaExim Auth failed2025-03-03 23:56:41 dovecot_plain authenticator failed for ([221.146.201.37]) [221.146.201.37]:41696: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)221.146.201.371835841HY  -' ossec13001g Exim Auth failed2025-03-03 23:55:14 dovecot_plain authenticator failed for ppp005055076002.access.hol.gr [5.55.76.2]:52652: 535 Incorrect authentication data5.55.76.2390903aX  -S# ossec13001gExim Auth failed2025-03-03 23:44:46 dovecot_plain authenticator failed for ([8.209.221.7]) [8.209.221.7]:46126: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)8.209.221.71861060EW  -' ossec13001gExim Auth failed2025-03-03 23:24:45 dovecot_login authenticator failed for ([181.233.93.67]) [181.233.93.67]:46513: 535 Incorrect authentication data181.233.93.673469034dV  -W% ossec13001gExim Auth failed2025-03-03 23:07:28 dovecot_plain authenticator failed for ([14.99.61.248]) [14.99.61.248]:59748: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)14.99.61.2481269750 L- 8 8 ^ Y ]zs+L[w  -?+ ossec13001gExim Auth failed2025-03-04 00:58:40 dovecot_login authenticator failed for ([103.146.233.100]) [103.146.233.100]:43907: 535 Incorrect authentication data (set_id=bo_msk)103.146.233.1001269750pv  -k) ossec13001gExim Auth failed2025-03-04 00:58:32 dovecot_login authenticator failed for ([222.239.231.61]) [222.239.231.61]:33398: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)222.239.231.611835841Qu  -3# ossec13001gVExim Auth failed2025-03-04 00:51:56 dovecot_plain authenticator failed for ([101.13.5.49]) [101.13.5.49]:57072: 535 Incorrect authentication data (set_id=services)101.13.5.491668284jt  -a' ossec13001gFExim Auth failed2025-03-04 00:51:41 dovecot_plain authenticator failed for ([79.77.174.182]) [79.77.174.182]:35962: 535 Incorrect authentication data (set_id=services@heipowersystem.com)79.77.174.1822635167Ws  -;) ossec13001gExim Auth failed2025-03-04 00:46:42 dovecot_plain authenticator failed for ([185.134.179.106]) [185.101.16.250]:35635: 535 Incorrect authentication data (set_id=sales)185.101.16.250272103jr  -_) ossec13001g Exim Auth failed2025-03-04 00:46:25 dovecot_plain authenticator failed for ([188.247.49.186]) [188.247.49.186]:38412: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)188.247.49.1862017370[q  -?+ ossec13001gExim Auth failed2025-03-04 00:44:10 dovecot_login authenticator failed for ([220.120.227.186]) [220.120.227.186]:33566: 535 Incorrect authentication data (set_id=bo_msk)220.120.227.1861835841ep  -W' ossec13001giExim Auth failed2025-03-04 00:43:44 dovecot_login authenticator failed for 202-4-196-180.static.pccw-hkt.com [202.4.196.180]:37384: 535 Incorrect authentication data (set_id=bo_msk)202.4.196.1801819730o  -# ossec13001g[Exim Auth failed2025-03-04 00:43:31 dovecot_login authenticator failed for 96-1-40-151-staticipeast.wireless.telus.com [96.1.40.151]:60033: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)96.1.40.1516251999_n  -K' ossec13001gYExim Auth failed2025-03-04 00:43:29 dovecot_login authenticator failed for ([49.124.151.30]) [49.124.151.30]:38830: 535 Incorrect authentication data (set_id=vikas.khandelwal)49.124.151.301733045xm  -% ossec13001gKExim Auth failed2025-03-04 00:43:14 dovecot_login authenticator failed for (6-62-170-152.fibertel.com.ar) [152.170.62.6]:35243: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)152.170.62.63865483l  -% ossec13001gIExim Auth failed2025-03-04 00:43:12 dovecot_login authenticator failed for c-73-95-112-29.hsd1.co.comcast.net [73.95.112.29]:50182: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)73.95.112.296252001Vk -7' ossec13001gExim Auth failed2025-03-04 00:41:03 dovecot_login authenticator failed for (nyaystambh.com) [111.56.54.202]:52316: 535 Incorrect authentication data (set_id=nologin)111.56.54.2021814991|j  -+ ossec13001gkExim Auth failed2025-03-04 00:39:30 dovecot_plain authenticator failed for ([118.183.180.108]) [118.183.180.108]:27276: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)118.183.180.1081814991qi  -q% ossec13001gyExim Auth failed2025-03-04 00:39:45 dovecot_plain authenticator failed for 95-30-250-44.broadband.corbina.ru [95.30.250.44]:57786: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)95.30.250.442017370ah  -K+ ossec13001gExim Auth failed2025-03-04 00:33:55 dovecot_plain authenticator failed for (106.51.70.231.actcorp.in) [180.151.254.218]:50920: 535 Incorrect authentication data (set_id=sales)180.151.254.2181269750jg  -_) ossec13001gExim Auth failed2025-03-04 00:33:27 dovecot_plain authenticator failed for ([119.62.156.161]) [119.62.156.161]:30466: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)119.62.156.1611814991 % 4 I ? U ^\n}T  -5' ossec13001g dExim Auth failed2025-03-04 01:26:19 dovecot_plain authenticator failed for ([90.188.40.123]) [90.188.40.123]:45298: 535 Incorrect authentication data (set_id=sales)90.188.40.1232017370m  -c+ ossec13001g NExim Auth failed2025-03-04 01:25:56 dovecot_plain authenticator failed for ([179.183.114.175]) [179.183.114.175]:43385: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)179.183.114.1753469034j  -c% ossec13001g ~Exim Auth failed2025-03-04 01:26:45 dovecot_login authenticator failed for ([101.230.0.49]) [124.74.9.190]:53265: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)124.74.9.1901814991(  3U) ossec11301gNew FTP connection.Mar 4 01:23:55 vm1 pure-ftpd[1896067]: (?@165.22.204.198) [INFO] New connection from 165.22.204.198165.22.204.1982750405U  -7' ossec13001gExim Auth failed2025-03-04 01:19:12 dovecot_login authenticator failed for ([103.69.244.39]) [103.69.244.39]:32850: 535 Incorrect authentication data (set_id=bo_msk)103.69.244.391269750m  -g' ossec13001gExim Auth failed2025-03-04 01:18:58 dovecot_login authenticator failed for ([58.16.215.241]) [58.16.215.241]:37378: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)58.16.215.2411814991|  -) ossec13001gExim Auth failed2025-03-04 01:18:29 dovecot_plain authenticator failed for 125-228-225-91.hinet-ip.hinet.net [125.228.225.91]:33819: 535 Incorrect authentication data (set_id=services@heipowersystem.com)125.228.225.911668284W  -9) ossec13001gExim Auth failed2025-03-04 01:14:50 dovecot_plain authenticator failed for ([117.175.160.58]) [117.175.160.58]:35410: 535 Incorrect authentication data (set_id=sales)117.175.160.581814991d  -W% ossec13001gExim Auth failed2025-03-04 01:14:38 dovecot_plain authenticator failed for ([50.82.12.128]) [50.82.12.128]:59592: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)50.82.12.1286252001E  -' ossec13001gExim Auth failed2025-03-04 01:14:25 dovecot_plain authenticator failed for ([95.52.199.137]) [95.52.199.137]:57419: 535 Incorrect authentication data95.52.199.1372017370s~  -o+ ossec13001gyExim Auth failed2025-03-04 01:09:37 dovecot_login authenticator failed for ([211.247.127.250]) [211.247.127.250]:50616: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)211.247.127.2501835841f}  -W) ossec13001gExim Auth failed2025-03-04 01:02:08 dovecot_plain authenticator failed for s75-152-225-154.ab.hsia.telus.net [75.152.225.154]:35859: 535 Incorrect authentication data (set_id=sales)75.152.225.1546251999|  -% ossec13001gExim Auth failed2025-03-04 01:01:50 dovecot_plain authenticator failed for 206.81.4.146.static.wline.lns.sme.cust.swisscom.ch [146.4.81.206]:45115: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)146.4.81.2062658434g{  -]% ossec13001gExim Auth failed2025-03-04 01:01:27 dovecot_login authenticator failed for 32.104.29.34.bc.googleusercontent.com [34.29.104.32]:52356: 535 Incorrect authentication data (set_id=bo_msk)34.29.104.326252001mz  -g' ossec13001gExim Auth failed2025-03-04 01:01:17 dovecot_login authenticator failed for ([27.223.98.117]) [27.223.98.117]:51653: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)27.223.98.1171814991Zy  -?) ossec13001gExim Auth failed2025-03-04 00:59:09 dovecot_plain authenticator failed for ([187.93.153.166]) [187.93.153.166]:53180: 535 Incorrect authentication data (set_id=services)187.93.153.1663469034yx  -' ossec13001gExim Auth failed2025-03-04 00:58:58 dovecot_plain authenticator failed for 89-253-90-113.customers.ownit.se [89.253.90.113]:46426: 535 Incorrect authentication data (set_id=services@heipowersystem.com)89.253.90.1132661886 > P ` ~ APtp  -k) ossec13001gExim Auth failed2025-03-04 01:54:06 dovecot_login authenticator failed for ([183.100.18.224]) [183.100.18.224]:37408: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)183.100.18.2241835841%  3Q' ossec11301g7New FTP connection.Mar 4 01:51:09 vm1 pure-ftpd[1901779]: (?@87.236.176.99) [INFO] New connection from 87.236.176.9987.236.176.992635167k  -_+ ossec13001g)Exim Auth failed2025-03-04 01:50:57 dovecot_plain authenticator failed for (190-205-112-156.static.cantv.net) [190.205.112.156]:8906: 535 Incorrect authentication data (set_id=services)190.205.112.1563625428m  -e) ossec13001gExim Auth failed2025-03-04 01:50:42 dovecot_plain authenticator failed for ([154.203.67.113]) [154.203.67.113]:36230: 535 Incorrect authentication data (set_id=services@heipowersystem.com)154.203.67.1133374766X  -;) ossec13001gExim Auth failed2025-03-04 01:48:51 dovecot_login authenticator failed for ([218.93.229.230]) [218.93.229.230]:40095: 535 Incorrect authentication data (set_id=bo_msk)218.93.229.2301814991m  -g' ossec13001gExim Auth failed2025-03-04 01:48:38 dovecot_login authenticator failed for ([144.121.19.38]) [144.121.19.38]:57712: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)144.121.19.386252001U  -7' ossec13001g Exim Auth failed2025-03-04 01:44:00 dovecot_login authenticator failed for ([112.173.61.81]) [112.173.61.81]:58829: 535 Incorrect authentication data (set_id=bo_msk)112.173.61.811835841s  -o+ ossec13001g wExim Auth failed2025-03-04 01:43:42 dovecot_login authenticator failed for ([175.145.232.217]) [175.145.232.217]:37386: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)175.145.232.2171733045i  -_' ossec13001g Exim Auth failed2025-03-04 01:42:06 dovecot_plain authenticator failed for ([223.82.88.108]) [223.82.88.108]:1182: 535 Incorrect authentication data (set_id=services@heipowersystem.com)223.82.88.1081814991  3I# ossec11301g New FTP connection.Mar 4 01:41:28 vm1 pure-ftpd[1899734]: (?@71.6.232.22) [INFO] New connection from 71.6.232.2271.6.232.226252001g  -[' ossec13001g MExim Auth failed2025-03-04 01:38:44 dovecot_plain authenticator failed for ([60.29.100.218]) [60.29.100.218]:54595: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)60.29.100.2181814991n  -i' ossec13001g Exim Auth failed2025-03-04 01:36:39 dovecot_login authenticator failed for ([218.106.120.18]) [58.49.113.138]:12324: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)58.49.113.1381814991^  -K% ossec13001g $Exim Auth failed2025-03-04 01:33:48 dovecot_plain authenticator failed for (9.72.116.151.hathway.com) [116.72.9.151]:44270: 535 Incorrect authentication data (set_id=services)116.72.9.1511269750l  -e) ossec13001g Exim Auth failed2025-03-04 01:33:34 dovecot_plain authenticator failed for ([81.181.129.233]) [81.181.129.233]:53986: 535 Incorrect authentication data (set_id=services@heipowersystem.com)81.181.129.233798549j  -_) ossec13001g Exim Auth failed2025-03-04 01:27:27 dovecot_login authenticator failed for syn-070-127-232-248.res.spectrum.com [70.127.232.248]:37210: 535 Incorrect authentication data (set_id=bo_msk)70.127.232.2486252001T  -5' ossec13001g Exim Auth failed2025-03-04 01:27:06 dovecot_plain authenticator failed for ([183.216.70.66]) [183.216.70.66]:57908: 535 Incorrect authentication data (set_id=sales)183.216.70.661814991f  -[' ossec13001g |Exim Auth failed2025-03-04 01:26:42 dovecot_plain authenticator failed for ([87.120.67.149]) [87.120.67.149]:47313: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)87.120.67.149732800 0 H M n k +MVYQ*  -3% ossec13001gExim Auth failed2025-03-04 02:14:57 dovecot_login authenticator failed for ([94.205.82.33]) [94.205.82.33]:58116: 535 Incorrect authentication data (set_id=bo_msk)94.205.82.33290557y)  -' ossec13001gExim Auth failed2025-03-04 02:14:46 dovecot_login authenticator failed for 111-70-22-151.emome-ip.hinet.net [111.70.22.151]:51552: 535 Incorrect authentication data (set_id=services@heipowersystem.com)111.70.22.1511668284s(  -o+ ossec13001gExim Auth failed2025-03-04 02:14:42 dovecot_login authenticator failed for ([207.219.221.101]) [207.219.221.101]:42880: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)207.219.221.1016251999Z'  -=+ ossec13001gExim Auth failed2025-03-04 02:11:09 dovecot_plain authenticator failed for ([115.242.200.126]) [115.242.200.126]:45358: 535 Incorrect authentication data (set_id=sales)115.242.200.1261269750g&  -[' ossec13001gExim Auth failed2025-03-04 02:10:55 dovecot_plain authenticator failed for ([58.16.215.241]) [58.16.215.241]:36154: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)58.16.215.2411814991Z%  -=+ ossec13001gRExim Auth failed2025-03-04 02:08:41 dovecot_plain authenticator failed for ([175.206.105.126]) [175.206.105.126]:36408: 535 Incorrect authentication data (set_id=sales)175.206.105.1261835841m$  -c+ ossec13001g<Exim Auth failed2025-03-04 02:08:20 dovecot_plain authenticator failed for ([178.178.194.128]) [178.178.194.128]:54172: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)178.178.194.1282017370R#  -3% ossec13001gExim Auth failed2025-03-04 02:06:09 dovecot_login authenticator failed for ([95.54.40.239]) [95.54.40.239]:44252: 535 Incorrect authentication data (set_id=bo_msk)95.54.40.2392017370W"  -;' ossec13001gExim Auth failed2025-03-04 02:05:53 dovecot_plain authenticator failed for ([1.244.246.221]) [1.244.246.221]:59550: 535 Incorrect authentication data (set_id=services)1.244.246.2211835841s!  -o+ ossec13001gExim Auth failed2025-03-04 02:05:45 dovecot_login authenticator failed for ([221.149.233.245]) [221.149.233.245]:48657: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)221.149.233.2451835841Z  -?) ossec13001gExim Auth failed2025-03-04 02:05:43 dovecot_plain authenticator failed for ([123.209.200.21]) [123.209.200.21]:47114: 535 Incorrect authentication data (set_id=services)123.209.200.212077456  - ) ossec13001gExim Auth failed2025-03-04 02:05:19 dovecot_plain authenticator failed for customer-ip-193-151-51-223.ipv.net.pl [193.151.51.223]:60002: 535 Incorrect authentication data (set_id=services@heipowersystem.com)193.151.51.223798544[  -A) ossec13001gExim Auth failed2025-03-04 01:58:39 dovecot_plain authenticator failed for ([216.194.174.103]) [216.194.174.27]:33499: 535 Incorrect authentication data (set_id=services)216.194.174.276252001w  -w+ ossec13001gExim Auth failed2025-03-04 01:58:24 dovecot_plain authenticator failed for (448990.cloudwaysapps.com) [128.199.118.234]:44906: 535 Incorrect authentication data (set_id=services@heipowersystem.com)128.199.118.2341880251d  -W% ossec13001gExim Auth failed2025-03-04 01:58:13 dovecot_plain authenticator failed for h-46-59-44-182.a980.priv.bahnhof.se [46.59.44.182]:47132: 535 Incorrect authentication data (set_id=sales)46.59.44.1822661886g  -[' ossec13001gExim Auth failed2025-03-04 01:57:25 dovecot_plain authenticator failed for ([59.46.185.130]) [59.46.185.130]:59498: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)59.46.185.1301814991a  -O' ossec13001gExim Auth failed2025-03-04 01:54:37 dovecot_login authenticator failed for p85145-obmd01.osaka.ocn.ne.jp [180.7.156.144]:34401: 535 Incorrect authentication data (set_id=bo_msk)180.7.156.1441861060 5\*Dk^- (9l_~qdWJ=0# zm`SF9, 5GTa{nK>1$vi\OB57x x k ^ Q D 7 *    t g Z M @ 3 &  }pcVI</"viOBQ:yF,reX s f Y L ? 2 %  | o ^*\Dk-lS9( b U H ; . !   2077456$ 2077456F 2077456F 2077456 2077456F 2077456F 2077456F 20774562 2077456 2077456 2077456E 2077456E 2077456E 2077456E 2077456, 2077456H 2077456, 2077456, 2077456 2077456, 2077456 2077456G 2077456E 2077456 2077456, 2077456, 2077456 2077456 2077456, 2077456r 2077456 2077456 2077456b 20774560 2077456-0 2077456-'S 2077456 2077456 2077456G 2077456% 2077456% 2077456&' 2077456'K 2077456& 2077456 2077456' 2077456' 2077456 2077456 2077456( 2077456(K 2077456(> 2077456 2077456 2077456M 2077456*{ 2077456*" 2077456* 2077456) 2077456( 2077456M\ 2077456MU 2077456M0 2077456 2077456L 2077456+ 2077456+ 2077456+ 2077456+ 2077456+V 2077456+8 2077456+! 2077456* 2077456K 2077456Kg 2077456K% 20774562 2077456, 2077456, 2077456, 2077456,Z 2077456,6 2077456,* 2077456, 2077456J 2077456} 2077456JU 2077456JN 2077456J? 2077456J 2077456 2077456I 2077456 2077456IN 2077456IE 2077456IA 2077456I' 2077456H 2077456H 2077456y 2077456U 2077456H 2077456? 2077456, 2077456 2077456E 2077456E 2077456C 2077456C 2077456CA 2077456@ 2077456@N 2077456?[ 2077456?J 2077456?G 2077456> 2077456< 2077456; 2077456;y 2077456;U 20774569 20774568 20774567 20774567B 20774566 20774566 20774566 20774566 20774566 20774566 20774565 20774565 20774565 20774565b 20774565K 20774564 20774564 20774564 20774563 20774563 20774562 20774562/ 20774562 20774561 20774561 20774561 20774561P 20774561J 20774561G 20774560 20774560 20774560c 2077456/ 2077456/: 2077456/ 2077456. 2077456. 2077456.i 2077456.b 2077456. 2077456- 2077456- 2077456- 2077456-TL 2077456$ 2077456# 2077456#T 2077456# 2077456" 2077456" 2077456! 2077456!Q 2077456!/ 2077456! 2077456 2077456 2077456 2077456 = 2077456 < 2077456 2077456 2077456 2077456q 2077456f 2077456! 2077456 2077456 2077456f 2077456e 2077456\ 2077456F 2077456E 2077456< 2077456 2077456 2077456 2077456 2077456 2077456p 2077456H 2077456Hb 2077456H` 2077456H^ 0 B W | >PwnN;  -/# ossec13001g{Exim Auth failed2025-03-04 02:47:45 dovecot_login authenticator failed for ([5.30.215.71]) [5.30.215.71]:53790: 535 Incorrect authentication data (set_id=bo_msk)5.30.215.71290557:  -) ossec13001gQExim Auth failed2025-03-04 02:47:04 dovecot_login authenticator failed for (mobile-166-195-193-083.mycingular.net) [166.195.193.83]:47093: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)166.195.193.836252001U9  -7' ossec13001gExim Auth failed2025-03-04 02:36:24 dovecot_login authenticator failed for ([103.187.79.19]) [103.187.79.19]:49842: 535 Incorrect authentication data (set_id=bo_msk)103.187.79.191269750j8  -c% ossec13001gExim Auth failed2025-03-04 02:35:51 dovecot_login authenticator failed for ([38.21.61.150]) [38.21.61.150]:42321: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)38.21.61.1506252001Z7  -?) ossec13001gdExim Auth failed2025-03-04 02:34:35 dovecot_plain authenticator failed for ([183.109.148.43]) [183.109.148.43]:42376: 535 Incorrect authentication data (set_id=services)183.109.148.431835841p6  -i+ ossec13001gVExim Auth failed2025-03-04 02:34:21 dovecot_plain authenticator failed for ([211.198.178.191]) [211.198.178.191]:51114: 535 Incorrect authentication data (set_id=services@heipowersystem.com)211.198.178.1911835841N5  --# ossec13001gExim Auth failed2025-03-04 02:28:02 dovecot_plain authenticator failed for ([38.79.83.28]) [38.79.83.28]:39768: 535 Incorrect authentication data (set_id=sales)38.79.83.286252001u4  -w' ossec13001gExim Auth failed2025-03-04 02:27:40 dovecot_plain authenticator failed for 24-220-250-67-dynamic.midco.net [24.220.250.67]:33908: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)24.220.250.676252001T3  -7% ossec13001gExim Auth failed2025-03-04 02:22:56 dovecot_plain authenticator failed for ([43.154.94.85]) [43.154.94.85]:42226: 535 Incorrect authentication data (set_id=services)43.154.94.851819730i2  -]) ossec13001gExim Auth failed2025-03-04 02:23:25 dovecot_plain authenticator failed for 221-120-57-125.emome-ip.hinet.net [221.120.57.125]:40816: 535 Incorrect authentication data (set_id=services)221.120.57.1251668284j1  -a' ossec13001gExim Auth failed2025-03-04 02:22:44 dovecot_plain authenticator failed for ([116.86.62.245]) [116.86.62.245]:41789: 535 Incorrect authentication data (set_id=services@heipowersystem.com)116.86.62.2451880251j0  -_) ossec13001gGExim Auth failed2025-03-04 02:21:18 dovecot_plain authenticator failed for ([101.168.42.221]) [101.168.42.221]:45590: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)101.168.42.2212077456W/  -9) ossec13001gQExim Auth failed2025-03-04 02:21:29 dovecot_plain authenticator failed for ([103.180.240.96]) [103.180.240.96]:51588: 535 Incorrect authentication data (set_id=sales)103.180.240.961282988g.  -_# ossec13001g Exim Auth failed2025-03-04 02:20:18 dovecot_plain authenticator failed for 83-81-93-98.cable.dynamic.v4.ziggo.nl [83.81.93.98]:44934: 535 Incorrect authentication data (set_id=services)83.81.93.982750405j-  -a' ossec13001gExim Auth failed2025-03-04 02:20:03 dovecot_plain authenticator failed for ([191.59.251.95]) [191.59.251.95]:33404: 535 Incorrect authentication data (set_id=services@heipowersystem.com)191.59.251.953469034T,  -7' ossec13001g7Exim Auth failed2025-03-04 02:16:47 dovecot_login authenticator failed for ([185.167.59.53]) [185.167.59.53]:36732: 535 Incorrect authentication data (set_id=bo_msk)185.167.59.53617790t+  -y% ossec13001g-Exim Auth failed2025-03-04 02:16:37 dovecot_login authenticator failed for (host-157.214.77.5.ucom.am) [5.77.214.157]:51440: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)5.77.214.157174982 ~qdyl_RE8+WJ=0# zm`SF9, v i \ O B 5 (     r e X K > 1 $  { n a T G : -   w j ] P C 6 )    s f Y L ? 2 %  |obUH;.!xk^QD7*tgZM@3& }pcVI</"uh[NA4' ~qdWJ=06252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001m 6252001k 6252001f 6252001b 6252001 6252001 6252001 6252001~ 6252001z 6252001a 6252001` 6252001Y 6252001U 6252001E 6252001B 6252001; 62520012 6252001- 6252001! 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001p 6252001f 6252001U 6252001N 6252001- 6252001% 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001x 6252001p 6252001D 6252001@ 6252001? 6252001= 6252001: 62520018 62520015 62520014 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001v 6252001p 6252001M 6252001? 62520011 6252001% 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001{ 6252001z 6252001[ 6252001S 6252001P 6252001K 6252001C 6252001= 6252001( 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001z 6252001i 6252001\ 6252001Y 6252001W 6252001E 6252001D 6252001A 6252001, 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001x 6252001q 6252001m 6252001h 6252001P 6252001H 6252001G 6252001E 6252001C 6252001= 6252001: 6252001* 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001{ 6252001y 6252001r 6252001n 6252001^ 6252001S 6252001F 6252001D 6252001; 62520015 62520014 62520012 6252001\ 6252001Y 6252001W 6252001P 6252001M 6252001G 6252001D 6252001C 62520016 62520015 6252001+ 6252001* @ O !3?pluZL  -E% ossec13001g#gExim Auth failed2025-03-04 03:17:17 dovecot_plain authenticator failed for 77-85-52-109.ip.btc-net.bg [77.85.52.109]:48943: 535 Incorrect authentication data (set_id=sales)77.85.52.109732800dK  -W% ossec13001g#YExim Auth failed2025-03-04 03:17:03 dovecot_plain authenticator failed for ([80.82.54.138]) [81.211.77.58]:55698: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)81.211.77.582017370J  W% ossec9708g"Dovecot Aborted Login with empty userMar 4 03:14:33 vm1 dovecot[312763]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 2 secs): user=<>, rip=165.154.41.6, lip=103.74.54.108, session=165.154.41.61819730ZI  -?) ossec13001g"<Exim Auth failed2025-03-04 03:12:19 dovecot_plain authenticator failed for ([39.152.196.130]) [39.152.196.130]:42435: 535 Incorrect authentication data (set_id=services)39.152.196.1301814991H  - ' ossec13001g"(Exim Auth failed2025-03-04 03:12:00 dovecot_plain authenticator failed for broadband-188-32-170-20.ip.moscow.rt.ru [188.32.170.20]:59076: 535 Incorrect authentication data (set_id=services@heipowersystem.com)188.32.170.202017370KG  -+! ossec13001g Exim Auth failed2025-03-04 03:06:30 dovecot_login authenticator failed for ([149.0.16.4]) [149.0.16.4]:47640: 535 Incorrect authentication data (set_id=bo_msk)149.0.16.4298795pF  -k) ossec13001g Exim Auth failed2025-03-04 03:06:16 dovecot_login authenticator failed for ([186.138.219.91]) [186.138.219.91]:48709: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)186.138.219.913865483jE  -a' ossec13001g Exim Auth failed2025-03-04 03:05:26 dovecot_plain authenticator failed for ([183.47.48.178]) [183.47.48.178]:51553: 535 Incorrect authentication data (set_id=services@heipowersystem.com)183.47.48.1781814991gD  -[' ossec13001gExim Auth failed2025-03-04 02:57:37 dovecot_plain authenticator failed for syn-156-019-080-138.biz.spectrum.com [156.19.80.138]:44120: 535 Incorrect authentication data (set_id=sales)156.19.80.1386252001mC  -c+ ossec13001gExim Auth failed2025-03-04 02:57:05 dovecot_plain authenticator failed for ([197.255.138.149]) [197.255.138.149]:58708: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)197.255.138.1493374766UB  -7' ossec13001guExim Auth failed2025-03-04 02:56:13 dovecot_login authenticator failed for ([151.40.26.236]) [151.40.26.236]:60792: 535 Incorrect authentication data (set_id=bo_msk)151.40.26.2363175395HA  -) ossec13001geExim Auth failed2025-03-04 02:55:57 dovecot_login authenticator failed for ([102.212.105.34]) [102.212.105.34]:50854: 535 Incorrect authentication data102.212.105.342328926@  -' ossec13001gKExim Auth failed2025-03-04 02:55:31 dovecot_login authenticator failed for (mobile-166-195-004-247.mycingular.net) [166.195.4.247]:54238: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)166.195.4.2476252001"?  3M% ossec11301gNew FTP connection.Mar 4 02:54:12 vm1 pure-ftpd[1914872]: (?@20.171.25.51) [INFO] New connection from 20.171.25.5120.171.25.516252001m>  -e) ossec13001gExim Auth failed2025-03-04 02:53:15 dovecot_plain authenticator failed for ([222.239.231.61]) [222.239.231.61]:25672: 535 Incorrect authentication data (set_id=services@heipowersystem.com)222.239.231.611835841Q=  -1% ossec13001gExim Auth failed2025-03-04 02:49:39 dovecot_plain authenticator failed for ([74.95.13.185]) [74.95.13.185]:54223: 535 Incorrect authentication data (set_id=sales)74.95.13.1856252001g<  -[' ossec13001gExim Auth failed2025-03-04 02:49:01 dovecot_plain authenticator failed for ([1.252.204.203]) [1.252.204.203]:54868: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)1.252.204.2031835841 V - ? d s !G/VU]  -7' ossec13001g(Exim Auth failed2025-03-04 03:41:04 dovecot_login authenticator failed for ([37.28.177.141]) [37.28.177.141]:35534: 535 Incorrect authentication data (set_id=bo_msk)37.28.177.1412017370\  -3) ossec13001g(Exim Auth failed2025-03-04 03:40:35 dovecot_login authenticator failed for (abts-north-static-031.187.160.122.airtelbroadband.in) [122.160.187.31]:41940: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)122.160.187.311269750V[  -;% ossec13001g(Exim Auth failed2025-03-04 03:40:45 dovecot_login authenticator failed for (gurukuljaipur.com) [60.2.243.174]:41278: 535 Incorrect authentication data (set_id=nologin)60.2.243.1741814991WZ  -;' ossec13001g'Exim Auth failed2025-03-04 03:34:57 dovecot_plain authenticator failed for ([95.220.25.124]) [95.220.25.124]:13609: 535 Incorrect authentication data (set_id=services)95.220.25.1242017370jY  -a' ossec13001g'Exim Auth failed2025-03-04 03:34:48 dovecot_plain authenticator failed for ([91.126.196.67]) [91.126.196.67]:40600: 535 Incorrect authentication data (set_id=services@heipowersystem.com)91.126.196.672510769gX  -_# ossec13001g'hExim Auth failed2025-03-04 03:34:22 dovecot_login authenticator failed for ([101.13.5.37]) [101.13.5.37]:34148: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)101.13.5.371668284nW  -i' ossec13001g&Exim Auth failed2025-03-04 03:31:35 dovecot_login authenticator failed for 111-70-39-163.emome-ip.hinet.net [111.70.39.163]:41442: 535 Incorrect authentication data (set_id=vikas.khandelwal)111.70.39.1631668284V  -+ ossec13001g&Exim Auth failed2025-03-04 03:31:16 dovecot_login authenticator failed for (200-217-53-25.host.telemar.net.br) [200.216.168.226]:53597: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)200.216.168.2263469034U  W% ossec9708g&_Dovecot Aborted Login with empty userMar 4 03:29:57 vm1 dovecot[312763]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=8.209.98.208, lip=103.74.54.108, session=8.209.98.2082921044ZT  -?) ossec13001g&]Exim Auth failed2025-03-04 03:29:57 dovecot_plain authenticator failed for ([207.219.221.99]) [207.219.221.99]:46570: 535 Incorrect authentication data (set_id=services)207.219.221.996251999%S  3Q' ossec11301g&[New FTP connection.Mar 4 03:29:54 vm1 pure-ftpd[1922304]: (?@8.222.177.202) [INFO] New connection from 8.222.177.2028.222.177.2021880251mR  -e) ossec13001g&7Exim Auth failed2025-03-04 03:29:19 dovecot_plain authenticator failed for ([183.167.198.31]) [183.167.198.31]:47890: 535 Incorrect authentication data (set_id=services@heipowersystem.com)183.167.198.311814991WQ  -9) ossec13001g&Exim Auth failed2025-03-04 03:28:39 dovecot_plain authenticator failed for ([195.122.224.64]) [195.122.224.64]:59380: 535 Incorrect authentication data (set_id=sales)195.122.224.642017370jP  -_) ossec13001g&Exim Auth failed2025-03-04 03:28:29 dovecot_plain authenticator failed for ([220.178.201.58]) [220.178.201.58]:34329: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)220.178.201.581814991XO  -;) ossec13001g%Exim Auth failed2025-03-04 03:27:07 dovecot_login authenticator failed for ([222.119.124.66]) [222.119.124.66]:38503: 535 Incorrect authentication data (set_id=bo_msk)222.119.124.661835841rN  -s% ossec13001g%Exim Auth failed2025-03-04 03:26:50 dovecot_login authenticator failed for vps-0b1302de.vps.ovh.net [51.91.10.114]:48440: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)51.91.10.1143017382}M  -' ossec13001g#Exim Auth failed2025-03-04 03:18:54 dovecot_login authenticator failed for 62.174.139.16.static.user.ono.com [62.174.139.16]:60126: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)62.174.139.162510769 F \ j EWc[n  -?+ ossec13001g/VExim Auth failed2025-03-04 04:08:13 dovecot_login authenticator failed for ([182.163.122.133]) [182.163.122.133]:33977: 535 Incorrect authentication data (set_id=bo_msk)182.163.122.1331210997mm  -c+ ossec13001g/NExim Auth failed2025-03-04 04:08:05 dovecot_plain authenticator failed for ([114.243.136.120]) [114.243.136.120]:39498: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)114.243.136.1201814991tl  -w% ossec13001g/JExim Auth failed2025-03-04 04:08:01 dovecot_login authenticator failed for (fa138.54.fix-addr.vsi.ru) [81.211.77.58]:36856: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)81.211.77.582017370Xk  -;) ossec13001g/^Exim Auth failed2025-03-04 04:08:21 dovecot_login authenticator failed for ([49.124.152.149]) [49.124.152.149]:53210: 535 Incorrect authentication data (set_id=bo_msk)49.124.152.1491733045pj  -k) ossec13001g/<Exim Auth failed2025-03-04 04:07:46 dovecot_login authenticator failed for ([218.150.170.10]) [218.150.170.10]:44070: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)218.150.170.101835841ji  -a' ossec13001g/.Exim Auth failed2025-03-04 04:07:33 dovecot_plain authenticator failed for ([180.129.88.20]) [180.129.88.20]:43358: 535 Incorrect authentication data (set_id=services@heipowersystem.com)180.129.88.201880251Th  -7% ossec13001g-Exim Auth failed2025-03-04 04:01:05 dovecot_plain authenticator failed for ([59.1.214.102]) [59.1.214.102]:33936: 535 Incorrect authentication data (set_id=services)59.1.214.1021835841mg  -e) ossec13001g-Exim Auth failed2025-03-04 04:00:47 dovecot_plain authenticator failed for ([182.160.107.51]) [182.160.107.51]:34016: 535 Incorrect authentication data (set_id=services@heipowersystem.com)182.160.107.511210997Kf  -)! ossec13001g,Exim Auth failed2025-03-04 03:57:19 dovecot_plain authenticator failed for ([59.8.50.83]) [59.8.50.83]:46464: 535 Incorrect authentication data (set_id=sales)59.8.50.831835841ge  -[' ossec13001g,Exim Auth failed2025-03-04 03:57:06 dovecot_plain authenticator failed for ([102.221.64.10]) [102.221.64.10]:35694: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)102.221.64.102413451Ud  -7' ossec13001g+Exim Auth failed2025-03-04 03:51:56 dovecot_login authenticator failed for ([45.117.10.134]) [45.117.10.134]:57362: 535 Incorrect authentication data (set_id=bo_msk)45.117.10.1341814991gc  -_# ossec13001g+uExim Auth failed2025-03-04 03:51:39 dovecot_login authenticator failed for ([27.96.91.71]) [27.96.91.71]:52680: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)27.96.91.711269750Zb  -=+ ossec13001g*XExim Auth failed2025-03-04 03:46:56 dovecot_plain authenticator failed for ([123.210.128.249]) [123.210.128.249]:34148: 535 Incorrect authentication data (set_id=sales)123.210.128.2492077456na  -i) ossec13001g*8Exim Auth failed2025-03-04 03:46:24 dovecot_plain authenticator failed for (nl188-lv.zamnet.zm) [196.46.203.188]:44847: 535 Incorrect authentication data (set_id=services@heipowersystem.com)196.46.203.188895949f`  -[% ossec13001g*LExim Auth failed2025-03-04 03:46:43 dovecot_plain authenticator failed for ([103.177.205.100]) [58.84.61.189]:9193: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)58.84.61.1891269750T_  -7% ossec13001g*FExim Auth failed2025-03-04 03:46:37 dovecot_plain authenticator failed for ([61.81.151.97]) [61.81.151.97]:49932: 535 Incorrect authentication data (set_id=services)61.81.151.971835841^^ -E) ossec13001g)*Exim Auth failed2025-03-04 03:41:53 dovecot_login authenticator failed for (vandanabalbharti.com) [60.167.170.146]:58662: 535 Incorrect authentication data (set_id=nologin)60.167.170.1461814991 `4 = ^ c [ );T`p  -k) ossec13001g:Exim Auth failed2025-03-04 04:56:04 dovecot_login authenticator failed for ([60.219.112.193]) [60.219.112.193]:50397: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)60.219.112.1931814991c~  -U% ossec13001g9Exim Auth failed2025-03-04 04:53:16 dovecot_plain authenticator failed for 1-34-162-249.hinet-ip.hinet.net [1.34.162.249]:52160: 535 Incorrect authentication data (set_id=services)1.34.162.2491668284j}  -a' ossec13001g9Exim Auth failed2025-03-04 04:53:05 dovecot_plain authenticator failed for ([42.177.209.66]) [42.177.209.66]:43258: 535 Incorrect authentication data (set_id=services@heipowersystem.com)42.177.209.661814991R|  -3% ossec13001g8Exim Auth failed2025-03-04 04:47:42 dovecot_login authenticator failed for ([58.18.90.250]) [58.18.90.250]:54449: 535 Incorrect authentication data (set_id=bo_msk)58.18.90.2501814991m{  -g' ossec13001g8dExim Auth failed2025-03-04 04:46:51 dovecot_login authenticator failed for ([41.216.169.13]) [41.216.169.13]:49718: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)41.216.169.132328926gz  -[' ossec13001g6Exim Auth failed2025-03-04 04:39:41 dovecot_plain authenticator failed for ([111.48.214.96]) [111.48.214.96]:23738: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)111.48.214.961814991wy  -{' ossec13001g5Exim Auth failed2025-03-04 04:36:03 dovecot_login authenticator failed for (amplifypowerglobal.com) [221.229.216.1]:44546: 535 Incorrect authentication data (set_id=postmaster@amplifypowerglobal.com)221.229.216.11814991Tx  -5' ossec13001g5Exim Auth failed2025-03-04 04:34:56 dovecot_login authenticator failed for visaustralia.com [216.70.104.41]:47288: 535 Incorrect authentication data (set_id=bo_msk)216.70.104.416252001]w  -G' ossec13001g5Exim Auth failed2025-03-04 04:35:39 dovecot_login authenticator failed for (amplifypowerglobal.com) [221.229.216.1]:40760: 535 Incorrect authentication data (set_id=nologin)221.229.216.11814991pv  -k) ossec13001g5yExim Auth failed2025-03-04 04:34:25 dovecot_login authenticator failed for ([178.178.222.49]) [178.178.222.49]:30998: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)178.178.222.492017370Tu  -7% ossec13001g5Exim Auth failed2025-03-04 04:32:29 dovecot_plain authenticator failed for ([31.173.2.172]) [31.173.2.172]:60616: 535 Incorrect authentication data (set_id=services)31.173.2.1722017370t  -) ossec13001g4Exim Auth failed2025-03-04 04:32:04 dovecot_plain authenticator failed for (32.195.136.122.adsl-pool.jlccptt.net.cn) [122.136.195.32]:43872: 535 Incorrect authentication data (set_id=services@heipowersystem.com)122.136.195.321814991ws  -# ossec13001g3Exim Auth failed2025-03-04 04:26:15 dovecot_plain authenticator failed for 18.red-83-48-39.staticip.rima-tde.net [83.48.39.18]:17987: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)83.48.39.182510769[r  -?+ ossec13001g2Exim Auth failed2025-03-04 04:21:50 dovecot_login authenticator failed for ([203.123.219.137]) [203.123.219.137]:50274: 535 Incorrect authentication data (set_id=bo_msk)203.123.219.1371835841sq  -o+ ossec13001g2Exim Auth failed2025-03-04 04:21:41 dovecot_login authenticator failed for ([115.247.159.106]) [115.247.159.106]:50884: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)115.247.159.1061269750Zp  -=+ ossec13001g1Exim Auth failed2025-03-04 04:19:00 dovecot_plain authenticator failed for ([104.193.103.213]) [104.193.103.213]:53041: 535 Incorrect authentication data (set_id=sales)104.193.103.2136252001jo  -_) ossec13001g1Exim Auth failed2025-03-04 04:18:49 dovecot_plain authenticator failed for ([43.143.231.208]) [43.143.231.208]:41482: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)43.143.231.2081814991 Tx 4\oj  -_) ossec13001g?VExim Auth failed2025-03-04 05:16:29 dovecot_plain authenticator failed for ([222.117.88.230]) [222.117.88.230]:55804: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)222.117.88.2301835841i  -[+ ossec13001g?Exim Auth failed2025-03-04 05:15:22 dovecot_login authenticator failed for ([180.110.237.199]) [180.110.237.199]:27680: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)180.110.237.1991814991T  -7% ossec13001g?Exim Auth failed2025-03-04 05:15:21 dovecot_plain authenticator failed for ([2.63.169.110]) [2.63.169.110]:38698: 535 Incorrect authentication data (set_id=services)2.63.169.1102017370f  -]% ossec13001g?Exim Auth failed2025-03-04 05:15:05 dovecot_plain authenticator failed for ([94.205.82.33]) [94.205.82.33]:45963: 535 Incorrect authentication data (set_id=services@heipowersystem.com)94.205.82.33290557y  -}) ossec13001g?Exim Auth failed2025-03-04 05:15:05 dovecot_login authenticator failed for ([207.219.222.44]) [207.219.222.44]:57358: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)207.219.222.446251999Z  -?) ossec13001g=UExim Auth failed2025-03-04 05:07:56 dovecot_plain authenticator failed for ([121.189.226.81]) [121.189.226.81]:33562: 535 Incorrect authentication data (set_id=services)121.189.226.811835841j  -a' ossec13001g=7Exim Auth failed2025-03-04 05:07:26 dovecot_plain authenticator failed for ([61.146.121.12]) [61.146.121.12]:33160: 535 Incorrect authentication data (set_id=services@heipowersystem.com)61.146.121.121814991d  -U' ossec13001g<Exim Auth failed2025-03-04 05:06:26 dovecot_login authenticator failed for h77-94-125-250.static.bashtel.ru [77.94.125.250]:50040: 535 Incorrect authentication data (set_id=bo_msk)77.94.125.2502017370  -E% ossec13001g<Exim Auth failed2025-03-04 05:05:53 dovecot_login authenticator failed for 61-216-7-163.hinet-ip.hinet.net (61-216-7-165.hinet-ip.hinet.net) [61.216.7.163]:60199: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)61.216.7.1631668284g  -Y) ossec13001g<Exim Auth failed2025-03-04 05:05:17 dovecot_plain authenticator failed for (94.124.156.175.unknown.m1.com.sg) [175.156.124.94]:58920: 535 Incorrect authentication data (set_id=sales)175.156.124.941880251j  -_) ossec13001g<Exim Auth failed2025-03-04 05:05:07 dovecot_plain authenticator failed for ([112.111.61.230]) [112.111.61.229]:45478: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)112.111.61.2291814991T  -5' ossec13001g:Exim Auth failed2025-03-04 04:57:43 dovecot_plain authenticator failed for ([223.171.55.59]) [223.171.55.59]:58118: 535 Incorrect authentication data (set_id=sales)223.171.55.591835841a  -O) ossec13001g:Exim Auth failed2025-03-04 04:57:41 dovecot_plain authenticator failed for ([196.15.221.122]) [196.15.221.122]:50258: 535 Incorrect authentication data (set_id=vikas.khandelwal)196.15.221.122953987  -' ossec13001g:Exim Auth failed2025-03-04 04:57:30 dovecot_plain authenticator failed for broadband-77-37-179-158.ip.moscow.rt.ru [77.37.179.158]:53942: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)77.37.179.1582017370d  -W% ossec13001g:Exim Auth failed2025-03-04 04:57:19 dovecot_plain authenticator failed for ([50.24.152.80]) [50.24.152.80]:59450: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)50.24.152.806252001X  -;) ossec13001g:Exim Auth failed2025-03-04 04:56:37 dovecot_login authenticator failed for ([14.194.128.158]) [14.194.128.158]:60182: 535 Incorrect authentication data (set_id=bo_msk)14.194.128.1581269750(  3U) ossec11301g:New FTP connection.Mar 4 04:56:31 vm1 pure-ftpd[1941124]: (?@172.172.245.91) [INFO] New connection from 172.172.245.91172.172.245.916252001 5( & 2 A Y dev:35z!  -# ossec13001gDExim Auth failed2025-03-04 05:40:30 dovecot_plain authenticator failed for 18.red-83-48-39.staticip.rima-tde.net [83.48.39.18]:32763: 535 Incorrect authentication data (set_id=services@heipowersystem.com)83.48.39.182510769  -) ossec13001gDExim Auth failed2025-03-04 05:39:58 dovecot_plain authenticator failed for (91-220-216-178.omsk.mts.ru) [178.216.220.91]:59638: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)178.216.220.912017370T  -7% ossec13001gEExim Auth failed2025-03-04 05:40:42 dovecot_plain authenticator failed for ([49.124.148.2]) [49.124.148.2]:39284: 535 Incorrect authentication data (set_id=services)49.124.148.21733045R  -3% ossec13001gDExim Auth failed2025-03-04 05:39:02 dovecot_login authenticator failed for ([98.70.127.17]) [98.70.127.17]:41858: 535 Incorrect authentication data (set_id=bo_msk)98.70.127.171269750p  -k) ossec13001gDExim Auth failed2025-03-04 05:38:52 dovecot_login authenticator failed for ([38.211.138.232]) [38.211.138.232]:59870: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)38.211.138.2323932488M  --# ossec13001gCExim Auth failed2025-03-04 05:35:58 dovecot_plain authenticator failed for ([2.55.88.152]) [2.55.88.152]:35182: 535 Incorrect authentication data (set_id=sales)2.55.88.152294640j  -_) ossec13001gCExim Auth failed2025-03-04 05:35:42 dovecot_plain authenticator failed for ([222.114.84.175]) [222.114.84.175]:58820: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)222.114.84.1751835841W  -9) ossec13001gC}Exim Auth failed2025-03-04 05:34:12 dovecot_plain authenticator failed for ([128.185.253.66]) [128.185.253.66]:54806: 535 Incorrect authentication data (set_id=sales)128.185.253.661269750k  -a) ossec13001gCoExim Auth failed2025-03-04 05:33:57 dovecot_plain authenticator failed for ([159.223.250.131]) [161.35.200.202]:36318: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)161.35.200.2022921044{  -) ossec13001gBExim Auth failed2025-03-04 05:30:47 dovecot_plain authenticator failed for 50708de6.static.ziggozakelijk.nl [80.112.141.230]:57792: 535 Incorrect authentication data (set_id=services@heipowersystem.com)80.112.141.2302750405q  -s# ossec13001gB[Exim Auth failed2025-03-04 05:29:21 dovecot_login authenticator failed for (hebei.6.60.in-addr.arpa) [60.6.219.83]:35224: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)60.6.219.831814991d  -S) ossec13001g@Exim Auth failed2025-03-04 05:23:29 dovecot_login authenticator failed for p247044-obmd01.tokyo.ocn.ne.jp [153.141.156.44]:53496: 535 Incorrect authentication data (set_id=bo_msk)153.141.156.441861060m  -c+ ossec13001g@Exim Auth failed2025-03-04 05:23:15 dovecot_plain authenticator failed for ([119.206.117.105]) [119.206.117.105]:60260: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)119.206.117.1051835841p  -k) ossec13001g@Exim Auth failed2025-03-04 05:23:09 dovecot_login authenticator failed for ([46.236.190.103]) [46.236.190.103]:52052: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)46.236.190.1032017370~  - % ossec13001g@.Exim Auth failed2025-03-04 05:20:06 dovecot_login authenticator failed for syn-075-080-065-214.biz.spectrum.com [75.80.65.214]:37967: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)75.80.65.2146252001c  -U% ossec13001g@PExim Auth failed2025-03-04 05:20:38 dovecot_login authenticator failed for c-71-229-1-186.hsd1.al.comcast.net [71.229.1.186]:43170: 535 Incorrect authentication data (set_id=sales)71.229.1.1866252001m  -c+ ossec13001g@DExim Auth failed2025-03-04 05:20:27 dovecot_login authenticator failed for ([114.243.136.120]) [114.243.136.120]:54479: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)114.243.136.1201814991 i & P e "4FWij2  -a' ossec13001gPExim Auth failed2025-03-04 06:30:35 dovecot_plain authenticator failed for ([187.50.88.145]) [201.63.67.250]:40680: 535 Incorrect authentication data (set_id=services@heipowersystem.com)201.63.67.2503469034k1  -e% ossec13001gOExim Auth failed2025-03-04 06:25:46 dovecot_plain authenticator failed for vps-79f20bfc.vps.ovh.net ([87.98.249.193]) [51.75.24.107]:56974: 535 Incorrect authentication data (set_id=sales)51.75.24.1073017382j0  -_) ossec13001gOExim Auth failed2025-03-04 06:25:27 dovecot_plain authenticator failed for ([103.97.213.151]) [103.97.213.151]:47976: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)103.97.213.1511269750j/  -a' ossec13001gOExim Auth failed2025-03-04 06:23:25 dovecot_plain authenticator failed for ([91.126.196.67]) [91.126.196.67]:50560: 535 Incorrect authentication data (set_id=services@heipowersystem.com)91.126.196.672510769k.  -c' ossec13001gK=Exim Auth failed2025-03-04 06:07:17 dovecot_plain authenticator failed for ([223.80.109.135]) [27.223.100.90]:35574: 535 Incorrect authentication data (set_id=services@heipowersystem.com)27.223.100.901814991g-  -[' ossec13001gK+Exim Auth failed2025-03-04 06:06:57 dovecot_plain authenticator failed for ([191.59.251.95]) [191.59.251.95]:44168: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)191.59.251.953469034k,  -c' ossec13001gJExim Auth failed2025-03-04 06:04:57 dovecot_login authenticator failed for broadband-95-84-186-218.ip.moscow.rt.ru [95.84.186.218]:60872: 535 Incorrect authentication data (set_id=bo_msk)95.84.186.2182017370o+  -i) ossec13001gJExim Auth failed2025-03-04 06:04:37 dovecot_login authenticator failed for ([120.226.132.43]) [120.226.132.43]:8566: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)120.226.132.431814991W*  -9) ossec13001gJ7Exim Auth failed2025-03-04 06:02:53 dovecot_plain authenticator failed for ([183.109.148.43]) [183.109.148.43]:38384: 535 Incorrect authentication data (set_id=sales)183.109.148.431835841c)  -W% ossec13001gJExim Auth failed2025-03-04 06:02:29 dovecot_plain authenticator failed for ([197.87.10.83]) [197.87.10.83]:35449: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)197.87.10.83953987f(  -_# ossec13001gH&Exim Auth failed2025-03-04 05:54:05 dovecot_login authenticator failed for ([5.31.16.135]) [5.31.16.135]:40540: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)5.31.16.135290557W'  -9) ossec13001gHExim Auth failed2025-03-04 05:53:36 dovecot_plain authenticator failed for ([103.234.100.36]) [103.234.100.36]:35513: 535 Incorrect authentication data (set_id=sales)103.234.100.361733045g&  -[' ossec13001gGExim Auth failed2025-03-04 05:53:23 dovecot_plain authenticator failed for ([27.115.40.138]) [27.115.40.138]:33108: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)27.115.40.1381814991R%  -3% ossec13001gG.Exim Auth failed2025-03-04 05:49:57 dovecot_login authenticator failed for ([58.18.90.250]) [58.18.90.250]:49386: 535 Incorrect authentication data (set_id=bo_msk)58.18.90.2501814991d$  -Y# ossec13001gG&Exim Auth failed2025-03-04 05:49:49 dovecot_plain authenticator failed for ([1.31.80.166]) [1.31.80.166]:35178: 535 Incorrect authentication data (set_id=services@heipowersystem.com)1.31.80.1661814991m#  -g' ossec13001gG$Exim Auth failed2025-03-04 05:49:47 dovecot_login authenticator failed for ([188.234.245.7]) [188.234.245.7]:56754: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)188.234.245.72017370}"  -+ ossec13001gDExim Auth failed2025-03-04 05:40:39 dovecot_plain authenticator failed for 189.115.230.179.dynamic.adsl.gvt.net.br [189.115.230.179]:56290: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)189.115.230.1793469034 % t (:^gC  -]% ossec13001gUExim Auth failed2025-03-04 06:52:07 dovecot_plain authenticator failed for ([14.37.79.247]) [14.37.79.247]:37244: 535 Incorrect authentication data (set_id=services@heipowersystem.com)14.37.79.2471835841YB  -?) ossec13001gUExim Auth failed2025-03-04 06:52:23 dovecot_plain authenticator failed for ([81.181.129.233]) [81.181.129.233]:51182: 535 Incorrect authentication data (set_id=services)81.181.129.233798549XA  -;) ossec13001gUYExim Auth failed2025-03-04 06:50:24 dovecot_login authenticator failed for ([220.90.239.158]) [220.90.239.158]:38259: 535 Incorrect authentication data (set_id=bo_msk)220.90.239.1581835841j@  -c% ossec13001gU8Exim Auth failed2025-03-04 06:49:51 dovecot_login authenticator failed for ([49.124.148.5]) [49.124.148.5]:47748: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)49.124.148.51733045S?  -7% ossec13001gUExim Auth failed2025-03-04 06:48:56 dovecot_plain authenticator failed for ([212.50.48.86]) [212.50.48.86]:37718: 535 Incorrect authentication data (set_id=services)212.50.48.86298795j>  -a' ossec13001gTExim Auth failed2025-03-04 06:48:34 dovecot_plain authenticator failed for ([200.11.109.32]) [200.11.109.32]:46898: 535 Incorrect authentication data (set_id=services@heipowersystem.com)200.11.109.323469034[=  -?+ ossec13001gTExim Auth failed2025-03-04 06:48:17 dovecot_login authenticator failed for ([178.178.194.192]) [178.178.194.192]:56582: 535 Incorrect authentication data (set_id=bo_msk)178.178.194.1922017370p<  -k) ossec13001gTExim Auth failed2025-03-04 06:48:07 dovecot_login authenticator failed for ([207.219.222.44]) [207.219.222.44]:50028: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)207.219.222.446251999?;  =y) ossec13008gSMail Reciepient rejected2025-03-04 06:44:04 H=(mail.heipowersystem.com) [165.154.233.80]:49553 F= rejected RCPT : Rejected relay attempt: '165.154.233.80' From: 'nxhvybfyl@heipowersystem.com' To: 'goofile@fastmail.com'165.154.233.801694008X:  -;) ossec13001gSExim Auth failed2025-03-04 06:42:55 dovecot_login authenticator failed for ([112.102.48.193]) [112.102.48.193]:44248: 535 Incorrect authentication data (set_id=bo_msk)112.102.48.1931814991l9  -g' ossec13001gSExim Auth failed2025-03-04 06:42:36 dovecot_login authenticator failed for ([185.167.56.24]) [185.167.56.24]:37806: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)185.167.56.24617790Z8  -=+ ossec13001gSkExim Auth failed2025-03-04 06:42:10 dovecot_plain authenticator failed for ([123.209.118.166]) [123.209.118.166]:49944: 535 Incorrect authentication data (set_id=sales)123.209.118.1662077456g7  -[' ossec13001gSYExim Auth failed2025-03-04 06:41:52 dovecot_plain authenticator failed for ([50.249.167.45]) [50.249.167.45]:54497: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)50.249.167.456252001X6  -;) ossec13001gRExim Auth failed2025-03-04 06:39:22 dovecot_login authenticator failed for ([131.161.184.58]) [131.161.184.58]:56740: 535 Incorrect authentication data (set_id=bo_msk)131.161.184.5838654835  -' ossec13001gRExim Auth failed2025-03-04 06:39:09 dovecot_login authenticator failed for (187-50-88-145.customer.tdatabrasil.net.br) [201.63.67.250]:47223: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)201.63.67.2503469034"4  3M% ossec11301gPNew FTP connection.Mar 4 06:30:26 vm1 pure-ftpd[1960768]: (?@103.203.59.5) [INFO] New connection from 103.203.59.5103.203.59.51814991W3  -;' ossec13001gPExim Auth failed2025-03-04 06:30:47 dovecot_plain authenticator failed for ([49.124.153.17]) [49.124.153.17]:43766: 535 Incorrect authentication data (set_id=services)49.124.153.171733045 L7 I [ z 9=LmS  -e) ossec13001g]lExim Auth failed2025-03-04 07:24:50 dovecot_plain authenticator failed for ([222.119.124.66]) [222.119.124.66]:40950: 535 Incorrect authentication data (set_id=services@heipowersystem.com)222.119.124.661835841xR  -% ossec13001g\Exim Auth failed2025-03-04 07:18:51 dovecot_plain authenticator failed for net-93-64-108-27.cust.vodafonedsl.it [93.64.108.27]:56504: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)93.64.108.273175395WQ  -9) ossec13001g\Exim Auth failed2025-03-04 07:19:12 dovecot_plain authenticator failed for ([109.195.69.156]) [109.195.69.156]:59816: 535 Incorrect authentication data (set_id=sales)109.195.69.1562017370P  -) ossec13001gZExim Auth failed2025-03-04 07:14:02 dovecot_login authenticator failed for cm-110-171-21-108.revip7.asianet.co.th [110.171.21.108]:50187: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)110.171.21.1081605651XO  -=) ossec13001gZExim Auth failed2025-03-04 07:14:20 dovecot_login authenticator failed for ([185.134.179.106]) [185.101.16.250]:59630: 535 Incorrect authentication data (set_id=bo_msk)185.101.16.250272103QN  -1% ossec13001gZExim Auth failed2025-03-04 07:13:42 dovecot_plain authenticator failed for ([112.91.67.18]) [112.91.67.18]:49990: 535 Incorrect authentication data (set_id=sales)112.91.67.181814991gM  -[' ossec13001gZExim Auth failed2025-03-04 07:13:28 dovecot_plain authenticator failed for ([118.26.153.84]) [118.26.153.84]:54200: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)118.26.153.841819730iL  -_) ossec13001gYExim Auth failed2025-03-04 07:10:08 dovecot_plain authenticator failed for ([196.15.221.122]) [196.15.221.122]:58732: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)196.15.221.122953987[K  -?+ ossec13001gYExim Auth failed2025-03-04 07:08:11 dovecot_login authenticator failed for ([175.145.232.217]) [175.145.232.217]:35458: 535 Incorrect authentication data (set_id=bo_msk)175.145.232.2171733045|J  -% ossec13001gYoExim Auth failed2025-03-04 07:07:49 dovecot_login authenticator failed for c-71-229-1-186.hsd1.al.comcast.net [71.229.1.186]:54902: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)71.229.1.1866252001rI  -m+ ossec13001gX>Exim Auth failed2025-03-04 07:02:46 dovecot_login authenticator failed for (vandanabalbharti.com) [202.107.197.211]:40964: 535 Incorrect authentication data (set_id=sales@vandanabalbharti.com)202.107.197.2111814991]H  -E) ossec13001gX$Exim Auth failed2025-03-04 07:02:19 dovecot_login authenticator failed for (vandanabalbharti.com) [124.160.63.122]:23400: 535 Incorrect authentication data (set_id=nologin)124.160.63.1221814991jG  -a' ossec13001gWExim Auth failed2025-03-04 07:01:00 dovecot_plain authenticator failed for ([60.10.225.130]) [60.10.225.130]:34507: 535 Incorrect authentication data (set_id=services@heipowersystem.com)60.10.225.1301814991jF  -a' ossec13001gWExim Auth failed2025-03-04 07:00:25 dovecot_plain authenticator failed for ([72.26.178.196]) [72.26.178.196]:39676: 535 Incorrect authentication data (set_id=services@heipowersystem.com)72.26.178.1966252001WE  -9) ossec13001gWXExim Auth failed2025-03-04 06:58:56 dovecot_plain authenticator failed for ([45.225.194.121]) [45.225.194.121]:49970: 535 Incorrect authentication data (set_id=sales)45.225.194.1213469034jD  -_) ossec13001gW8Exim Auth failed2025-03-04 06:58:23 dovecot_plain authenticator failed for ([223.239.159.21]) [223.239.159.21]:58872: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)223.239.159.211269750 { M L o  &5cY{Zd  -?) ossec13001gcwExim Auth failed2025-03-04 07:50:38 dovecot_plain authenticator failed for ([206.72.249.212]) [206.72.231.218]:61278: 535 Incorrect authentication data (set_id=services)206.72.231.2186252001c  -+ ossec13001gc_Exim Auth failed2025-03-04 07:50:15 dovecot_plain authenticator failed for broadband-178-140-152-209.ip.moscow.rt.ru [178.140.152.209]:58930: 535 Incorrect authentication data (set_id=services@heipowersystem.com)178.140.152.2092017370Nb  --# ossec13001gcExim Auth failed2025-03-04 07:48:46 dovecot_plain authenticator failed for ([112.72.4.98]) [112.72.4.98]:40088: 535 Incorrect authentication data (set_id=sales)112.72.4.982029969ma  -c+ ossec13001gbExim Auth failed2025-03-04 07:48:30 dovecot_plain authenticator failed for ([222.112.246.217]) [222.112.246.217]:41971: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)222.112.246.2171835841m`  -e) ossec13001gaExim Auth failed2025-03-04 07:42:21 dovecot_plain authenticator failed for ([218.150.170.10]) [218.150.170.10]:43088: 535 Incorrect authentication data (set_id=services@heipowersystem.com)218.150.170.101835841S_  -7% ossec13001gaExim Auth failed2025-03-04 07:42:31 dovecot_plain authenticator failed for ([91.74.186.57]) [91.74.186.57]:60608: 535 Incorrect authentication data (set_id=services)91.74.186.57290557o^  -k) ossec13001g`XExim Auth failed2025-03-04 07:37:19 dovecot_login authenticator failed for ([89.144.187.114]) [89.144.187.114]:50969: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)89.144.187.114130758T]  -7' ossec13001g`hExim Auth failed2025-03-04 07:37:35 dovecot_login authenticator failed for ([185.167.56.24]) [185.167.56.24]:35740: 535 Incorrect authentication data (set_id=bo_msk)185.167.56.24617790f\  -]% ossec13001g`Exim Auth failed2025-03-04 07:36:09 dovecot_plain authenticator failed for ([45.93.94.125]) [45.93.94.125]:50802: 535 Incorrect authentication data (set_id=services@heipowersystem.com)45.93.94.125294640i[  -_) ossec13001g_Exim Auth failed2025-03-04 07:34:20 dovecot_plain authenticator failed for ([94.204.208.189]) [94.204.208.189]:51695: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)94.204.208.189290557kZ  -c' ossec13001g_vExim Auth failed2025-03-04 07:33:34 dovecot_login authenticator failed for host-37-205-73-112.bbcustomer.zsttk.net [37.205.73.112]:57978: 535 Incorrect authentication data (set_id=bo_msk)37.205.73.1122017370lY  -g' ossec13001g_nExim Auth failed2025-03-04 07:33:25 dovecot_login authenticator failed for ([94.202.148.15]) [94.202.148.15]:58409: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)94.202.148.15290557YX  -=) ossec13001g^Exim Auth failed2025-03-04 07:29:38 dovecot_login authenticator failed for ([101.230.251.217]) [180.154.53.221]:32692: 535 Incorrect authentication data (set_id=bo_msk)180.154.53.2211814991}W  -) ossec13001g^hExim Auth failed2025-03-04 07:29:02 dovecot_login authenticator failed for (grupokrause.static.gvt.net.br) [179.185.227.77]:48433: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)179.185.227.773469034%V  3Q' ossec11301g]New FTP connection.Mar 4 07:26:15 vm1 pure-ftpd[1972207]: (?@20.171.31.237) [INFO] New connection from 20.171.31.23720.171.31.2376252001TU  -7% ossec13001g]zExim Auth failed2025-03-04 07:25:05 dovecot_plain authenticator failed for ([116.212.19.9]) [116.212.19.9]:37504: 535 Incorrect authentication data (set_id=services)116.212.19.91835841.T  =W) ossec13008g]zMail Reciepient rejected2025-03-04 07:25:04 H=(mail.msnews24.in) [165.154.226.42]:60603 F= rejected RCPT : Rejected relay attempt: '165.154.226.42' From: 'bmmqkmdtryf@msnews24.in' To: 'goofile@fastmail.com'165.154.226.421668284 *\~tj`VLB8.$zpf\H>4*   v l b X N D : 0 &    ~ t j ` V L B 8 . $    z p f \ R H > * 4  vblXND:0&|rh^TJ@6,"xndZPF<2( ~tj`VLB8.$zpf\ | r h ^ T J @ 6 , "    x n d Z P F < 2 (   RRH>4*  vlbXND:0& gƦe gƤd gƤc gƣb gƣa gƢ` gơB_ gơ6^ gơ] gƞ\ gƞ[ gƞaZ gƞWY gƜX gƜW gƛV gƚU gƚ T gƘS gƘR gƗQ gƗP gƖgO gƖWN gƖKM gƖ5L gƔLK gƔBJ gƔ*I gƓH gƓjG gƓFF gƑE gƑ5D gƑ%C gƏB gƏA gƏ@ gƏ[? gƏA> gƍV= gƍB< gƍl; gƍ8: gƌ49 gƌ8 gƌ7 gƋ6 gƋ5 gƋ4 gƊ3 gƊ~2 gƉ1 gƉ0 gƈ/ gƈ. gƈ- gƈ, gƈ+ gƇ?* gƇ+) gƅ( gƅ' gƄ& gƄJ% gƄ:$ gƃ# gƃ" gƃ2! gƃ2 gƃ gƃ gƃ gƂ gƂ gƁ gƁ gƁ gƁy gƀ g gE gE g= g; gS gQ g~ g~ g~ g}x g{ g{ g{3 g{' gx gx gx gx guf guH gu gt gt gt gq_ gqS go go go  gn gn gm gm0 gl gl gl= gk gj gj gj gj gg gg gg ggr ggP gg, geN gcw gc_ gc gb ga ga g`h g`X g` g_ g_v g_n g^ g^h g] g]z g]z g]l g\ g\ gZ gZ gZ gZ gY gY gYo gX> gX$ gW gW gWX gW8 gU gU gUY gU8 gU gT gT gT g g g g2 gƿ gƾg gƾW gƽ gƽ  gƼ gƻ gƺ gƺ gƹz gƸr gƸX gƷJ gƷ2 gƵ~ gƵ} gƵc| gƵ5{ gƴz gƴy gƲx gƲw gƲv gƱu gƱt gưs gưr gƮq gƮp gƮYo gƫn gƫm gƫl gƫlk gƩj gƩi gƦh gƦg gƦf gS gS gS gSk gSY gR gR gP gP gP gO gO gO gK= gK+ gJ gJ gJ7 gJ gH& gH gG gG. gG& gG$ gE gD gD gD gD gD gC gC gC} gCo gB gB[ g@ g@ g@ g@P g@D g3 g@. g?V g? g? g? g? g=U g=7 g< g< g< g< g: g: g: g: g: g: g: g9~ g9} g8| g8d{ g6z g5y g5w g5x g5yv g5u g4t g3s g2r g2q g1p g1o g/^k g/Vn g/Nm g/Jl g/<j g/.i g-h  ! 0 Q } 9t  =o' ossec13008gm0Mail Reciepient rejected2025-03-04 08:32:06 H=(mail.fablixsolutions.com) [165.154.228.9]:52812 F= rejected RCPT : Rejected relay attempt: '165.154.228.9' From: 'xswlwt@fablixsolutions.com' To: 'goofile@fastmail.com'165.154.228.91643084cs  -S' ossec13001glExim Auth failed2025-03-04 08:31:12 dovecot_plain authenticator failed for 111-70-25-206.emome-ip.hinet.net [111.70.25.206]:47190: 535 Incorrect authentication data (set_id=sales)111.70.25.2061668284r  - ) ossec13001glExim Auth failed2025-03-04 08:31:00 dovecot_plain authenticator failed for broadband-188-255-34-171.ip.moscow.rt.ru [188.255.34.171]:50076: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)188.255.34.1712017370jq  -a' ossec13001gl=Exim Auth failed2025-03-04 08:28:05 dovecot_plain authenticator failed for ([149.54.15.126]) [149.54.15.126]:44429: 535 Incorrect authentication data (set_id=services@heipowersystem.com)149.54.15.1261149361Yp  -A% ossec13001gkExim Auth failed2025-03-04 08:22:53 dovecot_plain authenticator failed for vps-79f20bfc.vps.ovh.net [51.75.24.107]:28964: 535 Incorrect authentication data (set_id=sales)51.75.24.1073017382jo  -_) ossec13001gjExim Auth failed2025-03-04 08:22:43 dovecot_plain authenticator failed for ([191.59.177.235]) [191.59.177.235]:53744: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)191.59.177.2353469034Vn  -;' ossec13001gjExim Auth failed2025-03-04 08:22:38 dovecot_plain authenticator failed for ([188.59.88.234]) [188.59.88.234]:54902: 535 Incorrect authentication data (set_id=services)188.59.88.234298795gm  -]% ossec13001gjExim Auth failed2025-03-04 08:22:23 dovecot_plain authenticator failed for ([116.212.19.9]) [116.212.19.9]:42760: 535 Incorrect authentication data (set_id=services@heipowersystem.com)116.212.19.91835841}l  -' ossec13001gjExim Auth failed2025-03-04 08:21:01 dovecot_login authenticator failed for 202-4-196-180.static.pccw-hkt.com [202.4.196.180]:48835: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)202.4.196.1801819730sk  -o+ ossec13001ggExim Auth failed2025-03-04 08:08:00 dovecot_login authenticator failed for ([213.195.113.234]) [213.195.113.234]:37490: 535 Incorrect authentication data (set_id=bo_msk@saintsoldiercollege.com)213.195.113.2342510769Pj  -/% ossec13001ggExim Auth failed2025-03-04 08:07:53 dovecot_plain authenticator failed for ([27.71.20.180]) [27.71.20.180]:8044: 535 Incorrect authentication data (set_id=sales)27.71.20.1801562822[i  -?+ ossec13001ggExim Auth failed2025-03-04 08:08:09 dovecot_login authenticator failed for ([185.132.229.196]) [185.132.229.196]:48248: 535 Incorrect authentication data (set_id=bo_msk)185.132.229.1963175395mh  -c+ ossec13001ggrExim Auth failed2025-03-04 08:07:37 dovecot_plain authenticator failed for ([175.205.126.214]) [175.205.126.214]:57942: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)175.205.126.2141835841Wg  -;' ossec13001ggPExim Auth failed2025-03-04 08:07:03 dovecot_plain authenticator failed for ([24.224.69.119]) [24.224.69.119]:41936: 535 Incorrect authentication data (set_id=services)24.224.69.1196252001mf  -e) ossec13001gg,Exim Auth failed2025-03-04 08:06:27 dovecot_plain authenticator failed for ([117.158.160.42]) [117.158.160.42]:50794: 535 Incorrect authentication data (set_id=services@heipowersystem.com)117.158.160.421814991e  -)) ossec13001geNExim Auth failed2025-03-04 07:58:29 dovecot_plain authenticator failed for ip-179.48.229.117.fiberlinkpe.net.br ([179.48.229.118]) [179.48.229.117]:41256: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)179.48.229.1173469034 ! 0Xjyd  -U' ossec13001gxExim Auth failed2025-03-04 09:18:46 dovecot_plain authenticator failed for 81.60.194.189.dyn.user.ono.com [81.60.194.189]:50912: 535 Incorrect authentication data (set_id=services)81.60.194.1892510769m  -e) ossec13001gxExim Auth failed2025-03-04 09:18:36 dovecot_plain authenticator failed for ([45.201.140.227]) [45.201.140.227]:15744: 535 Incorrect authentication data (set_id=services@heipowersystem.com)45.201.140.2271831722Y  -?) ossec13001gufExim Auth failed2025-03-04 09:07:08 dovecot_plain authenticator failed for ([81.181.129.233]) [81.181.129.233]:56282: 535 Incorrect authentication data (set_id=services)81.181.129.233798549m  -e) ossec13001guHExim Auth failed2025-03-04 09:06:40 dovecot_plain authenticator failed for ([216.194.174.27]) [216.194.174.27]:42855: 535 Incorrect authentication data (set_id=services@heipowersystem.com)216.194.174.276252001Q  -1% ossec13001guExim Auth failed2025-03-04 09:05:29 dovecot_plain authenticator failed for ([27.124.18.27]) [27.124.18.27]:40980: 535 Incorrect authentication data (set_id=sales)27.124.18.271269750m  -c+ ossec13001gtExim Auth failed2025-03-04 09:05:01 dovecot_plain authenticator failed for ([154.144.230.118]) [154.144.230.118]:25561: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)154.144.230.1182542007j~  -a' ossec13001gtExim Auth failed2025-03-04 09:03:28 dovecot_plain authenticator failed for ([200.11.109.32]) [200.11.109.32]:51153: 535 Incorrect authentication data (set_id=services@heipowersystem.com)200.11.109.323469034T}  -7% ossec13001gtExim Auth failed2025-03-04 09:03:41 dovecot_plain authenticator failed for ([14.37.206.76]) [14.37.206.76]:52831: 535 Incorrect authentication data (set_id=services)14.37.206.761835841V|  -7) ossec13001gq_Exim Auth failed2025-03-04 08:49:57 dovecot_plain authenticator failed for works.ssc-gr.info [160.251.121.70]:38698: 535 Incorrect authentication data (set_id=sales)160.251.121.701861060g{  -[' ossec13001gqSExim Auth failed2025-03-04 08:49:45 dovecot_plain authenticator failed for ([116.86.62.245]) [116.86.62.245]:55632: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)116.86.62.2451880251cz  -U% ossec13001goExim Auth failed2025-03-04 08:43:46 dovecot_plain authenticator failed for 111-70-13-24.emome-ip.hinet.net [111.70.13.24]:41434: 535 Incorrect authentication data (set_id=services)111.70.13.241668284qy  -m) ossec13001goExim Auth failed2025-03-04 08:43:34 dovecot_plain authenticator failed for 74-103-174-206.gci.net [206.174.103.74]:63146: 535 Incorrect authentication data (set_id=services@heipowersystem.com)206.174.103.746252001lx  -e) ossec13001go Exim Auth failed2025-03-04 08:40:04 dovecot_login authenticator failed for ([87.236.141.106]) [87.236.141.106]:51251: 535 Incorrect authentication data (set_id=services@heipowersystem.com)87.236.141.106290291nw  -k' ossec13001gnExim Auth failed2025-03-04 08:38:36 dovecot_plain authenticator failed for cl-185-254-44-30.b4net.lt [185.254.44.30]:53870: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)185.254.44.30597427jv  =M+ ossec13008gnMail Reciepient rejected2025-03-04 08:38:01 H=(mail.shivelectricaltransformers.com) [165.154.213.186]:52753 F= rejected RCPT : Rejected relay attempt: '165.154.213.186' From: 'zgzpywqqgwq@shivelectricaltransformers.com' To: 'goofile@fastmail.com'165.154.213.1863469034[u -?) ossec13001gmExim Auth failed2025-03-04 08:34:12 dovecot_login authenticator failed for (gurukuljaipur.com) [101.89.140.209]:55784: 535 Incorrect authentication data (set_id=nologin)101.89.140.2091814991 7 F h } 8J]vq  -o' ossec13001gExim Auth failed2025-03-04 09:52:21 dovecot_plain authenticator failed for vps-926fddc5.vps.ovh.net [79.137.82.102]:54254: 535 Incorrect authentication data (set_id=services@heipowersystem.com)79.137.82.1023017382h  -[) ossec13001gEExim Auth failed2025-03-04 09:49:16 dovecot_login authenticator failed for 195-159-217-71.customer.powertech.no [195.159.217.71]:35254: 535 Incorrect authentication data (set_id=info)195.159.217.713144096s  -q) ossec13001gEExim Auth failed2025-03-04 09:49:16 dovecot_login authenticator failed for (ip-20-192.datautama.net.id) [112.109.20.192]:46941: 535 Incorrect authentication data (set_id=info@heipowersystem.com)112.109.20.1921643084c  -U% ossec13001g=Exim Auth failed2025-03-04 09:49:07 dovecot_login authenticator failed for ([103.78.23.30]) [103.78.23.30]:37820: 535 Incorrect authentication data (set_id=info@heipowersystem.com)103.78.23.301269750i  -]) ossec13001g;Exim Auth failed2025-03-04 09:49:06 dovecot_login authenticator failed for ([74.196.184.120]) [74.196.184.120]:38753: 535 Incorrect authentication data (set_id=info@heipowersystem.com)74.196.184.1206252001j  -a' ossec13001gSExim Auth failed2025-03-04 09:49:29 dovecot_login authenticator failed for dynamic-186-30-57-201.dynamic.etb.net.co [186.30.57.201]:58668: 535 Incorrect authentication data (set_id=info)186.30.57.2013686110V  -7) ossec13001gQExim Auth failed2025-03-04 09:49:27 dovecot_login authenticator failed for ([104.37.101.117]) [104.37.101.117]:55443: 535 Incorrect authentication data (set_id=info)104.37.101.1176252001Y  -=+ ossec13001g~Exim Auth failed2025-03-04 09:47:24 dovecot_plain authenticator failed for ([196.190.118.132]) [196.190.118.132]:40026: 535 Incorrect authentication data (set_id=sales)196.190.118.132337996c  -W% ossec13001g~Exim Auth failed2025-03-04 09:46:58 dovecot_plain authenticator failed for ([94.205.82.33]) [94.205.82.33]:53718: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)94.205.82.33290557`  -U! ossec13001g~Exim Auth failed2025-03-04 09:46:01 dovecot_plain authenticator failed for ([2.55.74.30]) [2.55.74.30]:54462: 535 Incorrect authentication data (set_id=services@heipowersystem.com)2.55.74.30294640j  -_) ossec13001g}xExim Auth failed2025-03-04 09:41:35 dovecot_plain authenticator failed for ([103.115.31.219]) [103.115.31.219]:52474: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)103.115.31.2191643084Q  -/' ossec13001g{Exim Auth failed2025-03-04 09:33:52 dovecot_plain authenticator failed for (pc0.zz.ha.cn) [218.28.77.206]:36030: 535 Incorrect authentication data (set_id=sales)218.28.77.2061814991g  -[' ossec13001g{Exim Auth failed2025-03-04 09:33:35 dovecot_plain authenticator failed for ([203.124.42.26]) [203.124.42.26]:54410: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)203.124.42.261168579Z  -?) ossec13001g{3Exim Auth failed2025-03-04 09:31:55 dovecot_plain authenticator failed for ([122.166.70.100]) [122.166.70.100]:45643: 535 Incorrect authentication data (set_id=services)122.166.70.1001269750m  -e) ossec13001g{'Exim Auth failed2025-03-04 09:31:43 dovecot_plain authenticator failed for ([221.140.188.44]) [221.140.188.44]:35354: 535 Incorrect authentication data (set_id=services@heipowersystem.com)221.140.188.441835841W  -9) ossec13001gxExim Auth failed2025-03-04 09:21:57 dovecot_plain authenticator failed for ([41.159.145.190]) [41.159.145.190]:39274: 535 Incorrect authentication data (set_id=sales)41.159.145.1902400553j  -_) ossec13001gxExim Auth failed2025-03-04 09:21:19 dovecot_plain authenticator failed for ([123.209.194.49]) [123.209.194.49]:54996: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)123.209.194.492077456   # = Y n#IXY& -=' ossec13001gƄExim Auth failed2025-03-04 10:13:18 dovecot_login authenticator failed for (gurukuljaipur.com) [221.229.216.1]:45874: 535 Incorrect authentication data (set_id=nologin)221.229.216.11814991T%  -7% ossec13001gƄJExim Auth failed2025-03-04 10:10:41 dovecot_plain authenticator failed for ([50.43.62.166]) [50.43.62.166]:49441: 535 Incorrect authentication data (set_id=services)50.43.62.1666252001m$  -e) ossec13001gƄ:Exim Auth failed2025-03-04 10:10:24 dovecot_plain authenticator failed for ([87.225.108.138]) [87.225.108.138]:55036: 535 Incorrect authentication data (set_id=services@heipowersystem.com)87.225.108.1382017370V#  -9) ossec13001gƃExim Auth failed2025-03-04 10:09:11 dovecot_plain authenticator failed for ([196.190.180.18]) [196.190.180.19]:45272: 535 Incorrect authentication data (set_id=sales)196.190.180.19337996r"  -s% ossec13001gƃExim Auth failed2025-03-04 10:08:38 dovecot_plain authenticator failed for (6-62-170-152.fibertel.com.ar) [152.170.62.6]:37569: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)152.170.62.63865483P!  -/% ossec13001gƃ2Exim Auth failed2025-03-04 10:06:00 dovecot_login authenticator failed for ([109.244.68.3]) [109.244.68.3]:50849: 535 Incorrect authentication data (set_id=info)109.244.68.31814991Z  -?) ossec13001gƃ2Exim Auth failed2025-03-04 10:06:01 dovecot_plain authenticator failed for ([220.80.192.168]) [220.80.192.168]:55216: 535 Incorrect authentication data (set_id=services)220.80.192.1681835841i  -]) ossec13001gƃExim Auth failed2025-03-04 10:05:41 dovecot_login authenticator failed for ([121.189.226.81]) [121.189.226.81]:37120: 535 Incorrect authentication data (set_id=info@heipowersystem.com)121.189.226.811835841W  -;' ossec13001gƃExim Auth failed2025-03-04 10:05:31 dovecot_plain authenticator failed for ([114.221.2.199]) [114.221.2.199]:45937: 535 Incorrect authentication data (set_id=services)114.221.2.1991814991W  -9) ossec13001gƃExim Auth failed2025-03-04 10:05:19 dovecot_plain authenticator failed for ([111.48.214.102]) [111.48.214.102]:52004: 535 Incorrect authentication data (set_id=sales)111.48.214.1021814991g  -]% ossec13001gƂExim Auth failed2025-03-04 10:05:09 dovecot_plain authenticator failed for ([188.168.86.6]) [188.168.86.6]:51880: 535 Incorrect authentication data (set_id=services@heipowersystem.com)188.168.86.62017370`  -S# ossec13001gƂExim Auth failed2025-03-04 10:04:52 dovecot_plain authenticator failed for ([95.0.252.76]) [95.0.252.76]:52678: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)95.0.252.76298795b  -O) ossec13001gƁExim Auth failed2025-03-04 10:00:25 dovecot_plain authenticator failed for ([87.225.108.138]) [87.225.108.138]:54954: 535 Incorrect authentication data (set_id=vikas.khandelwal)87.225.108.1382017370r  -q' ossec13001gƁExim Auth failed2025-03-04 10:00:10 dovecot_plain authenticator failed for ([88.84.209.146]) [88.84.209.146]:56826: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)88.84.209.1462017370(  3U) ossec11301gƁNew FTP connection.Mar 4 09:59:50 vm1 pure-ftpd[2003873]: (?@167.94.145.105) [INFO] New connection from 167.94.145.105167.94.145.1056252001L  =+ ossec13008gƁyMail Reciepient rejected2025-03-04 09:58:41 H=(mail.vandanabalbharti.com) [165.154.213.186]:56956 F= rejected RCPT : Rejected relay attempt: '165.154.213.186' From: 'votqdanshrj@vandanabalbharti.com' To: 'goofile@fastmail.com'165.154.213.1863469034g  -]' ossec13001gƀExim Auth failed2025-03-04 09:52:46 dovecot_plain authenticator failed for bzq-109-67-154-24.red.bezeqint.net [109.67.154.24]:48530: 535 Incorrect authentication data (set_id=services)109.67.154.24294640 S :Rlb7  -S' ossec13001gƌExim Auth failed2025-03-04 10:43:43 dovecot_plain authenticator failed for ([77.139.82.133]) [77.139.82.133]:42819: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)77.139.82.133294640i6  -[+ ossec13001gƋExim Auth failed2025-03-04 10:43:32 dovecot_plain authenticator failed for ([114.215.211.223]) [114.215.211.223]:40596: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)114.215.211.2231814991v5  -y' ossec13001gƋExim Auth failed2025-03-04 10:43:06 dovecot_plain authenticator failed for ([149.54.15.126]) [149.54.15.126]:60844: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)149.54.15.1261149361g4  -[' ossec13001gƋExim Auth failed2025-03-04 10:42:58 dovecot_plain authenticator failed for ([58.42.226.215]) [58.42.226.215]:33229: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)58.42.226.2151814991W3  -9) ossec13001gƊExim Auth failed2025-03-04 10:37:21 dovecot_plain authenticator failed for ([222.117.88.230]) [222.117.88.230]:33952: 535 Incorrect authentication data (set_id=sales)222.117.88.2301835841g2  -[' ossec13001gƊ~Exim Auth failed2025-03-04 10:37:09 dovecot_plain authenticator failed for ([102.221.65.24]) [102.221.65.24]:46410: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)102.221.65.242413451b1  -S% ossec13001gƉExim Auth failed2025-03-04 10:34:01 dovecot_login authenticator failed for 95-30-217-31.broadband.corbina.ru [95.30.217.31]:50288: 535 Incorrect authentication data (set_id=sales)95.30.217.312017370d0  -W% ossec13001gƉExim Auth failed2025-03-04 10:33:50 dovecot_login authenticator failed for ([59.1.214.102]) [59.1.214.102]:33788: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)59.1.214.1021835841Z/  -?) ossec13001gƈExim Auth failed2025-03-04 10:30:36 dovecot_plain authenticator failed for ([41.159.145.190]) [41.159.145.190]:54692: 535 Incorrect authentication data (set_id=services)41.159.145.1902400553m.  -e) ossec13001gƈExim Auth failed2025-03-04 10:30:26 dovecot_plain authenticator failed for ([61.145.163.164]) [61.145.163.164]:33732: 535 Incorrect authentication data (set_id=services@heipowersystem.com)61.145.163.1641814991|-  -) ossec13001gƈExim Auth failed2025-03-04 10:28:49 dovecot_plain authenticator failed for syn-173-172-152-018.res.spectrum.com [173.172.152.18]:45860: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)173.172.152.186252001W,  -9) ossec13001gƈExim Auth failed2025-03-04 10:27:02 dovecot_plain authenticator failed for ([186.148.187.91]) [186.148.187.91]:45203: 535 Incorrect authentication data (set_id=sales)186.148.187.913686110g+  -[' ossec13001gƈExim Auth failed2025-03-04 10:26:33 dovecot_plain authenticator failed for ([58.242.86.203]) [58.242.86.203]:57386: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)58.242.86.2031814991Z*  -?) ossec13001gƇ?Exim Auth failed2025-03-04 10:23:18 dovecot_plain authenticator failed for ([220.80.192.168]) [220.80.192.168]:52018: 535 Incorrect authentication data (set_id=services)220.80.192.1681835841j)  -a' ossec13001gƇ+Exim Auth failed2025-03-04 10:22:57 dovecot_plain authenticator failed for ([220.122.115.9]) [220.122.115.9]:46044: 535 Incorrect authentication data (set_id=services@heipowersystem.com)220.122.115.918358414(  A_) ossec11302gƅFTP Authentication failed.Mar 4 10:17:36 vm1 pure-ftpd[2007922]: (?@104.194.158.90) [WARNING] Authentication failed for user [ftp]104.194.158.902921044)' 3U) ossec11301gƅNew FTP connection.Mar 4 10:17:13 vm1 pure-ftpd[2007882]: (?@104.194.158.90) [INFO] New connection from 104.194.158.90104.194.158.902921044 i. F b  5iQG  =+ ossec13008gƓjMail Reciepient rejected2025-03-04 11:15:14 H=(mail.westerndancecompany.com) [165.154.227.105]:52187 F= rejected RCPT : Rejected relay attempt: '165.154.227.105' From: 'ucewjavas@westerndancecompany.com' To: 'goofile@fastmail.com'165.154.227.1051668284mF  -c+ ossec13001gƓFExim Auth failed2025-03-04 11:14:37 dovecot_plain authenticator failed for ([183.109.195.179]) [183.109.195.179]:38786: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)183.109.195.1791835841E  Ug) ossec11001gƑDeferred login on the cpanel service[2025-03-04 11:07:59 +0530] info [webmaild] 157.38.111.214 - kps@amplifypowerglobal.com "POST /cpsess4742333493/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [157.38.122.143] != Current IP Address [157.38.111.214]157.38.111.2141269750SD  -7% ossec13001gƑ5Exim Auth failed2025-03-04 11:05:48 dovecot_plain authenticator failed for ([5.11.164.165]) [5.11.164.165]:51169: 535 Incorrect authentication data (set_id=services)5.11.164.165298795xC  -}' ossec13001gƑ%Exim Auth failed2025-03-04 11:05:33 dovecot_plain authenticator failed for 46.79-160-128.customer.lyse.net [79.160.128.46]:33867: 535 Incorrect authentication data (set_id=services@heipowersystem.com)79.160.128.463144096ZB  -=+ ossec13001gƏExim Auth failed2025-03-04 10:59:55 dovecot_plain authenticator failed for ([171.244.142.135]) [171.244.142.135]:64640: 535 Incorrect authentication data (set_id=sales)171.244.142.1351562822tA  -q+ ossec13001gƏExim Auth failed2025-03-04 10:59:37 dovecot_plain authenticator failed for (448990.cloudwaysapps.com) [128.199.118.234]:14074: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)128.199.118.2341880251g@  -[' ossec13001gƏExim Auth failed2025-03-04 10:59:24 dovecot_plain authenticator failed for ([118.38.239.52]) [118.38.239.52]:38494: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)118.38.239.521835841Z?  -?) ossec13001gƏ[Exim Auth failed2025-03-04 10:57:53 dovecot_plain authenticator failed for ([112.25.140.211]) [112.25.140.211]:41784: 535 Incorrect authentication data (set_id=services)112.25.140.2111814991m>  -e) ossec13001gƏAExim Auth failed2025-03-04 10:57:27 dovecot_plain authenticator failed for ([46.236.190.103]) [46.236.190.103]:52802: 535 Incorrect authentication data (set_id=services@heipowersystem.com)46.236.190.1032017370k=  -_+ ossec13001gƍVExim Auth failed2025-03-04 10:49:17 dovecot_login authenticator failed for ([112.132.14.159]) [112.123.199.111]:54824: 535 Incorrect authentication data (set_id=info@heipowersystem.com)112.123.199.1111814991W<  -9) ossec13001gƍBExim Auth failed2025-03-04 10:48:58 dovecot_plain authenticator failed for ([187.93.153.166]) [187.93.153.166]:34136: 535 Incorrect authentication data (set_id=sales)187.93.153.1663469034`;  -M' ossec13001gƍlExim Auth failed2025-03-04 10:49:39 dovecot_login authenticator failed for (pppoe-static.mosoblast.rt.ru) [77.51.214.170]:41711: 535 Incorrect authentication data (set_id=info)77.51.214.1702017370d:  -W% ossec13001gƍ8Exim Auth failed2025-03-04 10:48:47 dovecot_plain authenticator failed for ([87.117.32.22]) [87.117.32.22]:53992: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)87.117.32.222017370d9  -S) ossec13001gƌ4Exim Auth failed2025-03-04 10:44:27 dovecot_plain authenticator failed for (91-220-216-178.omsk.mts.ru) [178.216.220.91]:60718: 535 Incorrect authentication data (set_id=services)178.216.220.912017370f8  -]% ossec13001gƌExim Auth failed2025-03-04 10:44:04 dovecot_plain authenticator failed for ([91.74.186.57]) [91.74.186.57]:55676: 535 Incorrect authentication data (set_id=services@heipowersystem.com)91.74.186.57290557   6 Q c `@UdZX  -?) ossec13001gƜExim Auth failed2025-03-04 11:55:46 dovecot_plain authenticator failed for ([220.161.52.149]) [220.161.52.149]:59963: 535 Incorrect authentication data (set_id=services)220.161.52.1491814991mW  -e) ossec13001gƜExim Auth failed2025-03-04 11:55:32 dovecot_plain authenticator failed for ([202.156.63.212]) [202.156.63.212]:50548: 535 Incorrect authentication data (set_id=services@heipowersystem.com)202.156.63.2121880251gV  -[' ossec13001gƛExim Auth failed2025-03-04 11:49:45 dovecot_plain authenticator failed for ([223.171.55.59]) [223.171.55.59]:43246: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)223.171.55.591835841WU  -;' ossec13001gƚExim Auth failed2025-03-04 11:43:40 dovecot_plain authenticator failed for ([50.249.167.45]) [50.249.167.45]:40328: 535 Incorrect authentication data (set_id=services)50.249.167.456252001gT  -]% ossec13001gƚ Exim Auth failed2025-03-04 11:43:29 dovecot_plain authenticator failed for ([27.72.103.74]) [27.72.103.74]:60736: 535 Incorrect authentication data (set_id=services@heipowersystem.com)27.72.103.741562822TS  -5' ossec13001gƘExim Auth failed2025-03-04 11:38:47 dovecot_plain authenticator failed for ([121.157.28.10]) [121.157.28.10]:56044: 535 Incorrect authentication data (set_id=sales)121.157.28.101835841jR  -_) ossec13001gƘExim Auth failed2025-03-04 11:38:09 dovecot_plain authenticator failed for ([117.53.254.144]) [117.53.254.144]:60094: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)117.53.254.1441835841TQ  -7% ossec13001gƗExim Auth failed2025-03-04 11:33:59 dovecot_plain authenticator failed for ([27.71.20.180]) [27.71.20.180]:15602: 535 Incorrect authentication data (set_id=services)27.71.20.1801562822gP  -]% ossec13001gƗExim Auth failed2025-03-04 11:33:31 dovecot_plain authenticator failed for ([58.18.90.250]) [58.18.90.250]:56059: 535 Incorrect authentication data (set_id=services@heipowersystem.com)58.18.90.2501814991MO  -/! ossec13001gƖgExim Auth failed2025-03-04 11:27:58 dovecot_plain authenticator failed for ([149.0.16.4]) [149.0.16.4]:58790: 535 Incorrect authentication data (set_id=services)149.0.16.4298795N  - ) ossec13001gƖWExim Auth failed2025-03-04 11:27:42 dovecot_plain authenticator failed for syn-173-095-123-220.biz.spectrum.com [173.95.123.220]:52069: 535 Incorrect authentication data (set_id=services@heipowersystem.com)173.95.123.2206252001jM  -a' ossec13001gƖKExim Auth failed2025-03-04 11:27:30 dovecot_plain authenticator failed for broadband-95-84-186-218.ip.moscow.rt.ru [95.84.186.218]:49410: 535 Incorrect authentication data (set_id=sales)95.84.186.2182017370aL  -S# ossec13001gƖ5Exim Auth failed2025-03-04 11:27:08 dovecot_plain authenticator failed for ([5.166.68.89]) [5.166.68.89]:53150: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)5.166.68.892017370ZK  -?) ossec13001gƔLExim Auth failed2025-03-04 11:19:00 dovecot_plain authenticator failed for ([175.125.68.208]) [175.125.68.208]:46190: 535 Incorrect authentication data (set_id=services)175.125.68.2081835841WJ  -;' ossec13001gƔBExim Auth failed2025-03-04 11:18:49 dovecot_plain authenticator failed for ([222.180.4.150]) [222.180.4.150]:48836: 535 Incorrect authentication data (set_id=services)222.180.4.1501814991mI  -e) ossec13001gƔ*Exim Auth failed2025-03-04 11:18:26 dovecot_plain authenticator failed for ([219.251.253.62]) [219.251.253.62]:41793: 535 Incorrect authentication data (set_id=services@heipowersystem.com)219.251.253.621835841H  W' ossec9708gƓDovecot Aborted Login with empty userMar 4 11:15:50 vm1 dovecot[312763]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=87.236.176.89, lip=103.74.54.108, TLS, session=87.236.176.892635167 : O g o <NUmi  -e) ossec13001gƩExim Auth failed2025-03-04 12:50:03 dovecot_plain authenticator failed for mail-02.03.perm.ru [46.146.210.180]:47347: 535 Incorrect authentication data (set_id=services@heipowersystem.com)46.146.210.1802017370Zh  -?) ossec13001gƦExim Auth failed2025-03-04 12:37:13 dovecot_plain authenticator failed for ([103.129.201.82]) [103.129.201.81]:60896: 535 Incorrect authentication data (set_id=services)103.129.201.811210997Qg  -1% ossec13001gƦExim Auth failed2025-03-04 12:37:08 dovecot_plain authenticator failed for ([141.94.18.69]) [141.94.18.69]:58006: 535 Incorrect authentication data (set_id=sales)141.94.18.693017382uf  -y% ossec13001gƦExim Auth failed2025-03-04 12:37:00 dovecot_plain authenticator failed for ool-4a5ad51c.dyn.optonline.net [74.90.213.28]:35326: 535 Incorrect authentication data (set_id=services@heipowersystem.com)74.90.213.286252001je  -_) ossec13001gƦExim Auth failed2025-03-04 12:37:01 dovecot_plain authenticator failed for ([182.160.107.51]) [182.160.107.51]:48936: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)182.160.107.511210997Wd  -;' ossec13001gƤExim Auth failed2025-03-04 12:29:55 dovecot_plain authenticator failed for ([124.160.45.26]) [124.160.45.26]:44406: 535 Incorrect authentication data (set_id=services)124.160.45.261814991lc  -e) ossec13001gƤExim Auth failed2025-03-04 12:29:30 dovecot_plain authenticator failed for ([185.101.16.250]) [185.101.16.250]:35458: 535 Incorrect authentication data (set_id=services@heipowersystem.com)185.101.16.250272103fb  -[' ossec13001gƣExim Auth failed2025-03-04 12:24:19 dovecot_plain authenticator failed for ([185.167.56.70]) [185.167.56.70]:45730: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)185.167.56.70617790Ma  --# ossec13001gƣExim Auth failed2025-03-04 12:24:32 dovecot_plain authenticator failed for ([95.0.252.76]) [95.0.252.76]:57900: 535 Incorrect authentication data (set_id=sales)95.0.252.76298795m`  -e) ossec13001gƢExim Auth failed2025-03-04 12:20:18 dovecot_plain authenticator failed for ([176.222.190.70]) [176.222.190.70]:33528: 535 Incorrect authentication data (set_id=services@heipowersystem.com)176.222.190.701522867Q_  -1% ossec13001gơBExim Auth failed2025-03-04 12:14:17 dovecot_plain authenticator failed for ([101.13.2.178]) [101.13.2.178]:57649: 535 Incorrect authentication data (set_id=sales)101.13.2.1781668284c^  -W% ossec13001gơ6Exim Auth failed2025-03-04 12:14:05 dovecot_plain authenticator failed for ([94.204.90.91]) [94.204.90.91]:36362: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)94.204.90.91290557t]  -w' ossec13001gơExim Auth failed2025-03-04 12:13:36 dovecot_plain authenticator failed for (46.30.161.197.access.ipnet.ua) [46.30.161.197]:48544: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)46.30.161.197690791d\  -U' ossec13001gƞExim Auth failed2025-03-04 12:03:16 dovecot_plain authenticator failed for (111-86-33-194.intelcom-ug.ru) [194.33.87.111]:60656: 535 Incorrect authentication data (set_id=services)194.33.87.1112017370g[  -]% ossec13001gƞExim Auth failed2025-03-04 12:03:07 dovecot_plain authenticator failed for ([59.34.17.130]) [59.34.17.130]:59570: 535 Incorrect authentication data (set_id=services@heipowersystem.com)59.34.17.1301814991WZ  -9) ossec13001gƞaExim Auth failed2025-03-04 12:02:00 dovecot_plain authenticator failed for ([27.107.168.206]) [27.107.168.206]:46280: 535 Incorrect authentication data (set_id=sales)27.107.168.2061269750gY  -[' ossec13001gƞWExim Auth failed2025-03-04 12:01:50 dovecot_plain authenticator failed for ([57.128.19.228]) [57.128.19.228]:48142: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)57.128.19.2283017382   4 Z  (7Yhy  -' ossec13001gƴExim Auth failed2025-03-04 13:37:39 dovecot_plain authenticator failed for pool-99-251-252-98.cpe.net.cable.rogers.com [99.251.252.98]:37252: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)99.251.252.9862519997x  =g+ ossec13008gƲMail Reciepient rejected2025-03-04 13:29:57 H=(mail.rokamauka.com) [165.154.210.114]:52797 F= rejected RCPT : Rejected relay attempt: '165.154.210.114' From: 'modjbiwrwmv@rokamauka.com' To: 'goofile@fastmail.com'165.154.210.1141694008Qw  -1% ossec13001gƲExim Auth failed2025-03-04 13:29:19 dovecot_plain authenticator failed for ([60.11.20.130]) [60.11.20.130]:54210: 535 Incorrect authentication data (set_id=sales)60.11.20.1301814991kv  -_+ ossec13001gƲExim Auth failed2025-03-04 13:29:07 dovecot_plain authenticator failed for ([182.76.69.209]) [128.185.228.134]:53130: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)128.185.228.1341269750Zu  -?) ossec13001gƱExim Auth failed2025-03-04 13:24:04 dovecot_plain authenticator failed for ([111.48.208.197]) [111.48.208.197]:41426: 535 Incorrect authentication data (set_id=services)111.48.208.1971814991mt  -e) ossec13001gƱExim Auth failed2025-03-04 13:23:52 dovecot_plain authenticator failed for ([128.185.253.66]) [128.185.253.66]:58856: 535 Incorrect authentication data (set_id=services@heipowersystem.com)128.185.253.661269750Zs  -=+ ossec13001gưExim Auth failed2025-03-04 13:20:05 dovecot_plain authenticator failed for ([157.122.132.209]) [157.122.132.209]:56403: 535 Incorrect authentication data (set_id=sales)157.122.132.2091814991mr  -c+ ossec13001gưExim Auth failed2025-03-04 13:19:43 dovecot_plain authenticator failed for ([123.209.118.166]) [123.209.118.166]:45714: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)123.209.118.1662077456mq  -e) ossec13001gƮExim Auth failed2025-03-04 13:11:22 dovecot_plain authenticator failed for ([178.177.200.26]) [178.177.200.26]:44222: 535 Incorrect authentication data (set_id=services@heipowersystem.com)178.177.200.262017370yp  -' ossec13001gƮExim Auth failed2025-03-04 13:11:01 dovecot_plain authenticator failed for c-98-220-97-188.hsd1.il.comcast.net [98.220.97.188]:33518: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)98.220.97.1886252001@o  ={) ossec13008gƮYMail Reciepient rejected2025-03-04 13:10:08 H=(mail.thepsindustries.com) [165.154.213.78]:54366 F= rejected RCPT : Rejected relay attempt: '165.154.213.78' From: 'bljfjcop@thepsindustries.com' To: 'goofile@fastmail.com'165.154.213.783469034Vn  -9) ossec13001gƫExim Auth failed2025-03-04 12:59:20 dovecot_plain authenticator failed for ([178.218.193.90]) [178.218.193.90]:35503: 535 Incorrect authentication data (set_id=sales)178.218.193.90798544fm  -[' ossec13001gƫExim Auth failed2025-03-04 12:59:05 dovecot_plain authenticator failed for ([91.239.23.149]) [91.239.23.149]:41524: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)91.239.23.149458258ml  -g' ossec13001gƫExim Auth failed2025-03-04 12:58:14 dovecot_plain authenticator failed for host-37-205-73-112.bbcustomer.zsttk.net [37.205.73.112]:59702: 535 Incorrect authentication data (set_id=services)37.205.73.1122017370lk  -c) ossec13001gƫlExim Auth failed2025-03-04 12:57:40 dovecot_plain authenticator failed for ([186.237.145.18]) [186.237.145.18]:3131: 535 Incorrect authentication data (set_id=services@heipowersystem.com)186.237.145.183469034}j  -' ossec13001gƩExim Auth failed2025-03-04 12:50:54 dovecot_plain authenticator failed for broadband-77-37-179-158.ip.moscow.rt.ru [77.37.179.158]:54892: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)77.37.179.1582017370 )5 ] z  ;0Tf~h  -]' ossec13001gƾWExim Auth failed2025-03-04 14:18:23 dovecot_plain authenticator failed for ([189.108.224.67]) [191.210.73.33]:43736: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)191.210.73.333469034d  -Y# ossec13001gƽExim Auth failed2025-03-04 14:13:00 dovecot_plain authenticator failed for 18.red-83-48-39.staticip.rima-tde.net [83.48.39.18]:19087: 535 Incorrect authentication data (set_id=sales)83.48.39.182510769j  -_) ossec13001gƽ Exim Auth failed2025-03-04 14:12:50 dovecot_plain authenticator failed for ([191.210.87.101]) [191.210.87.101]:35102: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)191.210.87.1013469034X  -?% ossec13001gƼExim Auth failed2025-03-04 14:11:28 dovecot_login authenticator failed for (fablixsolutions.com) [60.2.243.174]:35354: 535 Incorrect authentication data (set_id=nologin)60.2.243.1741814991  -% ossec13001gƻExim Auth failed2025-03-04 14:07:51 dovecot_plain authenticator failed for 61-216-7-163.hinet-ip.hinet.net ([61.216.7.164]) [61.216.7.163]:51734: 535 Incorrect authentication data (set_id=services@heipowersystem.com)61.216.7.1631668284]  -C+ ossec13001gƺExim Auth failed2025-03-04 14:00:10 dovecot_plain authenticator failed for ([123.210.131.121]) [123.210.131.121]:43080: 535 Incorrect authentication data (set_id=services)123.210.131.1212077456i  -_' ossec13001gƺExim Auth failed2025-03-04 13:59:59 dovecot_plain authenticator failed for visaustralia.com [216.70.104.41]:38854: 535 Incorrect authentication data (set_id=services@heipowersystem.com)216.70.104.416252001g  -[' ossec13001gƹzExim Auth failed2025-03-04 13:57:38 dovecot_plain authenticator failed for ([61.80.158.202]) [61.80.158.202]:54009: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)61.80.158.2021835841X  -?) ossec13001gƸrExim Auth failed2025-03-04 13:53:13 dovecot_plain authenticator failed for ([213.32.253.235]) [213.32.253.235]:52470: 535 Incorrect authentication data (set_id=services)213.32.253.23599237j  -a' ossec13001gƸXExim Auth failed2025-03-04 13:52:47 dovecot_plain authenticator failed for ([31.173.66.222]) [31.173.66.222]:57330: 535 Incorrect authentication data (set_id=services@heipowersystem.com)31.173.66.2222017370Q  -1% ossec13001gƷJExim Auth failed2025-03-04 13:48:16 dovecot_plain authenticator failed for ([60.173.218.7]) [60.173.218.7]:57163: 535 Incorrect authentication data (set_id=sales)60.173.218.71814991j  -_) ossec13001gƷ2Exim Auth failed2025-03-04 13:47:53 dovecot_plain authenticator failed for ([171.217.70.151]) [171.217.70.151]:42778: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)171.217.70.1511814991u~  -u) ossec13001gƵExim Auth failed2025-03-04 13:41:57 dovecot_login authenticator failed for (amplifypowerglobal.com) [101.89.140.209]:46428: 535 Incorrect authentication data (set_id=office@amplifypowerglobal.com)101.89.140.2091814991_}  -I) ossec13001gƵExim Auth failed2025-03-04 13:41:33 dovecot_login authenticator failed for (amplifypowerglobal.com) [101.89.140.209]:43264: 535 Incorrect authentication data (set_id=nologin)101.89.140.2091814991T|  -7% ossec13001gƵcExim Auth failed2025-03-04 13:40:09 dovecot_plain authenticator failed for ([186.73.22.20]) [186.73.22.20]:40726: 535 Incorrect authentication data (set_id=services)186.73.22.203703430p{  -i+ ossec13001gƵ5Exim Auth failed2025-03-04 13:39:23 dovecot_plain authenticator failed for ([121.135.188.125]) [121.135.188.125]:52360: 535 Incorrect authentication data (set_id=services@heipowersystem.com)121.135.188.1251835841Sz  -3' ossec13001gƴExim Auth failed2025-03-04 13:38:13 dovecot_plain authenticator failed for ([223.82.88.108]) [223.82.88.108]:1204: 535 Incorrect authentication data (set_id=sales)223.82.88.1081814991 _ b | %<Ncl  -g% ossec13001gExim Auth failed2025-03-04 14:58:38 dovecot_plain authenticator failed for vps-79f20bfc.vps.ovh.net [51.75.24.107]:58504: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)51.75.24.1073017382(  3U) ossec11301gNew FTP connection.Mar 4 14:55:03 vm1 pure-ftpd[2067394]: (?@54.153.125.188) [INFO] New connection from 54.153.125.18854.153.125.1886252001}  -) ossec13001gAExim Auth failed2025-03-04 14:52:08 dovecot_login authenticator failed for (94.124.156.175.unknown.m1.com.sg) [175.156.124.94]:43023: 535 Incorrect authentication data (set_id=services@heipowersystem.com)175.156.124.941880251W  -9) ossec13001gůExim Auth failed2025-03-04 14:49:43 dovecot_plain authenticator failed for ([103.115.31.219]) [103.115.31.219]:54286: 535 Incorrect authentication data (set_id=sales)103.115.31.2191643084g  -[' ossec13001gřExim Auth failed2025-03-04 14:49:21 dovecot_plain authenticator failed for ([183.105.3.221]) [183.105.3.221]:45542: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)183.105.3.2211835841j  -a' ossec13001g=Exim Auth failed2025-03-04 14:47:48 dovecot_plain authenticator failed for ([46.73.156.221]) [46.73.156.221]:60038: 535 Incorrect authentication data (set_id=services@heipowersystem.com)46.73.156.2212017370e  -Y% ossec13001g]Exim Auth failed2025-03-04 14:44:04 dovecot_plain authenticator failed for 95-30-250-44.broadband.corbina.ru [95.30.250.44]:59202: 535 Incorrect authentication data (set_id=services)95.30.250.442017370) 3U) ossec11301g]New FTP connection.Mar 4 14:44:04 vm1 pure-ftpd[2064377]: (?@89.248.163.214) [INFO] New connection from 89.248.163.21489.248.163.2142750405j  -a' ossec13001gMExim Auth failed2025-03-04 14:43:49 dovecot_plain authenticator failed for ([41.224.62.206]) [41.224.62.206]:46780: 535 Incorrect authentication data (set_id=services@heipowersystem.com)41.224.62.2062464461W  -9) ossec13001g?Exim Auth failed2025-03-04 14:39:17 dovecot_plain authenticator failed for ([192.199.58.185]) [192.199.58.185]:37843: 535 Incorrect authentication data (set_id=sales)192.199.58.1856251999   -) ossec13001g3Exim Auth failed2025-03-04 14:39:05 dovecot_plain authenticator failed for (ip-103-133.222-205.cloudteknologinusantara.co.id) [125.163.69.149]:55162: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)125.163.69.1491643084d  -W% ossec13001gExim Auth failed2025-03-04 14:33:24 dovecot_plain authenticator failed for h-46-59-44-182.a980.priv.bahnhof.se [46.59.44.182]:42930: 535 Incorrect authentication data (set_id=sales)46.59.44.1822661886g  -[' ossec13001gExim Auth failed2025-03-04 14:33:13 dovecot_plain authenticator failed for ([57.128.19.228]) [57.128.19.228]:58776: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)57.128.19.2283017382b  -W% ossec13001gExim Auth failed2025-03-04 14:28:09 dovecot_login authenticator failed for ([65.20.128.78]) [65.20.128.78]:43893: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)65.20.128.7899237y  -' ossec13001g2Exim Auth failed2025-03-04 14:26:17 dovecot_plain authenticator failed for wsip-174-79-91-142.br.br.cox.net [174.79.91.142]:52769: 535 Incorrect authentication data (set_id=services@heipowersystem.com)174.79.91.1426252001"  3M% ossec11301gƿNew FTP connection.Mar 4 14:23:54 vm1 pure-ftpd[2060087]: (?@20.29.23.143) [INFO] New connection from 20.29.23.14320.29.23.1436252001w  -y) ossec13001gƾgExim Auth failed2025-03-04 14:18:38 dovecot_plain authenticator failed for (ip-103-133.222-205.cloudteknologinusantara.co.id) [125.163.69.149]:51110: 535 Incorrect authentication data (set_id=sales)125.163.69.1491643084 (/ I X l  IOgj,  -_) ossec13001g Exim Auth failed2025-03-04 15:46:41 dovecot_plain authenticator failed for ([117.53.254.144]) [117.53.254.144]:43990: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)117.53.254.1441835841Z+  -?) ossec13001gExim Auth failed2025-03-04 15:45:43 dovecot_plain authenticator failed for ([220.119.126.81]) [220.119.126.81]:50182: 535 Incorrect authentication data (set_id=services)220.119.126.811835841d*  -Y# ossec13001gExim Auth failed2025-03-04 15:45:30 dovecot_plain authenticator failed for ([101.13.3.72]) [101.13.3.72]:54580: 535 Incorrect authentication data (set_id=services@heipowersystem.com)101.13.3.721668284v)  -y' ossec13001gExim Auth failed2025-03-04 15:41:23 dovecot_plain authenticator failed for 57-45-246-103.southernonline.net [103.246.45.57]:47100: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)103.246.45.571269750S(  -3' ossec13001gкExim Auth failed2025-03-04 15:36:50 dovecot_plain authenticator failed for ([103.161.93.51]) [103.161.93.51]:6081: 535 Incorrect authentication data (set_id=sales)103.161.93.511269750q'  -q% ossec13001gаExim Auth failed2025-03-04 15:36:39 dovecot_plain authenticator failed for bb121-7-209-18.singnet.com.sg [121.7.209.18]:44287: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)121.7.209.181880251g&  -[' ossec13001gExim Auth failed2025-03-04 15:29:10 dovecot_plain authenticator failed for (pc0.zz.ha.cn) [218.28.77.206]:50073: 535 Incorrect authentication data (set_id=services@heipowersystem.com)218.28.77.2061814991j%  -_) ossec13001gpExim Auth failed2025-03-04 15:27:03 dovecot_plain authenticator failed for ([112.111.61.232]) [112.111.61.229]:32996: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)112.111.61.2291814991Z$  -?) ossec13001gsExim Auth failed2025-03-04 15:18:35 dovecot_plain authenticator failed for ([60.171.237.143]) [60.171.237.143]:49280: 535 Incorrect authentication data (set_id=services)60.171.237.1431814991c#  -Y# ossec13001ggExim Auth failed2025-03-04 15:18:22 dovecot_plain authenticator failed for ([95.0.252.72]) [95.0.252.72]:47200: 535 Incorrect authentication data (set_id=services@heipowersystem.com)95.0.252.72298795Z"  -?) ossec13001gExim Auth failed2025-03-04 15:12:17 dovecot_plain authenticator failed for ([39.165.154.222]) [39.165.154.222]:59322: 535 Incorrect authentication data (set_id=services)39.165.154.2221814991W!  -;' ossec13001gExim Auth failed2025-03-04 15:12:06 dovecot_plain authenticator failed for ([178.25.73.199]) [178.25.73.199]:57187: 535 Incorrect authentication data (set_id=services)178.25.73.1992921044h  -Y+ ossec13001gExim Auth failed2025-03-04 15:11:44 dovecot_plain authenticator failed for (tgw-rp.ru) [109.106.136.152]:51498: 535 Incorrect authentication data (set_id=services@heipowersystem.com)109.106.136.1522017370m  -e) ossec13001gHExim Auth failed2025-03-04 15:05:03 dovecot_plain authenticator failed for ([124.221.104.33]) [124.221.104.33]:35968: 535 Incorrect authentication data (set_id=services@heipowersystem.com)124.221.104.331814991b  -O) ossec13001gExim Auth failed2025-03-04 15:04:18 dovecot_plain authenticator failed for ([128.185.224.87]) [152.52.243.154]:41878: 535 Incorrect authentication data (set_id=vikas.khandelwal)152.52.243.1541269750u  -u) ossec13001gExim Auth failed2025-03-04 15:04:00 dovecot_plain authenticator failed for ([103.218.132.27]) [103.218.132.27]:41029: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)103.218.132.271269750T  -5' ossec13001gExim Auth failed2025-03-04 14:58:57 dovecot_plain authenticator failed for ([60.10.225.130]) [60.10.225.130]:35075: 535 Incorrect authentication data (set_id=sales)60.10.225.1301814991 m> > M l ~ 3KmZ=  -=+ ossec13001gsExim Auth failed2025-03-04 16:22:34 dovecot_plain authenticator failed for ([123.210.152.243]) [123.210.152.243]:60944: 535 Incorrect authentication data (set_id=sales)123.210.152.2432077456d<  -W% ossec13001gYExim Auth failed2025-03-04 16:22:08 dovecot_plain authenticator failed for ([76.72.14.152]) [76.72.14.152]:54933: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)76.72.14.1526252001`;  -O% ossec13001gڅExim Auth failed2025-03-04 16:18:35 dovecot_plain authenticator failed for wsip-70-169-19-52.hr.hr.cox.net [70.169.19.52]:39238: 535 Incorrect authentication data (set_id=sales)70.169.19.526252001g:  -[' ossec13001gqExim Auth failed2025-03-04 16:18:15 dovecot_plain authenticator failed for ([112.132.89.72]) [112.132.89.72]:41342: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)112.132.89.721814991]9  -C+ ossec13001gExim Auth failed2025-03-04 16:11:43 dovecot_plain authenticator failed for ([115.245.172.214]) [115.245.172.214]:46300: 535 Incorrect authentication data (set_id=services)115.245.172.2141269750d8  -Y# ossec13001gExim Auth failed2025-03-04 16:11:20 dovecot_plain authenticator failed for ([59.0.60.158]) [59.0.60.158]:51074: 535 Incorrect authentication data (set_id=services@heipowersystem.com)59.0.60.1581835841f7  -]# ossec13001gxExim Auth failed2025-03-04 16:05:35 dovecot_login authenticator failed for host-2-98-157-37.as13285.net [2.98.157.37]:33684: 535 Incorrect authentication data (set_id=vikas.khandelwal)2.98.157.372635167r6  -q' ossec13001gjExim Auth failed2025-03-04 16:05:21 dovecot_login authenticator failed for ([121.154.90.47]) [121.154.90.47]:49612: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)121.154.90.4718358415  - ) ossec13001gExim Auth failed2025-03-04 16:03:32 dovecot_plain authenticator failed for c-73-106-172-226.hsd1.ga.comcast.net [73.106.172.226]:47716: 535 Incorrect authentication data (set_id=services@heipowersystem.com)73.106.172.2266252001g4  -[' ossec13001gExim Auth failed2025-03-04 16:02:37 dovecot_plain authenticator failed for ([39.152.120.40]) [39.152.120.40]:22974: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)39.152.120.401814991a3  -O) ossec13001g.Exim Auth failed2025-03-04 16:00:05 dovecot_plain authenticator failed for ip-188-127-16-197.ennet.pl [188.127.16.197]:51330: 535 Incorrect authentication data (set_id=services)188.127.16.197798544j2  -a' ossec13001gExim Auth failed2025-03-04 15:59:49 dovecot_plain authenticator failed for ([61.173.105.26]) [61.173.105.26]:47834: 535 Incorrect authentication data (set_id=services@heipowersystem.com)61.173.105.261814991]1  -E) ossec13001g Exim Auth failed2025-03-04 15:59:28 dovecot_plain authenticator failed for host-ys.srk1-b.v4.dfn.nl [62.238.214.147]:38139: 535 Incorrect authentication data (set_id=sales)62.238.214.1472750405m0  -c+ ossec13001gExim Auth failed2025-03-04 15:59:12 dovecot_plain authenticator failed for ([197.255.138.197]) [197.255.138.197]:38318: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)197.255.138.1973374766|/  -+ ossec13001g3Exim Auth failed2025-03-04 15:47:23 dovecot_plain authenticator failed for ([211.247.127.250]) [211.247.127.250]:52481: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)211.247.127.2501835841W.  -9) ossec13001g!Exim Auth failed2025-03-04 15:47:04 dovecot_plain authenticator failed for ([168.126.90.210]) [168.126.90.210]:49646: 535 Incorrect authentication data (set_id=sales)168.126.90.2101835841c-  -S' ossec13001gMExim Auth failed2025-03-04 15:47:47 dovecot_plain authenticator failed for ([89.175.49.147]) [89.175.49.147]:53838: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)89.175.49.1472017370   ; M l BT>M  =u+ ossec13008gMail Reciepient rejected2025-03-04 17:10:20 H=(mail.heipowersystem.com) [165.154.227.103]:61258 F= rejected RCPT : Rejected relay attempt: '165.154.227.103' From: 'mxqprtj@heipowersystem.com' To: 'goofile@fastmail.com'165.154.227.1031668284jL  -_) ossec13001gPExim Auth failed2025-03-04 17:08:54 dovecot_plain authenticator failed for ([175.125.68.208]) [175.125.68.208]:38334: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)175.125.68.2081835841SK  -3' ossec13001gdExim Auth failed2025-03-04 17:09:14 dovecot_plain authenticator failed for visaustralia.com [216.70.104.41]:60254: 535 Incorrect authentication data (set_id=sales)216.70.104.416252001gJ  -]% ossec13001gExim Auth failed2025-03-04 17:06:28 dovecot_plain authenticator failed for ([98.70.127.17]) [98.70.127.17]:38520: 535 Incorrect authentication data (set_id=services@heipowersystem.com)98.70.127.171269750TI  -7% ossec13001gWExim Auth failed2025-03-04 17:00:31 dovecot_plain authenticator failed for ([14.37.79.247]) [14.37.79.247]:48697: 535 Incorrect authentication data (set_id=services)14.37.79.2471835841dH  -Y# ossec13001g7Exim Auth failed2025-03-04 16:59:59 dovecot_plain authenticator failed for ([101.13.5.49]) [101.13.5.49]:46854: 535 Incorrect authentication data (set_id=services@heipowersystem.com)101.13.5.491668284gG  -]% ossec13001gExim Auth failed2025-03-04 16:53:42 dovecot_plain authenticator failed for ([38.21.61.150]) [38.21.61.150]:49144: 535 Incorrect authentication data (set_id=services@heipowersystem.com)38.21.61.1506252001pF  -m' ossec13001gOExim Auth failed2025-03-04 16:51:50 dovecot_login authenticator failed for 89-179-99-200.broadband.corbina.ru [89.179.99.200]:58988: 535 Incorrect authentication data (set_id=vikas.khandelwal)89.179.99.2002017370rE  -q' ossec13001gGExim Auth failed2025-03-04 16:51:42 dovecot_login authenticator failed for ([183.47.48.178]) [183.47.48.178]:57398: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)183.47.48.1781814991tD  -w% ossec13001gExim Auth failed2025-03-04 16:46:35 dovecot_plain authenticator failed for bb121-7-26-195.singnet.com.sg [121.7.26.195]:54494: 535 Incorrect authentication data (set_id=services@heipowersystem.com)121.7.26.1951880251WC  -;' ossec13001gExim Auth failed2025-03-04 16:46:45 dovecot_plain authenticator failed for ([116.88.187.44]) [116.88.187.44]:51031: 535 Incorrect authentication data (set_id=services)116.88.187.441880251]B  -C+ ossec13001gޖExim Auth failed2025-03-04 16:35:56 dovecot_plain authenticator failed for ([111.193.226.252]) [111.193.226.252]:23792: 535 Incorrect authentication data (set_id=services)111.193.226.2521814991jA  -a' ossec13001gފExim Auth failed2025-03-04 16:35:44 dovecot_plain authenticator failed for ([180.129.22.12]) [180.129.22.12]:38855: 535 Incorrect authentication data (set_id=services@heipowersystem.com)180.129.22.121880251T@  -5' ossec13001gExim Auth failed2025-03-04 16:32:27 dovecot_plain authenticator failed for ([220.74.63.183]) [220.74.63.183]:50264: 535 Incorrect authentication data (set_id=sales)220.74.63.1831835841u?  -w' ossec13001gݵExim Auth failed2025-03-04 16:32:13 dovecot_plain authenticator failed for 42-200-70-134.static.imsbiz.com [42.200.70.134]:59594: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)42.200.70.1341819730p>  -i+ ossec13001g#Exim Auth failed2025-03-04 16:25:30 dovecot_plain authenticator failed for ([223.241.214.127]) [223.241.214.127]:40835: 535 Incorrect authentication data (set_id=services@heipowersystem.com)223.241.214.1271814991 Y. Y ~ 3YV^  -;' ossec13001gExim Auth failed2025-03-04 17:44:47 dovecot_plain authenticator failed for mail.infologic.co.il [85.130.200.51]:56514: 535 Incorrect authentication data (set_id=sales)85.130.200.51294640g]  -[' ossec13001gExim Auth failed2025-03-04 17:44:37 dovecot_plain authenticator failed for ([49.245.99.168]) [49.245.99.168]:41973: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)49.245.99.1681880251W\  -;' ossec13001gExim Auth failed2025-03-04 17:42:00 dovecot_plain authenticator failed for ([61.81.133.182]) [61.81.133.182]:59468: 535 Incorrect authentication data (set_id=services)61.81.133.1821835841m[  -e) ossec13001gExim Auth failed2025-03-04 17:41:31 dovecot_plain authenticator failed for ([38.211.138.232]) [38.211.138.232]:48550: 535 Incorrect authentication data (set_id=services@heipowersystem.com)38.211.138.2323932488vZ  -y' ossec13001gExim Auth failed2025-03-04 17:36:26 dovecot_login authenticator failed for ([203.190.150.4]) [203.190.150.4]:54506: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)203.190.150.41269750XY  -=' ossec13001gExim Auth failed2025-03-04 17:36:17 dovecot_login authenticator failed for syn-024-043-191-220.biz.spectrum.com [24.43.191.220]:40808: 535 Incorrect authentication data24.43.191.2206252001X  -) ossec13001gExim Auth failed2025-03-04 17:36:49 dovecot_login authenticator failed for (ip-103-133.222-205.cloudteknologinusantara.co.id) [125.163.69.149]:59040: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)125.163.69.1491643084HW  -% ossec13001gExim Auth failed2025-03-04 17:35:29 dovecot_plain authenticator failed for ([4.4.89.74]) [4.4.89.74]:38496: 535 Incorrect authentication data (set_id=sales)4.4.89.746252001jV  -_) ossec13001g{Exim Auth failed2025-03-04 17:35:14 dovecot_plain authenticator failed for ([178.178.222.47]) [178.178.222.47]:58592: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)178.178.222.472017370$U  =C) ossec13008gMail Reciepient rejected2025-03-04 17:32:01 H=(mail.msnews24.in) [165.154.226.98]:65358 F= rejected RCPT : Rejected relay attempt: '165.154.226.98' From: 'hktluz@msnews24.in' To: 'goofile@fastmail.com'165.154.226.981668284TT  -5' ossec13001gcExim Auth failed2025-03-04 17:30:34 dovecot_plain authenticator failed for ([92.255.190.69]) [92.255.190.69]:56324: 535 Incorrect authentication data (set_id=sales)92.255.190.692017370S  -+ ossec13001gEExim Auth failed2025-03-04 17:30:04 dovecot_plain authenticator failed for 122-151-131-211.sta.wbroadband.net.au [122.151.131.211]:37563: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)122.151.131.2112077456sR  -u% ossec13001gExim Auth failed2025-03-04 17:28:55 dovecot_plain authenticator failed for 82-65-201-95.subs.proxad.net [82.65.201.95]:50228: 535 Incorrect authentication data (set_id=services@heipowersystem.com)82.65.201.953017382WQ  -;' ossec13001gExim Auth failed2025-03-04 17:14:19 dovecot_plain authenticator failed for ([197.211.47.66]) [197.211.47.66]:33019: 535 Incorrect authentication data (set_id=services)197.211.47.662328926QP  -1% ossec13001gExim Auth failed2025-03-04 17:14:20 dovecot_plain authenticator failed for ([60.166.8.174]) [60.166.8.174]:41538: 535 Incorrect authentication data (set_id=sales)60.166.8.1741814991dO  -W% ossec13001gExim Auth failed2025-03-04 17:14:06 dovecot_plain authenticator failed for ([59.34.17.130]) [59.34.17.130]:53745: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)59.34.17.1301814991fN  -]% ossec13001gExim Auth failed2025-03-04 17:14:04 dovecot_plain authenticator failed for ([86.57.254.73]) [86.57.254.73]:33163: 535 Incorrect authentication data (set_id=services@heipowersystem.com)86.57.254.73630336 h " J Y { RVhjo  -_) ossec13001gQExim Auth failed2025-03-04 18:30:00 dovecot_plain authenticator failed for ([27.107.168.206]) [27.107.168.206]:44534: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)27.107.168.2061269750In  = + ossec13008g#Mail Reciepient rejected2025-03-04 18:29:14 H=(mail.saintsoldiercollege.com) [165.154.213.136]:61028 F= rejected RCPT : Rejected relay attempt: '165.154.213.136' From: 'ubxln@saintsoldiercollege.com' To: 'goofile@fastmail.com'165.154.213.1363469034mm  -e) ossec13001gExim Auth failed2025-03-04 18:27:55 dovecot_plain authenticator failed for ([121.168.210.98]) [121.168.210.98]:24769: 535 Incorrect authentication data (set_id=services@heipowersystem.com)121.168.210.981835841:l  Ak) ossec11302gFTP Authentication failed.Mar 4 18:22:31 vm1 pure-ftpd[2111180]: (?@152.32.208.169) [WARNING] Authentication failed for user [anonymous]152.32.208.1696252001)k 3U) ossec11301gNew FTP connection.Mar 4 18:22:22 vm1 pure-ftpd[2111169]: (?@152.32.208.169) [INFO] New connection from 152.32.208.169152.32.208.1696252001Yj  -=+ ossec13001gBExim Auth failed2025-03-04 18:21:13 dovecot_plain authenticator failed for ([154.205.146.118]) [154.205.146.118]:56958: 535 Incorrect authentication data (set_id=sales)154.205.146.118290291|i  -' ossec13001g8Exim Auth failed2025-03-04 18:21:04 dovecot_plain authenticator failed for (csub-24-224-69-119.mi-connection.com) [24.224.69.119]:60708: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)24.224.69.1196252001Zh  -?) ossec13001g"Exim Auth failed2025-03-04 18:12:08 dovecot_plain authenticator failed for ([112.102.48.161]) [112.102.48.161]:38934: 535 Incorrect authentication data (set_id=services)112.102.48.1611814991dg  -U' ossec13001gExim Auth failed2025-03-04 18:11:54 dovecot_plain authenticator failed for b217-29-190-97.pppoe.mark-itt.net [217.29.190.97]:54068: 535 Incorrect authentication data (set_id=sales)217.29.190.972017370df  -W% ossec13001g Exim Auth failed2025-03-04 18:11:44 dovecot_plain authenticator failed for ([88.87.84.104]) [88.87.84.104]:41768: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)88.87.84.1042017370me  -e) ossec13001gExim Auth failed2025-03-04 18:11:36 dovecot_plain authenticator failed for ([222.117.88.230]) [222.117.88.230]:53808: 535 Incorrect authentication data (set_id=services@heipowersystem.com)222.117.88.2301835841Zd  -?) ossec13001ggExim Auth failed2025-03-04 18:00:30 dovecot_plain authenticator failed for ([187.76.173.246]) [187.76.173.246]:35014: 535 Incorrect authentication data (set_id=services)187.76.173.2463469034mc  -e) ossec13001g[Exim Auth failed2025-03-04 18:00:18 dovecot_plain authenticator failed for ([67.213.230.122]) [67.213.230.122]:42128: 535 Incorrect authentication data (set_id=services@heipowersystem.com)67.213.230.1226252001Tb  -5' ossec13001gExim Auth failed2025-03-04 17:59:12 dovecot_plain authenticator failed for ([119.84.241.94]) [119.84.241.94]:41836: 535 Incorrect authentication data (set_id=sales)119.84.241.941814991ta  -s) ossec13001gExim Auth failed2025-03-04 17:58:26 dovecot_plain authenticator failed for 70.sub-166-155-210.myvzw.com [166.155.210.70]:55962: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)166.155.210.706252001q`  -k+ ossec13001g>Exim Auth failed2025-03-04 17:47:00 dovecot_plain authenticator failed for 189.115.230.179.dynamic.adsl.gvt.net.br [189.115.230.179]:33349: 535 Incorrect authentication data (set_id=services)189.115.230.1793469034m_  -e) ossec13001g0Exim Auth failed2025-03-04 17:46:47 dovecot_plain authenticator failed for ([112.102.48.217]) [112.102.48.217]:53774: 535 Incorrect authentication data (set_id=services@heipowersystem.com)112.102.48.2171814991 (4 \ w  T  -5' ossec13001g=Exim Auth failed2025-03-04 19:16:36 dovecot_plain authenticator failed for ([95.220.25.124]) [95.220.25.124]:60275: 535 Incorrect authentication data (set_id=sales)95.220.25.1242017370:~  =o) ossec13008g1Mail Reciepient rejected2025-03-04 19:16:24 H=(mail.gurukuljaipur.com) [165.154.226.98]:52834 F= rejected RCPT : Rejected relay attempt: '165.154.226.98' From: 'vcyxooab@gurukuljaipur.com' To: 'goofile@fastmail.com'165.154.226.981668284w}  -{' ossec13001g'Exim Auth failed2025-03-04 19:16:14 dovecot_plain authenticator failed for 62.174.139.16.static.user.ono.com [62.174.139.16]:57820: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)62.174.139.162510769|  -+ ossec13001gOExim Auth failed2025-03-04 19:04:06 dovecot_plain authenticator failed for 173-181-129-161-ent-barlow-staticipwest.wireless.telus.com [173.181.129.161]:42960: 535 Incorrect authentication data (set_id=services)173.181.129.1616251999m{  -e) ossec13001g7Exim Auth failed2025-03-04 19:03:41 dovecot_plain authenticator failed for ([186.138.219.91]) [186.138.219.91]:41853: 535 Incorrect authentication data (set_id=services@heipowersystem.com)186.138.219.913865483Tz  -5' ossec13001gExim Auth failed2025-03-04 19:01:03 dovecot_plain authenticator failed for ([179.40.18.220]) [179.40.18.220]:46241: 535 Incorrect authentication data (set_id=sales)179.40.18.2203865483jy  -_) ossec13001gExim Auth failed2025-03-04 19:00:46 dovecot_plain authenticator failed for ([121.189.226.81]) [121.189.226.81]:50636: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)121.189.226.811835841Vx  -9) ossec13001gExim Auth failed2025-03-04 18:49:16 dovecot_plain authenticator failed for ([94.201.236.143]) [94.201.236.143]:50150: 535 Incorrect authentication data (set_id=sales)94.201.236.143290557 w  -#+ ossec13001gExim Auth failed2025-03-04 18:48:38 dovecot_plain authenticator failed for (abts-kk-static-226.253.166.122.airtelbroadband.in) [122.166.253.226]:35928: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)122.166.253.2261269750Zv  -?) ossec13001gExim Auth failed2025-03-04 18:44:57 dovecot_login authenticator failed for ([195.122.224.64]) [195.122.224.64]:54976: 535 Incorrect authentication data (set_id=services)195.122.224.642017370gu  -]% ossec13001gExim Auth failed2025-03-04 18:44:34 dovecot_login authenticator failed for ([59.1.214.102]) [59.1.214.102]:42570: 535 Incorrect authentication data (set_id=services@heipowersystem.com)59.1.214.1021835841nt  -e+ ossec13001gExim Auth failed2025-03-04 18:41:26 dovecot_plain authenticator failed for 189.115.230.179.dynamic.adsl.gvt.net.br [189.115.230.179]:37215: 535 Incorrect authentication data (set_id=sales)189.115.230.1793469034as  -S# ossec13001gExim Auth failed2025-03-04 18:41:14 dovecot_plain authenticator failed for ([1.31.80.166]) [1.31.80.166]:33721: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)1.31.80.1661814991Tr  -7% ossec13001gExim Auth failed2025-03-04 18:39:50 dovecot_plain authenticator failed for ([58.22.255.28]) [58.22.255.28]:46769: 535 Incorrect authentication data (set_id=services)58.22.255.281814991pq  -i+ ossec13001gExim Auth failed2025-03-04 18:39:34 dovecot_plain authenticator failed for ([211.247.127.250]) [211.247.127.250]:53852: 535 Incorrect authentication data (set_id=services@heipowersystem.com)211.247.127.2501835841Tp  -5' ossec13001gaExim Auth failed2025-03-04 18:30:15 dovecot_plain authenticator failed for ([49.245.99.168]) [49.245.99.168]:42505: 535 Incorrect authentication data (set_id=sales)49.245.99.1681880251 n , G i ~  ?jsn  - + ossec13001gExim Auth failed2025-03-04 20:01:48 dovecot_plain authenticator failed for 189.115.230.179.dynamic.adsl.gvt.net.br [189.115.230.179]:43133: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)189.115.230.1793469034s  -s' ossec13001g Exim Auth failed2025-03-04 19:57:54 dovecot_plain authenticator failed for 116-240-97-42.dyn.ip.vocus.au [116.240.97.42]:40147: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)116.240.97.422077456Q  -1% ossec13001gExim Auth failed2025-03-04 19:58:20 dovecot_plain authenticator failed for ([27.24.141.90]) [27.24.141.90]:39028: 535 Incorrect authentication data (set_id=sales)27.24.141.901814991T  -7% ossec13001g Exim Auth failed2025-03-04 19:52:47 dovecot_plain authenticator failed for ([27.72.103.74]) [27.72.103.74]:60610: 535 Incorrect authentication data (set_id=services)27.72.103.741562822p  -i+ ossec13001g Exim Auth failed2025-03-04 19:52:32 dovecot_plain authenticator failed for ([116.228.195.251]) [116.228.195.251]:20172: 535 Incorrect authentication data (set_id=services@heipowersystem.com)116.228.195.2511814991Z  -?) ossec13001g Exim Auth failed2025-03-04 19:41:16 dovecot_plain authenticator failed for ([151.49.116.193]) [151.49.116.193]:42454: 535 Incorrect authentication data (set_id=services)151.49.116.1933175395m  -e) ossec13001g Exim Auth failed2025-03-04 19:41:03 dovecot_plain authenticator failed for ([128.185.253.90]) [128.185.253.90]:55882: 535 Incorrect authentication data (set_id=services@heipowersystem.com)128.185.253.901269750}  -' ossec13001g 3Exim Auth failed2025-03-04 19:37:46 dovecot_plain authenticator failed for syn-156-019-080-138.biz.spectrum.com [156.19.80.138]:58016: 535 Incorrect authentication data (set_id=services@heipowersystem.com)156.19.80.1386252001U  -7' ossec13001gIExim Auth failed2025-03-04 19:33:51 dovecot_plain authenticator failed for ([189.108.224.67]) [191.210.73.33]:46114: 535 Incorrect authentication data (set_id=sales)191.210.73.333469034d  -W% ossec13001g;Exim Auth failed2025-03-04 19:33:37 dovecot_plain authenticator failed for ([27.124.18.21]) [27.124.18.27]:59342: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)27.124.18.271269750l  -e) ossec13001gExim Auth failed2025-03-04 19:27:50 dovecot_plain authenticator failed for ([87.236.141.106]) [87.236.141.106]:43842: 535 Incorrect authentication data (set_id=services@heipowersystem.com)87.236.141.106290291n  -e+ ossec13001g`Exim Auth failed2025-03-04 19:25:43 dovecot_plain authenticator failed for net-188-219-104-210.cust.vodafonedsl.it [188.219.104.210]:48394: 535 Incorrect authentication data (set_id=sales)188.219.104.2103175395g  -[' ossec13001gXExim Auth failed2025-03-04 19:25:35 dovecot_plain authenticator failed for ([91.126.196.67]) [91.126.196.67]:44006: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)91.126.196.672510769Z  -=+ ossec13001gExim Auth failed2025-03-04 19:22:45 dovecot_login authenticator failed for ([183.224.122.114]) [183.224.122.114]:59824: 535 Incorrect authentication data (set_id=sales)183.224.122.1141814991a  -S# ossec13001gExim Auth failed2025-03-04 19:22:22 dovecot_login authenticator failed for ([1.70.158.32]) [1.70.158.32]:49223: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)1.70.158.321814991]  -C+ ossec13001gjExim Auth failed2025-03-04 19:17:20 dovecot_plain authenticator failed for ([175.206.105.126]) [175.206.105.126]:58972: 535 Incorrect authentication data (set_id=services)175.206.105.1261835841o  -i+ ossec13001g\Exim Auth failed2025-03-04 19:17:06 dovecot_plain authenticator failed for ([196.189.126.185]) [196.189.126.185]:55054: 535 Incorrect authentication data (set_id=services@heipowersystem.com)196.189.126.185337996 \*R ~tj`VLB8.$zpRH>4*   v l b X N D : 0 &    ~ t j ` V L B 8 . $    z p f \ R H > 4 *  vblXND:0&|rh^TJ@6,"xndZPF<2( ~tj`VLB8.$z\Rpf | r h ^ T J @ 6 , "    x n d Z P F < 2 (  f\H>4*  vlbXND:0& gWR gW: gWf gW` gT gT gR gQ gQu gQ gQ gO gO gO gN gL gL gJ gJ gJ ~ gI} gI| gI { gHz gHy gHx gHuw gHv gGu gGt gGs gGr gEq gEbp gENo gCn gCJm gAl gAk gAUj gACi g?h g?g g>f g>1e g;d g;c g;b g;(a g:` g9M_ g9A^ g8o] g8W\ g7[ g6Z g5pY g5NX g4nW g4nV g3U g2T g0S g0}R g/Q g/P g.O g.N g.M g-L g-6K g-(J g,I g,H g,ZG g,8F g+E g+D g*kC g*[B g(A g'@ g'? g'm> g&= g&|< g%; g%: g%:9 g%,8 g"7 g"6 g!5 g 4 g 3 g2 g1 g0 g/ g. g- g, g+ g* g) g( gH' g<& gI% gG$ g<# g" g! g g g  g0 g g g( g g| gE g3 g g gI g  gD g g g  g  g  g  g  g 3 gI g; g g` gX g g gj g\ g= g1 g' gO g7 g g g g g g g g g g ga gQ g# g g g gB g8 g" g g] gM gp3 gp% gmz gml gkx gjl gjU gh gg) gg gf~ gfj gf gf ge gd gd gd gbS ga ga ga g` g_v g_V g_J g_/ g_ g^ g^ g^v g^\ g^D g[ g[3 g[# gZ gY gXs gX] gX gW g  g gg g[ g g g> g0 g g g g g g g g g{ g gc gE g g g g g g gd gP g gW g7 g gO gG g g gޖ gފ g gݵ g# gs gp] gY gڅ gq g g gx gj g g g. g g  g gM g3 g! g  g g g gк gа g gp gs gg g g g gH g g g g g gA gů gř g= g]   1@`p  -i+ ossec13001gExim Auth failed2025-03-04 20:49:09 dovecot_plain authenticator failed for ([163.179.105.211]) [163.179.105.211]:53622: 535 Incorrect authentication data (set_id=services@heipowersystem.com)163.179.105.2111814991l  -c+ ossec13001gExim Auth failed2025-03-04 20:48:51 dovecot_plain authenticator failed for ([196.189.126.185]) [196.189.126.185]:46024: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)196.189.126.185337996j  -a' ossec13001g Exim Auth failed2025-03-04 20:36:51 dovecot_plain authenticator failed for ([37.28.177.141]) [37.28.177.141]:47324: 535 Incorrect authentication data (set_id=services@heipowersystem.com)37.28.177.1412017370W  -9) ossec13001g0Exim Auth failed2025-03-04 20:37:28 dovecot_plain authenticator failed for ([178.163.27.129]) [178.163.27.129]:57696: 535 Incorrect authentication data (set_id=sales)178.163.27.1292017370\  -A+ ossec13001gExim Auth failed2025-03-04 20:37:00 dovecot_plain authenticator failed for ([114.143.224.97]) [182.156.135.216]:34173: 535 Incorrect authentication data (set_id=services)182.156.135.2161269750m  -c+ ossec13001gExim Auth failed2025-03-04 20:36:42 dovecot_plain authenticator failed for ([114.243.136.120]) [114.243.136.120]:39604: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)114.243.136.1201814991V  -;' ossec13001g(Exim Auth failed2025-03-04 20:28:47 dovecot_plain authenticator failed for ([213.55.79.199]) [213.55.79.195]:60106: 535 Incorrect authentication data (set_id=services)213.55.79.195337996m  -e) ossec13001gExim Auth failed2025-03-04 20:28:35 dovecot_plain authenticator failed for ([175.125.68.208]) [175.125.68.208]:45967: 535 Incorrect authentication data (set_id=services@heipowersystem.com)175.125.68.2081835841  W!+ ossec9708g|Dovecot Aborted Login with empty userMar 4 20:25:54 vm1 dovecot[312763]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=185.247.137.217, lip=103.74.54.108, TLS, session=185.247.137.217298795W  -;' ossec13001gEExim Auth failed2025-03-04 20:20:45 dovecot_plain authenticator failed for ([41.67.143.142]) [41.67.143.142]:51966: 535 Incorrect authentication data (set_id=services)41.67.143.1422328926}  -) ossec13001g3Exim Auth failed2025-03-04 20:20:27 dovecot_plain authenticator failed for (116.68.197.124.unknown.m1.com.sg) [124.197.68.116]:43626: 535 Incorrect authentication data (set_id=services@heipowersystem.com)124.197.68.1161880251T  -5' ossec13001gExim Auth failed2025-03-04 20:18:30 dovecot_plain authenticator failed for ([46.52.204.227]) [46.52.204.227]:33410: 535 Incorrect authentication data (set_id=sales)46.52.204.2272017370|  -) ossec13001gExim Auth failed2025-03-04 20:18:14 dovecot_plain authenticator failed for syn-098-102-148-242.biz.spectrum.com [98.102.148.242]:33414: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)98.102.148.2426252001B  =) ossec13008gIMail Reciepient rejected2025-03-04 20:12:16 H=(mail.thepsindustries.com) [165.154.226.38]:52645 F= rejected RCPT : Rejected relay attempt: '165.154.226.38' From: 'cpqwfqfmc@thepsindustries.com' To: 'goofile@fastmail.com'165.154.226.381668284r  -q' ossec13001g Exim Auth failed2025-03-04 20:11:16 dovecot_plain authenticator failed for ([60.29.100.218]) [60.29.100.218]:43651: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)60.29.100.2181814991m  -e) ossec13001gDExim Auth failed2025-03-04 20:03:40 dovecot_plain authenticator failed for ([220.80.192.168]) [220.80.192.168]:57660: 535 Incorrect authentication data (set_id=services@heipowersystem.com)220.80.192.1681835841 M& 2 8 d y ~*GMv1  -w) ossec13001gExim Auth failed2025-03-04 21:10:02 dovecot_login authenticator failed for (amplifypowerglobal.com) [60.167.170.146]:56384: 535 Incorrect authentication data (set_id=support@amplifypowerglobal.com)60.167.170.1461814991_0  -I) ossec13001gExim Auth failed2025-03-04 21:09:37 dovecot_login authenticator failed for (amplifypowerglobal.com) [60.167.170.146]:54026: 535 Incorrect authentication data (set_id=nologin)60.167.170.1461814991c/  -Q) ossec13001gExim Auth failed2025-03-04 21:09:28 dovecot_login authenticator failed for (hn.kd.ny.adsl) [218.29.239.174]:59352: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)218.29.239.1741814991r.  -u% ossec13001gExim Auth failed2025-03-04 21:09:18 dovecot_login authenticator failed for ([2.55.122.202]) [2.55.122.202]:53167: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)2.55.122.202294640Y-  -=) ossec13001gExim Auth failed2025-03-04 21:06:25 dovecot_login authenticator failed for zdomainaccess.com [216.70.114.230]:41180: 535 Incorrect authentication data (set_id=services)216.70.114.2306252001m,  -e) ossec13001gExim Auth failed2025-03-04 21:05:59 dovecot_login authenticator failed for ([119.200.229.33]) [119.200.229.33]:50203: 535 Incorrect authentication data (set_id=services@heipowersystem.com)119.200.229.331835841W+  -;' ossec13001gExim Auth failed2025-03-04 21:04:50 dovecot_plain authenticator failed for ([219.248.65.30]) [219.248.65.30]:54464: 535 Incorrect authentication data (set_id=services)219.248.65.301835841m*  -e) ossec13001gExim Auth failed2025-03-04 21:04:25 dovecot_plain authenticator failed for ([103.218.132.27]) [103.218.132.27]:45278: 535 Incorrect authentication data (set_id=services@heipowersystem.com)103.218.132.271269750j)  -a' ossec13001gExim Auth failed2025-03-04 21:02:06 dovecot_plain authenticator failed for ([213.128.4.213]) [213.128.4.213]:58114: 535 Incorrect authentication data (set_id=services@heipowersystem.com)213.128.4.2132017370k(  -_+ ossec13001gExim Auth failed2025-03-04 21:02:35 dovecot_plain authenticator failed for 158.160.200.177.netflexisp.com.br [177.200.160.158]:52373: 535 Incorrect authentication data (set_id=services)177.200.160.1583469034w' -w) ossec13001gHExim Auth failed2025-03-04 20:59:11 dovecot_login authenticator failed for (undefined.hostname.localhost) [120.138.121.18]:36826: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)120.138.121.181269750g&  -[' ossec13001g<Exim Auth failed2025-03-04 20:58:58 dovecot_login authenticator failed for ([118.38.239.52]) [118.38.239.52]:44044: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)118.38.239.521835841P%  -1% ossec13001gIExim Auth failed2025-03-04 20:54:56 dovecot_plain authenticator failed for ([197.87.10.83]) [197.87.10.83]:33096: 535 Incorrect authentication data (set_id=sales)197.87.10.83953987v$  -y' ossec13001gGExim Auth failed2025-03-04 20:54:55 dovecot_plain authenticator failed for ([1.227.228.136]) [1.227.228.136]:57906: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)1.227.228.1361835841p#  -q# ossec13001g<Exim Auth failed2025-03-04 20:54:43 dovecot_plain authenticator failed for 37.151.71.8.dynamic.telecom.kz [37.151.71.8]:55573: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)37.151.71.81522867^"  -I) ossec13001gExim Auth failed2025-03-04 20:52:17 dovecot_plain authenticator failed for ip-188-127-16-197.ennet.pl [188.127.16.197]:54086: 535 Incorrect authentication data (set_id=sales)188.127.16.197798544t!  -s) ossec13001gExim Auth failed2025-03-04 20:52:01 dovecot_plain authenticator failed for 17.sub-166-248-194.myvzw.com [166.248.194.17]:52240: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)166.248.194.176252001 \ ' 6 K s p>]\}B  -' ossec13001g*[Exim Auth failed2025-03-04 21:59:14 dovecot_plain authenticator failed for (24.115.19.225.res-cmts.sm3.ptd.net) [24.115.19.225]:36298: 535 Incorrect authentication data (set_id=services@heipowersystem.com)24.115.19.2256252001]A -C) ossec13001g(Exim Auth failed2025-03-04 21:53:18 dovecot_login authenticator failed for (thepsindustries.com) [101.89.140.209]:52912: 535 Incorrect authentication data (set_id=nologin)101.89.140.2091814991W@  -9) ossec13001g'Exim Auth failed2025-03-04 21:48:30 dovecot_plain authenticator failed for ([110.49.145.233]) [110.49.145.233]:37974: 535 Incorrect authentication data (set_id=sales)110.49.145.2331605651f?  -Y' ossec13001g'Exim Auth failed2025-03-04 21:48:03 dovecot_plain authenticator failed for ([120.24.83.156]) [223.104.199.0]:2186: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)223.104.199.01814991p>  -i+ ossec13001g'mExim Auth failed2025-03-04 21:46:43 dovecot_plain authenticator failed for ([121.178.185.141]) [121.178.185.141]:34034: 535 Incorrect authentication data (set_id=services@heipowersystem.com)121.178.185.1411835841Y=  -=) ossec13001g&Exim Auth failed2025-03-04 21:43:04 dovecot_plain authenticator failed for ([222.128.44.171]) [222.128.44.171]:2058: 535 Incorrect authentication data (set_id=services)222.128.44.1711814991m<  -e) ossec13001g&|Exim Auth failed2025-03-04 21:42:44 dovecot_plain authenticator failed for ([186.237.145.18]) [186.237.145.18]:41392: 535 Incorrect authentication data (set_id=services@heipowersystem.com)186.237.145.183469034b;  -Q' ossec13001g%Exim Auth failed2025-03-04 21:39:43 dovecot_plain authenticator failed for host146.sub-63-40-199.myvzw.com [63.40.199.146]:16836: 535 Incorrect authentication data (set_id=sales)63.40.199.1466252001^:  -O! ossec13001g%Exim Auth failed2025-03-04 21:39:32 dovecot_plain authenticator failed for ([1.25.18.18]) [1.25.18.18]:32876: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)1.25.18.181814991_9  -K' ossec13001g%:Exim Auth failed2025-03-04 21:37:20 dovecot_login authenticator failed for ([61.136.142.13]) [61.136.142.13]:34734: 535 Incorrect authentication data (set_id=vikas.khandelwal)61.136.142.1318149918  - ' ossec13001g%,Exim Auth failed2025-03-04 21:37:07 dovecot_login authenticator failed for p7001156-ipoefx.ipoe.ocn.ne.jp [118.3.227.155]:42600: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)118.3.227.1551861060T7  -5' ossec13001g"Exim Auth failed2025-03-04 21:26:44 dovecot_plain authenticator failed for ([103.47.74.210]) [103.47.74.210]:52902: 535 Incorrect authentication data (set_id=sales)103.47.74.2101269750g6  -[' ossec13001g"Exim Auth failed2025-03-04 21:26:30 dovecot_plain authenticator failed for ([223.210.27.53]) [223.210.27.53]:51112: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)223.210.27.531814991m5  -e) ossec13001g!Exim Auth failed2025-03-04 21:23:25 dovecot_plain authenticator failed for ([118.123.116.93]) [118.123.116.93]:39009: 535 Incorrect authentication data (set_id=services@heipowersystem.com)118.123.116.931814991T4  -5' ossec13001g Exim Auth failed2025-03-04 21:17:40 dovecot_plain authenticator failed for ([14.53.126.112]) [14.53.126.112]:57140: 535 Incorrect authentication data (set_id=sales)14.53.126.11218358413  --+ ossec13001g Exim Auth failed2025-03-04 21:17:12 dovecot_plain authenticator failed for lnsm1-torontoxn-142-116-116-160.internet.virginmobile.ca [142.116.116.160]:40374: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)142.116.116.1606251999g2  -[' ossec13001gExim Auth failed2025-03-04 21:12:58 dovecot_plain authenticator failed for ([50.238.55.194]) [50.238.55.194]:30438: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)50.238.55.1946252001 ") > S s jR  -_) ossec13001g0}Exim Auth failed2025-03-04 22:25:24 dovecot_plain authenticator failed for ([111.48.208.197]) [111.48.208.197]:42250: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)111.48.208.1971814991ZQ  -?) ossec13001g/Exim Auth failed2025-03-04 22:21:56 dovecot_plain authenticator failed for ([222.117.88.230]) [222.117.88.230]:51824: 535 Incorrect authentication data (set_id=services)222.117.88.2301835841vP  -{% ossec13001g/Exim Auth failed2025-03-04 22:21:15 dovecot_plain authenticator failed for 111-70-1-159.emome-ip.hinet.net [111.70.1.159]:52701: 535 Incorrect authentication data (set_id=services@heipowersystem.com)111.70.1.1591668284WO  -9) ossec13001g.Exim Auth failed2025-03-04 22:19:02 dovecot_plain authenticator failed for ([191.59.206.191]) [191.59.206.191]:38308: 535 Incorrect authentication data (set_id=sales)191.59.206.1913469034iN  -_) ossec13001g.Exim Auth failed2025-03-04 22:18:45 dovecot_plain authenticator failed for ([94.204.230.214]) [94.204.230.214]:60455: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)94.204.230.214290557FM  =+ ossec13008g.Mail Reciepient rejected2025-03-04 22:14:54 H=(mail.amplifypowerglobal.com) [165.154.226.104]:50108 F= rejected RCPT : Rejected relay attempt: '165.154.226.104' From: 'epkyz@amplifypowerglobal.com' To: 'goofile@fastmail.com'165.154.226.1041668284}L  -' ossec13001g-Exim Auth failed2025-03-04 22:13:53 dovecot_login authenticator failed for broadband-188-32-170-20.ip.moscow.rt.ru [188.32.170.20]:49902: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)188.32.170.202017370]K  -C+ ossec13001g-6Exim Auth failed2025-03-04 22:11:26 dovecot_plain authenticator failed for ([181.174.200.138]) [181.174.200.138]:22342: 535 Incorrect authentication data (set_id=services)181.174.200.1383865483jJ  -a' ossec13001g-(Exim Auth failed2025-03-04 22:11:12 dovecot_plain authenticator failed for ([186.179.80.12]) [186.179.80.12]:35158: 535 Incorrect authentication data (set_id=services@heipowersystem.com)186.179.80.123895114ZI  -=+ ossec13001g,Exim Auth failed2025-03-04 22:09:55 dovecot_plain authenticator failed for ([175.145.232.217]) [175.145.232.217]:53370: 535 Incorrect authentication data (set_id=sales)175.145.232.2171733045gH  -[' ossec13001g,Exim Auth failed2025-03-04 22:09:41 dovecot_plain authenticator failed for ([49.245.10.228]) [49.245.10.228]:43417: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)49.245.10.2281880251\G  -A+ ossec13001g,ZExim Auth failed2025-03-04 22:07:44 dovecot_plain authenticator failed for ([181.174.200.138]) [181.174.200.138]:9721: 535 Incorrect authentication data (set_id=services)181.174.200.1383865483gF  -]% ossec13001g,8Exim Auth failed2025-03-04 22:07:11 dovecot_plain authenticator failed for ([87.117.32.22]) [87.117.32.22]:57308: 535 Incorrect authentication data (set_id=services@heipowersystem.com)87.117.32.222017370gE  -[' ossec13001g+Exim Auth failed2025-03-04 22:04:59 dovecot_plain authenticator failed for syn-172-090-128-097.res.spectrum.com [172.90.128.97]:62284: 535 Incorrect authentication data (set_id=sales)172.90.128.976252001uD  -y% ossec13001g+Exim Auth failed2025-03-04 22:04:32 dovecot_plain authenticator failed for 95-30-250-44.broadband.corbina.ru [95.30.250.44]:60038: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)95.30.250.442017370ZC  -?) ossec13001g*kExim Auth failed2025-03-04 21:59:30 dovecot_plain authenticator failed for ([213.255.219.43]) [213.255.219.43]:50090: 535 Incorrect authentication data (set_id=services)213.255.219.432782113 w~qdWJ=0# zm`SF9,w v i \ O B 5 (    s f Y L ? 2 %   | o b U H ; . !   x k ^ Q D 7 *     u h [ N A 4 ' ~qdWJ=0# zm`SF9,vi\OB5(reXK>1$ {naTG:-  2328926O 2464461O 2328926N` 2328926N_ 2328926N^ 2464461NH 2413451M 2440476M5 2510769H 2510769G 2510769G 2510769G 2510769E 2510769Do 2510769D 2510769B 2510769A 2510769? 2510769? 2510769? 2510769? 2510769> 2510769= 2510769=} 2510769=S 2510769< 2510769; 2510769; 2510769;| 25107699 25107697 251076977 25107696 25107696} 251076967 25107696 25107695 25107695T 25107694 25107694k 25107694 25107693 25107693h 25107693` 25107693 25107692 25107691 2510769/I 2510769. 2510769.P 2510769,! 2510769) 2510769) 2510769(? 2510769($ 2510769' 2510769' 2510769% 2510769% 2510769$j 2510769#S 2510769#Q 2510769" 2510769" 2510769! 2510769! 2510769 2510769x 2510769Z 2510769B 2510769 2510769 2510769 2510769 2510769V 2510769 2510769 2510769 2510769 2510769 2510769 2510769 2510769 2510769 2510769s 2510769Y 2510769M 2510769 2510769] 2510769i 2510769 2510769T 2510769 2510769 2510769 2510769d 2510769 2510769 2510769 2510769 2510769 2510769 2510769 2510769> 2510769 2510769 2510769 2510769  2464461J 2400553I 2395170H 2510769 2510769 2510769 2510769 2510769 2510769 2510769 2510769i 2510769 248816? 2464461D_ 2464461DV 2464461B 2464461@E 2464461? 24644619 24644615{ 24644612 24644610 2464461/U 2464461/ 2464461-2 2464461+ 2464461*] 2464461( 2464461' 2464461'1 2464461& 2464461&K 2464461&$ 2464461#7 2464461# 2464461" 2464461!8 2464461  2464461Z 2464461 2464461 2464461 2464461 2464461? 2453866H 2440476;8 2440476 24404766 2440476 2440476 2440476w 2434508$ 2434508 2434508 2413451. 2413451. 2413451.s 2413451- 2413451,] 2413451,R 2413451* 2413451( 2413451' 2413451' 2413451$ 2413451$ 2413451!\ 2413451 24134512 2413451e 2413451g 2413451 2413451X 2413451( 2413451 241170Fq 24005538 2400553& 2400553% 2400553$ 2400553 2400553 2400553 2400553 2400553/ 2400553 2400553" 2400553 2400553 23951700 2395170. 2395170,F 2395170+ 2395170+ 2395170* 2395170 2395170 2395170 23951707 2395170 2363686> 2328926F 2328926D( 2328926B 2328926BM 2328926@ 2328926> 2328926>T 2328926< 23289265 23289265* 23289263 23289260 23289260k 2328926.* 2328926* 2328926* 2328926* 2328926(1 2328926& 2328926%4 2328926#6 2328926" 2328926" 2328926! 2328926! 2328926 2328926 s 2328926 E 2328926X 2328926 2328926 2328926 2328926j 2328926 2328926 2328926{ 2328926A 2328926 Q"   /Z_~`BQmb  -e) ossec13001g;Exim Auth failed2025-03-04 23:12:37 dovecot_plain authenticator failed for ([218.150.170.10]) [218.150.170.10]:38608: 535 Incorrect authentication data (set_id=services@heipowersystem.com)218.150.170.101835841a  W% ossec9708g;(Dovecot Aborted Login with empty userMar 4 23:10:55 vm1 dovecot[312763]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=71.6.134.231, lip=103.74.54.108, TLS, session=71.6.134.2316252001`  W% ossec9708g:Dovecot Aborted Login with empty userMar 4 23:06:16 vm1 dovecot[312763]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=203.55.131.5, lip=103.74.54.108, TLS, session=203.55.131.56252001]_  -C+ ossec13001g9MExim Auth failed2025-03-04 23:03:01 dovecot_plain authenticator failed for ([211.198.178.191]) [211.198.178.191]:44816: 535 Incorrect authentication data (set_id=services)211.198.178.1911835841w^  -w+ ossec13001g9AExim Auth failed2025-03-04 23:02:49 dovecot_plain authenticator failed for (106.51.70.231.actcorp.in) [180.151.254.218]:43818: 535 Incorrect authentication data (set_id=services@heipowersystem.com)180.151.254.2181269750Q]  -1% ossec13001g8oExim Auth failed2025-03-04 22:59:19 dovecot_plain authenticator failed for ([60.172.53.82]) [60.172.53.82]:58383: 535 Incorrect authentication data (set_id=sales)60.172.53.821814991b\  -W% ossec13001g8WExim Auth failed2025-03-04 22:58:55 dovecot_plain authenticator failed for ([65.20.129.71]) [65.20.129.71]:51019: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)65.20.129.7199237d[  -W% ossec13001g7Exim Auth failed2025-03-04 22:53:27 dovecot_plain authenticator failed for ([101.13.4.119]) [101.13.4.119]:58894: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)101.13.4.1191668284iZ  -_) ossec13001g6Exim Auth failed2025-03-04 22:52:47 dovecot_plain authenticator failed for ([178.172.225.52]) [178.172.225.52]:55950: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)178.172.225.52630336WY  -;' ossec13001g5pExim Auth failed2025-03-04 22:46:31 dovecot_plain authenticator failed for ([47.206.95.195]) [47.206.95.195]:50926: 535 Incorrect authentication data (set_id=services)47.206.95.1956252001jX  -a' ossec13001g5NExim Auth failed2025-03-04 22:45:57 dovecot_plain authenticator failed for ([58.57.154.146]) [58.57.154.146]:42590: 535 Incorrect authentication data (set_id=services@heipowersystem.com)58.57.154.1461814991QW  U) ossec11001g4nDeferred login on the cpanel service[2025-03-04 22:42:13 +0530] info [whostmgrd] 106.206.136.85 - root "GET /cpsess1369878617/scripts4/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: cookie ip check: IP address has changed: IP Address [106.206.136.79] != Current IP Address [106.206.136.85]106.206.136.851269750V  5') ossec11011g4nWHM SSO login failed[2025-03-04 22:42:13 +0530] info [whostmgrd] 106.206.136.85 PURGE root:0UUrUjt6xyJhqxK8 badpass [cookie ip check: IP address has changed: IP Address [106.206.136.79] != Current IP Address [106.206.136.85]]106.206.136.851269750yU  -' ossec13001g3Exim Auth failed2025-03-04 22:38:56 dovecot_plain authenticator failed for syn-097-086-134-216.res.spectrum.com [97.86.134.216]:2341: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)97.86.134.2166252001T  -+ ossec13001g2Exim Auth failed2025-03-04 22:33:59 dovecot_plain authenticator failed for 123-195-225-182.dynamic.kbronet.com.tw [123.195.225.182]:52708: 535 Incorrect authentication data (set_id=services@heipowersystem.com)123.195.225.1821668284ZS  -=+ ossec13001g0Exim Auth failed2025-03-04 22:25:35 dovecot_plain authenticator failed for ([163.179.105.211]) [163.179.105.211]:36442: 535 Incorrect authentication data (set_id=sales)163.179.105.2111814991 * @ C U z zzXr  -?% ossec13001gGExim Auth failed2025-03-05 00:04:31 dovecot_login authenticator failed for (fablixsolutions.com) [60.2.243.174]:60584: 535 Incorrect authentication data (set_id=nologin)60.2.243.1741814991jq  -a' ossec13001gEExim Auth failed2025-03-04 23:56:35 dovecot_plain authenticator failed for ([58.49.113.138]) [58.49.113.138]:13853: 535 Incorrect authentication data (set_id=services@heipowersystem.com)58.49.113.1381814991Vp  -7) ossec13001gEbExim Auth failed2025-03-04 23:54:34 dovecot_plain authenticator failed for mail-02.03.perm.ru [46.146.210.180]:6858: 535 Incorrect authentication data (set_id=sales)46.146.210.1802017370go  -[' ossec13001gENExim Auth failed2025-03-04 23:54:13 dovecot_plain authenticator failed for ([183.47.48.178]) [183.47.48.178]:35607: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)183.47.48.1781814991In  = ) ossec13008gCMail Reciepient rejected2025-03-04 23:47:22 H=(mail.uttamclassesjaipur.com) [165.154.213.54]:55543 F= rejected RCPT : Rejected relay attempt: '165.154.213.54' From: 'hlacydxy@uttamclassesjaipur.com' To: 'goofile@fastmail.com'165.154.213.543469034gm  -[' ossec13001gCJExim Auth failed2025-03-04 23:45:37 dovecot_plain authenticator failed for ([120.237.54.87]) [120.237.54.87]:36921: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)120.237.54.871814991\l  -A+ ossec13001gAExim Auth failed2025-03-04 23:39:52 dovecot_plain authenticator failed for ([114.143.224.97]) [182.156.135.216]:22829: 535 Incorrect authentication data (set_id=services)182.156.135.2161269750k  -+ ossec13001gAExim Auth failed2025-03-04 23:39:33 dovecot_plain authenticator failed for 123-195-225-182.dynamic.kbronet.com.tw [123.195.225.182]:59468: 535 Incorrect authentication data (set_id=services@heipowersystem.com)123.195.225.1821668284]j  -C+ ossec13001gAUExim Auth failed2025-03-04 23:37:16 dovecot_plain authenticator failed for ([197.149.125.227]) [197.149.125.227]:44836: 535 Incorrect authentication data (set_id=services)197.149.125.2272328926|i  -) ossec13001gACExim Auth failed2025-03-04 23:36:59 dovecot_plain authenticator failed for 83-233-242-245.cust.bredband2.com [83.233.242.245]:44514: 535 Incorrect authentication data (set_id=services@heipowersystem.com)83.233.242.2452661886Wh  -9) ossec13001g?Exim Auth failed2025-03-04 23:29:56 dovecot_plain authenticator failed for ([176.192.250.81]) [176.192.250.81]:57072: 535 Incorrect authentication data (set_id=sales)176.192.250.812017370jg  -_) ossec13001g?Exim Auth failed2025-03-04 23:29:46 dovecot_plain authenticator failed for ([125.136.163.86]) [125.136.163.86]:48394: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)125.136.163.861835841yf  -}) ossec13001g>Exim Auth failed2025-03-04 23:25:37 dovecot_plain authenticator failed for 110-25-105-242.adsl.fetnet.net [110.25.105.242]:57872: 535 Incorrect authentication data (set_id=services@heipowersystem.com)110.25.105.2421668284fe  -[' ossec13001g>1Exim Auth failed2025-03-04 23:23:51 dovecot_plain authenticator failed for ([185.167.56.24]) [185.167.56.24]:40616: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)185.167.56.24617790Vd  -7) ossec13001g;Exim Auth failed2025-03-04 23:13:01 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.152.249]:58124: 535 Incorrect authentication data (set_id=sales)191.36.152.2493469034xc  -}' ossec13001g;Exim Auth failed2025-03-04 23:12:45 dovecot_plain authenticator failed for 90-230-168-26-no600.tbcn.telia.com [90.230.168.26]:60944: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)90.230.168.262661886 z 9 AGJFcxz  W' ossec9708gNDovecot Aborted Login with empty userMar 5 00:33:33 vm1 dovecot[312763]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 7 secs): user=<>, rip=87.236.176.31, lip=103.74.54.108, TLS, session=87.236.176.312635167Z  -=+ ossec13001gLExim Auth failed2025-03-05 00:26:50 dovecot_plain authenticator failed for ([103.231.163.154]) [103.231.163.154]:50611: 535 Incorrect authentication data (set_id=sales)103.231.163.1541210997g  -[' ossec13001gLExim Auth failed2025-03-05 00:26:41 dovecot_plain authenticator failed for ([119.84.241.94]) [119.84.241.94]:46274: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)119.84.241.941814991_  -O# ossec13001gJExim Auth failed2025-03-05 00:17:15 dovecot_plain authenticator failed for 95-31-6-109.static.corbina.ru [95.31.6.109]:59636: 535 Incorrect authentication data (set_id=services)95.31.6.1092017370  - ' ossec13001gJExim Auth failed2025-03-05 00:16:57 dovecot_plain authenticator failed for ip4d16b6e6.dynamic.kabel-deutschland.de [77.22.182.230]:49460: 535 Incorrect authentication data (set_id=services@heipowersystem.com)77.22.182.2302921044y~  -}) ossec13001gJ Exim Auth failed2025-03-05 00:14:29 dovecot_plain authenticator failed for 57-132-150-162.dyn.grandenetworks.net [57.132.150.162]:41104: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)57.132.150.1626252001v}  -y' ossec13001gIExim Auth failed2025-03-05 00:14:13 dovecot_plain authenticator failed for ([41.74.140.107]) [41.74.140.107]:36903: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)41.74.140.1073374766Z|  -=+ ossec13001gIExim Auth failed2025-03-05 00:10:25 dovecot_plain authenticator failed for ([222.236.155.146]) [222.236.155.146]:43342: 535 Incorrect authentication data (set_id=sales)222.236.155.1461835841d{  -W% ossec13001gI Exim Auth failed2025-03-05 00:10:13 dovecot_plain authenticator failed for ([27.124.18.21]) [27.124.18.27]:59300: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)27.124.18.271269750lz  -c) ossec13001gHExim Auth failed2025-03-05 00:09:39 dovecot_plain authenticator failed for syn-172-248-047-114.res.spectrum.com [172.248.47.114]:41356: 535 Incorrect authentication data (set_id=services)172.248.47.1146252001ly  -e) ossec13001gHExim Auth failed2025-03-05 00:09:23 dovecot_plain authenticator failed for ([168.167.55.230]) [168.167.55.230]:45771: 535 Incorrect authentication data (set_id=services@heipowersystem.com)168.167.55.230933860Sx  -5' ossec13001gHExim Auth failed2025-03-05 00:07:56 dovecot_plain authenticator failed for ([91.219.196.17]) [91.219.196.17]:51204: 535 Incorrect authentication data (set_id=sales)91.219.196.17690791mw  -c+ ossec13001gHuExim Auth failed2025-03-05 00:07:39 dovecot_plain authenticator failed for ([182.224.231.102]) [182.224.231.102]:42030: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)182.224.231.1021835841v  ?1 ossec1008gHProcess exiting (killed).Mar 5 00:06:01 vm1 spamd[1580217]: spamd: server killed by SIGTERM, shutting downWu  -9) ossec13001gGExim Auth failed2025-03-05 00:05:05 dovecot_plain authenticator failed for ([220.119.126.81]) [220.119.126.81]:33541: 535 Incorrect authentication data (set_id=sales)220.119.126.811835841lt  -g% ossec13001gGExim Auth failed2025-03-05 00:04:57 dovecot_login authenticator failed for (fablixsolutions.com) [60.2.243.174]:35552: 535 Incorrect authentication data (set_id=support@fablixsolutions.com)60.2.243.1741814991xs  -{) ossec13001gGExim Auth failed2025-03-05 00:04:54 dovecot_plain authenticator failed for 89-179-241-253.static.corbina.ru [89.179.241.253]:59248: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)89.179.241.2532017370 f! G i e w &Kfa  -S# ossec13001gX]Exim Auth failed2025-03-05 01:15:32 dovecot_plain authenticator failed for ([47.91.88.67]) [47.91.88.67]:36768: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)47.91.88.672921044W  -;' ossec13001gXExim Auth failed2025-03-05 01:14:17 dovecot_plain authenticator failed for ([1.244.246.221]) [1.244.246.221]:42192: 535 Incorrect authentication data (set_id=services)1.244.246.2211835841g  -]% ossec13001gWExim Auth failed2025-03-05 01:13:47 dovecot_plain authenticator failed for ([59.1.214.102]) [59.1.214.102]:59278: 535 Incorrect authentication data (set_id=services@heipowersystem.com)59.1.214.1021835841  - ) ossec13001gWRExim Auth failed2025-03-05 01:11:06 dovecot_plain authenticator failed for 57-132-150-162.dyn.grandenetworks.net [57.132.150.162]:42824: 535 Incorrect authentication data (set_id=services@heipowersystem.com)57.132.150.1626252001y  -% ossec13001gW:Exim Auth failed2025-03-05 01:10:42 dovecot_plain authenticator failed for 32.104.29.34.bc.googleusercontent.com [34.29.104.32]:36378: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)34.29.104.326252001Z  -?) ossec13001gWfExim Auth failed2025-03-05 01:11:26 dovecot_plain authenticator failed for ([178.178.222.47]) [178.178.222.47]:45462: 535 Incorrect authentication data (set_id=services)178.178.222.472017370j  -]+ ossec13001gW`Exim Auth failed2025-03-05 01:11:19 dovecot_plain authenticator failed for (172.183.199.112.unknown.m1.com.sg) [112.199.183.172]:33989: 535 Incorrect authentication data (set_id=sales)112.199.183.1721880251\  -C+ ossec13001gTExim Auth failed2025-03-05 01:00:12 dovecot_plain authenticator failed for ([196.191.212.232]) [196.191.212.232]:42300: 535 Incorrect authentication data (set_id=services)196.191.212.232337996i  -_' ossec13001gTExim Auth failed2025-03-05 00:59:30 dovecot_plain authenticator failed for ([58.250.157.83]) [58.250.157.83]:2056: 535 Incorrect authentication data (set_id=services@heipowersystem.com)58.250.157.831814991j  -_) ossec13001gRExim Auth failed2025-03-05 00:51:44 dovecot_plain authenticator failed for mail-02.03.perm.ru [46.146.210.180]:46005: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)46.146.210.1802017370Z  -=+ ossec13001gQExim Auth failed2025-03-05 00:46:40 dovecot_plain authenticator failed for ([180.188.143.166]) [180.188.143.166]:60880: 535 Incorrect authentication data (set_id=sales)180.188.143.1661819730j  -_) ossec13001gQuExim Auth failed2025-03-05 00:46:05 dovecot_plain authenticator failed for ([27.123.242.252]) [27.123.242.252]:43168: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)27.123.242.2521269750  - ' ossec13001gQExim Auth failed2025-03-05 00:44:11 dovecot_plain authenticator failed for broadband-46-242-107-60.ip.moscow.rt.ru [46.242.107.60]:58578: 535 Incorrect authentication data (set_id=services@heipowersystem.com)46.242.107.602017370Z  -?) ossec13001gQExim Auth failed2025-03-05 00:44:26 dovecot_plain authenticator failed for ([212.220.113.55]) [212.220.113.55]:54372: 535 Incorrect authentication data (set_id=services)212.220.113.552017370V  -9) ossec13001gOExim Auth failed2025-03-05 00:38:42 dovecot_plain authenticator failed for ([212.90.111.127]) [212.90.111.127]:36657: 535 Incorrect authentication data (set_id=sales)212.90.111.127294640m  -c+ ossec13001gOExim Auth failed2025-03-05 00:38:06 dovecot_plain authenticator failed for ([121.152.119.174]) [121.152.119.174]:60868: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)121.152.119.1741835841j  -a' ossec13001gOExim Auth failed2025-03-05 00:37:57 dovecot_plain authenticator failed for ([200.11.109.32]) [200.11.109.32]:58095: 535 Incorrect authentication data (set_id=services@heipowersystem.com)200.11.109.323469034 (7 \ h  %4\nu%  -u) ossec13001g`Exim Auth failed2025-03-05 01:52:03 dovecot_login authenticator failed for ([114.247.207.98]) [114.247.207.98]:35042: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)114.247.207.981814991c$  -W# ossec13001g_vExim Auth failed2025-03-05 01:45:49 dovecot_plain authenticator failed for 18.red-83-48-39.staticip.rima-tde.net [83.48.39.18]:3598: 535 Incorrect authentication data (set_id=sales)83.48.39.182510769j#  -_) ossec13001g_VExim Auth failed2025-03-05 01:45:17 dovecot_plain authenticator failed for ([192.34.128.202]) [192.34.128.202]:43816: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)192.34.128.2026252001T"  -5' ossec13001g_JExim Auth failed2025-03-05 01:45:06 dovecot_plain authenticator failed for ([101.58.144.50]) [101.58.144.50]:42233: 535 Incorrect authentication data (set_id=sales)101.58.144.503175395m!  -c+ ossec13001g_/Exim Auth failed2025-03-05 01:44:37 dovecot_plain authenticator failed for ([119.206.117.105]) [119.206.117.105]:45646: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)119.206.117.1051835841l  -c) ossec13001g_Exim Auth failed2025-03-05 01:43:54 dovecot_plain authenticator failed for syn-035-130-111-146.biz.spectrum.com [35.130.111.146]:45726: 535 Incorrect authentication data (set_id=services)35.130.111.1466252001t  -w% ossec13001g^Exim Auth failed2025-03-05 01:43:44 dovecot_plain authenticator failed for bb121-7-209-18.singnet.com.sg [121.7.209.18]:48188: 535 Incorrect authentication data (set_id=services@heipowersystem.com)121.7.209.181880251T  -5' ossec13001g^Exim Auth failed2025-03-05 01:41:46 dovecot_plain authenticator failed for ([120.238.28.76]) [120.238.28.76]:42874: 535 Incorrect authentication data (set_id=sales)120.238.28.761814991g  -[' ossec13001g^vExim Auth failed2025-03-05 01:41:33 dovecot_plain authenticator failed for ([121.65.54.204]) [121.65.54.204]:53968: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)121.65.54.2041835841T  -7% ossec13001g^\Exim Auth failed2025-03-05 01:41:07 dovecot_plain authenticator failed for ([5.164.185.13]) [5.164.185.13]:42048: 535 Incorrect authentication data (set_id=services)5.164.185.132017370m  -e) ossec13001g^DExim Auth failed2025-03-05 01:40:43 dovecot_plain authenticator failed for ([118.123.116.93]) [118.123.116.93]:49783: 535 Incorrect authentication data (set_id=services@heipowersystem.com)118.123.116.931814991p  -i+ ossec13001g[Exim Auth failed2025-03-05 01:29:30 dovecot_plain authenticator failed for ([165.154.202.101]) [165.154.202.101]:17458: 535 Incorrect authentication data (set_id=services@heipowersystem.com)165.154.202.1016252001W  -;' ossec13001g[3Exim Auth failed2025-03-05 01:27:39 dovecot_plain authenticator failed for ([132.247.87.75]) [132.247.87.75]:59150: 535 Incorrect authentication data (set_id=services)132.247.87.753996063p  -i+ ossec13001g[#Exim Auth failed2025-03-05 01:27:22 dovecot_plain authenticator failed for ([120.236.137.140]) [120.236.137.140]:59662: 535 Incorrect authentication data (set_id=services@heipowersystem.com)120.236.137.1401814991W  -9) ossec13001gZExim Auth failed2025-03-05 01:22:34 dovecot_plain authenticator failed for ([182.151.45.136]) [182.151.45.136]:51664: 535 Incorrect authentication data (set_id=sales)182.151.45.1361814991m  -c+ ossec13001gYExim Auth failed2025-03-05 01:22:16 dovecot_plain authenticator failed for ([103.146.233.202]) [103.146.233.202]:42390: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)103.146.233.2021269750T  -5' ossec13001gXsExim Auth failed2025-03-05 01:15:54 dovecot_plain authenticator failed for ([50.249.167.45]) [50.249.167.45]:42641: 535 Incorrect authentication data (set_id=sales)50.249.167.456252001 }/ @ [ V  AXU}T6  -5' ossec13001gjlExim Auth failed2025-03-05 02:32:34 dovecot_plain authenticator failed for ([103.69.244.39]) [103.69.244.39]:46598: 535 Incorrect authentication data (set_id=sales)103.69.244.3912697505  -+ ossec13001gjUExim Auth failed2025-03-05 02:32:13 dovecot_plain authenticator failed for 122-151-131-211.sta.wbroadband.net.au [122.151.131.211]:37730: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)122.151.131.2112077456e4  -]% ossec13001ghExim Auth failed2025-03-05 02:25:02 dovecot_plain authenticator failed for ([65.20.251.53]) [65.20.251.53]:38176: 535 Incorrect authentication data (set_id=services@heipowersystem.com)65.20.251.5399237Q3  -1% ossec13001gg)Exim Auth failed2025-03-05 02:18:40 dovecot_plain authenticator failed for ([49.245.37.17]) [49.245.37.17]:33796: 535 Incorrect authentication data (set_id=sales)49.245.37.1718802512  - + ossec13001ggExim Auth failed2025-03-05 02:18:24 dovecot_plain authenticator failed for (mobile-166-195-195-160.mycingular.net) [166.195.195.160]:49318: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)166.195.195.1606252001T1  -7% ossec13001gf~Exim Auth failed2025-03-05 02:15:50 dovecot_plain authenticator failed for ([36.33.201.45]) [36.33.201.45]:56400: 535 Incorrect authentication data (set_id=services)36.33.201.451814991m0  -e) ossec13001gfjExim Auth failed2025-03-05 02:15:30 dovecot_plain authenticator failed for ([220.179.249.21]) [220.179.249.21]:54242: 535 Incorrect authentication data (set_id=services@heipowersystem.com)220.179.249.211814991Q/  -1% ossec13001gfExim Auth failed2025-03-05 02:14:14 dovecot_plain authenticator failed for ([103.4.103.61]) [103.4.103.61]:43459: 535 Incorrect authentication data (set_id=sales)103.4.103.611168579g.  -[' ossec13001gfExim Auth failed2025-03-05 02:13:59 dovecot_plain authenticator failed for ([61.108.83.138]) [61.108.83.138]:32784: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)61.108.83.1381835841f-  -Y' ossec13001geExim Auth failed2025-03-05 02:09:32 dovecot_plain authenticator failed for 111-70-23-241.emome-ip.hinet.net [111.70.23.241]:32864: 535 Incorrect authentication data (set_id=services)111.70.23.2411668284m,  -e) ossec13001gdExim Auth failed2025-03-05 02:09:22 dovecot_plain authenticator failed for ([117.53.254.144]) [117.53.254.144]:58049: 535 Incorrect authentication data (set_id=services@heipowersystem.com)117.53.254.1441835841S+  -3' ossec13001gdExim Auth failed2025-03-05 02:08:10 dovecot_plain authenticator failed for ([77.106.78.215]) [77.106.78.215]:2203: 535 Incorrect authentication data (set_id=sales)77.106.78.2152017370*  - + ossec13001gdExim Auth failed2025-03-05 02:07:54 dovecot_plain authenticator failed for (static.ill.117.250.253.141.bsnl.co.in) [117.250.253.137]:32792: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)117.250.253.1371269750a)  -S# ossec13001gbSExim Auth failed2025-03-05 01:58:03 dovecot_plain authenticator failed for ([101.13.5.49]) [101.13.5.49]:48378: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)101.13.5.491668284k(  -a) ossec13001gaExim Auth failed2025-03-05 01:55:53 dovecot_plain authenticator failed for nova-185-040-122-250.cpe.novanet.is [185.40.122.250]:55896: 535 Incorrect authentication data (set_id=services)185.40.122.2502629691j'  -a' ossec13001gaExim Auth failed2025-03-05 01:55:31 dovecot_plain authenticator failed for ([27.223.98.117]) [27.223.98.117]:57088: 535 Incorrect authentication data (set_id=services@heipowersystem.com)27.223.98.1171814991_&  -K' ossec13001gaExim Auth failed2025-03-05 01:52:30 dovecot_login authenticator failed for ([195.24.215.70]) [195.24.215.70]:46370: 535 Incorrect authentication data (set_id=vikas.khandelwal)195.24.215.702233387 T  ) 8 W [ }*BTjG  -a' ossec13001gxExim Auth failed2025-03-05 03:33:20 dovecot_plain authenticator failed for ([223.171.55.59]) [223.171.55.59]:47544: 535 Incorrect authentication data (set_id=services@heipowersystem.com)223.171.55.591835841dF  -W% ossec13001gxGExim Auth failed2025-03-05 03:31:42 dovecot_plain authenticator failed for ([218.22.0.200]) [218.22.0.200]:58346: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)218.22.0.2001814991iE  -]) ossec13001gwExim Auth failed2025-03-05 03:28:25 dovecot_plain authenticator failed for 144.46.246.220.static.netvigator.com [220.246.46.144]:60170: 535 Incorrect authentication data (set_id=sales)220.246.46.1441819730mD  -c+ ossec13001gwsExim Auth failed2025-03-05 03:28:10 dovecot_plain authenticator failed for ([114.215.211.223]) [114.215.211.223]:33522: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)114.215.211.2231814991mC  -e) ossec13001gvExim Auth failed2025-03-05 03:22:25 dovecot_login authenticator failed for ([103.115.31.219]) [103.115.31.219]:44136: 535 Incorrect authentication data (set_id=services@heipowersystem.com)103.115.31.2191643084nB  -k' ossec13001gtExim Auth failed2025-03-05 03:15:38 dovecot_plain authenticator failed for cl-185-254-44-30.b4net.lt [185.254.44.30]:32770: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)185.254.44.30597427WA  -9) ossec13001grrExim Auth failed2025-03-05 03:06:49 dovecot_plain authenticator failed for ([220.80.192.168]) [220.80.192.168]:52934: 535 Incorrect authentication data (set_id=sales)220.80.192.1681835841W@  -;' ossec13001grjExim Auth failed2025-03-05 03:06:40 dovecot_plain authenticator failed for ([61.81.133.182]) [61.81.133.182]:42464: 535 Incorrect authentication data (set_id=services)61.81.133.1821835841g?  -[' ossec13001grdExim Auth failed2025-03-05 03:06:35 dovecot_plain authenticator failed for ([58.42.226.215]) [58.42.226.215]:58035: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)58.42.226.2151814991m>  -e) ossec13001gr^Exim Auth failed2025-03-05 03:06:28 dovecot_plain authenticator failed for ([112.111.61.230]) [112.111.61.229]:34942: 535 Incorrect authentication data (set_id=services@heipowersystem.com)112.111.61.2291814991Z=  -=+ ossec13001gpiExim Auth failed2025-03-05 02:58:08 dovecot_plain authenticator failed for ([218.149.228.165]) [218.149.228.165]:54172: 535 Incorrect authentication data (set_id=sales)218.149.228.1651835841x<  -{) ossec13001gp]Exim Auth failed2025-03-05 02:57:57 dovecot_plain authenticator failed for 89-179-241-253.static.corbina.ru [89.179.241.253]:59512: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)89.179.241.2532017370];  -C+ ossec13001gp3Exim Auth failed2025-03-05 02:57:14 dovecot_plain authenticator failed for ([194.226.155.198]) [194.226.155.198]:59054: 535 Incorrect authentication data (set_id=services)194.226.155.1982017370m:  -e) ossec13001gp%Exim Auth failed2025-03-05 02:57:00 dovecot_plain authenticator failed for ([178.178.222.60]) [178.178.222.60]:38468: 535 Incorrect authentication data (set_id=services@heipowersystem.com)178.178.222.602017370Z9  -=+ ossec13001gmzExim Auth failed2025-03-05 02:45:38 dovecot_plain authenticator failed for ([201.183.225.156]) [201.183.225.156]:46614: 535 Incorrect authentication data (set_id=sales)201.183.225.15636583948  - ) ossec13001gmlExim Auth failed2025-03-05 02:45:24 dovecot_plain authenticator failed for (175-182-64-203.adsl.dynamic.seed.net.tw) [175.182.64.203]:45700: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)175.182.64.2031668284p7  -i+ ossec13001gkxExim Auth failed2025-03-05 02:37:03 dovecot_plain authenticator failed for ([222.189.211.114]) [222.189.211.114]:39388: 535 Incorrect authentication data (set_id=services@heipowersystem.com)222.189.211.1141814991 B 9 , N f  +%B_X  -K' ossec13001gLJGExim Auth failed2025-03-05 04:35:42 dovecot_plain authenticator failed for ([119.84.241.94]) [119.84.241.94]:39994: 535 Incorrect authentication data (set_id=vikas.khandelwal)119.84.241.941814991W  -' ossec13001gLJ/Exim Auth failed2025-03-05 04:35:18 dovecot_plain authenticator failed for (12.22.129.180.unknown.m1.com.sg) [180.129.22.12]:57824: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)180.129.22.121880251ZV  -?) ossec13001gdžExim Auth failed2025-03-05 04:32:44 dovecot_plain authenticator failed for ([122.228.225.22]) [122.228.225.22]:62552: 535 Incorrect authentication data (set_id=services)122.228.225.221814991iU  -a' ossec13001gdžExim Auth failed2025-03-05 04:32:27 dovecot_plain authenticator failed for ([41.59.201.180]) [41.59.201.180]:47825: 535 Incorrect authentication data (set_id=services@heipowersystem.com)41.59.201.180149590xT  -# ossec13001gDžExim Auth failed2025-03-05 04:28:52 dovecot_plain authenticator failed for net-2-38-71-159.cust.vodafonedsl.it [2.38.71.159]:65115: 535 Incorrect authentication data (set_id=services@heipowersystem.com)2.38.71.1593175395ZS  -?) ossec13001gǂExim Auth failed2025-03-05 04:17:12 dovecot_plain authenticator failed for ([101.168.42.221]) [101.168.42.221]:53266: 535 Incorrect authentication data (set_id=services)101.168.42.2212077456wR  -y) ossec13001gǂExim Auth failed2025-03-05 04:16:54 dovecot_plain authenticator failed for 17.sub-166-248-194.myvzw.com [166.248.194.17]:57354: 535 Incorrect authentication data (set_id=services@heipowersystem.com)166.248.194.176252001QQ  -1% ossec13001gǂzExim Auth failed2025-03-05 04:15:13 dovecot_plain authenticator failed for ([59.34.17.130]) [59.34.17.130]:34697: 535 Incorrect authentication data (set_id=sales)59.34.17.1301814991jP  -_) ossec13001gǂnExim Auth failed2025-03-05 04:15:01 dovecot_plain authenticator failed for ([218.155.40.158]) [218.155.40.158]:35840: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)218.155.40.1581835841yO  -}) ossec13001gExim Auth failed2025-03-05 04:04:03 dovecot_plain authenticator failed for ip72-199-156-231.sd.sd.cox.net [72.199.156.231]:54850: 535 Incorrect authentication data (set_id=services@heipowersystem.com)72.199.156.2316252001WN  -9) ossec13001gQExim Auth failed2025-03-05 04:01:44 dovecot_plain authenticator failed for ([117.158.88.106]) [117.158.88.106]:17661: 535 Incorrect authentication data (set_id=sales)117.158.88.1061814991dM  -W% ossec13001g=Exim Auth failed2025-03-05 04:01:24 dovecot_plain authenticator failed for ([88.87.84.104]) [88.87.84.104]:60527: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)88.87.84.1042017370ZL  -?) ossec13001g~AExim Auth failed2025-03-05 03:57:11 dovecot_plain authenticator failed for ([218.23.156.227]) [218.23.156.227]:49609: 535 Incorrect authentication data (set_id=services)218.23.156.2271814991 K  -!% ossec13001g~3Exim Auth failed2025-03-05 03:56:58 dovecot_plain authenticator failed for 206.81.4.146.static.wline.lns.sme.cust.swisscom.ch [146.4.81.206]:50505: 535 Incorrect authentication data (set_id=services@heipowersystem.com)146.4.81.2062658434WJ  -9) ossec13001g}nExim Auth failed2025-03-05 03:53:41 dovecot_plain authenticator failed for ([125.23.204.106]) [125.23.204.106]:38392: 535 Incorrect authentication data (set_id=sales)125.23.204.1061269750zI  -' ossec13001g}XExim Auth failed2025-03-05 03:53:19 dovecot_plain authenticator failed for syn-076-176-206-019.res.spectrum.com [76.176.206.19]:59792: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)76.176.206.196252001jH  -a' ossec13001gzExim Auth failed2025-03-05 03:41:55 dovecot_plain authenticator failed for ([220.85.251.16]) [220.85.251.16]:49386: 535 Incorrect authentication data (set_id=services@heipowersystem.com)220.85.251.161835841 d" 6 \ K k -Rdji  -_) ossec13001gǏExim Auth failed2025-03-05 05:12:22 dovecot_plain authenticator failed for ([218.155.40.158]) [218.155.40.158]:55310: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)218.155.40.1581835841Wh  -;' ossec13001gǎExim Auth failed2025-03-05 05:08:34 dovecot_plain authenticator failed for ([102.31.152.59]) [102.31.152.59]:58980: 535 Incorrect authentication data (set_id=services)102.31.152.592464461Wg  -9) ossec13001gǎExim Auth failed2025-03-05 05:08:26 dovecot_plain authenticator failed for ([176.192.250.81]) [176.192.250.81]:57910: 535 Incorrect authentication data (set_id=sales)176.192.250.812017370f  -) ossec13001gǎExim Auth failed2025-03-05 05:08:17 dovecot_plain authenticator failed for ip-062-143-219-127.um16.pools.vodafone-ip.de [62.143.219.127]:59792: 535 Incorrect authentication data (set_id=services@heipowersystem.com)62.143.219.1272921044ie  -_) ossec13001gǎExim Auth failed2025-03-05 05:08:08 dovecot_plain authenticator failed for ([178.218.193.90]) [178.218.193.90]:33677: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)178.218.193.90798544jd  -a' ossec13001gnjExim Auth failed2025-03-05 04:59:30 dovecot_plain authenticator failed for ([50.238.55.194]) [50.238.55.194]:11622: 535 Incorrect authentication data (set_id=services@heipowersystem.com)50.238.55.1946252001gc  -[' ossec13001gnjExim Auth failed2025-03-05 04:59:13 dovecot_plain authenticator failed for ([103.183.11.30]) [103.183.11.30]:39996: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)103.183.11.301643084fb  -]# ossec13001gljExim Auth failed2025-03-05 04:46:50 dovecot_plain authenticator failed for 18.red-83-48-39.staticip.rima-tde.net [83.48.39.18]:4130: 535 Incorrect authentication data (set_id=services)83.48.39.182510769ja  -a' ossec13001gljExim Auth failed2025-03-05 04:46:22 dovecot_plain authenticator failed for ([111.48.214.96]) [111.48.214.96]:41106: 535 Incorrect authentication data (set_id=services@heipowersystem.com)111.48.214.961814991Q`  -1% ossec13001gLjExim Auth failed2025-03-05 04:41:23 dovecot_plain authenticator failed for ([116.7.248.50]) [116.7.248.50]:57749: 535 Incorrect authentication data (set_id=sales)116.7.248.501814991a_  -S# ossec13001gLjExim Auth failed2025-03-05 04:41:08 dovecot_plain authenticator failed for ([59.96.62.29]) [59.96.62.29]:43750: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)59.96.62.291269750\^  -G% ossec13001gLJExim Auth failed2025-03-05 04:38:03 dovecot_login authenticator failed for ([58.22.255.28]) [58.22.255.28]:46077: 535 Incorrect authentication data (set_id=vikas.khandelwal)58.22.255.281814991 ]  -'' ossec13001gLJExim Auth failed2025-03-05 04:37:40 dovecot_login authenticator failed for (ip-107-12-61-200.static.silicanetworks.com) [200.61.12.107]:52196: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)200.61.12.1073865483V\  -7) ossec13001gLJExim Auth failed2025-03-05 04:38:25 dovecot_plain authenticator failed for ([200.205.223.1]) [187.93.153.166]:40433: 535 Incorrect authentication data (set_id=sales)187.93.153.1663469034h[  -]' ossec13001gLJExim Auth failed2025-03-05 04:38:14 dovecot_plain authenticator failed for ([218.106.120.18]) [58.49.113.138]:18108: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)58.49.113.1381814991uZ  -u) ossec13001gLJExim Auth failed2025-03-05 04:37:21 dovecot_login authenticator failed for ([121.189.226.81]) [121.189.226.81]:52992: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)121.189.226.811835841aY  -M) ossec13001gLJExim Auth failed2025-03-05 04:37:33 dovecot_login authenticator failed for ([222.128.44.171]) [222.128.44.171]:2048: 535 Incorrect authentication data (set_id=vikas.khandelwal)222.128.44.1711814991 o > I [ }  !+Q]ojz  -a' ossec13001gǙExim Auth failed2025-03-05 05:53:49 dovecot_plain authenticator failed for ([103.47.74.210]) [103.47.74.210]:53760: 535 Incorrect authentication data (set_id=services@heipowersystem.com)103.47.74.2101269750py  -i+ ossec13001gǘdExim Auth failed2025-03-05 05:48:43 dovecot_login authenticator failed for (159.14.132.112.adsl-pool.ah.cnuninet.net) [112.123.199.111]:38728: 535 Incorrect authentication data (set_id=info)112.123.199.1111814991Vx  -7) ossec13001gǘRExim Auth failed2025-03-05 05:48:25 dovecot_login authenticator failed for ([117.134.13.108]) [117.134.13.108]:64774: 535 Incorrect authentication data (set_id=info)117.134.13.1081814991rw  -q' ossec13001gǘPExim Auth failed2025-03-05 05:48:23 dovecot_login authenticator failed for h014-014-160-190.gd.netyou.jp [14.14.160.190]:42470: 535 Incorrect authentication data (set_id=info@heipowersystem.com)14.14.160.1901861060nv  -k% ossec13001gǘJExim Auth failed2025-03-05 05:48:16 dovecot_login authenticator failed for (85-19-195-12.telia-isp.no) [85.19.195.12]:41618: 535 Incorrect authentication data (set_id=info@heipowersystem.com)85.19.195.123144096uu  -{# ossec13001gǗExim Auth failed2025-03-05 05:45:02 dovecot_plain authenticator failed for 210.0.90.81.static.nexnet.net.au [210.0.90.81]:45676: 535 Incorrect authentication data (set_id=services@heipowersystem.com)210.0.90.812077456gt  -[' ossec13001gǗExim Auth failed2025-03-05 05:44:59 dovecot_plain authenticator failed for ([111.175.39.76]) [111.175.39.76]:55947: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)111.175.39.761814991as  -M) ossec13001gǗExim Auth failed2025-03-05 05:45:22 dovecot_plain authenticator failed for 17.sub-166-248-194.myvzw.com [166.248.194.17]:58342: 535 Incorrect authentication data (set_id=sales)166.248.194.176252001Wr  -;' ossec13001gǗExim Auth failed2025-03-05 05:45:15 dovecot_plain authenticator failed for ([111.53.131.79]) [111.53.131.79]:60936: 535 Incorrect authentication data (set_id=services)111.53.131.791814991Wq  -;' ossec13001gǔExim Auth failed2025-03-05 05:32:11 dovecot_plain authenticator failed for ([220.122.115.9]) [220.122.115.9]:48634: 535 Incorrect authentication data (set_id=services)220.122.115.91835841gp  -]% ossec13001gǔsExim Auth failed2025-03-05 05:31:53 dovecot_plain authenticator failed for ([85.19.195.12]) [85.19.195.12]:36230: 535 Incorrect authentication data (set_id=services@heipowersystem.com)85.19.195.123144096Zo  -?) ossec13001gǓExim Auth failed2025-03-05 05:28:11 dovecot_plain authenticator failed for ([191.59.177.235]) [191.59.177.235]:50182: 535 Incorrect authentication data (set_id=services)191.59.177.2353469034jn  -a' ossec13001gǓExim Auth failed2025-03-05 05:27:58 dovecot_plain authenticator failed for ([50.249.167.45]) [50.249.167.45]:40725: 535 Incorrect authentication data (set_id=services@heipowersystem.com)50.249.167.456252001qm  -u% ossec13001gǑ^Exim Auth failed2025-03-05 05:18:45 dovecot_plain authenticator failed for ([46.161.196.5]) [46.161.196.5]:58654: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)46.161.196.599237Zl  -=+ ossec13001gǐExim Auth failed2025-03-05 05:16:36 dovecot_plain authenticator failed for ([163.179.105.211]) [163.179.105.211]:49973: 535 Incorrect authentication data (set_id=sales)163.179.105.2111814991dk  -W% ossec13001gǐExim Auth failed2025-03-05 05:16:03 dovecot_plain authenticator failed for ([61.42.133.74]) [61.42.133.74]:38372: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)61.42.133.741835841xj  -% ossec13001gǐExim Auth failed2025-03-05 05:16:29 dovecot_plain authenticator failed for 95-30-250-44.broadband.corbina.ru [95.30.250.44]:60884: 535 Incorrect authentication data (set_id=services@heipowersystem.com)95.30.250.442017370 G"8 X k } GP  -/% ossec13001gǡExim Auth failed2025-03-05 06:28:16 dovecot_login authenticator failed for ([223.71.10.94]) [223.71.10.94]:50240: 535 Incorrect authentication data (set_id=info)223.71.10.941814991y  -! ossec13001gǡExim Auth failed2025-03-05 06:27:54 dovecot_login authenticator failed for 96-1-34-28-staticipeast.wireless.telus.com [96.1.34.28]:55920: 535 Incorrect authentication data (set_id=info@heipowersystem.com)96.1.34.286251999d  -W% ossec13001gǠExim Auth failed2025-03-05 06:25:12 dovecot_login authenticator failed for ([14.37.206.76]) [14.37.206.76]:56326: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)14.37.206.761835841r  -q' ossec13001gǟExim Auth failed2025-03-05 06:20:02 dovecot_login authenticator failed for h77-94-125-250.static.bashtel.ru [77.94.125.250]:42041: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)77.94.125.2502017370  -) ossec13001gǟExim Auth failed2025-03-05 06:19:53 dovecot_login authenticator failed for 50708de6.static.ziggozakelijk.nl [80.112.141.230]:52560: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)80.112.141.2302750405m  -e) ossec13001gǟ5Exim Auth failed2025-03-05 06:17:48 dovecot_plain authenticator failed for ([103.180.240.96]) [103.180.240.96]:52316: 535 Incorrect authentication data (set_id=services@heipowersystem.com)103.180.240.961282988j  -a' ossec13001gǞGExim Auth failed2025-03-05 06:13:51 dovecot_plain authenticator failed for syn-098-144-082-250.res.spectrum.com [98.144.82.250]:47988: 535 Incorrect authentication data (set_id=services)98.144.82.2506252001p  -i+ ossec13001gǞ;Exim Auth failed2025-03-05 06:13:39 dovecot_plain authenticator failed for ([121.135.188.125]) [121.135.188.125]:59124: 535 Incorrect authentication data (set_id=services@heipowersystem.com)121.135.188.1251835841l  -c) ossec13001gǝExim Auth failed2025-03-05 06:08:52 dovecot_plain authenticator failed for syn-070-122-139-172.res.spectrum.com [70.122.139.172]:48768: 535 Incorrect authentication data (set_id=services)70.122.139.1726252001m  -e) ossec13001gǝ Exim Auth failed2025-03-05 06:08:35 dovecot_plain authenticator failed for ([103.97.213.151]) [103.97.213.151]:37572: 535 Incorrect authentication data (set_id=services@heipowersystem.com)103.97.213.1511269750W  -9) ossec13001gǛExim Auth failed2025-03-05 06:02:05 dovecot_plain authenticator failed for ([173.20.253.109]) [173.20.253.109]:53610: 535 Incorrect authentication data (set_id=sales)173.20.253.1096252001i  -]) ossec13001gǛ|Exim Auth failed2025-03-05 06:01:55 dovecot_plain authenticator failed for zdomainaccess.com [216.70.114.230]:40380: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)216.70.114.2306252001j  -a' ossec13001gǛzExim Auth failed2025-03-05 06:01:53 dovecot_plain authenticator failed for ([194.33.87.111]) [194.33.87.111]:55308: 535 Incorrect authentication data (set_id=services@heipowersystem.com)194.33.87.1112017370i~  -_' ossec13001gǛExim Auth failed2025-03-05 06:02:13 dovecot_plain authenticator failed for 179-189-85-66.goldnettelecom.com.br [179.189.85.66]:50268: 535 Incorrect authentication data (set_id=services)179.189.85.663469034\}  -A+ ossec13001gǚExim Auth failed2025-03-05 05:59:02 dovecot_login authenticator failed for (Mail.chinaqiaoyu.com) [222.185.255.227]:48752: 535 Incorrect authentication data (set_id=info)222.185.255.2271814991f|  -Y' ossec13001gǚExim Auth failed2025-03-05 05:58:49 dovecot_login authenticator failed for ([111.53.129.92]) [111.53.129.92]:54226: 535 Incorrect authentication data (set_id=info@heipowersystem.com)111.53.129.921814991Z{  -?) ossec13001gǙExim Auth failed2025-03-05 05:54:08 dovecot_plain authenticator failed for ([218.150.170.10]) [218.150.170.10]:50272: 535 Incorrect authentication data (set_id=services)218.150.170.101835841  : b q .CrqW  -;' ossec13001gǩ Exim Auth failed2025-03-05 07:00:08 dovecot_plain authenticator failed for ([170.250.128.5]) [170.250.128.5]:43428: 535 Incorrect authentication data (set_id=services)170.250.128.56252001g  -]% ossec13001gǩExim Auth failed2025-03-05 06:59:55 dovecot_plain authenticator failed for ([192.24.44.91]) [192.24.44.91]:52351: 535 Incorrect authentication data (set_id=services@heipowersystem.com)192.24.44.916251999W  -;' ossec13001gǧExim Auth failed2025-03-05 06:55:17 dovecot_plain authenticator failed for ([223.171.55.59]) [223.171.55.59]:46026: 535 Incorrect authentication data (set_id=services)223.171.55.591835841}  -+ ossec13001gǧExim Auth failed2025-03-05 06:54:48 dovecot_plain authenticator failed for (165-220-154-126.cust.exede.net) [165.220.154.126]:36170: 535 Incorrect authentication data (set_id=services@heipowersystem.com)165.220.154.1263175395M  --# ossec13001gǦExim Auth failed2025-03-05 06:49:33 dovecot_plain authenticator failed for ([2.55.64.191]) [2.55.64.191]:56187: 535 Incorrect authentication data (set_id=sales)2.55.64.191294640g  -[' ossec13001gǦExim Auth failed2025-03-05 06:49:17 dovecot_plain authenticator failed for ([154.127.90.34]) [154.127.90.34]:41459: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)154.127.90.342440476Q  -1% ossec13001gǦGExim Auth failed2025-03-05 06:47:58 dovecot_plain authenticator failed for ([87.117.32.22]) [87.117.32.22]:58394: 535 Incorrect authentication data (set_id=sales)87.117.32.222017370c  -W% ossec13001gǦ;Exim Auth failed2025-03-05 06:47:46 dovecot_plain authenticator failed for ([94.200.95.18]) [94.200.95.18]:47978: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)94.200.95.18290557T  -7% ossec13001gǤeExim Auth failed2025-03-05 06:39:56 dovecot_plain authenticator failed for ([110.35.63.27]) [110.35.63.27]:35212: 535 Incorrect authentication data (set_id=services)110.35.63.271835841Q  -1% ossec13001gǤeExim Auth failed2025-03-05 06:39:56 dovecot_plain authenticator failed for ([39.164.91.67]) [39.164.91.67]:44404: 535 Incorrect authentication data (set_id=sales)39.164.91.671814991h  -a' ossec13001gǤUExim Auth failed2025-03-05 06:39:40 dovecot_plain authenticator failed for ([65.20.169.121]) [65.20.169.121]:37632: 535 Incorrect authentication data (set_id=services@heipowersystem.com)65.20.169.12199237j  -_) ossec13001gǤQExim Auth failed2025-03-05 06:39:36 dovecot_plain authenticator failed for ([168.121.46.162]) [168.121.46.162]:40046: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)168.121.46.1623932488m  -e) ossec13001gǢHExim Auth failed2025-03-05 06:30:56 dovecot_plain authenticator failed for ([67.213.230.122]) [67.213.230.122]:36112: 535 Incorrect authentication data (set_id=services@heipowersystem.com)67.213.230.1226252001T  -5' ossec13001gǢ@Exim Auth failed2025-03-05 06:30:48 dovecot_plain authenticator failed for ([223.210.27.53]) [223.210.27.53]:37962: 535 Incorrect authentication data (set_id=sales)223.210.27.531814991_  -K' ossec13001gǢ2Exim Auth failed2025-03-05 06:30:33 dovecot_plain authenticator failed for 126.64.125.78.rev.sfr.net [78.125.64.126]:58656: 535 Incorrect authentication data (set_id=services)78.125.64.1263017382n  -g) ossec13001gǢ0Exim Auth failed2025-03-05 06:30:32 dovecot_plain authenticator failed for 118-119-237-24.gci.net [24.237.119.118]:56246: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)24.237.119.1186252001m  -e) ossec13001gǢ(Exim Auth failed2025-03-05 06:30:23 dovecot_plain authenticator failed for ([49.124.152.240]) [49.124.152.240]:56422: 535 Incorrect authentication data (set_id=services@heipowersystem.com)49.124.152.2401733045 3"D M b t )3r-  -q' ossec13001gdzExim Auth failed2025-03-05 07:46:06 dovecot_plain authenticator failed for 126.64.125.78.rev.sfr.net [78.125.64.126]:43176: 535 Incorrect authentication data (set_id=services@heipowersystem.com)78.125.64.1263017382W,  -;' ossec13001gDzExim Auth failed2025-03-05 07:40:57 dovecot_plain authenticator failed for ([27.45.146.126]) [27.45.146.126]:38062: 535 Incorrect authentication data (set_id=services)27.45.146.1261814991m+  -e) ossec13001gDzExim Auth failed2025-03-05 07:40:45 dovecot_plain authenticator failed for ([31.207.207.180]) [31.207.207.180]:56206: 535 Incorrect authentication data (set_id=services@heipowersystem.com)31.207.207.1802017370j*  -_) ossec13001gDZ Exim Auth failed2025-03-05 07:33:56 dovecot_plain authenticator failed for ([45.201.140.227]) [45.201.140.227]:58510: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)45.201.140.2271831722f)  -U+ ossec13001gDZ&Exim Auth failed2025-03-05 07:34:22 dovecot_plain authenticator failed for (m121-202-208-245.smartone.com) [121.202.208.245]:56424: 535 Incorrect authentication data (set_id=sales)121.202.208.2451819730V(  -;' ossec13001gǯTExim Auth failed2025-03-05 07:26:34 dovecot_plain authenticator failed for ([185.167.56.70]) [185.167.56.70]:42940: 535 Incorrect authentication data (set_id=services)185.167.56.70617790T'  -5' ossec13001gǯHExim Auth failed2025-03-05 07:26:22 dovecot_plain authenticator failed for ([45.181.196.97]) [45.181.196.97]:42770: 535 Incorrect authentication data (set_id=sales)45.181.196.973469034&  - ' ossec13001gǯFExim Auth failed2025-03-05 07:26:21 dovecot_plain authenticator failed for ipb21949c7.dynamic.kabel-deutschland.de [178.25.73.199]:45248: 535 Incorrect authentication data (set_id=services@heipowersystem.com)178.25.73.1992921044I%  = ) ossec13008gǯ6Mail Reciepient rejected2025-03-05 07:26:04 H=(mail.vandanabalbharti.com) [165.154.226.38]:58475 F= rejected RCPT : Rejected relay attempt: '165.154.226.38' From: 'arojjmfqxlj@vandanabalbharti.com' To: 'goofile@fastmail.com'165.154.226.381668284g$  -[' ossec13001gǯ4Exim Auth failed2025-03-05 07:26:02 dovecot_plain authenticator failed for ([14.53.126.112]) [14.53.126.112]:57578: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)14.53.126.1121835841Z#  -?) ossec13001gǭ5Exim Auth failed2025-03-05 07:17:33 dovecot_plain authenticator failed for ([175.205.191.27]) [175.205.191.27]:53790: 535 Incorrect authentication data (set_id=services)175.205.191.271835841W"  -9) ossec13001gǭ5Exim Auth failed2025-03-05 07:17:32 dovecot_plain authenticator failed for ([166.195.197.38]) [166.195.197.38]:43381: 535 Incorrect authentication data (set_id=sales)166.195.197.386252001j!  -a' ossec13001gǭ#Exim Auth failed2025-03-05 07:17:15 dovecot_plain authenticator failed for ([57.128.19.228]) [57.128.19.228]:51476: 535 Incorrect authentication data (set_id=services@heipowersystem.com)57.128.19.2283017382g  -[' ossec13001gǭExim Auth failed2025-03-05 07:17:02 dovecot_plain authenticator failed for ([175.202.82.16]) [175.202.82.16]:46198: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)175.202.82.161835841s  -s' ossec13001gǩExim Auth failed2025-03-05 07:03:40 dovecot_plain authenticator failed for 83.106.54.198.in-addr.arpa [198.54.106.83]:59504: 535 Incorrect authentication data (set_id=services@heipowersystem.com)198.54.106.836252001Z  -?) ossec13001gǪExim Auth failed2025-03-05 07:04:14 dovecot_plain authenticator failed for ([187.76.173.246]) [187.76.173.246]:55332: 535 Incorrect authentication data (set_id=services)187.76.173.2463469034Z  -?) ossec13001gǩ2Exim Auth failed2025-03-05 07:00:25 dovecot_plain authenticator failed for ([123.209.194.49]) [123.209.194.49]:50576: 535 Incorrect authentication data (set_id=services)123.209.194.492077456 m& B Q v &K@Wmf>  -]% ossec13001gǽcExim Auth failed2025-03-05 08:26:35 dovecot_plain authenticator failed for ([185.167.58.9]) [185.167.58.9]:60982: 535 Incorrect authentication data (set_id=services@heipowersystem.com)185.167.58.9617790e=  -W' ossec13001gǻExim Auth failed2025-03-05 08:20:30 dovecot_plain authenticator failed for 24-220-250-67-dynamic.midco.net [24.220.250.67]:44460: 535 Incorrect authentication data (set_id=services)24.220.250.676252001<  -% ossec13001gǻExim Auth failed2025-03-05 08:20:12 dovecot_plain authenticator failed for 61-216-7-163.hinet-ip.hinet.net ([61.216.7.165]) [61.216.7.163]:49875: 535 Incorrect authentication data (set_id=services@heipowersystem.com)61.216.7.1631668284W;  -9) ossec13001gǻExim Auth failed2025-03-05 08:20:11 dovecot_plain authenticator failed for ([14.194.128.158]) [14.194.128.158]:35796: 535 Incorrect authentication data (set_id=sales)14.194.128.1581269750j:  -_) ossec13001gǻExim Auth failed2025-03-05 08:20:00 dovecot_plain authenticator failed for ([183.167.198.31]) [183.167.198.31]:49576: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)183.167.198.311814991]9  -C+ ossec13001gǺExim Auth failed2025-03-05 08:12:21 dovecot_plain authenticator failed for ([220.120.224.227]) [220.120.224.227]:58166: 535 Incorrect authentication data (set_id=services)220.120.224.2271835841y8  -' ossec13001gǹExim Auth failed2025-03-05 08:11:58 dovecot_plain authenticator failed for 111-70-25-206.emome-ip.hinet.net [111.70.25.206]:49088: 535 Incorrect authentication data (set_id=services@heipowersystem.com)111.70.25.2061668284j7  -_) ossec13001gǹExim Auth failed2025-03-05 08:11:55 dovecot_plain authenticator failed for ([103.163.44.118]) [103.163.44.118]:35284: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)103.163.44.1181269750_6  -K' ossec13001gǹ.Exim Auth failed2025-03-05 08:08:38 dovecot_login authenticator failed for ([58.16.215.241]) [58.16.215.241]:60882: 535 Incorrect authentication data (set_id=vikas.khandelwal)58.16.215.2411814991o5  -m% ossec13001gǹExim Auth failed2025-03-05 08:08:07 dovecot_login authenticator failed for ([5.59.141.152]) [5.59.141.152]:56760: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)5.59.141.1522017370g4  -[' ossec13001gǷExim Auth failed2025-03-05 08:02:58 dovecot_plain authenticator failed for ([211.109.75.68]) [211.109.75.69]:55626: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)211.109.75.691835841Q3  -3# ossec13001gǷExim Auth failed2025-03-05 08:03:31 dovecot_plain authenticator failed for ([14.98.28.43]) [14.98.28.43]:49086: 535 Incorrect authentication data (set_id=services)14.98.28.431269750W2  -9) ossec13001gǷExim Auth failed2025-03-05 08:03:15 dovecot_plain authenticator failed for ([123.209.200.21]) [123.209.200.21]:34416: 535 Incorrect authentication data (set_id=sales)123.209.200.212077456m1  -e) ossec13001gǷExim Auth failed2025-03-05 08:02:58 dovecot_plain authenticator failed for ([111.48.140.240]) [111.48.140.240]:44404: 535 Incorrect authentication data (set_id=services@heipowersystem.com)111.48.140.2401814991`0  -Q# ossec13001gǴExim Auth failed2025-03-05 07:50:14 dovecot_plain authenticator failed for 37.151.71.8.dynamic.telecom.kz [37.151.71.8]:49764: 535 Incorrect authentication data (set_id=services)37.151.71.81522867p/  -i+ ossec13001gǴExim Auth failed2025-03-05 07:50:04 dovecot_plain authenticator failed for ([223.107.146.186]) [223.107.146.186]:58428: 535 Incorrect authentication data (set_id=services@heipowersystem.com)223.107.146.1861814991b.  -S% ossec13001gdzExim Auth failed2025-03-05 07:46:19 dovecot_plain authenticator failed for (6-62-170-152.fibertel.com.ar) [152.170.62.6]:43240: 535 Incorrect authentication data (set_id=services)152.170.62.63865483 *\~tj`VLB8.$zpf\H>4*   v l b X N D : 0 &    ~ t j ` V L B 8 . $    z p f \ R H > 4 *   vlbXND:0&|rh^TJ@6,"xndZPF<2( ~tj`VLB8.$zfp\ | r h ^ T J @ 6 , "    x n d Z P F < 2 (   RRH>4*  vlbXND:0& g g g g g g, g g g  g gY g; g9 g+ g- g g g  g g gF g: g g g g} gw gk gg g] g g g g g g gy gW g g g g g  gZ gE g g g gZ g g g g g  g g g g g߰ gߖ g g~ gݑ} g݁| g{ gz gy gx g0w g$v g u gt g؜s gr gq gp go g:n g.m gl gk g]j g+i g!h gsg gf ge gd gTc gHb g6a g|` gh_ gh^ g\] g\ g[ gΘZ gmY gKX gGW gAV g?U g5T gxS gPR gQ g&P gƬO gƎN gƂM gķL gĵK gĭJ gīI g3H gG gF g­E g¥D gǿC gǿxB gǾA gǾ@ gǽ}? gǽc> gǻ= gǻ< gǻ; gǻ: gǺ9 gǹ8 gǹ7 gǹ.6 gǹ5 gǷ3 gǷ2 gǷ4 gǷ1 gǴ0 gǴ/ gdz. gdz- gDz, gDz+ gDZ&) gDZ * gǯT( gǯH' gǯF& gǯ6% gǯ4$ gǭ5# gǭ5" gǭ#! gǭ gǪ gǩ gǩ2 gǩ  gǩ gǧ gǧ gǦ gǦ gǦG gǦ; gǤe gǤe gǤU g g g gT g@ g g gl g` g` gV gJ gB g< g g g g g g g g  g  g  g  g  g x g  g{ gm g g g g gh g g g g ge g g g gǤQ gǢH gǢ@ gǢ2 gǢ0 gǢ( gǡ gǡ gǠ gǟ gǟ gǟ5 gǞG gǞ; gǝ gǝ  gǛ gǛ gǛ| gǛz gǚ gǚ gǙ gǙ gǘd gǘR gǘP gǘJ gǗ gǗ gǗ gǗ gǔ gǔs gǓ gǓ gǑ^ gǐ gǐ gǐ gǏ gǎ g gǎ gǎ gǎ gnj gnj glj glj gLj gLj gLJ gLJ gLJ gLJ gLJ gLJ gLJG gLJ/ gdž gdž gDž gǂ gǂ gǂz gǂn g gQ g= g~A g~3 g}n g}X gz gx gxG gw gws gv gt grr grj grd gr^ "J b t <QcpO  -i+ ossec13001gƬExim Auth failed2025-03-05 09:06:10 dovecot_plain authenticator failed for ([114.215.211.223]) [114.215.211.223]:41760: 535 Incorrect authentication data (set_id=services@heipowersystem.com)114.215.211.2231814991PN  -1% ossec13001gƎExim Auth failed2025-03-05 09:05:40 dovecot_plain authenticator failed for ([94.205.82.33]) [94.205.82.33]:58132: 535 Incorrect authentication data (set_id=sales)94.205.82.33290557jM  -_) ossec13001gƂExim Auth failed2025-03-05 09:05:29 dovecot_plain authenticator failed for ([218.150.170.10]) [218.150.170.10]:48626: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)218.150.170.101835841gL  -[' ossec13001gķExim Auth failed2025-03-05 08:57:50 dovecot_plain authenticator failed for syn-097-070-129-101.res.spectrum.com [97.70.129.101]:47764: 535 Incorrect authentication data (set_id=sales)97.70.129.1016252001WK  -;' ossec13001gĵExim Auth failed2025-03-05 08:57:49 dovecot_plain authenticator failed for ([31.173.20.146]) [31.173.20.146]:57536: 535 Incorrect authentication data (set_id=services)31.173.20.1462017370J  - + ossec13001gĭExim Auth failed2025-03-05 08:57:40 dovecot_plain authenticator failed for syn-108-191-170-208.biz.spectrum.com [108.191.170.208]:60354: 535 Incorrect authentication data (set_id=services@heipowersystem.com)108.191.170.2086252001cI  -W% ossec13001gīExim Auth failed2025-03-05 08:57:39 dovecot_plain authenticator failed for ([94.205.82.33]) [94.205.82.33]:42215: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)94.205.82.33290557lH  -i# ossec13001g3Exim Auth failed2025-03-05 08:55:38 dovecot_login authenticator failed for (fablixsolutions.com) [14.18.77.99]:36840: 535 Incorrect authentication data (set_id=webmaster@fablixsolutions.com)14.18.77.991814991VG  -=# ossec13001gExim Auth failed2025-03-05 08:55:13 dovecot_login authenticator failed for (fablixsolutions.com) [14.18.77.99]:33348: 535 Incorrect authentication data (set_id=nologin)14.18.77.991814991gF  -[' ossec13001gExim Auth failed2025-03-05 08:48:38 dovecot_plain authenticator failed for ([49.124.151.67]) [49.124.151.67]:42740: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)49.124.151.671733045TE  -5' ossec13001g­Exim Auth failed2025-03-05 08:49:08 dovecot_plain authenticator failed for ([121.166.85.53]) [121.166.85.53]:41276: 535 Incorrect authentication data (set_id=sales)121.166.85.531835841D  - + ossec13001g¥Exim Auth failed2025-03-05 08:48:59 dovecot_plain authenticator failed for 137.173.198.203.static.netvigator.com [203.198.173.137]:53364: 535 Incorrect authentication data (set_id=services@heipowersystem.com)203.198.173.1371819730ZC  -?) ossec13001gǿExim Auth failed2025-03-05 08:35:53 dovecot_plain authenticator failed for ([103.218.132.27]) [103.218.132.27]:38934: 535 Incorrect authentication data (set_id=services)103.218.132.271269750jB  -a' ossec13001gǿxExim Auth failed2025-03-05 08:35:27 dovecot_plain authenticator failed for ([220.122.115.9]) [220.122.115.9]:42981: 535 Incorrect authentication data (set_id=services@heipowersystem.com)220.122.115.91835841dA  -Y# ossec13001gǾExim Auth failed2025-03-05 08:31:41 dovecot_plain authenticator failed for ([60.8.120.74]) [60.8.50.150]:33210: 535 Incorrect authentication data (set_id=services@heipowersystem.com)60.8.50.1501814991T@  -7% ossec13001gǾExim Auth failed2025-03-05 08:32:26 dovecot_plain authenticator failed for ([60.166.8.174]) [60.166.8.174]:42306: 535 Incorrect authentication data (set_id=services)60.166.8.1741814991Z?  -?) ossec13001gǽ}Exim Auth failed2025-03-05 08:27:00 dovecot_plain authenticator failed for ([203.193.147.37]) [203.193.147.37]:54357: 535 Incorrect authentication data (set_id=services)203.193.147.371269750 O. + < K m u*OW`  -;' ossec13001g|Exim Auth failed2025-03-05 09:43:47 dovecot_plain authenticator failed for ([61.81.133.182]) [61.81.133.182]:35578: 535 Incorrect authentication data (set_id=services)61.81.133.1821835841k_  -c' ossec13001ghExim Auth failed2025-03-05 09:43:28 dovecot_plain authenticator failed for ([223.75.231.193]) [58.49.113.138]:13539: 535 Incorrect authentication data (set_id=services@heipowersystem.com)58.49.113.1381814991f^  -Y' ossec13001ghExim Auth failed2025-03-05 09:43:27 dovecot_plain authenticator failed for c-98-220-97-188.hsd1.il.comcast.net [98.220.97.188]:39716: 535 Incorrect authentication data (set_id=sales)98.220.97.1886252001m]  -c+ ossec13001g\Exim Auth failed2025-03-05 09:43:16 dovecot_plain authenticator failed for ([103.231.163.154]) [103.231.163.154]:42603: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)103.231.163.1541210997^\  -K' ossec13001gExim Auth failed2025-03-05 09:41:07 dovecot_login authenticator failed for cl-185-254-44-30.b4net.lt [185.254.44.30]:54392: 535 Incorrect authentication data (set_id=services)185.254.44.30597427p[  -i+ ossec13001gExim Auth failed2025-03-05 09:40:55 dovecot_login authenticator failed for ([178.178.127.114]) [178.178.127.114]:12673: 535 Incorrect authentication data (set_id=services@heipowersystem.com)178.178.127.1142017370yZ  -' ossec13001gΘExim Auth failed2025-03-05 09:39:58 dovecot_plain authenticator failed for cl-185-254-44-30.b4net.lt [185.254.44.30]:49776: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)185.254.44.30597427ZY  -?) ossec13001gmExim Auth failed2025-03-05 09:35:01 dovecot_plain authenticator failed for ([221.140.188.44]) [221.140.188.44]:35644: 535 Incorrect authentication data (set_id=services)221.140.188.441835841WX  -9) ossec13001gKExim Auth failed2025-03-05 09:34:27 dovecot_plain authenticator failed for ([103.129.201.82]) [103.129.201.81]:44702: 535 Incorrect authentication data (set_id=sales)103.129.201.811210997qW  -u# ossec13001gGExim Auth failed2025-03-05 09:34:23 dovecot_plain authenticator failed for 89-67-38-27.dynamic.chello.pl [89.67.38.27]:34932: 535 Incorrect authentication data (set_id=services@heipowersystem.com)89.67.38.27798544tV  -u' ossec13001gAExim Auth failed2025-03-05 09:34:17 dovecot_plain authenticator failed for 81.60.194.189.dyn.user.ono.com [81.60.194.189]:56622: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)81.60.194.1892510769ZU  -?) ossec13001g?Exim Auth failed2025-03-05 09:21:26 dovecot_plain authenticator failed for ([112.25.140.211]) [112.25.140.211]:56643: 535 Incorrect authentication data (set_id=services)112.25.140.2111814991mT  -e) ossec13001g5Exim Auth failed2025-03-05 09:21:15 dovecot_plain authenticator failed for ([216.194.174.27]) [216.194.174.27]:37323: 535 Incorrect authentication data (set_id=services@heipowersystem.com)216.194.174.276252001kS  -_+ ossec13001gxExim Auth failed2025-03-05 09:18:08 dovecot_plain authenticator failed for 158.160.200.177.netflexisp.com.br [177.200.160.158]:42944: 535 Incorrect authentication data (set_id=services)177.200.160.1583469034R  - ) ossec13001gPExim Auth failed2025-03-05 09:17:27 dovecot_plain authenticator failed for syn-173-095-123-220.biz.spectrum.com [173.95.123.220]:56859: 535 Incorrect authentication data (set_id=services@heipowersystem.com)173.95.123.2206252001mQ  -e) ossec13001gExim Auth failed2025-03-05 09:12:18 dovecot_plain authenticator failed for ([180.166.162.78]) [180.166.162.78]:33248: 535 Incorrect authentication data (set_id=services@heipowersystem.com)180.166.162.781814991]P  -C+ ossec13001g&Exim Auth failed2025-03-05 09:12:30 dovecot_plain authenticator failed for ([223.241.214.127]) [223.241.214.127]:44495: 535 Incorrect authentication data (set_id=services)223.241.214.1271814991 6  H m y *6Zr  -?) ossec13001gExim Auth failed2025-03-05 10:20:21 dovecot_plain authenticator failed for ([60.171.237.143]) [60.171.237.143]:45159: 535 Incorrect authentication data (set_id=services)60.171.237.1431814991dq  -Y# ossec13001gExim Auth failed2025-03-05 10:20:09 dovecot_plain authenticator failed for ([60.28.60.82]) [60.28.60.82]:52636: 535 Incorrect authentication data (set_id=services@heipowersystem.com)60.28.60.821814991dp  -U' ossec13001gExim Auth failed2025-03-05 10:20:06 dovecot_plain authenticator failed for c-85-228-121-10.bbcust.telenor.se [85.228.121.10]:36348: 535 Incorrect authentication data (set_id=sales)85.228.121.102661886mo  -c+ ossec13001gExim Auth failed2025-03-05 10:19:57 dovecot_plain authenticator failed for ([157.122.132.223]) [157.122.132.223]:51559: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)157.122.132.2231814991[n  -A) ossec13001g:Exim Auth failed2025-03-05 10:16:49 dovecot_plain authenticator failed for 118-119-237-24.gci.net [24.237.119.118]:58563: 535 Incorrect authentication data (set_id=sales)24.237.119.1186252001gm  -[' ossec13001g.Exim Auth failed2025-03-05 10:16:38 dovecot_plain authenticator failed for ([106.12.254.47]) [106.12.254.47]:15827: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)106.12.254.471814991]l  -C+ ossec13001gExim Auth failed2025-03-05 10:06:57 dovecot_plain authenticator failed for ([218.149.228.170]) [218.149.228.170]:34003: 535 Incorrect authentication data (set_id=services)218.149.228.1701835841}k  -' ossec13001gExim Auth failed2025-03-05 10:06:44 dovecot_plain authenticator failed for syn-097-070-129-101.res.spectrum.com [97.70.129.101]:57346: 535 Incorrect authentication data (set_id=services@heipowersystem.com)97.70.129.1016252001%j  3Q' ossec11301g]New FTP connection.Mar 5 10:04:36 vm1 pure-ftpd[2305835]: (?@20.169.107.13) [INFO] New connection from 20.169.107.1320.169.107.136252001Yi  -?) ossec13001g+Exim Auth failed2025-03-05 10:03:47 dovecot_plain authenticator failed for ([196.188.187.85]) [196.188.187.85]:53252: 535 Incorrect authentication data (set_id=services)196.188.187.85337996mh  -e) ossec13001g!Exim Auth failed2025-03-05 10:03:37 dovecot_plain authenticator failed for ([146.158.106.61]) [146.158.106.61]:41288: 535 Incorrect authentication data (set_id=services@heipowersystem.com)146.158.106.612017370%g  3Q' ossec11301gsNew FTP connection.Mar 5 10:00:42 vm1 pure-ftpd[2305256]: (?@20.163.14.234) [INFO] New connection from 20.163.14.23420.163.14.2346252001Tf  -7% ossec13001gExim Auth failed2025-03-05 09:58:15 dovecot_plain authenticator failed for ([110.7.52.183]) [110.7.52.183]:51040: 535 Incorrect authentication data (set_id=services)110.7.52.1831814991pe  -i+ ossec13001gExim Auth failed2025-03-05 09:57:57 dovecot_plain authenticator failed for ([203.123.219.137]) [203.123.219.137]:35880: 535 Incorrect authentication data (set_id=services@heipowersystem.com)203.123.219.1371835841Wd -;% ossec13001gExim Auth failed2025-03-05 09:57:52 dovecot_login authenticator failed for (gurukuljaipur.com) [119.96.131.8]:43070: 535 Incorrect authentication data (set_id=nologin)119.96.131.81814991Qc  -1% ossec13001gTExim Auth failed2025-03-05 09:51:39 dovecot_plain authenticator failed for ([61.42.133.74]) [61.42.133.74]:38107: 535 Incorrect authentication data (set_id=sales)61.42.133.741835841jb  -a' ossec13001gHExim Auth failed2025-03-05 09:51:27 dovecot_plain authenticator failed for ([88.201.163.65]) [88.201.163.65]:52292: 535 Incorrect authentication data (set_id=services@heipowersystem.com)88.201.163.652017370qa  -o' ossec13001g6Exim Auth failed2025-03-05 09:51:09 dovecot_plain authenticator failed for d54c70cda.static.telenet.be [84.199.12.218]:57864: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)84.199.12.2182802361 V  ' 9 [u.VT  -5' ossec13001gExim Auth failed2025-03-05 11:06:00 dovecot_plain authenticator failed for ([47.206.95.195]) [47.206.95.195]:47604: 535 Incorrect authentication data (set_id=sales)47.206.95.1956252001g  -[' ossec13001gExim Auth failed2025-03-05 11:05:49 dovecot_plain authenticator failed for ([124.246.92.77]) [124.246.92.77]:51145: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)124.246.92.771880251W  -;' ossec13001g߰Exim Auth failed2025-03-05 10:52:55 dovecot_plain authenticator failed for ([88.84.209.146]) [88.84.209.146]:59614: 535 Incorrect authentication data (set_id=services)88.84.209.1462017370w  -{' ossec13001gߖExim Auth failed2025-03-05 10:52:29 dovecot_plain authenticator failed for 81.60.194.189.dyn.user.ono.com [81.60.194.189]:52774: 535 Incorrect authentication data (set_id=services@heipowersystem.com)81.60.194.1892510769Z  -?) ossec13001gExim Auth failed2025-03-05 10:49:30 dovecot_plain authenticator failed for ([60.223.239.134]) [60.223.239.134]:53461: 535 Incorrect authentication data (set_id=services)60.223.239.1341814991m~  -e) ossec13001gExim Auth failed2025-03-05 10:48:56 dovecot_plain authenticator failed for ([178.163.27.129]) [178.163.27.129]:55446: 535 Incorrect authentication data (set_id=services@heipowersystem.com)178.163.27.1292017370Z}  -?) ossec13001gݑExim Auth failed2025-03-05 10:43:53 dovecot_plain authenticator failed for ([123.209.107.18]) [123.209.107.18]:49552: 535 Incorrect authentication data (set_id=services)123.209.107.182077456j|  -a' ossec13001g݁Exim Auth failed2025-03-05 10:43:36 dovecot_plain authenticator failed for ([125.21.141.54]) [125.21.141.54]:61979: 535 Incorrect authentication data (set_id=services@heipowersystem.com)125.21.141.541269750g{  -[' ossec13001gExim Auth failed2025-03-05 10:36:57 dovecot_plain authenticator failed for ([171.244.63.34]) [171.244.63.34]:59998: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)171.244.63.341562822bz  -Q' ossec13001gExim Auth failed2025-03-05 10:37:17 dovecot_plain authenticator failed for 94-246-52.218.3p.ntebredband.no [94.246.52.218]:60000: 535 Incorrect authentication data (set_id=sales)94.246.52.2183144096Zy  -?) ossec13001gExim Auth failed2025-03-05 10:37:13 dovecot_plain authenticator failed for ([124.112.45.222]) [124.112.45.222]:59206: 535 Incorrect authentication data (set_id=services)124.112.45.2221814991jx  -a' ossec13001gExim Auth failed2025-03-05 10:36:58 dovecot_plain authenticator failed for ([115.140.89.82]) [115.140.89.82]:38776: 535 Incorrect authentication data (set_id=services@heipowersystem.com)115.140.89.821835841iw  -_' ossec13001g0Exim Auth failed2025-03-05 10:29:28 dovecot_plain authenticator failed for syn-097-086-134-216.res.spectrum.com [97.86.134.216]:1909: 535 Incorrect authentication data (set_id=services)97.86.134.2166252001gv  -[' ossec13001g$Exim Auth failed2025-03-05 10:29:15 dovecot_plain authenticator failed for syn-071-012-241-225.res.spectrum.com [71.12.241.225]:43468: 535 Incorrect authentication data (set_id=sales)71.12.241.2256252001pu  -i+ ossec13001g Exim Auth failed2025-03-05 10:29:11 dovecot_plain authenticator failed for ([117.141.148.187]) [117.141.148.187]:43354: 535 Incorrect authentication data (set_id=services@heipowersystem.com)117.141.148.1871814991|t  -) ossec13001gExim Auth failed2025-03-05 10:29:04 dovecot_plain authenticator failed for syn-172-248-047-114.res.spectrum.com [172.248.47.114]:41285: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)172.248.47.1146252001 s  -) ossec13001g؜Exim Auth failed2025-03-05 10:22:44 dovecot_plain authenticator failed for (116.68.197.124.unknown.m1.com.sg) [124.197.68.116]:56149: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)124.197.68.1161880251 p5   8 ]-BQNpZ  -?) ossec13001gExim Auth failed2025-03-05 11:35:20 dovecot_plain authenticator failed for ([119.200.229.33]) [119.200.229.33]:45065: 535 Incorrect authentication data (set_id=services)119.200.229.331835841  - % ossec13001gExim Auth failed2025-03-05 11:34:51 dovecot_plain authenticator failed for port-ip-88-150-6-165.reverse.mdcc-fun.de [88.150.6.165]:59106: 535 Incorrect authentication data (set_id=services@heipowersystem.com)88.150.6.1652921044m  -e) ossec13001gExim Auth failed2025-03-05 11:34:51 dovecot_plain authenticator failed for ([138.75.118.229]) [138.75.118.229]:34458: 535 Incorrect authentication data (set_id=services@heipowersystem.com)138.75.118.2291880251g  -[' ossec13001g Exim Auth failed2025-03-05 11:32:50 dovecot_login authenticator failed for ([114.30.180.58]) [114.30.180.58]:40296: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)114.30.180.581835841Q  -3# ossec13001gZExim Auth failed2025-03-05 11:29:53 dovecot_plain authenticator failed for ([49.0.129.12]) [49.0.129.12]:56494: 535 Incorrect authentication data (set_id=services)49.0.129.122029969w  -{' ossec13001gEExim Auth failed2025-03-05 11:29:32 dovecot_plain authenticator failed for 81.60.194.189.dyn.user.ono.com [81.60.194.189]:59032: 535 Incorrect authentication data (set_id=services@heipowersystem.com)81.60.194.1892510769W  -;' ossec13001gExim Auth failed2025-03-05 11:23:41 dovecot_plain authenticator failed for ([111.48.214.96]) [111.48.214.96]:49836: 535 Incorrect authentication data (set_id=services)111.48.214.961814991j  -_) ossec13001gExim Auth failed2025-03-05 11:23:05 dovecot_plain authenticator failed for ([41.159.145.190]) [41.159.145.190]:40975: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)41.159.145.1902400553m  -e) ossec13001gExim Auth failed2025-03-05 11:23:04 dovecot_plain authenticator failed for ([183.109.148.43]) [183.109.148.43]:45050: 535 Incorrect authentication data (set_id=services@heipowersystem.com)183.109.148.431835841"  3M% ossec11301gZNew FTP connection.Mar 5 11:17:03 vm1 pure-ftpd[2319002]: (?@20.65.193.83) [INFO] New connection from 20.65.193.8320.65.193.836252001W  -9) ossec13001gExim Auth failed2025-03-05 11:15:19 dovecot_plain authenticator failed for ([60.171.237.143]) [60.171.237.143]:46503: 535 Incorrect authentication data (set_id=sales)60.171.237.1431814991W  -;' ossec13001gExim Auth failed2025-03-05 11:15:17 dovecot_plain authenticator failed for ([149.54.15.162]) [149.54.15.162]:58898: 535 Incorrect authentication data (set_id=services)149.54.15.1621149361j  -a' ossec13001gExim Auth failed2025-03-05 11:15:00 dovecot_plain authenticator failed for ([27.45.146.126]) [27.45.146.126]:50467: 535 Incorrect authentication data (set_id=services@heipowersystem.com)27.45.146.1261814991j  -_) ossec13001gExim Auth failed2025-03-05 11:14:51 dovecot_plain authenticator failed for ([121.190.129.68]) [121.190.129.68]:39131: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)121.190.129.681835841B  =}+ ossec13008g Mail Reciepient rejected2025-03-05 11:07:15 H=(mail.heipowersystem.com) [165.154.213.185]:51321 F= rejected RCPT : Rejected relay attempt: '165.154.213.185' From: 'zgjqxgmqs@heipowersystem.com' To: 'goofile@fastmail.com'165.154.213.1853469034]  -C+ ossec13001gExim Auth failed2025-03-05 11:06:23 dovecot_plain authenticator failed for ([117.196.209.244]) [117.196.209.244]:56138: 535 Incorrect authentication data (set_id=services)117.196.209.2441269750f  -]% ossec13001gExim Auth failed2025-03-05 11:06:06 dovecot_plain authenticator failed for ([185.167.56.2]) [185.167.56.2]:46906: 535 Incorrect authentication data (set_id=services@heipowersystem.com)185.167.56.2617790 !4 V h h m wW$  -;' ossec13001gExim Auth failed2025-03-05 12:15:25 dovecot_plain authenticator failed for ([46.52.204.227]) [46.52.204.227]:39165: 535 Incorrect authentication data (set_id=services)46.52.204.2272017370x#  -% ossec13001gExim Auth failed2025-03-05 12:15:09 dovecot_plain authenticator failed for 95-30-250-44.broadband.corbina.ru [95.30.250.44]:49646: 535 Incorrect authentication data (set_id=services@heipowersystem.com)95.30.250.442017370+"  =Q) ossec13008g}Mail Reciepient rejected2025-03-05 12:13:09 H=(mail.nyaystambh.com) [165.154.226.98]:56091 F= rejected RCPT : Rejected relay attempt: '165.154.226.98' From: 'qikbb@nyaystambh.com' To: 'goofile@fastmail.com'165.154.226.981668284W!  -;' ossec13001gwExim Auth failed2025-03-05 12:08:47 dovecot_plain authenticator failed for ([211.109.75.67]) [211.109.75.69]:50802: 535 Incorrect authentication data (set_id=services)211.109.75.691835841s  -u% ossec13001gkExim Auth failed2025-03-05 12:08:34 dovecot_plain authenticator failed for 206.81.4.146.static.wline.lns.sme.cust.swisscom.ch [146.4.81.206]:60475: 535 Incorrect authentication data (set_id=sales)146.4.81.2062658434i  -a' ossec13001ggExim Auth failed2025-03-05 12:08:31 dovecot_plain authenticator failed for ([196.46.199.11]) [196.46.199.11]:53811: 535 Incorrect authentication data (set_id=services@heipowersystem.com)196.46.199.11895949j  -_) ossec13001g]Exim Auth failed2025-03-05 12:08:20 dovecot_plain authenticator failed for ([183.167.196.62]) [183.167.196.62]:58285: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)183.167.196.621814991f  -[' ossec13001gExim Auth failed2025-03-05 12:00:33 dovecot_plain authenticator failed for ([94.202.148.15]) [94.202.148.15]:56198: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)94.202.148.15290557  -% ossec13001gExim Auth failed2025-03-05 12:00:56 dovecot_plain authenticator failed for 61-216-7-163.hinet-ip.hinet.net ([61.216.7.165]) [61.216.7.163]:43640: 535 Incorrect authentication data (set_id=services@heipowersystem.com)61.216.7.1631668284g  -[' ossec13001gExim Auth failed2025-03-05 11:53:37 dovecot_plain authenticator failed for syn-045-049-179-157.res.spectrum.com [45.49.179.157]:52323: 535 Incorrect authentication data (set_id=sales)45.49.179.1576252001w  -{' ossec13001gExim Auth failed2025-03-05 11:53:15 dovecot_plain authenticator failed for (cajasolidariaguachinango.com.mx) [201.144.8.115]:55757: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)201.144.8.1153996063|  -) ossec13001gExim Auth failed2025-03-05 11:52:01 dovecot_plain authenticator failed for 80.111.168.125.sta.wbroadband.net.au [125.168.111.80]:53510: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)125.168.111.802077456j  -a' ossec13001gExim Auth failed2025-03-05 11:52:12 dovecot_plain authenticator failed for ([120.24.83.156]) [223.104.199.0]:18562: 535 Incorrect authentication data (set_id=services@heipowersystem.com)223.104.199.01814991Z  -?) ossec13001gyExim Auth failed2025-03-05 11:38:56 dovecot_plain authenticator failed for ([123.209.194.49]) [123.209.194.49]:57202: 535 Incorrect authentication data (set_id=services)123.209.194.492077456i  -a' ossec13001gWExim Auth failed2025-03-05 11:38:22 dovecot_plain authenticator failed for ([94.201.79.121]) [94.201.79.121]:51118: 535 Incorrect authentication data (set_id=services@heipowersystem.com)94.201.79.121290557[  -A+ ossec13001gExim Auth failed2025-03-05 11:35:33 dovecot_plain authenticator failed for ([196.200.227.78]) [196.200.227.194]:55800: 535 Incorrect authentication data (set_id=services)196.200.227.194149590 w- O ]  5Gi6bwg5  -]% ossec13001gExim Auth failed2025-03-05 12:54:05 dovecot_plain authenticator failed for ([218.68.0.210]) [218.68.0.210]:48199: 535 Incorrect authentication data (set_id=services@heipowersystem.com)218.68.0.2101814991P4  -1% ossec13001gExim Auth failed2025-03-05 12:54:03 dovecot_plain authenticator failed for ([91.92.130.86]) [91.92.130.86]:38350: 535 Incorrect authentication data (set_id=sales)91.92.130.86130758d3  -W% ossec13001g Exim Auth failed2025-03-05 12:53:53 dovecot_plain authenticator failed for ([80.82.54.138]) [81.211.77.58]:33942: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)81.211.77.582017370G2  =+ ossec13008gMail Reciepient rejected2025-03-05 12:48:48 H=(mail.thepsindustries.com) [165.154.226.249]:60086 F= rejected RCPT : Rejected relay attempt: '165.154.226.249' From: 'ugadrhhqtx@thepsindustries.com' To: 'goofile@fastmail.com'165.154.226.2491668284Z1  -?) ossec13001gYExim Auth failed2025-03-05 12:46:40 dovecot_plain authenticator failed for ([188.247.49.186]) [188.247.49.186]:42496: 535 Incorrect authentication data (set_id=services)188.247.49.1862017370j0  -a' ossec13001g;Exim Auth failed2025-03-05 12:46:11 dovecot_plain authenticator failed for ([49.245.10.228]) [49.245.10.228]:50227: 535 Incorrect authentication data (set_id=services@heipowersystem.com)49.245.10.2281880251S/  -5' ossec13001g9Exim Auth failed2025-03-05 12:46:09 dovecot_plain authenticator failed for ([185.167.56.24]) [185.167.56.24]:41528: 535 Incorrect authentication data (set_id=sales)185.167.56.24617790c.  -U% ossec13001g+Exim Auth failed2025-03-05 12:45:55 dovecot_plain authenticator failed for ([42.236.91.93]) [42.236.91.93]:8450: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)42.236.91.931814991Z-  -?) ossec13001g-Exim Auth failed2025-03-05 12:37:24 dovecot_plain authenticator failed for ([216.194.174.74]) [216.194.174.27]:20359: 535 Incorrect authentication data (set_id=services)216.194.174.276252001U,  -7' ossec13001gExim Auth failed2025-03-05 12:37:07 dovecot_plain authenticator failed for ([218.106.120.18]) [58.49.113.138]:11734: 535 Incorrect authentication data (set_id=sales)58.49.113.1381814991g+  -]% ossec13001gExim Auth failed2025-03-05 12:37:03 dovecot_plain authenticator failed for ([27.124.18.27]) [27.124.18.27]:55398: 535 Incorrect authentication data (set_id=services@heipowersystem.com)27.124.18.271269750i*  -_) ossec13001g Exim Auth failed2025-03-05 12:36:50 dovecot_plain authenticator failed for ([94.204.230.214]) [94.204.230.214]:37679: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)94.204.230.214290557W)  -;' ossec13001gExim Auth failed2025-03-05 12:24:10 dovecot_plain authenticator failed for ([120.253.31.84]) [120.253.31.84]:11579: 535 Incorrect authentication data (set_id=services)120.253.31.841814991n(  -g) ossec13001gExim Auth failed2025-03-05 12:23:57 dovecot_plain authenticator failed for ([101.230.251.217]) [180.154.53.221]:35773: 535 Incorrect authentication data (set_id=services@heipowersystem.com)180.154.53.2211814991Z'  -?) ossec13001gFExim Auth failed2025-03-05 12:20:44 dovecot_plain authenticator failed for ([183.109.148.43]) [183.109.148.43]:45730: 535 Incorrect authentication data (set_id=services)183.109.148.431835841m&  -e) ossec13001g:Exim Auth failed2025-03-05 12:20:32 dovecot_plain authenticator failed for ([218.23.156.227]) [218.23.156.227]:59763: 535 Incorrect authentication data (set_id=services@heipowersystem.com)218.23.156.2271814991^% -E) ossec13001gExim Auth failed2025-03-05 12:18:56 dovecot_login authenticator failed for (vandanabalbharti.com) [101.89.140.209]:54610: 535 Incorrect authentication data (set_id=nologin)101.89.140.2091814991 "1 Y { 4(KLD  =+ ossec13008ghMail Reciepient rejected2025-03-05 13:33:50 H=(mail.vandanabalbharti.com) [165.154.213.166]:64370 F= rejected RCPT : Rejected relay attempt: '165.154.213.166' From: 'frldzkxbgvj@vandanabalbharti.com' To: 'goofile@fastmail.com'165.154.213.1663469034hC  -]' ossec13001gExim Auth failed2025-03-05 13:31:58 dovecot_plain authenticator failed for ([223.75.231.193]) [58.49.113.138]:16111: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)58.49.113.1381814991~B  Ua' ossec11001gDeferred login on the cpanel service[2025-03-05 13:26:47 +0530] info [webmaild] 157.38.135.83 - kps@amplifypowerglobal.com "POST /cpsess5509030091/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [157.38.135.77] != Current IP Address [157.38.135.83]157.38.135.831269750YA  -?) ossec13001gExim Auth failed2025-03-05 13:23:29 dovecot_plain authenticator failed for ([94.204.230.214]) [94.204.230.214]:37786: 535 Incorrect authentication data (set_id=services)94.204.230.214290557m@  -e) ossec13001gExim Auth failed2025-03-05 13:23:13 dovecot_plain authenticator failed for ([112.102.48.129]) [112.102.48.129]:38833: 535 Incorrect authentication data (set_id=services@heipowersystem.com)112.102.48.1291814991j?  -_) ossec13001geExim Auth failed2025-03-05 13:16:44 dovecot_login authenticator failed for ([116.10.127.167]) [116.10.127.167]:36547: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)116.10.127.1671814991)> U5' ossec11001gDeferred login on the cpanel service[2025-03-05 13:10:45 +0530] info [webmaild] 157.38.135.77 - kps@amplifypowerglobal.com "GET /cpsess9848732088/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect157.38.135.771269750=  Uc' ossec11001gDeferred login on the cpanel service[2025-03-05 13:10:27 +0530] info [webmaild] 157.38.135.77 - kps@amplifypowerglobal.com "POST /cpsess9848732088/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [157.38.134.202] != Current IP Address [157.38.135.77]157.38.135.771269750W<  -;' ossec13001gExim Auth failed2025-03-05 13:09:59 dovecot_plain authenticator failed for ([211.109.75.66]) [211.109.75.69]:54405: 535 Incorrect authentication data (set_id=services)211.109.75.691835841z;  -# ossec13001gExim Auth failed2025-03-05 13:09:47 dovecot_plain authenticator failed for 83-81-93-98.cable.dynamic.v4.ziggo.nl [83.81.93.98]:40418: 535 Incorrect authentication data (set_id=services@heipowersystem.com)83.81.93.982750405g:  -]% ossec13001gExim Auth failed2025-03-05 13:05:58 dovecot_plain authenticator failed for ([74.95.13.185]) [74.95.13.185]:57374: 535 Incorrect authentication data (set_id=services@heipowersystem.com)74.95.13.1856252001Z9  -?) ossec13001gExim Auth failed2025-03-05 13:06:15 dovecot_plain authenticator failed for ([46.146.227.191]) [46.146.227.191]:57220: 535 Incorrect authentication data (set_id=services)46.146.227.1912017370T8  -7% ossec13001gExim Auth failed2025-03-05 13:01:29 dovecot_plain authenticator failed for ([74.95.13.185]) [74.95.13.185]:49379: 535 Incorrect authentication data (set_id=services)74.95.13.1856252001m7  -e) ossec13001gExim Auth failed2025-03-05 13:01:17 dovecot_plain authenticator failed for ([222.117.88.230]) [222.117.88.230]:59442: 535 Incorrect authentication data (set_id=services@heipowersystem.com)222.117.88.2301835841Z6  -?) ossec13001g,Exim Auth failed2025-03-05 12:54:27 dovecot_plain authenticator failed for ([111.93.177.228]) [111.93.177.228]:49416: 535 Incorrect authentication data (set_id=services)111.93.177.2281269750 W?moW?'?zaH/ g N 5   m T ; " t [ B )  z a H /  h O 6  nU<# y`G.fM4lS:! sZA(y`G.Q8pW"GRAYBGRAY%GRAY$cGRAY{GRAY 8GRAY GRAY u]GRAY- ZBLACKr- "BLACK-8BLACK-LBLACK,BLACK,W BLACK)+jBLACK+BLACK)OBLACK(~BLACK(~BLACK (~<BLACK (uBLACK:(q[`BLACK(WBLACK(WBLACKk(TBLACK(EEBLACK(E)BLACK)(E(BLACK-'jyGRAY%/BLACK%<BLACK#BLACK#^BLACK"mBLACKfBLACKyc BLACK`VBLACK^5nBLACKXBLACKslBLACKVlBLACKpBLACKBLACKnzeBLACKrz8BLACKR);BLACKD%5BLACKBLACK BLACKq BLACKmBLACKQBLACKrBLACK6BLACK>HHGRAYoGRAYGRAYGRAYGRAY .BLACK %BLACK ^vBLACK ^cbBLACK  ^bBLACK ^EBLACK VBzBLACK OJBLACK OBLACK  OBLACK O2BLACKe OBLACK OBLACK OBLACK O+BLACK  OBLACK OBLACK OABLACK OBLACK0 OBLACKD OeBLACK OeBLACK O<BLACKZ O;@BLACK5 O:BLACK. O:BLACKg O:TBLACK` O4BLACK O2QBLACK^ OBLACK OBLACK OBLACK OnBLACK\ OBLACK] MbBLACK L׾BLACK LBLACK LBLACKT LӦBLACK KdBLACK JzBLACKx JBLACKo JwBLACK JBLACK} JBLACK J'BLACK J$BLACK J_BLACK J~BLACK JBLACK2 Je`BLACK JeHBLACKo J`BLACK JGBLACK J>BLACK HBLACK HrBLACK EBLACKf E|BLACK EBLACK E BLACK EBLACKc DvPBLACK DtBBLACK DBLACKU0%BLACK^7BLACKl7UBLACK|7FBLACKa6IBLACK1BLACKzGRAYsGRAYO+GRAY=~GRAY$GRAYaGRAYGRAYBLACKh.ɘBLACK4<BLACKg 0GRAYhОBLACK4ѐBLACKJBLACKJBLACK47uBLACK4QjBLACK4BLACK4z"BLACK4BLACK4_EBLACK4_iBLACK4yBLACK+J05BLACKJ0BLACKJ3LBLACK4BLACK~4aBLACK46BLACK4!BLACK4BLACK'4zBLACK4XBLACK14TBLACK4:BLACK!4BLACK4#BLACKdM}GRAY4_BLACK4^BLACK4^ BLACK Y4yNBLACK4y'BLACKgBLACKi]BLACK_mBLACK^Hw=BLACK^BLACK[UBLACK T+BLACKTBLACKTBLACKT4BLACKT4BLACKT4BLACKT4BLACKT4BLACKQ.BLACKQFGRAYO]!BLACKE s%: @ e 1.MsVU  -9) ossec13001gExim Auth failed2025-03-05 14:18:10 dovecot_plain authenticator failed for ([87.236.141.106]) [87.236.141.106]:34445: 535 Incorrect authentication data (set_id=sales)87.236.141.106290291]T  -C+ ossec13001gExim Auth failed2025-03-05 14:18:05 dovecot_plain authenticator failed for ([199.188.103.179]) [199.188.103.179]:60394: 535 Incorrect authentication data (set_id=services)199.188.103.1796252001S  - ) ossec13001gExim Auth failed2025-03-05 14:17:45 dovecot_plain authenticator failed for 0x3ec67866.ejb.customer.dk.telia.net [62.198.120.102]:59249: 535 Incorrect authentication data (set_id=services@heipowersystem.com)62.198.120.1022623032jR  -_) ossec13001gExim Auth failed2025-03-05 14:17:43 dovecot_plain authenticator failed for ([41.159.145.190]) [41.159.145.190]:43609: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)41.159.145.1902400553vQ  -{% ossec13001g Exim Auth failed2025-03-05 14:08:53 dovecot_plain authenticator failed for 1-34-162-249.hinet-ip.hinet.net [1.34.162.249]:43053: 535 Incorrect authentication data (set_id=services@heipowersystem.com)1.34.162.2491668284jP  -_) ossec13001g Exim Auth failed2025-03-05 14:08:53 dovecot_plain authenticator failed for ([151.49.116.193]) [151.49.116.193]:59438: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)151.49.116.1933175395aO  -O' ossec13001g Exim Auth failed2025-03-05 14:04:54 dovecot_login authenticator failed for (nyaystambh.com) [111.207.12.99]:35156: 535 Incorrect authentication data (set_id=test@nyaystambh.com)111.207.12.991814991UN  -7' ossec13001g Exim Auth failed2025-03-05 14:04:30 dovecot_login authenticator failed for (nyaystambh.com) [111.207.12.99]:60206: 535 Incorrect authentication data (set_id=nologin)111.207.12.991814991ZM  -?) ossec13001g Exim Auth failed2025-03-05 13:55:57 dovecot_plain authenticator failed for ([61.143.241.150]) [61.143.241.150]:41102: 535 Incorrect authentication data (set_id=services)61.143.241.1501814991}L  - % ossec13001g xExim Auth failed2025-03-05 13:55:27 dovecot_plain authenticator failed for broadband-188-32-68-79.ip.moscow.rt.ru [188.32.68.79]:47488: 535 Incorrect authentication data (set_id=services@heipowersystem.com)188.32.68.792017370rK  -q' ossec13001g Exim Auth failed2025-03-05 13:52:05 dovecot_plain authenticator failed for 126.64.125.78.rev.sfr.net [78.125.64.126]:59476: 535 Incorrect authentication data (set_id=services@heipowersystem.com)78.125.64.1263017382pJ  -i+ ossec13001gmExim Auth failed2025-03-05 13:46:44 dovecot_plain authenticator failed for ([175.205.126.214]) [175.205.126.214]:54490: 535 Incorrect authentication data (set_id=services@heipowersystem.com)175.205.126.2141835841SI  -7% ossec13001g{Exim Auth failed2025-03-05 13:46:59 dovecot_plain authenticator failed for ([94.200.95.18]) [94.200.95.18]:57084: 535 Incorrect authentication data (set_id=services)94.200.95.18290557WH  -;' ossec13001gExim Auth failed2025-03-05 13:40:11 dovecot_plain authenticator failed for ([103.65.227.71]) [103.65.227.71]:48964: 535 Incorrect authentication data (set_id=services)103.65.227.711210997vG  -w) ossec13001gExim Auth failed2025-03-05 13:40:01 dovecot_plain authenticator failed for (183.83.188.236.actcorp.in) [183.83.188.236]:52302: 535 Incorrect authentication data (set_id=services@heipowersystem.com)183.83.188.2361269750gF  -[' ossec13001gExim Auth failed2025-03-05 13:39:50 dovecot_plain authenticator failed for ([211.114.40.60]) [211.114.40.60]:40518: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)211.114.40.601835841WE  -9) ossec13001gExim Auth failed2025-03-05 13:40:20 dovecot_plain authenticator failed for ([216.194.174.27]) [216.194.174.27]:31542: 535 Incorrect authentication data (set_id=sales)216.194.174.276252001   C U g y   re  -q' ossec13001gExim Auth failed2025-03-05 14:43:05 dovecot_plain authenticator failed for ([59.46.185.130]) [59.46.185.130]:35781: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)59.46.185.1301814991 d  -!% ossec13001gExim Auth failed2025-03-05 14:43:02 dovecot_login authenticator failed for (5x164x185x13.dynamic.samara.ertelecom.ru) [5.164.185.13]:46246: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)5.164.185.132017370uc  -{# ossec13001gTExim Auth failed2025-03-05 14:41:47 dovecot_plain authenticator failed for (70.246.50.116.ids.service.static.eastern-tele.com) [58.69.17.18]:48566: 535 Incorrect authentication data (set_id=services)58.69.17.181694008zb  -# ossec13001g@Exim Auth failed2025-03-05 14:41:28 dovecot_plain authenticator failed for 18.red-83-48-39.staticip.rima-tde.net [83.48.39.18]:60558: 535 Incorrect authentication data (set_id=services@heipowersystem.com)83.48.39.182510769fa  -]% ossec13001gExim Auth failed2025-03-05 14:40:01 dovecot_login authenticator failed for ([94.200.20.66]) [94.200.20.66]:59929: 535 Incorrect authentication data (set_id=services@heipowersystem.com)94.200.20.66290557]`  -C+ ossec13001gExim Auth failed2025-03-05 14:40:14 dovecot_login authenticator failed for ([125.139.124.120]) [125.139.124.120]:37032: 535 Incorrect authentication data (set_id=services)125.139.124.1201835841]_  -C+ ossec13001glExim Auth failed2025-03-05 14:37:56 dovecot_plain authenticator failed for ([211.238.237.254]) [211.238.237.254]:58883: 535 Incorrect authentication data (set_id=services)211.238.237.2541835841m^  -e) ossec13001g`Exim Auth failed2025-03-05 14:37:44 dovecot_plain authenticator failed for ([161.35.200.202]) [161.35.200.202]:36236: 535 Incorrect authentication data (set_id=services@heipowersystem.com)161.35.200.2022921044Z]  -=+ ossec13001g`Exim Auth failed2025-03-05 14:33:26 dovecot_login authenticator failed for ([183.107.210.176]) [183.107.210.176]:53644: 535 Incorrect authentication data (set_id=sales)183.107.210.1761835841p\  -k) ossec13001gVExim Auth failed2025-03-05 14:33:17 dovecot_login authenticator failed for (customer-187-237-47-214.uninet-ide.com.mx) [187.237.47.214]:58978: 535 Incorrect authentication data (set_id=sales)187.237.47.2143996063j[  -_) ossec13001gJExim Auth failed2025-03-05 14:33:06 dovecot_login authenticator failed for ([221.165.172.38]) [221.165.172.38]:44650: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)221.165.172.381835841jZ  -_) ossec13001gBExim Auth failed2025-03-05 14:32:57 dovecot_login authenticator failed for ([175.205.191.27]) [175.205.191.27]:38346: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)175.205.191.271835841jY  -a' ossec13001g<Exim Auth failed2025-03-05 14:32:51 dovecot_plain authenticator failed for ([114.216.5.134]) [114.216.5.134]:55710: 535 Incorrect authentication data (set_id=services@heipowersystem.com)114.216.5.1341814991QX  -1% ossec13001gExim Auth failed2025-03-05 14:25:59 dovecot_plain authenticator failed for ([31.173.2.172]) [31.173.2.172]:49342: 535 Incorrect authentication data (set_id=sales)31.173.2.1722017370mW  -c+ ossec13001gExim Auth failed2025-03-05 14:25:38 dovecot_plain authenticator failed for ([213.195.113.234]) [213.195.113.234]:54942: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)213.195.113.2342510769sV  -s' ossec13001gExim Auth failed2025-03-05 14:26:01 dovecot_plain authenticator failed for 83.106.54.198.in-addr.arpa [198.54.106.83]:55542: 535 Incorrect authentication data (set_id=services@heipowersystem.com)198.54.106.836252001 W 3 F f r  !/WTv  -7% ossec13001gGExim Auth failed2025-03-05 15:24:13 dovecot_plain authenticator failed for ([60.11.20.130]) [60.11.20.130]:58978: 535 Incorrect authentication data (set_id=services)60.11.20.1301814991nu  -g) ossec13001g9Exim Auth failed2025-03-05 15:24:01 dovecot_plain authenticator failed for ([101.230.251.217]) [180.154.53.221]:23656: 535 Incorrect authentication data (set_id=services@heipowersystem.com)180.154.53.2211814991dt  -U' ossec13001gwExim Auth failed2025-03-05 15:20:46 dovecot_plain authenticator failed for h77-53-235-246.cust.bredband2.com [77.53.235.246]:42458: 535 Incorrect authentication data (set_id=sales)77.53.235.2462661886ss  -u% ossec13001giExim Auth failed2025-03-05 15:20:31 dovecot_plain authenticator failed for 111-70-3-198.emome-ip.hinet.net [111.70.3.198]:53170: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)111.70.3.1981668284mr  -g' ossec13001g Exim Auth failed2025-03-05 15:19:00 dovecot_plain authenticator failed for ip4d16b6e6.dynamic.kabel-deutschland.de [77.22.182.230]:37876: 535 Incorrect authentication data (set_id=services)77.22.182.2302921044mq  -e) ossec13001gExim Auth failed2025-03-05 15:18:47 dovecot_plain authenticator failed for ([39.183.162.243]) [39.183.162.243]:58522: 535 Incorrect authentication data (set_id=services@heipowersystem.com)39.183.162.2431814991_p  -K' ossec13001g:Exim Auth failed2025-03-05 15:11:14 dovecot_login authenticator failed for ([118.188.18.25]) [118.188.18.25]:12316: 535 Incorrect authentication data (set_id=vikas.khandelwal)118.188.18.251814991oo  -m% ossec13001gExim Auth failed2025-03-05 15:10:46 dovecot_login authenticator failed for ([60.174.34.26]) [60.174.34.26]:48287: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)60.174.34.261814991Zn  -?) ossec13001gExim Auth failed2025-03-05 15:04:31 dovecot_plain authenticator failed for ([59.102.188.188]) [59.102.188.188]:48108: 535 Incorrect authentication data (set_id=services)59.102.188.1881668284mm  -c+ ossec13001gExim Auth failed2025-03-05 15:04:14 dovecot_plain authenticator failed for ([182.224.231.102]) [182.224.231.102]:60716: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)182.224.231.1021835841gl  -]% ossec13001gExim Auth failed2025-03-05 15:04:08 dovecot_plain authenticator failed for ([1.212.225.99]) [1.212.225.99]:58872: 535 Incorrect authentication data (set_id=services@heipowersystem.com)1.212.225.991835841pk  -i+ ossec13001g{Exim Auth failed2025-03-05 14:55:15 dovecot_plain authenticator failed for ([116.228.195.251]) [116.228.195.251]:49219: 535 Incorrect authentication data (set_id=services@heipowersystem.com)116.228.195.2511814991\j  -G% ossec13001gExim Auth failed2025-03-05 14:43:47 dovecot_login authenticator failed for ([58.122.255.2]) [58.122.255.2]:53964: 535 Incorrect authentication data (set_id=vikas.khandelwal)58.122.255.21835841ii  -[+ ossec13001gExim Auth failed2025-03-05 14:43:43 dovecot_login authenticator failed for ([125.139.124.120]) [125.139.124.120]:59782: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)125.139.124.1201835841bh  -O) ossec13001gExim Auth failed2025-03-05 14:43:32 dovecot_plain authenticator failed for ([49.124.131.160]) [49.124.131.160]:36608: 535 Incorrect authentication data (set_id=vikas.khandelwal)49.124.131.1601733045sg  -u% ossec13001gExim Auth failed2025-03-05 14:43:23 dovecot_login authenticator failed for ([36.112.75.46]) [36.112.75.46]:51604: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)36.112.75.461814991lf  -e' ossec13001gExim Auth failed2025-03-05 14:43:19 dovecot_login authenticator failed for bb115-66-129-26.singnet.com.sg [115.66.129.26]:55882: 535 Incorrect authentication data (set_id=vikas.khandelwal)115.66.129.261880251 X ? N d f .0B\X  - ' ossec13001g)Exim Auth failed2025-03-05 16:09:53 dovecot_plain authenticator failed for (mobile-166-195-004-247.mycingular.net) [166.195.4.247]:42196: 535 Incorrect authentication data (set_id=services@heipowersystem.com)166.195.4.2476252001b  -M+ ossec13001g(Exim Auth failed2025-03-05 16:04:51 dovecot_plain authenticator failed for pcd429162.netvigator.com [203.218.219.162]:48204: 535 Incorrect authentication data (set_id=services)203.218.219.1621819730j  -a' ossec13001g(Exim Auth failed2025-03-05 16:04:32 dovecot_plain authenticator failed for ([211.202.71.21]) [211.202.71.21]:35255: 535 Incorrect authentication data (set_id=services@heipowersystem.com)211.202.71.211835841z  -% ossec13001g'9Exim Auth failed2025-03-05 15:58:08 dovecot_plain authenticator failed for h-46-59-44-182.a980.priv.bahnhof.se [46.59.44.182]:46400: 535 Incorrect authentication data (set_id=services@heipowersystem.com)46.59.44.1822661886d  -W% ossec13001g'1Exim Auth failed2025-03-05 15:57:59 dovecot_plain authenticator failed for ([60.174.231.6]) [60.174.231.6]:56736: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)60.174.231.61814991O  -3# ossec13001g%YExim Auth failed2025-03-05 15:50:07 dovecot_plain authenticator failed for ([65.20.169.5]) [65.20.169.5]:39582: 535 Incorrect authentication data (set_id=services)65.20.169.599237Z  -=+ ossec13001g%SExim Auth failed2025-03-05 15:50:02 dovecot_plain authenticator failed for ([178.178.194.128]) [178.178.194.128]:36886: 535 Incorrect authentication data (set_id=sales)178.178.194.1282017370m  -e) ossec13001g%OExim Auth failed2025-03-05 15:49:58 dovecot_plain authenticator failed for ([49.124.152.253]) [49.124.152.253]:52446: 535 Incorrect authentication data (set_id=services@heipowersystem.com)49.124.152.2531733045g  -[' ossec13001g%>Exim Auth failed2025-03-05 15:49:42 dovecot_plain authenticator failed for ([101.58.144.50]) [101.58.144.50]:48210: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)101.58.144.503175395g~  -]% ossec13001g#2Exim Auth failed2025-03-05 15:40:57 dovecot_plain authenticator failed for ([1.247.245.61]) [1.247.245.61]:57610: 535 Incorrect authentication data (set_id=services@heipowersystem.com)1.247.245.611835841T}  -5' ossec13001g#0Exim Auth failed2025-03-05 15:40:56 dovecot_plain authenticator failed for ([41.216.169.13]) [41.216.169.13]:48008: 535 Incorrect authentication data (set_id=sales)41.216.169.132328926z|  -% ossec13001g#Exim Auth failed2025-03-05 15:40:37 dovecot_plain authenticator failed for broadband-188-32-68-79.ip.moscow.rt.ru [188.32.68.79]:57765: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)188.32.68.792017370f{  -Y' ossec13001g!Exim Auth failed2025-03-05 15:33:49 dovecot_login authenticator failed for 111-70-49-103.emome-ip.hinet.net [111.70.49.103]:55464: 535 Incorrect authentication data (set_id=services)111.70.49.1031668284mz  -e) ossec13001g!wExim Auth failed2025-03-05 15:33:35 dovecot_login authenticator failed for ([46.138.247.195]) [46.138.247.195]:50766: 535 Incorrect authentication data (set_id=services@heipowersystem.com)46.138.247.1952017370Uy  -;' ossec13001g 9Exim Auth failed2025-03-05 15:28:16 dovecot_plain authenticator failed for ([65.20.235.206]) [65.20.235.206]:42968: 535 Incorrect authentication data (set_id=services)65.20.235.20699237gx  -]% ossec13001g %Exim Auth failed2025-03-05 15:27:56 dovecot_plain authenticator failed for ([141.94.18.69]) [141.94.18.69]:39716: 535 Incorrect authentication data (set_id=services@heipowersystem.com)141.94.18.693017382yw  -}) ossec13001gExim Auth failed2025-03-05 15:27:01 dovecot_plain authenticator failed for ([190.121.193.46]) [190.121.193.46]:45034: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)190.121.193.463595528 8 J l ~  -ASecV  -;' ossec13001g3Exim Auth failed2025-03-05 16:51:15 dovecot_plain authenticator failed for ([41.59.228.160]) [41.59.228.160]:58630: 535 Incorrect authentication data (set_id=services)41.59.228.160149590~  -+ ossec13001g3Exim Auth failed2025-03-05 16:51:01 dovecot_plain authenticator failed for d142-179-145-166.abhsia.telus.net [142.179.145.166]:53084: 535 Incorrect authentication data (set_id=services@heipowersystem.com)142.179.145.1666251999j  -a' ossec13001g1Exim Auth failed2025-03-05 16:44:05 dovecot_plain authenticator failed for ([218.4.205.242]) [218.4.205.242]:40296: 535 Incorrect authentication data (set_id=services@heipowersystem.com)218.4.205.2421814991j  -_) ossec13001g1Exim Auth failed2025-03-05 16:43:38 dovecot_plain authenticator failed for ([209.38.100.151]) [209.38.100.151]:55894: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)209.38.100.1512750405h  -Y+ ossec13001g2Exim Auth failed2025-03-05 16:44:08 dovecot_plain authenticator failed for (208.235.164.124.adsl-pool.sx.cn) [124.164.235.208]:58069: 535 Incorrect authentication data (set_id=sales)124.164.235.2081814991f  -Y' ossec13001g0Exim Auth failed2025-03-05 16:39:06 dovecot_plain authenticator failed for c188-151-64-10.bredband.tele2.se [188.151.64.10]:60756: 535 Incorrect authentication data (set_id=services)188.151.64.102661886p  -i+ ossec13001g0Exim Auth failed2025-03-05 16:38:46 dovecot_plain authenticator failed for ([182.163.122.133]) [182.163.122.133]:46827: 535 Incorrect authentication data (set_id=services@heipowersystem.com)182.163.122.1331210997Z  -?) ossec13001g0Exim Auth failed2025-03-05 16:36:05 dovecot_plain authenticator failed for ([46.146.227.191]) [46.146.227.191]:57594: 535 Incorrect authentication data (set_id=services)46.146.227.1912017370T  -5' ossec13001g0Exim Auth failed2025-03-05 16:35:59 dovecot_plain authenticator failed for ([195.24.215.70]) [195.24.215.70]:34708: 535 Incorrect authentication data (set_id=sales)195.24.215.702233387m  -e) ossec13001g0Exim Auth failed2025-03-05 16:35:54 dovecot_plain authenticator failed for ([168.126.90.210]) [168.126.90.210]:44716: 535 Incorrect authentication data (set_id=services@heipowersystem.com)168.126.90.2101835841j  -_) ossec13001g0Exim Auth failed2025-03-05 16:35:42 dovecot_plain authenticator failed for ([121.189.198.60]) [121.189.198.60]:52620: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)121.189.198.601835841Z  -?) ossec13001g-Exim Auth failed2025-03-05 16:26:56 dovecot_plain authenticator failed for ([27.128.162.146]) [27.128.162.146]:50602: 535 Incorrect authentication data (set_id=services)27.128.162.1461814991j  -a' ossec13001g-Exim Auth failed2025-03-05 16:26:43 dovecot_plain authenticator failed for ([220.74.63.183]) [220.74.63.183]:37708: 535 Incorrect authentication data (set_id=services@heipowersystem.com)220.74.63.1831835841Z  -=+ ossec13001g-Exim Auth failed2025-03-05 16:26:41 dovecot_plain authenticator failed for ([117.240.117.171]) [117.240.117.170]:59848: 535 Incorrect authentication data (set_id=sales)117.240.117.1701269750j  -_) ossec13001g-Exim Auth failed2025-03-05 16:26:28 dovecot_plain authenticator failed for ([158.140.39.128]) [158.140.39.128]:34234: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)158.140.39.1286252001W  -;' ossec13001g*Exim Auth failed2025-03-05 16:13:45 dovecot_plain authenticator failed for ([58.238.181.96]) [58.238.181.96]:37993: 535 Incorrect authentication data (set_id=services)58.238.181.961835841i  -a' ossec13001g*Exim Auth failed2025-03-05 16:13:33 dovecot_plain authenticator failed for ([94.205.250.78]) [94.205.250.78]:53334: 535 Incorrect authentication data (set_id=services@heipowersystem.com)94.205.250.78290557 ~ 2  XtgZM@3& }pcVI</"sq J = 0 F 2Y KWjydf , e=l_RE8+ m J rC6)Pw  yl_RE8+ u h [ N A 4 '  ~ q d 0# L?]{naTG:- wj]PC6) v i \ O B 5 (    > 1 $  9 ` S z #  W2635 2542007J] 2635167;< 2635167; 2542007J 2623032? 2542007; 2635167 2635167 2635167 2635167  2635167 2635167 2635167 2635167 2635167 2635167  2635167u 2635167 2635167& 2635167 2635167 2635167 2635167 2635167;{ 25895819f 2635167 2635167= 2635167= 2635167< 2635167<' 2635167; 2635167; 2635167 2635167 2635167| 2635167 2635167 2635167Q 2635167* 26296911 26296910 2629691( 2629691(# 2629691"W 2629691 26230324 26230323 26230322 2623032/ 2623032> 26230320 2623032i 2623032 2623032 2623032p 2623032 2623032@ 26230328 25420070# 2542007/ 2542007.( 2542007.& 2542007, 2542007, 2542007,4 2542007*5 2542007( 2542007'6 2542007& 2542007#W 2542007 2542007 2542007% 2542007& 2542007 } 2542007  2542007  2542007 2542007 2542007 2542007 2542007 2542007 2542007 2542007 2542007 2542007e 2635167Es 2635167Er 2635167Eq 2635167En 2635167Em 2635167El 2635167EL 2635167EK 2635167EJ 2635167E 2635167D 2635167D 2635167D 2635167C 2635167C 2635167B 2635167BX 2635167BG 2635167B7 2635167A 2635167AG 2635167AF 2635167AE 2635167AD 2635167AC 2635167A5 2635167@ 2635167@ 2635167@ 2635167@O 2635167@- 2635167? 2635167?U 2635167?T 2635167?S 2635167>I 2635167=m 2635167= 2635167= 2635167H 2635167 2635167l 2635167 2635167 2635167 2635167 2635167 2635167 2635167 2635167 2635167I 2635167I 2635167I 2542007OO 2510769O 2623032N 2629691M 2510769M 2623032L 2510769L 2542007L` 2510769L? 2510769L$ 2635167H 2635167HL 2635167H 2635167G 2635167G 2635167Gd 2635167G 2635167F 2635167F 2635167F 2635167F 2635167F` 2635167FR 2635167F 2635167E 2635167E 2635167E 2635167E 26351679 26351679 26351679 26351679 2510769I 2635167I 2629691I 2542007H 2635167J 2623032H 2635167J 2542007G 2635167K 2635167K 2629691G4 2635167M 2635167K 2629691F 2542007F 2542007E 2542007Eb 2635167M 2542007D 2635167M{ 2635167M& 2629691C 2623032C: 2635167NY 2635167NP 2542007Ae 2542007AK 2542007@K 2635167N 26351679 26351678 26351677 26351676 26351676U 26351676 26351676 26351676 26351675 26351675 26351675y 26351675c 26351675^ 26351675: 26351674* 26351673 26351673 263516736 26351672e 26351671 26351671 26351671 26351671 26351670 26351670 26351670Z 26351670M 26351670$ 26351670 2635167/ 2635167. 2635167- 2635167,< 2635167+ 2635167+ 2635167+ 2635167+ 2635167*b 2635167)F 2635167(e 2635167' 2635167& 2635167& 2635167%| 2635167" 2635167! 2635167 P 2635167N 2635167N 2542007?j 2629691?b 2635167: 2635167: 2635167: 2635167:; 2635167: 2623032O 2629691JQ 2542007O 2623032> 2542007=' 2635167 2635167| 2635167j 2635167 2635167 2635167k 2635167 ~qdWJ=0# zm`SF9, v i \ O B 5 (     r e X K > 1 $  { n a T G : -   w j ] P C 6 )    s f Y L ? 2 %  1269750M 1269750K 1269750J 1269750I 1269750H 1269750G 1269750F 1269750E 1269750D 1269750C 1269750A 1269750@ 1269750? 1269750> 1269750= 1269750< 1269750; 1269750: 12697509 12697508 12697506 12697505 12697504 12697503 12697501 12697500 1269750/ 1269750. 1269750- 1269750, 1269750+ 1269750* 1269750) 1269750( 1269750' 1269750& 1269750% 1269750$ 1269750# 1269750" 1269750! 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 ~ & ( V h w"4Vb~`)  -U! ossec13001g?Exim Auth failed2025-03-05 17:42:14 dovecot_plain authenticator failed for ([2.55.74.30]) [2.55.74.30]:59891: 535 Incorrect authentication data (set_id=services@heipowersystem.com)2.55.74.30294640p(  -i+ ossec13001g>WExim Auth failed2025-03-05 17:36:46 dovecot_plain authenticator failed for ([117.253.140.168]) [117.253.140.168]:39105: 535 Incorrect authentication data (set_id=services@heipowersystem.com)117.253.140.1681269750Z'  -?) ossec13001g>aExim Auth failed2025-03-05 17:36:57 dovecot_plain authenticator failed for ([95.105.113.109]) [95.105.113.109]:51888: 535 Incorrect authentication data (set_id=services)95.105.113.1092017370j&  -_) ossec13001g<Exim Auth failed2025-03-05 17:30:04 dovecot_plain authenticator failed for ([121.162.101.72]) [121.162.101.72]:60542: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)121.162.101.721835841\%  -G% ossec13001g:Exim Auth failed2025-03-05 17:22:27 dovecot_plain authenticator failed for vps-0b1302de.vps.ovh.net [51.91.10.114]:60556: 535 Incorrect authentication data (set_id=services)51.91.10.1143017382j$  -a' ossec13001g:Exim Auth failed2025-03-05 17:22:11 dovecot_plain authenticator failed for ([218.28.77.206]) [218.28.77.206]:55370: 535 Incorrect authentication data (set_id=services@heipowersystem.com)218.28.77.2061814991c#  -Q) ossec13001g:Exim Auth failed2025-03-05 17:22:02 dovecot_plain authenticator failed for ip72-199-156-231.sd.sd.cox.net [72.199.156.231]:58035: 535 Incorrect authentication data (set_id=sales)72.199.156.2316252001j"  -_) ossec13001g:Exim Auth failed2025-03-05 17:21:51 dovecot_plain authenticator failed for ([178.178.222.47]) [178.178.222.47]:39008: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)178.178.222.472017370Z!  -?) ossec13001g8Exim Auth failed2025-03-05 17:13:20 dovecot_plain authenticator failed for ([128.185.253.66]) [128.185.253.66]:42758: 535 Incorrect authentication data (set_id=services)128.185.253.661269750P  -1# ossec13001g8Exim Auth failed2025-03-05 17:13:10 dovecot_plain authenticator failed for ([116.50.246.69]) [58.69.17.18]:43696: 535 Incorrect authentication data (set_id=sales)58.69.17.181694008m  -e) ossec13001g8Exim Auth failed2025-03-05 17:13:02 dovecot_plain authenticator failed for ([183.167.198.31]) [183.167.198.31]:39477: 535 Incorrect authentication data (set_id=services@heipowersystem.com)183.167.198.311814991j  -_) ossec13001g8Exim Auth failed2025-03-05 17:12:49 dovecot_plain authenticator failed for ([182.191.122.84]) [182.191.122.84]:49048: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)182.191.122.841168579N  --% ossec13001g8=Exim Auth failed2025-03-05 17:10:45 dovecot_login authenticator failed for (localhost) [81.30.107.91]:40888: 535 Incorrect authentication data (set_id=99999999)81.30.107.91130758z  -) ossec13001g5Exim Auth failed2025-03-05 16:59:41 dovecot_plain authenticator failed for (207.122.87.116.starhub.net.sg) [116.87.122.207]:36302: 535 Incorrect authentication data (set_id=services@heipowersystem.com)116.87.122.2071880251i  -]) ossec13001g5Exim Auth failed2025-03-05 16:57:22 dovecot_plain authenticator failed for 144.46.246.220.static.netvigator.com [220.246.46.144]:62195: 535 Incorrect authentication data (set_id=sales)220.246.46.1441819730j  -_) ossec13001g5 Exim Auth failed2025-03-05 16:57:05 dovecot_plain authenticator failed for ([121.124.52.237]) [121.124.52.237]:43600: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)121.124.52.2371835841{  -) ossec13001g4Exim Auth failed2025-03-05 16:56:23 dovecot_plain authenticator failed for 89-179-241-253.static.corbina.ru [89.179.241.253]:49372: 535 Incorrect authentication data (set_id=services@heipowersystem.com)89.179.241.2532017370 p ' A S P i  0?Qp]:  -C+ ossec13001gI\Exim Auth failed2025-03-05 18:23:47 dovecot_plain authenticator failed for ([180.110.237.199]) [180.110.237.199]:39615: 535 Incorrect authentication data (set_id=services)180.110.237.1991814991j9  -a' ossec13001gIJExim Auth failed2025-03-05 18:23:29 dovecot_plain authenticator failed for ([121.166.85.53]) [121.166.85.53]:58582: 535 Incorrect authentication data (set_id=services@heipowersystem.com)121.166.85.531835841m8  -e) ossec13001gGExim Auth failed2025-03-05 18:16:58 dovecot_plain authenticator failed for ([94.181.187.192]) [94.181.187.192]:54070: 535 Incorrect authentication data (set_id=services@heipowersystem.com)94.181.187.1922017370j7  -_) ossec13001gGExim Auth failed2025-03-05 18:16:34 dovecot_plain authenticator failed for ([216.194.174.80]) [216.194.174.27]:15974: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)216.194.174.276252001g6  -[' ossec13001gGExim Auth failed2025-03-05 18:16:10 dovecot_login authenticator failed for ([58.42.226.215]) [58.42.226.215]:43584: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)58.42.226.2151814991Z5  -?) ossec13001gEExim Auth failed2025-03-05 18:08:27 dovecot_plain authenticator failed for ([212.220.113.55]) [212.220.113.55]:56598: 535 Incorrect authentication data (set_id=services)212.220.113.552017370g4  -]% ossec13001gEExim Auth failed2025-03-05 18:08:15 dovecot_plain authenticator failed for ([5.164.185.13]) [5.164.185.13]:52428: 535 Incorrect authentication data (set_id=services@heipowersystem.com)5.164.185.132017370c3  -W% ossec13001gEExim Auth failed2025-03-05 18:08:04 dovecot_plain authenticator failed for ([197.87.10.83]) [197.87.10.83]:45462: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)197.87.10.83953987f2  -W) ossec13001gCExim Auth failed2025-03-05 17:59:24 dovecot_plain authenticator failed for (ws60-209.199.103.rcil.gov.in) [103.199.209.60]:35780: 535 Incorrect authentication data (set_id=services)103.199.209.601269750j1  -a' ossec13001gCExim Auth failed2025-03-05 17:59:08 dovecot_plain authenticator failed for ([46.21.240.186]) [46.21.240.186]:58881: 535 Incorrect authentication data (set_id=services@heipowersystem.com)46.21.240.1862017370T0  -5' ossec13001gCExim Auth failed2025-03-05 17:59:06 dovecot_plain authenticator failed for ([24.187.213.29]) [24.187.213.29]:50426: 535 Incorrect authentication data (set_id=sales)24.187.213.296252001c/  -W% ossec13001gCExim Auth failed2025-03-05 17:58:56 dovecot_plain authenticator failed for ([94.204.90.91]) [94.204.90.91]:33149: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)94.204.90.91290557.  - ) ossec13001g@Exim Auth failed2025-03-05 17:46:26 dovecot_plain authenticator failed for (abts-north-dynamic-010.149.176.122.airtelbroadband.in) [122.176.149.10]:37291: 535 Incorrect authentication data (set_id=services)122.176.149.101269750j-  -a' ossec13001g@Exim Auth failed2025-03-05 17:46:16 dovecot_plain authenticator failed for ([120.78.172.20]) [120.78.172.20]:49602: 535 Incorrect authentication data (set_id=services@heipowersystem.com)120.78.172.201814991b,  -O) ossec13001g@OExim Auth failed2025-03-05 17:45:10 dovecot_login authenticator failed for ([39.165.154.222]) [39.165.154.222]:32780: 535 Incorrect authentication data (set_id=vikas.khandelwal)39.165.154.2221814991u+  -u) ossec13001g@+Exim Auth failed2025-03-05 17:44:35 dovecot_login authenticator failed for ([183.109.148.43]) [183.109.148.43]:37650: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)183.109.148.431835841\*  -C+ ossec13001g?Exim Auth failed2025-03-05 17:42:24 dovecot_plain authenticator failed for ([154.205.146.118]) [154.205.146.118]:55908: 535 Incorrect authentication data (set_id=services)154.205.146.118290291 z N]GYqNI  --# ossec13001gRExim Auth failed2025-03-05 19:03:31 dovecot_plain authenticator failed for ([59.12.201.7]) [59.12.201.7]:43798: 535 Incorrect authentication data (set_id=sales)59.12.201.71835841jH  -_) ossec13001gRExim Auth failed2025-03-05 19:03:05 dovecot_plain authenticator failed for ([123.209.67.169]) [123.209.67.169]:53208: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)123.209.67.1692077456dG  -Y# ossec13001gPExim Auth failed2025-03-05 18:55:03 dovecot_plain authenticator failed for ([61.233.4.50]) [61.233.4.50]:37783: 535 Incorrect authentication data (set_id=services@heipowersystem.com)61.233.4.501814991jF  -_) ossec13001gPExim Auth failed2025-03-05 18:54:48 dovecot_plain authenticator failed for ([111.172.120.32]) [111.172.120.32]:51168: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)111.172.120.321814991:E  =m+ ossec13008gNMail Reciepient rejected2025-03-05 18:47:02 H=(mail.nyaystambh.com) [165.154.228.156]:55166 F= rejected RCPT : Rejected relay attempt: '165.154.228.156' From: 'uowabgmvwnj@nyaystambh.com' To: 'goofile@fastmail.com'165.154.228.1561643084TD  -7% ossec13001gNExim Auth failed2025-03-05 18:46:23 dovecot_plain authenticator failed for ([202.84.34.85]) [202.84.34.85]:41384: 535 Incorrect authentication data (set_id=services)202.84.34.851210997mC  -e) ossec13001gNExim Auth failed2025-03-05 18:46:12 dovecot_plain authenticator failed for ([60.171.237.143]) [60.171.237.143]:51737: 535 Incorrect authentication data (set_id=services@heipowersystem.com)60.171.237.14318149910B UA) ossec11001gL*Deferred login on the cpanel service[2025-03-05 18:35:45 +0530] info [webmaild] 157.38.132.210 - kps@amplifypowerglobal.com "POST /cpsess9750846261/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect157.38.132.21012697500A UA) ossec11001gKDeferred login on the cpanel service[2025-03-05 18:34:45 +0530] info [webmaild] 157.38.132.210 - kps@amplifypowerglobal.com "POST /cpsess9750846261/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect157.38.132.21012697500@ UA) ossec11001gK~Deferred login on the cpanel service[2025-03-05 18:32:54 +0530] info [webmaild] 157.38.132.210 - kps@amplifypowerglobal.com "POST /cpsess9750846261/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect157.38.132.2101269750V?  -;' ossec13001gKZExim Auth failed2025-03-05 18:32:18 dovecot_plain authenticator failed for ([87.200.68.214]) [87.200.68.214]:41681: 535 Incorrect authentication data (set_id=services)87.200.68.214290557g>  -]% ossec13001gKPExim Auth failed2025-03-05 18:32:08 dovecot_plain authenticator failed for ([59.22.68.213]) [59.22.68.213]:45488: 535 Incorrect authentication data (set_id=services@heipowersystem.com)59.22.68.2131835841]=  -C+ ossec13001gJExim Auth failed2025-03-05 18:28:56 dovecot_plain authenticator failed for ([178.178.194.136]) [178.178.194.136]:49880: 535 Incorrect authentication data (set_id=services)178.178.194.1362017370f<  -[% ossec13001gJvExim Auth failed2025-03-05 18:28:30 dovecot_plain authenticator failed for ([36.48.70.211]) [36.48.70.211]:1486: 535 Incorrect authentication data (set_id=services@heipowersystem.com)36.48.70.2111814991;  Ug) ossec11001gIDeferred login on the cpanel service[2025-03-05 18:25:36 +0530] info [webmaild] 157.38.132.210 - kps@amplifypowerglobal.com "POST /cpsess9750846261/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [157.38.133.115] != Current IP Address [157.38.132.210]157.38.132.2101269750 6 E j +DjZ  -a' ossec13001g[Exim Auth failed2025-03-05 19:42:04 dovecot_plain authenticator failed for ([102.31.152.59]) [102.31.152.59]:55384: 535 Incorrect authentication data (set_id=services@heipowersystem.com)102.31.152.592464461mY  -c+ ossec13001g[Exim Auth failed2025-03-05 19:42:04 dovecot_plain authenticator failed for ([103.123.114.215]) [103.123.114.215]:46032: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)103.123.114.2151168579(X  3U) ossec11301g["New FTP connection.Mar 5 19:39:36 vm1 pure-ftpd[2417854]: (?@206.168.34.121) [INFO] New connection from 206.168.34.121206.168.34.1216252001cW  -Q) ossec13001gYExim Auth failed2025-03-05 19:33:00 dovecot_plain authenticator failed for 110-25-106-243.adsl.fetnet.net [110.25.106.243]:45644: 535 Incorrect authentication data (set_id=sales)110.25.106.2431668284bV  -S% ossec13001gYExim Auth failed2025-03-05 19:32:59 dovecot_plain authenticator failed for (undefined.hostname.localhost) [103.90.97.98]:36338: 535 Incorrect authentication data (set_id=services)103.90.97.981269750mU  -e) ossec13001gYExim Auth failed2025-03-05 19:32:49 dovecot_plain authenticator failed for ([101.168.42.221]) [101.168.42.221]:55302: 535 Incorrect authentication data (set_id=services@heipowersystem.com)101.168.42.2212077456mT  -c+ ossec13001gYExim Auth failed2025-03-05 19:32:43 dovecot_plain authenticator failed for ([106.246.227.218]) [106.246.227.218]:51406: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)106.246.227.2181835841lS  -e' ossec13001gVsExim Auth failed2025-03-05 19:19:38 dovecot_plain authenticator failed for rm0zqz.g-service.ru [84.22.155.211]:56502: 535 Incorrect authentication data (set_id=services@heipowersystem.com)84.22.155.2112017370aR  -S% ossec13001gVExim Auth failed2025-03-05 19:19:51 dovecot_plain authenticator failed for host-5-58-201-106.bitternet.ua [5.58.201.106]:46737: 535 Incorrect authentication data (set_id=services)5.58.201.106690791ZQ  -?) ossec13001gUExim Auth failed2025-03-05 19:15:57 dovecot_plain authenticator failed for ([117.158.243.50]) [117.158.243.50]:58054: 535 Incorrect authentication data (set_id=services)117.158.243.501814991vP  -w) ossec13001gUExim Auth failed2025-03-05 19:15:46 dovecot_plain authenticator failed for 245.134.20.178.in-addr.arpa [178.20.134.245]:52278: 535 Incorrect authentication data (set_id=services@heipowersystem.com)178.20.134.2452017370kO  -_+ ossec13001gUCExim Auth failed2025-03-05 19:14:35 dovecot_login authenticator failed for (nyaystambh.com) [202.107.197.211]:52356: 535 Incorrect authentication data (set_id=postmaster@nyaystambh.com)202.107.197.2111814991WN  -9) ossec13001gU)Exim Auth failed2025-03-05 19:14:08 dovecot_login authenticator failed for (nyaystambh.com) [124.160.63.122]:36177: 535 Incorrect authentication data (set_id=nologin)124.160.63.1221814991WM  -;' ossec13001gT?Exim Auth failed2025-03-05 19:10:14 dovecot_plain authenticator failed for ([125.20.46.114]) [125.20.46.114]:53154: 535 Incorrect authentication data (set_id=services)125.20.46.1141269750mL  -e) ossec13001gT7Exim Auth failed2025-03-05 19:10:05 dovecot_plain authenticator failed for ([187.93.153.166]) [187.93.153.166]:44072: 535 Incorrect authentication data (set_id=services@heipowersystem.com)187.93.153.1663469034XK  -=' ossec13001gRExim Auth failed2025-03-05 19:03:57 dovecot_plain authenticator failed for (www.nettlinx.com) [202.53.94.242]:47994: 535 Incorrect authentication data (set_id=services)202.53.94.2421269750jJ  -a' ossec13001gRExim Auth failed2025-03-05 19:03:42 dovecot_plain authenticator failed for ([115.140.89.82]) [115.140.89.82]:56400: 535 Incorrect authentication data (set_id=services@heipowersystem.com)115.140.89.821835841 J 0 ? M L ]jJQk  -3# ossec13001g`Exim Auth failed2025-03-05 20:02:33 dovecot_plain authenticator failed for ([38.79.83.28]) [38.79.83.28]:53116: 535 Incorrect authentication data (set_id=services)38.79.83.286252001zj  -' ossec13001g`nExim Auth failed2025-03-05 20:02:13 dovecot_plain authenticator failed for fixed-186-96-134-64.totalplay.net [186.96.134.64]:50386: 535 Incorrect authentication data (set_id=services@heipowersystem.com)186.96.134.643996063gi  -[' ossec13001g_GExim Auth failed2025-03-05 19:57:18 dovecot_login authenticator failed for 0x3ec64ba8.aal.customer.dk.telia.net [62.198.75.168]:34336: 535 Incorrect authentication data (set_id=sales)62.198.75.1682623032Wh  -;' ossec13001g_AExim Auth failed2025-03-05 19:57:13 dovecot_plain authenticator failed for ([58.42.226.215]) [58.42.226.215]:38800: 535 Incorrect authentication data (set_id=services)58.42.226.2151814991dg  -W% ossec13001g_=Exim Auth failed2025-03-05 19:57:08 dovecot_login authenticator failed for ([58.18.90.250]) [58.18.90.250]:34976: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)58.18.90.2501814991mf  -e) ossec13001g_'Exim Auth failed2025-03-05 19:56:47 dovecot_plain authenticator failed for ([221.140.188.44]) [221.140.188.44]:54990: 535 Incorrect authentication data (set_id=services@heipowersystem.com)221.140.188.441835841ae  -O) ossec13001g]Exim Auth failed2025-03-05 19:50:49 dovecot_plain authenticator failed for ([94.204.208.189]) [94.204.208.189]:60318: 535 Incorrect authentication data (set_id=vikas.khandelwal)94.204.208.189290557]d  -C+ ossec13001g]Exim Auth failed2025-03-05 19:50:38 dovecot_plain authenticator failed for ([178.178.127.114]) [178.178.127.114]:58636: 535 Incorrect authentication data (set_id=services)178.178.127.1142017370dc  -Y# ossec13001g]Exim Auth failed2025-03-05 19:50:28 dovecot_plain authenticator failed for ([60.28.60.82]) [60.28.60.82]:42446: 535 Incorrect authentication data (set_id=services@heipowersystem.com)60.28.60.821814991ob  -m% ossec13001g]Exim Auth failed2025-03-05 19:50:14 dovecot_plain authenticator failed for ([14.39.41.171]) [14.39.41.171]:43039: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)14.39.41.1711835841ka  -c' ossec13001g]Exim Auth failed2025-03-05 19:49:59 dovecot_plain authenticator failed for modemcable039.132-202-24.mc.videotron.ca [24.202.132.39]:49676: 535 Incorrect authentication data (set_id=sales)24.202.132.396251999}`  -' ossec13001g]Exim Auth failed2025-03-05 19:49:48 dovecot_plain authenticator failed for broadband-5-228-183-178.ip.moscow.rt.ru [5.228.183.178]:22130: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)5.228.183.1782017370n_  -i' ossec13001g[Exim Auth failed2025-03-05 19:42:40 dovecot_login authenticator failed for (82-208-99-163.static.mts-nn.ru) [82.208.99.163]:51788: 535 Incorrect authentication data (set_id=vikas.khandelwal)82.208.99.1632017370m^  -e) ossec13001g[Exim Auth failed2025-03-05 19:42:26 dovecot_login authenticator failed for p37046-obmd01.osaka.ocn.ne.jp [153.141.224.46]:54537: 535 Incorrect authentication data (set_id=vikas.khandelwal)153.141.224.461861060g]  -[' ossec13001g[Exim Auth failed2025-03-05 19:42:19 dovecot_plain authenticator failed for h88-129-31-231.cust.bredband2.com [88.129.31.231]:59002: 535 Incorrect authentication data (set_id=services)88.129.31.2312661886e\  -Y% ossec13001g[Exim Auth failed2025-03-05 19:42:17 dovecot_plain authenticator failed for syn-097-092-033-136.res.spectrum.com [97.92.33.136]:35206: 535 Incorrect authentication data (set_id=sales)97.92.33.1366252001x[  -y+ ossec13001g[Exim Auth failed2025-03-05 19:42:05 dovecot_login authenticator failed for ([118.220.149.129]) [118.220.149.129]:57670: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)118.220.149.1291835841 *\~tj`VLB8.$zpf\H>4*   v l b X N D : 0 &    ~ t j ` V L B 8 . $    z p f \ R H > 4 *  vlbXND:0&|rJh^T@,"6xndZPF<2( ~tj`VLB8.$zpf\ | r h ^ T J @ 6 , "    x n d Z P F < 2 (   RRH>4*  vlbXND:0& gȘ gȘ gȘt gȗ gȗ gȗC gȗ- gȗ+ gȗ# gȖY gȖ= gȕ' gȕ; gȓ gȓ gȓ gȓ gȒ< gȒ: gȒ" gȒ$ gȐ? gȐ/ gȐ# gȎK gȎ9 gȎ- gȎ+ gȎ  gȍ gȍ gȍ gȍ gȍ; gȍ7 gȍ% gȍ gȌr gȌl gȌ` gȌ\ gȋ gȋ gȋp gȋl gȊl gȊJ gȊD gȊ@ gȉ gȉ gȈ gȇ[ gȇY gȅU gȅK gȅI gȅ? gȂD gȂ2 gȂ$ gȂ gȁ0 gȀD gȀ1 gȀ  g g~ g~k g~W g} g| g|u g| g{D gzP gzv gzv gz^ gyz gyj gwi gw] gw? gvq gvY gu gu? gu gs gs gs gs~ gq gq gq gq go go{ gn gkh gk^ gj, gj gh~ gh} gh| ght{ gh/z gh!y ggx ggw gfv gfu gft gfs gfr gfq gdvp gdqo gdgn gaVm gaFl g`k g`nj g_Gi g_Ah g_=g g_'f g]e g]d g]c g]b g]a g]` g[_ g[^ g[] g[\ g[[ g[Z g[Y g["X gYW gYV gYU gYT gVR gVsS gUQ gUP gUCO gU)N gT?M gT7L gRK gRJ gRI gRH gPG gPF gNE gND gNC gL*B gKA gK~@ gKZ? gKP> gJ= gȧ gȧ gȦ" gȥ gȥ gȥ gȥ gȣ gȣ gȣR gȣJ gȣ@ gȣ@ gȢ gȢ gȢ gȢ gȢ  gȢ gȢ gȢ gȡ gȡ gȡ  gȟ gȟ gȟ gȟ gȞ gȞ gȞ gȞ} gȜ gȜ gȜ gȚ gȚ gȚ gș gș) gȘ gȘ gȘ gJv< gI; gI\: gIJ9 gG8 gG7 gG6 gE5 gE4 gE3 gC2 gC1 gC0 gC/ g@. g@- g@O, g@++ g?* g?) g>a' g>W( g<& g:% g:$ g:# g:" g8! g8 g8 g8 g8= g5 g5 g5  g4 g3 g3 g2 g1 g1 g0 gȧ g0 g0 g0 g0 g0 g- g- g- g- g* g* g) g( g( g'9 g'1 g%Y g%S g%O g%> g#2 g#0 g# g! g!w g 9 g % g gG g9 gw gi g  g g: g g g g g{ g g v 5 ] h w17Pbvh|  -a' ossec13001ghExim Auth failed2025-03-05 20:36:48 dovecot_plain authenticator failed for ([65.20.235.206]) [65.20.235.206]:37566: 535 Incorrect authentication data (set_id=services@heipowersystem.com)65.20.235.20699237j{  -_) ossec13001ghtExim Auth failed2025-03-05 20:36:26 dovecot_plain authenticator failed for ([103.115.31.219]) [103.115.31.219]:38122: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)103.115.31.2191643084cz  -S' ossec13001gh/Exim Auth failed2025-03-05 20:35:19 dovecot_plain authenticator failed for ([119.84.241.94]) [119.84.241.94]:42416: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)119.84.241.941814991vy  -y' ossec13001gh!Exim Auth failed2025-03-05 20:35:05 dovecot_plain authenticator failed for ([203.147.98.39]) [203.147.98.39]:53653: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)203.147.98.392077456\x  -A+ ossec13001ggExim Auth failed2025-03-05 20:33:20 dovecot_login authenticator failed for ([180.110.237.199]) [180.110.237.199]:2353: 535 Incorrect authentication data (set_id=services)180.110.237.1991814991gw  -]% ossec13001ggExim Auth failed2025-03-05 20:33:01 dovecot_login authenticator failed for ([58.22.255.28]) [58.22.255.28]:33544: 535 Incorrect authentication data (set_id=services@heipowersystem.com)58.22.255.281814991Pv  -1% ossec13001gfExim Auth failed2025-03-05 20:28:52 dovecot_plain authenticator failed for ([212.50.48.86]) [212.50.48.86]:50930: 535 Incorrect authentication data (set_id=sales)212.50.48.86298795Qu  -1% ossec13001gfExim Auth failed2025-03-05 20:28:44 dovecot_plain authenticator failed for ([103.4.103.61]) [103.4.103.61]:52714: 535 Incorrect authentication data (set_id=sales)103.4.103.611168579]t  -C+ ossec13001gfExim Auth failed2025-03-05 20:28:57 dovecot_plain authenticator failed for ([222.114.223.155]) [222.114.223.155]:38953: 535 Incorrect authentication data (set_id=services)222.114.223.1551835841ms  -e) ossec13001gfExim Auth failed2025-03-05 20:28:32 dovecot_plain authenticator failed for ([168.126.90.210]) [168.126.90.210]:44838: 535 Incorrect authentication data (set_id=services@heipowersystem.com)168.126.90.2101835841mr  -c+ ossec13001gfExim Auth failed2025-03-05 20:28:28 dovecot_plain authenticator failed for ([103.146.233.100]) [103.146.233.100]:34215: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)103.146.233.1001269750qq  -o' ossec13001gfExim Auth failed2025-03-05 20:28:12 dovecot_plain authenticator failed for d54c70cda.static.telenet.be [84.199.12.218]:51734: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)84.199.12.2182802361Tp  -7% ossec13001gdvExim Auth failed2025-03-05 20:19:25 dovecot_plain authenticator failed for ([218.22.0.200]) [218.22.0.200]:35396: 535 Incorrect authentication data (set_id=services)218.22.0.2001814991go  -[' ossec13001gdqExim Auth failed2025-03-05 20:19:20 dovecot_plain authenticator failed for ([1.220.226.226]) [1.220.226.226]:43163: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)1.220.226.2261835841mn  -e) ossec13001gdgExim Auth failed2025-03-05 20:19:10 dovecot_plain authenticator failed for ([178.178.222.47]) [178.178.222.47]:41624: 535 Incorrect authentication data (set_id=services@heipowersystem.com)178.178.222.472017370hm  -]' ossec13001gaVExim Auth failed2025-03-05 20:06:04 dovecot_plain authenticator failed for 78-69-119-192-no600.tbcn.telia.com [78.69.119.192]:54168: 535 Incorrect authentication data (set_id=services)78.69.119.1922661886l  - ) ossec13001gaFExim Auth failed2025-03-05 20:05:48 dovecot_plain authenticator failed for 166.46.246.220.static.netvigator.com [220.246.46.166]:64500: 535 Incorrect authentication data (set_id=services@heipowersystem.com)220.246.46.1661819730 \(K Z j g 4\T  -7% ossec13001gsExim Auth failed2025-03-05 21:24:02 dovecot_plain authenticator failed for ([223.84.12.28]) [223.84.12.28]:58782: 535 Incorrect authentication data (set_id=services)223.84.12.281814991c  -S' ossec13001gsExim Auth failed2025-03-05 21:23:50 dovecot_plain authenticator failed for (201.173.16.21-clientes-izzi.mx) [201.173.16.21]:48883: 535 Incorrect authentication data (set_id=sales)201.173.16.213996063x  -}' ossec13001gsExim Auth failed2025-03-05 21:23:49 dovecot_plain authenticator failed for 46.79-160-128.customer.lyse.net [79.160.128.46]:47943: 535 Incorrect authentication data (set_id=services@heipowersystem.com)79.160.128.463144096g  -[' ossec13001gs~Exim Auth failed2025-03-05 21:23:34 dovecot_plain authenticator failed for ([220.85.251.16]) [220.85.251.16]:54764: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)220.85.251.161835841T  -7% ossec13001gqExim Auth failed2025-03-05 21:16:06 dovecot_plain authenticator failed for ([60.166.8.174]) [60.166.8.174]:45508: 535 Incorrect authentication data (set_id=services)60.166.8.1741814991n  -e+ ossec13001gqExim Auth failed2025-03-05 21:15:52 dovecot_plain authenticator failed for ([182.76.69.209]) [128.185.228.134]:51576: 535 Incorrect authentication data (set_id=services@heipowersystem.com)128.185.228.1341269750Q  -1% ossec13001gqExim Auth failed2025-03-05 21:15:39 dovecot_plain authenticator failed for ([85.19.195.12]) [85.19.195.12]:40868: 535 Incorrect authentication data (set_id=sales)85.19.195.123144096m  -c+ ossec13001gqExim Auth failed2025-03-05 21:15:27 dovecot_plain authenticator failed for ([103.219.154.156]) [103.219.154.156]:53406: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)103.219.154.1562750405z  -) ossec13001goExim Auth failed2025-03-05 21:06:32 dovecot_plain authenticator failed for (207.122.87.116.starhub.net.sg) [116.87.122.207]:59666: 535 Incorrect authentication data (set_id=services@heipowersystem.com)116.87.122.2071880251m  -c+ ossec13001go{Exim Auth failed2025-03-05 21:06:26 dovecot_plain authenticator failed for ([218.149.235.152]) [218.149.235.152]:42954: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)218.149.235.1521835841  = # ossec13008gnMail Reciepient rejected2025-03-05 21:04:11 H=([45.136.5.37]) [45.136.5.37]:59971 F= rejected RCPT : Rejected relay attempt: '45.136.5.37' From: 'support@gsta.com' To: 'happy1@abv.bg'45.136.5.37298795Y  -?) ossec13001gkhExim Auth failed2025-03-05 20:49:03 dovecot_plain authenticator failed for ([89.144.187.114]) [89.144.187.114]:41807: 535 Incorrect authentication data (set_id=services)89.144.187.114130758  - ) ossec13001gk^Exim Auth failed2025-03-05 20:48:53 dovecot_plain authenticator failed for syn-035-130-133-206.biz.spectrum.com [35.130.133.206]:48846: 535 Incorrect authentication data (set_id=services@heipowersystem.com)35.130.133.2066252001l  -c) ossec13001gj,Exim Auth failed2025-03-05 20:43:47 dovecot_plain authenticator failed for 109.43.246.220.static.netvigator.com [220.246.43.109]:54042: 535 Incorrect authentication data (set_id=services)220.246.43.1091819730m  -e) ossec13001gjExim Auth failed2025-03-05 20:43:31 dovecot_plain authenticator failed for ([158.140.39.128]) [158.140.39.128]:36453: 535 Incorrect authentication data (set_id=services@heipowersystem.com)158.140.39.1286252001Y~  -?) ossec13001ghExim Auth failed2025-03-05 20:37:09 dovecot_plain authenticator failed for ([185.101.16.250]) [185.101.16.250]:50836: 535 Incorrect authentication data (set_id=services)185.101.16.250272103T}  -5' ossec13001ghExim Auth failed2025-03-05 20:36:51 dovecot_plain authenticator failed for ([57.128.19.228]) [57.128.19.228]:42482: 535 Incorrect authentication data (set_id=sales)57.128.19.2283017382  ' 6 U g | 6Bg  -[' ossec13001g|uExim Auth failed2025-03-05 22:01:48 dovecot_plain authenticator failed for ([111.124.47.11]) [111.124.47.11]:38038: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)111.124.47.111814991P  -/% ossec13001g|Exim Auth failed2025-03-05 22:02:14 dovecot_plain authenticator failed for ([59.99.153.21]) [59.99.153.21]:1203: 535 Incorrect authentication data (set_id=sales)59.99.153.211269750"  3M% ossec11301g{DNew FTP connection.Mar 5 21:56:43 vm1 pure-ftpd[2442782]: (?@139.162.77.6) [INFO] New connection from 139.162.77.6139.162.77.61861060p  -q# ossec13001gzPExim Auth failed2025-03-05 21:52:40 dovecot_plain authenticator failed for 111-70-32-2.emome-ip.hinet.net [111.70.32.2]:46213: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)111.70.32.21668284O  -1% ossec13001gzvExim Auth failed2025-03-05 21:53:17 dovecot_plain authenticator failed for ([65.20.170.25]) [65.20.170.25]:47391: 535 Incorrect authentication data (set_id=sales)65.20.170.2599237T  -7% ossec13001gzvExim Auth failed2025-03-05 21:53:17 dovecot_plain authenticator failed for ([60.11.20.130]) [60.11.20.130]:51814: 535 Incorrect authentication data (set_id=services)60.11.20.1301814991m  -e) ossec13001gz^Exim Auth failed2025-03-05 21:52:54 dovecot_plain authenticator failed for ([192.34.128.202]) [192.34.128.202]:48738: 535 Incorrect authentication data (set_id=services@heipowersystem.com)192.34.128.2026252001]  -C+ ossec13001gyzExim Auth failed2025-03-05 21:49:05 dovecot_plain authenticator failed for ([211.238.237.254]) [211.238.237.254]:47391: 535 Incorrect authentication data (set_id=services)211.238.237.2541835841j  -a' ossec13001gyjExim Auth failed2025-03-05 21:48:50 dovecot_plain authenticator failed for ([125.20.46.114]) [125.20.46.114]:57142: 535 Incorrect authentication data (set_id=services@heipowersystem.com)125.20.46.1141269750W  -;' ossec13001gwiExim Auth failed2025-03-05 21:40:16 dovecot_plain authenticator failed for ([24.115.19.225]) [24.115.19.225]:58358: 535 Incorrect authentication data (set_id=services)24.115.19.2256252001g  -[' ossec13001gw]Exim Auth failed2025-03-05 21:40:04 dovecot_plain authenticator failed for fixed-186-96-134-64.totalplay.net [186.96.134.64]:35803: 535 Incorrect authentication data (set_id=services)186.96.134.643996063j  -a' ossec13001gw?Exim Auth failed2025-03-05 21:39:35 dovecot_plain authenticator failed for ([61.108.83.138]) [61.108.83.138]:33782: 535 Incorrect authentication data (set_id=services@heipowersystem.com)61.108.83.1381835841]  -C+ ossec13001gvqExim Auth failed2025-03-05 21:36:09 dovecot_plain authenticator failed for ([178.178.194.128]) [178.178.194.128]:39324: 535 Incorrect authentication data (set_id=services)178.178.194.1282017370m  -e) ossec13001gvYExim Auth failed2025-03-05 21:35:44 dovecot_plain authenticator failed for ([216.126.67.221]) [216.126.67.221]:57058: 535 Incorrect authentication data (set_id=services@heipowersystem.com)216.126.67.2216251999j  -a' ossec13001guExim Auth failed2025-03-05 21:32:40 dovecot_login authenticator failed for ([123.182.89.19]) [123.182.89.19]:59775: 535 Incorrect authentication data (set_id=services@heipowersystem.com)123.182.89.191814991v  -{% ossec13001gu?Exim Auth failed2025-03-05 21:31:01 dovecot_plain authenticator failed for 206.81.4.146.static.wline.lns.sme.cust.swisscom.ch [146.4.81.206]:54919: 535 Incorrect authentication data (set_id=services)146.4.81.2062658434m  -e) ossec13001guExim Auth failed2025-03-05 21:30:28 dovecot_plain authenticator failed for ([221.167.21.148]) [221.167.21.148]:38968: 535 Incorrect authentication data (set_id=services@heipowersystem.com)221.167.21.1481835841 % * O T d (4]pf/  -]% ossec13001gȅKExim Auth failed2025-03-05 22:39:29 dovecot_plain authenticator failed for ([94.204.96.91]) [94.204.96.91]:48253: 535 Incorrect authentication data (set_id=services@heipowersystem.com)94.204.96.91290557c.  -S' ossec13001gȅIExim Auth failed2025-03-05 22:39:28 dovecot_plain authenticator failed for 216.106.67.50.reverse.socket.net [216.106.67.50]:54744: 535 Incorrect authentication data (set_id=sales)216.106.67.506252001m-  -c+ ossec13001gȅ?Exim Auth failed2025-03-05 22:39:18 dovecot_plain authenticator failed for ([109.124.195.218]) [109.124.195.218]:50118: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)109.124.195.2182017370W,  -9) ossec13001gȂDExim Auth failed2025-03-05 22:26:36 dovecot_login authenticator failed for ([191.210.87.101]) [191.210.87.101]:53734: 535 Incorrect authentication data (set_id=sales)191.210.87.1013469034i+  -_) ossec13001gȂ2Exim Auth failed2025-03-05 22:26:17 dovecot_login authenticator failed for ([85.159.165.216]) [85.159.165.216]:41677: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)85.159.165.216294640S*  -7# ossec13001gȂ$Exim Auth failed2025-03-05 22:26:04 dovecot_plain authenticator failed for ([203.177.65.26]) [58.69.17.18]:44144: 535 Incorrect authentication data (set_id=services)58.69.17.181694008p)  -i+ ossec13001gȂExim Auth failed2025-03-05 22:25:54 dovecot_plain authenticator failed for ([183.230.252.103]) [183.230.252.103]:37746: 535 Incorrect authentication data (set_id=services@heipowersystem.com)183.230.252.1031814991p(  -i+ ossec13001gȁ0Exim Auth failed2025-03-05 22:21:58 dovecot_plain authenticator failed for ([178.178.194.128]) [178.178.194.128]:57090: 535 Incorrect authentication data (set_id=services@heipowersystem.com)178.178.194.1282017370?'  gQ' ossec11307gȀDMultiple connection attempts from same sourceMar 5 22:18:02 vm1 pure-ftpd[2446765]: (?@206.168.34.88) [INFO] New connection from 206.168.34.88206.168.34.886252001&& 3Q' ossec11301gȀ1 New FTP connection.Mar 5 22:17:44 vm1 pure-ftpd[2446722]: (?@206.168.34.88) [INFO] New connection from 206.168.34.88206.168.34.886252001W%  -;' ossec13001gȀ Exim Auth failed2025-03-05 22:17:09 dovecot_plain authenticator failed for ([111.175.39.76]) [111.175.39.76]:45870: 535 Incorrect authentication data (set_id=services)111.175.39.761814991l$  -e) ossec13001gExim Auth failed2025-03-05 22:16:40 dovecot_plain authenticator failed for ([212.90.111.127]) [212.90.111.127]:51597: 535 Incorrect authentication data (set_id=services@heipowersystem.com)212.90.111.127294640w#  -y) ossec13001g~Exim Auth failed2025-03-05 22:10:31 dovecot_plain authenticator failed for 17.sub-166-248-194.myvzw.com [166.248.194.17]:53066: 535 Incorrect authentication data (set_id=services@heipowersystem.com)166.248.194.176252001W"  -9) ossec13001g~kExim Auth failed2025-03-05 22:10:11 dovecot_plain authenticator failed for ([87.225.108.138]) [87.225.108.138]:59710: 535 Incorrect authentication data (set_id=sales)87.225.108.1382017370w!  -y) ossec13001g~WExim Auth failed2025-03-05 22:09:51 dovecot_plain authenticator failed for bb116-14-233-108.singnet.com.sg [116.14.233.108]:55869: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)116.14.233.1081880251i  -g! ossec13001g}Exim Auth failed2025-03-05 22:07:29 dovecot_plain authenticator failed for (2-55-74-30.orange.net.il) [2.55.74.30]:46580: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)2.55.74.30294640j  -a' ossec13001g|Exim Auth failed2025-03-05 22:02:09 dovecot_plain authenticator failed for ([39.165.183.70]) [39.165.183.70]:40398: 535 Incorrect authentication data (set_id=services@heipowersystem.com)39.165.183.701814991 W $ 3 B g 252WW@  -9) ossec13001gȌlExim Auth failed2025-03-05 23:09:55 dovecot_plain authenticator failed for ([195.122.224.64]) [195.122.224.64]:43870: 535 Incorrect authentication data (set_id=sales)195.122.224.642017370?  - ) ossec13001gȌ`Exim Auth failed2025-03-05 23:09:43 dovecot_plain authenticator failed for 226.149.48.116.static.netvigator.com [116.48.149.226]:51502: 535 Incorrect authentication data (set_id=services@heipowersystem.com)116.48.149.2261819730y>  -}) ossec13001gȌ\Exim Auth failed2025-03-05 23:09:40 dovecot_plain authenticator failed for s75-152-225-154.ab.hsia.telus.net [75.152.225.154]:58083: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)75.152.225.1546251999Z=  -?) ossec13001gȋExim Auth failed2025-03-05 23:06:12 dovecot_plain authenticator failed for ([183.109.148.43]) [183.109.148.43]:50248: 535 Incorrect authentication data (set_id=services)183.109.148.431835841W<  -9) ossec13001gȋExim Auth failed2025-03-05 23:06:05 dovecot_plain authenticator failed for ([220.77.245.227]) [220.77.245.227]:38422: 535 Incorrect authentication data (set_id=sales)220.77.245.2271835841m;  -e) ossec13001gȋpExim Auth failed2025-03-05 23:05:44 dovecot_plain authenticator failed for ([154.203.67.113]) [154.203.67.113]:52850: 535 Incorrect authentication data (set_id=services@heipowersystem.com)154.203.67.1133374766g:  -[' ossec13001gȋlExim Auth failed2025-03-05 23:05:40 dovecot_plain authenticator failed for ([101.58.144.50]) [101.58.144.50]:47558: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)101.58.144.503175395T9  -7% ossec13001gȊlExim Auth failed2025-03-05 23:01:23 dovecot_plain authenticator failed for ([58.18.90.250]) [58.18.90.250]:55635: 535 Incorrect authentication data (set_id=services)58.18.90.2501814991g8  -[' ossec13001gȊJExim Auth failed2025-03-05 23:00:50 dovecot_plain authenticator failed for syn-156-019-080-138.biz.spectrum.com [156.19.80.138]:57847: 535 Incorrect authentication data (set_id=sales)156.19.80.1386252001r7  -u# ossec13001gȊDExim Auth failed2025-03-05 23:00:44 dovecot_plain authenticator failed for 95-31-6-109.static.corbina.ru [95.31.6.109]:51818: 535 Incorrect authentication data (set_id=services@heipowersystem.com)95.31.6.1092017370c6  -W% ossec13001gȊ@Exim Auth failed2025-03-05 23:00:39 dovecot_plain authenticator failed for ([94.205.82.33]) [94.205.82.33]:42094: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)94.205.82.33290557W5  -;' ossec13001gȉExim Auth failed2025-03-05 22:55:44 dovecot_plain authenticator failed for ([64.52.161.161]) [64.52.161.161]:52006: 535 Incorrect authentication data (set_id=services)64.52.161.1616252001m4  -e) ossec13001gȉExim Auth failed2025-03-05 22:55:23 dovecot_plain authenticator failed for ([175.125.68.208]) [175.125.68.208]:53605: 535 Incorrect authentication data (set_id=services@heipowersystem.com)175.125.68.2081835841m3  -c+ ossec13001gȈExim Auth failed2025-03-05 22:54:48 dovecot_plain authenticator failed for ([165.154.202.101]) [165.154.202.101]:33730: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)165.154.202.1016252001j2  -_) ossec13001gȇ[Exim Auth failed2025-03-05 22:48:18 dovecot_plain authenticator failed for ([183.109.148.43]) [183.109.148.43]:42676: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)183.109.148.431835841y1  -' ossec13001gȇYExim Auth failed2025-03-05 22:48:17 dovecot_plain authenticator failed for h77-94-125-250.static.bashtel.ru [77.94.125.250]:51215: 535 Incorrect authentication data (set_id=services@heipowersystem.com)77.94.125.2502017370m0  -g' ossec13001gȅUExim Auth failed2025-03-05 22:39:40 dovecot_plain authenticator failed for broadband-95-84-186-218.ip.moscow.rt.ru [95.84.186.218]:54224: 535 Incorrect authentication data (set_id=services)95.84.186.2182017370 v+7 R d *9^vdQ  -W% ossec13001gȐ?Exim Auth failed2025-03-05 23:26:15 dovecot_plain authenticator failed for ([202.200.14.2]) [202.200.14.2]:37517: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)202.200.14.21814991WP  -;' ossec13001gȐ/Exim Auth failed2025-03-05 23:25:58 dovecot_plain authenticator failed for ([31.133.71.204]) [31.133.71.204]:57705: 535 Incorrect authentication data (set_id=services)31.133.71.2042017370mO  -e) ossec13001gȐ#Exim Auth failed2025-03-05 23:25:46 dovecot_plain authenticator failed for ([221.140.188.44]) [221.140.188.44]:52914: 535 Incorrect authentication data (set_id=services@heipowersystem.com)221.140.188.441835841TN  -5' ossec13001gȎKExim Auth failed2025-03-05 23:17:54 dovecot_plain authenticator failed for ([121.166.85.53]) [121.166.85.53]:54408: 535 Incorrect authentication data (set_id=sales)121.166.85.531835841YM  -?) ossec13001gȎ9Exim Auth failed2025-03-05 23:17:37 dovecot_plain authenticator failed for ([185.167.58.121]) [185.167.58.121]:41628: 535 Incorrect authentication data (set_id=services)185.167.58.121617790lL  -e' ossec13001gȎ-Exim Auth failed2025-03-05 23:17:23 dovecot_plain authenticator failed for ([202.149.220.146]) [114.143.75.66]:58628: 535 Incorrect authentication data (set_id=services@heipowersystem.com)114.143.75.661269750K  --+ ossec13001gȎ+Exim Auth failed2025-03-05 23:17:22 dovecot_plain authenticator failed for static-200-105-141-170.acelerate.net ([200.105.141.161]) [200.105.141.170]:37614: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)200.105.141.1703923057sJ  -u% ossec13001gȎ Exim Auth failed2025-03-05 23:16:50 dovecot_login authenticator failed for wsip-70-169-19-52.hr.hr.cox.net [70.169.19.52]:36550: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)70.169.19.526252001jI  -_) ossec13001gȍExim Auth failed2025-03-05 23:16:39 dovecot_login authenticator failed for ([219.145.195.44]) [219.145.195.44]:55811: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)219.145.195.441814991]H  -C+ ossec13001gȍExim Auth failed2025-03-05 23:15:49 dovecot_plain authenticator failed for ([176.226.241.177]) [176.226.241.177]:43868: 535 Incorrect authentication data (set_id=services)176.226.241.1772017370gG  -[' ossec13001gȍExim Auth failed2025-03-05 23:15:39 dovecot_plain authenticator failed for ([118.26.153.84]) [118.26.153.84]:60666: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)118.26.153.841819730nF  -k% ossec13001gȍExim Auth failed2025-03-05 23:15:34 dovecot_plain authenticator failed for vps-79f20bfc.vps.ovh.net [51.75.24.107]:9149: 535 Incorrect authentication data (set_id=services@heipowersystem.com)51.75.24.1073017382XE  -?) ossec13001gȍ;Exim Auth failed2025-03-05 23:13:22 dovecot_plain authenticator failed for ([185.255.47.190]) [185.255.47.190]:52610: 535 Incorrect authentication data (set_id=services)185.255.47.19099237jD  -a' ossec13001gȍ7Exim Auth failed2025-03-05 23:13:18 dovecot_plain authenticator failed for broadband-95-84-158-215.ip.moscow.rt.ru [95.84.158.215]:54426: 535 Incorrect authentication data (set_id=sales)95.84.158.2152017370aC  -S# ossec13001gȍ%Exim Auth failed2025-03-05 23:13:01 dovecot_plain authenticator failed for ([154.65.31.6]) [154.65.31.6]:42462: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)154.65.31.62395170pB  -i+ ossec13001gȍExim Auth failed2025-03-05 23:12:49 dovecot_plain authenticator failed for ([175.156.139.195]) [175.156.139.195]:48996: 535 Incorrect authentication data (set_id=services@heipowersystem.com)175.156.139.1951880251QA  -3# ossec13001gȌrExim Auth failed2025-03-05 23:10:01 dovecot_plain authenticator failed for ([154.65.31.6]) [154.65.31.6]:37398: 535 Incorrect authentication data (set_id=services)154.65.31.62395170 ~qdWJ=0# zm`SF9, v i \ O B 5 (     r e X K > 1 $  { n a T G : -   w j ] P C 6 )    s f Y L ? 2 %  |obUH;.!xk^QD7*tgZM@3& }pcVI</"yl_RE8+uh[NA4' ~qdWJ=0 1814991' 1814991' 1814991' 1814991' 1814991' 1814991' 1814991' 1814991'u 1814991's 1814991'm 1814991'd 1814991'] 1814991'V 1814991'T 1814991'R 1814991'O 1814991'E 1814991'@ 1814991'> 1814991'8 1814991'7 1814991'4 1814991'3 1814991'2 1814991'0 1814991'/ 1814991'. 1814991'* 1814991'! 1814991' 1814991' 1814991' 1814991' 1814991' 1814991' 1814991' 1814991' 1814991& 1814991& 1814991& 1814991& 1814991& 1814991& 1814991& 1814991& 1814991& 1814991& 1814991& 1814991& 1814991& 1814991& 1814991& 1814991& 1814991& 1814991& 1814991& 1814991& 1814991&s 1814991&r 1814991&q 1814991&n 1814991&g 1814991&e 1814991&] 1814991&N 1814991&L 1814991&I 1814991&F 1814991&? 1814991&3 1814991&0 1814991&/ 1814991&- 1814991&, 1814991&# 1814991&" 1814991& 1814991& 1814991& 1814991& 1814991% 1814991% 1814991% 1814991% 1814991% 1814991% 1814991% 1814991% 1814991% 1814991% 1814991% 1814991% 1814991% 1814991% 1814991% 1814991% 1814991% 1814991% 1814991% 1814991% 1814991% 1814991% 1814991% 1814991% 1814991% 1814991% 1814991% 1814991% 1814991% 1814991%} 1814991%z 1814991%u 1814991%m 1814991%h 1814991%g 1814991%e 1814991%c 1814991%a 1814991%^ 1814991%] 1814991%[ 1814991%Y 1814991%J 1814991%G 1814991%; 1814991%1 1814991%, 1814991%( 1814991% 1814991% 1814991% 1814991% 1814991% 1814991% 1814991% 1814991% 1814991$ 1814991$ 1814991$ 1814991$ 1814991$ 1814991$ 1814991$ 1814991$ 1814991$ 1814991$ 1814991$ 1814991$ 1814991$ 1814991$ 1814991$ 1814991$ 1814991$ 1814991$ 1814991$ 1814991$ 1814991$ 1814991$ 1814991$ 1814991$ 1814991$ 1814991$ 1814991$ 1814991$ 1814991$ 1814991$ 1814991$ 1814991$ 1814991$ 1814991${ 1814991$w 1814991$u 1814991$n 1814991$l 1814991$k 1814991$i 1814991$g 1814991$] 1814991$V 1814991$U 1814991$L 1814991$K 1814991$J 1814991$@ 1814991$> 1814991$: 1814991$+ 1814991$ 1814991$ 1814991$ 1814991$ 1814991$ 1814991$ 1814991# 1814991# 1814991# 1814991# 1814991# 1814991# 1814991# 1814991# 1814991# 1814991# 1814991# 1814991# 1814991# 1814991# 1814991# 1814991# 1814991# 1814991# 1814991#| 1814991#w 1814991#v 1814991#t 1814991#o 1814991#g 1814991#^ 1814991#[ 1814991#V 1814991#R 1814991#O 1814991#N 1814991#M 1814991#D 1814991#? 1814991#8 1814991#2 1814991#, 1814991#+ 1814991#) 1814991# 1814991# 1814991# 1814991# 1814991# 1814991# 1814991" +- R w |  +Za  -=+ ossec13001gȗCExim Auth failed2025-03-05 23:56:11 dovecot_plain authenticator failed for ([157.122.183.220]) [157.122.183.220]:36354: 535 Incorrect authentication data (set_id=sales)157.122.183.2201814991 `  -'' ossec13001gȗ-Exim Auth failed2025-03-05 23:55:49 dovecot_plain authenticator failed for syn-104-174-078-030.res.spectrum.com (104-174-078-030.res.spectrum.com) [104.174.78.30]:50942: 535 Incorrect authentication data (set_id=services)104.174.78.306252001a_  -S# ossec13001gȗ+Exim Auth failed2025-03-05 23:55:46 dovecot_plain authenticator failed for ([101.13.5.37]) [101.13.5.37]:48456: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)101.13.5.371668284y^  -# ossec13001gȗ#Exim Auth failed2025-03-05 23:55:39 dovecot_plain authenticator failed for syn-070-120-006-086.res.spectrum.com [70.120.6.86]:50059: 535 Incorrect authentication data (set_id=services@heipowersystem.com)70.120.6.866252001t]  -w% ossec13001gȖYExim Auth failed2025-03-05 23:52:16 dovecot_plain authenticator failed for bb121-7-26-195.singnet.com.sg [121.7.26.195]:53292: 535 Incorrect authentication data (set_id=services@heipowersystem.com)121.7.26.1951880251j\  -a' ossec13001gȖ=Exim Auth failed2025-03-05 23:51:48 dovecot_plain authenticator failed for rt-kalyanov.tagan.ru [95.174.99.133]:59023: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)95.174.99.1332017370~[  -) ossec13001gȕ'Exim Auth failed2025-03-05 23:47:10 dovecot_plain authenticator failed for c-73-134-126-162.hsd1.md.comcast.net [73.134.126.162]:4974: 535 Incorrect authentication data (set_id=services@heipowersystem.com)73.134.126.1626252001dZ  -W% ossec13001gȕ;Exim Auth failed2025-03-05 23:47:29 dovecot_plain authenticator failed for ([182.76.71.82]) [182.76.71.82]:57900: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)182.76.71.821269750WY  -;' ossec13001gȓExim Auth failed2025-03-05 23:41:39 dovecot_plain authenticator failed for ([61.108.83.138]) [61.108.83.138]:43208: 535 Incorrect authentication data (set_id=services)61.108.83.1381835841dX  -U' ossec13001gȓExim Auth failed2025-03-05 23:41:31 dovecot_plain authenticator failed for (static-14.38.103.extranet.co.in) [59.94.179.175]:42604: 535 Incorrect authentication data (set_id=sales)59.94.179.1751269750iW  -_' ossec13001gȓExim Auth failed2025-03-05 23:41:28 dovecot_plain authenticator failed for ([58.250.157.83]) [58.250.157.83]:2057: 535 Incorrect authentication data (set_id=services@heipowersystem.com)58.250.157.831814991wV  -{' ossec13001gȓExim Auth failed2025-03-05 23:41:11 dovecot_plain authenticator failed for h77-53-235-246.cust.bredband2.com [77.53.235.246]:39644: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)77.53.235.2462661886WU  -9) ossec13001gȒ<Exim Auth failed2025-03-05 23:34:44 dovecot_plain authenticator failed for ([182.191.122.84]) [182.191.122.84]:41332: 535 Incorrect authentication data (set_id=sales)182.191.122.841168579WT  -;' ossec13001gȒ:Exim Auth failed2025-03-05 23:34:41 dovecot_plain authenticator failed for ([77.51.214.170]) [77.51.214.170]:50620: 535 Incorrect authentication data (set_id=services)77.51.214.1702017370dS  -W% ossec13001gȒ"Exim Auth failed2025-03-05 23:34:17 dovecot_plain authenticator failed for ([61.81.151.97]) [61.81.151.97]:41334: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)61.81.151.971835841gR  -]% ossec13001gȒ$Exim Auth failed2025-03-05 23:34:19 dovecot_plain authenticator failed for ([46.0.130.216]) [46.0.130.216]:50688: 535 Incorrect authentication data (set_id=services@heipowersystem.com)46.0.130.2162017370 u ' L ^ n b #N`ugs  -[' ossec13001gȞExim Auth failed2025-03-06 00:27:26 dovecot_plain authenticator failed for (24.115.19.225.res-cmts.sm3.ptd.net) [24.115.19.225]:55464: 535 Incorrect authentication data (set_id=sales)24.115.19.2256252001jr  -_) ossec13001gȞ}Exim Auth failed2025-03-06 00:27:00 dovecot_plain authenticator failed for ([14.194.128.158]) [14.194.128.158]:50818: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)14.194.128.1581269750Qq  -1% ossec13001gȜExim Auth failed2025-03-06 00:20:20 dovecot_plain authenticator failed for ([59.22.68.213]) [59.22.68.213]:53754: 535 Incorrect authentication data (set_id=sales)59.22.68.2131835841jp  -a' ossec13001gȜExim Auth failed2025-03-06 00:20:12 dovecot_plain authenticator failed for ([49.124.151.70]) [49.124.151.70]:50888: 535 Incorrect authentication data (set_id=services@heipowersystem.com)49.124.151.701733045vo  -y' ossec13001gȜExim Auth failed2025-03-06 00:20:07 dovecot_plain authenticator failed for 67-60-211-114.cpe.sparklight.net [67.60.211.114]:59807: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)67.60.211.1146252001gn  -[' ossec13001gȚExim Auth failed2025-03-06 00:11:39 dovecot_plain authenticator failed for ([58.49.113.138]) [58.49.113.138]:12617: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)58.49.113.1381814991Wm -7) ossec13001gȚExim Auth failed2025-03-06 00:11:28 dovecot_login authenticator failed for (rokamauka.com) [101.89.140.209]:51744: 535 Incorrect authentication data (set_id=nologin)101.89.140.2091814991l  -) ossec13001gȚExim Auth failed2025-03-06 00:11:57 dovecot_plain authenticator failed for (nsg-corporate-34.230.187.122.airtel.in) [122.187.230.34]:42261: 535 Incorrect authentication data (set_id=services@heipowersystem.com)122.187.230.341269750k  ?1 ossec1008gșProcess exiting (killed).Mar 6 00:06:20 vm1 spamd[2184802]: spamd: server killed by SIGTERM, shutting downCj  77 ossec502gș)Ossec server started.ossec: Ossec started.ji  -_) ossec13001gȘExim Auth failed2025-03-06 00:03:13 dovecot_plain authenticator failed for ([94.181.187.192]) [94.181.187.192]:54714: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)94.181.187.1922017370Th  -5' ossec13001gȘExim Auth failed2025-03-06 00:03:21 dovecot_plain authenticator failed for ([116.88.187.44]) [116.88.187.44]:39661: 535 Incorrect authentication data (set_id=sales)116.88.187.441880251lg  -c) ossec13001gȘExim Auth failed2025-03-06 00:02:04 dovecot_plain authenticator failed for syn-070-127-232-248.res.spectrum.com [70.127.232.248]:39449: 535 Incorrect authentication data (set_id=services)70.127.232.2486252001jf  -a' ossec13001gȘExim Auth failed2025-03-06 00:01:48 dovecot_plain authenticator failed for ([14.53.126.112]) [14.53.126.112]:51116: 535 Incorrect authentication data (set_id=services@heipowersystem.com)14.53.126.1121835841We  -9) ossec13001gȘExim Auth failed2025-03-06 00:01:42 dovecot_plain authenticator failed for ([223.82.241.146]) [223.82.241.146]:33532: 535 Incorrect authentication data (set_id=sales)223.82.241.1461814991pd  -q# ossec13001gȘtExim Auth failed2025-03-06 00:01:14 dovecot_plain authenticator failed for 111-70-32-6.emome-ip.hinet.net [111.70.32.6]:58667: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)111.70.32.61668284Wc  -;' ossec13001gȗExim Auth failed2025-03-05 23:59:01 dovecot_plain authenticator failed for ([58.16.215.241]) [58.16.215.241]:41288: 535 Incorrect authentication data (set_id=services)58.16.215.2411814991b  -+ ossec13001gȗExim Auth failed2025-03-05 23:58:47 dovecot_plain authenticator failed for (nsg-corporate-144.230.187.122.airtel.in) [122.187.230.144]:57562: 535 Incorrect authentication data (set_id=services@heipowersystem.com)122.187.230.1441269750 s7 2 T r 9QsZ  -=+ ossec13001gȢExim Auth failed2025-03-06 00:45:24 dovecot_plain authenticator failed for ([115.247.159.106]) [115.247.159.106]:51666: 535 Incorrect authentication data (set_id=sales)115.247.159.1061269750d  -W% ossec13001gȢExim Auth failed2025-03-06 00:44:46 dovecot_plain authenticator failed for ([58.18.90.250]) [58.18.90.250]:39776: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)58.18.90.2501814991T  -7% ossec13001gȢExim Auth failed2025-03-06 00:45:09 dovecot_plain authenticator failed for ([80.234.36.12]) [80.234.36.12]:58016: 535 Incorrect authentication data (set_id=services)80.234.36.122017370m  -e) ossec13001gȢExim Auth failed2025-03-06 00:44:48 dovecot_plain authenticator failed for ([37.151.212.229]) [37.151.212.229]:38684: 535 Incorrect authentication data (set_id=services@heipowersystem.com)37.151.212.2291522867k  -a) ossec13001gȢ Exim Auth failed2025-03-06 00:42:12 dovecot_login authenticator failed for 245.134.20.178.in-addr.arpa [178.20.134.245]:52880: 535 Incorrect authentication data (set_id=vikas.khandelwal)178.20.134.2452017370u  -u) ossec13001gȢExim Auth failed2025-03-06 00:42:04 dovecot_login authenticator failed for ([223.239.159.21]) [223.239.159.21]:55558: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)223.239.159.211269750m~  -e) ossec13001gȢExim Auth failed2025-03-06 00:42:04 dovecot_plain authenticator failed for ([221.130.87.125]) [221.130.87.125]:41983: 535 Incorrect authentication data (set_id=services@heipowersystem.com)221.130.87.1251814991V}  -7) ossec13001gȢExim Auth failed2025-03-06 00:42:03 dovecot_plain authenticator failed for ([67.213.230.122]) [67.213.230.122]:8825: 535 Incorrect authentication data (set_id=sales)67.213.230.1226252001||  -) ossec13001gȡExim Auth failed2025-03-06 00:41:28 dovecot_plain authenticator failed for syn-098-156-255-186.res.spectrum.com [98.156.255.186]:56542: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)98.156.255.1866252001m{  -e) ossec13001gȡExim Auth failed2025-03-06 00:37:59 dovecot_plain authenticator failed for ([218.149.70.142]) [218.149.70.142]:33846: 535 Incorrect authentication data (set_id=services@heipowersystem.com)218.149.70.1421835841jz  -_) ossec13001gȡ Exim Auth failed2025-03-06 00:37:57 dovecot_plain authenticator failed for ([218.234.104.42]) [218.234.104.42]:57132: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)218.234.104.421835841Zy  -?) ossec13001gȟExim Auth failed2025-03-06 00:33:20 dovecot_plain authenticator failed for ([124.115.177.38]) [124.115.177.38]:39319: 535 Incorrect authentication data (set_id=services)124.115.177.381814991^x  -O! ossec13001gȟExim Auth failed2025-03-06 00:32:49 dovecot_plain authenticator failed for ([59.8.11.36]) [59.8.11.36]:36705: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)59.8.11.361835841Zw  -=+ ossec13001gȟExim Auth failed2025-03-06 00:33:08 dovecot_plain authenticator failed for ([180.188.139.189]) [180.188.139.189]:48860: 535 Incorrect authentication data (set_id=sales)180.188.139.1891819730v  - ) ossec13001gȟExim Auth failed2025-03-06 00:32:55 dovecot_plain authenticator failed for (107-175-76-146-host.colocrossing.com) [107.175.76.146]:37054: 535 Incorrect authentication data (set_id=services@heipowersystem.com)107.175.76.1466252001Zu  -?) ossec13001gȞExim Auth failed2025-03-06 00:27:43 dovecot_plain authenticator failed for ([182.139.39.150]) [182.139.39.150]:52554: 535 Incorrect authentication data (set_id=services)182.139.39.1501814991gt  -]% ossec13001gȞExim Auth failed2025-03-06 00:27:30 dovecot_plain authenticator failed for ([58.19.42.175]) [58.19.42.175]:37088: 535 Incorrect authentication data (set_id=services@heipowersystem.com)58.19.42.1751814991 p. S u 3KpW  -9) ossec13001gȩGExim Auth failed2025-03-06 01:13:03 dovecot_plain authenticator failed for ([222.117.88.230]) [222.117.88.230]:44720: 535 Incorrect authentication data (set_id=sales)222.117.88.2301835841d  -Y# ossec13001gȩCExim Auth failed2025-03-06 01:12:59 dovecot_plain authenticator failed for ([154.65.31.6]) [154.65.31.6]:55475: 535 Incorrect authentication data (set_id=services@heipowersystem.com)154.65.31.62395170K  -+ ossec13001gȧExim Auth failed2025-03-06 01:06:31 dovecot_plain authenticator failed for ([212.120.163.110]) [212.120.163.110]:59116: 535 Incorrect authentication data212.120.163.1102017370U  -;' ossec13001gȧExim Auth failed2025-03-06 01:06:22 dovecot_plain authenticator failed for ([65.20.169.151]) [65.20.169.151]:35921: 535 Incorrect authentication data (set_id=services)65.20.169.15199237p  -i+ ossec13001gȧExim Auth failed2025-03-06 01:06:07 dovecot_plain authenticator failed for ([109.124.195.218]) [109.124.195.218]:50446: 535 Incorrect authentication data (set_id=services@heipowersystem.com)109.124.195.2182017370j  -_) ossec13001gȧExim Auth failed2025-03-06 01:06:06 dovecot_plain authenticator failed for ([223.239.159.21]) [223.239.159.21]:45194: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)223.239.159.211269750  -' ossec13001gȦ"Exim Auth failed2025-03-06 00:59:38 dovecot_plain authenticator failed for 179-189-85-66.goldnettelecom.com.br [179.189.85.66]:34304: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)179.189.85.663469034S  -7# ossec13001gȥExim Auth failed2025-03-06 00:58:09 dovecot_plain authenticator failed for ([116.50.246.69]) [58.69.17.18]:56948: 535 Incorrect authentication data (set_id=services)58.69.17.181694008  W!+ ossec9708gȥDovecot Aborted Login with empty userMar 6 00:57:47 vm1 dovecot[312763]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=185.247.137.244, lip=103.74.54.108, TLS, session=185.247.137.244298795j  -_) ossec13001gȥExim Auth failed2025-03-06 00:57:36 dovecot_plain authenticator failed for ([178.178.222.53]) [178.178.222.53]:35926: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)178.178.222.532017370i  -a' ossec13001gȥExim Auth failed2025-03-06 00:57:34 dovecot_plain authenticator failed for ([78.142.41.167]) [78.142.41.167]:35596: 535 Incorrect authentication data (set_id=services@heipowersystem.com)78.142.41.167732800l  -c) ossec13001gȣExim Auth failed2025-03-06 00:49:35 dovecot_plain authenticator failed for syn-172-248-047-114.res.spectrum.com [172.248.47.114]:39741: 535 Incorrect authentication data (set_id=services)172.248.47.1146252001g  -]% ossec13001gȣExim Auth failed2025-03-06 00:49:26 dovecot_plain authenticator failed for ([183.24.87.18]) [183.24.87.18]:56777: 535 Incorrect authentication data (set_id=services@heipowersystem.com)183.24.87.181814991Z  -?) ossec13001gȣRExim Auth failed2025-03-06 00:47:36 dovecot_plain authenticator failed for ([85.174.139.107]) [85.174.139.107]:55502: 535 Incorrect authentication data (set_id=services)85.174.139.1072017370W  -9) ossec13001gȣJExim Auth failed2025-03-06 00:47:28 dovecot_plain authenticator failed for ([207.219.221.99]) [207.219.221.99]:33150: 535 Incorrect authentication data (set_id=sales)207.219.221.996251999c  -W% ossec13001gȣ@Exim Auth failed2025-03-06 00:47:19 dovecot_plain authenticator failed for ([5.11.164.165]) [5.11.164.165]:33541: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)5.11.164.165298795g  -]% ossec13001gȣ@Exim Auth failed2025-03-06 00:47:20 dovecot_plain authenticator failed for ([92.47.46.174]) [92.47.46.174]:55622: 535 Incorrect authentication data (set_id=services@heipowersystem.com)92.47.46.1741522867 k0 B Z |  .1Lk]&  -C+ ossec13001gȭExim Auth failed2025-03-06 01:31:10 dovecot_plain authenticator failed for ([201.183.225.156]) [201.183.225.156]:57585: 535 Incorrect authentication data (set_id=services)201.183.225.1563658394a%  -S% ossec13001gȭzExim Auth failed2025-03-06 01:30:57 dovecot_plain authenticator failed for static-193-217-0-16.cust.tele2.lt [193.217.0.16]:60112: 535 Incorrect authentication data (set_id=sales)193.217.0.16597427y$  -' ossec13001gȭtExim Auth failed2025-03-06 01:30:52 dovecot_plain authenticator failed for 60-249-207-53.hinet-ip.hinet.net [60.249.207.53]:60461: 535 Incorrect authentication data (set_id=services@heipowersystem.com)60.249.207.531668284g#  -[' ossec13001gȭlExim Auth failed2025-03-06 01:30:44 dovecot_plain authenticator failed for ([121.65.54.204]) [121.65.54.204]:50016: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)121.65.54.2041835841l"  -c) ossec13001gȬExim Auth failed2025-03-06 01:28:06 dovecot_plain authenticator failed for 166.46.246.220.static.netvigator.com [220.246.46.166]:60810: 535 Incorrect authentication data (set_id=services)220.246.46.1661819730d!  -W% ossec13001gȬExim Auth failed2025-03-06 01:27:54 dovecot_plain authenticator failed for ([66.11.25.195]) [66.11.25.195]:37254: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)66.11.25.1956252001m  -e) ossec13001gȬExim Auth failed2025-03-06 01:27:39 dovecot_plain authenticator failed for ([157.122.199.25]) [157.122.199.25]:45429: 535 Incorrect authentication data (set_id=services@heipowersystem.com)157.122.199.251814991e  -W' ossec13001gȫExim Auth failed2025-03-06 01:24:16 dovecot_plain authenticator failed for 42-200-70-134.static.imsbiz.com [42.200.70.134]:44167: 535 Incorrect authentication data (set_id=services)42.200.70.1341819730m  -e) ossec13001gȫExim Auth failed2025-03-06 01:23:49 dovecot_plain authenticator failed for ([221.167.21.148]) [221.167.21.148]:44286: 535 Incorrect authentication data (set_id=services@heipowersystem.com)221.167.21.1481835841Z  -=+ ossec13001gȫExim Auth failed2025-03-06 01:23:42 dovecot_plain authenticator failed for ([123.209.117.171]) [123.209.117.171]:43280: 535 Incorrect authentication data (set_id=sales)123.209.117.1712077456j  -_) ossec13001gȫExim Auth failed2025-03-06 01:23:30 dovecot_plain authenticator failed for ([178.178.222.58]) [178.178.222.58]:48360: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)178.178.222.582017370p  -i+ ossec13001gȫExim Auth failed2025-03-06 01:23:30 dovecot_plain authenticator failed for ([190.211.250.118]) [190.211.250.122]:37698: 535 Incorrect authentication data (set_id=services@heipowersystem.com)190.211.250.1223895114Z  -=+ ossec13001gȪExim Auth failed2025-03-06 01:19:20 dovecot_plain authenticator failed for ([121.178.185.141]) [121.178.185.141]:54872: 535 Incorrect authentication data (set_id=sales)121.178.185.1411835841d  -Y# ossec13001gȪExim Auth failed2025-03-06 01:19:14 dovecot_plain authenticator failed for ([61.6.225.90]) [61.6.225.90]:46716: 535 Incorrect authentication data (set_id=services@heipowersystem.com)61.6.225.901820814j  -_) ossec13001gȪExim Auth failed2025-03-06 01:19:03 dovecot_plain authenticator failed for ([221.140.188.44]) [221.140.188.44]:55112: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)221.140.188.441835841[  -A+ ossec13001gȩmExim Auth failed2025-03-06 01:13:41 dovecot_plain authenticator failed for ([196.200.227.78]) [196.200.227.194]:33974: 535 Incorrect authentication data (set_id=services)196.200.227.194149590m  -c+ ossec13001gȩ;Exim Auth failed2025-03-06 01:12:51 dovecot_plain authenticator failed for ([175.206.105.126]) [175.206.105.126]:39356: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)175.206.105.1261835841 "( J Y $IOZvm7  -e) ossec13001gȰExim Auth failed2025-03-06 01:43:50 dovecot_plain authenticator failed for ([211.248.31.142]) [211.248.31.142]:37548: 535 Incorrect authentication data (set_id=services@heipowersystem.com)211.248.31.1421835841`6  -K) ossec13001gȰqExim Auth failed2025-03-06 01:43:36 dovecot_plain authenticator failed for (183.83.188.236.actcorp.in) [183.83.188.236]:55870: 535 Incorrect authentication data (set_id=sales)183.83.188.2361269750q5  -o' ossec13001gȰAExim Auth failed2025-03-06 01:42:48 dovecot_plain authenticator failed for 42-200-70-134.static.imsbiz.com [42.200.70.134]:47881: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)42.200.70.1341819730v4  -y' ossec13001gȰ7Exim Auth failed2025-03-06 01:42:37 dovecot_plain authenticator failed for ([118.122.38.74]) [118.122.38.74]:54902: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)118.122.38.741814991W3  -9) ossec13001gȮExim Auth failed2025-03-06 01:36:58 dovecot_plain authenticator failed for ([221.130.87.125]) [221.130.87.125]:50050: 535 Incorrect authentication data (set_id=sales)221.130.87.1251814991O2  --' ossec13001gȮExim Auth failed2025-03-06 01:36:49 dovecot_plain authenticator failed for 86.100.221.62.dyn.idknet.com [62.221.100.86]:44542: 535 Incorrect authentication data62.221.100.86617790j1  -_) ossec13001gȮExim Auth failed2025-03-06 01:36:31 dovecot_plain authenticator failed for ([223.82.241.146]) [223.82.241.146]:51866: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)223.82.241.1461814991i0  -]) ossec13001gȮExim Auth failed2025-03-06 01:35:29 dovecot_plain authenticator failed for 0x3ec67866.ejb.customer.dk.telia.net [62.198.120.102]:55322: 535 Incorrect authentication data (set_id=sales)62.198.120.1022623032z/  -' ossec13001gȮuExim Auth failed2025-03-06 01:35:07 dovecot_plain authenticator failed for syn-071-066-157-177.biz.spectrum.com [71.66.157.177]:51848: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)71.66.157.1776252001j.  -a' ossec13001gȮsExim Auth failed2025-03-06 01:35:06 dovecot_plain authenticator failed for ([149.54.15.126]) [149.54.15.126]:44132: 535 Incorrect authentication data (set_id=services@heipowersystem.com)149.54.15.1261149361g-  -[' ossec13001gȮ Exim Auth failed2025-03-06 01:33:21 dovecot_plain authenticator failed for ([111.48.214.96]) [111.48.214.96]:27834: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)111.48.214.961814991W,  -9) ossec13001gȮExim Auth failed2025-03-06 01:33:32 dovecot_plain authenticator failed for ([123.209.67.169]) [123.209.67.169]:45820: 535 Incorrect authentication data (set_id=sales)123.209.67.1692077456Q+  -3# ossec13001gȮExim Auth failed2025-03-06 01:33:32 dovecot_plain authenticator failed for ([101.13.5.37]) [101.13.5.37]:33038: 535 Incorrect authentication data (set_id=services)101.13.5.371668284m*  -e) ossec13001gȭExim Auth failed2025-03-06 01:33:04 dovecot_plain authenticator failed for ([191.59.176.133]) [191.59.176.133]:39938: 535 Incorrect authentication data (set_id=services@heipowersystem.com)191.59.176.1333469034Z)  -?) ossec13001gȭExim Auth failed2025-03-06 01:32:56 dovecot_login authenticator failed for ([103.97.213.151]) [103.97.213.151]:46164: 535 Incorrect authentication data (set_id=services)103.97.213.1511269750v(  -w) ossec13001gȭExim Auth failed2025-03-06 01:32:44 dovecot_login authenticator failed for (183.83.188.236.actcorp.in) [183.83.188.236]:57790: 535 Incorrect authentication data (set_id=services@heipowersystem.com)183.83.188.2361269750Z'  -=+ ossec13001gȭExim Auth failed2025-03-06 01:31:20 dovecot_plain authenticator failed for ([222.236.155.146]) [222.236.155.146]:34613: 535 Incorrect authentication data (set_id=sales)222.236.155.1461835841 j ? Q `  (8MojH  - ) ossec13001gȷuExim Auth failed2025-03-06 02:13:32 dovecot_plain authenticator failed for (107-175-76-146-host.colocrossing.com) [107.175.76.146]:42488: 535 Incorrect authentication data (set_id=services@heipowersystem.com)107.175.76.1466252001ZG  -?) ossec13001gȶExim Auth failed2025-03-06 02:09:45 dovecot_plain authenticator failed for ([112.164.234.33]) [112.164.234.33]:52863: 535 Incorrect authentication data (set_id=services)112.164.234.331835841gF  -]% ossec13001gȶExim Auth failed2025-03-06 02:09:27 dovecot_plain authenticator failed for ([14.35.218.58]) [14.35.218.58]:42473: 535 Incorrect authentication data (set_id=services@heipowersystem.com)14.35.218.581835841lE  -e' ossec13001gȵnExim Auth failed2025-03-06 02:04:53 dovecot_plain authenticator failed for (node-115-187-61-70.alliancebroadband.in) [115.187.61.70]:51604: 535 Incorrect authentication data (set_id=sales)115.187.61.701269750pD  -i+ ossec13001gȵdExim Auth failed2025-03-06 02:04:43 dovecot_plain authenticator failed for ([167.250.119.207]) [167.250.119.207]:38212: 535 Incorrect authentication data (set_id=services@heipowersystem.com)167.250.119.2073865483jC  -_) ossec13001gȵ^Exim Auth failed2025-03-06 02:04:38 dovecot_plain authenticator failed for ([222.117.88.230]) [222.117.88.230]:39266: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)222.117.88.2301835841SB  -7% ossec13001gȴExim Auth failed2025-03-06 01:59:05 dovecot_plain authenticator failed for ([185.167.58.9]) [185.167.58.9]:51670: 535 Incorrect authentication data (set_id=services)185.167.58.9617790QA  -1% ossec13001gȴExim Auth failed2025-03-06 01:58:47 dovecot_plain authenticator failed for ([78.197.6.173]) [78.197.6.173]:59805: 535 Incorrect authentication data (set_id=sales)78.197.6.1733017382j@  -a' ossec13001gȳExim Auth failed2025-03-06 01:58:44 dovecot_plain authenticator failed for ([211.109.75.68]) [211.109.75.69]:53262: 535 Incorrect authentication data (set_id=services@heipowersystem.com)211.109.75.691835841j?  -_) ossec13001gȳExim Auth failed2025-03-06 01:58:35 dovecot_plain authenticator failed for ([123.209.200.21]) [123.209.200.21]:53488: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)123.209.200.212077456l>  -c) ossec13001gȲvExim Auth failed2025-03-06 01:52:12 dovecot_plain authenticator failed for 0x3ec67866.ejb.customer.dk.telia.net [62.198.120.102]:42062: 535 Incorrect authentication data (set_id=services)62.198.120.1022623032Z=  -=+ ossec13001gȲpExim Auth failed2025-03-06 01:52:06 dovecot_plain authenticator failed for ([175.156.139.195]) [175.156.139.195]:40931: 535 Incorrect authentication data (set_id=sales)175.156.139.1951880251m<  -e) ossec13001gȲlExim Auth failed2025-03-06 01:52:03 dovecot_plain authenticator failed for ([195.122.224.64]) [195.122.224.64]:58320: 535 Incorrect authentication data (set_id=services@heipowersystem.com)195.122.224.642017370j;  -_) ossec13001gȲVExim Auth failed2025-03-06 01:51:40 dovecot_plain authenticator failed for ([118.123.116.93]) [118.123.116.93]:59569: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)118.123.116.931814991T:  -5' ossec13001gȱExim Auth failed2025-03-06 01:49:55 dovecot_login authenticator failed for ([59.89.148.179]) [59.89.148.179]:53268: 535 Incorrect authentication data (set_id=sales)59.89.148.1791269750j9  -_) ossec13001gȱExim Auth failed2025-03-06 01:49:36 dovecot_login authenticator failed for mail-02.03.perm.ru [46.146.210.180]:29729: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)46.146.210.1802017370w8  -{' ossec13001gȰgExim Auth failed2025-03-06 01:43:26 dovecot_plain authenticator failed for h77-53-235-246.cust.bredband2.com [77.53.235.246]:58510: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)77.53.235.2462661886 uC b -85Z\ucY  -W% ossec13001gȾExim Auth failed2025-03-06 02:44:33 dovecot_plain authenticator failed for ([94.205.83.14]) [94.205.83.14]:43917: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)94.205.83.14290557zX  -) ossec13001gȽExim Auth failed2025-03-06 02:37:31 dovecot_plain authenticator failed for (104.226.75.138.unknown.m1.com.sg) [138.75.226.104]:57315: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)138.75.226.1041880251WW  -9) ossec13001gȽ.Exim Auth failed2025-03-06 02:37:58 dovecot_plain authenticator failed for ([146.158.106.61]) [146.158.106.61]:52280: 535 Incorrect authentication data (set_id=sales)146.158.106.612017370V  - ) ossec13001gȽ,Exim Auth failed2025-03-06 02:37:55 dovecot_plain authenticator failed for syn-076-178-103-119.res.spectrum.com [76.178.103.119]:43118: 535 Incorrect authentication data (set_id=services@heipowersystem.com)76.178.103.1196252001qU  -k+ ossec13001gȻBExim Auth failed2025-03-06 02:29:45 dovecot_plain authenticator failed for net-188-219-104-210.cust.vodafonedsl.it [188.219.104.210]:54031: 535 Incorrect authentication data (set_id=services)188.219.104.2103175395gT  -]% ossec13001gȻ$Exim Auth failed2025-03-06 02:29:14 dovecot_plain authenticator failed for ([141.94.18.69]) [141.94.18.69]:38038: 535 Incorrect authentication data (set_id=services@heipowersystem.com)141.94.18.693017382WS  -;' ossec13001gȹUExim Auth failed2025-03-06 02:21:32 dovecot_plain authenticator failed for ([149.54.15.162]) [149.54.15.162]:45779: 535 Incorrect authentication data (set_id=services)149.54.15.1621149361mR  -e) ossec13001gȹ-Exim Auth failed2025-03-06 02:20:53 dovecot_plain authenticator failed for ([146.158.106.61]) [146.158.106.61]:49028: 535 Incorrect authentication data (set_id=services@heipowersystem.com)146.158.106.612017370jQ  -a' ossec13001gȸExim Auth failed2025-03-06 02:19:33 dovecot_plain authenticator failed for ([220.74.63.183]) [220.74.63.183]:54820: 535 Incorrect authentication data (set_id=services@heipowersystem.com)220.74.63.1831835841TP  -5' ossec13001gȸExim Auth failed2025-03-06 02:19:31 dovecot_plain authenticator failed for ([36.32.223.199]) [58.242.71.121]:28908: 535 Incorrect authentication data (set_id=sales)58.242.71.1211814991zO  -) ossec13001gȸExim Auth failed2025-03-06 02:18:53 dovecot_plain authenticator failed for (104.226.75.138.unknown.m1.com.sg) [138.75.226.104]:44771: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)138.75.226.1041880251jN  -a' ossec13001gȸ#Exim Auth failed2025-03-06 02:16:25 dovecot_plain authenticator failed for ([223.210.27.53]) [223.210.27.53]:62968: 535 Incorrect authentication data (set_id=services@heipowersystem.com)223.210.27.531814991jM  -_) ossec13001gȸ!Exim Auth failed2025-03-06 02:16:24 dovecot_plain authenticator failed for ([87.225.108.138]) [87.225.108.138]:60314: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)87.225.108.1382017370ZL  -?) ossec13001gȸKExim Auth failed2025-03-06 02:17:07 dovecot_plain authenticator failed for ([209.38.100.151]) [209.38.100.151]:46710: 535 Incorrect authentication data (set_id=services)209.38.100.1512750405]K  -C+ ossec13001gȸ=Exim Auth failed2025-03-06 02:16:52 dovecot_plain authenticator failed for ([108.144.255.167]) [108.144.255.167]:13391: 535 Incorrect authentication data (set_id=services)108.144.255.1676252001WJ  -;' ossec13001gȷExim Auth failed2025-03-06 02:13:42 dovecot_plain authenticator failed for ([60.29.100.218]) [60.29.100.218]:50629: 535 Incorrect authentication data (set_id=services)60.29.100.2181814991^I  -O! ossec13001gȷ}Exim Auth failed2025-03-06 02:13:39 dovecot_plain authenticator failed for ([1.25.18.18]) [1.25.18.18]:59954: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)1.25.18.181814991 u2 W c "!3HMuTj  -5' ossec13001gExim Auth failed2025-03-06 03:02:50 dovecot_plain authenticator failed for ([101.58.144.50]) [101.58.144.50]:44242: 535 Incorrect authentication data (set_id=sales)101.58.144.503175395wi  -y) ossec13001gExim Auth failed2025-03-06 03:02:51 dovecot_plain authenticator failed for 155-61-202-109.kamensktel.ru [109.202.61.155]:47351: 535 Incorrect authentication data (set_id=services@heipowersystem.com)109.202.61.1552017370gh  -[' ossec13001gExim Auth failed2025-03-06 03:02:36 dovecot_plain authenticator failed for ([118.122.38.74]) [118.122.38.74]:48326: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)118.122.38.741814991jg  -a' ossec13001g@Exim Auth failed2025-03-06 02:59:35 dovecot_plain authenticator failed for ([57.128.19.228]) [57.128.19.228]:42046: 535 Incorrect authentication data (set_id=services@heipowersystem.com)57.128.19.2283017382}f  -' ossec13001g2Exim Auth failed2025-03-06 02:59:20 dovecot_plain authenticator failed for broadband-95-84-186-218.ip.moscow.rt.ru [95.84.186.218]:54786: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)95.84.186.2182017370Ze  -?) ossec13001gMExim Auth failed2025-03-06 02:55:32 dovecot_plain authenticator failed for ([178.178.222.47]) [178.178.222.47]:56110: 535 Incorrect authentication data (set_id=services)178.178.222.472017370id  -a' ossec13001gCExim Auth failed2025-03-06 02:55:22 dovecot_plain authenticator failed for ([94.202.148.15]) [94.202.148.15]:59991: 535 Incorrect authentication data (set_id=services@heipowersystem.com)94.202.148.15290557yc  -% ossec13001geExim Auth failed2025-03-06 02:55:56 dovecot_plain authenticator failed for static-84-242-88-70.bb.vodafone.cz [84.242.88.70]:34644: 535 Incorrect authentication data (set_id=services@heipowersystem.com)84.242.88.703077311[b  -A) ossec13001g[Exim Auth failed2025-03-06 02:55:47 dovecot_plain authenticator failed for 118-119-237-24.gci.net [24.237.119.118]:46883: 535 Incorrect authentication data (set_id=sales)24.237.119.1186252001xa  -}' ossec13001gQExim Auth failed2025-03-06 02:55:36 dovecot_plain authenticator failed for 89-179-99-200.broadband.corbina.ru [89.179.99.200]:51562: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)89.179.99.2002017370W`  -9) ossec13001g!Exim Auth failed2025-03-06 02:50:32 dovecot_plain authenticator failed for ([183.109.148.43]) [183.109.148.43]:35004: 535 Incorrect authentication data (set_id=sales)183.109.148.431835841j_  -_) ossec13001gExim Auth failed2025-03-06 02:50:20 dovecot_plain authenticator failed for ([49.205.177.146]) [223.239.159.21]:60408: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)223.239.159.211269750Q^  -3# ossec13001g+Exim Auth failed2025-03-06 02:50:43 dovecot_plain authenticator failed for ([206.0.8.204]) [206.0.8.204]:43816: 535 Incorrect authentication data (set_id=services)206.0.8.2043469034p]  -i+ ossec13001g!Exim Auth failed2025-03-06 02:50:32 dovecot_plain authenticator failed for ([117.184.119.106]) [117.184.119.106]:48319: 535 Incorrect authentication data (set_id=services@heipowersystem.com)117.184.119.1061814991W\  -9) ossec13001gȾExim Auth failed2025-03-06 02:45:10 dovecot_plain authenticator failed for ([49.124.152.252]) [49.124.152.252]:38902: 535 Incorrect authentication data (set_id=sales)49.124.152.2521733045Y[  -?) ossec13001gȾExim Auth failed2025-03-06 02:44:57 dovecot_plain authenticator failed for ([185.101.16.250]) [185.101.16.250]:59208: 535 Incorrect authentication data (set_id=services)185.101.16.250272103mZ  -e) ossec13001gȾExim Auth failed2025-03-06 02:44:46 dovecot_plain authenticator failed for ([109.195.69.156]) [109.195.69.156]:29815: 535 Incorrect authentication data (set_id=services@heipowersystem.com)109.195.69.1562017370 %7 I n AYwK{  -+ ossec13001gExim Auth failed2025-03-06 03:24:12 dovecot_plain authenticator failed for ([124.225.185.148]) [124.225.185.148]:38218: 535 Incorrect authentication data124.225.185.1481814991fz  -Y' ossec13001g Exim Auth failed2025-03-06 03:16:07 dovecot_plain authenticator failed for 57-45-246-103.southernonline.net [103.246.45.57]:56760: 535 Incorrect authentication data (set_id=services)103.246.45.571269750jy  -a' ossec13001g Exim Auth failed2025-03-06 03:15:46 dovecot_plain authenticator failed for ([1.244.246.221]) [1.244.246.221]:54818: 535 Incorrect authentication data (set_id=services@heipowersystem.com)1.244.246.2211835841Sx  -5' ossec13001gExim Auth failed2025-03-06 03:15:34 dovecot_plain authenticator failed for ([185.167.56.24]) [185.167.56.24]:37108: 535 Incorrect authentication data (set_id=sales)185.167.56.24617790w  -' ossec13001gExim Auth failed2025-03-06 03:15:24 dovecot_plain authenticator failed for wllk-bri-66-ip-66-43-253-231.wireless.netins.net [66.43.253.231]:55294: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)66.43.253.2316252001Tv  -5' ossec13001gŮExim Auth failed2025-03-06 03:14:13 dovecot_plain authenticator failed for ([211.109.75.67]) [211.109.75.69]:64741: 535 Incorrect authentication data (set_id=sales)211.109.75.691835841du  -W% ossec13001gŠExim Auth failed2025-03-06 03:14:00 dovecot_plain authenticator failed for ([103.4.103.61]) [103.4.103.61]:37589: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)103.4.103.611168579(t  3U) ossec11301gĞNew FTP connection.Mar 6 03:09:41 vm1 pure-ftpd[2505321]: (?@89.248.168.227) [INFO] New connection from 89.248.168.22789.248.168.2272750405]s  -C+ ossec13001gExim Auth failed2025-03-06 03:07:17 dovecot_plain authenticator failed for ([194.226.155.198]) [194.226.155.198]:49616: 535 Incorrect authentication data (set_id=services)194.226.155.1982017370Tr  -5' ossec13001gExim Auth failed2025-03-06 03:07:18 dovecot_plain authenticator failed for ([124.160.45.26]) [124.160.45.26]:40358: 535 Incorrect authentication data (set_id=sales)124.160.45.261814991rq  -u# ossec13001gExim Auth failed2025-03-06 03:07:06 dovecot_plain authenticator failed for 95-31-6-109.static.corbina.ru [95.31.6.109]:52628: 535 Incorrect authentication data (set_id=services@heipowersystem.com)95.31.6.1092017370mp  -c+ ossec13001gExim Auth failed2025-03-06 03:07:05 dovecot_plain authenticator failed for ([123.209.117.171]) [123.209.117.171]:58258: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)123.209.117.1712077456]o  -C+ ossec13001gÞExim Auth failed2025-03-06 03:05:25 dovecot_plain authenticator failed for ([121.239.241.153]) [121.239.241.153]:60466: 535 Incorrect authentication data (set_id=services)121.239.241.1531814991Wn  -9) ossec13001gÚExim Auth failed2025-03-06 03:05:22 dovecot_plain authenticator failed for ([112.111.61.232]) [112.111.61.229]:54654: 535 Incorrect authentication data (set_id=sales)112.111.61.2291814991jm  -_) ossec13001gÈExim Auth failed2025-03-06 03:05:03 dovecot_plain authenticator failed for ([50.190.139.137]) [50.190.139.137]:51704: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)50.190.139.1376252001jl  -a' ossec13001gÎExim Auth failed2025-03-06 03:05:09 dovecot_plain authenticator failed for ([46.29.121.110]) [46.29.121.110]:53820: 535 Incorrect authentication data (set_id=services@heipowersystem.com)46.29.121.1103017382Wk  -;' ossec13001gExim Auth failed2025-03-06 03:03:03 dovecot_plain authenticator failed for ([218.4.205.242]) [218.4.205.242]:39885: 535 Incorrect authentication data (set_id=services)218.4.205.2421814991 : @ c p r 3Hasf  -[' ossec13001gExim Auth failed2025-03-06 03:45:31 dovecot_plain authenticator failed for ([91.239.23.149]) [91.239.23.149]:39052: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)91.239.23.149458258T  -5' ossec13001g6Exim Auth failed2025-03-06 03:42:06 dovecot_plain authenticator failed for ([72.26.178.196]) [72.26.178.196]:60188: 535 Incorrect authentication data (set_id=sales)72.26.178.1966252001j  -_) ossec13001g4Exim Auth failed2025-03-06 03:42:03 dovecot_plain authenticator failed for (116.68.197.124.unknown.m1.com.sg) [124.197.68.116]:59654: 535 Incorrect authentication data (set_id=services)124.197.68.1161880251c  -W% ossec13001g&Exim Auth failed2025-03-06 03:41:49 dovecot_plain authenticator failed for ([2.179.186.69]) [2.179.186.69]:60600: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)2.179.186.69130758g  -]% ossec13001g$Exim Auth failed2025-03-06 03:41:48 dovecot_plain authenticator failed for ([59.7.203.177]) [59.7.203.177]:62842: 535 Incorrect authentication data (set_id=services@heipowersystem.com)59.7.203.1771835841+  3Y+ ossec11301gNew FTP connection.Mar 6 03:40:20 vm1 pure-ftpd[2511087]: (?@194.187.176.203) [INFO] New connection from 194.187.176.203194.187.176.2032921044]  -C+ ossec13001gExim Auth failed2025-03-06 03:37:00 dovecot_plain authenticator failed for ([203.193.168.181]) [203.193.168.181]:55236: 535 Incorrect authentication data (set_id=services)203.193.168.1811269750g  -]% ossec13001gExim Auth failed2025-03-06 03:36:52 dovecot_plain authenticator failed for ([223.84.12.28]) [223.84.12.28]:42612: 535 Incorrect authentication data (set_id=services@heipowersystem.com)223.84.12.281814991]  -C+ ossec13001gɷExim Auth failed2025-03-06 03:31:26 dovecot_plain authenticator failed for ([121.152.119.174]) [121.152.119.174]:33230: 535 Incorrect authentication data (set_id=services)121.152.119.1741835841  -' ossec13001gɫExim Auth failed2025-03-06 03:31:14 dovecot_plain authenticator failed for (187-50-88-145.customer.tdatabrasil.net.br) [201.63.67.250]:36606: 535 Incorrect authentication data (set_id=services@heipowersystem.com)201.63.67.2503469034W  -9) ossec13001gɫExim Auth failed2025-03-06 03:31:14 dovecot_plain authenticator failed for ([222.160.99.210]) [222.160.99.210]:39135: 535 Incorrect authentication data (set_id=sales)222.160.99.2101814991z  -' ossec13001gəExim Auth failed2025-03-06 03:30:56 dovecot_plain authenticator failed for syn-097-089-202-226.biz.spectrum.com [97.89.202.226]:45690: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)97.89.202.2266252001o  -k' ossec13001gȇExim Auth failed2025-03-06 03:26:22 dovecot_login authenticator failed for (heipowersystem.com) [221.229.216.1]:38970: 535 Incorrect authentication data (set_id=postmaster@heipowersystem.com)221.229.216.11814991Y  -?' ossec13001gmExim Auth failed2025-03-06 03:25:56 dovecot_login authenticator failed for (heipowersystem.com) [221.229.216.1]:35628: 535 Incorrect authentication data (set_id=nologin)221.229.216.11814991v~  -{% ossec13001g!Exim Auth failed2025-03-06 03:24:40 dovecot_plain authenticator failed for 89-160-38-13.cust.bredband2.com [89.160.38.13]:53238: 535 Incorrect authentication data (set_id=services@heipowersystem.com)89.160.38.132661886T}  -5' ossec13001gExim Auth failed2025-03-06 03:24:27 dovecot_plain authenticator failed for ([14.53.126.112]) [14.53.126.112]:45658: 535 Incorrect authentication data (set_id=sales)14.53.126.1121835841j|  -_) ossec13001gExim Auth failed2025-03-06 03:24:14 dovecot_plain authenticator failed for ([170.233.29.157]) [170.233.29.157]:44182: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)170.233.29.1573865483 %7 \ k e *@eT  -5' ossec13001gExim Auth failed2025-03-06 04:02:19 dovecot_plain authenticator failed for wsip-184-186-96-58.lv.lv.cox.net [184.186.96.58]:59184: 535 Incorrect authentication data184.186.96.586252001W  -9) ossec13001gExim Auth failed2025-03-06 04:01:40 dovecot_plain authenticator failed for ([222.239.231.61]) [222.239.231.61]:21427: 535 Incorrect authentication data (set_id=sales)222.239.231.611835841f  -]% ossec13001gExim Auth failed2025-03-06 04:01:40 dovecot_plain authenticator failed for ([41.24.28.218]) [41.24.28.218]:29472: 535 Incorrect authentication data (set_id=services@heipowersystem.com)41.24.28.218953987c  -W% ossec13001gлExim Auth failed2025-03-06 04:01:22 dovecot_plain authenticator failed for ([196.0.89.118]) [196.0.89.118]:47133: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)196.0.89.118226074p  -k) ossec13001gExim Auth failed2025-03-06 03:53:55 dovecot_plain authenticator failed for broadband-178-140-95-221.ip.moscow.rt.ru [178.140.95.221]:38873: 535 Incorrect authentication data (set_id=services)178.140.95.2212017370j  -_) ossec13001gExim Auth failed2025-03-06 03:53:39 dovecot_plain authenticator failed for ([111.48.208.197]) [111.48.208.197]:24608: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)111.48.208.1971814991i  -a' ossec13001gExim Auth failed2025-03-06 03:53:16 dovecot_plain authenticator failed for ([94.205.250.78]) [94.205.250.78]:60686: 535 Incorrect authentication data (set_id=services@heipowersystem.com)94.205.250.78290557Q  -1% ossec13001g}Exim Auth failed2025-03-06 03:51:47 dovecot_plain authenticator failed for ([58.18.90.114]) [58.18.90.114]:47326: 535 Incorrect authentication data (set_id=sales)58.18.90.1141814991p  -i+ ossec13001g{Exim Auth failed2025-03-06 03:51:46 dovecot_plain authenticator failed for ([221.149.233.244]) [221.149.233.244]:39497: 535 Incorrect authentication data (set_id=services@heipowersystem.com)221.149.233.2441835841t  -s) ossec13001gmExim Auth failed2025-03-06 03:51:31 dovecot_plain authenticator failed for (91-220-216-178.omsk.mts.ru) [178.216.220.91]:56314: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)178.216.220.912017370h  -]' ossec13001gExim Auth failed2025-03-06 03:49:04 dovecot_plain authenticator failed for 90-230-168-26-no600.tbcn.telia.com [90.230.168.26]:49914: 535 Incorrect authentication data (set_id=services)90.230.168.262661886T  -5' ossec13001gExim Auth failed2025-03-06 03:48:53 dovecot_plain authenticator failed for ([61.81.133.182]) [61.81.133.182]:59711: 535 Incorrect authentication data (set_id=sales)61.81.133.1821835841  - + ossec13001gExim Auth failed2025-03-06 03:48:46 dovecot_plain authenticator failed for 163.189-202-206.bestelclientes.com.mx [189.202.206.163]:38550: 535 Incorrect authentication data (set_id=services@heipowersystem.com)189.202.206.1633996063m  -c+ ossec13001gExim Auth failed2025-03-06 03:48:42 dovecot_plain authenticator failed for ([167.250.119.253]) [167.250.119.253]:35086: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)167.250.119.2533865483W  -;' ossec13001g4Exim Auth failed2025-03-06 03:46:20 dovecot_plain authenticator failed for ([58.51.122.230]) [58.51.122.230]:35098: 535 Incorrect authentication data (set_id=services)58.51.122.2301814991j  -a' ossec13001g"Exim Auth failed2025-03-06 03:46:02 dovecot_plain authenticator failed for ([118.38.239.52]) [118.38.239.52]:40014: 535 Incorrect authentication data (set_id=services@heipowersystem.com)118.38.239.521835841W  -9) ossec13001gExim Auth failed2025-03-06 03:45:51 dovecot_plain authenticator failed for ([31.220.168.116]) [31.220.168.116]:38412: 535 Incorrect authentication data (set_id=sales)31.220.168.1162017370 *\~tj`VLB8.$zpf\H>4*   v l b X N D : 0 &    ~ t j ` V L B 8 . $    z p f \ R H > 4 *  vlbXND:0&|rh^TJ@6,"xndZPF<2( ~tj`VLB8.$zpf\ | r h ^ T J @ 6 , "    x n d Z P F < 2 (   RRH>4*  vlbXND:0& g g g g g g g: g, g( g! g g g gH g2 g& g  g g gS gG g; g7 g g g g gI g= g2 g g g gn gd g~ g g gb g^ gV gT g g g g g g} gq g_ g_ g g g g\ gS gv gl g g  g  g g g gn g g g g g g g g g ge gC g7 g+ gݰ gݮ gݐ g, g6 g4 g gی g۪ gۚ gP g gٷ g٩ g٧ g1 g' g g؝ g؍ g؇ g g g g g g g gն gx gx gh gh g g g gz g@ g g g gл g g g g} g{ gm g g g g g4 g" g g g6 g4 g& g$ g g g gɷ gɫ gɫ gə gȇ gm g!~ g} g| g{ g z g y gx gw gŮv gŠu gĞt gs gr gq gp gÞo gÚn gÎl gÈm gk gj gi gh g(? gd; gP: gP9 g48 g15 g7 g6 g4 g3 g2 g1 g0 g!/ g. g- g , g+ g* g*) g( g' g& g% g($ g# g" g ! g g g g g g g g g g g_ g= gm gi g g@g g2f gec g[b gQa gMe gCd g+^ g!` g!] g_ gȾ\ gȾ[ gȾZ gȾY gȽ.W gȽ,V gȽX gȻBU gȻ$T gȹUS gȹ-R gȸQ gȸP gȸO gȸKL gȸ=K gȸ#N gȸ!M gȷJ gȷ}I gȷuH gȶG gȶF gȵnE gȵdD gȵ^C gȴB gȴA gȳ@ gȳ? gȲv> g,< gȲp= gȲl< gȲV; gȱ: gȱ9 gȰ7 gȰq6 gȰg8 gȰA5 gȰ74 gȮ3 gȮ2 gȮ1 gȮ0 gȮu/ gȮs. gȮ, gȮ+ gȮ - gȭ* gȭ) gȭ( gȭ' gȭ& gȭz% gȭt$ gȭl# gȬ" gȬ! gȬ gȫ gȫ gȫ gȫ gȫ gȪ gȪ gȪ gȩm gȩG gȩC gȩ; !- B R z #;Jun.  -k% ossec13001gExim Auth failed2025-03-06 04:31:52 dovecot_plain authenticator failed for vps-79f20bfc.vps.ovh.net ([87.98.249.193]) [51.75.24.107]:26254: 535 Incorrect authentication data (set_id=services)51.75.24.1073017382Q-  -1% ossec13001gExim Auth failed2025-03-06 04:31:51 dovecot_plain authenticator failed for ([14.37.206.76]) [14.37.206.76]:35322: 535 Incorrect authentication data (set_id=sales)14.37.206.761835841m,  -e) ossec13001gExim Auth failed2025-03-06 04:31:42 dovecot_plain authenticator failed for ([211.248.31.142]) [211.248.31.142]:43906: 535 Incorrect authentication data (set_id=services@heipowersystem.com)211.248.31.1421835841d+  -W% ossec13001gExim Auth failed2025-03-06 04:31:31 dovecot_plain authenticator failed for ([14.37.79.247]) [14.37.79.247]:38823: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)14.37.79.2471835841p*  -i+ ossec13001gExim Auth failed2025-03-06 04:27:52 dovecot_plain authenticator failed for ([125.139.124.120]) [125.139.124.120]:34838: 535 Incorrect authentication data (set_id=services@heipowersystem.com)125.139.124.1201835841f)  -]% ossec13001gExim Auth failed2025-03-06 04:23:06 dovecot_plain authenticator failed for ([86.57.254.73]) [86.57.254.73]:57548: 535 Incorrect authentication data (set_id=services@heipowersystem.com)86.57.254.73630336](  -K# ossec13001gExim Auth failed2025-03-06 04:22:49 dovecot_plain authenticator failed for 37.151.71.8.dynamic.telecom.kz [37.151.71.8]:58922: 535 Incorrect authentication data (set_id=sales)37.151.71.81522867v'  -y' ossec13001gնExim Auth failed2025-03-06 04:22:37 dovecot_plain authenticator failed for (173-29-118-52.client.mchsi.com) [173.29.118.52]:60149: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)173.29.118.526252001R&  -7% ossec13001gxExim Auth failed2025-03-06 04:17:20 dovecot_plain authenticator failed for ([65.20.170.25]) [65.20.170.25]:53008: 535 Incorrect authentication data (set_id=services)65.20.170.2599237e%  -S+ ossec13001gxExim Auth failed2025-03-06 04:17:19 dovecot_plain authenticator failed for (pool-176-226-241-177.is74.ru) [176.226.241.177]:34516: 535 Incorrect authentication data (set_id=sales)176.226.241.1772017370m$  -e) ossec13001ghExim Auth failed2025-03-06 04:17:04 dovecot_plain authenticator failed for ([146.158.106.61]) [146.158.106.61]:48373: 535 Incorrect authentication data (set_id=services@heipowersystem.com)146.158.106.612017370j#  -_) ossec13001ghExim Auth failed2025-03-06 04:17:03 dovecot_plain authenticator failed for ([220.161.52.149]) [220.161.52.149]:36644: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)220.161.52.1491814991T"  -5' ossec13001gExim Auth failed2025-03-06 04:10:33 dovecot_plain authenticator failed for ([111.48.214.96]) [111.48.214.96]:23250: 535 Incorrect authentication data (set_id=sales)111.48.214.961814991l!  -c+ ossec13001gExim Auth failed2025-03-06 04:10:13 dovecot_plain authenticator failed for ([196.190.118.132]) [196.190.118.132]:55636: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)196.190.118.132337996g  -]% ossec13001gExim Auth failed2025-03-06 04:10:05 dovecot_plain authenticator failed for ([80.82.54.138]) [81.211.77.58]:26014: 535 Incorrect authentication data (set_id=services@heipowersystem.com)81.211.77.582017370p  -o% ossec13001gzExim Auth failed2025-03-06 04:08:49 dovecot_login authenticator failed for (amplifypowerglobal.com) [125.72.54.81]:42078: 535 Incorrect authentication data (set_id=admin@amplifypowerglobal.com)125.72.54.811814991[  -E% ossec13001g@Exim Auth failed2025-03-06 04:07:51 dovecot_login authenticator failed for (amplifypowerglobal.com) [125.72.54.81]:37986: 535 Incorrect authentication data (set_id=nologin)125.72.54.811814991 * R k #NZ`/)@ 3U) ossec11301g, New FTP connection.Mar 6 04:54:27 vm1 pure-ftpd[2525331]: (?@165.154.179.62) [INFO] New connection from 165.154.179.62165.154.179.622017370B?  gU) ossec11307g6Multiple connection attempts from same sourceMar 6 04:54:37 vm1 pure-ftpd[2525347]: (?@165.154.179.62) [INFO] New connection from 165.154.179.62165.154.179.622017370:>  Ak) ossec11302g4FTP Authentication failed.Mar 6 04:54:35 vm1 pure-ftpd[2525335]: (?@165.154.179.62) [WARNING] Authentication failed for user [anonymous]165.154.179.622017370)= 3U) ossec11301gNew FTP connection.Mar 6 04:54:09 vm1 pure-ftpd[2525302]: (?@165.154.179.62) [INFO] New connection from 165.154.179.62165.154.179.622017370v<  -y' ossec13001gیExim Auth failed2025-03-06 04:47:32 dovecot_plain authenticator failed for c188-151-64-10.bredband.tele2.se [188.151.64.10]:41134: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)188.151.64.102661886p;  -i+ ossec13001g۪Exim Auth failed2025-03-06 04:48:02 dovecot_plain authenticator failed for ([121.142.146.167]) [121.142.146.167]:38656: 535 Incorrect authentication data (set_id=services@heipowersystem.com)121.142.146.1671835841Q:  -1% ossec13001gۚExim Auth failed2025-03-06 04:47:45 dovecot_plain authenticator failed for ([14.39.41.171]) [14.39.41.171]:45956: 535 Incorrect authentication data (set_id=sales)14.39.41.1711835841T9 -5% ossec13001gPExim Auth failed2025-03-06 04:46:30 dovecot_login authenticator failed for (nyaystambh.com) [119.96.131.8]:54718: 535 Incorrect authentication data (set_id=nologin)119.96.131.81814991Z8  -?) ossec13001gExim Auth failed2025-03-06 04:39:56 dovecot_plain authenticator failed for ([60.175.146.138]) [60.175.146.138]:37744: 535 Incorrect authentication data (set_id=services)60.175.146.1381814991^7  -I) ossec13001gٷExim Auth failed2025-03-06 04:39:43 dovecot_plain authenticator failed for ip-188-127-16-197.ennet.pl [188.127.16.197]:56990: 535 Incorrect authentication data (set_id=sales)188.127.16.197798544m6  -e) ossec13001g٩Exim Auth failed2025-03-06 04:39:29 dovecot_plain authenticator failed for ([175.214.52.214]) [175.214.52.214]:10073: 535 Incorrect authentication data (set_id=services@heipowersystem.com)175.214.52.2141835841m5  -c+ ossec13001g٧Exim Auth failed2025-03-06 04:39:27 dovecot_plain authenticator failed for ([183.109.195.179]) [183.109.195.179]:44288: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)183.109.195.1791835841p4  -i+ ossec13001g1Exim Auth failed2025-03-06 04:37:29 dovecot_plain authenticator failed for ([199.188.103.179]) [199.188.103.179]:32822: 535 Incorrect authentication data (set_id=services@heipowersystem.com)199.188.103.1796252001V3  -9) ossec13001g'Exim Auth failed2025-03-06 04:37:18 dovecot_plain authenticator failed for ([91.224.253.233]) [91.224.253.233]:52180: 535 Incorrect authentication data (set_id=sales)91.224.253.233690791c2  -W% ossec13001gExim Auth failed2025-03-06 04:37:08 dovecot_plain authenticator failed for ([94.204.90.91]) [94.204.90.91]:34296: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)94.204.90.91290557T1  -7% ossec13001g؝Exim Auth failed2025-03-06 04:35:01 dovecot_plain authenticator failed for ([112.91.67.18]) [112.91.67.18]:57030: 535 Incorrect authentication data (set_id=services)112.91.67.181814991g0  -[' ossec13001g؍Exim Auth failed2025-03-06 04:34:44 dovecot_plain authenticator failed for ([178.25.73.199]) [178.25.73.199]:32812: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)178.25.73.1992921044g/  -]% ossec13001g؇Exim Auth failed2025-03-06 04:34:39 dovecot_plain authenticator failed for ([80.82.54.138]) [81.211.77.58]:47725: 535 Incorrect authentication data (set_id=services@heipowersystem.com)81.211.77.582017370 d= L B [ j  6XdpQ  -i+ ossec13001gnExim Auth failed2025-03-06 05:21:09 dovecot_plain authenticator failed for ([178.178.194.128]) [178.178.194.128]:51236: 535 Incorrect authentication data (set_id=services@heipowersystem.com)178.178.194.1282017370ZP  -?) ossec13001gExim Auth failed2025-03-06 05:18:18 dovecot_plain authenticator failed for ([197.255.138.31]) [197.255.138.31]:35859: 535 Incorrect authentication data (set_id=services)197.255.138.313374766fO  -]% ossec13001gExim Auth failed2025-03-06 05:18:01 dovecot_plain authenticator failed for ([196.0.34.106]) [196.0.34.106]:60599: 535 Incorrect authentication data (set_id=services@heipowersystem.com)196.0.34.106226074mN  -c+ ossec13001gExim Auth failed2025-03-06 05:17:39 dovecot_plain authenticator failed for ([182.163.122.133]) [182.163.122.133]:32205: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)182.163.122.1331210997kM  =Y# ossec13008gMail Reciepient rejected2025-03-06 05:17:28 H=([45.136.5.37]) [45.136.5.37]:62614 F= rejected RCPT : SMTP AUTH is required for message submission on port 58745.136.5.37298795gL  -[' ossec13001gExim Auth failed2025-03-06 05:14:00 dovecot_plain authenticator failed for syn-071-066-157-177.biz.spectrum.com [71.66.157.177]:62855: 535 Incorrect authentication data (set_id=sales)71.66.157.1776252001iK  -[+ ossec13001gExim Auth failed2025-03-06 05:13:39 dovecot_plain authenticator failed for (tagsdev.click) [199.188.103.179]:50574: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)199.188.103.1796252001ZJ  -?) ossec13001gExim Auth failed2025-03-06 05:09:14 dovecot_plain authenticator failed for ([124.221.104.33]) [124.221.104.33]:45934: 535 Incorrect authentication data (set_id=services)124.221.104.331814991dI  -W% ossec13001gExim Auth failed2025-03-06 05:09:01 dovecot_plain authenticator failed for ([92.47.46.174]) [92.47.46.174]:52888: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)92.47.46.1741522867mH  -e) ossec13001gExim Auth failed2025-03-06 05:09:00 dovecot_plain authenticator failed for ([47.189.156.222]) [47.189.156.222]:41444: 535 Incorrect authentication data (set_id=services@heipowersystem.com)47.189.156.2226252001WG  -;' ossec13001geExim Auth failed2025-03-06 05:03:56 dovecot_plain authenticator failed for ([218.4.205.242]) [218.4.205.242]:49764: 535 Incorrect authentication data (set_id=services)218.4.205.2421814991mF  -e) ossec13001gCExim Auth failed2025-03-06 05:03:21 dovecot_plain authenticator failed for ([122.228.225.21]) [122.228.225.21]:60468: 535 Incorrect authentication data (set_id=services@heipowersystem.com)122.228.225.211814991cE  -Q) ossec13001g7Exim Auth failed2025-03-06 05:03:10 dovecot_plain authenticator failed for 110-25-105-223.adsl.fetnet.net [110.25.105.223]:49649: 535 Incorrect authentication data (set_id=sales)110.25.105.2231668284D  -% ossec13001g+Exim Auth failed2025-03-06 05:02:58 dovecot_plain authenticator failed for 206.81.4.146.static.wline.lns.sme.cust.swisscom.ch [146.4.81.206]:37618: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)146.4.81.2062658434mC  -e) ossec13001gݰExim Auth failed2025-03-06 04:56:39 dovecot_plain authenticator failed for ([111.48.208.197]) [111.48.208.197]:47230: 535 Incorrect authentication data (set_id=services@heipowersystem.com)111.48.208.1971814991TB  -5' ossec13001gݮExim Auth failed2025-03-06 04:56:37 dovecot_plain authenticator failed for ([221.11.33.116]) [221.11.33.116]:36912: 535 Incorrect authentication data (set_id=sales)221.11.33.1161814991gA  -[' ossec13001gݐExim Auth failed2025-03-06 04:56:08 dovecot_plain authenticator failed for ([191.59.254.45]) [191.59.254.45]:55790: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)191.59.254.453469034 z Q s ..@bzdb  -S) ossec13001g}Exim Auth failed2025-03-06 05:42:45 dovecot_plain authenticator failed for (124-170-38-136.tpgi.com.au) [124.170.38.136]:55979: 535 Incorrect authentication data (set_id=services)124.170.38.1362077456Za  -=+ ossec13001gqExim Auth failed2025-03-06 05:42:32 dovecot_plain authenticator failed for ([221.149.233.246]) [221.149.233.246]:60584: 535 Incorrect authentication data (set_id=sales)221.149.233.2461835841j`  -_) ossec13001g_Exim Auth failed2025-03-06 05:42:13 dovecot_plain authenticator failed for ([183.100.18.224]) [183.100.18.224]:42210: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)183.100.18.2241835841|_  -) ossec13001g_Exim Auth failed2025-03-06 05:42:13 dovecot_plain authenticator failed for 125-228-225-91.hinet-ip.hinet.net [125.228.225.91]:60273: 535 Incorrect authentication data (set_id=services@heipowersystem.com)125.228.225.911668284b^  -O) ossec13001gExim Auth failed2025-03-06 05:34:36 dovecot_login authenticator failed for ([220.178.201.58]) [220.178.201.58]:58584: 535 Incorrect authentication data (set_id=vikas.khandelwal)220.178.201.581814991g]  -]% ossec13001gExim Auth failed2025-03-06 05:34:22 dovecot_plain authenticator failed for ([14.37.79.247]) [14.37.79.247]:52375: 535 Incorrect authentication data (set_id=services@heipowersystem.com)14.37.79.2471835841q\  -o' ossec13001gExim Auth failed2025-03-06 05:34:17 dovecot_login authenticator failed for ([58.250.157.83]) [58.250.157.83]:2058: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)58.250.157.831814991k[  -e% ossec13001g\Exim Auth failed2025-03-06 05:33:39 dovecot_plain authenticator failed for vps-79f20bfc.vps.ovh.net ([87.98.249.193]) [51.75.24.107]:44598: 535 Incorrect authentication data (set_id=sales)51.75.24.1073017382dZ  -W% ossec13001gSExim Auth failed2025-03-06 05:33:30 dovecot_plain authenticator failed for ([80.82.54.138]) [81.211.77.58]:51124: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)81.211.77.582017370]Y  -C+ ossec13001gvExim Auth failed2025-03-06 05:25:33 dovecot_plain authenticator failed for ([183.224.122.114]) [183.224.122.114]:47526: 535 Incorrect authentication data (set_id=services)183.224.122.1141814991gX  -]% ossec13001glExim Auth failed2025-03-06 05:25:23 dovecot_plain authenticator failed for ([85.19.195.12]) [85.19.195.12]:39570: 535 Incorrect authentication data (set_id=services@heipowersystem.com)85.19.195.123144096gW  -[' ossec13001gExim Auth failed2025-03-06 05:23:28 dovecot_plain authenticator failed for ([211.109.75.66]) [211.109.75.69]:60670: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)211.109.75.691835841mV  -e) ossec13001g Exim Auth failed2025-03-06 05:23:47 dovecot_plain authenticator failed for ([60.171.237.143]) [60.171.237.143]:53769: 535 Incorrect authentication data (set_id=services@heipowersystem.com)60.171.237.1431814991ZU  -=+ ossec13001g Exim Auth failed2025-03-06 05:23:46 dovecot_plain authenticator failed for ([123.209.108.180]) [123.209.108.180]:47260: 535 Incorrect authentication data (set_id=sales)123.209.108.1802077456BT  -% ossec13001gExim Auth failed2025-03-06 05:22:13 dovecot_plain authenticator failed for ([180.7.190.87]) [180.7.190.87]:44470: 535 Incorrect authentication data180.7.190.871861060{S  -) ossec13001gExim Auth failed2025-03-06 05:21:30 dovecot_plain authenticator failed for c-73-134-126-162.hsd1.md.comcast.net [73.134.126.162]:1123: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)73.134.126.1626252001fR  -W) ossec13001gExim Auth failed2025-03-06 05:21:27 dovecot_plain authenticator failed for p165190-obmd01.tokyo.ocn.ne.jp [153.141.58.190]:38775: 535 Incorrect authentication data (set_id=services)153.141.58.1901861060 G  3 R  %Gr8?Gts  -s) ossec13001gExim Auth failed2025-03-06 06:06:30 dovecot_plain authenticator failed for syn-098-102-148-242.biz.spectrum.com [98.102.148.242]:41268: 535 Incorrect authentication data (set_id=vikas.khandelwal)98.102.148.2426252001ur  -u) ossec13001gExim Auth failed2025-03-06 06:05:58 dovecot_plain authenticator failed for ([112.111.61.230]) [112.111.61.229]:53334: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)112.111.61.2291814991%q  3Q' ossec11301gNew FTP connection.Mar 6 06:05:05 vm1 pure-ftpd[2538863]: (?@20.169.104.60) [INFO] New connection from 20.169.104.6020.169.104.606252001Tp  -5' ossec13001gnExim Auth failed2025-03-06 06:03:50 dovecot_plain authenticator failed for ([61.108.83.138]) [61.108.83.138]:38487: 535 Incorrect authentication data (set_id=sales)61.108.83.1381835841jo  -_) ossec13001gdExim Auth failed2025-03-06 06:03:40 dovecot_plain authenticator failed for ([60.171.237.143]) [60.171.237.143]:49776: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)60.171.237.1431814991yn  -% ossec13001g~Exim Auth failed2025-03-06 05:59:50 dovecot_plain authenticator failed for 32.104.29.34.bc.googleusercontent.com [34.29.104.32]:47418: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)34.29.104.326252001Ym  -?) ossec13001gExim Auth failed2025-03-06 06:00:09 dovecot_plain authenticator failed for ([185.167.58.121]) [185.167.58.121]:37708: 535 Incorrect authentication data (set_id=services)185.167.58.121617790ml  -e) ossec13001gExim Auth failed2025-03-06 05:59:58 dovecot_plain authenticator failed for ([222.119.124.66]) [222.119.124.66]:48029: 535 Incorrect authentication data (set_id=services@heipowersystem.com)222.119.124.661835841Qk  -1% ossec13001gbExim Auth failed2025-03-06 05:55:05 dovecot_plain authenticator failed for ([220.81.9.218]) [220.81.9.218]:41592: 535 Incorrect authentication data (set_id=sales)220.81.9.2181835841Zj  -?) ossec13001g^Exim Auth failed2025-03-06 05:55:02 dovecot_plain authenticator failed for ([112.111.61.231]) [112.111.61.229]:37188: 535 Incorrect authentication data (set_id=services)112.111.61.2291814991vi  -y' ossec13001gVExim Auth failed2025-03-06 05:54:52 dovecot_plain authenticator failed for p5098d833.dip0.t-ipconnect.de [80.152.216.51]:28632: 535 Incorrect authentication data (set_id=services@heipowersystem.com)80.152.216.512921044jh  -_) ossec13001gTExim Auth failed2025-03-06 05:54:51 dovecot_plain authenticator failed for ([78.132.137.230]) [78.132.137.230]:59806: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)78.132.137.2302017370Ag  ={+ ossec13008gMail Reciepient rejected2025-03-06 05:52:48 H=(mail.thepsindustries.com) [165.154.233.146]:54395 F= rejected RCPT : Rejected relay attempt: '165.154.233.146' From: 'hobivgc@thepsindustries.com' To: 'goofile@fastmail.com'165.154.233.1461694008]f  -C+ ossec13001gExim Auth failed2025-03-06 05:49:27 dovecot_plain authenticator failed for ([220.189.235.126]) [220.189.235.126]:52657: 535 Incorrect authentication data (set_id=services)220.189.235.1261814991de  -U' ossec13001gExim Auth failed2025-03-06 05:49:18 dovecot_plain authenticator failed for h77-53-235-246.cust.bredband2.com [77.53.235.246]:58512: 535 Incorrect authentication data (set_id=sales)77.53.235.2462661886jd  -a' ossec13001gExim Auth failed2025-03-06 05:49:07 dovecot_plain authenticator failed for ([82.208.99.163]) [82.208.99.163]:57908: 535 Incorrect authentication data (set_id=services@heipowersystem.com)82.208.99.1632017370sc  -u% ossec13001gExim Auth failed2025-03-06 05:49:04 dovecot_plain authenticator failed for 1-36-180-128.ptr.netvigator.com [1.36.180.128]:59335: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)1.36.180.1281819730 ( 1 C _ 6HZW  -9) ossec13001gHExim Auth failed2025-03-06 06:28:47 dovecot_plain authenticator failed for ([121.162.101.72]) [121.162.101.72]:55251: 535 Incorrect authentication data (set_id=sales)121.162.101.721835841W  -;' ossec13001g2Exim Auth failed2025-03-06 06:28:25 dovecot_plain authenticator failed for ([123.182.89.19]) [123.182.89.19]:32854: 535 Incorrect authentication data (set_id=services)123.182.89.191814991j  -a' ossec13001g&Exim Auth failed2025-03-06 06:28:12 dovecot_plain authenticator failed for ([1.252.204.203]) [1.252.204.203]:53759: 535 Incorrect authentication data (set_id=services@heipowersystem.com)1.252.204.2031835841j  -_) ossec13001g Exim Auth failed2025-03-06 06:28:06 dovecot_plain authenticator failed for ([203.193.147.37]) [203.193.147.37]:58969: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)203.193.147.371269750T  -5' ossec13001gExim Auth failed2025-03-06 06:19:34 dovecot_plain authenticator failed for ([88.84.209.146]) [88.84.209.146]:50702: 535 Incorrect authentication data (set_id=sales)88.84.209.1462017370|  -) ossec13001gExim Auth failed2025-03-06 06:19:24 dovecot_plain authenticator failed for syn-035-130-111-146.biz.spectrum.com [35.130.111.146]:35945: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)35.130.111.1466252001Z~  -?) ossec13001gSExim Auth failed2025-03-06 06:11:53 dovecot_plain authenticator failed for ([111.48.208.197]) [111.48.208.197]:21966: 535 Incorrect authentication data (set_id=services)111.48.208.1971814991S}  -3' ossec13001gGExim Auth failed2025-03-06 06:11:42 dovecot_plain authenticator failed for ([58.250.157.83]) [58.250.157.83]:2059: 535 Incorrect authentication data (set_id=sales)58.250.157.831814991t|  -u' ossec13001g;Exim Auth failed2025-03-06 06:11:31 dovecot_plain authenticator failed for (111-86-33-194.intelcom-ug.ru) [194.33.87.111]:55530: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)194.33.87.1112017370d{  -Y# ossec13001g7Exim Auth failed2025-03-06 06:11:25 dovecot_plain authenticator failed for ([60.28.60.82]) [60.28.60.82]:55922: 535 Incorrect authentication data (set_id=services@heipowersystem.com)60.28.60.821814991Zz  -?) ossec13001gExim Auth failed2025-03-06 06:09:40 dovecot_plain authenticator failed for ([103.180.240.96]) [103.180.240.96]:36518: 535 Incorrect authentication data (set_id=services)103.180.240.961282988Zy  -=+ ossec13001gExim Auth failed2025-03-06 06:09:33 dovecot_plain authenticator failed for ([212.120.163.110]) [212.120.163.110]:50429: 535 Incorrect authentication data (set_id=sales)212.120.163.1102017370`x  -S# ossec13001gExim Auth failed2025-03-06 06:09:21 dovecot_plain authenticator failed for ([2.55.88.152]) [2.55.88.152]:54615: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)2.55.88.152294640jw  -a' ossec13001gExim Auth failed2025-03-06 06:09:19 dovecot_plain authenticator failed for ([222.100.159.2]) [222.100.159.2]:35729: 535 Incorrect authentication data (set_id=services@heipowersystem.com)222.100.159.21835841sv  -s' ossec13001gIExim Auth failed2025-03-06 06:07:28 dovecot_plain authenticator failed for 83.106.54.198.in-addr.arpa [198.54.106.83]:59881: 535 Incorrect authentication data (set_id=services@heipowersystem.com)198.54.106.836252001ju  -]+ ossec13001g=Exim Auth failed2025-03-06 06:07:15 dovecot_plain authenticator failed for (180-222-166-212.static.dsl.net.au) [180.222.166.212]:37860: 535 Incorrect authentication data (set_id=sales)180.222.166.2122077456ft  -Y' ossec13001g2Exim Auth failed2025-03-06 06:07:05 dovecot_plain authenticator failed for ([223.82.115.84]) [223.82.115.84]:1556: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)223.82.115.841814991 $ F ^ [  2J_tj  -a' ossec13001g=Exim Auth failed2025-03-06 06:49:55 dovecot_plain authenticator failed for ([60.191.94.106]) [60.191.94.106]:33832: 535 Incorrect authentication data (set_id=services@heipowersystem.com)60.191.94.1061814991g  -]% ossec13001gmExim Auth failed2025-03-06 06:46:27 dovecot_plain authenticator failed for ([2.63.169.110]) [2.63.169.110]:47558: 535 Incorrect authentication data (set_id=services@heipowersystem.com)2.63.169.1102017370g  -[' ossec13001giExim Auth failed2025-03-06 06:46:24 dovecot_plain authenticator failed for ([31.173.20.146]) [31.173.20.146]:52592: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)31.173.20.1462017370d -Q) ossec13001gExim Auth failed2025-03-06 06:43:48 dovecot_login authenticator failed for 122.103.187.50.ap.gmobb-fix.jp [122.103.187.50]:44742: 535 Incorrect authentication data (set_id=sales)122.103.187.501861060T  -5' ossec13001gExim Auth failed2025-03-06 06:43:45 dovecot_plain authenticator failed for ([121.65.54.204]) [121.65.54.204]:33258: 535 Incorrect authentication data (set_id=sales)121.65.54.2041835841W  -9) ossec13001gExim Auth failed2025-03-06 06:43:43 dovecot_login authenticator failed for ([222.128.80.201]) [222.128.80.201]:12971: 535 Incorrect authentication data (set_id=sales)222.128.80.2011814991g  -[' ossec13001gExim Auth failed2025-03-06 06:43:40 dovecot_login authenticator failed for ([183.105.3.221]) [183.105.3.221]:42972: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)183.105.3.2211835841v  -w) ossec13001gExim Auth failed2025-03-06 06:43:33 dovecot_plain authenticator failed for 110-25-106-243.adsl.fetnet.net [110.25.106.243]:50154: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)110.25.106.2431668284j  -_) ossec13001gExim Auth failed2025-03-06 06:43:32 dovecot_login authenticator failed for ([92.124.137.205]) [92.124.137.205]:49439: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)92.124.137.2052017370i  -_) ossec13001gExim Auth failed2025-03-06 06:43:27 dovecot_login authenticator failed for ([87.200.188.170]) [87.200.188.170]:43324: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)87.200.188.170290557Z  -?) ossec13001g:Exim Auth failed2025-03-06 06:41:22 dovecot_plain authenticator failed for ([203.189.124.62]) [203.189.124.62]:42829: 535 Incorrect authentication data (set_id=services)203.189.124.622077456T  -5' ossec13001g,Exim Auth failed2025-03-06 06:41:07 dovecot_plain authenticator failed for ([180.168.119.2]) [180.168.119.2]:42873: 535 Incorrect authentication data (set_id=sales)180.168.119.21814991  - ) ossec13001g(Exim Auth failed2025-03-06 06:41:03 dovecot_plain authenticator failed for syn-104-231-212-078.res.spectrum.com [104.231.212.78]:50158: 535 Incorrect authentication data (set_id=services@heipowersystem.com)104.231.212.786252001d  -W% ossec13001g!Exim Auth failed2025-03-06 06:40:55 dovecot_plain authenticator failed for ([111.50.70.34]) [111.50.70.34]:34089: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)111.50.70.341814991Z  -?) ossec13001gExim Auth failed2025-03-06 06:35:29 dovecot_plain authenticator failed for ([78.132.137.230]) [78.132.137.230]:59876: 535 Incorrect authentication data (set_id=services)78.132.137.2302017370m  -c+ ossec13001gExim Auth failed2025-03-06 06:35:21 dovecot_plain authenticator failed for ([123.209.105.123]) [123.209.105.123]:39854: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)123.209.105.1232077456g  -]% ossec13001gExim Auth failed2025-03-06 06:35:19 dovecot_plain authenticator failed for ([49.124.132.6]) [49.124.132.6]:55774: 535 Incorrect authentication data (set_id=services@heipowersystem.com)49.124.132.61733045 p   B j w 5TZpf&  -W) ossec13001gExim Auth failed2025-03-06 07:01:46 dovecot_login authenticator failed for ([183.193.94.254]) [101.224.38.123]:44298: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)101.224.38.1231814991v%  -y' ossec13001gExim Auth failed2025-03-06 07:01:27 dovecot_login authenticator failed for ([218.4.214.115]) [218.4.214.115]:35491: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)218.4.214.1151814991]$  -C+ ossec13001g(Exim Auth failed2025-03-06 06:58:07 dovecot_plain authenticator failed for ([121.135.188.125]) [121.135.188.125]:57124: 535 Incorrect authentication data (set_id=services)121.135.188.1251835841Z#  -=+ ossec13001gExim Auth failed2025-03-06 06:57:57 dovecot_plain authenticator failed for ([190.121.193.126]) [190.121.193.126]:48928: 535 Incorrect authentication data (set_id=sales)190.121.193.1263595528j"  -a' ossec13001gExim Auth failed2025-03-06 06:57:49 dovecot_plain authenticator failed for ([67.55.189.215]) [67.55.189.215]:40328: 535 Incorrect authentication data (set_id=services@heipowersystem.com)67.55.189.2156252001|!  -) ossec13001g Exim Auth failed2025-03-06 06:57:39 dovecot_plain authenticator failed for 166.46.246.220.static.netvigator.com [220.246.46.166]:54514: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)220.246.46.1661819730]  -C+ ossec13001gExim Auth failed2025-03-06 06:56:32 dovecot_login authenticator failed for ([119.198.191.130]) [119.198.191.130]:44079: 535 Incorrect authentication data (set_id=services)119.198.191.1301835841W  -;' ossec13001gExim Auth failed2025-03-06 06:56:12 dovecot_plain authenticator failed for ([58.42.226.215]) [58.42.226.215]:43018: 535 Incorrect authentication data (set_id=services)58.42.226.2151814991p  -i+ ossec13001gExim Auth failed2025-03-06 06:56:09 dovecot_login authenticator failed for ([197.255.196.156]) [197.255.196.156]:39438: 535 Incorrect authentication data (set_id=services@heipowersystem.com)197.255.196.1562413451T  -5' ossec13001gExim Auth failed2025-03-06 06:56:04 dovecot_plain authenticator failed for ([211.202.71.21]) [211.202.71.21]:60400: 535 Incorrect authentication data (set_id=sales)211.202.71.211835841j  -a' ossec13001gExim Auth failed2025-03-06 06:55:41 dovecot_plain authenticator failed for ([39.152.196.78]) [39.152.196.78]:38340: 535 Incorrect authentication data (set_id=services@heipowersystem.com)39.152.196.781814991o  -o# ossec13001gExim Auth failed2025-03-06 06:55:41 dovecot_plain authenticator failed for 95-31-6-109.static.corbina.ru [95.31.6.109]:53562: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)95.31.6.1092017370T  -7% ossec13001gExim Auth failed2025-03-06 06:53:31 dovecot_plain authenticator failed for ([220.81.9.218]) [220.81.9.218]:52416: 535 Incorrect authentication data (set_id=services)220.81.9.2181835841V  -9) ossec13001gExim Auth failed2025-03-06 06:53:19 dovecot_plain authenticator failed for ([185.101.16.250]) [185.101.16.250]:45883: 535 Incorrect authentication data (set_id=sales)185.101.16.250272103p  -i+ ossec13001gExim Auth failed2025-03-06 06:53:10 dovecot_plain authenticator failed for ([175.117.144.158]) [175.117.144.158]:38628: 535 Incorrect authentication data (set_id=services@heipowersystem.com)175.117.144.1581835841y  -' ossec13001gExim Auth failed2025-03-06 06:53:10 dovecot_plain authenticator failed for c-98-198-85-135.hsd1.tx.comcast.net [98.198.85.135]:49495: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)98.198.85.1356252001o  -g+ ossec13001g_Exim Auth failed2025-03-06 06:50:29 dovecot_plain authenticator failed for (177-174-122-213.user.vivozap.com.br) [177.174.122.213]:52890: 535 Incorrect authentication data (set_id=services)177.174.122.2133469034 " 4 0 O ^ sop7  -i+ ossec13001gExim Auth failed2025-03-06 07:27:50 dovecot_plain authenticator failed for ([115.242.200.126]) [115.242.200.126]:41164: 535 Incorrect authentication data (set_id=services@heipowersystem.com)115.242.200.1261269750j6  -_) ossec13001gExim Auth failed2025-03-06 07:27:39 dovecot_plain authenticator failed for ([178.216.220.91]) [178.216.220.91]:56998: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)178.216.220.912017370S5  -7% ossec13001g1Exim Auth failed2025-03-06 07:28:09 dovecot_plain authenticator failed for ([194.28.91.40]) [194.28.91.40]:58143: 535 Incorrect authentication data (set_id=services)194.28.91.40690791(4  3U) ossec11301gNew FTP connection.Mar 6 07:25:56 vm1 pure-ftpd[2553739]: (?@89.248.168.227) [INFO] New connection from 89.248.168.22789.248.168.2272750405Z3  -?) ossec13001gExim Auth failed2025-03-06 07:22:28 dovecot_plain authenticator failed for ([115.244.25.190]) [103.156.208.66]:36110: 535 Incorrect authentication data (set_id=services)103.156.208.661269750f2  -W) ossec13001gExim Auth failed2025-03-06 07:22:12 dovecot_plain authenticator failed for c83-254-214-181.bredband.tele2.se [83.254.214.181]:54842: 535 Incorrect authentication data (set_id=sales)83.254.214.1812661886l1  -c) ossec13001gExim Auth failed2025-03-06 07:22:03 dovecot_plain authenticator failed for zdomainaccess.com [216.70.114.230]:45048: 535 Incorrect authentication data (set_id=services@heipowersystem.com)216.70.114.2306252001f0  -[' ossec13001gExim Auth failed2025-03-06 07:21:55 dovecot_plain authenticator failed for ([91.219.196.17]) [91.219.196.17]:56378: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)91.219.196.17690791W/  -;' ossec13001g!Exim Auth failed2025-03-06 07:15:03 dovecot_plain authenticator failed for ([183.47.48.178]) [183.47.48.178]:57365: 535 Incorrect authentication data (set_id=services)183.47.48.1781814991W.  -9) ossec13001gExim Auth failed2025-03-06 07:14:56 dovecot_plain authenticator failed for ([223.82.241.145]) [223.82.241.145]:60118: 535 Incorrect authentication data (set_id=sales)223.82.241.1451814991g-  -]% ossec13001gExim Auth failed2025-03-06 07:14:51 dovecot_plain authenticator failed for ([58.16.49.250]) [58.16.49.250]:32982: 535 Incorrect authentication data (set_id=services@heipowersystem.com)58.16.49.2501814991m,  -c+ ossec13001g Exim Auth failed2025-03-06 07:14:44 dovecot_plain authenticator failed for ([203.123.219.137]) [203.123.219.137]:37114: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)203.123.219.1371835841]+  -C+ ossec13001gExim Auth failed2025-03-06 07:08:22 dovecot_login authenticator failed for ([121.135.188.125]) [121.135.188.125]:36878: 535 Incorrect authentication data (set_id=services)121.135.188.1251835841*  -' ossec13001gExim Auth failed2025-03-06 07:08:07 dovecot_login authenticator failed for (160.228-59-41.static-zone.ttcldata.net) [41.59.228.160]:43628: 535 Incorrect authentication data (set_id=services@heipowersystem.com)41.59.228.160149590j)  -_) ossec13001g*Exim Auth failed2025-03-06 07:06:40 dovecot_plain authenticator failed for ([124.221.104.33]) [124.221.104.33]:54954: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)124.221.104.331814991l(  -a+ ossec13001gExim Auth failed2025-03-06 07:06:26 dovecot_plain authenticator failed for c188-150-226-207.bredband.tele2.se [188.150.226.207]:58202: 535 Incorrect authentication data (set_id=services)188.150.226.2072661886j'  -a' ossec13001gExim Auth failed2025-03-06 07:06:17 dovecot_plain authenticator failed for ([61.185.216.98]) [61.185.216.98]:43802: 535 Incorrect authentication data (set_id=services@heipowersystem.com)61.185.216.981814991 }pcVI</"yl_RE8+~qdWJ=0# zm`SF9, v i \ O B 5 (     r e X K > 1 $  { n a T G : -   w j ] P C 6 )    s f Y L ? 2 %  |obUH;.!xk^QD7*tgZM@3& uh[NA4' ~qdWJ=0bVJ> 1269750K< 1269750K: 1269750K7 1269750K, 1269750J 1269750J 1269750J 1269750J 1269750J 1269750J 1269750J 1269750J 1269750J 1269750J 1269750J 1269750J 1269750J 1269750J 1269750J 1269750J 1269750J 1269750J 1269750J 1269750J 1269750J 1269750J 1269750@ 1269750@T 1269750@$ 1269750@ 1269750@ 1269750@ 1269750@ 1269750? 1269750? 1269750? 1269750? 1269750? 1269750? 1269750? 1269750? 1269750? 1269750? 1269750?w 1269750?h 1269750?Z 1269750?W 1269750?R 1269750?K 1269750?3 1269750? 1269750> 1269750> 1269750> 1269750> 1269750> 1269750> 1269750> 1269750> 1269750J 1269750J 1269750J 1269750J 1269750J 1269750J 1269750J 1269750J 1269750J 1269750J 1269750J 1269750J 1269750J 1269750J 1269750J 1269750J 1269750J 1269750J 1269750J 1269750J 1269750J 1269750J 1269750J 1269750J 1269750J 1269750J 1269750J 1269750J 1269750J 1269750J 1269750J} 1269750Ju 1269750Jq 1269750Ji 1269750Je 1269750JS 1269750JG 1269750JD 1269750JB 1269750J; 1269750J: 1269750J7 1269750J# 1269750J! 1269750J 1269750J 1269750J 1269750J 1269750J 1269750J 1269750J 1269750J 1269750J 1269750J 1269750I 1269750I 1269750I 1269750I 1269750I 1269750I 1269750I 1269750I 1269750I~ 1269750Ix 1269750IO 1269750I: 1269750I! 1269750I 1269750I 1269750H 1269750H 1269750H 1269750H 1269750H 1269750H 1269750H 1269750H 1269750H 1269750H 1269750H 1269750H 1269750H 1269750H 1269750H 1269750H 1269750H 1269750H 1269750Hr 1269750Hp 1269750Hm 1269750HK 1269750H8 1269750H$ 1269750H 1269750G 1269750G 1269750G 1269750GY 1269750GR 1269750G5 1269750G3 1269750G 1269750G 1269750G 1269750G 1269750F 1269750F 1269750F 1269750F 1269750F 1269750F 1269750F 1269750F 1269750F 1269750F 1269750Fz 1269750Fo 1269750FV 1269750FU 1269750F7 1269750F/ 1269750E 1269750E 1269750E 1269750E 1269750E 1269750E 1269750E 1269750E 1269750E 1269750E 1269750Eh 1269750Ee 1269750Ed 1269750EZ 1269750EY 1269750ED 1269750EA 1269750E: 1269750E9 1269750E 1269750D 1269750D 1269750D 1269750D 1269750D 1269750D 1269750D 1269750Dp 1269750Di 1269750D] 1269750DT 1269750DH 1269750D 1269750D 1269750D 1269750D 1269750D 1269750C 1269750C 1269750C 1269750C 1269750C 1269750C 1269750C] 1269750C\ 1269750CO 1269750CM 1269750C@ 1269750C6 1269750C# 1269750B 1269750B 1269750B 1269750B 1269750B 1269750B 1269750B 1269750B 1269750B 1269750B 1269750BZ 1269750BE 1269750B@ 1269750B5 1269750B& 1269750B" 1269750B 1269750B 1269750B 1269750A 1269750A 1269750A 1269750A 1269750Av 1269750A[ 1269750A8 1269750A 1269750A 1269750A 1269750@ 1269750@ 1269750@ 1269750@ 1269750@ }pcVI</"yl_RE8+~qdWJ=0# zm`SF9, v i \ O B 5 (     r e X K > 1 $  { n a T G : -   w j ] P C 6 )    s f Y L ? 2 %  |obUH;.!xk^QD7*tgZM@3& uh[NA4' ~qdWJ=0 6252001". 6252001 6252001 6252001 6252001w 6252001v 6252001t 6252001n 6252001k 6252001j 6252001g 6252001^ 6252001T 6252001R 6252001L 6252001J 6252001= 6252001" 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001" 6252001" 6252001! 6252001! 6252001! 6252001! 6252001! 6252001! 6252001! 6252001! 6252001! 6252001! 6252001! 6252001! 6252001! 6252001! 6252001!z 6252001!p 6252001!l 6252001!Z 6252001!Y 6252001!U 6252001!T 6252001!K 6252001!F 6252001!. 6252001!) 6252001! 6252001! 6252001! 6252001! 6252001! 6252001! 6252001! 6252001! 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 ~ 6252001 u 6252001 t 6252001 f 6252001 ` 6252001 ^ 6252001 ] 6252001 Z 6252001 W 6252001 V 6252001 M 6252001 C 6252001 ? 6252001 9 6252001 / 6252001 * 6252001 ' 6252001 % 6252001 6252001  6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001~ 6252001{ 6252001o 6252001c 6252001` 6252001_ 6252001\ 6252001U 6252001J 6252001' 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001s 6252001b 6252001Z 6252001S 6252001? 6252001. 6252001- 6252001" 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001k 6252001a 6252001` 6252001Y 6252001U 6252001= 62520011 6252001" 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001w 6252001m 6252001b 6252001V 6252001K 6252001H 6252001/ 6252001! 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001k 6252001\ 6252001X 62520017 62520010 6252001# 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 * Y 08ZzkH  -c' ossec13001gExim Auth failed2025-03-06 07:44:22 dovecot_plain authenticator failed for ([223.75.231.193]) [58.49.113.138]:10684: 535 Incorrect authentication data (set_id=services@heipowersystem.com)58.49.113.1381814991mG  -c+ ossec13001gExim Auth failed2025-03-06 07:44:16 dovecot_plain authenticator failed for ([116.116.108.165]) [116.116.108.165]:58234: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)116.116.108.1651814991\F  -A+ ossec13001gExim Auth failed2025-03-06 07:44:43 dovecot_plain authenticator failed for ([182.163.122.133]) [182.163.122.133]:1255: 535 Incorrect authentication data (set_id=services)182.163.122.1331210997ZE  -=+ ossec13001gExim Auth failed2025-03-06 07:44:28 dovecot_plain authenticator failed for ([157.122.183.220]) [157.122.183.220]:33421: 535 Incorrect authentication data (set_id=sales)157.122.183.2201814991tD  -w% ossec13001gExim Auth failed2025-03-06 07:42:54 dovecot_plain authenticator failed for bb121-7-26-195.singnet.com.sg [121.7.26.195]:32784: 535 Incorrect authentication data (set_id=services@heipowersystem.com)121.7.26.1951880251QC  -1% ossec13001gExim Auth failed2025-03-06 07:40:15 dovecot_plain authenticator failed for ([182.76.71.82]) [182.76.71.82]:58746: 535 Incorrect authentication data (set_id=sales)182.76.71.821269750]B  -C+ ossec13001gExim Auth failed2025-03-06 07:39:52 dovecot_plain authenticator failed for ([213.195.113.234]) [213.195.113.234]:35964: 535 Incorrect authentication data (set_id=services)213.195.113.2342510769sA  -w# ossec13001gExim Auth failed2025-03-06 07:39:43 dovecot_plain authenticator failed for 37.151.71.8.dynamic.telecom.kz [37.151.71.8]:44914: 535 Incorrect authentication data (set_id=services@heipowersystem.com)37.151.71.81522867g@  -[' ossec13001gExim Auth failed2025-03-06 07:39:39 dovecot_plain authenticator failed for ([121.65.54.204]) [121.65.54.204]:58674: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)121.65.54.2041835841y?  -}) ossec13001g(Exim Auth failed2025-03-06 07:36:31 dovecot_plain authenticator failed for 46-162-112-159.cust.bredband2.com [46.162.112.159]:48552: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)46.162.112.1592661886]>  -C+ ossec13001g>Exim Auth failed2025-03-06 07:36:52 dovecot_plain authenticator failed for ([190.211.250.118]) [190.211.250.122]:44264: 535 Incorrect authentication data (set_id=services)190.211.250.1223895114c=  -S' ossec13001g8Exim Auth failed2025-03-06 07:36:46 dovecot_plain authenticator failed for 216.106.67.50.reverse.socket.net [216.106.67.50]:60286: 535 Incorrect authentication data (set_id=sales)216.106.67.506252001p<  -i+ ossec13001g,Exim Auth failed2025-03-06 07:36:34 dovecot_plain authenticator failed for ([123.210.131.121]) [123.210.131.121]:56010: 535 Incorrect authentication data (set_id=services@heipowersystem.com)123.210.131.1212077456T;  -7% ossec13001gdExim Auth failed2025-03-06 07:33:15 dovecot_plain authenticator failed for ([36.33.201.45]) [36.33.201.45]:38082: 535 Incorrect authentication data (set_id=services)36.33.201.451814991M:  --# ossec13001gPExim Auth failed2025-03-06 07:32:55 dovecot_plain authenticator failed for ([5.30.215.71]) [5.30.215.71]:44329: 535 Incorrect authentication data (set_id=sales)5.30.215.71290557j9  -a' ossec13001gPExim Auth failed2025-03-06 07:32:54 dovecot_plain authenticator failed for ([89.101.36.159]) [89.101.36.159]:50823: 535 Incorrect authentication data (set_id=services@heipowersystem.com)89.101.36.1592963597d8  -W% ossec13001g4Exim Auth failed2025-03-06 07:32:27 dovecot_plain authenticator failed for ([27.124.18.27]) [27.124.18.27]:38556: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)27.124.18.271269750   ! 0 R g | !rzY  -' ossec13001g Exim Auth failed2025-03-06 08:18:42 dovecot_plain authenticator failed for syn-156-019-080-138.biz.spectrum.com [156.19.80.138]:53527: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)156.19.80.1386252001dX  -W% ossec13001g Exim Auth failed2025-03-06 08:14:13 dovecot_plain authenticator failed for ([59.7.203.177]) [59.7.203.177]:44580: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)59.7.203.1771835841mW  -e) ossec13001g Exim Auth failed2025-03-06 08:13:59 dovecot_plain authenticator failed for ([178.163.27.129]) [178.163.27.129]:55850: 535 Incorrect authentication data (set_id=services@heipowersystem.com)178.163.27.1292017370ZV  -?) ossec13001g Exim Auth failed2025-03-06 08:14:11 dovecot_plain authenticator failed for ([218.94.115.164]) [218.94.115.164]:33928: 535 Incorrect authentication data (set_id=services)218.94.115.1641814991+U  3Y+ ossec11301g New FTP connection.Mar 6 08:08:41 vm1 pure-ftpd[2561685]: (?@147.185.132.255) [INFO] New connection from 147.185.132.255147.185.132.2556252001dT  -Y# ossec13001g Exim Auth failed2025-03-06 08:08:10 dovecot_plain authenticator failed for ([60.6.219.83]) [60.6.219.83]:56291: 535 Incorrect authentication data (set_id=services@heipowersystem.com)60.6.219.831814991QS  -3# ossec13001g mExim Auth failed2025-03-06 08:03:17 dovecot_plain authenticator failed for ([101.13.5.49]) [101.13.5.49]:55258: 535 Incorrect authentication data (set_id=services)101.13.5.491668284gR  -]% ossec13001g [Exim Auth failed2025-03-06 08:02:58 dovecot_plain authenticator failed for ([110.34.70.28]) [110.34.70.28]:35704: 535 Incorrect authentication data (set_id=services@heipowersystem.com)110.34.70.281835841ZQ  -?) ossec13001g Exim Auth failed2025-03-06 08:01:39 dovecot_plain authenticator failed for ([121.189.226.81]) [121.189.226.81]:50720: 535 Incorrect authentication data (set_id=services)121.189.226.811835841QP  -1% ossec13001gExim Auth failed2025-03-06 08:01:10 dovecot_plain authenticator failed for ([183.6.102.11]) [183.6.102.11]:16034: 535 Incorrect authentication data (set_id=sales)183.6.102.111814991gO  -]% ossec13001gExim Auth failed2025-03-06 08:01:10 dovecot_plain authenticator failed for ([218.68.0.210]) [218.68.0.210]:33190: 535 Incorrect authentication data (set_id=services@heipowersystem.com)218.68.0.2101814991gN  -[' ossec13001gExim Auth failed2025-03-06 08:00:56 dovecot_plain authenticator failed for ([103.65.227.12]) [103.65.227.12]:52792: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)103.65.227.121210997ZM  -?) ossec13001gExim Auth failed2025-03-06 07:53:14 dovecot_plain authenticator failed for ([157.122.199.25]) [157.122.199.25]:54621: 535 Incorrect authentication data (set_id=services)157.122.199.251814991mL  -e) ossec13001gExim Auth failed2025-03-06 07:52:48 dovecot_plain authenticator failed for ([103.129.201.82]) [103.129.201.81]:47436: 535 Incorrect authentication data (set_id=services@heipowersystem.com)103.129.201.811210997jK  -_) ossec13001gExim Auth failed2025-03-06 07:52:22 dovecot_plain authenticator failed for ([182.70.118.230]) [182.70.118.230]:45803: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)182.70.118.2301269750zJ  -% ossec13001gExim Auth failed2025-03-06 07:51:08 dovecot_login authenticator failed for (dynamicip-95-79-108-51.pppoe.nn.ertelecom.ru) [95.79.108.51]:55376: 535 Incorrect authentication data (set_id=vikas.khandelwal)95.79.108.512017370oI  -m% ossec13001gExim Auth failed2025-03-06 07:50:59 dovecot_login authenticator failed for ([60.174.35.18]) [60.174.35.18]:54051: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)60.174.35.181814991 8  < ^ e x#8gj  -[' ossec13001gExim Auth failed2025-03-06 08:30:51 dovecot_plain authenticator failed for ([123.182.89.19]) [123.182.89.19]:54768: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)123.182.89.191814991gi  -]% ossec13001gYExim Auth failed2025-03-06 08:28:33 dovecot_plain authenticator failed for ([1.212.225.99]) [1.212.225.99]:42578: 535 Incorrect authentication data (set_id=services@heipowersystem.com)1.212.225.991835841jh  -a' ossec13001gIExim Auth failed2025-03-06 08:28:17 dovecot_plain authenticator failed for ([14.53.126.112]) [14.53.126.112]:48386: 535 Incorrect authentication data (set_id=services@heipowersystem.com)14.53.126.1121835841Qg  -3# ossec13001gExim Auth failed2025-03-06 08:26:13 dovecot_plain authenticator failed for ([1.241.64.92]) [1.241.64.92]:49326: 535 Incorrect authentication data (set_id=services)1.241.64.921835841pf  -i+ ossec13001gExim Auth failed2025-03-06 08:26:02 dovecot_plain authenticator failed for ([175.203.245.102]) [175.203.245.102]:41118: 535 Incorrect authentication data (set_id=services@heipowersystem.com)175.203.245.1021835841pe  -i+ ossec13001gExim Auth failed2025-03-06 08:26:02 dovecot_login authenticator failed for (pool-176-226-241-177.is74.ru) [176.226.241.177]:37508: 535 Incorrect authentication data (set_id=vikas.khandelwal)176.226.241.1772017370rd  -q' ossec13001gExim Auth failed2025-03-06 08:25:51 dovecot_login authenticator failed for ([95.220.25.124]) [95.220.25.124]:17995: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)95.220.25.1242017370Vc  -9) ossec13001gExim Auth failed2025-03-06 08:25:48 dovecot_plain authenticator failed for ([168.167.55.230]) [168.167.55.230]:39945: 535 Incorrect authentication data (set_id=sales)168.167.55.230933860}b  -' ossec13001gExim Auth failed2025-03-06 08:25:37 dovecot_plain authenticator failed for broadband-95-84-158-215.ip.moscow.rt.ru [95.84.158.215]:50400: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)95.84.158.2152017370ja  -_) ossec13001gExim Auth failed2025-03-06 08:23:18 dovecot_plain authenticator failed for ([67.159.139.135]) [67.159.139.135]:53356: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)67.159.139.1356252001i`  -]) ossec13001gExim Auth failed2025-03-06 08:23:08 dovecot_plain authenticator failed for (173-20-253-109.client.mchsi.com) [173.20.253.109]:37686: 535 Incorrect authentication data (set_id=services)173.20.253.1096252001u_  -w' ossec13001g Exim Auth failed2025-03-06 08:22:57 dovecot_plain authenticator failed for n219077029126.netvigator.com [219.77.29.126]:33554: 535 Incorrect authentication data (set_id=services@heipowersystem.com)219.77.29.1261819730Z^  -=+ ossec13001g Exim Auth failed2025-03-06 08:21:39 dovecot_plain authenticator failed for ([222.114.223.155]) [222.114.223.155]:44671: 535 Incorrect authentication data (set_id=sales)222.114.223.1551835841]] -A+ ossec13001g Exim Auth failed2025-03-06 08:21:31 dovecot_login authenticator failed for (gurukuljaipur.com) [111.122.211.212]:52948: 535 Incorrect authentication data (set_id=nologin)111.122.211.2121814991}\  -) ossec13001g Exim Auth failed2025-03-06 08:21:27 dovecot_plain authenticator failed for (static-206.168.107.27-tataidc.co.in) [27.107.168.206]:42394: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)27.107.168.2061269750c[  -Q) ossec13001g #Exim Auth failed2025-03-06 08:19:05 dovecot_plain authenticator failed for n11923628209.netvigator.com [119.236.28.209]:42190: 535 Incorrect authentication data (set_id=services)119.236.28.2091819730wZ  -{' ossec13001g Exim Auth failed2025-03-06 08:18:45 dovecot_plain authenticator failed for 81.60.194.189.dyn.user.ono.com [81.60.194.189]:39255: 535 Incorrect authentication data (set_id=services@heipowersystem.com)81.60.194.1892510769 P  @ e t)>Pj{  -a' ossec13001gExim Auth failed2025-03-06 09:04:45 dovecot_plain authenticator failed for ([112.196.60.13]) [112.196.60.13]:42972: 535 Incorrect authentication data (set_id=services@heipowersystem.com)112.196.60.131269750gz  -[' ossec13001gExim Auth failed2025-03-06 08:59:43 dovecot_plain authenticator failed for ([41.74.140.107]) [41.74.140.107]:59055: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)41.74.140.1073374766Ty  -7% ossec13001gExim Auth failed2025-03-06 09:00:07 dovecot_plain authenticator failed for ([59.22.68.213]) [59.22.68.213]:60829: 535 Incorrect authentication data (set_id=services)59.22.68.2131835841zx  -# ossec13001gExim Auth failed2025-03-06 08:59:54 dovecot_plain authenticator failed for 18.red-83-48-39.staticip.rima-tde.net [83.48.39.18]:57075: 535 Incorrect authentication data (set_id=services@heipowersystem.com)83.48.39.182510769Tw  -7% ossec13001gmExim Auth failed2025-03-06 08:54:28 dovecot_plain authenticator failed for ([113.192.1.27]) [113.192.1.26]:55966: 535 Incorrect authentication data (set_id=services)113.192.1.261643084Qv  -1% ossec13001ggExim Auth failed2025-03-06 08:54:22 dovecot_plain authenticator failed for ([78.197.6.173]) [78.197.6.173]:58750: 535 Incorrect authentication data (set_id=sales)78.197.6.1733017382{u  -+ ossec13001g_Exim Auth failed2025-03-06 08:54:13 dovecot_plain authenticator failed for (109-120-192-105.ip.btc-net.bg) [109.120.192.105]:35757: 535 Incorrect authentication data (set_id=services@heipowersystem.com)109.120.192.105732800t  -+ ossec13001gKExim Auth failed2025-03-06 08:53:53 dovecot_plain authenticator failed for (nsg-corporate-160.229.187.122.airtel.in) [122.187.229.160]:60316: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)122.187.229.1601269750Ps  -3# ossec13001gExim Auth failed2025-03-06 08:47:35 dovecot_plain authenticator failed for ([95.0.252.76]) [95.0.252.76]:33698: 535 Incorrect authentication data (set_id=services)95.0.252.76298795jr  -a' ossec13001gExim Auth failed2025-03-06 08:47:24 dovecot_plain authenticator failed for ([203.81.213.46]) [203.81.213.46]:50502: 535 Incorrect authentication data (set_id=services@heipowersystem.com)203.81.213.461168579mq  -c+ ossec13001gExim Auth failed2025-03-06 08:47:05 dovecot_plain authenticator failed for ([157.122.183.220]) [157.122.183.220]:57454: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)157.122.183.2201814991Wp  -;' ossec13001gExim Auth failed2025-03-06 08:39:13 dovecot_plain authenticator failed for ([218.22.187.70]) [218.22.187.66]:51955: 535 Incorrect authentication data (set_id=services)218.22.187.661814991\o  -I# ossec13001gExim Auth failed2025-03-06 08:38:58 dovecot_plain authenticator failed for 95-31-6-109.static.corbina.ru [95.31.6.109]:53914: 535 Incorrect authentication data (set_id=sales)95.31.6.1092017370vn  -{% ossec13001gExim Auth failed2025-03-06 08:38:50 dovecot_plain authenticator failed for 1-36-180-128.ptr.netvigator.com [1.36.180.128]:56282: 535 Incorrect authentication data (set_id=services@heipowersystem.com)1.36.180.1281819730jm  -_) ossec13001gExim Auth failed2025-03-06 08:38:26 dovecot_plain authenticator failed for ([118.45.113.206]) [118.45.113.206]:33951: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)118.45.113.2061835841ql  -k+ ossec13001gExim Auth failed2025-03-06 08:30:48 dovecot_plain authenticator failed for 189.115.230.179.dynamic.adsl.gvt.net.br [189.115.230.179]:54713: 535 Incorrect authentication data (set_id=services)189.115.230.1793469034k  - ) ossec13001gExim Auth failed2025-03-06 08:30:22 dovecot_plain authenticator failed for syn-173-095-123-220.biz.spectrum.com [173.95.123.220]:36703: 535 Incorrect authentication data (set_id=services@heipowersystem.com)173.95.123.2206252001 / T m | { '6^}T  -5' ossec13001g@Exim Auth failed2025-03-06 09:15:03 dovecot_plain authenticator failed for ([175.202.82.16]) [175.202.82.16]:52358: 535 Incorrect authentication data (set_id=sales)175.202.82.161835841]  -C+ ossec13001g2Exim Auth failed2025-03-06 09:14:48 dovecot_plain authenticator failed for ([221.195.208.238]) [221.195.208.238]:49634: 535 Incorrect authentication data (set_id=services)221.195.208.2381814991T  -5' ossec13001g*Exim Auth failed2025-03-06 09:14:40 dovecot_plain authenticator failed for ([218.22.187.70]) [218.22.187.66]:47607: 535 Incorrect authentication data (set_id=sales)218.22.187.661814991m  -e) ossec13001g&Exim Auth failed2025-03-06 09:14:37 dovecot_plain authenticator failed for ([220.90.239.158]) [220.90.239.158]:34925: 535 Incorrect authentication data (set_id=services@heipowersystem.com)220.90.239.1581835841]  -C+ ossec13001gExim Auth failed2025-03-06 09:11:59 dovecot_plain authenticator failed for ([109.124.195.218]) [109.124.195.218]:51544: 535 Incorrect authentication data (set_id=services)109.124.195.2182017370g  -[' ossec13001gExim Auth failed2025-03-06 09:11:55 dovecot_plain authenticator failed for ([220.122.115.9]) [220.122.115.9]:60574: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)220.122.115.91835841  - ' ossec13001g~Exim Auth failed2025-03-06 09:11:49 dovecot_plain authenticator failed for 6.112.255.173.bc.googleusercontent.com [173.255.112.6]:48100: 535 Incorrect authentication data (set_id=services@heipowersystem.com)173.255.112.66252001K  -)! ossec13001gExim Auth failed2025-03-06 09:12:09 dovecot_plain authenticator failed for ([45.6.80.40]) [45.6.80.40]:43336: 535 Incorrect authentication data (set_id=sales)45.6.80.403469034f  -W) ossec13001gExim Auth failed2025-03-06 09:09:59 dovecot_login authenticator failed for (undefined.hostname.localhost) [120.138.121.18]:49676: 535 Incorrect authentication data (set_id=services)120.138.121.181269750m  -e) ossec13001gExim Auth failed2025-03-06 09:09:27 dovecot_login authenticator failed for ([221.228.237.90]) [221.228.237.90]:43422: 535 Incorrect authentication data (set_id=services@heipowersystem.com)221.228.237.901814991W  -9) ossec13001gExim Auth failed2025-03-06 09:08:54 dovecot_plain authenticator failed for ([167.142.198.54]) [167.142.198.54]:54659: 535 Incorrect authentication data (set_id=sales)167.142.198.546252001}  -+ ossec13001gExim Auth failed2025-03-06 09:08:51 dovecot_plain authenticator failed for (abts-kk-static-226.253.166.122.airtelbroadband.in) [122.166.253.226]:45029: 535 Incorrect authentication data (set_id=services)122.166.253.2261269750m  -e) ossec13001gExim Auth failed2025-03-06 09:08:40 dovecot_plain authenticator failed for ([50.188.204.213]) [50.188.204.213]:54843: 535 Incorrect authentication data (set_id=services@heipowersystem.com)50.188.204.2136252001c  -W% ossec13001gExim Auth failed2025-03-06 09:08:39 dovecot_plain authenticator failed for ([2.179.186.69]) [2.179.186.69]:46411: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)2.179.186.69130758W~  -;' ossec13001gExim Auth failed2025-03-06 09:05:35 dovecot_plain authenticator failed for ([39.165.183.70]) [39.165.183.70]:46322: 535 Incorrect authentication data (set_id=services)39.165.183.701814991e}  -Y' ossec13001gExim Auth failed2025-03-06 09:05:16 dovecot_plain authenticator failed for 5.185.111.118.ipv4.public.orange.pl [5.185.111.118]:41412: 535 Incorrect authentication data (set_id=sales)5.185.111.118798544d|  -W% ossec13001gExim Auth failed2025-03-06 09:04:52 dovecot_plain authenticator failed for ([14.37.206.76]) [14.37.206.76]:52044: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)14.37.206.761835841 N  F k +NY  -?) ossec13001g!Exim Auth failed2025-03-06 09:46:15 dovecot_plain authenticator failed for ([196.190.180.18]) [196.190.180.19]:22315: 535 Incorrect authentication data (set_id=services)196.190.180.19337996m  -e) ossec13001g!Exim Auth failed2025-03-06 09:46:00 dovecot_plain authenticator failed for ([223.75.218.224]) [223.75.218.224]:32944: 535 Incorrect authentication data (set_id=services@heipowersystem.com)223.75.218.2241814991g  -[' ossec13001g!Exim Auth failed2025-03-06 09:46:01 dovecot_plain authenticator failed for ([217.24.185.98]) [217.24.185.98]:59510: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)217.24.185.982017370s  -o+ ossec13001g 5Exim Auth failed2025-03-06 09:40:28 dovecot_plain authenticator failed for broadband-178-140-191-131.ip.moscow.rt.ru [178.140.191.131]:39857: 535 Incorrect authentication data (set_id=services)178.140.191.1312017370  -# ossec13001g &Exim Auth failed2025-03-06 09:40:12 dovecot_plain authenticator failed for 50.24.14.46.static.wline.lns.sme.cust.swisscom.ch [46.14.24.50]:49199: 535 Incorrect authentication data (set_id=services@heipowersystem.com)46.14.24.502658434p  -q# ossec13001g ;Exim Auth failed2025-03-06 09:40:35 dovecot_plain authenticator failed for 37.151.71.8.dynamic.telecom.kz [37.151.71.8]:34118: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)37.151.71.81522867m  -c+ ossec13001gExim Auth failed2025-03-06 09:33:43 dovecot_plain authenticator failed for ([211.104.166.110]) [211.104.166.110]:37168: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)211.104.166.1101835841W  -;' ossec13001gExim Auth failed2025-03-06 09:33:26 dovecot_plain authenticator failed for ([170.81.14.113]) [170.81.14.113]:46860: 535 Incorrect authentication data (set_id=services)170.81.14.1133469034i  -a' ossec13001gExim Auth failed2025-03-06 09:33:14 dovecot_plain authenticator failed for ([185.167.56.70]) [185.167.56.70]:34380: 535 Incorrect authentication data (set_id=services@heipowersystem.com)185.167.56.70617790V  -;' ossec13001gExim Auth failed2025-03-06 09:25:25 dovecot_plain authenticator failed for ([213.55.79.199]) [213.55.79.195]:53386: 535 Incorrect authentication data (set_id=services)213.55.79.195337996m  -e) ossec13001gExim Auth failed2025-03-06 09:24:50 dovecot_plain authenticator failed for ([14.194.128.158]) [14.194.128.158]:56846: 535 Incorrect authentication data (set_id=services@heipowersystem.com)14.194.128.1581269750g  -[' ossec13001gExim Auth failed2025-03-06 09:24:38 dovecot_plain authenticator failed for ([211.109.75.67]) [211.109.75.69]:50191: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)211.109.75.691835841W  -;' ossec13001gExim Auth failed2025-03-06 09:17:06 dovecot_plain authenticator failed for ([1.220.226.226]) [1.220.226.226]:38043: 535 Incorrect authentication data (set_id=services)1.220.226.2261835841L  --# ossec13001gExim Auth failed2025-03-06 09:16:43 dovecot_plain authenticator failed for ([65.20.169.5]) [65.20.169.5]:38151: 535 Incorrect authentication data (set_id=sales)65.20.169.599237v  -{% ossec13001gExim Auth failed2025-03-06 09:16:29 dovecot_plain authenticator failed for 1-36-180-128.ptr.netvigator.com [1.36.180.128]:56975: 535 Incorrect authentication data (set_id=services@heipowersystem.com)1.36.180.1281819730~  - % ossec13001gExim Auth failed2025-03-06 09:16:22 dovecot_plain authenticator failed for vps-79f20bfc.vps.ovh.net ([87.98.249.193]) [51.75.24.107]:52586: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)51.75.24.1073017382j  -_) ossec13001gExim Auth failed2025-03-06 09:14:25 dovecot_plain authenticator failed for ([178.163.27.129]) [178.163.27.129]:56714: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)178.163.27.1292017370 (/ F n  3?dyg.  -[' ossec13001g%cExim Auth failed2025-03-06 10:02:34 dovecot_plain authenticator failed for ([182.42.113.10]) [182.42.113.10]:41450: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)182.42.113.101814991]-  -C+ ossec13001g%Exim Auth failed2025-03-06 10:03:01 dovecot_plain authenticator failed for ([139.227.248.225]) [139.227.248.225]:47188: 535 Incorrect authentication data (set_id=services)139.227.248.2251814991i,  -_' ossec13001g%Exim Auth failed2025-03-06 10:00:57 dovecot_plain authenticator failed for dhcp-4-bc-9f-52-b7-f.cpe.i-zoom.net [24.244.93.233]:52162: 535 Incorrect authentication data (set_id=services)24.244.93.2336251999g+  -]% ossec13001g$Exim Auth failed2025-03-06 10:00:41 dovecot_plain authenticator failed for ([116.212.19.9]) [116.212.19.9]:50658: 535 Incorrect authentication data (set_id=services@heipowersystem.com)116.212.19.91835841W*  -;' ossec13001g$nExim Auth failed2025-03-06 09:58:30 dovecot_plain authenticator failed for ([118.218.10.21]) [118.218.10.21]:38576: 535 Incorrect authentication data (set_id=services)118.218.10.211835841p)  -i+ ossec13001g$bExim Auth failed2025-03-06 09:58:18 dovecot_plain authenticator failed for ([220.120.227.186]) [220.120.227.186]:47454: 535 Incorrect authentication data (set_id=services@heipowersystem.com)220.120.227.1861835841S(  -5' ossec13001g$RExim Auth failed2025-03-06 09:58:02 dovecot_plain authenticator failed for ([46.30.161.197]) [46.30.161.197]:36800: 535 Incorrect authentication data (set_id=sales)46.30.161.197690791j'  -_) ossec13001g$KExim Auth failed2025-03-06 09:57:53 dovecot_plain authenticator failed for ([221.140.188.44]) [221.140.188.44]:50028: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)221.140.188.441835841Z&  -?) ossec13001g#Exim Auth failed2025-03-06 09:55:19 dovecot_plain authenticator failed for ([118.45.113.206]) [118.45.113.206]:42525: 535 Incorrect authentication data (set_id=services)118.45.113.2061835841|%  -' ossec13001g#Exim Auth failed2025-03-06 09:54:52 dovecot_plain authenticator failed for c-73-97-114-149.hsd1.wa.comcast.net [73.97.114.149]:43419: 535 Incorrect authentication data (set_id=services@heipowersystem.com)73.97.114.1496252001e$  -[' ossec13001g#Exim Auth failed2025-03-06 09:54:48 dovecot_plain authenticator failed for ([65.20.213.101]) [65.20.213.101]:46868: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)65.20.213.10199237P#  -1% ossec13001g#Exim Auth failed2025-03-06 09:55:11 dovecot_plain authenticator failed for ([149.0.19.108]) [149.0.19.108]:58966: 535 Incorrect authentication data (set_id=sales)149.0.19.108298795W"  -;' ossec13001g"Exim Auth failed2025-03-06 09:51:03 dovecot_plain authenticator failed for ([178.25.73.199]) [178.25.73.199]:35389: 535 Incorrect authentication data (set_id=services)178.25.73.1992921044T!  -5' ossec13001g"Exim Auth failed2025-03-06 09:50:51 dovecot_plain authenticator failed for ([50.249.167.45]) [50.249.167.45]:35436: 535 Incorrect authentication data (set_id=sales)50.249.167.456252001e  -]% ossec13001g"Exim Auth failed2025-03-06 09:50:47 dovecot_plain authenticator failed for ([65.20.191.97]) [65.20.191.97]:51538: 535 Incorrect authentication data (set_id=services@heipowersystem.com)65.20.191.9799237u  -y% ossec13001g"Exim Auth failed2025-03-06 09:50:40 dovecot_plain authenticator failed for 128-72-81-95.broadband.corbina.ru [128.72.81.95]:56390: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)128.72.81.952017370T  -5' ossec13001g!Exim Auth failed2025-03-06 09:46:32 dovecot_plain authenticator failed for ([111.48.214.96]) [111.48.214.96]:34654: 535 Incorrect authentication data (set_id=sales)111.48.214.961814991 = I H g | qp>  -i+ ossec13001g*Exim Auth failed2025-03-06 10:26:22 dovecot_plain authenticator failed for ([175.203.245.102]) [175.203.245.102]:46872: 535 Incorrect authentication data (set_id=services@heipowersystem.com)175.203.245.1021835841=  5#' ossec11011g*WHM SSO login failed[2025-03-06 10:26:17 +0530] info [whostmgrd] 223.177.1.255 PURGE root:aEMLGYyjE3SIVLV_ badpass [cookie ip check: IP address has changed: IP Address [122.181.82.145] != Current IP Address [223.177.1.255]]223.177.1.2551269750<  Ue) ossec11001g*VDeferred login on the cpanel service[2025-03-06 10:23:42 +0530] info [webmaild] 157.38.133.136 - kps@amplifypowerglobal.com "POST /cpsess7548508505/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [157.38.134.35] != Current IP Address [157.38.133.136]157.38.133.1361269750d;  -Y# ossec13001g)XExim Auth failed2025-03-06 10:19:27 dovecot_plain authenticator failed for ([70.90.99.29]) [70.90.99.29]:54206: 535 Incorrect authentication data (set_id=services@heipowersystem.com)70.90.99.296252001|:  - # ossec13001g)RExim Auth failed2025-03-06 10:19:20 dovecot_plain authenticator failed for static-98-110-70-2.cmdnnj.fios.verizon.net [98.110.70.2]:48389: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)98.110.70.26252001Q9  -3# ossec13001g)hExim Auth failed2025-03-06 10:19:43 dovecot_plain authenticator failed for ([101.13.5.27]) [101.13.5.27]:35694: 535 Incorrect authentication data (set_id=services)101.13.5.271668284W8  -9) ossec13001g(Exim Auth failed2025-03-06 10:16:46 dovecot_login authenticator failed for ([112.29.109.174]) [112.29.109.174]:43958: 535 Incorrect authentication data (set_id=sales)112.29.109.1741814991g7  -[' ossec13001g(Exim Auth failed2025-03-06 10:16:12 dovecot_login authenticator failed for ([62.192.226.83]) [62.192.226.83]:56260: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)62.192.226.832017370M6  --# ossec13001g'OExim Auth failed2025-03-06 10:10:47 dovecot_plain authenticator failed for ([5.31.16.135]) [5.31.16.135]:47405: 535 Incorrect authentication data (set_id=sales)5.31.16.1352905575  -' ossec13001g'IExim Auth failed2025-03-06 10:10:40 dovecot_login authenticator failed for s01060030f43b0098.vn.shawcable.net [70.79.120.248]:50883: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)70.79.120.2486251999g4  -[' ossec13001g'EExim Auth failed2025-03-06 10:10:36 dovecot_plain authenticator failed for ([49.124.151.28]) [49.124.151.28]:44872: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)49.124.151.281733045]3  -C+ ossec13001g'eExim Auth failed2025-03-06 10:11:09 dovecot_plain authenticator failed for ([114.215.211.223]) [114.215.211.223]:48424: 535 Incorrect authentication data (set_id=services)114.215.211.2231814991}2  -+ ossec13001g'_Exim Auth failed2025-03-06 10:11:03 dovecot_login authenticator failed for (mobile-166-195-195-145.mycingular.net) [166.195.195.145]:42345: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)166.195.195.1456252001p1  -i+ ossec13001g'UExim Auth failed2025-03-06 10:10:52 dovecot_plain authenticator failed for ([222.236.155.146]) [222.236.155.146]:47191: 535 Incorrect authentication data (set_id=services@heipowersystem.com)222.236.155.1461835841W0  -9) ossec13001g%uExim Auth failed2025-03-06 10:02:52 dovecot_plain authenticator failed for ([117.53.254.144]) [117.53.254.144]:60610: 535 Incorrect authentication data (set_id=sales)117.53.254.1441835841d/  -Y# ossec13001g%oExim Auth failed2025-03-06 10:02:45 dovecot_plain authenticator failed for ([38.79.83.28]) [38.79.83.28]:34320: 535 Incorrect authentication data (set_id=services@heipowersystem.com)38.79.83.286252001 *\~tj`VLB8.$zpf\H>4*   v l b X N D : 0 &    ~ t j ` V L B 8 . $    z p f \ R H > 4 *  vlbXND:0&|rh^TJ@6,"xndZFP<2( ~tj`VLB8.$zpf\ | r h ^ T J @ 6 , "    x n d Z P F < 2 (   RRH>4*  vlbXND:0& gPV< gO; gO: gO9 gO8 gO7 gO 6 gO5 gN4 gN,3 gN*2 gN1 gN0 gL/ gL. gL- gM, gL+ gK* gK) gK( gK' gJ & gI% gI$ gI# gI" gH ! gH gG gG gF  gF  gE gE gE gE gE gE gE gE gD gD gDA gD; gD/ gC[ gCK gC9 gB* gB: gB  gB  g@ g@ g@ g@ g@ g?< g?0 g?. g?& g? g=/ g=- g=# g= g;\ g;C g;1 g;  g;E g: g: g:. g:" g: g9d g9Z g9Z g9P g8 g8x g8x g8r g7U g7U g7G g7A g6g g6[ g5 g5 g5 g5 g4[ g4K g4A g49 g2 g2D g28 g0V g0I g05 g/ g/ g/ g/O g/9 g/% g/# g. g.w g.m g.e g- g-w g,c g,S g,Q g,D g* g+ g+ g* g* g* g*V g)h g)X g)R g( g( g'e g'_ g'U g'O g'I g'E g% g%u g%o g%c g% g$ g$n g$b g$R g$K g# g# g# g# g" g" g" g" g! g! g! g! g ; g 5 g & g g g g g g]g g]f g]e g[d g[c g[nb g[Pa gZ` gZ_ gZ^ gY] gY\ gY[ gYY gY Z gWV gWU gWX gWW gVS gVT gVR gVzQ gVxP gVBO gV8N gUK gTM gTL gTJ gS/I gRG gRF gRH gRE gQD gQC gPB gPA gP@ gP? gPz> gPh= g g g g g g@ g2 g* g& g g g g g~ g g g g g g g~ g} g| g{ gy gx gz gmw ggv g_u gKt gs gr gq gp go gn gm gj gl gk gYi g]h gIh gg gf ge gd gc gb ga g` g _ g ^ g ] g \ g #[ g Z g Y g X g V g W g U g T g mS g [R g Q gP gO gN gM gL gK gJ gI gF gE gH gG gD gC gB gA g@ g>> # H ##5XjN  -_) ossec13001g/%Exim Auth failed2025-03-06 10:44:12 dovecot_plain authenticator failed for ([92.126.223.175]) [92.126.223.175]:51470: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)92.126.223.1752017370kM  -e) ossec13001g/#Exim Auth failed2025-03-06 10:44:11 dovecot_plain authenticator failed for ([213.32.253.235]) [213.32.253.235]:41046: 535 Incorrect authentication data (set_id=services@heipowersystem.com)213.32.253.23599237TL  -5' ossec13001g.Exim Auth failed2025-03-06 10:41:37 dovecot_plain authenticator failed for ([41.67.143.142]) [41.67.143.142]:55488: 535 Incorrect authentication data (set_id=sales)41.67.143.1422328926YK  -?) ossec13001g.wExim Auth failed2025-03-06 10:41:19 dovecot_plain authenticator failed for ([196.190.180.18]) [196.190.180.19]:34445: 535 Incorrect authentication data (set_id=services)196.190.180.19337996jJ  -a' ossec13001g.mExim Auth failed2025-03-06 10:41:07 dovecot_plain authenticator failed for ([175.202.82.16]) [175.202.82.16]:45108: 535 Incorrect authentication data (set_id=services@heipowersystem.com)175.202.82.161835841|I  - # ossec13001g.eExim Auth failed2025-03-06 10:41:00 dovecot_plain authenticator failed for static-98-110-70-2.cmdnnj.fios.verizon.net [98.110.70.2]:57130: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)98.110.70.26252001jH  -a' ossec13001g-Exim Auth failed2025-03-06 10:37:16 dovecot_plain authenticator failed for ([209.173.10.75]) [209.173.10.75]:38058: 535 Incorrect authentication data (set_id=services@heipowersystem.com)209.173.10.756252001jG  -_) ossec13001g-wExim Auth failed2025-03-06 10:37:03 dovecot_plain authenticator failed for ([195.222.57.183]) [195.222.57.183]:52632: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)195.222.57.1833277605fF  -]# ossec13001g,cExim Auth failed2025-03-06 10:32:26 dovecot_plain authenticator failed for syn-070-120-006-086.res.spectrum.com [70.120.6.86]:65157: 535 Incorrect authentication data (set_id=services)70.120.6.866252001zE  -' ossec13001g,SExim Auth failed2025-03-06 10:32:09 dovecot_plain authenticator failed for b217-29-190-97.pppoe.mark-itt.net [217.29.190.97]:52734: 535 Incorrect authentication data (set_id=services@heipowersystem.com)217.29.190.972017370]D  -K# ossec13001g,QExim Auth failed2025-03-06 10:32:07 dovecot_plain authenticator failed for 37.151.71.8.dynamic.telecom.kz [37.151.71.8]:33391: 535 Incorrect authentication data (set_id=sales)37.151.71.81522867C  - ) ossec13001g,DExim Auth failed2025-03-06 10:31:55 dovecot_plain authenticator failed for broadband-188-255-34-171.ip.moscow.rt.ru [188.255.34.171]:55558: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)188.255.34.1712017370xB US' ossec11001g*Deferred login on the cpanel service[2025-03-06 10:26:13 +0530] info [cpaneld] 223.177.1.255 - techno "GET /cpsess1087293310/frontend/jupiter/index.html?login=1&post_login=83000075932650 HTTP/1.1" DEFERRED LOGIN cpaneld: cookie ip check: IP address has changed: IP Address [122.181.82.145] != Current IP Address [223.177.1.255]223.177.1.2551269750WA  -9) ossec13001g+Exim Auth failed2025-03-06 10:26:48 dovecot_plain authenticator failed for ([183.220.247.85]) [183.220.247.85]:33370: 535 Incorrect authentication data (set_id=sales)183.220.247.851814991]@  -C+ ossec13001g+Exim Auth failed2025-03-06 10:26:35 dovecot_plain authenticator failed for ([210.113.122.243]) [210.113.122.243]:41112: 535 Incorrect authentication data (set_id=services)210.113.122.2431835841x?  -' ossec13001g*Exim Auth failed2025-03-06 10:26:24 dovecot_plain authenticator failed for 5.185.111.118.ipv4.public.orange.pl [5.185.111.118]:52512: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)5.185.111.118798544 .U j ` Ugvyd_  -Y# ossec13001g5Exim Auth failed2025-03-06 11:12:59 dovecot_plain authenticator failed for ([112.94.6.54]) [112.94.6.54]:52402: 535 Incorrect authentication data (set_id=services@heipowersystem.com)112.94.6.541814991j^  -_) ossec13001g5Exim Auth failed2025-03-06 11:12:51 dovecot_plain authenticator failed for ([73.231.102.189]) [73.231.102.189]:53730: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)73.231.102.1896252001W]  -9) ossec13001g4[Exim Auth failed2025-03-06 11:06:25 dovecot_plain authenticator failed for ([49.205.177.146]) [223.239.159.21]:41888: 535 Incorrect authentication data (set_id=sales)223.239.159.211269750y\  -' ossec13001g4KExim Auth failed2025-03-06 11:06:10 dovecot_plain authenticator failed for 182.3.174.178.static.wline.lns.sme.cust.swisscom.ch [178.174.3.182]:33026: 535 Incorrect authentication data (set_id=services)178.174.3.1822658434m[  -e) ossec13001g4AExim Auth failed2025-03-06 11:05:59 dovecot_plain authenticator failed for ([112.168.71.109]) [112.168.71.109]:35734: 535 Incorrect authentication data (set_id=services@heipowersystem.com)112.168.71.1091835841jZ  -_) ossec13001g49Exim Auth failed2025-03-06 11:05:52 dovecot_plain authenticator failed for ([111.48.140.240]) [111.48.140.240]:21930: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)111.48.140.2401814991%Y  3Q' ossec11301g2New FTP connection.Mar 6 10:59:01 vm1 pure-ftpd[2595538]: (?@4.246.231.230) [INFO] New connection from 4.246.231.2304.246.231.2306252001mX  -e) ossec13001g2DExim Auth failed2025-03-06 10:57:31 dovecot_plain authenticator failed for ([218.150.170.10]) [218.150.170.10]:48812: 535 Incorrect authentication data (set_id=services@heipowersystem.com)218.150.170.101835841iW  -_) ossec13001g28Exim Auth failed2025-03-06 10:57:20 dovecot_plain authenticator failed for ([94.201.236.143]) [94.201.236.143]:43211: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)94.201.236.143290557WV  -;' ossec13001g0VExim Auth failed2025-03-06 10:49:17 dovecot_plain authenticator failed for ([170.81.14.113]) [170.81.14.113]:45091: 535 Incorrect authentication data (set_id=services)170.81.14.1133469034]U  -C+ ossec13001g0IExim Auth failed2025-03-06 10:49:05 dovecot_plain authenticator failed for ([103.158.138.179]) [103.158.138.179]:55656: 535 Incorrect authentication data (set_id=services)103.158.138.1791269750mT  -e) ossec13001g05Exim Auth failed2025-03-06 10:48:45 dovecot_plain authenticator failed for ([60.173.105.206]) [60.173.105.206]:57969: 535 Incorrect authentication data (set_id=services@heipowersystem.com)60.173.105.2061814991SS  -5' ossec13001g/Exim Auth failed2025-03-06 10:46:54 dovecot_plain authenticator failed for ([151.252.197.3]) [151.252.197.3]:55253: 535 Incorrect authentication data (set_id=sales)151.252.197.3732800R  -+ ossec13001g/Exim Auth failed2025-03-06 10:46:48 dovecot_plain authenticator failed for (nsg-corporate-247.228.187.122.airtel.in) [122.187.228.247]:40844: 535 Incorrect authentication data (set_id=services@heipowersystem.com)122.187.228.2471269750gQ  -[' ossec13001g/Exim Auth failed2025-03-06 10:46:40 dovecot_plain authenticator failed for ([14.48.227.118]) [14.48.227.118]:46453: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)14.48.227.1181835841UP  -7' ossec13001g/OExim Auth failed2025-03-06 10:44:54 dovecot_plain authenticator failed for ([218.106.120.18]) [58.49.113.138]:19086: 535 Incorrect authentication data (set_id=sales)58.49.113.1381814991NO  -/! ossec13001g/9Exim Auth failed2025-03-06 10:44:32 dovecot_plain authenticator failed for ([59.8.11.36]) [59.8.11.36]:38426: 535 Incorrect authentication data (set_id=services)59.8.11.361835841 (K U ] o  .Fnjgp  -[' ossec13001g:Exim Auth failed2025-03-06 11:30:55 dovecot_plain authenticator failed for ([42.233.34.152]) [42.233.34.152]:48348: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)42.233.34.1521814991Vo  -;' ossec13001g9dExim Auth failed2025-03-06 11:27:56 dovecot_plain authenticator failed for ([94.158.46.233]) [94.158.46.233]:54942: 535 Incorrect authentication data (set_id=services)94.158.46.233690791n  - ' ossec13001g9ZExim Auth failed2025-03-06 11:27:45 dovecot_plain authenticator failed for broadband-188-32-170-20.ip.moscow.rt.ru [188.32.170.20]:55962: 535 Incorrect authentication data (set_id=services@heipowersystem.com)188.32.170.202017370Tm  -5' ossec13001g9ZExim Auth failed2025-03-06 11:27:46 dovecot_plain authenticator failed for ([211.109.75.66]) [211.109.75.69]:50810: 535 Incorrect authentication data (set_id=sales)211.109.75.691835841dl  -W% ossec13001g9PExim Auth failed2025-03-06 11:27:34 dovecot_plain authenticator failed for ([112.91.67.18]) [112.91.67.18]:56588: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)112.91.67.181814991Yk  -?' ossec13001g8Exim Auth failed2025-03-06 11:24:13 dovecot_plain authenticator failed for mail.toptronicsinc.com [218.4.156.254]:57306: 535 Incorrect authentication data (set_id=sales)218.4.156.2541814991jj  -_) ossec13001g8xExim Auth failed2025-03-06 11:24:00 dovecot_plain authenticator failed for ([111.48.140.240]) [111.48.140.240]:29240: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)111.48.140.2401814991Zi  -?) ossec13001g8xExim Auth failed2025-03-06 11:24:00 dovecot_plain authenticator failed for ([94.181.187.192]) [94.181.187.192]:56138: 535 Incorrect authentication data (set_id=services)94.181.187.1922017370vh  -w) ossec13001g8rExim Auth failed2025-03-06 11:23:52 dovecot_plain authenticator failed for 245.134.20.178.in-addr.arpa [178.20.134.245]:58149: 535 Incorrect authentication data (set_id=services@heipowersystem.com)178.20.134.2452017370Qg  -1% ossec13001g7UExim Auth failed2025-03-06 11:19:08 dovecot_plain authenticator failed for ([111.23.42.49]) [111.23.42.49]:55762: 535 Incorrect authentication data (set_id=sales)111.23.42.491814991Zf  -?) ossec13001g7UExim Auth failed2025-03-06 11:19:09 dovecot_plain authenticator failed for ([183.230.165.58]) [183.230.165.58]:35106: 535 Incorrect authentication data (set_id=services)183.230.165.581814991ge  -[' ossec13001g7GExim Auth failed2025-03-06 11:18:55 dovecot_plain authenticator failed for ([72.26.178.196]) [72.26.178.196]:58536: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)72.26.178.1966252001jd  -a' ossec13001g7AExim Auth failed2025-03-06 11:18:49 dovecot_plain authenticator failed for ([103.69.244.39]) [103.69.244.39]:37982: 535 Incorrect authentication data (set_id=services@heipowersystem.com)103.69.244.391269750tc  -s) ossec13001g6gExim Auth failed2025-03-06 11:15:10 dovecot_plain authenticator failed for syn-172-118-123-044.res.spectrum.com [172.118.123.44]:49832: 535 Incorrect authentication data (set_id=vikas.khandelwal)172.118.123.446252001rb  -q' ossec13001g6[Exim Auth failed2025-03-06 11:14:59 dovecot_plain authenticator failed for ([121.154.90.47]) [121.154.90.47]:56392: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)121.154.90.471835841Ya  -?) ossec13001g5Exim Auth failed2025-03-06 11:13:26 dovecot_plain authenticator failed for ([94.204.230.214]) [94.204.230.214]:34002: 535 Incorrect authentication data (set_id=services)94.204.230.214290557T`  -5' ossec13001g5Exim Auth failed2025-03-06 11:13:04 dovecot_plain authenticator failed for ([211.58.49.145]) [211.58.49.145]:40538: 535 Incorrect authentication data (set_id=sales)211.58.49.1451835841 "7 L q 5]lpj  -_) ossec13001g?0Exim Auth failed2025-03-06 11:52:38 dovecot_plain authenticator failed for ([223.220.167.38]) [223.220.167.38]:58529: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)223.220.167.381814991L  --# ossec13001g?.Exim Auth failed2025-03-06 11:52:36 dovecot_plain authenticator failed for ([65.20.169.5]) [65.20.169.5]:37817: 535 Incorrect authentication data (set_id=sales)65.20.169.599237x  -# ossec13001g?&Exim Auth failed2025-03-06 11:52:28 dovecot_plain authenticator failed for net-2-37-223-58.cust.vodafonedsl.it [2.37.223.58]:43278: 535 Incorrect authentication data (set_id=services@heipowersystem.com)2.37.223.583175395m~  -c+ ossec13001g?Exim Auth failed2025-03-06 11:52:15 dovecot_plain authenticator failed for ([203.123.219.137]) [203.123.219.137]:40533: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)203.123.219.1371835841T}  -7% ossec13001g=/Exim Auth failed2025-03-06 11:44:07 dovecot_plain authenticator failed for ([39.129.25.70]) [39.129.25.70]:43942: 535 Incorrect authentication data (set_id=services)39.129.25.701814991U|  -9) ossec13001g=-Exim Auth failed2025-03-06 11:44:05 dovecot_plain authenticator failed for ([185.255.47.190]) [185.255.47.190]:44990: 535 Incorrect authentication data (set_id=sales)185.255.47.19099237g{  -]% ossec13001g=#Exim Auth failed2025-03-06 11:43:54 dovecot_plain authenticator failed for ([110.34.70.28]) [110.34.70.28]:42184: 535 Incorrect authentication data (set_id=services@heipowersystem.com)110.34.70.281835841gz  -[' ossec13001g=Exim Auth failed2025-03-06 11:43:49 dovecot_plain authenticator failed for ([111.75.223.17]) [111.75.223.17]:53417: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)111.75.223.171814991fy  -Y' ossec13001g;\Exim Auth failed2025-03-06 11:36:19 dovecot_plain authenticator failed for 185.39.167.72.host.secureserver.net [72.167.39.185]:59538: 535 Incorrect authentication data (set_id=sales)72.167.39.1856252001Vx  -9) ossec13001g;CExim Auth failed2025-03-06 11:35:53 dovecot_plain authenticator failed for ([213.59.165.109]) [213.59.165.109]:49729: 535 Incorrect authentication data (set_id=sales)213.59.165.109690791mw  -e) ossec13001g;1Exim Auth failed2025-03-06 11:35:35 dovecot_plain authenticator failed for ([218.234.104.42]) [218.234.104.42]:47421: 535 Incorrect authentication data (set_id=services@heipowersystem.com)218.234.104.421835841jv  -_) ossec13001g; Exim Auth failed2025-03-06 11:35:19 dovecot_plain authenticator failed for ([178.178.222.58]) [178.178.222.58]:36950: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)178.178.222.582017370fu  -W) ossec13001g;EExim Auth failed2025-03-06 11:35:55 dovecot_plain authenticator failed for a109-51-222-234.cpe.netcabo.pt [109.51.222.234]:44028: 535 Incorrect authentication data (set_id=services)109.51.222.2342264397Wt  -9) ossec13001g:Exim Auth failed2025-03-06 11:33:35 dovecot_plain authenticator failed for ([222.239.231.61]) [222.239.231.61]:54887: 535 Incorrect authentication data (set_id=sales)222.239.231.611835841gs  -[' ossec13001g:Exim Auth failed2025-03-06 11:33:22 dovecot_plain authenticator failed for ([200.175.88.85]) [200.175.88.85]:32851: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)200.175.88.853469034gr  -]% ossec13001g:.Exim Auth failed2025-03-06 11:31:18 dovecot_plain authenticator failed for ([138.36.24.33]) [138.36.24.33]:56228: 535 Incorrect authentication data (set_id=services@heipowersystem.com)138.36.24.333508796Zq  -=+ ossec13001g:"Exim Auth failed2025-03-06 11:31:06 dovecot_plain authenticator failed for ([179.183.114.175]) [179.183.114.175]:51161: 535 Incorrect authentication data (set_id=sales)179.183.114.1753469034 %; , A l { -?jpj  -_) ossec13001gDExim Auth failed2025-03-06 12:17:07 dovecot_plain authenticator failed for ([154.203.67.113]) [154.203.67.113]:56257: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)154.203.67.1133374766v  -y' ossec13001gDAExim Auth failed2025-03-06 12:14:16 dovecot_plain authenticator failed for 111-70-20-166.emome-ip.hinet.net [111.70.20.166]:54403: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)111.70.20.1661668284Q  -3# ossec13001gD;Exim Auth failed2025-03-06 12:14:10 dovecot_plain authenticator failed for ([70.90.99.29]) [70.90.99.29]:52871: 535 Incorrect authentication data (set_id=services)70.90.99.296252001j  -a' ossec13001gD/Exim Auth failed2025-03-06 12:13:58 dovecot_plain authenticator failed for ([58.57.154.146]) [58.57.154.146]:52948: 535 Incorrect authentication data (set_id=services@heipowersystem.com)58.57.154.1461814991j  -a' ossec13001gC[Exim Auth failed2025-03-06 12:10:26 dovecot_plain authenticator failed for ([187.218.57.50]) [149.19.169.81]:29262: 535 Incorrect authentication data (set_id=services@heipowersystem.com)149.19.169.813996063W  -9) ossec13001gCKExim Auth failed2025-03-06 12:10:09 dovecot_plain authenticator failed for ([220.119.126.81]) [220.119.126.81]:59757: 535 Incorrect authentication data (set_id=sales)220.119.126.811835841g  -[' ossec13001gC9Exim Auth failed2025-03-06 12:09:52 dovecot_plain authenticator failed for ([124.246.92.77]) [124.246.92.77]:39955: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)124.246.92.771880251T  -5' ossec13001gB*Exim Auth failed2025-03-06 12:05:21 dovecot_plain authenticator failed for ([88.204.52.137]) [88.204.52.137]:56518: 535 Incorrect authentication data (set_id=sales)88.204.52.1372017370e  -Y% ossec13001gB:Exim Auth failed2025-03-06 12:05:38 dovecot_plain authenticator failed for 95-31-29-128.broadband.corbina.ru [95.31.29.128]:33368: 535 Incorrect authentication data (set_id=services)95.31.29.1282017370j  -_) ossec13001gB Exim Auth failed2025-03-06 12:05:11 dovecot_plain authenticator failed for ([222.67.133.193]) [222.67.133.193]:41177: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)222.67.133.1931814991g  -]% ossec13001gB Exim Auth failed2025-03-06 12:05:12 dovecot_plain authenticator failed for ([14.37.206.76]) [14.37.206.76]:38633: 535 Incorrect authentication data (set_id=services@heipowersystem.com)14.37.206.761835841m  -e) ossec13001g@Exim Auth failed2025-03-06 11:59:47 dovecot_plain authenticator failed for ([121.124.52.237]) [121.124.52.237]:52133: 535 Incorrect authentication data (set_id=services@heipowersystem.com)121.124.52.2371835841Q  -1% ossec13001g@Exim Auth failed2025-03-06 11:59:29 dovecot_plain authenticator failed for ([39.164.91.67]) [39.164.91.67]:33834: 535 Incorrect authentication data (set_id=sales)39.164.91.671814991g  -[' ossec13001g@Exim Auth failed2025-03-06 11:59:16 dovecot_plain authenticator failed for ([122.225.55.98]) [122.225.55.98]:41030: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)122.225.55.981814991   -+ ossec13001g@Exim Auth failed2025-03-06 11:58:55 dovecot_plain authenticator failed for c188-148-148-191.bredband.tele2.se [188.148.148.191]:44500: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)188.148.148.1912661886f  -W) ossec13001g@Exim Auth failed2025-03-06 11:59:07 dovecot_plain authenticator failed for ([111.48.214.102]) [111.48.214.102]:15450: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)111.48.214.1021814991W  -9) ossec13001g?<Exim Auth failed2025-03-06 11:52:50 dovecot_plain authenticator failed for ([222.68.155.105]) [222.68.155.105]:35438: 535 Incorrect authentication data (set_id=sales)222.68.155.1051814991    ) N m WLd%"  3Q' ossec11301gINew FTP connection.Mar 6 12:37:16 vm1 pure-ftpd[2617116]: (?@20.221.67.103) [INFO] New connection from 20.221.67.10320.221.67.1036252001e!  -W' ossec13001gH Exim Auth failed2025-03-06 12:30:25 dovecot_plain authenticator failed for 81-234-121-57-no600.tbcn.telia.com [81.234.121.57]:52908: 535 Incorrect authentication data (set_id=sales)81.234.121.572661886  -') ossec13001gHExim Auth failed2025-03-06 12:30:21 dovecot_plain authenticator failed for node-184t.pool-125-27.dynamic.nt-isp.net (node-184t.pool-125-27.dynamic.totinternet.net) [125.27.223.109]:47358: 535 Incorrect authentication data125.27.223.1091605651p  -i+ ossec13001gGExim Auth failed2025-03-06 12:30:10 dovecot_plain authenticator failed for ([219.146.138.226]) [219.146.138.226]:45950: 535 Incorrect authentication data (set_id=services@heipowersystem.com)219.146.138.2261814991|  -) ossec13001gGExim Auth failed2025-03-06 12:29:53 dovecot_plain authenticator failed for 109.46.246.220.static.netvigator.com [220.246.46.109]:58480: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)220.246.46.1091819730Q  -1% ossec13001gF Exim Auth failed2025-03-06 12:21:53 dovecot_plain authenticator failed for ([27.124.18.21]) [27.124.18.27]:51076: 535 Incorrect authentication data (set_id=sales)27.124.18.271269750Y  -?) ossec13001gF Exim Auth failed2025-03-06 12:21:53 dovecot_plain authenticator failed for ([85.105.241.188]) [85.105.241.188]:38330: 535 Incorrect authentication data (set_id=services)85.105.241.188298795d  -W% ossec13001gEExim Auth failed2025-03-06 12:21:40 dovecot_plain authenticator failed for ([8.139.253.26]) [8.139.253.26]:43882: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)8.139.253.261814991  -) ossec13001gEExim Auth failed2025-03-06 12:21:32 dovecot_plain authenticator failed for ip-062-143-219-127.um16.pools.vodafone-ip.de [62.143.219.127]:61401: 535 Incorrect authentication data (set_id=services@heipowersystem.com)62.143.219.1272921044  --+ ossec13001gEExim Auth failed2025-03-06 12:19:34 dovecot_plain authenticator failed for static-200-105-141-170.acelerate.net ([200.105.141.161]) [200.105.141.170]:57998: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)200.105.141.1703923057]  -C+ ossec13001gEExim Auth failed2025-03-06 12:19:50 dovecot_plain authenticator failed for ([190.211.250.118]) [190.211.250.122]:55153: 535 Incorrect authentication data (set_id=services)190.211.250.1223895114W  -9) ossec13001gEExim Auth failed2025-03-06 12:19:46 dovecot_plain authenticator failed for ([111.48.214.102]) [111.48.214.102]:19468: 535 Incorrect authentication data (set_id=sales)111.48.214.1021814991m  -e) ossec13001gEExim Auth failed2025-03-06 12:19:37 dovecot_plain authenticator failed for ([178.177.200.26]) [178.177.200.26]:39112: 535 Incorrect authentication data (set_id=services@heipowersystem.com)178.177.200.262017370d  -U' ossec13001gEExim Auth failed2025-03-06 12:17:44 dovecot_plain authenticator failed for ool-45734cba.dyn.optonline.net [69.115.76.186]:40214: 535 Incorrect authentication data (set_id=services)69.115.76.1866252001  -+ ossec13001gEExim Auth failed2025-03-06 12:17:29 dovecot_plain authenticator failed for (nsg-corporate-247.228.187.122.airtel.in) [122.187.228.247]:56584: 535 Incorrect authentication data (set_id=services@heipowersystem.com)122.187.228.2471269750p  -i+ ossec13001gDExim Auth failed2025-03-06 12:17:22 dovecot_plain authenticator failed for (nsg-corporate-210.240.187.122.airtel.in) [122.187.240.210]:56040: 535 Incorrect authentication data (set_id=sales)122.187.240.2101269750 G! C e q s U,2Gg2  -[' ossec13001gN*Exim Auth failed2025-03-06 12:56:33 dovecot_plain authenticator failed for ([220.86.135.65]) [220.86.135.80]:37638: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)220.86.135.801835841v1  -{% ossec13001gNExim Auth failed2025-03-06 12:55:58 dovecot_plain authenticator failed for 78-67-176-43-no2814.tbcn.telia.com [78.67.176.43]:34630: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)78.67.176.432661886k0  -c' ossec13001gNExim Auth failed2025-03-06 12:56:08 dovecot_plain authenticator failed for ([177.174.89.105]) [177.174.89.99]:59880: 535 Incorrect authentication data (set_id=services@heipowersystem.com)177.174.89.993469034T/  -7% ossec13001gLExim Auth failed2025-03-06 12:51:30 dovecot_plain authenticator failed for ([186.73.22.20]) [186.73.22.20]:58024: 535 Incorrect authentication data (set_id=services)186.73.22.203703430 .  -) ossec13001gLExim Auth failed2025-03-06 12:51:16 dovecot_plain authenticator failed for 76-216-120-234.lightspeed.tukrga.sbcglobal.net [76.216.120.234]:45764: 535 Incorrect authentication data (set_id=services@heipowersystem.com)76.216.120.2346252001g-  -[' ossec13001gLExim Auth failed2025-03-06 12:51:15 dovecot_plain authenticator failed for ([50.238.55.194]) [50.238.55.194]:49263: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)50.238.55.1946252001c,  -Q) ossec13001gMExim Auth failed2025-03-06 12:51:57 dovecot_plain authenticator failed for 110-25-104-193.adsl.fetnet.net [110.25.104.193]:42541: 535 Incorrect authentication data (set_id=sales)110.25.104.1931668284+  Uc' ossec11001gLDeferred login on the cpanel service[2025-03-06 12:51:04 +0530] info [webmaild] 157.38.132.63 - kps@amplifypowerglobal.com "POST /cpsess5873711954/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [157.38.133.136] != Current IP Address [157.38.132.63]157.38.132.631269750H*  = ' ossec13008gKMail Reciepient rejected2025-03-06 12:46:38 H=(mail.uttamclassesjaipur.com) [165.154.227.2]:65066 F= rejected RCPT : Rejected relay attempt: '165.154.227.2' From: 'ccibkcnpy@uttamclassesjaipur.com' To: 'goofile@fastmail.com'165.154.227.21668284N)  --# ossec13001gKExim Auth failed2025-03-06 12:45:31 dovecot_plain authenticator failed for ([101.13.5.27]) [101.13.5.27]:37488: 535 Incorrect authentication data (set_id=sales)101.13.5.271668284z(  -) ossec13001gKExim Auth failed2025-03-06 12:45:23 dovecot_plain authenticator failed for bb115-66-228-194.singnet.com.sg [115.66.228.194]:54954: 535 Incorrect authentication data (set_id=services@heipowersystem.com)115.66.228.1941880251p'  -q# ossec13001gKExim Auth failed2025-03-06 12:45:18 dovecot_plain authenticator failed for 111-70-9-41.emome-ip.hinet.net [111.70.9.41]:49952: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)111.70.9.411668284Z&  -?) ossec13001gJ Exim Auth failed2025-03-06 12:38:58 dovecot_plain authenticator failed for ([220.178.39.106]) [220.178.39.106]:39390: 535 Incorrect authentication data (set_id=services)220.178.39.1061814991Z%  -=+ ossec13001gIExim Auth failed2025-03-06 12:38:40 dovecot_plain authenticator failed for ([218.149.235.152]) [218.149.235.152]:53296: 535 Incorrect authentication data (set_id=sales)218.149.235.1521835841j$  -a' ossec13001gIExim Auth failed2025-03-06 12:38:30 dovecot_plain authenticator failed for ([112.196.60.13]) [112.196.60.13]:52960: 535 Incorrect authentication data (set_id=services@heipowersystem.com)112.196.60.131269750m#  -c+ ossec13001gIExim Auth failed2025-03-06 12:38:17 dovecot_plain authenticator failed for ([220.248.188.139]) [220.248.188.139]:56207: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)220.248.188.1391814991 "7 : 2 W   /TxiC  -a' ossec13001gQExim Auth failed2025-03-06 13:12:15 dovecot_plain authenticator failed for ([185.167.56.70]) [185.167.56.70]:37774: 535 Incorrect authentication data (set_id=services@heipowersystem.com)185.167.56.70617790XB  -;) ossec13001gPExim Auth failed2025-03-06 13:08:35 dovecot_plain authenticator failed for ([125.16.12.73]) [128.185.253.90]:36038: 535 Incorrect authentication data (set_id=services)128.185.253.901269750WA  -9) ossec13001gPExim Auth failed2025-03-06 13:08:04 dovecot_plain authenticator failed for ([124.112.45.222]) [124.112.45.222]:55289: 535 Incorrect authentication data (set_id=sales)124.112.45.2221814991m@  -e) ossec13001gPExim Auth failed2025-03-06 13:08:01 dovecot_plain authenticator failed for ([202.149.219.78]) [202.149.219.78]:38986: 535 Incorrect authentication data (set_id=services@heipowersystem.com)202.149.219.781269750i?  -[+ ossec13001gPExim Auth failed2025-03-06 13:07:47 dovecot_plain authenticator failed for (tagsdev.click) [199.188.103.179]:44746: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)199.188.103.1796252001V>  -;' ossec13001gPzExim Auth failed2025-03-06 13:06:26 dovecot_plain authenticator failed for ([46.30.161.197]) [46.30.161.197]:57147: 535 Incorrect authentication data (set_id=services)46.30.161.197690791u=  -w' ossec13001gPhExim Auth failed2025-03-06 13:06:08 dovecot_plain authenticator failed for (net245.234.188-7.ertelecom.ru) [188.234.245.7]:50948: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)188.234.245.72017370a<  -U! ossec13001gPVExim Auth failed2025-03-06 13:05:50 dovecot_plain authenticator failed for ([1.25.18.18]) [1.25.18.18]:47938: 535 Incorrect authentication data (set_id=services@heipowersystem.com)1.25.18.181814991W;  -9) ossec13001gOExim Auth failed2025-03-06 13:03:46 dovecot_plain authenticator failed for ([113.57.119.194]) [113.57.119.194]:16080: 535 Incorrect authentication data (set_id=sales)113.57.119.1941814991l:  -e) ossec13001gOExim Auth failed2025-03-06 13:03:41 dovecot_plain authenticator failed for ([185.181.41.120]) [185.181.41.120]:57883: 535 Incorrect authentication data (set_id=services@heipowersystem.com)185.181.41.120617790m9  -c+ ossec13001gOExim Auth failed2025-03-06 13:03:16 dovecot_plain authenticator failed for ([118.220.149.129]) [118.220.149.129]:50600: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)118.220.149.1291835841R8  -7% ossec13001gOExim Auth failed2025-03-06 13:03:52 dovecot_plain authenticator failed for ([65.20.133.56]) [65.20.133.56]:41289: 535 Incorrect authentication data (set_id=services)65.20.133.5699237W7  -9) ossec13001gOExim Auth failed2025-03-06 13:00:24 dovecot_plain authenticator failed for ([202.149.219.78]) [202.149.219.78]:34760: 535 Incorrect authentication data (set_id=sales)202.149.219.7812697506  -' ossec13001gO Exim Auth failed2025-03-06 13:00:17 dovecot_plain authenticator failed for host-88-43-231-186.business.telecomitalia.it ([88.43.231.188]) [88.43.231.186]:46036: 535 Incorrect authentication data (set_id=services)88.43.231.1863175395y5  -}) ossec13001gOExim Auth failed2025-03-06 13:00:09 dovecot_plain authenticator failed for (m121-202-152-40.smartone.com) [121.202.152.40]:52779: 535 Incorrect authentication data (set_id=services@heipowersystem.com)121.202.152.401819730g4  -[' ossec13001gNExim Auth failed2025-03-06 13:00:03 dovecot_plain authenticator failed for ([1.252.204.203]) [1.252.204.203]:57898: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)1.252.204.2031835841Z3  -?) ossec13001gN,Exim Auth failed2025-03-06 12:56:35 dovecot_plain authenticator failed for ([196.28.226.124]) [196.28.226.124]:40533: 535 Incorrect authentication data (set_id=services)196.28.226.1241036973 - O t  iR  -a' ossec13001gVExim Auth failed2025-03-06 13:32:10 dovecot_plain authenticator failed for ([94.204.78.117]) [94.204.78.117]:44480: 535 Incorrect authentication data (set_id=services@heipowersystem.com)94.204.78.117290557cQ  -W# ossec13001gVzExim Auth failed2025-03-06 13:32:01 dovecot_plain authenticator failed for ([116.50.246.69]) [58.69.17.18]:46542: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)58.69.17.181694008CP  =) ossec13008gVxMail Reciepient rejected2025-03-06 13:31:59 H=(mail.heipowersystem.com) [165.154.213.22]:58251 F= rejected RCPT : Rejected relay attempt: '165.154.213.22' From: 'hhbvwotvxzy@heipowersystem.com' To: 'goofile@fastmail.com'165.154.213.223469034XO  -;) ossec13001gVBExim Auth failed2025-03-06 13:31:05 dovecot_plain authenticator failed for ([159.223.250.131]) [161.35.200.202]:54646: 535 Incorrect authentication data (set_id=sales)161.35.200.2022921044mN  -c+ ossec13001gV8Exim Auth failed2025-03-06 13:30:55 dovecot_plain authenticator failed for ([125.140.244.144]) [125.140.244.144]:35406: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)125.140.244.1441835841QM  -3# ossec13001gTExim Auth failed2025-03-06 13:25:31 dovecot_plain authenticator failed for ([5.166.68.89]) [5.166.68.89]:41948: 535 Incorrect authentication data (set_id=services)5.166.68.892017370jL  -_) ossec13001gTExim Auth failed2025-03-06 13:25:26 dovecot_plain authenticator failed for ([211.114.81.212]) [211.114.81.212]:51645: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)211.114.81.2121835841hK  =I+ ossec13008gUMail Reciepient rejected2025-03-06 13:25:50 H=(mail.shivelectricaltransformers.com) [165.154.226.104]:60402 F= rejected RCPT : Rejected relay attempt: '165.154.226.104' From: 'xzlsthzllr@shivelectricaltransformers.com' To: 'goofile@fastmail.com'165.154.226.1041668284iJ  -a' ossec13001gTExim Auth failed2025-03-06 13:24:59 dovecot_plain authenticator failed for ([91.75.105.190]) [91.75.105.190]:47820: 535 Incorrect authentication data (set_id=services@heipowersystem.com)91.75.105.190290557~I  Ua' ossec11001gS/Deferred login on the cpanel service[2025-03-06 13:17:58 +0530] info [webmaild] 157.38.132.71 - kps@amplifypowerglobal.com "POST /cpsess7962533031/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [157.38.132.63] != Current IP Address [157.38.132.71]157.38.132.711269750mH  -e) ossec13001gRExim Auth failed2025-03-06 13:16:24 dovecot_plain authenticator failed for ([94.181.187.192]) [94.181.187.192]:56482: 535 Incorrect authentication data (set_id=services@heipowersystem.com)94.181.187.1922017370WG  -;' ossec13001gRExim Auth failed2025-03-06 13:16:40 dovecot_plain authenticator failed for ([103.183.11.30]) [103.183.11.30]:41918: 535 Incorrect authentication data (set_id=services)103.183.11.301643084ZF  -=+ ossec13001gRExim Auth failed2025-03-06 13:16:36 dovecot_plain authenticator failed for ([123.210.128.249]) [123.210.128.249]:43158: 535 Incorrect authentication data (set_id=sales)123.210.128.2492077456dE  -W% ossec13001gRExim Auth failed2025-03-06 13:16:08 dovecot_plain authenticator failed for ([120.157.2.90]) [120.157.2.90]:46626: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)120.157.2.902077456gD  -[' ossec13001gQExim Auth failed2025-03-06 13:12:25 dovecot_plain authenticator failed for 202-4-196-160.static.pccw-hkt.com [202.4.196.160]:52053: 535 Incorrect authentication data (set_id=services)202.4.196.1601819730 *\~tj`VLB8.$zpf\H>4*   v l b X N D : 0 &    ~ t j ` V L B 8 . $    z p f \ R H > 4 *  vlbXDN&:0|rh^TJ@6,"xndZPF<2( ~tj`VLB8.$zpf\ | r h ^ T J @ 6 , "    x n d Z P F < 2 (   RRH>4*  vlbXND:0& g`g gTf gDZe gad g3c gƧb gra g&` g_ g^ g] g\ g[ gZ gqY g_X gsW gɿ#V gɿ-U gɾmT gɼS gɼR gɻQ gɻP gɻO gɻFN gɻ<M gɻ$L gɻK gɹJ gɹI gɸH gɸ{G gɷF gɷE gɶYD gɶOC gɶB gɵA gɵ@ gɳ.? gɳ> gɲ= gɲ< gɲz; gɲ`: gɰ9 gɰ_8 gɰI7 gɰ?6 gɰ5 gɰ 4 gɮu3 gɮi2 gɭJ1 gɭ>0 gɬ/ gɬ. gɬ~- gɬp, gɪ+ gɪ* gɩ) gɩ( gɨ' gɨ& gɨ % gɧ$ gɧ# gɧ" gɦ! gɦ gɦ gɤ gɤ gɤ gɤ gɣ gɢw gɢa gɡ+ gɠ gɠ gɟw gɟb gɟJ gɟ> gɞ gɞt gɝ6 gɝ  gɜf gɚ gɚ gɚ gɚ gə gə gə gə gɘ5 gɘQ gɗ gɗ gɖ~ gɖr gɖ\ gɔJ gɔ> gɔ gɒI gɒ; gɑk gɑ[ gɐ gɐ gɐP gɏ gɏ gɎO gɎ? gɎ gɍ gɍI gɍ9 gɋ gɋ gɊF gɊ4 gɉ gɉ gɉx gɈz gɈf gɇ gɇw gɇO gɇ7 gɄ gɄ~ gɄa gɄW gɃX gɃP gɂ gɂ gɁ gɁz gɁv gɀ gɀ g g g g g3 g! g}} g}k g| g| g| g|z g|j g|j g|` g{ g{ g{ g{ g  g g+ g" g g g g gէ g7 g) g g g g g gю gф~ g| gp gX g} gχ| gy{ gz gey gEx gw gv g8u g*t g˲s gxq glp glo gbn gbm g\l gRk gJr g0j g$i gh g{ gz, gz  gz gz gz  gy  gx gx gx gw gw gw gu gu gu gu gu gt gs gs gs gs gr gq gq gq gq gqw gqi gp gp gp/ gp! go go gn gn gn  gn gm gm gL gm gl gl gl gl gl~ gj gj gj gh gh gh gh gf gf gf gfV gfR gfF ge ge ge~ ge} gd| gd{ gd y gdx gcz gcw gbv gbu gbt gbs gb+r gaq gap ga{o gamn g`m g`l g_k g_j %P e ,ZgYkqjc  -_) ossec13001g[Exim Auth failed2025-03-06 13:54:54 dovecot_plain authenticator failed for ([117.53.254.144]) [117.53.254.144]:46143: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)117.53.254.1441835841vb  -y' ossec13001g[nExim Auth failed2025-03-06 13:53:08 dovecot_plain authenticator failed for (160.72.153.14.lightower.net) [160.72.153.14]:55562: 535 Incorrect authentication data (set_id=services@heipowersystem.com)160.72.153.146252001ja  -_) ossec13001g[PExim Auth failed2025-03-06 13:52:38 dovecot_plain authenticator failed for ([223.220.167.38]) [223.220.167.38]:55472: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)223.220.167.381814991 `  -+ ossec13001gZExim Auth failed2025-03-06 13:50:30 dovecot_plain authenticator failed for (176x212x190x170.dynamic.ryazan.ertelecom.ru) [176.212.190.170]:52610: 535 Incorrect authentication data (set_id=services@heipowersystem.com)176.212.190.1702017370o_  -k' ossec13001gZExim Auth failed2025-03-06 13:49:54 dovecot_plain authenticator failed for 126.64.125.78.rev.sfr.net [78.125.64.126]:60928: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)78.125.64.1263017382N^  --# ossec13001gZExim Auth failed2025-03-06 13:47:27 dovecot_plain authenticator failed for ([27.96.91.71]) [27.96.91.71]:44480: 535 Incorrect authentication data (set_id=sales)27.96.91.711269750Q]  -3# ossec13001gYExim Auth failed2025-03-06 13:47:01 dovecot_plain authenticator failed for ([101.13.5.49]) [101.13.5.49]:41906: 535 Incorrect authentication data (set_id=services)101.13.5.491668284p\  -i+ ossec13001gYExim Auth failed2025-03-06 13:46:49 dovecot_plain authenticator failed for ([123.209.118.166]) [123.209.118.166]:40928: 535 Incorrect authentication data (set_id=services@heipowersystem.com)123.209.118.1662077456m[  -c+ ossec13001gYExim Auth failed2025-03-06 13:46:46 dovecot_plain authenticator failed for ([190.211.250.118]) [190.211.250.122]:51990: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)190.211.250.1223895114gZ  -[' ossec13001gY Exim Auth failed2025-03-06 13:42:56 dovecot_plain authenticator failed for ([24.115.19.225]) [24.115.19.225]:51022: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)24.115.19.2256252001jY  -a' ossec13001gYExim Auth failed2025-03-06 13:43:07 dovecot_plain authenticator failed for ([103.69.244.39]) [103.69.244.39]:50316: 535 Incorrect authentication data (set_id=services@heipowersystem.com)103.69.244.391269750]X  -C+ ossec13001gWExim Auth failed2025-03-06 13:37:49 dovecot_login authenticator failed for ([122.187.230.154]) [122.187.230.154]:57206: 535 Incorrect authentication data (set_id=services)122.187.230.1541269750jW  -a' ossec13001gWExim Auth failed2025-03-06 13:37:33 dovecot_login authenticator failed for ([37.28.177.141]) [37.28.177.141]:46274: 535 Incorrect authentication data (set_id=services@heipowersystem.com)37.28.177.1412017370SV  -5' ossec13001gWExim Auth failed2025-03-06 13:38:04 dovecot_plain authenticator failed for ([77.139.82.133]) [77.139.82.133]:42304: 535 Incorrect authentication data (set_id=sales)77.139.82.133294640gU  -[' ossec13001gWExim Auth failed2025-03-06 13:37:53 dovecot_plain authenticator failed for ([183.105.3.221]) [183.105.3.221]:47422: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)183.105.3.2211835841QT  -3# ossec13001gVExim Auth failed2025-03-06 13:32:21 dovecot_plain authenticator failed for ([49.0.129.12]) [49.0.129.12]:43520: 535 Incorrect authentication data (set_id=services)49.0.129.122029969WS  -9) ossec13001gVExim Auth failed2025-03-06 13:32:27 dovecot_plain authenticator failed for ([67.213.230.122]) [67.213.230.122]:51577: 535 Incorrect authentication data (set_id=sales)67.213.230.1226252001 (7 \ n .6dt  -+ ossec13001gbExim Auth failed2025-03-06 14:24:52 dovecot_plain authenticator failed for 189.115.230.179.dynamic.adsl.gvt.net.br [189.115.230.179]:41752: 535 Incorrect authentication data (set_id=services@heipowersystem.com)189.115.230.1793469034gs  -[' ossec13001gbExim Auth failed2025-03-06 14:24:41 dovecot_plain authenticator failed for ([72.26.178.196]) [72.26.178.196]:54324: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)72.26.178.1966252001%r  3Q' ossec11301gb+New FTP connection.Mar 6 14:21:53 vm1 pure-ftpd[2641336]: (?@209.38.46.178) [INFO] New connection from 209.38.46.178209.38.46.1782750405Qq  -3# ossec13001gaExim Auth failed2025-03-06 14:19:11 dovecot_plain authenticator failed for ([59.12.63.70]) [59.12.63.70]:53763: 535 Incorrect authentication data (set_id=services)59.12.63.701835841Np  --# ossec13001gaExim Auth failed2025-03-06 14:19:05 dovecot_plain authenticator failed for ([61.233.4.50]) [61.233.4.50]:43582: 535 Incorrect authentication data (set_id=sales)61.233.4.501814991to  -u) ossec13001ga{Exim Auth failed2025-03-06 14:18:58 dovecot_plain authenticator failed for ip-188-127-16-197.ennet.pl [188.127.16.197]:56012: 535 Incorrect authentication data (set_id=services@heipowersystem.com)188.127.16.197798544an  -S# ossec13001gamExim Auth failed2025-03-06 14:18:45 dovecot_plain authenticator failed for ([206.0.8.204]) [206.0.8.204]:47274: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)206.0.8.2043469034Wm  -9) ossec13001g`Exim Auth failed2025-03-06 14:16:32 dovecot_login authenticator failed for ([220.161.52.149]) [220.161.52.149]:47855: 535 Incorrect authentication data (set_id=sales)220.161.52.1491814991jl  -_) ossec13001g`Exim Auth failed2025-03-06 14:16:16 dovecot_login authenticator failed for ([103.97.213.151]) [103.97.213.151]:58688: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)103.97.213.1511269750Wk  -9) ossec13001g_Exim Auth failed2025-03-06 14:12:15 dovecot_plain authenticator failed for ([222.117.88.230]) [222.117.88.230]:37718: 535 Incorrect authentication data (set_id=sales)222.117.88.2301835841pj  -i+ ossec13001g_Exim Auth failed2025-03-06 14:11:58 dovecot_plain authenticator failed for ([125.130.223.207]) [125.130.223.207]:56175: 535 Incorrect authentication data (set_id=services@heipowersystem.com)125.130.223.2071835841di  -W% ossec13001g_Exim Auth failed2025-03-06 14:11:52 dovecot_plain authenticator failed for ([103.83.9.138]) [103.83.9.138]:53618: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)103.83.9.1381269750Wh  -;' ossec13001g]Exim Auth failed2025-03-06 14:03:51 dovecot_plain authenticator failed for ([88.204.52.137]) [88.204.52.137]:56710: 535 Incorrect authentication data (set_id=services)88.204.52.1372017370jg  -a' ossec13001g]Exim Auth failed2025-03-06 14:03:35 dovecot_plain authenticator failed for ([1.220.226.226]) [1.220.226.226]:39276: 535 Incorrect authentication data (set_id=services@heipowersystem.com)1.220.226.2261835841Wf  -9) ossec13001g]Exim Auth failed2025-03-06 14:03:11 dovecot_plain authenticator failed for ([120.157.12.107]) [120.157.12.107]:57728: 535 Incorrect authentication data (set_id=sales)120.157.12.1072077456me  -c+ ossec13001g]Exim Auth failed2025-03-06 14:02:58 dovecot_plain authenticator failed for ([123.209.108.180]) [123.209.108.180]:54394: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)123.209.108.1802077456Td  -5' ossec13001g[Exim Auth failed2025-03-06 13:55:17 dovecot_plain authenticator failed for ([211.109.75.66]) [211.109.75.69]:52068: 535 Incorrect authentication data (set_id=sales)211.109.75.691835841 #O d ,AV|m  -e) ossec13001gfExim Auth failed2025-03-06 14:41:32 dovecot_plain authenticator failed for ([194.164.95.228]) [194.164.95.228]:38408: 535 Incorrect authentication data (set_id=services@heipowersystem.com)194.164.95.2282635167]  -C+ ossec13001gfExim Auth failed2025-03-06 14:41:55 dovecot_plain authenticator failed for ([103.123.114.215]) [103.123.114.215]:52756: 535 Incorrect authentication data (set_id=services)103.123.114.2151168579V  -9) ossec13001gfRExim Auth failed2025-03-06 14:39:38 dovecot_plain authenticator failed for ([85.105.241.188]) [85.105.241.188]:44734: 535 Incorrect authentication data (set_id=sales)85.105.241.188298795g  -[' ossec13001gfFExim Auth failed2025-03-06 14:39:25 dovecot_plain authenticator failed for ([31.173.20.146]) [31.173.20.146]:54192: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)31.173.20.1462017370g  -]% ossec13001gfVExim Auth failed2025-03-06 14:39:42 dovecot_plain authenticator failed for ([59.2.141.155]) [59.2.141.155]:59996: 535 Incorrect authentication data (set_id=services@heipowersystem.com)59.2.141.1551835841T  -5' ossec13001geExim Auth failed2025-03-06 14:37:19 dovecot_plain authenticator failed for ([220.74.63.183]) [220.74.63.183]:33300: 535 Incorrect authentication data (set_id=sales)220.74.63.1831835841l  -c) ossec13001geExim Auth failed2025-03-06 14:37:26 dovecot_plain authenticator failed for ([222.128.44.171]) [222.128.44.171]:2059: 535 Incorrect authentication data (set_id=services@heipowersystem.com)222.128.44.1711814991r~  -s% ossec13001geExim Auth failed2025-03-06 14:37:05 dovecot_plain authenticator failed for (undefined.hostname.localhost) [103.90.97.98]:51508: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)103.90.97.981269750Q}  -3# ossec13001geExim Auth failed2025-03-06 14:34:20 dovecot_plain authenticator failed for ([112.72.4.98]) [112.72.4.98]:27180: 535 Incorrect authentication data (set_id=services)112.72.4.982029969|  -% ossec13001gdExim Auth failed2025-03-06 14:33:56 dovecot_plain authenticator failed for 61-216-7-163.hinet-ip.hinet.net ([61.216.7.164]) [61.216.7.163]:34393: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)61.216.7.1631668284{  -) ossec13001gdExim Auth failed2025-03-06 14:33:45 dovecot_plain authenticator failed for (63.230.182.190.unassigned.ridsa.com.ar) [190.182.230.63]:56571: 535 Incorrect authentication data (set_id=services@heipowersystem.com)190.182.230.633865483gz  -]% ossec13001gcExim Auth failed2025-03-06 14:29:39 dovecot_plain authenticator failed for ([5.59.141.152]) [5.59.141.152]:49200: 535 Incorrect authentication data (set_id=services@heipowersystem.com)5.59.141.1522017370Py  -1# ossec13001gd Exim Auth failed2025-03-06 14:29:56 dovecot_plain authenticator failed for ([116.50.246.69]) [58.69.17.18]:45046: 535 Incorrect authentication data (set_id=sales)58.69.17.181694008Sx  -7% ossec13001gdExim Auth failed2025-03-06 14:29:51 dovecot_plain authenticator failed for ([197.87.10.83]) [197.87.10.83]:40611: 535 Incorrect authentication data (set_id=services)197.87.10.83953987gw  -[' ossec13001gcExim Auth failed2025-03-06 14:29:39 dovecot_plain authenticator failed for ([222.180.4.150]) [222.180.4.150]:35200: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)222.180.4.1501814991Pv  -1% ossec13001gbExim Auth failed2025-03-06 14:25:18 dovecot_plain authenticator failed for ([94.205.82.33]) [94.205.82.33]:50940: 535 Incorrect authentication data (set_id=sales)94.205.82.33290557Yu  -?) ossec13001gbExim Auth failed2025-03-06 14:25:06 dovecot_plain authenticator failed for ([178.172.225.52]) [178.172.225.52]:53839: 535 Incorrect authentication data (set_id=services)178.172.225.52630336  . Y { 7Lb^wT  -5' ossec13001gnExim Auth failed2025-03-06 15:12:24 dovecot_plain authenticator failed for ([1.220.226.226]) [1.220.226.226]:38122: 535 Incorrect authentication data (set_id=sales)1.220.226.2261835841c  -S' ossec13001gmExim Auth failed2025-03-06 15:12:08 dovecot_plain authenticator failed for (173-29-118-52.client.mchsi.com) [173.29.118.52]:51883: 535 Incorrect authentication data (set_id=sales)173.29.118.526252001  - ' ossec13001gmExim Auth failed2025-03-06 15:12:02 dovecot_plain authenticator failed for broadband-95-84-158-215.ip.moscow.rt.ru [95.84.158.215]:59883: 535 Incorrect authentication data (set_id=services@heipowersystem.com)95.84.158.2152017370f  -[' ossec13001gmExim Auth failed2025-03-06 15:11:49 dovecot_plain authenticator failed for ([94.204.100.40]) [94.204.100.40]:51956: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)94.204.100.40290557g  -Y) ossec13001glExim Auth failed2025-03-06 15:06:52 dovecot_plain authenticator failed for ip-142-90-218-227.user.start.ca [142.90.218.227]:45824: 535 Incorrect authentication data (set_id=services)142.90.218.2276251999T  -7% ossec13001glExim Auth failed2025-03-06 15:06:26 dovecot_plain authenticator failed for ([42.236.91.93]) [42.236.91.93]:35374: 535 Incorrect authentication data (set_id=services)42.236.91.931814991Y  -=+ ossec13001glExim Auth failed2025-03-06 15:06:18 dovecot_plain authenticator failed for ([196.189.126.185]) [196.189.126.185]:55284: 535 Incorrect authentication data (set_id=sales)196.189.126.185337996m  -e) ossec13001glExim Auth failed2025-03-06 15:06:08 dovecot_plain authenticator failed for ([125.23.204.106]) [125.23.204.106]:57212: 535 Incorrect authentication data (set_id=services@heipowersystem.com)125.23.204.1061269750g  -[' ossec13001gl~Exim Auth failed2025-03-06 15:05:57 dovecot_plain authenticator failed for ([103.161.93.51]) [103.161.93.51]:38021: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)103.161.93.511269750Z  -?) ossec13001gjExim Auth failed2025-03-06 14:59:20 dovecot_plain authenticator failed for ([192.199.58.185]) [192.199.58.185]:58198: 535 Incorrect authentication data (set_id=services)192.199.58.1856251999j  -a' ossec13001gjExim Auth failed2025-03-06 14:58:57 dovecot_plain authenticator failed for ([106.86.209.86]) [106.86.209.86]:15514: 535 Incorrect authentication data (set_id=services@heipowersystem.com)106.86.209.861814991c  -W# ossec13001gjExim Auth failed2025-03-06 14:58:44 dovecot_plain authenticator failed for ([116.50.246.69]) [58.69.17.18]:53842: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)58.69.17.181694008Z  -?) ossec13001ghExim Auth failed2025-03-06 14:50:38 dovecot_plain authenticator failed for ([195.122.224.64]) [195.122.224.64]:51504: 535 Incorrect authentication data (set_id=services)195.122.224.642017370Q  -1% ossec13001ghExim Auth failed2025-03-06 14:50:31 dovecot_plain authenticator failed for ([5.59.141.152]) [5.59.141.152]:49286: 535 Incorrect authentication data (set_id=sales)5.59.141.1522017370f  -Y' ossec13001ghExim Auth failed2025-03-06 14:50:20 dovecot_plain authenticator failed for visaustralia.com [216.70.104.41]:39766: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)216.70.104.416252001j  -a' ossec13001ghExim Auth failed2025-03-06 14:50:17 dovecot_plain authenticator failed for ([49.124.151.54]) [49.124.151.54]:46884: 535 Incorrect authentication data (set_id=services@heipowersystem.com)49.124.151.541733045v  -y' ossec13001gfExim Auth failed2025-03-06 14:41:49 dovecot_plain authenticator failed for 111-70-32-180.emome-ip.hinet.net [111.70.32.180]:38062: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)111.70.32.1801668284 "D T c -.+=O^W'  -9) ossec13001gsExim Auth failed2025-03-06 15:33:51 dovecot_login authenticator failed for ([216.194.174.86]) [216.194.174.27]:54977: 535 Incorrect authentication data (set_id=sales)216.194.174.276252001m&  -c+ ossec13001grExim Auth failed2025-03-06 15:33:31 dovecot_login authenticator failed for ([183.109.195.179]) [183.109.195.179]:57336: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)183.109.195.1791835841j%  -a' ossec13001gqExim Auth failed2025-03-06 15:29:07 dovecot_plain authenticator failed for ([1.220.226.226]) [1.220.226.226]:43063: 535 Incorrect authentication data (set_id=services@heipowersystem.com)1.220.226.2261835841j$  -]+ ossec13001gqExim Auth failed2025-03-06 15:28:51 dovecot_plain authenticator failed for (172.183.199.112.unknown.m1.com.sg) [112.199.183.172]:42728: 535 Incorrect authentication data (set_id=sales)112.199.183.1721880251#  -+ ossec13001gqExim Auth failed2025-03-06 15:28:39 dovecot_plain authenticator failed for 122-148-252-147.sta.wbroadband.net.au [122.148.252.147]:49521: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)122.148.252.1472077456{"  -' ossec13001gqExim Auth failed2025-03-06 15:27:18 dovecot_plain authenticator failed for 78-69-119-192-no600.tbcn.telia.com [78.69.119.192]:49610: 535 Incorrect authentication data (set_id=services@heipowersystem.com)78.69.119.1922661886W!  -9) ossec13001gqwExim Auth failed2025-03-06 15:27:11 dovecot_plain authenticator failed for ([182.139.39.150]) [182.139.39.150]:48604: 535 Incorrect authentication data (set_id=sales)182.139.39.1501814991j  -_) ossec13001gqiExim Auth failed2025-03-06 15:26:56 dovecot_plain authenticator failed for ([111.48.208.197]) [111.48.208.197]:53374: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)111.48.208.1971814991T  -5' ossec13001gpExim Auth failed2025-03-06 15:24:35 dovecot_plain authenticator failed for ([31.173.20.146]) [31.173.20.146]:54376: 535 Incorrect authentication data (set_id=sales)31.173.20.1462017370d  -W% ossec13001gpExim Auth failed2025-03-06 15:24:20 dovecot_plain authenticator failed for ([112.91.67.18]) [112.91.67.18]:60696: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)112.91.67.181814991Z  -?) ossec13001gp/Exim Auth failed2025-03-06 15:21:43 dovecot_plain authenticator failed for ([106.55.161.136]) [106.55.161.136]:49526: 535 Incorrect authentication data (set_id=services)106.55.161.1361814991p  -i+ ossec13001gp!Exim Auth failed2025-03-06 15:21:29 dovecot_plain authenticator failed for ([106.246.227.218]) [106.246.227.218]:36726: 535 Incorrect authentication data (set_id=services@heipowersystem.com)106.246.227.2181835841W  -;' ossec13001goExim Auth failed2025-03-06 15:17:11 dovecot_plain authenticator failed for ([41.67.143.142]) [41.67.143.142]:57384: 535 Incorrect authentication data (set_id=services)41.67.143.1422328926m  -e) ossec13001goExim Auth failed2025-03-06 15:16:58 dovecot_plain authenticator failed for ([112.111.61.229]) [112.111.61.229]:46344: 535 Incorrect authentication data (set_id=services@heipowersystem.com)112.111.61.2291814991l  -e' ossec13001gnExim Auth failed2025-03-06 15:15:18 dovecot_login authenticator failed for (thepsindustries.com) [58.240.171.59]:57356: 535 Incorrect authentication data (set_id=sales@thepsindustries.com)58.240.171.591814991Z  -A' ossec13001gnExim Auth failed2025-03-06 15:14:55 dovecot_login authenticator failed for (thepsindustries.com) [58.240.171.59]:52314: 535 Incorrect authentication data (set_id=nologin)58.240.171.591814991Z  -?) ossec13001gn Exim Auth failed2025-03-06 15:12:36 dovecot_plain authenticator failed for ([176.222.190.70]) [176.222.190.70]:40768: 535 Incorrect authentication data (set_id=services)176.222.190.701522867  9 / F [ g+P>PgloU7  -9) ossec13001gy Exim Auth failed2025-03-06 15:59:29 dovecot_plain authenticator failed for ([213.32.253.235]) [213.32.253.235]:53447: 535 Incorrect authentication data (set_id=sales)213.32.253.23599237W6  -;' ossec13001gxExim Auth failed2025-03-06 15:59:07 dovecot_plain authenticator failed for ([61.81.133.182]) [61.81.133.182]:33978: 535 Incorrect authentication data (set_id=services)61.81.133.1821835841y5  -}) ossec13001gxExim Auth failed2025-03-06 15:58:59 dovecot_plain authenticator failed for c83-254-214-181.bredband.tele2.se [83.254.214.181]:53158: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)83.254.214.1812661886w4  -{' ossec13001gxExim Auth failed2025-03-06 15:58:55 dovecot_plain authenticator failed for 5.113.159.133.rev.iijmobile.jp [133.159.113.5]:53030: 535 Incorrect authentication data (set_id=services@heipowersystem.com)133.159.113.51861060e3  -Y% ossec13001gwExim Auth failed2025-03-06 15:53:13 dovecot_plain authenticator failed for syn-072-017-090-246.biz.spectrum.com [72.17.90.246]:39002: 535 Incorrect authentication data (set_id=sales)72.17.90.2466252001j2  -a' ossec13001gwExim Auth failed2025-03-06 15:53:04 dovecot_plain authenticator failed for ([61.108.83.254]) [61.108.83.139]:52768: 535 Incorrect authentication data (set_id=services@heipowersystem.com)61.108.83.13918358411  -') ossec13001gwExim Auth failed2025-03-06 15:52:56 dovecot_plain authenticator failed for (abts-north-static-059.221.160.122.airtelbroadband.in) [122.160.221.59]:37138: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)122.160.221.591269750W0  -;' ossec13001guExim Auth failed2025-03-06 15:46:29 dovecot_plain authenticator failed for ([182.135.66.27]) [182.135.66.27]:39770: 535 Incorrect authentication data (set_id=services)182.135.66.2718149918/  =k) ossec13008guMail Reciepient rejected2025-03-06 15:46:20 H=mta6-66.183.ptransmail.com [175.158.66.183]:23294 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 CV=no F=<17412003711406484-93688-1-hsnews.in@nc.bajajallianz.co.in> rejected RCPT : Sender verify failed175.158.66.1831269750p.  -i+ ossec13001guExim Auth failed2025-03-06 15:46:06 dovecot_plain authenticator failed for ([211.238.237.254]) [211.238.237.254]:56398: 535 Incorrect authentication data (set_id=services@heipowersystem.com)211.238.237.2541835841g-  -[' ossec13001guExim Auth failed2025-03-06 15:46:00 dovecot_plain authenticator failed for ([125.20.46.114]) [125.20.46.114]:57330: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)125.20.46.1141269750e,  -S+ ossec13001guExim Auth failed2025-03-06 15:42:17 dovecot_login authenticator failed for ([183.230.252.103]) [183.230.252.103]:47114: 535 Incorrect authentication data (set_id=vikas.khandelwal)183.230.252.1031814991+  -' ossec13001gtExim Auth failed2025-03-06 15:42:01 dovecot_login authenticator failed for (79-77-174-182.static.dsl.as9105.com) [79.77.174.182]:55732: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)79.77.174.1822635167]*  -C+ ossec13001gsExim Auth failed2025-03-06 15:37:50 dovecot_plain authenticator failed for ([177.174.105.113]) [177.174.105.113]:49904: 535 Incorrect authentication data (set_id=services)177.174.105.1133469034p)  -i+ ossec13001gsExim Auth failed2025-03-06 15:37:31 dovecot_plain authenticator failed for ([203.123.219.137]) [203.123.219.137]:35967: 535 Incorrect authentication data (set_id=services@heipowersystem.com)203.123.219.1371835841n(  -g) ossec13001gsExim Auth failed2025-03-06 15:37:10 dovecot_plain authenticator failed for 74-103-174-206.gci.net [206.174.103.74]:64832: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)206.174.103.746252001  1 J i ~ :NV\qWH  -9) ossec13001g|Exim Auth failed2025-03-06 16:16:06 dovecot_plain authenticator failed for ([220.182.17.122]) [220.182.17.122]:54038: 535 Incorrect authentication data (set_id=sales)220.182.17.1221814991gG  -]% ossec13001g|Exim Auth failed2025-03-06 16:16:03 dovecot_plain authenticator failed for ([112.91.124.4]) [112.91.124.4]:57484: 535 Incorrect authentication data (set_id=services@heipowersystem.com)112.91.124.41814991vF  -w) ossec13001g|Exim Auth failed2025-03-06 16:15:55 dovecot_plain authenticator failed for (ws60-209.199.103.rcil.gov.in) [103.199.209.60]:40228: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)103.199.209.601269750tE  -u) ossec13001g|jExim Auth failed2025-03-06 16:13:54 dovecot_plain authenticator failed for ip-188-127-16-197.ennet.pl [188.127.16.197]:43486: 535 Incorrect authentication data (set_id=services@heipowersystem.com)188.127.16.197798544hD  -]' ossec13001g|`Exim Auth failed2025-03-06 16:13:43 dovecot_plain authenticator failed for ([189.108.224.67]) [191.210.73.33]:34111: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)191.210.73.333469034QC  -3# ossec13001g|zExim Auth failed2025-03-06 16:14:10 dovecot_plain authenticator failed for ([112.94.6.54]) [112.94.6.54]:63956: 535 Incorrect authentication data (set_id=services)112.94.6.541814991bB  -Q' ossec13001g|jExim Auth failed2025-03-06 16:13:53 dovecot_plain authenticator failed for 46.79-160-128.customer.lyse.net [79.160.128.46]:59477: 535 Incorrect authentication data (set_id=sales)79.160.128.463144096gA  -]% ossec13001g{Exim Auth failed2025-03-06 16:11:28 dovecot_plain authenticator failed for ([223.84.12.28]) [223.84.12.28]:36246: 535 Incorrect authentication data (set_id=services@heipowersystem.com)223.84.12.281814991T@  -7% ossec13001g{Exim Auth failed2025-03-06 16:08:15 dovecot_plain authenticator failed for ([38.21.61.150]) [38.21.61.150]:46021: 535 Incorrect authentication data (set_id=services)38.21.61.1506252001Q?  -1% ossec13001g{Exim Auth failed2025-03-06 16:08:13 dovecot_plain authenticator failed for ([27.71.20.180]) [27.71.20.180]:42988: 535 Incorrect authentication data (set_id=sales)27.71.20.1801562822m>  -e) ossec13001g{Exim Auth failed2025-03-06 16:07:58 dovecot_plain authenticator failed for ([114.247.207.98]) [114.247.207.98]:35897: 535 Incorrect authentication data (set_id=services@heipowersystem.com)114.247.207.981814991g=  -[' ossec13001g{Exim Auth failed2025-03-06 16:07:50 dovecot_plain authenticator failed for ([43.139.182.85]) [43.139.182.85]:53872: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)43.139.182.851814991]<  -C+ ossec13001gz,Exim Auth failed2025-03-06 16:04:19 dovecot_plain authenticator failed for ([197.255.138.149]) [197.255.138.149]:59292: 535 Incorrect authentication data (set_id=services)197.255.138.1493374766c;  -U% ossec13001gz Exim Auth failed2025-03-06 16:04:07 dovecot_plain authenticator failed for 111-70-3-198.emome-ip.hinet.net [111.70.3.198]:51673: 535 Incorrect authentication data (set_id=services)111.70.3.1981668284f:  -W) ossec13001gzExim Auth failed2025-03-06 16:04:00 dovecot_plain authenticator failed for (189.218.168.30-clientes-izzi.mx) [189.218.168.30]:58622: 535 Incorrect authentication data (set_id=sales)189.218.168.303996063y9  -' ossec13001gzExim Auth failed2025-03-06 16:03:52 dovecot_plain authenticator failed for 67-60-211-114.cpe.sparklight.net [67.60.211.114]:56064: 535 Incorrect authentication data (set_id=services@heipowersystem.com)67.60.211.1146252001d8  -W% ossec13001gz Exim Auth failed2025-03-06 16:03:45 dovecot_plain authenticator failed for ([39.164.91.67]) [39.164.91.67]:38592: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)39.164.91.671814991 4 > [ T v  8HjyZY  -=+ ossec13001gɃXExim Auth failed2025-03-06 16:43:28 dovecot_plain authenticator failed for ([207.219.221.101]) [207.219.221.101]:58811: 535 Incorrect authentication data (set_id=sales)207.219.221.1016251999mX  -c+ ossec13001gɃPExim Auth failed2025-03-06 16:43:19 dovecot_plain authenticator failed for ([201.183.225.156]) [201.183.225.156]:48851: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)201.183.225.1563658394ZW  -?) ossec13001gɂExim Auth failed2025-03-06 16:40:43 dovecot_plain authenticator failed for ([176.192.250.81]) [176.192.250.81]:50832: 535 Incorrect authentication data (set_id=services)176.192.250.812017370lV  -c) ossec13001gɂExim Auth failed2025-03-06 16:40:33 dovecot_plain authenticator failed for ([222.128.44.171]) [222.128.44.171]:2060: 535 Incorrect authentication data (set_id=services@heipowersystem.com)222.128.44.1711814991NU  --# ossec13001gɁExim Auth failed2025-03-06 16:35:54 dovecot_plain authenticator failed for ([181.49.3.38]) [181.49.3.38]:60662: 535 Incorrect authentication data (set_id=sales)181.49.3.383686110dT  -W% ossec13001gɁzExim Auth failed2025-03-06 16:35:29 dovecot_plain authenticator failed for ([8.139.253.26]) [8.139.253.26]:63694: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)8.139.253.261814991lS  -e) ossec13001gɁvExim Auth failed2025-03-06 16:35:24 dovecot_plain authenticator failed for ([94.204.230.214]) [94.204.230.214]:48075: 535 Incorrect authentication data (set_id=services@heipowersystem.com)94.204.230.214290557YR  -?) ossec13001gɀExim Auth failed2025-03-06 16:32:29 dovecot_login authenticator failed for ([87.236.141.106]) [87.236.141.106]:43137: 535 Incorrect authentication data (set_id=services)87.236.141.106290291mQ  -e) ossec13001gɀExim Auth failed2025-03-06 16:32:14 dovecot_login authenticator failed for ([112.111.61.231]) [112.111.61.229]:55642: 535 Incorrect authentication data (set_id=services@heipowersystem.com)112.111.61.2291814991WP  -9) ossec13001gExim Auth failed2025-03-06 16:29:05 dovecot_plain authenticator failed for ([31.207.207.180]) [31.207.207.180]:38209: 535 Incorrect authentication data (set_id=sales)31.207.207.1802017370gO  -[' ossec13001gExim Auth failed2025-03-06 16:28:39 dovecot_plain authenticator failed for ([45.181.196.97]) [45.181.196.97]:49024: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)45.181.196.973469034ZN  -?) ossec13001gExim Auth failed2025-03-06 16:27:24 dovecot_plain authenticator failed for ([192.199.58.185]) [192.199.58.185]:33589: 535 Incorrect authentication data (set_id=services)192.199.58.1856251999M  -) ossec13001gExim Auth failed2025-03-06 16:27:06 dovecot_plain authenticator failed for broadband-178-140-95-221.ip.moscow.rt.ru [178.140.95.221]:33643: 535 Incorrect authentication data (set_id=services@heipowersystem.com)178.140.95.2212017370_L  -K' ossec13001g3Exim Auth failed2025-03-06 16:25:47 dovecot_plain authenticator failed for ([183.47.48.178]) [183.47.48.178]:36335: 535 Incorrect authentication data (set_id=vikas.khandelwal)183.47.48.1781814991rK  -q' ossec13001g!Exim Auth failed2025-03-06 16:25:29 dovecot_plain authenticator failed for ([202.53.94.242]) [202.53.94.242]:43048: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)202.53.94.2421269750WJ  -;' ossec13001g}}Exim Auth failed2025-03-06 16:18:28 dovecot_plain authenticator failed for ([183.220.243.2]) [183.220.243.2]:46830: 535 Incorrect authentication data (set_id=services)183.220.243.21814991mI  -e) ossec13001g}kExim Auth failed2025-03-06 16:18:10 dovecot_plain authenticator failed for ([152.42.211.235]) [152.42.211.235]:51812: 535 Incorrect authentication data (set_id=services@heipowersystem.com)152.42.211.2351880251 a  9 N s <Kafj  -Y' ossec13001gɋExim Auth failed2025-03-06 17:19:32 dovecot_plain authenticator failed for 217-76-83-103.cust.bredband2.com [217.76.83.103]:57072: 535 Incorrect authentication data (set_id=services)217.76.83.1032661886mi  -e) ossec13001gɋExim Auth failed2025-03-06 17:19:08 dovecot_plain authenticator failed for ([103.129.201.82]) [103.129.201.81]:60348: 535 Incorrect authentication data (set_id=services@heipowersystem.com)103.129.201.811210997Th  -7% ossec13001gɊFExim Auth failed2025-03-06 17:13:02 dovecot_plain authenticator failed for ([60.11.20.130]) [60.11.20.130]:42632: 535 Incorrect authentication data (set_id=services)60.11.20.1301814991pg  -i+ ossec13001gɊ4Exim Auth failed2025-03-06 17:12:44 dovecot_plain authenticator failed for ([193.158.248.248]) [193.158.248.248]:34630: 535 Incorrect authentication data (set_id=services@heipowersystem.com)193.158.248.2482921044gf  -[' ossec13001gɉExim Auth failed2025-03-06 17:11:43 dovecot_plain authenticator failed for ([159.75.92.136]) [159.75.92.136]:35454: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)159.75.92.1361814991pe  -k) ossec13001gɉExim Auth failed2025-03-06 17:09:45 dovecot_plain authenticator failed for (91-220-216-178.omsk.mts.ru) [178.216.220.91]:58166: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)178.216.220.912017370yd  -}) ossec13001gɉxExim Auth failed2025-03-06 17:09:34 dovecot_plain authenticator failed for ([221.167.21.148]) [221.167.21.148]:55322: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)221.167.21.1481835841Tc  -7% ossec13001gɈzExim Auth failed2025-03-06 17:05:20 dovecot_plain authenticator failed for ([43.154.94.85]) [43.154.94.85]:40814: 535 Incorrect authentication data (set_id=services)43.154.94.851819730gb  -]% ossec13001gɈfExim Auth failed2025-03-06 17:05:01 dovecot_plain authenticator failed for ([59.2.141.155]) [59.2.141.155]:57502: 535 Incorrect authentication data (set_id=services@heipowersystem.com)59.2.141.1551835841Ta  -7% ossec13001gɇExim Auth failed2025-03-06 17:01:25 dovecot_plain authenticator failed for ([218.68.0.210]) [218.68.0.210]:51552: 535 Incorrect authentication data (set_id=services)218.68.0.2101814991p`  -i+ ossec13001gɇwExim Auth failed2025-03-06 17:01:03 dovecot_plain authenticator failed for ([179.183.114.175]) [179.183.114.175]:40738: 535 Incorrect authentication data (set_id=services@heipowersystem.com)179.183.114.1753469034W_  -9) ossec13001gɇOExim Auth failed2025-03-06 17:00:22 dovecot_plain authenticator failed for ([125.136.163.86]) [125.136.163.86]:38524: 535 Incorrect authentication data (set_id=sales)125.136.163.861835841g^  -[' ossec13001gɇ7Exim Auth failed2025-03-06 16:59:59 dovecot_plain authenticator failed for ([177.125.22.55]) [177.125.22.55]:39500: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)177.125.22.553469034S]  -5' ossec13001gɄExim Auth failed2025-03-06 16:48:32 dovecot_plain authenticator failed for ([87.120.67.149]) [87.120.67.149]:40262: 535 Incorrect authentication data (set_id=sales)87.120.67.149732800m\  -c+ ossec13001gɄ~Exim Auth failed2025-03-06 16:48:22 dovecot_plain authenticator failed for ([167.250.119.177]) [167.250.119.177]:33113: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)167.250.119.1773865483q[  -k+ ossec13001gɄaExim Auth failed2025-03-06 16:47:51 dovecot_plain authenticator failed for (static.ill.117.250.165.114.bsnl.co.in) [117.250.165.114]:47260: 535 Incorrect authentication data (set_id=services)117.250.165.1141269750Z  -+ ossec13001gɄWExim Auth failed2025-03-06 16:47:41 dovecot_plain authenticator failed for broadband-178-140-152-209.ip.moscow.rt.ru [178.140.152.209]:54526: 535 Incorrect authentication data (set_id=services@heipowersystem.com)178.140.152.2092017370 N * @ X } t*,NZ|  -=+ ossec13001gɔJExim Auth failed2025-03-06 17:55:44 dovecot_plain authenticator failed for ([123.210.152.243]) [123.210.152.243]:53428: 535 Incorrect authentication data (set_id=sales)123.210.152.2432077456z{  -' ossec13001gɔ>Exim Auth failed2025-03-06 17:55:33 dovecot_plain authenticator failed for (64.250.41.124.dynamic.wlink.com.np) [124.41.250.64]:39287: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)124.41.250.641282988gz  -]% ossec13001gɔExim Auth failed2025-03-06 17:55:01 dovecot_plain authenticator failed for ([1.212.225.99]) [1.212.225.99]:59926: 535 Incorrect authentication data (set_id=services@heipowersystem.com)1.212.225.991835841Wy  -9) ossec13001gɒIExim Auth failed2025-03-06 17:47:13 dovecot_plain authenticator failed for ([61.150.123.106]) [61.150.123.106]:50460: 535 Incorrect authentication data (set_id=sales)61.150.123.1061814991gx  -[' ossec13001gɒ;Exim Auth failed2025-03-06 17:46:59 dovecot_plain authenticator failed for ([89.101.36.159]) [89.101.36.159]:46977: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)89.101.36.1592963597Ww  -;' ossec13001gɑkExim Auth failed2025-03-06 17:43:29 dovecot_plain authenticator failed for ([106.12.254.47]) [106.12.254.47]:41078: 535 Incorrect authentication data (set_id=services)106.12.254.471814991mv  -e) ossec13001gɑ[Exim Auth failed2025-03-06 17:43:14 dovecot_plain authenticator failed for ([178.178.222.53]) [178.178.222.53]:38388: 535 Incorrect authentication data (set_id=services@heipowersystem.com)178.178.222.532017370^u  -M# ossec13001gɐExim Auth failed2025-03-06 17:41:08 dovecot_plain authenticator failed for host-2-98-157-37.as13285.net [2.98.157.37]:52006: 535 Incorrect authentication data (set_id=services)2.98.157.372635167gt  -]% ossec13001gɐExim Auth failed2025-03-06 17:40:45 dovecot_plain authenticator failed for ([112.91.67.18]) [112.91.67.18]:54066: 535 Incorrect authentication data (set_id=services@heipowersystem.com)112.91.67.181814991Cs  77 ossec502gɐPOssec server started.ossec: Ossec started.Qr  -1% ossec13001gɏExim Auth failed2025-03-06 17:36:45 dovecot_plain authenticator failed for ([31.173.2.172]) [31.173.2.172]:37536: 535 Incorrect authentication data (set_id=sales)31.173.2.1722017370jq  -_) ossec13001gɏExim Auth failed2025-03-06 17:36:35 dovecot_plain authenticator failed for ([49.205.177.146]) [223.239.159.21]:51728: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)223.239.159.211269750Wp  -9) ossec13001gɎOExim Auth failed2025-03-06 17:30:14 dovecot_plain authenticator failed for ([218.234.104.42]) [218.234.104.42]:46720: 535 Incorrect authentication data (set_id=sales)218.234.104.421835841do  -W% ossec13001gɎ?Exim Auth failed2025-03-06 17:29:58 dovecot_plain authenticator failed for ([110.35.63.27]) [110.35.63.27]:40028: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)110.35.63.271835841fn  -W) ossec13001gɎExim Auth failed2025-03-06 17:28:58 dovecot_plain authenticator failed for 110-25-101-236.adsl.fetnet.net [110.25.101.236]:39670: 535 Incorrect authentication data (set_id=services)110.25.101.2361668284gm  -]% ossec13001gɍExim Auth failed2025-03-06 17:28:39 dovecot_plain authenticator failed for ([59.22.68.213]) [59.22.68.213]:58634: 535 Incorrect authentication data (set_id=services@heipowersystem.com)59.22.68.2131835841kl  -e% ossec13001gɍIExim Auth failed2025-03-06 17:25:52 dovecot_plain authenticator failed for vps-79f20bfc.vps.ovh.net ([87.98.249.193]) [51.75.24.107]:56463: 535 Incorrect authentication data (set_id=sales)51.75.24.1073017382xk  -% ossec13001gɍ9Exim Auth failed2025-03-06 17:25:36 dovecot_plain authenticator failed for net-93-64-108-27.cust.vodafonedsl.it [93.64.108.27]:42250: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)93.64.108.273175395 7! C O a "7d  -W% ossec13001gɝ Exim Auth failed2025-03-06 18:33:27 dovecot_plain authenticator failed for ([113.192.1.27]) [113.192.1.26]:33122: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)113.192.1.261643084  -# ossec13001gɜfExim Auth failed2025-03-06 18:30:21 dovecot_plain authenticator failed for static-98-110-70-2.cmdnnj.fios.verizon.net [98.110.70.2]:34852: 535 Incorrect authentication data (set_id=services@heipowersystem.com)98.110.70.26252001j  -a' ossec13001gɚExim Auth failed2025-03-06 18:23:21 dovecot_plain authenticator failed for ([201.173.16.21]) [201.173.16.21]:33255: 535 Incorrect authentication data (set_id=services@heipowersystem.com)201.173.16.213996063  -+ ossec13001gɚExim Auth failed2025-03-06 18:23:48 dovecot_plain authenticator failed for 137.173.198.203.static.netvigator.com ([203.198.173.145]) [203.198.173.137]:56684: 535 Incorrect authentication data (set_id=services)203.198.173.1371819730g  -[' ossec13001gɚExim Auth failed2025-03-06 18:22:49 dovecot_plain authenticator failed for 62.174.139.16.static.user.ono.com [62.174.139.16]:36764: 535 Incorrect authentication data (set_id=services)62.174.139.162510769j  -a' ossec13001gɚExim Auth failed2025-03-06 18:22:28 dovecot_plain authenticator failed for ([121.154.90.17]) [121.154.90.17]:34390: 535 Incorrect authentication data (set_id=services@heipowersystem.com)121.154.90.171835841Q  -1% ossec13001gəExim Auth failed2025-03-06 18:19:15 dovecot_plain authenticator failed for ([14.37.206.76]) [14.37.206.76]:34254: 535 Incorrect authentication data (set_id=sales)14.37.206.761835841h  -a' ossec13001gəExim Auth failed2025-03-06 18:18:43 dovecot_plain authenticator failed for ([65.20.169.121]) [65.20.169.121]:54515: 535 Incorrect authentication data (set_id=services@heipowersystem.com)65.20.169.12199237c  -U% ossec13001gəExim Auth failed2025-03-06 18:18:51 dovecot_plain authenticator failed for 89-160-38-13.cust.bredband2.com [89.160.38.13]:37074: 535 Incorrect authentication data (set_id=services)89.160.38.132661886y  -% ossec13001gəExim Auth failed2025-03-06 18:18:51 dovecot_plain authenticator failed for 7.248.146.34.bc.googleusercontent.com [34.146.248.7]:40282: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)34.146.248.71861060j  -a' ossec13001gɘ5Exim Auth failed2025-03-06 18:12:27 dovecot_plain authenticator failed for ([58.42.226.215]) [58.42.226.215]:49545: 535 Incorrect authentication data (set_id=services@heipowersystem.com)58.42.226.2151814991Z  -?) ossec13001gɘQExim Auth failed2025-03-06 18:12:56 dovecot_plain authenticator failed for ([166.195.197.38]) [166.195.197.38]:54727: 535 Incorrect authentication data (set_id=services)166.195.197.386252001j  -a' ossec13001gɗExim Auth failed2025-03-06 18:10:26 dovecot_plain authenticator failed for ipb21949c7.dynamic.kabel-deutschland.de [178.25.73.199]:54602: 535 Incorrect authentication data (set_id=sales)178.25.73.1992921044p  -q# ossec13001gɗExim Auth failed2025-03-06 18:09:52 dovecot_plain authenticator failed for 111-70-19-8.emome-ip.hinet.net [111.70.19.8]:48113: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)111.70.19.81668284Z  -=+ ossec13001gɖ~Exim Auth failed2025-03-06 18:05:10 dovecot_plain authenticator failed for ([175.145.232.217]) [175.145.232.217]:52126: 535 Incorrect authentication data (set_id=sales)175.145.232.2171733045a~  -S# ossec13001gɖrExim Auth failed2025-03-06 18:04:58 dovecot_plain authenticator failed for ([61.233.4.50]) [61.233.4.50]:35675: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)61.233.4.501814991v}  -{% ossec13001gɖ\Exim Auth failed2025-03-06 18:04:35 dovecot_plain authenticator failed for 111-70-13-24.emome-ip.hinet.net [111.70.13.24]:54765: 535 Incorrect authentication data (set_id=services@heipowersystem.com)111.70.13.241668284 ^)5 W Z 0?^]  -C+ ossec13001gɤExim Auth failed2025-03-06 19:06:09 dovecot_plain authenticator failed for ([190.211.250.118]) [190.211.250.122]:36561: 535 Incorrect authentication data (set_id=services)190.211.250.1223895114m  -e) ossec13001gɤExim Auth failed2025-03-06 19:05:36 dovecot_plain authenticator failed for ([218.23.156.227]) [218.23.156.227]:56550: 535 Incorrect authentication data (set_id=services@heipowersystem.com)218.23.156.2271814991e  -U) ossec13001gɤExim Auth failed2025-03-06 19:05:12 dovecot_plain authenticator failed for (136-34-165-114.googlefiber.net) [136.34.165.114]:47764: 535 Incorrect authentication data (set_id=sales)136.34.165.1146252001g  -[' ossec13001gɤExim Auth failed2025-03-06 19:04:59 dovecot_plain authenticator failed for ([31.173.66.222]) [31.173.66.222]:48218: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)31.173.66.2222017370  -% ossec13001gɣExim Auth failed2025-03-06 19:01:15 dovecot_plain authenticator failed for vps-79f20bfc.vps.ovh.net ([87.98.249.193]) [51.75.24.107]:4173: 535 Incorrect authentication data (set_id=services@heipowersystem.com)51.75.24.1073017382T  -5' ossec13001gɢwExim Auth failed2025-03-06 18:56:15 dovecot_plain authenticator failed for ([89.101.36.159]) [89.101.36.159]:35371: 535 Incorrect authentication data (set_id=sales)89.101.36.1592963597i  -_) ossec13001gɢaExim Auth failed2025-03-06 18:55:53 dovecot_plain authenticator failed for ([81.181.129.233]) [81.181.129.233]:52326: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)81.181.129.233798549  -' ossec13001gɡ+Exim Auth failed2025-03-06 18:50:43 dovecot_plain authenticator failed for (172-125-13-11.lightspeed.rcsntx.sbcglobal.net) [172.125.13.11]:58776: 535 Incorrect authentication data (set_id=services@heipowersystem.com)172.125.13.116252001i  -]) ossec13001gɠExim Auth failed2025-03-06 18:48:13 dovecot_plain authenticator failed for syn-070-122-139-172.res.spectrum.com [70.122.139.172]:54911: 535 Incorrect authentication data (set_id=sales)70.122.139.1726252001j  -a) ossec13001gɠExim Auth failed2025-03-06 18:47:52 dovecot_plain authenticator failed for ([185.134.179.106]) [185.101.16.250]:55377: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)185.101.16.250272103_  -M% ossec13001gɟwExim Auth failed2025-03-06 18:43:25 dovecot_plain authenticator failed for 89-109-4-133.dynamic.mts-nn.ru [89.109.4.133]:59456: 535 Incorrect authentication data (set_id=sales)89.109.4.1332017370g  -[' ossec13001gɟbExim Auth failed2025-03-06 18:43:06 dovecot_plain authenticator failed for ([46.52.204.227]) [46.52.204.227]:54411: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)46.52.204.2272017370T  -5' ossec13001gɟJExim Auth failed2025-03-06 18:42:42 dovecot_plain authenticator failed for ([220.85.251.16]) [220.85.251.16]:52786: 535 Incorrect authentication data (set_id=sales)220.85.251.161835841y  -}) ossec13001gɟ>Exim Auth failed2025-03-06 18:42:30 dovecot_plain authenticator failed for 46-162-112-159.cust.bredband2.com [46.162.112.159]:37774: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)46.162.112.1592661886Z  -?) ossec13001gɞExim Auth failed2025-03-06 18:39:41 dovecot_plain authenticator failed for ([121.189.226.81]) [121.189.226.81]:37724: 535 Incorrect authentication data (set_id=services)121.189.226.811835841p  -i+ ossec13001gɞtExim Auth failed2025-03-06 18:39:07 dovecot_plain authenticator failed for ([222.236.155.146]) [222.236.155.146]:53591: 535 Incorrect authentication data (set_id=services@heipowersystem.com)222.236.155.1461835841S  -5' ossec13001gɝ6Exim Auth failed2025-03-06 18:33:49 dovecot_plain authenticator failed for ([91.239.23.149]) [91.239.23.149]:40706: 535 Incorrect authentication data (set_id=sales)91.239.23.149458258 p = / Z i 4\Zpf/  -W) ossec13001gɬExim Auth failed2025-03-06 19:40:05 dovecot_plain authenticator failed for c83-254-215-116.bredband.tele2.se [83.254.215.116]:39164: 535 Incorrect authentication data (set_id=sales)83.254.215.1162661886~.  - % ossec13001gɬExim Auth failed2025-03-06 19:39:29 dovecot_plain authenticator failed for vps-79f20bfc.vps.ovh.net ([87.98.249.193]) [51.75.24.107]:29712: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)51.75.24.1073017382T-  -7% ossec13001gɬ~Exim Auth failed2025-03-06 19:39:01 dovecot_plain authenticator failed for ([218.68.0.210]) [218.68.0.210]:46676: 535 Incorrect authentication data (set_id=services)218.68.0.2101814991c,  -Y# ossec13001gɬpExim Auth failed2025-03-06 19:38:48 dovecot_plain authenticator failed for ([91.221.7.13]) [91.221.7.13]:49790: 535 Incorrect authentication data (set_id=services@heipowersystem.com)91.221.7.13690791]+  -C+ ossec13001gɪExim Auth failed2025-03-06 19:31:29 dovecot_plain authenticator failed for ([119.198.191.130]) [119.198.191.130]:35278: 535 Incorrect authentication data (set_id=services)119.198.191.1301835841j*  -a' ossec13001gɪExim Auth failed2025-03-06 19:31:07 dovecot_plain authenticator failed for ([49.124.153.16]) [49.124.153.16]:48936: 535 Incorrect authentication data (set_id=services@heipowersystem.com)49.124.153.161733045T)  -5' ossec13001gɩExim Auth failed2025-03-06 19:27:08 dovecot_plain authenticator failed for ([120.253.31.84]) [120.253.31.84]:32884: 535 Incorrect authentication data (set_id=sales)120.253.31.841814991j(  -_) ossec13001gɩExim Auth failed2025-03-06 19:26:56 dovecot_plain authenticator failed for ([111.171.125.94]) [111.171.125.94]:50489: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)111.171.125.941835841c'  -W# ossec13001gɨExim Auth failed2025-03-06 19:24:02 dovecot_plain authenticator failed for syn-071-090-034-032.res.spectrum.com [71.90.34.32]:60427: 535 Incorrect authentication data (set_id=sales)71.90.34.326252001g&  -[' ossec13001gɨExim Auth failed2025-03-06 19:23:43 dovecot_plain authenticator failed for ([103.183.11.30]) [103.183.11.30]:33814: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)103.183.11.301643084c%  -Q) ossec13001gɨ Exim Auth failed2025-03-06 19:20:04 dovecot_plain authenticator failed for 245.134.20.178.in-addr.arpa [178.20.134.245]:60562: 535 Incorrect authentication data (set_id=services)178.20.134.2452017370m$  -e) ossec13001gɧExim Auth failed2025-03-06 19:19:49 dovecot_plain authenticator failed for ([121.189.226.81]) [121.189.226.81]:52978: 535 Incorrect authentication data (set_id=services@heipowersystem.com)121.189.226.811835841Q#  -1% ossec13001gɧExim Auth failed2025-03-06 19:15:52 dovecot_login authenticator failed for ([191.59.165.4]) [191.59.165.4]:39566: 535 Incorrect authentication data (set_id=sales)191.59.165.43469034 "  -) ossec13001gɧExim Auth failed2025-03-06 19:15:42 dovecot_login authenticator failed for (ip-103-133.222-205.cloudteknologinusantara.co.id) [125.163.69.149]:58172: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)125.163.69.1491643084Z!  -?) ossec13001gɦExim Auth failed2025-03-06 19:15:27 dovecot_plain authenticator failed for ([123.209.194.49]) [123.209.194.49]:57740: 535 Incorrect authentication data (set_id=services)123.209.194.492077456y  -{+ ossec13001gɦExim Auth failed2025-03-06 19:15:15 dovecot_plain authenticator failed for 131.sub-166-143-166.myvzw.com [166.143.166.131]:2875: 535 Incorrect authentication data (set_id=services@heipowersystem.com)166.143.166.1316252001d  -W% ossec13001gɦExim Auth failed2025-03-06 19:11:35 dovecot_plain authenticator failed for ([144.48.49.72]) [144.48.49.72]:56697: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)144.48.49.721269750 ! 3 U S { .Sel@  -e' ossec13001gɵExim Auth failed2025-03-06 20:19:04 dovecot_plain authenticator failed for ([128.185.221.134]) [27.123.81.134]:55066: 535 Incorrect authentication data (set_id=services@heipowersystem.com)27.123.81.1341269750T?  -5' ossec13001gɳ.Exim Auth failed2025-03-06 20:07:32 dovecot_plain authenticator failed for ([103.48.194.21]) [103.48.194.21]:55550: 535 Incorrect authentication data (set_id=sales)103.48.194.211562822j>  -_) ossec13001gɳExim Auth failed2025-03-06 20:07:16 dovecot_plain authenticator failed for ([218.108.143.34]) [218.108.143.34]:55660: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)218.108.143.341814991W=  -;' ossec13001gɲExim Auth failed2025-03-06 20:06:02 dovecot_plain authenticator failed for ([91.122.31.214]) [91.122.31.214]:41148: 535 Incorrect authentication data (set_id=services)91.122.31.2142017370j<  -a' ossec13001gɲExim Auth failed2025-03-06 20:05:46 dovecot_plain authenticator failed for ([120.194.50.39]) [120.194.50.39]:14434: 535 Incorrect authentication data (set_id=services@heipowersystem.com)120.194.50.391814991T;  -5' ossec13001gɲzExim Auth failed2025-03-06 20:04:33 dovecot_plain authenticator failed for ([220.122.115.9]) [220.122.115.9]:46396: 535 Incorrect authentication data (set_id=sales)220.122.115.91835841p:  -q# ossec13001gɲ`Exim Auth failed2025-03-06 20:04:06 dovecot_plain authenticator failed for 111-70-32-6.emome-ip.hinet.net [111.70.32.6]:36883: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)111.70.32.61668284g9  -]% ossec13001gɰExim Auth failed2025-03-06 19:57:49 dovecot_plain authenticator failed for ([14.39.98.157]) [14.39.98.157]:52683: 535 Incorrect authentication data (set_id=services@heipowersystem.com)14.39.98.1571835841W8  -;' ossec13001gɰ_Exim Auth failed2025-03-06 19:55:34 dovecot_plain authenticator failed for ([195.24.215.70]) [195.24.215.70]:60824: 535 Incorrect authentication data (set_id=services)195.24.215.7022333877  - ) ossec13001gɰIExim Auth failed2025-03-06 19:55:12 dovecot_plain authenticator failed for 123-193-152-64.dynamic.kbronet.com.tw [123.193.152.64]:57776: 535 Incorrect authentication data (set_id=services@heipowersystem.com)123.193.152.641668284E6  -' ossec13001gɰ?Exim Auth failed2025-03-06 19:55:02 dovecot_plain authenticator failed for ([154.127.90.34]) [154.127.90.34]:38933: 535 Incorrect authentication data154.127.90.342440476T5  -5' ossec13001gɰExim Auth failed2025-03-06 19:54:24 dovecot_plain authenticator failed for ([14.48.227.118]) [14.48.227.118]:36258: 535 Incorrect authentication data (set_id=sales)14.48.227.1181835841~4  -) ossec13001gɰ Exim Auth failed2025-03-06 19:54:11 dovecot_plain authenticator failed for net-188-152-225-58.cust.vodafonedsl.it [188.152.225.58]:44413: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)188.152.225.583175395Z3  -?) ossec13001gɮuExim Auth failed2025-03-06 19:47:24 dovecot_plain authenticator failed for ([37.151.212.229]) [37.151.212.229]:49664: 535 Incorrect authentication data (set_id=services)37.151.212.2291522867j2  -a' ossec13001gɮiExim Auth failed2025-03-06 19:47:12 dovecot_plain authenticator failed for ([125.21.141.54]) [125.21.141.54]:57942: 535 Incorrect authentication data (set_id=services@heipowersystem.com)125.21.141.541269750j1  -_) ossec13001gɭJExim Auth failed2025-03-06 19:42:25 dovecot_plain authenticator failed for (138.219.244.10.static.softdados.net) [177.128.209.48]:35942: 535 Incorrect authentication data (set_id=sales)177.128.209.483469034m0  -c+ ossec13001gɭ>Exim Auth failed2025-03-06 19:42:13 dovecot_plain authenticator failed for ([116.148.186.186]) [116.148.186.186]:57202: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)116.148.186.1861814991 U, ; O ^ p ||FUmQ  -e) ossec13001gɻExim Auth failed2025-03-06 20:45:04 dovecot_plain authenticator failed for ([112.111.61.232]) [112.111.61.229]:54478: 535 Incorrect authentication data (set_id=services@heipowersystem.com)112.111.61.2291814991TP  -5' ossec13001gɻExim Auth failed2025-03-06 20:43:53 dovecot_plain authenticator failed for ([118.38.239.52]) [118.38.239.52]:50776: 535 Incorrect authentication data (set_id=sales)118.38.239.521835841fO  -[' ossec13001gɻExim Auth failed2025-03-06 20:43:40 dovecot_plain authenticator failed for ([91.75.105.190]) [91.75.105.190]:59519: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)91.75.105.190290557eN  -S+ ossec13001gɻFExim Auth failed2025-03-06 20:42:06 dovecot_login authenticator failed for ([115.144.115.150]) [115.144.115.150]:44133: 535 Incorrect authentication data (set_id=vikas.khandelwal)115.144.115.1501835841xM  -y+ ossec13001gɻ<Exim Auth failed2025-03-06 20:41:56 dovecot_login authenticator failed for ([163.204.112.147]) [163.204.112.147]:38548: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)163.204.112.1471814991WL  -;' ossec13001gɻ$Exim Auth failed2025-03-06 20:41:31 dovecot_plain authenticator failed for ([211.109.75.68]) [211.109.75.69]:55503: 535 Incorrect authentication data (set_id=services)211.109.75.691835841iK  -a' ossec13001gɻExim Auth failed2025-03-06 20:41:13 dovecot_plain authenticator failed for ([102.33.36.254]) [102.33.36.254]:50614: 535 Incorrect authentication data (set_id=services@heipowersystem.com)102.33.36.254953987]J  -G' ossec13001gɹExim Auth failed2025-03-06 20:36:00 dovecot_login authenticator failed for 83.106.54.198.in-addr.arpa [198.54.106.83]:52780: 535 Incorrect authentication data (set_id=sales)198.54.106.836252001bI  -W% ossec13001gɹExim Auth failed2025-03-06 20:35:48 dovecot_login authenticator failed for ([65.20.251.53]) [65.20.251.53]:56313: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)65.20.251.5399237|H  -) ossec13001gɸExim Auth failed2025-03-06 20:32:10 dovecot_plain authenticator failed for 166.46.246.220.static.netvigator.com [220.246.46.166]:53118: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)220.246.46.1661819730pG  -i+ ossec13001gɸ{Exim Auth failed2025-03-06 20:30:11 dovecot_plain authenticator failed for ([183.224.122.114]) [183.224.122.114]:44504: 535 Incorrect authentication data (set_id=services@heipowersystem.com)183.224.122.1141814991jF  -_) ossec13001gɷExim Auth failed2025-03-06 20:27:52 dovecot_plain authenticator failed for ([117.53.254.144]) [117.53.254.144]:39849: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)117.53.254.1441835841mE  -c+ ossec13001gɷExim Auth failed2025-03-06 20:28:02 dovecot_plain authenticator failed for 123-195-225-182.dynamic.kbronet.com.tw [123.195.225.182]:33966: 535 Incorrect authentication data (set_id=sales)123.195.225.1821668284hD  -[) ossec13001gɶYExim Auth failed2025-03-06 20:21:05 dovecot_plain authenticator failed for 50708de6.static.ziggozakelijk.nl [80.112.141.230]:44578: 535 Incorrect authentication data (set_id=services)80.112.141.2302750405mC  -e) ossec13001gɶOExim Auth failed2025-03-06 20:20:54 dovecot_plain authenticator failed for ([175.125.68.208]) [175.125.68.208]:37922: 535 Incorrect authentication data (set_id=services@heipowersystem.com)175.125.68.2081835841_B  -M% ossec13001gɶExim Auth failed2025-03-06 20:19:38 dovecot_plain authenticator failed for (undefined.hostname.localhost) [103.90.97.98]:58260: 535 Incorrect authentication data (set_id=sales)103.90.97.981269750mA  -c+ ossec13001gɵExim Auth failed2025-03-06 20:19:27 dovecot_plain authenticator failed for ([197.251.194.251]) [197.251.194.251]:38614: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)197.251.194.2512300660 .  ) 5 E Z|+.yb  -}) ossec13001gƧExim Auth failed2025-03-06 21:30:38 dovecot_plain authenticator failed for (ws60-209.199.103.rcil.gov.in) [103.199.209.60]:47978: 535 Incorrect authentication data (set_id=services@heipowersystem.com)103.199.209.601269750ja  -_) ossec13001grExim Auth failed2025-03-06 21:21:14 dovecot_plain authenticator failed for ([168.126.90.210]) [168.126.90.210]:60663: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)168.126.90.2101835841`  - ) ossec13001g&Exim Auth failed2025-03-06 21:19:58 dovecot_plain authenticator failed for syn-172-100-186-071.res.spectrum.com [172.100.186.71]:60644: 535 Incorrect authentication data (set_id=services@heipowersystem.com)172.100.186.716252001h_  -_% ossec13001gExim Auth failed2025-03-06 21:10:53 dovecot_plain authenticator failed for syn-137-027-032-070.biz.spectrum.com [137.27.32.70]:38860: 535 Incorrect authentication data (set_id=services)137.27.32.706252001i^  -a' ossec13001gExim Auth failed2025-03-06 21:10:36 dovecot_plain authenticator failed for ([94.204.100.40]) [94.204.100.40]:37054: 535 Incorrect authentication data (set_id=services@heipowersystem.com)94.204.100.40290557T]  -5' ossec13001gExim Auth failed2025-03-06 21:09:40 dovecot_plain authenticator failed for ([146.88.78.123]) [146.88.78.123]:49420: 535 Incorrect authentication data (set_id=sales)146.88.78.1231694008z\  -' ossec13001gExim Auth failed2025-03-06 21:09:30 dovecot_plain authenticator failed for syn-024-090-169-209.res.spectrum.com [24.90.169.209]:54389: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)24.90.169.2096252001T[  -7% ossec13001gExim Auth failed2025-03-06 21:04:26 dovecot_plain authenticator failed for ([103.52.32.76]) [103.52.32.76]:33111: 535 Incorrect authentication data (set_id=services)103.52.32.761269750UZ  -7' ossec13001gExim Auth failed2025-03-06 21:04:33 dovecot_plain authenticator failed for ([218.106.120.18]) [58.49.113.138]:17768: 535 Incorrect authentication data (set_id=sales)58.49.113.1381814991ZY  -=+ ossec13001gqExim Auth failed2025-03-06 21:04:09 dovecot_plain authenticator failed for ([103.146.233.100]) [103.146.233.100]:38354: 535 Incorrect authentication data (set_id=sales)103.146.233.1001269750gX  -[' ossec13001g_Exim Auth failed2025-03-06 21:03:50 dovecot_plain authenticator failed for ([41.216.169.13]) [41.216.169.13]:50308: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)41.216.169.132328926lW  -e) ossec13001gsExim Auth failed2025-03-06 21:04:11 dovecot_plain authenticator failed for ([94.204.230.214]) [94.204.230.214]:51665: 535 Incorrect authentication data (set_id=services@heipowersystem.com)94.204.230.214290557pV  -i+ ossec13001gɿ#Exim Auth failed2025-03-06 20:58:33 dovecot_plain authenticator failed for ([103.186.221.174]) [103.186.221.174]:51694: 535 Incorrect authentication data (set_id=services@heipowersystem.com)103.186.221.1741269750dU  -S) ossec13001gɿ-Exim Auth failed2025-03-06 20:58:45 dovecot_plain authenticator failed for 17.sub-166-248-194.myvzw.com [166.248.194.17]:62476: 535 Incorrect authentication data (set_id=services)166.248.194.176252001}T  -) ossec13001gɾmExim Auth failed2025-03-06 20:55:32 dovecot_plain authenticator failed for 123-193-152-64.dynamic.kbronet.com.tw [123.193.152.64]:55578: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)123.193.152.641668284S  - ) ossec13001gɼExim Auth failed2025-03-06 20:47:49 dovecot_plain authenticator failed for broadband-188-255-34-171.ip.moscow.rt.ru [188.255.34.171]:56594: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)188.255.34.1712017370fR  -W) ossec13001gɼExim Auth failed2025-03-06 20:45:15 dovecot_plain authenticator failed for (ws60-209.199.103.rcil.gov.in) [103.199.209.60]:49706: 535 Incorrect authentication data (set_id=services)103.199.209.601269750 }pcVI</"yl_RE8+~qdWJ=0# zm`SF9, v i \ O B 5 (     r e X K > 1 $  { n a T G : -   w j ] P C 6 )    s f Y L ? 2 %  |obUH;.!xk^QD7*tgZM@3& uh[NA4' ~qdWJ=0? 6252001*I 6252001# 6252001# 6252001# 6252001# 6252001# 6252001# 6252001#{ 6252001#y 6252001#" 6252001# 6252001# 6252001# 6252001# 6252001# 6252001" 6252001" 6252001" 6252001" 6252001" 6252001" 6252001" 6252001" 6252001" 6252001" 6252001" 6252001" 6252001"| 6252001"u 6252001"i 6252001"b 6252001"X 6252001"L 6252001"C 6252001*H 6252001*> 6252001*2 6252001*- 6252001*& 6252001*! 6252001* 6252001* 6252001* 6252001* 6252001* 6252001* 6252001) 6252001) 6252001) 6252001) 6252001) 6252001) 6252001) 6252001) 6252001) 6252001) 6252001) 6252001)y 6252001)s 6252001)j 6252001)f 6252001)Z 6252001)X 6252001)W 6252001)V 6252001)T 6252001)D 6252001)5 6252001)/ 6252001). 6252001), 6252001) 6252001) 6252001) 6252001) 6252001) 6252001) 6252001( 6252001( 6252001( 6252001( 6252001( 6252001( 6252001( 6252001( 6252001( 6252001( 6252001( 6252001( 6252001( 6252001(t 6252001(j 6252001(d 6252001(O 6252001(N 6252001(3 6252001(0 6252001( 6252001( 6252001( 6252001' 6252001' 6252001' 6252001' 6252001' 6252001' 6252001' 6252001' 6252001'v 6252001'q 6252001'g 6252001'\ 6252001'U 6252001'I 6252001'H 6252001'F 6252001'D 6252001'B 6252001'A 6252001'? 6252001' 6252001' 6252001' 6252001' 6252001' 6252001' 6252001' 6252001' 6252001' 6252001' 6252001& 6252001& 6252001& 6252001& 6252001& 6252001& 6252001& 6252001& 6252001& 6252001& 6252001& 6252001& 6252001& 6252001& 6252001& 6252001& 6252001&} 6252001&| 6252001&v 6252001&i 6252001&d 6252001&c 6252001&a 6252001&` 6252001&Z 6252001&W 6252001&C 6252001&A 6252001&8 6252001&7 6252001&. 6252001& 6252001& 6252001& 6252001& 6252001% 6252001% 6252001% 6252001% 6252001% 6252001% 6252001% 6252001% 6252001% 6252001% 6252001% 6252001% 6252001% 6252001% 6252001%{ 6252001%y 6252001%x 6252001%i 6252001%f 6252001%Z 6252001%R 6252001%K 6252001%D 6252001%@ 6252001%8 6252001$ 6252001$ 6252001$ 6252001$ 6252001$ 6252001$ 6252001$ 6252001$ 6252001$ 6252001$ 6252001$ 6252001$ 6252001$ 6252001$ 6252001$ 6252001$ 6252001$ 6252001$ 6252001$ 6252001$ 6252001$ 6252001$ 6252001$y 6252001$v 6252001$a 6252001$I 6252001$F 6252001$8 6252001$3 6252001$ 6252001$ 6252001$ 6252001$ 6252001# 6252001# 6252001# 6252001# 6252001# 6252001# 6252001# 6252001# 6252001# 6252001# 6252001# 6252001# 6252001# 6252001# 6252001# 6252001#  + = b w Iuxmr  -e) ossec13001gJExim Auth failed2025-03-06 21:50:25 dovecot_plain authenticator failed for ([191.210.87.101]) [191.210.87.101]:60753: 535 Incorrect authentication data (set_id=services@heipowersystem.com)191.210.87.1013469034lq  -a+ ossec13001gxExim Auth failed2025-03-06 21:51:11 dovecot_login authenticator failed for 165.199.148.122.sta.wbroadband.net.au [122.148.199.165]:34109: 535 Incorrect authentication data (set_id=sales)122.148.199.1652077456Wp  -9) ossec13001glExim Auth failed2025-03-06 21:50:59 dovecot_login authenticator failed for ([220.80.192.168]) [220.80.192.168]:33226: 535 Incorrect authentication data (set_id=sales)220.80.192.1681835841eo  -Y% ossec13001glExim Auth failed2025-03-06 21:50:59 dovecot_login authenticator failed for syn-072-017-090-246.biz.spectrum.com [72.17.90.246]:58600: 535 Incorrect authentication data (set_id=sales)72.17.90.2466252001Zn  -?) ossec13001gbExim Auth failed2025-03-06 21:50:49 dovecot_plain authenticator failed for ([222.116.48.103]) [222.116.48.103]:38397: 535 Incorrect authentication data (set_id=services)222.116.48.1031835841 m  -#+ ossec13001gbExim Auth failed2025-03-06 21:50:50 dovecot_login authenticator failed for (abts-kk-static-226.253.166.122.airtelbroadband.in) [122.166.253.226]:52494: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)122.166.253.2261269750l  -+ ossec13001g\Exim Auth failed2025-03-06 21:50:44 dovecot_login authenticator failed for (203.173.209.139.adsl-pool.jlccptt.net.cn) [139.209.173.203]:19430: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)139.209.173.2031814991`k  -S# ossec13001gRExim Auth failed2025-03-06 21:50:34 dovecot_login authenticator failed for ([91.74.30.24]) [91.74.30.24]:51027: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)91.74.30.24290557Pj  -3# ossec13001g0Exim Auth failed2025-03-06 21:45:42 dovecot_plain authenticator failed for ([95.0.252.72]) [95.0.252.72]:57168: 535 Incorrect authentication data (set_id=services)95.0.252.72298795*i  =O) ossec13008g$Mail Reciepient rejected2025-03-06 21:45:30 H=(mail.msnews24.in) [165.154.210.93]:54425 F= rejected RCPT : Rejected relay attempt: '165.154.210.93' From: 'qhwqzvctv@msnews24.in' To: 'goofile@fastmail.com'165.154.210.931694008gh  -]% ossec13001gExim Auth failed2025-03-06 21:45:25 dovecot_plain authenticator failed for ([14.37.206.76]) [14.37.206.76]:33784: 535 Incorrect authentication data (set_id=services@heipowersystem.com)14.37.206.761835841Wg  -9) ossec13001g`Exim Auth failed2025-03-06 21:42:15 dovecot_plain authenticator failed for ([221.10.221.104]) [221.10.221.104]:41791: 535 Incorrect authentication data (set_id=sales)221.10.221.1041814991jf  -_) ossec13001gTExim Auth failed2025-03-06 21:42:03 dovecot_plain authenticator failed for ([123.209.107.18]) [123.209.107.18]:38478: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)123.209.107.182077456je  -_) ossec13001gDZExim Auth failed2025-03-06 21:35:04 dovecot_plain authenticator failed for ([220.77.245.227]) [220.77.245.227]:40920: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)220.77.245.2271835841fd  -Y' ossec13001gaExim Auth failed2025-03-06 21:33:45 dovecot_login authenticator failed for 111-70-39-163.emome-ip.hinet.net [111.70.39.163]:33265: 535 Incorrect authentication data (set_id=services)111.70.39.1631668284yc  -' ossec13001g3Exim Auth failed2025-03-06 21:32:58 dovecot_login authenticator failed for wsip-174-79-91-142.br.br.cox.net [174.79.91.142]:50421: 535 Incorrect authentication data (set_id=services@heipowersystem.com)174.79.91.1426252001   D G h w T]so  -i) ossec13001g|Exim Auth failed2025-03-06 22:16:51 dovecot_plain authenticator failed for (broadband-37.204-170-200.ip.moscow.rt.ru) [37.204.170.200]:35125: 535 Incorrect authentication data (set_id=sales)37.204.170.2002017370g  -[' ossec13001gpExim Auth failed2025-03-06 22:16:39 dovecot_plain authenticator failed for ([45.250.249.12]) [45.250.249.12]:53632: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)45.250.249.121269750j  -_) ossec13001gXExim Auth failed2025-03-06 22:16:14 dovecot_plain authenticator failed for ([61.145.163.164]) [61.145.163.164]:39737: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)61.145.163.1641814991Z  -?) ossec13001gюExim Auth failed2025-03-06 22:17:08 dovecot_plain authenticator failed for ([112.168.71.109]) [112.168.71.109]:35206: 535 Incorrect authentication data (set_id=services)112.168.71.1091835841|~  -' ossec13001gфExim Auth failed2025-03-06 22:16:58 dovecot_plain authenticator failed for syn-097-086-134-216.res.spectrum.com [97.86.134.216]:3928: 535 Incorrect authentication data (set_id=services@heipowersystem.com)97.86.134.2166252001f}  -]% ossec13001gExim Auth failed2025-03-06 22:10:05 dovecot_plain authenticator failed for ([194.28.91.40]) [194.28.91.40]:41780: 535 Incorrect authentication data (set_id=services@heipowersystem.com)194.28.91.40690791f|  -W) ossec13001gχExim Auth failed2025-03-06 22:08:31 dovecot_login authenticator failed for ([218.150.170.10]) [218.150.170.10]:50382: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)218.150.170.101835841s{  -u% ossec13001gyExim Auth failed2025-03-06 22:08:17 dovecot_login authenticator failed for ([12.202.15.69]) [12.202.15.69]:29350: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)12.202.15.6962520017z  =i) ossec13008gMail Reciepient rejected2025-03-06 22:05:44 H=(mail.nyaystambh.com) [165.154.233.84]:65396 F= rejected RCPT : Rejected relay attempt: '165.154.233.84' From: 'lghmrwflvwa@nyaystambh.com' To: 'goofile@fastmail.com'165.154.233.841694008dy  -S) ossec13001geExim Auth failed2025-03-06 22:03:40 dovecot_login authenticator failed for (ip-20-192.datautama.net.id) [112.109.20.192]:60004: 535 Incorrect authentication data (set_id=services)112.109.20.1921643084mx  -e) ossec13001gEExim Auth failed2025-03-06 22:03:09 dovecot_login authenticator failed for ([118.36.234.156]) [118.36.234.156]:51794: 535 Incorrect authentication data (set_id=services@heipowersystem.com)118.36.234.1561835841[w  -C) ossec13001gExim Auth failed2025-03-06 22:02:19 dovecot_plain authenticator failed for (nl188-lv.zamnet.zm) [196.46.203.188]:45671: 535 Incorrect authentication data (set_id=services)196.46.203.188895949yv  -% ossec13001gExim Auth failed2025-03-06 22:01:47 dovecot_plain authenticator failed for static-84-242-88-70.bb.vodafone.cz [84.242.88.70]:41780: 535 Incorrect authentication data (set_id=services@heipowersystem.com)84.242.88.703077311Tu  -5' ossec13001g8Exim Auth failed2025-03-06 21:54:23 dovecot_plain authenticator failed for ([121.154.90.47]) [121.154.90.47]:56032: 535 Incorrect authentication data (set_id=sales)121.154.90.471835841mt  -c+ ossec13001g*Exim Auth failed2025-03-06 21:54:10 dovecot_plain authenticator failed for ([124.197.135.208]) [124.197.135.208]:35462: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)124.197.135.2081835841os  -o# ossec13001g˲Exim Auth failed2025-03-06 21:52:10 dovecot_plain authenticator failed for 95-31-6-109.static.corbina.ru [95.31.6.109]:56950: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)95.31.6.1092017370 ( * O U j !COn"  3M% ossec11301gLNew FTP connection.Mar 6 22:54:27 vm1 pure-ftpd[2750405]: (?@94.102.56.99) [INFO] New connection from 94.102.56.9994.102.56.992750405]  -C+ ossec13001g Exim Auth failed2025-03-06 22:53:21 dovecot_plain authenticator failed for ([154.144.230.118]) [154.144.230.118]:35335: 535 Incorrect authentication data (set_id=services)154.144.230.1182542007p  -i+ ossec13001gExim Auth failed2025-03-06 22:53:11 dovecot_plain authenticator failed for ([183.236.165.203]) [183.236.165.203]:59109: 535 Incorrect authentication data (set_id=services@heipowersystem.com)183.236.165.2031814991Z  -?) ossec13001g+Exim Auth failed2025-03-06 22:45:23 dovecot_plain authenticator failed for ([128.185.224.87]) [152.52.243.154]:41868: 535 Incorrect authentication data (set_id=services)152.52.243.1541269750j  -a' ossec13001gExim Auth failed2025-03-06 22:45:00 dovecot_plain authenticator failed for ([220.122.115.9]) [220.122.115.9]:41451: 535 Incorrect authentication data (set_id=services@heipowersystem.com)220.122.115.91835841c  -U% ossec13001gExim Auth failed2025-03-06 22:44:53 dovecot_plain authenticator failed for ([58.131.97.5]) [180.88.96.37]:16376: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)180.88.96.371814991m  -e) ossec13001g"Exim Auth failed2025-03-06 22:45:12 dovecot_plain authenticator failed for ([114.247.207.98]) [114.247.207.98]:54767: 535 Incorrect authentication data (set_id=services@heipowersystem.com)114.247.207.981814991T  -5' ossec13001gExim Auth failed2025-03-06 22:45:05 dovecot_plain authenticator failed for ([118.38.239.52]) [118.38.239.52]:33198: 535 Incorrect authentication data (set_id=sales)118.38.239.521835841X  -;) ossec13001gExim Auth failed2025-03-06 22:35:14 dovecot_plain authenticator failed for ([125.16.12.73]) [128.185.253.90]:48482: 535 Incorrect authentication data (set_id=services)128.185.253.901269750m  -e) ossec13001gէExim Auth failed2025-03-06 22:34:39 dovecot_plain authenticator failed for ([41.159.145.190]) [41.159.145.190]:43471: 535 Incorrect authentication data (set_id=services@heipowersystem.com)41.159.145.1902400553Z  -=+ ossec13001g7Exim Auth failed2025-03-06 22:32:45 dovecot_plain authenticator failed for ([178.178.194.136]) [178.178.194.136]:37000: 535 Incorrect authentication data (set_id=sales)178.178.194.1362017370g  -[' ossec13001g)Exim Auth failed2025-03-06 22:32:31 dovecot_plain authenticator failed for ([89.101.36.159]) [89.101.36.159]:49677: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)89.101.36.1592963597v  -y' ossec13001gExim Auth failed2025-03-06 22:22:55 dovecot_plain authenticator failed for ([92.255.190.69]) [92.255.190.69]:38772: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)92.255.190.692017370W  -9) ossec13001gExim Auth failed2025-03-06 22:22:41 dovecot_plain authenticator failed for ([59.102.188.188]) [59.102.188.188]:45115: 535 Incorrect authentication data (set_id=sales)59.102.188.1881668284z  -' ossec13001gExim Auth failed2025-03-06 22:22:24 dovecot_plain authenticator failed for syn-131-148-000-202.biz.spectrum.com [131.148.0.202]:59837: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)131.148.0.2026252001c  -S' ossec13001gExim Auth failed2025-03-06 22:23:13 dovecot_plain authenticator failed for ([114.216.5.134]) [114.216.5.134]:38572: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)114.216.5.1341814991m  -e) ossec13001gExim Auth failed2025-03-06 22:23:07 dovecot_plain authenticator failed for ([218.98.160.117]) [218.98.160.117]:60170: 535 Incorrect authentication data (set_id=services@heipowersystem.com)218.98.160.1171814991 :~G \ O B 5 (     r e X K > 1 $  :VdW7t  q { n a T G : -   w j ] P C 6 )    s f Y L ? 2 %NA4' uE8yl_"I<c}  |obUH;.!/p*k^QD# dWJ~qh[+RgZM@3&x v izm`SF9,=0 2658434, 2635167O 26584346 26584345 2661886/ 2661886/ 26618862 2661886( 2661886 2661886 2661886 2661886~ 26618868 2661886 2661886m 2661886] 2661886 2661886 2661886 2661886p 2661886i 2661886c 2661886/ 2661886/ 2661886? 26618860e 26618861 2661886! 2661886 26618860l 2661886 26618860p 2661886 26584343 26618860 2661886 2661886 2661886 26618861s 2661886 2661886/ 26618861 2661886 2661886 2661886 A 2661886* 2661886*= 2661886*9 2661886)+ 26618862 26618862 266188626 26618862# 26618862 2661886 2661886* 2661886! 2661886!x 2661886* 2661886! 2661886! 2658434/ 2661886"! 2661886+# 2661886" 2661886"R 2661886"> 2661886+L 2658434- 2661886/ 2658434I 26618862 2661886+ 2661886+` 2661886+T 2658434> 26618864W 266188648 26618864( 26618863 26618863{ 26618863$ 26618863 2658434< 2658434< 26618864f 2658434; 26618865 26618864h 26584348~ 2661886+ 26584346 2661886+ 26584346 2661886, 2661886, 2661886,V 2661886, 26584346 2661886- 2661886-J 2661886-; 2661886- 26618866F 26618866, 26618865 2658434> 2661886(( 2661886' 2661886' 2661886& 2661886& 2661886&^ 2661886% 2661886% 2661886%k 2661886%: 2661886%7 2661886%6 2661886$ 2661886$q 2661886$` 2661886$1 2661886$$ 2661886$ 2661886# 2661886# 2661886# 2661886# 2661886#b 2661886#a 2661886#@ 2661886#1 2661886" 2661886" 2661886" 2661886 2661886 2661886 2661886a 2661886O 2661886H 2661886o 2661886 2661886^ 2661886 2661886 2661886 2661886 2661886 2661886 2661886 2661886 2661886Q 2661886 2661886 2661886 2661886 2661886J 2661886 2661886 2661886 2661886N 2661886J 2661886 2661886 2661886q 2661886m 26618866 2661886) 2661886 2661886 2661886 z 2661886 d 2661886 2661886 2661886  2661886  2661886 2 2661886 ( 2661886 2661886 Y 2661886 A 2661886 2 2661886 - 2661886 2661886 ) 2661886 2661886 2661886S 2661886R 2661886L 2658434+B 2658434+? 2658434' 2658434& 2658434$ 2658434# 2658434 T 2658434 2658434 2658434 2658434 2658434 2658434 2658434 2658434 2658434 2658434] 2658434 2658434 2658434 2658434 2658434S 2658434 2658434 + 2658434 2658434 Q 2658434 2658434 26618869v 26618869m 26618868 26618867 26618867 26618867l 26618867h 26618867$ 26618867 26618866w 2658434D 2658434D 2658434M 2661886? 2661886? 2661886? 2661886? 2661886?9 2661886> 2661886>+ 2661886> 2661886< 2661886< 2661886 2635167O 2658434O 2658434O  . 5 R g j6[^T$  -5' ossec13001gExim Auth failed2025-03-06 23:22:36 dovecot_plain authenticator failed for ([31.134.243.37]) [31.134.243.37]:52394: 535 Incorrect authentication data (set_id=sales)31.134.243.372017370y#  -}) ossec13001gExim Auth failed2025-03-06 23:22:25 dovecot_plain authenticator failed for 125-228-154-55.hinet-ip.hinet.net [125.228.154.55]:56937: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)125.228.154.551668284W"  -9) ossec13001g߻Exim Auth failed2025-03-06 23:17:38 dovecot_plain authenticator failed for ([110.77.137.236]) [110.77.137.236]:59478: 535 Incorrect authentication data (set_id=sales)110.77.137.2361605651d!  -W% ossec13001g߯Exim Auth failed2025-03-06 23:17:26 dovecot_plain authenticator failed for ([58.22.255.28]) [58.22.255.28]:54832: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)58.22.255.281814991W  -;' ossec13001gޑExim Auth failed2025-03-06 23:12:40 dovecot_plain authenticator failed for ([201.173.16.21]) [201.173.16.21]:59589: 535 Incorrect authentication data (set_id=services)201.173.16.213996063r  -q' ossec13001gރExim Auth failed2025-03-06 23:12:26 dovecot_login authenticator failed for ([124.160.45.26]) [124.160.45.26]:36566: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)124.160.45.261814991p  -i+ ossec13001gExim Auth failed2025-03-06 23:12:22 dovecot_plain authenticator failed for ([194.226.155.198]) [194.226.155.198]:52208: 535 Incorrect authentication data (set_id=services@heipowersystem.com)194.226.155.1982017370%  3Q' ossec11301gݟNew FTP connection.Mar 6 23:08:37 vm1 pure-ftpd[2753411]: (?@198.235.24.65) [INFO] New connection from 198.235.24.65198.235.24.656252001Z  -?) ossec13001gExim Auth failed2025-03-06 23:06:05 dovecot_plain authenticator failed for ([222.68.155.105]) [222.68.155.105]:53991: 535 Incorrect authentication data (set_id=services)222.68.155.1051814991/  =Y) ossec13008gMail Reciepient rejected2025-03-06 23:05:51 H=(mail.nyaystambh.com) [165.154.213.54]:58611 F= rejected RCPT : Rejected relay attempt: '165.154.213.54' From: 'jjiqgmm@nyaystambh.com' To: 'goofile@fastmail.com'165.154.213.543469034m  -e) ossec13001gExim Auth failed2025-03-06 23:05:34 dovecot_plain authenticator failed for ([111.48.214.102]) [111.48.214.102]:20258: 535 Incorrect authentication data (set_id=services@heipowersystem.com)111.48.214.1021814991U  -3+ ossec13001gExim Auth failed2025-03-06 22:57:47 dovecot_plain authenticator failed for (mail.bntb.bm) [207.228.168.194]:56300: 535 Incorrect authentication data (set_id=sales)207.228.168.1943573345g  -[' ossec13001gExim Auth failed2025-03-06 22:57:29 dovecot_plain authenticator failed for ([92.27.116.226]) [92.27.116.226]:57660: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)92.27.116.2262635167_  -K' ossec13001gExim Auth failed2025-03-06 22:57:29 dovecot_login authenticator failed for ([115.78.92.189]) [115.78.92.189]:43634: 535 Incorrect authentication data (set_id=vikas.khandelwal)115.78.92.1891562822u  -u) ossec13001gExim Auth failed2025-03-06 22:57:11 dovecot_login authenticator failed for ([112.176.249.35]) [112.176.249.35]:43199: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)112.176.249.351835841W  -9) ossec13001gExim Auth failed2025-03-06 22:56:23 dovecot_plain authenticator failed for ([41.159.145.190]) [41.159.145.190]:44407: 535 Incorrect authentication data (set_id=sales)41.159.145.1902400553s  -s' ossec13001gڴExim Auth failed2025-03-06 22:56:11 dovecot_plain authenticator failed for p5098d833.dip0.t-ipconnect.de [80.152.216.51]:28235: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)80.152.216.512921044  1 4 \ '#}c5  -W% ossec13001gExim Auth failed2025-03-06 23:55:17 dovecot_plain authenticator failed for ([185.167.58.9]) [185.167.58.9]:39842: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)185.167.58.9617790T4  -5' ossec13001gExim Auth failed2025-03-06 23:55:09 dovecot_plain authenticator failed for ([194.26.226.55]) [194.26.226.55]:53848: 535 Incorrect authentication data (set_id=sales)194.26.226.552017370t3  -u' ossec13001g|Exim Auth failed2025-03-06 23:54:59 dovecot_plain authenticator failed for (mamanguape.static.gvt.net.br) [177.207.248.5]:57869: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)177.207.248.53469034V2  -;' ossec13001gvExim Auth failed2025-03-06 23:54:53 dovecot_plain authenticator failed for ([185.167.56.34]) [185.167.56.34]:38932: 535 Incorrect authentication data (set_id=services)185.167.56.34617790p1  -i+ ossec13001ghExim Auth failed2025-03-06 23:54:39 dovecot_plain authenticator failed for ([125.140.244.144]) [125.140.244.144]:48712: 535 Incorrect authentication data (set_id=services@heipowersystem.com)125.140.244.1441835841"0  3M% ossec11301g New FTP connection.Mar 6 23:40:15 vm1 pure-ftpd[2760080]: (?@64.62.156.68) [INFO] New connection from 64.62.156.6864.62.156.686252001/  - ) ossec13001gExim Auth failed2025-03-06 23:39:56 dovecot_plain authenticator failed for (63.230.182.190.unassigned.ridsa.com.ar) [190.182.230.63]:48464: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)190.182.230.633865483[.  -A) ossec13001gExim Auth failed2025-03-06 23:39:48 dovecot_plain authenticator failed for ([101.230.251.217]) [180.154.53.221]:36405: 535 Incorrect authentication data (set_id=services)180.154.53.2211814991l-  -e) ossec13001gExim Auth failed2025-03-06 23:39:35 dovecot_plain authenticator failed for ([196.46.203.188]) [196.46.203.188]:43101: 535 Incorrect authentication data (set_id=services@heipowersystem.com)196.46.203.188895949c,  -S' ossec13001giExim Auth failed2025-03-06 23:37:36 dovecot_plain authenticator failed for 111-70-39-163.emome-ip.hinet.net [111.70.39.163]:50373: 535 Incorrect authentication data (set_id=sales)111.70.39.1631668284b+  -W% ossec13001gSExim Auth failed2025-03-06 23:37:14 dovecot_plain authenticator failed for ([65.20.128.78]) [65.20.128.78]:55984: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)65.20.128.7899237j*  -a' ossec13001gEExim Auth failed2025-03-06 23:36:59 dovecot_plain authenticator failed for ([14.53.126.112]) [14.53.126.112]:46148: 535 Incorrect authentication data (set_id=services@heipowersystem.com)14.53.126.1121835841')  3U) ossec11301gNew FTP connection.Mar 6 23:36:18 vm1 pure-ftpd[2759179]: (?@185.247.137.46) [INFO] New connection from 185.247.137.46185.247.137.46298795T(  -7% ossec13001gHExim Auth failed2025-03-06 23:32:47 dovecot_plain authenticator failed for ([103.7.183.17]) [103.7.183.17]:50958: 535 Incorrect authentication data (set_id=services)103.7.183.171269750y'  -' ossec13001g6Exim Auth failed2025-03-06 23:32:29 dovecot_plain authenticator failed for 83-233-30-104.cust.bredband2.com [83.233.30.104]:50568: 535 Incorrect authentication data (set_id=services@heipowersystem.com)83.233.30.1042661886W&  -;' ossec13001g2Exim Auth failed2025-03-06 23:28:09 dovecot_plain authenticator failed for ([154.127.90.34]) [154.127.90.34]:37689: 535 Incorrect authentication data (set_id=services)154.127.90.342440476p%  -i+ ossec13001g Exim Auth failed2025-03-06 23:27:52 dovecot_plain authenticator failed for ([103.231.163.154]) [103.231.163.154]:24267: 535 Incorrect authentication data (set_id=services@heipowersystem.com)103.231.163.1541210997 (O ^ j   '-CixgF  -]% ossec13001gExim Auth failed2025-03-07 00:21:58 dovecot_plain authenticator failed for ([87.117.32.22]) [87.117.32.22]:60594: 535 Incorrect authentication data (set_id=services@heipowersystem.com)87.117.32.222017370ZE  -?) ossec13001gExim Auth failed2025-03-07 00:17:27 dovecot_login authenticator failed for ([218.23.156.227]) [218.23.156.227]:51765: 535 Incorrect authentication data (set_id=services)218.23.156.2271814991QD  -1% ossec13001gExim Auth failed2025-03-07 00:18:04 dovecot_plain authenticator failed for ([58.22.255.28]) [58.22.255.28]:39023: 535 Incorrect authentication data (set_id=sales)58.22.255.281814991dC  -W% ossec13001gExim Auth failed2025-03-07 00:17:36 dovecot_plain authenticator failed for ([58.18.90.250]) [58.18.90.250]:38389: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)58.18.90.2501814991jB  -a' ossec13001gExim Auth failed2025-03-07 00:17:07 dovecot_login authenticator failed for ([175.202.82.16]) [175.202.82.16]:54750: 535 Incorrect authentication data (set_id=services@heipowersystem.com)175.202.82.161835841mA  -e) ossec13001gKExim Auth failed2025-03-07 00:15:29 dovecot_login authenticator failed for (net69.195.109-156.krsk.ertelecom.ru) [109.195.69.156]:35137: 535 Incorrect authentication data (set_id=services)109.195.69.1562017370V@  -9) ossec13001gAExim Auth failed2025-03-07 00:15:20 dovecot_login authenticator failed for ([94.204.208.189]) [94.204.208.189]:38747: 535 Incorrect authentication data (set_id=sales)94.204.208.189290557f?  -[' ossec13001g9Exim Auth failed2025-03-07 00:15:11 dovecot_login authenticator failed for ([91.75.105.190]) [91.75.105.190]:40595: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)91.75.105.190290557v>  -y' ossec13001g5Exim Auth failed2025-03-07 00:15:08 dovecot_login authenticator failed for (160.72.153.14.lightower.net) [160.72.153.14]:39551: 535 Incorrect authentication data (set_id=services@heipowersystem.com)160.72.153.146252001j=  -_) ossec13001glExim Auth failed2025-03-07 00:11:48 dovecot_plain authenticator failed for ([216.194.174.27]) [216.194.174.27]:36865: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)216.194.174.276252001j<  -a' ossec13001gExim Auth failed2025-03-07 00:09:54 dovecot_plain authenticator failed for ([186.179.80.12]) [186.179.80.12]:54668: 535 Incorrect authentication data (set_id=services@heipowersystem.com)186.179.80.123895114Y; -?% ossec13001g"Exim Auth failed2025-03-07 00:06:17 dovecot_login authenticator failed for (thepsindustries.com) [119.96.131.8]:60004: 535 Incorrect authentication data (set_id=nologin)119.96.131.81814991:  ?1 ossec1008g*Process exiting (killed).Mar 7 00:06:24 vm1 spamd[2471135]: spamd: server killed by SIGTERM, shutting downp9  -i+ ossec13001gExim Auth failed2025-03-07 00:04:30 dovecot_plain authenticator failed for ([218.149.235.152]) [218.149.235.152]:51646: 535 Incorrect authentication data (set_id=services@heipowersystem.com)218.149.235.1521835841m8  -c+ ossec13001gBExim Auth failed2025-03-07 00:02:33 dovecot_plain authenticator failed for ([144.123.153.214]) [144.123.153.214]:40341: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)144.123.153.2141814991U7  -9) ossec13001gfExim Auth failed2025-03-07 00:03:09 dovecot_plain authenticator failed for ([213.32.253.235]) [213.32.253.235]:58641: 535 Incorrect authentication data (set_id=sales)213.32.253.23599237T6  -5' ossec13001gExim Auth failed2025-03-06 23:55:31 dovecot_plain authenticator failed for ([151.40.26.236]) [151.40.26.236]:36026: 535 Incorrect authentication data (set_id=sales)151.40.26.2363175395 I% % 4 Vh) ISW  -7% ossec13001gEExim Auth failed2025-03-07 00:58:05 dovecot_plain authenticator failed for ([154.73.19.69]) [154.73.19.69]:60724: 535 Incorrect authentication data (set_id=services)154.73.19.69953987V  -) ossec13001gExim Auth failed2025-03-07 00:53:11 dovecot_plain authenticator failed for (145.37.212.118.adsl-pool.jx.chinaunicom.com) [118.212.37.145]:59599: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)118.212.37.1451814991ZU  -?) ossec13001gExim Auth failed2025-03-07 00:53:03 dovecot_plain authenticator failed for ([168.121.46.162]) [168.121.46.162]:58118: 535 Incorrect authentication data (set_id=services)168.121.46.1623932488vT  -{% ossec13001gExim Auth failed2025-03-07 00:52:45 dovecot_plain authenticator failed for 111-70-3-198.emome-ip.hinet.net [111.70.3.198]:36459: 535 Incorrect authentication data (set_id=services@heipowersystem.com)111.70.3.1981668284QS  -1% ossec13001gExim Auth failed2025-03-07 00:43:42 dovecot_plain authenticator failed for ([179.185.1.97]) [179.185.1.97]:41189: 535 Incorrect authentication data (set_id=sales)179.185.1.973469034jR  -_) ossec13001gExim Auth failed2025-03-07 00:43:13 dovecot_plain authenticator failed for ([49.124.152.175]) [49.124.152.175]:60984: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)49.124.152.1751733045fQ  -]% ossec13001gNExim Auth failed2025-03-07 00:41:09 dovecot_plain authenticator failed for ([212.50.48.86]) [212.50.48.86]:59908: 535 Incorrect authentication data (set_id=services@heipowersystem.com)212.50.48.86298795dP  -W% ossec13001gExim Auth failed2025-03-07 00:35:33 dovecot_plain authenticator failed for ([103.7.183.17]) [103.7.183.17]:64027: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)103.7.183.171269750NO  --# ossec13001gExim Auth failed2025-03-07 00:35:54 dovecot_plain authenticator failed for ([59.12.201.7]) [59.12.201.7]:50613: 535 Incorrect authentication data (set_id=sales)59.12.201.71835841jN  -a' ossec13001gExim Auth failed2025-03-07 00:31:03 dovecot_plain authenticator failed for ([92.118.93.205]) [92.118.93.205]:55558: 535 Incorrect authentication data (set_id=services@heipowersystem.com)92.118.93.2052017370ZM  -?) ossec13001gExim Auth failed2025-03-07 00:25:23 dovecot_plain authenticator failed for ([171.217.70.151]) [171.217.70.151]:58292: 535 Incorrect authentication data (set_id=services)171.217.70.1511814991mL  -e) ossec13001gExim Auth failed2025-03-07 00:25:11 dovecot_plain authenticator failed for ([183.89.210.225]) [183.89.210.225]:34022: 535 Incorrect authentication data (set_id=services@heipowersystem.com)183.89.210.2251605651TK  -5' ossec13001g-Exim Auth failed2025-03-07 00:23:33 dovecot_plain authenticator failed for ([165.90.117.84]) [165.90.117.84]:53028: 535 Incorrect authentication data (set_id=sales)165.90.117.843374766gJ  -[' ossec13001g!Exim Auth failed2025-03-07 00:23:20 dovecot_plain authenticator failed for ([103.47.74.210]) [103.47.74.210]:59760: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)103.47.74.2101269750mI  -c+ ossec13001gExim Auth failed2025-03-07 00:23:09 dovecot_plain authenticator failed for ([123.209.118.166]) [123.209.118.166]:58594: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)123.209.118.1662077456HH  = + ossec13008g Mail Reciepient rejected2025-03-07 00:22:58 H=(mail.uttamclassesjaipur.com) [165.154.228.195]:57896 F= rejected RCPT : Rejected relay attempt: '165.154.228.195' From: 'cvwcgm@uttamclassesjaipur.com' To: 'goofile@fastmail.com'165.154.228.1951643084WG  -;' ossec13001gExim Auth failed2025-03-07 00:22:14 dovecot_plain authenticator failed for ([103.183.11.30]) [103.183.11.30]:37554: 535 Incorrect authentication data (set_id=services)103.183.11.301643084 a% 4 3 E d e ?aZh  -=+ ossec13001gAExim Auth failed2025-03-07 01:32:08 dovecot_plain authenticator failed for ([124.197.135.208]) [124.197.135.208]:53616: 535 Incorrect authentication data (set_id=sales)124.197.135.2081835841Zg  -?) ossec13001gExim Auth failed2025-03-07 01:30:35 dovecot_plain authenticator failed for ([14.194.128.158]) [14.194.128.158]:40956: 535 Incorrect authentication data (set_id=services)14.194.128.1581269750jf  -a' ossec13001gExim Auth failed2025-03-07 01:30:12 dovecot_plain authenticator failed for ([1.220.226.226]) [1.220.226.226]:45660: 535 Incorrect authentication data (set_id=services@heipowersystem.com)1.220.226.2261835841de  -U' ossec13001gExim Auth failed2025-03-07 01:22:08 dovecot_plain authenticator failed for b217-29-190-97.pppoe.mark-itt.net [217.29.190.97]:58024: 535 Incorrect authentication data (set_id=sales)217.29.190.972017370kd  -c' ossec13001gExim Auth failed2025-03-07 01:21:50 dovecot_plain authenticator failed for www.michels-schwab.de [217.86.146.64]:51058: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)217.86.146.642921044]c  -C+ ossec13001gExim Auth failed2025-03-07 01:18:44 dovecot_plain authenticator failed for ([121.189.103.212]) [121.189.103.212]:47273: 535 Incorrect authentication data (set_id=services)121.189.103.2121835841jb  -a' ossec13001gExim Auth failed2025-03-07 01:18:14 dovecot_plain authenticator failed for ([61.108.83.138]) [61.108.83.138]:48418: 535 Incorrect authentication data (set_id=services@heipowersystem.com)61.108.83.1381835841da  -U' ossec13001g8Exim Auth failed2025-03-07 01:14:56 dovecot_plain authenticator failed for ool-45734cba.dyn.optonline.net [69.115.76.186]:55816: 535 Incorrect authentication data (set_id=services)69.115.76.1866252001j`  -a' ossec13001g(Exim Auth failed2025-03-07 01:14:40 dovecot_plain authenticator failed for ([49.245.10.228]) [49.245.10.228]:40950: 535 Incorrect authentication data (set_id=services@heipowersystem.com)49.245.10.2281880251Z_  -=+ ossec13001gExim Auth failed2025-03-07 01:09:07 dovecot_plain authenticator failed for ([190.211.250.118]) [190.211.250.122]:55501: 535 Incorrect authentication data (set_id=sales)190.211.250.1223895114{^  -+ ossec13001gExim Auth failed2025-03-07 01:08:56 dovecot_plain authenticator failed for 136.169.144.176.dynamic.ufanet.ru [136.169.144.176]:50714: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)136.169.144.1762017370]]  -C+ ossec13001gExim Auth failed2025-03-07 01:08:09 dovecot_plain authenticator failed for ([182.163.122.133]) [182.163.122.133]:29867: 535 Incorrect authentication data (set_id=services)182.163.122.1331210997j\  -]+ ossec13001gExim Auth failed2025-03-07 01:07:49 dovecot_plain authenticator failed for (165-220-154-126.cust.exede.net) [165.220.154.126]:36526: 535 Incorrect authentication data (set_id=services)165.220.154.1263175395}[  - % ossec13001g|Exim Auth failed2025-03-07 01:07:30 dovecot_plain authenticator failed for broadband-5-228-92-193.ip.moscow.rt.ru [5.228.92.193]:59336: 535 Incorrect authentication data (set_id=services@heipowersystem.com)5.228.92.1932017370mZ  -c+ ossec13001g(Exim Auth failed2025-03-07 01:01:50 dovecot_plain authenticator failed for ([123.209.108.180]) [123.209.108.180]:33864: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)123.209.108.1802077456ZY  -=+ ossec13001g1Exim Auth failed2025-03-07 01:02:01 dovecot_plain authenticator failed for ([114.243.136.120]) [114.243.136.120]:52144: 535 Incorrect authentication data (set_id=sales)114.243.136.1201814991yX  -# ossec13001g3Exim Auth failed2025-03-07 00:57:47 dovecot_plain authenticator failed for syn-071-091-077-097.res.spectrum.com [71.91.77.97]:32908: 535 Incorrect authentication data (set_id=services@heipowersystem.com)71.91.77.976252001 ]   % ?Ng"4]Sy  -5' ossec13001g_Exim Auth failed2025-03-07 02:06:47 dovecot_plain authenticator failed for ([94.204.78.117]) [94.204.78.117]:39397: 535 Incorrect authentication data (set_id=sales)94.204.78.117290557jx  -_) ossec13001gEExim Auth failed2025-03-07 02:06:21 dovecot_plain authenticator failed for ([60.171.237.143]) [60.171.237.143]:46334: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)60.171.237.1431814991aw  -S# ossec13001gExim Auth failed2025-03-07 02:03:09 dovecot_plain authenticator failed for ([221.4.153.7]) [221.4.153.7]:54589: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)221.4.153.71814991Wv  -;' ossec13001gExim Auth failed2025-03-07 02:00:47 dovecot_plain authenticator failed for ([203.190.150.4]) [203.190.150.4]:60578: 535 Incorrect authentication data (set_id=services)203.190.150.41269750mu  -e) ossec13001gExim Auth failed2025-03-07 02:00:35 dovecot_plain authenticator failed for ([221.167.21.148]) [221.167.21.148]:38298: 535 Incorrect authentication data (set_id=services@heipowersystem.com)221.167.21.1481835841yt  -% ossec13001gExim Auth failed2025-03-07 01:54:33 dovecot_plain authenticator failed for 32.104.29.34.bc.googleusercontent.com [34.29.104.32]:45950: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)34.29.104.326252001ms  -e) ossec13001gExim Auth failed2025-03-07 01:43:47 dovecot_plain authenticator failed for ([43.143.231.208]) [43.143.231.208]:50402: 535 Incorrect authentication data (set_id=services@heipowersystem.com)43.143.231.2081814991"r  3M% ossec11301gNew FTP connection.Mar 7 01:41:53 vm1 pure-ftpd[2790297]: (?@103.213.7.95) [INFO] New connection from 103.213.7.95103.213.7.951269750cq  -S' ossec13001grExim Auth failed2025-03-07 01:41:29 dovecot_plain authenticator failed for 111-70-41-195.emome-ip.hinet.net [111.70.41.195]:57914: 535 Incorrect authentication data (set_id=sales)111.70.41.1951668284mp  -k% ossec13001g`Exim Auth failed2025-03-07 01:41:12 dovecot_plain authenticator failed for 77-85-52-109.ip.btc-net.bg [77.85.52.109]:54623: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)77.85.52.109732800bo  -Q' ossec13001gPExim Auth failed2025-03-07 01:40:55 dovecot_login authenticator failed for rt-kalyanov.tagan.ru [95.174.99.133]:57164: 535 Incorrect authentication data (set_id=vikas.khandelwal)95.174.99.1332017370rn  -q' ossec13001gFExim Auth failed2025-03-07 01:40:45 dovecot_login authenticator failed for ([121.65.54.204]) [121.65.54.204]:48370: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)121.65.54.2041835841gm  -[' ossec13001gLExim Auth failed2025-03-07 01:36:34 dovecot_plain authenticator failed for ([72.26.178.196]) [72.26.178.196]:51034: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)72.26.178.1966252001gl  -]% ossec13001g!Exim Auth failed2025-03-07 01:35:52 dovecot_plain authenticator failed for ([222.180.2.62]) [222.180.2.62]:47164: 535 Incorrect authentication data (set_id=services@heipowersystem.com)222.180.2.621814991Sk  -7% ossec13001g+Exim Auth failed2025-03-07 01:36:02 dovecot_plain authenticator failed for ([2.55.122.202]) [2.55.122.202]:59745: 535 Incorrect authentication data (set_id=services)2.55.122.202294640Fj  =+ ossec13008gMail Reciepient rejected2025-03-07 01:33:33 H=(mail.amplifypowerglobal.com) [165.154.226.104]:57326 F= rejected RCPT : Rejected relay attempt: '165.154.226.104' From: 'cvrgd@amplifypowerglobal.com' To: 'goofile@fastmail.com'165.154.226.1041668284ji  -_) ossec13001g Exim Auth failed2025-03-07 01:31:16 dovecot_plain authenticator failed for ([220.80.192.168]) [220.80.192.168]:34028: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)220.80.192.1681835841 T4 @ T x -ATi  -a' ossec13001g Exim Auth failed2025-03-07 02:30:16 dovecot_plain authenticator failed for ([41.59.228.160]) [41.59.228.160]:46114: 535 Incorrect authentication data (set_id=services@heipowersystem.com)41.59.228.160149590h  -a' ossec13001g Exim Auth failed2025-03-07 02:31:09 dovecot_login authenticator failed for ([91.106.54.112]) [91.106.54.112]:44540: 535 Incorrect authentication data (set_id=services@heipowersystem.com)91.106.54.11299237d  -W' ossec13001g sExim Auth failed2025-03-07 02:28:26 dovecot_plain authenticator failed for bzq-109-67-154-24.red.bezeqint.net [109.67.154.24]:54154: 535 Incorrect authentication data (set_id=sales)109.67.154.24294640g  -[' ossec13001g OExim Auth failed2025-03-07 02:27:49 dovecot_login authenticator failed for ([103.174.34.49]) [103.174.34.49]:49646: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)103.174.34.491269750h  -_) ossec13001g cExim Auth failed2025-03-07 02:28:10 dovecot_plain authenticator failed for ([185.255.47.190]) [185.255.47.190]:45742: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)185.255.47.19099237Z  -?) ossec13001g Exim Auth failed2025-03-07 02:25:17 dovecot_plain authenticator failed for ([218.155.40.158]) [218.155.40.158]:57665: 535 Incorrect authentication data (set_id=services)218.155.40.1581835841y  -' ossec13001g Exim Auth failed2025-03-07 02:24:54 dovecot_plain authenticator failed for 111-70-14-135.emome-ip.hinet.net [111.70.14.135]:53183: 535 Incorrect authentication data (set_id=services@heipowersystem.com)111.70.14.1351668284W  -9) ossec13001g Exim Auth failed2025-03-07 02:24:23 dovecot_plain authenticator failed for ([125.136.163.86]) [125.136.163.86]:35668: 535 Incorrect authentication data (set_id=sales)125.136.163.861835841s  -q) ossec13001g yExim Auth failed2025-03-07 02:24:16 dovecot_login authenticator failed for bb115-66-228-194.singnet.com.sg [115.66.228.194]:34920: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)115.66.228.1941880251m  -c+ ossec13001g sExim Auth failed2025-03-07 02:24:09 dovecot_plain authenticator failed for ([220.180.166.214]) [220.180.166.214]:48980: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)220.180.166.2141814991y  -}) ossec13001g oExim Auth failed2025-03-07 02:24:06 dovecot_login authenticator failed for ([191.59.177.235]) [191.59.177.235]:48350: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)191.59.177.2353469034m  -g' ossec13001g >Exim Auth failed2025-03-07 02:23:18 dovecot_login authenticator failed for (gurukuljaipur.com) [111.56.54.202]:49372: 535 Incorrect authentication data (set_id=postmaster@gurukuljaipur.com)111.56.54.2021814991X~  -=' ossec13001g $Exim Auth failed2025-03-07 02:22:52 dovecot_login authenticator failed for (gurukuljaipur.com) [111.56.54.202]:46430: 535 Incorrect authentication data (set_id=nologin)111.56.54.2021814991h}  -[) ossec13001g &Exim Auth failed2025-03-07 02:14:20 dovecot_plain authenticator failed for 50708de6.static.ziggozakelijk.nl [80.112.141.230]:58242: 535 Incorrect authentication data (set_id=services)80.112.141.2302750405p|  -i+ ossec13001g Exim Auth failed2025-03-07 02:14:10 dovecot_plain authenticator failed for ([123.209.117.171]) [123.209.117.171]:57204: 535 Incorrect authentication data (set_id=services@heipowersystem.com)123.209.117.1712077456W{  -;' ossec13001gExim Auth failed2025-03-07 02:09:56 dovecot_plain authenticator failed for ([37.28.177.141]) [37.28.177.141]:52954: 535 Incorrect authentication data (set_id=services)37.28.177.1412017370mz  -e) ossec13001gExim Auth failed2025-03-07 02:09:24 dovecot_plain authenticator failed for ([191.59.206.191]) [191.59.206.191]:36938: 535 Incorrect authentication data (set_id=services@heipowersystem.com)191.59.206.1913469034 b#( 7 Y k 8G7bQ  -1% ossec13001gpExim Auth failed2025-03-07 02:53:59 dovecot_plain authenticator failed for ([197.5.144.31]) [197.5.144.31]:48266: 535 Incorrect authentication data (set_id=sales)197.5.144.312464461c  -S' ossec13001gbExim Auth failed2025-03-07 02:53:46 dovecot_plain authenticator failed for p5098d833.dip0.t-ipconnect.de [80.152.216.51]:26686: 535 Incorrect authentication data (set_id=services)80.152.216.512921044%  -S+ ossec13001g\Exim Auth failed2025-03-07 02:53:39 dovecot_plain authenticator failed for static-200-105-141-170.acelerate.net (static-200-105-141-161.acelerate.net) [200.105.141.170]:45890: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)200.105.141.1703923057m  -e) ossec13001gXExim Auth failed2025-03-07 02:53:36 dovecot_plain authenticator failed for ([220.119.126.81]) [220.119.126.81]:50942: 535 Incorrect authentication data (set_id=services@heipowersystem.com)220.119.126.811835841b  -O) ossec13001g2Exim Auth failed2025-03-07 02:48:41 dovecot_plain authenticator failed for ([209.38.100.151]) [209.38.100.151]:59866: 535 Incorrect authentication data (set_id=vikas.khandelwal)209.38.100.1512750405r  -q' ossec13001g(Exim Auth failed2025-03-07 02:48:32 dovecot_plain authenticator failed for ([39.152.120.40]) [39.152.120.40]:34970: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)39.152.120.401814991T  -5' ossec13001gExim Auth failed2025-03-07 02:47:08 dovecot_plain authenticator failed for ([106.86.209.86]) [106.86.209.86]:57412: 535 Incorrect authentication data (set_id=sales)106.86.209.861814991`  -S# ossec13001gExim Auth failed2025-03-07 02:46:51 dovecot_plain authenticator failed for ([2.55.85.196]) [2.55.85.196]:60455: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)2.55.85.196294640j  -_) ossec13001gExim Auth failed2025-03-07 02:46:40 dovecot_plain authenticator failed for ([196.28.226.124]) [196.28.226.124]:40419: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)196.28.226.1241036973W  -;' ossec13001gExim Auth failed2025-03-07 02:43:40 dovecot_plain authenticator failed for ([221.13.67.139]) [221.13.67.139]:49524: 535 Incorrect authentication data (set_id=services)221.13.67.1391814991m  -e) ossec13001gExim Auth failed2025-03-07 02:43:29 dovecot_plain authenticator failed for ([116.148.103.34]) [116.148.103.34]:52506: 535 Incorrect authentication data (set_id=services@heipowersystem.com)116.148.103.341814991]  -C+ ossec13001g7Exim Auth failed2025-03-07 02:35:59 dovecot_plain authenticator failed for ([182.163.122.133]) [182.163.122.133]:33279: 535 Incorrect authentication data (set_id=services)182.163.122.1331210997j  -a' ossec13001g-Exim Auth failed2025-03-07 02:35:48 dovecot_plain authenticator failed for ([118.38.239.52]) [118.38.239.52]:35840: 535 Incorrect authentication data (set_id=services@heipowersystem.com)118.38.239.521835841Z  -=+ ossec13001gExim Auth failed2025-03-07 02:35:34 dovecot_plain authenticator failed for ([175.156.154.149]) [175.156.154.149]:50090: 535 Incorrect authentication data (set_id=sales)175.156.154.1491880251m  -c+ ossec13001gExim Auth failed2025-03-07 02:35:11 dovecot_plain authenticator failed for ([220.120.224.227]) [220.120.224.227]:33908: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)220.120.224.2271835841w  -{' ossec13001g Exim Auth failed2025-03-07 02:31:17 dovecot_login authenticator failed for (92x255x190x69.static-business.omsk.ertelecom.ru) [92.255.190.69]:58070: 535 Incorrect authentication data (set_id=services)92.255.190.692017370Y  -?) ossec13001g Exim Auth failed2025-03-07 02:30:35 dovecot_plain authenticator failed for ([94.204.208.189]) [94.204.208.189]:37425: 535 Incorrect authentication data (set_id=services)94.204.208.189290557 JPC6)~wj]s~qdWJ=0# zm`{naTG:- fYL' qdWJTH<0$ 4|pdXL@4(@ui]QE9-! ymaUI=1%  } q e Y M A 5 )    u i ] Q E 9 - !  y m a U I = 1 %   } q e Y M A 5 )    u i ] Q E 9 - !   2802361N 2802361N 2802361I 2802361I 2802361O 28023615 2802361 2802361 2802361 2802361 2802361 2802361L 2802361L 2802361K 2802361K 2802361HZ 2802361HY 2802361H 289688H 290291G 2802361G 2802361G 2802361G 2802361' 2802361& 290557( 290557' 290557' 290557'~ 290557't 290557'i 290557& 290557&= 290557% 290557% 290557% 2802361~ 2802361} 2782113J1 2782113H 27821137 27821133A 2802361% 2802361# 2802361q 2802361a 2802361Bs 2802361Br 2802361A 2802361A 2802361@ 2802361@ 2802361@ 2802361@ 2802361? 2802361? 2802361> 2802361> 2802361>e 2802361>d 2802361> 2802361> 2802361< 2802361< 2802361< 2802361< 2802361; 2802361; 2802361;r 290557 290557 290557: 290557$ 2905577 290557> 2905577 290557 290557 290291/ 290291, 290291*h 290291 290291* 290291 290291 290291 290291 290291 290291! 290291 290291 290291= 2902919 290291 \ 290291 2896888[ 289688): 289688 289688{ 289688 285570' 285570' 285570% 285570! 2802361:E 2802361:D 28023619 28023619 28023618 28023618 28023617 28023617s 28023617r 28023616 28023616 28023616$ 28023616# 28023614G 28023614F 28023613 28023612 28023611 28023611 280236114 280236113 2802361- 2802361-? 2802361+ 2802361) 2802361( 2802361C 2802361C 2802361C 290557% 290557%~ 290557$ 290557$ 290557$ 290557$H 290557# 290557# 290557# 290557# 290557# 290557# 290557# 290557#p 290557" 290557" 290557"_ 290557"B 290557"0 290557"( 290557! 290557!< 290557 Q 290557 290557 290557 290557 290557k 290557^ 290557W 290557O 290557 290557 290557v 290557R 290557J 290557 290557 290557 290557: 290557 290557 290557 290557d 290557Y 290557 290557 290557e 290557? 290557/ 290557 290557 290557 290557 290557 290557 290557 290557N 290557I 290557 290557N 290557 290557^ 2905578 290557 290557 290557 290557 290557 290557 290557; 290557* 290557 290557 290557 290557 290557 290557 290557 290557k 290557E 290557 2905578 290557 290557 290557 290557 290557 290557 290557 290557 290557 290557b 290557A 290557 290557 290557 290557 290557' 290557 290557 290557U 290557 290557 290557 290557 290557 290557 290557 290557* 290557# 290557 290557 290557 290557 290557  290557  290557  290557  290557 290557 290557 290557 D 290557 8 290557 1 290557  290557  290557  290557  290557 290557 290557 290557 y 290557 q 290557 b 290557 V 290557  290557 J 290557 w 290557 S 290557 290557 290557 290557 290557 2802361E 2802361E 2802361Ep 2802361Eo 2802361D 2802361D 2802361D *\~tj`VLB8.$zpf\H>4*   v l b X N D : 0 &    ~ t j ` V L B 8 . $    z p f \ R H > 4 *  vlbDXN0:&|rh^TJ@6,"xndZPF<2( ~tj`VLB8.$zpf\ | r h ^ T J @ 6 , "    x n d Z P F < 2 (   RRH>4*  vlbXND:0& gH8 gH gF gF gF gF gE gE gE gCc gCE gC gB gA g@ gA g@ g@H g? g?  g> ~ g> } g= | g; { g; z g; y g;5 x g;) w g: v g: u g9| t g9d s g9 r g9" q g7 p g7z o g6 n g6 m g51 l g5 k g4 j g3 i g3 h g37 g g2 f g3 e g2 d g1t c g1j b g0 a g0 ` g0 _ g0 ^ g/ ] g/R \ g/: [ g. Z g.n Y g.e X g.W W g.5 V g.' U g, T g, S g, R g, Q g+u P g+k O g* N g* M g* L g*_ K g) J g) I g)B H g( G g( F g(V E g'Z D g'P C g& B g& A g% @ g% ? g$U > g$w = g$E < g$1 ; g# : g# 9 g"g 8 g!F 7 g!4 6 g 5 gq 4 gi 3 g5 2 gC 1 g] 0 gm / g} . g - g , g + g * g ) g ( g ' g & gN % g $ g # g " g ! gm g?  g9  g  g{  gp  gb  g\  gX  g2  g(  g  g  g  g  g  g7  g-  g  g g  g  g g g s  g c  g O  g  g  g  g y  g s  g o g > g $ g & g  g g g_ gE g g g g g g gr g` gP gF gL g+ g! g gA g]Y gZ gZ gZ gZ gY gY gY gY gY gXd gW gV gVf gV\ gV gU gT% gS gS gR gR gR gQ| gQq gO gO gO gO~ gN gN gM gM gM gK gK gI gI gI gI gH gH gHB g  g g g g g g g8 g( g g g g g| g1 g( gE g3 g g g g g gN g g g g g g- g! g g  g g g g g g gK gA g9 g] g5 gl g g* g" g gf gB g g g g| gv gh g  g g g gi gS gE g gH g6 g2 g  g g g߻ g߯ gޑ gރ g gݟ g g g g g g g g @ U a q  -Hmc,  -S' ossec13001gExim Auth failed2025-03-07 03:32:55 dovecot_plain authenticator failed for ([182.42.113.10]) [182.42.113.10]:52675: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)182.42.113.101814991W+  -9) ossec13001gExim Auth failed2025-03-07 03:30:33 dovecot_plain authenticator failed for ([49.124.154.175]) [49.124.154.175]:40986: 535 Incorrect authentication data (set_id=sales)49.124.154.1751733045a*  -S# ossec13001gExim Auth failed2025-03-07 03:30:21 dovecot_plain authenticator failed for ([38.79.83.28]) [38.79.83.28]:41414: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)38.79.83.286252001Z)  -=+ ossec13001gExim Auth failed2025-03-07 03:26:38 dovecot_plain authenticator failed for ([123.139.133.238]) [123.139.133.238]:54084: 535 Incorrect authentication data (set_id=sales)123.139.133.2381814991w(  -}' ossec13001gExim Auth failed2025-03-07 03:26:15 dovecot_plain authenticator failed for bzq-109-67-154-24.red.bezeqint.net [109.67.154.24]:48396: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)109.67.154.24294640y'  -' ossec13001gExim Auth failed2025-03-07 03:24:39 dovecot_plain authenticator failed for d28-23-152-164.dim.wideopenwest.com [23.28.164.152]:54018: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)23.28.164.1526252001m&  -e) ossec13001gExim Auth failed2025-03-07 03:22:24 dovecot_plain authenticator failed for ([111.48.140.240]) [111.48.140.240]:55284: 535 Incorrect authentication data (set_id=services@heipowersystem.com)111.48.140.2401814991g%  -[' ossec13001gNExim Auth failed2025-03-07 03:14:44 dovecot_plain authenticator failed for ([50.249.167.45]) [50.249.167.45]:42503: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)50.249.167.456252001m$  -e) ossec13001gExim Auth failed2025-03-07 03:13:42 dovecot_plain authenticator failed for ([119.45.170.229]) [119.45.170.229]:51400: 535 Incorrect authentication data (set_id=services@heipowersystem.com)119.45.170.2291814991W# -=# ossec13001gExim Auth failed2025-03-07 03:09:40 dovecot_login authenticator failed for (thepsindustries.com) [14.18.77.99]:41950: 535 Incorrect authentication data (set_id=nologin)14.18.77.991814991W"  -9) ossec13001gExim Auth failed2025-03-07 03:08:28 dovecot_plain authenticator failed for ([178.177.200.26]) [178.177.200.26]:39282: 535 Incorrect authentication data (set_id=sales)178.177.200.262017370g!  -[' ossec13001gExim Auth failed2025-03-07 03:08:14 dovecot_plain authenticator failed for ([187.218.57.50]) [149.19.169.81]:45855: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)149.19.169.813996063l  -c) ossec13001gmExim Auth failed2025-03-07 03:06:44 dovecot_plain authenticator failed for syn-172-248-047-114.res.spectrum.com [172.248.47.114]:54281: 535 Incorrect authentication data (set_id=services)172.248.47.1146252001p  -i+ ossec13001g?Exim Auth failed2025-03-07 03:05:59 dovecot_plain authenticator failed for ([203.123.219.137]) [203.123.219.137]:55690: 535 Incorrect authentication data (set_id=services@heipowersystem.com)203.123.219.1371835841g  -]% ossec13001g9Exim Auth failed2025-03-07 03:05:52 dovecot_plain authenticator failed for ([42.236.91.93]) [42.236.91.93]:23278: 535 Incorrect authentication data (set_id=services@heipowersystem.com)42.236.91.931814991W  -9) ossec13001gExim Auth failed2025-03-07 03:03:11 dovecot_plain authenticator failed for ([175.125.68.208]) [175.125.68.208]:33670: 535 Incorrect authentication data (set_id=sales)175.125.68.2081835841a  -S# ossec13001g{Exim Auth failed2025-03-07 03:02:42 dovecot_plain authenticator failed for ([70.90.99.29]) [70.90.99.29]:37369: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)70.90.99.296252001 Y ! 3 X [ ]r':Y]=  -C+ ossec13001g$wExim Auth failed2025-03-07 04:10:54 dovecot_plain authenticator failed for ([123.209.117.171]) [123.209.117.171]:50116: 535 Incorrect authentication data (set_id=services)123.209.117.1712077456i<  -]) ossec13001g$EExim Auth failed2025-03-07 04:10:05 dovecot_plain authenticator failed for 93.135.220.111.sta.wbroadband.net.au [111.220.135.93]:36388: 535 Incorrect authentication data (set_id=sales)111.220.135.932077456m;  -c+ ossec13001g$1Exim Auth failed2025-03-07 04:09:44 dovecot_plain authenticator failed for ([176.212.190.170]) [176.212.190.170]:54364: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)176.212.190.1702017370Z:  -=+ ossec13001g#Exim Auth failed2025-03-07 04:05:05 dovecot_plain authenticator failed for ([175.206.105.126]) [175.206.105.126]:34914: 535 Incorrect authentication data (set_id=sales)175.206.105.1261835841j9  -_) ossec13001g# Exim Auth failed2025-03-07 04:04:47 dovecot_plain authenticator failed for ([192.34.128.202]) [192.34.128.202]:40930: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)192.34.128.2026252001p8  -i+ ossec13001g"gExim Auth failed2025-03-07 04:02:05 dovecot_plain authenticator failed for ([223.241.214.127]) [223.241.214.127]:44542: 535 Incorrect authentication data (set_id=services@heipowersystem.com)223.241.214.1271814991W7  -9) ossec13001g!FExim Auth failed2025-03-07 03:57:17 dovecot_plain authenticator failed for ([178.163.27.129]) [178.163.27.129]:50278: 535 Incorrect authentication data (set_id=sales)178.163.27.1292017370g6  -[' ossec13001g!4Exim Auth failed2025-03-07 03:57:00 dovecot_plain authenticator failed for ([186.179.80.12]) [186.179.80.12]:36110: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)186.179.80.123895114P5  -1% ossec13001gExim Auth failed2025-03-07 03:45:40 dovecot_plain authenticator failed for ([86.57.254.73]) [86.57.254.73]:59320: 535 Incorrect authentication data (set_id=sales)86.57.254.73630336g4  -[' ossec13001gqExim Auth failed2025-03-07 03:45:12 dovecot_plain authenticator failed for ([146.88.78.123]) [146.88.78.123]:44123: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)146.88.78.1231694008z3  -' ossec13001giExim Auth failed2025-03-07 03:45:04 dovecot_plain authenticator failed for b217-29-190-97.pppoe.mark-itt.net [217.29.190.97]:59014: 535 Incorrect authentication data (set_id=services@heipowersystem.com)217.29.190.972017370y2  -}) ossec13001g5Exim Auth failed2025-03-07 03:39:57 dovecot_plain authenticator failed for 221-120-42-196.emome-ip.hinet.net [221.120.42.196]:44642: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)221.120.42.1961668284W1  -9) ossec13001gCExim Auth failed2025-03-07 03:40:10 dovecot_plain authenticator failed for ([222.119.124.66]) [222.119.124.66]:49417: 535 Incorrect authentication data (set_id=sales)222.119.124.661835841j0  -a' ossec13001g]Exim Auth failed2025-03-07 03:36:20 dovecot_plain authenticator failed for ([93.102.155.19]) [93.102.155.19]:52422: 535 Incorrect authentication data (set_id=services@heipowersystem.com)93.102.155.192264397h/  -[) ossec13001gmExim Auth failed2025-03-07 03:36:37 dovecot_plain authenticator failed for (136-34-165-114.googlefiber.net) [136.34.165.114]:36258: 535 Incorrect authentication data (set_id=services)136.34.165.1146252001s.  -u% ossec13001g}Exim Auth failed2025-03-07 03:32:36 dovecot_plain authenticator failed for ([222.216.2.74]) [222.216.2.74]:49713: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)222.216.2.741814991x-  -}' ossec13001gExim Auth failed2025-03-07 03:33:04 dovecot_plain authenticator failed for 46.79-160-128.customer.lyse.net [79.160.128.46]:54508: 535 Incorrect authentication data (set_id=services@heipowersystem.com)79.160.128.463144096  T IE|t C?7/*' m i )40.126.245.145BLACKggBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests2077456(~local)89.187.165.172BLACKgLgͱLBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests2658434Ylocal)40.126.245.207BLACKgںkg͋kBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests2077456(~local~%20.37.207.53BLACKgag2Blacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests2077456%5local'13.75.137.100BLACKgRg#Blacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests2077456 Kdlocal)52.156.184.132BLACKg+gBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests20774564local~%52.169.82.28BLACKggBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests29635974Rlocal+165.231.182.115BLACKgogoBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests453733slocal'48.210.43.210BLACKgلgUBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests18610600+local)193.41.206.246BLACKgfg7Blacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests3017382)local'45.133.193.56BLACKg__g0_Blacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests2629691-8local}'45.154.152.24BLACKggύBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests3932488-local|'52.164.121.39BLACKgg˞Blacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests29635974y'local{'13.72.246.151BLACKgؔgeBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests2077456 Hlocal}u#13.74.71.28BLACKgOg Blacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests2963597 JGlocalt'35.94.163.149BLACKgLzgzBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests6252001#^locals'13.69.215.223BLACKg.gBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests2963597 Elocalr)209.227.239.70BLACKg֐jgajBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests3175395Flocalq+102.129.145.226BLACKg։gZBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests6252001flocalo)204.93.149.165BLACKgր]gQ]Blacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests6252001]local} #13.94.99.98BLACKg*gBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests2963597 ^cblocalz)35.180.242.231BLACKggBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests3017382#localx)206.189.194.93BLACKgw gH Blacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests6252001ν]localw'74.176.58.129BLACKgugFBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests1861060J:localv)52.187.206.191BLACKgQ9g"9Blacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests20774564οlocal i 7 7 Y h '1>iQN  -1% ossec13001g*Exim Auth failed2025-03-07 04:38:36 dovecot_plain authenticator failed for ([8.139.253.26]) [8.139.253.26]:26208: 535 Incorrect authentication data (set_id=sales)8.139.253.261814991oM  -o# ossec13001g*Exim Auth failed2025-03-07 04:38:19 dovecot_plain authenticator failed for host116.sub-63-40-8.myvzw.com [63.40.8.116]:56419: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)63.40.8.1166252001rL  -q' ossec13001g*Exim Auth failed2025-03-07 04:36:42 dovecot_plain authenticator failed for 126.64.125.78.rev.sfr.net [78.125.64.126]:51860: 535 Incorrect authentication data (set_id=services@heipowersystem.com)78.125.64.1263017382jK  -a' ossec13001g*_Exim Auth failed2025-03-07 04:36:05 dovecot_plain authenticator failed for ([121.166.85.53]) [121.166.85.53]:57104: 535 Incorrect authentication data (set_id=services@heipowersystem.com)121.166.85.531835841TJ  -5' ossec13001g)Exim Auth failed2025-03-07 04:34:13 dovecot_plain authenticator failed for ([58.16.215.241]) [58.16.215.241]:47982: 535 Incorrect authentication data (set_id=sales)58.16.215.2411814991dI  -W% ossec13001g)Exim Auth failed2025-03-07 04:33:56 dovecot_plain authenticator failed for ([219.159.57.4]) [219.159.57.4]:39148: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)219.159.57.41814991H  W!+ ossec9708g)BDovecot Aborted Login with empty userMar 7 04:31:20 vm1 dovecot[312763]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=185.247.137.139, lip=103.74.54.108, TLS, session=185.247.137.139298795ZG  -?) ossec13001g(Exim Auth failed2025-03-07 04:28:13 dovecot_plain authenticator failed for ([49.205.177.146]) [223.239.159.21]:35210: 535 Incorrect authentication data (set_id=services)223.239.159.211269750HF  -) ossec13001g(Exim Auth failed2025-03-07 04:28:07 dovecot_plain authenticator failed for ([60.223.239.134]) [60.223.239.134]:37032: 535 Incorrect authentication data60.223.239.1341814991gE  -]% ossec13001g(VExim Auth failed2025-03-07 04:27:26 dovecot_plain authenticator failed for ([41.76.80.100]) [41.76.80.100]:48775: 535 Incorrect authentication data (set_id=services@heipowersystem.com)41.76.80.1002328926WD  -9) ossec13001g'ZExim Auth failed2025-03-07 04:23:13 dovecot_plain authenticator failed for ([183.220.247.88]) [183.220.247.88]:56174: 535 Incorrect authentication data (set_id=sales)183.220.247.881814991mC  -c+ ossec13001g'PExim Auth failed2025-03-07 04:23:02 dovecot_plain authenticator failed for ([165.154.202.101]) [165.154.202.101]:31546: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)165.154.202.1016252001ZB  -?) ossec13001g&Exim Auth failed2025-03-07 04:21:01 dovecot_plain authenticator failed for ([114.247.207.98]) [114.247.207.98]:52903: 535 Incorrect authentication data (set_id=services)114.247.207.981814991|A  -) ossec13001g&Exim Auth failed2025-03-07 04:20:49 dovecot_plain authenticator failed for 83-233-242-245.cust.bredband2.com [83.233.242.245]:53212: 535 Incorrect authentication data (set_id=services@heipowersystem.com)83.233.242.2452661886W@  -9) ossec13001g%Exim Auth failed2025-03-07 04:17:09 dovecot_plain authenticator failed for ([213.255.219.43]) [213.255.219.43]:33556: 535 Incorrect authentication data (set_id=sales)213.255.219.432782113y?  -% ossec13001g%Exim Auth failed2025-03-07 04:16:52 dovecot_plain authenticator failed for 48.211.41.34.bc.googleusercontent.com [34.41.211.48]:32770: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)34.41.211.486252001m>  -e) ossec13001g$UExim Auth failed2025-03-07 04:10:20 dovecot_plain authenticator failed for ([203.193.147.37]) [203.193.147.37]:52649: 535 Incorrect authentication data (set_id=services@heipowersystem.com)203.193.147.371269750  3 F h x ~  C f_  -[' ossec13001g0Exim Auth failed2025-03-07 05:03:38 dovecot_plain authenticator failed for ([185.167.56.34]) [185.167.56.34]:45614: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)185.167.56.34617790"^  3M% ossec11301g0New FTP connection.Mar 7 05:03:22 vm1 pure-ftpd[2832856]: (?@3.142.131.47) [INFO] New connection from 3.142.131.473.142.131.476252001#] 3M% ossec11301g/New FTP connection.Mar 7 04:58:33 vm1 pure-ftpd[2831823]: (?@3.142.131.47) [INFO] New connection from 3.142.131.473.142.131.476252001T\  -7% ossec13001g/RExim Auth failed2025-03-07 04:57:13 dovecot_plain authenticator failed for ([101.13.4.119]) [101.13.4.119]:47702: 535 Incorrect authentication data (set_id=services)101.13.4.1191668284m[  -e) ossec13001g/:Exim Auth failed2025-03-07 04:56:50 dovecot_plain authenticator failed for ([222.116.48.103]) [222.116.48.103]:46939: 535 Incorrect authentication data (set_id=services@heipowersystem.com)222.116.48.1031835841VZ  -7) ossec13001g.Exim Auth failed2025-03-07 04:53:47 dovecot_plain authenticator failed for zdomainaccess.com [216.70.114.230]:48070: 535 Incorrect authentication data (set_id=sales)216.70.114.2306252001mY  -c+ ossec13001g.nExim Auth failed2025-03-07 04:53:25 dovecot_plain authenticator failed for ([222.112.246.217]) [222.112.246.217]:39547: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)222.112.246.2171835841TX  -5' ossec13001g.eExim Auth failed2025-03-07 04:53:17 dovecot_plain authenticator failed for ([185.77.238.39]) [185.77.238.39]:55860: 535 Incorrect authentication data (set_id=sales)185.77.238.392017370|W  -) ossec13001g.WExim Auth failed2025-03-07 04:53:02 dovecot_plain authenticator failed for syn-076-178-103-119.res.spectrum.com [76.178.103.119]:41660: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)76.178.103.1196252001ZV  -?) ossec13001g.5Exim Auth failed2025-03-07 04:52:29 dovecot_plain authenticator failed for ([73.231.102.189]) [73.231.102.189]:42534: 535 Incorrect authentication data (set_id=services)73.231.102.1896252001mU  -e) ossec13001g.'Exim Auth failed2025-03-07 04:52:14 dovecot_plain authenticator failed for ([178.178.222.53]) [178.178.222.53]:34218: 535 Incorrect authentication data (set_id=services@heipowersystem.com)178.178.222.532017370vT  -{% ossec13001g,Exim Auth failed2025-03-07 04:47:07 dovecot_login authenticator failed for 206.81.4.146.static.wline.lns.sme.cust.swisscom.ch [146.4.81.206]:34517: 535 Incorrect authentication data (set_id=services)146.4.81.2062658434lS  -e) ossec13001g,Exim Auth failed2025-03-07 04:46:57 dovecot_login authenticator failed for ([185.167.58.121]) [185.167.58.121]:47464: 535 Incorrect authentication data (set_id=services@heipowersystem.com)185.167.58.121617790ZR  -?) ossec13001g,Exim Auth failed2025-03-07 04:46:03 dovecot_plain authenticator failed for ([222.67.133.193]) [222.67.133.193]:64776: 535 Incorrect authentication data (set_id=services)222.67.133.1931814991iQ  -a' ossec13001g,Exim Auth failed2025-03-07 04:45:27 dovecot_plain authenticator failed for ([94.204.100.40]) [94.204.100.40]:55273: 535 Incorrect authentication data (set_id=services@heipowersystem.com)94.204.100.40290557^P  -M# ossec13001g+uExim Auth failed2025-03-07 04:40:43 dovecot_plain authenticator failed for host-2-98-157-37.as13285.net [2.98.157.37]:56452: 535 Incorrect authentication data (set_id=services)2.98.157.372635167gO  -]% ossec13001g+kExim Auth failed2025-03-07 04:40:34 dovecot_plain authenticator failed for ([14.35.218.58]) [14.35.218.58]:38428: 535 Incorrect authentication data (set_id=services@heipowersystem.com)14.35.218.581835841 x ( J r  CJVxZp  -?) ossec13001g7Exim Auth failed2025-03-07 05:32:11 dovecot_plain authenticator failed for ([185.15.189.232]) [185.15.189.232]:52742: 535 Incorrect authentication data (set_id=services)185.15.189.2322017370po  -i+ ossec13001g7zExim Auth failed2025-03-07 05:32:01 dovecot_plain authenticator failed for ([103.146.233.100]) [103.146.233.100]:53556: 535 Incorrect authentication data (set_id=services@heipowersystem.com)103.146.233.1001269750un  -y% ossec13001g6Exim Auth failed2025-03-07 05:29:31 dovecot_plain authenticator failed for (6-62-170-152.fibertel.com.ar) [152.170.62.6]:49952: 535 Incorrect authentication data (set_id=services@heipowersystem.com)152.170.62.63865483Ym -=' ossec13001g6Exim Auth failed2025-03-07 05:29:22 dovecot_login authenticator failed for (gurukuljaipur.com) [111.207.12.99]:47810: 535 Incorrect authentication data (set_id=nologin)111.207.12.991814991Tl  -5' ossec13001g51Exim Auth failed2025-03-07 05:22:16 dovecot_plain authenticator failed for ([116.86.62.245]) [116.86.62.245]:32988: 535 Incorrect authentication data (set_id=sales)116.86.62.2451880251gk  -[' ossec13001g5Exim Auth failed2025-03-07 05:21:49 dovecot_plain authenticator failed for ([46.73.156.221]) [46.73.156.221]:50460: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)46.73.156.2212017370pj  -i+ ossec13001g4Exim Auth failed2025-03-07 05:21:15 dovecot_plain authenticator failed for ([125.140.244.144]) [125.140.244.144]:38768: 535 Incorrect authentication data (set_id=services@heipowersystem.com)125.140.244.1441835841Ti  -5' ossec13001g3Exim Auth failed2025-03-07 05:15:49 dovecot_plain authenticator failed for ([200.61.12.107]) [200.61.12.107]:49800: 535 Incorrect authentication data (set_id=sales)200.61.12.1073865483gh  -[' ossec13001g3Exim Auth failed2025-03-07 05:15:34 dovecot_plain authenticator failed for ([88.204.52.137]) [88.204.52.137]:58974: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)88.204.52.1372017370hg  -]' ossec13001g37Exim Auth failed2025-03-07 05:13:49 dovecot_plain authenticator failed for 119-46-148-53.static.asianet.co.th [119.46.148.53]:50058: 535 Incorrect authentication data (set_id=services)119.46.148.531605651xf  -{) ossec13001g2Exim Auth failed2025-03-07 05:12:25 dovecot_login authenticator failed for (136-34-165-114.googlefiber.net) [136.34.165.114]:37169: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)136.34.165.1146252001le  -e) ossec13001g3Exim Auth failed2025-03-07 05:13:02 dovecot_plain authenticator failed for ([178.172.225.52]) [178.172.225.52]:37505: 535 Incorrect authentication data (set_id=services@heipowersystem.com)178.172.225.52630336Td  -5' ossec13001g2Exim Auth failed2025-03-07 05:12:34 dovecot_login authenticator failed for ([106.227.87.29]) [106.227.87.29]:59276: 535 Incorrect authentication data (set_id=sales)106.227.87.291814991Zc  -?) ossec13001g1tExim Auth failed2025-03-07 05:06:19 dovecot_plain authenticator failed for ([200.106.49.149]) [200.106.49.149]:57506: 535 Incorrect authentication data (set_id=services)200.106.49.1493932488mb  -e) ossec13001g1jExim Auth failed2025-03-07 05:06:09 dovecot_plain authenticator failed for ([183.100.18.224]) [183.100.18.224]:41380: 535 Incorrect authentication data (set_id=services@heipowersystem.com)183.100.18.2241835841za  -}+ ossec13001g0Exim Auth failed2025-03-07 05:04:18 dovecot_plain authenticator failed for 158.160.200.177.netflexisp.com.br [177.200.160.158]:9869: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)177.200.160.1583469034e`  -Y% ossec13001g0Exim Auth failed2025-03-07 05:03:48 dovecot_plain authenticator failed for syn-072-017-090-246.biz.spectrum.com [72.17.90.246]:50778: 535 Incorrect authentication data (set_id=sales)72.17.90.2466252001 7"4 L a p  47y  -' ossec13001g@HExim Auth failed2025-03-07 06:09:34 dovecot_plain authenticator failed for 57-45-246-103.southernonline.net [103.246.45.57]:43386: 535 Incorrect authentication data (set_id=services@heipowersystem.com)103.246.45.571269750T  -5' ossec13001g?Exim Auth failed2025-03-07 06:07:31 dovecot_login authenticator failed for ([220.92.25.189]) [220.92.25.189]:57071: 535 Incorrect authentication data (set_id=sales)220.92.25.1891835841g  -[' ossec13001g?Exim Auth failed2025-03-07 06:06:55 dovecot_login authenticator failed for ([92.118.93.205]) [92.118.93.205]:56280: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)92.118.93.2052017370x~  -% ossec13001g>Exim Auth failed2025-03-07 06:02:27 dovecot_plain authenticator failed for syn-076-169-081-036.res.spectrum.com [76.169.81.36]:59126: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)76.169.81.366252001f}  -Y' ossec13001g>Exim Auth failed2025-03-07 05:59:59 dovecot_plain authenticator failed for 111-70-14-135.emome-ip.hinet.net [111.70.14.135]:54227: 535 Incorrect authentication data (set_id=services)111.70.14.1351668284j|  -a' ossec13001g=Exim Auth failed2025-03-07 05:59:39 dovecot_plain authenticator failed for ([118.38.239.52]) [118.38.239.52]:50760: 535 Incorrect authentication data (set_id=services@heipowersystem.com)118.38.239.521835841T{  -5' ossec13001g;Exim Auth failed2025-03-07 05:50:02 dovecot_plain authenticator failed for ([180.129.88.20]) [180.129.88.20]:47946: 535 Incorrect authentication data (set_id=sales)180.129.88.201880251.z  =W) ossec13008g;Mail Reciepient rejected2025-03-07 05:49:58 H=(mail.rokamauka.com) [165.154.208.84]:51620 F= rejected RCPT : Rejected relay attempt: '165.154.208.84' From: 'olbdidbq@rokamauka.com' To: 'goofile@fastmail.com'165.154.208.841668284jy  -_) ossec13001g;Exim Auth failed2025-03-07 05:49:52 dovecot_plain authenticator failed for ([121.189.198.60]) [121.189.198.60]:48944: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)121.189.198.601835841Yx  -?) ossec13001g;5Exim Auth failed2025-03-07 05:47:56 dovecot_plain authenticator failed for ([89.144.187.114]) [89.144.187.114]:34673: 535 Incorrect authentication data (set_id=services)89.144.187.114130758ww  -{' ossec13001g;)Exim Auth failed2025-03-07 05:47:44 dovecot_plain authenticator failed for (111-86-33-194.intelcom-ug.ru) [194.33.87.111]:55762: 535 Incorrect authentication data (set_id=services@heipowersystem.com)194.33.87.1112017370Qv  -3# ossec13001g:Exim Auth failed2025-03-07 05:45:49 dovecot_plain authenticator failed for ([101.13.1.58]) [101.13.1.58]:49632: 535 Incorrect authentication data (set_id=services)101.13.1.581668284mu  -e) ossec13001g:Exim Auth failed2025-03-07 05:45:38 dovecot_plain authenticator failed for ([167.142.198.54]) [167.142.198.54]:54695: 535 Incorrect authentication data (set_id=services@heipowersystem.com)167.142.198.546252001gt  -[' ossec13001g9|Exim Auth failed2025-03-07 05:40:36 dovecot_plain authenticator failed for syn-098-144-082-250.res.spectrum.com [98.144.82.250]:43886: 535 Incorrect authentication data (set_id=sales)98.144.82.2506252001ds  -W% ossec13001g9dExim Auth failed2025-03-07 05:40:11 dovecot_plain authenticator failed for ([41.76.80.100]) [41.76.80.100]:42768: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)41.76.80.1002328926jr  -_) ossec13001g9Exim Auth failed2025-03-07 05:38:49 dovecot_plain authenticator failed for ([117.252.49.222]) [117.252.49.222]:55483: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)117.252.49.2221269750Zq  -=+ ossec13001g9"Exim Auth failed2025-03-07 05:39:06 dovecot_plain authenticator failed for ([175.206.105.126]) [175.206.105.126]:34960: 535 Incorrect authentication data (set_id=sales)175.206.105.1261835841 t9 R ^ p .8Fetm  -e) ossec13001gH8Exim Auth failed2025-03-07 06:43:27 dovecot_plain authenticator failed for ([182.160.107.51]) [182.160.107.51]:35096: 535 Incorrect authentication data (set_id=services@heipowersystem.com)182.160.107.511210997] -E' ossec13001gHExim Auth failed2025-03-07 06:42:35 dovecot_login authenticator failed for (s2seducationtrust.com) [111.61.229.78]:12451: 535 Incorrect authentication data (set_id=nologin)111.61.229.781814991n  -g) ossec13001gFExim Auth failed2025-03-07 06:38:08 dovecot_login authenticator failed for ip72-199-156-231.sd.sd.cox.net [72.199.156.231]:39145: 535 Incorrect authentication data (set_id=vikas.khandelwal)72.199.156.2316252001r  -q' ossec13001gFExim Auth failed2025-03-07 06:37:58 dovecot_login authenticator failed for ([61.133.10.205]) [61.133.10.204]:35912: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)61.133.10.2041814991j  -_) ossec13001gFExim Auth failed2025-03-07 06:36:58 dovecot_plain authenticator failed for ([219.251.253.62]) [219.251.253.62]:52625: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)219.251.253.621835841~  -) ossec13001gFExim Auth failed2025-03-07 06:34:04 dovecot_plain authenticator failed for (abts-north-static-059.221.160.122.airtelbroadband.in) [122.160.221.59]:44938: 535 Incorrect authentication data (set_id=services)122.160.221.591269750X  -=' ossec13001gEExim Auth failed2025-03-07 06:33:57 dovecot_plain authenticator failed for ([177.174.89.105]) [177.174.89.99]:35139: 535 Incorrect authentication data (set_id=services)177.174.89.993469034j  -a' ossec13001gEExim Auth failed2025-03-07 06:33:52 dovecot_plain authenticator failed for ([219.248.65.30]) [219.248.65.30]:54831: 535 Incorrect authentication data (set_id=services@heipowersystem.com)219.248.65.301835841g  -]% ossec13001gEExim Auth failed2025-03-07 06:33:23 dovecot_plain authenticator failed for ([59.2.141.155]) [59.2.141.155]:34808: 535 Incorrect authentication data (set_id=services@heipowersystem.com)59.2.141.1551835841W  -;' ossec13001gCcExim Auth failed2025-03-07 06:22:50 dovecot_plain authenticator failed for ([217.24.185.98]) [217.24.185.98]:54178: 535 Incorrect authentication data (set_id=services)217.24.185.982017370g  -]% ossec13001gCEExim Auth failed2025-03-07 06:22:20 dovecot_plain authenticator failed for ([5.59.141.152]) [5.59.141.152]:52284: 535 Incorrect authentication data (set_id=services@heipowersystem.com)5.59.141.1522017370S  -5' ossec13001gC Exim Auth failed2025-03-07 06:21:24 dovecot_plain authenticator failed for ([91.239.23.149]) [91.239.23.149]:55710: 535 Incorrect authentication data (set_id=sales)91.239.23.149458258j  -_) ossec13001gBExim Auth failed2025-03-07 06:21:04 dovecot_plain authenticator failed for ([220.182.17.122]) [220.182.17.122]:45036: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)220.182.17.1221814991p  -i+ ossec13001gAExim Auth failed2025-03-07 06:12:44 dovecot_plain authenticator failed for ([103.186.221.174]) [103.186.221.174]:41770: 535 Incorrect authentication data (set_id=services@heipowersystem.com)103.186.221.1741269750c  -W# ossec13001g@Exim Auth failed2025-03-07 06:12:13 dovecot_plain authenticator failed for syn-071-091-077-097.res.spectrum.com [71.91.77.97]:35490: 535 Incorrect authentication data (set_id=sales)71.91.77.976252001X  -;) ossec13001gAExim Auth failed2025-03-07 06:12:53 dovecot_plain authenticator failed for ([125.16.12.73]) [128.185.253.90]:55118: 535 Incorrect authentication data (set_id=services)128.185.253.901269750g  -[' ossec13001g@Exim Auth failed2025-03-07 06:11:58 dovecot_plain authenticator failed for ([194.26.226.55]) [194.26.226.55]:56990: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)194.26.226.552017370 1 B @ 8 = hz 21}#  -' ossec13001gOExim Auth failed2025-03-07 07:15:27 dovecot_plain authenticator failed for syn-075-080-100-185.res.spectrum.com [75.80.100.185]:35684: 535 Incorrect authentication data (set_id=services@heipowersystem.com)75.80.100.1856252001j"  -_) ossec13001gO~Exim Auth failed2025-03-07 07:14:29 dovecot_plain authenticator failed for ([46.146.227.191]) [46.146.227.191]:50068: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)46.146.227.1912017370W!  -9) ossec13001gOExim Auth failed2025-03-07 07:14:52 dovecot_plain authenticator failed for ([220.161.52.149]) [220.161.52.149]:59997: 535 Incorrect authentication data (set_id=sales)220.161.52.1491814991i  -]) ossec13001gN Exim Auth failed2025-03-07 07:08:18 dovecot_plain authenticator failed for syn-076-178-103-119.res.spectrum.com [76.178.103.119]:60698: 535 Incorrect authentication data (set_id=sales)76.178.103.1196252001g  -[' ossec13001gNExim Auth failed2025-03-07 07:08:08 dovecot_plain authenticator failed for ([170.250.67.14]) [170.250.67.14]:43287: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)170.250.67.146252001]  -C+ ossec13001gMExim Auth failed2025-03-07 07:07:27 dovecot_plain authenticator failed for ([114.243.136.120]) [114.243.136.120]:49603: 535 Incorrect authentication data (set_id=services)114.243.136.1201814991y  -' ossec13001gMExim Auth failed2025-03-07 07:07:16 dovecot_plain authenticator failed for 211-20-26-201.hinet-ip.hinet.net [211.20.26.201]:42178: 535 Incorrect authentication data (set_id=services@heipowersystem.com)211.20.26.2011668284j  -_) ossec13001gMExim Auth failed2025-03-07 07:04:07 dovecot_plain authenticator failed for ([121.147.25.111]) [121.147.25.111]:60582: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)121.147.25.1111835841W  -;' ossec13001gKExim Auth failed2025-03-07 06:59:09 dovecot_plain authenticator failed for ([195.24.215.70]) [195.24.215.70]:55002: 535 Incorrect authentication data (set_id=services)195.24.215.702233387j  -a' ossec13001gKExim Auth failed2025-03-07 06:58:57 dovecot_plain authenticator failed for ([77.51.214.170]) [77.51.214.170]:48993: 535 Incorrect authentication data (set_id=services@heipowersystem.com)77.51.214.1702017370Q  -1% ossec13001gIExim Auth failed2025-03-07 06:51:01 dovecot_plain authenticator failed for ([95.79.57.221]) [95.79.57.221]:55488: 535 Incorrect authentication data (set_id=sales)95.79.57.2212017370w  -{' ossec13001gIExim Auth failed2025-03-07 06:50:53 dovecot_plain authenticator failed for h88-129-31-231.cust.bredband2.com [88.129.31.231]:36815: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)88.129.31.2312661886  -' ossec13001gIExim Auth failed2025-03-07 06:50:24 dovecot_plain authenticator failed for host-88-43-231-186.business.telecomitalia.it ([88.43.231.188]) [88.43.231.186]:33972: 535 Incorrect authentication data (set_id=services)88.43.231.1863175395~  -+ ossec13001gIExim Auth failed2025-03-07 06:50:14 dovecot_plain authenticator failed for d142-179-145-166.abhsia.telus.net [142.179.145.166]:35440: 535 Incorrect authentication data (set_id=services@heipowersystem.com)142.179.145.1666251999T  -5' ossec13001gHExim Auth failed2025-03-07 06:46:24 dovecot_plain authenticator failed for ([50.171.64.170]) [50.171.64.170]:59638: 535 Incorrect authentication data (set_id=sales)50.171.64.1706252001v  -y' ossec13001gHExim Auth failed2025-03-07 06:46:02 dovecot_plain authenticator failed for 216.106.67.50.reverse.socket.net [216.106.67.50]:35360: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)216.106.67.506252001h  -_% ossec13001gHBExim Auth failed2025-03-07 06:43:37 dovecot_plain authenticator failed for syn-097-092-033-136.res.spectrum.com [97.92.33.136]:55880: 535 Incorrect authentication data (set_id=services)97.92.33.1366252001 r+: Q W z  !4Ynrx4  -y+ ossec13001gYExim Auth failed2025-03-07 07:58:01 dovecot_plain authenticator failed for ([123.209.108.180]) [123.209.108.180]:60120: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)123.209.108.1802077456g3  -[' ossec13001gXdExim Auth failed2025-03-07 07:52:28 dovecot_plain authenticator failed for ([14.53.126.112]) [14.53.126.112]:53748: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)14.53.126.1121835841W2  -;' ossec13001gWExim Auth failed2025-03-07 07:46:33 dovecot_plain authenticator failed for ([112.196.60.13]) [112.196.60.13]:41168: 535 Incorrect authentication data (set_id=services)112.196.60.131269750i1  -a' ossec13001gVExim Auth failed2025-03-07 07:46:23 dovecot_plain authenticator failed for ([185.167.56.24]) [185.167.56.24]:42506: 535 Incorrect authentication data (set_id=services@heipowersystem.com)185.167.56.24617790f0  -Y' ossec13001gVfExim Auth failed2025-03-07 07:43:57 dovecot_plain authenticator failed for syn-097-086-134-216.res.spectrum.com [97.86.134.216]:1813: 535 Incorrect authentication data (set_id=sales)97.86.134.2166252001v/  -{% ossec13001gV\Exim Auth failed2025-03-07 07:43:46 dovecot_plain authenticator failed for c-73-95-112-29.hsd1.co.comcast.net [73.95.112.29]:40674: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)73.95.112.296252001j.  -c% ossec13001gVExim Auth failed2025-03-07 07:42:20 dovecot_plain authenticator failed for broadband-188-32-68-79.ip.moscow.rt.ru [188.32.68.79]:51819: 535 Incorrect authentication data (set_id=services)188.32.68.792017370p-  -i+ ossec13001gUExim Auth failed2025-03-07 07:42:08 dovecot_plain authenticator failed for ([163.179.105.241]) [163.179.105.241]:44882: 535 Incorrect authentication data (set_id=services@heipowersystem.com)163.179.105.2411814991g,  -[' ossec13001gT%Exim Auth failed2025-03-07 07:34:20 dovecot_plain authenticator failed for ([58.238.181.96]) [58.238.181.96]:34362: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)58.238.181.961835841T+  -7% ossec13001gSExim Auth failed2025-03-07 07:32:02 dovecot_plain authenticator failed for ([103.83.9.138]) [103.83.9.138]:43972: 535 Incorrect authentication data (set_id=services)103.83.9.1381269750d*  -Y# ossec13001gSExim Auth failed2025-03-07 07:31:34 dovecot_plain authenticator failed for ([8.209.221.7]) [8.209.221.7]:41534: 535 Incorrect authentication data (set_id=services@heipowersystem.com)8.209.221.71861060d)  -W% ossec13001gRExim Auth failed2025-03-07 07:29:22 dovecot_plain authenticator failed for ([110.35.63.27]) [110.35.63.27]:53114: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)110.35.63.271835841Y(  -?' ossec13001gRExim Auth failed2025-03-07 07:28:24 dovecot_login authenticator failed for rm0zqz.g-service.ru [84.22.155.211]:48168: 535 Incorrect authentication data (set_id=services)84.22.155.2112017370v'  -{% ossec13001gRExim Auth failed2025-03-07 07:28:05 dovecot_login authenticator failed for 111-70-32-53.emome-ip.hinet.net [111.70.32.53]:37560: 535 Incorrect authentication data (set_id=services@heipowersystem.com)111.70.32.531668284e&  -W' ossec13001gQ|Exim Auth failed2025-03-07 07:23:00 dovecot_plain authenticator failed for 42-200-70-134.static.imsbiz.com [42.200.70.134]:52931: 535 Incorrect authentication data (set_id=services)42.200.70.1341819730m%  -e) ossec13001gQqExim Auth failed2025-03-07 07:22:48 dovecot_plain authenticator failed for ([121.147.25.111]) [121.147.25.111]:45572: 535 Incorrect authentication data (set_id=services@heipowersystem.com)121.147.25.1111835841Q$  -3# ossec13001gOExim Auth failed2025-03-07 07:15:37 dovecot_plain authenticator failed for ([70.90.99.29]) [70.90.99.29]:49309: 535 Incorrect authentication data (set_id=services)70.90.99.296252001 ^, W l n #<^ZE  -=+ ossec13001g_Exim Auth failed2025-03-07 08:22:53 dovecot_plain authenticator failed for ([123.209.105.123]) [123.209.105.123]:44430: 535 Incorrect authentication data (set_id=sales)123.209.105.1232077456cD  -W% ossec13001g_rExim Auth failed2025-03-07 08:22:34 dovecot_plain authenticator failed for ([197.87.10.83]) [197.87.10.83]:39317: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)197.87.10.83953987TC  -7% ossec13001g^vExim Auth failed2025-03-07 08:18:21 dovecot_plain authenticator failed for ([27.188.66.84]) [27.188.66.84]:57627: 535 Incorrect authentication data (set_id=services)27.188.66.841814991lB  -e) ossec13001g^hExim Auth failed2025-03-07 08:18:08 dovecot_plain authenticator failed for ([82.102.188.117]) [82.102.188.117]:35814: 535 Incorrect authentication data (set_id=services@heipowersystem.com)82.102.188.117294640&A  =G) ossec13008g]Mail Reciepient rejected2025-03-07 08:16:01 H=(mail.hsnews.in) [165.154.226.62]:49569 F= rejected RCPT : Rejected relay attempt: '165.154.226.62' From: 'ordudgiqnp@hsnews.in' To: 'goofile@fastmail.com'165.154.226.621668284l@  -c) ossec13001g]Exim Auth failed2025-03-07 08:15:15 dovecot_plain authenticator failed for syn-173-095-123-220.biz.spectrum.com [173.95.123.220]:45303: 535 Incorrect authentication data (set_id=services)173.95.123.2206252001m?  -e) ossec13001g]Exim Auth failed2025-03-07 08:15:02 dovecot_plain authenticator failed for ([111.93.177.228]) [111.93.177.228]:57526: 535 Incorrect authentication data (set_id=services@heipowersystem.com)111.93.177.2281269750Z>  -=+ ossec13001g]Exim Auth failed2025-03-07 08:14:16 dovecot_plain authenticator failed for ([114.243.136.120]) [114.243.136.120]:58613: 535 Incorrect authentication data (set_id=sales)114.243.136.1201814991g=  -[' ossec13001g]YExim Auth failed2025-03-07 08:13:37 dovecot_plain authenticator failed for ([123.182.89.19]) [123.182.89.19]:39393: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)123.182.89.191814991_<  -K' ossec13001gZExim Auth failed2025-03-07 08:01:51 dovecot_plain authenticator failed for 126.64.125.78.rev.sfr.net [78.125.64.126]:35894: 535 Incorrect authentication data (set_id=services)78.125.64.1263017382Z;  -=+ ossec13001gZExim Auth failed2025-03-07 08:01:37 dovecot_plain authenticator failed for ([203.123.219.137]) [203.123.219.137]:44381: 535 Incorrect authentication data (set_id=sales)203.123.219.1371835841j:  -a' ossec13001gZExim Auth failed2025-03-07 08:01:37 dovecot_plain authenticator failed for ([41.216.169.13]) [41.216.169.13]:39252: 535 Incorrect authentication data (set_id=services@heipowersystem.com)41.216.169.132328926z9  -' ossec13001gZExim Auth failed2025-03-07 08:01:26 dovecot_plain authenticator failed for syn-024-090-169-209.res.spectrum.com [24.90.169.209]:54179: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)24.90.169.2096252001g8  -]% ossec13001gYExim Auth failed2025-03-07 07:59:03 dovecot_plain authenticator failed for ([60.166.8.174]) [60.166.8.174]:58185: 535 Incorrect authentication data (set_id=services@heipowersystem.com)60.166.8.1741814991Q7  -1% ossec13001gYExim Auth failed2025-03-07 07:58:55 dovecot_plain authenticator failed for ([182.76.71.82]) [182.76.71.82]:34366: 535 Incorrect authentication data (set_id=sales)182.76.71.821269750j6  -_) ossec13001gYExim Auth failed2025-03-07 07:58:46 dovecot_plain authenticator failed for ([218.98.160.119]) [218.98.160.117]:22212: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)218.98.160.1171814991b5  -O) ossec13001gYExim Auth failed2025-03-07 07:58:40 dovecot_plain authenticator failed for ([121.190.129.68]) [121.190.129.68]:36013: 535 Incorrect authentication data (set_id=vikas.khandelwal)121.190.129.681835841 c" 4 Q P h }9KcdV  -W% ossec13001gh(Exim Auth failed2025-03-07 08:59:44 dovecot_plain authenticator failed for ([49.124.148.2]) [49.124.148.2]:57280: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)49.124.148.21733045jU  -a' ossec13001gf"Exim Auth failed2025-03-07 08:51:04 dovecot_plain authenticator failed for ([210.245.95.11]) [210.245.95.11]:34702: 535 Incorrect authentication data (set_id=services@heipowersystem.com)210.245.95.111562822WT  -9) ossec13001geExim Auth failed2025-03-07 08:49:30 dovecot_plain authenticator failed for ([67.213.230.122]) [67.213.230.122]:48644: 535 Incorrect authentication data (set_id=sales)67.213.230.1226252001mS  -c+ ossec13001geExim Auth failed2025-03-07 08:49:01 dovecot_plain authenticator failed for ([123.209.118.166]) [123.209.118.166]:57722: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)123.209.118.1662077456QR  -1% ossec13001ge6Exim Auth failed2025-03-07 08:47:08 dovecot_plain authenticator failed for ([218.22.0.200]) [218.22.0.200]:59024: 535 Incorrect authentication data (set_id=sales)218.22.0.2001814991vQ  -y' ossec13001ge*Exim Auth failed2025-03-07 08:46:56 dovecot_plain authenticator failed for 37-46-160-175.customers.ownit.se [37.46.160.175]:51152: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)37.46.160.1752661886hP  -[+ ossec13001gdExim Auth failed2025-03-07 08:42:18 dovecot_plain authenticator failed for ([196.200.227.194]) [196.200.227.194]:51386: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)196.200.227.194149590yO  -}) ossec13001gdExim Auth failed2025-03-07 08:42:00 dovecot_plain authenticator failed for ([191.59.206.191]) [191.59.206.191]:52210: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)191.59.206.1913469034fN  -[' ossec13001gbExim Auth failed2025-03-07 08:36:14 dovecot_plain authenticator failed for ([185.167.56.24]) [185.167.56.24]:36116: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)185.167.56.24617790RM  -5' ossec13001gbCExim Auth failed2025-03-07 08:34:35 dovecot_plain authenticator failed for ([65.20.169.121]) [65.20.169.121]:34468: 535 Incorrect authentication data (set_id=sales)65.20.169.12199237gL  -[' ossec13001gb5Exim Auth failed2025-03-07 08:34:20 dovecot_plain authenticator failed for ([58.49.113.138]) [58.49.113.138]:15995: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)58.49.113.1381814991dK  -S) ossec13001gaExim Auth failed2025-03-07 08:33:21 dovecot_plain authenticator failed for 227.sub-166-143-59.myvzw.com [166.143.59.227]:27359: 535 Incorrect authentication data (set_id=services)166.143.59.2276252001}J  -' ossec13001gaExim Auth failed2025-03-07 08:33:05 dovecot_plain authenticator failed for syn-097-070-129-101.res.spectrum.com [97.70.129.101]:47835: 535 Incorrect authentication data (set_id=services@heipowersystem.com)97.70.129.1016252001_I -G) ossec13001gaExim Auth failed2025-03-07 08:31:21 dovecot_login authenticator failed for (s2seducationtrust.com) [101.89.140.209]:36250: 535 Incorrect authentication data (set_id=nologin)101.89.140.2091814991jH  -a' ossec13001g`Exim Auth failed2025-03-07 08:28:57 dovecot_plain authenticator failed for broadband-77-37-179-158.ip.moscow.rt.ru [77.37.179.158]:57556: 535 Incorrect authentication data (set_id=sales)77.37.179.1582017370iG  -]) ossec13001g`Exim Auth failed2025-03-07 08:28:46 dovecot_plain authenticator failed for zdomainaccess.com [216.70.114.230]:48362: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)216.70.114.2306252001mF  -e) ossec13001g`rExim Auth failed2025-03-07 08:26:50 dovecot_plain authenticator failed for ([222.143.30.155]) [222.143.30.155]:52322: 535 Incorrect authentication data (set_id=services@heipowersystem.com)222.143.30.1551814991 %5 Z l ~ 5mg  -e) ossec13001goRExim Auth failed2025-03-07 09:30:17 dovecot_plain authenticator failed for ([119.200.229.33]) [119.200.229.33]:37828: 535 Incorrect authentication data (set_id=services@heipowersystem.com)119.200.229.331835841Wf  -9) ossec13001goExim Auth failed2025-03-07 09:31:12 dovecot_plain authenticator failed for ([118.123.116.93]) [118.123.116.93]:51264: 535 Incorrect authentication data (set_id=sales)118.123.116.931814991Ze  -?) ossec13001gorExim Auth failed2025-03-07 09:30:50 dovecot_plain authenticator failed for ([111.48.214.102]) [111.48.214.102]:43718: 535 Incorrect authentication data (set_id=services)111.48.214.1021814991jd  -_) ossec13001gopExim Auth failed2025-03-07 09:30:47 dovecot_plain authenticator failed for ([218.94.115.164]) [218.94.115.164]:52204: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)218.94.115.1641814991%c  3Q' ossec11301gnNew FTP connection.Mar 7 09:27:56 vm1 pure-ftpd[2889568]: (?@91.238.181.92) [INFO] New connection from 91.238.181.9291.238.181.923017382Nb  --# ossec13001glExim Auth failed2025-03-07 09:19:01 dovecot_plain authenticator failed for ([58.18.42.74]) [58.18.42.74]:39238: 535 Incorrect authentication data (set_id=sales)58.18.42.741814991ma  -c+ ossec13001glExim Auth failed2025-03-07 09:18:33 dovecot_plain authenticator failed for ([203.123.219.137]) [203.123.219.137]:54698: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)203.123.219.1371835841T`  -7% ossec13001gkExim Auth failed2025-03-07 09:15:19 dovecot_plain authenticator failed for ([41.74.136.46]) [41.74.136.46]:36798: 535 Incorrect authentication data (set_id=services)41.74.136.463374766m_  -e) ossec13001gkExim Auth failed2025-03-07 09:15:03 dovecot_plain authenticator failed for ([220.161.52.149]) [220.161.52.149]:42967: 535 Incorrect authentication data (set_id=services@heipowersystem.com)220.161.52.1491814991j^  -a' ossec13001gkExim Auth failed2025-03-07 09:14:51 dovecot_plain authenticator failed for ([1.220.226.226]) [1.220.226.226]:43569: 535 Incorrect authentication data (set_id=services@heipowersystem.com)1.220.226.2261835841j]  -a' ossec13001gkExim Auth failed2025-03-07 09:14:35 dovecot_plain authenticator failed for ([83.239.32.106]) [83.239.32.106]:57229: 535 Incorrect authentication data (set_id=services@heipowersystem.com)83.239.32.1062017370]\  -C+ ossec13001gjExim Auth failed2025-03-07 09:10:47 dovecot_plain authenticator failed for ([194.226.155.198]) [194.226.155.198]:53052: 535 Incorrect authentication data (set_id=services)194.226.155.1982017370j[  -a' ossec13001gjExim Auth failed2025-03-07 09:10:36 dovecot_plain authenticator failed for ([27.40.100.203]) [27.40.100.203]:58194: 535 Incorrect authentication data (set_id=services@heipowersystem.com)27.40.100.2031814991jZ  -_) ossec13001giExim Auth failed2025-03-07 09:05:29 dovecot_plain authenticator failed for ([110.77.137.236]) [110.77.137.236]:41300: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)110.77.137.2361605651WY  -;' ossec13001ghExim Auth failed2025-03-07 09:01:27 dovecot_plain authenticator failed for ([77.51.214.170]) [77.51.214.170]:44160: 535 Incorrect authentication data (set_id=services)77.51.214.1702017370lX  -c) ossec13001ghlExim Auth failed2025-03-07 09:00:51 dovecot_plain authenticator failed for zdomainaccess.com [216.70.114.230]:33202: 535 Incorrect authentication data (set_id=services@heipowersystem.com)216.70.114.2306252001WW  -9) ossec13001gh8Exim Auth failed2025-03-07 09:00:00 dovecot_plain authenticator failed for ([111.171.125.94]) [111.171.125.94]:43425: 535 Incorrect authentication data (set_id=sales)111.171.125.941835841 0tgZM@3& xk^ 2 %  QD7*}pVI</"yl_RE8uh[NA4' ~qdWJ=0 { n  r em`SF9, v i \ O B 5 (    +c  ? qdWJ=0# z| ~obUH;.! > 1 $   s f Y L w j ] P C 6 )    a T G : -   X K 1814991)n 1814991)k 1814991)i 1814991)h 1814991)g 1814991)_ 1814991)^ 1814991)\ 1814991)[ 1814991)K 1814991* 1814991)H 1814991)G 1814991* 1814991)A 1814991* 1814991); 1814991)4 1814991)3 1814991)) 1814991) 1814991) 1814991) 1814991) 1814991) 1814991) 1814991) 1814991) 1814991*% 1814991) 1814991( 1814991( 1814991( 1814991( 1814991( 1814991( 1814991( 1814991( 1814991( 1814991*( 1814991( 1814991( 1814991( 1814991( 1814991( 1814991( 1814991( 1814991( 1814991( 1814991( 1814991( 1814991( 1814991( 1814991( 1814991( 1814991( 1814991( 1814991( 1814991( 1814991( 1814991( 1814991( 1814991( 1814991*. 1814991(z 1814991(x 1814991(s 1814991(k 1814991* 1814991' 1814991' 1814991' 1814991' 1814991' 1814991' 1814991' 1814991' 1814991' 1814991' 1814991' 1814991' 1814991' 1814991' 1814991' 1814991' 1814991' 1814991(h 1814991(_ 1814991(Z 1814991(Y 1814991(X 1814991(W 1814991(L 1814991(J 1814991(I 1814991(D 1814991(< 1814991(: 1814991(8 1814991(7 1814991(6 1814991(/ 1814991( 1814991' 1814991' 1814991' 1814991' 1814991' 1814991' 1814991' 1814991' 1814991' 1814991' 1814991+ 1814991+ 1814991+ 1814991+ 1814991+{ 1814991+s 1814991+d 1814991+] 1814991+N 1814991+M 1814991+J 1814991* 1814991* 1814991* 1814991* 1814991* 1814991* 1814991* 1814991* 1814991*B 1814991*: 1814991*6 1814991*1 1814991( 1814991( 1814991( 1814991*D 1814991+ 1814991+ 1814991+ 1814991+ 1814991+ 1814991(- 1814991( 1814991( 1814991*J 1814991+ 1814991+ 1814991)q K 1814991)~ 1814991)} 1814991)r 1814991* 1814991* 1814991* 1814991* 1814991+ 1814991+ 1814991+ 1814991+ 1814991+ 1814991+ 1814991+ 1814991+ 1814991+ 1814991+|  1814991) 1814991) 1814991) 1814991) 1814991* 1814991* 1814991* 1814991* 1814991* 1814991) 1814991) 1814991) 1814991) 1814991) 1814991) 1814991) 1814991) 1814991) 1814991) 1814991) 1814991) 1814991) 1814991) 1814991) 1814991) 1814991) 1814991) 1814991) 1814991) 1814991) 1814991) 1814991) 1814991) 1814991) 1814991) 1814991) 1814991) 1814991) 1814991) 1814991* 1814991* 1814991* 1814991* 1814991* 1814991* 1814991* 1814991* 1814991*~ 1814991*u 1814991*t 1814991*s 1814991*j 1814991*g 1814991*d 1814991*X 1814991*U 1814991*R 1814991*Q 1814991*K 1814991+I 1814991+F 1814991+A 1814991+, 1814991+* 1814991+% 1814991+ 1814991+ 1814991* 1814991* = O w j O^Ww  -9) ossec13001gySExim Auth failed2025-03-07 10:12:58 dovecot_plain authenticator failed for ([37.204.170.200]) [37.204.170.200]:36685: 535 Incorrect authentication data (set_id=sales)37.204.170.2002017370ev  -W' ossec13001gxExim Auth failed2025-03-07 10:10:37 dovecot_login authenticator failed for (109.cpe-186-68-83.gye.satnet.net) [186.68.83.109]:43774: 535 Incorrect authentication data (set_id=sales)186.68.83.1093658394mu  -c+ ossec13001gxExim Auth failed2025-03-07 10:10:21 dovecot_login authenticator failed for ([180.188.143.166]) [180.188.143.166]:41813: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)180.188.143.1661819730vt  -{% ossec13001gwExim Auth failed2025-03-07 10:03:17 dovecot_plain authenticator failed for 111-70-19-17.emome-ip.hinet.net [111.70.19.17]:51925: 535 Incorrect authentication data (set_id=services@heipowersystem.com)111.70.19.171668284Ws  -9) ossec13001gvExim Auth failed2025-03-07 10:01:44 dovecot_plain authenticator failed for ([216.194.174.27]) [216.194.174.27]:54689: 535 Incorrect authentication data (set_id=sales)216.194.174.276252001pr  -o% ossec13001gvExim Auth failed2025-03-07 10:01:33 dovecot_plain authenticator failed for ti0004q160-7861.bb.online.no [95.34.158.19]:60452: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)95.34.158.193144096Zq  -?) ossec13001gudExim Auth failed2025-03-07 09:56:11 dovecot_plain authenticator failed for ([221.10.221.104]) [221.10.221.104]:33823: 535 Incorrect authentication data (set_id=services)221.10.221.1041814991mp  -e) ossec13001guRExim Auth failed2025-03-07 09:55:53 dovecot_plain authenticator failed for ([128.185.224.87]) [152.52.243.154]:52206: 535 Incorrect authentication data (set_id=services@heipowersystem.com)152.52.243.1541269750 rejected RCPT : Rejected relay attempt: '165.154.228.195' From: 'aiykzm@heipowersystem.com' To: 'goofile@fastmail.com'165.154.228.1951643084Wn  -9) ossec13001gsWExim Auth failed2025-03-07 09:47:26 dovecot_plain authenticator failed for ([121.159.71.249]) [121.159.71.249]:40042: 535 Incorrect authentication data (set_id=sales)121.159.71.2491835841m  -A) ossec13001gsKExim Auth failed2025-03-07 09:47:14 dovecot_plain authenticator failed for 131-106-85-205.s1483.c3-0.tlg-cbr5.atw-tlg.pa.cable.rcncustomer.com [131.106.85.205]:57820: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)131.106.85.2056252001jl  -a' ossec13001gsIExim Auth failed2025-03-07 09:47:12 dovecot_plain authenticator failed for ([116.86.62.245]) [116.86.62.245]:39417: 535 Incorrect authentication data (set_id=services@heipowersystem.com)116.86.62.2451880251Tk  -5' ossec13001gqExim Auth failed2025-03-07 09:40:25 dovecot_plain authenticator failed for ([220.92.25.189]) [220.92.25.189]:44439: 535 Incorrect authentication data (set_id=sales)220.92.25.1891835841jj  -_) ossec13001gqExim Auth failed2025-03-07 09:40:13 dovecot_plain authenticator failed for ([87.225.108.138]) [87.225.108.138]:53052: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)87.225.108.1382017370Ti  -7% ossec13001gqExim Auth failed2025-03-07 09:37:53 dovecot_plain authenticator failed for ([222.99.10.11]) [222.99.10.11]:56848: 535 Incorrect authentication data (set_id=services)222.99.10.111835841gh  -]% ossec13001gqExim Auth failed2025-03-07 09:37:30 dovecot_plain authenticator failed for ([144.48.49.72]) [144.48.49.72]:50342: 535 Incorrect authentication data (set_id=services@heipowersystem.com)144.48.49.721269750  6 H p  m  -e) ossec13001gʀ)Exim Auth failed2025-03-07 10:42:07 dovecot_plain authenticator failed for ([185.130.158.98]) [185.130.158.98]:35981: 535 Incorrect authentication data (set_id=services@heipowersystem.com)185.130.158.982635167j  -_) ossec13001gExim Auth failed2025-03-07 10:40:32 dovecot_plain authenticator failed for ([111.12.145.198]) [111.12.145.198]:46271: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)111.12.145.1981814991m  -e) ossec13001g~\Exim Auth failed2025-03-07 10:34:28 dovecot_plain authenticator failed for ([109.195.69.156]) [109.195.69.156]:30131: 535 Incorrect authentication data (set_id=services@heipowersystem.com)109.195.69.1562017370  Ug) ossec11001g}Deferred login on the cpanel service[2025-03-07 10:28:58 +0530] info [webmaild] 157.38.133.202 - kps@amplifypowerglobal.com "POST /cpsess7078219555/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [157.38.134.228] != Current IP Address [157.38.133.202]157.38.133.2021269750c  -Q) ossec13001g}Exim Auth failed2025-03-07 10:28:41 dovecot_plain authenticator failed for ip72-199-156-231.sd.sd.cox.net [72.199.156.231]:34215: 535 Incorrect authentication data (set_id=sales)72.199.156.2316252001v  -w) ossec13001g|Exim Auth failed2025-03-07 10:28:10 dovecot_plain authenticator failed for 110-25-105-242.adsl.fetnet.net [110.25.105.242]:54274: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)110.25.105.2421668284j  -_) ossec13001g|eExim Auth failed2025-03-07 10:26:05 dovecot_login authenticator failed for ([183.109.148.43]) [183.109.148.43]:52906: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)183.109.148.431835841n  -g) ossec13001g{Exim Auth failed2025-03-07 10:22:35 dovecot_plain authenticator failed for 74-103-174-206.gci.net [206.174.103.74]:61300: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)206.174.103.746252001T  -5' ossec13001g{Exim Auth failed2025-03-07 10:22:47 dovecot_plain authenticator failed for ([219.248.65.30]) [219.248.65.30]:46695: 535 Incorrect authentication data (set_id=sales)219.248.65.301835841Z~  -?) ossec13001g{?Exim Auth failed2025-03-07 10:21:10 dovecot_plain authenticator failed for ([207.219.221.99]) [207.219.221.99]:49417: 535 Incorrect authentication data (set_id=services)207.219.221.996251999m}  -e) ossec13001g{/Exim Auth failed2025-03-07 10:20:55 dovecot_plain authenticator failed for ([222.114.84.175]) [222.114.84.175]:45490: 535 Incorrect authentication data (set_id=services@heipowersystem.com)222.114.84.1751835841T|  -5' ossec13001gyExim Auth failed2025-03-07 10:14:36 dovecot_plain authenticator failed for ([47.206.95.195]) [47.206.95.195]:46025: 535 Incorrect authentication data (set_id=sales)47.206.95.1956252001j{  -_) ossec13001gyExim Auth failed2025-03-07 10:14:13 dovecot_plain authenticator failed for ([60.173.105.206]) [60.173.105.206]:54168: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)60.173.105.2061814991Zz  -?) ossec13001gyExim Auth failed2025-03-07 10:13:53 dovecot_plain authenticator failed for ([221.10.221.104]) [221.10.221.104]:50717: 535 Incorrect authentication data (set_id=services)221.10.221.1041814991ny  -g) ossec13001gy}Exim Auth failed2025-03-07 10:13:41 dovecot_plain authenticator failed for ([216.194.174.103]) [216.194.174.27]:58275: 535 Incorrect authentication data (set_id=services@heipowersystem.com)216.194.174.276252001vx  -y' ossec13001gy=Exim Auth failed2025-03-07 10:12:36 dovecot_plain authenticator failed for c188-151-64-10.bredband.tele2.se [188.151.64.10]:51330: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)188.151.64.102661886 Q4 3 B W p--#8JQu  -y% ossec13001gʋmExim Auth failed2025-03-07 11:30:12 dovecot_plain authenticator failed for 74.212.82.34.bc.googleusercontent.com ([34.82.26.7]) [34.82.212.74]:37706: 535 Incorrect authentication data (set_id=sales)34.82.212.746252001j  -_) ossec13001gʋYExim Auth failed2025-03-07 11:29:53 dovecot_plain authenticator failed for ([178.178.222.58]) [178.178.222.58]:59336: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)178.178.222.582017370g  -]% ossec13001gʊExim Auth failed2025-03-07 11:27:23 dovecot_plain authenticator failed for ([38.21.61.150]) [38.21.61.150]:49135: 535 Incorrect authentication data (set_id=services@heipowersystem.com)38.21.61.1506252001T  -5' ossec13001gʊyExim Auth failed2025-03-07 11:26:08 dovecot_plain authenticator failed for ([124.246.92.77]) [124.246.92.77]:55195: 535 Incorrect authentication data (set_id=sales)124.246.92.771880251z  -' ossec13001gʊcExim Auth failed2025-03-07 11:25:46 dovecot_plain authenticator failed for (24.115.19.225.res-cmts.sm3.ptd.net) [24.115.19.225]:50990: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)24.115.19.22562520010  =]' ossec13008gʉMail Reciepient rejected2025-03-07 11:23:14 H=(mail.nyaystambh.com) [165.154.228.9]:57801 F= rejected RCPT : Rejected relay attempt: '165.154.228.9' From: 'mftzuhqhv@nyaystambh.com' To: 'goofile@fastmail.com'165.154.228.91643084|  -) ossec13001gʇrExim Auth failed2025-03-07 11:13:13 dovecot_plain authenticator failed for s75-152-225-154.ab.hsia.telus.net [75.152.225.154]:10806: 535 Incorrect authentication data (set_id=services@heipowersystem.com)75.152.225.1546251999W  -9) ossec13001gʇHExim Auth failed2025-03-07 11:12:32 dovecot_plain authenticator failed for ([113.64.211.125]) [113.64.211.125]:42650: 535 Incorrect authentication data (set_id=sales)113.64.211.1251814991a  -S# ossec13001gʇ:Exim Auth failed2025-03-07 11:12:17 dovecot_plain authenticator failed for ([181.49.3.38]) [181.49.3.38]:58829: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)181.49.3.383686110  Uc' ossec11001gʆ"Deferred login on the cpanel service[2025-03-07 11:07:36 +0530] info [webmaild] 157.38.135.91 - kps@amplifypowerglobal.com "POST /cpsess0949056030/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [157.38.133.202] != Current IP Address [157.38.135.91]157.38.135.911269750c  -Q) ossec13001gʄExim Auth failed2025-03-07 11:02:44 dovecot_plain authenticator failed for 110-25-105-242.adsl.fetnet.net [110.25.105.242]:60017: 535 Incorrect authentication data (set_id=sales)110.25.105.2421668284g  -[' ossec13001gʄExim Auth failed2025-03-07 11:02:23 dovecot_plain authenticator failed for ([94.102.51.218]) [94.102.51.218]:33774: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)94.102.51.2182750405m  -e) ossec13001gʃ3Exim Auth failed2025-03-07 10:55:07 dovecot_plain authenticator failed for (static-78.219.149.202-tataidc.co.in) [202.149.219.78]:36614: 535 Incorrect authentication data (set_id=services)202.149.219.781269750}  -' ossec13001gʃExim Auth failed2025-03-07 10:54:37 dovecot_plain authenticator failed for syn-045-049-179-157.res.spectrum.com [45.49.179.157]:37733: 535 Incorrect authentication data (set_id=services@heipowersystem.com)45.49.179.1576252001W  -9) ossec13001gʂ;Exim Auth failed2025-03-07 10:50:57 dovecot_plain authenticator failed for ([197.242.170.10]) [197.242.170.10]:49903: 535 Incorrect authentication data (set_id=sales)197.242.170.101036973m  -c+ ossec13001gʂ)Exim Auth failed2025-03-07 10:50:40 dovecot_plain authenticator failed for ([125.139.124.120]) [125.139.124.120]:52034: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)125.139.124.1201835841 @vj^RF:." znbVJ>2& ~ r f Z N B 6 *    v j ^ R F : . "  z n b V J > 2 &    '   sg[OC7+~rfZNB6*pdXL|@ x k ^ Q D 7 *    t g Z M @ 3~qdWJ=0# zm`SF9,vi\OB5(reXK>1$  290557OF 290557J5 290557J 290557I 290557H 290557J^ 290557J 2921044, 290557N 290557M 290557Mw 290557K 290557K 290557K^ 290557N 2921044, 2921044+ 290557H 290557H 290557Hg 290557HO 290557G0 290557G+ 290557F 290557F 290557E 290557EM 290557EF 290557E3 2921044+ 2921044+ 2921044+ 2921044+ 2921044+ 2921044+ 2921044+ 2921044+ 2921044+ 2921044* 2921044* 2921044* 2921044* 2921044* 2921044* 2921044) 2921044( 2921044(w 2921044' 2921044' 2921044' 2921044' 2921044' 2921044' 2921044'{ 2921044& 2921044% 2921044% 2921044%O 2921044% 2921044% 2921044% 2921044% 2921044$} 2921044$W 2921044# 2921044# 2921044#L 2921044#< 2921044# 2921044" 2921044" 2921044! 2921044!m 2921044!X 2921044!N 2921044  2921044 2921044 2921044 2921044 2921044O 2921044 2921044 2921044 2921044 2921044 2921044 2921044 2921044 2921044& 2921044 2921044 2921044 2921044 2921044( 2921044' 2921044 2921044U 2921044 2921044 2921044 2921044 2921044 2921044 2921044 2921044 2921044| 2921044 2921044 2921044 290557D| 290557DP 290557D% 290557D 290557C 290557C 290557C 290557C 290557B 290557B^ 290557BC 290557B 290557A 290557A 290557A 290557@ 290557@ 290557@\ 290557?i 290557> 290557> 290557> 290557> 290557>, 290557> 290557= 290557=` 290557=? 290557= 290557< 290557; 2921044 2921044 2921044 2921044V 2921044 2921044 2921044 2921044 2921044( 2921044 2921044 2921044 o 2921044 h 2921044 2921044 2921044 2921044 2921044 2921044 2921044 2921044 L 2921044i 2921044 2921044 2921044 2921044 2921044 2921044 2921044 2921044u 2921044 290557; 290557: 290557: 290557: 290557:H 2905579 2905579' 2905578U 2905576 2905576B 2905576' 2905576 2905575 2905575 2905575 2905575k 2905575` 2905575 2905574 2905574 2905573 2905573 2905572f 2905572 2905571 2905571 2905571 2905571 2905570 2905570 2905570 2905570 2905570 2905570 2905570 290557/ 290557/ 290557/ 290557/ 290557/ 290557/ 290557/ 290557/ 290557/ 290557/ 290557/z 290557/v 290557/t 290557/f 290557/S 290557/= 290557/0 290557/ 290557. 290557. 290557. 290557. 290557.L 290557.? 290557.# 290557. 290557. 290557. 290557- 290557-g 290557-b 290557-Q 290557- 290557- 290557, 290557, 290557, 290557, 290557, 290557, 290557, 290557,b 290557,D 290557,: 290557+ 290557+ 290557+ 290557+l 290557+E 290557+ 290557* 290557* 290557*k 290557*A 290557*+ 290557* 290557) 290557( 290557( 290557( 290557( 290557( 290557( 290557( 290557( 290557( 290557O 290557N 290557N 290557O 290557O 2921044/ 2921044. 2921044-R 2921044-! 290557N 7 ; K b { g'  -[' ossec13001gʔHExim Auth failed2025-03-07 12:07:59 dovecot_plain authenticator failed for ([175.202.82.16]) [175.202.82.16]:56084: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)175.202.82.161835841W&  -;' ossec13001gʓExim Auth failed2025-03-07 12:05:54 dovecot_plain authenticator failed for ([182.42.113.10]) [182.42.113.10]:57504: 535 Incorrect authentication data (set_id=services)182.42.113.101814991m%  -e) ossec13001gʓExim Auth failed2025-03-07 12:05:35 dovecot_plain authenticator failed for ([220.182.11.126]) [220.182.11.126]:49986: 535 Incorrect authentication data (set_id=services@heipowersystem.com)220.182.11.1261814991I$  = + ossec13008gʒMail Reciepient rejected2025-03-07 12:01:50 H=(mail.s2seducationtrust.com) [165.154.208.196]:61836 F= rejected RCPT : Rejected relay attempt: '165.154.208.196' From: 'vgcrrouy@s2seducationtrust.com' To: 'goofile@fastmail.com'165.154.208.1961668284v#  -{% ossec13001gʒExim Auth failed2025-03-07 12:00:57 dovecot_plain authenticator failed for 111-70-13-24.emome-ip.hinet.net [111.70.13.24]:34339: 535 Incorrect authentication data (set_id=services@heipowersystem.com)111.70.13.241668284Q"  -1% ossec13001gʐExim Auth failed2025-03-07 11:52:12 dovecot_plain authenticator failed for ([111.50.70.34]) [111.50.70.34]:33210: 535 Incorrect authentication data (set_id=sales)111.50.70.341814991!  - + ossec13001gʐExim Auth failed2025-03-07 11:51:54 dovecot_plain authenticator failed for 123-195-225-182.dynamic.kbronet.com.tw [123.195.225.182]:37770: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)123.195.225.1821668284j  -a' ossec13001gʎExim Auth failed2025-03-07 11:44:17 dovecot_plain authenticator failed for syn-097-070-129-101.res.spectrum.com [97.70.129.101]:60671: 535 Incorrect authentication data (set_id=services)97.70.129.1016252001p  -i+ ossec13001gʎExim Auth failed2025-03-07 11:44:06 dovecot_plain authenticator failed for ([118.220.149.129]) [118.220.149.129]:51344: 535 Incorrect authentication data (set_id=services@heipowersystem.com)118.220.149.1291835841T  -5' ossec13001gʍExim Auth failed2025-03-07 11:41:01 dovecot_plain authenticator failed for ([112.196.60.13]) [112.196.60.13]:50108: 535 Incorrect authentication data (set_id=sales)112.196.60.131269750c  -W% ossec13001gʍExim Auth failed2025-03-07 11:40:52 dovecot_plain authenticator failed for ([2.55.122.202]) [2.55.122.202]:56797: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)2.55.122.202294640e  -S+ ossec13001gʍExim Auth failed2025-03-07 11:37:22 dovecot_login authenticator failed for ([190.121.193.126]) [190.121.193.126]:34356: 535 Incorrect authentication data (set_id=vikas.khandelwal)190.121.193.1263595528l  -e' ossec13001gʍ Exim Auth failed2025-03-07 11:37:06 dovecot_login authenticator failed for p160063-obmd01.osaka.ocn.ne.jp [61.112.103.62]:45687: 535 Incorrect authentication data (set_id=vikas.khandelwal)61.112.103.621861060x  -y+ ossec13001gʌExim Auth failed2025-03-07 11:36:48 dovecot_login authenticator failed for ([123.209.108.180]) [123.209.108.180]:57180: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)123.209.108.1802077456W  -;' ossec13001gʌRExim Auth failed2025-03-07 11:34:00 dovecot_plain authenticator failed for ([170.250.128.5]) [170.250.128.5]:45800: 535 Incorrect authentication data (set_id=services)170.250.128.56252001j  -a' ossec13001gʌFExim Auth failed2025-03-07 11:33:48 dovecot_plain authenticator failed for ([57.128.19.228]) [57.128.19.228]:39050: 535 Incorrect authentication data (set_id=services@heipowersystem.com)57.128.19.2283017382 % 5`ug8  -]% ossec13001gʙ-Exim Auth failed2025-03-07 12:28:52 dovecot_plain authenticator failed for ([197.5.144.31]) [197.5.144.31]:49404: 535 Incorrect authentication data (set_id=services@heipowersystem.com)197.5.144.312464461Y7  -=) ossec13001gʘExim Auth failed2025-03-07 12:27:43 dovecot_login authenticator failed for ([119.62.156.161]) [119.62.156.161]:4474: 535 Incorrect authentication data (set_id=services)119.62.156.1611814991m6  -e) ossec13001gʘExim Auth failed2025-03-07 12:27:26 dovecot_login authenticator failed for ([220.77.245.227]) [220.77.245.227]:48060: 535 Incorrect authentication data (set_id=services@heipowersystem.com)220.77.245.2271835841T5  -5' ossec13001gʗExim Auth failed2025-03-07 12:23:09 dovecot_plain authenticator failed for ([103.187.79.19]) [103.187.79.19]:55398: 535 Incorrect authentication data (set_id=sales)103.187.79.191269750j4  -_) ossec13001gʗExim Auth failed2025-03-07 12:22:34 dovecot_plain authenticator failed for ([27.107.168.206]) [27.107.168.206]:42858: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)27.107.168.2061269750g3  -Y) ossec13001gʖExim Auth failed2025-03-07 12:19:16 dovecot_login authenticator failed for 171-100-245-37.static.asianet.co.th [171.100.245.37]:36777: 535 Incorrect authentication data (set_id=info)171.100.245.371605651Q2  -1% ossec13001gʖExim Auth failed2025-03-07 12:19:34 dovecot_plain authenticator failed for ([103.4.103.61]) [103.4.103.61]:50888: 535 Incorrect authentication data (set_id=sales)103.4.103.611168579V1  -7) ossec13001gʖExim Auth failed2025-03-07 12:19:23 dovecot_login authenticator failed for ([211.228.113.27]) [211.228.113.27]:37113: 535 Incorrect authentication data (set_id=info)211.228.113.271835841}0  -' ossec13001gʖExim Auth failed2025-03-07 12:18:52 dovecot_login authenticator failed for dynamic-186-30-57-201.dynamic.etb.net.co [186.30.57.201]:50220: 535 Incorrect authentication data (set_id=info@heipowersystem.com)186.30.57.2013686110k/  -_+ ossec13001gʖExim Auth failed2025-03-07 12:19:11 dovecot_login authenticator failed for 165.199.148.122.sta.wbroadband.net.au [122.148.199.165]:60822: 535 Incorrect authentication data (set_id=info)122.148.199.1652077456h.  -[) ossec13001gʖExim Auth failed2025-03-07 12:19:11 dovecot_login authenticator failed for zdomainaccess.com [216.70.114.230]:38430: 535 Incorrect authentication data (set_id=info@heipowersystem.com)216.70.114.2306252001d-  -W% ossec13001gʖExim Auth failed2025-03-07 12:19:09 dovecot_plain authenticator failed for ([58.18.90.114]) [58.18.90.114]:55374: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)58.18.90.1141814991`,  -Q# ossec13001gʖExim Auth failed2025-03-07 12:18:59 dovecot_login authenticator failed for ([59.0.60.158]) [59.0.60.158]:49382: 535 Incorrect authentication data (set_id=info@heipowersystem.com)59.0.60.1581835841i+  -a' ossec13001gʖExim Auth failed2025-03-07 12:15:40 dovecot_plain authenticator failed for ([46.30.161.197]) [46.30.161.197]:50609: 535 Incorrect authentication data (set_id=services@heipowersystem.com)46.30.161.197690791W*  -;' ossec13001gʖ"Exim Auth failed2025-03-07 12:15:53 dovecot_plain authenticator failed for ([120.78.172.20]) [120.78.172.20]:55318: 535 Incorrect authentication data (set_id=services)120.78.172.201814991")  3M% ossec11301gʔdNew FTP connection.Mar 7 12:08:26 vm1 pure-ftpd[2923731]: (?@20.65.193.76) [INFO] New connection from 20.65.193.7620.65.193.766252001W(  -9) ossec13001gʔ\Exim Auth failed2025-03-07 12:08:19 dovecot_plain authenticator failed for ([218.94.115.164]) [218.94.115.164]:45196: 535 Incorrect authentication data (set_id=sales)218.94.115.1641814991     @ Otz~ ]H  -C+ ossec13001gʟExim Auth failed2025-03-07 12:57:13 dovecot_plain authenticator failed for ([122.187.230.154]) [122.187.230.154]:58327: 535 Incorrect authentication data (set_id=services)122.187.230.1541269750TG  -5' ossec13001gʟExim Auth failed2025-03-07 12:57:39 dovecot_plain authenticator failed for ([103.47.74.210]) [103.47.74.210]:43146: 535 Incorrect authentication data (set_id=sales)103.47.74.2101269750gF  -[' ossec13001gʟExim Auth failed2025-03-07 12:57:23 dovecot_plain authenticator failed for ([65.175.24.142]) [65.175.24.142]:52053: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)65.175.24.1426252001mE  -e) ossec13001gʟExim Auth failed2025-03-07 12:57:00 dovecot_plain authenticator failed for ([60.173.105.206]) [60.173.105.206]:46248: 535 Incorrect authentication data (set_id=services@heipowersystem.com)60.173.105.2061814991TD  -7% ossec13001gʞoExim Auth failed2025-03-07 12:51:17 dovecot_plain authenticator failed for ([193.93.237.8]) [193.93.237.8]:50718: 535 Incorrect authentication data (set_id=services)193.93.237.82017370mC  -e) ossec13001gʞWExim Auth failed2025-03-07 12:50:53 dovecot_plain authenticator failed for ([218.149.70.142]) [218.149.70.142]:33030: 535 Incorrect authentication data (set_id=services@heipowersystem.com)218.149.70.1421835841xB  -{+ ossec13001gʞExim Auth failed2025-03-07 12:49:32 dovecot_plain authenticator failed for (109-120-192-105.ip.btc-net.bg) [109.120.192.105]:59557: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)109.120.192.105732800vA  -y' ossec13001gʝExim Auth failed2025-03-07 12:49:02 dovecot_plain authenticator failed for 111-70-41-195.emome-ip.hinet.net [111.70.41.195]:59324: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)111.70.41.1951668284W@  -9) ossec13001gʜ(Exim Auth failed2025-03-07 12:41:36 dovecot_plain authenticator failed for ([212.220.113.55]) [212.220.113.55]:51232: 535 Incorrect authentication data (set_id=sales)212.220.113.552017370m?  -c+ ossec13001gʜExim Auth failed2025-03-07 12:41:19 dovecot_plain authenticator failed for ([115.242.200.126]) [115.242.200.126]:49556: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)115.242.200.1261269750S>  -7% ossec13001gʛExim Auth failed2025-03-07 12:37:02 dovecot_plain authenticator failed for ([5.11.164.165]) [5.11.164.165]:35870: 535 Incorrect authentication data (set_id=services)5.11.164.165298795j=  -a' ossec13001gʛExim Auth failed2025-03-07 12:36:47 dovecot_plain authenticator failed for ([125.20.46.114]) [125.20.46.114]:52710: 535 Incorrect authentication data (set_id=services@heipowersystem.com)125.20.46.1141269750I<  -'! ossec13001gʚExim Auth failed2025-03-07 12:35:37 dovecot_login authenticator failed for ([5.32.107.6]) [5.32.107.6]:40836: 535 Incorrect authentication data (set_id=info)5.32.107.6290557r;  -q' ossec13001gʚExim Auth failed2025-03-07 12:35:19 dovecot_login authenticator failed for h014-014-160-190.gd.netyou.jp [14.14.160.190]:60702: 535 Incorrect authentication data (set_id=info@heipowersystem.com)14.14.160.1901861060S:  =+ ossec13008gʙsMail Reciepient rejected2025-03-07 12:30:02 H=(mail.saintsoldiercollege.com) [165.154.208.227]:62545 F= rejected RCPT : Rejected relay attempt: '165.154.208.227' From: 'pqkyuuveiq@saintsoldiercollege.com' To: 'goofile@fastmail.com'165.154.208.2271668284]9  -C+ ossec13001gʙOExim Auth failed2025-03-07 12:29:27 dovecot_plain authenticator failed for ([220.120.224.227]) [220.120.224.227]:50538: 535 Incorrect authentication data (set_id=services)220.120.224.2271835841 *\~tj`VLB8.$zpf\H>4*   v l b X N D : 0 &    ~ t j ` V L B 8 . $    z p f \ R H > 4 *   vlbXND:0&|rh^TJ@6,"xdnZPF<2( ~tj`VLB8.$zfp\ | r h ^ T J @ 6 , "    x n d Z P F < 2 (   RRH>4*  vlbXND:0& gk! g7! gI! g! g! gڦ! gڎ! g! g! g! g! gu! g_! g! g! g! g֣! g! g! gn! gf! gd! g\! gҸ! gҰ! gљ! g! g! g! gϙ! gϏ! g}! g! g! g! g,! g! gZ! g)! g! g! gc! g! g! g! g! gz! g\! g! g! g! gš! gh! g|! g2! g ! gʿ! gʿ! gʿ! gʿ! gʿ9! gʾu! gʾ! gʾ !~ gʺ&!} gʺ!| gʹ!{ gʺ !z gʹ!y gʹ}!x gʹs!w gʸ!v gʸ!u gʶ!t gʵ!s gʳ!r gʳz!q gʲ!p gʲv!o gʱ!n gʱ!m gʱ!l gʱ!k gʱ!j gʱ !i gʰ)!h gʰ!g gʯ!f gʯA!e gʯ1!d gʭg!c gʬ!b gʬ!a gʫ!` gʫ!_ gʫn!^ gʪ!] gʩ!\ gʩ![ gʩ!Z gʨ!Y gʧ!X gʧ!W gʦ{!V gʦo!U gʦe!T gʥ!S gʤ,!R gʤ!Q gʤ!P gʣ!O gʢ!N gʢ!M gʢ!L gʢ!K gʡ_!J gʡS!I gʟ!H gʟ!G gʟ!F gʟ!E gʞo!D gʞW!C gʞ!B gʝ!A gʜ(!@ gʜ!? gʛ!> gʛ!= gʚ!< gʚ!; gʙs!: gʙO!9 gʙ-!8 gʘ!7 gʘ!6 gʗ!5 gʗ!4 gʖ!2 gʖ!1 gʖ!3 gʖ!/ gʖ!. gʖ!- gʖ!, gʖ!0 gʖ"!* gʖ!+ gʔd!) gʔ\!( gʔH!' gʓ!& gʓ!% gʒ!$ gʒ!# gʐ!" gʐ!! gʎ! gʎ! gʍ! gʍ! gʍ! gʍ ! gʌ! gʌR! gʌF! gʋm! gʋY! gʊ! gʊy! g! g! g! g! gO! gv! gV! g rejected RCPT : Rejected relay attempt: '165.154.213.54' From: 'lgjqqpn@amplifypowerglobal.com' To: 'goofile@fastmail.com'165.154.213.543469034ix  -[+ ossec13001gʹ}Exim Auth failed2025-03-07 14:46:45 dovecot_plain authenticator failed for c188-150-226-207.bredband.tele2.se [188.150.226.207]:50318: 535 Incorrect authentication data (set_id=sales)188.150.226.2072661886fw  -Y' ossec13001gʹsExim Auth failed2025-03-07 14:46:35 dovecot_plain authenticator failed for ([58.250.157.83]) [58.250.157.83]:2061: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)58.250.157.831814991Yv  -?) ossec13001gʸExim Auth failed2025-03-07 14:43:33 dovecot_plain authenticator failed for ([196.189.126.10]) [196.189.126.10]:44096: 535 Incorrect authentication data (set_id=services)196.189.126.10337996mu  -e) ossec13001gʸExim Auth failed2025-03-07 14:43:19 dovecot_plain authenticator failed for ([218.150.170.10]) [218.150.170.10]:58800: 535 Incorrect authentication data (set_id=services@heipowersystem.com)218.150.170.101835841mt  -e) ossec13001gʶExim Auth failed2025-03-07 14:34:25 dovecot_plain authenticator failed for ([220.77.182.171]) [220.77.182.171]:33446: 535 Incorrect authentication data (set_id=services@heipowersystem.com)220.77.182.1711835841js  -_) ossec13001gʵExim Auth failed2025-03-07 14:30:29 dovecot_plain authenticator failed for ([112.111.61.230]) [112.111.61.229]:60352: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)112.111.61.2291814991Wr  -9) ossec13001gʳExim Auth failed2025-03-07 14:21:16 dovecot_plain authenticator failed for ([182.160.107.51]) [182.160.107.51]:41358: 535 Incorrect authentication data (set_id=sales)182.160.107.511210997sq  -u% ossec13001gʳzExim Auth failed2025-03-07 14:21:06 dovecot_plain authenticator failed for 1-34-162-249.hinet-ip.hinet.net [1.34.162.249]:37933: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)1.34.162.2491668284Wp  -;' ossec13001gʲExim Auth failed2025-03-07 14:17:01 dovecot_plain authenticator failed for ([50.171.64.170]) [50.171.64.170]:36694: 535 Incorrect authentication data (set_id=services)50.171.64.1706252001po  -i+ ossec13001gʲvExim Auth failed2025-03-07 14:16:45 dovecot_plain authenticator failed for ([176.212.190.170]) [176.212.190.170]:55668: 535 Incorrect authentication data (set_id=services@heipowersystem.com)176.212.190.1702017370bn  -O) ossec13001gʱExim Auth failed2025-03-07 14:14:38 dovecot_login authenticator failed for ([222.239.231.61]) [222.239.231.61]:55856: 535 Incorrect authentication data (set_id=vikas.khandelwal)222.239.231.611835841vm  -w) ossec13001gʱExim Auth failed2025-03-07 14:14:03 dovecot_login authenticator failed for ([159.223.250.131]) [161.35.200.202]:42522: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)161.35.200.2022921044l  W% ossec9708gʱDovecot Aborted Login with empty userMar 7 14:13:40 vm1 dovecot[312763]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 2 secs): user=<>, rip=71.6.134.235, lip=103.74.54.108, TLS, session=71.6.134.2356252001+k  =O+ ossec13008gʱMail Reciepient rejected2025-03-07 14:12:55 H=(mail.hsnews.in) [165.154.226.249]:53999 F= rejected RCPT : Rejected relay attempt: '165.154.226.249' From: 'cvwmbrplvpl@hsnews.in' To: 'goofile@fastmail.com'165.154.226.2491668284Wj  -;' ossec13001gʱExim Auth failed2025-03-07 14:10:50 dovecot_plain authenticator failed for ([103.65.227.12]) [103.65.227.12]:50377: 535 Incorrect authentication data (set_id=services)103.65.227.121210997  + P j   4LgQ  -1% ossec13001gšExim Auth failed2025-03-07 15:25:37 dovecot_plain authenticator failed for ([110.35.63.27]) [110.35.63.27]:47518: 535 Incorrect authentication data (set_id=sales)110.35.63.271835841a  -S# ossec13001ghExim Auth failed2025-03-07 15:24:46 dovecot_plain authenticator failed for ([38.79.83.28]) [38.79.83.28]:48914: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)38.79.83.286252001d  -W% ossec13001g|Exim Auth failed2025-03-07 15:25:07 dovecot_plain authenticator failed for ([27.124.18.27]) [27.124.18.27]:55410: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)27.124.18.271269750Q  -1% ossec13001g2Exim Auth failed2025-03-07 15:23:53 dovecot_plain authenticator failed for ([14.37.206.76]) [14.37.206.76]:43138: 535 Incorrect authentication data (set_id=sales)14.37.206.761835841|  -) ossec13001g Exim Auth failed2025-03-07 15:23:34 dovecot_plain authenticator failed for syn-172-248-047-114.res.spectrum.com [172.248.47.114]:40282: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)172.248.47.1146252001c  -O+ ossec13001gʿExim Auth failed2025-03-07 15:13:23 dovecot_plain authenticator failed for 184.sub-166-145-211.myvzw.com [166.145.211.184]:8854: 535 Incorrect authentication data (set_id=sales)166.145.211.1846252001W  -;' ossec13001gʿExim Auth failed2025-03-07 15:13:38 dovecot_plain authenticator failed for ([31.134.243.37]) [31.134.243.37]:35344: 535 Incorrect authentication data (set_id=services)31.134.243.372017370p  -i+ ossec13001gʿExim Auth failed2025-03-07 15:13:27 dovecot_plain authenticator failed for ([123.209.108.180]) [123.209.108.180]:51846: 535 Incorrect authentication data (set_id=services@heipowersystem.com)123.209.108.1802077456g  -[' ossec13001gʿExim Auth failed2025-03-07 15:13:12 dovecot_plain authenticator failed for ([61.173.105.26]) [61.173.105.26]:46154: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)61.173.105.261814991p  -q# ossec13001gʿ9Exim Auth failed2025-03-07 15:11:12 dovecot_login authenticator failed for 111-70-32-9.emome-ip.hinet.net [111.70.32.9]:59369: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)111.70.32.91668284m  -e) ossec13001gʾuExim Auth failed2025-03-07 15:07:55 dovecot_plain authenticator failed for ([192.199.58.185]) [192.199.58.185]:41336: 535 Incorrect authentication data (set_id=services@heipowersystem.com)192.199.58.1856251999W  -;' ossec13001gʾExim Auth failed2025-03-07 15:06:22 dovecot_plain authenticator failed for ([188.234.245.7]) [188.234.245.7]:54212: 535 Incorrect authentication data (set_id=services)188.234.245.72017370b~  -Y# ossec13001gʾ Exim Auth failed2025-03-07 15:06:12 dovecot_plain authenticator failed for ([65.20.169.5]) [65.20.169.5]:36618: 535 Incorrect authentication data (set_id=services@heipowersystem.com)65.20.169.599237W}  -9) ossec13001gʺ&Exim Auth failed2025-03-07 14:49:33 dovecot_plain authenticator failed for ([103.218.132.27]) [103.218.132.27]:46617: 535 Incorrect authentication data (set_id=sales)103.218.132.271269750p|  -q# ossec13001gʺExim Auth failed2025-03-07 14:49:19 dovecot_plain authenticator failed for 116-59-8-61.emome-ip.hinet.net [116.59.8.61]:33034: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)116.59.8.611668284m{  -e) ossec13001gʹExim Auth failed2025-03-07 14:48:38 dovecot_plain authenticator failed for ([190.121.193.46]) [190.121.193.46]:50456: 535 Incorrect authentication data (set_id=services@heipowersystem.com)190.121.193.463595528lz  -c) ossec13001gʺ Exim Auth failed2025-03-07 14:49:06 dovecot_plain authenticator failed for syn-172-118-123-044.res.spectrum.com [172.118.123.44]:60414: 535 Incorrect authentication data (set_id=services)172.118.123.446252001 m 5 M s $3Xmg  -[' ossec13001gExim Auth failed2025-03-07 16:01:04 dovecot_plain authenticator failed for ([197.211.47.66]) [197.211.47.66]:56589: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)197.211.47.662328926W  -;' ossec13001g,Exim Auth failed2025-03-07 15:57:55 dovecot_plain authenticator failed for ([92.255.190.69]) [92.255.190.69]:53712: 535 Incorrect authentication data (set_id=services)92.255.190.692017370m  -e) ossec13001gExim Auth failed2025-03-07 15:57:24 dovecot_plain authenticator failed for ([178.163.27.129]) [178.163.27.129]:54154: 535 Incorrect authentication data (set_id=services@heipowersystem.com)178.163.27.1292017370W  -9) ossec13001gZExim Auth failed2025-03-07 15:54:24 dovecot_plain authenticator failed for ([186.148.187.91]) [186.148.187.91]:47547: 535 Incorrect authentication data (set_id=sales)186.148.187.913686110w  -y) ossec13001g)Exim Auth failed2025-03-07 15:53:37 dovecot_plain authenticator failed for (207.122.87.116.starhub.net.sg) [116.87.122.207]:50332: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)116.87.122.2071880251i  -]) ossec13001gExim Auth failed2025-03-07 15:49:00 dovecot_login authenticator failed for 125-228-154-55.hinet-ip.hinet.net [125.228.154.55]:33247: 535 Incorrect authentication data (set_id=services)125.228.154.551668284q  -q' ossec13001gExim Auth failed2025-03-07 15:48:43 dovecot_login authenticator failed for (ppp11-lumwana.zamnet.zm) [196.46.199.11]:50873: 535 Incorrect authentication data (set_id=services@heipowersystem.com)196.46.199.11895949g  -[' ossec13001gcExim Auth failed2025-03-07 15:46:01 dovecot_plain authenticator failed for ([49.124.148.31]) [49.124.148.31]:49408: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)49.124.148.311733045W  -;' ossec13001gExim Auth failed2025-03-07 15:44:54 dovecot_plain authenticator failed for ([114.30.180.58]) [114.30.180.58]:48916: 535 Incorrect authentication data (set_id=services)114.30.180.581835841m  -e) ossec13001gExim Auth failed2025-03-07 15:44:30 dovecot_plain authenticator failed for ([223.220.167.38]) [223.220.167.38]:36348: 535 Incorrect authentication data (set_id=services@heipowersystem.com)223.220.167.381814991w  -w+ ossec13001gExim Auth failed2025-03-07 15:40:22 dovecot_login authenticator failed for (amplifypowerglobal.com) [111.122.211.212]:1106: 535 Incorrect authentication data (set_id=service@amplifypowerglobal.com)111.122.211.2121814991a  -K+ ossec13001gExim Auth failed2025-03-07 15:39:57 dovecot_login authenticator failed for (amplifypowerglobal.com) [111.122.211.212]:62094: 535 Incorrect authentication data (set_id=nologin)111.122.211.2121814991V  -;' ossec13001gzExim Auth failed2025-03-07 15:37:54 dovecot_plain authenticator failed for ([87.200.73.165]) [87.200.73.165]:32999: 535 Incorrect authentication data (set_id=services)87.200.73.165290557d  -Y# ossec13001g\Exim Auth failed2025-03-07 15:37:24 dovecot_plain authenticator failed for ([61.169.6.99]) [61.169.6.99]:38490: 535 Incorrect authentication data (set_id=services@heipowersystem.com)61.169.6.991814991Q  -1% ossec13001gExim Auth failed2025-03-07 15:31:40 dovecot_plain authenticator failed for ([41.76.80.100]) [41.76.80.100]:60228: 535 Incorrect authentication data (set_id=sales)41.76.80.1002328926m  -c+ ossec13001gExim Auth failed2025-03-07 15:31:29 dovecot_plain authenticator failed for ([175.206.105.126]) [175.206.105.126]:42200: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)175.206.105.1261835841  -% ossec13001gExim Auth failed2025-03-07 15:26:59 dovecot_plain authenticator failed for vps-79f20bfc.vps.ovh.net ([87.98.249.193]) [51.75.24.107]:12556: 535 Incorrect authentication data (set_id=services@heipowersystem.com)51.75.24.1073017382 8 ? h 7Llz+  - ) ossec13001gExim Auth failed2025-03-07 16:44:14 dovecot_plain authenticator failed for (nsg-corporate-21.229.187.122.airtel.in) [122.187.229.21]:53726: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)122.187.229.211269750\*  -G% ossec13001gnExim Auth failed2025-03-07 16:37:25 dovecot_login authenticator failed for ([38.21.61.150]) [38.21.61.150]:51923: 535 Incorrect authentication data (set_id=vikas.khandelwal)38.21.61.1506252001Z)  -?) ossec13001gfExim Auth failed2025-03-07 16:37:18 dovecot_plain authenticator failed for ([195.222.57.183]) [195.222.57.183]:42342: 535 Incorrect authentication data (set_id=services)195.222.57.1833277605u(  -u) ossec13001gdExim Auth failed2025-03-07 16:37:15 dovecot_login authenticator failed for ([167.142.198.54]) [167.142.198.54]:38124: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)167.142.198.546252001n'  -g+ ossec13001g\Exim Auth failed2025-03-07 16:37:07 dovecot_plain authenticator failed for ([196.200.227.78]) [196.200.227.194]:33982: 535 Incorrect authentication data (set_id=services@heipowersystem.com)196.200.227.194149590\&  -I# ossec13001gҸExim Auth failed2025-03-07 16:34:24 dovecot_plain authenticator failed for 95-31-6-109.static.corbina.ru [95.31.6.109]:60728: 535 Incorrect authentication data (set_id=sales)95.31.6.1092017370g%  -[' ossec13001gҰExim Auth failed2025-03-07 16:34:14 dovecot_plain authenticator failed for ([121.166.85.53]) [121.166.85.53]:35124: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)121.166.85.531835841$  Uc' ossec11001gљDeferred login on the cpanel service[2025-03-07 16:29:37 +0530] info [webmaild] 157.38.135.30 - kps@amplifypowerglobal.com "POST /cpsess2305487521/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [157.38.132.158] != Current IP Address [157.38.135.30]157.38.135.301269750m#  -e) ossec13001gExim Auth failed2025-03-07 16:26:38 dovecot_plain authenticator failed for broadband-188-255-34-171.ip.moscow.rt.ru [188.255.34.171]:58400: 535 Incorrect authentication data (set_id=sales)188.255.34.1712017370m"  -c+ ossec13001gExim Auth failed2025-03-07 16:26:34 dovecot_plain authenticator failed for ([118.122.255.5]) [118.122.252.141]:2452: 535 Incorrect authentication data (set_id=services@heipowersystem.com)118.122.252.1411814991j!  -_) ossec13001gExim Auth failed2025-03-07 16:26:25 dovecot_plain authenticator failed for ([138.75.118.229]) [138.75.118.229]:50722: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)138.75.118.2291880251Z  -?) ossec13001gϙExim Auth failed2025-03-07 16:21:05 dovecot_plain authenticator failed for ([103.115.31.219]) [103.115.31.219]:58488: 535 Incorrect authentication data (set_id=services)103.115.31.2191643084S  -7% ossec13001gϏExim Auth failed2025-03-07 16:20:54 dovecot_plain authenticator failed for ([212.50.48.86]) [212.50.48.86]:56896: 535 Incorrect authentication data (set_id=services)212.50.48.86298795u  -u) ossec13001g}Exim Auth failed2025-03-07 16:20:37 dovecot_plain authenticator failed for ns1019254.ip-15-204-208.us [15.204.208.192]:32782: 535 Incorrect authentication data (set_id=services@heipowersystem.com)15.204.208.1926252001T  -7% ossec13001gExim Auth failed2025-03-07 16:09:28 dovecot_plain authenticator failed for ([49.245.37.17]) [49.245.37.17]:56369: 535 Incorrect authentication data (set_id=services)49.245.37.171880251l  -e) ossec13001gExim Auth failed2025-03-07 16:09:17 dovecot_plain authenticator failed for ([196.188.187.85]) [196.188.187.85]:58414: 535 Incorrect authentication data (set_id=services@heipowersystem.com)196.188.187.85337996 ( Q y  /Qvj<  -_) ossec13001g7Exim Auth failed2025-03-07 17:23:25 dovecot_plain authenticator failed for ([220.178.246.43]) [220.178.246.43]:57553: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)220.178.246.431814991W;  -9) ossec13001gIExim Auth failed2025-03-07 17:23:43 dovecot_plain authenticator failed for ([111.172.120.32]) [111.172.120.32]:48416: 535 Incorrect authentication data (set_id=sales)111.172.120.321814991Z:  -?) ossec13001gExim Auth failed2025-03-07 17:17:40 dovecot_plain authenticator failed for ([222.143.30.155]) [222.143.30.155]:58990: 535 Incorrect authentication data (set_id=services)222.143.30.1551814991k9  -e) ossec13001gExim Auth failed2025-03-07 17:17:23 dovecot_plain authenticator failed for ([213.32.253.235]) [213.32.253.235]:35796: 535 Incorrect authentication data (set_id=services@heipowersystem.com)213.32.253.23599237t8  -y# ossec13001gڦExim Auth failed2025-03-07 17:08:14 dovecot_login authenticator failed for (5x166x68x89.dynamic.barnaul.ertelecom.ru) [5.166.68.89]:34690: 535 Incorrect authentication data (set_id=vikas.khandelwal)5.166.68.892017370r7  -q' ossec13001gڎExim Auth failed2025-03-07 17:07:50 dovecot_login authenticator failed for ([92.255.190.69]) [92.255.190.69]:41654: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)92.255.190.692017370W6  -9) ossec13001gExim Auth failed2025-03-07 17:05:26 dovecot_plain authenticator failed for ([119.62.156.161]) [119.62.156.161]:44892: 535 Incorrect authentication data (set_id=sales)119.62.156.1611814991g5  -[' ossec13001gExim Auth failed2025-03-07 17:04:51 dovecot_plain authenticator failed for ([188.234.245.7]) [188.234.245.7]:54598: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)188.234.245.72017370Z4  -?) ossec13001gExim Auth failed2025-03-07 17:04:44 dovecot_plain authenticator failed for ([124.112.45.222]) [124.112.45.222]:48106: 535 Incorrect authentication data (set_id=services)124.112.45.2221814991y3  -}) ossec13001gExim Auth failed2025-03-07 17:04:29 dovecot_plain authenticator failed for (m121-202-152-40.smartone.com) [121.202.152.40]:56481: 535 Incorrect authentication data (set_id=services@heipowersystem.com)121.202.152.401819730T2  -7% ossec13001guExim Auth failed2025-03-07 16:58:52 dovecot_plain authenticator failed for ([85.152.57.60]) [85.152.57.60]:53331: 535 Incorrect authentication data (set_id=services)85.152.57.6025107691  - ) ossec13001g_Exim Auth failed2025-03-07 16:58:31 dovecot_plain authenticator failed for syn-098-156-255-186.res.spectrum.com [98.156.255.186]:41272: 535 Incorrect authentication data (set_id=services@heipowersystem.com)98.156.255.1866252001m0  -c+ ossec13001gExim Auth failed2025-03-07 16:56:15 dovecot_plain authenticator failed for ([118.183.180.108]) [118.183.180.108]:36552: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)118.183.180.1081814991T/  -5' ossec13001gExim Auth failed2025-03-07 16:56:36 dovecot_plain authenticator failed for ([92.202.82.102]) [154.47.20.224]:30397: 535 Incorrect authentication data (set_id=sales)154.47.20.2241861060S.  -7% ossec13001gExim Auth failed2025-03-07 16:51:50 dovecot_plain authenticator failed for ([196.0.34.106]) [196.0.34.106]:32798: 535 Incorrect authentication data (set_id=services)196.0.34.106226074p-  -i+ ossec13001g֣Exim Auth failed2025-03-07 16:51:06 dovecot_plain authenticator failed for ([103.115.254.158]) [103.115.254.158]:37364: 535 Incorrect authentication data (set_id=services@heipowersystem.com)103.115.254.1581210997`,  -O% ossec13001gExim Auth failed2025-03-07 16:44:28 dovecot_plain authenticator failed for 111-70-19-17.emome-ip.hinet.net [111.70.19.17]:46185: 535 Incorrect authentication data (set_id=sales)111.70.19.171668284  3 ^ j o ;JSogM  -]% ossec13001gExim Auth failed2025-03-07 17:55:55 dovecot_plain authenticator failed for ([220.81.9.218]) [220.81.9.218]:47506: 535 Incorrect authentication data (set_id=services@heipowersystem.com)220.81.9.2181835841`L  -O% ossec13001gExim Auth failed2025-03-07 17:48:01 dovecot_plain authenticator failed for 111-70-38-54.emome-ip.hinet.net [111.70.38.54]:34233: 535 Incorrect authentication data (set_id=sales)111.70.38.541668284sK  -q) ossec13001gExim Auth failed2025-03-07 17:47:33 dovecot_plain authenticator failed for ip212-227-58-204.pbiaas.com [212.227.58.204]:40166: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)212.227.58.2043017382mJ  -e) ossec13001g~Exim Auth failed2025-03-07 17:45:57 dovecot_plain authenticator failed for ([183.100.18.224]) [183.100.18.224]:41178: 535 Incorrect authentication data (set_id=services@heipowersystem.com)183.100.18.2241835841ZI  -?) ossec13001gExim Auth failed2025-03-07 17:46:11 dovecot_plain authenticator failed for ([220.182.11.126]) [220.182.11.126]:42791: 535 Incorrect authentication data (set_id=services)220.182.11.1261814991gH  -]% ossec13001g(Exim Auth failed2025-03-07 17:40:15 dovecot_plain authenticator failed for ([113.192.1.27]) [113.192.1.26]:60263: 535 Incorrect authentication data (set_id=services@heipowersystem.com)113.192.1.261643084TG  -5' ossec13001g@Exim Auth failed2025-03-07 17:36:23 dovecot_plain authenticator failed for ([116.88.187.44]) [116.88.187.44]:41607: 535 Incorrect authentication data (set_id=sales)116.88.187.441880251mF  -c+ ossec13001g6Exim Auth failed2025-03-07 17:36:13 dovecot_plain authenticator failed for ([211.221.130.246]) [211.221.130.246]:46712: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)211.221.130.2461835841`E  -O% ossec13001gߟExim Auth failed2025-03-07 17:29:26 dovecot_plain authenticator failed for wsip-70-169-19-52.hr.hr.cox.net [70.169.19.52]:48866: 535 Incorrect authentication data (set_id=sales)70.169.19.526252001\D  -I# ossec13001g߃Exim Auth failed2025-03-07 17:28:59 dovecot_plain authenticator failed for p85005-obmd01.osaka.ocn.ne.jp [180.7.156.4]:41796: 535 Incorrect authentication data (set_id=sales)180.7.156.41861060ZC  -?) ossec13001gExim Auth failed2025-03-07 17:28:55 dovecot_login authenticator failed for ([221.146.201.37]) [221.146.201.37]:55190: 535 Incorrect authentication data (set_id=services)221.146.201.371835841wB  -{' ossec13001goExim Auth failed2025-03-07 17:28:39 dovecot_plain authenticator failed for h88-129-31-231.cust.bredband2.com [88.129.31.231]:49025: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)88.129.31.2312661886pA  -i+ ossec13001ggExim Auth failed2025-03-07 17:28:31 dovecot_login authenticator failed for ([119.206.117.105]) [119.206.117.105]:58058: 535 Incorrect authentication data (set_id=services@heipowersystem.com)119.206.117.1051835841Q@  -1% ossec13001g'Exim Auth failed2025-03-07 17:27:27 dovecot_login authenticator failed for ([36.37.203.28]) [36.37.203.28]:36224: 535 Incorrect authentication data (set_id=sales)36.37.203.281831722i?  -]) ossec13001gExim Auth failed2025-03-07 17:27:18 dovecot_login authenticator failed for zdomainaccess.com [216.70.114.230]:49526: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)216.70.114.2306252001X>  -?' ossec13001gލExim Auth failed2025-03-07 17:24:52 dovecot_plain authenticator failed for ([185.189.123.105]) [37.235.18.145]:37871: 535 Incorrect authentication data (set_id=services)37.235.18.145130758=  - ' ossec13001gkExim Auth failed2025-03-07 17:24:18 dovecot_plain authenticator failed for broadband-5-228-183-178.ip.moscow.rt.ru [5.228.183.178]:15898: 535 Incorrect authentication data (set_id=services@heipowersystem.com)5.228.183.1782017370 (0 B h 0EZi{a^  -S# ossec13001gIExim Auth failed2025-03-07 18:32:01 dovecot_plain authenticator failed for ([112.72.4.98]) [112.72.4.98]:41674: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)112.72.4.982029969j]  -_) ossec13001g+Exim Auth failed2025-03-07 18:31:30 dovecot_plain authenticator failed for ([117.252.49.222]) [117.252.49.222]:53424: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)117.252.49.2221269750m\  -e) ossec13001gExim Auth failed2025-03-07 18:29:19 dovecot_plain authenticator failed for ([112.91.124.108]) [112.91.124.108]:60427: 535 Incorrect authentication data (set_id=services@heipowersystem.com)112.91.124.1081814991g[  -[' ossec13001gExim Auth failed2025-03-07 18:25:25 dovecot_plain authenticator failed for ([103.65.227.12]) [103.65.227.12]:53675: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)103.65.227.121210997gZ  -[' ossec13001gExim Auth failed2025-03-07 18:24:58 dovecot_plain authenticator failed for ([60.29.100.218]) [60.29.100.218]:33754: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)60.29.100.2181814991fY  -Y' ossec13001gvExim Auth failed2025-03-07 18:19:57 dovecot_plain authenticator failed for 57-45-246-103.southernonline.net [103.246.45.57]:37160: 535 Incorrect authentication data (set_id=services)103.246.45.571269750gX  -]% ossec13001g]Exim Auth failed2025-03-07 18:19:31 dovecot_plain authenticator failed for ([98.70.127.17]) [98.70.127.17]:44458: 535 Incorrect authentication data (set_id=services@heipowersystem.com)98.70.127.171269750oW  -m% ossec13001g<Exim Auth failed2025-03-07 18:19:00 dovecot_plain authenticator failed for ([186.73.22.20]) [186.73.22.20]:49212: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)186.73.22.203703430oV  -k' ossec13001gExim Auth failed2025-03-07 18:18:15 dovecot_login authenticator failed for (s2seducationtrust.com) [111.207.12.99]:46442: 535 Incorrect authentication data (set_id=test@s2seducationtrust.com)111.207.12.991814991\U  -E' ossec13001gExim Auth failed2025-03-07 18:17:50 dovecot_login authenticator failed for (s2seducationtrust.com) [111.207.12.99]:43244: 535 Incorrect authentication data (set_id=nologin)111.207.12.991814991QT  -3# ossec13001g|Exim Auth failed2025-03-07 18:07:14 dovecot_plain authenticator failed for ([101.13.5.49]) [101.13.5.49]:39686: 535 Incorrect authentication data (set_id=services)101.13.5.491668284mS  -e) ossec13001gpExim Auth failed2025-03-07 18:07:03 dovecot_plain authenticator failed for ([61.185.216.150]) [61.185.216.150]:48429: 535 Incorrect authentication data (set_id=services@heipowersystem.com)61.185.216.1501814991SR  -5' ossec13001g4Exim Auth failed2025-03-07 18:06:02 dovecot_plain authenticator failed for ([178.61.149.64]) [178.61.149.64]:40507: 535 Incorrect authentication data (set_id=sales)178.61.149.64285570VQ  -9) ossec13001g$Exim Auth failed2025-03-07 18:05:47 dovecot_plain authenticator failed for ([213.59.165.109]) [213.59.165.109]:40066: 535 Incorrect authentication data (set_id=sales)213.59.165.109690791jP  -_) ossec13001gExim Auth failed2025-03-07 18:05:33 dovecot_plain authenticator failed for ([201.59.211.214]) [201.59.211.214]:41782: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)201.59.211.2143469034tO  -s) ossec13001gExim Auth failed2025-03-07 17:59:47 dovecot_plain authenticator failed for 17.sub-166-248-194.myvzw.com [166.248.194.17]:61854: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)166.248.194.176252001TN  -5' ossec13001gExim Auth failed2025-03-07 18:00:02 dovecot_plain authenticator failed for ([124.160.45.26]) [124.160.45.26]:35804: 535 Incorrect authentication data (set_id=sales)124.160.45.261814991 - D V u  ;Pexo  -}) ossec13001g}Exim Auth failed2025-03-07 19:02:44 dovecot_plain authenticator failed for ([31.141.253.119]) [31.141.253.119]:51602: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)31.141.253.119298795cn  -S' ossec13001gExim Auth failed2025-03-07 19:02:53 dovecot_plain authenticator failed for ([124.246.92.77]) [124.246.92.77]:58278: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)124.246.92.771880251am  -O' ossec13001gExim Auth failed2025-03-07 19:00:44 dovecot_login authenticator failed for 81.60.194.189.dyn.user.ono.com [81.60.194.189]:57424: 535 Incorrect authentication data (set_id=sales)81.60.194.1892510769gl  -[' ossec13001gExim Auth failed2025-03-07 19:00:26 dovecot_login authenticator failed for ([103.170.0.206]) [103.170.0.206]:52201: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)103.170.0.2061269750gk  -[' ossec13001gExim Auth failed2025-03-07 18:58:49 dovecot_plain authenticator failed for ([95.220.25.124]) [95.220.25.124]:62509: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)95.220.25.1242017370Zj  -=+ ossec13001gExim Auth failed2025-03-07 18:56:37 dovecot_plain authenticator failed for ([115.245.172.214]) [115.245.172.214]:45162: 535 Incorrect authentication data (set_id=sales)115.245.172.2141269750ai  -S# ossec13001gExim Auth failed2025-03-07 18:56:26 dovecot_plain authenticator failed for ([27.96.91.71]) [27.96.91.71]:36946: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)27.96.91.711269750h  -' ossec13001gExim Auth failed2025-03-07 18:55:38 dovecot_login authenticator failed for 89-179-99-200.broadband.corbina.ru [89.179.99.200]:59472: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)89.179.99.2002017370(g  3U) ossec11301gNew FTP connection.Mar 7 18:55:20 vm1 pure-ftpd[3008303]: (?@167.94.145.110) [INFO] New connection from 167.94.145.110167.94.145.1106252001Wf  -;' ossec13001gExim Auth failed2025-03-07 18:54:54 dovecot_plain authenticator failed for ([58.238.181.96]) [58.238.181.96]:34286: 535 Incorrect authentication data (set_id=services)58.238.181.961835841e  - + ossec13001gExim Auth failed2025-03-07 18:54:42 dovecot_plain authenticator failed for (237-166.adsl.static.espeed.com.bn) [119.160.166.237]:41734: 535 Incorrect authentication data (set_id=services@heipowersystem.com)119.160.166.2371820814]d -C) ossec13001gOExim Auth failed2025-03-07 18:53:26 dovecot_login authenticator failed for (fablixsolutions.com) [101.89.140.209]:49054: 535 Incorrect authentication data (set_id=nologin)101.89.140.2091814991]c  -C+ ossec13001gvExim Auth failed2025-03-07 18:49:49 dovecot_plain authenticator failed for ([193.158.248.248]) [193.158.248.248]:36196: 535 Incorrect authentication data (set_id=services)193.158.248.2482921044jb  -a' ossec13001gVExim Auth failed2025-03-07 18:49:18 dovecot_plain authenticator failed for ([85.26.221.136]) [85.26.221.136]:45467: 535 Incorrect authentication data (set_id=services@heipowersystem.com)85.26.221.1362017370ea  -Y' ossec13001g<Exim Auth failed2025-03-07 18:48:52 dovecot_login authenticator failed for (User) [193.46.255.40]:47026: 535 Incorrect authentication data (set_id=dfgdsfgfdgdfg@vandanabalbharti.com)193.46.255.40798549W`  -9) ossec13001g(Exim Auth failed2025-03-07 18:39:59 dovecot_plain authenticator failed for ([217.115.87.186]) [217.115.87.186]:56568: 535 Incorrect authentication data (set_id=sales)217.115.87.1862017370t_  -w% ossec13001gExim Auth failed2025-03-07 18:39:43 dovecot_plain authenticator failed for h77-53-111-65.cust.bredband2.com [77.53.111.65]:44990: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)77.53.111.652661886 d. @ e d  "1CXdp  -i+ ossec13001gExim Auth failed2025-03-07 19:59:19 dovecot_plain authenticator failed for ([182.163.122.133]) [182.163.122.133]:14975: 535 Incorrect authentication data (set_id=services@heipowersystem.com)182.163.122.1331210997g  -[' ossec13001gExim Auth failed2025-03-07 19:55:44 dovecot_plain authenticator failed for ([103.69.244.39]) [103.69.244.39]:51266: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)103.69.244.391269750j~  -_) ossec13001gExim Auth failed2025-03-07 19:47:32 dovecot_plain authenticator failed for ([106.55.161.136]) [106.55.161.136]:53574: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)106.55.161.1361814991m}  -e) ossec13001gExim Auth failed2025-03-07 19:42:39 dovecot_plain authenticator failed for ([223.82.241.146]) [223.82.241.146]:38382: 535 Incorrect authentication data (set_id=services@heipowersystem.com)223.82.241.1461814991W|  -;' ossec13001gExim Auth failed2025-03-07 19:43:00 dovecot_plain authenticator failed for ([47.206.95.195]) [47.206.95.195]:52314: 535 Incorrect authentication data (set_id=services)47.206.95.1956252001`{  -Q# ossec13001gExim Auth failed2025-03-07 19:37:47 dovecot_plain authenticator failed for 116-59-8-61.emome-ip.hinet.net [116.59.8.61]:40305: 535 Incorrect authentication data (set_id=services)116.59.8.611668284az  -U! ossec13001gExim Auth failed2025-03-07 19:37:26 dovecot_plain authenticator failed for ([1.25.18.18]) [1.25.18.18]:36998: 535 Incorrect authentication data (set_id=services@heipowersystem.com)1.25.18.181814991Wy  -9) ossec13001gqExim Auth failed2025-03-07 19:36:41 dovecot_plain authenticator failed for ([79.164.139.110]) [79.164.139.110]:49820: 535 Incorrect authentication data (set_id=sales)79.164.139.1102017370xx  -% ossec13001giExim Auth failed2025-03-07 19:36:31 dovecot_plain authenticator failed for syn-076-169-081-036.res.spectrum.com [76.169.81.36]:60178: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)76.169.81.366252001mw  -e) ossec13001gExim Auth failed2025-03-07 19:25:42 dovecot_plain authenticator failed for ([112.176.249.35]) [112.176.249.35]:38021: 535 Incorrect authentication data (set_id=services@heipowersystem.com)112.176.249.351835841mv  -g' ossec13001gExim Auth failed2025-03-07 19:26:08 dovecot_plain authenticator failed for broadband-85-30-248-213.ip.moscow.rt.ru [85.30.248.213]:52222: 535 Incorrect authentication data (set_id=services)85.30.248.2132017370au  -Q% ossec13001gFExim Auth failed2025-03-07 19:23:10 dovecot_plain authenticator failed for h77-53-111-65.cust.bredband2.com [77.53.111.65]:55608: 535 Incorrect authentication data (set_id=sales)77.53.111.652661886}t  -' ossec13001g>Exim Auth failed2025-03-07 19:23:01 dovecot_plain authenticator failed for ip-213-124-221-2.ip.prioritytelecom.net [213.124.221.2]:47852: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)213.124.221.22750405Ws  -;' ossec13001gExim Auth failed2025-03-07 19:04:33 dovecot_plain authenticator failed for ([103.183.11.30]) [103.183.11.30]:42868: 535 Incorrect authentication data (set_id=services)103.183.11.301643084jr  -a' ossec13001gExim Auth failed2025-03-07 19:04:01 dovecot_plain authenticator failed for ([49.124.151.69]) [49.124.151.69]:54122: 535 Incorrect authentication data (set_id=services@heipowersystem.com)49.124.151.691733045iq  -]) ossec13001gExim Auth failed2025-03-07 19:03:27 dovecot_plain authenticator failed for syn-075-191-221-158.res.spectrum.com [75.191.221.158]:44531: 535 Incorrect authentication data (set_id=sales)75.191.221.1586252001ap  -S# ossec13001gExim Auth failed2025-03-07 19:03:17 dovecot_plain authenticator failed for ([187.9.3.190]) [187.9.3.190]:44937: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)187.9.3.1903469034 A"= L n v V {AZ  -=+ ossec13001gExim Auth failed2025-03-07 20:25:11 dovecot_plain authenticator failed for ([103.123.114.215]) [103.123.114.215]:51648: 535 Incorrect authentication data (set_id=sales)103.123.114.2151168579d  -W% ossec13001gExim Auth failed2025-03-07 20:25:00 dovecot_plain authenticator failed for ([98.70.127.17]) [98.70.127.17]:33240: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)98.70.127.171269750T  -7% ossec13001gExim Auth failed2025-03-07 20:21:39 dovecot_plain authenticator failed for ([46.0.130.216]) [46.0.130.216]:58350: 535 Incorrect authentication data (set_id=services)46.0.130.2162017370j  -a' ossec13001gExim Auth failed2025-03-07 20:21:17 dovecot_plain authenticator failed for ([116.86.62.245]) [116.86.62.245]:52215: 535 Incorrect authentication data (set_id=services@heipowersystem.com)116.86.62.2451880251W  -9) ossec13001gExim Auth failed2025-03-07 20:20:21 dovecot_plain authenticator failed for ([122.228.225.21]) [122.228.225.21]:62370: 535 Incorrect authentication data (set_id=sales)122.228.225.211814991d  -W% ossec13001gExim Auth failed2025-03-07 20:19:58 dovecot_plain authenticator failed for ([113.192.1.27]) [113.192.1.26]:42070: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)113.192.1.261643084{  -' ossec13001gExim Auth failed2025-03-07 20:17:03 dovecot_plain authenticator failed for 89-179-78-247.broadband.corbina.ru [89.179.78.247]:54504: 535 Incorrect authentication data (set_id=services@heipowersystem.com)89.179.78.2472017370n  -k% ossec13001gExim Auth failed2025-03-07 20:17:12 dovecot_plain authenticator failed for vps-79f20bfc.vps.ovh.net ([87.98.249.193]) [51.75.24.107]:56415: 535 Incorrect authentication data (set_id=services)51.75.24.1073017382v  -y' ossec13001gExim Auth failed2025-03-07 20:12:46 dovecot_login authenticator failed for (170.250.128.5.hwccustomers.com) [170.250.128.5]:59964: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)170.250.128.56252001W  -9) ossec13001gExim Auth failed2025-03-07 20:12:57 dovecot_login authenticator failed for ([222.122.98.135]) [222.122.98.135]:42487: 535 Incorrect authentication data (set_id=sales)222.122.98.1351835841  W' ossec9708gDovecot Aborted Login with empty userMar 7 20:08:29 vm1 dovecot[312763]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=87.236.176.51, lip=103.74.54.108, TLS, session=<1e10k8Evkd5X7LAz>87.236.176.512635167t  -s) ossec13001gExim Auth failed2025-03-07 20:03:44 dovecot_plain authenticator failed for (189-44-133-238.customer.tdatabrasil.net.br) [189.44.133.238]:40240: 535 Incorrect authentication data (set_id=services)189.44.133.2383469034Z  -=+ ossec13001gExim Auth failed2025-03-07 20:03:29 dovecot_plain authenticator failed for ([124.225.185.148]) [124.225.185.148]:45186: 535 Incorrect authentication data (set_id=sales)124.225.185.1481814991m  -e) ossec13001gExim Auth failed2025-03-07 20:03:19 dovecot_plain authenticator failed for ([125.23.204.106]) [125.23.204.106]:56502: 535 Incorrect authentication data (set_id=services@heipowersystem.com)125.23.204.1061269750a  -S# ossec13001gExim Auth failed2025-03-07 20:03:11 dovecot_plain authenticator failed for ([27.96.91.71]) [27.96.91.71]:43154: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)27.96.91.711269750Z  -?) ossec13001gExim Auth failed2025-03-07 19:59:47 dovecot_plain authenticator failed for ([182.70.120.127]) [182.70.120.127]:52588: 535 Incorrect authentication data (set_id=services)182.70.120.1271269750 j  3 a v2Afjx!  -}' ossec13001gRExim Auth failed2025-03-07 21:01:30 dovecot_plain authenticator failed for 78-69-119-192-no600.tbcn.telia.com [78.69.119.192]:45886: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)78.69.119.1922661886W  -9) ossec13001ghExim Auth failed2025-03-07 21:01:52 dovecot_plain authenticator failed for ([175.125.68.208]) [175.125.68.208]:53027: 535 Incorrect authentication data (set_id=sales)175.125.68.2081835841m  -e) ossec13001gExim Auth failed2025-03-07 20:59:36 dovecot_login authenticator failed for (heipowersystem.com) [101.89.140.209]:55504: 535 Incorrect authentication data (set_id=office@heipowersystem.com)101.89.140.2091814991[  -A) ossec13001gExim Auth failed2025-03-07 20:59:11 dovecot_login authenticator failed for (heipowersystem.com) [101.89.140.209]:52826: 535 Incorrect authentication data (set_id=nologin)101.89.140.2091814991g  -[' ossec13001gExim Auth failed2025-03-07 20:55:46 dovecot_plain authenticator failed for ([88.204.52.137]) [88.204.52.137]:60746: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)88.204.52.1372017370W  -9) ossec13001g Exim Auth failed2025-03-07 20:56:00 dovecot_plain authenticator failed for ([103.147.248.23]) [103.147.248.23]:51914: 535 Incorrect authentication data (set_id=sales)103.147.248.231269750m  -e) ossec13001gGExim Auth failed2025-03-07 20:48:30 dovecot_plain authenticator failed for ([128.185.224.87]) [152.52.243.154]:53334: 535 Incorrect authentication data (set_id=services@heipowersystem.com)152.52.243.1541269750T  -7% ossec13001gWExim Auth failed2025-03-07 20:48:46 dovecot_plain authenticator failed for ([31.173.8.170]) [31.173.8.170]:52046: 535 Incorrect authentication data (set_id=services)31.173.8.1702017370h  -a' ossec13001g Exim Auth failed2025-03-07 20:45:41 dovecot_plain authenticator failed for ([65.20.213.111]) [65.20.213.111]:50483: 535 Incorrect authentication data (set_id=services@heipowersystem.com)65.20.213.11199237f  -Y' ossec13001g Exim Auth failed2025-03-07 20:46:04 dovecot_plain authenticator failed for 111-70-49-103.emome-ip.hinet.net [111.70.49.103]:55936: 535 Incorrect authentication data (set_id=services)111.70.49.1031668284g  -[' ossec13001g CExim Auth failed2025-03-07 20:35:38 dovecot_plain authenticator failed for ([218.28.77.206]) [218.28.77.206]:43730: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)218.28.77.2061814991N  --# ossec13001g ZExim Auth failed2025-03-07 20:36:02 dovecot_plain authenticator failed for ([59.0.60.158]) [59.0.60.158]:51534: 535 Incorrect authentication data (set_id=sales)59.0.60.1581835841W  -9) ossec13001g VExim Auth failed2025-03-07 20:35:58 dovecot_plain authenticator failed for ([50.223.176.171]) [50.223.176.171]:59895: 535 Incorrect authentication data (set_id=sales)50.223.176.1716252001c  -W% ossec13001g NExim Auth failed2025-03-07 20:35:50 dovecot_plain authenticator failed for ([45.93.94.125]) [45.93.94.125]:33750: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)45.93.94.125294640Q  -3# ossec13001g tExim Auth failed2025-03-07 20:32:12 dovecot_plain authenticator failed for ([206.0.8.204]) [206.0.8.204]:58104: 535 Incorrect authentication data (set_id=services)206.0.8.2043469034i  -_' ossec13001g hExim Auth failed2025-03-07 20:31:59 dovecot_plain authenticator failed for ([58.245.210.70]) [58.245.210.70]:6388: 535 Incorrect authentication data (set_id=services@heipowersystem.com)58.245.210.701814991E  =+ ossec13008gMail Reciepient rejected2025-03-07 20:25:24 H=(mail.fablixsolutions.com) [165.154.233.146]:60675 F= rejected RCPT : Rejected relay attempt: '165.154.233.146' From: 'qjjgycenu@fablixsolutions.com' To: 'goofile@fastmail.com'165.154.233.1461694008}wqke_YSMGA;5/)# {uoic]WQKE?93-'!   y s m g a [ U O I C = 7 1 + %      } w q k e _ Y S M G A ; 5 / ) #     { u o i c ] W Q K E ? 9 3 - ' !      y s m g a [ U O I C = 7 1 + %      } w q k e _ Y S M G A ; 5 / ) #    {uoic]WQKE?93-'! ysmga[UOIC=71+% }wqke_YSMGA;5/)# {uoic]WQKE?93-'! ysmga[UOIC=71+% ҳ%ѳгϲrβb̲R˲Bʲ1ɲ DzƱűoı^ñM±=, yiXG7&tdSC2!n]L;*wfUD3"o_O>/~n^N>- {kZI8'tc~R}A{0zyx}vlu[tJs9r(qonvmelTkCj2i!hgfoe^dMb<a,`_ ^y]h\X[GZ6Y&XWVsUbTQQ@P/OML}KlJ[IJH9F)EDCvBeAU@D?3>#=<:r8a7Q6A51432}1k0Z/I.8-',+*t)c(R&A%1$ #"~ n]M<+ ziYH7&sb Q @ 0  ~m\L;*wfUD4$q`O>- zjYI9(udSB1!ߗݖܖnۖ]ږLٖ;ؖ*ՖԖӕwҕfѕUЕDϕ3Ε"͕̕˔pʔ_ɔOǔ?Ɣ.ŔĔ Ó}n]L<+wgUD3!p_O>-|l^PB1 rbP@/ weR?. |k[J9&o\H4! ~~}l|Y{Fz3y#xw}vjuWsDq1po nwmelQk?j,ih gxfgeTcBb0a^ ]x\f[SZAY.XW VyUfSSR@Q,PN O|MjLVJBI2H!GFEoD_CMA<@)?>=q<^;K:89%874m3[2H16,#+*|)j(X'H&6%$$# "}!o \H7' ~ |vpjd^XRLF@:4.(" ztnhb\VPJD>82,&  ~ x r l f ` Z T N H B < 6 0 * $         ~ x r l f ` Z T N H B < 6 0 * $     |vpjd^XRLF@:4.(" ztnhb\VPJD>82,& ~xrlf`ZTNHB<60*$ |vpjd^XRLF@:4.(" ztnhb\VPJD>82,& | v p j d ^ X R L F @ : 4 . ( "     z t m f _ X Q J C < 5 . '      x q j c \ U N G @ 9 2 + ! jXG6%p^M<, {kYH:)~t}a|O{=z+wu txsjqZpJo8n'mljsibeRc=b)a`_s^c]R\A[0Z YX~WnV]TLS<Q+PO NxMgLVKFJ5H$FEDqC`BOA=>,<; :y9h8V7E655$421r0a/P.?-.,+ *{'j&Y$G#6"%!sbQ@/ o^N<+  x g X G5%rbP?. |k[K;*wfVE3"o^L<+ xhXG6%raP?/}l[I8'veTC3"p`O?. {jYH7&tcRA0}lZI8'tcRB2!o^M<, yiXG6%r~a}P|@{/zy w|vkuZtIs8r'qpnumdlSkBj2g!fedoc^bMa<`+_^ ]y\i[YYHX8W'UTSwQgPVOEN4M#LKJpI_HNF=E,BA @y?h>W=F<5;$987r5b4Q3@2/10 /|.j-Y,H+7*')('t&c$R#C"2!" p_N>. {jYH7&  s b Q @. {jYH7&saQ@/ |kZI:)veUD5$ߴr޴`ݴO۴>ڴ-ٴش ׳zֳiճXԳG ?  8 G C o 9?v2  -{% ossec13001gkExim Auth failed2025-03-07 21:53:07 dovecot_plain authenticator failed for 111-70-0-112.emome-ip.hinet.net [111.70.0.112]:54104: 535 Incorrect authentication data (set_id=services@heipowersystem.com)111.70.0.1121668284c1  -U' ossec13001gExim Auth failed2025-03-07 21:49:54 dovecot_login authenticator failed for (User) [193.46.255.40]:43216: 535 Incorrect authentication data (set_id=dfgdsfgfdgdfg@heipowersystem.com)193.46.255.40798549`0  -S# ossec13001gExim Auth failed2025-03-07 21:45:11 dovecot_plain authenticator failed for ([5.30.215.71]) [5.30.215.71]:60899: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)5.30.215.71290557]/  -C+ ossec13001gExim Auth failed2025-03-07 21:40:50 dovecot_plain authenticator failed for ([113.200.216.246]) [113.200.216.246]:43086: 535 Incorrect authentication data (set_id=services)113.200.216.2461814991m.  -e) ossec13001g~Exim Auth failed2025-03-07 21:40:37 dovecot_plain authenticator failed for ([50.223.176.171]) [50.223.176.171]:55515: 535 Incorrect authentication data (set_id=services@heipowersystem.com)50.223.176.1716252001n-  -i' ossec13001gCExim Auth failed2025-03-07 21:39:38 dovecot_login authenticator failed for (rw-00130-94.59.137.rcil.gov.in) [137.59.94.130]:47206: 535 Incorrect authentication data (set_id=vikas.khandelwal)137.59.94.1301269750u,  -u) ossec13001g:Exim Auth failed2025-03-07 21:39:30 dovecot_login authenticator failed for ([119.45.170.229]) [119.45.170.229]:53976: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)119.45.170.2291814991g+  -[' ossec13001g<Exim Auth failed2025-03-07 21:35:16 dovecot_plain authenticator failed for ([31.173.20.146]) [31.173.20.146]:50086: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)31.173.20.1462017370Q*  -1% ossec13001gJExim Auth failed2025-03-07 21:35:29 dovecot_plain authenticator failed for ([27.124.18.21]) [27.124.18.27]:53314: 535 Incorrect authentication data (set_id=sales)27.124.18.271269750j)  -a' ossec13001gExim Auth failed2025-03-07 21:33:09 dovecot_plain authenticator failed for ([61.153.208.38]) [61.153.208.38]:44784: 535 Incorrect authentication data (set_id=services@heipowersystem.com)61.153.208.381814991P(  -1% ossec13001g\Exim Auth failed2025-03-07 21:27:15 dovecot_plain authenticator failed for ([20.46.45.121]) [20.46.45.121]:59956: 535 Incorrect authentication data (set_id=sales)20.46.45.121290557'  - + ossec13001gRExim Auth failed2025-03-07 21:27:05 dovecot_plain authenticator failed for (static-146.220.149.202-tataidc.co.in) [202.149.220.149]:56940: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)202.149.220.1491269750m&  -k% ossec13001g%Exim Auth failed2025-03-07 21:13:31 dovecot_plain authenticator failed for 95-87-213-16.ip.btc-net.bg [95.87.213.16]:56092: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)95.87.213.16732800W%  -;' ossec13001g}Exim Auth failed2025-03-07 21:10:44 dovecot_plain authenticator failed for ([60.29.100.218]) [60.29.100.218]:34279: 535 Incorrect authentication data (set_id=services)60.29.100.2181814991$  -' ossec13001gaExim Auth failed2025-03-07 21:10:15 dovecot_plain authenticator failed for 80-15-180-102.ftth.fr.orangecustomers.net [80.15.180.102]:53648: 535 Incorrect authentication data (set_id=services@heipowersystem.com)80.15.180.1023017382f#  -Y' ossec13001g%Exim Auth failed2025-03-07 21:09:15 dovecot_plain authenticator failed for 111-70-22-151.emome-ip.hinet.net [111.70.22.151]:57120: 535 Incorrect authentication data (set_id=services)111.70.22.1511668284y"  -}) ossec13001gExim Auth failed2025-03-07 21:08:57 dovecot_plain authenticator failed for 110-25-105-242.adsl.fetnet.net [110.25.105.242]:45961: 535 Incorrect authentication data (set_id=services@heipowersystem.com)110.25.105.2421668284 #9 2 8 ^  %7^fB  -]% ossec13001g%Exim Auth failed2025-03-07 22:29:19 dovecot_plain authenticator failed for ([91.74.186.57]) [91.74.186.57]:34741: 535 Incorrect authentication data (set_id=services@heipowersystem.com)91.74.186.57290557ZA  -=+ ossec13001g%1Exim Auth failed2025-03-07 22:26:17 dovecot_plain authenticator failed for ([175.117.144.158]) [175.117.144.158]:58578: 535 Incorrect authentication data (set_id=sales)175.117.144.1581835841j@  -_) ossec13001g%%Exim Auth failed2025-03-07 22:26:05 dovecot_plain authenticator failed for ([59.102.188.188]) [59.102.188.188]:42269: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)59.102.188.1881668284s?  -o+ ossec13001g$Exim Auth failed2025-03-07 22:25:21 dovecot_login authenticator failed for (nsg-corporate-169.230.187.122.airtel.in) [122.187.230.169]:59759: 535 Incorrect authentication data (set_id=services)122.187.230.1691269750|>  -) ossec13001g$Exim Auth failed2025-03-07 22:24:53 dovecot_login authenticator failed for 83-233-242-245.cust.bredband2.com [83.233.242.245]:34076: 535 Incorrect authentication data (set_id=services@heipowersystem.com)83.233.242.2452661886U= -9# ossec13001g#Exim Auth failed2025-03-07 22:19:45 dovecot_login authenticator failed for (gurukuljaipur.com) [14.18.77.99]:60754: 535 Incorrect authentication data (set_id=nologin)14.18.77.991814991N<  --# ossec13001g"TExim Auth failed2025-03-07 22:14:03 dovecot_plain authenticator failed for ([61.233.4.50]) [61.233.4.50]:60054: 535 Incorrect authentication data (set_id=sales)61.233.4.501814991U;  -3+ ossec13001g"LExim Auth failed2025-03-07 22:13:56 dovecot_plain authenticator failed for p45160-obmd01.osaka.ocn.ne.jp [153.141.232.160]:47074: 535 Incorrect authentication data153.141.232.1601861060j:  -_) ossec13001g"Exim Auth failed2025-03-07 22:13:07 dovecot_plain authenticator failed for ([182.191.122.84]) [182.191.122.84]:44636: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)182.191.122.841168579j9  -a' ossec13001g!Exim Auth failed2025-03-07 22:12:18 dovecot_plain authenticator failed for ([103.69.244.39]) [103.69.244.39]:50836: 535 Incorrect authentication data (set_id=services@heipowersystem.com)103.69.244.391269750G8  =+ ossec13008g!BMail Reciepient rejected2025-03-07 22:09:28 H=(mail.s2seducationtrust.com) [165.154.213.166]:61744 F= rejected RCPT : Rejected relay attempt: '165.154.213.166' From: 'weekyyg@s2seducationtrust.com' To: 'goofile@fastmail.com'165.154.213.1663469034V7  -;' ossec13001g6Exim Auth failed2025-03-07 22:00:45 dovecot_plain authenticator failed for ([87.120.67.149]) [87.120.67.149]:33311: 535 Incorrect authentication data (set_id=services)87.120.67.149732800v6  -{% ossec13001g&Exim Auth failed2025-03-07 22:00:29 dovecot_plain authenticator failed for 1-36-180-128.ptr.netvigator.com [1.36.180.128]:44658: 535 Incorrect authentication data (set_id=services@heipowersystem.com)1.36.180.12818197305  -+ ossec13001gExim Auth failed2025-03-07 21:59:30 dovecot_plain authenticator failed for broadband-178-140-152-209.ip.moscow.rt.ru [178.140.152.209]:58746: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)178.140.152.2092017370f4  -[% ossec13001gExim Auth failed2025-03-07 21:59:45 dovecot_plain authenticator failed for 48.211.41.34.bc.googleusercontent.com [34.41.211.48]:57420: 535 Incorrect authentication data (set_id=sales)34.41.211.486252001Y3  -?' ossec13001gExim Auth failed2025-03-07 21:53:27 dovecot_plain authenticator failed for rm0zqz.g-service.ru [84.22.155.211]:57910: 535 Incorrect authentication data (set_id=services)84.22.155.2112017370 m. K S { ~  '9[^mmS  -c+ ossec13001g/Exim Auth failed2025-03-07 23:11:59 dovecot_plain authenticator failed for ([115.144.115.150]) [115.144.115.150]:41052: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)115.144.115.1501835841yR  -}) ossec13001g-Exim Auth failed2025-03-07 23:02:30 dovecot_plain authenticator failed for 94-255-178-175.cust.bredband2.com [94.255.178.175]:35792: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)94.255.178.1752661886ZQ  -?) ossec13001g,Exim Auth failed2025-03-07 22:57:33 dovecot_plain authenticator failed for ([119.164.89.121]) [119.164.89.121]:53776: 535 Incorrect authentication data (set_id=services)119.164.89.1211814991jP  -a' ossec13001g,sExim Auth failed2025-03-07 22:57:14 dovecot_plain authenticator failed for ([218.14.157.15]) [218.14.157.15]:50687: 535 Incorrect authentication data (set_id=services@heipowersystem.com)218.14.157.151814991^O  -K' ossec13001g,Exim Auth failed2025-03-07 22:57:56 dovecot_login authenticator failed for (User) [193.46.255.40]:57858: 535 Incorrect authentication data (set_id=dfgdsfgfdgdfg@rokamauka.com)193.46.255.40798549mN  -e) ossec13001g)Exim Auth failed2025-03-07 22:46:26 dovecot_plain authenticator failed for ([188.166.241.57]) [188.166.241.57]:32034: 535 Incorrect authentication data (set_id=services@heipowersystem.com)188.166.241.571880251ZM  -=+ ossec13001g)Exim Auth failed2025-03-07 22:45:07 dovecot_login authenticator failed for ([103.152.234.133]) [103.152.234.133]:38498: 535 Incorrect authentication data (set_id=sales)103.152.234.1331643084L  - + ossec13001g)Exim Auth failed2025-03-07 22:44:49 dovecot_login authenticator failed for (mobile-166-195-195-160.mycingular.net) [166.195.195.160]:33363: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)166.195.195.1606252001WK  -9) ossec13001g(Exim Auth failed2025-03-07 22:41:35 dovecot_plain authenticator failed for ([117.69.210.199]) [117.69.210.199]:38860: 535 Incorrect authentication data (set_id=sales)117.69.210.1991814991aJ  -S# ossec13001g(Exim Auth failed2025-03-07 22:41:11 dovecot_plain authenticator failed for ([221.4.153.7]) [221.4.153.7]:41741: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)221.4.153.71814991]I  -C+ ossec13001g'Exim Auth failed2025-03-07 22:36:32 dovecot_plain authenticator failed for ([203.128.181.121]) [203.128.181.121]:47997: 535 Incorrect authentication data (set_id=services)203.128.181.1211835841yH  -}) ossec13001g'~Exim Auth failed2025-03-07 22:36:05 dovecot_plain authenticator failed for 110-25-105-223.adsl.fetnet.net [110.25.105.223]:36785: 535 Incorrect authentication data (set_id=services@heipowersystem.com)110.25.105.2231668284TG  -5' ossec13001g'dExim Auth failed2025-03-07 22:35:38 dovecot_plain authenticator failed for ([83.239.84.130]) [83.239.84.130]:56833: 535 Incorrect authentication data (set_id=sales)83.239.84.1302017370tF  -q+ ossec13001g'TExim Auth failed2025-03-07 22:35:24 dovecot_plain authenticator failed for (126-209-236-109.sv-en.ru) [109.236.209.126]:40390: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)109.236.209.1262017370_E  -K) ossec13001g&?Exim Auth failed2025-03-07 22:30:46 dovecot_login authenticator failed for (88-223-193-232.init.lt) [88.223.193.232]:40347: 535 Incorrect authentication data (set_id=services)88.223.193.232597427mD  -e) ossec13001g&+Exim Auth failed2025-03-07 22:30:27 dovecot_login authenticator failed for ([220.119.126.81]) [220.119.126.81]:60853: 535 Incorrect authentication data (set_id=services@heipowersystem.com)220.119.126.811835841]C  -G' ossec13001g%Exim Auth failed2025-03-07 22:29:37 dovecot_plain authenticator failed for (made-again.tmesis.com) [24.187.213.29]:34540: 535 Incorrect authentication data (set_id=services)24.187.213.296252001 (7 f d +6NsnQd  -1% ossec13001g5yExim Auth failed2025-03-07 23:35:45 dovecot_login authenticator failed for ([91.122.42.56]) [91.122.42.56]:32978: 535 Incorrect authentication data (set_id=sales)91.122.42.562017370jc  -_) ossec13001g5oExim Auth failed2025-03-07 23:35:35 dovecot_login authenticator failed for ([60.173.105.206]) [60.173.105.206]:50660: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)60.173.105.2061814991b  - + ossec13001g5oExim Auth failed2025-03-07 23:35:35 dovecot_login authenticator failed for (mobile-166-195-195-160.mycingular.net) [166.195.195.160]:39200: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)166.195.195.1606252001Wa  -;' ossec13001g47Exim Auth failed2025-03-07 23:30:22 dovecot_plain authenticator failed for ([95.220.25.124]) [95.220.25.124]:30658: 535 Incorrect authentication data (set_id=services)95.220.25.1242017370d`  -W% ossec13001g3Exim Auth failed2025-03-07 23:29:22 dovecot_plain authenticator failed for ([59.7.203.177]) [59.7.203.177]:52662: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)59.7.203.1771835841q_  -q' ossec13001g3Exim Auth failed2025-03-07 23:29:19 dovecot_plain authenticator failed for ([87.200.68.214]) [87.200.68.214]:38055: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)87.200.68.214290557j^  -a' ossec13001g4#Exim Auth failed2025-03-07 23:30:01 dovecot_plain authenticator failed for ([115.88.121.73]) [115.88.121.73]:37330: 535 Incorrect authentication data (set_id=services@heipowersystem.com)115.88.121.731835841_]  -K' ossec13001g4 Exim Auth failed2025-03-07 23:29:36 dovecot_plain authenticator failed for ([60.29.100.218]) [60.29.100.218]:60531: 535 Incorrect authentication data (set_id=vikas.khandelwal)60.29.100.2181814991c\  -S' ossec13001g4Exim Auth failed2025-03-07 23:29:34 dovecot_plain authenticator failed for 57-45-246-103.southernonline.net [103.246.45.57]:45014: 535 Incorrect authentication data (set_id=sales)103.246.45.571269750T[  -5' ossec13001g3Exim Auth failed2025-03-07 23:25:18 dovecot_plain authenticator failed for ([58.242.86.203]) [58.242.86.203]:52620: 535 Incorrect authentication data (set_id=sales)58.242.86.2031814991gZ  -[' ossec13001g2Exim Auth failed2025-03-07 23:25:06 dovecot_plain authenticator failed for ([183.47.48.178]) [183.47.48.178]:52010: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)183.47.48.1781814991_Y  -M' ossec13001g2Exim Auth failed2025-03-07 23:23:35 dovecot_login authenticator failed for (User) [193.46.255.40]:49306: 535 Incorrect authentication data (set_id=dfgdsfgfdgdfg@nyaystambh.com)193.46.255.40798549WX  -;' ossec13001g1Exim Auth failed2025-03-07 23:19:48 dovecot_plain authenticator failed for ([24.187.213.29]) [24.187.213.29]:35138: 535 Incorrect authentication data (set_id=services)24.187.213.296252001~W  -) ossec13001g1Exim Auth failed2025-03-07 23:19:32 dovecot_plain authenticator failed for nova-185-040-122-250.cpe.novanet.is [185.40.122.250]:35604: 535 Incorrect authentication data (set_id=services@heipowersystem.com)185.40.122.2502629691MV  -/! ossec13001g0Exim Auth failed2025-03-07 23:15:40 dovecot_plain authenticator failed for ([149.0.16.4]) [149.0.16.4]:39980: 535 Incorrect authentication data (set_id=services)149.0.16.4298795mU  -e) ossec13001g0Exim Auth failed2025-03-07 23:15:09 dovecot_plain authenticator failed for ([194.186.69.166]) [194.186.69.166]:59108: 535 Incorrect authentication data (set_id=services@heipowersystem.com)194.186.69.1662017370TT  -5' ossec13001g/Exim Auth failed2025-03-07 23:12:19 dovecot_plain authenticator failed for ([103.47.74.210]) [103.47.74.210]:33836: 535 Incorrect authentication data (set_id=sales)103.47.74.2101269750 " E d w 4InWu  -9) ossec13001g;QExim Auth failed2025-03-08 00:00:40 dovecot_plain authenticator failed for ([216.194.174.86]) [216.194.174.27]:63262: 535 Incorrect authentication data (set_id=sales)216.194.174.276252001dt  -W% ossec13001g;EExim Auth failed2025-03-08 00:00:29 dovecot_plain authenticator failed for ([88.87.84.104]) [88.87.84.104]:58197: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)88.87.84.1042017370Ws  -9) ossec13001g;AExim Auth failed2025-03-08 00:00:24 dovecot_plain authenticator failed for ([211.248.31.142]) [211.248.31.142]:46860: 535 Incorrect authentication data (set_id=sales)211.248.31.1421835841gr  -[' ossec13001g;)Exim Auth failed2025-03-07 23:59:59 dovecot_plain authenticator failed for ([42.177.209.66]) [42.177.209.66]:46362: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)42.177.209.661814991Pq  -1# ossec13001g:mExim Auth failed2025-03-07 23:56:52 dovecot_plain authenticator failed for ([119.32.11.3]) [119.32.11.3]:7415: 535 Incorrect authentication data (set_id=services)119.32.11.31814991jp  -a' ossec13001g:RExim Auth failed2025-03-07 23:56:26 dovecot_plain authenticator failed for ([61.81.133.182]) [61.81.133.182]:41893: 535 Incorrect authentication data (set_id=services@heipowersystem.com)61.81.133.1821835841co  -S' ossec13001g7Exim Auth failed2025-03-07 23:45:52 dovecot_login authenticator failed for ([46.163.154.14]) [46.163.154.14]:54294: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)46.163.154.142017370|n  -+ ossec13001g7Exim Auth failed2025-03-07 23:45:43 dovecot_login authenticator failed for ([196.250.177.106]) [196.250.177.106]:40604: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)196.250.177.1062275384Tm  -7% ossec13001g7&Exim Auth failed2025-03-07 23:42:53 dovecot_login authenticator failed for ([91.122.42.56]) [91.122.42.56]:37366: 535 Incorrect authentication data (set_id=services)91.122.42.562017370ml  -e) ossec13001g7Exim Auth failed2025-03-07 23:42:42 dovecot_login authenticator failed for ([112.176.249.35]) [112.176.249.35]:41574: 535 Incorrect authentication data (set_id=services@heipowersystem.com)112.176.249.351835841ik  -]) ossec13001g7Exim Auth failed2025-03-07 23:42:36 dovecot_plain authenticator failed for ([188.166.241.57]) [188.166.241.57]:6402: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)188.166.241.571880251`j  -O% ossec13001g76Exim Auth failed2025-03-07 23:43:08 dovecot_plain authenticator failed for 1-34-162-249.hinet-ip.hinet.net [1.34.162.249]:42286: 535 Incorrect authentication data (set_id=sales)1.34.162.2491668284ii  -[+ ossec13001g7*Exim Auth failed2025-03-07 23:42:57 dovecot_plain authenticator failed for wsip-184-189-122-139.oc.oc.cox.net [184.189.122.139]:35959: 535 Incorrect authentication data (set_id=sales)184.189.122.1396252001]h -C) ossec13001g6Exim Auth failed2025-03-07 23:41:25 dovecot_login authenticator failed for (fablixsolutions.com) [42.193.105.109]:58602: 535 Incorrect authentication data (set_id=nologin)42.193.105.1091814991Yg  -?) ossec13001g6Exim Auth failed2025-03-07 23:38:18 dovecot_plain authenticator failed for ([168.167.55.230]) [168.167.55.230]:52516: 535 Incorrect authentication data (set_id=services)168.167.55.230933860jf  -a' ossec13001g6Exim Auth failed2025-03-07 23:38:06 dovecot_plain authenticator failed for ([31.173.66.222]) [31.173.66.222]:59522: 535 Incorrect authentication data (set_id=services@heipowersystem.com)31.173.66.2222017370le  -c) ossec13001g5yExim Auth failed2025-03-07 23:35:45 dovecot_login authenticator failed for (triband-del-59.178.120.171.bol.net.in) [59.178.120.171]:45050: 535 Incorrect authentication data (set_id=sales)59.178.120.1711269750 *\~tj`VLB8.$zpf\H>4*   v l b X N D : 0 &    ~ t j ` V L B 8 . $    z p f \ > 4 * R H  vblXND:0&|rh^TJ@6,"xndZPF<2( ~tj`VLB8.$pzf\ | r h ^ T J @ 6 , "    x n d Z P F < 2 (   RRH>4*  vlbXND:0& g{" g{" gy" gz" gyp" gyO" gx" gw " gw" gvB" gv:" gt" gt" gr" gr" gr%" gr" gr" gq" gq8" goH" go@" gn4" gm" gm" gk" gk" gk" gk" gk%" gk" gh" gh" gg" gg" gc" gc" gc" gc " gbw" gbk" gbT" g`"" g`" g`" g_" g]" g]" g]" g\" g\" gZ" gZ" gYX" gYL" gW" gW" gV[" gVI" gU+" gU!" gT" gT" gS" gSw" gQ" gQ" gP" gP" gP " gP" gO5" gO)" gN" gNm" gNW" gM" gM" gL" gLs" gL%" gL" gJn" gI" gI" gI" gG" gFc" gFY" gEa" gDO" gDG" gD5" gCG" gCh" gB." gB" g@" g@" g@ " g?" g?" g?" g>Y" g>c" g>A" g>?"~ g>/"} g="| g<"{ g<"z g<"y g" gˆ0" g˅" g˃" g˃q" g˂" g˂" gˁ " gˀ" gˀ" gˀv" gv" gd" g~" g~" g~" g~t" g~d" g}" g}" g|O" g|E" g$"> g#"= g"T"< g"L"; g"": g!"9 g!B"8 g6"7 g&"6 g"4 g"5 g"3 gk"2 g"1 g"0 g"/ g~". gC"- g:", gJ"* g<"+ g") g\"( gR"' g%"& g}"% ga"$ g%"# g"" gh" gR"! g" g" g " g" gW" gG" g " g " g Z" g V" g N" g˓k# g C" g t" g h" g" g" g" g" g" g" g" g" g" g" g" g" g" g" g" g" g" g" g! g! g! g! g! g! gq! gi! g! g! gF! g>! g! g! g! g! g! g}! g! g! g!  , T  X [_bG_tt%  3Q' ossec11301g@New FTP connection.Mar 8 00:22:48 vm1 pure-ftpd[3076541]: (?@104.248.48.37) [INFO] New connection from 104.248.48.37104.248.48.376252001Q  -1% ossec13001g@ Exim Auth failed2025-03-08 00:20:48 dovecot_login authenticator failed for ([61.81.151.97]) [61.81.151.97]:48496: 535 Incorrect authentication data (set_id=sales)61.81.151.971835841W  -9) ossec13001g?Exim Auth failed2025-03-08 00:20:13 dovecot_plain authenticator failed for ([186.208.76.154]) [186.208.76.154]:33832: 535 Incorrect authentication data (set_id=sales)186.208.76.1543469034|  -) ossec13001g?Exim Auth failed2025-03-08 00:20:06 dovecot_login authenticator failed for 212.42.246.220.static.netvigator.com [220.246.42.212]:56610: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)220.246.42.2121819730g  -[' ossec13001g?Exim Auth failed2025-03-08 00:20:00 dovecot_plain authenticator failed for ([83.136.176.12]) [83.136.176.12]:58044: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)83.136.176.122510769d  -U' ossec13001g>YExim Auth failed2025-03-08 00:13:37 dovecot_login authenticator failed for 5f448d99.dynamic.mv.ru [95.68.141.153]:58613: 535 Incorrect authentication data (set_id=vikas.khandelwal)95.68.141.1532017370  -9) ossec13001g>cExim Auth failed2025-03-08 00:13:47 dovecot_plain authenticator failed for 131-106-85-205.s1483.c3-0.tlg-cbr5.atw-tlg.pa.cable.rcncustomer.com [131.106.85.205]:53088: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)131.106.85.2056252001y  -}) ossec13001g>AExim Auth failed2025-03-08 00:13:12 dovecot_plain authenticator failed for ([106.55.161.136]) [106.55.161.136]:50408: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)106.55.161.1361814991x~  -y+ ossec13001g>?Exim Auth failed2025-03-08 00:13:10 dovecot_login authenticator failed for ([119.198.191.130]) [119.198.191.130]:37767: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)119.198.191.1301835841y}  -}) ossec13001g>/Exim Auth failed2025-03-08 00:12:54 dovecot_plain authenticator failed for ([191.210.87.101]) [191.210.87.101]:49132: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)191.210.87.1013469034%|  3Q' ossec11301g=New FTP connection.Mar 8 00:11:44 vm1 pure-ftpd[3074282]: (?@52.249.38.230) [INFO] New connection from 52.249.38.23052.249.38.2306252001Z{  -=+ ossec13001g<Exim Auth failed2025-03-08 00:07:01 dovecot_plain authenticator failed for ([222.189.211.114]) [222.189.211.114]:57460: 535 Incorrect authentication data (set_id=sales)222.189.211.1141814991gz  -[' ossec13001g<Exim Auth failed2025-03-08 00:06:44 dovecot_plain authenticator failed for ([188.43.204.45]) [188.43.204.45]:48244: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)188.43.204.452017370y  ?1 ossec1008g<Process exiting (killed).Mar 8 00:06:13 vm1 spamd[2770158]: spamd: server killed by SIGTERM, shutting downTx  -7% ossec13001g rejected RCPT : Rejected relay attempt: '165.154.226.150' From: 'occqzjhmuh@s2seducationtrust.com' To: 'goofile@fastmail.com'165.154.226.1501668284q  -k+ ossec13001gDOExim Auth failed2025-03-08 00:39:02 dovecot_plain authenticator failed for 189.115.230.179.dynamic.adsl.gvt.net.br [189.115.230.179]:36140: 535 Incorrect authentication data (set_id=services)189.115.230.1793469034T  -7% ossec13001gDGExim Auth failed2025-03-08 00:38:53 dovecot_plain authenticator failed for ([110.35.63.27]) [110.35.63.27]:42980: 535 Incorrect authentication data (set_id=services)110.35.63.271835841}  -' ossec13001gD5Exim Auth failed2025-03-08 00:38:36 dovecot_plain authenticator failed for 041.148.48.116.static.netvigator.com [116.48.148.41]:57868: 535 Incorrect authentication data (set_id=services@heipowersystem.com)116.48.148.411819730k  -_+ ossec13001gCGExim Auth failed2025-03-08 00:34:37 dovecot_plain authenticator failed for ([113.193.53.56]) [103.177.232.206]:44762: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)103.177.232.2061269750Z  -=+ ossec13001gChExim Auth failed2025-03-08 00:35:12 dovecot_plain authenticator failed for ([175.156.154.149]) [175.156.154.149]:60598: 535 Incorrect authentication data (set_id=sales)175.156.154.1491880251e  -W' ossec13001gB.Exim Auth failed2025-03-08 00:29:58 dovecot_plain authenticator failed for 24.115.19.225.res-cmts.sm3.ptd.net [24.115.19.225]:60776: 535 Incorrect authentication data (set_id=sales)24.115.19.2256252001m  -c+ ossec13001gBExim Auth failed2025-03-08 00:29:25 dovecot_plain authenticator failed for ([123.209.118.166]) [123.209.118.166]:34524: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)123.209.118.1662077456v  -y' ossec13001g@Exim Auth failed2025-03-08 00:22:48 dovecot_plain authenticator failed for p5098d833.dip0.t-ipconnect.de [80.152.216.51]:22999: 535 Incorrect authentication data (set_id=services@heipowersystem.com)80.152.216.512921044 . F r 5KbqT'  -5' ossec13001gQExim Auth failed2025-03-08 01:35:46 dovecot_plain authenticator failed for ([112.132.89.72]) [112.132.89.72]:38034: 535 Incorrect authentication data (set_id=sales)112.132.89.721814991m&  -c+ ossec13001gQExim Auth failed2025-03-08 01:35:21 dovecot_plain authenticator failed for ([211.221.130.246]) [211.221.130.246]:55118: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)211.221.130.2461835841e%  -]% ossec13001gPExim Auth failed2025-03-08 01:32:19 dovecot_plain authenticator failed for ([65.20.134.44]) [65.20.134.44]:52173: 535 Incorrect authentication data (set_id=services@heipowersystem.com)65.20.134.4499237f$  -[' ossec13001gPExim Auth failed2025-03-08 01:31:40 dovecot_login authenticator failed for (User) [193.46.255.40]:38706: 535 Incorrect authentication data (set_id=dfgdsfgfdgdfg@s2seducationtrust.com)193.46.255.40798549]#  -K# ossec13001gP Exim Auth failed2025-03-08 01:29:26 dovecot_plain authenticator failed for 37.151.71.8.dynamic.telecom.kz [37.151.71.8]:37982: 535 Incorrect authentication data (set_id=sales)37.151.71.81522867j"  -_) ossec13001gPExim Auth failed2025-03-08 01:29:14 dovecot_plain authenticator failed for ([112.168.71.109]) [112.168.71.109]:47462: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)112.168.71.1091835841W!  -;' ossec13001gO5Exim Auth failed2025-03-08 01:25:33 dovecot_plain authenticator failed for ([41.67.143.142]) [41.67.143.142]:38124: 535 Incorrect authentication data (set_id=services)41.67.143.1422328926m  -e) ossec13001gO)Exim Auth failed2025-03-08 01:25:21 dovecot_plain authenticator failed for ([191.59.176.133]) [191.59.176.133]:36442: 535 Incorrect authentication data (set_id=services@heipowersystem.com)191.59.176.1333469034c  -Q) ossec13001gNExim Auth failed2025-03-08 01:22:31 dovecot_plain authenticator failed for (azteca-comunicaciones.com) [186.148.187.91]:38918: 535 Incorrect authentication data (set_id=services)186.148.187.913686110m  -e) ossec13001gNmExim Auth failed2025-03-08 01:22:13 dovecot_plain authenticator failed for ([111.53.185.163]) [111.53.185.163]:40264: 535 Incorrect authentication data (set_id=services@heipowersystem.com)111.53.185.1631814991u  -w' ossec13001gNWExim Auth failed2025-03-08 01:21:51 dovecot_plain authenticator failed for (6-red145.ceviamonte.com.ar) [143.202.145.6]:53983: 535 Incorrect authentication data (set_id=services@heipowersystem.com)143.202.145.63865483]  -C+ ossec13001gMExim Auth failed2025-03-08 01:19:05 dovecot_plain authenticator failed for ([123.209.105.123]) [123.209.105.123]:60136: 535 Incorrect authentication data (set_id=services)123.209.105.1232077456l  -e) ossec13001gMExim Auth failed2025-03-08 01:18:48 dovecot_plain authenticator failed for ([94.204.208.189]) [94.204.208.189]:53891: 535 Incorrect authentication data (set_id=services@heipowersystem.com)94.204.208.189290557P  -1% ossec13001gLExim Auth failed2025-03-08 01:13:58 dovecot_plain authenticator failed for ([185.167.56.2]) [185.167.56.2]:57732: 535 Incorrect authentication data (set_id=sales)185.167.56.2617790d  -W% ossec13001gLsExim Auth failed2025-03-08 01:13:46 dovecot_plain authenticator failed for ([59.34.17.130]) [59.34.17.130]:44672: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)59.34.17.1301814991T  -5' ossec13001gL%Exim Auth failed2025-03-08 01:12:27 dovecot_login authenticator failed for ([103.93.37.178]) [103.93.37.178]:54522: 535 Incorrect authentication data (set_id=sales)103.93.37.1781269750v  -y' ossec13001gLExim Auth failed2025-03-08 01:12:19 dovecot_login authenticator failed for c188-151-42-56.bredband.tele2.se [188.151.42.56]:35718: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)188.151.42.562661886 0 < ^ v  3Bkm8  -e) ossec13001g]Exim Auth failed2025-03-08 02:26:41 dovecot_plain authenticator failed for ([94.181.187.192]) [94.181.187.192]:60622: 535 Incorrect authentication data (set_id=services@heipowersystem.com)94.181.187.1922017370W7  -9) ossec13001g\Exim Auth failed2025-03-08 02:23:25 dovecot_plain authenticator failed for ([201.59.211.214]) [201.59.211.214]:46405: 535 Incorrect authentication data (set_id=sales)201.59.211.2143469034g6  -[' ossec13001g\Exim Auth failed2025-03-08 02:23:14 dovecot_plain authenticator failed for ([186.68.83.109]) [186.68.83.109]:43394: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)186.68.83.1093658394S5  -5' ossec13001gZExim Auth failed2025-03-08 02:14:18 dovecot_plain authenticator failed for ([31.206.62.162]) [31.206.62.162]:48933: 535 Incorrect authentication data (set_id=sales)31.206.62.162298795m4  -c+ ossec13001gZExim Auth failed2025-03-08 02:14:07 dovecot_plain authenticator failed for ([103.186.221.174]) [103.186.221.174]:55240: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)103.186.221.1741269750W3  -;' ossec13001gYXExim Auth failed2025-03-08 02:08:47 dovecot_plain authenticator failed for ([186.177.88.96]) [186.177.88.96]:38420: 535 Incorrect authentication data (set_id=services)186.177.88.963624060z2  -% ossec13001gYLExim Auth failed2025-03-08 02:08:35 dovecot_plain authenticator failed for h-46-59-44-182.a980.priv.bahnhof.se [46.59.44.182]:41020: 535 Incorrect authentication data (set_id=services@heipowersystem.com)46.59.44.1822661886T1  -5' ossec13001gWExim Auth failed2025-03-08 02:01:27 dovecot_plain authenticator failed for ([46.21.240.186]) [46.21.240.186]:51922: 535 Incorrect authentication data (set_id=sales)46.21.240.1862017370d0  -W% ossec13001gWExim Auth failed2025-03-08 02:01:10 dovecot_plain authenticator failed for ([61.150.88.22]) [61.150.88.22]:51016: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)61.150.88.221814991Q/  -3# ossec13001gV[Exim Auth failed2025-03-08 01:56:02 dovecot_plain authenticator failed for ([61.51.81.78]) [61.51.81.78]:37348: 535 Incorrect authentication data (set_id=services)61.51.81.781814991p.  -i+ ossec13001gVIExim Auth failed2025-03-08 01:55:45 dovecot_plain authenticator failed for ([103.231.163.154]) [103.231.163.154]:19011: 535 Incorrect authentication data (set_id=services@heipowersystem.com)103.231.163.1541210997]-  -C+ ossec13001gU+Exim Auth failed2025-03-08 01:50:59 dovecot_plain authenticator failed for ([124.197.135.208]) [124.197.135.208]:42346: 535 Incorrect authentication data (set_id=services)124.197.135.2081835841d,  -Y# ossec13001gU!Exim Auth failed2025-03-08 01:50:48 dovecot_plain authenticator failed for ([45.170.50.2]) [45.170.50.2]:42473: 535 Incorrect authentication data (set_id=services@heipowersystem.com)45.170.50.23932488Z+  -=+ ossec13001gTExim Auth failed2025-03-08 01:49:41 dovecot_plain authenticator failed for ([121.178.185.141]) [121.178.185.141]:47672: 535 Incorrect authentication data (set_id=sales)121.178.185.1411835841p*  -m' ossec13001gTExim Auth failed2025-03-08 01:49:29 dovecot_plain authenticator failed for sagitario.itmorelia.edu.mx [200.33.171.65]:64393: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)200.33.171.653996063R)  -5' ossec13001gSExim Auth failed2025-03-08 01:44:03 dovecot_plain authenticator failed for ([65.20.169.151]) [65.20.169.151]:34439: 535 Incorrect authentication data (set_id=sales)65.20.169.15199237v(  -y' ossec13001gSwExim Auth failed2025-03-08 01:43:41 dovecot_plain authenticator failed for 60-249-207-53.hinet-ip.hinet.net [60.249.207.53]:56281: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)60.249.207.531668284 [: I [ P U j 9K[lI  -c) ossec13001ghExim Auth failed2025-03-08 03:15:01 dovecot_plain authenticator failed for c-50-149-161-131.hsd1.tn.comcast.net [50.149.161.131]:64558: 535 Incorrect authentication data (set_id=services)50.149.161.1316252001jH  -a' ossec13001ghExim Auth failed2025-03-08 03:14:23 dovecot_plain authenticator failed for ([50.249.167.45]) [50.249.167.45]:44513: 535 Incorrect authentication data (set_id=services@heipowersystem.com)50.249.167.456252001]G  -C+ ossec13001ggExim Auth failed2025-03-08 03:10:41 dovecot_plain authenticator failed for ([222.189.211.114]) [222.189.211.114]:45516: 535 Incorrect authentication data (set_id=services)222.189.211.1141814991mF  -e) ossec13001ggExim Auth failed2025-03-08 03:10:23 dovecot_plain authenticator failed for ([125.136.163.86]) [125.136.163.86]:59244: 535 Incorrect authentication data (set_id=services@heipowersystem.com)125.136.163.861835841TE  -5' ossec13001gcExim Auth failed2025-03-08 02:54:14 dovecot_plain authenticator failed for ([41.67.143.142]) [41.67.143.142]:36046: 535 Incorrect authentication data (set_id=sales)41.67.143.1422328926bD  -W% ossec13001gcExim Auth failed2025-03-08 02:54:04 dovecot_plain authenticator failed for ([65.20.128.78]) [65.20.128.78]:45497: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)65.20.128.7899237fC  -W) ossec13001gcExim Auth failed2025-03-08 02:50:18 dovecot_plain authenticator failed for a109-51-222-234.cpe.netcabo.pt [109.51.222.234]:38241: 535 Incorrect authentication data (set_id=services)109.51.222.2342264397mB  -e) ossec13001gc Exim Auth failed2025-03-08 02:50:10 dovecot_plain authenticator failed for ([203.193.147.37]) [203.193.147.37]:53842: 535 Incorrect authentication data (set_id=services@heipowersystem.com)203.193.147.371269750jA  -a' ossec13001gbwExim Auth failed2025-03-08 02:47:41 dovecot_plain authenticator failed for ([121.154.90.17]) [121.154.90.17]:34534: 535 Incorrect authentication data (set_id=services@heipowersystem.com)121.154.90.171835841T@  -5' ossec13001gbkExim Auth failed2025-03-08 02:47:29 dovecot_plain authenticator failed for ([220.85.251.16]) [220.85.251.16]:46342: 535 Incorrect authentication data (set_id=sales)220.85.251.161835841g?  -[' ossec13001gbTExim Auth failed2025-03-08 02:47:07 dovecot_plain authenticator failed for ([77.106.78.215]) [77.106.78.215]:25928: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)77.106.78.2152017370w>  -w+ ossec13001g`"Exim Auth failed2025-03-08 02:37:44 dovecot_login authenticator failed for 123.129.198.203.static.netvigator.com [203.198.129.123]:64142: 535 Incorrect authentication data (set_id=vikas.khandelwal)203.198.129.1231819730=  -) ossec13001g`Exim Auth failed2025-03-08 02:37:35 dovecot_login authenticator failed for customer-ip-193-151-51-223.ipv.net.pl [193.151.51.223]:41020: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)193.151.51.223798544j<  -_) ossec13001g`Exim Auth failed2025-03-08 02:37:12 dovecot_plain authenticator failed for (94.124.156.175.unknown.m1.com.sg) [175.156.124.94]:57583: 535 Incorrect authentication data (set_id=services)175.156.124.941880251m;  -e) ossec13001g_Exim Auth failed2025-03-08 02:37:02 dovecot_plain authenticator failed for ([221.167.21.148]) [221.167.21.148]:37520: 535 Incorrect authentication data (set_id=services@heipowersystem.com)221.167.21.1481835841T:  -5' ossec13001g]Exim Auth failed2025-03-08 02:28:30 dovecot_plain authenticator failed for ([121.33.207.58]) [121.33.207.58]:54236: 535 Incorrect authentication data (set_id=sales)121.33.207.581814991j9  -_) ossec13001g]Exim Auth failed2025-03-08 02:28:16 dovecot_plain authenticator failed for ([118.45.101.159]) [118.45.101.159]:57312: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)118.45.101.1591835841  . G E m '6arjZ  -a' ossec13001grExim Auth failed2025-03-08 03:56:32 dovecot_plain authenticator failed for ([58.49.113.138]) [58.49.113.138]:19342: 535 Incorrect authentication data (set_id=services@heipowersystem.com)58.49.113.1381814991kY  -c' ossec13001gr%Exim Auth failed2025-03-08 03:54:35 dovecot_login authenticator failed for dynamic-186-30-57-201.dynamic.etb.net.co [186.30.57.201]:59759: 535 Incorrect authentication data (set_id=sales)186.30.57.2013686110QX  -1% ossec13001grExim Auth failed2025-03-08 03:54:23 dovecot_plain authenticator failed for ([63.65.203.82]) [63.65.203.82]:56918: 535 Incorrect authentication data (set_id=sales)63.65.203.826252001mW  -c+ ossec13001grExim Auth failed2025-03-08 03:54:22 dovecot_login authenticator failed for ([103.106.154.138]) [103.106.154.138]:54802: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)103.106.154.1381269750jV  -_) ossec13001gqExim Auth failed2025-03-08 03:53:53 dovecot_plain authenticator failed for ([221.146.201.37]) [221.146.201.37]:35020: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)221.146.201.371835841jU  -a' ossec13001gq8Exim Auth failed2025-03-08 03:50:39 dovecot_plain authenticator failed for ([61.133.10.205]) [61.133.10.204]:52264: 535 Incorrect authentication data (set_id=services@heipowersystem.com)61.133.10.2041814991VT  -9) ossec13001goHExim Auth failed2025-03-08 03:42:23 dovecot_plain authenticator failed for ([185.101.16.250]) [185.101.16.250]:51480: 535 Incorrect authentication data (set_id=sales)185.101.16.250272103fS  -[' ossec13001go@Exim Auth failed2025-03-08 03:42:14 dovecot_plain authenticator failed for ([46.30.161.197]) [46.30.161.197]:54412: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)46.30.161.197690791gR  -[' ossec13001gn4Exim Auth failed2025-03-08 03:37:46 dovecot_plain authenticator failed for ([61.185.30.170]) [61.185.30.170]:52589: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)61.185.30.1701814991]Q  -C+ ossec13001gmExim Auth failed2025-03-08 03:35:35 dovecot_plain authenticator failed for ([213.195.113.234]) [213.195.113.234]:36204: 535 Incorrect authentication data (set_id=services)213.195.113.2342510769jP  -a' ossec13001gmExim Auth failed2025-03-08 03:35:25 dovecot_plain authenticator failed for ([77.51.214.170]) [77.51.214.170]:45341: 535 Incorrect authentication data (set_id=services@heipowersystem.com)77.51.214.1702017370hO  -Y+ ossec13001gkExim Auth failed2025-03-08 03:27:59 dovecot_plain authenticator failed for 158.160.200.177.netflexisp.com.br [177.200.160.158]:25276: 535 Incorrect authentication data (set_id=sales)177.200.160.1583469034TN  -7% ossec13001gkExim Auth failed2025-03-08 03:27:49 dovecot_login authenticator failed for ([49.124.132.5]) [49.124.132.5]:44492: 535 Incorrect authentication data (set_id=services)49.124.132.51733045~M  - ' ossec13001gkExim Auth failed2025-03-08 03:27:28 dovecot_login authenticator failed for ppp-210-86-167-42.revip.asianet.co.th [210.86.167.42]:50772: 535 Incorrect authentication data (set_id=services@heipowersystem.com)210.86.167.421605651cL  -W% ossec13001gkExim Auth failed2025-03-08 03:27:08 dovecot_plain authenticator failed for ([94.204.90.91]) [94.204.90.91]:33505: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)94.204.90.91290557ZK  -?) ossec13001gk%Exim Auth failed2025-03-08 03:24:44 dovecot_plain authenticator failed for ([39.129.133.184]) [39.129.133.184]:50502: 535 Incorrect authentication data (set_id=services)39.129.133.1841814991pJ  -i+ ossec13001gkExim Auth failed2025-03-08 03:24:22 dovecot_plain authenticator failed for ([103.219.154.156]) [103.219.154.156]:50514: 535 Incorrect authentication data (set_id=services@heipowersystem.com)103.219.154.1562750405 a  4 c )3Sank  -g) ossec13001g}Exim Auth failed2025-03-08 04:41:08 dovecot_plain authenticator failed for ([159.223.250.131]) [161.35.200.202]:60956: 535 Incorrect authentication data (set_id=services@heipowersystem.com)161.35.200.2022921044\j  -G% ossec13001g|OExim Auth failed2025-03-08 04:37:59 dovecot_plain authenticator failed for ([59.99.153.21]) [59.99.153.21]:40361: 535 Incorrect authentication data (set_id=vikas.khandelwal)59.99.153.211269750ri  -q' ossec13001g|EExim Auth failed2025-03-08 04:37:48 dovecot_plain authenticator failed for ([120.78.172.20]) [120.78.172.20]:48578: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)120.78.172.201814991jh  -_) ossec13001g{Exim Auth failed2025-03-08 04:36:05 dovecot_plain authenticator failed for ([205.164.235.34]) [205.164.235.38]:54682: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)205.164.235.383469034jg  -_) ossec13001g{Exim Auth failed2025-03-08 04:35:53 dovecot_plain authenticator failed for ([211.248.31.142]) [211.248.31.142]:37930: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)211.248.31.1421835841mf  -e) ossec13001gyExim Auth failed2025-03-08 04:27:58 dovecot_plain authenticator failed for ([183.220.247.88]) [183.220.247.88]:50892: 535 Incorrect authentication data (set_id=services@heipowersystem.com)183.220.247.881814991ie  -a% ossec13001gzExim Auth failed2025-03-08 04:28:09 dovecot_plain authenticator failed for 32.104.29.34.bc.googleusercontent.com [34.29.104.32]:49620: 535 Incorrect authentication data (set_id=services)34.29.104.326252001Wd  -9) ossec13001gypExim Auth failed2025-03-08 04:25:44 dovecot_plain authenticator failed for ([222.119.124.66]) [222.119.124.66]:39922: 535 Incorrect authentication data (set_id=sales)222.119.124.661835841gc  -[' ossec13001gyOExim Auth failed2025-03-08 04:25:09 dovecot_plain authenticator failed for ([110.52.91.145]) [110.52.91.145]:58172: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)110.52.91.1451814991jb  -a' ossec13001gxExim Auth failed2025-03-08 04:22:57 dovecot_plain authenticator failed for ([49.124.153.58]) [49.124.153.58]:33828: 535 Incorrect authentication data (set_id=services@heipowersystem.com)49.124.153.581733045ja  -_) ossec13001gw Exim Auth failed2025-03-08 04:15:30 dovecot_plain authenticator failed for ([112.176.249.35]) [112.176.249.35]:46753: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)112.176.249.351835841Z`  -=+ ossec13001gwExim Auth failed2025-03-08 04:15:40 dovecot_plain authenticator failed for ([122.187.230.154]) [122.187.230.154]:47779: 535 Incorrect authentication data (set_id=sales)122.187.230.1541269750M_  -/! ossec13001gvBExim Auth failed2025-03-08 04:12:09 dovecot_plain authenticator failed for ([2.55.74.30]) [2.55.74.30]:46658: 535 Incorrect authentication data (set_id=services)2.55.74.30294640d^  -Y# ossec13001gv:Exim Auth failed2025-03-08 04:12:00 dovecot_plain authenticator failed for ([81.22.58.11]) [81.22.58.11]:53550: 535 Incorrect authentication data (set_id=services@heipowersystem.com)81.22.58.112017370f]  -W) ossec13001gtExim Auth failed2025-03-08 04:05:25 dovecot_plain authenticator failed for 46-162-112-159.cust.bredband2.com [46.162.112.159]:53702: 535 Incorrect authentication data (set_id=sales)46.162.112.1592661886g\  -[' ossec13001gtExim Auth failed2025-03-08 04:05:15 dovecot_plain authenticator failed for ([58.42.226.215]) [58.42.226.215]:60431: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)58.42.226.2151814991 [  -!) ossec13001grExim Auth failed2025-03-08 03:56:56 dovecot_plain authenticator failed for 131-106-85-205.s1483.c3-0.tlg-cbr5.atw-tlg.pa.cable.rcncustomer.com [131.106.85.205]:42114: 535 Incorrect authentication data (set_id=services)131.106.85.2056252001 %E h { !CBd|g|  -[' ossec13001g˅Exim Auth failed2025-03-08 05:15:20 dovecot_plain authenticator failed for ([103.69.244.39]) [103.69.244.39]:47928: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)103.69.244.391269750T{  -5' ossec13001g˃Exim Auth failed2025-03-08 05:08:56 dovecot_plain authenticator failed for ([121.157.28.10]) [121.157.28.10]:57375: 535 Incorrect authentication data (set_id=sales)121.157.28.101835841dz  -W% ossec13001g˃qExim Auth failed2025-03-08 05:08:25 dovecot_plain authenticator failed for ([27.24.141.90]) [27.24.141.90]:40120: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)27.24.141.901814991Zy  -?) ossec13001g˂Exim Auth failed2025-03-08 05:05:53 dovecot_plain authenticator failed for ([103.134.113.59]) [103.134.113.59]:53916: 535 Incorrect authentication data (set_id=services)103.134.113.591269750}x  -' ossec13001g˂Exim Auth failed2025-03-08 05:05:33 dovecot_plain authenticator failed for syn-131-148-000-202.biz.spectrum.com [131.148.0.202]:55067: 535 Incorrect authentication data (set_id=services@heipowersystem.com)131.148.0.2026252001Zw  -?) ossec13001gˁ Exim Auth failed2025-03-08 04:58:10 dovecot_plain authenticator failed for ([119.45.170.229]) [119.45.170.229]:59074: 535 Incorrect authentication data (set_id=services)119.45.170.2291814991jv  -a' ossec13001gˀExim Auth failed2025-03-08 04:57:45 dovecot_plain authenticator failed for ([77.106.78.215]) [77.106.78.215]:62956: 535 Incorrect authentication data (set_id=services@heipowersystem.com)77.106.78.2152017370Su  -3' ossec13001gˀExim Auth failed2025-03-08 04:55:56 dovecot_plain authenticator failed for ([103.98.21.22]) [125.99.242.32]:34587: 535 Incorrect authentication data (set_id=sales)125.99.242.321269750gt  -[' ossec13001gˀvExim Auth failed2025-03-08 04:55:41 dovecot_plain authenticator failed for ([72.26.178.196]) [72.26.178.196]:53476: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)72.26.178.1966252001Ns  --# ossec13001gvExim Auth failed2025-03-08 04:51:25 dovecot_plain authenticator failed for ([59.0.60.158]) [59.0.60.158]:50912: 535 Incorrect authentication data (set_id=sales)59.0.60.1581835841vr  -y' ossec13001gdExim Auth failed2025-03-08 04:51:07 dovecot_plain authenticator failed for 111-70-49-109.emome-ip.hinet.net [111.70.49.109]:55953: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)111.70.49.1091668284lq  -c) ossec13001g~Exim Auth failed2025-03-08 04:47:47 dovecot_plain authenticator failed for 166.46.246.220.static.netvigator.com [220.246.46.166]:64712: 535 Incorrect authentication data (set_id=services)220.246.46.1661819730jp  -a' ossec13001g~Exim Auth failed2025-03-08 04:47:36 dovecot_plain authenticator failed for ([175.202.82.16]) [175.202.82.16]:41348: 535 Incorrect authentication data (set_id=services@heipowersystem.com)175.202.82.161835841io  -_' ossec13001g~Exim Auth failed2025-03-08 04:47:32 dovecot_login authenticator failed for (heipowersystem.com) [111.207.12.99]:40454: 535 Incorrect authentication data (set_id=test@heipowersystem.com)111.207.12.991814991Yn  -?' ossec13001g~tExim Auth failed2025-03-08 04:47:07 dovecot_login authenticator failed for (heipowersystem.com) [111.207.12.99]:36202: 535 Incorrect authentication data (set_id=nologin)111.207.12.991814991\m -E% ossec13001g~dExim Auth failed2025-03-08 04:46:50 dovecot_login authenticator failed for (amplifypowerglobal.com) [150.5.145.36]:45740: 535 Incorrect authentication data (set_id=nologin)150.5.145.361880251Wl  -;' ossec13001g}Exim Auth failed2025-03-08 04:41:23 dovecot_plain authenticator failed for ([123.182.89.19]) [123.182.89.19]:34925: 535 Incorrect authentication data (set_id=services)123.182.89.191814991 0["yl_k ~qdWJ=0# zm`SF9 x|obUH;.  v i 5 (    r 1 $ ^QD7* s f Y L ? 2 % }pcV    >I</NA4' ZM@3 XJRE8 &tg! K e  \ O B ,=0~qdWuh+ { n a T G : -   w j ] P C 6 ) 1668284E 1668284E 16682847 1668284F 1668284F 1668284Fn 1668284FS 1668284F2 1668284] 16682844I 16682844E 1668284| 16682844j 1668284 1668284F 16682845 16682845h 16682844 16682844 16682844 16682844 16682844 16682844n 1668284 1668284H 1668284G 1668284G9 1668284G 1668284 1668284HF 1668284H) 1668284 1668284H 1668284H 16682848 16682848Y 1668284 1668284H 1668284H 1668284H 16682848 16682848 16682848 1668284 z 1668284 v 1668284 \ 1668284 2 1668284  1668284 1668284 1668284 1668284 1668284 1668284 1668284d 1668284T 1668284E 1668284: 16682847 16682844 16682843 16682843O 16682840 16682840j 16682840[ 1668284/ 1668284/ 1668284. 1668284 1668284 } 1668284=V 1668284=U 1668284< 1668284 16682847 16682847 1668284=W 16682846 1668284=X 16682846 16682846 16682846 16682846x 1668284> 1668284= 1668284=Y 16682849{ 16682849I 1668284?a 1668284?4 16682849 1668284@ 1668284; 1668284A 1668284@ 1668284@ 1668284$ 1668284 1668284+ 1668284+ 1668284+ 1668284+ 1668284+ 1668284 1668284% 1668284% 1668284$ 1668284-` 1668284- 1668284, 1668284, 1668284,} 1668284,f 1668284,G 1668284,B 1668284, 1668284! 1668284A 1668284& 1668284& 1668284&b 1668284&T 1668284& 1668284& 1668284% 1668284% 1668284% 1668284% 1668284%` 1668284%U 1668284%P 1668284%? 1668284%* 1668284! 1668284& 1668284& 1668284. 1668284. 1668284. 1668284.x 1668284.t 1668284.V 1668284.C 1668284- 1668284- 16682840 1668284- 1668284- 1668284- 166828428 16682842 16682841 16682841 16682841 16682841H 166828415 1668284!$ 1668284!# 1668284!! 16682842 1668284+@ 16682842 1668284+' 1668284+ 16682842 1668284A 16682847% 1668284A 1668284*a 1668284*[ 1668284B 1668284*M 1668284) 1668284) 1668284) 1668284B= 1668284) 1668284)u 1668284)E 1668284( 1668284Bc 1668284( 1668284( 1668284( 1668284B 1668284Bz 1668284Bw 1668284( 1668284( 1668284B 1668284' 1668284B 1668284' 1668284C 1668284'P 1668284'( 1668284& 1668284$S 1668284$ 1668284# 1668284D' 1668284# 1668284D+ 1668284#4 1668284" 1668284" 1668284" 1668284" 1668284"j 1668284"H 1668284"@ 1668284"2 1668284"# 1668284"" 1668284" 1668284DO 1668284! 1668284! 1668284! 1668284! 1668284! 1668284! 1668284!| 1668284!q 1668284!k 1668284!V 1668284!S 1668284!A 1668284!: 1668284< 1668284D 1668284<5 1668284; 1668284E 1668284D 1668284:W 1668284:G 1668284: 7 M Y _ ]evuj  -_) ossec13001gˎ|Exim Auth failed2025-03-08 05:55:32 dovecot_plain authenticator failed for ([119.206.34.142]) [119.206.34.142]:51266: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)119.206.34.1421835841i  -a% ossec13001gˍExim Auth failed2025-03-08 05:52:44 dovecot_plain authenticator failed for 48.211.41.34.bc.googleusercontent.com [34.41.211.48]:54716: 535 Incorrect authentication data (set_id=services)34.41.211.486252001  -' ossec13001gˍExim Auth failed2025-03-08 05:52:27 dovecot_plain authenticator failed for pool-99-251-252-98.cpe.net.cable.rogers.com [99.251.252.98]:51976: 535 Incorrect authentication data (set_id=services@heipowersystem.com)99.251.252.986251999Z  -?) ossec13001gˋExim Auth failed2025-03-08 05:44:52 dovecot_plain authenticator failed for ([103.129.201.82]) [103.129.201.81]:40482: 535 Incorrect authentication data (set_id=services)103.129.201.811210997}  -) ossec13001gˋExim Auth failed2025-03-08 05:44:25 dovecot_plain authenticator failed for (223-197-145-33.static.imsbiz.com) [223.197.145.33]:60183: 535 Incorrect authentication data (set_id=services@heipowersystem.com)223.197.145.331819730k  -c' ossec13001gˋExim Auth failed2025-03-08 05:43:47 dovecot_plain authenticator failed for modemcable039.132-202-24.mc.videotron.ca [24.202.132.39]:57206: 535 Incorrect authentication data (set_id=sales)24.202.132.396251999t  -w% ossec13001gˋExim Auth failed2025-03-08 05:43:34 dovecot_plain authenticator failed for (123-51-28-60.static.dsl.net.au) [123.51.28.60]:48622: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)123.51.28.602077456%  3Q' ossec11301gˈNew FTP connection.Mar 8 05:30:24 vm1 pure-ftpd[3140460]: (?@91.238.181.96) [INFO] New connection from 91.238.181.9691.238.181.963017382W  -9) ossec13001gˈpExim Auth failed2025-03-08 05:29:44 dovecot_plain authenticator failed for ([178.178.222.60]) [178.178.222.60]:58440: 535 Incorrect authentication data (set_id=sales)178.178.222.602017370m  -c+ ossec13001gˈTExim Auth failed2025-03-08 05:29:16 dovecot_plain authenticator failed for ([112.172.126.247]) [112.172.126.247]:35178: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)112.172.126.2471835841`  -U! ossec13001gˇExim Auth failed2025-03-08 05:27:46 dovecot_plain authenticator failed for ([2.55.74.30]) [2.55.74.30]:60772: 535 Incorrect authentication data (set_id=services@heipowersystem.com)2.55.74.30294640%  3Q' ossec11301gˇnNew FTP connection.Mar 8 05:25:26 vm1 pure-ftpd[3139381]: (?@88.214.25.125) [INFO] New connection from 88.214.25.12588.214.25.1252921044v  -y' ossec13001gˆvExim Auth failed2025-03-08 05:21:17 dovecot_plain authenticator failed for ([170.250.128.5]) [170.250.128.5]:47636: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)170.250.128.56252001p  -i+ ossec13001gˆExim Auth failed2025-03-08 05:21:55 dovecot_plain authenticator failed for ([203.123.219.137]) [203.123.219.137]:42259: 535 Incorrect authentication data (set_id=services@heipowersystem.com)203.123.219.1371835841f  -W) ossec13001gˆExim Auth failed2025-03-08 05:21:40 dovecot_plain authenticator failed for ([183.220.247.88]) [183.220.247.88]:53198: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)183.220.247.881814991W~  -9) ossec13001gˆ>Exim Auth failed2025-03-08 05:20:20 dovecot_plain authenticator failed for ([175.182.64.203]) [175.182.64.203]:41634: 535 Incorrect authentication data (set_id=sales)175.182.64.2031668284j}  -_) ossec13001gˆ0Exim Auth failed2025-03-08 05:20:07 dovecot_plain authenticator failed for ([182.135.66.179]) [182.135.66.179]:49206: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)182.135.66.1791814991 "7 \ k /Q`Gjg  -[' ossec13001g˘RExim Auth failed2025-03-08 06:37:29 dovecot_plain authenticator failed for syn-071-012-241-225.res.spectrum.com [71.12.241.225]:50446: 535 Incorrect authentication data (set_id=sales)71.12.241.2256252001Y  -=) ossec13001g˘ Exim Auth failed2025-03-08 06:36:20 dovecot_plain authenticator failed for ([216.194.174.80]) [216.194.174.27]:6334: 535 Incorrect authentication data (set_id=services)216.194.174.276252001  -3+ ossec13001g˘Exim Auth failed2025-03-08 06:36:09 dovecot_plain authenticator failed for lnsm1-torontoxn-142-116-116-160.internet.virginmobile.ca [142.116.116.160]:42782: 535 Incorrect authentication data (set_id=services@heipowersystem.com)142.116.116.1606251999m  -e) ossec13001g˗Exim Auth failed2025-03-08 06:34:51 dovecot_plain authenticator failed for ([112.15.144.140]) [112.15.144.140]:49048: 535 Incorrect authentication data (set_id=services@heipowersystem.com)112.15.144.1401814991Z  -?) ossec13001g˕Exim Auth failed2025-03-08 06:23:49 dovecot_plain authenticator failed for ([167.142.198.54]) [167.142.198.54]:52963: 535 Incorrect authentication data (set_id=services)167.142.198.546252001j  -a' ossec13001g˕ Exim Auth failed2025-03-08 06:23:31 dovecot_plain authenticator failed for ([31.173.20.146]) [31.173.20.146]:51192: 535 Incorrect authentication data (set_id=services@heipowersystem.com)31.173.20.1462017370s  -u% ossec13001g˔Exim Auth failed2025-03-08 06:22:14 dovecot_plain authenticator failed for 206.81.4.146.static.wline.lns.sme.cust.swisscom.ch [146.4.81.206]:43599: 535 Incorrect authentication data (set_id=sales)146.4.81.2062658434d  -W% ossec13001g˔Exim Auth failed2025-03-08 06:22:01 dovecot_plain authenticator failed for ([60.12.33.249]) [60.12.33.249]:41559: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)60.12.33.2491814991l  -e) ossec13001g˓Exim Auth failed2025-03-08 06:17:30 dovecot_plain authenticator failed for ([85.105.241.188]) [85.105.241.188]:41330: 535 Incorrect authentication data (set_id=services@heipowersystem.com)85.105.241.188298795T  -5' ossec13001g˓Exim Auth failed2025-03-08 06:16:54 dovecot_plain authenticator failed for ([117.173.18.71]) [117.173.18.71]:46484: 535 Incorrect authentication data (set_id=sales)117.173.18.711814991g  -[' ossec13001g˓kExim Auth failed2025-03-08 06:16:34 dovecot_plain authenticator failed for ([48.218.170.53]) [48.218.170.53]:58958: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)48.218.170.531861060P  -1% ossec13001gˑExim Auth failed2025-03-08 06:08:51 dovecot_login authenticator failed for ([149.0.19.108]) [149.0.19.108]:48376: 535 Incorrect authentication data (set_id=sales)149.0.19.108298795d  -W% ossec13001gˑExim Auth failed2025-03-08 06:08:42 dovecot_login authenticator failed for ([197.5.144.31]) [197.5.144.31]:48604: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)197.5.144.312464461m  -e) ossec13001gːExim Auth failed2025-03-08 06:04:10 dovecot_plain authenticator failed for ([112.15.144.140]) [112.15.144.140]:36248: 535 Incorrect authentication data (set_id=services@heipowersystem.com)112.15.144.1401814991W  -9) ossec13001gːvExim Auth failed2025-03-08 06:03:57 dovecot_plain authenticator failed for ([151.49.116.193]) [151.49.116.193]:53513: 535 Incorrect authentication data (set_id=sales)151.49.116.1933175395g  -[' ossec13001gːfExim Auth failed2025-03-08 06:03:42 dovecot_plain authenticator failed for ([14.53.126.112]) [14.53.126.112]:58112: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)14.53.126.1121835841Z  -=+ ossec13001gˎExim Auth failed2025-03-08 05:55:54 dovecot_plain authenticator failed for ([114.243.136.120]) [114.243.136.120]:56639: 535 Incorrect authentication data (set_id=sales)114.243.136.1201814991 S B E p | *R`S /  -' ossec13001gˢExim Auth failed2025-03-08 07:22:50 dovecot_login authenticator failed for (64.250.41.124.dynamic.wlink.com.np) [124.41.250.64]:39634: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)124.41.250.641282988n.  -k% ossec13001gˢYExim Auth failed2025-03-08 07:20:16 dovecot_plain authenticator failed for (ppp075.bol-online.com) [202.84.34.85]:33196: 535 Incorrect authentication data (set_id=services@heipowersystem.com)202.84.34.851210997T-  -7% ossec13001gˢkExim Auth failed2025-03-08 07:20:34 dovecot_plain authenticator failed for ([144.48.49.72]) [144.48.49.72]:38756: 535 Incorrect authentication data (set_id=services)144.48.49.721269750W,  -9) ossec13001gˡExim Auth failed2025-03-08 07:16:46 dovecot_plain authenticator failed for ([61.145.163.164]) [61.145.163.164]:52148: 535 Incorrect authentication data (set_id=sales)61.145.163.1641814991j+  -_) ossec13001gˡqExim Auth failed2025-03-08 07:16:23 dovecot_plain authenticator failed for ([220.182.11.126]) [220.182.11.126]:45356: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)220.182.11.1261814991Z*  -?) ossec13001g˟Exim Auth failed2025-03-08 07:08:39 dovecot_plain authenticator failed for ([45.225.194.121]) [45.225.194.121]:48168: 535 Incorrect authentication data (set_id=services)45.225.194.1213469034p)  -i+ ossec13001g˟Exim Auth failed2025-03-08 07:08:27 dovecot_plain authenticator failed for ([114.243.136.120]) [114.243.136.120]:47090: 535 Incorrect authentication data (set_id=services@heipowersystem.com)114.243.136.1201814991Z(  -?) ossec13001g˞Exim Auth failed2025-03-08 07:01:49 dovecot_plain authenticator failed for ([168.126.90.210]) [168.126.90.210]:48781: 535 Incorrect authentication data (set_id=services)168.126.90.2101835841o'  -i+ ossec13001g˝Exim Auth failed2025-03-08 07:01:29 dovecot_plain authenticator failed for ([196.189.126.185]) [196.189.126.185]:42884: 535 Incorrect authentication data (set_id=services@heipowersystem.com)196.189.126.185337996g&  -[' ossec13001g˝ZExim Auth failed2025-03-08 06:58:57 dovecot_plain authenticator failed for ([92.255.190.69]) [92.255.190.69]:49920: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)92.255.190.692017370w%  -y) ossec13001g˜oExim Auth failed2025-03-08 06:55:03 dovecot_plain authenticator failed for (customer-187-141-234-40-sta.uninet-ide.com.mx) [187.141.234.34]:51369: 535 Incorrect authentication data (set_id=services)187.141.234.343996063p$  -i+ ossec13001g˜]Exim Auth failed2025-03-08 06:54:44 dovecot_plain authenticator failed for ([182.163.122.133]) [182.163.122.133]:30137: 535 Incorrect authentication data (set_id=services@heipowersystem.com)182.163.122.1331210997Q#  -1% ossec13001g˜;Exim Auth failed2025-03-08 06:54:11 dovecot_plain authenticator failed for ([144.48.49.72]) [144.48.49.72]:53820: 535 Incorrect authentication data (set_id=sales)144.48.49.721269750y"  -' ossec13001g˜3Exim Auth failed2025-03-08 06:54:02 dovecot_plain authenticator failed for c-73-45-216-101.hsd1.il.comcast.net [73.45.216.101]:55710: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)73.45.216.1016252001P!  -1% ossec13001g˚sExim Auth failed2025-03-08 06:46:34 dovecot_plain authenticator failed for ([185.167.56.2]) [185.167.56.2]:39680: 535 Incorrect authentication data (set_id=sales)185.167.56.2617790x  -{) ossec13001g˚SExim Auth failed2025-03-08 06:46:03 dovecot_plain authenticator failed for 89-179-241-253.static.corbina.ru [89.179.241.253]:56652: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)89.179.241.2532017370j  -]+ ossec13001g˘FExim Auth failed2025-03-08 06:37:17 dovecot_plain authenticator failed for ([118.122.255.5]) [118.122.252.141]:7607: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)118.122.252.1411814991 d G Y u cx<Qdi@  -]) ossec13001g˩Exim Auth failed2025-03-08 07:52:31 dovecot_plain authenticator failed for 94-255-178-175.cust.bredband2.com [94.255.178.175]:52248: 535 Incorrect authentication data (set_id=services)94.255.178.1752661886g?  -]% ossec13001g˩Exim Auth failed2025-03-08 07:52:18 dovecot_plain authenticator failed for ([218.68.0.210]) [218.68.0.210]:53028: 535 Incorrect authentication data (set_id=services@heipowersystem.com)218.68.0.2101814991Z>  -?) ossec13001g˨Exim Auth failed2025-03-08 07:47:35 dovecot_plain authenticator failed for ([131.161.184.58]) [131.161.184.58]:56432: 535 Incorrect authentication data (set_id=services)131.161.184.583865483j=  -a' ossec13001g˨Exim Auth failed2025-03-08 07:47:15 dovecot_plain authenticator failed for ([85.15.190.172]) [85.15.190.172]:58050: 535 Incorrect authentication data (set_id=services@heipowersystem.com)85.15.190.1722017370N<  --# ossec13001g˨MExim Auth failed2025-03-08 07:45:40 dovecot_plain authenticator failed for ([47.91.88.67]) [47.91.88.67]:49244: 535 Incorrect authentication data (set_id=sales)47.91.88.672921044j;  -_) ossec13001g˨7Exim Auth failed2025-03-08 07:45:18 dovecot_plain authenticator failed for ([121.190.129.68]) [121.190.129.68]:48333: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)121.190.129.681835841\:  -G% ossec13001g˥Exim Auth failed2025-03-08 07:34:08 dovecot_login authenticator failed for ([191.59.165.4]) [191.59.165.4]:41906: 535 Incorrect authentication data (set_id=vikas.khandelwal)191.59.165.43469034t9  -u) ossec13001g˥Exim Auth failed2025-03-08 07:33:57 dovecot_login authenticator failed for ([89.144.187.114]) [89.144.187.114]:50109: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)89.144.187.114130758T8  -5' ossec13001g˥(Exim Auth failed2025-03-08 07:32:14 dovecot_plain authenticator failed for ([124.228.32.34]) [124.228.32.34]:41160: 535 Incorrect authentication data (set_id=sales)124.228.32.341814991g7  -[' ossec13001g˥ Exim Auth failed2025-03-08 07:31:45 dovecot_plain authenticator failed for ([102.31.152.59]) [102.31.152.59]:51738: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)102.31.152.5924644616  W% ossec9708gˤDovecot Aborted Login with empty userMar 8 07:29:25 vm1 dovecot[312763]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=152.32.143.6, lip=103.74.54.108, TLS, session=152.32.143.62328926p5  -i+ ossec13001gˤaExim Auth failed2025-03-08 07:28:56 dovecot_plain authenticator failed for ([178.178.194.136]) [178.178.194.136]:48814: 535 Incorrect authentication data (set_id=services@heipowersystem.com)178.178.194.1362017370`4  -O% ossec13001gˣExim Auth failed2025-03-08 07:26:20 dovecot_plain authenticator failed for 111-70-4-132.emome-ip.hinet.net [111.70.4.132]:55273: 535 Incorrect authentication data (set_id=sales)111.70.4.1321668284j3  -_) ossec13001gˣExim Auth failed2025-03-08 07:25:56 dovecot_plain authenticator failed for ([31.220.168.116]) [31.220.168.116]:49991: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)31.220.168.1162017370Q2  -1% ossec13001gˣ9Exim Auth failed2025-03-08 07:24:00 dovecot_login authenticator failed for ([59.41.197.10]) [59.41.197.10]:32864: 535 Incorrect authentication data (set_id=sales)59.41.197.101814991y1  -}) ossec13001gˣ%Exim Auth failed2025-03-08 07:23:40 dovecot_login authenticator failed for c83-254-214-181.bredband.tele2.se [83.254.214.181]:39964: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)83.254.214.1812661886c0  -S' ossec13001gˣExim Auth failed2025-03-08 07:23:21 dovecot_login authenticator failed for ([61.81.133.182]) [61.81.133.182]:34757: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)61.81.133.1821835841 1 @ R \ h  P  - ' ossec13001g˱Exim Auth failed2025-03-08 08:23:14 dovecot_plain authenticator failed for broadband-188-32-170-20.ip.moscow.rt.ru [188.32.170.20]:51482: 535 Incorrect authentication data (set_id=services@heipowersystem.com)188.32.170.202017370mO  -e) ossec13001g˱SExim Auth failed2025-03-08 08:24:10 dovecot_login authenticator failed for ([39.129.133.184]) [39.129.133.184]:35542: 535 Incorrect authentication data (set_id=services@heipowersystem.com)39.129.133.1841814991TN  -7% ossec13001g˱9Exim Auth failed2025-03-08 08:23:44 dovecot_plain authenticator failed for ([112.102.48.9]) [112.102.48.9]:49246: 535 Incorrect authentication data (set_id=services)112.102.48.91814991mM  -e) ossec13001g˱Exim Auth failed2025-03-08 08:23:02 dovecot_plain authenticator failed for ([120.82.196.131]) [120.82.196.131]:53674: 535 Incorrect authentication data (set_id=services@heipowersystem.com)120.82.196.1311814991`L  -M' ossec13001g˰Exim Auth failed2025-03-08 08:18:45 dovecot_plain authenticator failed for p5098d833.dip0.t-ipconnect.de [80.152.216.51]:18972: 535 Incorrect authentication data (set_id=sales)80.152.216.512921044jK  -_) ossec13001g˯Exim Auth failed2025-03-08 08:18:29 dovecot_plain authenticator failed for ([182.180.93.208]) [182.180.93.208]:53636: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)182.180.93.2081168579J  W' ossec9708gˮvDovecot Aborted Login with empty userMar 8 08:11:57 vm1 dovecot[312763]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=185.247.137.8, lip=103.74.54.108, TLS, session=185.247.137.8298795QI  -1% ossec13001gˮHExim Auth failed2025-03-08 08:11:11 dovecot_login authenticator failed for ([110.35.63.27]) [110.35.63.27]:59832: 535 Incorrect authentication data (set_id=sales)110.35.63.271835841gH  -[' ossec13001gˮ2Exim Auth failed2025-03-08 08:10:49 dovecot_login authenticator failed for ([85.15.190.172]) [85.15.190.172]:58184: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)85.15.190.1722017370]G  -C+ ossec13001g˭Exim Auth failed2025-03-08 08:08:03 dovecot_plain authenticator failed for ([176.226.241.177]) [176.226.241.177]:34048: 535 Incorrect authentication data (set_id=services)176.226.241.1772017370pF  -i+ ossec13001g˭lExim Auth failed2025-03-08 08:07:30 dovecot_plain authenticator failed for ([175.117.144.158]) [175.117.144.158]:36570: 535 Incorrect authentication data (set_id=services@heipowersystem.com)175.117.144.1581835841rE  -q) ossec13001gˬExim Auth failed2025-03-08 08:03:51 dovecot_plain authenticator failed for host-91-202-230-214.static.oc3.zagan.visnet.pl [91.202.230.214]:57257: 535 Incorrect authentication data (set_id=sales)91.202.230.214798544jD  -_) ossec13001gˬExim Auth failed2025-03-08 08:03:40 dovecot_plain authenticator failed for ([116.114.84.234]) [116.114.84.234]:43766: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)116.114.84.2341814991mC  -c+ ossec13001g˫kExim Auth failed2025-03-08 07:58:58 dovecot_plain authenticator failed for ([121.135.188.125]) [121.135.188.125]:37114: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)121.135.188.1251835841ZB  -?) ossec13001g˪?Exim Auth failed2025-03-08 07:53:58 dovecot_login authenticator failed for ([125.136.163.86]) [125.136.163.86]:60376: 535 Incorrect authentication data (set_id=services)125.136.163.861835841mA  -e) ossec13001g˪+Exim Auth failed2025-03-08 07:53:39 dovecot_login authenticator failed for ([175.214.52.214]) [175.214.52.214]:41554: 535 Incorrect authentication data (set_id=services@heipowersystem.com)175.214.52.2141835841 ( C O _ r $9gga  -[' ossec13001g˷Exim Auth failed2025-03-08 08:50:31 dovecot_plain authenticator failed for h88-129-31-231.cust.bredband2.com [88.129.31.231]:52185: 535 Incorrect authentication data (set_id=services)88.129.31.2312661886^`  -O! ossec13001g˷hExim Auth failed2025-03-08 08:50:08 dovecot_plain authenticator failed for ([27.0.61.49]) [27.0.61.49]:35462: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)27.0.61.491269750b_  -Y# ossec13001g˷fExim Auth failed2025-03-08 08:50:06 dovecot_plain authenticator failed for ([65.20.169.5]) [65.20.169.5]:57719: 535 Incorrect authentication data (set_id=services@heipowersystem.com)65.20.169.599237N^  --# ossec13001g˵Exim Auth failed2025-03-08 08:39:54 dovecot_plain authenticator failed for ([60.28.60.82]) [60.28.60.82]:60148: 535 Incorrect authentication data (set_id=sales)60.28.60.821814991g]  -[' ossec13001g˴Exim Auth failed2025-03-08 08:39:40 dovecot_plain authenticator failed for ([45.229.19.193]) [45.229.19.193]:48842: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)45.229.19.1933865483V\  -7) ossec13001g˴Exim Auth failed2025-03-08 08:39:34 dovecot_login authenticator failed for ([43.246.138.100]) [43.246.138.100]:39200: 535 Incorrect authentication data (set_id=info)43.246.138.1001269750i[  -]) ossec13001g˴Exim Auth failed2025-03-08 08:39:24 dovecot_login authenticator failed for ([220.182.17.122]) [220.182.17.122]:59284: 535 Incorrect authentication data (set_id=info@heipowersystem.com)220.182.17.1221814991ZZ  -?) ossec13001g˴nExim Auth failed2025-03-08 08:37:24 dovecot_plain authenticator failed for ([138.75.118.229]) [138.75.118.229]:38611: 535 Incorrect authentication data (set_id=services)138.75.118.2291880251wY  -y) ossec13001g˴WExim Auth failed2025-03-08 08:37:03 dovecot_plain authenticator failed for (91-220-216-178.omsk.mts.ru) [178.216.220.91]:50100: 535 Incorrect authentication data (set_id=services@heipowersystem.com)178.216.220.912017370PX  -/% ossec13001g˲kExim Auth failed2025-03-08 08:28:50 dovecot_login authenticator failed for ([61.73.190.98]) [61.73.190.98]:40937: 535 Incorrect authentication data (set_id=info)61.73.190.981835841VW  -7) ossec13001g˲gExim Auth failed2025-03-08 08:28:47 dovecot_login authenticator failed for ([154.144.243.93]) [154.144.243.93]:41526: 535 Incorrect authentication data (set_id=info)154.144.243.932542007iV  -]) ossec13001g˲_Exim Auth failed2025-03-08 08:28:39 dovecot_login authenticator failed for ([116.114.84.234]) [116.114.84.234]:50359: 535 Incorrect authentication data (set_id=info@heipowersystem.com)116.114.84.2341814991lU  -a+ ossec13001g˲]Exim Auth failed2025-03-08 08:28:37 dovecot_login authenticator failed for ([125.140.244.144]) [125.140.244.144]:55474: 535 Incorrect authentication data (set_id=info@heipowersystem.com)125.140.244.1441835841pT  -i+ ossec13001g˱Exim Auth failed2025-03-08 08:26:40 dovecot_plain authenticator failed for ([123.210.131.121]) [123.210.131.121]:55966: 535 Incorrect authentication data (set_id=services@heipowersystem.com)123.210.131.1212077456aS  -O' ossec13001g˱yExim Auth failed2025-03-08 08:24:48 dovecot_plain authenticator failed for 81.60.194.189.dyn.user.ono.com [81.60.194.189]:40946: 535 Incorrect authentication data (set_id=sales)81.60.194.1892510769ZR  -?) ossec13001g˱kExim Auth failed2025-03-08 08:24:34 dovecot_login authenticator failed for ([182.135.66.179]) [182.135.66.179]:33574: 535 Incorrect authentication data (set_id=services)182.135.66.1791814991vQ  -}# ossec13001g˱YExim Auth failed2025-03-08 08:24:16 dovecot_plain authenticator failed for 18.red-83-48-39.staticip.rima-tde.net [83.48.39.18]:8233: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)83.48.39.182510769 % = h { '9azr  -+ ossec13001gExim Auth failed2025-03-08 09:33:50 dovecot_plain authenticator failed for (190-205-112-156.static.cantv.net) [190.205.112.156]:19710: 535 Incorrect authentication data (set_id=services@heipowersystem.com)190.205.112.1563625428hq  -Y+ ossec13001gWExim Auth failed2025-03-08 09:32:31 dovecot_plain authenticator failed for 158.160.200.177.netflexisp.com.br [177.200.160.158]:25479: 535 Incorrect authentication data (set_id=sales)177.200.160.1583469034cp  -W% ossec13001gKExim Auth failed2025-03-08 09:32:17 dovecot_plain authenticator failed for ([94.204.90.91]) [94.204.90.91]:58955: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)94.204.90.91290557To  -7% ossec13001g˿Exim Auth failed2025-03-08 09:22:57 dovecot_plain authenticator failed for ([60.173.218.7]) [60.173.218.7]:35230: 535 Incorrect authentication data (set_id=services)60.173.218.71814991jn  -a' ossec13001g˿Exim Auth failed2025-03-08 09:22:36 dovecot_plain authenticator failed for ([211.109.75.67]) [211.109.75.69]:53457: 535 Incorrect authentication data (set_id=services@heipowersystem.com)211.109.75.691835841Tm  -5' ossec13001g˽Exim Auth failed2025-03-08 09:17:10 dovecot_plain authenticator failed for (adsl.viettel.vn) [115.73.16.145]:52080: 535 Incorrect authentication data (set_id=sales)115.73.16.1451562822jl  -_) ossec13001g˽Exim Auth failed2025-03-08 09:16:54 dovecot_plain authenticator failed for ([221.167.21.148]) [221.167.21.148]:42646: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)221.167.21.1481835841Wk  -9) ossec13001g˼Exim Auth failed2025-03-08 09:13:14 dovecot_plain authenticator failed for ([183.83.188.236]) [183.83.188.236]:59126: 535 Incorrect authentication data (set_id=sales)183.83.188.2361269750ej  -[' ossec13001g˼Exim Auth failed2025-03-08 09:12:57 dovecot_plain authenticator failed for ([65.20.205.197]) [65.20.205.197]:38085: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)65.20.205.19799237}i  - % ossec13001g˻Exim Auth failed2025-03-08 09:09:05 dovecot_login authenticator failed for (5x167x48x130.dynamic.rostov.ertelecom.ru) [5.167.48.130]:47909: 535 Incorrect authentication data (set_id=info@heipowersystem.com)5.167.48.1302017370Zh  -?) ossec13001g˻Exim Auth failed2025-03-08 09:07:53 dovecot_plain authenticator failed for ([121.190.129.68]) [121.190.129.68]:37536: 535 Incorrect authentication data (set_id=services)121.190.129.681835841gg  -]% ossec13001g˻Exim Auth failed2025-03-08 09:07:39 dovecot_plain authenticator failed for ([202.200.14.2]) [202.200.14.2]:48575: 535 Incorrect authentication data (set_id=services@heipowersystem.com)202.200.14.21814991if  -a' ossec13001g˻Exim Auth failed2025-03-08 09:05:44 dovecot_login authenticator failed for mail.infologic.co.il [85.130.200.51]:43351: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)85.130.200.51294640Qe  -1% ossec13001g˻Exim Auth failed2025-03-08 09:05:56 dovecot_login authenticator failed for ([61.97.17.208]) [61.97.17.208]:43813: 535 Incorrect authentication data (set_id=sales)61.97.17.2081835841dd  -W% ossec13001g˺/Exim Auth failed2025-03-08 09:01:59 dovecot_plain authenticator failed for ([98.70.127.17]) [98.70.127.17]:58200: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)98.70.127.171269750Wc  -;' ossec13001g˹Exim Auth failed2025-03-08 08:57:13 dovecot_plain authenticator failed for ([14.49.166.131]) [14.49.166.131]:54193: 535 Incorrect authentication data (set_id=services)14.49.166.1311835841|b  -) ossec13001g˹Exim Auth failed2025-03-08 08:57:01 dovecot_plain authenticator failed for 46-162-112-159.cust.bredband2.com [46.162.112.159]:34432: 535 Incorrect authentication data (set_id=services@heipowersystem.com)46.162.112.1592661886 e 3 X b y  -Xeo  -i+ ossec13001gNExim Auth failed2025-03-08 10:19:16 dovecot_plain authenticator failed for ([196.189.126.185]) [196.189.126.185]:34100: 535 Incorrect authentication data (set_id=services@heipowersystem.com)196.189.126.185337996Q  -1% ossec13001g˼Exim Auth failed2025-03-08 10:16:50 dovecot_plain authenticator failed for ([50.82.12.128]) [50.82.12.128]:46234: 535 Incorrect authentication data (set_id=sales)50.82.12.1286252001n  -g) ossec13001g˦Exim Auth failed2025-03-08 10:16:29 dovecot_plain authenticator failed for 118-119-237-24.gci.net [24.237.119.118]:44461: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)24.237.119.1186252001j  -a' ossec13001gEExim Auth failed2025-03-08 10:14:53 dovecot_plain authenticator failed for ([182.213.57.49]) [182.213.57.49]:33432: 535 Incorrect authentication data (set_id=services@heipowersystem.com)182.213.57.491835841W  -;' ossec13001gUExim Auth failed2025-03-08 10:15:08 dovecot_plain authenticator failed for ([125.20.46.114]) [125.20.46.114]:40360: 535 Incorrect authentication data (set_id=services)125.20.46.1141269750h~  -]' ossec13001gExim Auth failed2025-03-08 10:00:11 dovecot_plain authenticator failed for ppp-210-86-167-42.revip.asianet.co.th [210.86.167.42]:53566: 535 Incorrect authentication data (set_id=sales)210.86.167.421605651g}  -[' ossec13001gExim Auth failed2025-03-08 10:00:00 dovecot_plain authenticator failed for ([121.154.90.17]) [121.154.90.17]:56978: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)121.154.90.171835841Z|  -=+ ossec13001gǠExim Auth failed2025-03-08 09:59:19 dovecot_plain authenticator failed for ([118.122.255.5]) [118.122.252.141]:4530: 535 Incorrect authentication data (set_id=services)118.122.252.1411814991m{  -e) ossec13001gǀExim Auth failed2025-03-08 09:58:47 dovecot_plain authenticator failed for ([216.194.174.80]) [216.194.174.27]:52459: 535 Incorrect authentication data (set_id=services@heipowersystem.com)216.194.174.276252001zz  -) ossec13001gExim Auth failed2025-03-08 09:51:42 dovecot_plain authenticator failed for (116.68.197.124.unknown.m1.com.sg) [124.197.68.116]:53419: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)124.197.68.1161880251iy  -]) ossec13001gExim Auth failed2025-03-08 09:52:02 dovecot_plain authenticator failed for syn-173-095-123-220.biz.spectrum.com [173.95.123.220]:50606: 535 Incorrect authentication data (set_id=sales)173.95.123.2206252001ex  -S+ ossec13001g Exim Auth failed2025-03-08 09:48:39 dovecot_plain authenticator failed for ([103.146.233.121]) [103.146.233.121]:54508: 535 Incorrect authentication data (set_id=vikas.khandelwal)103.146.233.1211269750rw  -q' ossec13001gExim Auth failed2025-03-08 09:48:31 dovecot_plain authenticator failed for ([223.210.27.53]) [223.210.27.53]:26000: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)223.210.27.531814991Wv  -9) ossec13001gĄExim Auth failed2025-03-08 09:46:03 dovecot_plain authenticator failed for ([112.91.124.138]) [112.91.124.138]:58933: 535 Incorrect authentication data (set_id=sales)112.91.124.1381814991gu  -[' ossec13001gZExim Auth failed2025-03-08 09:45:21 dovecot_plain authenticator failed for ([175.202.82.16]) [175.202.82.16]:56982: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)175.202.82.161835841]t  -C+ ossec13001gExim Auth failed2025-03-08 09:43:19 dovecot_plain authenticator failed for ([183.224.122.114]) [183.224.122.114]:53884: 535 Incorrect authentication data (set_id=services)183.224.122.1141814991}s  -) ossec13001gExim Auth failed2025-03-08 09:43:07 dovecot_plain authenticator failed for (94.124.156.175.unknown.m1.com.sg) [175.156.124.94]:51228: 535 Incorrect authentication data (set_id=services@heipowersystem.com)175.156.124.941880251 4 W e t BO^v  -y' ossec13001gExim Auth failed2025-03-08 10:55:28 dovecot_plain authenticator failed for 60-249-207-53.hinet-ip.hinet.net [60.249.207.53]:55640: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)60.249.207.531668284S  -7% ossec13001gExim Auth failed2025-03-08 10:51:22 dovecot_plain authenticator failed for ([94.205.83.14]) [94.205.83.14]:52461: 535 Incorrect authentication data (set_id=services)94.205.83.14290557m  -e) ossec13001gӺExim Auth failed2025-03-08 10:50:56 dovecot_plain authenticator failed for ([223.239.159.21]) [223.239.159.21]:46092: 535 Incorrect authentication data (set_id=services@heipowersystem.com)223.239.159.211269750o  -m% ossec13001gUExim Auth failed2025-03-08 10:49:16 dovecot_plain authenticator failed for vps-79f20bfc.vps.ovh.net [51.75.24.107]:10729: 535 Incorrect authentication data (set_id=services@heipowersystem.com)51.75.24.1073017382M  --# ossec13001gExim Auth failed2025-03-08 10:47:02 dovecot_plain authenticator failed for ([5.31.16.135]) [5.31.16.135]:55176: 535 Incorrect authentication data (set_id=sales)5.31.16.135290557~  -) ossec13001gExim Auth failed2025-03-08 10:46:51 dovecot_plain authenticator failed for ppp-210-86-163-194.revip.asianet.co.th [210.86.163.194]:52574: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)210.86.163.1941605651j  -a' ossec13001gExim Auth failed2025-03-08 10:38:19 dovecot_plain authenticator failed for ([61.108.83.138]) [61.108.83.138]:44857: 535 Incorrect authentication data (set_id=services@heipowersystem.com)61.108.83.1381835841Q  -1% ossec13001gϽExim Auth failed2025-03-08 10:33:55 dovecot_plain authenticator failed for ([87.117.32.22]) [87.117.32.22]:53754: 535 Incorrect authentication data (set_id=sales)87.117.32.222017370f  -[' ossec13001gϱExim Auth failed2025-03-08 10:33:44 dovecot_plain authenticator failed for ([46.30.161.197]) [46.30.161.197]:50554: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)46.30.161.197690791c  -S' ossec13001gτExim Auth failed2025-03-08 10:32:59 dovecot_plain authenticator failed for ([126.209.47.53]) [126.209.47.54]:10000: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)126.209.47.541694008p  -q# ossec13001gnExim Auth failed2025-03-08 10:32:37 dovecot_plain authenticator failed for ([187.9.3.190]) [187.9.3.190]:57730: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)187.9.3.1903469034S  -5' ossec13001gExim Auth failed2025-03-08 10:26:31 dovecot_plain authenticator failed for ([185.167.56.34]) [185.167.56.34]:36648: 535 Incorrect authentication data (set_id=sales)185.167.56.34617790m  -c+ ossec13001gExim Auth failed2025-03-08 10:26:19 dovecot_plain authenticator failed for ([116.116.108.165]) [116.116.108.165]:60805: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)116.116.108.1651814991n  -g) ossec13001g̞Exim Auth failed2025-03-08 10:20:37 dovecot_plain authenticator failed for (32.195.136.122.adsl-pool.jlccptt.net.cn) [122.136.195.32]:56871: 535 Incorrect authentication data (set_id=sales)122.136.195.321814991Y  -=) ossec13001g~Exim Auth failed2025-03-08 10:20:05 dovecot_plain authenticator failed for ([220.90.239.158]) [220.90.239.158]:8526: 535 Incorrect authentication data (set_id=services)220.90.239.1581835841g  -[' ossec13001g|Exim Auth failed2025-03-08 10:20:02 dovecot_plain authenticator failed for ([31.133.71.204]) [31.133.71.204]:55156: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)31.133.71.2042017370]  -C+ ossec13001glExim Auth failed2025-03-08 10:19:47 dovecot_plain authenticator failed for ([212.120.163.110]) [212.120.163.110]:46942: 535 Incorrect authentication data (set_id=services)212.120.163.1102017370 *\~tj`VLB8.$zpf\H>4*   v l b X N D : 0 &    ~ t j ` V L B 8 . $    z p f \ R H > 4 *  vlbXND:0&|r^ThJ@6,"xndZF<P2( ~tj`VLB8.$zpf\ | r h ^ T J @ 6 , "    x n d Z P F < 2 (   RRH>4*  vlbXND:0& gS$ gE$ g$ gr$ g$ g$ g $ g$ g[$ gM$ g)$ g$ g$ g$ g$ g8$ g$$ g$ g$ g$ g%# g# g# gu# gY# gI# g j# g \# g N# g # g # g ;# g )# g# g# g# g}# g# g# g# gR# gF# g# g# g1# g## g# g# g # g# g# g# g# g# gd# g# g# g# g# g# gs# g# gY# gA# g# gu# g# g# g# g# g# g# g# g# g}# g# gk# gY# gq# g# g}# gs# g# gX# gJ# g# gy# gn# g# g# g# g# gG# g;# gH# g# g# g# gx# g!# g# g# g# g# g# g޾# g# gݨ# gݒ# g # g$# g# g# g# g# g# g# g# g# gؿ# gد# g# g`# g׀# gj# gO# g# g# g# gӺ# gU# g# g# g# gϽ# gϱ# gτ# gn# g# g# g̞# g~# g|# gl# gN# g˼# g˦# gU# gE# g#~ g#} gǠ#| gǀ#{ g#y g#z g #x g#w gĄ#v gZ#u g#t g#s g#r gW#q gK#p g˿#o g˿#n g˽#m g˽#l g˼#k g˼#j g1J$> g1"$= g0$< g0$; g0$: g0x$9 g02$8 g0 $7 g.$6 g.u$1 g.s$5 g.i$4 g._$3 g.Y$2 g-$0 g,$/ g+C$. g+7$- g*$, g*$+ g)\$* g)P$) g(($' g($( g&$& g&$% g%$$ g%$# g%)$" g% $! g#,$ g#"$ g# $ g"$ g"$ g $ g$ g$ gs$ g$ gO$ g9$ g$ g˻#i g˻#h g˻#g g˻#e g˻#f g˺/#d g˹#c g˹#b g˷#a g˷h#` g˷f#_ g˵#^ g˴#] g˴#\ g˴#[ g˴n#Z g˴W#Y g˲k#X g˲g#W g˲_#V g˲]#U g˱#T g˱y#S g˱k#R g˱Y#Q g˱S#O g˱9#N g˱#P g˱#M g˰#L g˯#K gˮv#J gˮH#I gˮ2#H g˭#G g˭l#F gˬ#E gˬ#D g˫k#C g˪?#B g˪+#A g˩#@ g1x$? g˩#? g˨#> g˨#= g˨M#< g˨7#; g˥#: g˥#9 g˥(#8 g˥ #7 gˤ#6 gˤa#5 gˣ#4 gˣ#3 gˣ9#2 gˣ%#1 gˣ#0 gˢ#/ gˢk#- gˢY#. gˡ#, gˡq#+ g˟#* g˟#) g˞#( g˝#' g˝Z#& g˜o#% g˜]#$ g˜;## g˜3#" g˚s#! g˚S# g˘R# g˘F# g˘ # g˘# g˗# g˕# g˕ # g˔# g˔# g˓# i%7 C b ~ |&AiT%  -5' ossec13001g$Exim Auth failed2025-03-08 11:26:50 dovecot_plain authenticator failed for ([61.108.83.138]) [61.108.83.138]:36018: 535 Incorrect authentication data (set_id=sales)61.108.83.1381835841a$  -S# ossec13001gExim Auth failed2025-03-08 11:26:02 dovecot_plain authenticator failed for ([61.233.4.50]) [61.233.4.50]:59362: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)61.233.4.501814991d#  -Y# ossec13001gExim Auth failed2025-03-08 11:25:42 dovecot_plain authenticator failed for ([112.94.6.54]) [112.94.6.54]:28894: 535 Incorrect authentication data (set_id=services@heipowersystem.com)112.94.6.541814991`"  -S# ossec13001gExim Auth failed2025-03-08 11:21:50 dovecot_plain authenticator failed for ([95.0.252.72]) [95.0.252.72]:52416: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)95.0.252.72298795!  -' ossec13001gExim Auth failed2025-03-08 11:22:05 dovecot_plain authenticator failed for 131-106-31-52.s1842.c3-0.eas-cbr5.atw-eas.pa.cable.rcncustomer.com [131.106.31.52]:38482: 535 Incorrect authentication data (set_id=sales)131.106.31.526252001g  -[' ossec13001gExim Auth failed2025-03-08 11:12:53 dovecot_plain authenticator failed for c-85-228-121-10.bbcust.telenor.se [85.228.121.10]:38610: 535 Incorrect authentication data (set_id=services)85.228.121.102661886P  -1% ossec13001gExim Auth failed2025-03-08 11:12:52 dovecot_login authenticator failed for ([149.0.19.108]) [149.0.19.108]:58158: 535 Incorrect authentication data (set_id=sales)149.0.19.108298795d  -W% ossec13001gExim Auth failed2025-03-08 11:12:34 dovecot_login authenticator failed for ([92.47.46.174]) [92.47.46.174]:45892: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)92.47.46.1741522867m  -e) ossec13001gExim Auth failed2025-03-08 11:12:28 dovecot_plain authenticator failed for ([178.177.200.26]) [178.177.200.26]:48266: 535 Incorrect authentication data (set_id=services@heipowersystem.com)178.177.200.262017370e  -Y' ossec13001gؿExim Auth failed2025-03-08 11:12:21 dovecot_login authenticator failed for mail.infologic.co.il [85.130.200.51]:43638: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)85.130.200.51294640  -% ossec13001gدExim Auth failed2025-03-08 11:12:05 dovecot_login authenticator failed for c-73-95-112-29.hsd1.co.comcast.net [73.95.112.29]:43062: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)73.95.112.296252001u  -y% ossec13001gExim Auth failed2025-03-08 11:08:14 dovecot_plain authenticator failed for 128-72-81-95.broadband.corbina.ru [128.72.81.95]:52728: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)128.72.81.952017370`  -M' ossec13001g`Exim Auth failed2025-03-08 11:06:31 dovecot_login authenticator failed for (160.72.153.14.lightower.net) [160.72.153.14]:37041: 535 Incorrect authentication data (set_id=sales)160.72.153.146252001]  -C+ ossec13001g׀Exim Auth failed2025-03-08 11:07:04 dovecot_plain authenticator failed for ([191.241.247.150]) [191.241.247.150]:51714: 535 Incorrect authentication data (set_id=services)191.241.247.1503469034p  -i+ ossec13001gjExim Auth failed2025-03-08 11:06:42 dovecot_plain authenticator failed for ([103.146.233.100]) [103.146.233.100]:51847: 535 Incorrect authentication data (set_id=services@heipowersystem.com)103.146.233.1001269750j  -_) ossec13001gOExim Auth failed2025-03-08 11:06:13 dovecot_login authenticator failed for ([112.111.61.231]) [112.111.61.229]:45954: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)112.111.61.2291814991W  -9) ossec13001gExim Auth failed2025-03-08 10:55:49 dovecot_plain authenticator failed for ([183.100.18.224]) [183.100.18.224]:39438: 535 Incorrect authentication data (set_id=sales)183.100.18.2241835841 t%3 U V n CJLhtp6  -i+ ossec13001g;Exim Auth failed2025-03-08 12:14:09 dovecot_plain authenticator failed for ([118.122.220.235]) [118.122.220.235]:57230: 535 Incorrect authentication data (set_id=services@heipowersystem.com)118.122.220.2351814991`5  -S# ossec13001gHExim Auth failed2025-03-08 12:05:50 dovecot_plain authenticator failed for ([5.31.16.135]) [5.31.16.135]:53398: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)5.31.16.135290557z4  -' ossec13001gExim Auth failed2025-03-08 12:04:55 dovecot_plain authenticator failed for syn-097-089-202-226.biz.spectrum.com [97.89.202.226]:60952: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)97.89.202.2266252001u3  -w' ossec13001gExim Auth failed2025-03-08 12:04:04 dovecot_plain authenticator failed for 42-200-70-134.static.imsbiz.com [42.200.70.134]:33597: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)42.200.70.1341819730S2  -7% ossec13001gExim Auth failed2025-03-08 12:02:46 dovecot_plain authenticator failed for ([85.206.91.51]) [85.206.91.51]:57392: 535 Incorrect authentication data (set_id=services)85.206.91.51597427j1  -a' ossec13001gxExim Auth failed2025-03-08 12:02:23 dovecot_plain authenticator failed for ([182.42.113.10]) [182.42.113.10]:38764: 535 Incorrect authentication data (set_id=services@heipowersystem.com)182.42.113.101814991Z0  -?) ossec13001g!Exim Auth failed2025-03-08 11:52:24 dovecot_plain authenticator failed for ([61.145.163.164]) [61.145.163.164]:34580: 535 Incorrect authentication data (set_id=services)61.145.163.1641814991u/  -y% ossec13001gExim Auth failed2025-03-08 11:51:58 dovecot_plain authenticator failed for (undefined.hostname.localhost) [103.90.97.98]:34466: 535 Incorrect authentication data (set_id=services@heipowersystem.com)103.90.97.981269750j.  -a' ossec13001gExim Auth failed2025-03-08 11:46:51 dovecot_plain authenticator failed for ([14.53.126.112]) [14.53.126.112]:52552: 535 Incorrect authentication data (set_id=services@heipowersystem.com)14.53.126.1121835841Q-  -1% ossec13001gExim Auth failed2025-03-08 11:43:46 dovecot_plain authenticator failed for ([103.52.32.76]) [103.52.32.76]:39228: 535 Incorrect authentication data (set_id=sales)103.52.32.761269750j,  -_) ossec13001gExim Auth failed2025-03-08 11:43:36 dovecot_plain authenticator failed for ([112.164.196.95]) [112.164.196.95]:35944: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)112.164.196.951835841Z+  -=+ ossec13001gExim Auth failed2025-03-08 11:38:16 dovecot_plain authenticator failed for ([121.178.185.141]) [121.178.185.141]:34428: 535 Incorrect authentication data (set_id=sales)121.178.185.1411835841d*  -W% ossec13001g޾Exim Auth failed2025-03-08 11:37:58 dovecot_plain authenticator failed for ([39.164.91.67]) [39.164.91.67]:51392: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)39.164.91.671814991{)  -% ossec13001gExim Auth failed2025-03-08 11:34:37 dovecot_plain authenticator failed for syn-075-080-065-214.biz.spectrum.com [75.80.65.214]:32942: 535 Incorrect authentication data (set_id=services@heipowersystem.com)75.80.65.2146252001Z(  -?) ossec13001gݨExim Auth failed2025-03-08 11:33:20 dovecot_login authenticator failed for ([121.190.129.68]) [121.190.129.68]:57473: 535 Incorrect authentication data (set_id=services)121.190.129.681835841n'  -g) ossec13001gݒExim Auth failed2025-03-08 11:32:57 dovecot_login authenticator failed for ([159.223.250.131]) [161.35.200.202]:41602: 535 Incorrect authentication data (set_id=services@heipowersystem.com)161.35.200.2022921044W&  -9) ossec13001g Exim Auth failed2025-03-08 11:26:24 dovecot_plain authenticator failed for ([218.98.160.119]) [218.98.160.117]:64972: 535 Incorrect authentication data (set_id=sales)218.98.160.1171814991 K#  5 Yeo6<KmG  -c+ ossec13001gkExim Auth failed2025-03-08 12:49:06 dovecot_plain authenticator failed for ([175.156.139.195]) [175.156.139.195]:58308: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)175.156.139.1951880251vF  -{% ossec13001gYExim Auth failed2025-03-08 12:48:48 dovecot_plain authenticator failed for 111-70-4-132.emome-ip.hinet.net [111.70.4.132]:51845: 535 Incorrect authentication data (set_id=services@heipowersystem.com)111.70.4.1321668284TE  -7% ossec13001gqExim Auth failed2025-03-08 12:49:11 dovecot_plain authenticator failed for ([223.84.12.28]) [223.84.12.28]:43004: 535 Incorrect authentication data (set_id=services)223.84.12.281814991WD  -9) ossec13001gExim Auth failed2025-03-08 12:45:20 dovecot_plain authenticator failed for ([220.80.192.168]) [220.80.192.168]:58784: 535 Incorrect authentication data (set_id=sales)220.80.192.1681835841mC  -c+ ossec13001g}Exim Auth failed2025-03-08 12:45:07 dovecot_plain authenticator failed for ([124.197.135.208]) [124.197.135.208]:43284: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)124.197.135.2081835841EB  -' ossec13001gsExim Auth failed2025-03-08 12:44:57 dovecot_plain authenticator failed for ([91.122.31.214]) [91.122.31.214]:52363: 535 Incorrect authentication data91.122.31.2142017370fA  -]% ossec13001gExim Auth failed2025-03-08 12:43:25 dovecot_plain authenticator failed for ([94.205.83.14]) [94.205.83.14]:55514: 535 Incorrect authentication data (set_id=services@heipowersystem.com)94.205.83.14290557^@  -K' ossec13001gXExim Auth failed2025-03-08 12:31:43 dovecot_login authenticator failed for ([87.200.68.214]) [87.200.68.214]:47285: 535 Incorrect authentication data (set_id=vikas.khandelwal)87.200.68.214290557r?  -q' ossec13001gJExim Auth failed2025-03-08 12:31:28 dovecot_login authenticator failed for ([67.55.189.215]) [67.55.189.215]:35772: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)67.55.189.2156252001p>  -i+ ossec13001gExim Auth failed2025-03-08 12:29:53 dovecot_plain authenticator failed for ([123.209.118.166]) [123.209.118.166]:57216: 535 Incorrect authentication data (set_id=services@heipowersystem.com)123.209.118.1662077456X=  -9+ ossec13001gyExim Auth failed2025-03-08 12:28:00 dovecot_plain authenticator failed for ([182.76.69.209]) [128.185.228.134]:39814: 535 Incorrect authentication data (set_id=sales)128.185.228.1341269750`<  -S# ossec13001gnExim Auth failed2025-03-08 12:27:49 dovecot_plain authenticator failed for ([95.0.252.72]) [95.0.252.72]:35624: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)95.0.252.72298795X;  -?) ossec13001gExim Auth failed2025-03-08 12:24:45 dovecot_plain authenticator failed for ([185.255.47.190]) [185.255.47.190]:35396: 535 Incorrect authentication data (set_id=services)185.255.47.19099237y:  -' ossec13001gExim Auth failed2025-03-08 12:24:25 dovecot_plain authenticator failed for 83-233-30-104.cust.bredband2.com [83.233.30.104]:42622: 535 Incorrect authentication data (set_id=services@heipowersystem.com)83.233.30.1042661886j9  -_) ossec13001gExim Auth failed2025-03-08 12:24:08 dovecot_plain authenticator failed for ([191.210.87.101]) [191.210.87.101]:50413: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)191.210.87.1013469034?8  =y) ossec13008gMail Reciepient rejected2025-03-08 12:15:26 H=(mail.vandanabalbharti.com) [165.154.233.84]:52546 F= rejected RCPT : Rejected relay attempt: '165.154.233.84' From: 'iebhxt@vandanabalbharti.com' To: 'goofile@fastmail.com'165.154.233.841694008Y7  -?' ossec13001gGExim Auth failed2025-03-08 12:14:21 dovecot_plain authenticator failed for rm0zqz.g-service.ru [84.22.155.211]:39456: 535 Incorrect authentication data (set_id=services)84.22.155.2112017370 +C V n ~  6Gk{lX  -c) ossec13001gExim Auth failed2025-03-08 13:32:06 dovecot_plain authenticator failed for syn-070-122-139-172.res.spectrum.com [70.122.139.172]:60685: 535 Incorrect authentication data (set_id=services)70.122.139.1726252001tW  -u' ossec13001gsExim Auth failed2025-03-08 13:31:54 dovecot_plain authenticator failed for d54c70cda.static.telenet.be [84.199.12.218]:35252: 535 Incorrect authentication data (set_id=services@heipowersystem.com)84.199.12.2182802361jV  -a' ossec13001gExim Auth failed2025-03-08 13:24:18 dovecot_plain authenticator failed for ([186.179.80.12]) [186.179.80.12]:39936: 535 Incorrect authentication data (set_id=services@heipowersystem.com)186.179.80.123895114gU  -[' ossec13001gYExim Auth failed2025-03-08 13:22:56 dovecot_login authenticator failed for h77-53-235-246.cust.bredband2.com [77.53.235.246]:34414: 535 Incorrect authentication data (set_id=services)77.53.235.2462661886lT  -e) ossec13001gAExim Auth failed2025-03-08 13:22:31 dovecot_login authenticator failed for ([196.188.187.85]) [196.188.187.85]:43886: 535 Incorrect authentication data (set_id=services@heipowersystem.com)196.188.187.85337996XS  -?% ossec13001gExim Auth failed2025-03-08 13:19:17 dovecot_plain authenticator failed for (ppp075.bol-online.com) [202.84.34.85]:48726: 535 Incorrect authentication data (set_id=sales)202.84.34.851210997kR  -a) ossec13001guExim Auth failed2025-03-08 13:19:08 dovecot_plain authenticator failed for ([216.194.174.103]) [216.194.174.27]:16080: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)216.194.174.276252001PQ  -1% ossec13001gExim Auth failed2025-03-08 13:17:12 dovecot_plain authenticator failed for ([185.167.58.9]) [185.167.58.9]:58212: 535 Incorrect authentication data (set_id=sales)185.167.58.9617790vP  -{% ossec13001gExim Auth failed2025-03-08 13:16:46 dovecot_plain authenticator failed for static-84-242-88-70.bb.vodafone.cz [84.242.88.70]:41396: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)84.242.88.703077311+O  3Y+ ossec11301gNew FTP connection.Mar 8 13:08:32 vm1 pure-ftpd[3234708]: (?@172.172.245.159) [INFO] New connection from 172.172.245.159172.172.245.1596252001YN  -?' ossec13001gExim Auth failed2025-03-08 13:07:51 dovecot_plain authenticator failed for ([193.111.124.226]) [103.139.10.27]:30445: 535 Incorrect authentication data (set_id=services)103.139.10.271643084jM  -a' ossec13001gExim Auth failed2025-03-08 13:07:40 dovecot_plain authenticator failed for ([43.139.182.85]) [43.139.182.85]:52464: 535 Incorrect authentication data (set_id=services@heipowersystem.com)43.139.182.851814991lL  -c) ossec13001gExim Auth failed2025-03-08 13:04:25 dovecot_plain authenticator failed for syn-035-130-111-146.biz.spectrum.com [35.130.111.146]:58379: 535 Incorrect authentication data (set_id=services)35.130.111.1466252001dK  -Y# ossec13001gExim Auth failed2025-03-08 13:04:09 dovecot_plain authenticator failed for ([181.49.3.38]) [181.49.3.38]:36201: 535 Incorrect authentication data (set_id=services@heipowersystem.com)181.49.3.383686110iJ  -]) ossec13001gExim Auth failed2025-03-08 12:58:19 dovecot_plain authenticator failed for syn-070-127-232-248.res.spectrum.com [70.127.232.248]:34945: 535 Incorrect authentication data (set_id=sales)70.127.232.2486252001dI  -W% ossec13001g}Exim Auth failed2025-03-08 12:57:57 dovecot_plain authenticator failed for ([96.84.171.85]) [96.84.171.85]:50384: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)96.84.171.856252001QH  -1% ossec13001gExim Auth failed2025-03-08 12:49:39 dovecot_plain authenticator failed for ([211.151.86.9]) [211.151.86.9]:53900: 535 Incorrect authentication data (set_id=sales)211.151.86.91814991 ' 6 O [  6E(i  3U) ossec11301gNew FTP connection.Mar 8 14:08:00 vm1 pure-ftpd[3247299]: (?@104.152.52.232) [INFO] New connection from 104.152.52.232104.152.52.2326252001(h  3U) ossec11301gNew FTP connection.Mar 8 14:07:42 vm1 pure-ftpd[3247206]: (?@104.152.52.240) [INFO] New connection from 104.152.52.240104.152.52.2406252001mg  -c+ ossec13001g1Exim Auth failed2025-03-08 14:04:57 dovecot_plain authenticator failed for (172.183.199.112.unknown.m1.com.sg) [112.199.183.172]:41913: 535 Incorrect authentication data (set_id=services)112.199.183.1721880251ff  -]% ossec13001g#Exim Auth failed2025-03-08 14:04:42 dovecot_plain authenticator failed for ([196.0.34.106]) [196.0.34.106]:36036: 535 Incorrect authentication data (set_id=services@heipowersystem.com)196.0.34.106226074le  -e' ossec13001gExim Auth failed2025-03-08 14:03:12 dovecot_plain authenticator failed for 80-15-180-102.ftth.fr.orangecustomers.net [80.15.180.102]:33056: 535 Incorrect authentication data (set_id=sales)80.15.180.1023017382dd  -W% ossec13001gExim Auth failed2025-03-08 14:02:51 dovecot_plain authenticator failed for ([50.82.12.128]) [50.82.12.128]:50816: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)50.82.12.1286252001mc  -c+ ossec13001g Exim Auth failed2025-03-08 13:51:30 dovecot_plain authenticator failed for ([119.198.191.130]) [119.198.191.130]:38839: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)119.198.191.1301835841Yb  -?' ossec13001gExim Auth failed2025-03-08 13:51:19 dovecot_plain authenticator failed for rm0zqz.g-service.ru [84.22.155.211]:38458: 535 Incorrect authentication data (set_id=services)84.22.155.2112017370Wa  -9) ossec13001gExim Auth failed2025-03-08 13:51:48 dovecot_plain authenticator failed for ([220.178.201.58]) [220.178.201.58]:45511: 535 Incorrect authentication data (set_id=sales)220.178.201.581814991m`  -e) ossec13001gExim Auth failed2025-03-08 13:51:08 dovecot_plain authenticator failed for ([118.43.236.237]) [118.43.236.237]:46823: 535 Incorrect authentication data (set_id=services@heipowersystem.com)118.43.236.2371835841m_  -c+ ossec13001gExim Auth failed2025-03-08 13:51:01 dovecot_plain authenticator failed for ([210.104.222.189]) [210.104.222.189]:43338: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)210.104.222.1891835841T^  -7% ossec13001gExim Auth failed2025-03-08 13:45:01 dovecot_plain authenticator failed for ([31.173.2.172]) [31.173.2.172]:33744: 535 Incorrect authentication data (set_id=services)31.173.2.1722017370p]  -i+ ossec13001gdExim Auth failed2025-03-08 13:44:28 dovecot_plain authenticator failed for ([197.255.138.149]) [197.255.138.149]:36477: 535 Incorrect authentication data (set_id=services@heipowersystem.com)197.255.138.1493374766c\  -S' ossec13001gExim Auth failed2025-03-08 13:42:26 dovecot_plain authenticator failed for (201.173.16.21-clientes-izzi.mx) [201.173.16.21]:60799: 535 Incorrect authentication data (set_id=sales)201.173.16.213996063m[  -c+ ossec13001gExim Auth failed2025-03-08 13:41:59 dovecot_plain authenticator failed for ([125.143.244.159]) [125.143.244.159]:39284: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)125.143.244.1591835841jZ  -a' ossec13001gExim Auth failed2025-03-08 13:37:57 dovecot_plain authenticator failed for broadband-188-32-170-20.ip.moscow.rt.ru [188.32.170.20]:52428: 535 Incorrect authentication data (set_id=sales)188.32.170.202017370gY  -[' ossec13001gExim Auth failed2025-03-08 13:37:17 dovecot_plain authenticator failed for ([210.12.68.242]) [210.12.68.242]:41202: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)210.12.68.2421814991 7 9 H s hzZy  -?) ossec13001g jExim Auth failed2025-03-08 14:57:06 dovecot_plain authenticator failed for ([39.129.133.184]) [39.129.133.184]:47716: 535 Incorrect authentication data (set_id=services)39.129.133.1841814991ix  -a' ossec13001g \Exim Auth failed2025-03-08 14:56:52 dovecot_plain authenticator failed for ([185.167.56.70]) [185.167.56.70]:47818: 535 Incorrect authentication data (set_id=services@heipowersystem.com)185.167.56.70617790?w  =w+ ossec13008g NMail Reciepient rejected2025-03-08 14:52:21 H=(mail.fablixsolutions.com) [165.154.232.235]:54757 F= rejected RCPT : Rejected relay attempt: '165.154.232.235' From: 'usuzis@fablixsolutions.com' To: 'goofile@fastmail.com'165.154.232.2351605651iv  -]) ossec13001g Exim Auth failed2025-03-08 14:45:28 dovecot_plain authenticator failed for 83-233-242-245.cust.bredband2.com [83.233.242.245]:47930: 535 Incorrect authentication data (set_id=services)83.233.242.2452661886mu  -e) ossec13001g Exim Auth failed2025-03-08 14:44:49 dovecot_plain authenticator failed for ([218.23.156.227]) [218.23.156.227]:44467: 535 Incorrect authentication data (set_id=services@heipowersystem.com)218.23.156.2271814991Qt  -1% ossec13001g ;Exim Auth failed2025-03-08 14:39:15 dovecot_plain authenticator failed for ([85.19.195.12]) [85.19.195.12]:43002: 535 Incorrect authentication data (set_id=sales)85.19.195.123144096js  -_) ossec13001g )Exim Auth failed2025-03-08 14:38:57 dovecot_plain authenticator failed for ([161.35.200.202]) [161.35.200.202]:53418: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)161.35.200.2022921044%r  3Q' ossec11301gNew FTP connection.Mar 8 14:38:03 vm1 pure-ftpd[3253675]: (?@20.98.142.102) [INFO] New connection from 20.98.142.10220.98.142.1026252001hq  -_% ossec13001gExim Auth failed2025-03-08 14:33:10 dovecot_plain authenticator failed for syn-076-169-081-036.res.spectrum.com [76.169.81.36]:59234: 535 Incorrect authentication data (set_id=services)76.169.81.366252001mp  -e) ossec13001gExim Auth failed2025-03-08 14:32:47 dovecot_plain authenticator failed for ([210.99.124.119]) [210.99.124.119]:59846: 535 Incorrect authentication data (set_id=services@heipowersystem.com)210.99.124.1191835841o  Ue) ossec11001g}Deferred login on the cpanel service[2025-03-08 14:31:48 +0530] info [webmaild] 157.38.130.248 - kps@amplifypowerglobal.com "POST /cpsess5388617833/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [157.38.128.62] != Current IP Address [157.38.130.248]157.38.130.2481269750Qn  -1% ossec13001gExim Auth failed2025-03-08 14:24:42 dovecot_plain authenticator failed for ([222.99.10.11]) [222.99.10.11]:60619: 535 Incorrect authentication data (set_id=sales)222.99.10.111835841mm  -c+ ossec13001gExim Auth failed2025-03-08 14:24:31 dovecot_plain authenticator failed for ([173.205.243.224]) [173.205.243.224]:45481: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)173.205.243.2246252001zl  -' ossec13001gExim Auth failed2025-03-08 14:16:05 dovecot_plain authenticator failed for syn-071-066-157-177.biz.spectrum.com [71.66.157.177]:56889: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)71.66.157.1776252001Wk  -9) ossec13001gRExim Auth failed2025-03-08 14:14:01 dovecot_login authenticator failed for ([218.92.201.232]) [218.92.201.236]:58670: 535 Incorrect authentication data (set_id=sales)218.92.201.2361814991jj  -c% ossec13001gFExim Auth failed2025-03-08 14:13:50 dovecot_login authenticator failed for (broadband.actcorp.in) [106.51.29.53]:51672: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)106.51.29.531269750 , . G r d|,f  -Y' ossec13001gMExim Auth failed2025-03-08 15:39:17 dovecot_plain authenticator failed for syn-097-086-134-216.res.spectrum.com [97.86.134.216]:1792: 535 Incorrect authentication data (set_id=sales)97.86.134.2166252001h  -[) ossec13001g)Exim Auth failed2025-03-08 15:38:40 dovecot_plain authenticator failed for ([47.98.191.121]) [58.100.105.222]:2064: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)58.100.105.2221814991m  -e) ossec13001gExim Auth failed2025-03-08 15:37:52 dovecot_plain authenticator failed for ([49.124.149.204]) [49.124.149.204]:37982: 535 Incorrect authentication data (set_id=services@heipowersystem.com)49.124.149.2041733045g  -[' ossec13001gExim Auth failed2025-03-08 15:34:09 dovecot_plain authenticator failed for ([125.20.46.114]) [125.20.46.114]:47850: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)125.20.46.1141269750W  -;' ossec13001gExim Auth failed2025-03-08 15:29:28 dovecot_plain authenticator failed for ([102.221.64.10]) [102.221.64.10]:53917: 535 Incorrect authentication data (set_id=services)102.221.64.102413451m  -e) ossec13001gExim Auth failed2025-03-08 15:29:13 dovecot_plain authenticator failed for ([112.91.117.195]) [112.91.117.195]:57104: 535 Incorrect authentication data (set_id=services@heipowersystem.com)112.91.117.1951814991s  -u% ossec13001g8Exim Auth failed2025-03-08 15:21:51 dovecot_plain authenticator failed for 206.81.4.146.static.wline.lns.sme.cust.swisscom.ch [146.4.81.206]:55514: 535 Incorrect authentication data (set_id=sales)146.4.81.2062658434y  -}) ossec13001g$Exim Auth failed2025-03-08 15:21:31 dovecot_plain authenticator failed for c83-254-215-116.bredband.tele2.se [83.254.215.116]:51832: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)83.254.215.1162661886Z  -?) ossec13001gExim Auth failed2025-03-08 15:17:06 dovecot_plain authenticator failed for ([115.44.141.199]) [115.44.141.199]:55904: 535 Incorrect authentication data (set_id=services)115.44.141.1991814991d  -Y# ossec13001gExim Auth failed2025-03-08 15:16:30 dovecot_plain authenticator failed for ([60.8.50.150]) [60.8.50.150]:41984: 535 Incorrect authentication data (set_id=services@heipowersystem.com)60.8.50.1501814991>  =u+ ossec13008gMail Reciepient rejected2025-03-08 15:12:50 H=(mail.heipowersystem.com) [165.154.213.130]:59554 F= rejected RCPT : Rejected relay attempt: '165.154.213.130' From: 'yuttjua@heipowersystem.com' To: 'goofile@fastmail.com'165.154.213.1303469034Z  -?) ossec13001g%Exim Auth failed2025-03-08 15:08:45 dovecot_plain authenticator failed for ([216.194.174.86]) [216.194.174.27]:37460: 535 Incorrect authentication data (set_id=services)216.194.174.276252001j~  -a' ossec13001gExim Auth failed2025-03-08 15:08:28 dovecot_plain authenticator failed for ([49.124.149.47]) [49.124.149.47]:59442: 535 Incorrect authentication data (set_id=services@heipowersystem.com)49.124.149.471733045Q}  -1% ossec13001gExim Auth failed2025-03-08 15:06:37 dovecot_plain authenticator failed for ([110.35.63.27]) [110.35.63.27]:56972: 535 Incorrect authentication data (set_id=sales)110.35.63.271835841c|  -W% ossec13001guExim Auth failed2025-03-08 15:05:48 dovecot_plain authenticator failed for ([94.205.83.14]) [94.205.83.14]:54587: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)94.205.83.14290557X{  -C# ossec13001gYExim Auth failed2025-03-08 15:01:04 dovecot_plain authenticator failed for ([5.30.177.55]) [5.30.177.55]:48978: 535 Incorrect authentication data (set_id=vikas.khandelwal)5.30.177.55290557rz  -q' ossec13001gIExim Auth failed2025-03-08 15:00:48 dovecot_plain authenticator failed for ([112.173.61.81]) [112.173.61.81]:34325: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)112.173.61.811835841   ' L ^ \tD)  EK% ossec5715g SSHD authentication success.Mar 8 16:16:31 vm1 sshd[3274685]: Accepted password for root from 103.190.54.7 port 49820 ssh2103.190.54.71269750)  EK% ossec5715gSSHD authentication success.Mar 8 16:15:06 vm1 sshd[3274092]: Accepted password for root from 103.190.54.7 port 49819 ssh2103.190.54.71269750]  -C+ ossec13001gExim Auth failed2025-03-08 16:14:18 dovecot_plain authenticator failed for ([175.156.154.149]) [175.156.154.149]:49194: 535 Incorrect authentication data (set_id=services)175.156.154.1491880251m  -e) ossec13001gsExim Auth failed2025-03-08 16:14:02 dovecot_plain authenticator failed for ([41.159.145.190]) [41.159.145.190]:40360: 535 Incorrect authentication data (set_id=services@heipowersystem.com)41.159.145.1902400553}  -) ossec13001gExim Auth failed2025-03-08 16:11:15 dovecot_plain authenticator failed for 123-193-152-64.dynamic.kbronet.com.tw [123.193.152.64]:58708: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)123.193.152.641668284W  -9) ossec13001gOExim Auth failed2025-03-08 16:09:10 dovecot_plain authenticator failed for ([45.225.194.121]) [45.225.194.121]:48624: 535 Incorrect authentication data (set_id=sales)45.225.194.1213469034|  -) ossec13001g9Exim Auth failed2025-03-08 16:08:48 dovecot_plain authenticator failed for syn-075-191-221-158.res.spectrum.com [75.191.221.158]:34030: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)75.191.221.1586252001  - ) ossec13001gExim Auth failed2025-03-08 16:06:42 dovecot_plain authenticator failed for syn-035-130-133-206.biz.spectrum.com [35.130.133.206]:54546: 535 Incorrect authentication data (set_id=services@heipowersystem.com)35.130.133.2066252001N  --# ossec13001gSExim Auth failed2025-03-08 16:04:58 dovecot_login authenticator failed for ([1.241.64.92]) [1.241.64.92]:49406: 535 Incorrect authentication data (set_id=sales)1.241.64.921835841d  -W% ossec13001gEExim Auth failed2025-03-08 16:04:44 dovecot_login authenticator failed for ([27.24.141.90]) [27.24.141.90]:38542: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)27.24.141.901814991~  -) ossec13001gExim Auth failed2025-03-08 15:57:16 dovecot_plain authenticator failed for (abts-north-static-059.221.160.122.airtelbroadband.in) [122.160.221.59]:55330: 535 Incorrect authentication data (set_id=services)122.160.221.591269750j  -a' ossec13001grExim Auth failed2025-03-08 15:56:57 dovecot_plain authenticator failed for ([116.88.187.44]) [116.88.187.44]:39866: 535 Incorrect authentication data (set_id=services@heipowersystem.com)116.88.187.441880251W  -9) ossec13001gExim Auth failed2025-03-08 15:53:39 dovecot_login authenticator failed for ([106.55.161.136]) [106.55.161.136]:36672: 535 Incorrect authentication data (set_id=sales)106.55.161.1361814991m  -c+ ossec13001gExim Auth failed2025-03-08 15:53:22 dovecot_login authenticator failed for ([180.188.139.189]) [180.188.139.189]:59485: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)180.188.139.1891819730j  -_) ossec13001g Exim Auth failed2025-03-08 15:46:42 dovecot_plain authenticator failed for ([220.119.126.81]) [220.119.126.81]:50779: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)220.119.126.811835841x  -' ossec13001gExim Auth failed2025-03-08 15:45:31 dovecot_plain authenticator failed for mail.infologic.co.il [85.130.200.51]:51124: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)85.130.200.51294640z  -% ossec13001g[Exim Auth failed2025-03-08 15:39:30 dovecot_plain authenticator failed for broadband-188-32-68-79.ip.moscow.rt.ru [188.32.68.79]:37255: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)188.32.68.792017370 n G % C [ 7LnZ,  -?) ossec13001g*Exim Auth failed2025-03-08 16:59:23 dovecot_plain authenticator failed for ([221.146.201.37]) [221.146.201.37]:51140: 535 Incorrect authentication data (set_id=services)221.146.201.371835841g+  -[' ossec13001g*Exim Auth failed2025-03-08 16:59:05 dovecot_plain authenticator failed for (pc0.zz.ha.cn) [218.28.77.206]:44386: 535 Incorrect authentication data (set_id=services@heipowersystem.com)218.28.77.2061814991W*  -;' ossec13001g)\Exim Auth failed2025-03-08 16:56:19 dovecot_plain authenticator failed for ([46.21.240.186]) [46.21.240.186]:58458: 535 Incorrect authentication data (set_id=services)46.21.240.1862017370z)  -' ossec13001g)PExim Auth failed2025-03-08 16:56:07 dovecot_plain authenticator failed for bzq-109-67-154-24.red.bezeqint.net [109.67.154.24]:47388: 535 Incorrect authentication data (set_id=services@heipowersystem.com)109.67.154.24294640m(  -e) ossec13001g(Exim Auth failed2025-03-08 16:50:58 dovecot_plain authenticator failed for ([106.255.231.10]) [106.255.231.10]:42688: 535 Incorrect authentication data (set_id=services@heipowersystem.com)106.255.231.101835841W'  -;' ossec13001g((Exim Auth failed2025-03-08 16:51:11 dovecot_plain authenticator failed for ([191.59.254.45]) [191.59.254.45]:52692: 535 Incorrect authentication data (set_id=services)191.59.254.453469034T&  -5' ossec13001g&Exim Auth failed2025-03-08 16:45:15 dovecot_plain authenticator failed for ([95.105.66.123]) [95.105.66.123]:42502: 535 Incorrect authentication data (set_id=sales)95.105.66.1232017370k%  -_+ ossec13001g&Exim Auth failed2025-03-08 16:45:04 dovecot_plain authenticator failed for ([200.217.53.25]) [200.216.168.226]:54292: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)200.216.168.2263469034i$  -]) ossec13001g%Exim Auth failed2025-03-08 16:41:10 dovecot_plain authenticator failed for 46-162-112-159.cust.bredband2.com [46.162.112.159]:45858: 535 Incorrect authentication data (set_id=services)46.162.112.1592661886l#  -e) ossec13001g%Exim Auth failed2025-03-08 16:41:01 dovecot_plain authenticator failed for ([196.188.187.85]) [196.188.187.85]:52644: 535 Incorrect authentication data (set_id=services@heipowersystem.com)196.188.187.85337996W"  -9) ossec13001g%)Exim Auth failed2025-03-08 16:38:24 dovecot_plain authenticator failed for ([218.234.104.42]) [218.234.104.42]:54507: 535 Incorrect authentication data (set_id=sales)218.234.104.421835841d!  -W% ossec13001g% Exim Auth failed2025-03-08 16:37:55 dovecot_plain authenticator failed for ([43.154.94.85]) [43.154.94.85]:59812: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)43.154.94.851819730^  -O! ossec13001g# Exim Auth failed2025-03-08 16:29:22 dovecot_plain authenticator failed for ([45.6.80.40]) [45.6.80.40]:56306: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)45.6.80.403469034  W) ossec9708g#,Dovecot Aborted Login with empty userMar 8 16:29:55 vm1 dovecot[312763]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=185.226.197.42, lip=103.74.54.108, TLS, session=185.226.197.422264397T  -5' ossec13001g#"Exim Auth failed2025-03-08 16:29:45 dovecot_plain authenticator failed for ([92.255.190.69]) [92.255.190.69]:45018: 535 Incorrect authentication data (set_id=sales)92.255.190.692017370Z  -?) ossec13001g"Exim Auth failed2025-03-08 16:28:34 dovecot_plain authenticator failed for ([112.184.12.214]) [112.184.12.214]:58231: 535 Incorrect authentication data (set_id=services)112.184.12.2141835841  - ) ossec13001g"Exim Auth failed2025-03-08 16:28:20 dovecot_plain authenticator failed for syn-070-122-139-172.res.spectrum.com [70.122.139.172]:47837: 535 Incorrect authentication data (set_id=services@heipowersystem.com)70.122.139.1726252001 7 I a y i<  -[+ ossec13001g0Exim Auth failed2025-03-08 17:27:51 dovecot_login authenticator failed for ([119.198.191.130]) [119.198.191.130]:56658: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)119.198.191.1301835841;  -)+ ossec13001g0Exim Auth failed2025-03-08 17:27:38 dovecot_login authenticator failed for net-188-219-104-210.cust.vodafonedsl.it [188.219.104.210]:58423: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)188.219.104.2103175395Z:  -?) ossec13001g0Exim Auth failed2025-03-08 17:26:52 dovecot_plain authenticator failed for ([222.67.133.193]) [222.67.133.193]:46752: 535 Incorrect authentication data (set_id=services)222.67.133.1931814991q9  -q' ossec13001g0xExim Auth failed2025-03-08 17:26:38 dovecot_plain authenticator failed for cl-185-254-44-30.b4net.lt [185.254.44.30]:52014: 535 Incorrect authentication data (set_id=services@heipowersystem.com)185.254.44.30597427l8  -c) ossec13001g02Exim Auth failed2025-03-08 17:25:29 dovecot_login authenticator failed for syn-035-130-111-146.biz.spectrum.com [35.130.111.146]:45961: 535 Incorrect authentication data (set_id=services)35.130.111.1466252001p7  -i+ ossec13001g0 Exim Auth failed2025-03-08 17:24:49 dovecot_login authenticator failed for ([103.106.154.133]) [103.106.154.133]:46807: 535 Incorrect authentication data (set_id=services@heipowersystem.com)103.106.154.1331269750z6  -}+ ossec13001g.Exim Auth failed2025-03-08 17:18:15 dovecot_login authenticator failed for (abts-kk-static-226.253.166.122.airtelbroadband.in) [122.166.253.226]:39844: 535 Incorrect authentication data (set_id=sales)122.166.253.2261269750m5  -c+ ossec13001g.sExim Auth failed2025-03-08 17:18:02 dovecot_login authenticator failed for ([212.164.211.155]) [212.164.211.155]:56454: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)212.164.211.1552017370c4  -Q) ossec13001g.iExim Auth failed2025-03-08 17:17:52 dovecot_login authenticator failed for (undefined.hostname.localhost) [120.138.121.18]:36782: 535 Incorrect authentication data (set_id=sales)120.138.121.181269750}3  -' ossec13001g._Exim Auth failed2025-03-08 17:17:42 dovecot_login authenticator failed for (static.199.38.85.125.macminivault.com) [199.38.85.125]:53781: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)199.38.85.1256252001`2  -S# ossec13001g.YExim Auth failed2025-03-08 17:17:36 dovecot_plain authenticator failed for ([2.55.64.191]) [2.55.64.191]:60683: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)2.55.64.191294640d1  -U' ossec13001g.uExim Auth failed2025-03-08 17:18:04 dovecot_plain authenticator failed for h77-53-235-246.cust.bredband2.com [77.53.235.246]:34860: 535 Incorrect authentication data (set_id=sales)77.53.235.2462661886d0  -W% ossec13001g-Exim Auth failed2025-03-08 17:15:33 dovecot_plain authenticator failed for ([49.124.148.3]) [49.124.148.3]:34020: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)49.124.148.31733045j/  -a' ossec13001g,Exim Auth failed2025-03-08 17:09:57 dovecot_plain authenticator failed for ([125.20.46.114]) [125.20.46.114]:43740: 535 Incorrect authentication data (set_id=services@heipowersystem.com)125.20.46.1141269750W.  -9) ossec13001g+CExim Auth failed2025-03-08 17:04:26 dovecot_plain authenticator failed for ([175.125.68.208]) [175.125.68.208]:45070: 535 Incorrect authentication data (set_id=sales)175.125.68.2081835841j-  -_) ossec13001g+7Exim Auth failed2025-03-08 17:04:14 dovecot_plain authenticator failed for ([49.205.177.146]) [223.239.159.21]:58018: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)223.239.159.211269750 7 J g  )WSM  -5' ossec13001g9KExim Auth failed2025-03-08 18:04:17 dovecot_plain authenticator failed for ([185.167.56.34]) [185.167.56.34]:40102: 535 Incorrect authentication data (set_id=sales)185.167.56.34617790NL  --# ossec13001g9AExim Auth failed2025-03-08 18:04:08 dovecot_plain authenticator failed for ([61.169.6.99]) [61.169.6.99]:59520: 535 Incorrect authentication data (set_id=sales)61.169.6.991814991mK  -c+ ossec13001g95Exim Auth failed2025-03-08 18:03:55 dovecot_plain authenticator failed for ([163.204.112.147]) [163.204.112.147]:45912: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)163.204.112.1471814991WJ  -;' ossec13001g8Exim Auth failed2025-03-08 18:01:42 dovecot_plain authenticator failed for ([218.4.205.242]) [218.4.205.242]:41611: 535 Incorrect authentication data (set_id=services)218.4.205.2421814991I  - ) ossec13001g8Exim Auth failed2025-03-08 18:01:29 dovecot_plain authenticator failed for syn-070-127-232-248.res.spectrum.com [70.127.232.248]:46528: 535 Incorrect authentication data (set_id=services@heipowersystem.com)70.127.232.2486252001^H  -K' ossec13001g7HExim Auth failed2025-03-08 17:55:43 dovecot_login authenticator failed for ([91.73.195.150]) [91.73.195.150]:40267: 535 Incorrect authentication data (set_id=vikas.khandelwal)91.73.195.150290557uG  -u) ossec13001g7,Exim Auth failed2025-03-08 17:55:14 dovecot_login authenticator failed for ([220.124.240.75]) [220.124.240.66]:53084: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)220.124.240.661835841gF  -]% ossec13001g6!Exim Auth failed2025-03-08 17:50:49 dovecot_plain authenticator failed for ([50.43.62.166]) [50.43.62.166]:41665: 535 Incorrect authentication data (set_id=services@heipowersystem.com)50.43.62.1666252001ZE  -=+ ossec13001g4WExim Auth failed2025-03-08 17:43:10 dovecot_plain authenticator failed for ([103.231.163.154]) [103.231.163.154]:15628: 535 Incorrect authentication data (set_id=sales)103.231.163.1541210997mD  -c+ ossec13001g4AExim Auth failed2025-03-08 17:42:48 dovecot_plain authenticator failed for ([201.183.225.156]) [201.183.225.156]:48586: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)201.183.225.1563658394}C  -) ossec13001g2Exim Auth failed2025-03-08 17:36:52 dovecot_plain authenticator failed for (104.226.75.138.unknown.m1.com.sg) [138.75.226.104]:58017: 535 Incorrect authentication data (set_id=services@heipowersystem.com)138.75.226.1041880251mB  -e) ossec13001g2$Exim Auth failed2025-03-08 17:33:48 dovecot_plain authenticator failed for (nsg-corporate-21.229.187.122.airtel.in) [122.187.229.21]:49800: 535 Incorrect authentication data (set_id=sales)122.187.229.211269750dA  -W% ossec13001g2Exim Auth failed2025-03-08 17:33:37 dovecot_plain authenticator failed for ([141.94.18.69]) [141.94.18.69]:34172: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)141.94.18.693017382_@  -K' ossec13001g1Exim Auth failed2025-03-08 17:31:10 dovecot_login authenticator failed for ([61.169.31.242]) [61.169.31.242]:57385: 535 Incorrect authentication data (set_id=vikas.khandelwal)61.169.31.2421814991i?  -e! ossec13001g1xExim Auth failed2025-03-08 17:30:55 dovecot_login authenticator failed for ([45.6.80.40]) [45.6.80.40]:35784: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)45.6.80.403469034W>  -9) ossec13001g1JExim Auth failed2025-03-08 17:30:09 dovecot_plain authenticator failed for ([218.98.160.117]) [218.98.160.117]:60808: 535 Incorrect authentication data (set_id=sales)218.98.160.1171814991j=  -_) ossec13001g1"Exim Auth failed2025-03-08 17:29:30 dovecot_plain authenticator failed for ([218.149.70.142]) [218.149.70.142]:33396: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)218.149.70.1421835841 8 G f 1Yk`^  -U! ossec13001gDsExim Auth failed2025-03-08 18:51:54 dovecot_plain authenticator failed for ([2.55.74.30]) [2.55.74.30]:42634: 535 Incorrect authentication data (set_id=services@heipowersystem.com)2.55.74.30294640m]  -c+ ossec13001gC)Exim Auth failed2025-03-08 18:46:25 dovecot_plain authenticator failed for ([222.170.228.150]) [222.170.228.150]:53028: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)222.170.228.1501814991W\  -;' ossec13001gBExim Auth failed2025-03-08 18:43:46 dovecot_plain authenticator failed for ([220.122.115.9]) [220.122.115.9]:52616: 535 Incorrect authentication data (set_id=services)220.122.115.91835841j[  -a' ossec13001gBsExim Auth failed2025-03-08 18:43:23 dovecot_plain authenticator failed for ([116.86.62.245]) [116.86.62.245]:46624: 535 Incorrect authentication data (set_id=services@heipowersystem.com)116.86.62.2451880251TZ  -5' ossec13001gAExim Auth failed2025-03-08 18:37:42 dovecot_plain authenticator failed for ([149.54.15.162]) [149.54.15.162]:40024: 535 Incorrect authentication data (set_id=sales)149.54.15.1621149361jY  -_) ossec13001gA Exim Auth failed2025-03-08 18:37:22 dovecot_plain authenticator failed for ([94.190.222.124]) [94.190.222.124]:51342: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)94.190.222.1241819730WX  -;' ossec13001g@:Exim Auth failed2025-03-08 18:33:54 dovecot_plain authenticator failed for ([220.85.251.16]) [220.85.251.16]:56620: 535 Incorrect authentication data (set_id=services)220.85.251.161835841|W  -) ossec13001g@,Exim Auth failed2025-03-08 18:33:40 dovecot_plain authenticator failed for 202-188-035-194.ip-addr.vsenet.de [194.35.188.202]:50465: 535 Incorrect authentication data (set_id=services@heipowersystem.com)194.35.188.2022921044SV -3% ossec13001g>:Exim Auth failed2025-03-08 18:25:21 dovecot_login authenticator failed for (rokamauka.com) [119.96.131.8]:58190: 535 Incorrect authentication data (set_id=nologin)119.96.131.81814991ZU  -=+ ossec13001g=Exim Auth failed2025-03-08 18:22:24 dovecot_plain authenticator failed for ([116.116.108.165]) [116.116.108.165]:56062: 535 Incorrect authentication data (set_id=sales)116.116.108.1651814991pT  -i+ ossec13001g=^Exim Auth failed2025-03-08 18:21:40 dovecot_login authenticator failed for ([178.178.194.133]) [178.178.194.133]:14097: 535 Incorrect authentication data (set_id=services@heipowersystem.com)178.178.194.1332017370dS  -W% ossec13001g=rExim Auth failed2025-03-08 18:22:01 dovecot_plain authenticator failed for ([101.13.4.119]) [101.13.4.119]:35152: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)101.13.4.1191668284WR  -;' ossec13001g=nExim Auth failed2025-03-08 18:21:57 dovecot_login authenticator failed for ([59.94.179.175]) [59.94.179.175]:39060: 535 Incorrect authentication data (set_id=services)59.94.179.1751269750]Q  -C+ ossec13001g<Exim Auth failed2025-03-08 18:18:11 dovecot_plain authenticator failed for ([175.156.154.149]) [175.156.154.149]:36447: 535 Incorrect authentication data (set_id=services)175.156.154.1491880251mP  -e) ossec13001g, rip=185.247.137.111, lip=103.74.54.108, TLS, session=185.247.137.111298795fa  -[% ossec13001gEExim Auth failed2025-03-08 18:56:51 dovecot_plain authenticator failed for 32.104.29.34.bc.googleusercontent.com [34.29.104.32]:56436: 535 Incorrect authentication data (set_id=sales)34.29.104.326252001v`  -y' ossec13001gEExim Auth failed2025-03-08 18:56:38 dovecot_plain authenticator failed for 217-76-83-103.cust.bredband2.com [217.76.83.103]:42478: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)217.76.83.1032661886V_  -;' ossec13001gDExim Auth failed2025-03-08 18:52:13 dovecot_plain authenticator failed for ([185.167.56.34]) [185.167.56.34]:35676: 535 Incorrect authentication data (set_id=services)185.167.56.34617790 %~qdWJ=0# zm`SF9, v i \ O B 5 (     r e X K > 1 $  { n a T G : -   w j ] P C 6 )    s f Y L ? 2 % 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370z 2017370c 2017370\ 2017370X 2017370C 20173708 2017370+ 2017370( 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370s 2017370f 2017370^ 2017370Q 2017370I 2017370H 20173708 20173702 20173700 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370} 2017370w 2017370v 2017370n 2017370h 2017370[ 2017370T 2017370R 2017370E 2017370; 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 P 2017370 3 2017370 + 2017370  2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 } 2017370 o 2017370 j 2017370 b 2017370 V 2017370 T 2017370 > 2017370 ! 2017370  2017370  2017370  2017370  2017370  2017370  2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 m 2017370 k 2017370 P 2017370 1 2017370 # 2017370  2017370 2017370 2017370  2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 2017370 { `  4 5_q!CR`n  -g+ ossec13001gXExim Auth failed2025-03-08 20:18:34 dovecot_plain authenticator failed for ([196.200.227.78]) [196.200.227.194]:57372: 535 Incorrect authentication data (set_id=services@heipowersystem.com)196.200.227.194149590m  -e) ossec13001gXExim Auth failed2025-03-08 20:18:22 dovecot_plain authenticator failed for ([115.44.141.199]) [115.44.141.199]:21508: 535 Incorrect authentication data (set_id=services@heipowersystem.com)115.44.141.1991814991Z~  -=+ ossec13001gXExim Auth failed2025-03-08 20:18:13 dovecot_plain authenticator failed for ([211.221.130.246]) [211.221.130.246]:56048: 535 Incorrect authentication data (set_id=sales)211.221.130.2461835841k}  -c' ossec13001gXExim Auth failed2025-03-08 20:17:54 dovecot_plain authenticator failed for www.michels-schwab.de [217.86.146.64]:55256: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)217.86.146.642921044b|  -O) ossec13001gWExim Auth failed2025-03-08 20:13:40 dovecot_plain authenticator failed for ([112.168.71.109]) [112.168.71.109]:39096: 535 Incorrect authentication data (set_id=vikas.khandelwal)112.168.71.1091835841u{  -u) ossec13001gWExim Auth failed2025-03-08 20:13:21 dovecot_plain authenticator failed for ([222.87.205.105]) [222.87.205.105]:45465: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)222.87.205.1051814991'z  3U) ossec11301gVNew FTP connection.Mar 8 20:10:14 vm1 pure-ftpd[3324182]: (?@194.180.48.141) [INFO] New connection from 194.180.48.141194.180.48.141732800Sy  -1) ossec13001gVExim Auth failed2025-03-08 20:09:46 dovecot_plain authenticator failed for ([70.39.23.1]) [167.142.198.54]:58999: 535 Incorrect authentication data (set_id=sales)167.142.198.546252001jx  -_) ossec13001gVExim Auth failed2025-03-08 20:09:35 dovecot_plain authenticator failed for ([45.251.108.124]) [45.251.108.124]:52253: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)45.251.108.1241819730Rw  -3% ossec13001gTxExim Auth failed2025-03-08 20:00:14 dovecot_plain authenticator failed for ([58.131.97.5]) [180.88.96.37]:9910: 535 Incorrect authentication data (set_id=services)180.88.96.371814991{v  -% ossec13001gTjExim Auth failed2025-03-08 20:00:01 dovecot_plain authenticator failed for syn-076-169-081-036.res.spectrum.com [76.169.81.36]:34624: 535 Incorrect authentication data (set_id=services@heipowersystem.com)76.169.81.366252001hu  -Y+ ossec13001gSExim Auth failed2025-03-08 19:56:55 dovecot_plain authenticator failed for (208.235.164.124.adsl-pool.sx.cn) [124.164.235.208]:52464: 535 Incorrect authentication data (set_id=sales)124.164.235.2081814991gt  -[' ossec13001gSExim Auth failed2025-03-08 19:56:44 dovecot_plain authenticator failed for ([124.246.92.77]) [124.246.92.77]:40758: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)124.246.92.771880251s  - ) ossec13001gSExim Auth failed2025-03-08 19:56:20 dovecot_plain authenticator failed for customer-ip-193-151-51-223.ipv.net.pl ([91.227.103.222]) [193.151.51.223]:59890: 535 Incorrect authentication data (set_id=services)193.151.51.223798544mr  -e) ossec13001gSExim Auth failed2025-03-08 19:56:06 dovecot_plain authenticator failed for ([95.165.217.194]) [95.165.217.194]:52790: 535 Incorrect authentication data (set_id=services@heipowersystem.com)95.165.217.1942017370q  -' ossec13001gQExim Auth failed2025-03-08 19:45:31 dovecot_login authenticator failed for 217-76-83-103.cust.bredband2.com [217.76.83.103]:41114: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)217.76.83.1032661886xp  -{) ossec13001gPExim Auth failed2025-03-08 19:44:17 dovecot_plain authenticator failed for 89-179-241-253.static.corbina.ru [89.179.241.253]:58268: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)89.179.241.2532017370 (I e $HZlm  -c+ ossec13001g`Exim Auth failed2025-03-08 20:51:57 dovecot_plain authenticator failed for ([117.178.198.136]) [117.178.198.136]:51854: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)117.178.198.1361814991Z  -?) ossec13001g]Exim Auth failed2025-03-08 20:40:19 dovecot_plain authenticator failed for ([119.200.229.33]) [119.200.229.33]:58486: 535 Incorrect authentication data (set_id=services)119.200.229.331835841g  -[' ossec13001g]Exim Auth failed2025-03-08 20:40:05 dovecot_plain authenticator failed for syn-097-070-129-101.res.spectrum.com [97.70.129.101]:51700: 535 Incorrect authentication data (set_id=sales)97.70.129.1016252001f  -[' ossec13001g]Exim Auth failed2025-03-08 20:39:50 dovecot_plain authenticator failed for ([87.200.68.214]) [87.200.68.214]:37727: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)87.200.68.214290557j  -a' ossec13001g]Exim Auth failed2025-03-08 20:40:06 dovecot_plain authenticator failed for ([170.250.128.5]) [170.250.128.5]:59228: 535 Incorrect authentication data (set_id=services@heipowersystem.com)170.250.128.56252001j  -c% ossec13001g\rExim Auth failed2025-03-08 20:34:17 dovecot_login authenticator failed for (fablixsolutions.com) [125.72.54.81]:54128: 535 Incorrect authentication data (set_id=admin@fablixsolutions.com)125.72.54.811814991X  -?% ossec13001g\<Exim Auth failed2025-03-08 20:33:23 dovecot_login authenticator failed for (fablixsolutions.com) [125.72.54.81]:50106: 535 Incorrect authentication data (set_id=nologin)125.72.54.811814991i  -_' ossec13001g[Exim Auth failed2025-03-08 20:31:58 dovecot_plain authenticator failed for syn-097-086-134-216.res.spectrum.com [97.86.134.216]:2347: 535 Incorrect authentication data (set_id=services)97.86.134.2166252001g  -]% ossec13001g[Exim Auth failed2025-03-08 20:31:29 dovecot_plain authenticator failed for ([111.113.9.34]) [111.113.9.34]:40328: 535 Incorrect authentication data (set_id=services@heipowersystem.com)111.113.9.341814991j  -_) ossec13001g[Exim Auth failed2025-03-08 20:30:17 dovecot_plain authenticator failed for ([220.119.126.81]) [220.119.126.81]:41130: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)220.119.126.811835841W  -9) ossec13001g[Exim Auth failed2025-03-08 20:30:30 dovecot_plain authenticator failed for ([124.112.45.222]) [124.112.45.222]:42058: 535 Incorrect authentication data (set_id=sales)124.112.45.2221814991i  -a' ossec13001g["Exim Auth failed2025-03-08 20:28:40 dovecot_plain authenticator failed for ([78.142.41.167]) [78.142.41.167]:55998: 535 Incorrect authentication data (set_id=services@heipowersystem.com)78.142.41.167732800T  -7% ossec13001g[3Exim Auth failed2025-03-08 20:28:59 dovecot_plain authenticator failed for ([60.166.8.174]) [60.166.8.174]:34065: 535 Incorrect authentication data (set_id=services)60.166.8.1741814991W  -9) ossec13001g[Exim Auth failed2025-03-08 20:28:11 dovecot_plain authenticator failed for ([218.150.170.10]) [218.150.170.10]:51186: 535 Incorrect authentication data (set_id=sales)218.150.170.101835841`  -S# ossec13001gZExim Auth failed2025-03-08 20:27:59 dovecot_plain authenticator failed for ([5.77.213.29]) [5.77.213.29]:33819: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)5.77.213.29174982[ -A' ossec13001gYExim Auth failed2025-03-08 20:21:44 dovecot_login authenticator failed for (fablixsolutions.com) [111.56.54.202]:53096: 535 Incorrect authentication data (set_id=nologin)111.56.54.2021814991T  -7% ossec13001gXExim Auth failed2025-03-08 20:18:45 dovecot_plain authenticator failed for ([43.154.94.85]) [43.154.94.85]:34208: 535 Incorrect authentication data (set_id=services)43.154.94.851819730 (( / < N y|~hf!  -]% ossec13001gepExim Auth failed2025-03-08 21:12:40 dovecot_plain authenticator failed for ([45.93.94.125]) [45.93.94.125]:44184: 535 Incorrect authentication data (set_id=services@heipowersystem.com)45.93.94.125294640c  -U% ossec13001ge(Exim Auth failed2025-03-08 21:11:26 dovecot_plain authenticator failed for 78-67-176-43-no2814.tbcn.telia.com [78.67.176.43]:48196: 535 Incorrect authentication data (set_id=sales)78.67.176.432661886~  -) ossec13001geExim Auth failed2025-03-08 21:10:55 dovecot_plain authenticator failed for 47-158-210-137.lsan.ca.frontiernet.net [47.158.210.137]:55096: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)47.158.210.1376252001]  -C+ ossec13001gcExim Auth failed2025-03-08 21:06:02 dovecot_plain authenticator failed for ([175.206.105.126]) [175.206.105.126]:33240: 535 Incorrect authentication data (set_id=services)175.206.105.1261835841z  -) ossec13001gcExim Auth failed2025-03-08 21:05:48 dovecot_plain authenticator failed for cm222-166-167-89.hkcable.com.hk [222.166.167.89]:49380: 535 Incorrect authentication data (set_id=services@heipowersystem.com)222.166.167.891819730b  -Q' ossec13001gcExim Auth failed2025-03-08 21:04:26 dovecot_login authenticator failed for 42-200-70-134.static.imsbiz.com [42.200.70.134]:41532: 535 Incorrect authentication data (set_id=sales)42.200.70.1341819730  -1) ossec13001gcQExim Auth failed2025-03-08 21:03:36 dovecot_plain authenticator failed for (pardes-hana-hotnet145-arris1-213-57-214-111.hotnet.net.il) [213.57.214.111]:57794: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)213.57.214.111294640z  -% ossec13001gcpExim Auth failed2025-03-08 21:04:07 dovecot_login authenticator failed for (bundle-ether3.2078.static.gvt.net.br) [179.185.1.97]:34701: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)179.185.1.973469034y  -}) ossec13001gbExim Auth failed2025-03-08 20:58:31 dovecot_plain authenticator failed for ([120.224.242.78]) [120.224.242.78]:41237: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)120.224.242.781814991Q  -1% ossec13001gaExim Auth failed2025-03-08 20:57:58 dovecot_plain authenticator failed for ([211.228.79.8]) [211.228.79.8]:50588: 535 Incorrect authentication data (set_id=sales)211.228.79.81835841j  -_) ossec13001gaExim Auth failed2025-03-08 20:57:43 dovecot_plain authenticator failed for ([123.209.200.21]) [123.209.200.21]:43310: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)123.209.200.212077456o  -i+ ossec13001gagExim Auth failed2025-03-08 20:55:27 dovecot_plain authenticator failed for ([196.191.212.232]) [196.191.212.232]:41476: 535 Incorrect authentication data (set_id=services@heipowersystem.com)196.191.212.232337996Z  -?) ossec13001ga Exim Auth failed2025-03-08 20:53:54 dovecot_plain authenticator failed for ([168.126.90.210]) [168.126.90.210]:49096: 535 Incorrect authentication data (set_id=services)168.126.90.2101835841  -;' ossec13001g`Exim Auth failed2025-03-08 20:53:32 dovecot_plain authenticator failed for host-88-43-231-186.business.telecomitalia.it ([88.43.231.188]) [88.43.231.186]:60358: 535 Incorrect authentication data (set_id=services@heipowersystem.com)88.43.231.1863175395|  -) ossec13001g`Exim Auth failed2025-03-08 20:53:00 dovecot_plain authenticator failed for syn-098-102-148-242.biz.spectrum.com [98.102.148.242]:51136: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)98.102.148.2426252001T  -5' ossec13001g`Exim Auth failed2025-03-08 20:52:17 dovecot_plain authenticator failed for ([121.157.28.10]) [121.157.28.10]:54196: 535 Incorrect authentication data (set_id=sales)121.157.28.101835841 = I U w %8]y2  -' ossec13001gm0Exim Auth failed2025-03-08 21:45:44 dovecot_plain authenticator failed for wsip-174-79-91-142.br.br.cox.net [174.79.91.142]:60100: 535 Incorrect authentication data (set_id=services@heipowersystem.com)174.79.91.1426252001:1  Ak) ossec11302gkFTP Authentication failed.Mar 8 21:39:53 vm1 pure-ftpd[3342957]: (?@135.148.57.188) [WARNING] Authentication failed for user [anonymous]135.148.57.1886252001(0  3U) ossec11301gkNew FTP connection.Mar 8 21:39:48 vm1 pure-ftpd[3342957]: (?@135.148.57.188) [INFO] New connection from 135.148.57.188135.148.57.1886252001W/  -9) ossec13001gkExim Auth failed2025-03-08 21:38:46 dovecot_plain authenticator failed for ([130.250.134.35]) [130.250.134.35]:43072: 535 Incorrect authentication data (set_id=sales)130.250.134.356252001i.  -_) ossec13001gkExim Auth failed2025-03-08 21:38:36 dovecot_plain authenticator failed for ([94.202.156.237]) [94.202.156.237]:34821: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)94.202.156.237290557Z-  -?) ossec13001gk`Exim Auth failed2025-03-08 21:37:58 dovecot_plain authenticator failed for ([125.136.163.86]) [125.136.163.86]:38300: 535 Incorrect authentication data (set_id=services)125.136.163.861835841m,  -e) ossec13001gkNExim Auth failed2025-03-08 21:37:41 dovecot_plain authenticator failed for ([191.59.206.191]) [191.59.206.191]:57434: 535 Incorrect authentication data (set_id=services@heipowersystem.com)191.59.206.1913469034Q+  -1% ossec13001giExim Auth failed2025-03-08 21:31:16 dovecot_plain authenticator failed for ([111.23.42.49]) [111.23.42.49]:32908: 535 Incorrect authentication data (set_id=sales)111.23.42.491814991g*  -[' ossec13001giExim Auth failed2025-03-08 21:30:48 dovecot_plain authenticator failed for ([46.52.204.227]) [46.52.204.227]:58159: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)46.52.204.2272017370{)  -+ ossec13001ghExim Auth failed2025-03-08 21:26:27 dovecot_plain authenticator failed for (109-120-192-105.ip.btc-net.bg) [109.120.192.105]:60708: 535 Incorrect authentication data (set_id=services@heipowersystem.com)109.120.192.105732800T(  -7% ossec13001ggExim Auth failed2025-03-08 21:21:53 dovecot_login authenticator failed for ([222.180.2.62]) [222.180.2.62]:53351: 535 Incorrect authentication data (set_id=services)222.180.2.621814991h'  -Y+ ossec13001ggExim Auth failed2025-03-08 21:21:39 dovecot_login authenticator failed for (tgw-rp.ru) [109.106.136.152]:57336: 535 Incorrect authentication data (set_id=services@heipowersystem.com)109.106.136.1522017370Z&  -?) ossec13001ggaExim Auth failed2025-03-08 21:20:55 dovecot_plain authenticator failed for ([95.165.217.194]) [95.165.217.194]:53062: 535 Incorrect authentication data (set_id=services)95.165.217.1942017370p%  -i+ ossec13001ggWExim Auth failed2025-03-08 21:20:46 dovecot_plain authenticator failed for ([207.219.221.101]) [207.219.221.101]:58771: 535 Incorrect authentication data (set_id=services@heipowersystem.com)207.219.221.1016251999p$  -i+ ossec13001ggIExim Auth failed2025-03-08 21:20:31 dovecot_plain authenticator failed for ([124.225.185.148]) [124.225.185.148]:43208: 535 Incorrect authentication data (set_id=services@heipowersystem.com)124.225.185.1481814991Q#  -1% ossec13001gfExim Auth failed2025-03-08 21:18:56 dovecot_plain authenticator failed for ([193.93.237.8]) [193.93.237.8]:55082: 535 Incorrect authentication data (set_id=sales)193.93.237.82017370j"  -_) ossec13001gfExim Auth failed2025-03-08 21:18:34 dovecot_plain authenticator failed for ([114.202.80.152]) [114.202.80.152]:46989: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)114.202.80.1521835841 $ $ M _ \ nQB  -1% ossec13001gtvExim Auth failed2025-03-08 22:16:44 dovecot_plain authenticator failed for ([144.48.49.72]) [144.48.49.72]:35780: 535 Incorrect authentication data (set_id=sales)144.48.49.721269750gA  -[' ossec13001gtTExim Auth failed2025-03-08 22:16:12 dovecot_plain authenticator failed for ([102.221.65.24]) [102.221.65.24]:52549: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)102.221.65.242413451@  - ' ossec13001gsExim Auth failed2025-03-08 22:14:38 dovecot_plain authenticator failed for host-37-205-73-112.bbcustomer.zsttk.net [37.205.73.112]:50298: 535 Incorrect authentication data (set_id=services@heipowersystem.com)37.205.73.1122017370Z?  -=+ ossec13001gsExim Auth failed2025-03-08 22:12:47 dovecot_plain authenticator failed for ([124.197.135.208]) [124.197.135.208]:59872: 535 Incorrect authentication data (set_id=sales)124.197.135.2081835841 >  -+ ossec13001gsrExim Auth failed2025-03-08 22:12:25 dovecot_plain authenticator failed for (176x212x190x170.dynamic.ryazan.ertelecom.ru) [176.212.190.170]:59490: 535 Incorrect authentication data (set_id=services@heipowersystem.com)176.212.190.1702017370=  - ) ossec13001gslExim Auth failed2025-03-08 22:12:18 dovecot_plain authenticator failed for (32.195.136.122.adsl-pool.jlccptt.net.cn) [122.136.195.32]:40196: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)122.136.195.321814991V<  -;% ossec13001gqExim Auth failed2025-03-08 22:05:09 dovecot_plain authenticator failed for ([83.169.201.116]) [77.41.174.42]:17616: 535 Incorrect authentication data (set_id=services)77.41.174.422017370i;  -a' ossec13001gqExim Auth failed2025-03-08 22:04:58 dovecot_plain authenticator failed for ([87.200.73.165]) [87.200.73.165]:60805: 535 Incorrect authentication data (set_id=services@heipowersystem.com)87.200.73.165290557h:  -Y+ ossec13001gqgExim Auth failed2025-03-08 22:03:43 dovecot_plain authenticator failed for (208.235.164.124.adsl-pool.sx.cn) [124.164.235.208]:57267: 535 Incorrect authentication data (set_id=sales)124.164.235.2081814991j9  -_) ossec13001gqYExim Auth failed2025-03-08 22:03:29 dovecot_plain authenticator failed for ([31.220.168.116]) [31.220.168.116]:37501: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)31.220.168.11620173708  - ) ossec13001goExim Auth failed2025-03-08 21:55:35 dovecot_plain authenticator failed for (pardes-hana-hotnet145-arris1-213-57-214-111.hotnet.net.il) [213.57.214.111]:51950: 535 Incorrect authentication data (set_id=sales)213.57.214.111294640j7  -_) ossec13001goqExim Auth failed2025-03-08 21:55:20 dovecot_plain authenticator failed for ([74.196.184.120]) [74.196.184.120]:59611: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)74.196.184.1206252001S6  -7% ossec13001goExim Auth failed2025-03-08 21:53:42 dovecot_plain authenticator failed for ([45.93.94.125]) [45.93.94.125]:50764: 535 Incorrect authentication data (set_id=services)45.93.94.125294640|5  -% ossec13001goExim Auth failed2025-03-08 21:53:32 dovecot_plain authenticator failed for 32.104.29.34.bc.googleusercontent.com [34.29.104.32]:43186: 535 Incorrect authentication data (set_id=services@heipowersystem.com)34.29.104.326252001p4  -i+ ossec13001gnExim Auth failed2025-03-08 21:53:20 dovecot_plain authenticator failed for ([222.189.211.114]) [222.189.211.114]:60508: 535 Incorrect authentication data (set_id=services@heipowersystem.com)222.189.211.1141814991d3  -Q+ ossec13001gm@Exim Auth failed2025-03-08 21:45:59 dovecot_plain authenticator failed for (126-209-236-109.sv-en.ru) [109.236.209.126]:58802: 535 Incorrect authentication data (set_id=services)109.236.209.1262017370 *\~tj`VLB8.$zpf\H>4*   v l b X N D : 0 &    ~ t j ` V L B 8 . $    z p f \ R H > 4 *  vlbXND:0&|rh^TJ@6,"xdnZPF<2( ~tj`VLB8.$zpf\ | r h ^ T J @ 6 , "    x n d Z P F < 2 (   RRH>4*  vlbXND:0& g̲t%> g̲b%= g̱%< g̱%; g̰%: g̰%9 g̯/%8 g̯%7 g̮G%6 g̮G%5 g̮3%4 g̫8%3 g̫$%2 g̫%1 g̫ %0 g̩%/ g̩%. g̩z%- g̩b%, g̩%+ g̩H%* g̩%) g̨%( g̨%' g̨%& g̨%% g̨%%$ g̨%# g̦%" g̥%! g̥% g̤t% g̤V% g̤% g̣% g̢\% g̠% g̠% g̠% g̞y% g̞s% g̞k% g̞c% g̝% g̝% g̜% g̜% g̛% g̚% g̚% g̚% g̚% g̘% g̘% g̘m% g̘a% g̕n% g̕d% g̕% g̕x% g̔% g̔z% g̔% g̔$ g̓$ g̓$ g̓.$ g̓D$ g̒$ g̒$ g̑$ g̑ $ g̐7$ g̐$ g̏$ g̏$ g̎$ g̎$ g̎$ g̍$ g̋$ g̉$ g̉$ g̉$ ġk$ ġU$ ġK$ ḡ$ ḡ$ g̃r$ g̃h$ g̃b$ g̃Z$ ǵ$ ǵ$ g̀$ g̀$ g~$ g~$ g~$ g~h$ g~N$ g}>$ g}$$ g|$ gz$ gz$ gze$ gzE$ gy$ gx$ gx$ gw$ gw$ gw$ gw$ gw$ gw$ gw$ gw$ gv$ gu$ gu$ gu2$ gtv$ gtT$ gs$ gs$ gsr$ gsl$ gq$ gq$ gqg$ gqY$ go$ goq$ go$ go$ gn$ gm@$ gm0$ gk$ gk$ gk$ gk$ gk`$ gkN$ gi$ gi$ gh$ gg$ gg$ gga$ ggW$ ggI$ gf$ gf$ gep$ ge($ ge$ gc$ gc$ gc$ gcp$ gcQ$ gb$ ga$ ga$ gag$ ga $ g%i g%h gp%g gd%f g2%e g%d g%c gƷ%b gƫ%a gő%` gŅ%_ gă%^ gy%] g%\ g%[ gV%Z g>%Y g %X g%W g%T g%V g%U g̿%S g̿%R g̽%Q g̽e%P g̽ %O g̽%N g̼G%M g̼<%L g̻%K g̻%J g̸%I g̸r%H g̸b%G g̶{%F g̵%E g̵%D g̴%C g̴%B g̴%A g̳%@ g̳z%? g`$ g`$ g`$ g`$ g]$ g]$ g]$ g]$ g\r$ g\<$ g[$ g[$ g[$ g[$ g[3$ g["$ g[$ gZ$ gY$ gX$ gX$ gX$ gX$~ gX$} gW$| gW${ gV$z gV$y gV$x gTx$w gTj$v gS$u gS$t gS$s gS$r gQ$q gP$p gP8$o gP.$n gO"$m gO$l gN$k gn%k gN$j gLF$i gL)$h gL$g gK$f gH$e gH$d gG$c gF$b gE$a gE$` gD$_ gDs$^ gC)$] gB$\ gBs$[ gA$Z gA $Y g@:$X g@,$W g>:$V g=$U g=r$S g=n$R g=^$T g<$Q g rejected RCPT : Rejected relay attempt: '165.154.208.196' From: 'rgahu@shivelectricaltransformers.com' To: 'goofile@fastmail.com'165.154.208.1961668284 t$ - / 2 T Wy?Ut]c  -C+ ossec13001g̃bExim Auth failed2025-03-08 23:20:24 dovecot_plain authenticator failed for ([103.219.154.156]) [103.219.154.156]:34480: 535 Incorrect authentication data (set_id=services)103.219.154.1562750405fb  -[% ossec13001g̃ZExim Auth failed2025-03-08 23:20:16 dovecot_plain authenticator failed for ([60.29.51.54]) [117.14.51.58]:36415: 535 Incorrect authentication data (set_id=services@heipowersystem.com)117.14.51.581814991Ra  -5' ossec13001ǵExim Auth failed2025-03-08 23:14:27 dovecot_plain authenticator failed for ([93.191.115.52]) [93.191.115.54]:55236: 535 Incorrect authentication data (set_id=sales)93.191.115.5499237z`  -' ossec13001ǵExim Auth failed2025-03-08 23:14:10 dovecot_plain authenticator failed for syn-098-144-082-250.res.spectrum.com [98.144.82.250]:41392: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)98.144.82.2506252001Z_  -?) ossec13001g̀Exim Auth failed2025-03-08 23:08:45 dovecot_plain authenticator failed for ([195.222.57.183]) [195.222.57.183]:58056: 535 Incorrect authentication data (set_id=services)195.222.57.1833277605j^  -a' ossec13001g̀Exim Auth failed2025-03-08 23:08:31 dovecot_plain authenticator failed for ([220.92.25.189]) [220.92.25.189]:39018: 535 Incorrect authentication data (set_id=services@heipowersystem.com)220.92.25.1891835841R]  -3% ossec13001g~Exim Auth failed2025-03-08 23:01:21 dovecot_plain authenticator failed for ([58.131.97.5]) [180.88.96.37]:6759: 535 Incorrect authentication data (set_id=services)180.88.96.371814991R\  -1' ossec13001g~Exim Auth failed2025-03-08 23:01:02 dovecot_plain authenticator failed for p277012-obmd01.tokyo.ocn.ne.jp [180.41.108.11]:60496: 535 Incorrect authentication data180.41.108.111861060j[  -a' ossec13001g~Exim Auth failed2025-03-08 23:00:42 dovecot_plain authenticator failed for ([50.171.64.170]) [50.171.64.170]:39294: 535 Incorrect authentication data (set_id=services@heipowersystem.com)50.171.64.1706252001ZZ  -=+ ossec13001g~hExim Auth failed2025-03-08 22:59:12 dovecot_plain authenticator failed for ([123.209.118.166]) [123.209.118.166]:55744: 535 Incorrect authentication data (set_id=sales)123.209.118.1662077456yY  -' ossec13001g~NExim Auth failed2025-03-08 22:58:46 dovecot_plain authenticator failed for dhcp-4-bc-9f-52-b7-f.cpe.i-zoom.net [24.244.93.233]:49746: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)24.244.93.2336251999ZX  -?) ossec13001g}>Exim Auth failed2025-03-08 22:54:13 dovecot_plain authenticator failed for ([121.147.25.111]) [121.147.25.111]:47128: 535 Incorrect authentication data (set_id=services)121.147.25.1111835841yW  -}) ossec13001g}$Exim Auth failed2025-03-08 22:53:47 dovecot_plain authenticator failed for 110-25-105-242.adsl.fetnet.net [110.25.105.242]:55025: 535 Incorrect authentication data (set_id=services@heipowersystem.com)110.25.105.2421668284zV  -' ossec13001g|Exim Auth failed2025-03-08 22:51:03 dovecot_plain authenticator failed for syn-156-019-080-138.biz.spectrum.com [156.19.80.138]:58986: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)156.19.80.1386252001sU  -u% ossec13001gzExim Auth failed2025-03-08 22:44:26 dovecot_plain authenticator failed for 1-36-180-128.ptr.netvigator.com [1.36.180.128]:36017: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)1.36.180.1281819730gT  -[' ossec13001gzExim Auth failed2025-03-08 22:44:37 dovecot_plain authenticator failed for syn-071-066-157-177.biz.spectrum.com [71.66.157.177]:51249: 535 Incorrect authentication data (set_id=sales)71.66.157.1776252001mS  -e) ossec13001gzeExim Auth failed2025-03-08 22:42:05 dovecot_plain authenticator failed for ([120.224.242.78]) [120.224.242.78]:52685: 535 Incorrect authentication data (set_id=services@heipowersystem.com)120.224.242.781814991  : b q uft  -[% ossec13001g̏Exim Auth failed2025-03-09 00:13:24 dovecot_login authenticator failed for (gurukuljaipur.com) [125.72.54.81]:48386: 535 Incorrect authentication data (set_id=admin@gurukuljaipur.com)125.72.54.811814991Vs  -;% ossec13001g̏Exim Auth failed2025-03-09 00:12:32 dovecot_login authenticator failed for (gurukuljaipur.com) [125.72.54.81]:44242: 535 Incorrect authentication data (set_id=nologin)125.72.54.811814991Zr  -?) ossec13001g̎Exim Auth failed2025-03-09 00:09:21 dovecot_plain authenticator failed for ([220.182.11.126]) [220.182.11.126]:51677: 535 Incorrect authentication data (set_id=services)220.182.11.1261814991kq  -c' ossec13001g̎Exim Auth failed2025-03-09 00:09:08 dovecot_plain authenticator failed for ([223.75.231.193]) [58.49.113.138]:16145: 535 Incorrect authentication data (set_id=services@heipowersystem.com)58.49.113.1381814991p  ?1 ossec1008g̎Process exiting (killed).Mar 9 00:06:14 vm1 spamd[3073179]: spamd: server killed by SIGTERM, shutting downgo  -[' ossec13001g̍Exim Auth failed2025-03-09 00:01:31 dovecot_plain authenticator failed for ([180.168.119.2]) [180.168.119.2]:60162: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)180.168.119.21814991rn  -s% ossec13001g̋Exim Auth failed2025-03-08 23:53:15 dovecot_plain authenticator failed for ool-4a5ad51c.dyn.optonline.net [74.90.213.28]:37754: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)74.90.213.286252001wm  -y) ossec13001g̉Exim Auth failed2025-03-08 23:47:16 dovecot_plain authenticator failed for bb115-66-228-194.singnet.com.sg [115.66.228.194]:33354: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)115.66.228.1941880251]l  -C+ ossec13001g̉Exim Auth failed2025-03-08 23:46:51 dovecot_plain authenticator failed for ([211.104.166.110]) [211.104.166.110]:59832: 535 Incorrect authentication data (set_id=services)211.104.166.1101835841ek  -]% ossec13001g̉Exim Auth failed2025-03-08 23:46:38 dovecot_plain authenticator failed for ([46.161.196.5]) [46.161.196.5]:51062: 535 Incorrect authentication data (set_id=services@heipowersystem.com)46.161.196.599237pj  -i+ ossec13001ġkExim Auth failed2025-03-08 23:37:39 dovecot_plain authenticator failed for ([118.220.149.129]) [118.220.149.129]:60974: 535 Incorrect authentication data (set_id=services@heipowersystem.com)118.220.149.1291835841Ti  -5' ossec13001ġUExim Auth failed2025-03-08 23:37:16 dovecot_plain authenticator failed for ([37.28.177.141]) [37.28.177.141]:47142: 535 Incorrect authentication data (set_id=sales)37.28.177.1412017370mh  -c+ ossec13001ġKExim Auth failed2025-03-08 23:37:06 dovecot_plain authenticator failed for ([163.179.123.208]) [163.179.123.208]:39627: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)163.179.123.2081814991Tg  -5' ossec13001ḡExim Auth failed2025-03-08 23:27:07 dovecot_plain authenticator failed for ([60.166.31.198]) [60.166.31.198]:44965: 535 Incorrect authentication data (set_id=sales)60.166.31.1981814991af  -S# ossec13001ḡExim Auth failed2025-03-08 23:26:36 dovecot_plain authenticator failed for ([5.166.68.89]) [5.166.68.89]:40672: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)5.166.68.892017370^e  -O# ossec13001g̃rExim Auth failed2025-03-08 23:20:41 dovecot_login authenticator failed for (31-154-64-191.orange.net.il) [2.55.64.191]:35590: 535 Incorrect authentication data (set_id=services)2.55.64.191294640{d  -% ossec13001g̃hExim Auth failed2025-03-08 23:20:31 dovecot_login authenticator failed for (host-113.192.1.27.sblnetwork.co.id) [113.192.1.26]:52919: 535 Incorrect authentication data (set_id=services@heipowersystem.com)113.192.1.261643084 5 @ R t   -' ossec13001g̕Exim Auth failed2025-03-09 00:38:00 dovecot_plain authenticator failed for host-88-43-231-186.business.telecomitalia.it ([88.43.231.188]) [88.43.231.186]:42538: 535 Incorrect authentication data (set_id=services)88.43.231.1863175395p  -i+ ossec13001g̕xExim Auth failed2025-03-09 00:37:36 dovecot_plain authenticator failed for ([123.210.128.249]) [123.210.128.249]:49660: 535 Incorrect authentication data (set_id=services@heipowersystem.com)123.210.128.2492077456i  -c# ossec13001g̔Exim Auth failed2025-03-09 00:33:36 dovecot_login authenticator failed for (5x166x68x89.dynamic.barnaul.ertelecom.ru) [5.166.68.89]:50678: 535 Incorrect authentication data (set_id=sales)5.166.68.892017370a  -S# ossec13001g̔zExim Auth failed2025-03-09 00:33:21 dovecot_login authenticator failed for ([8.209.221.7]) [8.209.221.7]:59668: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)8.209.221.71861060Z  -=+ ossec13001g̔Exim Auth failed2025-03-09 00:33:56 dovecot_plain authenticator failed for ([175.205.126.214]) [175.205.126.214]:43358: 535 Incorrect authentication data (set_id=sales)175.205.126.2141835841g  -[' ossec13001g̔Exim Auth failed2025-03-09 00:33:43 dovecot_plain authenticator failed for ([220.92.25.189]) [220.92.25.189]:55271: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)220.92.25.1891835841n~  -k% ossec13001g̓Exim Auth failed2025-03-09 00:29:45 dovecot_plain authenticator failed for vps-79f20bfc.vps.ovh.net ([87.98.249.193]) [51.75.24.107]:43756: 535 Incorrect authentication data (set_id=services)51.75.24.1073017382j}  -a' ossec13001g̓Exim Auth failed2025-03-09 00:29:34 dovecot_plain authenticator failed for ([61.108.83.138]) [61.108.83.138]:50777: 535 Incorrect authentication data (set_id=services@heipowersystem.com)61.108.83.1381835841y|  -}) ossec13001g̓.Exim Auth failed2025-03-09 00:27:48 dovecot_login authenticator failed for ([103.129.201.82]) [103.129.201.81]:34660: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)103.129.201.811210997x{  -{) ossec13001g̓DExim Auth failed2025-03-09 00:28:12 dovecot_login authenticator failed for syn-173-095-123-220.biz.spectrum.com [173.95.123.220]:54695: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)173.95.123.2206252001jz  -_) ossec13001g̒Exim Auth failed2025-03-09 00:25:31 dovecot_login authenticator failed for (gurukuljaipur.com) [42.193.105.109]:47530: 535 Incorrect authentication data (set_id=sales@gurukuljaipur.com)42.193.105.1091814991Zy  -?) ossec13001g̒Exim Auth failed2025-03-09 00:25:07 dovecot_login authenticator failed for (gurukuljaipur.com) [42.193.105.109]:44466: 535 Incorrect authentication data (set_id=nologin)42.193.105.1091814991jx  -_) ossec13001g̑Exim Auth failed2025-03-09 00:22:31 dovecot_plain authenticator failed for ([130.250.134.35]) [130.250.134.35]:55244: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)130.250.134.356252001qw  -q% ossec13001g̑ Exim Auth failed2025-03-09 00:18:45 dovecot_plain authenticator failed for bb121-7-26-195.singnet.com.sg [121.7.26.195]:41426: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)121.7.26.1951880251Zv  -?) ossec13001g̐7Exim Auth failed2025-03-09 00:15:10 dovecot_plain authenticator failed for ([120.197.14.230]) [120.197.14.230]:43670: 535 Incorrect authentication data (set_id=services)120.197.14.2301814991iu  -a' ossec13001g̐Exim Auth failed2025-03-09 00:14:40 dovecot_plain authenticator failed for ([77.139.82.133]) [77.139.82.133]:34693: 535 Incorrect authentication data (set_id=services@heipowersystem.com)77.139.82.133294640 {: = _  5Zl{m  -e) ossec13001g̞kExim Auth failed2025-03-09 01:15:45 dovecot_plain authenticator failed for ([138.75.118.229]) [138.75.118.229]:57821: 535 Incorrect authentication data (set_id=services@heipowersystem.com)138.75.118.2291880251j  -_) ossec13001g̞cExim Auth failed2025-03-09 01:15:38 dovecot_plain authenticator failed for ([124.112.45.222]) [124.112.45.222]:56005: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)124.112.45.2221814991W  -;' ossec13001g̝Exim Auth failed2025-03-09 01:09:59 dovecot_plain authenticator failed for ([103.48.194.21]) [103.48.194.21]:49146: 535 Incorrect authentication data (set_id=services)103.48.194.211562822g  -]% ossec13001g̝Exim Auth failed2025-03-09 01:09:47 dovecot_plain authenticator failed for ([58.22.255.28]) [58.22.255.28]:58539: 535 Incorrect authentication data (set_id=services@heipowersystem.com)58.22.255.281814991Z  -=+ ossec13001g̜Exim Auth failed2025-03-09 01:07:48 dovecot_plain authenticator failed for ([210.113.122.243]) [210.113.122.243]:53092: 535 Incorrect authentication data (set_id=sales)210.113.122.2431835841m  -c+ ossec13001g̜Exim Auth failed2025-03-09 01:07:37 dovecot_plain authenticator failed for ([175.145.232.217]) [175.145.232.217]:40578: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)175.145.232.2171733045h  -_' ossec13001g̛Exim Auth failed2025-03-09 01:05:07 dovecot_login authenticator failed for (User) [193.46.255.40]:58772: 535 Incorrect authentication data (set_id=dfgdsfgfdgdfg@saintsoldiercollege.com)193.46.255.40798549W  -9) ossec13001g̚Exim Auth failed2025-03-09 01:00:20 dovecot_plain authenticator failed for ([209.141.177.55]) [209.141.177.55]:51231: 535 Incorrect authentication data (set_id=sales)209.141.177.556251999Z  -?) ossec13001g̚Exim Auth failed2025-03-09 01:00:13 dovecot_plain authenticator failed for ([119.206.34.142]) [119.206.34.142]:43168: 535 Incorrect authentication data (set_id=services)119.206.34.1421835841v  -y' ossec13001g̚Exim Auth failed2025-03-09 00:59:50 dovecot_plain authenticator failed for p5098d833.dip0.t-ipconnect.de [80.152.216.51]:22800: 535 Incorrect authentication data (set_id=services@heipowersystem.com)80.152.216.512921044  - + ossec13001g̚Exim Auth failed2025-03-09 00:59:46 dovecot_plain authenticator failed for (static.ill.117.250.253.141.bsnl.co.in) [117.250.253.137]:36444: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)117.250.253.1371269750j  -a' ossec13001g̘Exim Auth failed2025-03-09 00:51:57 dovecot_plain authenticator failed for ([111.124.47.11]) [111.124.47.11]:33209: 535 Incorrect authentication data (set_id=services@heipowersystem.com)111.124.47.111814991Z  -?) ossec13001g̘Exim Auth failed2025-03-09 00:52:09 dovecot_plain authenticator failed for ([111.171.125.94]) [111.171.125.94]:43976: 535 Incorrect authentication data (set_id=services)111.171.125.941835841Z  -=+ ossec13001g̘mExim Auth failed2025-03-09 00:50:13 dovecot_plain authenticator failed for ([203.123.219.137]) [203.123.219.137]:37508: 535 Incorrect authentication data (set_id=sales)203.123.219.1371835841y  -' ossec13001g̘aExim Auth failed2025-03-09 00:50:00 dovecot_plain authenticator failed for dhcp-4-bc-9f-52-b7-f.cpe.i-zoom.net [24.244.93.233]:59791: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)24.244.93.2336251999T  -5' ossec13001g̕nExim Auth failed2025-03-09 00:37:26 dovecot_login authenticator failed for ([182.42.113.10]) [182.42.113.10]:37425: 535 Incorrect authentication data (set_id=sales)182.42.113.101814991j  -_) ossec13001g̕dExim Auth failed2025-03-09 00:37:15 dovecot_login authenticator failed for ([218.23.156.227]) [218.23.156.227]:38729: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)218.23.156.2271814991 != ; X j  'BET{v a8'  Ai' ossec11302g̨FTP Authentication failed.Mar 9 01:59:01 vm1 pure-ftpd[3398260]: (?@91.196.152.17) [WARNING] Authentication failed for user [anonymous]91.196.152.173017382%&  3Q' ossec11301g̨New FTP connection.Mar 9 01:58:54 vm1 pure-ftpd[3398260]: (?@91.196.152.17) [INFO] New connection from 91.196.152.1791.196.152.173017382(%  3U) ossec11301g̨New FTP connection.Mar 9 01:58:54 vm1 pure-ftpd[3398258]: (?@91.196.152.105) [INFO] New connection from 91.196.152.10591.196.152.1053017382Q$  -1% ossec13001g̨%Exim Auth failed2025-03-09 01:57:16 dovecot_plain authenticator failed for ([103.4.103.61]) [103.4.103.61]:60848: 535 Incorrect authentication data (set_id=sales)103.4.103.611168579g#  -[' ossec13001g̨Exim Auth failed2025-03-09 01:57:01 dovecot_plain authenticator failed for ([82.208.99.163]) [82.208.99.163]:54994: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)82.208.99.1632017370"  - + ossec13001g̦Exim Auth failed2025-03-09 01:50:36 dovecot_plain authenticator failed for (static.ill.117.250.253.141.bsnl.co.in) [117.250.253.137]:54056: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)117.250.253.1371269750U!  -;' ossec13001g̥Exim Auth failed2025-03-09 01:47:28 dovecot_plain authenticator failed for ([65.20.235.206]) [65.20.235.206]:56647: 535 Incorrect authentication data (set_id=services)65.20.235.20699237m  -e) ossec13001g̥Exim Auth failed2025-03-09 01:46:56 dovecot_plain authenticator failed for ([60.173.105.206]) [60.173.105.206]:55131: 535 Incorrect authentication data (set_id=services@heipowersystem.com)60.173.105.2061814991y  -) ossec13001g̤tExim Auth failed2025-03-09 01:41:31 dovecot_plain authenticator failed for ip4-193-93-156-147.blue-net.com.pl ([193.93.156.149]) [193.93.156.147]:58988: 535 Incorrect authentication data (set_id=sales)193.93.156.147798544a  -S# ossec13001g̤VExim Auth failed2025-03-09 01:41:02 dovecot_plain authenticator failed for ([59.12.201.7]) [59.12.201.7]:47656: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)59.12.201.71835841m  -e) ossec13001g̤Exim Auth failed2025-03-09 01:39:37 dovecot_plain authenticator failed for ([218.149.70.142]) [218.149.70.142]:45622: 535 Incorrect authentication data (set_id=services@heipowersystem.com)218.149.70.1421835841%  3Q' ossec11301g̣New FTP connection.Mar 9 01:39:21 vm1 pure-ftpd[3394292]: (?@88.214.25.124) [INFO] New connection from 88.214.25.12488.214.25.1242921044%  3Q' ossec11301g̢\New FTP connection.Mar 9 01:32:34 vm1 pure-ftpd[3392852]: (?@88.214.25.124) [INFO] New connection from 88.214.25.12488.214.25.1242921044j  -_) ossec13001g̠Exim Auth failed2025-03-09 01:26:46 dovecot_plain authenticator failed for ([220.173.37.217]) [220.173.37.217]:38347: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)220.173.37.2171814991_  -K' ossec13001g̠Exim Auth failed2025-03-09 01:25:57 dovecot_plain authenticator failed for ([120.78.172.20]) [120.78.172.20]:33796: 535 Incorrect authentication data (set_id=vikas.khandelwal)120.78.172.201814991~  - % ossec13001g̠Exim Auth failed2025-03-09 01:25:44 dovecot_plain authenticator failed for 111-70-0-112.emome-ip.hinet.net [111.70.0.112]:51184: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)111.70.0.1121668284`  -O% ossec13001g̞yExim Auth failed2025-03-09 01:16:00 dovecot_plain authenticator failed for 111-70-38-54.emome-ip.hinet.net [111.70.38.54]:57725: 535 Incorrect authentication data (set_id=sales)111.70.38.541668284[  -C' ossec13001g̞sExim Auth failed2025-03-09 01:15:54 dovecot_plain authenticator failed for www.michels-schwab.de [217.86.146.64]:41836: 535 Incorrect authentication data (set_id=services)217.86.146.642921044  1 L t $3BX]T8  -5' ossec13001g̯/Exim Auth failed2025-03-09 02:27:19 dovecot_plain authenticator failed for ([50.249.167.45]) [50.249.167.45]:34638: 535 Incorrect authentication data (set_id=sales)50.249.167.456252001w7  -{' ossec13001g̯Exim Auth failed2025-03-09 02:27:03 dovecot_plain authenticator failed for h88-129-31-231.cust.bredband2.com [88.129.31.231]:50583: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)88.129.31.2312661886f6  -W) ossec13001g̮GExim Auth failed2025-03-09 02:23:25 dovecot_plain authenticator failed for c83-254-214-181.bredband.tele2.se [83.254.214.181]:53066: 535 Incorrect authentication data (set_id=sales)83.254.214.1812661886m5  -e) ossec13001g̮GExim Auth failed2025-03-09 02:23:25 dovecot_plain authenticator failed for ([203.193.147.37]) [203.193.147.37]:51204: 535 Incorrect authentication data (set_id=services@heipowersystem.com)203.193.147.371269750m4  -c+ ossec13001g̮3Exim Auth failed2025-03-09 02:23:05 dovecot_plain authenticator failed for ([197.149.125.227]) [197.149.125.227]:36724: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)197.149.125.2272328926V3  -9' ossec13001g̫8Exim Auth failed2025-03-09 02:10:24 dovecot_plain authenticator failed for ([95.85.112.170]) [95.85.112.170]:9755: 535 Incorrect authentication data (set_id=services)95.85.112.1701218197j2  -a' ossec13001g̫$Exim Auth failed2025-03-09 02:10:03 dovecot_plain authenticator failed for ([49.124.153.42]) [49.124.153.42]:58342: 535 Incorrect authentication data (set_id=services@heipowersystem.com)49.124.153.421733045`1  -O% ossec13001g̫Exim Auth failed2025-03-09 02:09:50 dovecot_plain authenticator failed for ([116.7.248.50]) [116.7.248.50]:38226: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)116.7.248.5018149910  -) ossec13001g̫ Exim Auth failed2025-03-09 02:09:39 dovecot_plain authenticator failed for (186-208-76-154.veloo.com.br) [186.208.76.154]:46573: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)186.208.76.1543469034W/  -9) ossec13001g̩Exim Auth failed2025-03-09 02:05:02 dovecot_plain authenticator failed for ([222.114.84.175]) [222.114.84.175]:33616: 535 Incorrect authentication data (set_id=sales)222.114.84.1751835841j.  -_) ossec13001g̩Exim Auth failed2025-03-09 02:04:51 dovecot_plain authenticator failed for ([87.225.108.138]) [87.225.108.138]:52512: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)87.225.108.1382017370q-  -o) ossec13001g̩zExim Auth failed2025-03-09 02:02:56 dovecot_plain authenticator failed for ip-188-127-16-197.ennet.pl [188.127.16.197]:34074: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)188.127.16.197798544Z,  -=+ ossec13001g̩bExim Auth failed2025-03-09 02:02:33 dovecot_login authenticator failed for ([223.241.214.127]) [223.241.214.127]:48186: 535 Incorrect authentication data (set_id=sales)223.241.214.1271814991T+  -5' ossec13001g̩Exim Auth failed2025-03-09 02:03:08 dovecot_plain authenticator failed for ([49.124.145.56]) [49.124.145.56]:40874: 535 Incorrect authentication data (set_id=sales)49.124.145.561733045a*  -S# ossec13001g̩HExim Auth failed2025-03-09 02:02:06 dovecot_login authenticator failed for ([101.13.5.37]) [101.13.5.37]:55562: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)101.13.5.371668284W)  -;' ossec13001g̩Exim Auth failed2025-03-09 02:00:56 dovecot_plain authenticator failed for ([175.202.82.16]) [175.202.82.16]:40780: 535 Incorrect authentication data (set_id=services)175.202.82.161835841p(  -i+ ossec13001g̨Exim Auth failed2025-03-09 02:00:38 dovecot_plain authenticator failed for ([118.122.196.230]) [118.122.196.230]:38082: 535 Incorrect authentication data (set_id=services@heipowersystem.com)118.122.196.2301814991 * ? j |  .>Vh"I  3M% ossec11301g̸New FTP connection.Mar 9 03:07:35 vm1 pure-ftpd[3412913]: (?@139.162.77.6) [INFO] New connection from 139.162.77.6139.162.77.61861060jH  -_) ossec13001g̸rExim Auth failed2025-03-09 03:06:49 dovecot_plain authenticator failed for ([125.143.213.84]) [125.143.213.84]:32936: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)125.143.213.841835841dG  -Y# ossec13001g̸bExim Auth failed2025-03-09 03:06:32 dovecot_plain authenticator failed for ([221.4.153.7]) [221.4.153.7]:32772: 535 Incorrect authentication data (set_id=services@heipowersystem.com)221.4.153.71814991lF  -a+ ossec13001g̶{Exim Auth failed2025-03-09 02:58:26 dovecot_plain authenticator failed for ([114.143.224.97]) [182.156.135.216]:46179: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)182.156.135.2161269750ZE  -?) ossec13001g̵Exim Auth failed2025-03-09 02:55:08 dovecot_plain authenticator failed for ([121.189.198.60]) [121.189.198.60]:36544: 535 Incorrect authentication data (set_id=services)121.189.198.601835841D  - ) ossec13001g̵Exim Auth failed2025-03-09 02:54:51 dovecot_plain authenticator failed for syn-172-248-047-114.res.spectrum.com [172.248.47.114]:53749: 535 Incorrect authentication data (set_id=services@heipowersystem.com)172.248.47.1146252001gC  -Y) ossec13001g̴Exim Auth failed2025-03-09 02:51:41 dovecot_plain authenticator failed for (94.124.156.175.unknown.m1.com.sg) [175.156.124.94]:57850: 535 Incorrect authentication data (set_id=sales)175.156.124.941880251TB  -5' ossec13001g̴Exim Auth failed2025-03-09 02:51:32 dovecot_plain authenticator failed for ([79.143.164.98]) [79.143.164.98]:60163: 535 Incorrect authentication data (set_id=sales)79.143.164.983277605jA  -_) ossec13001g̴Exim Auth failed2025-03-09 02:51:01 dovecot_plain authenticator failed for ([222.119.124.66]) [222.119.124.66]:41491: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)222.119.124.661835841Z@  -?) ossec13001g̳Exim Auth failed2025-03-09 02:46:12 dovecot_plain authenticator failed for ([216.194.174.27]) [216.194.174.27]:43657: 535 Incorrect authentication data (set_id=services)216.194.174.276252001y?  -' ossec13001g̳zExim Auth failed2025-03-09 02:45:37 dovecot_plain authenticator failed for 60-249-207-53.hinet-ip.hinet.net [60.249.207.53]:49062: 535 Incorrect authentication data (set_id=services@heipowersystem.com)60.249.207.531668284]>  -C+ ossec13001g̲tExim Auth failed2025-03-09 02:41:16 dovecot_plain authenticator failed for ([190.205.112.156]) [190.205.112.156]:21729: 535 Incorrect authentication data (set_id=services)190.205.112.1563625428j=  -a' ossec13001g̲bExim Auth failed2025-03-09 02:40:57 dovecot_plain authenticator failed for ([211.109.75.66]) [211.109.75.69]:50277: 535 Incorrect authentication data (set_id=services@heipowersystem.com)211.109.75.691835841Q<  -1% ossec13001g̱Exim Auth failed2025-03-09 02:37:46 dovecot_plain authenticator failed for ([110.34.70.28]) [110.34.70.28]:55553: 535 Incorrect authentication data (set_id=sales)110.34.70.281835841g;  -[' ossec13001g̱Exim Auth failed2025-03-09 02:37:29 dovecot_plain authenticator failed for ([42.180.162.26]) [42.180.162.26]:46527: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)42.180.162.261814991g:  -[' ossec13001g̰Exim Auth failed2025-03-09 02:33:30 dovecot_plain authenticator failed for h88-129-31-231.cust.bredband2.com [88.129.31.231]:35505: 535 Incorrect authentication data (set_id=services)88.129.31.2312661886g9  -]% ossec13001g̰Exim Auth failed2025-03-09 02:33:08 dovecot_plain authenticator failed for ([106.51.57.89]) [106.51.57.89]:60848: 535 Incorrect authentication data (set_id=services@heipowersystem.com)106.51.57.891269750 n7 , L ^ :InWZ  -;' ossec13001gVExim Auth failed2025-03-09 03:49:02 dovecot_plain authenticator failed for ([107.91.33.184]) [107.91.33.184]:61900: 535 Incorrect authentication data (set_id=services)107.91.33.1846252001mY  -e) ossec13001g>Exim Auth failed2025-03-09 03:48:38 dovecot_plain authenticator failed for ([124.112.45.222]) [124.112.45.222]:40169: 535 Incorrect authentication data (set_id=services@heipowersystem.com)124.112.45.2221814991WX  -;' ossec13001g Exim Auth failed2025-03-09 03:43:30 dovecot_plain authenticator failed for ([114.30.180.58]) [114.30.180.58]:52637: 535 Incorrect authentication data (set_id=services)114.30.180.581835841mW  -e) ossec13001gExim Auth failed2025-03-09 03:43:18 dovecot_plain authenticator failed for ([37.204.170.200]) [37.204.170.200]:57818: 535 Incorrect authentication data (set_id=services@heipowersystem.com)37.204.170.2002017370WV  -9) ossec13001gExim Auth failed2025-03-09 03:41:31 dovecot_plain authenticator failed for ([49.124.148.194]) [49.124.148.194]:42598: 535 Incorrect authentication data (set_id=sales)49.124.148.1941733045jU  -_) ossec13001gExim Auth failed2025-03-09 03:41:20 dovecot_plain authenticator failed for ([59.102.188.188]) [59.102.188.188]:47952: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)59.102.188.1881668284dT  -W% ossec13001gExim Auth failed2025-03-09 03:42:04 dovecot_plain authenticator failed for ([179.185.1.97]) [179.185.1.97]:60805: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)179.185.1.973469034PS  -1% ossec13001g̿Exim Auth failed2025-03-09 03:38:10 dovecot_plain authenticator failed for ([206.42.79.74]) [206.42.79.74]:42830: 535 Incorrect authentication data (set_id=sales)206.42.79.74203312~R  -) ossec13001g̿Exim Auth failed2025-03-09 03:37:50 dovecot_plain authenticator failed for 47-158-210-137.lsan.ca.frontiernet.net [47.158.210.137]:33560: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)47.158.210.1376252001oQ  -i+ ossec13001g̽Exim Auth failed2025-03-09 03:29:23 dovecot_plain authenticator failed for ([196.190.118.132]) [196.190.118.132]:47030: 535 Incorrect authentication data (set_id=services@heipowersystem.com)196.190.118.132337996~P  - % ossec13001g̽eExim Auth failed2025-03-09 03:27:56 dovecot_login authenticator failed for 111-70-13-54.emome-ip.hinet.net [111.70.13.54]:35647: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)111.70.13.541668284XO  -=' ossec13001g̽ Exim Auth failed2025-03-09 03:26:26 dovecot_plain authenticator failed for www.michels-schwab.de [217.86.146.64]:56330: 535 Incorrect authentication data (set_id=sales)217.86.146.642921044jN  -_) ossec13001g̽Exim Auth failed2025-03-09 03:26:15 dovecot_plain authenticator failed for ([220.119.126.81]) [220.119.126.81]:59988: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)220.119.126.811835841\M  -G% ossec13001g̼GExim Auth failed2025-03-09 03:23:10 dovecot_plain authenticator failed for vps-0b1302de.vps.ovh.net [51.91.10.114]:44414: 535 Incorrect authentication data (set_id=services)51.91.10.1143017382L  -% ossec13001g̼<Exim Auth failed2025-03-09 03:22:59 dovecot_plain authenticator failed for vps-79f20bfc.vps.ovh.net (ip193.ip-87-98-249.eu) [51.75.24.107]:17619: 535 Incorrect authentication data (set_id=services@heipowersystem.com)51.75.24.1073017382WK  -;' ossec13001g̻Exim Auth failed2025-03-09 03:21:34 dovecot_plain authenticator failed for ([172.125.13.11]) [172.125.13.11]:58348: 535 Incorrect authentication data (set_id=services)172.125.13.116252001jJ  -a' ossec13001g̻Exim Auth failed2025-03-09 03:20:59 dovecot_plain authenticator failed for ([60.29.100.218]) [60.29.100.218]:49724: 535 Incorrect authentication data (set_id=services@heipowersystem.com)60.29.100.2181814991 L@ A d h 6EjLCl  77 ossec502gOssec server started.ossec: Ossec started.wk  -{' ossec13001gnExim Auth failed2025-03-09 04:23:33 dovecot_plain authenticator failed for c-85-228-121-10.bbcust.telenor.se [85.228.121.10]:47642: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)85.228.121.102661886Yj  -A% ossec13001g~Exim Auth failed2025-03-09 04:23:49 dovecot_plain authenticator failed for vps-0b1302de.vps.ovh.net [51.91.10.114]:38046: 535 Incorrect authentication data (set_id=sales)51.91.10.1143017382Wi  -;' ossec13001gExim Auth failed2025-03-09 04:21:57 dovecot_plain authenticator failed for ([107.91.33.184]) [107.91.33.184]:59991: 535 Incorrect authentication data (set_id=services)107.91.33.1846252001mh  -e) ossec13001gExim Auth failed2025-03-09 04:21:38 dovecot_plain authenticator failed for ([223.82.241.146]) [223.82.241.146]:46136: 535 Incorrect authentication data (set_id=services@heipowersystem.com)223.82.241.1461814991Zg  -?) ossec13001gpExim Auth failed2025-03-09 04:19:20 dovecot_plain authenticator failed for ([116.114.84.234]) [116.114.84.234]:59089: 535 Incorrect authentication data (set_id=services)116.114.84.2341814991yf  -% ossec13001gdExim Auth failed2025-03-09 04:19:08 dovecot_plain authenticator failed for c-73-95-112-29.hsd1.co.comcast.net [73.95.112.29]:55738: 535 Incorrect authentication data (set_id=services@heipowersystem.com)73.95.112.296252001Ze  -?) ossec13001g2Exim Auth failed2025-03-09 04:18:18 dovecot_login authenticator failed for ([220.182.17.122]) [220.182.17.122]:41420: 535 Incorrect authentication data (set_id=services)220.182.17.1221814991gd  -]% ossec13001gExim Auth failed2025-03-09 04:17:50 dovecot_login authenticator failed for ([59.99.153.21]) [59.99.153.21]:55591: 535 Incorrect authentication data (set_id=services@heipowersystem.com)59.99.153.211269750ac  -S# ossec13001gExim Auth failed2025-03-09 04:16:33 dovecot_plain authenticator failed for ([221.4.153.7]) [221.4.153.7]:34081: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)221.4.153.71814991Sb  -7% ossec13001gƷExim Auth failed2025-03-09 04:07:43 dovecot_plain authenticator failed for ([196.0.89.118]) [196.0.89.118]:48315: 535 Incorrect authentication data (set_id=services)196.0.89.118226074ga  -]% ossec13001gƫExim Auth failed2025-03-09 04:07:31 dovecot_plain authenticator failed for ([42.236.91.93]) [42.236.91.93]:47016: 535 Incorrect authentication data (set_id=services@heipowersystem.com)42.236.91.931814991c`  -S' ossec13001gőExim Auth failed2025-03-09 04:02:48 dovecot_plain authenticator failed for 111-70-23-235.emome-ip.hinet.net [111.70.23.235]:51923: 535 Incorrect authentication data (set_id=sales)111.70.23.2351668284x_  -}' ossec13001gŅExim Auth failed2025-03-09 04:02:37 dovecot_plain authenticator failed for 119-46-148-53.static.asianet.co.th [119.46.148.53]:53136: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)119.46.148.531605651Y^  -=) ossec13001găExim Auth failed2025-03-09 03:58:19 dovecot_login authenticator failed for ([183.56.179.201]) [113.116.246.32]:5586: 535 Incorrect authentication data (set_id=services)113.116.246.321814991{]  -) ossec13001gyExim Auth failed2025-03-09 03:58:08 dovecot_login authenticator failed for (134.239.223.60.adsl-pool.sx.cn) [60.223.239.134]:43294: 535 Incorrect authentication data (set_id=services@heipowersystem.com)60.223.239.1341814991N\  --# ossec13001gExim Auth failed2025-03-09 03:51:22 dovecot_plain authenticator failed for ([59.0.60.158]) [59.0.60.158]:53194: 535 Incorrect authentication data (set_id=sales)59.0.60.1581835841j[  -_) ossec13001gExim Auth failed2025-03-09 03:51:10 dovecot_plain authenticator failed for ([39.152.114.206]) [39.152.114.206]:18778: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)39.152.114.2061814991 $ F k   EK`l|W}  -9) ossec13001gExim Auth failed2025-03-09 05:04:20 dovecot_plain authenticator failed for ([171.217.70.151]) [171.217.70.151]:53246: 535 Incorrect authentication data (set_id=sales)171.217.70.1511814991g|  -[' ossec13001gExim Auth failed2025-03-09 05:03:47 dovecot_plain authenticator failed for ([79.77.174.182]) [79.77.174.182]:36622: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)79.77.174.1822635167l{  -c) ossec13001gExim Auth failed2025-03-09 05:03:29 dovecot_plain authenticator failed for syn-076-178-103-119.res.spectrum.com [76.178.103.119]:61599: 535 Incorrect authentication data (set_id=services)76.178.103.1196252001pz  -i+ ossec13001gӼExim Auth failed2025-03-09 05:03:16 dovecot_plain authenticator failed for ([116.228.195.251]) [116.228.195.251]:16105: 535 Incorrect authentication data (set_id=services@heipowersystem.com)116.228.195.2511814991gy  -[' ossec13001gxExim Auth failed2025-03-09 05:02:08 dovecot_plain authenticator failed for syn-024-090-169-209.res.spectrum.com [24.90.169.209]:46912: 535 Incorrect authentication data (set_id=sales)24.90.169.2096252001vx  -w) ossec13001gLExim Auth failed2025-03-09 05:01:24 dovecot_plain authenticator failed for ip72-199-156-231.sd.sd.cox.net [72.199.156.231]:53080: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)72.199.156.2316252001Ww  -;' ossec13001grExim Auth failed2025-03-09 04:53:28 dovecot_plain authenticator failed for ([59.14.179.108]) [59.14.179.108]:54666: 535 Incorrect authentication data (set_id=services)59.14.179.1081835841gv  -]% ossec13001gdExim Auth failed2025-03-09 04:53:16 dovecot_plain authenticator failed for ([222.99.10.11]) [222.99.10.11]:57274: 535 Incorrect authentication data (set_id=services@heipowersystem.com)222.99.10.111835841Wu -;% ossec13001g]Exim Auth failed2025-03-09 04:44:36 dovecot_login authenticator failed for (gurukuljaipur.com) [60.2.243.174]:35722: 535 Incorrect authentication data (set_id=nologin)60.2.243.1741814991Nt  --# ossec13001gOExim Auth failed2025-03-09 04:44:22 dovecot_plain authenticator failed for ([59.0.60.158]) [59.0.60.158]:58404: 535 Incorrect authentication data (set_id=sales)59.0.60.1581835841gs  -[' ossec13001g7Exim Auth failed2025-03-09 04:43:59 dovecot_plain authenticator failed for ([85.26.221.136]) [85.26.221.136]:56089: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)85.26.221.1362017370Zr  -?) ossec13001gExim Auth failed2025-03-09 04:42:24 dovecot_plain authenticator failed for ([219.251.253.62]) [219.251.253.62]:40429: 535 Incorrect authentication data (set_id=services)219.251.253.621835841fq  -[% ossec13001gεExim Auth failed2025-03-09 04:41:49 dovecot_plain authenticator failed for ([27.71.20.180]) [27.71.20.180]:6256: 535 Incorrect authentication data (set_id=services@heipowersystem.com)27.71.20.1801562822Wp  -;' ossec13001gkExim Auth failed2025-03-09 04:36:18 dovecot_plain authenticator failed for ([88.204.52.137]) [88.204.52.137]:52218: 535 Incorrect authentication data (set_id=services)88.204.52.1372017370Zo  -=+ ossec13001g̓Exim Auth failed2025-03-09 04:36:41 dovecot_plain authenticator failed for ([211.104.166.110]) [211.104.166.110]:60828: 535 Incorrect authentication data (set_id=sales)211.104.166.1101835841jn  -_) ossec13001gqExim Auth failed2025-03-09 04:36:23 dovecot_plain authenticator failed for ([218.150.170.10]) [218.150.170.10]:39186: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)218.150.170.101835841jm  -a' ossec13001gYExim Auth failed2025-03-09 04:36:00 dovecot_plain authenticator failed for ([45.117.10.134]) [45.117.10.134]:36500: 535 Incorrect authentication data (set_id=services@heipowersystem.com)45.117.10.1341814991 V? d c x r%AVg  -[' ossec13001gExim Auth failed2025-03-09 05:54:54 dovecot_plain authenticator failed for syn-131-148-000-202.biz.spectrum.com [131.148.0.202]:53239: 535 Incorrect authentication data (set_id=sales)131.148.0.2026252001`  -S# ossec13001gExim Auth failed2025-03-09 05:54:42 dovecot_plain authenticator failed for ([5.77.214.39]) [5.77.214.39]:33560: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)5.77.214.39174982Z  -?) ossec13001gkExim Auth failed2025-03-09 05:53:07 dovecot_plain authenticator failed for ([178.178.222.58]) [178.178.222.58]:51678: 535 Incorrect authentication data (set_id=services)178.178.222.582017370j  -a' ossec13001gQExim Auth failed2025-03-09 05:52:40 dovecot_plain authenticator failed for ([46.52.204.227]) [46.52.204.227]:56779: 535 Incorrect authentication data (set_id=services@heipowersystem.com)46.52.204.2272017370l  -c) ossec13001gExim Auth failed2025-03-09 05:46:18 dovecot_login authenticator failed for (heipowersystem.com) [42.193.105.109]:50186: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)42.193.105.1091814991[  -A) ossec13001gݹExim Auth failed2025-03-09 05:45:53 dovecot_login authenticator failed for (heipowersystem.com) [42.193.105.109]:57998: 535 Incorrect authentication data (set_id=nologin)42.193.105.1091814991t  -s) ossec13001g3Exim Auth failed2025-03-09 05:43:37 dovecot_login authenticator failed for (ip-20-192.datautama.net.id) [112.109.20.192]:43101: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)112.109.20.1921643084m  -e) ossec13001gExim Auth failed2025-03-09 05:37:40 dovecot_plain authenticator failed for (static-78.219.149.202-tataidc.co.in) [202.149.219.78]:53434: 535 Incorrect authentication data (set_id=services)202.149.219.781269750j  -a' ossec13001gۿExim Auth failed2025-03-09 05:37:26 dovecot_plain authenticator failed for ([188.43.204.45]) [188.43.204.45]:37209: 535 Incorrect authentication data (set_id=services@heipowersystem.com)188.43.204.452017370W  -9) ossec13001gbExim Auth failed2025-03-09 05:35:54 dovecot_plain authenticator failed for ([31.220.168.116]) [31.220.168.116]:50287: 535 Incorrect authentication data (set_id=sales)31.220.168.1162017370  -5' ossec13001gVExim Auth failed2025-03-09 05:35:42 dovecot_plain authenticator failed for host-88-43-231-186.business.telecomitalia.it ([88.43.231.188]) [88.43.231.186]:34636: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)88.43.231.1863175395j  -_) ossec13001gExim Auth failed2025-03-09 05:29:47 dovecot_plain authenticator failed for ([175.205.191.27]) [175.205.191.27]:44494: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)175.205.191.271835841g  -]% ossec13001g٘Exim Auth failed2025-03-09 05:28:16 dovecot_plain authenticator failed for ([220.81.9.218]) [220.81.9.218]:49864: 535 Incorrect authentication data (set_id=services@heipowersystem.com)220.81.9.2181835841}  -' ossec13001gExim Auth failed2025-03-09 05:21:28 dovecot_plain authenticator failed for syn-131-148-000-202.biz.spectrum.com [131.148.0.202]:57295: 535 Incorrect authentication data (set_id=services@heipowersystem.com)131.148.0.2026252001W  -;' ossec13001g Exim Auth failed2025-03-09 05:21:40 dovecot_plain authenticator failed for ([58.242.86.203]) [58.242.86.203]:49611: 535 Incorrect authentication data (set_id=services)58.242.86.2031814991P  -1% ossec13001gExim Auth failed2025-03-09 05:21:02 dovecot_plain authenticator failed for ([185.167.56.2]) [185.167.56.2]:41426: 535 Incorrect authentication data (set_id=sales)185.167.56.2617790i~  -_) ossec13001gExim Auth failed2025-03-09 05:20:37 dovecot_plain authenticator failed for ([94.201.236.143]) [94.201.236.143]:59064: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)94.201.236.143290557 : B X +)8Zsl^  -K' ossec13001gExim Auth failed2025-03-09 06:37:40 dovecot_plain authenticator failed for ([94.205.250.78]) [94.205.250.78]:54785: 535 Incorrect authentication data (set_id=vikas.khandelwal)94.205.250.78290557  -' ossec13001gExim Auth failed2025-03-09 06:37:19 dovecot_plain authenticator failed for 81-230-83-162-no600.tbcn.telia.com [81.230.83.162]:47974: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)81.230.83.1622661886c  -W% ossec13001g Exim Auth failed2025-03-09 06:30:14 dovecot_plain authenticator failed for ([41.24.28.218]) [41.24.28.218]:22688: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)41.24.28.218953987Z  -?) ossec13001gExim Auth failed2025-03-09 06:28:50 dovecot_plain authenticator failed for ([168.126.90.210]) [168.126.90.210]:55693: 535 Incorrect authentication data (set_id=services)168.126.90.2101835841m  -e) ossec13001gExim Auth failed2025-03-09 06:28:28 dovecot_plain authenticator failed for ([110.77.137.236]) [110.77.137.236]:38324: 535 Incorrect authentication data (set_id=services@heipowersystem.com)110.77.137.2361605651~  -+ ossec13001gExim Auth failed2025-03-09 06:25:59 dovecot_plain authenticator failed for (abts-north-dynamic-140.159.176.122.airtelbroadband.in) [122.176.159.140]:55099: 535 Incorrect authentication data (set_id=sales)122.176.159.1401269750j  -_) ossec13001gExim Auth failed2025-03-09 06:25:21 dovecot_plain authenticator failed for ([222.67.133.193]) [222.67.133.193]:18749: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)222.67.133.1931814991j  -a' ossec13001gExim Auth failed2025-03-09 06:24:04 dovecot_plain authenticator failed for ([27.40.100.238]) [27.40.100.238]:33388: 535 Incorrect authentication data (set_id=services@heipowersystem.com)27.40.100.2381814991g  -[' ossec13001ggExim Auth failed2025-03-09 06:14:21 dovecot_plain authenticator failed for syn-097-070-129-101.res.spectrum.com [97.70.129.101]:41131: 535 Incorrect authentication data (set_id=sales)97.70.129.1016252001m  -c+ ossec13001gQExim Auth failed2025-03-09 06:14:00 dovecot_plain authenticator failed for ([123.210.152.243]) [123.210.152.243]:50510: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)123.210.152.2432077456W  -;' ossec13001g Exim Auth failed2025-03-09 06:08:36 dovecot_plain authenticator failed for ([116.86.62.245]) [116.86.62.245]:39490: 535 Incorrect authentication data (set_id=services)116.86.62.2451880251j  -a' ossec13001gExim Auth failed2025-03-09 06:07:57 dovecot_plain authenticator failed for ([61.185.30.170]) [61.185.30.170]:52658: 535 Incorrect authentication data (set_id=services@heipowersystem.com)61.185.30.1701814991(  3U) ossec11301g4New FTP connection.Mar 9 06:00:42 vm1 pure-ftpd[3450000]: (?@167.94.138.164) [INFO] New connection from 167.94.138.164167.94.138.1646252001f  -Y' ossec13001gExim Auth failed2025-03-09 05:57:54 dovecot_plain authenticator failed for 57-45-246-103.southernonline.net [103.246.45.57]:57158: 535 Incorrect authentication data (set_id=services)103.246.45.571269750t  -u' ossec13001gvExim Auth failed2025-03-09 05:57:32 dovecot_plain authenticator failed for d54c70cda.static.telenet.be [84.199.12.218]:53730: 535 Incorrect authentication data (set_id=services@heipowersystem.com)84.199.12.2182802361W  -9) ossec13001gExim Auth failed2025-03-09 05:56:00 dovecot_login authenticator failed for ([60.173.105.206]) [60.173.105.206]:48758: 535 Incorrect authentication data (set_id=sales)60.173.105.2061814991g  -[' ossec13001gExim Auth failed2025-03-09 05:55:37 dovecot_login authenticator failed for ([14.53.126.112]) [14.53.126.112]:42174: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)14.53.126.1121835841 }pcVI</"yl_RE8+~qdWJ=0# zm`SF9, v i \ O B 5 (     r e X K > 1 $  { n a T G : -   w j ] P C 6 )    s f Y L ? 2 %  |obUH;.!xk^QD7*tgZM@3& uh[NA4' ~qdWJ=0ZNB6 62520012P 62520012N 62520012= 62520012, 62520012' 62520012$ 62520012 62520012 62520012 62520012 62520012 62520012 62520011 62520011 62520011 62520011 62520011 62520011 62520011 62520011 62520011 62520011 62520011 62520011 62520011 6252001+[ 6252001+Y 6252001+U 6252001+S 6252001+C 6252001+> 6252001+< 6252001+7 6252001+5 6252001+3 6252001+2 6252001+/ 6252001+& 6252001+ 6252001+ 6252001* 6252001* 6252001* 6252001* 6252001* 6252001* 6252001* 6252001* 6252001* 6252001* 6252001* 6252001* 6252001* 6252001* 6252001* 6252001*} 6252001*w 6252001*c 62520011 62520011 62520011 62520011z 62520011w 62520011^ 62520011] 62520011Z 62520011V 62520011U 62520011O 62520011K 62520011C 62520011B 625200112 62520011/ 62520011' 62520011% 62520011# 62520011" 62520011 62520011 62520011 62520011 62520011 62520011 62520011 62520011 62520011 62520010 62520010 62520010 62520010 62520010 62520010 62520010 62520010 62520010 62520010 62520010 62520010 62520010 62520010 62520010x 62520010w 62520010h 62520010g 62520010b 62520010Y 62520010X 62520010V 62520010I 62520010@ 62520010? 62520010> 625200108 625200105 625200103 625200101 62520010& 62520010 62520010 62520010 62520010 6252001/ 6252001/ 6252001/ 6252001/ 6252001/ 6252001/ 6252001/ 6252001/ 6252001/ 6252001/ 6252001/ 6252001/ 6252001/ 6252001/ 6252001/ 6252001/x 6252001/s 6252001/q 6252001/g 6252001/d 6252001/O 6252001/F 6252001/> 6252001/9 6252001/3 6252001/ 6252001. 6252001. 6252001. 6252001. 6252001. 6252001. 6252001. 6252001. 6252001. 6252001. 6252001. 6252001. 6252001. 6252001. 6252001. 6252001. 6252001. 6252001. 6252001. 6252001. 6252001.w 6252001.u 6252001.a 6252001.` 6252001.] 6252001.U 6252001.S 6252001.N 6252001.J 6252001.F 6252001.B 6252001.< 6252001.7 6252001.5 6252001.. 6252001. 6252001. 6252001- 6252001- 6252001- 6252001- 6252001- 6252001- 6252001- 6252001- 6252001- 6252001- 6252001- 6252001- 6252001- 6252001- 6252001- 6252001- 6252001- 6252001-} 6252001-| 6252001-_ 6252001-I 6252001-= 6252001-< 6252001-4 6252001-3 6252001-% 6252001-" 6252001- 6252001- 6252001- 6252001- 6252001- 6252001- 6252001, 6252001, 6252001, 6252001, 6252001, 6252001, 6252001, 6252001, 6252001, 6252001, 6252001, 6252001, 6252001,h 6252001,g 6252001,\ 6252001,[ 6252001,Q 6252001,> 6252001,7 6252001, 6252001, 6252001, 6252001+ 6252001+ 6252001+ 6252001+ 6252001+ 6252001+ 6252001+ 6252001+ 6252001+ 6252001+ 6252001+ 6252001+ 6252001+ 6252001+ 6252001+ 6252001+ 6252001+ 6252001+w 6252001+t 6252001+m 6252001+k 6252001+f 6252001+e 7 < a t +Yoj0  -_) ossec13001gXExim Auth failed2025-03-09 07:05:18 dovecot_plain authenticator failed for ([27.107.168.206]) [27.107.168.206]:51766: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)27.107.168.2061269750v/  -y' ossec13001gXExim Auth failed2025-03-09 07:05:18 dovecot_login authenticator failed for 111-70-42-100.emome-ip.hinet.net [111.70.42.100]:33968: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)111.70.42.1001668284W.  -9) ossec13001gExim Auth failed2025-03-09 07:06:05 dovecot_login authenticator failed for ([222.219.182.24]) [222.219.182.24]:36213: 535 Incorrect authentication data (set_id=sales)222.219.182.241814991f-  -]# ossec13001gExim Auth failed2025-03-09 07:06:01 dovecot_plain authenticator failed for syn-070-120-006-086.res.spectrum.com [70.120.6.86]:63024: 535 Incorrect authentication data (set_id=services)70.120.6.866252001N,  --# ossec13001gzExim Auth failed2025-03-09 07:05:52 dovecot_plain authenticator failed for ([61.233.4.50]) [61.233.4.50]:50972: 535 Incorrect authentication data (set_id=sales)61.233.4.501814991g+  -]% ossec13001gxExim Auth failed2025-03-09 07:05:51 dovecot_plain authenticator failed for ([60.174.231.6]) [60.174.231.6]:46983: 535 Incorrect authentication data (set_id=services@heipowersystem.com)60.174.231.61814991m*  -k% ossec13001gvExim Auth failed2025-03-09 07:05:49 dovecot_login authenticator failed for 77-85-52-109.ip.btc-net.bg [77.85.52.109]:43750: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)77.85.52.109732800U)  -7' ossec13001g+Exim Auth failed2025-03-09 07:00:19 dovecot_login authenticator failed for ([188.244.154.53]) [95.191.129.54]:53804: 535 Incorrect authentication data (set_id=sales)95.191.129.542017370g(  -[' ossec13001gExim Auth failed2025-03-09 06:59:53 dovecot_login authenticator failed for ([95.105.66.123]) [95.105.66.123]:53514: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)95.105.66.1232017370T'  -7% ossec13001gExim Auth failed2025-03-09 06:50:00 dovecot_plain authenticator failed for ([85.152.57.60]) [85.152.57.60]:57163: 535 Incorrect authentication data (set_id=services)85.152.57.602510769g&  -]% ossec13001gExim Auth failed2025-03-09 06:49:50 dovecot_plain authenticator failed for ([60.172.1.210]) [60.172.1.210]:41283: 535 Incorrect authentication data (set_id=services@heipowersystem.com)60.172.1.2101814991b%  -Q' ossec13001g5Exim Auth failed2025-03-09 06:47:40 dovecot_plain authenticator failed for 42-200-70-134.static.imsbiz.com [42.200.70.134]:51526: 535 Incorrect authentication data (set_id=sales)42.200.70.1341819730i$  -_) ossec13001g+Exim Auth failed2025-03-09 06:47:29 dovecot_plain authenticator failed for ([94.204.230.214]) [94.204.230.214]:34746: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)94.204.230.214290557W#  -;' ossec13001goExim Auth failed2025-03-09 06:44:22 dovecot_plain authenticator failed for ([46.29.121.110]) [46.29.121.110]:55760: 535 Incorrect authentication data (set_id=services)46.29.121.1103017382w"  -{' ossec13001geExim Auth failed2025-03-09 06:44:12 dovecot_plain authenticator failed for p285021-obmd01.tokyo.ocn.ne.jp [153.141.46.20]:46264: 535 Incorrect authentication data (set_id=services@heipowersystem.com)153.141.46.201861060Z!  -=+ ossec13001g<Exim Auth failed2025-03-09 06:39:15 dovecot_plain authenticator failed for ([211.247.127.250]) [211.247.127.250]:46554: 535 Incorrect authentication data (set_id=sales)211.247.127.2501835841g  -[' ossec13001g&Exim Auth failed2025-03-09 06:38:54 dovecot_plain authenticator failed for ([46.29.121.110]) [46.29.121.110]:52328: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)46.29.121.1103017382 ,B g y s y  "KZTA  -7% ossec13001gExim Auth failed2025-03-09 07:38:25 dovecot_plain authenticator failed for ([74.95.13.185]) [74.95.13.185]:53973: 535 Incorrect authentication data (set_id=services)74.95.13.1856252001m@  -e) ossec13001gExim Auth failed2025-03-09 07:38:14 dovecot_plain authenticator failed for ([207.219.221.53]) [207.219.221.53]:54057: 535 Incorrect authentication data (set_id=services@heipowersystem.com)207.219.221.536251999S?  -5' ossec13001gqExim Auth failed2025-03-09 07:31:21 dovecot_plain authenticator failed for ([91.219.196.17]) [91.219.196.17]:56414: 535 Incorrect authentication data (set_id=sales)91.219.196.17690791g>  -[' ossec13001gYExim Auth failed2025-03-09 07:30:56 dovecot_plain authenticator failed for ([114.216.5.134]) [114.216.5.134]:33220: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)114.216.5.1341814991T=  -5' ossec13001gExim Auth failed2025-03-09 07:29:21 dovecot_plain authenticator failed for ([114.30.180.58]) [114.30.180.58]:57949: 535 Incorrect authentication data (set_id=sales)114.30.180.581835841i<  -]) ossec13001gExim Auth failed2025-03-09 07:28:55 dovecot_plain authenticator failed for (host-185-26-197-131.net4life.it) [185.26.197.131]:40371: 535 Incorrect authentication data (set_id=services)185.26.197.1313175395g;  -]% ossec13001gExim Auth failed2025-03-09 07:28:46 dovecot_plain authenticator failed for ([60.166.8.174]) [60.166.8.174]:33397: 535 Incorrect authentication data (set_id=services@heipowersystem.com)60.166.8.1741814991v:  -w) ossec13001gExim Auth failed2025-03-09 07:29:10 dovecot_plain authenticator failed for 110-25-105-242.adsl.fetnet.net [110.25.105.242]:38535: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)110.25.105.2421668284j9  -_) ossec13001gExim Auth failed2025-03-09 07:16:27 dovecot_plain authenticator failed for ([113.64.208.228]) [113.64.208.228]:36604: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)113.64.208.2281814991r8  -q' ossec13001gExim Auth failed2025-03-09 07:15:19 dovecot_login authenticator failed for (173-29-118-52.client.mchsi.com) [173.29.118.52]:51193: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)173.29.118.526252001Z7  -?) ossec13001gExim Auth failed2025-03-09 07:15:03 dovecot_plain authenticator failed for ([128.185.253.66]) [128.185.253.66]:34462: 535 Incorrect authentication data (set_id=services)128.185.253.661269750v6  -y' ossec13001gExim Auth failed2025-03-09 07:14:59 dovecot_login authenticator failed for ([114.30.203.26]) [114.30.203.26]:34030: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)114.30.203.2618358415  - + ossec13001gExim Auth failed2025-03-09 07:14:32 dovecot_plain authenticator failed for 145.173.198.203.static.netvigator.com [203.198.173.145]:47095: 535 Incorrect authentication data (set_id=services@heipowersystem.com)203.198.173.1451819730j4  -_) ossec13001gFExim Auth failed2025-03-09 07:13:33 dovecot_plain authenticator failed for ([61.143.241.150]) [61.143.241.150]:48801: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)61.143.241.1501814991W3  -;' ossec13001gExim Auth failed2025-03-09 07:12:25 dovecot_login authenticator failed for ([120.133.17.20]) [120.133.17.20]:30556: 535 Incorrect authentication data (set_id=services)120.133.17.201814991f2  -[% ossec13001gExim Auth failed2025-03-09 07:11:58 dovecot_login authenticator failed for ([8.243.166.66]) [8.243.166.66]:4501: 535 Incorrect authentication data (set_id=services@heipowersystem.com)8.243.166.663686110P1  -/% ossec13001gdExim Auth failed2025-03-09 07:05:31 dovecot_login authenticator failed for ([8.243.166.66]) [8.243.166.66]:4501: 535 Incorrect authentication data (set_id=sales)8.243.166.663686110 6 H j t  Hpv}aR  -M) ossec13001gExim Auth failed2025-03-09 08:25:27 dovecot_login authenticator failed for zdomainaccess.com [216.70.114.230]:42650: 535 Incorrect authentication data (set_id=vikas.khandelwal)216.70.114.2306252001uQ  -u) ossec13001gExim Auth failed2025-03-09 08:25:18 dovecot_login authenticator failed for ([216.194.174.80]) [216.194.174.27]:47019: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)216.194.174.276252001vP  -}# ossec13001gExim Auth failed2025-03-09 08:15:47 dovecot_plain authenticator failed for syn-071-091-077-097.res.spectrum.com [71.91.77.97]:37315: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)71.91.77.976252001TO  -5' ossec13001gTExim Auth failed2025-03-09 08:09:16 dovecot_plain authenticator failed for ([27.45.235.148]) [27.45.235.148]:33530: 535 Incorrect authentication data (set_id=sales)27.45.235.1481814991TN  -7% ossec13001g Exim Auth failed2025-03-09 08:08:22 dovecot_plain authenticator failed for ([14.37.79.247]) [14.37.79.247]:50148: 535 Incorrect authentication data (set_id=services)14.37.79.2471835841jM  -_) ossec13001g@Exim Auth failed2025-03-09 08:08:54 dovecot_plain authenticator failed for ([220.77.245.227]) [220.77.245.227]:40758: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)220.77.245.2271835841gL  -]% ossec13001g Exim Auth failed2025-03-09 08:08:02 dovecot_plain authenticator failed for ([42.236.91.93]) [42.236.91.93]:46124: 535 Incorrect authentication data (set_id=services@heipowersystem.com)42.236.91.931814991ZK  -=+ ossec13001gUExim Auth failed2025-03-09 08:00:44 dovecot_plain authenticator failed for ([213.195.113.234]) [213.195.113.234]:36734: 535 Incorrect authentication data (set_id=sales)213.195.113.2342510769dJ  -W% ossec13001gGExim Auth failed2025-03-09 08:00:31 dovecot_plain authenticator failed for ([59.1.214.102]) [59.1.214.102]:42236: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)59.1.214.1021835841]I  -C+ ossec13001gExim Auth failed2025-03-09 07:53:16 dovecot_plain authenticator failed for ([185.132.229.196]) [185.132.229.196]:46085: 535 Incorrect authentication data (set_id=services)185.132.229.1963175395jH  -a' ossec13001gExim Auth failed2025-03-09 07:52:56 dovecot_plain authenticator failed for ([171.244.63.34]) [171.244.63.34]:18178: 535 Incorrect authentication data (set_id=services@heipowersystem.com)171.244.63.341562822bG  -O) ossec13001gExim Auth failed2025-03-09 07:42:43 dovecot_login authenticator failed for ([39.165.154.222]) [39.165.154.222]:44938: 535 Incorrect authentication data (set_id=vikas.khandelwal)39.165.154.2221814991rF  -q' ossec13001gExim Auth failed2025-03-09 07:42:29 dovecot_login authenticator failed for ([218.201.62.71]) [218.201.62.71]:45924: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)218.201.62.711814991ZE  -?) ossec13001gExim Auth failed2025-03-09 07:41:56 dovecot_plain authenticator failed for ([61.150.123.106]) [61.150.123.106]:52319: 535 Incorrect authentication data (set_id=services)61.150.123.1061814991jD  -a' ossec13001gExim Auth failed2025-03-09 07:41:33 dovecot_plain authenticator failed for ([67.55.189.215]) [67.55.189.215]:60446: 535 Incorrect authentication data (set_id=services@heipowersystem.com)67.55.189.2156252001XC  -;) ossec13001gExim Auth failed2025-03-09 07:41:17 dovecot_plain authenticator failed for ([159.223.250.131]) [161.35.200.202]:37302: 535 Incorrect authentication data (set_id=sales)161.35.200.2022921044jB  -_) ossec13001gExim Auth failed2025-03-09 07:41:07 dovecot_plain authenticator failed for ([186.148.187.91]) [186.148.187.91]:34639: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)186.148.187.913686110 \* , A A P c+J\jc  -a' ossec13001g 2Exim Auth failed2025-03-09 09:08:24 dovecot_plain authenticator failed for ([89.175.49.147]) [89.175.49.147]:59628: 535 Incorrect authentication data (set_id=services@heipowersystem.com)89.175.49.1472017370]b  -C+ ossec13001g NExim Auth failed2025-03-09 09:08:53 dovecot_plain authenticator failed for ([103.146.233.121]) [103.146.233.121]:44877: 535 Incorrect authentication data (set_id=services)103.146.233.1211269750ka  -_+ ossec13001g EExim Auth failed2025-03-09 09:04:29 dovecot_plain authenticator failed for ([200.217.53.25]) [200.216.168.226]:43931: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)200.216.168.2263469034W`  -;' ossec13001g IExim Auth failed2025-03-09 09:00:16 dovecot_plain authenticator failed for ([149.54.15.126]) [149.54.15.126]:32995: 535 Incorrect authentication data (set_id=services)149.54.15.1261149361f_  -]% ossec13001g 5Exim Auth failed2025-03-09 08:59:56 dovecot_plain authenticator failed for ([185.167.56.2]) [185.167.56.2]:53442: 535 Incorrect authentication data (set_id=services@heipowersystem.com)185.167.56.2617790T^  -5' ossec13001g AExim Auth failed2025-03-09 08:55:52 dovecot_plain authenticator failed for ([95.85.112.170]) [95.85.112.170]:18823: 535 Incorrect authentication data (set_id=sales)95.85.112.1701218197j]  -_) ossec13001g 1Exim Auth failed2025-03-09 08:55:36 dovecot_plain authenticator failed for ([61.138.165.118]) [61.138.165.118]:41166: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)61.138.165.1181814991t\  -w% ossec13001g ZExim Auth failed2025-03-09 08:52:02 dovecot_plain authenticator failed for h77-53-111-65.cust.bredband2.com [77.53.111.65]:51886: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)77.53.111.652661886m[  -c+ ossec13001g @Exim Auth failed2025-03-09 08:51:36 dovecot_plain authenticator failed for ([124.225.185.148]) [124.225.185.148]:54606: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)124.225.185.1481814991QZ  -3# ossec13001gExim Auth failed2025-03-09 08:46:14 dovecot_plain authenticator failed for ([59.12.201.7]) [59.12.201.7]:59681: 535 Incorrect authentication data (set_id=services)59.12.201.71835841iY  -a' ossec13001gExim Auth failed2025-03-09 08:45:28 dovecot_plain authenticator failed for ([178.61.149.64]) [178.61.149.64]:37667: 535 Incorrect authentication data (set_id=services@heipowersystem.com)178.61.149.64285570mX  -e) ossec13001gExim Auth failed2025-03-09 08:36:45 dovecot_plain authenticator failed for ([41.159.145.190]) [41.159.145.190]:47161: 535 Incorrect authentication data (set_id=services@heipowersystem.com)41.159.145.1902400553|W  -) ossec13001gExim Auth failed2025-03-09 08:37:02 dovecot_plain authenticator failed for customer-ip-193-151-51-223.ipv.net.pl ([91.227.103.222]) [193.151.51.223]:48594: 535 Incorrect authentication data (set_id=sales)193.151.51.223798544gV  -[' ossec13001gExim Auth failed2025-03-09 08:36:49 dovecot_plain authenticator failed for ([46.52.204.227]) [46.52.204.227]:49536: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)46.52.204.2272017370zU  -) ossec13001gExim Auth failed2025-03-09 08:33:22 dovecot_plain authenticator failed for (ip-103-133.222-205.cloudteknologinusantara.co.id) [125.163.69.199]:33944: 535 Incorrect authentication data (set_id=services)125.163.69.1991643084dT  -Y# ossec13001gExim Auth failed2025-03-09 08:33:09 dovecot_plain authenticator failed for ([5.166.68.89]) [5.166.68.89]:54440: 535 Incorrect authentication data (set_id=services@heipowersystem.com)5.166.68.892017370jS  -a' ossec13001gExim Auth failed2025-03-09 08:27:42 dovecot_plain authenticator failed for ([46.29.121.110]) [46.29.121.110]:34004: 535 Incorrect authentication data (set_id=services@heipowersystem.com)46.29.121.1103017382 7 B g p  /K]|"t  3M% ossec11301gpNew FTP connection.Mar 9 09:52:07 vm1 pure-ftpd[3497638]: (?@139.162.77.6) [INFO] New connection from 139.162.77.6139.162.77.61861060Ws  -;' ossec13001g~Exim Auth failed2025-03-09 09:48:04 dovecot_plain authenticator failed for ([223.71.98.202]) [223.71.98.202]:34438: 535 Incorrect authentication data (set_id=services)223.71.98.2021814991r  - ' ossec13001grExim Auth failed2025-03-09 09:47:53 dovecot_plain authenticator failed for broadband-188-32-170-20.ip.moscow.rt.ru [188.32.170.20]:56008: 535 Incorrect authentication data (set_id=services@heipowersystem.com)188.32.170.202017370Yq  -A% ossec13001g Exim Auth failed2025-03-09 09:46:10 dovecot_plain authenticator failed for vps-0b1302de.vps.ovh.net [51.91.10.114]:54808: 535 Incorrect authentication data (set_id=sales)51.91.10.1143017382jp  -_) ossec13001gExim Auth failed2025-03-09 09:45:53 dovecot_plain authenticator failed for ([221.130.87.125]) [221.130.87.125]:54579: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)221.130.87.1251814991`o  -Q# ossec13001g]Exim Auth failed2025-03-09 09:30:27 dovecot_plain authenticator failed for 111-70-32-5.emome-ip.hinet.net [111.70.32.5]:41823: 535 Incorrect authentication data (set_id=services)111.70.32.51668284mn  -c+ ossec13001gYExim Auth failed2025-03-09 09:30:24 dovecot_plain authenticator failed for ([103.146.233.121]) [103.146.233.121]:35586: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)103.146.233.1211269750mm  -e) ossec13001gKExim Auth failed2025-03-09 09:30:09 dovecot_plain authenticator failed for mail-02.03.perm.ru [46.146.210.180]:60135: 535 Incorrect authentication data (set_id=services@heipowersystem.com)46.146.210.1802017370%l  3Q' ossec11301gyNew FTP connection.Mar 9 09:26:39 vm1 pure-ftpd[3492463]: (?@198.235.24.95) [INFO] New connection from 198.235.24.95198.235.24.956252001Sk  -7% ossec13001gExim Auth failed2025-03-09 09:24:09 dovecot_plain authenticator failed for ([91.74.186.57]) [91.74.186.57]:45383: 535 Incorrect authentication data (set_id=services)91.74.186.57290557j  -+ ossec13001gExim Auth failed2025-03-09 09:23:59 dovecot_plain authenticator failed for net-188-219-104-210.cust.vodafonedsl.it [188.219.104.210]:40103: 535 Incorrect authentication data (set_id=services@heipowersystem.com)188.219.104.2103175395Si  -5' ossec13001gExim Auth failed2025-03-09 09:19:46 dovecot_plain authenticator failed for ([46.30.161.197]) [46.30.161.197]:45420: 535 Incorrect authentication data (set_id=sales)46.30.161.197690791sh  -s) ossec13001gExim Auth failed2025-03-09 09:19:36 dovecot_plain authenticator failed for 212-72-203-252.ip.btc-net.bg [212.72.203.252]:36204: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)212.72.203.252732800Wg  -;' ossec13001g$Exim Auth failed2025-03-09 09:16:42 dovecot_login authenticator failed for ([211.252.94.26]) [211.252.94.26]:54773: 535 Incorrect authentication data (set_id=services)211.252.94.261835841qf  -o' ossec13001g Exim Auth failed2025-03-09 09:16:20 dovecot_login authenticator failed for vps-926fddc5.vps.ovh.net [79.137.82.102]:58364: 535 Incorrect authentication data (set_id=services@heipowersystem.com)79.137.82.1023017382Ze  -=+ ossec13001g@Exim Auth failed2025-03-09 09:12:54 dovecot_plain authenticator failed for ([199.188.103.179]) [199.188.103.179]:56304: 535 Incorrect authentication data (set_id=sales)199.188.103.1796252001gd  -[' ossec13001g6Exim Auth failed2025-03-09 09:12:44 dovecot_plain authenticator failed for ([183.47.48.178]) [183.47.48.178]:57267: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)183.47.48.1781814991 *\~tj`VLB8.$zpf\H>4*   v l b X N D : 0 &    ~ t j ` V L B 8 . $    z p f \ R H > 4 *  vlXbND:0&|rh^TJ@6,"xndZFP<2( `~tjVLB8.$zpf\ | r h ^ T J @ 6 , "    x n d Z P F < 2 (   RRH>4*  vlbXND:0& g[&i gY&h gY&g gY&f gY&e gW &d gV&c gV~&b gVt&a gU&` gU&_ gU&^ gU&] gT&\ gS&[ gT &Z gR&Y gR&X gR&W gR&V gP&U gP&T gP&S gP&R gO&Q gO&P gN&O gN&N gN&M gN&L gL&K gL&J gL&I gL&H gI&G gI&F gI1&E gI&D gFX&C gF:&B gF&A gF&@ gE.&? gE&> gD&= gDp&< gB &; gA&: gA&9 g@M&8 g@W&7 g?&6 g>"&5 g>&4 g<&3 g<&2 g<&1 g<&0 g<"&/ g;&. g;&- g:A&, g:/&+ g9&* g9&) g6&( g6&' g5l&& g5R&% g4&$ g4&# g3&" g3&! g2& g2& g1& g0& g0& g/& g/& g.& g.& g.& g,& g,& g,& g+& g*{& g*& g)& g)& g(& g(& g'& g'& g&0& g&(& g%& g%& g$& g"& g"& g!}& g!& g & g & g% g>% g(% g% g% g% g% g% g% g % g% gp% g~% gr% g % g% g]% gY% gK% gy% g% g% g% g% g$% g % g@% g6% g N% g 2% g E% g I% g 5% g A% g 1% g Z% g @% g% g% g% g% g% g% g% g% g% g% g% gT% g@% g % g % gU% gG% g% g% g% g% g% g% g% g% g% g% gq& gq!& gq& gpw& gp]& gpU& go& go& go& go& go& go& gn~& gn|& gnr& gnf& gl& gl& gl& gk& gk& gj{& gjk&~ gh&{ gh&} gh&| gg &y gf&x gf&z gf&w gd&v gd&u ga&s ga&t g`&r g_{&q g_[&p g]&o g]&l g]&n g]&m g[&k g[&j gq% gY% g% g% g% g% g% g% g% g% g% gF% g% g% g% g% gz% gx% gv% gd% gX% gX% g+% g% g% g% g5% g+% go% ge% g<% g&% g% g% g % g% g% g% g% g% gg% gQ% gs& g % g% g4% g% gv% g% g% g% g% gk% gQ% g% gݹ% g3% g% gۿ% gb% gV% g% g٘% g % g% g% g%~ g%} g%| g%{ gӼ%z gx%y gL%x gr%w gd%v g]%u gO%t g7%s g%r gε%q g̓%o gq%n gk%p gY%m g%l G) < [ s "GW  -;' ossec13001g"Exim Auth failed2025-03-09 10:41:04 dovecot_plain authenticator failed for ([125.20.46.114]) [125.20.46.114]:60778: 535 Incorrect authentication data (set_id=services)125.20.46.1141269750p  -i+ ossec13001g"Exim Auth failed2025-03-09 10:40:43 dovecot_plain authenticator failed for ([124.197.135.208]) [124.197.135.208]:43754: 535 Incorrect authentication data (set_id=services@heipowersystem.com)124.197.135.2081835841m  -e) ossec13001g!}Exim Auth failed2025-03-09 10:34:59 dovecot_plain authenticator failed for ([130.250.134.35]) [130.250.134.35]:56730: 535 Incorrect authentication data (set_id=services@heipowersystem.com)130.250.134.356252001W  -;' ossec13001g!Exim Auth failed2025-03-09 10:35:11 dovecot_plain authenticator failed for ([218.28.77.206]) [218.28.77.206]:45122: 535 Incorrect authentication data (set_id=services)218.28.77.2061814991N  --# ossec13001g Exim Auth failed2025-03-09 10:31:23 dovecot_plain authenticator failed for ([50.81.70.80]) [50.81.70.80]:33848: 535 Incorrect authentication data (set_id=sales)50.81.70.806252001g  -[' ossec13001g Exim Auth failed2025-03-09 10:30:49 dovecot_plain authenticator failed for ([186.177.88.96]) [186.177.88.96]:34510: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)186.177.88.9636240604  =c) ossec13008gMail Reciepient rejected2025-03-09 10:28:17 H=(mail.gurukuljaipur.com) [165.154.213.78]:52961 F= rejected RCPT : Rejected relay attempt: '165.154.213.78' From: 'tppqz@gurukuljaipur.com' To: 'goofile@fastmail.com'165.154.213.783469034Z~  -=+ ossec13001g>Exim Auth failed2025-03-09 10:21:09 dovecot_plain authenticator failed for ([207.219.221.101]) [207.219.221.101]:60031: 535 Incorrect authentication data (set_id=sales)207.219.221.1016251999a}  -S# ossec13001g(Exim Auth failed2025-03-09 10:20:48 dovecot_plain authenticator failed for ([81.22.58.11]) [81.22.58.11]:50786: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)81.22.58.112017370}|  -' ossec13001gExim Auth failed2025-03-09 10:18:07 dovecot_plain authenticator failed for syn-024-090-169-209.res.spectrum.com [24.90.169.209]:58565: 535 Incorrect authentication data (set_id=services@heipowersystem.com)24.90.169.2096252001f{  -W) ossec13001gExim Auth failed2025-03-09 10:14:19 dovecot_plain authenticator failed for 125-228-154-55.hinet-ip.hinet.net [125.228.154.55]:56842: 535 Incorrect authentication data (set_id=sales)125.228.154.551668284jz  -_) ossec13001gExim Auth failed2025-03-09 10:14:10 dovecot_plain authenticator failed for ([113.64.208.228]) [113.64.208.228]:58066: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)113.64.208.2281814991dy  -W% ossec13001gExim Auth failed2025-03-09 10:06:32 dovecot_plain authenticator failed for ([183.6.102.11]) [183.6.102.11]:40086: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)183.6.102.111814991]x  -C+ ossec13001gExim Auth failed2025-03-09 09:58:17 dovecot_plain authenticator failed for ([185.132.229.196]) [185.132.229.196]:37350: 535 Incorrect authentication data (set_id=services)185.132.229.1963175395iw  -a' ossec13001gExim Auth failed2025-03-09 09:57:59 dovecot_plain authenticator failed for ([91.75.105.190]) [91.75.105.190]:40588: 535 Incorrect authentication data (set_id=services@heipowersystem.com)91.75.105.190290557fv  -W) ossec13001g Exim Auth failed2025-03-09 09:55:03 dovecot_plain authenticator failed for 202-188-035-194.ip-addr.vsenet.de [194.35.188.202]:44368: 535 Incorrect authentication data (set_id=sales)194.35.188.2022921044iu  -]) ossec13001gExim Auth failed2025-03-09 09:54:55 dovecot_plain authenticator failed for ([222.128.44.171]) [222.128.44.171]:2061: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)222.128.44.1711814991 $ I N s  ;J]W  -;' ossec13001g,Exim Auth failed2025-03-09 11:23:41 dovecot_plain authenticator failed for ([211.57.78.222]) [211.57.78.222]:52607: 535 Incorrect authentication data (set_id=services)211.57.78.2221835841T  -3) ossec13001g,Exim Auth failed2025-03-09 11:23:32 dovecot_plain authenticator failed for p278251-obmd01.tokyo.ocn.ne.jp [180.41.109.250]:49694: 535 Incorrect authentication data180.41.109.2501861060i  -a' ossec13001g,Exim Auth failed2025-03-09 11:23:00 dovecot_plain authenticator failed for ([91.239.23.149]) [91.239.23.149]:45256: 535 Incorrect authentication data (set_id=services@heipowersystem.com)91.239.23.149458258m  -e) ossec13001g+Exim Auth failed2025-03-09 11:18:06 dovecot_plain authenticator failed for ([220.80.192.168]) [220.80.192.168]:58156: 535 Incorrect authentication data (set_id=services@heipowersystem.com)220.80.192.1681835841a  -S# ossec13001g*{Exim Auth failed2025-03-09 11:13:23 dovecot_plain authenticator failed for ([14.98.28.43]) [14.98.28.43]:56176: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)14.98.28.431269750Z  -=+ ossec13001g*Exim Auth failed2025-03-09 11:13:35 dovecot_plain authenticator failed for ([104.193.103.213]) [104.193.103.213]:52539: 535 Incorrect authentication data (set_id=sales)104.193.103.2136252001Y  -;+ ossec13001g)Exim Auth failed2025-03-09 11:10:18 dovecot_plain authenticator failed for ([114.143.224.97]) [182.156.135.216]:47881: 535 Incorrect authentication data (set_id=sales)182.156.135.2161269750g  -[' ossec13001g)Exim Auth failed2025-03-09 11:10:08 dovecot_plain authenticator failed for ([173.29.118.52]) [173.29.118.52]:58186: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)173.29.118.526252001]  -C+ ossec13001g(Exim Auth failed2025-03-09 11:06:20 dovecot_plain authenticator failed for ([181.233.140.250]) [181.233.140.250]:49589: 535 Incorrect authentication data (set_id=services)181.233.140.2503469034|  -) ossec13001g(Exim Auth failed2025-03-09 11:06:03 dovecot_plain authenticator failed for 125-228-225-91.hinet-ip.hinet.net [125.228.225.91]:55562: 535 Incorrect authentication data (set_id=services@heipowersystem.com)125.228.225.911668284Z  -?) ossec13001g'Exim Auth failed2025-03-09 11:01:23 dovecot_plain authenticator failed for ([31.220.168.116]) [31.220.168.116]:57983: 535 Incorrect authentication data (set_id=services)31.220.168.1162017370j  -a' ossec13001g'Exim Auth failed2025-03-09 11:00:51 dovecot_plain authenticator failed for ([61.185.30.170]) [61.185.30.170]:53478: 535 Incorrect authentication data (set_id=services@heipowersystem.com)61.185.30.1701814991W  -=% ossec13001g&0Exim Auth failed2025-03-09 10:55:03 dovecot_login authenticator failed for (broadband.actcorp.in) [106.51.29.53]:44926: 535 Incorrect authentication data (set_id=sales)106.51.29.531269750w  -}' ossec13001g&(Exim Auth failed2025-03-09 10:54:55 dovecot_login authenticator failed for bzq-109-67-154-24.red.bezeqint.net [109.67.154.24]:44458: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)109.67.154.24294640W  -9) ossec13001g%Exim Auth failed2025-03-09 10:53:30 dovecot_plain authenticator failed for ([120.82.196.131]) [120.82.196.131]:59613: 535 Incorrect authentication data (set_id=sales)120.82.196.1311814991g  -[' ossec13001g%Exim Auth failed2025-03-09 10:53:03 dovecot_plain authenticator failed for ([93.102.155.19]) [93.102.155.19]:45612: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)93.102.155.192264397m  -c+ ossec13001g$Exim Auth failed2025-03-09 10:48:28 dovecot_plain authenticator failed for ([220.180.166.214]) [220.180.166.214]:41229: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)220.180.166.2141814991 ~qdWJ=0# zm`SF9, v i \ O B 5 (     r e X K > 1 $  { n a T G : -   w j ] P C 6 )    s f Y L ? 2 %  |obUH;.!xk^QD7*tgZM@3& }pcVI</"yl_RE8+uh[NA4' ~qdWJ=0 18149910 18149910 18149910 18149910 18149910 18149910z 18149910y 18149910s 18149910n 18149910i 18149910d 18149910_ 18149910] 18149910J 18149910 18149910 18149910 18149910 18149910 18149910 18149910 18149910 18149910 1814991/ 1814991/ 1814991/ 1814991/ 1814991/ 1814991/ 1814991/ 1814991/ 1814991/ 1814991/ 1814991/ 1814991/ 1814991/ 1814991/ 1814991/ 1814991/ 1814991/ 1814991/ 1814991/ 1814991/ 1814991/ 1814991/ 1814991/ 1814991/ 1814991/ 1814991/ 1814991/ 1814991/ 1814991/| 1814991/r 1814991/n 1814991/m 1814991/a 1814991/` 1814991/^ 1814991/] 1814991/Z 1814991/R 1814991/N 1814991/L 1814991/J 1814991/H 1814991/G 1814991/@ 1814991/; 1814991/8 1814991/* 1814991/# 1814991/ 1814991/ 1814991/ 1814991/ 1814991. 1814991. 1814991. 1814991. 1814991. 1814991. 1814991. 1814991. 1814991. 1814991. 1814991. 1814991. 1814991. 1814991. 1814991. 1814991. 1814991. 1814991. 1814991. 1814991. 1814991. 1814991. 1814991. 1814991. 1814991. 1814991. 1814991. 1814991. 1814991. 1814991. 1814991. 1814991.l 1814991.f 1814991._ 1814991.O 1814991.E 1814991.A 1814991.= 1814991.: 1814991.9 1814991.4 1814991.0 1814991.+ 1814991. 1814991. 1814991. 1814991. 1814991. 1814991. 1814991. 1814991. 1814991- 1814991- 1814991- 1814991- 1814991- 1814991- 1814991- 1814991- 1814991- 1814991- 1814991- 1814991- 1814991- 1814991- 1814991- 1814991- 1814991- 1814991- 1814991- 1814991- 1814991- 1814991- 1814991- 1814991- 1814991- 1814991- 1814991- 1814991- 1814991- 1814991- 1814991-z 1814991-w 1814991-t 1814991-r 1814991-q 1814991-o 1814991-n 1814991-f 1814991-e 1814991-c 1814991-a 1814991-[ 1814991-W 1814991-V 1814991-P 1814991-N 1814991-G 1814991-E 1814991-8 1814991-1 1814991-. 1814991-, 1814991-( 1814991-$ 1814991-# 1814991- 1814991- 1814991- 1814991- 1814991, 1814991, 1814991, 1814991, 1814991, 1814991, 1814991, 1814991, 1814991, 1814991, 1814991, 1814991, 1814991, 1814991, 1814991, 1814991, 1814991, 1814991, 1814991, 1814991, 1814991, 1814991, 1814991, 1814991, 1814991, 1814991, 1814991, 1814991,t 1814991,n 1814991,i 1814991,e 1814991,` 1814991,O 1814991,M 1814991,L 1814991,H 1814991,E 1814991,C 1814991,; 1814991,3 1814991, 1814991, 1814991, 1814991, 1814991, 1814991+ 1814991+ 1814991+ 1814991+ 1814991+ 1814991+ 1814991+ 1814991+ @ U  0 XXXshT&  -5' ossec13001g5lExim Auth failed2025-03-09 12:00:02 dovecot_login authenticator failed for ([121.65.54.204]) [121.65.54.204]:50172: 535 Incorrect authentication data (set_id=sales)121.65.54.2041835841j%  -_) ossec13001g5RExim Auth failed2025-03-09 11:59:36 dovecot_login authenticator failed for ([192.199.58.185]) [192.199.58.185]:41370: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)192.199.58.1856251999S$  -5% ossec13001g4Exim Auth failed2025-03-09 11:56:25 dovecot_plain authenticator failed for ([102.110.7.41]) [102.110.7.41]:2736: 535 Incorrect authentication data (set_id=services)102.110.7.412464461j#  -a' ossec13001g4Exim Auth failed2025-03-09 11:56:14 dovecot_plain authenticator failed for ([58.253.194.26]) [58.253.194.26]:50759: 535 Incorrect authentication data (set_id=services@heipowersystem.com)58.253.194.261814991_"  -K' ossec13001g3Exim Auth failed2025-03-09 11:52:27 dovecot_plain authenticator failed for ([125.69.76.148]) [125.69.76.148]:46085: 535 Incorrect authentication data (set_id=vikas.khandelwal)125.69.76.1481814991!  -) ossec13001g3Exim Auth failed2025-03-09 11:52:14 dovecot_plain authenticator failed for 123.149.48.116.static.netvigator.com [116.48.149.123]:53660: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)116.48.149.1231819730a  -O' ossec13001g2Exim Auth failed2025-03-09 11:48:51 dovecot_plain authenticator failed for d54c70cda.static.telenet.be [84.199.12.218]:54594: 535 Incorrect authentication data (set_id=services)84.199.12.2182802361|  -) ossec13001g2Exim Auth failed2025-03-09 11:48:35 dovecot_plain authenticator failed for 125-228-225-91.hinet-ip.hinet.net [125.228.225.91]:46355: 535 Incorrect authentication data (set_id=services@heipowersystem.com)125.228.225.911668284|  -) ossec13001g1Exim Auth failed2025-03-09 11:43:35 dovecot_plain authenticator failed for 227.42.246.220.static.netvigator.com [220.246.42.227]:60401: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)220.246.42.2271819730T  -7% ossec13001g0Exim Auth failed2025-03-09 11:39:28 dovecot_plain authenticator failed for ([85.19.195.12]) [85.19.195.12]:47152: 535 Incorrect authentication data (set_id=services)85.19.195.123144096e  -]% ossec13001g0Exim Auth failed2025-03-09 11:39:16 dovecot_plain authenticator failed for ([46.161.196.5]) [46.161.196.5]:33032: 535 Incorrect authentication data (set_id=services@heipowersystem.com)46.161.196.599237n -c+ ossec13001g/Exim Auth failed2025-03-09 11:36:17 dovecot_plain authenticator failed for ([181.233.140.250]) [181.233.140.250]:50556: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)181.233.140.2503469034F  =+ ossec13008g/Mail Reciepient rejected2025-03-09 11:35:32 H=(mail.heipowersystem.com) [165.154.213.166]:52659 F= rejected RCPT : Rejected relay attempt: '165.154.213.166' From: 'mtrwjjjpdpr@heipowersystem.com' To: 'goofile@fastmail.com'165.154.213.1663469034g  -[' ossec13001g.Exim Auth failed2025-03-09 11:32:25 dovecot_plain authenticator failed for ([46.73.156.221]) [46.73.156.221]:52700: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)46.73.156.2212017370K  -)! ossec13001g.Exim Auth failed2025-03-09 11:31:16 dovecot_login authenticator failed for ([45.6.80.40]) [45.6.80.40]:49996: 535 Incorrect authentication data (set_id=sales)45.6.80.403469034m  -c+ ossec13001g.Exim Auth failed2025-03-09 11:31:04 dovecot_login authenticator failed for ([222.112.246.217]) [222.112.246.217]:33461: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)222.112.246.2171835841 ". = b q ==P_Z7  -?) ossec13001g@WExim Auth failed2025-03-09 12:46:37 dovecot_plain authenticator failed for ([216.194.174.27]) [216.194.174.27]:28384: 535 Incorrect authentication data (set_id=services)216.194.174.276252001m6  -c+ ossec13001g?Exim Auth failed2025-03-09 12:45:01 dovecot_plain authenticator failed for ([103.115.254.158]) [103.115.254.158]:39487: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)103.115.254.1581210997i5  -[+ ossec13001g>"Exim Auth failed2025-03-09 12:37:13 dovecot_plain authenticator failed for ([222.236.155.146]) [222.236.155.146]:34133: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)222.236.155.1461835841|4  -+ ossec13001g>Exim Auth failed2025-03-09 12:36:56 dovecot_plain authenticator failed for ([121.178.185.141]) [121.178.185.141]:55190: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)121.178.185.1411835841]3  -C+ ossec13001g<Exim Auth failed2025-03-09 12:31:58 dovecot_plain authenticator failed for ([163.204.112.147]) [163.204.112.147]:58376: 535 Incorrect authentication data (set_id=services)163.204.112.1471814991p2  -i+ ossec13001g<Exim Auth failed2025-03-09 12:31:34 dovecot_plain authenticator failed for ([182.163.122.133]) [182.163.122.133]:19019: 535 Incorrect authentication data (set_id=services@heipowersystem.com)182.163.122.1331210997T1  -5' ossec13001g<Exim Auth failed2025-03-09 12:30:36 dovecot_plain authenticator failed for ([95.85.112.170]) [95.85.112.170]:47259: 535 Incorrect authentication data (set_id=sales)95.85.112.1701218197g0  -[' ossec13001g<Exim Auth failed2025-03-09 12:30:27 dovecot_plain authenticator failed for ([59.46.185.130]) [59.46.185.130]:54537: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)59.46.185.1301814991Y/ -?% ossec13001g<"Exim Auth failed2025-03-09 12:28:41 dovecot_login authenticator failed for (fablixsolutions.com) [119.96.131.8]:55458: 535 Incorrect authentication data (set_id=nologin)119.96.131.81814991r.  -q' ossec13001g;Exim Auth failed2025-03-09 12:26:24 dovecot_plain authenticator failed for (172-125-13-11.lightspeed.rcsntx.sbcglobal.net) [172.125.13.11]:60631: 535 Incorrect authentication data (set_id=sales)172.125.13.116252001j-  -_) ossec13001g;Exim Auth failed2025-03-09 12:26:13 dovecot_plain authenticator failed for ([220.179.249.21]) [220.179.249.21]:55325: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)220.179.249.211814991W,  -;' ossec13001g:AExim Auth failed2025-03-09 12:20:41 dovecot_plain authenticator failed for ([59.48.175.202]) [59.48.175.202]:48284: 535 Incorrect authentication data (set_id=services)59.48.175.2021814991m+  -e) ossec13001g:/Exim Auth failed2025-03-09 12:20:22 dovecot_plain authenticator failed for ([164.164.117.23]) [164.164.117.23]:39392: 535 Incorrect authentication data (set_id=services@heipowersystem.com)164.164.117.231269750W*  -9) ossec13001g9Exim Auth failed2025-03-09 12:19:10 dovecot_plain authenticator failed for ([151.49.116.193]) [151.49.116.193]:45699: 535 Incorrect authentication data (set_id=sales)151.49.116.1933175395m)  -c+ ossec13001g9Exim Auth failed2025-03-09 12:19:00 dovecot_plain authenticator failed for ([124.197.135.208]) [124.197.135.208]:44686: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)124.197.135.2081835841p(  -q# ossec13001g6Exim Auth failed2025-03-09 12:05:51 dovecot_plain authenticator failed for 37.151.71.8.dynamic.telecom.kz [37.151.71.8]:51488: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)37.151.71.81522867Z'  -=+ ossec13001g6Exim Auth failed2025-03-09 12:06:04 dovecot_plain authenticator failed for ([123.209.118.166]) [123.209.118.166]:34736: 535 Incorrect authentication data (set_id=sales)123.209.118.1662077456 f  0 U = S ~#*MfcH  -W% ossec13001gLExim Auth failed2025-03-09 13:39:19 dovecot_plain authenticator failed for ([5.11.164.165]) [5.11.164.165]:35460: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)5.11.164.165298795YG  -C# ossec13001gIExim Auth failed2025-03-09 13:26:52 dovecot_login authenticator failed for ([59.0.60.158]) [59.0.60.158]:38980: 535 Incorrect authentication data (set_id=vikas.khandelwal)59.0.60.1581835841uF  -u) ossec13001gIExim Auth failed2025-03-09 13:26:15 dovecot_login authenticator failed for ([119.62.184.137]) [119.62.184.137]:38341: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)119.62.184.1371814991QE  -1% ossec13001gI1Exim Auth failed2025-03-09 13:24:25 dovecot_plain authenticator failed for ([202.84.34.85]) [202.84.34.85]:47512: 535 Incorrect authentication data (set_id=sales)202.84.34.851210997mD  -c+ ossec13001gIExim Auth failed2025-03-09 13:23:51 dovecot_plain authenticator failed for ([175.145.232.217]) [175.145.232.217]:33964: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)175.145.232.2171733045gC  -[' ossec13001gFXExim Auth failed2025-03-09 13:12:16 dovecot_plain authenticator failed for syn-024-090-169-209.res.spectrum.com [24.90.169.209]:43686: 535 Incorrect authentication data (set_id=sales)24.90.169.2096252001gB  -[' ossec13001gF:Exim Auth failed2025-03-09 13:11:44 dovecot_plain authenticator failed for ([183.105.3.221]) [183.105.3.221]:32950: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)183.105.3.2211835841lA  -c) ossec13001gFExim Auth failed2025-03-09 13:11:04 dovecot_plain authenticator failed for syn-075-191-221-158.res.spectrum.com [75.191.221.158]:33591: 535 Incorrect authentication data (set_id=services)75.191.221.1586252001j@  -a' ossec13001gFExim Auth failed2025-03-09 13:10:52 dovecot_plain authenticator failed for ([49.124.149.49]) [49.124.149.49]:38712: 535 Incorrect authentication data (set_id=services@heipowersystem.com)49.124.149.491733045]? -C) ossec13001gE.Exim Auth failed2025-03-09 13:07:17 dovecot_login authenticator failed for (fablixsolutions.com) [124.160.63.122]:47217: 535 Incorrect authentication data (set_id=nologin)124.160.63.1221814991Q>  -3# ossec13001gEExim Auth failed2025-03-09 13:06:39 dovecot_plain authenticator failed for ([14.98.28.43]) [14.98.28.43]:42698: 535 Incorrect authentication data (set_id=services)14.98.28.431269750f=  -]% ossec13001gDExim Auth failed2025-03-09 13:06:23 dovecot_plain authenticator failed for ([94.204.96.91]) [94.204.96.91]:42703: 535 Incorrect authentication data (set_id=services@heipowersystem.com)94.204.96.91290557<  -5' ossec13001gDpExim Auth failed2025-03-09 13:04:06 dovecot_plain authenticator failed for host-88-43-231-186.business.telecomitalia.it ([88.43.231.188]) [88.43.231.186]:59432: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)88.43.231.1863175395W;  -;' ossec13001gB Exim Auth failed2025-03-09 12:53:54 dovecot_plain authenticator failed for ([219.248.65.30]) [219.248.65.30]:47418: 535 Incorrect authentication data (set_id=services)219.248.65.301835841j:  -a' ossec13001gAExim Auth failed2025-03-09 12:53:43 dovecot_plain authenticator failed for ([211.58.49.145]) [211.58.49.145]:58272: 535 Incorrect authentication data (set_id=services@heipowersystem.com)211.58.49.1451835841j9  -a' ossec13001gAExim Auth failed2025-03-09 12:53:27 dovecot_plain authenticator failed for ([220.92.25.189]) [220.92.25.189]:39685: 535 Incorrect authentication data (set_id=services@heipowersystem.com)220.92.25.1891835841p8  -i+ ossec13001g@MExim Auth failed2025-03-09 12:46:28 dovecot_plain authenticator failed for ([165.154.202.101]) [165.154.202.101]:38786: 535 Incorrect authentication data (set_id=services@heipowersystem.com)165.154.202.1016252001 C k ))8[QY  -1% ossec13001gRExim Auth failed2025-03-09 14:05:23 dovecot_plain authenticator failed for ([98.70.127.17]) [98.70.127.17]:54380: 535 Incorrect authentication data (set_id=sales)98.70.127.171269750YX  -?) ossec13001gRExim Auth failed2025-03-09 14:05:23 dovecot_plain authenticator failed for ([185.167.58.121]) [185.167.58.121]:57686: 535 Incorrect authentication data (set_id=services)185.167.58.121617790mW  -e) ossec13001gRExim Auth failed2025-03-09 14:05:10 dovecot_plain authenticator failed for ([50.188.204.213]) [50.188.204.213]:58962: 535 Incorrect authentication data (set_id=services@heipowersystem.com)50.188.204.2136252001|V  -) ossec13001gRExim Auth failed2025-03-09 14:05:04 dovecot_plain authenticator failed for 209.66.246.220.static.netvigator.com [220.246.66.209]:64999: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)220.246.66.2091819730jU  -_) ossec13001gPExim Auth failed2025-03-09 13:57:02 dovecot_plain authenticator failed for (94.124.156.175.unknown.m1.com.sg) [175.156.124.94]:34031: 535 Incorrect authentication data (set_id=services)175.156.124.941880251fT  -W) ossec13001gPExim Auth failed2025-03-09 13:56:56 dovecot_plain authenticator failed for 125-228-154-55.hinet-ip.hinet.net [125.228.154.55]:53064: 535 Incorrect authentication data (set_id=sales)125.228.154.551668284yS  -% ossec13001gPExim Auth failed2025-03-09 13:56:49 dovecot_plain authenticator failed for static-84-242-88-70.bb.vodafone.cz [84.242.88.70]:36672: 535 Incorrect authentication data (set_id=services@heipowersystem.com)84.242.88.703077311uR  -w' ossec13001gPExim Auth failed2025-03-09 13:56:45 dovecot_plain authenticator failed for 46.79-160-128.customer.lyse.net [79.160.128.46]:32816: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)79.160.128.463144096WQ  -;' ossec13001gOExim Auth failed2025-03-09 13:51:38 dovecot_plain authenticator failed for ([46.29.121.110]) [46.29.121.110]:34596: 535 Incorrect authentication data (set_id=services)46.29.121.1103017382P  - + ossec13001gOExim Auth failed2025-03-09 13:51:24 dovecot_plain authenticator failed for 145.173.198.203.static.netvigator.com [203.198.173.145]:59583: 535 Incorrect authentication data (set_id=services@heipowersystem.com)203.198.173.1451819730kO  -a) ossec13001gNExim Auth failed2025-03-09 13:47:35 dovecot_plain authenticator failed for ([125.16.12.73]) [128.185.253.90]:48930: 535 Incorrect authentication data (set_id=services@heipowersystem.com)128.185.253.901269750WN  -9) ossec13001gNExim Auth failed2025-03-09 13:47:58 dovecot_plain authenticator failed for ([223.83.212.180]) [223.83.212.180]:39978: 535 Incorrect authentication data (set_id=sales)223.83.212.1801814991ZM  -?) ossec13001gNExim Auth failed2025-03-09 13:47:46 dovecot_plain authenticator failed for ([46.138.247.195]) [46.138.247.195]:58730: 535 Incorrect authentication data (set_id=services)46.138.247.1952017370gL  -[' ossec13001gNExim Auth failed2025-03-09 13:47:40 dovecot_plain authenticator failed for ([120.78.172.20]) [120.78.172.20]:46256: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)120.78.172.201814991TK  -7% ossec13001gLExim Auth failed2025-03-09 13:40:29 dovecot_plain authenticator failed for ([197.5.144.31]) [197.5.144.31]:48352: 535 Incorrect authentication data (set_id=services)197.5.144.312464461NJ  -/! ossec13001gLExim Auth failed2025-03-09 13:40:17 dovecot_plain authenticator failed for ([59.2.14.33]) [59.2.14.33]:35384: 535 Incorrect authentication data (set_id=services)59.2.14.331835841gI  -]% ossec13001gLExim Auth failed2025-03-09 13:39:42 dovecot_plain authenticator failed for ([60.172.54.36]) [60.172.54.36]:33783: 535 Incorrect authentication data (set_id=services@heipowersystem.com)60.172.54.361814991 (: O [ q Woj  -g+ ossec13001g[Exim Auth failed2025-03-09 14:43:56 dovecot_plain authenticator failed for ([125.21.146.174]) [115.242.200.126]:37938: 535 Incorrect authentication data (set_id=services@heipowersystem.com)115.242.200.1261269750zi  -' ossec13001g[Exim Auth failed2025-03-09 14:43:37 dovecot_plain authenticator failed for syn-075-080-100-185.res.spectrum.com [75.80.100.185]:33330: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)75.80.100.1856252001Wh  -9) ossec13001gYExim Auth failed2025-03-09 14:34:46 dovecot_plain authenticator failed for ([49.124.149.211]) [49.124.149.211]:48560: 535 Incorrect authentication data (set_id=sales)49.124.149.2111733045pg  -i+ ossec13001gYExim Auth failed2025-03-09 14:34:36 dovecot_plain authenticator failed for ([117.141.148.187]) [117.141.148.187]:47479: 535 Incorrect authentication data (set_id=services@heipowersystem.com)117.141.148.1871814991|f  -+ ossec13001gYExim Auth failed2025-03-09 14:34:18 dovecot_plain authenticator failed for 122-222-117-139.east.ap.gmo-isp.jp [122.222.117.139]:61263: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)122.222.117.1391861060Te  -7% ossec13001gYExim Auth failed2025-03-09 14:35:04 dovecot_plain authenticator failed for ([116.7.248.50]) [116.7.248.50]:45489: 535 Incorrect authentication data (set_id=services)116.7.248.501814991(d  3U) ossec11301gW New FTP connection.Mar 9 14:23:51 vm1 pure-ftpd[3554253]: (?@172.172.245.78) [INFO] New connection from 172.172.245.78172.172.245.786252001"c  3M% ossec11301gVNew FTP connection.Mar 9 14:21:47 vm1 pure-ftpd[3553937]: (?@20.83.49.214) [INFO] New connection from 20.83.49.21420.83.49.2146252001ib  -]) ossec13001gV~Exim Auth failed2025-03-09 14:21:09 dovecot_plain authenticator failed for 125-228-225-91.hinet-ip.hinet.net [125.228.225.91]:38944: 535 Incorrect authentication data (set_id=services)125.228.225.911668284{a  -% ossec13001gVtExim Auth failed2025-03-09 14:21:00 dovecot_plain authenticator failed for syn-072-017-090-246.biz.spectrum.com [72.17.90.246]:38458: 535 Incorrect authentication data (set_id=services@heipowersystem.com)72.17.90.2466252001}`  -' ossec13001gUExim Auth failed2025-03-09 14:17:18 dovecot_login authenticator failed for syn-075-080-100-185.res.spectrum.com [75.80.100.185]:40008: 535 Incorrect authentication data (set_id=services@heipowersystem.com)75.80.100.1856252001W_  -;' ossec13001gUExim Auth failed2025-03-09 14:17:46 dovecot_plain authenticator failed for ([175.202.82.16]) [175.202.82.16]:55184: 535 Incorrect authentication data (set_id=services)175.202.82.161835841f^  -Y' ossec13001gUExim Auth failed2025-03-09 14:17:41 dovecot_login authenticator failed for 217-76-83-103.cust.bredband2.com [217.76.83.103]:39010: 535 Incorrect authentication data (set_id=services)217.76.83.1032661886p]  -i+ ossec13001gUExim Auth failed2025-03-09 14:17:33 dovecot_plain authenticator failed for ([116.148.186.186]) [116.148.186.186]:54886: 535 Incorrect authentication data (set_id=services@heipowersystem.com)116.148.186.1861814991g\  -[' ossec13001gTExim Auth failed2025-03-09 14:10:30 dovecot_plain authenticator failed for ([149.54.15.162]) [149.54.15.162]:58296: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)149.54.15.1621149361j[  -_) ossec13001gSExim Auth failed2025-03-09 14:10:15 dovecot_plain authenticator failed for ([211.252.172.89]) [211.252.172.89]:38207: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)211.252.172.891835841TZ  -5' ossec13001gT Exim Auth failed2025-03-09 14:10:42 dovecot_plain authenticator failed for ([12.189.234.28]) [12.189.234.28]:34694: 535 Incorrect authentication data (set_id=sales)12.189.234.286252001 t+ ; J l | 1Setm{  -e) ossec13001ghExim Auth failed2025-03-09 15:39:48 dovecot_plain authenticator failed for ([200.106.49.149]) [200.106.49.149]:53694: 535 Incorrect authentication data (set_id=services@heipowersystem.com)200.106.49.1493932488jz  -a' ossec13001gfExim Auth failed2025-03-09 15:31:17 dovecot_plain authenticator failed for ([49.124.153.29]) [49.124.153.29]:43588: 535 Incorrect authentication data (set_id=services@heipowersystem.com)49.124.153.291733045Zy  -?) ossec13001gg Exim Auth failed2025-03-09 15:31:47 dovecot_plain authenticator failed for ([111.171.125.94]) [111.171.125.94]:56575: 535 Incorrect authentication data (set_id=services)111.171.125.941835841Zx  -=+ ossec13001gfExim Auth failed2025-03-09 15:31:29 dovecot_plain authenticator failed for ([103.219.154.156]) [103.219.154.156]:46876: 535 Incorrect authentication data (set_id=sales)103.219.154.1562750405gw  -[' ossec13001gfExim Auth failed2025-03-09 15:30:51 dovecot_plain authenticator failed for ([89.175.49.147]) [89.175.49.147]:55132: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)89.175.49.1472017370sv  -s' ossec13001gdExim Auth failed2025-03-09 15:22:43 dovecot_login authenticator failed for (cust-72-26-178-196.wireless.t6b.com) [72.26.178.196]:38414: 535 Incorrect authentication data (set_id=vikas.khandelwal)72.26.178.1966252001ru  -q' ossec13001gdExim Auth failed2025-03-09 15:22:08 dovecot_login authenticator failed for ([186.179.80.12]) [186.179.80.12]:42242: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)186.179.80.123895114pt  -i+ ossec13001gaExim Auth failed2025-03-09 15:08:19 dovecot_plain authenticator failed for ([175.205.126.214]) [175.205.126.214]:33108: 535 Incorrect authentication data (set_id=services@heipowersystem.com)175.205.126.2141835841Zs  -?) ossec13001gaExim Auth failed2025-03-09 15:08:31 dovecot_plain authenticator failed for ([183.220.243.62]) [183.220.243.62]:51514: 535 Incorrect authentication data (set_id=services)183.220.243.621814991jr  -a' ossec13001g`Exim Auth failed2025-03-09 15:04:11 dovecot_plain authenticator failed for ([60.29.100.218]) [60.29.100.218]:33927: 535 Incorrect authentication data (set_id=services@heipowersystem.com)60.29.100.2181814991Qq  -3# ossec13001g_{Exim Auth failed2025-03-09 14:59:29 dovecot_plain authenticator failed for ([60.28.60.82]) [60.28.60.82]:47964: 535 Incorrect authentication data (set_id=services)60.28.60.821814991lp  -e) ossec13001g_[Exim Auth failed2025-03-09 14:58:57 dovecot_plain authenticator failed for ([185.101.16.250]) [185.101.16.250]:48526: 535 Incorrect authentication data (set_id=services@heipowersystem.com)185.101.16.250272103Zo  -?) ossec13001g]Exim Auth failed2025-03-09 14:52:31 dovecot_plain authenticator failed for ([175.214.52.214]) [175.214.52.214]:14913: 535 Incorrect authentication data (set_id=services)175.214.52.2141835841mn  -e) ossec13001g]Exim Auth failed2025-03-09 14:52:06 dovecot_plain authenticator failed for ([223.82.241.146]) [223.82.241.146]:37956: 535 Incorrect authentication data (set_id=services@heipowersystem.com)223.82.241.1461814991lm  -a+ ossec13001g]Exim Auth failed2025-03-09 14:51:47 dovecot_plain authenticator failed for ([182.163.122.133]) [182.163.122.133]:4321: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)182.163.122.1331210997pl  -k) ossec13001g]Exim Auth failed2025-03-09 14:52:09 dovecot_plain authenticator failed for (200-205-223-1.customer.tdatabrasil.net.br) [187.93.153.166]:60015: 535 Incorrect authentication data (set_id=sales)187.93.153.1663469034]k  -C+ ossec13001g[Exim Auth failed2025-03-09 14:44:28 dovecot_plain authenticator failed for ([119.206.117.105]) [119.206.117.105]:43000: 535 Incorrect authentication data (set_id=services)119.206.117.1051835841 e"$  9 N s <Qeh  -[) ossec13001goExim Auth failed2025-03-09 16:09:02 dovecot_plain authenticator failed for 50708de6.static.ziggozakelijk.nl [80.112.141.230]:51918: 535 Incorrect authentication data (set_id=services)80.112.141.2302750405g  -[' ossec13001goExim Auth failed2025-03-09 16:08:51 dovecot_plain authenticator failed for ([67.55.189.215]) [67.55.189.215]:47767: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)67.55.189.2156252001Z  -=+ ossec13001goExim Auth failed2025-03-09 16:06:01 dovecot_login authenticator failed for ([103.106.154.133]) [103.106.154.133]:58679: 535 Incorrect authentication data (set_id=sales)103.106.154.1331269750j  -_) ossec13001goExim Auth failed2025-03-09 16:05:49 dovecot_login authenticator failed for ([60.173.105.206]) [60.173.105.206]:47554: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)60.173.105.2061814991d  -W% ossec13001gnrExim Auth failed2025-03-09 16:03:22 dovecot_login authenticator failed for ([121.26.31.62]) [121.26.31.62]:16288: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)121.26.31.621814991Q  -1% ossec13001gn~Exim Auth failed2025-03-09 16:03:33 dovecot_login authenticator failed for ([102.53.15.54]) [102.53.15.54]:55746: 535 Incorrect authentication data (set_id=sales)102.53.15.542542007W  -9) ossec13001gn|Exim Auth failed2025-03-09 16:03:32 dovecot_login authenticator failed for ([74.196.184.120]) [74.196.184.120]:48194: 535 Incorrect authentication data (set_id=sales)74.196.184.1206252001|  -) ossec13001gnfExim Auth failed2025-03-09 16:03:09 dovecot_login authenticator failed for syn-173-095-123-220.biz.spectrum.com [173.95.123.220]:49110: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)173.95.123.2206252001m  -e) ossec13001glExim Auth failed2025-03-09 15:55:25 dovecot_plain authenticator failed for ([191.36.152.249]) [191.36.152.249]:35564: 535 Incorrect authentication data (set_id=services@heipowersystem.com)191.36.152.2493469034m  -g' ossec13001glExim Auth failed2025-03-09 15:55:53 dovecot_plain authenticator failed for broadband-188-32-170-20.ip.moscow.rt.ru [188.32.170.20]:57186: 535 Incorrect authentication data (set_id=services)188.32.170.202017370m  -e) ossec13001glExim Auth failed2025-03-09 15:55:33 dovecot_plain authenticator failed for ([151.49.116.193]) [151.49.116.193]:36639: 535 Incorrect authentication data (set_id=services@heipowersystem.com)151.49.116.1933175395W  -;' ossec13001gkExim Auth failed2025-03-09 15:51:52 dovecot_plain authenticator failed for ([170.250.128.5]) [170.250.128.5]:46300: 535 Incorrect authentication data (set_id=services)170.250.128.56252001g  -]% ossec13001gkExim Auth failed2025-03-09 15:51:33 dovecot_plain authenticator failed for ([60.172.54.36]) [60.172.54.36]:55384: 535 Incorrect authentication data (set_id=services@heipowersystem.com)60.172.54.361814991b  -O) ossec13001gj{Exim Auth failed2025-03-09 15:46:27 dovecot_plain authenticator failed for ns1019254.ip-15-204-208.us [15.204.208.192]:57680: 535 Incorrect authentication data (set_id=services)15.204.208.1926252001~  - ) ossec13001gjkExim Auth failed2025-03-09 15:46:11 dovecot_plain authenticator failed for (187-13-169-174.user.veloxzone.com.br) [187.13.169.174]:53082: 535 Incorrect authentication data (set_id=services@heipowersystem.com)187.13.169.1743469034z}  -' ossec13001ghExim Auth failed2025-03-09 15:39:41 dovecot_plain authenticator failed for syn-071-012-241-225.res.spectrum.com [71.12.241.225]:33410: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)71.12.241.2256252001Z|  -?) ossec13001ghExim Auth failed2025-03-09 15:39:33 dovecot_plain authenticator failed for syn-172-100-186-071.res.spectrum.com [172.100.186.71]:33626: 535 Incorrect authentication data172.100.186.716252001 x"9 ] i *PZjxn  -i' ossec13001gxwExim Auth failed2025-03-09 16:46:05 dovecot_login authenticator failed for (173-29-118-52.client.mchsi.com) [173.29.118.52]:63763: 535 Incorrect authentication data (set_id=vikas.khandelwal)173.29.118.526252001l  -i# ossec13001gxeExim Auth failed2025-03-09 16:45:47 dovecot_login authenticator failed for ([27.98.249.9]) [27.98.249.9]:33315: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)27.98.249.91814991r  -u# ossec13001gwExim Auth failed2025-03-09 16:42:31 dovecot_plain authenticator failed for 95-31-6-109.static.corbina.ru [95.31.6.109]:58320: 535 Incorrect authentication data (set_id=services@heipowersystem.com)95.31.6.1092017370V  -;' ossec13001gvExim Auth failed2025-03-09 16:38:51 dovecot_plain authenticator failed for ([213.55.79.199]) [213.55.79.195]:49230: 535 Incorrect authentication data (set_id=services)213.55.79.195337996m  -e) ossec13001gvExim Auth failed2025-03-09 16:38:18 dovecot_plain authenticator failed for ([182.70.118.230]) [182.70.118.230]:51865: 535 Incorrect authentication data (set_id=services@heipowersystem.com)182.70.118.2301269750W  -;' ossec13001gsExim Auth failed2025-03-09 16:26:45 dovecot_plain authenticator failed for ([116.88.187.44]) [116.88.187.44]:42796: 535 Incorrect authentication data (set_id=services)116.88.187.441880251Q  -1% ossec13001gsExim Auth failed2025-03-09 16:26:35 dovecot_plain authenticator failed for ([61.81.151.97]) [61.81.151.97]:54980: 535 Incorrect authentication data (set_id=sales)61.81.151.971835841g  -]% ossec13001gsExim Auth failed2025-03-09 16:26:30 dovecot_plain authenticator failed for ([113.192.1.27]) [113.192.1.26]:41806: 535 Incorrect authentication data (set_id=services@heipowersystem.com)113.192.1.261643084m  -c+ ossec13001gsExim Auth failed2025-03-09 16:26:08 dovecot_plain authenticator failed for ([210.104.221.252]) [210.104.221.252]:59276: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)210.104.221.2521835841y  -' ossec13001gqExim Auth failed2025-03-09 16:18:22 dovecot_plain authenticator failed for 67-60-211-114.cpe.sparklight.net [67.60.211.114]:44330: 535 Incorrect authentication data (set_id=services@heipowersystem.com)67.60.211.1146252001f  -W) ossec13001gq!Exim Auth failed2025-03-09 16:14:48 dovecot_login authenticator failed for ([221.228.237.90]) [221.228.237.90]:28422: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)221.228.237.901814991{  -+ ossec13001gqExim Auth failed2025-03-09 16:14:35 dovecot_login authenticator failed for ([178.219.125.158]) [178.219.125.158]:44891: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)178.219.125.158798544X  -=' ossec13001gpwExim Auth failed2025-03-09 16:11:57 dovecot_login authenticator failed for (netcomafrica.com) [41.67.143.142]:42390: 535 Incorrect authentication data (set_id=services)41.67.143.1422328926p  -i+ ossec13001gp]Exim Auth failed2025-03-09 16:11:31 dovecot_login authenticator failed for ([103.152.234.134]) [103.152.234.134]:48172: 535 Incorrect authentication data (set_id=services@heipowersystem.com)103.152.234.1341643084X  -=' ossec13001gpUExim Auth failed2025-03-09 16:11:24 dovecot_login authenticator failed for syn-050-074-136-134.biz.spectrum.com [50.74.136.134]:38710: 535 Incorrect authentication data50.74.136.1346252001e  -]% ossec13001goExim Auth failed2025-03-09 16:08:49 dovecot_plain authenticator failed for ([46.161.196.5]) [46.161.196.5]:40310: 535 Incorrect authentication data (set_id=services@heipowersystem.com)46.161.196.599237Z  -=+ ossec13001goExim Auth failed2025-03-09 16:09:04 dovecot_plain authenticator failed for ([125.139.124.120]) [125.139.124.120]:46914: 535 Incorrect authentication data (set_id=sales)125.139.124.1201835841 r)  6 E d 8JrT.  -7% ossec13001g~Exim Auth failed2025-03-09 17:13:10 dovecot_plain authenticator failed for ([27.71.20.180]) [27.71.20.180]:19291: 535 Incorrect authentication data (set_id=services)27.71.20.1801562822j-  -a' ossec13001g~Exim Auth failed2025-03-09 17:12:59 dovecot_plain authenticator failed for ([58.242.86.203]) [58.242.86.203]:50247: 535 Incorrect authentication data (set_id=services@heipowersystem.com)58.242.86.2031814991T,  -5' ossec13001g~Exim Auth failed2025-03-09 17:12:55 dovecot_plain authenticator failed for ([112.4.150.142]) [112.4.150.142]:45686: 535 Incorrect authentication data (set_id=sales)112.4.150.1421814991k+  -a) ossec13001g~Exim Auth failed2025-03-09 17:12:43 dovecot_plain authenticator failed for ([159.223.250.131]) [161.35.200.202]:46642: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)161.35.200.2022921044o*  -m% ossec13001g}Exim Auth failed2025-03-09 17:05:55 dovecot_plain authenticator failed for ([116.7.248.50]) [116.7.248.50]:55397: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)116.7.248.501814991U)  -9' ossec13001g|Exim Auth failed2025-03-09 17:05:14 dovecot_plain authenticator failed for ([185.189.123.105]) [37.235.18.145]:35603: 535 Incorrect authentication data (set_id=sales)37.235.18.145130758f(  -Y' ossec13001g|Exim Auth failed2025-03-09 17:05:09 dovecot_plain authenticator failed for wsip-174-79-91-142.br.br.cox.net [174.79.91.142]:51348: 535 Incorrect authentication data (set_id=services)174.79.91.1426252001z'  -) ossec13001g|Exim Auth failed2025-03-09 17:05:04 dovecot_plain authenticator failed for (94.124.156.175.unknown.m1.com.sg) [175.156.124.94]:54170: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)175.156.124.941880251j&  -a' ossec13001g|Exim Auth failed2025-03-09 17:04:51 dovecot_plain authenticator failed for ([61.133.10.205]) [61.133.10.204]:56276: 535 Incorrect authentication data (set_id=services@heipowersystem.com)61.133.10.2041814991g%  -[' ossec13001g{Exim Auth failed2025-03-09 17:00:35 dovecot_login authenticator failed for ([95.191.129.54]) [95.191.129.54]:60136: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)95.191.129.542017370T$  -5' ossec13001g{Exim Auth failed2025-03-09 17:00:52 dovecot_login authenticator failed for ([50.249.167.45]) [50.249.167.45]:53709: 535 Incorrect authentication data (set_id=sales)50.249.167.456252001]#  -C+ ossec13001g{tExim Auth failed2025-03-09 16:58:50 dovecot_login authenticator failed for ([118.122.196.230]) [118.122.196.230]:34756: 535 Incorrect authentication data (set_id=services)118.122.196.2301814991m"  -e) ossec13001g{dExim Auth failed2025-03-09 16:58:35 dovecot_login authenticator failed for ([123.209.67.169]) [123.209.67.169]:49338: 535 Incorrect authentication data (set_id=services@heipowersystem.com)123.209.67.1692077456V!  -;' ossec13001gzExim Auth failed2025-03-09 16:55:49 dovecot_plain authenticator failed for ([77.139.82.133]) [77.139.82.133]:34791: 535 Incorrect authentication data (set_id=services)77.139.82.133294640  -3+ ossec13001gzExim Auth failed2025-03-09 16:55:38 dovecot_plain authenticator failed for lnsm1-torontoxn-142-116-116-160.internet.virginmobile.ca [142.116.116.160]:39202: 535 Incorrect authentication data (set_id=services@heipowersystem.com)142.116.116.1606251999h  -]' ossec13001gzExim Auth failed2025-03-09 16:55:37 dovecot_plain authenticator failed for ppp-210-86-167-42.revip.asianet.co.th [210.86.167.42]:56911: 535 Incorrect authentication data (set_id=sales)210.86.167.421605651g  -[' ossec13001gzExim Auth failed2025-03-09 16:55:17 dovecot_plain authenticator failed for ([103.190.91.20]) [103.190.91.20]:39206: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)103.190.91.201269750 m$ < K y 00BTamp?  -i+ ossec13001g͉Exim Auth failed2025-03-09 17:59:01 dovecot_plain authenticator failed for ([102.207.152.163]) [102.207.152.163]:57978: 535 Incorrect authentication data (set_id=services@heipowersystem.com)102.207.152.1633374766o>  -i+ ossec13001g͇Exim Auth failed2025-03-09 17:51:24 dovecot_plain authenticator failed for ([196.200.227.194]) [196.200.227.194]:43884: 535 Incorrect authentication data (set_id=services@heipowersystem.com)196.200.227.194149590j=  -_) ossec13001g͇Exim Auth failed2025-03-09 17:50:58 dovecot_plain authenticator failed for 123-193-152-64.dynamic.kbronet.com.tw [123.193.152.64]:55208: 535 Incorrect authentication data (set_id=sales)123.193.152.641668284j<  -_) ossec13001g͇Exim Auth failed2025-03-09 17:50:41 dovecot_plain authenticator failed for mail-02.03.perm.ru [46.146.210.180]:21703: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)46.146.210.1802017370|;  -+ ossec13001g͇EExim Auth failed2025-03-09 17:49:17 dovecot_plain authenticator failed for ([119.206.117.105]) [119.206.117.105]:58420: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)119.206.117.1051835841`:  -O% ossec13001g͇YExim Auth failed2025-03-09 17:49:36 dovecot_plain authenticator failed for ([220.81.9.218]) [220.81.9.218]:43338: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)220.81.9.2181835841f9  -[% ossec13001gͅExim Auth failed2025-03-09 17:43:01 dovecot_plain authenticator failed for 48.211.41.34.bc.googleusercontent.com [34.41.211.48]:41478: 535 Incorrect authentication data (set_id=sales)34.41.211.486252001g8  -[' ossec13001gͅExim Auth failed2025-03-09 17:42:49 dovecot_plain authenticator failed for ([95.191.129.54]) [95.191.129.54]:55866: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)95.191.129.542017370S7  -5' ossec13001gͅExim Auth failed2025-03-09 17:42:07 dovecot_plain authenticator failed for ([91.219.196.17]) [91.219.196.17]:58250: 535 Incorrect authentication data (set_id=sales)91.219.196.17690791m6  -e) ossec13001gͅExim Auth failed2025-03-09 17:41:53 dovecot_plain authenticator failed for ([41.159.145.190]) [41.159.145.190]:33001: 535 Incorrect authentication data (set_id=services@heipowersystem.com)41.159.145.1902400553j5  -_) ossec13001gͅ~Exim Auth failed2025-03-09 17:41:41 dovecot_plain authenticator failed for ([220.77.245.227]) [220.77.245.227]:44360: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)220.77.245.2271835841V4  -;' ossec13001gͅExim Auth failed2025-03-09 17:42:13 dovecot_plain authenticator failed for ([94.204.78.117]) [94.204.78.117]:56551: 535 Incorrect authentication data (set_id=services)94.204.78.117290557N3  -/! ossec13001g͂Exim Auth failed2025-03-09 17:28:56 dovecot_plain authenticator failed for ([27.0.61.49]) [27.0.61.49]:33070: 535 Incorrect authentication data (set_id=services)27.0.61.491269750m2  -e) ossec13001g͂rExim Auth failed2025-03-09 17:28:40 dovecot_plain authenticator failed for ([192.34.128.202]) [192.34.128.202]:48206: 535 Incorrect authentication data (set_id=services@heipowersystem.com)192.34.128.2026252001d1  -W% ossec13001ǵExim Auth failed2025-03-09 17:25:15 dovecot_plain authenticator failed for h77-53-111-65.cust.bredband2.com [77.53.111.65]:38826: 535 Incorrect authentication data (set_id=services)77.53.111.652661886m0  -e) ossec13001ǵExim Auth failed2025-03-09 17:24:52 dovecot_plain authenticator failed for ([117.158.243.50]) [117.158.243.50]:33592: 535 Incorrect authentication data (set_id=services@heipowersystem.com)117.158.243.501814991g/  -]% ossec13001g̀cExim Auth failed2025-03-09 17:19:54 dovecot_plain authenticator failed for ([191.59.165.4]) [191.59.165.4]:44072: 535 Incorrect authentication data (set_id=services@heipowersystem.com)191.59.165.43469034 $ ; G a T cx|aO  -O) ossec13001g͒Exim Auth failed2025-03-09 18:37:27 dovecot_plain authenticator failed for ip-188-127-16-197.ennet.pl [188.127.16.197]:46782: 535 Incorrect authentication data (set_id=services)188.127.16.197798544jN  -a' ossec13001g͒~Exim Auth failed2025-03-09 18:37:08 dovecot_plain authenticator failed for ([220.74.63.183]) [220.74.63.183]:47514: 535 Incorrect authentication data (set_id=services@heipowersystem.com)220.74.63.1831835841]M  -C+ ossec13001g͐UExim Auth failed2025-03-09 18:27:57 dovecot_plain authenticator failed for ([176.226.241.177]) [176.226.241.177]:48738: 535 Incorrect authentication data (set_id=services)176.226.241.1772017370aL  -U! ossec13001g͐IExim Auth failed2025-03-09 18:27:45 dovecot_plain authenticator failed for ([59.9.38.92]) [59.9.38.92]:49146: 535 Incorrect authentication data (set_id=services@heipowersystem.com)59.9.38.921835841mK  -c+ ossec13001g͐AExim Auth failed2025-03-09 18:27:36 dovecot_plain authenticator failed for ([115.245.172.214]) [115.245.172.214]:55988: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)115.245.172.2141269750J  - ) ossec13001g͏Exim Auth failed2025-03-09 18:25:24 dovecot_login authenticator failed for 110-25-105-242.adsl.fetnet.net [110.25.105.242]:47115: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)110.25.105.2421668284sI  -o+ ossec13001g͍Exim Auth failed2025-03-09 18:17:17 dovecot_login authenticator failed for (208.235.164.124.adsl-pool.sx.cn) [124.164.235.208]:60134: 535 Incorrect authentication data (set_id=vikas.khandelwal)124.164.235.2081814991 H  -) ossec13001g͍Exim Auth failed2025-03-09 18:16:58 dovecot_login authenticator failed for 47-158-210-137.lsan.ca.frontiernet.net [47.158.210.137]:50916: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)47.158.210.1376252001ZG  -?) ossec13001g͍HExim Auth failed2025-03-09 18:14:56 dovecot_plain authenticator failed for ([191.59.177.235]) [191.59.177.235]:59806: 535 Incorrect authentication data (set_id=services)191.59.177.2353469034mF  -e) ossec13001g͍0Exim Auth failed2025-03-09 18:14:32 dovecot_plain authenticator failed for ([61.191.163.102]) [61.191.163.102]:47706: 535 Incorrect authentication data (set_id=services@heipowersystem.com)61.191.163.1021814991 E  -!% ossec13001g͌TExim Auth failed2025-03-09 18:10:51 dovecot_plain authenticator failed for 206.81.4.146.static.wline.lns.sme.cust.swisscom.ch [146.4.81.206]:42399: 535 Incorrect authentication data (set_id=services@heipowersystem.com)146.4.81.2062658434bD  -S% ossec13001g͋&Exim Auth failed2025-03-09 18:05:50 dovecot_plain authenticator failed for (undefined.hostname.localhost) [103.90.97.98]:43450: 535 Incorrect authentication data (set_id=services)103.90.97.981269750pC  -i+ ossec13001g͋Exim Auth failed2025-03-09 18:05:33 dovecot_plain authenticator failed for ([115.245.172.214]) [115.245.172.214]:39936: 535 Incorrect authentication data (set_id=services@heipowersystem.com)115.245.172.2141269750eB  -U) ossec13001g͉Exim Auth failed2025-03-09 17:59:21 dovecot_plain authenticator failed for (186-208-76-154.veloo.com.br) [186.208.76.154]:60468: 535 Incorrect authentication data (set_id=services)186.208.76.1543469034pA  -q# ossec13001g͉{Exim Auth failed2025-03-09 17:58:43 dovecot_plain authenticator failed for 37.151.71.8.dynamic.telecom.kz [37.151.71.8]:43341: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)37.151.71.81522867d@  -U' ossec13001g͉Exim Auth failed2025-03-09 17:59:03 dovecot_plain authenticator failed for fixed-186-96-134-64.totalplay.net [186.96.134.64]:38648: 535 Incorrect authentication data (set_id=sales)186.96.134.643996063 l , N ] | >P]lm`  -e) ossec13001g͛ZExim Auth failed2025-03-09 19:14:56 dovecot_login authenticator failed for ([211.228.97.186]) [211.228.97.186]:51503: 535 Incorrect authentication data (set_id=services@heipowersystem.com)211.228.97.1861835841o_  -g+ ossec13001g͛>Exim Auth failed2025-03-09 19:14:29 dovecot_plain authenticator failed for 163.189-202-206.bestelclientes.com.mx [189.202.206.163]:53452: 535 Incorrect authentication data (set_id=services)189.202.206.1633996063j^  -a' ossec13001g͛"Exim Auth failed2025-03-09 19:14:01 dovecot_plain authenticator failed for ([41.224.62.206]) [41.224.62.206]:46607: 535 Incorrect authentication data (set_id=services@heipowersystem.com)41.224.62.2062464461%]  3Q' ossec11301g͙New FTP connection.Mar 9 19:08:13 vm1 pure-ftpd[3614460]: (?@87.236.176.39) [INFO] New connection from 87.236.176.3987.236.176.392635167k\  -_+ ossec13001g͘+Exim Auth failed2025-03-09 19:01:23 dovecot_plain authenticator failed for 158.160.200.177.netflexisp.com.br [177.200.160.158]:53950: 535 Incorrect authentication data (set_id=services)177.200.160.1583469034l[  -c) ossec13001g͘'Exim Auth failed2025-03-09 19:01:19 dovecot_plain authenticator failed for syn-070-122-139-172.res.spectrum.com [70.122.139.172]:47850: 535 Incorrect authentication data (set_id=services)70.122.139.1726252001nZ  -g) ossec13001g͘!Exim Auth failed2025-03-09 19:01:12 dovecot_plain authenticator failed for ([216.194.174.103]) [216.194.174.27]:38847: 535 Incorrect authentication data (set_id=services@heipowersystem.com)216.194.174.276252001kY  -_+ ossec13001g͘Exim Auth failed2025-03-09 19:00:55 dovecot_plain authenticator failed for d142-179-145-166.abhsia.telus.net [142.179.145.166]:36268: 535 Incorrect authentication data (set_id=services)142.179.145.1666251999jX  -a' ossec13001g͘Exim Auth failed2025-03-09 19:00:41 dovecot_plain authenticator failed for ([200.175.88.85]) [200.175.88.85]:51721: 535 Incorrect authentication data (set_id=services@heipowersystem.com)200.175.88.853469034fW  -Y' ossec13001g͗?Exim Auth failed2025-03-09 18:57:26 dovecot_plain authenticator failed for 217-76-83-103.cust.bredband2.com [217.76.83.103]:57264: 535 Incorrect authentication data (set_id=services)217.76.83.1032661886yV  -}) ossec13001g͗/Exim Auth failed2025-03-09 18:57:09 dovecot_plain authenticator failed for ip72-199-156-231.sd.sd.cox.net [72.199.156.231]:48931: 535 Incorrect authentication data (set_id=services@heipowersystem.com)72.199.156.2316252001]U  -C+ ossec13001g͕Exim Auth failed2025-03-09 18:51:58 dovecot_plain authenticator failed for ([119.206.117.105]) [119.206.117.105]:49136: 535 Incorrect authentication data (set_id=services)119.206.117.1051835841mT  -e) ossec13001g͕Exim Auth failed2025-03-09 18:51:46 dovecot_plain authenticator failed for ([14.194.128.158]) [14.194.128.158]:51204: 535 Incorrect authentication data (set_id=services@heipowersystem.com)14.194.128.1581269750ZS  -=+ ossec13001g͔pExim Auth failed2025-03-09 18:45:27 dovecot_plain authenticator failed for ([114.243.136.120]) [114.243.136.120]:51940: 535 Incorrect authentication data (set_id=sales)114.243.136.1201814991mR  -e) ossec13001g͔hExim Auth failed2025-03-09 18:45:19 dovecot_plain authenticator failed for ([119.200.229.33]) [119.200.229.33]:39307: 535 Incorrect authentication data (set_id=services@heipowersystem.com)119.200.229.331835841gQ  -[' ossec13001g͔RExim Auth failed2025-03-09 18:44:58 dovecot_plain authenticator failed for ([180.129.88.20]) [180.129.88.20]:36538: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)180.129.88.201880251tP  -u' ossec13001g͔@Exim Auth failed2025-03-09 18:44:39 dovecot_plain authenticator failed for p162086-obmd01.osaka.ocn.ne.jp [61.112.205.85]:47520: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)61.112.205.851861060 ( M _ t . =Rwp  -% ossec13001gͦoExim Auth failed2025-03-09 20:02:13 dovecot_login authenticator failed for static-193-217-1-27.cust.tele2.lt [193.217.1.27]:59322: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)193.217.1.27597427uo  -u) ossec13001gͦ%Exim Auth failed2025-03-09 20:00:59 dovecot_plain authenticator failed for (145.37.212.118.adsl-pool.jx.chinaunicom.com) [118.212.37.145]:50090: 535 Incorrect authentication data (set_id=services)118.212.37.1451814991mn  -e) ossec13001gͦExim Auth failed2025-03-09 20:00:45 dovecot_plain authenticator failed for ([103.129.201.82]) [103.129.201.81]:45258: 535 Incorrect authentication data (set_id=services@heipowersystem.com)103.129.201.811210997]m  -C+ ossec13001gͣ Exim Auth failed2025-03-09 19:47:45 dovecot_plain authenticator failed for ([112.164.240.110]) [112.164.240.110]:48472: 535 Incorrect authentication data (set_id=services)112.164.240.1101835841jl  -a' ossec13001g͢Exim Auth failed2025-03-09 19:46:58 dovecot_plain authenticator failed for ([112.132.89.72]) [112.132.89.72]:38245: 535 Incorrect authentication data (set_id=services@heipowersystem.com)112.132.89.721814991]k  -C+ ossec13001g͢%Exim Auth failed2025-03-09 19:43:57 dovecot_plain authenticator failed for ([112.164.240.110]) [112.164.240.110]:46918: 535 Incorrect authentication data (set_id=services)112.164.240.1101835841gj  -]% ossec13001g͢Exim Auth failed2025-03-09 19:43:22 dovecot_plain authenticator failed for ([60.174.35.18]) [60.174.35.18]:50303: 535 Incorrect authentication data (set_id=services@heipowersystem.com)60.174.35.181814991Wi  -;' ossec13001g͠Exim Auth failed2025-03-09 19:38:09 dovecot_plain authenticator failed for ([94.181.23.131]) [94.181.23.131]:56222: 535 Incorrect authentication data (set_id=services)94.181.23.1312017370gh  -]% ossec13001g͠Exim Auth failed2025-03-09 19:37:59 dovecot_plain authenticator failed for ([218.70.9.114]) [218.70.9.114]:40444: 535 Incorrect authentication data (set_id=services@heipowersystem.com)218.70.9.1141814991mg  -e) ossec13001g͟5Exim Auth failed2025-03-09 19:31:25 dovecot_plain authenticator failed for ([196.28.226.123]) [196.28.226.123]:38313: 535 Incorrect authentication data (set_id=services@heipowersystem.com)196.28.226.1231036973Bf  =}+ ossec13008g͟]Mail Reciepient rejected2025-03-09 19:32:03 H=(mail.vandanabalbharti.com) [165.154.226.172]:51080 F= rejected RCPT : Rejected relay attempt: '165.154.226.172' From: 'sdglzt@vandanabalbharti.com' To: 'goofile@fastmail.com'165.154.226.1721668284ge  -[' ossec13001g͟?Exim Auth failed2025-03-09 19:31:35 dovecot_plain authenticator failed for ([146.88.78.123]) [146.88.78.123]:60204: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)146.88.78.1231694008jd  -a' ossec13001g͝nExim Auth failed2025-03-09 19:23:49 dovecot_plain authenticator failed for ([186.68.83.109]) [186.68.83.109]:55108: 535 Incorrect authentication data (set_id=services@heipowersystem.com)186.68.83.1093658394Wc  -9) ossec13001g͜Exim Auth failed2025-03-09 19:19:59 dovecot_plain authenticator failed for ([195.122.224.64]) [195.122.224.64]:44858: 535 Incorrect authentication data (set_id=sales)195.122.224.642017370jb  -_) ossec13001g͜|Exim Auth failed2025-03-09 19:19:48 dovecot_plain authenticator failed for ([168.121.46.162]) [168.121.46.162]:53442: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)168.121.46.1623932488fa  -Y' ossec13001g͛jExim Auth failed2025-03-09 19:15:12 dovecot_login authenticator failed for (82-208-99-163.static.mts-nn.ru) [82.208.99.163]:54590: 535 Incorrect authentication data (set_id=services)82.208.99.1632017370  /  , >_wS0E|  -% ossec13001gExim Auth failed2025-03-09 22:12:13 dovecot_plain authenticator failed for syn-075-080-065-214.biz.spectrum.com [75.80.65.214]:36833: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)75.80.65.2146252001]  -K# ossec13001gExim Auth failed2025-03-09 21:55:41 dovecot_login authenticator failed for 111-70-32-2.emome-ip.hinet.net [111.70.32.2]:56844: 535 Incorrect authentication data (set_id=sales)111.70.32.21668284E~  -' ossec13001gExim Auth failed2025-03-09 21:55:13 dovecot_login authenticator failed for ([79.143.164.98]) [79.143.164.98]:35859: 535 Incorrect authentication data79.143.164.983277605g}  -[' ossec13001gExim Auth failed2025-03-09 21:54:57 dovecot_login authenticator failed for ([116.88.187.44]) [116.88.187.44]:46483: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)116.88.187.441880251|  W!+ ossec9708gͽDovecot Aborted Login with empty userMar 9 21:40:49 vm1 dovecot[312763]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 7 secs): user=<>, rip=185.247.137.166, lip=103.74.54.108, TLS, session=185.247.137.166298795E{  =+ ossec13008gͺ<Mail Reciepient rejected2025-03-09 21:26:42 H=(mail.fablixsolutions.com) [165.154.228.195]:56249 F= rejected RCPT : Rejected relay attempt: '165.154.228.195' From: 'ovqphedth@fablixsolutions.com' To: 'goofile@fastmail.com'165.154.228.1951643084Wz  -9) ossec13001g͸kExim Auth failed2025-03-09 21:18:59 dovecot_login authenticator failed for ([116.113.193.70]) [116.113.193.70]:15547: 535 Incorrect authentication data (set_id=sales)116.113.193.701814991dy  -W% ossec13001g͸]Exim Auth failed2025-03-09 21:18:45 dovecot_login authenticator failed for ([14.37.206.76]) [14.37.206.76]:38658: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)14.37.206.761835841[x -A' ossec13001gͳ"Exim Auth failed2025-03-09 20:56:25 dovecot_login authenticator failed for (thepsindustries.com) [58.240.171.59]:48044: 535 Incorrect authentication data (set_id=nologin)58.240.171.591814991jw  -_) ossec13001gͪExim Auth failed2025-03-09 20:17:57 dovecot_plain authenticator failed for ([217.115.87.186]) [217.115.87.186]:60097: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)217.115.87.1862017370^v  -M# ossec13001gͪExim Auth failed2025-03-09 20:17:48 dovecot_plain authenticator failed for host-2-98-157-37.as13285.net [2.98.157.37]:52794: 535 Incorrect authentication data (set_id=services)2.98.157.372635167ju  -a' ossec13001gͪ Exim Auth failed2025-03-09 20:17:38 dovecot_plain authenticator failed for ([49.124.145.62]) [49.124.145.62]:36310: 535 Incorrect authentication data (set_id=services@heipowersystem.com)49.124.145.621733045/t  =W+ ossec13008gͩ=Mail Reciepient rejected2025-03-09 20:14:12 H=(mail.msnews24.in) [165.154.226.150]:56005 F= rejected RCPT : Rejected relay attempt: '165.154.226.150' From: 'utenutsudp@msnews24.in' To: 'goofile@fastmail.com'165.154.226.1501668284]s  -C+ ossec13001gͨ=Exim Auth failed2025-03-09 20:09:56 dovecot_plain authenticator failed for ([222.236.155.146]) [222.236.155.146]:47130: 535 Incorrect authentication data (set_id=services)222.236.155.1461835841jr  -a' ossec13001gͨ/Exim Auth failed2025-03-09 20:09:43 dovecot_plain authenticator failed for ([85.15.190.172]) [85.15.190.172]:58092: 535 Incorrect authentication data (set_id=services@heipowersystem.com)85.15.190.1722017370~q  -) ossec13001gͨ+Exim Auth failed2025-03-09 20:09:38 dovecot_plain authenticator failed for ppp-210-86-163-194.revip.asianet.co.th [210.86.163.194]:52876: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)210.86.163.1941605651 Tf /Tvg  -[' ossec13001g[Exim Auth failed2025-03-10 00:43:30 dovecot_login authenticator failed for ([118.38.239.52]) [118.38.239.52]:41792: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)118.38.239.521835841i  -]) ossec13001g,Exim Auth failed2025-03-10 00:25:39 dovecot_plain authenticator failed for ([183.71.251.66]) [113.249.32.208]:24698: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)113.249.32.2081814991Z  -?) ossec13001g7Exim Auth failed2025-03-10 00:08:45 dovecot_login authenticator failed for ([49.124.152.248]) [49.124.152.248]:47252: 535 Incorrect authentication data (set_id=services)49.124.152.2481733045W  -;' ossec13001g-Exim Auth failed2025-03-10 00:08:36 dovecot_login authenticator failed for ([64.52.161.161]) [64.52.161.161]:49175: 535 Incorrect authentication data (set_id=services)64.52.161.1616252001j  -a' ossec13001g Exim Auth failed2025-03-10 00:08:00 dovecot_login authenticator failed for ([27.40.100.149]) [27.40.100.149]:54711: 535 Incorrect authentication data (set_id=services@heipowersystem.com)27.40.100.1491814991q  -m) ossec13001gExim Auth failed2025-03-10 00:07:32 dovecot_plain authenticator failed for 118-119-237-24.gci.net [24.237.119.118]:54720: 535 Incorrect authentication data (set_id=services@heipowersystem.com)24.237.119.1186252001# 3M% ossec11301g.New FTP connection.Mar 10 00:04:21 vm1 pure-ftpd[3676484]: (?@45.79.181.94) [INFO] New connection from 45.79.181.9445.79.181.946252001i  -a% ossec13001g֥Exim Auth failed2025-03-09 23:27:55 dovecot_login authenticator failed for 7.248.146.34.bc.googleusercontent.com [34.146.248.7]:40030: 535 Incorrect authentication data (set_id=services)34.146.248.71861060}  - % ossec13001g֓Exim Auth failed2025-03-09 23:27:38 dovecot_login authenticator failed for broadband-5-228-92-193.ip.moscow.rt.ru [5.228.92.193]:53861: 535 Incorrect authentication data (set_id=services@heipowersystem.com)5.228.92.1932017370_  -K' ossec13001gԼExim Auth failed2025-03-09 23:19:48 dovecot_login authenticator failed for ([122.175.12.33]) [122.175.12.33]:57086: 535 Incorrect authentication data (set_id=vikas.khandelwal)122.175.12.331269750   -!) ossec13001gԬExim Auth failed2025-03-09 23:19:32 dovecot_login authenticator failed for (nsg-corporate-21.229.187.122.airtel.in) [122.187.229.21]:42648: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)122.187.229.211269750  -) ossec13001gԘExim Auth failed2025-03-09 23:19:12 dovecot_login authenticator failed for mobile-107-80-220-155.mycingular.net [107.80.220.155]:39745: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)107.80.220.1556252001u  -y% ossec13001gExim Auth failed2025-03-09 22:55:33 dovecot_plain authenticator failed for 32.104.29.34.bc.googleusercontent.com [34.29.104.32]:36944: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)34.29.104.326252001y  -}) ossec13001gExim Auth failed2025-03-09 22:55:01 dovecot_plain authenticator failed for ([103.134.113.59]) [103.134.113.59]:55148: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)103.134.113.591269750H  -% ossec13001g̀Exim Auth failed2025-03-09 22:48:55 dovecot_plain authenticator failed for ([4.4.89.74]) [4.4.89.74]:43162: 535 Incorrect authentication data (set_id=sales)4.4.89.746252001j  -_) ossec13001gsExim Auth failed2025-03-09 22:48:42 dovecot_plain authenticator failed for ([222.114.84.175]) [222.114.84.175]:37840: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)222.114.84.1751835841(  3U) ossec11301giNew FTP connection.Mar 9 22:22:56 vm1 pure-ftpd[3654925]: (?@147.185.132.99) [INFO] New connection from 147.185.132.99147.185.132.996252001 % P _ !FElb"  -O) ossec13001g Exim Auth failed2025-03-10 03:14:48 dovecot_plain authenticator failed for ([118.26.153.102]) [118.26.153.102]:45814: 535 Incorrect authentication data (set_id=vikas.khandelwal)118.26.153.1021819730U! -5' ossec13001g Exim Auth failed2025-03-10 03:10:20 dovecot_login authenticator failed for (rokamauka.com) [58.240.171.59]:40018: 535 Incorrect authentication data (set_id=nologin)58.240.171.591814991U  -7' ossec13001g*Exim Auth failed2025-03-10 02:46:25 dovecot_login authenticator failed for ([223.75.231.193]) [58.49.113.138]:11845: 535 Incorrect authentication data (set_id=sales)58.49.113.1381814991}  -) ossec13001gExim Auth failed2025-03-10 02:46:04 dovecot_login authenticator failed for (usr.1net.by.225.172.178.in-addr.arpa) [178.172.225.52]:36676: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)178.172.225.52630336W  -9) ossec13001guExim Auth failed2025-03-10 02:30:36 dovecot_login authenticator failed for ([220.178.246.43]) [220.178.246.43]:52637: 535 Incorrect authentication data (set_id=sales)220.178.246.431814991z  -' ossec13001g;Exim Auth failed2025-03-10 02:29:38 dovecot_login authenticator failed for syn-074-218-095-154.biz.spectrum.com [74.218.95.154]:55576: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)74.218.95.1546252001(  3U) ossec11301g{New FTP connection.Mar 10 02:17:54 vm1 pure-ftpd[3704872]: (?@198.235.24.109) [INFO] New connection from 198.235.24.109198.235.24.1096252001e  -U) ossec13001g-Exim Auth failed2025-03-10 01:21:09 dovecot_login authenticator failed for s75-152-225-154.ab.hsia.telus.net [75.152.225.154]:1980: 535 Incorrect authentication data (set_id=sales)75.152.225.1546251999y  -' ossec13001gExim Auth failed2025-03-10 01:20:48 dovecot_login authenticator failed for 179-189-85-66.goldnettelecom.com.br [179.189.85.66]:55554: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)179.189.85.663469034\  -G% ossec13001gExim Auth failed2025-03-10 01:20:20 dovecot_login authenticator failed for ([59.2.141.155]) [59.2.141.155]:35840: 535 Incorrect authentication data (set_id=vikas.khandelwal)59.2.141.1551835841r  -q' ossec13001gExim Auth failed2025-03-10 01:19:59 dovecot_login authenticator failed for ([221.224.2.202]) [221.224.2.202]:56225: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)221.224.2.2021814991v  -y' ossec13001gExim Auth failed2025-03-10 00:53:34 dovecot_login authenticator failed for ([112.15.84.229]) [112.15.84.229]:49248: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)112.15.84.2291814991Z  -?) ossec13001gExim Auth failed2025-03-10 00:50:34 dovecot_login authenticator failed for ([211.248.31.142]) [211.248.31.142]:59848: 535 Incorrect authentication data (set_id=services)211.248.31.1421835841m  -e) ossec13001gExim Auth failed2025-03-10 00:50:22 dovecot_login authenticator failed for ([220.182.17.122]) [220.182.17.122]:59830: 535 Incorrect authentication data (set_id=services@heipowersystem.com)220.182.17.1221814991Q  -1% ossec13001gyExim Auth failed2025-03-10 00:44:00 dovecot_login authenticator failed for ([111.63.42.76]) [111.63.42.76]:10302: 535 Incorrect authentication data (set_id=sales)111.63.42.761814991Q  -1% ossec13001gsExim Auth failed2025-03-10 00:43:54 dovecot_login authenticator failed for ([124.216.0.10]) [124.216.0.10]:58849: 535 Incorrect authentication data (set_id=sales)124.216.0.101835841  - + ossec13001ggExim Auth failed2025-03-10 00:43:41 dovecot_login authenticator failed for cm-171-100-122-220.revip10.asianet.co.th [171.100.122.220]:49566: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)171.100.122.2201605651 *\~tj`VLB8.$zpf\H>4*   v l b X N D : 0 &    ~ t j ` V L B 8 . $    z p f \ R H > 4 *  vlbXN:D0&|rhJ@6^T,"xndZPF<2( ~tj`VLB8.$zpf\ | r h ^ T J @ 6 , "    x n d Z P F < 2 (   RRH>4*  vlbXND:0& g' g' gT' g8' g' gJ' g(' g' g' g`' gD' g' g' g ' g' gC' g0' g' g' gZ' g' g' g '~ g'} g'| g'{ g'z g'y gɢ'x gz'w g'v g9'u gE't g['s gιn'r gε'q gδ'p gγf'o gγW'n gβ'm gβ'l gβ'k gβ!'j gα'i gΰe'h gί'g gά 'f gά'e gΨ'd gΨo'c gΤ'b g΢'a g΢'` gΚ'_ gΚ'^ gΚ!'] gΚ'\ gΙ'[ gΙ'Z gΙ'Y gΙu'X gΖ~'W gΖt'V gΒ'U gΎ'T g΍V'S g΍N'R g΋K'Q g΋!'P gΉ'O gΉ'N g·n'M g·\'L g·'K g·'J g·'I g·'H g·'G gt'F gq'E gq'D gq'C gqx'B gmQ'A ghf'@ gd'? g\'> g\'= g\'< g\'; gXn': gXl'9 gR'8 gI:'7 gI0'6 gI$'5 gI'4 gHJ'3 gH0'2 g<'1 g='0 g( '/ g''. g''- g&', g$J'+ g$&'* g') g'( g'' g'& gZ'% gJ'$ g '# g '" g '! g*' g' gu' g;' g{' g-' g' g' g' g' g' g' gy' gs' gg' g[' g,' g7' g-' g ' g' g.' g֥' g֓' gԼ' gԬ' gԘ' g' g' g̀' gs' gi' g' g& g& g& gͽ& gͺ<& g͸k& g͸]& gͳ"& gͪ& gͪ& gͪ & gͩ=& gͨ=& gͨ/& gͨ+& gͦo& gͦ%& gͦ& gͣ & g͢& g͢%& gP' gP~' gPh' gM' gM' gL' gK' gFD' gF.' gD]' gDS' g<' g9 ' g9' g5' g5]' g5+' g5' g0' g.' g.' g.(' g.' g-' g,w' g,k' g,e' g,`' g#k' g#W' g!s' g:' gB' g.' g' g' gB' g' gv' gT' gJ' g@' g' g͢& g͠& g͠& g͟]& g͟?& g͟5& g͝n& g͜& g͜|& g͛j& g͛Z& g͛>& g͛"& g͙& g͘+& g͘'& g͘!& g͘& g͘& g͗?& g͗/& g͕& g͕& g͔p& g͔h& g͔R& g͔@& g͒& g͒~& g͐U& g͐I& g͐A& g͏& g͍& g͍& g͍H& g͍0& g͌T& g͋&& g͋& g͉& g͉& gW' g͉& g͉{& g͇& g͇& g͇& g͇Y& g͇E& gͅ& gͅ& gͅ& gͅ& gͅ& gͅ~& g͂& g͂r& ǵ& ǵ& g̀c& g~& g~& g~& g~& g}& g|& g|& g|& g|& g{& g{& g{t& g{d& gz& gz& gz& gz& gxw& gxe& gw& gv& gv& gs& gs& w (>Pgx%v  3Q' ossec11301gNew FTP connection.Mar 10 16:41:53 vm1 pure-ftpd[3886096]: (?@4.236.190.194) [INFO] New connection from 4.236.190.1944.236.190.1946252001mu  -c+ ossec13001g9Exim Auth failed2025-03-10 16:38:40 dovecot_plain authenticator failed for ([183.247.171.186]) [183.247.171.186]:48789: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)183.247.171.1861814991kt  -i# ossec13001gEExim Auth failed2025-03-10 16:30:20 dovecot_login authenticator failed for ([5.30.177.55]) [5.30.177.55]:36114: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)5.30.177.55290557es  -S+ ossec13001g[Exim Auth failed2025-03-10 16:30:42 dovecot_login authenticator failed for ([118.122.196.230]) [118.122.196.230]:56400: 535 Incorrect authentication data (set_id=vikas.khandelwal)118.122.196.2301814991jr  -_) ossec13001gιnExim Auth failed2025-03-10 15:35:33 dovecot_plain authenticator failed for ([188.166.241.57]) [188.166.241.57]:51760: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)188.166.241.571880251fq  -Y' ossec13001gεExim Auth failed2025-03-10 15:16:46 dovecot_plain authenticator failed for 67-60-211-114.cpe.sparklight.net [67.60.211.114]:46880: 535 Incorrect authentication data (set_id=services)67.60.211.1146252001ip  -a' ossec13001gδExim Auth failed2025-03-10 15:16:35 dovecot_plain authenticator failed for ([85.130.181.81]) [85.130.181.81]:30955: 535 Incorrect authentication data (set_id=services@heipowersystem.com)85.130.181.81294640Wo  -9) ossec13001gγfExim Auth failed2025-03-10 15:09:48 dovecot_login authenticator failed for ([183.99.228.131]) [183.99.228.131]:40970: 535 Incorrect authentication data (set_id=sales)183.99.228.1311835841in  -_) ossec13001gγWExim Auth failed2025-03-10 15:09:34 dovecot_login authenticator failed for ([185.101.16.250]) [185.101.16.250]:39485: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)185.101.16.250272103Zm  -=+ ossec13001gβExim Auth failed2025-03-10 15:07:28 dovecot_login authenticator failed for ([116.148.186.186]) [116.148.186.186]:59626: 535 Incorrect authentication data (set_id=sales)116.148.186.1861814991jl  -_) ossec13001gβExim Auth failed2025-03-10 15:07:19 dovecot_login authenticator failed for ([203.129.206.14]) [203.129.206.14]:52294: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)203.129.206.141269750vk  -w) ossec13001gβExim Auth failed2025-03-10 15:07:14 dovecot_login authenticator failed for p164213-obmd01.tokyo.ocn.ne.jp [153.141.57.213]:34469: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)153.141.57.2131861060ij  -[+ ossec13001gβ!Exim Auth failed2025-03-10 15:04:24 dovecot_login authenticator failed for ([119.206.117.105]) [119.206.117.105]:42864: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)119.206.117.1051835841ui  -y' ossec13001gαExim Auth failed2025-03-10 15:03:39 dovecot_login authenticator failed for ([91.75.105.190]) [91.75.105.190]:49639: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)91.75.105.190290557jh  -_) ossec13001gΰeExim Auth failed2025-03-10 14:56:59 dovecot_plain authenticator failed for ([49.124.152.243]) [49.124.152.243]:35028: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)49.124.152.2431733045"g  3M% ossec11301gίNew FTP connection.Mar 10 14:53:09 vm1 pure-ftpd[3863287]: (?@20.65.195.57) [INFO] New connection from 20.65.195.5720.65.195.576252001_f  -K' ossec13001gά Exim Auth failed2025-03-10 14:38:27 dovecot_plain authenticator failed for 51.174.157.77.rev.sfr.net [77.157.174.51]:33538: 535 Incorrect authentication data (set_id=services)77.157.174.513017382 ; C P j w &;g3  -Y) ossec13001gHJExim Auth failed2025-03-10 07:32:49 dovecot_login authenticator failed for (rokamauka.com) [124.160.63.122]:44231: 535 Incorrect authentication data (set_id=postmaster@rokamauka.com)124.160.63.1221814991X2  -9+ ossec13001gH0Exim Auth failed2025-03-10 07:32:22 dovecot_login authenticator failed for (rokamauka.com) [202.107.197.211]:42646: 535 Incorrect authentication data (set_id=nologin)202.107.197.2111814991g1  -[' ossec13001g<Exim Auth failed2025-03-10 06:44:33 dovecot_login authenticator failed for ([41.224.62.206]) [41.224.62.206]:43956: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)41.224.62.2062464461W0  -9) ossec13001g=Exim Auth failed2025-03-10 06:45:02 dovecot_login authenticator failed for ([220.178.246.43]) [220.178.246.43]:36910: 535 Incorrect authentication data (set_id=sales)220.178.246.431814991u/  -s+ ossec13001g( Exim Auth failed2025-03-10 05:15:15 dovecot_login authenticator failed for (thepsindustries.com) [202.107.197.211]:41166: 535 Incorrect authentication data (set_id=postmaster@thepsindustries.com)202.107.197.2111814991\.  -C) ossec13001g'Exim Auth failed2025-03-10 05:14:50 dovecot_login authenticator failed for (thepsindustries.com) [124.160.63.122]:12256: 535 Incorrect authentication data (set_id=nologin)124.160.63.1221814991-  W) ossec9708g'Dovecot Aborted Login with empty userMar 10 05:14:05 vm1 dovecot[312763]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=118.193.33.130, lip=103.74.54.108, TLS, session=118.193.33.1301819730j,  -a' ossec13001g&Exim Auth failed2025-03-10 05:09:02 dovecot_plain authenticator failed for ([95.105.66.123]) [95.105.66.123]:51394: 535 Incorrect authentication data (set_id=services@heipowersystem.com)95.105.66.1232017370o+  -g+ ossec13001g$JExim Auth failed2025-03-10 04:59:14 dovecot_login authenticator failed for (static-97.224.143.114-tataidc.co.in) [182.156.135.216]:19591: 535 Incorrect authentication data (set_id=services)182.156.135.2161269750j*  -a' ossec13001g$&Exim Auth failed2025-03-10 04:58:38 dovecot_login authenticator failed for ([61.51.184.194]) [61.51.184.194]:41657: 535 Incorrect authentication data (set_id=services@heipowersystem.com)61.51.184.1941814991a)  -O' ossec13001gExim Auth failed2025-03-10 04:09:35 dovecot_login authenticator failed for ([128.185.221.140]) [27.123.81.178]:33326: 535 Incorrect authentication data (set_id=vikas.khandelwal)27.123.81.1781269750o(  -m% ossec13001gExim Auth failed2025-03-10 04:09:11 dovecot_login authenticator failed for ([101.13.4.119]) [101.13.4.119]:42910: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)101.13.4.1191668284b'  -S' ossec13001gExim Auth failed2025-03-10 03:57:13 dovecot_plain authenticator failed for ([91.239.23.149]) [91.239.23.149]:54702: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)91.239.23.149458258o&  -q# ossec13001gExim Auth failed2025-03-10 03:56:59 dovecot_plain authenticator failed for ([2.55.64.191]) [2.55.64.191]:53332: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)2.55.64.191294640V%  -9) ossec13001gZExim Auth failed2025-03-10 03:51:13 dovecot_plain authenticator failed for ([196.190.180.18]) [196.190.180.19]:18830: 535 Incorrect authentication data (set_id=sales)196.190.180.19337996f$  -[' ossec13001gJExim Auth failed2025-03-10 03:50:58 dovecot_plain authenticator failed for ([41.59.201.180]) [41.59.201.180]:53046: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)41.59.201.180149590u#  -u) ossec13001g Exim Auth failed2025-03-10 03:14:29 dovecot_plain authenticator failed for ([218.149.70.142]) [218.149.70.142]:48214: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)218.149.70.1421835841  }qeYMA5)9ui]QE9-! |pdXL@4(th\PD8,   ]QE-! v i \ O B 5 (     r e X K > 1 $  { n a T G : -   w j ] P C 6 )    s f Y L ? 2 %~qdWJ=0# zm`SF9,vi 617790M 617790L] 617790Kp 617790J 614540J 617790G# 617790F\ 617790D} 6251999>[ 6251999> 6251999< 6251999< 6251999; 6251999;5 6251999: 6251999: 6251999: 6251999: 6251999: 6251999: 62519999 62519998 62519998 62519998 62519998# 62519996 62519996 62519995 62519995 62519995 62519995# 62519994 625199944 62519993w 62519992 62519990 62519990* 6251999. 6251999. 6251999.{ 6251999.Q 6251999.! 6251999- 6251999- 6251999-s 6251999- 6251999, 6251999, 6251999, 6251999+a 6251999*4 6251999) 6251999) 6251999) 6251999)x 6251999)= 597427@ 617790 617790 617790 617790 6177905 617790 617790 617790c 617790^ 617790 617790 617790 ^ 617790 617790 ~ 617790 & 617790 617790 a 617790 617790 [ 617790 H 614540?s 6145406] 6145404 6145403[ 6145401a 5974274 597427* 597427& 597427$9 597427# 597427"E 597427% 597427\ 597427Z 597427 597427 597427T 597427M 597427 h 597427 617790> 617790> 617790=b 617790< 617790<} 61779083 6177907o 6177905+ 6251999)6 6251999(l 6251999([ 6251999(% 6251999' 6251999& 6251999& 6251999&% 6251999% 6251999% 6251999% 6251999% 6251999$ 6251999$ 6251999# 6251999# 6251999# 6251999! 6251999! 6251999 6251999 6251999 6251999 6251999 6251999 6251999 6251999 6251999 6251999 6251999 6251999a 6251999 6251999 6251999 62519993 6251999 6251999 6251999y 6251999 6251999 6251999T 6251999( 6251999 6251999 6251999 6251999 6251999x 6251999 6251999 6251999I 6251999 6251999 6251999J 6251999 6251999 6251999} 6251999 6251999U 6251999 6251999> 6251999 6251999 6251999* 6251999= 62519991 6251999 6251999 s 6251999 J 6251999 n 6251999 . 6251999  6251999 [ 6251999 M 6251999 d 6251999 6251999  6251999 6251999 f 6251999 , 6251999  6251999 6251999= 6251999 6251999c 6251999b 6251999Q 6251999B 6177904% 6177903+ 6177901 617790/Q 617790- 617790- 617790- 617790- 617790, 617790,+ 617790, 617790+ 617790+ 617790* 617790)p 617790)7 617790(. 617790&X 617790% 617790% 617790$_ 617790$M 617790# 617790# 617790# 617790#! 617790" 617790 617790 617790 _ 617790 S 617790 617790 617790C 617790: 617790 617790 617790x 617790B 6177902 617790 617790 617790 617790> 617790( 617790e 617790b 617790 617790 617790, 617790 6177907 > V {  d CIKarC  -q' ossec13001gqExim Auth failed2025-03-10 10:28:43 dovecot_login authenticator failed for 079.42.246.220.static.netvigator.com [220.246.42.79]:55055: 535 Incorrect authentication data (set_id=vikas.khandelwal)220.246.42.791819730B  -% ossec13001gqxExim Auth failed2025-03-10 10:28:32 dovecot_login authenticator failed for 32.104.29.34.bc.googleusercontent.com [34.29.104.32]:36590: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)34.29.104.326252001A  - ) ossec13001gmQExim Auth failed2025-03-10 10:10:48 dovecot_plain authenticator failed for syn-172-100-186-071.res.spectrum.com [172.100.186.71]:41746: 535 Incorrect authentication data (set_id=services@heipowersystem.com)172.100.186.716252001d@  -Y# ossec13001ghfExim Auth failed2025-03-10 09:49:49 dovecot_login authenticator failed for ([61.169.6.99]) [61.169.6.99]:58414: 535 Incorrect authentication data (set_id=services@heipowersystem.com)61.169.6.991814991%?  3Q' ossec11301gdNew FTP connection.Mar 10 09:34:29 vm1 pure-ftpd[3796288]: (?@206.168.34.39) [INFO] New connection from 206.168.34.39206.168.34.396252001Y>  -C# ossec13001g\Exim Auth failed2025-03-10 08:59:46 dovecot_login authenticator failed for ([1.24.210.27]) [1.24.210.27]:34864: 535 Incorrect authentication data (set_id=vikas.khandelwal)1.24.210.271814991f=  -W) ossec13001g\Exim Auth failed2025-03-10 08:59:42 dovecot_plain authenticator failed for ([178.178.222.52]) [178.178.222.52]:38508: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)178.178.222.522017370z<  -# ossec13001g\Exim Auth failed2025-03-10 08:59:37 dovecot_login authenticator failed for bsn-61-28-83.dynamic.siol.net [86.61.28.83]:56634: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)86.61.28.833190538v;  -y' ossec13001g\Exim Auth failed2025-03-10 08:59:32 dovecot_plain authenticator failed for ([149.54.15.126]) [149.54.15.126]:43993: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)149.54.15.1261149361: W' ossec9708gXnDovecot Aborted Login with empty userMar 10 08:41:40 vm1 dovecot[312763]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=185.226.196.8, lip=103.74.54.108, TLS, session=<6jPBVPQvW6e54sQI>185.226.196.822643979  W' ossec9708gXlDovecot Aborted Login with empty userMar 10 08:41:39 vm1 dovecot[312763]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=185.226.196.7, lip=103.74.54.108, session=185.226.196.72264397x8  -y+ ossec13001gRExim Auth failed2025-03-10 08:16:48 dovecot_plain authenticator failed for ([111.193.226.252]) [111.193.226.252]:29844: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)111.193.226.2521814991W7  -9) ossec13001gI:Exim Auth failed2025-03-10 07:36:50 dovecot_login authenticator failed for ([222.128.80.201]) [222.128.80.201]:53542: 535 Incorrect authentication data (set_id=sales)222.128.80.2011814991d6  -W% ossec13001gI0Exim Auth failed2025-03-10 07:36:39 dovecot_login authenticator failed for ([102.53.15.17]) [102.53.15.17]:59277: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)102.53.15.172542007V5  -9) ossec13001gI$Exim Auth failed2025-03-10 07:36:27 dovecot_login authenticator failed for ([185.101.16.250]) [185.101.16.250]:45618: 535 Incorrect authentication data (set_id=sales)185.101.16.250272103d4  -W% ossec13001gIExim Auth failed2025-03-10 07:36:18 dovecot_login authenticator failed for ([218.68.0.210]) [218.68.0.210]:59194: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)218.68.0.2101814991 o= #No[T -A' ossec13001gΎExim Auth failed2025-03-10 12:30:46 dovecot_login authenticator failed for (thepsindustries.com) [111.56.54.202]:45514: 535 Incorrect authentication data (set_id=nologin)111.56.54.2021814991QS  -1% ossec13001g΍VExim Auth failed2025-03-10 12:27:25 dovecot_login authenticator failed for ([176.31.174.3]) [176.31.174.3]:47457: 535 Incorrect authentication data (set_id=sales)176.31.174.33017382gR  -[' ossec13001g΍NExim Auth failed2025-03-10 12:27:17 dovecot_login authenticator failed for ([61.131.46.146]) [61.131.46.146]:50685: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)61.131.46.1461814991fQ  -W) ossec13001g΋KExim Auth failed2025-03-10 12:18:42 dovecot_login authenticator failed for ([119.202.250.32]) [119.202.250.32]:39843: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)119.202.250.321835841P  -/) ossec13001g΋!Exim Auth failed2025-03-10 12:18:00 dovecot_login authenticator failed for (123-110-53-177.cctv.dynamic.tbcnet.net.tw) [123.110.53.177]:40143: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)123.110.53.1771668284TO  -7% ossec13001gΉExim Auth failed2025-03-10 12:13:07 dovecot_login authenticator failed for ([111.63.42.76]) [111.63.42.76]:35342: 535 Incorrect authentication data (set_id=services)111.63.42.761814991pN  -i+ ossec13001gΉExim Auth failed2025-03-10 12:12:54 dovecot_login authenticator failed for ([103.106.154.141]) [103.106.154.141]:55248: 535 Incorrect authentication data (set_id=services@heipowersystem.com)103.106.154.1411269750lM  -i# ossec13001g·nExim Auth failed2025-03-10 12:02:12 dovecot_login authenticator failed for host-79-9-125-33.business.telecomitalia.it [79.9.125.33]:62613: 535 Incorrect authentication data (set_id=services)79.9.125.333175395mL  -e) ossec13001g·\Exim Auth failed2025-03-10 12:01:56 dovecot_login authenticator failed for ([222.116.47.157]) [222.116.47.157]:54468: 535 Incorrect authentication data (set_id=services@heipowersystem.com)222.116.47.1571835841|K  -) ossec13001g·Exim Auth failed2025-03-10 12:00:42 dovecot_login authenticator failed for 80.111.168.125.sta.wbroadband.net.au [125.168.111.80]:36729: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)125.168.111.802077456dJ  -W% ossec13001g·Exim Auth failed2025-03-10 12:00:39 dovecot_login authenticator failed for ([61.97.17.208]) [61.97.17.208]:34097: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)61.97.17.2081835841I -%+ ossec13001g·Exim Auth failed2025-03-10 12:00:39 dovecot_login authenticator failed for (173-166-112-154-newengland.hfc.comcastbusiness.net) [173.166.112.154]:57959: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)173.166.112.1546252001gH  -[' ossec13001g·Exim Auth failed2025-03-10 12:00:52 dovecot_login authenticator failed for syn-097-089-202-226.biz.spectrum.com [97.89.202.226]:55806: 535 Incorrect authentication data (set_id=sales)97.89.202.2266252001iG  -]) ossec13001g·Exim Auth failed2025-03-10 12:00:47 dovecot_login authenticator failed for 195-159-217-71.customer.powertech.no [195.159.217.71]:46878: 535 Incorrect authentication data (set_id=sales)195.159.217.713144096+F  3Y+ ossec11301gtNew FTP connection.Mar 10 10:43:23 vm1 pure-ftpd[3810817]: (?@172.202.117.178) [INFO] New connection from 172.202.117.178172.202.117.1786252001TE  -5' ossec13001gqExim Auth failed2025-03-10 10:29:20 dovecot_plain authenticator failed for ([112.4.150.142]) [112.4.150.142]:39486: 535 Incorrect authentication data (set_id=sales)112.4.150.1421814991gD  -[' ossec13001gqExim Auth failed2025-03-10 10:29:07 dovecot_plain authenticator failed for ([47.206.95.195]) [47.206.95.195]:40368: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)47.206.95.1956252001 4  . S P mw!4ie  -a' ossec13001gάExim Auth failed2025-03-10 14:38:17 dovecot_plain authenticator failed for ([85.130.181.81]) [85.130.181.81]:65209: 535 Incorrect authentication data (set_id=services@heipowersystem.com)85.130.181.81294640Td  -7% ossec13001gΨExim Auth failed2025-03-10 14:23:19 dovecot_login authenticator failed for ([60.221.58.77]) [60.221.58.77]:56483: 535 Incorrect authentication data (set_id=services)60.221.58.771814991pc  -i+ ossec13001gΨoExim Auth failed2025-03-10 14:23:01 dovecot_login authenticator failed for ([103.106.154.141]) [103.106.154.141]:36930: 535 Incorrect authentication data (set_id=services@heipowersystem.com)103.106.154.1411269750yb  -}) ossec13001gΤExim Auth failed2025-03-10 14:04:31 dovecot_plain authenticator failed for ([197.242.170.10]) [197.242.170.10]:51268: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)197.242.170.101036973Pa  -/% ossec13001g΢Exim Auth failed2025-03-10 13:59:00 dovecot_plain authenticator failed for ([27.71.20.180]) [27.71.20.180]:5636: 535 Incorrect authentication data (set_id=sales)27.71.20.1801562822d`  -W% ossec13001g΢Exim Auth failed2025-03-10 13:58:39 dovecot_plain authenticator failed for ([2.63.169.110]) [2.63.169.110]:58580: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)2.63.169.1102017370s_  -u' ossec13001gΚExim Auth failed2025-03-10 13:25:19 dovecot_plain authenticator failed for bzq-109-67-154-24.red.bezeqint.net [109.67.154.24]:54984: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)109.67.154.24294640v^  -y' ossec13001gΚExim Auth failed2025-03-10 13:24:59 dovecot_plain authenticator failed for ([103.174.34.49]) [103.174.34.49]:60171: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)103.174.34.491269750\]  -G% ossec13001gΚ!Exim Auth failed2025-03-10 13:22:00 dovecot_plain authenticator failed for ([42.81.140.83]) [42.81.140.83]:43311: 535 Incorrect authentication data (set_id=vikas.khandelwal)42.81.140.831814991r\  -q' ossec13001gΚExim Auth failed2025-03-10 13:21:44 dovecot_plain authenticator failed for ([50.224.22.135]) [50.224.22.135]:42906: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)50.224.22.1356252001_[  -K' ossec13001gΙExim Auth failed2025-03-10 13:19:57 dovecot_login authenticator failed for ([103.65.227.12]) [103.65.227.12]:55562: 535 Incorrect authentication data (set_id=vikas.khandelwal)103.65.227.121210997Z  - ) ossec13001gΙExim Auth failed2025-03-10 13:19:47 dovecot_login authenticator failed for (91-220-216-178.omsk.mts.ru) [178.216.220.91]:53620: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)178.216.220.912017370WY  -9) ossec13001gΙExim Auth failed2025-03-10 13:19:23 dovecot_plain authenticator failed for ([203.129.206.14]) [203.129.206.14]:44928: 535 Incorrect authentication data (set_id=sales)203.129.206.141269750gX  -[' ossec13001gΙuExim Auth failed2025-03-10 13:19:08 dovecot_plain authenticator failed for ([45.115.173.11]) [45.115.173.11]:33799: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)45.115.173.111269750tW  -q+ ossec13001gΖ~Exim Auth failed2025-03-10 13:06:29 dovecot_login authenticator failed for (bb128-106-196-150.singnet.com.sg) [128.106.196.150]:23957: 535 Incorrect authentication data (set_id=vikas.khandelwal)128.106.196.1501880251oV  -m% ossec13001gΖtExim Auth failed2025-03-10 13:06:19 dovecot_login authenticator failed for ([60.221.58.77]) [60.221.58.77]:33135: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)60.221.58.771814991xU  -% ossec13001gΒExim Auth failed2025-03-10 12:49:33 dovecot_login authenticator failed for syn-072-017-090-246.biz.spectrum.com [72.17.90.246]:39576: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)72.17.90.2466252001  " u &3y  -}) ossec13001gExim Auth failed2025-03-10 19:10:00 dovecot_plain authenticator failed for ([182.160.107.51]) [182.160.107.51]:41104: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)182.160.107.511210997W  -9) ossec13001gCExim Auth failed2025-03-10 19:03:54 dovecot_plain authenticator failed for ([61.191.163.102]) [61.191.163.102]:59632: 535 Incorrect authentication data (set_id=sales)61.191.163.1021814991j  -_) ossec13001g0Exim Auth failed2025-03-10 19:03:35 dovecot_plain authenticator failed for ([125.136.163.86]) [125.136.163.86]:36276: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)125.136.163.861835841  W' ossec9708gDovecot Aborted Login with empty userMar 10 19:01:22 vm1 dovecot[312763]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=87.236.176.80, lip=103.74.54.108, TLS, session=87.236.176.802635167z  U[% ossec11001gDeferred login on the cpanel service[2025-03-10 18:41:01 +0530] info [webmaild] 49.35.184.25 - kps@amplifypowerglobal.com "POST /cpsess6660476028/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [49.35.168.98] != Current IP Address [49.35.184.25]49.35.184.251269750o  -m% ossec13001gZExim Auth failed2025-03-10 18:25:52 dovecot_plain authenticator failed for ([103.4.103.61]) [103.4.103.61]:40976: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)103.4.103.611168579O  -1% ossec13001gExim Auth failed2025-03-10 18:11:52 dovecot_plain authenticator failed for ([65.20.128.78]) [65.20.128.78]:52525: 535 Incorrect authentication data (set_id=sales)65.20.128.7899237m  -c+ ossec13001gExim Auth failed2025-03-10 18:11:32 dovecot_plain authenticator failed for ([163.179.105.241]) [163.179.105.241]:56225: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)163.179.105.2411814991f~  -[' ossec13001g Exim Auth failed2025-03-10 17:58:59 dovecot_login authenticator failed for ([91.72.153.110]) [91.72.153.110]:51348: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)91.72.153.110290557Z}  -?) ossec13001gExim Auth failed2025-03-10 17:54:06 dovecot_plain authenticator failed for ([31.220.168.116]) [31.220.168.116]:53180: 535 Incorrect authentication data (set_id=services)31.220.168.1162017370m|  -e) ossec13001gExim Auth failed2025-03-10 17:53:44 dovecot_plain authenticator failed for ([138.75.118.229]) [138.75.118.229]:60519: 535 Incorrect authentication data (set_id=services@heipowersystem.com)138.75.118.2291880251Z{  -?) ossec13001gExim Auth failed2025-03-10 17:19:58 dovecot_login authenticator failed for ([161.35.200.202]) [161.35.200.202]:55884: 535 Incorrect authentication data (set_id=services)161.35.200.2022921044pz  -i+ ossec13001gExim Auth failed2025-03-10 17:19:45 dovecot_login authenticator failed for ([103.115.254.158]) [103.115.254.158]:50756: 535 Incorrect authentication data (set_id=services@heipowersystem.com)103.115.254.1581210997)y  EK% ossec5715gSSHD authentication success.Mar 10 16:49:49 vm1 sshd[3887758]: Accepted password for root from 103.190.54.7 port 50886 ssh2103.190.54.71269750cx  -S' ossec13001gɢExim Auth failed2025-03-10 16:44:40 dovecot_plain authenticator failed for ([49.124.153.27]) [49.124.153.27]:52018: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)49.124.153.271733045sw  -u% ossec13001gzExim Auth failed2025-03-10 16:44:00 dovecot_plain authenticator failed for ([61.76.58.118]) [61.76.58.118]:39270: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)61.76.58.1181835841  j | & 5 L^qT  -5' ossec13001g@Exim Auth failed2025-03-10 21:03:18 dovecot_plain authenticator failed for ([37.28.177.141]) [37.28.177.141]:49468: 535 Incorrect authentication data (set_id=sales)37.28.177.1412017370u  -{# ossec13001gExim Auth failed2025-03-10 21:02:35 dovecot_plain authenticator failed for net-2-35-217-44.cust.vodafonedsl.it [2.35.217.44]:47031: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)2.35.217.443175395r  -o) ossec13001gExim Auth failed2025-03-10 21:01:27 dovecot_plain authenticator failed for (94.124.156.175.unknown.m1.com.sg) [175.156.124.94]:54507: 535 Incorrect authentication data (set_id=vikas.khandelwal)175.156.124.941880251o  -m% ossec13001gExim Auth failed2025-03-10 21:01:15 dovecot_plain authenticator failed for ([85.152.57.60]) [85.152.57.60]:54572: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)85.152.57.602510769s  -u% ossec13001gTExim Auth failed2025-03-10 20:42:20 dovecot_plain authenticator failed for 206.81.4.146.static.wline.lns.sme.cust.swisscom.ch [146.4.81.206]:42330: 535 Incorrect authentication data (set_id=sales)146.4.81.2062658434d  -W% ossec13001g8Exim Auth failed2025-03-10 20:41:51 dovecot_plain authenticator failed for ([27.115.42.62]) [27.115.42.62]:54332: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)27.115.42.621814991b -Q' ossec13001gExim Auth failed2025-03-10 20:36:24 dovecot_login authenticator failed for (User) [193.46.255.40]:39144: 535 Incorrect authentication data (set_id=sourcing@s2seducationtrust.com)193.46.255.40798549i  -]) ossec13001gJExim Auth failed2025-03-10 20:29:21 dovecot_login authenticator failed for 109.43.246.220.static.netvigator.com [220.246.43.109]:50708: 535 Incorrect authentication data (set_id=sales)220.246.43.1091819730j  -_) ossec13001g(Exim Auth failed2025-03-10 20:28:46 dovecot_login authenticator failed for ([167.250.118.53]) [167.250.118.53]:44419: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)167.250.118.533865483e  -[# ossec13001gExim Auth failed2025-03-10 20:23:22 dovecot_plain authenticator failed for 36.74-67-87.adsl-dyn.isp.belgacom.be [87.67.74.36]:3403: 535 Incorrect authentication data (set_id=services)87.67.74.362802361m  -e) ossec13001gExim Auth failed2025-03-10 20:23:12 dovecot_plain authenticator failed for ([124.65.160.234]) [124.65.160.234]:59050: 535 Incorrect authentication data (set_id=services@heipowersystem.com)124.65.160.2341814991R  =) ossec13008g`Mail Reciepient rejected2025-03-10 20:12:39 H=(mail.westerndancecompany.com) [165.154.233.80]:58578 F= rejected RCPT : Rejected relay attempt: '165.154.233.80' From: 'dsjkierskrs@westerndancecompany.com' To: 'goofile@fastmail.com'165.154.233.801694008j  -_) ossec13001gDExim Auth failed2025-03-10 19:59:22 dovecot_login authenticator failed for ([218.150.170.10]) [218.150.170.10]:37652: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)218.150.170.101835841(  3U) ossec11301gNew FTP connection.Mar 10 19:17:47 vm1 pure-ftpd[3919504]: (?@147.45.112.185) [INFO] New connection from 147.45.112.185147.45.112.1852134431  3I# ossec11301gNew FTP connection.Mar 10 19:14:58 vm1 pure-ftpd[3918838]: (?@60.13.6.250) [INFO] New connection from 60.13.6.25060.13.6.2501814991C  =+ ossec13008g Mail Reciepient rejected2025-03-10 19:11:31 H=(mail.s2seducationtrust.com) [165.154.213.130]:61229 F= rejected RCPT : Rejected relay attempt: '165.154.213.130' From: 'llsxw@s2seducationtrust.com' To: 'goofile@fastmail.com'165.154.213.1303469034 C4@~z q k b [ VQK;444.~&%52.169.4.211BLACKg}g}Blacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests29635974local%)179.43.188.122BLACKggųBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests2658434+zlocal$%193.24.211.4BLACKg\gҶ\Blacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests2921044local~%48.210.29.75BLACKg*/g/Blacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests18610600Klocal~ %52.169.94.12BLACKgۨgyBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests29635974^ local '40.126.245.60BLACKgugFBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests2077456(~<localI#%157.66.54.26BLACKgߤguBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests1643084B6local!'52.169.180.58BLACKgDFgFBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests29635974:local '13.79.187.207BLACKg9fg fBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests2963597 Olocal)52.169.180.122BLACKggЩBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests29635974zlocal}#84.239.5.21BLACKgݱgЂBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests6252001Tlocal'217.154.80.83BLACKg݊g[Blacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests2921044ٚPSlocal~%52.169.94.26BLACKg݇}gX}Blacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests29635974^local)52.169.181.250BLACKgGgBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests29635974local'13.79.186.222BLACKg6gBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests2963597 Olocal'149.22.90.207BLACKg gBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests2802361Zlocal+144.126.146.166BLACKglocal~%13.94.69.150BLACKg gϖ Blacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests2963597 ^Elocal'193.41.206.12BLACKgܵgφBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests3017382) local)43.153.193.106BLACKgwgHBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests1880251+jlocal'52.169.181.33BLACKgXg)Blacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests29635974!local'52.169.93.157BLACKg9g Blacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests29635974]local'48.210.31.133BLACKg*gBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests18610600local 5 ; < -EjQ'  -1% ossec13001g,wExim Auth failed2025-03-10 23:46:23 dovecot_login authenticator failed for ([211.93.6.230]) [211.93.6.230]:39398: 535 Incorrect authentication data (set_id=sales)211.93.6.2301814991Q&  -1% ossec13001g,kExim Auth failed2025-03-10 23:46:10 dovecot_login authenticator failed for ([36.112.75.46]) [36.112.75.46]:28962: 535 Incorrect authentication data (set_id=sales)36.112.75.461814991s%  -u% ossec13001g,eExim Auth failed2025-03-10 23:46:04 dovecot_login authenticator failed for 111-70-3-198.emome-ip.hinet.net [111.70.3.198]:51688: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)111.70.3.1981668284d$  -W% ossec13001g,`Exim Auth failed2025-03-10 23:45:59 dovecot_login authenticator failed for ([194.65.69.71]) [194.65.69.71]:60867: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)194.65.69.712264397W#  -9) ossec13001g#kExim Auth failed2025-03-10 23:07:47 dovecot_login authenticator failed for ([222.239.231.61]) [222.239.231.61]:25939: 535 Incorrect authentication data (set_id=sales)222.239.231.611835841d"  -W% ossec13001g#WExim Auth failed2025-03-10 23:07:27 dovecot_login authenticator failed for ([14.35.218.58]) [14.35.218.58]:47690: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)14.35.218.581835841&! 3Q' ossec11301g!sNew FTP connection.Mar 10 22:59:22 vm1 pure-ftpd[3965170]: (?@106.75.61.236) [INFO] New connection from 106.75.61.236106.75.61.2361814991p  -i+ ossec13001g:Exim Auth failed2025-03-10 22:45:36 dovecot_plain authenticator failed for ([134.175.226.122]) [134.175.226.122]:38776: 535 Incorrect authentication data (set_id=services@heipowersystem.com)134.175.226.1221814991Z  -=+ ossec13001gBExim Auth failed2025-03-10 22:41:29 dovecot_plain authenticator failed for ([190.121.193.126]) [190.121.193.126]:40326: 535 Incorrect authentication data (set_id=sales)190.121.193.1263595528x  -}' ossec13001g.Exim Auth failed2025-03-10 22:41:08 dovecot_plain authenticator failed for (109.cpe-186-68-83.gye.satnet.net) [186.68.83.109]:57622: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)186.68.83.1093658394d  -Y# ossec13001gExim Auth failed2025-03-10 22:22:59 dovecot_plain authenticator failed for ([112.94.6.54]) [112.94.6.54]:58436: 535 Incorrect authentication data (set_id=services@heipowersystem.com)112.94.6.541814991  -# ossec13001gExim Auth failed2025-03-10 22:14:14 dovecot_login authenticator failed for static-98-110-70-2.cmdnnj.fios.verizon.net [98.110.70.2]:56205: 535 Incorrect authentication data (set_id=services@heipowersystem.com)98.110.70.26252001(  3U) ossec11301gBNew FTP connection.Mar 10 21:46:00 vm1 pure-ftpd[3950004]: (?@147.185.132.33) [INFO] New connection from 147.185.132.33147.185.132.336252001{  -+ ossec13001gExim Auth failed2025-03-10 21:43:09 dovecot_plain authenticator failed for ([218.75.123.109]) [183.247.171.186]:37153: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)183.247.171.1861814991v  -y' ossec13001gvExim Auth failed2025-03-10 21:42:37 dovecot_plain authenticator failed for ([123.182.89.19]) [123.182.89.19]:48793: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)123.182.89.191814991Z  -=+ ossec13001gTExim Auth failed2025-03-10 21:37:47 dovecot_plain authenticator failed for ([115.242.200.126]) [115.242.200.126]:56260: 535 Incorrect authentication data (set_id=sales)115.242.200.1261269750i  -]) ossec13001gJExim Auth failed2025-03-10 21:37:36 dovecot_plain authenticator failed for ([103.59.134.177]) [103.59.134.177]:7120: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)103.59.134.1771269750 1 s o!'1r8  -q' ossec13001gFDExim Auth failed2025-03-11 01:36:26 dovecot_plain authenticator failed for syn-075-080-100-185.res.spectrum.com [75.80.100.185]:33868: 535 Incorrect authentication data (set_id=vikas.khandelwal)75.80.100.1856252001v7  -w) ossec13001gF.Exim Auth failed2025-03-11 01:36:05 dovecot_plain authenticator failed for ([159.223.250.131]) [161.35.200.202]:33316: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)161.35.200.2022921044^6  -K' ossec13001gD]Exim Auth failed2025-03-11 01:28:21 dovecot_plain authenticator failed for ([46.30.161.197]) [46.30.161.197]:47639: 535 Incorrect authentication data (set_id=vikas.khandelwal)46.30.161.1976907915  -' ossec13001gDSExim Auth failed2025-03-11 01:28:10 dovecot_plain authenticator failed for 111-70-32-180.emome-ip.hinet.net [111.70.32.180]:38584: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)111.70.32.1801668284c4  -W% ossec13001g<Exim Auth failed2025-03-11 00:54:47 dovecot_login authenticator failed for ([45.93.94.125]) [45.93.94.125]:55108: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)45.93.94.125294640u3  -w' ossec13001g9 Exim Auth failed2025-03-11 00:40:23 dovecot_login authenticator failed for (s2seducationtrust.com) [111.56.54.202]:54984: 535 Incorrect authentication data (set_id=postmaster@s2seducationtrust.com)111.56.54.2021814991\2  -E' ossec13001g9Exim Auth failed2025-03-11 00:39:55 dovecot_login authenticator failed for (s2seducationtrust.com) [111.56.54.202]:52090: 535 Incorrect authentication data (set_id=nologin)111.56.54.2021814991h1  -_% ossec13001g5Exim Auth failed2025-03-11 00:25:17 dovecot_login authenticator failed for (heipowersystem.com) [125.72.54.81]:58952: 535 Incorrect authentication data (set_id=admin@heipowersystem.com)125.72.54.811814991W0  -=% ossec13001g5]Exim Auth failed2025-03-11 00:24:21 dovecot_login authenticator failed for (heipowersystem.com) [125.72.54.81]:53788: 535 Incorrect authentication data (set_id=nologin)125.72.54.811814991\/  -G% ossec13001g5+Exim Auth failed2025-03-11 00:23:31 dovecot_login authenticator failed for ([36.112.75.46]) [36.112.75.46]:13718: 535 Incorrect authentication data (set_id=vikas.khandelwal)36.112.75.461814991.  - ) ossec13001g5Exim Auth failed2025-03-11 00:23:05 dovecot_login authenticator failed for (ipoe-static.mosoblast.rt.ru) [89.109.233.181]:35726: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)89.109.233.1812017370-  ?1 ossec1008g0Process exiting (killed).Mar 11 00:05:33 vm1 spamd[3374951]: spamd: server killed by SIGTERM, shutting downr,  -q' ossec13001g.Exim Auth failed2025-03-10 23:56:29 dovecot_login authenticator failed for 67-60-211-114.cpe.sparklight.net [67.60.211.114]:54792: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)67.60.211.1146252001y+  -}) ossec13001g.Exim Auth failed2025-03-10 23:55:56 dovecot_login authenticator failed for ([197.255.200.75]) [197.255.200.75]:37028: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)197.255.200.752413451Z*  -?) ossec13001g.(Exim Auth failed2025-03-10 23:53:35 dovecot_login authenticator failed for ([222.239.231.61]) [222.239.231.61]:14823: 535 Incorrect authentication data (set_id=services)222.239.231.611835841d)  -Y# ossec13001g.Exim Auth failed2025-03-10 23:53:15 dovecot_login authenticator failed for ([27.98.249.9]) [27.98.249.9]:33986: 535 Incorrect authentication data (set_id=services@heipowersystem.com)27.98.249.91814991F(  =+ ossec13008g-Mail Reciepient rejected2025-03-10 23:51:02 H=(mail.amplifypowerglobal.com) [165.154.210.114]:58517 F= rejected RCPT : Rejected relay attempt: '165.154.210.114' From: 'xabwy@amplifypowerglobal.com' To: 'goofile@fastmail.com'165.154.210.1141694008  ( P S Z q `M_UI  -;# ossec13001gk9Exim Auth failed2025-03-11 04:14:09 dovecot_login authenticator failed for (heipowersystem.com) [14.18.77.99]:37340: 535 Incorrect authentication data (set_id=nologin)14.18.77.991814991jH  -a' ossec13001gaExim Auth failed2025-03-11 03:33:29 dovecot_plain authenticator failed for syn-172-090-128-097.res.spectrum.com [172.90.128.97]:50503: 535 Incorrect authentication data (set_id=services)172.90.128.976252001G  -+) ossec13001gaExim Auth failed2025-03-11 03:33:15 dovecot_plain authenticator failed for ip4-193-93-156-147.blue-net.com.pl ([193.93.156.149]) [193.93.156.147]:49222: 535 Incorrect authentication data (set_id=services@heipowersystem.com)193.93.156.147798544(F  3U) ossec11301gaNew FTP connection.Mar 11 03:33:52 vm1 pure-ftpd[4024355]: (?@20.169.106.209) [INFO] New connection from 20.169.106.20920.169.106.2096252001[E -C% ossec13001g^$Exim Auth failed2025-03-11 03:18:19 dovecot_login authenticator failed for (s2seducationtrust.com) [119.96.131.8]:41280: 535 Incorrect authentication data (set_id=nologin)119.96.131.81814991gD  -[' ossec13001g\Exim Auth failed2025-03-11 03:12:27 dovecot_plain authenticator failed for ([146.88.78.123]) [146.88.78.123]:37035: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)146.88.78.1231694008mC  -e) ossec13001g\WExim Auth failed2025-03-11 03:10:38 dovecot_login authenticator failed for ([221.140.188.44]) [221.140.188.44]:37308: 535 Incorrect authentication data (set_id=services@heipowersystem.com)221.140.188.441835841ZB  -?) ossec13001gYyExim Auth failed2025-03-11 02:58:24 dovecot_plain authenticator failed for ([60.171.237.143]) [60.171.237.143]:39005: 535 Incorrect authentication data (set_id=services)60.171.237.1431814991jA  -a' ossec13001gYbExim Auth failed2025-03-11 02:58:02 dovecot_plain authenticator failed for ([200.61.12.107]) [200.61.12.107]:61813: 535 Incorrect authentication data (set_id=services@heipowersystem.com)200.61.12.1073865483Z@  -A' ossec13001gWExim Auth failed2025-03-11 02:51:22 dovecot_login authenticator failed for (thepsindustries.com) [58.240.171.59]:35334: 535 Incorrect authentication data (set_id=nologin)58.240.171.591814991e?  -S+ ossec13001gPExim Auth failed2025-03-11 02:20:19 dovecot_login authenticator failed for ([118.220.149.129]) [118.220.149.129]:57374: 535 Incorrect authentication data (set_id=vikas.khandelwal)118.220.149.1291835841u>  -u) ossec13001gP~Exim Auth failed2025-03-11 02:20:05 dovecot_login authenticator failed for ([202.108.14.226]) [202.108.14.225]:54618: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)202.108.14.2251814991y=  -}) ossec13001gPhExim Auth failed2025-03-11 02:19:44 dovecot_plain authenticator failed for ([95.165.217.194]) [95.165.217.194]:49234: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)95.165.217.1942017370T<  -5' ossec13001gMExim Auth failed2025-03-11 02:05:36 dovecot_login authenticator failed for ([180.7.180.120]) [180.7.180.120]:38346: 535 Incorrect authentication data (set_id=sales)180.7.180.1201861060f;  -Y' ossec13001gMExim Auth failed2025-03-11 02:05:15 dovecot_login authenticator failed for ([103.98.21.22]) [125.99.242.32]:43722: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)125.99.242.321269750y:  -}) ossec13001gLExim Auth failed2025-03-11 02:03:41 dovecot_plain authenticator failed for mail-02.03.perm.ru [46.146.210.180]:34594: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)46.146.210.1802017370m9  -c+ ossec13001gKExim Auth failed2025-03-11 01:58:57 dovecot_plain authenticator failed for ([109.124.195.218]) [109.124.195.218]:56774: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)109.124.195.2182017370 0A[uyl_R@3& t J=0~dWJ=0# zSF9,^QD7*gZMobUH;.!/"|pcVI< Y L } ? 2 %E  8 fxk w j ] { n a T G : -   m`q~qdW4'  K > 1 $  Nh  r e X+ O B 5 (     s P C 6 )     v i \ 18358414l 18358414g 18358414Y 18358419 18358419 18358419 18358419 18358419 18358413 1835841: 18358419 18358419 18358419 18358419 18358419 18358413 1835841: 1835841:u 1835841:F 1835841:9 1835841:6 18358413 1835841; 18358413! 1835841; 18358413, 1835841<- 1835841<, 1835841< 1835841< 1835841< 183584135 18358413. 1835841 ]  H[-d[  -W% ossec13001gό^Exim Auth failed2025-03-11 06:35:32 dovecot_plain authenticator failed for ([141.94.18.69]) [141.94.18.69]:52466: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)141.94.18.693017382TZ  -5' ossec13001gόpExim Auth failed2025-03-11 06:35:51 dovecot_plain authenticator failed for ([61.133.10.205]) [61.133.10.204]:38172: 535 Incorrect authentication data (set_id=sales)61.133.10.2041814991pY  -i+ ossec13001gϊOExim Auth failed2025-03-11 06:26:46 dovecot_plain authenticator failed for ([123.210.152.243]) [123.210.152.243]:47962: 535 Incorrect authentication data (set_id=services@heipowersystem.com)123.210.152.2432077456$X  3Q' ossec11301gω_New FTP connection.Mar 11 06:22:46 vm1 pure-ftpd[4059259]: (?@185.93.89.132) [INFO] New connection from 185.93.89.132185.93.89.132130758NW  --# ossec13001gρExim Auth failed2025-03-11 05:51:17 dovecot_login authenticator failed for ([181.49.3.38]) [181.49.3.38]:53368: 535 Incorrect authentication data (set_id=sales)181.49.3.383686110iV  -_' ossec13001gρExim Auth failed2025-03-11 05:50:56 dovecot_login authenticator failed for (www.safecleen.com) [58.49.113.138]:19700: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)58.49.113.1381814991TU  -5' ossec13001gπExim Auth failed2025-03-11 05:46:51 dovecot_plain authenticator failed for ([217.24.185.98]) [217.24.185.98]:49030: 535 Incorrect authentication data (set_id=sales)217.24.185.982017370cT  -W% ossec13001gπExim Auth failed2025-03-11 05:46:30 dovecot_plain authenticator failed for ([94.204.96.91]) [94.204.96.91]:52065: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)94.204.96.91290557bS  -O) ossec13001gzExim Auth failed2025-03-11 05:21:22 dovecot_plain authenticator failed for ([112.111.61.232]) [112.111.61.229]:59842: 535 Incorrect authentication data (set_id=vikas.khandelwal)112.111.61.2291814991uR  -u) ossec13001gzExim Auth failed2025-03-11 05:20:48 dovecot_plain authenticator failed for ([178.177.200.26]) [178.177.200.26]:54926: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)178.177.200.262017370ZQ  -C% ossec13001gn$Exim Auth failed2025-03-11 04:26:35 dovecot_login authenticator failed for (User) [87.106.77.61]:56245: 535 Incorrect authentication data (set_id=aditi@vm1.technobases.in)87.106.77.612921044ZP  -C% ossec13001gmExim Auth failed2025-03-11 04:25:39 dovecot_login authenticator failed for (User) [87.106.77.61]:50061: 535 Incorrect authentication data (set_id=ayush@vm1.technobases.in)87.106.77.612921044ZO  -C% ossec13001gmExim Auth failed2025-03-11 04:24:38 dovecot_login authenticator failed for (User) [87.106.77.61]:53958: 535 Incorrect authentication data (set_id=harsh@vm1.technobases.in)87.106.77.612921044YN  -A% ossec13001gmvExim Auth failed2025-03-11 04:23:41 dovecot_login authenticator failed for (User) [87.106.77.61]:50358: 535 Incorrect authentication data (set_id=aman@vm1.technobases.in)87.106.77.612921044]M  -I% ossec13001gmNExim Auth failed2025-03-11 04:23:00 dovecot_login authenticator failed for (User) [87.106.77.61]:59534: 535 Incorrect authentication data (set_id=abhishek@vm1.technobases.in)87.106.77.612921044aL  -M) ossec13001gl3Exim Auth failed2025-03-11 04:18:19 dovecot_login authenticator failed for (ip-20-192.datautama.net.id) [112.109.20.192]:47863: 535 Incorrect authentication data (set_id=sales)112.109.20.1921643084mK  -c+ ossec13001glExim Auth failed2025-03-11 04:17:47 dovecot_login authenticator failed for ([103.106.154.138]) [103.106.154.138]:38773: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)103.106.154.1381269750hJ  -a# ossec13001gkSExim Auth failed2025-03-11 04:14:34 dovecot_login authenticator failed for (heipowersystem.com) [14.18.77.99]:41132: 535 Incorrect authentication data (set_id=contact@heipowersystem.com)14.18.77.991814991 O  >S~7Odl  -W% ossec13001gϩExim Auth failed2025-03-11 08:41:47 dovecot_plain authenticator failed for ([197.5.144.31]) [197.5.144.31]:54482: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)197.5.144.312464461Wk  -;' ossec13001gϨExim Auth failed2025-03-11 08:37:38 dovecot_plain authenticator failed for ([220.92.25.189]) [220.92.25.189]:39576: 535 Incorrect authentication data (set_id=services)220.92.25.1891835841jj  -a' ossec13001gϨExim Auth failed2025-03-11 08:37:14 dovecot_plain authenticator failed for ([218.14.157.15]) [218.14.157.15]:41061: 535 Incorrect authentication data (set_id=services@heipowersystem.com)218.14.157.151814991li  -e' ossec13001gϦ.Exim Auth failed2025-03-11 08:25:40 dovecot_login authenticator failed for (thepsindustries.com) [221.229.216.1]:45398: 535 Incorrect authentication data (set_id=sales@thepsindustries.com)221.229.216.11814991Zh  -A' ossec13001gϦExim Auth failed2025-03-11 08:25:14 dovecot_login authenticator failed for (thepsindustries.com) [221.229.216.1]:41988: 535 Incorrect authentication data (set_id=nologin)221.229.216.11814991`g  -M' ossec13001gϤExim Auth failed2025-03-11 08:20:21 dovecot_login authenticator failed for (rokamauka.com) [58.240.171.59]:45478: 535 Incorrect authentication data (set_id=sales@rokamauka.com)58.240.171.591814991pf  -q# ossec13001gϤExim Auth failed2025-03-11 08:20:07 dovecot_plain authenticator failed for ([14.98.28.43]) [14.98.28.43]:55756: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)14.98.28.431269750Te  -5' ossec13001gϤExim Auth failed2025-03-11 08:19:57 dovecot_login authenticator failed for (rokamauka.com) [58.240.171.59]:45654: 535 Incorrect authentication data (set_id=nologin)58.240.171.591814991Qd  -1% ossec13001gϤExim Auth failed2025-03-11 08:18:44 dovecot_plain authenticator failed for ([113.192.1.27]) [113.192.1.26]:53198: 535 Incorrect authentication data (set_id=sales)113.192.1.261643084gc  -[' ossec13001gϤ|Exim Auth failed2025-03-11 08:18:27 dovecot_plain authenticator failed for ([37.28.177.141]) [37.28.177.141]:41248: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)37.28.177.1412017370Yb  -?) ossec13001gϙExim Auth failed2025-03-11 07:31:48 dovecot_login authenticator failed for ([81.181.129.233]) [81.181.129.233]:29479: 535 Incorrect authentication data (set_id=services)81.181.129.233798549ja  -a' ossec13001gϙ}Exim Auth failed2025-03-11 07:31:31 dovecot_login authenticator failed for ([106.227.87.29]) [106.227.87.29]:38424: 535 Incorrect authentication data (set_id=services@heipowersystem.com)106.227.87.291814991|`  -+ ossec13001gϘExim Auth failed2025-03-11 07:29:05 dovecot_plain authenticator failed for ([202.149.220.146]) [202.149.220.149]:35488: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)202.149.220.1491269750J_  -)! ossec13001gϗExim Auth failed2025-03-11 07:23:17 dovecot_plain authenticator failed for ([149.0.16.4]) [149.0.16.4]:43564: 535 Incorrect authentication data (set_id=sales)149.0.16.4298795g^  -[' ossec13001gϗnExim Auth failed2025-03-11 07:22:45 dovecot_plain authenticator failed for ([217.24.185.98]) [217.24.185.98]:46032: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)217.24.185.982017370r]  -q' ossec13001gϕExim Auth failed2025-03-11 07:15:59 dovecot_login authenticator failed for ([102.221.65.24]) [102.221.65.24]:35989: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)102.221.65.242413451D\  =+ ossec13008gϏMail Reciepient rejected2025-03-11 06:49:28 H=(mail.vandanabalbharti.com) [165.154.213.196]:60794 F= rejected RCPT : Rejected relay attempt: '165.154.213.196' From: 'ckawepl@vandanabalbharti.com' To: 'goofile@fastmail.com'165.154.213.1963469034 y/ 9 N c j m !3?cyf}  -[' ossec13001gvExim Auth failed2025-03-11 10:47:41 dovecot_login authenticator failed for ([178.61.149.64]) [178.61.149.64]:53115: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)178.61.149.64285570X|  -;+ ossec13001gƦExim Auth failed2025-03-11 10:44:13 dovecot_login authenticator failed for ([196.200.227.78]) [196.200.227.194]:35908: 535 Incorrect authentication data (set_id=sales)196.200.227.194149590p{  -o% ossec13001gƒExim Auth failed2025-03-11 10:43:54 dovecot_login authenticator failed for ti0004q160-7861.bb.online.no [95.34.158.19]:49988: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)95.34.158.193144096jz  -_) ossec13001gExim Auth failed2025-03-11 10:18:58 dovecot_plain authenticator failed for ([120.157.12.107]) [120.157.12.107]:52694: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)120.157.12.1072077456Gy  -) ossec13001gExim Auth failed2025-03-11 10:18:35 dovecot_plain authenticator failed for ([213.59.167.111]) [213.59.167.111]:39291: 535 Incorrect authentication data213.59.167.111690791x  W) ossec9708gϺoDovecot Aborted Login with empty userMar 11 09:52:06 vm1 dovecot[312763]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=185.247.137.27, lip=103.74.54.108, TLS, session=185.247.137.27298795Tw  -5' ossec13001gϸExim Auth failed2025-03-11 09:45:28 dovecot_plain authenticator failed for ([112.102.61.21]) [112.102.61.21]:41702: 535 Incorrect authentication data (set_id=sales)112.102.61.211814991wv  -y) ossec13001gϸExim Auth failed2025-03-11 09:45:17 dovecot_plain authenticator failed for (207.122.87.116.starhub.net.sg) [116.87.122.207]:50320: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)116.87.122.2071880251u  3I# ossec11301gϵNew FTP connection.Mar 11 09:33:06 vm1 pure-ftpd[4097883]: (?@71.6.232.20) [INFO] New connection from 71.6.232.2071.6.232.206252001ft  -W) ossec13001gϵlExim Auth failed2025-03-11 09:30:43 dovecot_plain authenticator failed for ([128.185.224.87]) [152.52.243.154]:34116: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)152.52.243.1541269750ys  -}) ossec13001gϵ(Exim Auth failed2025-03-11 09:29:34 dovecot_plain authenticator failed for 94-255-178-175.cust.bredband2.com [94.255.178.175]:35412: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)94.255.178.1752661886ur  -y' ossec13001gϵDExim Auth failed2025-03-11 09:30:04 dovecot_plain authenticator failed for ([178.61.149.64]) [178.61.149.64]:55585: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)178.61.149.64285570gq  -[' ossec13001gϮExim Auth failed2025-03-11 09:01:48 dovecot_plain authenticator failed for syn-097-089-202-226.biz.spectrum.com [97.89.202.226]:34775: 535 Incorrect authentication data (set_id=sales)97.89.202.2266252001gp  -[' ossec13001gϮExim Auth failed2025-03-11 09:01:39 dovecot_plain authenticator failed for ([45.117.10.134]) [45.117.10.134]:32906: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)45.117.10.1341814991ro  -q' ossec13001gϬExim Auth failed2025-03-11 08:51:00 dovecot_login authenticator failed for ([103.48.194.21]) [103.48.194.21]:58076: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)103.48.194.211562822cn  -U% ossec13001gϪ[Exim Auth failed2025-03-11 08:43:30 dovecot_plain authenticator failed for 89-160-38-13.cust.bredband2.com [89.160.38.13]:58184: 535 Incorrect authentication data (set_id=services)89.160.38.132661886fm  -]% ossec13001gϪIExim Auth failed2025-03-11 08:43:13 dovecot_plain authenticator failed for ([91.74.186.57]) [91.74.186.57]:45956: 535 Incorrect authentication data (set_id=services@heipowersystem.com)91.74.186.57290557 ' + = O t %(>^W  -;' ossec13001g܌Exim Auth failed2025-03-11 12:17:39 dovecot_plain authenticator failed for ([41.224.62.206]) [41.224.62.206]:38298: 535 Incorrect authentication data (set_id=services)41.224.62.2062464461\  -G% ossec13001g׵Exim Auth failed2025-03-11 11:57:00 dovecot_plain authenticator failed for ([59.99.153.21]) [59.99.153.21]:17872: 535 Incorrect authentication data (set_id=vikas.khandelwal)59.99.153.211269750f  -a ossec13001gשExim Auth failed2025-03-11 11:56:48 dovecot_plain authenticator failed for ([4.4.89.74]) [4.4.89.74]:49880: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)4.4.89.746252001y  -}) ossec13001gExim Auth failed2025-03-11 11:32:00 dovecot_login authenticator failed for ([211.248.31.142]) [211.248.31.142]:49246: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)211.248.31.1421835841l  -c) ossec13001gExim Auth failed2025-03-11 11:32:09 dovecot_login authenticator failed for (31-220-168-116.rdtc.ru) [31.220.168.116]:33141: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)31.220.168.1162017370W  -;' ossec13001gExim Auth failed2025-03-11 11:27:30 dovecot_login authenticator failed for ([41.215.216.72]) [41.215.216.72]:45196: 535 Incorrect authentication data (set_id=services)41.215.216.723374766f  -]# ossec13001gExim Auth failed2025-03-11 11:27:19 dovecot_login authenticator failed for ppp-58-11-61-33.revip2.asianet.co.th [58.11.61.33]:42147: 535 Incorrect authentication data (set_id=services)58.11.61.331605651j  -a' ossec13001gЭExim Auth failed2025-03-11 11:27:00 dovecot_login authenticator failed for ([46.52.204.227]) [46.52.204.227]:52906: 535 Incorrect authentication data (set_id=services@heipowersystem.com)46.52.204.2272017370c  -W% ossec13001g͸Exim Auth failed2025-03-11 11:14:23 dovecot_login authenticator failed for ([94.200.20.66]) [94.200.20.66]:43202: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)94.200.20.66290557l  -a+ ossec13001gExim Auth failed2025-03-11 11:15:02 dovecot_login authenticator failed for (static-97.224.143.114-tataidc.co.in) [182.156.135.216]:45873: 535 Incorrect authentication data (set_id=sales)182.156.135.2161269750Q  -1% ossec13001gExim Auth failed2025-03-11 11:14:45 dovecot_login authenticator failed for ([221.10.10.20]) [221.10.10.20]:40444: 535 Incorrect authentication data (set_id=sales)221.10.10.201814991W  -9) ossec13001gExim Auth failed2025-03-11 11:14:35 dovecot_login authenticator failed for ([190.121.195.38]) [190.121.195.38]:35462: 535 Incorrect authentication data (set_id=sales)190.121.195.383595528j  -_) ossec13001gExim Auth failed2025-03-11 11:14:33 dovecot_login authenticator failed for ([122.228.225.20]) [122.228.225.20]:52916: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)122.228.225.201814991j  -_) ossec13001gͺExim Auth failed2025-03-11 11:14:25 dovecot_login authenticator failed for ([119.206.34.142]) [119.206.34.142]:43482: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)119.206.34.1421835841x  -{) ossec13001gExim Auth failed2025-03-11 11:06:04 dovecot_plain authenticator failed for syn-173-172-152-018.res.spectrum.com [173.172.152.18]:40018: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)173.172.152.186252001p  -q# ossec13001g˹Exim Auth failed2025-03-11 11:05:53 dovecot_plain authenticator failed for ([59.96.62.29]) [59.96.62.29]:59752: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)59.96.62.291269750a~  -O' ossec13001gǛExim Auth failed2025-03-11 10:48:17 dovecot_login authenticator failed for 81.60.194.189.dyn.user.ono.com [81.60.194.189]:44217: 535 Incorrect authentication data (set_id=sales)81.60.194.1892510769  % H X m &wf  -Y' ossec13001gExim Auth failed2025-03-11 13:38:36 dovecot_login authenticator failed for 111-70-42-100.emome-ip.hinet.net [111.70.42.100]:21241: 535 Incorrect authentication data (set_id=services)111.70.42.1001668284}  -' ossec13001gyExim Auth failed2025-03-11 13:38:24 dovecot_login authenticator failed for syn-074-218-095-154.biz.spectrum.com [74.218.95.154]:52544: 535 Incorrect authentication data (set_id=services@heipowersystem.com)74.218.95.1546252001Y  -A% ossec13001gExim Auth failed2025-03-11 13:17:13 dovecot_login authenticator failed for (vandanabalbharti.com) [60.2.243.174]:34568: 535 Incorrect authentication data (set_id=nologin)60.2.243.1741814991+  3Y+ ossec11301gNew FTP connection.Mar 11 13:04:24 vm1 pure-ftpd[4141345]: (?@103.216.173.161) [INFO] New connection from 103.216.173.161103.216.173.1611269750Z  -?) ossec13001g{Exim Auth failed2025-03-11 13:04:17 dovecot_login authenticator failed for ([223.171.89.199]) [223.171.89.199]:50688: 535 Incorrect authentication data (set_id=services)223.171.89.1991835841p  -o% ossec13001gSExim Auth failed2025-03-11 13:03:38 dovecot_login authenticator failed for (hebei.2.60.in-addr.arpa) [60.2.203.254]:46424: 535 Incorrect authentication data (set_id=services@heipowersystem.com)60.2.203.2541814991_  -O% ossec13001g5Exim Auth failed2025-03-11 12:41:49 dovecot_plain authenticator failed for ([41.24.28.218]) [41.24.28.218]:20717: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)41.24.28.218953987v  -y' ossec13001gExim Auth failed2025-03-11 12:41:19 dovecot_plain authenticator failed for ([114.30.180.58]) [114.30.180.58]:53424: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)114.30.180.581835841Q  -1% ossec13001gExim Auth failed2025-03-11 12:36:10 dovecot_plain authenticator failed for ([101.13.4.124]) [101.13.4.124]:58718: 535 Incorrect authentication data (set_id=sales)101.13.4.1241668284j  -_) ossec13001gExim Auth failed2025-03-11 12:35:37 dovecot_plain authenticator failed for ([103.196.30.122]) [103.196.30.122]:34225: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)103.196.30.1221269750Q  -1% ossec13001gExim Auth failed2025-03-11 12:35:09 dovecot_plain authenticator failed for ([103.4.103.61]) [103.4.103.61]:49851: 535 Incorrect authentication data (set_id=sales)103.4.103.611168579g  -[' ossec13001gExim Auth failed2025-03-11 12:34:52 dovecot_plain authenticator failed for ([222.100.159.2]) [222.100.159.2]:42968: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)222.100.159.21835841l  -g% ossec13001gExim Auth failed2025-03-11 12:27:47 dovecot_login authenticator failed for (vandanabalbharti.com) [125.72.54.81]:41238: 535 Incorrect authentication data (set_id=sales@vandanabalbharti.com)125.72.54.811814991Y  -A% ossec13001g޶Exim Auth failed2025-03-11 12:26:53 dovecot_login authenticator failed for (vandanabalbharti.com) [125.72.54.81]:36132: 535 Incorrect authentication data (set_id=nologin)125.72.54.811814991_  -K' ossec13001gVExim Auth failed2025-03-11 12:21:01 dovecot_login authenticator failed for ([203.190.150.4]) [203.190.150.4]:60642: 535 Incorrect authentication data (set_id=vikas.khandelwal)203.190.150.41269750q  -q' ossec13001g<Exim Auth failed2025-03-11 12:20:36 dovecot_login authenticator failed for ([91.72.148.106]) [91.72.148.106]:41170: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)91.72.148.106290557  - ) ossec13001g~Exim Auth failed2025-03-11 12:17:25 dovecot_plain authenticator failed for 112.46.246.220.static.netvigator.com [220.246.46.112]:59100: 535 Incorrect authentication data (set_id=services@heipowersystem.com)220.246.46.1121819730 U ; 1 > < a.'5U\/  -G% ossec13001g!4Exim Auth failed2025-03-11 17:10:35 dovecot_plain authenticator failed for ([27.24.141.90]) [27.24.141.90]:49736: 535 Incorrect authentication data (set_id=vikas.khandelwal)27.24.141.901814991n.  -m% ossec13001g!Exim Auth failed2025-03-11 17:10:02 dovecot_plain authenticator failed for ([185.167.56.2]) [185.167.56.2]:59862: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)185.167.56.2617790V-  -9' ossec13001g Exim Auth failed2025-03-11 17:09:41 dovecot_plain authenticator failed for ([58.57.154.146]) [58.57.154.146]:3208: 535 Incorrect authentication data (set_id=services)58.57.154.1461814991p,  -i+ ossec13001g Exim Auth failed2025-03-11 17:09:28 dovecot_plain authenticator failed for ([211.221.130.246]) [211.221.130.246]:50882: 535 Incorrect authentication data (set_id=services@heipowersystem.com)211.221.130.24618358415+  =c+ ossec13008gMail Reciepient rejected2025-03-11 16:12:39 H=(mail.rokamauka.com) [165.154.232.235]:50393 F= rejected RCPT : Rejected relay attempt: '165.154.232.235' From: 'fzuftqnhvx@rokamauka.com' To: 'goofile@fastmail.com'165.154.232.2351605651b*  -S' ossec13001gNExim Auth failed2025-03-11 16:07:00 dovecot_plain authenticator failed for ([46.30.161.197]) [46.30.161.197]:54504: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)46.30.161.197690791v)  -y' ossec13001g.Exim Auth failed2025-03-11 16:06:28 dovecot_plain authenticator failed for ([124.246.92.77]) [124.246.92.77]:44719: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)124.246.92.771880251v(  -y' ossec13001gExim Auth failed2025-03-11 16:01:11 dovecot_plain authenticator failed for 89-253-90-113.customers.ownit.se [89.253.90.113]:35769: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)89.253.90.1132661886U'  =#+ ossec13008g]Mail Reciepient rejected2025-03-11 15:58:44 H=(mail.westerndancecompany.com) [165.154.228.195]:55139 F= rejected RCPT : Rejected relay attempt: '165.154.228.195' From: 'kzhxbehdfol@westerndancecompany.com' To: 'goofile@fastmail.com'165.154.228.1951643084W&  -9) ossec13001g Exim Auth failed2025-03-11 15:47:25 dovecot_login authenticator failed for ([183.100.18.224]) [183.100.18.224]:53304: 535 Incorrect authentication data (set_id=sales)183.100.18.2241835841~%  - ' ossec13001g Exim Auth failed2025-03-11 15:46:44 dovecot_login authenticator failed for modemcable039.132-202-24.mc.videotron.ca [24.202.132.39]:55434: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)24.202.132.396251999o$  -m% ossec13001gExim Auth failed2025-03-11 15:26:07 dovecot_plain authenticator failed for ([85.152.57.60]) [85.152.57.60]:59739: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)85.152.57.602510769#  -) ossec13001gExim Auth failed2025-03-11 15:25:51 dovecot_plain authenticator failed for nova-185-040-122-250.cpe.novanet.is [185.40.122.250]:54151: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)185.40.122.2502629691W"  -9) ossec13001gExim Auth failed2025-03-11 14:14:18 dovecot_plain authenticator failed for ([190.121.193.46]) [190.121.193.46]:44700: 535 Incorrect authentication data (set_id=sales)190.121.193.463595528u!  -y% ossec13001gExim Auth failed2025-03-11 14:14:02 dovecot_plain authenticator failed for 128-72-81-95.broadband.corbina.ru [128.72.81.95]:52660: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)128.72.81.952017370m  -e) ossec13001gExim Auth failed2025-03-11 14:09:28 dovecot_login authenticator failed for mail-02.03.perm.ru [46.146.210.180]:31796: 535 Incorrect authentication data (set_id=services@heipowersystem.com)46.146.210.1802017370  8 L  m?  -c+ ossec13001gAExim Auth failed2025-03-11 19:28:38 dovecot_plain authenticator failed for ([213.195.113.234]) [213.195.113.234]:45186: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)213.195.113.2342510769]>  -C+ ossec13001g=9Exim Auth failed2025-03-11 19:10:08 dovecot_plain authenticator failed for ([123.210.152.243]) [123.210.152.243]:39094: 535 Incorrect authentication data (set_id=services)123.210.152.2432077456=  -# ossec13001g=Exim Auth failed2025-03-11 19:09:35 dovecot_plain authenticator failed for (5x166x68x89.dynamic.barnaul.ertelecom.ru) [5.166.68.89]:54334: 535 Incorrect authentication data (set_id=services@heipowersystem.com)5.166.68.892017370^< -C+ ossec13001g/BExim Auth failed2025-03-11 18:10:32 dovecot_login authenticator failed for (heipowersystem.com) [202.107.197.211]:45090: 535 Incorrect authentication data (set_id=nologin)202.107.197.2111814991A;  =}) ossec13008g.Mail Reciepient rejected2025-03-11 18:08:23 H=(mail.vandanabalbharti.com) [165.154.233.84]:55032 F= rejected RCPT : Rejected relay attempt: '165.154.233.84' From: 'qtygcnp@vandanabalbharti.com' To: 'goofile@fastmail.com'165.154.233.841694008W:  -;' ossec13001g-Exim Auth failed2025-03-11 18:04:21 dovecot_login authenticator failed for ([120.78.172.20]) [120.78.172.20]:54662: 535 Incorrect authentication data (set_id=services)120.78.172.201814991j9  -a' ossec13001g-Exim Auth failed2025-03-11 18:04:06 dovecot_login authenticator failed for ([49.124.151.56]) [49.124.151.56]:56478: 535 Incorrect authentication data (set_id=services@heipowersystem.com)49.124.151.561733045s8  -u% ossec13001g+Exim Auth failed2025-03-11 17:55:00 dovecot_plain authenticator failed for ([27.24.141.90]) [27.24.141.90]:40054: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)27.24.141.901814991j7  -_) ossec13001g*Exim Auth failed2025-03-11 17:48:15 dovecot_plain authenticator failed for ([116.10.127.167]) [116.10.127.167]:38430: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)116.10.127.1671814991g6  -[' ossec13001g$Exim Auth failed2025-03-11 17:25:28 dovecot_plain authenticator failed for ([58.49.113.138]) [58.49.113.138]:12166: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)58.49.113.1381814991%5  3O) ossec11301g$New FTP connection.Mar 11 17:25:21 vm1 pure-ftpd[1765]: (?@194.165.16.167) [INFO] New connection from 194.165.16.167194.165.16.1672993457B4  =}+ ossec13008g"Mail Reciepient rejected2025-03-11 17:16:35 H=(mail.vandanabalbharti.com) [165.154.213.130]:51379 F= rejected RCPT : Rejected relay attempt: '165.154.213.130' From: 'mgwuiy@vandanabalbharti.com' To: 'goofile@fastmail.com'165.154.213.1303469034"3  3M% ossec11301g"New FTP connection.Mar 11 17:14:18 vm1 pure-ftpd[4193422]: (?@20.163.15.96) [INFO] New connection from 20.163.15.9620.163.15.966252001V2  -?! ossec13001g!Exim Auth failed2025-03-11 17:13:19 dovecot_login authenticator failed for ([27.0.61.49]) [27.0.61.49]:59984: 535 Incorrect authentication data (set_id=vikas.khandelwal)27.0.61.491269750r1  -q' ossec13001g!Exim Auth failed2025-03-11 17:13:10 dovecot_login authenticator failed for ([197.211.47.66]) [197.211.47.66]:52635: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)197.211.47.662328926t0  -s) ossec13001g!>Exim Auth failed2025-03-11 17:10:45 dovecot_plain authenticator failed for syn-173-172-152-018.res.spectrum.com [173.172.152.18]:40718: 535 Incorrect authentication data (set_id=vikas.khandelwal)173.172.152.186252001 *\~tj`VLB8.$zpf\H>4*   v l b X N D : 0 &    ~ t j ` V L B 8 . $    z p f \ R H > 4 *  vlbXND:0&|rh^TJ@6,"xndZPF<2( ~jt`VLB8.$pzf\ | r h ^ T J @ 6 , "    x n d Z P F < 2 (   RRH>4*  vlbXND:0& g3( g.( g,v( g,( g(( g(( g%( g%( g%8( g#a( g ( g ( gV( gH( g( g( gf( g( g( g( g( g ( g ( g ( g8( g*( g( g( g( gm( gN( gh( gT( g( g( g( g( g( g( g( g3( g"( g_( gS( gO( g( g( g( g֞( g( g˗( gɃ( gH( g"( g ( gƢ( g&( gN( gн( gйb( gй@( gе( gе( gг( gг( gгm(~ gгa(} gгY(| gЭ({ gЭ(z gЭ(y gЭ(x gЫ(w gЫ(v gЪ(u gЪ(t gШ0(s gЧ(r gЧ(q gУ(p gС(o gС~(n gЙj(m gЗ(l gЗ(k gБ(j gА&(i gА6(h gЎ+(g gЎ(f gЅ(e gЄ(d gЂ(c g}u(b g}g(a g}W(` gw(_ gv(^ gvH(] gv>(\ gt([ gt(Z gt(Y gt(X gtK(W gs(V gs(U gj(T gj(S gh:(R gh4(Q gb(P ga(O ga(N g`>(M g_(L g`,(K g\(J g\(I gT(H gT(G gS(F gS(E gO(D gO(C gI*(B gB(A gA(@ gA(? g=9(> g=(= g/B(< g.(; g-(: g-(9 g+(8 g*(7 g$(6 g$(5 g"(4 g"(3 g!(2 g!(1 g!>(0 g!4(/ g!(. g (- g (, g(+ gN(* g.() g(( g](' g (& g (% g($ g(# g(" g(! g( g( gy( g( g( g{( gS( g5( g( g( g( gw8( gt( gts( gf( gf( gf( ge( geQ( geC( ge3( gc( g_( gZ( gY( gYQ( gS( gOH( gMJ( gM( gL( gF( gE3( gD( gC( gC( gB( gB( gB( g@( g@( g?( g?( g=( g=( g=n( g=b( g6x( g6H( g5( g5}( g3( g3( g3( g( g( g( g޶( gV( g<( g܌( g~( g׵( gש( g( g( g( g( gЭ( g( g( g( g( gͺ( g͸( g( g˹' gǛ' gv' gƦ' gƒ' g' g' gϺo' gϸ' gϸ' gϵ' gϵl' gϵD' gϵ(' gϮ' gϮ' gϬ' gϪ[' gϪI' gϩ' gzY( gϨ' gϨ' gϦ.' gϦ' gϤ' gϤ' gϤ' gϤ' gϤ|' gϙ' gϙ}' gϘ' gϗ' gϗn' gϕ' gϏ' gόp' gό^' gϊO' gω_' gρ' gρ' gπ' gπ' gz' gz' gn$' gm' gm' gmv' gmN' gl3' gl' gkS' gk9' ga' ga' ga' g^$' g\' g\W' gYy'  !vWYTP  -5' ossec13001gbExim Auth failed2025-03-11 21:47:07 dovecot_login authenticator failed for ([88.84.209.146]) [88.84.209.146]:57494: 535 Incorrect authentication data (set_id=sales)88.84.209.1462017370zO  -' ossec13001gaExim Auth failed2025-03-11 21:46:51 dovecot_login authenticator failed for syn-097-089-202-226.biz.spectrum.com [97.89.202.226]:60324: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)97.89.202.2266252001#N  3M' ossec11301gaNew FTP connection.Mar 11 21:45:11 vm1 pure-ftpd[55410]: (?@206.168.34.95) [INFO] New connection from 206.168.34.95206.168.34.956252001TM  -5' ossec13001g`>Exim Auth failed2025-03-11 21:39:33 dovecot_plain authenticator failed for ([31.173.20.146]) [31.173.20.146]:52296: 535 Incorrect authentication data (set_id=sales)31.173.20.1462017370[L -A' ossec13001g_Exim Auth failed2025-03-11 21:38:28 dovecot_login authenticator failed for (fablixsolutions.com) [221.229.216.1]:57952: 535 Incorrect authentication data (set_id=nologin)221.229.216.11814991mK  -c+ ossec13001g`,Exim Auth failed2025-03-11 21:39:14 dovecot_plain authenticator failed for ([123.209.108.180]) [123.209.108.180]:55502: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)123.209.108.1802077456nJ  -k% ossec13001g\Exim Auth failed2025-03-11 21:24:53 dovecot_login authenticator failed for (s2seducationtrust.com) [125.72.54.81]:38348: 535 Incorrect authentication data (set_id=sales@s2seducationtrust.com)125.72.54.811814991ZI  -C% ossec13001g\Exim Auth failed2025-03-11 21:23:59 dovecot_login authenticator failed for (s2seducationtrust.com) [125.72.54.81]:33624: 535 Incorrect authentication data (set_id=nologin)125.72.54.811814991'H 3Q) ossec11301gTNew FTP connection.Mar 11 20:50:24 vm1 pure-ftpd[44136]: (?@89.248.163.214) [INFO] New connection from 89.248.163.21489.248.163.2142750405mG  -c+ ossec13001gTExim Auth failed2025-03-11 20:47:23 dovecot_login authenticator failed for ([178.178.127.114]) [178.178.127.114]:60581: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)178.178.127.1142017370gF  -[' ossec13001gSExim Auth failed2025-03-11 20:47:15 dovecot_login authenticator failed for ([180.7.188.169]) [180.7.188.169]:54536: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)180.7.188.1691861060qE  -q% ossec13001gSExim Auth failed2025-03-11 20:46:47 dovecot_login authenticator failed for p72033-obmd01.osaka.ocn.ne.jp [180.7.119.32]:52179: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)180.7.119.321861060^D  -K% ossec13001gOExim Auth failed2025-03-11 20:30:08 dovecot_plain authenticator failed for ([58.131.97.5]) [180.88.96.37]:9642: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)180.88.96.371814991sC  -u% ossec13001gOExim Auth failed2025-03-11 20:29:55 dovecot_plain authenticator failed for ([98.70.127.17]) [98.70.127.17]:41068: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)98.70.127.171269750)B  =K+ ossec13008gI*Mail Reciepient rejected2025-03-11 20:01:06 H=(mail.hsnews.in) [165.154.232.235]:54887 F= rejected RCPT : Rejected relay attempt: '165.154.232.235' From: 'wiymcisjxp@hsnews.in' To: 'goofile@fastmail.com'165.154.232.2351605651A  W!+ ossec9708gBDovecot Aborted Login with empty userMar 11 19:32:41 vm1 dovecot[312763]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=185.247.137.175, lip=103.74.54.108, TLS, session=185.247.137.175298795a@  -S# ossec13001gAExim Auth failed2025-03-11 19:28:49 dovecot_plain authenticator failed for (6.41.43.103.cust-fiber.enegan.it) [103.43.41.6]:59512: 535 Incorrect authentication data (set_id=sales)103.43.41.63175395 ubN;'yfUC1 w d Q ? -   u b O < )   o \ I 7 %  q _ N = +   n Z H 4 lXD/p\H3  mXC/|iT@-nZE0 wcP=*xeRA.#20.161.5.26n'20.14.160.237%20.122.56.22R'20.122.101.26r'20.10.181.200q'20.10.177.152m#20.1.140.54>'197.63.210.87'196.251.84.62)196.127.14.119)196.115.49.163'195.231.75.493+195.178.110.163+195.178.110.1639)195.15.242.133)194.247.173.99'194.0.234.153'193.70.81.116 '193.70.81.103'193.41.206.98'193.41.206.72()193.41.206.246'193.41.206.24)193.41.206.189'193.41.206.12%193.24.211.4$%192.99.7.188%192.99.36.61v%192.99.35.94%192.99.13.69'192.95.30.177%192.95.30.12+188.213.128.195+188.166.219.127)188.166.183.62)187.217.186.28%185.91.127.9'185.4.176.103)182.68.227.2411%18.227.72.72'18.224.18.177 )18.223.111.250%18.218.22.99)18.191.225.152'18.189.22.234'18.117.152.93)179.43.188.122%+178.128.211.202 '176.65.144.40%176.38.0.194'173.239.249.6})173.239.249.42)173.239.249.32)172.93.102.106)172.200.58.223h+172.190.154.228+172.177.131.186)172.176.156.15N)172.172.74.123j+172.167.192.196+172.167.100.202+172.166.208.240+172.166.163.142'170.64.223.90'170.39.218.72)170.39.218.246)170.39.218.202)170.39.218.138'170.39.218.12)170.39.218.109'167.86.125.25~+165.231.182.115)164.92.127.117)164.152.20.174'159.223.43.95F%157.66.54.26#'157.66.54.166'156.146.58.54c)152.69.220.151u'152.59.108.70j)152.59.108.251=%152.58.99.319'152.58.99.206m)150.136.69.140+150.136.222.122)150.136.112.62)15.235.227.163'149.22.90.207'149.202.86.86)149.130.215.43F)146.190.139.80z+144.126.146.166+140.224.147.210)137.135.78.166+137.135.244.124 +137.135.244.121)135.235.156.42w)135.181.180.59S'134.122.97.81H)132.145.29.111+132.145.140.179%130.33.66.85E'130.33.62.103F+130.131.211.176)130.131.208.46#13.94.99.98 %13.94.98.135%13.94.69.150'13.94.118.162%13.86.66.122%13.79.60.209Z#13.79.59.645#13.79.58.84`%13.79.58.192.%13.79.58.162g%13.79.52.158#13.79.50.81^%13.79.25.151%13.79.25.141%13.79.246.74%13.79.20.152#13.79.2.245]'13.79.187.207 '13.79.186.222%13.79.17.110\%13.79.167.50e'13.79.157.149'13.79.156.154'13.79.156.134%13.79.155.43 '13.79.154.153%13.79.153.65'13.79.153.251'13.79.133.2550'13.79.129.149D'13.79.101.201'13.79.101.137%13.77.98.167'13.76.215.190'13.76.211.253'13.76.211.219T'13.76.211.166'13.75.137.100%13.74.96.186#13.74.71.28%13.74.62.165'13.74.255.122x'13.74.238.233o'13.74.220.119'13.74.185.216}'13.74.168.157%13.74.164.39%13.74.164.36%13.74.154.95'13.74.148.126'13.74.145.1752%13.74.101.96%13.74.101.72o'13.72.246.151'13.72.114.192'13.69.217.194f'13.69.217.124'13.69.215.223%13.69.209.12'13.69.150.135c%13.68.29.179U%13.68.118.80%13.68.116.66#13.250.9.37'13.250.46.201)129.213.150.89'128.24.77.249t'128.24.77.171'128.24.77.112%128.24.41.54'128.24.111.93)128.24.110.220)128.24.109.135)128.24.102.210G)128.199.21.147'109.228.60.34y)105.154.93.213'104.46.203.86)104.46.201.152%104.46.1.228'104.41.153.63;+104.208.158.128+103.244.251.164'103.233.10.48+102.129.145.226 p\H4  .Ru@ dp]Jx.UC9%P,B=ziWD1 _ d<x f s s ` M 9 &)'0   x e R @ .  Q s v c Q ? -b  :   N s b N ;  (Th    t a O >{ *  #3.16.66.211%#3.145.149.6$%3.15.177.123 %3.137.174.56 %3.141.34.194%3.139.61.126#3.149.242.7#3.141.1.115%3.19.246.156#3.139.79.43)77.125.143.185%52.242.79.78+217.182.175.125'217.154.80.83+217.142.186.155)213.136.81.226)209.38.166.186b)209.227.239.70)206.189.194.93)204.93.149.165#20.7.172.81%20.7.172.247#20.41.23.59D%20.37.207.53%20.246.27.88s)20.242.108.188V)20.242.108.167p%20.2.217.114#3.23.97.142)52.138.177.114'52.164.255.78)52.170.130.194#52.247.58.9)48.211.167.159%52.169.9.153!40.69.69.7'52.247.61.144'52.247.62.164%23.99.255.11%40.113.91.96)52.169.209.144%74.235.1.185)74.235.238.205'52.169.55.117#40.84.7.184)43.135.186.236'52.169.81.106)52.138.176.121'52.147.173.60'52.167.122.34#52.177.15.3%74.176.48.53'74.176.48.234%74.176.51.76%23.96.86.163%74.176.48.88%74.176.48.83%74.176.51.84)39.106.121.135'40.87.157.138#4.185.54.73%52.163.95.69'37.60.249.237)52.169.181.211~#4.185.55.85|'74.225.150.60{%4.185.49.209z%23.102.2.211y%4.185.55.150l'40.87.152.175k%65.108.2.171i%81.167.26.57e'52.169.127.35d#4.185.55.70a)74.225.149.205_'74.225.150.56[)84.247.172.191Y'52.169.183.15X'52.186.29.184C)52.170.144.155B'52.169.93.189='48.218.144.17<)40.117.181.238:'64.23.187.1114'52.169.180.881'52.164.229.600)52.138.194.104/%40.69.40.187-#52.169.94.7%52.164.121.3+)52.178.183.174*#40.69.41.14)'52.169.180.58!)52.169.180.122#84.239.5.21'95.217.109.26%94.72.119.61#94.23.7.188%91.215.85.31 )89.187.165.172#84.239.5.15%84.239.43.18'84.234.31.211'84.234.31.193%84.17.52.248%84.17.52.179%84.17.52.177%84.17.52.172%84.17.52.145%81.70.28.141'81.161.238.46%79.137.93.33E#77.68.12.96x'74.176.58.129'65.21.232.254)65.108.227.178*#65.0.123.26b%64.227.96.61#58.19.1.117)52.187.206.191'52.178.207.51f)52.178.205.103%52.178.202.5)52.178.143.101R)52.178.137.151T'52.169.95.105#52.169.95.1%52.169.94.26%52.169.94.12 %52.169.93.78I'52.169.93.157'52.169.91.160d%52.169.90.21'52.169.89.233K'52.169.89.232%52.169.89.22'52.169.88.234'52.169.83.211L%52.169.82.28%52.169.71.29#52.169.5.45%52.169.4.246%52.169.4.211&'52.169.183.89'52.169.183.46W'52.169.181.97'52.169.181.54'52.169.181.33'52.169.181.27')52.169.181.250)52.169.181.239)52.169.181.227'52.169.180.84'52.169.180.19'52.164.218.25)52.164.218.141'52.164.123.85'52.164.123.56M'52.164.121.91'52.164.121.78'52.164.121.39)52.164.121.210)52.156.184.132'51.79.231.174%51.104.3.160J'48.210.43.210'48.210.31.133%48.210.29.75'45.76.255.173'45.154.152.24%45.148.10.90r%45.148.10.90%45.148.10.34'45.148.10.186'45.133.193.56%44.234.87.12))44.234.253.181)43.153.193.106'41.250.223.79'40.126.245.60 )40.126.245.207)40.126.245.145 #4.216.48.37^'37.156.47.169'35.94.163.149)35.180.242.231)34.146.109.172!3.19.60.84%3.17.203.110+!3.15.15.12%3.14.247.228%3.135.184.36%23.94.53.110    5 Z 9?^ua  -u) ossec13001g}gExim Auth failed2025-03-11 23:43:58 dovecot_login authenticator failed for ([218.150.170.10]) [218.150.170.10]:54010: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)218.150.170.101835841N`  -+% ossec13001g}WExim Auth failed2025-03-11 23:43:43 dovecot_login authenticator failed for (dynamic-ip-adsl.viettel.vn) [27.72.123.47]:48864: 535 Incorrect authentication data27.72.123.471562822]_  -K# ossec13001gwExim Auth failed2025-03-11 23:16:41 dovecot_login authenticator failed for ([27.98.249.9]) [27.98.249.9]:41978: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)27.98.249.91814991v^  -y' ossec13001gvExim Auth failed2025-03-11 23:16:06 dovecot_login authenticator failed for ([222.100.159.2]) [222.100.159.2]:43798: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)222.100.159.21835841]]  -C+ ossec13001gvHExim Auth failed2025-03-11 23:13:34 dovecot_login authenticator failed for ([103.152.234.134]) [103.152.234.134]:46350: 535 Incorrect authentication data (set_id=services)103.152.234.1341643084r\  -s' ossec13001gv>Exim Auth failed2025-03-11 23:13:24 dovecot_login authenticator failed for (62-73-121-209.btc-net.bg) [62.73.121.209]:33925: 535 Incorrect authentication data (set_id=services@heipowersystem.com)62.73.121.209732800T[  -5' ossec13001gtExim Auth failed2025-03-11 23:06:50 dovecot_login authenticator failed for ([184.71.121.54]) [184.71.121.54]:59233: 535 Incorrect authentication data (set_id=sales)184.71.121.546251999TZ  -5' ossec13001gtExim Auth failed2025-03-11 23:06:50 dovecot_login authenticator failed for ([60.166.31.198]) [60.166.31.198]:43718: 535 Incorrect authentication data (set_id=sales)60.166.31.1981814991Y  -+ ossec13001gtExim Auth failed2025-03-11 23:06:30 dovecot_login authenticator failed for (159.14.132.112.adsl-pool.ah.cnuninet.net) [112.123.199.111]:51202: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)112.123.199.1111814991jX  -_) ossec13001gtExim Auth failed2025-03-11 23:06:19 dovecot_login authenticator failed for ([122.228.225.20]) [122.228.225.20]:41038: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)122.228.225.201814991 W  3I% ossec11301gtKNew FTP connection.Mar 11 23:05:06 vm1 pure-ftpd[71782]: (?@103.203.59.5) [INFO] New connection from 103.203.59.5103.203.59.51814991WV  -9) ossec13001gsExim Auth failed2025-03-11 23:03:39 dovecot_plain authenticator failed for ([119.206.34.142]) [119.206.34.142]:45768: 535 Incorrect authentication data (set_id=sales)119.206.34.1421835841dU  -W% ossec13001gsExim Auth failed2025-03-11 23:03:20 dovecot_plain authenticator failed for ([43.154.94.85]) [43.154.94.85]:43552: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)43.154.94.851819730rT  -q' ossec13001gjExim Auth failed2025-03-11 22:25:20 dovecot_plain authenticator failed for ([217.24.185.98]) [217.24.185.98]:43996: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)217.24.185.982017370uS  -u) ossec13001gjExim Auth failed2025-03-11 22:25:04 dovecot_plain authenticator failed for ([119.206.34.142]) [119.206.34.142]:57636: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)119.206.34.1421835841tR  -u' ossec13001gh:Exim Auth failed2025-03-11 22:13:37 dovecot_login authenticator failed for (21-172-91-219.static.youbroadband.in) [219.91.172.21]:33462: 535 Incorrect authentication data (set_id=vikas.khandelwal)219.91.172.211269750xQ  -y+ ossec13001gh4Exim Auth failed2025-03-11 22:13:30 dovecot_login authenticator failed for ([190.121.193.126]) [190.121.193.126]:51524: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)190.121.193.1263595528 u V {mu}6HuOr  -1% ossec13001gЧExim Auth failed2025-03-12 02:45:35 dovecot_plain authenticator failed for ([65.20.251.53]) [65.20.251.53]:42167: 535 Incorrect authentication data (set_id=sales)65.20.251.5399237jq  -_) ossec13001gЧExim Auth failed2025-03-12 02:45:13 dovecot_plain authenticator failed for ([125.136.163.86]) [125.136.163.86]:40220: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)125.136.163.861835841Cp  =+ ossec13008gУMail Reciepient rejected2025-03-12 02:26:39 H=(mail.thepsindustries.com) [165.154.210.114]:49865 F= rejected RCPT : Rejected relay attempt: '165.154.210.114' From: 'cjkyiglc@thepsindustries.com' To: 'goofile@fastmail.com'165.154.210.1141694008to -q) ossec13001gСExim Auth failed2025-03-12 02:18:27 dovecot_plain authenticator failed for (customer-gdl-mca-84-198.megared.net.mx) [201.132.84.198]:56196: 535 Incorrect authentication data (set_id=technobases)201.132.84.1983996063tn -q) ossec13001gС~Exim Auth failed2025-03-12 02:17:57 dovecot_plain authenticator failed for (customer-gdl-mca-84-198.megared.net.mx) [201.132.84.198]:64942: 535 Incorrect authentication data (set_id=technobases)201.132.84.1983996063!m  3K% ossec11301gЙjNew FTP connection.Mar 12 01:43:30 vm1 pure-ftpd[105461]: (?@139.162.77.6) [INFO] New connection from 139.162.77.6139.162.77.61861060bl  -O) ossec13001gЗExim Auth failed2025-03-12 01:35:46 dovecot_login authenticator failed for ([209.141.177.55]) [209.141.177.55]:42062: 535 Incorrect authentication data (set_id=vikas.khandelwal)209.141.177.556251999lk  -i# ossec13001gЗExim Auth failed2025-03-12 01:35:37 dovecot_login authenticator failed for ([112.94.6.54]) [112.94.6.54]:57598: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)112.94.6.541814991$j 3M' ossec11301gБNew FTP connection.Mar 12 01:11:12 vm1 pure-ftpd[98808]: (?@45.79.128.205) [INFO] New connection from 45.79.128.20545.79.128.2056252001gi  -[' ossec13001gА&Exim Auth failed2025-03-12 01:03:58 dovecot_plain authenticator failed for ([49.245.10.228]) [49.245.10.228]:52538: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)49.245.10.2281880251Wh  -9) ossec13001gА6Exim Auth failed2025-03-12 01:04:12 dovecot_plain authenticator failed for ([219.139.39.106]) [219.139.39.106]:60924: 535 Incorrect authentication data (set_id=sales)219.139.39.1061814991Kg  =) ossec13008gЎ+Mail Reciepient rejected2025-03-12 00:55:30 H=(mail.amplifypowerglobal.com) [165.154.233.80]:62026 F= rejected RCPT : Rejected relay attempt: '165.154.233.80' From: 'vfiwpiucw@amplifypowerglobal.com' To: 'goofile@fastmail.com'165.154.233.801694008gf  -]% ossec13001gЎExim Auth failed2025-03-12 00:55:17 dovecot_plain authenticator failed for ([14.46.30.239]) [14.46.30.239]:40247: 535 Incorrect authentication data (set_id=services@heipowersystem.com)14.46.30.2391835841e  -3# ossec13001gЅExim Auth failed2025-03-12 00:18:30 dovecot_plain authenticator failed for cpc81914-leic18-2-0-cust77.8-1.cable.virginm.net [82.0.107.78]:49506: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)82.0.107.782635167gd  -[' ossec13001gЄExim Auth failed2025-03-12 00:15:24 dovecot_plain authenticator failed for ([170.250.67.14]) [170.250.67.14]:56930: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)170.250.67.146252001c  ?1 ossec1008gЂProcess exiting (killed).Mar 12 00:05:56 vm1 spamd[3980481]: spamd: server killed by SIGTERM, shutting downbb  -O) ossec13001g}uExim Auth failed2025-03-11 23:44:12 dovecot_login authenticator failed for ([112.176.249.35]) [112.176.249.35]:44833: 535 Incorrect authentication data (set_id=vikas.khandelwal)112.176.249.351835841 ~qdWJ=0# zm`SF9, v i \ O B 5 (     r e X K > 1 $  { n a T G : -   w j ] P C 6 )    s f Y L ? 2 %  |obUH;.!xk^QD7*tgZM@3& }pcVI</"yl_RE8+uh[NA4' ~qdWJ=0 18149916s 18149916r 18149916g 18149916_ 18149916\ 18149916Z 18149916X 18149916V 18149916T 18149916R 18149916K 18149916J 18149916@ 18149916- 18149916 18149915 18149915 18149915 18149915 18149915 18149915 18149915 18149915 18149915 18149915 18149915 18149915 18149915 18149915| 18149915i 18149915g 18149915\ 18149915Y 18149915@ 181499154 18149915 18149915 18149914 18149914 18149914 18149914 18149914 18149914 18149914 18149914 18149914 18149914 18149914 18149914| 18149914t 18149914p 18149914m 18149914i 18149914d 18149914c 18149914b 18149914^ 18149914] 18149914X 18149914V 18149914U 18149914S 18149914O 18149914N 18149914H 18149914. 18149914- 18149914) 18149914' 18149914 18149914 18149914 18149914 18149914 18149913 18149913 18149913 18149913 18149913 18149913 18149913 18149913 18149913 18149913 18149913 18149913 18149913 18149913 18149913 18149913 18149913 18149913 18149913t 18149913l 18149913j 18149913e 18149913d 18149913U 18149913M 18149913I 18149913H 18149913B 18149913= 181499134 181499132 181499131 181499130 18149913/ 18149913( 18149913' 18149913" 18149913 18149913 18149913 18149913 18149913 18149913 18149913 18149912 18149912 18149912 18149912 18149912 18149912 18149912 18149912 18149912 18149912 18149912 18149912 18149912 18149912 18149912 18149912 18149912 18149912 18149912 18149912i 18149912g 18149912b 18149912a 18149912[ 18149912X 18149912V 18149912U 18149912S 18149912R 18149912Q 18149912K 18149912I 18149912H 18149912C 18149912B 181499124 181499122 18149912) 18149912 18149912 18149912 18149912 18149912 18149912 18149912 18149912 18149912 18149912 18149911 18149911 18149911 18149911 18149911 18149911 18149911 18149911 18149911 18149911 18149911 18149911 18149911 18149911 18149911 18149911 18149911 18149911 18149911 18149911 18149911 18149911 18149911 18149911 18149911 18149911 18149911 18149911~ 18149911{ 18149911x 18149911u 18149911f 18149911e 18149911c 18149911b 18149911\ 18149911[ 18149911T 18149911S 18149911Q 18149911N 18149911M 18149911D 18149911@ 18149911? 18149911= 18149911< 18149911: 181499116 18149911 18149911 18149910 18149910 18149910 18149910 18149910 18149910 18149910 18149910 18149910 18149910 18149910 18149910 18149910 18149910 18149910 18149910 18149910 18149910 18149910 18149910 18149910 G ! I X \ } 8Gm  -e) ossec13001gй@Exim Auth failed2025-03-12 03:59:20 dovecot_login authenticator failed for ([183.167.196.62]) [183.167.196.62]:44055: 535 Incorrect authentication data (set_id=services@heipowersystem.com)183.167.196.621814991]  -C+ ossec13001gеExim Auth failed2025-03-12 03:43:48 dovecot_plain authenticator failed for ([220.120.224.227]) [220.120.224.227]:51144: 535 Incorrect authentication data (set_id=services)220.120.224.2271835841p  -i+ ossec13001gеExim Auth failed2025-03-12 03:43:20 dovecot_plain authenticator failed for ([218.149.228.149]) [218.149.228.149]:58732: 535 Incorrect authentication data (set_id=services@heipowersystem.com)218.149.228.1491835841f  -W) ossec13001gгExim Auth failed2025-03-12 03:35:19 dovecot_plain authenticator failed for ([176.192.250.81]) [176.192.250.81]:57428: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)176.192.250.812017370s  -u% ossec13001gгExim Auth failed2025-03-12 03:35:08 dovecot_plain authenticator failed for ([112.91.67.18]) [112.91.67.18]:39210: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)112.91.67.181814991T~  -5' ossec13001gгmExim Auth failed2025-03-12 03:34:28 dovecot_plain authenticator failed for ([180.129.88.20]) [180.129.88.20]:33011: 535 Incorrect authentication data (set_id=sales)180.129.88.201880251a}  -S# ossec13001gгaExim Auth failed2025-03-12 03:34:17 dovecot_plain authenticator failed for ([27.96.91.71]) [27.96.91.71]:55520: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)27.96.91.711269750x|  -y+ ossec13001gгYExim Auth failed2025-03-12 03:34:08 dovecot_plain authenticator failed for ([223.197.153.138]) [223.197.153.138]:50020: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)223.197.153.1381819730l{  -e) ossec13001gЭExim Auth failed2025-03-12 03:10:46 dovecot_login authenticator failed for ([196.190.180.18]) [196.190.180.19]:48929: 535 Incorrect authentication data (set_id=services@heipowersystem.com)196.190.180.19337996bz  -O) ossec13001gЭExim Auth failed2025-03-12 03:10:07 dovecot_login authenticator failed for ([61.191.163.102]) [61.191.163.102]:43424: 535 Incorrect authentication data (set_id=vikas.khandelwal)61.191.163.1021814991[y  -G% ossec13001gЭExim Auth failed2025-03-12 03:09:47 dovecot_login authenticator failed for ([154.73.19.69]) [154.73.19.69]:35285: 535 Incorrect authentication data (set_id=vikas.khandelwal)154.73.19.69953987xx  -y+ ossec13001gЭExim Auth failed2025-03-12 03:09:35 dovecot_login authenticator failed for ([123.139.133.238]) [123.139.133.238]:32800: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)123.139.133.2381814991mw  -c+ ossec13001gЫExim Auth failed2025-03-12 03:01:06 dovecot_plain authenticator failed for ([193.158.248.248]) [193.158.248.248]:43058: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)193.158.248.2482921044Tv  -7% ossec13001gЫExim Auth failed2025-03-12 02:58:37 dovecot_plain authenticator failed for ([193.93.237.8]) [193.93.237.8]:58982: 535 Incorrect authentication data (set_id=services)193.93.237.82017370Zu  -?) ossec13001gЪExim Auth failed2025-03-12 02:58:10 dovecot_plain authenticator failed for ([191.59.206.191]) [191.59.206.191]:51974: 535 Incorrect authentication data (set_id=services)191.59.206.1913469034t  - ' ossec13001gЪExim Auth failed2025-03-12 02:57:56 dovecot_plain authenticator failed for (mobile-166-195-004-247.mycingular.net) [166.195.4.247]:41322: 535 Incorrect authentication data (set_id=services@heipowersystem.com)166.195.4.2476252001ys  -}) ossec13001gШ0Exim Auth failed2025-03-12 02:46:31 dovecot_plain authenticator failed for ([106.55.161.136]) [106.55.161.136]:35764: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)106.55.161.1361814991 9=~qdWJ=0# zm`SF9, v i \ O B 5 (     r e X K > 1 $  { n a T G : -   n,=QD x l ` T H < 0 $  | p d X L @ 4 (   th\PD8, xl`TH<0$ |pdXL@4(th\PD8, {bVJvi\OB5(vj^ 2921044Ny 294640M 294640M 294640M 2921044M 294640MM 294640K 2921044K 294640K( 294640J 292104407 2921044O 29210440 2921044/ 2963597Oy 2921044OM 294640O 294640NR 2921044N& 2921044N% 2921044N{ 2921044Nz 298795 298795 298795: 298795 29635976" 29635975 296359717 29635970 29635970) 2963597/' 2963597* 2963597) 2963597( 2963597 2963597 2963597 29635979 2963597 2963597 2963597 2963597 2960313D 2960313/5 2960313- 294640I 294640I 294640H 294640Hy 294640H 294640F 294640F@ 294640D 294640A 294640> 294640>3 294640>$ 294640> 294640;W 294640: 294640:n 2946409 2946409) 2946409 29464082 2946408& 2946406 2946405J 2946404 2946403 2946403f 29464038 2946402 2946402 2946402 2946402 2946401 2946401n 2946401m 2946401l 2946401k 2946401j 2946401i 2946401h 2946401d 2946400 294640/D 294640- 294640-A 294640-@ 294640- 294640, 294640+ 294640+ 294640) 294640) 294640( 294640' 294640'p 294640'e 294640'_ 294640'& 294640& 294640& 294640$ 294640$ 294640$ 294640$ 294640$ 294640$ 294640$^ 294640$2 294640$) 294640$ 294640# 294640#f 294640# 294640" 294640" 294640! 294640 294640 ( 294640  294640  294640 294640V 294640 294640 294640 294640 294640) 294640 294640 294640. 294640 2946407 294640 294640 294640 294640 294640 294640 294640 294640 2946403 294640 294640 294640 294640B 2946403 294640 294640 294640M 294640 294640 294640 294640f 294640 294640 294640 m 294640 294640 294640 N 294640 294640 294640 294640 294640 294640 294640 294640 294640 2921044I# 2921044H 2921044Hu 2921044Ht 2921044H6 2921044H5 2921044G 2921044G 2921044G 2921044G 2921044GU 2921044FK 2921044F? 2921044F8 2921044E| 2921044E{ 2921044Ez 2921044Ec 2921044EX 2921044EW 2921044EV 2921044EQ 2921044EP 2921044EO 2921044D 2921044D 2921044D 2921044D 2921044D 2921044D 2921044DD 2921044DB 2921044C 2921044C 2921044C 2921044C[ 2921044CG 2921044B 2921044B 2921044B< 2921044B 2921044B 2921044B 2921044B 2921044B 2921044B 2921044@ 2921044@ 2921044@R 2921044? 2921044? 2921044? 2921044?p 2921044?o 2921044?n 2921044> 2921044> 2921044>g 2921044>f 2921044>C 2921044>B 2921044= 2921044= 2921044< 2921044; 2921044: 2921044: 2921044: 2921044: 2921044: 29210449y 29210449A 29210448* 29210447| 29210447` 29210447_ 29210447] 29210447Q 29210447H 29210447G 29210446 29210446< 29210446( 29210446 29210446 29210445 29210445Z 29210445M 29210443v 29210443< 29210442 29210442 29210442 29210442 29210442 29210441 29210441 29210441 29210441. 29210441- 29210440 29210440 29210440 29210440H 29210440= 29210440< 29210440; 29210440: R  s 9Rc  -W% ossec13001gSExim Auth failed2025-03-12 06:24:42 dovecot_login authenticator failed for ([196.0.34.106]) [196.0.34.106]:50746: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)196.0.34.106226074`  -S# ossec13001gOExim Auth failed2025-03-12 06:20:22 dovecot_plain authenticator failed for ([5.30.177.55]) [5.30.177.55]:38021: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)5.30.177.55290557f  -W) ossec13001gExim Auth failed2025-03-12 06:18:54 dovecot_login authenticator failed for ([222.160.99.210]) [222.160.99.210]:33789: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)222.160.99.2101814991  -' ossec13001gExim Auth failed2025-03-12 06:18:38 dovecot_login authenticator failed for 24.115.19.225.res-cmts.sm3.ptd.net [24.115.19.225]:32940: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)24.115.19.2256252001i  -]) ossec13001gExim Auth failed2025-03-12 06:05:21 dovecot_plain authenticator failed for 125-228-225-91.hinet-ip.hinet.net [125.228.225.91]:39620: 535 Incorrect authentication data (set_id=services)125.228.225.911668284m  -e) ossec13001g֞Exim Auth failed2025-03-12 06:04:36 dovecot_plain authenticator failed for ([119.206.34.142]) [119.206.34.142]:39848: 535 Incorrect authentication data (set_id=services@heipowersystem.com)119.206.34.1421835841~  -+ ossec13001gExim Auth failed2025-03-12 05:31:19 dovecot_plain authenticator failed for (208.235.164.124.adsl-pool.sx.cn) [124.164.235.208]:59547: 535 Incorrect authentication data (set_id=services@heipowersystem.com)124.164.235.2081814991r  -u% ossec13001g˗Exim Auth failed2025-03-12 05:17:35 dovecot_login authenticator failed for ([5.11.176.108]) [5.11.176.108]:33554: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)5.11.176.108298795m  -c+ ossec13001gɃExim Auth failed2025-03-12 05:08:41 dovecot_login authenticator failed for ([123.210.128.249]) [123.210.128.249]:33780: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)123.210.128.2492077456p  -q# ossec13001gHExim Auth failed2025-03-12 05:03:27 dovecot_plain authenticator failed for ([60.6.219.83]) [60.6.219.83]:37986: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)60.6.219.831814991W  -9) ossec13001g"Exim Auth failed2025-03-12 04:58:33 dovecot_plain authenticator failed for ([186.148.187.91]) [186.148.187.91]:58675: 535 Incorrect authentication data (set_id=sales)186.148.187.913686110m  -c+ ossec13001g Exim Auth failed2025-03-12 04:58:10 dovecot_plain authenticator failed for ([123.139.133.238]) [123.139.133.238]:46986: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)123.139.133.2381814991V -7' ossec13001gƢExim Auth failed2025-03-12 04:56:26 dovecot_login authenticator failed for (nyaystambh.com) [111.207.12.99]:34296: 535 Incorrect authentication data (set_id=nologin)111.207.12.991814991$  3O' ossec11301g&New FTP connection.Mar 12 04:54:21 vm1 pure-ftpd[145420]: (?@64.226.118.91) [INFO] New connection from 64.226.118.9164.226.118.912921044|  -' ossec13001gNExim Auth failed2025-03-12 04:29:25 dovecot_login authenticator failed for d54c70cda.static.telenet.be [84.199.12.218]:48550: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)84.199.12.2182802361v  -y' ossec13001gнExim Auth failed2025-03-12 04:18:32 dovecot_plain authenticator failed for ([112.196.60.13]) [112.196.60.13]:33214: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)112.196.60.131269750g  -Y) ossec13001gйbExim Auth failed2025-03-12 03:59:54 dovecot_login authenticator failed for (host-79-164-139-110.qwerty.ru) [79.164.139.110]:50822: 535 Incorrect authentication data (set_id=services)79.164.139.1102017370 K%  - C [ )EKv%  -y' ossec13001gExim Auth failed2025-03-12 08:56:05 dovecot_plain authenticator failed for ([120.78.172.20]) [120.78.172.20]:40730: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)120.78.172.201814991`$  -S# ossec13001gExim Auth failed2025-03-12 08:52:23 dovecot_plain authenticator failed for ([5.30.215.71]) [5.30.215.71]:40300: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)5.30.215.71290557Z#  -=+ ossec13001gExim Auth failed2025-03-12 08:52:43 dovecot_plain authenticator failed for ([218.157.127.163]) [218.157.127.163]:59465: 535 Incorrect authentication data (set_id=sales)218.157.127.1631835841c"  -S' ossec13001gmExim Auth failed2025-03-12 08:28:51 dovecot_login authenticator failed for ([191.59.251.95]) [191.59.251.95]:41266: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)191.59.251.953469034!  -' ossec13001gNExim Auth failed2025-03-12 08:28:22 dovecot_login authenticator failed for ool-45734cba.dyn.optonline.net [69.115.76.186]:40948: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)69.115.76.1866252001b  -O) ossec13001ghExim Auth failed2025-03-12 08:24:32 dovecot_plain authenticator failed for ([221.181.210.98]) [221.181.210.98]:56467: 535 Incorrect authentication data (set_id=vikas.khandelwal)221.181.210.981814991r  -q' ossec13001gTExim Auth failed2025-03-12 08:24:12 dovecot_plain authenticator failed for ([58.49.113.138]) [58.49.113.138]:15069: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)58.49.113.1381814991W  -9) ossec13001gExim Auth failed2025-03-12 08:18:56 dovecot_login authenticator failed for ([187.76.173.246]) [187.76.173.246]:58000: 535 Incorrect authentication data (set_id=sales)187.76.173.2463469034f  -Y' ossec13001gExim Auth failed2025-03-12 08:18:26 dovecot_login authenticator failed for ([58.250.157.83]) [58.250.157.83]:2054: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)58.250.157.831814991f  -Y' ossec13001gExim Auth failed2025-03-12 07:57:14 dovecot_login authenticator failed for 221x253x29x53.ap221.ftth.ucom.ne.jp [221.253.29.53]:34922: 535 Incorrect authentication data (set_id=sales)221.253.29.531861060W  -9) ossec13001gExim Auth failed2025-03-12 07:56:48 dovecot_login authenticator failed for ([183.167.196.62]) [183.167.196.62]:60578: 535 Incorrect authentication data (set_id=sales)183.167.196.621814991d  -W% ossec13001gExim Auth failed2025-03-12 07:56:33 dovecot_login authenticator failed for ([109.244.68.3]) [109.244.68.3]:34928: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)109.244.68.31814991f  -[' ossec13001gExim Auth failed2025-03-12 07:56:32 dovecot_login authenticator failed for ([91.72.171.210]) [91.72.171.210]:52045: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)91.72.171.210290557c  -W% ossec13001gExim Auth failed2025-03-12 07:33:57 dovecot_login authenticator failed for ([94.204.90.91]) [94.204.90.91]:55634: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)94.204.90.91290557m  -e) ossec13001g3Exim Auth failed2025-03-12 07:06:51 dovecot_login authenticator failed for ([125.136.163.86]) [125.136.163.86]:58076: 535 Incorrect authentication data (set_id=services@heipowersystem.com)125.136.163.861835841  W' ossec9708g"Dovecot Aborted Login with empty userMar 12 06:45:14 vm1 dovecot[312763]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=45.156.129.73, lip=103.74.54.108, TLS, session=45.156.129.732264397W  -9) ossec13001g_Exim Auth failed2025-03-12 06:24:54 dovecot_login authenticator failed for ([37.151.212.229]) [37.151.212.229]:36295: 535 Incorrect authentication data (set_id=sales)37.151.212.2291522867 >1 G B _ 6Nsw>L6  =+ ossec13008g#aMail Reciepient rejected2025-03-12 11:32:08 H=(mail.vandanabalbharti.com) [165.154.213.130]:56811 F= rejected RCPT : Rejected relay attempt: '165.154.213.130' From: 'pfxgesbqrdf@vandanabalbharti.com' To: 'goofile@fastmail.com'165.154.213.1303469034e5  -S+ ossec13001g Exim Auth failed2025-03-12 11:20:42 dovecot_plain authenticator failed for ([112.164.244.205]) [112.164.244.205]:33113: 535 Incorrect authentication data (set_id=vikas.khandelwal)112.164.244.2051835841x4  -y+ ossec13001g Exim Auth failed2025-03-12 11:20:28 dovecot_plain authenticator failed for ([220.120.224.227]) [220.120.224.227]:34168: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)220.120.224.2271835841W3  -9) ossec13001gVExim Auth failed2025-03-12 10:53:34 dovecot_login authenticator failed for ([67.213.230.122]) [67.213.230.122]:17109: 535 Incorrect authentication data (set_id=sales)67.213.230.1226252001d2  -W% ossec13001gHExim Auth failed2025-03-12 10:53:19 dovecot_login authenticator failed for ([113.192.1.27]) [113.192.1.26]:48663: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)113.192.1.261643084'1  3S) ossec11301gNew FTP connection.Mar 12 10:41:26 vm1 pure-ftpd[217250]: (?@194.165.16.164) [INFO] New connection from 194.165.16.164194.165.16.1642993457K0  -)! ossec13001gExim Auth failed2025-03-12 10:28:56 dovecot_plain authenticator failed for ([59.8.2.236]) [59.8.2.236]:46639: 535 Incorrect authentication data (set_id=sales)59.8.2.2361835841m/  -c+ ossec13001gfExim Auth failed2025-03-12 10:28:14 dovecot_plain authenticator failed for ([222.189.211.114]) [222.189.211.114]:51186: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)222.189.211.1141814991M.  =+ ossec13008gMail Reciepient rejected2025-03-12 10:26:16 H=(mail.s2seducationtrust.com) [165.154.213.166]:60894 F= rejected RCPT : Rejected relay attempt: '165.154.213.166' From: 'crlshtajyy@s2seducationtrust.com' To: 'goofile@fastmail.com'165.154.213.1663469034d-  -Y# ossec13001gExim Auth failed2025-03-12 10:24:29 dovecot_login authenticator failed for ([59.7.57.174]) [59.7.57.174]:58786: 535 Incorrect authentication data (set_id=services@heipowersystem.com)59.7.57.1741835841W,  -;' ossec13001gExim Auth failed2025-03-12 10:25:06 dovecot_login authenticator failed for ([218.4.205.242]) [218.4.205.242]:41803: 535 Incorrect authentication data (set_id=services)218.4.205.2421814991&+  3S) ossec11301gNew FTP connection.Mar 12 10:08:35 vm1 pure-ftpd[210432]: (?@185.247.137.68) [INFO] New connection from 185.247.137.68185.247.137.68298795_*  -K' ossec13001g Exim Auth failed2025-03-12 09:46:41 dovecot_plain authenticator failed for ([64.52.161.161]) [64.52.161.161]:60162: 535 Incorrect authentication data (set_id=vikas.khandelwal)64.52.161.1616252001)  -% ossec13001g Exim Auth failed2025-03-12 09:46:26 dovecot_plain authenticator failed for static-84-242-88-70.bb.vodafone.cz [84.242.88.70]:40364: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)84.242.88.703077311f(  -W) ossec13001g Exim Auth failed2025-03-12 09:46:12 dovecot_plain authenticator failed for ([70.39.23.1]) [167.142.198.54]:38905: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)167.142.198.546252001Z'  -?) ossec13001g8Exim Auth failed2025-03-12 09:36:16 dovecot_plain authenticator failed for ([110.49.145.233]) [110.49.145.233]:52498: 535 Incorrect authentication data (set_id=services)110.49.145.2331605651m&  -e) ossec13001g*Exim Auth failed2025-03-12 09:36:02 dovecot_plain authenticator failed for ([109.70.203.114]) [109.70.203.114]:57966: 535 Incorrect authentication data (set_id=services@heipowersystem.com)109.70.203.1143175395 K.@ I ^ n %'DKuG  -u) ossec13001g=bExim Auth failed2025-03-12 13:23:06 dovecot_login authenticator failed for ([183.167.196.62]) [183.167.196.62]:42746: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)183.167.196.621814991_F  -O% ossec13001g6xExim Auth failed2025-03-12 12:53:35 dovecot_login authenticator failed for ([94.206.93.90]) [94.206.93.90]:43778: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)94.206.93.90290557zE  -' ossec13001g6HExim Auth failed2025-03-12 12:52:48 dovecot_login authenticator failed for (dumy186.panafonet.gr) [62.74.225.186]:45911: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)62.74.225.186390903kD  -c' ossec13001g5Exim Auth failed2025-03-12 12:49:43 dovecot_login authenticator failed for net-130-0-149-238.cust.vodafonedsl.it [130.0.149.238]:53925: 535 Incorrect authentication data (set_id=services)130.0.149.2383175395yC  -}) ossec13001g5}Exim Auth failed2025-03-12 12:49:25 dovecot_login authenticator failed for (undefined.hostname.localhost) [103.151.38.224]:55501: 535 Incorrect authentication data (set_id=services@heipowersystem.com)103.151.38.2241269750WB  -9) ossec13001g3Exim Auth failed2025-03-12 12:42:54 dovecot_login authenticator failed for ([221.228.237.90]) [221.228.237.90]:20462: 535 Incorrect authentication data (set_id=sales)221.228.237.901814991ZA  -=+ ossec13001g3Exim Auth failed2025-03-12 12:42:33 dovecot_login authenticator failed for ([154.144.255.208]) [154.144.255.208]:60948: 535 Incorrect authentication data (set_id=sales)154.144.255.2082542007j@  -_) ossec13001g3Exim Auth failed2025-03-12 12:42:22 dovecot_login authenticator failed for ([117.159.234.69]) [117.159.234.69]:35128: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)117.159.234.691814991k?  -c+ ossec13001g3Exim Auth failed2025-03-12 12:41:58 dovecot_login authenticator failed for ([192.145.171.159]) [192.145.171.159]:44138: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)192.145.171.15951537l>  -g% ossec13001g.Exim Auth failed2025-03-12 12:17:48 dovecot_plain authenticator failed for vps-0b1302de.vps.ovh.net [51.91.10.114]:48148: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)51.91.10.1143017382m=  -e) ossec13001g,vExim Auth failed2025-03-12 12:10:54 dovecot_plain authenticator failed for ([121.147.25.111]) [121.147.25.111]:60484: 535 Incorrect authentication data (set_id=services@heipowersystem.com)121.147.25.1111835841b<  -S% ossec13001g,Exim Auth failed2025-03-12 12:11:14 dovecot_plain authenticator failed for p386141-obmd01.tokyo.ocn.ne.jp [60.45.46.140]:40801: 535 Incorrect authentication data (set_id=services)60.45.46.1401861060l;  -c) ossec13001g(Exim Auth failed2025-03-12 11:55:51 dovecot_plain authenticator failed for syn-184-152-099-171.res.spectrum.com [184.152.99.171]:40240: 535 Incorrect authentication data (set_id=services)184.152.99.1716252001g:  -]% ossec13001g(Exim Auth failed2025-03-12 11:55:40 dovecot_plain authenticator failed for ([49.124.153.4]) [49.124.153.4]:47780: 535 Incorrect authentication data (set_id=services@heipowersystem.com)49.124.153.41733045s9  -u% ossec13001g%Exim Auth failed2025-03-12 11:42:10 dovecot_plain authenticator failed for ([113.192.1.27]) [113.192.1.26]:48075: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)113.192.1.261643084j8  -_) ossec13001g%Exim Auth failed2025-03-12 11:39:25 dovecot_plain authenticator failed for ([178.178.222.59]) [178.178.222.59]:56038: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)178.178.222.592017370N7  --# ossec13001g%8Exim Auth failed2025-03-12 11:39:59 dovecot_plain authenticator failed for ([223.82.86.2]) [223.82.86.2]:49873: 535 Incorrect authentication data (set_id=sales)223.82.86.21814991  + G V  <NWVX  -9) ossec13001gMExim Auth failed2025-03-12 14:29:56 dovecot_plain authenticator failed for ([196.190.180.18]) [196.190.180.19]:39667: 535 Incorrect authentication data (set_id=sales)196.190.180.19337996{W  -) ossec13001gLExim Auth failed2025-03-12 14:29:39 dovecot_plain authenticator failed for nova-185-040-122-250.cpe.novanet.is [185.40.122.250]:40925: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)185.40.122.2502629691'V  3S) ossec11301gFNew FTP connection.Mar 12 14:03:18 vm1 pure-ftpd[259262]: (?@20.169.104.123) [INFO] New connection from 20.169.104.12320.169.104.1236252001sU  -u% ossec13001gE3Exim Auth failed2025-03-12 13:56:25 dovecot_login authenticator failed for ([62.16.40.223]) [62.16.40.223]:50946: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)62.16.40.2232017370jT  -_) ossec13001gDExim Auth failed2025-03-12 13:54:15 dovecot_plain authenticator failed for ([218.150.170.10]) [218.150.170.10]:49532: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)218.150.170.101835841US  -? ossec13001gCExim Auth failed2025-03-12 13:51:11 dovecot_plain authenticator failed for 16-8-44-5.kamensktel.ru [5.44.8.16]:45730: 535 Incorrect authentication data (set_id=services)5.44.8.162017370pR  -i+ ossec13001gCExim Auth failed2025-03-12 13:50:38 dovecot_plain authenticator failed for ([180.188.143.166]) [180.188.143.166]:39479: 535 Incorrect authentication data (set_id=services@heipowersystem.com)180.188.143.1661819730gQ  -[' ossec13001gBExim Auth failed2025-03-12 13:46:59 dovecot_login authenticator failed for syn-097-089-202-226.biz.spectrum.com [97.89.202.226]:33601: 535 Incorrect authentication data (set_id=sales)97.89.202.2266252001fP  -Y' ossec13001gBExim Auth failed2025-03-12 13:46:49 dovecot_login authenticator failed for ([58.250.157.83]) [58.250.157.83]:2055: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)58.250.157.831814991QO  -/' ossec13001gBExim Auth failed2025-03-12 13:46:43 dovecot_login authenticator failed for p85145-obmd01.osaka.ocn.ne.jp [180.7.156.144]:41264: 535 Incorrect authentication data180.7.156.1441861060cN  -W# ossec13001g@Exim Auth failed2025-03-12 13:36:42 dovecot_plain authenticator failed for syn-070-120-006-086.res.spectrum.com [70.120.6.86]:62830: 535 Incorrect authentication data (set_id=sales)70.120.6.866252001dM  -W% ossec13001g@Exim Auth failed2025-03-12 13:36:24 dovecot_plain authenticator failed for ([50.82.12.128]) [50.82.12.128]:54884: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)50.82.12.1286252001PL  -/% ossec13001g?Exim Auth failed2025-03-12 13:33:45 dovecot_login authenticator failed for (hn.kd.ny.adsl) [123.7.86.144]:37800: 535 Incorrect authentication data (set_id=sales)123.7.86.1441814991mK  -c+ ossec13001g?Exim Auth failed2025-03-12 13:33:10 dovecot_login authenticator failed for ([119.207.156.209]) [119.207.156.209]:28263: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)119.207.156.2091835841`J  -M' ossec13001g=Exim Auth failed2025-03-12 13:24:17 dovecot_plain authenticator failed for ([223.75.231.193]) [58.49.113.138]:15355: 535 Incorrect authentication data (set_id=vikas.khandelwal)58.49.113.1381814991[I  -G% ossec13001g=nExim Auth failed2025-03-12 13:23:17 dovecot_login authenticator failed for ([94.206.93.90]) [94.206.93.90]:59174: 535 Incorrect authentication data (set_id=vikas.khandelwal)94.206.93.90290557rH  -q' ossec13001g=Exim Auth failed2025-03-12 13:24:05 dovecot_plain authenticator failed for ([58.18.103.142]) [58.18.103.142]:35185: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)58.18.103.1421814991 t L f [ pCAY_tgh  -]% ossec13001gtsExim Auth failed2025-03-12 17:18:01 dovecot_plain authenticator failed for ([218.22.0.200]) [218.22.0.200]:56570: 535 Incorrect authentication data (set_id=services@heipowersystem.com)218.22.0.2001814991vg  -y' ossec13001gfExim Auth failed2025-03-12 16:19:29 dovecot_login authenticator failed for laubervilliers-656-1-162-119.w92-154.abo.wanadoo.fr [92.154.21.119]:32770: 535 Incorrect authentication data (set_id=sales)92.154.21.1193017382df  -W% ossec13001gfExim Auth failed2025-03-12 16:19:19 dovecot_login authenticator failed for ([95.79.108.51]) [95.79.108.51]:41696: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)95.79.108.512017370~e  - # ossec13001gfExim Auth failed2025-03-12 16:19:01 dovecot_plain authenticator failed for p85005-obmd01.osaka.ocn.ne.jp [180.7.156.4]:34275: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)180.7.156.41861060~d  Ua' ossec11001geDeferred login on the cpanel service[2025-03-12 16:15:46 +0530] info [webmaild] 49.35.135.209 - kps@amplifypowerglobal.com "POST /cpsess2278280735/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [49.35.160.114] != Current IP Address [49.35.135.209]49.35.135.2091269750ac  -S# ossec13001geQExim Auth failed2025-03-12 16:13:28 dovecot_plain authenticator failed for ([101.13.5.49]) [101.13.5.49]:58604: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)101.13.5.491668284`b  -O% ossec13001geCExim Auth failed2025-03-12 16:13:14 dovecot_plain authenticator failed for ([222.180.2.62]) [222.180.2.62]:53980: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)222.180.2.621814991sa  -u% ossec13001ge3Exim Auth failed2025-03-12 16:12:59 dovecot_plain authenticator failed for ([103.86.16.88]) [103.86.16.88]:37576: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)103.86.16.881269750g`  -[' ossec13001gcExim Auth failed2025-03-12 16:05:56 dovecot_plain authenticator failed for ([120.78.172.20]) [120.78.172.20]:46618: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)120.78.172.201814991g_  -]% ossec13001g_Exim Auth failed2025-03-12 15:50:29 dovecot_login authenticator failed for ([195.7.40.149]) [195.7.40.149]:59835: 535 Incorrect authentication data (set_id=services@heipowersystem.com)195.7.40.1492963597^  -% ossec13001gYExim Auth failed2025-03-12 15:24:59 dovecot_plain authenticator failed for (45.201.33.36.adsl-pool.ah.cnuninet.net) [36.33.201.45]:38010: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)36.33.201.451814991b]  -O) ossec13001gZExim Auth failed2025-03-12 15:25:12 dovecot_plain authenticator failed for ([186.177.88.108]) [186.177.88.108]:49153: 535 Incorrect authentication data (set_id=vikas.khandelwal)186.177.88.1083624060&\  a'' ossec5710gYQAttempt to login using a non-existent userMar 12 15:22:16 vm1 sshd[275348]: Invalid user from 47.236.42.190 port 5552847.236.42.1901880251[  W!+ ossec9708gSDovecot Aborted Login with empty userMar 12 14:57:42 vm1 dovecot[312763]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 7 secs): user=<>, rip=185.247.137.190, lip=103.74.54.108, TLS, session=185.247.137.190298795jZ  -a' ossec13001gOHExim Auth failed2025-03-12 14:39:27 dovecot_plain authenticator failed for ([88.201.163.65]) [88.201.163.65]:59182: 535 Incorrect authentication data (set_id=services@heipowersystem.com)88.201.163.652017370uY  -y' ossec13001gMJExim Auth failed2025-03-12 14:30:57 dovecot_plain authenticator failed for ([94.205.250.78]) [94.205.250.78]:52058: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)94.205.250.78290557   " ,CX}`bx  -O) ossec13001gѦExim Auth failed2025-03-12 20:51:35 dovecot_login authenticator failed for ([109.70.203.114]) [109.70.203.114]:43696: 535 Incorrect authentication data (set_id=vikas.khandelwal)109.70.203.1143175395rw  -q' ossec13001gѦSExim Auth failed2025-03-12 20:50:51 dovecot_login authenticator failed for ([102.221.65.24]) [102.221.65.24]:38729: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)102.221.65.242413451\v  -G% ossec13001gѤExim Auth failed2025-03-12 20:43:38 dovecot_login authenticator failed for ([193.93.237.8]) [193.93.237.8]:59516: 535 Incorrect authentication data (set_id=vikas.khandelwal)193.93.237.82017370 u  -O% ossec13001gѤExim Auth failed2025-03-12 20:43:13 dovecot_login authenticator failed for 61-216-7-163.hinet-ip.hinet.net (61-216-7-164.hinet-ip.hinet.net) [61.216.7.163]:54409: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)61.216.7.1631668284xt  -{) ossec13001gџExim Auth failed2025-03-12 20:23:19 dovecot_plain authenticator failed for syn-172-118-123-044.res.spectrum.com [172.118.123.44]:41196: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)172.118.123.446252001ys  -}) ossec13001gџExim Auth failed2025-03-12 20:23:04 dovecot_plain authenticator failed for ([60.173.105.206]) [60.173.105.206]:35998: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)60.173.105.2061814991Wr  -9) ossec13001gџExim Auth failed2025-03-12 20:19:55 dovecot_plain authenticator failed for ([222.143.30.155]) [222.143.30.155]:42542: 535 Incorrect authentication data (set_id=sales)222.143.30.1551814991gq  -[' ossec13001gџExim Auth failed2025-03-12 20:19:42 dovecot_plain authenticator failed for ([106.91.215.98]) [106.91.215.98]:41665: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)106.91.215.981814991ep  -S+ ossec13001gјExim Auth failed2025-03-12 19:52:38 dovecot_plain authenticator failed for ([123.210.128.249]) [123.210.128.249]:45216: 535 Incorrect authentication data (set_id=vikas.khandelwal)123.210.128.2492077456ro  -q' ossec13001gјExim Auth failed2025-03-12 19:52:20 dovecot_plain authenticator failed for ([218.14.180.33]) [218.14.180.33]:33006: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)218.14.180.331814991jn  -a' ossec13001gђExim Auth failed2025-03-12 19:26:24 dovecot_login authenticator failed for ([146.88.78.123]) [146.88.78.123]:58138: 535 Incorrect authentication data (set_id=services@heipowersystem.com)146.88.78.1231694008dm  -W% ossec13001g|Exim Auth failed2025-03-12 17:53:10 dovecot_plain authenticator failed for ([119.207.7.99]) [119.207.7.99]:55532: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)119.207.7.991835841ql  -q' ossec13001gzwExim Auth failed2025-03-12 17:43:42 dovecot_login authenticator failed for ([87.200.73.165]) [87.200.73.165]:41004: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)87.200.73.165290557Uk  -3+ ossec13001gzYExim Auth failed2025-03-12 17:43:12 dovecot_login authenticator failed for p60239-obmd01.osaka.ocn.ne.jp [153.141.247.239]:59597: 535 Incorrect authentication data153.141.247.2391861060Kj  =+ ossec13008gw8Mail Reciepient rejected2025-03-12 17:29:51 H=(mail.s2seducationtrust.com) [165.154.227.155]:53773 F= rejected RCPT : Rejected relay attempt: '165.154.227.155' From: 'jrwbdsnwf@s2seducationtrust.com' To: 'goofile@fastmail.com'165.154.227.1551668284gi  -[' ossec13001gtExim Auth failed2025-03-12 17:18:14 dovecot_plain authenticator failed for ool-18bbfd43.static.optonline.net [24.187.253.67]:49508: 535 Incorrect authentication data (set_id=services)24.187.253.676252001 }4 3 V ~ -U{w}v  -y' ossec13001gѴXExim Auth failed2025-03-12 21:50:40 dovecot_login authenticator failed for syn-172-090-128-097.res.spectrum.com [172.90.128.97]:53034: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)172.90.128.976252001  - ' ossec13001gѴPExim Auth failed2025-03-12 21:50:30 dovecot_login authenticator failed for d54c70cda.static.telenet.be [84.199.12.218]:35484: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)84.199.12.2182802361V  -9) ossec13001gѴNExim Auth failed2025-03-12 21:50:29 dovecot_login authenticator failed for ([31.141.216.143]) [31.141.216.143]:46942: 535 Incorrect authentication data (set_id=sales)31.141.216.143298795T  -5' ossec13001gѴDExim Auth failed2025-03-12 21:50:20 dovecot_login authenticator failed for ([112.15.84.229]) [112.15.84.229]:44992: 535 Incorrect authentication data (set_id=sales)112.15.84.2291814991g  -[' ossec13001gѴDExim Auth failed2025-03-12 21:50:20 dovecot_login authenticator failed for ([41.215.216.72]) [41.215.216.72]:33658: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)41.215.216.723374766d  -U' ossec13001gѴ6Exim Auth failed2025-03-12 21:50:05 dovecot_login authenticator failed for (pc0.zz.ha.cn) [218.28.77.206]:54021: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)218.28.77.2061814991s  -u% ossec13001gѳxExim Auth failed2025-03-12 21:46:55 dovecot_plain authenticator failed for ([141.94.18.69]) [141.94.18.69]:50248: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)141.94.18.693017382l  -a+ ossec13001gѲExim Auth failed2025-03-12 21:40:57 dovecot_login authenticator failed for 123.129.198.203.static.netvigator.com [203.198.129.123]:60291: 535 Incorrect authentication data (set_id=sales)203.198.129.1231819730i  -]) ossec13001gѲExim Auth failed2025-03-12 21:40:46 dovecot_login authenticator failed for mail-02.03.perm.ru [46.146.210.180]:3208: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)46.146.210.1802017370T  -5' ossec13001gѲExim Auth failed2025-03-12 21:40:46 dovecot_plain authenticator failed for ([39.152.120.40]) [39.152.120.40]:28434: 535 Incorrect authentication data (set_id=sales)39.152.120.401814991c  -W% ossec13001gѱExim Auth failed2025-03-12 21:40:24 dovecot_plain authenticator failed for ([94.204.90.91]) [94.204.90.91]:50787: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)94.204.90.91290557g~  -[' ossec13001gѫqExim Auth failed2025-03-12 21:12:41 dovecot_plain authenticator failed for ([112.173.61.81]) [112.173.61.81]:48638: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)112.173.61.811835841T}  -5' ossec13001gѫ}Exim Auth failed2025-03-12 21:12:53 dovecot_plain authenticator failed for ([114.30.180.58]) [114.30.180.58]:48155: 535 Incorrect authentication data (set_id=sales)114.30.180.581835841Y|  -?) ossec13001gѩ,Exim Auth failed2025-03-12 21:02:59 dovecot_plain authenticator failed for ([82.102.188.117]) [82.102.188.117]:38649: 535 Incorrect authentication data (set_id=services)82.102.188.117294640}{  -' ossec13001gѩExim Auth failed2025-03-12 21:02:23 dovecot_plain authenticator failed for syn-035-130-111-098.biz.spectrum.com [35.130.111.98]:40520: 535 Incorrect authentication data (set_id=services@heipowersystem.com)35.130.111.986252001Yz  -E! ossec13001gѨExim Auth failed2025-03-12 21:00:35 dovecot_plain authenticator failed for ([189.44.19.161]) [189.20.6.2]:33852: 535 Incorrect authentication data (set_id=vikas.khandelwal)189.20.6.23469034ky  -g# ossec13001gѨExim Auth failed2025-03-12 21:00:07 dovecot_plain authenticator failed for (pc0.zz.ha.cn) [218.28.18.2]:35143: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)218.28.18.21814991 7 : S , V a{~j  -a' ossec13001gExim Auth failed2025-03-12 23:05:11 dovecot_plain authenticator failed for ([183.47.48.178]) [183.47.48.178]:44934: 535 Incorrect authentication data (set_id=services@heipowersystem.com)183.47.48.1781814991x  -{) ossec13001gŜExim Auth failed2025-03-12 23:04:19 dovecot_plain authenticator failed for c-50-149-161-131.hsd1.tn.comcast.net [50.149.161.131]:62215: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)50.149.161.1316252001y  -}) ossec13001g~Exim Auth failed2025-03-12 23:03:49 dovecot_plain authenticator failed for ([120.157.12.107]) [120.157.12.107]:57864: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)120.157.12.1072077456g  -[' ossec13001gExim Auth failed2025-03-12 23:01:49 dovecot_plain authenticator failed for ([38.148.95.217]) [38.148.95.217]:52041: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)38.148.95.2176252001a  -O' ossec13001ggExim Auth failed2025-03-12 22:50:38 dovecot_login authenticator failed for 81.60.194.189.dyn.user.ono.com [81.60.194.189]:35249: 535 Incorrect authentication data (set_id=sales)81.60.194.1892510769d  -W% ossec13001gQExim Auth failed2025-03-12 22:50:15 dovecot_login authenticator failed for ([8.139.253.26]) [8.139.253.26]:39704: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)8.139.253.261814991x  -# ossec13001g"Exim Auth failed2025-03-12 22:45:13 dovecot_login authenticator failed for static-98-110-70-2.cmdnnj.fios.verizon.net [98.110.70.2]:56319: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)98.110.70.26252001y  -}) ossec13001gExim Auth failed2025-03-12 22:44:34 dovecot_login authenticator failed for ([121.124.52.237]) [121.124.52.237]:41983: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)121.124.52.2371835841b  -O) ossec13001gExim Auth failed2025-03-12 22:43:34 dovecot_plain authenticator failed for ([167.172.239.86]) [167.172.239.86]:44498: 535 Incorrect authentication data (set_id=vikas.khandelwal)167.172.239.866252001q  -q' ossec13001gExim Auth failed2025-03-12 22:43:24 dovecot_plain authenticator failed for ([196.46.199.11]) [196.46.199.11]:57756: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)196.46.199.11895949R  -; ossec13001gѽExim Auth failed2025-03-12 22:30:08 dovecot_login authenticator failed for ([5.32.61.6]) [5.32.61.6]:51123: 535 Incorrect authentication data (set_id=vikas.khandelwal)5.32.61.6290557#  -S' ossec13001gѽExim Auth failed2025-03-12 22:29:58 dovecot_login authenticator failed for 131-106-31-52.s1842.c3-0.eas-cbr5.atw-eas.pa.cable.rcncustomer.com [131.106.31.52]:50804: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)131.106.31.526252001c  -S' ossec13001gѶExim Auth failed2025-03-12 22:00:57 dovecot_login authenticator failed for ([118.188.18.25]) [118.188.18.25]:21305: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)118.188.18.251814991y  -}) ossec13001gѶExim Auth failed2025-03-12 22:00:35 dovecot_login authenticator failed for ([119.206.34.142]) [119.206.34.142]:39572: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)119.206.34.1421835841Z  -?) ossec13001gѵExim Auth failed2025-03-12 21:57:39 dovecot_login authenticator failed for ([183.193.94.254]) [101.224.38.123]:63430: 535 Incorrect authentication data (set_id=services)101.224.38.1231814991g  -]% ossec13001gѵExim Auth failed2025-03-12 21:57:25 dovecot_login authenticator failed for ([36.37.203.28]) [36.37.203.28]:39596: 535 Incorrect authentication data (set_id=services@heipowersystem.com)36.37.203.281831722 4 @ R w $4l+  -c) ossec13001gExim Auth failed2025-03-13 04:16:00 dovecot_plain authenticator failed for 81-224-183-135-no2620.tbcn.telia.com [81.224.183.135]:52880: 535 Incorrect authentication data (set_id=services)81.224.183.1352661886m*  -e) ossec13001gExim Auth failed2025-03-13 04:15:52 dovecot_plain authenticator failed for ([203.193.147.37]) [203.193.147.37]:51505: 535 Incorrect authentication data (set_id=services@heipowersystem.com)203.193.147.371269750f)  -W) ossec13001g Exim Auth failed2025-03-13 03:58:59 dovecot_plain authenticator failed for ([60.173.105.206]) [60.173.105.206]:36055: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)60.173.105.2061814991|(  -+ ossec13001g Exim Auth failed2025-03-13 03:58:28 dovecot_plain authenticator failed for ([115.247.159.106]) [115.247.159.106]:56392: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)115.247.159.1061269750e'  -U+ ossec13001gExim Auth failed2025-03-13 03:45:42 dovecot_plain authenticator failed for 3pc100-144.rconx.com [185.115.100.144]:52438: 535 Incorrect authentication data (set_id=vikas.khandelwal)185.115.100.144272103x&  -y+ ossec13001gkExim Auth failed2025-03-13 03:45:06 dovecot_plain authenticator failed for ([115.247.159.106]) [115.247.159.106]:33312: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)115.247.159.1061269750S%  -5% ossec13001gExim Auth failed2025-03-13 03:16:41 dovecot_login authenticator failed for ([200.223.243.81]) [201.18.58.62]:54453: 535 Incorrect authentication data (set_id=sales)201.18.58.623469034x$  -}' ossec13001gExim Auth failed2025-03-13 03:16:18 dovecot_login authenticator failed for (109.cpe-186-68-83.gye.satnet.net) [186.68.83.109]:40938: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)186.68.83.1093658394C#  77 ossec502g}Ossec server started.ossec: Ossec started.4"  ; ossec9703g7Dovecot is Starting Up.Mar 13 03:10:07 vm1 dovecot[385857]: master: Dovecot v2.3.21.1 (d492236fa0) starting up for lmtp, imap, pop3 (core dumps disabled)V!  -;% ossec13001gExim Auth failed2025-03-12 23:43:58 dovecot_login authenticator failed for ([89.179.241.253]) [81.200.17.89]:20930: 535 Incorrect authentication data (set_id=services)81.200.17.892017370x  -{) ossec13001gExim Auth failed2025-03-12 23:43:40 dovecot_login authenticator failed for p38088-obmd01.osaka.ocn.ne.jp [153.141.225.88]:53781: 535 Incorrect authentication data (set_id=services@heipowersystem.com)153.141.225.881861060h  -[) ossec13001gExim Auth failed2025-03-12 23:39:07 dovecot_plain authenticator failed for ([47.98.191.121]) [58.100.105.222]:2857: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)58.100.105.2221814991W  -;' ossec13001gExim Auth failed2025-03-12 23:32:05 dovecot_plain authenticator failed for ([89.175.49.147]) [89.175.49.147]:57864: 535 Incorrect authentication data (set_id=services)89.175.49.1472017370j  -a' ossec13001g Exim Auth failed2025-03-12 23:31:46 dovecot_plain authenticator failed for ([222.76.248.54]) [222.76.248.54]:37930: 535 Incorrect authentication data (set_id=services@heipowersystem.com)222.76.248.541814991W  -9) ossec13001gxExim Auth failed2025-03-12 23:25:02 dovecot_plain authenticator failed for ([182.180.93.208]) [182.180.93.208]:56052: 535 Incorrect authentication data (set_id=sales)182.180.93.2081168579  - + ossec13001gcExim Auth failed2025-03-12 23:24:43 dovecot_plain authenticator failed for (static-146.220.149.202-tataidc.co.in) [202.149.220.149]:33814: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)202.149.220.1491269750]  -C+ ossec13001gExim Auth failed2025-03-12 23:05:22 dovecot_plain authenticator failed for ([103.194.243.187]) [103.194.243.187]:57269: 535 Incorrect authentication data (set_id=services)103.194.243.1871269750 " E K j |-p|<  - # ossec13001g'SExim Auth failed2025-03-13 06:01:13 dovecot_plain authenticator failed for (5x166x68x89.dynamic.barnaul.ertelecom.ru) [5.166.68.89]:33292: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)5.166.68.892017370T;  -5' ossec13001g%Exim Auth failed2025-03-13 05:55:15 dovecot_plain authenticator failed for ([58.49.113.138]) [58.49.113.138]:12251: 535 Incorrect authentication data (set_id=sales)58.49.113.1381814991d:  -Y% ossec13001g%Exim Auth failed2025-03-13 05:54:50 dovecot_plain authenticator failed for ([89.211.42.163]) [37.186.54.71]:62146: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)37.186.54.7128968899  Ai) ossec11302g"FTP Authentication failed.Mar 13 05:40:47 vm1 pure-ftpd[418225]: (?@141.164.107.20) [WARNING] Authentication failed for user [anonymous]141.164.107.201655842(8 3S) ossec11301g"New FTP connection.Mar 13 05:40:42 vm1 pure-ftpd[418225]: (?@141.164.107.20) [INFO] New connection from 141.164.107.20141.164.107.201655842t7  -u) ossec13001gExim Auth failed2025-03-13 05:24:16 dovecot_plain authenticator failed for ([185.167.58.121]) [185.167.58.121]:44592: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)185.167.58.121617790T6  -5' ossec13001g>Exim Auth failed2025-03-13 05:22:29 dovecot_plain authenticator failed for ([38.20.111.164]) [38.20.111.164]:59355: 535 Incorrect authentication data (set_id=sales)38.20.111.16462519995  -) ossec13001g+Exim Auth failed2025-03-13 05:22:09 dovecot_plain authenticator failed for pool-108-18-206-153.washdc.fios.verizon.net [108.18.206.153]:48693: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)108.18.206.1536252001m4  -e) ossec13001g>Exim Auth failed2025-03-13 05:22:29 dovecot_login authenticator failed for ([221.178.176.85]) [221.178.176.85]:54145: 535 Incorrect authentication data (set_id=services@heipowersystem.com)221.178.176.851814991W3  -;' ossec13001gExim Auth failed2025-03-13 05:19:32 dovecot_plain authenticator failed for ([121.33.207.58]) [121.33.207.58]:52704: 535 Incorrect authentication data (set_id=services)121.33.207.581814991j2  -a' ossec13001gExim Auth failed2025-03-13 05:19:19 dovecot_plain authenticator failed for ([177.207.248.5]) [177.207.248.5]:34687: 535 Incorrect authentication data (set_id=services@heipowersystem.com)177.207.248.53469034]1  -K# ossec13001gExim Auth failed2025-03-13 05:07:41 dovecot_plain authenticator failed for ([49.0.129.12]) [49.0.129.12]:57288: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)49.0.129.122029969v0  -y' ossec13001gExim Auth failed2025-03-13 05:07:25 dovecot_plain authenticator failed for ([92.255.190.69]) [92.255.190.69]:50950: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)92.255.190.692017370W/  -9) ossec13001gExim Auth failed2025-03-13 05:06:56 dovecot_plain authenticator failed for ([74.196.184.120]) [74.196.184.120]:46647: 535 Incorrect authentication data (set_id=sales)74.196.184.1206252001~.  -) ossec13001gExim Auth failed2025-03-13 05:06:43 dovecot_plain authenticator failed for (107-175-76-146-host.colocrossing.com) [107.175.76.146]:56250: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)107.175.76.1466252001W-  -9) ossec13001gExim Auth failed2025-03-13 04:20:18 dovecot_plain authenticator failed for ([213.255.219.43]) [213.255.219.43]:48971: 535 Incorrect authentication data (set_id=sales)213.255.219.432782113,  - ) ossec13001gExim Auth failed2025-03-13 04:19:53 dovecot_plain authenticator failed for (mobile-166-195-193-083.mycingular.net) [166.195.193.83]:59720: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)166.195.193.836252001 %: S V n vL  -' ossec13001g:Exim Auth failed2025-03-13 07:21:13 dovecot_plain authenticator failed for host-88-43-231-186.business.telecomitalia.it ([88.43.231.188]) [88.43.231.186]:60646: 535 Incorrect authentication data (set_id=services)88.43.231.1863175395WK  -;' ossec13001g9Exim Auth failed2025-03-13 07:20:50 dovecot_plain authenticator failed for ([182.42.113.10]) [182.42.113.10]:32952: 535 Incorrect authentication data (set_id=services)182.42.113.101814991mJ  -e) ossec13001g9Exim Auth failed2025-03-13 07:20:36 dovecot_plain authenticator failed for ([182.239.78.124]) [182.239.78.124]:54424: 535 Incorrect authentication data (set_id=services@heipowersystem.com)182.239.78.1241819730jI  -_) ossec13001g9Exim Auth failed2025-03-13 07:19:23 dovecot_login authenticator failed for ([115.244.25.186]) [103.156.208.66]:48686: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)103.156.208.661269750nH  -i' ossec13001g9Exim Auth failed2025-03-13 07:18:57 dovecot_plain authenticator failed for (6.105.141.116.adsl-pool.jlccptt.net.cn) [116.141.105.6]:37472: 535 Incorrect authentication data (set_id=services)116.141.105.61814991mG  -e) ossec13001g9Exim Auth failed2025-03-13 07:18:46 dovecot_plain authenticator failed for ([119.62.184.137]) [119.62.184.137]:36334: 535 Incorrect authentication data (set_id=services@heipowersystem.com)119.62.184.1371814991bF  -O) ossec13001g9QExim Auth failed2025-03-13 07:18:00 dovecot_login authenticator failed for ([194.164.95.228]) [194.164.95.228]:36048: 535 Incorrect authentication data (set_id=vikas.khandelwal)194.164.95.2282635167 E  -O% ossec13001g9?Exim Auth failed2025-03-13 07:17:42 dovecot_login authenticator failed for 61-216-7-163.hinet-ip.hinet.net (61-216-7-165.hinet-ip.hinet.net) [61.216.7.163]:37724: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)61.216.7.1631668284{D  -+ ossec13001g0Exim Auth failed2025-03-13 06:42:19 dovecot_plain authenticator failed for mobile-166-200-113-122.mycingular.net [166.200.113.122]:55160: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)166.200.113.1226252001|C  -+ ossec13001g0Exim Auth failed2025-03-13 06:42:05 dovecot_plain authenticator failed for ([180.188.139.189]) [180.188.139.189]:43216: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)180.188.139.1891819730QB  -1% ossec13001g0WExim Auth failed2025-03-13 06:39:42 dovecot_plain authenticator failed for ([176.31.174.3]) [176.31.174.3]:48625: 535 Incorrect authentication data (set_id=sales)176.31.174.33017382dA  -W% ossec13001g0MExim Auth failed2025-03-13 06:39:31 dovecot_plain authenticator failed for ([58.16.114.30]) [58.16.114.30]:38139: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)58.16.114.301814991y@  -}) ossec13001g(Exim Auth failed2025-03-13 06:07:17 dovecot_plain authenticator failed for ([209.38.100.151]) [209.38.100.151]:48254: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)209.38.100.1512750405c?  -S' ossec13001g(Exim Auth failed2025-03-13 06:07:30 dovecot_plain authenticator failed for ([118.26.153.84]) [118.26.153.84]:63592: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)118.26.153.841819730g>  -]% ossec13001g'Exim Auth failed2025-03-13 06:03:48 dovecot_plain authenticator failed for ([61.81.151.97]) [61.81.151.97]:45822: 535 Incorrect authentication data (set_id=services@heipowersystem.com)61.81.151.971835841W=  -9) ossec13001g']Exim Auth failed2025-03-13 06:01:24 dovecot_plain authenticator failed for ([192.199.58.185]) [192.199.58.185]:51331: 535 Incorrect authentication data (set_id=sales)192.199.58.1856251999 G' L ^ m q \5Gj^  -_) ossec13001gWExim Auth failed2025-03-13 09:25:08 dovecot_login authenticator failed for ([61.184.176.231]) [61.184.176.231]:50168: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)61.184.176.2311814991']  3S) ossec11301gTNew FTP connection.Mar 13 09:14:53 vm1 pure-ftpd[461239]: (?@147.45.112.187) [INFO] New connection from 147.45.112.187147.45.112.1872134431`\  -O% ossec13001gT<Exim Auth failed2025-03-13 09:12:52 dovecot_plain authenticator failed for ([58.33.109.90]) [58.33.109.90]:38789: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)58.33.109.901814991|[  -+ ossec13001gT(Exim Auth failed2025-03-13 09:12:31 dovecot_plain authenticator failed for ([221.224.159.220]) [221.224.159.218]:59812: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)221.224.159.2181814991iZ  -]) ossec13001gSExim Auth failed2025-03-13 09:10:09 dovecot_plain authenticator failed for syn-172-248-047-114.res.spectrum.com [172.248.47.114]:54728: 535 Incorrect authentication data (set_id=sales)172.248.47.1146252001eY  -[' ossec13001gSExim Auth failed2025-03-13 09:09:57 dovecot_plain authenticator failed for ([65.20.213.101]) [65.20.213.101]:59033: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)65.20.213.10199237>X  gO' ossec11307gPOMultiple connection attempts from same sourceMar 13 08:56:06 vm1 pure-ftpd[457483]: (?@199.45.155.88) [INFO] New connection from 199.45.155.88199.45.155.886252001%W 3O' ossec11301gPI New FTP connection.Mar 13 08:56:01 vm1 pure-ftpd[457461]: (?@199.45.155.88) [INFO] New connection from 199.45.155.88199.45.155.886252001_V  -K' ossec13001gOExim Auth failed2025-03-13 08:53:21 dovecot_plain authenticator failed for ([75.111.59.146]) [75.111.59.146]:32894: 535 Incorrect authentication data (set_id=vikas.khandelwal)75.111.59.1466252001sU  -u) ossec13001gOExim Auth failed2025-03-13 08:53:10 dovecot_plain authenticator failed for ([213.32.253.235]) [213.32.253.235]:38008: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)213.32.253.23599237$T  3O' ossec11301gLNew FTP connection.Mar 13 08:40:56 vm1 pure-ftpd[454483]: (?@206.168.34.36) [INFO] New connection from 206.168.34.36206.168.34.366252001fS  -W) ossec13001gGExim Auth failed2025-03-13 08:19:25 dovecot_login authenticator failed for ([222.116.47.157]) [222.116.47.157]:57886: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)222.116.47.1571835841xR  -}) ossec13001gGExim Auth failed2025-03-13 08:19:08 dovecot_login authenticator failed for ([91.224.253.233]) [91.224.253.233]:57914: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)91.224.253.233690791mQ  -c+ ossec13001gEExim Auth failed2025-03-13 08:10:18 dovecot_login authenticator failed for (201-234-106-216.static.impsat.net.ar) [201.234.106.216]:40644: 535 Incorrect authentication data (set_id=sales)201.234.106.2163865483jP  -_) ossec13001gEExim Auth failed2025-03-13 08:10:08 dovecot_login authenticator failed for ([117.53.254.144]) [117.53.254.144]:33599: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)117.53.254.1441835841WO  -9) ossec13001g>[Exim Auth failed2025-03-13 07:39:29 dovecot_plain authenticator failed for ([211.48.113.101]) [211.48.113.101]:56962: 535 Incorrect authentication data (set_id=sales)211.48.113.1011835841jN  -_) ossec13001g>9Exim Auth failed2025-03-13 07:38:56 dovecot_plain authenticator failed for ([112.161.26.125]) [112.161.26.125]:39960: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)112.161.26.1251835841gM  -[' ossec13001g;Exim Auth failed2025-03-13 07:28:02 dovecot_plain authenticator failed for ([103.93.37.178]) [103.93.37.178]:38904: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)103.93.37.1781269750 : _ q ,T[Vh}Wo  -9) ossec13001gfCExim Auth failed2025-03-13 10:29:45 dovecot_login authenticator failed for ([196.28.226.123]) [196.28.226.123]:56566: 535 Incorrect authentication data (set_id=sales)196.28.226.1231036973gn  -[' ossec13001gf%Exim Auth failed2025-03-13 10:29:16 dovecot_login authenticator failed for ([106.227.87.29]) [106.227.87.29]:58068: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)106.227.87.291814991jm  -a' ossec13001g`/Exim Auth failed2025-03-13 10:03:50 dovecot_login authenticator failed for ([203.116.95.48]) [203.116.95.48]:52286: 535 Incorrect authentication data (set_id=services@heipowersystem.com)203.116.95.481880251l  -% ossec13001g_Exim Auth failed2025-03-13 10:02:46 dovecot_login authenticator failed for (88x87x84x104.static-customer.volgograd.ertelecom.ru) [88.87.84.104]:43823: 535 Incorrect authentication data (set_id=vikas.khandelwal)88.87.84.1042017370uk  -u) ossec13001g_Exim Auth failed2025-03-13 10:02:14 dovecot_login authenticator failed for ([218.92.201.232]) [218.92.201.226]:44437: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)218.92.201.2261814991Tj  -5' ossec13001g[Exim Auth failed2025-03-13 09:44:40 dovecot_plain authenticator failed for ([23.94.179.104]) [23.94.179.104]:60570: 535 Incorrect authentication data (set_id=sales)23.94.179.1046252001gi  -[' ossec13001g[Exim Auth failed2025-03-13 09:44:22 dovecot_plain authenticator failed for ([39.165.61.209]) [39.165.61.209]:58996: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)39.165.61.2091814991Th  -7% ossec13001gZ@Exim Auth failed2025-03-13 09:38:30 dovecot_plain authenticator failed for ([36.48.70.211]) [36.48.70.211]:57574: 535 Incorrect authentication data (set_id=services)36.48.70.2111814991Qg  -3# ossec13001gZ.Exim Auth failed2025-03-13 09:38:13 dovecot_plain authenticator failed for ([36.7.155.16]) [36.7.155.16]:38840: 535 Incorrect authentication data (set_id=services)36.7.155.161814991jf  -a' ossec13001gZExim Auth failed2025-03-13 09:37:54 dovecot_plain authenticator failed for ([170.250.128.5]) [170.250.128.5]:46266: 535 Incorrect authentication data (set_id=services@heipowersystem.com)170.250.128.56252001fe  -W) ossec13001gYExim Auth failed2025-03-13 09:35:45 dovecot_login authenticator failed for ([120.29.140.140]) [120.29.140.140]:37729: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)120.29.140.1401835841vd  -y' ossec13001gYvExim Auth failed2025-03-13 09:35:09 dovecot_login authenticator failed for ([14.48.227.118]) [14.48.227.118]:49957: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)14.48.227.1181835841Wc  -;' ossec13001gXExim Auth failed2025-03-13 09:32:24 dovecot_login authenticator failed for ([103.107.36.18]) [103.107.36.18]:36850: 535 Incorrect authentication data (set_id=services)103.107.36.181269750jb  -a' ossec13001gXExim Auth failed2025-03-13 09:32:14 dovecot_login authenticator failed for ([103.174.34.49]) [103.174.34.49]:50727: 535 Incorrect authentication data (set_id=services@heipowersystem.com)103.174.34.491269750Wa  -9) ossec13001gW)Exim Auth failed2025-03-13 09:25:21 dovecot_login authenticator failed for ([222.239.231.61]) [222.239.231.61]:37323: 535 Incorrect authentication data (set_id=sales)222.239.231.611835841W`  -9) ossec13001gW%Exim Auth failed2025-03-13 09:25:17 dovecot_login authenticator failed for ([185.168.173.87]) [185.168.173.87]:56076: 535 Incorrect authentication data (set_id=sales)185.168.173.873175395g_  -[' ossec13001gWExim Auth failed2025-03-13 09:25:09 dovecot_login authenticator failed for ([39.165.236.12]) [39.165.236.12]:50632: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)39.165.236.121814991 *\~tj`VLB8.$zpf\H>4*   v l b X N D : 0 &    ~ t j ` V L B 8 . $    z p f \ R H > 4 *  vlbXND:0&|rh^TJ@6,"xndZPF2<( ~tj`VLB8.$zpf\ | r h ^ T J @ 6 , "    x n d Z P F < 2 (   RRH>4*  vlbXND:0& g) g) g) g) g) g) g) g؁) gu) g) g) gԤ) gP) g3) g) gҭ) gң) g) gu) g]) gU) gR) g@) g΢) gΖ) g) g) g) g) g) g) gC) g-) gp) gdž) g4) g*) g) g+) g) g) g) gҼQ) gҼG) gҼ?) gҼ) gһ) gһG) gһS) gҸ) gҸ) gҷ\) gҷH) gҷ) gҶ) gҴK) gҴ?) gҩ) gҩ) gҦ9) gҦ-) gҤ) gҤ) gҟT) gҟ<) gҞ) gҞ) gҞ) gҞ ) gҜ) gҙ) gҙ) gғ) gғ) gғ ) gҐ) gҐ) gҐ) gҎ#) gҌk) gҌa) gҊ) gҊ) g҈) g҈) g҈) g҆) g҆) g҄) gҀ) gҀ) gҀ ) gҀ) g) g}) g}) g}/) g|) g|) g{p) g{H) g{ ) g{) gy) gy) gyB) gy.) gu) gq)~ gq)} gp)| gp){ gp)z gp)y goU)x gl)w gl)v gl)u glx)t gi)s gi)r gf)q gf)p gfC)o gf%)n g`/)m g_)l g_)k g[)j g[)i gZ@)h gZ.)g gZ)f gY)e gYv)d gX)c gX)b gW))a gW%)` gW)_ gW)^ gT)] gT<)\ gT()[ gS)Z gS)Y gPO)X gPI)W gO)V gO)U gL)T gG)S gG)R gE)Q gE)P g>[)O g>9)N g;)M g:)L g9)K g9)J g9)I g9)H g9)G g9Q)F g9?)E g0)D g0)C g0W)B g0M)A g* g* g * g* g* g * g * g * g * g * g * gO* g9* g* g* g* g* g* g* g* g* g* g$) g) gm) ga) gS) gA) g1) g) g) g) g) g) g ) g_) g) g) g) g) g) gr) gQ) g()? g()@ g')> g'])= g'S)< g%); g%): g")9 g")8 g)7 g>)6 g>)4 g+)5 g)3 g)2 g)1 g)0 g)/ g). g)- g), g)+ g)* g )) g )( g)' gk)& g)% g)$ g})# g7)" g)! g) g) g) g ) gx) gc) g) g) gŜ) g~) g* g) gg) gQ) g") g) g) g) gѽ) gѽ) gѶ) gѶ) gѵ) gѵ) gѴX) gѴP) gѴN) gѴD) gѴD) gѴ6) gѳx) gѲ) gѲ) gѲ) gѱ( gѫ}( gѫq( gѩ,( gѩ( gѨ( gѨ( gѦ( gѦS( gѤ( gѤ( gџ( gџ( gџ( gџ( gј( gј( gђ( g|( /( 2 : 9 X J]o`vu/j  -a' ossec13001gy.Exim Auth failed2025-03-13 11:50:28 dovecot_login authenticator failed for rt-kalyanov.tagan.ru [95.174.99.133]:37299: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)95.174.99.1332017370$  3O' ossec11301guNew FTP connection.Mar 13 11:33:00 vm1 pure-ftpd[489160]: (?@20.65.193.183) [INFO] New connection from 20.65.193.18320.65.193.1836252001T~  -5' ossec13001gqExim Auth failed2025-03-13 11:19:36 dovecot_plain authenticator failed for ([61.185.30.170]) [61.185.30.170]:39801: 535 Incorrect authentication data (set_id=sales)61.185.30.1701814991d}  -W% ossec13001gqExim Auth failed2025-03-13 11:19:14 dovecot_plain authenticator failed for ([58.16.91.144]) [58.16.91.144]:59608: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)58.16.91.1441814991l|  -a+ ossec13001gpExim Auth failed2025-03-13 11:15:03 dovecot_plain authenticator failed for 122-222-117-139.east.ap.gmo-isp.jp [122.222.117.139]:59069: 535 Incorrect authentication data (set_id=services)122.222.117.1391861060}{  -+ ossec13001gpExim Auth failed2025-03-13 11:14:50 dovecot_plain authenticator failed for (static.ill.117.250.119.122.bsnl.co.in) [117.250.119.122]:48212: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)117.250.119.1221269750fz  -[% ossec13001gpExim Auth failed2025-03-13 11:14:46 dovecot_plain authenticator failed for ([27.71.20.180]) [27.71.20.180]:4511: 535 Incorrect authentication data (set_id=services@heipowersystem.com)27.71.20.1801562822 y  -!) ossec13001gpExim Auth failed2025-03-13 11:14:38 dovecot_plain authenticator failed for syn-208-105-193-045.biz.spectrum.com [208.105.193.45]:59026: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)208.105.193.456252001jx  -_) ossec13001goUExim Auth failed2025-03-13 11:08:28 dovecot_plain authenticator failed for ([207.219.221.99]) [207.219.221.99]:34541: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)207.219.221.996251999iw  -[+ ossec13001glExim Auth failed2025-03-13 10:57:57 dovecot_plain authenticator failed for ([211.247.127.250]) [211.247.127.250]:37912: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)211.247.127.2501835841 v  -#' ossec13001glExim Auth failed2025-03-13 10:57:46 dovecot_plain authenticator failed for (mail110220.dc.sistemdc.commailtr.com) [78.189.21.157]:10358: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)78.189.21.157298795]u  -K# ossec13001glExim Auth failed2025-03-13 10:56:36 dovecot_plain authenticator failed for 111-70-32-9.emome-ip.hinet.net [111.70.32.9]:42657: 535 Incorrect authentication data (set_id=sales)111.70.32.91668284}t  -' ossec13001glxExim Auth failed2025-03-13 10:56:16 dovecot_plain authenticator failed for broadband-95-84-186-218.ip.moscow.rt.ru [95.84.186.218]:50926: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)95.84.186.2182017370ts  -s) ossec13001giExim Auth failed2025-03-13 10:44:47 dovecot_plain authenticator failed for c-69-242-149-240.hsd1.mo.comcast.net [69.242.149.240]:36720: 535 Incorrect authentication data (set_id=vikas.khandelwal)69.242.149.2406252001rr  -q' ossec13001giExim Auth failed2025-03-13 10:44:28 dovecot_plain authenticator failed for ([183.247.194.8]) [183.247.194.8]:49114: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)183.247.194.81814991bq  -O) ossec13001gfExim Auth failed2025-03-13 10:31:03 dovecot_plain authenticator failed for ([222.75.225.206]) [222.75.225.206]:58303: 535 Incorrect authentication data (set_id=vikas.khandelwal)222.75.225.2061814991np  -m% ossec13001gfExim Auth failed2025-03-13 10:30:47 dovecot_plain authenticator failed for ([185.167.56.2]) [185.167.56.2]:50976: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)185.167.56.2617790 e": c k q w y%:eQ  -1% ossec13001gҀExim Auth failed2025-03-13 12:23:01 dovecot_plain authenticator failed for ([14.46.30.239]) [14.46.30.239]:44231: 535 Incorrect authentication data (set_id=sales)14.46.30.2391835841g  -[' ossec13001gҀExim Auth failed2025-03-13 12:22:50 dovecot_plain authenticator failed for ([80.233.77.125]) [80.233.77.125]:38936: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)80.233.77.1252963597T  -7% ossec13001gҀ Exim Auth failed2025-03-13 12:20:07 dovecot_plain authenticator failed for ([78.134.19.99]) [78.134.19.99]:41065: 535 Incorrect authentication data (set_id=services)78.134.19.993175395p  -i+ ossec13001gҀExim Auth failed2025-03-13 12:19:43 dovecot_plain authenticator failed for ([194.226.155.198]) [194.226.155.198]:58018: 535 Incorrect authentication data (set_id=services@heipowersystem.com)194.226.155.1982017370y  -' ossec13001gExim Auth failed2025-03-13 12:19:32 dovecot_plain authenticator failed for 111-70-23-248.emome-ip.hinet.net [111.70.23.248]:41318: 535 Incorrect authentication data (set_id=services@heipowersystem.com)111.70.23.2481668284v  -y' ossec13001g}Exim Auth failed2025-03-13 12:07:18 dovecot_plain authenticator failed for ([220.86.135.65]) [220.86.135.80]:44040: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)220.86.135.801835841^ -E) ossec13001g}Exim Auth failed2025-03-13 12:07:12 dovecot_login authenticator failed for (vandanabalbharti.com) [124.160.63.122]:29857: 535 Incorrect authentication data (set_id=nologin)124.160.63.1221814991f  -W) ossec13001g}/Exim Auth failed2025-03-13 12:07:33 dovecot_plain authenticator failed for ([49.124.152.225]) [49.124.152.225]:40648: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)49.124.152.2251733045V  -9) ossec13001g|Exim Auth failed2025-03-13 12:06:35 dovecot_plain authenticator failed for ([197.156.97.198]) [197.156.97.198]:47778: 535 Incorrect authentication data (set_id=sales)197.156.97.198337996g  -[' ossec13001g|Exim Auth failed2025-03-13 12:06:20 dovecot_plain authenticator failed for ([103.187.79.19]) [103.187.79.19]:55992: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)103.187.79.191269750z  -' ossec13001g{pExim Auth failed2025-03-13 12:00:08 dovecot_login authenticator failed for (6.105.141.116.adsl-pool.jlccptt.net.cn) [116.141.105.6]:34366: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)116.141.105.61814991v  -y' ossec13001g{HExim Auth failed2025-03-13 11:59:28 dovecot_login authenticator failed for ([221.11.33.116]) [221.11.33.116]:35641: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)221.11.33.1161814991v  -w) ossec13001g{ Exim Auth failed2025-03-13 11:58:26 dovecot_plain authenticator failed for 198-91-188-226.cpe.distributel.net [198.91.188.226]:35388: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)198.91.188.2266251999t  -y' ossec13001g{Exim Auth failed2025-03-13 11:58:15 dovecot_plain authenticator failed for ([65.20.172.194]) [65.20.172.194]:49797: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)65.20.172.19499237S  -5' ossec13001gyExim Auth failed2025-03-13 11:52:11 dovecot_plain authenticator failed for ([46.130.54.153]) [46.130.54.153]:35346: 535 Incorrect authentication data (set_id=sales)46.130.54.153174982d  -W% ossec13001gyExim Auth failed2025-03-13 11:51:55 dovecot_plain authenticator failed for ([59.34.17.130]) [59.34.17.130]:57563: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)59.34.17.1301814991Z  -=+ ossec13001gyBExim Auth failed2025-03-13 11:50:48 dovecot_login authenticator failed for ([178.178.194.131]) [178.178.194.131]:40446: 535 Incorrect authentication data (set_id=sales)178.178.194.1312017370 Q   ) >Zo 5/QZ"  -A' ossec13001gғExim Auth failed2025-03-13 13:43:23 dovecot_login authenticator failed for rt-kalyanov.tagan.ru [95.174.99.133]:58559: 535 Incorrect authentication data (set_id=services)95.174.99.1332017370g!  -]% ossec13001gғExim Auth failed2025-03-13 13:43:14 dovecot_login authenticator failed for ([195.158.19.6]) [195.158.19.6]:57910: 535 Incorrect authentication data (set_id=services@heipowersystem.com)195.158.19.61512440  W' ossec9708gғ Dovecot Aborted Login with empty userMar 13 13:40:51 vm1 dovecot[385861]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 2 secs): user=<>, rip=103.218.241.7, lip=103.74.54.108, session=103.218.241.71819730T  -5' ossec13001gҐExim Auth failed2025-03-13 13:31:02 dovecot_plain authenticator failed for ([182.42.113.10]) [182.42.113.10]:36660: 535 Incorrect authentication data (set_id=sales)182.42.113.101814991Q  -1% ossec13001gҐExim Auth failed2025-03-13 13:30:44 dovecot_plain authenticator failed for ([60.28.39.166]) [60.28.39.166]:47575: 535 Incorrect authentication data (set_id=sales)60.28.39.1661814991y  -' ossec13001gҐExim Auth failed2025-03-13 13:30:26 dovecot_plain authenticator failed for 185.39.167.72.host.secureserver.net [72.167.39.185]:51862: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)72.167.39.1856252001'  3S) ossec11301gҎ#New FTP connection.Mar 13 13:19:54 vm1 pure-ftpd[511052]: (?@198.235.24.115) [INFO] New connection from 198.235.24.115198.235.24.1156252001a  -S% ossec13001gҌkExim Auth failed2025-03-13 13:12:33 dovecot_plain authenticator failed for host-5-58-201-106.bitternet.ua [5.58.201.106]:35899: 535 Incorrect authentication data (set_id=services)5.58.201.106690791g  -]% ossec13001gҌaExim Auth failed2025-03-13 13:12:24 dovecot_plain authenticator failed for ([103.68.38.78]) [103.68.38.78]:34494: 535 Incorrect authentication data (set_id=services@heipowersystem.com)103.68.38.781269750`  -O% ossec13001gҊExim Auth failed2025-03-13 13:05:36 dovecot_plain authenticator failed for ti0004q160-7861.bb.online.no [95.34.158.19]:33188: 535 Incorrect authentication data (set_id=services)95.34.158.193144096g  -]% ossec13001gҊExim Auth failed2025-03-13 13:05:26 dovecot_plain authenticator failed for ([59.34.17.130]) [59.34.17.130]:34818: 535 Incorrect authentication data (set_id=services@heipowersystem.com)59.34.17.1301814991r  -q' ossec13001g҈Exim Auth failed2025-03-13 12:57:29 dovecot_plain authenticator failed for 111-70-23-254.emome-ip.hinet.net [111.70.23.254]:43269: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)111.70.23.2541668284p  -q# ossec13001g҈Exim Auth failed2025-03-13 12:57:17 dovecot_plain authenticator failed for ([59.7.57.174]) [59.7.57.174]:54930: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)59.7.57.1741835841s  -q) ossec13001g҈Exim Auth failed2025-03-13 12:56:55 dovecot_plain authenticator failed for (183.83.188.236.actcorp.in) [183.83.188.236]:53076: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)183.83.188.2361269750T  -5' ossec13001g҆Exim Auth failed2025-03-13 12:48:43 dovecot_login authenticator failed for ([217.24.185.98]) [217.24.185.98]:58660: 535 Incorrect authentication data (set_id=sales)217.24.185.982017370j  -_) ossec13001g҆Exim Auth failed2025-03-13 12:48:32 dovecot_login authenticator failed for ([106.55.161.136]) [106.55.161.136]:44982: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)106.55.161.1361814991,  =S) ossec13008g҄Mail Reciepient rejected2025-03-13 12:40:13 H=(mail.msnews24.in) [165.154.233.84]:63685 F= rejected RCPT : Rejected relay attempt: '165.154.233.84' From: 'hwofnoasic@msnews24.in' To: 'goofile@fastmail.com'165.154.233.841694008 4 ;Mxn3  -m# ossec13001gҴKExim Auth failed2025-03-13 16:02:42 dovecot_plain authenticator failed for syn-071-071-064-052.res.spectrum.com [71.71.64.52]:35633: 535 Incorrect authentication data (set_id=vikas.khandelwal)71.71.64.526252001r2  -q' ossec13001gҴ?Exim Auth failed2025-03-13 16:02:30 dovecot_plain authenticator failed for ([120.78.172.20]) [120.78.172.20]:50908: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)120.78.172.201814991w1  -{' ossec13001gҩExim Auth failed2025-03-13 15:18:01 dovecot_login authenticator failed for (amplifypowerglobal.com) [111.56.54.202]:55160: 535 Incorrect authentication data (set_id=postmaster@amplifypowerglobal.com)111.56.54.2021814991]0  -G' ossec13001gҩExim Auth failed2025-03-13 15:17:37 dovecot_login authenticator failed for (amplifypowerglobal.com) [111.56.54.202]:52514: 535 Incorrect authentication data (set_id=nologin)111.56.54.2021814991Q/  -1% ossec13001gҦ9Exim Auth failed2025-03-13 15:02:40 dovecot_plain authenticator failed for ([186.73.22.20]) [186.73.22.20]:38738: 535 Incorrect authentication data (set_id=sales)186.73.22.203703430j.  -_) ossec13001gҦ-Exim Auth failed2025-03-13 15:02:28 dovecot_plain authenticator failed for ([115.244.25.190]) [103.156.208.66]:33262: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)103.156.208.661269750Y-  -?) ossec13001gҤExim Auth failed2025-03-13 14:56:36 dovecot_plain authenticator failed for ([213.57.214.111]) [213.57.214.111]:60131: 535 Incorrect authentication data (set_id=services)213.57.214.111294640y,  -' ossec13001gҤExim Auth failed2025-03-13 14:56:09 dovecot_plain authenticator failed for 95.57.104.252.dynamic.telecom.kz [95.57.104.252]:36898: 535 Incorrect authentication data (set_id=services@heipowersystem.com)95.57.104.2521522867i+  -_' ossec13001gҟTExim Auth failed2025-03-13 14:33:15 dovecot_login authenticator failed for (gurukuljaipur.com) [111.207.12.99]:57456: 535 Incorrect authentication data (set_id=office@gurukuljaipur.com)111.207.12.991814991X*  -=' ossec13001gҟ<Exim Auth failed2025-03-13 14:32:51 dovecot_login authenticator failed for (gurukuljaipur.com) [111.207.12.99]:53794: 535 Incorrect authentication data (set_id=nologin)111.207.12.991814991f)  -W) ossec13001gҞExim Auth failed2025-03-13 14:30:29 dovecot_plain authenticator failed for ([207.102.66.226]) [207.102.66.226]:50650: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)207.102.66.2266251999|(  -+ ossec13001gҞExim Auth failed2025-03-13 14:30:11 dovecot_plain authenticator failed for ([111.193.226.252]) [111.193.226.252]:16148: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)111.193.226.2521814991U'  -9) ossec13001gҞExim Auth failed2025-03-13 14:27:59 dovecot_plain authenticator failed for ([62.201.228.210]) [62.201.228.210]:35338: 535 Incorrect authentication data (set_id=sales)62.201.228.21099237d&  -W% ossec13001gҞ Exim Auth failed2025-03-13 14:27:47 dovecot_plain authenticator failed for ([60.31.181.52]) [60.31.181.52]:40391: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)60.31.181.521814991'%  3S) ossec11301gҜNew FTP connection.Mar 13 14:21:51 vm1 pure-ftpd[523817]: (?@209.38.206.136) [INFO] New connection from 209.38.206.136209.38.206.1362921044W$  -9) ossec13001gҙExim Auth failed2025-03-13 14:09:46 dovecot_login authenticator failed for ([222.160.99.210]) [222.160.99.210]:52253: 535 Incorrect authentication data (set_id=sales)222.160.99.2101814991m#  -c+ ossec13001gҙExim Auth failed2025-03-13 14:09:28 dovecot_login authenticator failed for ([111.193.226.252]) [111.193.226.252]:31858: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)111.193.226.2521814991 9 & . , C ev)Qcl9CE  77 ossec502gOssec server started.ossec: Ossec started.iD  -[+ ossec13001g+Exim Auth failed2025-03-13 17:06:10 dovecot_plain authenticator failed for ([123.138.101.106]) [123.138.101.106]:52301: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)123.138.101.1061814991sC  -u% ossec13001gExim Auth failed2025-03-13 17:05:58 dovecot_plain authenticator failed for ([46.0.130.216]) [46.0.130.216]:55694: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)46.0.130.2162017370jB  -_) ossec13001gExim Auth failed2025-03-13 16:59:56 dovecot_plain authenticator failed for ([222.106.198.35]) [222.106.198.35]:38480: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)222.106.198.351835841TA  -5' ossec13001gExim Auth failed2025-03-13 17:00:12 dovecot_plain authenticator failed for ([31.43.202.110]) [31.43.202.110]:52191: 535 Incorrect authentication data (set_id=sales)31.43.202.1102017370Z@  -=+ ossec13001gҼQExim Auth failed2025-03-13 16:36:57 dovecot_plain authenticator failed for ([223.247.227.109]) [223.247.227.109]:59364: 535 Incorrect authentication data (set_id=sales)223.247.227.1091814991!?  3K% ossec11301gҼGNew FTP connection.Mar 13 16:36:45 vm1 pure-ftpd[551424]: (?@103.203.59.5) [INFO] New connection from 103.203.59.5103.203.59.51814991j>  -_) ossec13001gҼ?Exim Auth failed2025-03-13 16:36:39 dovecot_plain authenticator failed for ([218.23.156.227]) [218.23.156.227]:59180: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)218.23.156.2271814991b=  -O) ossec13001gҼExim Auth failed2025-03-13 16:35:53 dovecot_login authenticator failed for ([157.122.199.19]) [157.122.199.19]:56607: 535 Incorrect authentication data (set_id=vikas.khandelwal)157.122.199.191814991r<  -q' ossec13001gһExim Auth failed2025-03-13 16:35:27 dovecot_login authenticator failed for ([103.174.34.49]) [103.174.34.49]:56195: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)103.174.34.491269750k;  -e) ossec13001gһGExim Auth failed2025-03-13 16:32:29 dovecot_plain authenticator failed for ([185.255.47.190]) [185.255.47.190]:53810: 535 Incorrect authentication data (set_id=services@heipowersystem.com)185.255.47.19099237Z:  -?) ossec13001gһSExim Auth failed2025-03-13 16:32:41 dovecot_plain authenticator failed for ([218.67.123.202]) [218.67.123.202]:40489: 535 Incorrect authentication data (set_id=services)218.67.123.2021814991e9  -S+ ossec13001gҸExim Auth failed2025-03-13 16:22:32 dovecot_plain authenticator failed for ([175.156.139.195]) [175.156.139.195]:49540: 535 Incorrect authentication data (set_id=vikas.khandelwal)175.156.139.1951880251~8  - ' ossec13001gҸExim Auth failed2025-03-13 16:22:06 dovecot_plain authenticator failed for (160.72.153.14.lightower.net) [160.72.153.14]:38737: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)160.72.153.146252001t7  -w% ossec13001gҷ\Exim Auth failed2025-03-13 16:15:48 dovecot_plain authenticator failed for syn-072-017-090-246.biz.spectrum.com [72.17.90.246]:35948: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)72.17.90.2466252001v6  -y' ossec13001gҷHExim Auth failed2025-03-13 16:15:27 dovecot_plain authenticator failed for ([117.158.25.54]) [117.158.25.54]:34054: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)117.158.25.541814991Z5  -=+ ossec13001gҷExim Auth failed2025-03-13 16:14:16 dovecot_plain authenticator failed for ([182.176.138.162]) [182.176.138.162]:38719: 535 Incorrect authentication data (set_id=sales)182.176.138.1621168579~4  -) ossec13001gҶExim Auth failed2025-03-13 16:14:00 dovecot_plain authenticator failed for net-188-152-225-58.cust.vodafonedsl.it [188.152.225.58]:34317: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)188.152.225.583175395 ^) B 5 D l %JPT^rV  -q' ossec13001gUExim Auth failed2025-03-13 18:10:52 dovecot_login authenticator failed for ([200.37.179.83]) [200.37.179.83]:52751: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)200.37.179.833932488xU  -{) ossec13001gRExim Auth failed2025-03-13 17:58:02 dovecot_login authenticator failed for 222.42.246.220.static.netvigator.com [220.246.42.222]:64411: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)220.246.42.2221819730vT  -y' ossec13001g@Exim Auth failed2025-03-13 17:57:44 dovecot_login authenticator failed for ([83.239.84.130]) [83.239.84.130]:39343: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)83.239.84.1302017370WS  -;' ossec13001g΢Exim Auth failed2025-03-13 17:55:06 dovecot_login authenticator failed for ([220.95.14.102]) [220.95.14.102]:50378: 535 Incorrect authentication data (set_id=services)220.95.14.1021835841mR  -e) ossec13001gΖExim Auth failed2025-03-13 17:54:53 dovecot_login authenticator failed for ([222.239.231.61]) [222.239.231.61]:37434: 535 Incorrect authentication data (set_id=services@heipowersystem.com)222.239.231.611835841HQ  -% ossec13001gExim Auth failed2025-03-13 17:48:13 dovecot_login authenticator failed for ([4.4.89.74]) [4.4.89.74]:58554: 535 Incorrect authentication data (set_id=sales)4.4.89.746252001fP  -W) ossec13001gExim Auth failed2025-03-13 17:48:04 dovecot_login authenticator failed for 220-135-116-94.hinet-ip.hinet.net [220.135.116.94]:50800: 535 Incorrect authentication data (set_id=sales)220.135.116.941668284mO  -c+ ossec13001gExim Auth failed2025-03-13 17:48:03 dovecot_login authenticator failed for ([125.140.244.144]) [125.140.244.144]:37258: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)125.140.244.1441835841gN  -[' ossec13001gExim Auth failed2025-03-13 17:47:53 dovecot_login authenticator failed for ([103.65.227.71]) [103.65.227.71]:36419: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)103.65.227.711210997TM  -5' ossec13001gExim Auth failed2025-03-13 17:39:25 dovecot_plain authenticator failed for ([121.33.207.58]) [121.33.207.58]:33347: 535 Incorrect authentication data (set_id=sales)121.33.207.581814991hL  -_) ossec13001gExim Auth failed2025-03-13 17:39:10 dovecot_plain authenticator failed for ([196.216.81.126]) [196.216.81.126]:49060: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)196.216.81.12649518TK  -7% ossec13001gCExim Auth failed2025-03-13 17:36:25 dovecot_plain authenticator failed for ([5.59.141.152]) [5.59.141.152]:55188: 535 Incorrect authentication data (set_id=services)5.59.141.1522017370mJ  -e) ossec13001g-Exim Auth failed2025-03-13 17:36:04 dovecot_plain authenticator failed for ([183.167.196.62]) [183.167.196.62]:54676: 535 Incorrect authentication data (set_id=services@heipowersystem.com)183.167.196.621814991 I  -' ossec13001gpExim Auth failed2025-03-13 17:24:24 dovecot_plain authenticator failed for syn-045-049-179-157.res.spectrum.com [45.49.179.157]:48412: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)45.49.179.1576252001cH  -S' ossec13001gdžExim Auth failed2025-03-13 17:24:45 dovecot_plain authenticator failed for ([64.52.161.161]) [64.52.161.161]:40485: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)64.52.161.1616252001iG  -]) ossec13001g4Exim Auth failed2025-03-13 17:23:23 dovecot_plain authenticator failed for syn-076-178-103-119.res.spectrum.com [76.178.103.119]:52820: 535 Incorrect authentication data (set_id=sales)76.178.103.1196252001fF  -[% ossec13001g*Exim Auth failed2025-03-13 17:23:13 dovecot_plain authenticator failed for ([103.145.27.106]) [103.145.27.1]:46406: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)103.145.27.11643084 "4 Y C _ c ouf  -y% ossec13001gExim Auth failed2025-03-13 19:03:51 dovecot_login authenticator failed for 95-30-250-44.broadband.corbina.ru [95.30.250.44]:58932: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)95.30.250.442017370pe  -m' ossec13001gExim Auth failed2025-03-13 18:44:04 dovecot_login authenticator failed for (thepsindustries.com) [58.240.171.59]:58590: 535 Incorrect authentication data (set_id=webmaster@thepsindustries.com)58.240.171.591814991Zd  -A' ossec13001gExim Auth failed2025-03-13 18:43:39 dovecot_login authenticator failed for (thepsindustries.com) [58.240.171.59]:43384: 535 Incorrect authentication data (set_id=nologin)58.240.171.591814991ic  -]) ossec13001g؁Exim Auth failed2025-03-13 18:37:11 dovecot_plain authenticator failed for 166.46.246.220.static.netvigator.com [220.246.46.166]:60852: 535 Incorrect authentication data (set_id=sales)220.246.46.1661819730jb  -_) ossec13001guExim Auth failed2025-03-13 18:37:00 dovecot_plain authenticator failed for ([43.228.131.114]) [43.228.131.114]:40296: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)43.228.131.1142029969a  -;% ossec13001gExim Auth failed2025-03-13 18:25:46 dovecot_login authenticator failed for net-2-32-137-250.cust.dsl.teletu.it (net-2-32-137-250.cust.vodafonedsl.it) [2.32.137.250]:38301: 535 Incorrect authentication data (set_id=vikas.khandelwal)2.32.137.2503175395r`  -q' ossec13001gExim Auth failed2025-03-13 18:25:27 dovecot_login authenticator failed for ([222.120.176.6]) [222.120.176.6]:59462: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)222.120.176.61835841m_  -e) ossec13001gԤExim Auth failed2025-03-13 18:20:43 dovecot_plain authenticator failed for ([168.121.46.162]) [168.121.46.162]:37440: 535 Incorrect authentication data (set_id=services@heipowersystem.com)168.121.46.1623932488R^  -7% ossec13001gPExim Auth failed2025-03-13 18:19:19 dovecot_plain authenticator failed for ([65.20.251.53]) [65.20.251.53]:59110: 535 Incorrect authentication data (set_id=services)65.20.251.5399237p]  -i+ ossec13001g3Exim Auth failed2025-03-13 18:18:50 dovecot_plain authenticator failed for ([178.178.194.135]) [178.178.194.135]:43184: 535 Incorrect authentication data (set_id=services@heipowersystem.com)178.178.194.1352017370x\  -{) ossec13001gExim Auth failed2025-03-13 18:12:42 dovecot_login authenticator failed for p38088-obmd01.osaka.ocn.ne.jp [153.141.225.88]:52149: 535 Incorrect authentication data (set_id=services@heipowersystem.com)153.141.225.881861060`[  -O% ossec13001gҭExim Auth failed2025-03-13 18:12:20 dovecot_plain authenticator failed for ([62.16.40.223]) [62.16.40.223]:52926: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)62.16.40.2232017370Z  --+ ossec13001gңExim Auth failed2025-03-13 18:12:10 dovecot_plain authenticator failed for broadband-178-140-152-209.ip.moscow.rt.ru [178.140.152.209]:54898: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)178.140.152.2092017370WY  -9) ossec13001gExim Auth failed2025-03-13 18:11:35 dovecot_plain authenticator failed for ([115.244.25.186]) [103.156.208.66]:47076: 535 Incorrect authentication data (set_id=sales)103.156.208.661269750jX  -_) ossec13001guExim Auth failed2025-03-13 18:11:25 dovecot_plain authenticator failed for ([209.38.100.151]) [209.38.100.151]:42146: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)209.38.100.1512750405ZW  -G% ossec13001g]Exim Auth failed2025-03-13 18:11:00 dovecot_login authenticator failed for ([65.20.250.63]) [65.20.250.63]:52942: 535 Incorrect authentication data (set_id=vikas.khandelwal)65.20.250.6399237 g + T p w 9Kg`w  -O% ossec13001gExim Auth failed2025-03-13 20:04:20 dovecot_plain authenticator failed for 111-70-0-112.emome-ip.hinet.net [111.70.0.112]:46292: 535 Incorrect authentication data (set_id=sales)111.70.0.1121668284jv  -_) ossec13001gExim Auth failed2025-03-13 20:04:03 dovecot_plain authenticator failed for ([121.168.210.98]) [121.168.210.98]:52758: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)121.168.210.981835841Wu  -;' ossec13001gExim Auth failed2025-03-13 20:00:25 dovecot_plain authenticator failed for ([1.227.228.136]) [1.227.228.136]:54000: 535 Incorrect authentication data (set_id=services)1.227.228.1361835841gt  -]% ossec13001gExim Auth failed2025-03-13 20:00:14 dovecot_plain authenticator failed for ([27.71.20.180]) [27.71.20.180]:44202: 535 Incorrect authentication data (set_id=services@heipowersystem.com)27.71.20.1801562822$s  3O' ossec11301g New FTP connection.Mar 13 19:52:02 vm1 pure-ftpd[591686]: (?@206.168.34.62) [INFO] New connection from 206.168.34.62206.168.34.626252001r  W) ossec9708g_Dovecot Aborted Login with empty userMar 13 19:49:09 vm1 dovecot[385861]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 7 secs): user=<>, rip=185.247.137.94, lip=103.74.54.108, TLS, session=<+L1XATowL4a594le>185.247.137.94298795sq  -s) ossec13001gExim Auth failed2025-03-13 19:42:58 dovecot_plain authenticator failed for (178-252-26-235.netianet.net.pl) [178.252.26.235]:38238: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)178.252.26.235798544|p  -+ ossec13001gExim Auth failed2025-03-13 19:42:41 dovecot_plain authenticator failed for ([223.241.214.127]) [223.241.214.127]:45621: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)223.241.214.1271814991jo  -a' ossec13001gExim Auth failed2025-03-13 19:41:34 dovecot_plain authenticator failed for broadband-95-84-158-215.ip.moscow.rt.ru [95.84.158.215]:53514: 535 Incorrect authentication data (set_id=sales)95.84.158.2152017370cn  -W% ossec13001gExim Auth failed2025-03-13 19:41:23 dovecot_plain authenticator failed for ([78.186.54.65]) [78.186.54.65]:37584: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)78.186.54.65298795_m  -K' ossec13001gExim Auth failed2025-03-13 19:32:53 dovecot_login authenticator failed for ([117.36.158.76]) [117.36.158.76]:22431: 535 Incorrect authentication data (set_id=vikas.khandelwal)117.36.158.761814991ul  -s+ ossec13001grExim Auth failed2025-03-13 19:32:25 dovecot_login authenticator failed for ([187.218.57.50]) [216.234.205.244]:7114: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)216.234.205.2443996063`k  -O% ossec13001gQExim Auth failed2025-03-13 19:19:04 dovecot_login authenticator failed for (nyaystambh.com) [125.72.54.81]:49300: 535 Incorrect authentication data (set_id=sales@nyaystambh.com)125.72.54.811814991Sj  -5% ossec13001gExim Auth failed2025-03-13 19:18:08 dovecot_login authenticator failed for (nyaystambh.com) [125.72.54.81]:44050: 535 Incorrect authentication data (set_id=nologin)125.72.54.811814991ii  -[+ ossec13001gExim Auth failed2025-03-13 19:13:14 dovecot_login authenticator failed for ([175.206.105.126]) [175.206.105.126]:50568: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)175.206.105.1261835841yh  -}) ossec13001gExim Auth failed2025-03-13 19:13:03 dovecot_login authenticator failed for ([221.167.21.148]) [221.167.21.148]:35338: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)221.167.21.1481835841gg  -Y) ossec13001gExim Auth failed2025-03-13 19:04:00 dovecot_login authenticator failed for 198-91-194-206.cpe.distributel.net [198.91.194.206]:47218: 535 Incorrect authentication data (set_id=sales)198.91.194.2066251999  % 8 + P _1*  3W+ ossec11301gNew FTP connection.Mar 13 21:30:27 vm1 pure-ftpd[612206]: (?@147.185.132.177) [INFO] New connection from 147.185.132.177147.185.132.1776252001_  -K' ossec13001gExim Auth failed2025-03-13 21:25:39 dovecot_login authenticator failed for (089-101-036159.ntlworld.ie) [89.101.36.159]:41804: 535 Incorrect authentication data (set_id=sales)89.101.36.1592963597g  -[' ossec13001gExim Auth failed2025-03-13 21:25:29 dovecot_login authenticator failed for ([46.29.121.110]) [46.29.121.110]:36682: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)46.29.121.1103017382S  -5' ossec13001gExim Auth failed2025-03-13 21:23:57 dovecot_login authenticator failed for ([91.75.105.190]) [91.75.105.190]:45453: 535 Incorrect authentication data (set_id=sales)91.75.105.190290557d  -W% ossec13001gExim Auth failed2025-03-13 21:23:36 dovecot_login authenticator failed for ([110.7.52.183]) [110.7.52.183]:38526: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)110.7.52.1831814991s  -s' ossec13001gExim Auth failed2025-03-13 21:20:13 dovecot_login authenticator failed for (static-14.38.103.extranet.co.in) [59.94.179.175]:50258: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)59.94.179.1751269750t  -w% ossec13001gExim Auth failed2025-03-13 21:20:02 dovecot_login authenticator failed for ([36.32.223.199]) [36.33.125.36]:29648: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)36.33.125.361814991T  -5' ossec13001gExim Auth failed2025-03-13 21:07:55 dovecot_plain authenticator failed for ([210.245.95.11]) [210.245.95.11]:46174: 535 Incorrect authentication data (set_id=sales)210.245.95.111562822|  -) ossec13001gExim Auth failed2025-03-13 21:07:38 dovecot_plain authenticator failed for syn-035-130-111-146.biz.spectrum.com [35.130.111.146]:58173: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)35.130.111.1466252001V  -;' ossec13001g$Exim Auth failed2025-03-13 21:04:58 dovecot_plain authenticator failed for ([105.16.161.35]) [105.16.161.35]:48148: 535 Incorrect authentication data (set_id=services)105.16.161.35953987m~  -e) ossec13001gExim Auth failed2025-03-13 21:04:36 dovecot_plain authenticator failed for ([103.156.208.70]) [103.156.208.66]:33878: 535 Incorrect authentication data (set_id=services@heipowersystem.com)103.156.208.661269750W}  -;' ossec13001gmExim Auth failed2025-03-13 20:57:41 dovecot_login authenticator failed for ([61.184.26.197]) [61.184.26.197]:47124: 535 Incorrect authentication data (set_id=services)61.184.26.1971814991 |  -) ossec13001gaExim Auth failed2025-03-13 20:57:29 dovecot_login authenticator failed for (host-115-208-static-98-201.uninet-ide.com.mx) [201.98.208.115]:42569: 535 Incorrect authentication data (set_id=services@heipowersystem.com)201.98.208.1153996063i{  -[+ ossec13001gSExim Auth failed2025-03-13 20:52:58 dovecot_plain authenticator failed for ([124.114.149.106]) [124.114.149.106]:59352: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)124.114.149.1061814991oz  -q# ossec13001gAExim Auth failed2025-03-13 20:52:40 dovecot_plain authenticator failed for ([2.55.89.171]) [2.55.89.171]:36596: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)2.55.89.171294640dy  -Y# ossec13001g1Exim Auth failed2025-03-13 20:52:23 dovecot_plain authenticator failed for 18.red-83-48-39.staticip.rima-tde.net [83.48.39.18]:46871: 535 Incorrect authentication data (set_id=sales)83.48.39.182510769|x  -+ ossec13001gExim Auth failed2025-03-13 20:51:51 dovecot_plain authenticator failed for (190-205-112-156.static.cantv.net) [190.205.112.156]:36977: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)190.205.112.1563625428 ! ! F I b ;AWl$  3O' ossec11301gNew FTP connection.Mar 13 23:16:19 vm1 pure-ftpd[633729]: (?@20.171.29.218) [INFO] New connection from 20.171.29.21820.171.29.2186252001W  -9) ossec13001gExim Auth failed2025-03-13 23:14:56 dovecot_plain authenticator failed for ([161.35.200.202]) [161.35.200.202]:34518: 535 Incorrect authentication data (set_id=sales)161.35.200.2022921044j  -_) ossec13001gExim Auth failed2025-03-13 23:14:47 dovecot_plain authenticator failed for ([116.114.84.246]) [116.114.84.246]:45662: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)116.114.84.2461814991e  -W) ossec13001gExim Auth failed2025-03-13 23:12:13 dovecot_plain authenticator failed for 80-186-144-129.elisa-mobile.fi [80.186.144.129]:60797: 535 Incorrect authentication data (set_id=services)80.186.144.129660013g  -]% ossec13001gExim Auth failed2025-03-13 23:11:56 dovecot_plain authenticator failed for ([113.192.1.27]) [113.192.1.26]:52389: 535 Incorrect authentication data (set_id=services@heipowersystem.com)113.192.1.261643084f  -W) ossec13001gExim Auth failed2025-03-13 23:00:00 dovecot_plain authenticator failed for ([112.46.138.214]) [112.46.138.214]:52638: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)112.46.138.2141814991v  -y' ossec13001g Exim Auth failed2025-03-13 22:59:48 dovecot_plain authenticator failed for ([154.127.43.66]) [154.127.43.66]:37037: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)154.127.43.662395170Q  -1% ossec13001gExim Auth failed2025-03-13 22:59:17 dovecot_plain authenticator failed for ([110.35.63.30]) [110.35.63.30]:38186: 535 Incorrect authentication data (set_id=sales)110.35.63.301835841j  -_) ossec13001gExim Auth failed2025-03-13 22:58:51 dovecot_plain authenticator failed for ([182.135.66.179]) [182.135.66.179]:53266: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)182.135.66.17918149917  Ag' ossec11302g FTP Authentication failed.Mar 13 22:16:36 vm1 pure-ftpd[621711]: (?@152.32.141.86) [WARNING] Authentication failed for user [anonymous]152.32.141.862328926% 3O' ossec11301g New FTP connection.Mar 13 22:16:26 vm1 pure-ftpd[621704]: (?@152.32.141.86) [INFO] New connection from 152.32.141.86152.32.141.862328926c  -S' ossec13001g Exim Auth failed2025-03-13 22:15:12 dovecot_plain authenticator failed for ([85.15.190.172]) [85.15.190.172]:60642: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)85.15.190.1722017370y  -}) ossec13001g Exim Auth failed2025-03-13 22:14:55 dovecot_plain authenticator failed for ([115.244.25.190]) [103.156.208.66]:58824: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)103.156.208.661269750W  -9) ossec13001g Exim Auth failed2025-03-13 22:08:47 dovecot_plain authenticator failed for ([74.196.184.120]) [74.196.184.120]:40353: 535 Incorrect authentication data (set_id=sales)74.196.184.1206252001|  -) ossec13001g Exim Auth failed2025-03-13 22:08:35 dovecot_plain authenticator failed for c-69-242-149-240.hsd1.mo.comcast.net [69.242.149.240]:55646: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)69.242.149.2406252001b  -O) ossec13001gOExim Auth failed2025-03-13 21:31:18 dovecot_plain authenticator failed for ([116.198.37.128]) [116.198.37.128]:47188: 535 Incorrect authentication data (set_id=vikas.khandelwal)116.198.37.1281814991u  -u) ossec13001g9Exim Auth failed2025-03-13 21:30:57 dovecot_plain authenticator failed for ([222.174.184.86]) [222.174.184.86]:49420: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)222.174.184.861814991 " 7 R m u{>VjV*  -9) ossec13001g7Exim Auth failed2025-03-14 01:22:31 dovecot_plain authenticator failed for ([88.250.162.175]) [88.250.162.175]:33321: 535 Incorrect authentication data (set_id=sales)88.250.162.175298795m)  -c+ ossec13001g7tExim Auth failed2025-03-14 01:22:20 dovecot_plain authenticator failed for ([177.174.105.113]) [177.174.105.113]:37438: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)177.174.105.1133469034Z(  -?) ossec13001g/Exim Auth failed2025-03-14 00:48:58 dovecot_login authenticator failed for ([36.110.161.134]) [36.110.161.134]:53380: 535 Incorrect authentication data (set_id=services)36.110.161.1341814991h'  -a' ossec13001g/Exim Auth failed2025-03-14 00:48:45 dovecot_login authenticator failed for ([65.20.168.206]) [65.20.168.206]:36057: 535 Incorrect authentication data (set_id=services@heipowersystem.com)65.20.168.20699237d& -Q) ossec13001g'FExim Auth failed2025-03-14 00:13:16 dovecot_login authenticator failed for (xzd3sdKAO) [207.254.40.146]:51745: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)207.254.40.1466252001U% -5' ossec13001g%Exim Auth failed2025-03-14 00:07:49 dovecot_login authenticator failed for (rokamauka.com) [58.240.171.59]:38478: 535 Incorrect authentication data (set_id=nologin)58.240.171.591814991$  ?/ ossec1008g%Process exiting (killed).Mar 14 00:07:10 vm1 spamd[387810]: spamd: server killed by SIGTERM, shutting downz#  -) ossec13001g#@Exim Auth failed2025-03-13 23:56:06 dovecot_plain authenticator failed for (207.122.87.116.starhub.net.sg) [116.87.122.207]:42558: 535 Incorrect authentication data (set_id=services@heipowersystem.com)116.87.122.2071880251Y"  -=) ossec13001g#LExim Auth failed2025-03-13 23:56:18 dovecot_plain authenticator failed for ([159.196.221.74]) [159.196.221.74]:1584: 535 Incorrect authentication data (set_id=services)159.196.221.742077456v!  -y' ossec13001g![Exim Auth failed2025-03-13 23:48:03 dovecot_plain authenticator failed for syn-156-019-080-138.biz.spectrum.com [156.19.80.138]:50684: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)156.19.80.1386252001  -!% ossec13001g!SExim Auth failed2025-03-13 23:47:54 dovecot_plain authenticator failed for host-46-50-205-61.bbcustomer.zsttk.net [46.50.205.61]:18024: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)46.50.205.612017370g  -Y) ossec13001g!7Exim Auth failed2025-03-13 23:47:27 dovecot_plain authenticator failed for (166.80.156.175.unknown.m1.com.sg) [175.156.80.166]:45450: 535 Incorrect authentication data (set_id=sales)175.156.80.1661880251a  -S# ossec13001g!-Exim Auth failed2025-03-13 23:47:16 dovecot_plain authenticator failed for ([14.54.22.11]) [14.54.22.11]:55202: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)14.54.22.111835841a  -S% ossec13001g! Exim Auth failed2025-03-13 23:46:43 dovecot_plain authenticator failed for static-193-217-1-27.cust.tele2.lt [193.217.1.27]:37160: 535 Incorrect authentication data (set_id=sales)193.217.1.27597427g  -[' ossec13001g Exim Auth failed2025-03-13 23:46:19 dovecot_plain authenticator failed for ([218.28.98.161]) [218.28.98.161]:14914: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)218.28.98.1611814991i  -_' ossec13001gExim Auth failed2025-03-13 23:28:00 dovecot_plain authenticator failed for c-73-45-216-101.hsd1.il.comcast.net [73.45.216.101]:60401: 535 Incorrect authentication data (set_id=services)73.45.216.1016252001m  -e) ossec13001gExim Auth failed2025-03-13 23:27:49 dovecot_plain authenticator failed for ([123.209.200.21]) [123.209.200.21]:41428: 535 Incorrect authentication data (set_id=services@heipowersystem.com)123.209.200.212077456   / D m 1_rud;  -U) ossec13001gFHExim Auth failed2025-03-14 02:25:34 dovecot_login authenticator failed for (178-165-63-216-kh.maxnet.ua) [178.165.63.216]:58868: 535 Incorrect authentication data (set_id=services)178.165.63.216690791m:  -e) ossec13001gF>Exim Auth failed2025-03-14 02:25:24 dovecot_login authenticator failed for ([222.186.68.153]) [222.186.68.153]:55001: 535 Incorrect authentication data (set_id=services@heipowersystem.com)222.186.68.1531814991y9  -}) ossec13001gDExim Auth failed2025-03-14 02:19:20 dovecot_login authenticator failed for 83-233-242-245.cust.bredband2.com [83.233.242.245]:53396: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)83.233.242.2452661886i8  -_) ossec13001gDExim Auth failed2025-03-14 02:19:12 dovecot_login authenticator failed for ([81.215.211.182]) [81.215.211.182]:57148: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)81.215.211.182298795N7  --# ossec13001gDExim Auth failed2025-03-14 02:19:06 dovecot_login authenticator failed for ([27.71.26.64]) [27.71.26.64]:19477: 535 Incorrect authentication data (set_id=sales)27.71.26.641562822g6  -[' ossec13001gDExim Auth failed2025-03-14 02:18:48 dovecot_login authenticator failed for ([114.242.61.19]) [114.242.61.35]:48102: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)114.242.61.351814991Q5  -1% ossec13001gDExim Auth failed2025-03-14 02:18:32 dovecot_login authenticator failed for ([102.53.15.56]) [102.53.15.56]:48267: 535 Incorrect authentication data (set_id=sales)102.53.15.562542007z4  -! ossec13001gDExim Auth failed2025-03-14 02:18:25 dovecot_login authenticator failed for 96-1-34-28-staticipeast.wireless.telus.com [96.1.34.28]:52573: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)96.1.34.286251999q3  -o' ossec13001gDExim Auth failed2025-03-14 02:18:23 dovecot_login authenticator failed for (49.206.244.235.actcorp.in) [49.206.241.22]:16612: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)49.206.241.221269750$2  3O' ossec11301gANew FTP connection.Mar 14 02:03:21 vm1 pure-ftpd[673339]: (?@20.169.106.61) [INFO] New connection from 20.169.106.6120.169.106.616252001]1 -E' ossec13001g9Exim Auth failed2025-03-14 01:33:05 dovecot_login authenticator failed for (s2seducationtrust.com) [111.207.12.99]:48968: 535 Incorrect authentication data (set_id=nologin)111.207.12.991814991S0  -7% ossec13001g9Exim Auth failed2025-03-14 01:31:35 dovecot_plain authenticator failed for ([196.0.34.106]) [196.0.34.106]:41421: 535 Incorrect authentication data (set_id=services)196.0.34.106226074g/  -]% ossec13001g9vExim Auth failed2025-03-14 01:30:54 dovecot_plain authenticator failed for ([5.59.141.152]) [5.59.141.152]:56730: 535 Incorrect authentication data (set_id=services@heipowersystem.com)5.59.141.1522017370b.  -O) ossec13001g8BExim Auth failed2025-03-14 01:25:46 dovecot_login authenticator failed for ([60.171.237.143]) [60.171.237.143]:43308: 535 Incorrect authentication data (set_id=vikas.khandelwal)60.171.237.1431814991~-  - # ossec13001g82Exim Auth failed2025-03-14 01:25:29 dovecot_login authenticator failed for c-24-7-216-47.hsd1.mn.comcast.net [24.7.216.47]:62224: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)24.7.216.476252001i,  -[+ ossec13001g7Exim Auth failed2025-03-14 01:23:09 dovecot_plain authenticator failed for ([211.247.127.250]) [211.247.127.250]:33621: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)211.247.127.2501835841x+  -}) ossec13001g7Exim Auth failed2025-03-14 01:22:52 dovecot_plain authenticator failed for ([94.201.236.143]) [94.201.236.143]:52823: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)94.201.236.143290557   (AE_nK  -k% ossec13001gS}Exim Auth failed2025-03-14 03:21:57 dovecot_login authenticator failed for (vandanabalbharti.com) [119.96.131.8]:53540: 535 Incorrect authentication data (set_id=contact@vandanabalbharti.com)119.96.131.81814991YJ  -A% ossec13001gSeExim Auth failed2025-03-14 03:21:33 dovecot_login authenticator failed for (vandanabalbharti.com) [119.96.131.8]:49710: 535 Incorrect authentication data (set_id=nologin)119.96.131.81814991rI  -o) ossec13001gS7Exim Auth failed2025-03-14 03:20:46 dovecot_plain authenticator failed for ool-4579c7cb.dyn.optonline.net [69.121.199.203]:60026: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)69.121.199.2036252001H  -') ossec13001gSExim Auth failed2025-03-14 03:20:09 dovecot_plain authenticator failed for (mobile-166-195-197-027.mycingular.net) [166.195.197.27]:48460: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)166.195.197.276252001aG  -S# ossec13001gQExim Auth failed2025-03-14 03:13:42 dovecot_plain authenticator failed for ([59.96.62.29]) [59.96.62.29]:35300: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)59.96.62.291269750'F  3S) ossec11301gOxNew FTP connection.Mar 14 03:04:47 vm1 pure-ftpd[685934]: (?@147.45.112.183) [INFO] New connection from 147.45.112.183147.45.112.1832134431bE  -O) ossec13001gMpExim Auth failed2025-03-14 02:56:06 dovecot_login authenticator failed for ([175.202.82.251]) [175.202.82.251]:55944: 535 Incorrect authentication data (set_id=vikas.khandelwal)175.202.82.2511835841xD  -% ossec13001gM\Exim Auth failed2025-03-14 02:55:46 dovecot_login authenticator failed for (hebei.6.60.in-addr.arpa) [60.6.212.150]:39808: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)60.6.212.1501814991cC  -U' ossec13001gJExim Auth failed2025-03-14 02:44:03 dovecot_login authenticator failed for host-176-36-49-230.b024.la.net.ua [176.36.49.230]:59694: 535 Incorrect authentication data (set_id=sales)176.36.49.230690791iB  -]) ossec13001gJExim Auth failed2025-03-14 02:43:48 dovecot_login authenticator failed for ([222.173.82.198]) [222.173.82.198]:9576: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)222.173.82.1981814991qA  -q' ossec13001gHExim Auth failed2025-03-14 02:36:37 dovecot_plain authenticator failed for ([94.204.100.40]) [94.204.100.40]:54862: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)94.204.100.40290557e@  -S+ ossec13001gHExim Auth failed2025-03-14 02:36:46 dovecot_plain authenticator failed for ([175.156.139.195]) [175.156.139.195]:34049: 535 Incorrect authentication data (set_id=vikas.khandelwal)175.156.139.1951880251y?  -}) ossec13001gFExim Auth failed2025-03-14 02:28:22 dovecot_login authenticator failed for ([218.150.170.10]) [218.150.170.10]:50490: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)218.150.170.101835841x>  -{) ossec13001gFExim Auth failed2025-03-14 02:28:33 dovecot_login authenticator failed for c-69-242-149-240.hsd1.mo.comcast.net [69.242.149.240]:44030: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)69.242.149.2406252001r=  -s% ossec13001gFExim Auth failed2025-03-14 02:27:27 dovecot_login authenticator failed for 78-67-176-43-no2814.tbcn.telia.com [78.67.176.43]:50032: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)78.67.176.432661886<  -?) ossec13001gFExim Auth failed2025-03-14 02:27:18 dovecot_login authenticator failed for (abts-mum-static-127.120.70.182.airtelbroadband.in) [182.70.120.127]:43518: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)182.70.120.1271269750 " . V [ p ev[  -y' ossec13001gә?Exim Auth failed2025-03-14 08:19:33 dovecot_plain authenticator failed for 111-70-41-164.emome-ip.hinet.net [111.70.41.164]:33254: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)111.70.41.1641668284ZZ  -=+ ossec13001gӘ>Exim Auth failed2025-03-14 08:15:17 dovecot_login authenticator failed for ([117.247.239.202]) [122.160.142.194]:46798: 535 Incorrect authentication data (set_id=sales)122.160.142.1941269750nY  -g) ossec13001gӘ0Exim Auth failed2025-03-14 08:15:04 dovecot_login authenticator failed for (214-017.rosintel.net) [178.252.214.17]:55792: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)178.252.214.172017370UX -5' ossec13001gӓExim Auth failed2025-03-14 07:52:56 dovecot_login authenticator failed for (rokamauka.com) [111.61.229.78]:26772: 535 Incorrect authentication data (set_id=nologin)111.61.229.781814991lW  -c) ossec13001gӐExim Auth failed2025-03-14 07:42:16 dovecot_plain authenticator failed for 155-61-202-109.kamensktel.ru [109.202.61.155]:52047: 535 Incorrect authentication data (set_id=vikas.khandelwal)109.202.61.1552017370uV  -u) ossec13001gӐwExim Auth failed2025-03-14 07:42:05 dovecot_plain authenticator failed for ([119.206.34.142]) [119.206.34.142]:39436: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)119.206.34.1421835841WU -7) ossec13001gӋExim Auth failed2025-03-14 07:20:55 dovecot_login authenticator failed for (rokamauka.com) [42.193.105.109]:33190: 535 Incorrect authentication data (set_id=nologin)42.193.105.1091814991AT  =}) ossec13008gӀ6Mail Reciepient rejected2025-03-14 06:32:46 H=(mail.vandanabalbharti.com) [165.154.233.80]:64243 F= rejected RCPT : Rejected relay attempt: '165.154.233.80' From: 'uzgswla@vandanabalbharti.com' To: 'goofile@fastmail.com'165.154.233.801694008jS  -_) ossec13001ghFExim Auth failed2025-03-14 04:50:38 dovecot_plain authenticator failed for ([212.220.113.55]) [212.220.113.55]:58790: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)212.220.113.552017370TR  -5' ossec13001ge5Exim Auth failed2025-03-14 04:37:32 dovecot_login authenticator failed for ([124.228.32.34]) [124.228.32.34]:46823: 535 Incorrect authentication data (set_id=sales)124.228.32.341814991gQ  -[' ossec13001ge)Exim Auth failed2025-03-14 04:37:21 dovecot_login authenticator failed for ([61.184.119.61]) [61.184.119.61]:47452: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)61.184.119.611814991wP  -w+ ossec13001geExim Auth failed2025-03-14 04:37:10 dovecot_login authenticator failed for p55202-obmd01.osaka.ocn.ne.jp [153.141.242.202]:37752: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)153.141.242.2021861060TO  -7% ossec13001gdExim Auth failed2025-03-14 04:32:26 dovecot_plain authenticator failed for ([103.4.103.61]) [103.4.103.61]:48324: 535 Incorrect authentication data (set_id=services)103.4.103.611168579pN  -i+ ossec13001gcExim Auth failed2025-03-14 04:32:04 dovecot_plain authenticator failed for ([103.120.116.162]) [103.120.116.162]:47971: 535 Incorrect authentication data (set_id=services@heipowersystem.com)103.120.116.1621168579`M  -Q# ossec13001g_Exim Auth failed2025-03-14 04:11:07 dovecot_login authenticator failed for 111-70-10-3.emome-ip.hinet.net [111.70.10.3]:58623: 535 Incorrect authentication data (set_id=services)111.70.10.31668284vL  -y' ossec13001g^Exim Auth failed2025-03-14 04:10:58 dovecot_login authenticator failed for (160.72.153.14.lightower.net) [160.72.153.14]:38048: 535 Incorrect authentication data (set_id=services@heipowersystem.com)160.72.153.146252001  a \WVy u n PLHF= 6 iT'13.76.211.219BLACKgg؁Blacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests1880251 Llocal~R%20.122.56.22BLACKgOg Blacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests6252001z8localG)128.24.102.210BLACKg{gt{Blacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests6252001flocalF'130.33.62.103BLACKgZgoZBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests1861060!>glocalE%130.33.66.85BLACKg\Og-OBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests1861060!BUlocal}D#20.41.23.59BLACKgg߃Blacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests6252001);localC'52.186.29.184BLACKggַBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests62520014localB)52.170.144.155BLACKgmgִmBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests62520014local}>#20.1.140.54BLACKgΖg֟Blacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests62520016local='52.169.93.189BLACKgg֏Blacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests29635974]local<'48.218.144.17BLACKg㼔g֍Blacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests18610600ڐlocal;'104.41.153.63BLACKggyBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests6252001h)?local:)40.117.181.238BLACKggdBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests6252001(ulocal~-%40.69.40.187BLACKgog@Blacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests2963597(E(local~+%52.164.121.3BLACKgmg>Blacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests29635974ylocal*)52.178.183.174BLACKgTg%Blacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests29635974local})#40.69.41.14BLACKgOg Blacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests2963597(E)local('193.41.206.72BLACKg >g>Blacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests3017382)Hlocal''52.169.181.27BLACKggϊBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests29635974localN)172.176.156.15BLACKgg׻Blacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests6252001localS)135.181.180.59BLACKgugFBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests660013;local}5#13.79.59.64BLACKgz gK Blacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests2963597 O;@local4'64.23.187.111BLACKgZg+Blacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests6252001@olocal3'195.231.75.49BLACKggzBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests3175395K1local2'13.74.145.175BLACKgygmyBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests2963597 Jlocal1'52.169.180.88BLACKg^g^Blacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests29635974Xlocal0'52.164.229.60BLACKggBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests29635974<local/)52.138.194.104BLACKggӻBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests29635974hlocal~.%13.79.58.192BLACKggӌBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests2963597 O:local % 6  < "5DTsZk  -K ossec13001gӻ'Exim Auth failed2025-03-14 10:44:14 dovecot_login authenticator failed for ([5.32.61.6]) [5.32.61.6]:48834: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)5.32.61.6290557_j -G) ossec13001gӹMExim Auth failed2025-03-14 10:36:20 dovecot_login authenticator failed for (s2seducationtrust.com) [42.193.105.109]:39728: 535 Incorrect authentication data (set_id=nologin)42.193.105.1091814991]i  -G' ossec13001gӰExim Auth failed2025-03-14 09:56:58 dovecot_plain authenticator failed for (106.51.70.231.actcorp.in) [106.51.70.231]:53902: 535 Incorrect authentication data (set_id=sales)106.51.70.2311269750lh  -c+ ossec13001gӰExim Auth failed2025-03-14 09:56:42 dovecot_plain authenticator failed for ([154.205.146.118]) [154.205.146.118]:33158: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)154.205.146.118290291mg  -m! ossec13001gӬExim Auth failed2025-03-14 09:40:04 dovecot_login authenticator failed for ([182.54.3.2]) [182.54.3.2]:56435: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)182.54.3.21814991if  -[+ ossec13001gӬ(Exim Auth failed2025-03-14 09:40:15 dovecot_login authenticator failed for ([222.236.155.146]) [222.236.155.146]:40049: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)222.236.155.1461835841je  -a' ossec13001gӫExim Auth failed2025-03-14 09:38:43 dovecot_plain authenticator failed for ([120.138.5.219]) [120.138.5.219]:47828: 535 Incorrect authentication data (set_id=services@heipowersystem.com)120.138.5.2191269750Td  -5' ossec13001gӪExim Auth failed2025-03-14 09:31:18 dovecot_login authenticator failed for ([124.228.32.34]) [124.228.32.34]:53434: 535 Incorrect authentication data (set_id=sales)124.228.32.341814991gc  -[' ossec13001gӪExim Auth failed2025-03-14 09:31:07 dovecot_login authenticator failed for ([12.150.243.20]) [12.150.243.18]:38397: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)12.150.243.186252001b  W) ossec9708gӦ0Dovecot Aborted Login with empty userMar 14 09:14:47 vm1 dovecot[385861]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=87.236.176.106, lip=103.74.54.108, TLS, session=87.236.176.1062635167Ca  =+ ossec13008gӣMail Reciepient rejected2025-03-14 09:03:41 H=(mail.fablixsolutions.com) [165.154.208.196]:51367 F= rejected RCPT : Rejected relay attempt: '165.154.208.196' From: 'orxsixyy@fablixsolutions.com' To: 'goofile@fastmail.com'165.154.208.1961668284]`  -K' ossec13001gӝExim Auth failed2025-03-14 08:38:08 dovecot_login authenticator failed for ([65.20.173.139]) [65.20.173.139]:40560: 535 Incorrect authentication data (set_id=vikas.khandelwal)65.20.173.13999237_  -5) ossec13001gӝExim Auth failed2025-03-14 08:37:59 dovecot_login authenticator failed for (ip-103-133.222-205.cloudteknologinusantara.co.id) [125.164.44.248]:52712: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)125.164.44.2481643084k^  -e' ossec13001gӚExim Auth failed2025-03-14 08:26:13 dovecot_plain authenticator failed for (185-189-123-105.laser.ir) [37.235.18.145]:37964: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)37.235.18.145130758v]  -y' ossec13001gӚExim Auth failed2025-03-14 08:25:44 dovecot_plain authenticator failed for ([102.31.152.59]) [102.31.152.59]:58120: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)102.31.152.592464461]\  -K# ossec13001gәMExim Auth failed2025-03-14 08:19:47 dovecot_plain authenticator failed for 37.151.71.8.dynamic.telecom.kz [37.151.71.8]:53638: 535 Incorrect authentication data (set_id=sales)37.151.71.81522867 a@ K Y DHac|  -O+ ossec13001g͎Exim Auth failed2025-03-14 12:02:45 dovecot_login authenticator failed for ([187.218.57.50]) [216.234.205.244]:36308: 535 Incorrect authentication data (set_id=vikas.khandelwal)216.234.205.2443996063x{  -y+ ossec13001gvExim Auth failed2025-03-14 12:02:21 dovecot_login authenticator failed for ([123.209.117.171]) [123.209.117.171]:46744: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)123.209.117.1712077456Wz  -9) ossec13001gExim Auth failed2025-03-14 11:51:14 dovecot_login authenticator failed for ([178.178.222.50]) [178.178.222.50]:37516: 535 Incorrect authentication data (set_id=sales)178.178.222.502017370vy  -y' ossec13001gExim Auth failed2025-03-14 11:51:05 dovecot_login authenticator failed for (82-208-99-163.static.mts-nn.ru) [82.208.99.163]:55864: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)82.208.99.1632017370Wx  -;' ossec13001gĦExim Auth failed2025-03-14 11:24:46 dovecot_login authenticator failed for ([194.26.226.55]) [194.26.226.55]:55442: 535 Incorrect authentication data (set_id=services)194.26.226.552017370w  - ) ossec13001gĞExim Auth failed2025-03-14 11:24:37 dovecot_login authenticator failed for syn-035-130-133-206.biz.spectrum.com [35.130.133.206]:33938: 535 Incorrect authentication data (set_id=services@heipowersystem.com)35.130.133.2066252001bv  -O) ossec13001gExim Auth failed2025-03-14 11:21:27 dovecot_login authenticator failed for ([14.139.107.146]) [14.139.107.146]:34418: 535 Incorrect authentication data (set_id=vikas.khandelwal)14.139.107.1461269750su  -s' ossec13001gExim Auth failed2025-03-14 11:21:16 dovecot_login authenticator failed for ([218.106.120.18]) [58.49.113.138]:16964: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)58.49.113.1381814991kt  -c' ossec13001gExim Auth failed2025-03-14 11:17:01 dovecot_login authenticator failed for (heipowersystem.com) [111.207.12.99]:40322: 535 Incorrect authentication data (set_id=office@heipowersystem.com)111.207.12.991814991Ys  -?' ossec13001g»Exim Auth failed2025-03-14 11:16:35 dovecot_login authenticator failed for (heipowersystem.com) [111.207.12.99]:36532: 535 Incorrect authentication data (set_id=nologin)111.207.12.991814991ir  -c# ossec13001gӽ~Exim Auth failed2025-03-14 10:54:13 dovecot_login authenticator failed for 100.7.61.94.rev.vodafone.pt [94.61.7.100]:55272: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)94.61.7.1002264397sq  -u% ossec13001gӽlExim Auth failed2025-03-14 10:53:56 dovecot_login authenticator failed for ([61.81.151.97]) [61.81.151.97]:57052: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)61.81.151.971835841Qp  -3# ossec13001gӼExim Auth failed2025-03-14 10:51:14 dovecot_login authenticator failed for ([59.0.60.158]) [59.0.60.158]:60444: 535 Incorrect authentication data (set_id=services)59.0.60.1581835841no  -i+ ossec13001gӼExim Auth failed2025-03-14 10:51:00 dovecot_login authenticator failed for ([192.145.171.159]) [192.145.171.159]:48244: 535 Incorrect authentication data (set_id=services@heipowersystem.com)192.145.171.15951537qn  -q% ossec13001gӻExim Auth failed2025-03-14 10:44:06 dovecot_login authenticator failed for bb121-7-26-195.singnet.com.sg [121.7.26.195]:55374: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)121.7.26.1951880251Wm  -9) ossec13001gӻ9Exim Auth failed2025-03-14 10:44:32 dovecot_login authenticator failed for ([119.202.250.32]) [119.202.250.32]:36806: 535 Incorrect authentication data (set_id=sales)119.202.250.321835841al  -O' ossec13001gӻ)Exim Auth failed2025-03-14 10:44:17 dovecot_login authenticator failed for p7001160-ipoefx.ipoe.ocn.ne.jp [118.3.227.159]:36578: 535 Incorrect authentication data (set_id=sales)118.3.227.1591861060 t" G W W =PtX -9) ossec13001gSExim Auth failed2025-03-14 15:05:15 dovecot_login authenticator failed for (nyaystambh.com) [101.89.140.209]:45282: 535 Incorrect authentication data (set_id=nologin)101.89.140.2091814991i  -_) ossec13001gExim Auth failed2025-03-14 15:03:07 dovecot_plain authenticator failed for ([196.189.126.10]) [196.189.126.10]:41890: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)196.189.126.10337996O  -1% ossec13001gExim Auth failed2025-03-14 15:03:27 dovecot_plain authenticator failed for ([65.20.191.97]) [65.20.191.97]:54922: 535 Incorrect authentication data (set_id=sales)65.20.191.9799237\  -G% ossec13001g7Exim Auth failed2025-03-14 14:51:58 dovecot_login authenticator failed for ([58.18.90.250]) [58.18.90.250]:52632: 535 Incorrect authentication data (set_id=vikas.khandelwal)58.18.90.2501814991o  -m% ossec13001g+Exim Auth failed2025-03-14 14:51:46 dovecot_login authenticator failed for ([203.252.10.4]) [203.252.10.4]:51085: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)203.252.10.41835841Z  -?) ossec13001gExim Auth failed2025-03-14 14:45:07 dovecot_plain authenticator failed for ([182.160.107.51]) [182.160.107.51]:55256: 535 Incorrect authentication data (set_id=services)182.160.107.511210997m  -e) ossec13001gExim Auth failed2025-03-14 14:44:44 dovecot_plain authenticator failed for ([193.234.119.69]) [193.234.119.69]:59100: 535 Incorrect authentication data (set_id=services@heipowersystem.com)193.234.119.692661886q  -m) ossec13001gBExim Auth failed2025-03-14 13:35:21 dovecot_login authenticator failed for (142.92.214.139.adsl-pool.jlccptt.net.cn) [139.214.92.142]:51473: 535 Incorrect authentication data (set_id=services)139.214.92.1421814991f  -]% ossec13001g.Exim Auth failed2025-03-14 13:35:02 dovecot_login authenticator failed for ([95.173.2.140]) [95.173.2.140]:36030: 535 Incorrect authentication data (set_id=services@heipowersystem.com)95.173.2.140298795v  -w) ossec13001gExim Auth failed2025-03-14 13:32:48 dovecot_plain authenticator failed for (94.124.156.175.unknown.m1.com.sg) [175.156.124.94]:44515: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)175.156.124.941880251s  -u% ossec13001gExim Auth failed2025-03-14 13:32:24 dovecot_plain authenticator failed for ([77.41.156.64]) [77.41.156.64]:58698: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)77.41.156.642017370Q  -1% ossec13001g)Exim Auth failed2025-03-14 13:26:25 dovecot_plain authenticator failed for ([66.55.74.113]) [66.55.74.113]:43272: 535 Incorrect authentication data (set_id=sales)66.55.74.1136252001|  -) ossec13001gExim Auth failed2025-03-14 13:26:14 dovecot_plain authenticator failed for 171.41.246.220.static.netvigator.com [220.246.41.171]:49506: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)220.246.41.1711819730l  -i# ossec13001g]Exim Auth failed2025-03-14 12:53:08 dovecot_login authenticator failed for (vandanabalbharti.com) [14.18.77.99]:48830: 535 Incorrect authentication data (set_id=contact@vandanabalbharti.com)14.18.77.991814991W  -?# ossec13001gCExim Auth failed2025-03-14 12:52:42 dovecot_login authenticator failed for (vandanabalbharti.com) [14.18.77.99]:44986: 535 Incorrect authentication data (set_id=nologin)14.18.77.991814991^~  -I' ossec13001g؏Exim Auth failed2025-03-14 12:49:43 dovecot_plain authenticator failed for ([223.82.236.69]) [223.82.236.69]:1154: 535 Incorrect authentication data (set_id=vikas.khandelwal)223.82.236.691814991x}  -y+ ossec13001g؃Exim Auth failed2025-03-14 12:49:30 dovecot_plain authenticator failed for ([143.170.180.196]) [143.170.180.196]:60136: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)143.170.180.1966252001 3 *  + F h *563  - ) ossec13001g,Exim Auth failed2025-03-14 18:48:41 dovecot_login authenticator failed for syn-070-122-139-172.res.spectrum.com [70.122.139.172]:52118: 535 Incorrect authentication data (set_id=services@heipowersystem.com)70.122.139.1726252001{  -+ ossec13001g*&Exim Auth failed2025-03-14 18:37:48 dovecot_plain authenticator failed for (177-174-122-213.user.vivozap.com.br) [177.174.122.213]:40315: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)177.174.122.2133469034q  -u% ossec13001g*Exim Auth failed2025-03-14 18:37:36 dovecot_plain authenticator failed for ([65.20.191.43]) [65.20.191.43]:46522: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)65.20.191.4399237d  -W% ossec13001g(Exim Auth failed2025-03-14 18:31:33 dovecot_plain authenticator failed for ([175.198.18.3]) [175.198.18.3]:59117: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)175.198.18.31835841P  -1% ossec13001g(Exim Auth failed2025-03-14 18:31:43 dovecot_plain authenticator failed for ([94.204.82.91]) [94.204.82.91]:35252: 535 Incorrect authentication data (set_id=sales)94.204.82.91290557b  -O) ossec13001gExim Auth failed2025-03-14 17:54:09 dovecot_plain authenticator failed for ([121.147.25.111]) [121.147.25.111]:46928: 535 Incorrect authentication data (set_id=vikas.khandelwal)121.147.25.1111835841u  -u) ossec13001gExim Auth failed2025-03-14 17:53:57 dovecot_plain authenticator failed for ([109.191.68.111]) [109.191.68.111]:53073: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)109.191.68.1112017370f  -W) ossec13001gtExim Auth failed2025-03-14 17:01:00 dovecot_login authenticator failed for ([220.178.201.58]) [220.178.201.58]:43637: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)220.178.201.581814991y  -}) ossec13001ghExim Auth failed2025-03-14 17:00:46 dovecot_login authenticator failed for ([103.163.44.118]) [103.163.44.118]:43532: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)103.163.44.1181269750P  -/% ossec13001g4Exim Auth failed2025-03-14 16:51:23 dovecot_login authenticator failed for (hn.kd.ny.adsl) [123.7.86.144]:46188: 535 Incorrect authentication data (set_id=sales)123.7.86.1441814991d  -W% ossec13001g*Exim Auth failed2025-03-14 16:51:13 dovecot_login authenticator failed for ([81.95.86.249]) [81.95.86.249]:40096: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)81.95.86.2493144096Z  -=+ ossec13001gExim Auth failed2025-03-14 16:41:34 dovecot_login authenticator failed for ([167.250.119.207]) [167.250.119.207]:42333: 535 Incorrect authentication data (set_id=sales)167.250.119.2073865483a  -S# ossec13001gExim Auth failed2025-03-14 16:41:22 dovecot_login authenticator failed for ([49.82.36.41]) [49.82.36.41]:57672: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)49.82.36.411814991i  -[+ ossec13001g Exim Auth failed2025-03-14 16:36:05 dovecot_login authenticator failed for ([191.241.247.150]) [191.241.247.150]:65030: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)191.241.247.1503469034  -') ossec13001g Exim Auth failed2025-03-14 16:35:51 dovecot_login authenticator failed for (red.170.233.29.175.ssservicios.com.ar) [170.233.29.175]:46657: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)170.233.29.1753865483_  -K' ossec13001gExim Auth failed2025-03-14 15:57:22 dovecot_login authenticator failed for ([203.116.95.48]) [203.116.95.48]:60854: 535 Incorrect authentication data (set_id=vikas.khandelwal)203.116.95.481880251o  -m% ossec13001grExim Auth failed2025-03-14 15:56:57 dovecot_login authenticator failed for ([60.174.35.18]) [60.174.35.18]:35657: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)60.174.35.181814991 *\~tj`VLB8.$zpf\H>4*   v l b X N D : 0 &    ~ t j ` V L B 8 . $    z p f \ R H > 4 *  vlbXND:0&|rh^TJ6@,"xndZPF<2( ~tj`VLB8.$zpf\ | r h ^ T J @ 6 , "    x n d Z P F < 2 (   RRH>4*  vlbXND:0& g֧+ g֧+ g֧k+ g֧S+ g֧ + g֦+ g֦+ g֦+ g֥++ g֥M+ g֥++ g֤+ g֤,+ g֤,+ g֤,+ g֡+ g֡l+ g֡P+ g֡F+ g֡:+ g֠+ g֠+ g֚* g֚* g֚6* g֚$* g֘* g֘* g֘* g֘* g֊z* g֊* gֆ9* gֆ5* gֆ!* gֆ* g~[* g~M* g{ * gz* gy* gv* gq* gh* gh* ggo* gg[* gd* gdD* gaM* ga;* g_* g_* g^* g^* gY* gY* gT* gRH* gRR* gQ5* gP* gPq* gN* gN* gN* gNM* gN* gԒ* gԒ* gԒ* gԌF* gԌ<* gԇs* gԇ* gԃH* gԃ.* gw* gs* gs* gr^* grL* gp* gp* gp* gp* gm* gm* gh6* gh&* gg3* gf* gY* gY* gY* gL\* gJx* gH* gH* gB* gB* g?* g?* g>* g>}* g;n* g;x* g:* g:* g:* g9* g8$* g8* g8* g8* g3* g3* g/_* g,* g,* g*&* g** g(* g(* g* g* gt* gh* g4* g** g* g* g * g * g* gr* gS* g* g* g7* g+* g* g* gB* g.* g* g* g)* g* g]* gC* g؏*~ g؃*} g͎*| gv*{ g*z g*y gĦ*x gĞ*w g*v g*u g*t g»*s gӽ~*r gӽl*q gӼ*p gӼ*o gӻ9*m gӻ)*l gӻ'*k g7+@ g.q+? g._+> g(+= g +< g+; gC+: g+9 g x+6 g a+8 g Z+7 g s+5 g+4 gw+3 gA+2 g&+1 g+0 g+/ g +. g?+- g/+, g++ g+* g+) g+( g+' g+& g+% g҄+$ gx+# gǏ+" gK+! gM+ g?+ g+ g+ gּK+ gּ+ gֳ+ gְ:+ g֪^+ g֪F+ g֧+ gӻ*n gӹM*j gӰ*i gӰ*h gӬ(*f gӬ*g gӫ*e gӪ*d gӪ*c gӦ0*b gӣ*a gӝ*` gӝ*_ gӚ*^ gӚ*] gәM*\ gә?*[ gӘ>*Z gӘ0*Y gӓ*X gӐ*W gӐw*V gӋ*U gӀ6*T ghF*S ge5*R ge)*Q ge*P gd*O gc*N g_*M g^*L gS}*K gSe*J gS7*I gS*H gQ*G gOx*F gMp*E gM\*D gJ*C gJ*B g7+A gH*@ gH*A gF*> gF*? gF*= gF*< gFH*; gF>*: gD*9 gD*8 gD*7 gD*6 gD*5 gD*4 gD*3 gA*2 g9*1 g9*0 g9v*/ g8B*. g82*- g7*, g7*+ g7** g7t*) g/*( g/*' g'F*& g%*% g%*$ g#L*" g#@*# g![*! g!S* g!7* g!-* g! * g * g* g* g* g*     <as ].  -C+ ossec13001g>Exim Auth failed2025-03-14 20:04:48 dovecot_login authenticator failed for ([178.178.194.131]) [178.178.194.131]:59556: 535 Incorrect authentication data (set_id=services)178.178.194.1312017370p-  -i+ ossec13001g>}Exim Auth failed2025-03-14 20:04:37 dovecot_login authenticator failed for ([175.117.144.158]) [175.117.144.158]:55454: 535 Incorrect authentication data (set_id=services@heipowersystem.com)175.117.144.1581835841p,  -i+ ossec13001g;nExim Auth failed2025-03-14 19:51:34 dovecot_plain authenticator failed for ([178.178.127.114]) [178.178.127.114]:29127: 535 Incorrect authentication data (set_id=services@heipowersystem.com)178.178.127.1142017370U+  -;' ossec13001g;xExim Auth failed2025-03-14 19:51:43 dovecot_plain authenticator failed for ([65.20.235.206]) [65.20.235.206]:46967: 535 Incorrect authentication data (set_id=services)65.20.235.20699237t*  -w% ossec13001g:Exim Auth failed2025-03-14 19:49:06 dovecot_login authenticator failed for syn-072-017-090-246.biz.spectrum.com [72.17.90.246]:58998: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)72.17.90.2466252001r)  -s% ossec13001g:Exim Auth failed2025-03-14 19:48:50 dovecot_login authenticator failed for ([12.202.15.69]) [12.202.15.69]:7075: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)12.202.15.696252001T(  -7% ossec13001g:Exim Auth failed2025-03-14 19:45:32 dovecot_login authenticator failed for ([61.81.151.97]) [61.81.151.97]:37768: 535 Incorrect authentication data (set_id=services)61.81.151.971835841j'  -a' ossec13001g9Exim Auth failed2025-03-14 19:45:20 dovecot_login authenticator failed for ([94.102.51.218]) [94.102.51.218]:46940: 535 Incorrect authentication data (set_id=services@heipowersystem.com)94.102.51.2182750405W&  -9) ossec13001g8$Exim Auth failed2025-03-14 19:37:31 dovecot_login authenticator failed for ([61.164.202.219]) [61.164.202.218]:17079: 535 Incorrect authentication data (set_id=sales)61.164.202.2181814991W%  -9) ossec13001g8Exim Auth failed2025-03-14 19:37:23 dovecot_login authenticator failed for ([118.45.101.159]) [118.45.101.159]:33706: 535 Incorrect authentication data (set_id=sales)118.45.101.1591835841g$  -[' ossec13001g8Exim Auth failed2025-03-14 19:37:15 dovecot_login authenticator failed for ([118.33.246.91]) [118.33.246.91]:58371: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)118.33.246.911835841s#  -s' ossec13001g8Exim Auth failed2025-03-14 19:37:12 dovecot_login authenticator failed for (160.72.153.14.lightower.net) [160.72.153.14]:44878: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)160.72.153.146252001i"  -]) ossec13001g3Exim Auth failed2025-03-14 19:15:49 dovecot_login authenticator failed for c-73-106-172-226.hsd1.ga.comcast.net [73.106.172.226]:52364: 535 Incorrect authentication data (set_id=sales)73.106.172.2266252001m!  -i% ossec13001g3Exim Auth failed2025-03-14 19:15:39 dovecot_login authenticator failed for 116-94-0-159.ppps.bbiq.jp [116.94.0.159]:18734: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)116.94.0.15918610605  =c+ ossec13008g/_Mail Reciepient rejected2025-03-14 19:00:07 H=(mail.rokamauka.com) [165.154.232.235]:60217 F= rejected RCPT : Rejected relay attempt: '165.154.232.235' From: 'pwrvaqtzpn@rokamauka.com' To: 'goofile@fastmail.com'165.154.232.2351605651l  -e' ossec13001g,Exim Auth failed2025-03-14 18:48:50 dovecot_login authenticator failed for 107.201.86.34.bc.googleusercontent.com [34.86.201.107]:56662: 535 Incorrect authentication data (set_id=services)34.86.201.1076252001 : / M n | Yib?  -O) ossec13001gmExim Auth failed2025-03-14 23:26:11 dovecot_login authenticator failed for ([190.121.193.46]) [190.121.193.46]:44244: 535 Incorrect authentication data (set_id=vikas.khandelwal)190.121.193.463595528}>  -' ossec13001gmExim Auth failed2025-03-14 23:26:02 dovecot_login authenticator failed for n219077029126.netvigator.com [219.77.29.126]:54236: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)219.77.29.1261819730b=  -O) ossec13001gh6Exim Auth failed2025-03-14 23:02:36 dovecot_plain authenticator failed for ([212.220.113.55]) [212.220.113.55]:49616: 535 Incorrect authentication data (set_id=vikas.khandelwal)212.220.113.552017370o<  -m% ossec13001gh&Exim Auth failed2025-03-14 23:02:20 dovecot_plain authenticator failed for ([27.124.18.19]) [27.124.18.19]:43750: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)27.124.18.191269750\; -E% ossec13001gg3Exim Auth failed2025-03-14 22:58:18 dovecot_login authenticator failed for (amplifypowerglobal.com) [119.96.131.8]:50408: 535 Incorrect authentication data (set_id=nologin)119.96.131.81814991':  3S) ossec11301gfNew FTP connection.Mar 14 22:53:15 vm1 pure-ftpd[935880]: (?@194.165.16.164) [INFO] New connection from 194.165.16.164194.165.16.1642993457V9  -9) ossec13001gYExim Auth failed2025-03-14 22:00:46 dovecot_login authenticator failed for ([185.116.231.33]) [185.116.231.33]:56070: 535 Incorrect authentication data (set_id=sales)185.116.231.33690791T8  -5' ossec13001gYExim Auth failed2025-03-14 22:00:35 dovecot_login authenticator failed for ([49.124.149.21]) [49.124.149.21]:33306: 535 Incorrect authentication data (set_id=sales)49.124.149.211733045j7  -_) ossec13001gYExim Auth failed2025-03-14 22:00:19 dovecot_login authenticator failed for ([193.234.119.22]) [193.234.119.22]:50880: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)193.234.119.222661886!6  3K% ossec11301gL\New FTP connection.Mar 14 21:03:47 vm1 pure-ftpd[911216]: (?@20.171.25.51) [INFO] New connection from 20.171.25.5120.171.25.5162520015  W!+ ossec9708gJxDovecot Aborted Login with empty userMar 14 20:55:43 vm1 dovecot[385861]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=185.247.137.234, lip=103.74.54.108, TLS, session=185.247.137.234298795n4  -i' ossec13001gHExim Auth failed2025-03-14 20:47:56 dovecot_login authenticator failed for (vandanabalbharti.com) [221.229.216.1]:50494: 535 Incorrect authentication data (set_id=sales@vandanabalbharti.com)221.229.216.11814991[3  -C' ossec13001gHExim Auth failed2025-03-14 20:47:28 dovecot_login authenticator failed for (vandanabalbharti.com) [221.229.216.1]:47412: 535 Incorrect authentication data (set_id=nologin)221.229.216.11814991^2  -K' ossec13001gBExim Auth failed2025-03-14 20:20:02 dovecot_login authenticator failed for ([91.72.148.106]) [91.72.148.106]:36638: 535 Incorrect authentication data (set_id=vikas.khandelwal)91.72.148.1062905571  -) ossec13001gBExim Auth failed2025-03-14 20:19:49 dovecot_login authenticator failed for syn-172-090-227-255.res.spectrum.com [172.90.227.255]:35486: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)172.90.227.2556252001T0  -5' ossec13001g?Exim Auth failed2025-03-14 20:10:01 dovecot_plain authenticator failed for ([96.94.173.238]) [96.94.173.238]:53022: 535 Incorrect authentication data (set_id=sales)96.94.173.2386252001j/  -_) ossec13001g?Exim Auth failed2025-03-14 20:09:51 dovecot_plain authenticator failed for ([118.70.227.203]) [118.70.227.203]:54578: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)118.70.227.2031562822  = c i  t5\t`dP  -W% ossec13001gԒExim Auth failed2025-03-15 02:03:54 dovecot_login authenticator failed for ([220.81.9.218]) [220.81.9.218]:51796: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)220.81.9.2181835841jO  -_) ossec13001gԒExim Auth failed2025-03-15 02:03:16 dovecot_login authenticator failed for ([200.106.49.149]) [200.106.49.149]:56572: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)200.106.49.1493932488WN  -;' ossec13001gԌFExim Auth failed2025-03-15 01:36:29 dovecot_login authenticator failed for ([92.255.190.69]) [92.255.190.69]:38224: 535 Incorrect authentication data (set_id=services)92.255.190.692017370M  -)+ ossec13001gԌ<Exim Auth failed2025-03-15 01:36:19 dovecot_login authenticator failed for (abts-kk-static-226.253.166.122.airtelbroadband.in) [122.166.253.226]:46449: 535 Incorrect authentication data (set_id=services@heipowersystem.com)122.166.253.2261269750dL  -W% ossec13001gԇsExim Auth failed2025-03-15 01:15:54 dovecot_plain authenticator failed for ([106.51.57.89]) [106.51.57.89]:42836: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)106.51.57.891269750UK  -7' ossec13001gԇExim Auth failed2025-03-15 01:16:14 dovecot_plain authenticator failed for ([189.108.224.67]) [191.210.73.33]:38238: 535 Incorrect authentication data (set_id=sales)191.210.73.333469034WJ  -;' ossec13001gԃHExim Auth failed2025-03-15 00:58:06 dovecot_plain authenticator failed for ([222.218.17.45]) [222.218.17.45]:41093: 535 Incorrect authentication data (set_id=services)222.218.17.451814991jI  -a' ossec13001gԃ.Exim Auth failed2025-03-15 00:57:42 dovecot_plain authenticator failed for ([117.32.102.90]) [117.32.102.90]:52807: 535 Incorrect authentication data (set_id=services@heipowersystem.com)117.32.102.901814991H  ?/ ossec1008gwProcess exiting (killed).Mar 15 00:06:10 vm1 spamd[649532]: spamd: server killed by SIGTERM, shutting downiG  -[+ ossec13001gsExim Auth failed2025-03-14 23:49:07 dovecot_login authenticator failed for ([154.113.167.210]) [154.113.167.210]:36878: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)154.113.167.2102328926F  -) ossec13001gsExim Auth failed2025-03-14 23:48:57 dovecot_login authenticator failed for (213.33.204.130.moscow.gldn.net) [213.33.204.130]:55906: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)213.33.204.1302017370fE  -W) ossec13001gr^Exim Auth failed2025-03-14 23:45:57 dovecot_plain authenticator failed for ([211.252.168.97]) [211.252.168.97]:45118: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)211.252.168.971835841vD  -y' ossec13001grLExim Auth failed2025-03-14 23:45:40 dovecot_plain authenticator failed for ([222.120.176.6]) [222.120.176.6]:46700: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)222.120.176.61835841VC  -9) ossec13001gpExim Auth failed2025-03-14 23:39:50 dovecot_plain authenticator failed for ([109.233.21.109]) [109.233.21.109]:55454: 535 Incorrect authentication data (set_id=sales)109.233.21.109272103QB  -1% ossec13001gpExim Auth failed2025-03-14 23:39:51 dovecot_login authenticator failed for ([27.124.18.19]) [27.124.18.19]:54658: 535 Incorrect authentication data (set_id=sales)27.124.18.191269750jA  -_) ossec13001gpExim Auth failed2025-03-14 23:39:40 dovecot_login authenticator failed for ([111.93.177.228]) [111.93.177.228]:51552: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)111.93.177.2281269750|@  -) ossec13001gpExim Auth failed2025-03-14 23:39:29 dovecot_plain authenticator failed for syn-035-130-111-146.biz.spectrum.com [35.130.111.146]:40248: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)35.130.111.1466252001 %C e > :H\o`b  -M) ossec13001g_Exim Auth failed2025-03-16 10:48:18 dovecot_login authenticator failed for (19.135.150.178.triolan.net) [178.150.135.19]:10415: 535 Incorrect authentication data (set_id=sales)178.150.135.19690791ia  -_) ossec13001g_Exim Auth failed2025-03-16 10:48:07 dovecot_login authenticator failed for ([102.215.188.37]) [102.215.188.37]:33123: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)102.215.188.37192950h`  -_% ossec13001g^Exim Auth failed2025-03-16 10:46:07 dovecot_plain authenticator failed for (dynamic-ip-adsl.viettel.vn) [117.2.123.19]:40958: 535 Incorrect authentication data (set_id=vikas.khandelwal)117.2.123.191562822n_  -k% ossec13001g^Exim Auth failed2025-03-16 10:45:53 dovecot_plain authenticator failed for (hn.kd.ny.adsl) [123.7.86.144]:58876: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)123.7.86.1441814991^^  -I' ossec13001gYExim Auth failed2025-03-16 10:25:40 dovecot_login authenticator failed for (90.188.40.123.stbur.ru) [90.188.40.123]:58292: 535 Incorrect authentication data (set_id=services)90.188.40.1232017370m]  -e) ossec13001gYExim Auth failed2025-03-16 10:25:26 dovecot_login authenticator failed for ([118.140.135.25]) [118.140.135.25]:35856: 535 Incorrect authentication data (set_id=services@heipowersystem.com)118.140.135.251819730&\  3S) ossec11301gTNew FTP connection.Mar 16 10:03:10 vm1 pure-ftpd[420125]: (?@45.144.212.139) [INFO] New connection from 45.144.212.13945.144.212.139690791r[  -q' ossec13001gRHExim Auth failed2025-03-16 09:53:35 dovecot_login authenticator failed for ([60.191.94.106]) [60.191.94.106]:40012: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)60.191.94.1061814991eZ  -S+ ossec13001gRRExim Auth failed2025-03-16 09:53:44 dovecot_login authenticator failed for ([124.106.145.241]) [124.106.145.241]:42288: 535 Incorrect authentication data (set_id=vikas.khandelwal)124.106.145.2411694008$Y  3O' ossec11301gQ5New FTP connection.Mar 16 09:49:01 vm1 pure-ftpd[416971]: (?@167.94.146.62) [INFO] New connection from 167.94.146.62167.94.146.626252001^X -G' ossec13001gPExim Auth failed2025-03-16 09:46:08 dovecot_login authenticator failed for (amplifypowerglobal.com) [221.229.216.1]:34962: 535 Incorrect authentication data (set_id=nologin)221.229.216.11814991'W  3S) ossec11301gPqNew FTP connection.Mar 16 09:45:44 vm1 pure-ftpd[416407]: (?@206.168.34.113) [INFO] New connection from 206.168.34.113206.168.34.1136252001YV  -A% ossec13001gNExim Auth failed2025-03-16 09:39:21 dovecot_login authenticator failed for (User) [87.106.77.61]:53926: 535 Incorrect authentication data (set_id=gill@vm1.technobases.in)87.106.77.612921044[U  -E% ossec13001gNExim Auth failed2025-03-16 09:38:26 dovecot_login authenticator failed for (User) [87.106.77.61]:50259: 535 Incorrect authentication data (set_id=chahal@vm1.technobases.in)87.106.77.612921044ZT  -C% ossec13001gNExim Auth failed2025-03-16 09:37:32 dovecot_login authenticator failed for (User) [87.106.77.61]:49267: 535 Incorrect authentication data (set_id=zaidi@vm1.technobases.in)87.106.77.612921044ZS  -C% ossec13001gNMExim Auth failed2025-03-16 09:36:36 dovecot_login authenticator failed for (User) [87.106.77.61]:60227: 535 Incorrect authentication data (set_id=bapna@vm1.technobases.in)87.106.77.612921044^R  -K% ossec13001gNExim Auth failed2025-03-16 09:35:50 dovecot_login authenticator failed for (User) [87.106.77.61]:50972: 535 Incorrect authentication data (set_id=bistagond@vm1.technobases.in)87.106.77.612921044WQ  -9) ossec13001gԒExim Auth failed2025-03-15 02:04:05 dovecot_login authenticator failed for ([221.167.21.148]) [221.167.21.148]:48654: 535 Incorrect authentication data (set_id=sales)221.167.21.1481835841 5 45[r  -C' ossec13001gֆExim Auth failed2025-03-16 13:34:46 dovecot_login authenticator failed for (vandanabalbharti.com) [111.56.54.202]:50148: 535 Incorrect authentication data (set_id=nologin)111.56.54.2021814991Wq  -9) ossec13001g~[Exim Auth failed2025-03-16 13:01:39 dovecot_plain authenticator failed for ([193.234.119.69]) [193.234.119.69]:34262: 535 Incorrect authentication data (set_id=sales)193.234.119.692661886zp  -) ossec13001g~MExim Auth failed2025-03-16 13:01:23 dovecot_plain authenticator failed for (80-184-100-101.myrepublic.com.sg) [218.212.153.73]:53840: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)218.212.153.731880251Co  =+ ossec13008g{ Mail Reciepient rejected2025-03-16 12:47:29 H=(mail.s2seducationtrust.com) [165.154.210.114]:62310 F= rejected RCPT : Rejected relay attempt: '165.154.210.114' From: 'lvmxa@s2seducationtrust.com' To: 'goofile@fastmail.com'165.154.210.1141694008Wn  -;' ossec13001gzExim Auth failed2025-03-16 12:43:19 dovecot_plain authenticator failed for ([61.108.83.138]) [61.108.83.138]:54871: 535 Incorrect authentication data (set_id=services)61.108.83.1381835841jm  -a' ossec13001gyExim Auth failed2025-03-16 12:42:49 dovecot_plain authenticator failed for ([120.157.60.38]) [120.157.60.38]:48864: 535 Incorrect authentication data (set_id=services@heipowersystem.com)120.157.60.382077456!l  3K% ossec11301gvNew FTP connection.Mar 16 12:29:20 vm1 pure-ftpd[453497]: (?@13.89.125.28) [INFO] New connection from 13.89.125.2813.89.125.286252001Ok  =+ ossec13008gqMail Reciepient rejected2025-03-16 12:07:18 H=(mail.westerndancecompany.com) [165.154.210.114]:63516 F= rejected RCPT : Rejected relay attempt: '165.154.210.114' From: 'zvgezhdk@westerndancecompany.com' To: 'goofile@fastmail.com'165.154.210.1141694008 j  -%' ossec13001ghExim Auth failed2025-03-16 11:29:39 dovecot_plain authenticator failed for broadband-95-84-158-215.ip.moscow.rt.ru [95.84.158.215]:50777: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)95.84.158.2152017370ci  -S' ossec13001ghExim Auth failed2025-03-16 11:30:02 dovecot_plain authenticator failed for ([178.218.82.32]) [178.218.82.32]:59848: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)178.218.82.322017370Vh  -9) ossec13001ggoExim Auth failed2025-03-16 11:23:50 dovecot_plain authenticator failed for ([31.141.253.119]) [31.141.253.119]:36368: 535 Incorrect authentication data (set_id=sales)31.141.253.119298795ig  -]) ossec13001gg[Exim Auth failed2025-03-16 11:23:30 dovecot_plain authenticator failed for ([222.242.204.22]) [222.242.204.22]:3628: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)222.242.204.221814991/f  =Y) ossec13008gdMail Reciepient rejected2025-03-16 11:13:01 H=(mail.nyaystambh.com) [165.154.233.84]:61687 F= rejected RCPT : Rejected relay attempt: '165.154.233.84' From: 'vwnoqyf@nyaystambh.com' To: 'goofile@fastmail.com'165.154.233.8416940083e  =_+ ossec13008gdDMail Reciepient rejected2025-03-16 11:10:19 H=(mail.rokamauka.com) [165.154.213.196]:49960 F= rejected RCPT : Rejected relay attempt: '165.154.213.196' From: 'ublmcblpa@rokamauka.com' To: 'goofile@fastmail.com'165.154.213.1963469034bd  -S' ossec13001gaMExim Auth failed2025-03-16 10:57:41 dovecot_login authenticator failed for ([41.59.201.180]) [41.59.201.180]:41956: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)41.59.201.180149590yc  -}) ossec13001ga;Exim Auth failed2025-03-16 10:57:23 dovecot_login authenticator failed for ([103.29.185.162]) [103.29.185.162]:47124: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)103.29.185.1621643084 7/ 8  )BU[~;B7  -) ossec13001g֡FExim Auth failed2025-03-16 15:30:36 dovecot_login authenticator failed for 195-159-217-71.customer.powertech.no [195.159.217.71]:36218: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)195.159.217.713144096u C_' ossec11313g֡:FTP file uploaded to serverMar 16 15:30:25 vm1 pure-ftpd[492848]: (user@spexscart.com@171.79.183.59) [NOTICE] /home/techno/public_html/spexscart.com//shop.php uploaded (10613 bytes, 402.90KB/sec)171.79.183.591269750% 3O' ossec11301g֠New FTP connection.Mar 16 15:29:11 vm1 pure-ftpd[492823]: (?@171.79.183.59) [INFO] New connection from 171.79.183.59171.79.183.591269750/ CS' ossec11309g֠FTP Authentication success.Mar 16 15:29:12 vm1 pure-ftpd[492823]: (?@171.79.183.59) [INFO] user@spexscart.com is now logged in171.79.183.591269750f  -W) ossec13001g֚Exim Auth failed2025-03-16 15:03:24 dovecot_login authenticator failed for ([222.128.80.201]) [222.128.80.201]:24903: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)222.128.80.2011814991y~  -}) ossec13001g֚Exim Auth failed2025-03-16 15:02:56 dovecot_login authenticator failed for ([103.146.233.52]) [103.146.233.52]:34948: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)103.146.233.521269750Y}  -?) ossec13001g֚6Exim Auth failed2025-03-16 15:00:28 dovecot_login authenticator failed for ([31.141.216.143]) [31.141.216.143]:46242: 535 Incorrect authentication data (set_id=services)31.141.216.143298795v|  -y' ossec13001g֚$Exim Auth failed2025-03-16 15:00:10 dovecot_login authenticator failed for p87142-obmd01.osaka.ocn.ne.jp [180.7.158.141]:36678: 535 Incorrect authentication data (set_id=services@heipowersystem.com)180.7.158.1411861060i{  -]) ossec13001g֘Exim Auth failed2025-03-16 14:53:40 dovecot_login authenticator failed for syn-172-090-227-255.res.spectrum.com [172.90.227.255]:56354: 535 Incorrect authentication data (set_id=sales)172.90.227.2556252001cz  -U% ossec13001g֘Exim Auth failed2025-03-16 14:53:29 dovecot_login authenticator failed for ([8.243.166.66]) [8.243.166.66]:4501: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)8.243.166.663686110ay  -O' ossec13001g֘Exim Auth failed2025-03-16 14:53:25 dovecot_login authenticator failed for p7001160-ipoefx.ipoe.ocn.ne.jp [118.3.227.159]:34174: 535 Incorrect authentication data (set_id=sales)118.3.227.1591861060zx  -}+ ossec13001g֘Exim Auth failed2025-03-16 14:53:14 dovecot_login authenticator failed for (197-255-203-194.netpagedns.net) [197.255.203.194]:47273: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)197.255.203.1942413451Zw -?' ossec13001g֊zExim Auth failed2025-03-16 13:53:21 dovecot_login authenticator failed for (heipowersystem.com) [111.61.229.78]:37055: 535 Incorrect authentication data (set_id=nologin)111.61.229.781814991Jv  = + ossec13008g֊Mail Reciepient rejected2025-03-16 13:51:43 H=(mail.uttamclassesjaipur.com) [165.154.213.136]:49523 F= rejected RCPT : Rejected relay attempt: '165.154.213.136' From: 'kxndiia@uttamclassesjaipur.com' To: 'goofile@fastmail.com'165.154.213.1363469034su  -s' ossec13001gֆ9Exim Auth failed2025-03-16 13:35:11 dovecot_login authenticator failed for (vandanabalbharti.com) [111.56.54.202]:53134: 535 Incorrect authentication data (set_id=postmaster@vandanabalbharti.com)111.56.54.2021814991St  -5' ossec13001gֆ5Exim Auth failed2025-03-16 13:35:07 dovecot_login authenticator failed for ([185.167.56.70]) [185.167.56.70]:36006: 535 Incorrect authentication data (set_id=sales)185.167.56.70617790vs  -{' ossec13001gֆ!Exim Auth failed2025-03-16 13:34:47 dovecot_login authenticator failed for (41.84.132.142.liquidtelecom.net) [41.84.132.142]:59471: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)41.84.132.142192950 G- %  |obUH;.!xk^QD7*tgZM@3& -:~qdWJ=0# zm`SF9, v i \ O B 5 (     r e X K > 1 $  { n a T G : -   w j ] P C 6 )    s f Y L ? 2}pcVI</"yl_RE8+uh[NA4' wk_SG 1694008 1694008zP 1668284O 1668284OE 1668284O 1694008 1694008 1694008 1694008 1694008 16940084 1694008 1694008 1694008[ 1694008 1694008 1694008t 1694008 1694008 1694008j 16940085 1694008 1694008 1694008 : 1694008 1694008 < 1694008 9 1694008 1694008 1694008 1694008 N 1694008 * 1694008 1694008 1694008 1694008 1694008g 1694008b 1694008D 1694008 1694008 1694008 1668284N 1668284Ns 1668284Nd 1668284NI 1668284ND 1668284N2 1668284N 1668284M 1668284M 1668284M 1668284M 1668284M 1668284M 1668284M 1668284M 1668284M 1668284M 1668284L 1668284L! 1668284K 1668284K 1668284K 1668284K 1668284Kh 1668284K3 1668284K 1668284K 1668284JV 1668284JH 1668284I 1668284I 1733045 1733045 1733045u 1733045 1733045 1733045 1733045 1733045 1733045 1733045 1733045 1733045  1733045 2 1733045 1733045 1733045 ] 1733045 m 1733045 E 1733045  1733045 1733045 n 1733045 k 1733045 D 1733045 1733045 1694008L 1694008KV 1694008G_ 1694008F 1694008F 1694008E$ 1694008C 1694008C 1694008C 1694008B 1694008B$ 1694008B 1694008A 1694008A 1694008A 1694008@ 1694008@ 1694008@W 1694008? 1694008? 1694008? 1694008? 1694008?~ 1694008?f 1694008?^ 1694008> 1694008> 1694008> 1694008>% 1694008= 1694008= 1694008=G 1694008< 1694008< 1694008< 1694008<{ 1694008 rejected RCPT : Rejected relay attempt: '165.154.227.155' From: 'vdztngnvnw@saintsoldiercollege.com' To: 'goofile@fastmail.com'165.154.227.1551668284t  C_' ossec11313g֤,FTP file uploaded to serverMar 16 15:43:00 vm1 pure-ftpd[495830]: (user@spexscart.com@171.79.183.59) [NOTICE] /home/techno/public_html/spexscart.com//shop.php uploaded (10427 bytes, 389.78KB/sec)171.79.183.591269750$  3O' ossec11301g֤,New FTP connection.Mar 16 15:42:59 vm1 pure-ftpd[495830]: (?@171.79.183.59) [INFO] New connection from 171.79.183.59171.79.183.591269750.  CS' ossec11309g֤,FTP Authentication success.Mar 16 15:42:59 vm1 pure-ftpd[495830]: (?@171.79.183.59) [INFO] user@spexscart.com is now logged in171.79.183.591269750u C_' ossec11313g֡FTP file uploaded to serverMar 16 15:32:11 vm1 pure-ftpd[492848]: (user@spexscart.com@171.79.183.59) [NOTICE] /home/techno/public_html/spexscart.com//shop.php uploaded (10613 bytes, 741.63KB/sec)171.79.183.591269750u C_' ossec11313g֡lFTP file uploaded to serverMar 16 15:31:15 vm1 pure-ftpd[492848]: (user@spexscart.com@171.79.183.59) [NOTICE] /home/techno/public_html/spexscart.com//shop.php uploaded (10807 bytes, 417.62KB/sec)171.79.183.591269750_  -K' ossec13001g֡PExim Auth failed2025-03-16 15:30:46 dovecot_login authenticator failed for ([183.182.99.92]) [183.182.99.92]:56607: 535 Incorrect authentication data (set_id=vikas.khandelwal)183.182.99.921655842 + ? [  o%  -m% ossec13001gExim Auth failed2025-03-16 20:19:54 dovecot_login authenticator failed for ([58.16.49.250]) [58.16.49.250]:46764: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)58.16.49.2501814991Q$  -3# ossec13001g҄Exim Auth failed2025-03-16 19:00:44 dovecot_login authenticator failed for ([41.63.235.9]) [41.63.235.9]:58499: 535 Incorrect authentication data (set_id=services)41.63.235.93355338y#  -' ossec13001gxExim Auth failed2025-03-16 19:00:32 dovecot_login authenticator failed for 217-76-83-103.cust.bredband2.com [217.76.83.103]:50942: 535 Incorrect authentication data (set_id=services@heipowersystem.com)217.76.83.1032661886}"  U_' ossec11001gǏDeferred login on the cpanel service[2025-03-16 18:13:59 +0530] info [webmaild] 49.35.254.196 - kps@amplifypowerglobal.com "POST /cpsess1569767620/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [49.35.250.89] != Current IP Address [49.35.254.196]49.35.254.1961269750m!  -c+ ossec13001gKExim Auth failed2025-03-16 18:12:51 dovecot_plain authenticator failed for ([123.209.123.195]) [123.209.123.195]:44838: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)123.209.123.1952077456`  -K) ossec13001gMExim Auth failed2025-03-16 18:04:20 dovecot_login authenticator failed for ([125.16.12.73]) [128.185.253.90]:48128: 535 Incorrect authentication data (set_id=vikas.khandelwal)128.185.253.901269750  -' ossec13001g?Exim Auth failed2025-03-16 18:04:06 dovecot_login authenticator failed for syn-156-019-080-138.biz.spectrum.com [156.19.80.138]:50363: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)156.19.80.1386252001p  -i+ ossec13001gExim Auth failed2025-03-16 17:54:10 dovecot_plain authenticator failed for ([197.255.138.149]) [197.255.138.149]:38613: 535 Incorrect authentication data (set_id=services@heipowersystem.com)197.255.138.1493374766e  -U) ossec13001gExim Auth failed2025-03-16 17:54:25 dovecot_plain authenticator failed for p5dd3e89f.dip0.t-ipconnect.de [93.211.232.159]:54094: 535 Incorrect authentication data (set_id=services)93.211.232.1592921044t  -s) ossec13001gּKExim Auth failed2025-03-16 17:25:54 dovecot_login authenticator failed for 144.46.246.220.static.netvigator.com [220.246.46.144]:49435: 535 Incorrect authentication data (set_id=vikas.khandelwal)220.246.46.1441819730o  -m% ossec13001gּExim Auth failed2025-03-16 17:25:08 dovecot_login authenticator failed for ([154.127.42.2]) [154.127.42.2]:47712: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)154.127.42.22395170$  3O' ossec11301gֳNew FTP connection.Mar 16 16:46:17 vm1 pure-ftpd[509965]: (?@91.238.181.92) [INFO] New connection from 91.238.181.9291.238.181.923017382`  -S# ossec13001gְ:Exim Auth failed2025-03-16 16:34:24 dovecot_plain authenticator failed for ([5.31.27.112]) [5.31.27.112]:39585: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)5.31.27.112290557h  -]' ossec13001g֪^Exim Auth failed2025-03-16 16:09:26 dovecot_login authenticator failed for (gurukuljaipur.com) [221.229.216.1]:42160: 535 Incorrect authentication data (set_id=sales@gurukuljaipur.com)221.229.216.11814991X  -=' ossec13001g֪FExim Auth failed2025-03-16 16:09:01 dovecot_login authenticator failed for (gurukuljaipur.com) [221.229.216.1]:39044: 535 Incorrect authentication data (set_id=nologin)221.229.216.11814991u  Ca' ossec11313g֧FTP file uploaded to serverMar 16 15:58:15 vm1 pure-ftpd[499403]: (user@spexscart.com@171.79.183.59) [NOTICE] /home/techno/public_html/spexscart.com//index.php uploaded (69564 bytes, 364.26KB/sec)171.79.183.591269750   %  " +G,>$5  3O' ossec11301g sNew FTP connection.Mar 16 22:55:06 vm1 pure-ftpd[593130]: (?@20.221.67.154) [INFO] New connection from 20.221.67.15420.221.67.1546252001;4  =o+ ossec13008gMail Reciepient rejected2025-03-16 22:48:55 H=(mail.gurukuljaipur.com) [165.154.213.130]:63176 F= rejected RCPT : Rejected relay attempt: '165.154.213.130' From: 'stdcasv@gurukuljaipur.com' To: 'goofile@fastmail.com'165.154.213.1303469034'3  3S) ossec11301gwNew FTP connection.Mar 16 22:21:01 vm1 pure-ftpd[585504]: (?@18.224.179.165) [INFO] New connection from 18.224.179.16518.224.179.1656252001(2 3S) ossec11301gANew FTP connection.Mar 16 22:15:51 vm1 pure-ftpd[584347]: (?@18.224.179.165) [INFO] New connection from 18.224.179.16518.224.179.1656252001j1  -_) ossec13001g&Exim Auth failed2025-03-16 22:11:09 dovecot_login authenticator failed for ([191.59.176.133]) [191.59.176.133]:60134: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)191.59.176.1333469034f0  -W) ossec13001gExim Auth failed2025-03-16 22:06:15 dovecot_login authenticator failed for ([121.147.25.111]) [121.147.25.111]:34034: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)121.147.25.1111835841/  -# ossec13001gExim Auth failed2025-03-16 22:05:58 dovecot_login authenticator failed for syn-070-120-006-086.res.spectrum.com [70.120.6.86]:49771: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)70.120.6.866252001$.  =C) ossec13008g Mail Reciepient rejected2025-03-16 21:53:39 H=(mail.hsnews.in) [165.154.233.80]:54563 F= rejected RCPT : Rejected relay attempt: '165.154.233.80' From: 'odiynujjz@hsnews.in' To: 'goofile@fastmail.com'165.154.233.801694008`-  -O% ossec13001g?Exim Auth failed2025-03-16 21:50:14 dovecot_plain authenticator failed for ([109.63.246.9]) [109.63.246.9]:50060: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)109.63.246.92017370s,  -u% ossec13001g/Exim Auth failed2025-03-16 21:49:58 dovecot_plain authenticator failed for ([58.18.90.114]) [58.18.90.114]:43522: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)58.18.90.1141814991k+  -a) ossec13001gExim Auth failed2025-03-16 21:44:04 dovecot_plain authenticator failed for net-188-152-225-58.cust.vodafonedsl.it [188.152.225.58]:52173: 535 Incorrect authentication data (set_id=sales)188.152.225.583175395j*  -_) ossec13001gExim Auth failed2025-03-16 21:43:54 dovecot_plain authenticator failed for ([182.151.45.136]) [182.151.45.136]:46457: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)182.151.45.1361814991")  =?) ossec13008gMail Reciepient rejected2025-03-16 21:31:50 H=(mail.hsnews.in) [165.154.213.78]:63353 F= rejected RCPT : Rejected relay attempt: '165.154.213.78' From: 'ybpujejg@hsnews.in' To: 'goofile@fastmail.com'165.154.213.783469034\(  -G% ossec13001gExim Auth failed2025-03-16 21:06:37 dovecot_plain authenticator failed for ([14.35.218.58]) [14.35.218.58]:56973: 535 Incorrect authentication data (set_id=vikas.khandelwal)14.35.218.581835841'  -' ossec13001gExim Auth failed2025-03-16 21:06:25 dovecot_plain authenticator failed for 211-20-26-201.hinet-ip.hinet.net [211.20.26.201]:34136: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)211.20.26.2011668284r&  -q' ossec13001gExim Auth failed2025-03-16 20:20:07 dovecot_login authenticator failed for syn-097-089-202-226.biz.spectrum.com [97.89.202.226]:55780: 535 Incorrect authentication data (set_id=vikas.khandelwal)97.89.202.2266252001 rj v B %=DZrdG  -W% ossec13001gIFExim Auth failed2025-03-17 03:27:25 dovecot_login authenticator failed for ([103.68.38.78]) [103.68.38.78]:44312: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)103.68.38.781269750fF  -W) ossec13001gB0Exim Auth failed2025-03-17 02:57:11 dovecot_plain authenticator failed for ([139.226.28.235]) [139.226.28.235]:28462: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)139.226.28.2351814991uE  -y' ossec13001gBExim Auth failed2025-03-17 02:56:52 dovecot_plain authenticator failed for ([94.201.79.121]) [94.201.79.121]:57499: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)94.201.79.121290557dD  -W% ossec13001g@Exim Auth failed2025-03-17 02:51:14 dovecot_plain authenticator failed for ([62.16.40.223]) [62.16.40.223]:57008: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)62.16.40.2232017370'C  3S) ossec11301g<New FTP connection.Mar 17 02:33:37 vm1 pure-ftpd[644842]: (?@172.202.118.40) [INFO] New connection from 172.202.118.40172.202.118.406252001~B  - % ossec13001g8Exim Auth failed2025-03-17 02:13:44 dovecot_plain authenticator failed for 206.81.4.146.static.wline.lns.sme.cust.swisscom.ch [146.4.81.206]:38165: 535 Incorrect authentication data (set_id=vikas.khandelwal)146.4.81.2062658434rA  -q' ossec13001g7Exim Auth failed2025-03-17 02:13:30 dovecot_plain authenticator failed for ([218.87.21.146]) [218.87.21.146]:35834: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)218.87.21.1461814991-@  =S+ ossec13008g7Mail Reciepient rejected2025-03-17 02:09:30 H=(mail.msnews24.in) [165.154.208.196]:59762 F= rejected RCPT : Rejected relay attempt: '165.154.208.196' From: 'nfwypwpwb@msnews24.in' To: 'goofile@fastmail.com'165.154.208.1961668284v?  -{% ossec13001g.qExim Auth failed2025-03-17 01:32:56 dovecot_login authenticator failed for 206.81.4.146.static.wline.lns.sme.cust.swisscom.ch [146.4.81.206]:57858: 535 Incorrect authentication data (set_id=services)146.4.81.2062658434~>  - ' ossec13001g._Exim Auth failed2025-03-17 01:32:38 dovecot_login authenticator failed for (cust-72-26-178-196.wireless.t6b.com) [72.26.178.196]:55058: 535 Incorrect authentication data (set_id=services@heipowersystem.com)72.26.178.1966252001!=  3K% ossec11301g(New FTP connection.Mar 17 01:09:05 vm1 pure-ftpd[625837]: (?@94.102.56.99) [INFO] New connection from 94.102.56.9994.102.56.992750405$<  3O' ossec11301g New FTP connection.Mar 17 00:35:15 vm1 pure-ftpd[618172]: (?@198.235.24.67) [INFO] New connection from 198.235.24.67198.235.24.676252001;  ?/ ossec1008gProcess exiting (killed).Mar 17 00:08:38 vm1 spamd[188037]: spamd: server killed by SIGTERM, shutting down4:  ; ossec9703gCDovecot is Starting Up.Mar 17 00:06:50 vm1 dovecot[611131]: master: Dovecot v2.3.21.1 (d492236fa0) starting up for lmtp, imap, pop3 (core dumps disabled)o9  -m' ossec13001gExim Auth failed2025-03-16 23:21:55 dovecot_plain authenticator failed for (185-189-123-105.laser.ir) [37.235.18.145]:34301: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)37.235.18.145130758p8  -i+ ossec13001g aExim Auth failed2025-03-16 23:03:20 dovecot_plain authenticator failed for ([123.209.117.171]) [123.209.117.171]:50400: 535 Incorrect authentication data (set_id=services@heipowersystem.com)123.209.117.1712077456'7  3S) ossec11301g ZNew FTP connection.Mar 16 23:03:13 vm1 pure-ftpd[595015]: (?@205.210.31.199) [INFO] New connection from 205.210.31.199205.210.31.1996252001g6  -]% ossec13001g xExim Auth failed2025-03-16 23:03:42 dovecot_plain authenticator failed for ([2.63.169.110]) [2.63.169.110]:56406: 535 Incorrect authentication data (set_id=services@heipowersystem.com)2.63.169.1102017370 "K e t .>cyX  -}) ossec13001g׊ Exim Auth failed2025-03-17 08:04:07 dovecot_plain authenticator failed for ([95.167.133.126]) [95.167.133.126]:39614: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)95.167.133.1262017370ZW  -=+ ossec13001g׈Exim Auth failed2025-03-17 07:58:39 dovecot_plain authenticator failed for ([180.188.143.166]) [180.188.143.166]:60347: 535 Incorrect authentication data (set_id=sales)180.188.143.1661819730jV  -_) ossec13001g׈Exim Auth failed2025-03-17 07:58:12 dovecot_plain authenticator failed for ([123.209.83.241]) [123.209.83.241]:35206: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)123.209.83.2412077456gU  -[' ossec13001gׇExim Auth failed2025-03-17 07:53:51 dovecot_login authenticator failed for syn-075-080-100-185.res.spectrum.com [75.80.100.185]:55592: 535 Incorrect authentication data (set_id=sales)75.80.100.1856252001yT  -}) ossec13001gׇExim Auth failed2025-03-17 07:53:25 dovecot_login authenticator failed for 46-162-112-159.cust.bredband2.com [46.162.112.159]:35616: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)46.162.112.1592661886oS  -i) ossec13001gׇcExim Auth failed2025-03-17 07:52:25 dovecot_login authenticator failed for ([70.39.23.1]) [167.142.198.54]:51066: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)167.142.198.546252001TR  -9% ossec13001gׇoExim Auth failed2025-03-17 07:52:38 dovecot_login authenticator failed for ([194.28.91.40]) [194.28.91.40]:37893: 535 Incorrect authentication data (set_id=admission)194.28.91.40690791WQ  -;' ossec13001gׇExim Auth failed2025-03-17 07:51:03 dovecot_login authenticator failed for ([151.63.145.14]) [151.63.145.14]:38363: 535 Incorrect authentication data (set_id=services)151.63.145.143175395lP  -c) ossec13001g׆Exim Auth failed2025-03-17 07:50:36 dovecot_login authenticator failed for ([175.116.66.199]) [175.116.66.199]:6630: 535 Incorrect authentication data (set_id=services@heipowersystem.com)175.116.66.1991835841'O  3S) ossec11301gt-New FTP connection.Mar 17 06:30:29 vm1 pure-ftpd[699647]: (?@45.156.129.112) [INFO] New connection from 45.156.129.11245.156.129.1122264397aN  -O' ossec13001gnExim Auth failed2025-03-17 06:06:16 dovecot_login authenticator failed for (rokamauka.com) [111.207.12.99]:60792: 535 Incorrect authentication data (set_id=office@rokamauka.com)111.207.12.991814991TM  -5' ossec13001gnjExim Auth failed2025-03-17 06:05:53 dovecot_login authenticator failed for (rokamauka.com) [111.207.12.99]:57590: 535 Incorrect authentication data (set_id=nologin)111.207.12.991814991ZL  -?) ossec13001gSPExim Auth failed2025-03-17 04:10:16 dovecot_plain authenticator failed for ([193.234.119.19]) [193.234.119.19]:52646: 535 Incorrect authentication data (set_id=services)193.234.119.192661886mK  -e) ossec13001gSFExim Auth failed2025-03-17 04:10:06 dovecot_plain authenticator failed for ([121.147.25.111]) [121.147.25.111]:34738: 535 Incorrect authentication data (set_id=services@heipowersystem.com)121.147.25.1111835841bJ  -S% ossec13001gMExim Auth failed2025-03-17 03:45:32 dovecot_login authenticator failed for (nyaystambh.com) [60.2.243.174]:51438: 535 Incorrect authentication data (set_id=support@nyaystambh.com)60.2.243.1741814991SI  -5% ossec13001gMiExim Auth failed2025-03-17 03:45:04 dovecot_login authenticator failed for (nyaystambh.com) [60.2.243.174]:48240: 535 Incorrect authentication data (set_id=nologin)60.2.243.1741814991ZH  -=+ ossec13001gIpExim Auth failed2025-03-17 03:28:07 dovecot_login authenticator failed for ([175.205.126.214]) [175.205.126.214]:51298: 535 Incorrect authentication data (set_id=sales)175.205.126.2141835841   ( : C gig  -e! ossec13001g\Exim Auth failed2025-03-17 12:29:40 dovecot_plain authenticator failed for ([45.6.80.40]) [45.6.80.40]:35960: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)45.6.80.403469034~f Qc' ossec11000gLogin failed on the cpanel service[2025-03-17 12:06:12 +0530] info [cpaneld] 64.23.208.123 - msnews24in "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user msnews24in (has_cpuser_file failed)64.23.208.1236252001e  -') ossec13001g׷Exim Auth failed2025-03-17 11:19:27 dovecot_plain authenticator failed for (mobile-166-195-193-083.mycingular.net) [166.195.193.83]:44830: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)166.195.193.836252001gd  -[' ossec13001g׶oExim Auth failed2025-03-17 11:13:11 dovecot_plain authenticator failed for ([218.4.205.242]) [218.4.205.242]:52337: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)218.4.205.2421814991zc  U[% ossec11001g׬Deferred login on the cpanel service[2025-03-17 10:31:01 +0530] info [webmaild] 49.35.180.41 - kps@amplifypowerglobal.com "POST /cpsess4102068514/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [49.35.172.63] != Current IP Address [49.35.180.41]49.35.180.411269750cb  U)) ossec11001gקDeferred login on the cpanel service[2025-03-17 10:11:03 +0530] info [cpaneld] 182.68.225.240 - techno "GET /cpsess2637736342/frontend/jupiter/filemanager/index.html HTTP/1.1" DEFERRED LOGIN cpaneld: cookie ip check: IP address has changed: IP Address [171.79.183.59] != Current IP Address [182.68.225.240]182.68.225.2401269750Za  -A' ossec13001gןExim Auth failed2025-03-17 09:36:14 dovecot_plain authenticator failed for vps-0aeff849.vps.ovh.ca [51.222.206.10]:44894: 535 Incorrect authentication data (set_id=sales)51.222.206.106251999j`  -_) ossec13001gןExim Auth failed2025-03-17 09:35:51 dovecot_plain authenticator failed for ([193.234.119.53]) [193.234.119.53]:36424: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)193.234.119.532661886%_ 3O' ossec11301gכNew FTP connection.Mar 17 09:18:25 vm1 pure-ftpd[737667]: (?@212.83.190.55) [INFO] New connection from 212.83.190.55212.83.190.553017382s^  -u' ossec13001gכ^Exim Auth failed2025-03-17 09:17:41 dovecot_plain authenticator failed for 46-10-103-204.ip.btc-net.bg [46.10.103.204]:41540: 535 Incorrect authentication data (set_id=services@heipowersystem.com)46.10.103.204732800j]  -_) ossec13001gזExim Auth failed2025-03-17 08:58:41 dovecot_login authenticator failed for ([114.250.93.159]) [114.250.93.159]:51669: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)114.250.93.1591814991d\  -U' ossec13001gזExim Auth failed2025-03-17 08:59:03 dovecot_login authenticator failed for (228.10.245.49.unknown.m1.com.sg) [49.245.10.228]:52887: 535 Incorrect authentication data (set_id=sales)49.245.10.2281880251'[  3S) ossec11301gו9New FTP connection.Mar 17 08:51:27 vm1 pure-ftpd[731467]: (?@199.45.154.119) [INFO] New connection from 199.45.154.119199.45.154.1196252001KZ  =+ ossec13008gבMail Reciepient rejected2025-03-17 08:36:24 H=(mail.westerndancecompany.com) [165.154.228.195]:57843 F= rejected RCPT : Rejected relay attempt: '165.154.228.195' From: 'okxkhc@westerndancecompany.com' To: 'goofile@fastmail.com'165.154.228.1951643084rY  -q' ossec13001g׊-Exim Auth failed2025-03-17 08:04:20 dovecot_plain authenticator failed for wsip-174-79-91-142.br.br.cox.net [174.79.91.142]:59821: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)174.79.91.1426252001 <$  8 M e<Zx  -?) ossec13001gExim Auth failed2025-03-17 14:26:41 dovecot_plain authenticator failed for ([95.167.250.158]) [95.167.250.158]:52912: 535 Incorrect authentication data (set_id=services)95.167.250.1582017370jw  -a' ossec13001goExim Auth failed2025-03-17 14:20:54 dovecot_login authenticator failed for syn-035-130-111-098.biz.spectrum.com [35.130.111.98]:36795: 535 Incorrect authentication data (set_id=services)35.130.111.986252001yv  -' ossec13001gIExim Auth failed2025-03-17 14:20:17 dovecot_login authenticator failed for (rw-00130-94.59.137.rcil.gov.in) [137.59.94.130]:42188: 535 Incorrect authentication data (set_id=services@heipowersystem.com)137.59.94.1301269750Vu  -7) ossec13001gQExim Auth failed2025-03-17 14:11:51 dovecot_login authenticator failed for ([210.245.34.177]) [210.245.34.177]:55220: 535 Incorrect authentication data (set_id=info)210.245.34.1771562822kt  -c' ossec13001g*Exim Auth failed2025-03-17 14:11:14 dovecot_login authenticator failed for ([158.140.32.93]) [158.140.32.93]:45777: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)158.140.32.936252001bs  -O) ossec13001gSExim Auth failed2025-03-17 13:54:50 dovecot_login authenticator failed for ([183.52.221.182]) [183.52.221.182]:55001: 535 Incorrect authentication data (set_id=vikas.khandelwal)183.52.221.1821814991nr  -m% ossec13001gDExim Auth failed2025-03-17 13:54:34 dovecot_login authenticator failed for ([194.28.91.40]) [194.28.91.40]:34219: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)194.28.91.40690791]q  -K# ossec13001gExim Auth failed2025-03-17 13:14:10 dovecot_plain authenticator failed for ([1.241.64.92]) [1.241.64.92]:58783: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)1.241.64.921835841|p  -+ ossec13001gһExim Auth failed2025-03-17 13:13:54 dovecot_plain authenticator failed for ([103.186.221.174]) [103.186.221.174]:35044: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)103.186.221.1741269750Zo  -=+ ossec13001geExim Auth failed2025-03-17 13:08:12 dovecot_plain authenticator failed for ([180.188.143.166]) [180.188.143.166]:43181: 535 Incorrect authentication data (set_id=sales)180.188.143.1661819730dn  -W% ossec13001gCExim Auth failed2025-03-17 13:07:39 dovecot_plain authenticator failed for ([193.93.237.8]) [193.93.237.8]:50502: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)193.93.237.82017370gm  -[' ossec13001gvExim Auth failed2025-03-17 12:51:26 dovecot_plain authenticator failed for syn-075-080-100-185.res.spectrum.com [75.80.100.185]:37506: 535 Incorrect authentication data (set_id=sales)75.80.100.1856252001`l  -S# ossec13001gXExim Auth failed2025-03-17 12:50:55 dovecot_plain authenticator failed for ([91.75.7.237]) [91.75.7.237]:55328: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)91.75.7.237290557\k  -G% ossec13001gbExim Auth failed2025-03-17 12:46:48 dovecot_login authenticator failed for ([20.83.155.49]) [20.83.155.49]:48564: 535 Incorrect authentication data (set_id=vikas.khandelwal)20.83.155.496252001rj  -q' ossec13001gQExim Auth failed2025-03-17 12:46:32 dovecot_login authenticator failed for ([103.187.79.19]) [103.187.79.19]:58930: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)103.187.79.191269750.i  =W) ossec13008gMail Reciepient rejected2025-03-17 12:31:24 H=srv733800.hstgr.cloud (ubuntu-cloudpanel.localhost) [148.135.137.14]:41792 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 CV=no F= rejected RCPT : Sender verify failed148.135.137.141269750Xh  -C# ossec13001gqExim Auth failed2025-03-17 12:30:00 dovecot_plain authenticator failed for ([95.0.252.72]) [95.0.252.72]:50110: 535 Incorrect authentication data (set_id=vikas.khandelwal)95.0.252.72298795 wg $-Cewj  -_) ossec13001gExim Auth failed2025-03-17 17:30:25 dovecot_login authenticator failed for ([185.130.158.98]) [185.130.158.98]:46261: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)185.130.158.982635167Z  -=+ ossec13001gExim Auth failed2025-03-17 17:30:42 dovecot_login authenticator failed for ([103.252.219.223]) [103.252.219.223]:58810: 535 Incorrect authentication data (set_id=sales)103.252.219.2231269750f  -W) ossec13001g Exim Auth failed2025-03-17 17:25:37 dovecot_login authenticator failed for ([109.70.203.114]) [109.70.203.114]:53022: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)109.70.203.1143175395s  -u% ossec13001g Exim Auth failed2025-03-17 17:25:21 dovecot_login authenticator failed for ([2.63.169.110]) [2.63.169.110]:33286: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)2.63.169.1102017370s  -q) ossec13001gExim Auth failed2025-03-17 16:29:20 dovecot_plain authenticator failed for (207.122.87.116.starhub.net.sg) [116.87.122.207]:38632: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)116.87.122.2071880251y  -}) ossec13001glExim Auth failed2025-03-17 16:28:52 dovecot_plain authenticator failed for ([210.94.189.169]) [210.94.189.169]:57998: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)210.94.189.1691835841j  -_) ossec13001gExim Auth failed2025-03-17 16:22:43 dovecot_plain authenticator failed for ([175.214.52.214]) [175.214.52.214]:65428: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)175.214.52.2141835841p  -m' ossec13001gExim Auth failed2025-03-17 16:08:24 dovecot_login authenticator failed for (thepsindustries.com) [58.240.171.59]:42528: 535 Incorrect authentication data (set_id=webmaster@thepsindustries.com)58.240.171.591814991Z  -A' ossec13001gExim Auth failed2025-03-17 16:07:59 dovecot_login authenticator failed for (thepsindustries.com) [58.240.171.59]:60516: 535 Incorrect authentication data (set_id=nologin)58.240.171.591814991b  -O) ossec13001g.Exim Auth failed2025-03-17 15:45:08 dovecot_plain authenticator failed for ([121.128.84.224]) [121.128.84.224]:56662: 535 Incorrect authentication data (set_id=vikas.khandelwal)121.128.84.2241835841l  -i# ossec13001gExim Auth failed2025-03-17 15:44:50 dovecot_plain authenticator failed for ([1.83.169.63]) [1.83.169.63]:37116: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)1.83.169.631814991p~  -o' ossec13001gExim Auth failed2025-03-17 15:38:59 dovecot_login authenticator failed for (78.188.102.28.static.ttnet.com.tr) [78.188.102.28]:58144: 535 Incorrect authentication data (set_id=vikas.khandelwal)78.188.102.28298795r}  -q' ossec13001gExim Auth failed2025-03-17 15:38:41 dovecot_login authenticator failed for ([46.148.139.39]) [46.148.139.39]:59550: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)46.148.139.392017370m|  -g' ossec13001gExim Auth failed2025-03-17 15:30:09 dovecot_login authenticator failed for (fablixsolutions.com) [111.207.12.99]:40766: 535 Incorrect authentication data (set_id=office@fablixsolutions.com)111.207.12.991814991Z{  -A' ossec13001gExim Auth failed2025-03-17 15:29:44 dovecot_login authenticator failed for (fablixsolutions.com) [111.207.12.99]:37674: 535 Incorrect authentication data (set_id=nologin)111.207.12.991814991'z  3S) ossec11301gNew FTP connection.Mar 17 14:44:20 vm1 pure-ftpd[810751]: (?@147.45.112.185) [INFO] New connection from 147.45.112.185147.45.112.1852134431jy  -a' ossec13001gExim Auth failed2025-03-17 14:26:32 dovecot_plain authenticator failed for ([175.202.82.16]) [175.202.82.16]:52986: 535 Incorrect authentication data (set_id=services@heipowersystem.com)175.202.82.161835841 X$. E   7 Iq*0XT  -7% ossec13001g,\Exim Auth failed2025-03-17 19:36:19 dovecot_plain authenticator failed for ([98.70.127.17]) [98.70.127.17]:40002: 535 Incorrect authentication data (set_id=services)98.70.127.171269750v  -{% ossec13001g,NExim Auth failed2025-03-17 19:36:04 dovecot_plain authenticator failed for 1-34-162-249.hinet-ip.hinet.net [1.34.162.249]:57892: 535 Incorrect authentication data (set_id=services@heipowersystem.com)1.34.162.2491668284U  -9% ossec13001g%Exim Auth failed2025-03-17 19:08:08 dovecot_login authenticator failed for ([60.2.203.254]) [60.2.203.254]:42741: 535 Incorrect authentication data (set_id=admission)60.2.203.2541814991s  -q) ossec13001g%Exim Auth failed2025-03-17 19:07:40 dovecot_login authenticator failed for ([191.59.176.133]) [191.59.176.133]:40426: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)191.59.176.1333469034f  -W) ossec13001gExim Auth failed2025-03-17 18:22:04 dovecot_plain authenticator failed for ([120.157.255.25]) [120.157.255.25]:34272: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)120.157.255.252077456   -' ossec13001gExim Auth failed2025-03-17 18:21:42 dovecot_plain authenticator failed for syn-072-177-091-103.res.spectrum.com [72.177.91.103]:44054: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)72.177.91.1036252001'  3S) ossec11301gNew FTP connection.Mar 17 18:21:16 vm1 pure-ftpd[858303]: (?@182.71.140.194) [INFO] New connection from 182.71.140.194182.71.140.1941269750a  -K+ ossec13001gExim Auth failed2025-03-17 18:16:05 dovecot_plain authenticator failed for (106.51.70.231.actcorp.in) [180.151.254.218]:50554: 535 Incorrect authentication data (set_id=sales)180.151.254.2181269750l  -c+ ossec13001gsExim Auth failed2025-03-17 18:15:38 dovecot_plain authenticator failed for ([195.133.158.175]) [195.133.158.175]:38256: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)195.133.158.175294640T  -5' ossec13001gExim Auth failed2025-03-17 18:00:54 dovecot_plain authenticator failed for ([60.15.178.174]) [60.15.178.174]:56585: 535 Incorrect authentication data (set_id=sales)60.15.178.1741814991j  -_) ossec13001gExim Auth failed2025-03-17 18:00:37 dovecot_plain authenticator failed for ([121.189.226.81]) [121.189.226.81]:37130: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)121.189.226.811835841Z  -E# ossec13001gExim Auth failed2025-03-17 17:42:15 dovecot_plain authenticator failed for vps-74fbfdbe.vps.ovh.net [5.196.8.180]:34616: 535 Incorrect authentication data (set_id=services)5.196.8.1803017382w  -{' ossec13001gExim Auth failed2025-03-17 17:41:56 dovecot_plain authenticator failed for (111-86-33-194.intelcom-ug.ru) [194.33.87.111]:58082: 535 Incorrect authentication data (set_id=services@heipowersystem.com)194.33.87.11120173701  =[+ ossec13008gMail Reciepient rejected2025-03-17 17:39:28 H=(mail.rokamauka.com) [165.154.210.114]:59247 F= rejected RCPT : Rejected relay attempt: '165.154.210.114' From: 'xsawjket@rokamauka.com' To: 'goofile@fastmail.com'165.154.210.1141694008e  -S+ ossec13001gExim Auth failed2025-03-17 17:38:13 dovecot_plain authenticator failed for ([121.204.171.142]) [121.204.171.142]:35590: 535 Incorrect authentication data (set_id=vikas.khandelwal)121.204.171.1421814991r  -q' ossec13001gExim Auth failed2025-03-17 17:37:54 dovecot_plain authenticator failed for ([138.122.98.22]) [138.122.98.22]:36003: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)138.122.98.223996063X  -?% ossec13001gkExim Auth failed2025-03-17 17:37:06 dovecot_login authenticator failed for (thepsindustries.com) [60.2.243.174]:41438: 535 Incorrect authentication data (set_id=nologin)60.2.243.1741814991 8 4=\T+  -5' ossec13001gIExim Auth failed2025-03-17 21:41:41 dovecot_login authenticator failed for (rokamauka.com) [58.240.171.59]:44098: 535 Incorrect authentication data (set_id=nologin)58.240.171.591814991]*  -K# ossec13001gIExim Auth failed2025-03-17 21:41:23 dovecot_plain authenticator failed for ([14.98.28.43]) [14.98.28.43]:50718: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)14.98.28.431269750s)  -u% ossec13001gIExim Auth failed2025-03-17 21:41:12 dovecot_plain authenticator failed for ([50.43.62.166]) [50.43.62.166]:57658: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)50.43.62.1666252001Z(  -=+ ossec13001gH(Exim Auth failed2025-03-17 21:34:55 dovecot_plain authenticator failed for ([103.252.219.223]) [103.252.219.223]:52892: 535 Incorrect authentication data (set_id=sales)103.252.219.2231269750g'  -[' ossec13001gHExim Auth failed2025-03-17 21:34:37 dovecot_plain authenticator failed for ([136.62.72.219]) [136.62.72.219]:49492: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)136.62.72.2196252001*&  3W+ ossec11301gG~New FTP connection.Mar 17 21:32:06 vm1 pure-ftpd[899354]: (?@147.185.132.103) [INFO] New connection from 147.185.132.103147.185.132.1036252001Q%  =+ ossec13008gGdMail Reciepient rejected2025-03-17 21:31:39 H=(mail.westerndancecompany.com) [165.154.227.155]:65110 F= rejected RCPT : Rejected relay attempt: '165.154.227.155' From: 'zusntdkwu@westerndancecompany.com' To: 'goofile@fastmail.com'165.154.227.1551668284M$  -+# ossec13001gEbExim Auth failed2025-03-17 21:23:05 dovecot_login authenticator failed for ([81.22.58.11]) [81.22.58.11]:44643: 535 Incorrect authentication data (set_id=info)81.22.58.112017370x#  -}' ossec13001gEVExim Auth failed2025-03-17 21:22:53 dovecot_login authenticator failed for ool-45734cba.dyn.optonline.net [69.115.76.186]:47246: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)69.115.76.1866252001"  W) ossec9708gA{Dovecot Aborted Login with empty userMar 17 21:06:26 vm1 dovecot[611135]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=87.236.176.130, lip=103.74.54.108, TLS, session=87.236.176.1302635167X!  -C# ossec13001g?>Exim Auth failed2025-03-17 20:56:53 dovecot_plain authenticator failed for ([5.30.215.71]) [5.30.215.71]:45763: 535 Incorrect authentication data (set_id=vikas.khandelwal)5.30.215.71290557o  -m% ossec13001g?.Exim Auth failed2025-03-17 20:56:37 dovecot_plain authenticator failed for ([5.188.96.157]) [5.188.96.157]:33612: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)5.188.96.1572017370]  -C+ ossec13001g? Exim Auth failed2025-03-17 20:56:04 dovecot_login authenticator failed for ([109.191.151.161]) [109.191.151.161]:56996: 535 Incorrect authentication data (set_id=services)109.191.151.1612017370m  -e) ossec13001g?Exim Auth failed2025-03-17 20:55:53 dovecot_login authenticator failed for ([223.220.167.38]) [223.220.167.38]:57708: 535 Incorrect authentication data (set_id=services@heipowersystem.com)223.220.167.381814991$  3O' ossec11301g7New FTP connection.Mar 17 20:24:53 vm1 pure-ftpd[884815]: (?@66.240.192.85) [INFO] New connection from 66.240.192.8566.240.192.856252001X  -;) ossec13001g0Exim Auth failed2025-03-17 19:54:43 dovecot_plain authenticator failed for ([159.223.250.131]) [161.35.200.202]:50324: 535 Incorrect authentication data (set_id=sales)161.35.200.2022921044h  -]' ossec13001g0Exim Auth failed2025-03-17 19:54:26 dovecot_plain authenticator failed for ([84.149.112.221]) [195.52.244.84]:34128: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)195.52.244.842921044 s ~ #Naa{]W<  -9) ossec13001gmoExim Auth failed2025-03-18 00:13:59 dovecot_login authenticator failed for (nyaystambh.com) [124.160.63.122]:39819: 535 Incorrect authentication data (set_id=nologin)124.160.63.1221814991;  ?/ ossec1008gkProcess exiting (killed).Mar 18 00:05:55 vm1 spamd[612323]: spamd: server killed by SIGTERM, shutting down:  W% ossec9708ggDovecot Aborted Login with empty userMar 17 23:49:25 vm1 dovecot[611135]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 2 secs): user=<>, rip=71.6.134.233, lip=103.74.54.108, TLS, session=71.6.134.2336252001b9  -S' ossec13001gd-Exim Auth failed2025-03-17 23:34:29 dovecot_plain authenticator failed for ([185.167.56.70]) [185.167.56.70]:38726: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)185.167.56.70617790|8  -+ ossec13001gdExim Auth failed2025-03-17 23:34:14 dovecot_plain authenticator failed for ([189.218.168.228]) [189.218.168.228]:39150: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)189.218.168.2283996063i7  -_) ossec13001gbExim Auth failed2025-03-17 23:27:42 dovecot_plain authenticator failed for ([147.235.226.51]) [147.235.226.51]:42120: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)147.235.226.51294640Q6  -1% ossec13001g_rExim Auth failed2025-03-17 23:14:18 dovecot_plain authenticator failed for ([58.96.247.71]) [58.96.247.71]:48608: 535 Incorrect authentication data (set_id=sales)58.96.247.711880251j5  -_) ossec13001g_bExim Auth failed2025-03-17 23:14:01 dovecot_plain authenticator failed for ([121.168.210.98]) [121.168.210.98]:41935: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)121.168.210.981835841g4  -[' ossec13001g_TExim Auth failed2025-03-17 23:13:47 dovecot_plain authenticator failed for ([222.222.51.25]) [222.222.51.25]:57864: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)222.222.51.251814991W3  -;' ossec13001gZExim Auth failed2025-03-17 22:55:08 dovecot_plain authenticator failed for ([101.168.1.233]) [101.168.1.233]:33500: 535 Incorrect authentication data (set_id=services)101.168.1.2332077456j2  -a' ossec13001gZExim Auth failed2025-03-17 22:54:45 dovecot_plain authenticator failed for ([221.157.85.22]) [221.157.85.22]:54114: 535 Incorrect authentication data (set_id=services@heipowersystem.com)221.157.85.221835841d1  -Q+ ossec13001gZExim Auth failed2025-03-17 22:53:32 dovecot_login authenticator failed for 184.sub-166-143-153.myvzw.com [166.143.153.184]:39232: 535 Incorrect authentication data (set_id=sales)166.143.153.1846252001g0  -[' ossec13001gZuExim Auth failed2025-03-17 22:53:00 dovecot_login authenticator failed for ([193.95.21.147]) [193.95.21.147]:55012: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)193.95.21.1472464461b/  -O) ossec13001gYExim Auth failed2025-03-17 22:49:49 dovecot_plain authenticator failed for ([188.244.154.53]) [188.244.154.53]:51912: 535 Incorrect authentication data (set_id=vikas.khandelwal)188.244.154.532017370q.  -o' ossec13001gYExim Auth failed2025-03-17 22:49:36 dovecot_plain authenticator failed for ([58.250.157.83]) [58.250.157.83]:2066: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)58.250.157.831814991!-  3K% ossec11301gU2New FTP connection.Mar 17 22:30:33 vm1 pure-ftpd[911990]: (?@64.227.70.84) [INFO] New connection from 64.227.70.8464.227.70.842750405d,  -U' ossec13001gIExim Auth failed2025-03-17 21:42:11 dovecot_login authenticator failed for (rokamauka.com) [58.240.171.59]:48662: 535 Incorrect authentication data (set_id=webmaster@rokamauka.com)58.240.171.591814991 y ) H g:HcyfN  -[' ossec13001gؐExim Auth failed2025-03-18 02:44:32 dovecot_plain authenticator failed for ([185.167.56.70]) [185.167.56.70]:41178: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)185.167.56.70617790aM  -O) ossec13001gؐExim Auth failed2025-03-18 02:44:09 dovecot_login authenticator failed for athedsl-4393708.home.otenet.gr [79.130.122.220]:38754: 535 Incorrect authentication data (set_id=info)79.130.122.220390903nL  -g) ossec13001gؐExim Auth failed2025-03-18 02:44:01 dovecot_login authenticator failed for ([222.160.99.210]) [222.160.99.210]:56593: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)222.160.99.2101814991'K  3S) ossec11301g؋New FTP connection.Mar 18 02:23:48 vm1 pure-ftpd[963811]: (?@198.235.24.175) [INFO] New connection from 198.235.24.175198.235.24.1756252001_J  -M% ossec13001g؊ Exim Auth failed2025-03-18 02:16:02 dovecot_login authenticator failed for 114-34-52-26.hinet-ip.hinet.net [114.34.52.26]:50656: 535 Incorrect authentication data (set_id=info)114.34.52.261668284nI  -g) ossec13001g؉Exim Auth failed2025-03-18 02:15:49 dovecot_login authenticator failed for ([193.234.119.73]) [193.234.119.73]:39852: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)193.234.119.732661886xH  -}' ossec13001g؉Exim Auth failed2025-03-18 02:15:05 dovecot_login authenticator failed for p165098-obmd01.osaka.ocn.ne.jp [61.113.228.97]:43628: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)61.113.228.971861060G  -) ossec13001g؈Exim Auth failed2025-03-18 02:07:28 dovecot_plain authenticator failed for (207.122.87.116.starhub.net.sg) [116.87.122.207]:35342: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)116.87.122.2071880251'F  3S) ossec11301g؂lNew FTP connection.Mar 18 01:43:32 vm1 pure-ftpd[954929]: (?@87.236.176.185) [INFO] New connection from 87.236.176.18587.236.176.1852635167$E  3O' ossec11301g~New FTP connection.Mar 18 01:28:28 vm1 pure-ftpd[951722]: (?@4.236.187.220) [INFO] New connection from 4.236.187.2204.236.187.2206252001WD -=# ossec13001g} Exim Auth failed2025-03-18 01:20:32 dovecot_login authenticator failed for (fablixsolutions.com) [14.18.77.99]:49386: 535 Incorrect authentication data (set_id=nologin)14.18.77.991814991SC  -5' ossec13001gyExim Auth failed2025-03-18 01:05:34 dovecot_plain authenticator failed for ([87.200.73.165]) [87.200.73.165]:41031: 535 Incorrect authentication data (set_id=sales)87.200.73.165290557aB  -S# ossec13001gybExim Auth failed2025-03-18 01:04:58 dovecot_plain authenticator failed for ([1.83.169.63]) [1.83.169.63]:47170: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)1.83.169.631814991A  3G# ossec11301gw&New FTP connection.Mar 18 00:55:24 vm1 pure-ftpd[944782]: (?@71.6.232.28) [INFO] New connection from 71.6.232.2871.6.232.286252001]@  -C+ ossec13001gu5Exim Auth failed2025-03-18 00:47:09 dovecot_plain authenticator failed for ([111.194.239.233]) [111.194.239.233]:37360: 535 Incorrect authentication data (set_id=services)111.194.239.2331814991p?  -i+ ossec13001guExim Auth failed2025-03-18 00:46:41 dovecot_plain authenticator failed for ([123.116.142.131]) [123.116.142.131]:36777: 535 Incorrect authentication data (set_id=services@heipowersystem.com)123.116.142.1311814991s>  -q) ossec13001gsExim Auth failed2025-03-18 00:41:15 dovecot_login authenticator failed for ([138.75.241.225]) [138.75.241.225]:60315: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)138.75.241.2251880251h=  -Y+ ossec13001gmExim Auth failed2025-03-18 00:14:25 dovecot_login authenticator failed for (nyaystambh.com) [202.107.197.211]:34924: 535 Incorrect authentication data (set_id=service@nyaystambh.com)202.107.197.2111814991 *\~tj`VLB8.$zpf\H>4*   v l b X N D : 0 &    ~ t j ` V L B 8 . $    z p f \ R H > 4 *  vlbXND:0&|rh^TJ@6,"xnZdPF<2( ~tj`VLB8.$zpf\ | r h ^ T J @ 6 , "    x n d Z P F < 2 (   RRH>4*  vlbXND:0& gO4,@ gN,? gK ,> gJ,= gI,< gI,; gH,: gH,9 gG,8 gG,7 gDS,6 gD;,5 gBB,4 gB.,3 g={,2 g=i,1 g=],0 g=K,/ g;,. g;,- g7,, g7,+ g3 ,* g2,) g2,( g2,' g2b,& g2P,% g2 ,$ g0>,# g02," g00,! g0$, g+, g+, g%, g$, g$, g , g <, g, g, g, gw, g#, g, gv, g, g, g , g 0, g, g, g, g, gJ, g8, g, g, g, g, gn, g, g, g., g + gg+ g[+ g+ g9+ g,+ g4+ g+ g+ gi+ gi+ gJ+ g<+ gݼ+ gݮ+ gڳ+ gA+ g!+ g+ gN+ gN+ gϼ+ gk+ gO+ g6+ g+ gؽ#+ gؼ+ gز+ gج+ gث+ gت+ gت+ gا+ gا+ gا+ gإ+ gأw+ gء+ gء+ gؠ&+ gؠ+ g؟+ g؟+ g؞+ g؞+ gؘ,+ gؒU+ gؐ+ gؐ+ gؐ+ gؐ+ g؋+ g؊ + g؉+ g؉+ g؈+ g؂l+ g~+ g} + gy+ gyb+ gw&+ gu5+ gu+ gs+ gm+ gmo+ gk+ gg+ gd-+ gd+ gb+ g_r+ g_b+ g_T+ gZ+ gZ+ gZ+ gZu+ gY+ gY+ gU2+ gI+ gI+ gI+ gI+ gH(+ gH+ gG~+ gGd+ gEb+ gEV+ gA{+ g?>+ g?.+ g? + g?+ g7+ g0+ g0+ g,\+ g,N+ g%+ g%+ gl,k gl,j gk,i gk,h gi,g gi,f gi,e gi,d gh,c gh,b gh,a gf,` gf,_ ge*,^ ge,] gdz,\ gdf,[ gdP,Z gcx,Y gcP,X g`,W g^,V g^~,U g^l,T g\,S g\,R gW,Q gW,P gWd,O gWR,N gV,M gVj,L gV,K gU,J gU,I gU,H gT,G gT ,E gS,F gS,D gS,C gQ,B gP|,A g+ g+ g+ g+ gs+ g+ g+ g+ g+ g+ g+ g+ gk+ g+ g+ g + g + g+ gl+ g+ g+ g+ g.+ g+ g+~ g+} g+| g+{ g+z g+x g+y go+w gI+v gQ+u g*+t gS+s gD+r g+q gһ+p ge+o gC+n gv+m gl,l gX+l gb+k gQ+j g+i gq+h g\+g g+f g׷+e g׶o+d g׬+c gק+b gן+a gן+` gכ+_ gכ^+^ gז+\ gז+] gו9+[ gב+Z g׊-+Y g׊ +X g׈+W g׈+V gׇ+U gׇ+T gׇo+R gׇc+S gׇ+Q g׆+P gt-+O gn+N gnj+M gSP+L gSF+K gM+J gMi+I gIp+H gIF+G gB0+F gB+E g@+D g<+C y s p o k kc`]WOLKEr'20.122.101.26BLACKggmBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests6252001zelocalq'20.10.181.200BLACKg烞gTBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests6252001 localp)20.242.108.167BLACKgdg5Blacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests6252001llocal~o%13.74.101.72BLACKgXg)Blacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests2963597 JeHlocal}n#20.161.5.26BLACKgQg"Blacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests6252001localm'20.10.177.152BLACKg?FgFBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests6252001 local~l%4.185.55.150BLACKg)gBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests29210447localk'40.87.152.175BLACKg#gBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests2963597(Wlocalj)172.172.74.123BLACKggBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests6252001J{local}i%65.108.2.171BLACKggBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests660013Allocalh)172.200.58.223BLACKggBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests6252001:local~g%13.79.58.162BLACKgеg١Blacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests2963597 O:localf'13.69.217.194BLACKgɖgٚBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests2963597 Elocal~e%81.167.26.57BLACKg gٚ Blacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests3144096Q9locald'52.169.127.35BLACKggdBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests29635974#localc'13.69.150.135BLACKggXBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests2963597 Elocalb)209.38.166.186BLACKggXBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests2635167&local}a#4.185.55.70BLACKglg=Blacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests29210447Flocal}`#13.79.58.84BLACKgYg*Blacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests2963597 O:Tlocal_)74.225.149.205BLACKgPg!Blacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests1269750Jlocal}^#13.79.50.81BLACKg(6g6Blacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests2963597 O2Qlocal}]#13.79.2.245BLACKgDgDBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests2963597 Olocal~\%13.79.17.110BLACKggBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests2963597 Onlocal['74.225.150.56BLACKggBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests1269750J8local~Z%13.79.60.209BLACKg gۏBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests2963597 O<localY)84.247.172.191BLACKggBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests2921044TlocalX'52.169.183.15BLACKggŶBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests29635974localW'52.169.183.46BLACKggؿBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests29635974.localV)20.242.108.188BLACKggجBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests6252001llocal~U%13.68.29.179BLACKg$g؍$Blacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests6252001 Dlocal (  % CLjtz^  -' ossec13001gاExim Auth failed2025-03-18 04:23:27 dovecot_login authenticator failed for syn-024-090-169-209.res.spectrum.com [24.90.169.209]:56902: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)24.90.169.2096252001W]  -9) ossec13001gاExim Auth failed2025-03-18 04:22:52 dovecot_plain authenticator failed for ([193.234.119.76]) [193.234.119.76]:40706: 535 Incorrect authentication data (set_id=sales)193.234.119.762661886z\  -' ossec13001gاExim Auth failed2025-03-18 04:22:20 dovecot_plain authenticator failed for syn-072-177-091-103.res.spectrum.com [72.177.91.103]:59608: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)72.177.91.1036252001$[  3O' ossec11301gإNew FTP connection.Mar 18 04:14:53 vm1 pure-ftpd[988878]: (?@20.171.26.150) [INFO] New connection from 20.171.26.15020.171.26.1506252001vZ  -w) ossec13001gأwExim Auth failed2025-03-18 04:04:29 dovecot_plain authenticator failed for (azteca-comunicaciones.com) [186.148.187.91]:55638: 535 Incorrect authentication data (set_id=services@heipowersystem.com)186.148.187.913686110bY  -O) ossec13001gءExim Auth failed2025-03-18 03:57:13 dovecot_plain authenticator failed for ([116.232.78.150]) [116.232.78.150]:42614: 535 Incorrect authentication data (set_id=vikas.khandelwal)116.232.78.1501814991rX  -q' ossec13001gءExim Auth failed2025-03-18 03:56:57 dovecot_plain authenticator failed for ([217.24.185.98]) [217.24.185.98]:43156: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)217.24.185.982017370^W  -E+ ossec13001gؠ&Exim Auth failed2025-03-18 03:50:21 dovecot_login authenticator failed for ([108.144.195.109]) [108.144.195.109]:41658: 535 Incorrect authentication data (set_id=admission)108.144.195.1096252001sV  -q) ossec13001gؠExim Auth failed2025-03-18 03:50:06 dovecot_login authenticator failed for ([195.122.224.64]) [195.122.224.64]:36064: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)195.122.224.642017370^U  -I' ossec13001g؟Exim Auth failed2025-03-18 03:48:21 dovecot_login authenticator failed for d54c70cda.static.telenet.be [84.199.12.218]:47350: 535 Incorrect authentication data (set_id=sales)84.199.12.2182802361gT  -[' ossec13001g؟Exim Auth failed2025-03-18 03:48:07 dovecot_login authenticator failed for ([154.127.43.35]) [154.127.43.35]:47168: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)154.127.43.352395170ZS  -?) ossec13001g؞Exim Auth failed2025-03-18 03:45:18 dovecot_login authenticator failed for ([183.100.18.224]) [183.100.18.224]:52186: 535 Incorrect authentication data (set_id=services)183.100.18.2241835841xR  -' ossec13001g؞Exim Auth failed2025-03-18 03:44:42 dovecot_login authenticator failed for (host-144-253-28-31.sevstar.net) [31.28.253.144]:51793: 535 Incorrect authentication data (set_id=services@heipowersystem.com)31.28.253.144690791-Q  =S+ ossec13008gؘ,Mail Reciepient rejected2025-03-18 03:16:18 H=(mail.msnews24.in) [165.154.208.196]:64277 F= rejected RCPT : Rejected relay attempt: '165.154.208.196' From: 'dhxkiawyt@msnews24.in' To: 'goofile@fastmail.com'165.154.208.1961668284 P  -' ossec13001gؒUExim Auth failed2025-03-18 02:51:24 dovecot_plain authenticator failed for syn-071-066-157-177.biz.spectrum.com [71.66.157.177]:56395: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)71.66.157.1776252001TO  -5' ossec13001gؐExim Auth failed2025-03-18 02:44:45 dovecot_plain authenticator failed for ([14.29.244.223]) [14.29.244.223]:35764: 535 Incorrect authentication data (set_id=sales)14.29.244.2231814991 CreXK>1$~qdWJ=0# zm`SF9, v i \ O B 5 (     r e X K > 1 $  { n a T G : -   w j ] P C 6 )    s f Y L ? 2 %  |obUH;.!x {naTG:- wj]Pm`SF9,vi\OBC5(k^QD7*6) 62520019 62520019* 62520019! 62520019 62520019 62520019 62520019 62520019 62520019 62520018 62520018 62520018 62520018 62520018 62520018 62520018 62520018 62520018 62520018 62520018 62520018 62520018 62520018s 62520018i 62520018c 62520018V 62520018P 62520018L 62520018K 62520018D 62520018B 62520018" 62520018 62520018 62520018 62520012 62520012 62520012 62520012y 62520012u 62520012q 62520012p 62520012o 62520012]z 62520019 62520019 62520019 62520019 62520019 62520019 62520019 62520019 62520019 62520019 62520019 62520019 62520019 62520019 62520019 62520019t 62520019q 62520019p 62520019o 62520019a 62520019^ 62520019[ 62520019G 62520019: 625200197 625200190 62520019/ 62520018 62520018 62520017 62520017 62520017 62520017 62520017 62520017 62520017 62520017 62520017 62520017 62520017 62520017 62520017 62520017 62520017 62520017 62520017 62520017p 62520017j 62520017i 62520017g 62520017Z 62520017L 62520017K 62520017E 62520017> 625200174 625200173 625200172 625200171 625200170 62520017/ 62520017. 62520017- 62520017, 62520017+ 62520017* 62520017) 62520017! 62520017 62520017 62520017 62520017 62520017 62520017 62520017 62520017 62520016 62520016 62520016 62520016 62520016 62520016 62520016 62520016 62520016 62520016 62520016 62520016 62520016 62520016 62520016 62520016 62520016 62520016 62520016~ 62520016t 62520016a 62520016S 62520016C 62520016= 62520016; 62520016: 625200169 625200166 62520016 62520016 62520016 62520016 62520016 62520016 62520015 62520015 62520015 62520015 62520015 62520015 62520015 62520015 62520015 62520015 62520015 62520015 62520015 62520015 62520015 62520015x 62520015l 62520015j 62520015e 62520015a 62520015U 62520015I 62520015E 62520015A 62520015= 62520015& 62520015 62520014 62520014 62520014 62520014 62520014 62520014 62520014 62520014 62520014 62520014 62520014} 62520014s 62520014= 625200146 62520014 62520013 62520013 62520013 62520013 62520013 62520013 62520013 62520013 62520013 62520013 62520013 62520013 62520013 62520013 62520013 62520013 62520013 62520013 62520013 62520013 62520013 62520013 62520013 62520013 62520013 62520013r 62520013_ 62520013^ 62520013Z 62520013K 62520013? 62520013- 62520013 62520013 62520013 62520013 62520013 62520012 62520012 62520012 62520012 62520012 62520012 k7 : 8 D f,6,*BkSo  -5' ossec13001gAExim Auth failed2025-03-18 07:53:59 dovecot_plain authenticator failed for ([91.75.110.231]) [91.75.110.231]:48078: 535 Incorrect authentication data (set_id=sales)91.75.110.231290557dn  -W% ossec13001g!Exim Auth failed2025-03-18 07:53:28 dovecot_plain authenticator failed for ([27.16.163.70]) [27.16.163.70]:24626: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)27.16.163.701814991~m  - ' ossec13001gExim Auth failed2025-03-18 07:44:05 dovecot_login authenticator failed for 42-200-75-233.static.imsbiz.com [42.200.75.233]:46532: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)42.200.75.2331819730l  = % ossec13008gNMail Reciepient rejected2025-03-18 07:41:26 H=(da.semanta.ir) [45.147.78.99]:49268 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 CV=no F= rejected RCPT : Sender verify failed45.147.78.99130758rk  -q' ossec13001gNExim Auth failed2025-03-18 07:15:50 dovecot_plain authenticator failed for ([219.248.65.30]) [219.248.65.30]:47693: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)219.248.65.301835841%j  3Q' ossec11301gϼNew FTP connection.Mar 18 07:13:23 vm1 pure-ftpd[1028122]: (?@142.93.167.14) [INFO] New connection from 142.93.167.14142.93.167.142921044Zi  -=+ ossec13001gkExim Auth failed2025-03-18 06:12:18 dovecot_plain authenticator failed for ([220.120.224.227]) [220.120.224.227]:40578: 535 Incorrect authentication data (set_id=sales)220.120.224.2271835841dh  -W% ossec13001gOExim Auth failed2025-03-18 06:11:50 dovecot_plain authenticator failed for ([175.4.106.99]) [175.4.106.99]:36397: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)175.4.106.991814991jg  -a' ossec13001g6Exim Auth failed2025-03-18 06:07:10 dovecot_login authenticator failed for (heipowersystem.com) [221.229.216.1]:33208: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)221.229.216.11814991Yf  -?' ossec13001gExim Auth failed2025-03-18 06:06:44 dovecot_login authenticator failed for (heipowersystem.com) [221.229.216.1]:57796: 535 Incorrect authentication data (set_id=nologin)221.229.216.11814991Ze  -?) ossec13001gؽ#Exim Auth failed2025-03-18 05:54:02 dovecot_plain authenticator failed for ([58.210.188.130]) [58.210.188.130]:10981: 535 Incorrect authentication data (set_id=services)58.210.188.1301814991pd  -i+ ossec13001gؼExim Auth failed2025-03-18 05:53:21 dovecot_plain authenticator failed for ([193.234.119.254]) [193.234.119.254]:55048: 535 Incorrect authentication data (set_id=services@heipowersystem.com)193.234.119.2542661886Sc  =+ ossec13008gزMail Reciepient rejected2025-03-18 05:10:13 H=(mail.westerndancecompany.com) [165.154.227.155]:56013 F= rejected RCPT : Rejected relay attempt: '165.154.227.155' From: 'qabcjbvkah@westerndancecompany.com' To: 'goofile@fastmail.com'165.154.227.1551668284'b  3S) ossec11301gجNew FTP connection.Mar 18 04:44:32 vm1 pure-ftpd[995369]: (?@139.162.176.49) [INFO] New connection from 139.162.176.49139.162.176.492921044ya  -}) ossec13001gثExim Auth failed2025-03-18 04:40:39 dovecot_plain authenticator failed for ([120.157.12.107]) [120.157.12.107]:34370: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)120.157.12.1072077456W`  -9) ossec13001gتExim Auth failed2025-03-18 04:34:59 dovecot_plain authenticator failed for ([75.144.210.178]) [75.144.210.178]:40596: 535 Incorrect authentication data (set_id=sales)75.144.210.1786252001j_  -_) ossec13001gتExim Auth failed2025-03-18 04:34:47 dovecot_plain authenticator failed for ([191.59.176.133]) [191.59.176.133]:59464: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)191.59.176.1333469034   # F , =OwS  -5' ossec13001g.Exim Auth failed2025-03-18 09:44:36 dovecot_plain authenticator failed for ([185.167.59.53]) [185.167.59.53]:52832: 535 Incorrect authentication data (set_id=sales)185.167.59.53617790g  -[' ossec13001g Exim Auth failed2025-03-18 09:44:02 dovecot_plain authenticator failed for ([106.37.103.82]) [106.37.103.82]:33813: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)106.37.103.821814991T~  -5' ossec13001ggExim Auth failed2025-03-18 09:32:45 dovecot_plain authenticator failed for ([219.248.65.30]) [219.248.65.30]:50500: 535 Incorrect authentication data (set_id=sales)219.248.65.301835841j}  -_) ossec13001g[Exim Auth failed2025-03-18 09:32:34 dovecot_plain authenticator failed for ([183.101.143.82]) [183.101.143.82]:38379: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)183.101.143.821835841R|  -3% ossec13001gExim Auth failed2025-03-18 09:31:19 dovecot_login authenticator failed for (rokamauka.com) [60.2.243.174]:35570: 535 Incorrect authentication data (set_id=nologin)60.2.243.1741814991u{  -u) ossec13001g9Exim Auth failed2025-03-18 09:06:24 dovecot_plain authenticator failed for ([210.222.15.113]) [210.222.15.113]:54280: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)210.222.15.1131835841z  W' ossec9708g,Dovecot Aborted Login with empty userMar 18 08:53:22 vm1 dovecot[611135]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=87.236.176.29, lip=103.74.54.108, TLS, session=87.236.176.292635167Ly -%% ossec13001g4Exim Auth failed2025-03-18 08:44:59 dovecot_login authenticator failed for (iZgw83jthqqae34ms8ozmgZ) [8.209.75.155]:51070: 535 Incorrect authentication data8.209.75.1552921044yx -% ossec13001gExim Auth failed2025-03-18 08:42:07 dovecot_login authenticator failed for (iZgw83jthqqae34ms8ozmgZ) [8.209.75.155]:54426: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)8.209.75.1552921044qw -o% ossec13001gExim Auth failed2025-03-18 08:42:02 dovecot_login authenticator failed for (iZgw83jthqqae34ms8ozmgZ) [8.209.75.155]:44466: 535 Incorrect authentication data (set_id=services@heipowersystem.com)8.209.75.1552921044(v  3U) ossec11301giNew FTP connection.Mar 18 08:37:20 vm1 pure-ftpd[1046235]: (?@164.92.199.123) [INFO] New connection from 164.92.199.123164.92.199.1232921044(u  3U) ossec11301giNew FTP connection.Mar 18 08:37:21 vm1 pure-ftpd[1046237]: (?@161.35.201.165) [INFO] New connection from 161.35.201.165161.35.201.1652921044Yt  -;+ ossec13001gJExim Auth failed2025-03-18 08:24:02 dovecot_login authenticator failed for ([115.247.159.106]) [115.247.159.106]:49668: 535 Incorrect authentication data (set_id=info)115.247.159.1061269750ps  -i+ ossec13001g<Exim Auth failed2025-03-18 08:23:47 dovecot_login authenticator failed for ([114.143.224.97]) [182.156.133.169]:13636: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)182.156.133.1691269750or  -i) ossec13001gݼExim Auth failed2025-03-18 08:13:08 dovecot_login authenticator failed for bb116-14-132-114.singnet.com.sg [116.14.132.114]:45676: 535 Incorrect authentication data (set_id=vikas.khandelwal)116.14.132.1141880251rq  -q' ossec13001gݮExim Auth failed2025-03-18 08:12:53 dovecot_login authenticator failed for ([111.14.104.60]) [111.14.104.60]:41062: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)111.14.104.601814991|p  -+ ossec13001gڳExim Auth failed2025-03-18 08:00:11 dovecot_plain authenticator failed for ([123.210.152.243]) [123.210.152.243]:35990: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)123.210.152.2432077456 : 5 - K W ~  -' ossec13001gExim Auth failed2025-03-18 11:51:30 dovecot_login authenticator failed for dhcp-4-bc-9f-52-b7-f.cpe.i-zoom.net [24.244.93.233]:34916: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)24.244.93.2336251999g  -[' ossec13001g Exim Auth failed2025-03-18 11:33:46 dovecot_plain authenticator failed for ([185.77.238.39]) [185.77.238.39]:37916: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)185.77.238.392017370v  -y' ossec13001g 0Exim Auth failed2025-03-18 11:22:46 dovecot_plain authenticator failed for 217-76-83-103.cust.bredband2.com [217.76.83.103]:32768: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)217.76.83.1032661886o  -m% ossec13001gExim Auth failed2025-03-18 11:07:18 dovecot_login authenticator failed for ([1.224.58.243]) [1.224.58.243]:42202: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)1.224.58.2431835841l  -a+ ossec13001gExim Auth failed2025-03-18 11:07:29 dovecot_login authenticator failed for (106.51.70.231.actcorp.in) [180.151.254.218]:38754: 535 Incorrect authentication data (set_id=vikas.khandelwal)180.151.254.2181269750m  -e) ossec13001gExim Auth failed2025-03-18 11:04:14 dovecot_plain authenticator failed for (nsg-static-218.129.72.182.airtel.in) [182.72.129.218]:38406: 535 Incorrect authentication data (set_id=services)182.72.129.2181269750g  -]% ossec13001gExim Auth failed2025-03-18 11:03:50 dovecot_plain authenticator failed for ([113.8.218.54]) [113.8.218.54]:60129: 535 Incorrect authentication data (set_id=services@heipowersystem.com)113.8.218.541814991Y  -;+ ossec13001gJExim Auth failed2025-03-18 11:01:53 dovecot_login authenticator failed for ([182.163.122.133]) [182.163.122.133]:18445: 535 Incorrect authentication data (set_id=info)182.163.122.1331210997q  -k+ ossec13001g8Exim Auth failed2025-03-18 11:01:35 dovecot_login authenticator failed for ([115.242.200.126]) [115.242.200.126]:40654: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)115.242.200.1261269750U  -9% ossec13001gExim Auth failed2025-03-18 10:26:11 dovecot_login authenticator failed for ([5.59.141.152]) [5.59.141.152]:51698: 535 Incorrect authentication data (set_id=admission)5.59.141.1522017370p  -m' ossec13001gExim Auth failed2025-03-18 10:26:00 dovecot_login authenticator failed for ([112.196.60.13]) [112.196.60.13]:49696: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)112.196.60.131269750^  -K' ossec13001gExim Auth failed2025-03-18 09:50:36 dovecot_login authenticator failed for ([213.55.79.199]) [213.55.79.195]:45566: 535 Incorrect authentication data (set_id=vikas.khandelwal)213.55.79.195337996  -' ossec13001gExim Auth failed2025-03-18 09:50:16 dovecot_login authenticator failed for dhcp-4-bc-9f-52-b7-f.cpe.i-zoom.net [24.244.93.233]:57683: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)24.244.93.2336251999  - ) ossec13001gnExim Auth failed2025-03-18 09:49:56 dovecot_login authenticator failed for p175141-obmd01.osaka.ocn.ne.jp [61.118.250.140]:59930: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)61.118.250.1401861060T -5% ossec13001gExim Auth failed2025-03-18 09:48:24 dovecot_login authenticator failed for (nyaystambh.com) [119.96.131.8]:50400: 535 Incorrect authentication data (set_id=nologin)119.96.131.81814991j  -a' ossec13001gExim Auth failed2025-03-18 09:47:58 dovecot_login authenticator failed for ([88.84.209.146]) [88.84.209.146]:55272: 535 Incorrect authentication data (set_id=services@heipowersystem.com)88.84.209.1462017370  p  12DU~p  -m' ossec13001g0$Exim Auth failed2025-03-18 14:04:43 dovecot_login authenticator failed for ([111.175.39.76]) [111.175.39.76]:36124: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)111.175.39.761814991M  -+# ossec13001g+Exim Auth failed2025-03-18 13:45:49 dovecot_login authenticator failed for ([49.82.36.41]) [49.82.36.41]:43134: 535 Incorrect authentication data (set_id=info)49.82.36.411814991q  -k+ ossec13001g+Exim Auth failed2025-03-18 13:45:37 dovecot_login authenticator failed for ([223.239.130.245]) [223.239.130.245]:12425: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)223.239.130.2451269750S  -3' ossec13001g%Exim Auth failed2025-03-18 13:17:35 dovecot_login authenticator failed for ([85.15.190.172]) [85.15.190.172]:59264: 535 Incorrect authentication data (set_id=info)85.15.190.1722017370k  -c' ossec13001g$Exim Auth failed2025-03-18 13:16:46 dovecot_login authenticator failed for ([101.168.30.19]) [101.168.30.19]:41836: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)101.168.30.192077456j  -_) ossec13001g$Exim Auth failed2025-03-18 13:12:58 dovecot_plain authenticator failed for ([61.191.163.102]) [61.191.163.102]:60692: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)61.191.163.1021814991d  -W% ossec13001g Exim Auth failed2025-03-18 12:58:58 dovecot_login authenticator failed for ([38.175.91.33]) [38.175.91.33]:60384: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)38.175.91.336252001p  -m' ossec13001g <Exim Auth failed2025-03-18 12:56:50 dovecot_login authenticator failed for ([49.124.151.23]) [49.124.151.23]:37042: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)49.124.151.231733045  W!+ ossec9708gDovecot Aborted Login with empty userMar 18 12:55:02 vm1 dovecot[611135]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=185.247.137.151, lip=103.74.54.108, TLS, session=185.247.137.151298795%  3Q' ossec11301gNew FTP connection.Mar 18 12:53:44 vm1 pure-ftpd[1101952]: (?@88.214.25.122) [INFO] New connection from 88.214.25.12288.214.25.1222921044  -% ossec13001gExim Auth failed2025-03-18 12:53:43 dovecot_login authenticator failed for 48.211.41.34.bc.googleusercontent.com [34.41.211.48]:53814: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)34.41.211.486252001"  3M% ossec11301gwNew FTP connection.Mar 18 12:49:17 vm1 pure-ftpd[1100971]: (?@20.83.53.168) [INFO] New connection from 20.83.53.16820.83.53.1686252001o  -g+ ossec13001g#Exim Auth failed2025-03-18 12:18:02 dovecot_login authenticator failed for broadband-178-140-152-209.ip.moscow.rt.ru [178.140.152.209]:59128: 535 Incorrect authentication data (set_id=info)178.140.152.2092017370m  -g) ossec13001gExim Auth failed2025-03-18 12:17:29 dovecot_login authenticator failed for ([102.222.243.28]) [102.222.243.28]:48078: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)102.222.243.28953987A  ={+ ossec13008gvMail Reciepient rejected2025-03-18 12:02:21 H=(mail.fablixsolutions.com) [165.154.226.150]:55050 F= rejected RCPT : Rejected relay attempt: '165.154.226.150' From: 'okqripw@fablixsolutions.com' To: 'goofile@fastmail.com'165.154.226.1501668284G  =+ ossec13008gMail Reciepient rejected2025-03-18 12:00:10 H=(mail.thepsindustries.com) [165.154.213.196]:50643 F= rejected RCPT : Rejected relay attempt: '165.154.213.196' From: 'nedhbeqebn@thepsindustries.com' To: 'goofile@fastmail.com'165.154.213.1963469034 $' R zby{/  -) ossec13001g=KExim Auth failed2025-03-18 15:00:50 dovecot_login authenticator failed for vps-4718093-x.dattaweb.com [149.50.129.189]:40952: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)149.50.129.1893865483V.  -7) ossec13001g;Exim Auth failed2025-03-18 14:54:47 dovecot_login authenticator failed for ([119.195.77.177]) [119.195.77.177]:33317: 535 Incorrect authentication data (set_id=info)119.195.77.1771835841i-  -]) ossec13001g;Exim Auth failed2025-03-18 14:54:19 dovecot_login authenticator failed for ([119.30.150.166]) [119.30.150.166]:50462: 535 Incorrect authentication data (set_id=info@heipowersystem.com)119.30.150.1661835841R,  -3' ossec13001g7Exim Auth failed2025-03-18 14:37:17 dovecot_login authenticator failed for ([178.242.61.74]) [178.242.61.74]:49601: 535 Incorrect authentication data (set_id=info)178.242.61.74298795j+  -c' ossec13001g7Exim Auth failed2025-03-18 14:36:46 dovecot_login authenticator failed for ([185.167.56.70]) [185.167.56.70]:49286: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)185.167.56.70617790e*  -S+ ossec13001g3 Exim Auth failed2025-03-18 14:17:08 dovecot_plain authenticator failed for ([123.209.206.117]) [123.209.206.117]:33602: 535 Incorrect authentication data (set_id=vikas.khandelwal)123.209.206.1172077456)  -5' ossec13001g2Exim Auth failed2025-03-18 14:16:48 dovecot_plain authenticator failed for 37-190-61-156.dynamic.spd-mgts.ru ([195.91.162.219]) [37.190.61.156]:3970: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)37.190.61.1562017370,( U=% ossec11001g2Deferred login on the cpanel service[2025-03-18 14:15:51 +0530] info [webmaild] 49.35.226.22 - kps@amplifypowerglobal.com "POST /cpsess8932756651/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect49.35.226.221269750,' U=% ossec11001g2Deferred login on the cpanel service[2025-03-18 14:14:51 +0530] info [webmaild] 49.35.226.22 - kps@amplifypowerglobal.com "POST /cpsess8932756651/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect49.35.226.221269750W&  -9) ossec13001g2bExim Auth failed2025-03-18 14:14:18 dovecot_login authenticator failed for ([106.245.142.89]) [106.245.142.89]:53666: 535 Incorrect authentication data (set_id=sales)106.245.142.891835841%  -?' ossec13001g2PExim Auth failed2025-03-18 14:14:00 dovecot_login authenticator failed for 69-172-79-198.static.imsbiz.com (173-248-234-145.static.imsbiz.com) [69.172.79.198]:65496: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)69.172.79.1981819730|$ U]% ossec11001g2 Deferred login on the cpanel service[2025-03-18 14:13:11 +0530] info [webmaild] 49.35.226.22 - kps@amplifypowerglobal.com "POST /cpsess8932756651/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [49.35.249.147] != Current IP Address [49.35.226.22]49.35.226.221269750Q#  -1% ossec13001g0>Exim Auth failed2025-03-18 14:05:09 dovecot_login authenticator failed for ([112.78.1.149]) [112.78.1.149]:40914: 535 Incorrect authentication data (set_id=sales)112.78.1.1491562822y"  -}) ossec13001g02Exim Auth failed2025-03-18 14:04:57 dovecot_login authenticator failed for 95-210-105-142.ip.skylogicnet.com [95.210.105.142]:38195: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)95.210.105.1423175395X!  -=' ossec13001g00Exim Auth failed2025-03-18 14:04:54 dovecot_login authenticator failed for ([109.69.15.253]) [109.69.15.253]:35915: 535 Incorrect authentication data (set_id=admission)109.69.15.2532510769 !' C X 9Ko~i@  -a% ossec13001gO4Exim Auth failed2025-03-18 16:17:15 dovecot_login authenticator failed for ([14.35.218.58]) [14.35.218.58]:49934: 535 Incorrect authentication data (set_id=postmaster@heipowersystem.com)14.35.218.581835841m?  -e) ossec13001gNExim Auth failed2025-03-18 16:15:35 dovecot_plain authenticator failed for ([121.189.226.81]) [121.189.226.81]:50426: 535 Incorrect authentication data (set_id=services@heipowersystem.com)121.189.226.811835841X>  -=' ossec13001gK Exim Auth failed2025-03-18 15:59:30 dovecot_login authenticator failed for ([77.239.108.24]) [77.239.108.24]:59008: 535 Incorrect authentication data (set_id=admission)77.239.108.246252001j=  -e# ossec13001gJExim Auth failed2025-03-18 15:58:59 dovecot_login authenticator failed for ([58.27.253.6]) [58.27.253.6]:13483: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)58.27.253.61168579V<  -7) ossec13001gIExim Auth failed2025-03-18 15:53:24 dovecot_login authenticator failed for ([185.249.68.112]) [185.249.68.112]:40698: 535 Incorrect authentication data (set_id=info)185.249.68.1122635167o;  -i) ossec13001gIExim Auth failed2025-03-18 15:53:15 dovecot_login authenticator failed for ([101.230.251.217]) [180.154.53.221]:15875: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)180.154.53.2211814991S:  -5' ossec13001gHExim Auth failed2025-03-18 15:49:38 dovecot_login authenticator failed for ([91.72.148.106]) [91.72.148.106]:33100: 535 Incorrect authentication data (set_id=admin)91.72.148.106290557q9  -m) ossec13001gHExim Auth failed2025-03-18 15:49:20 dovecot_login authenticator failed for (94.140.210.134.ptspb.ru) [94.140.210.134]:49906: 535 Incorrect authentication data (set_id=admin@heipowersystem.com)94.140.210.1342017370Y8  -;+ ossec13001gGExim Auth failed2025-03-18 15:46:07 dovecot_login authenticator failed for ([195.239.224.194]) [195.239.224.194]:42134: 535 Incorrect authentication data (set_id=info)195.239.224.19420173707  - ) ossec13001gGExim Auth failed2025-03-18 15:45:29 dovecot_login authenticator failed for syn-172-100-186-071.res.spectrum.com [172.100.186.71]:37136: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)172.100.186.716252001[6  -A) ossec13001gDSExim Auth failed2025-03-18 15:30:51 dovecot_login authenticator failed for ([101.168.42.221]) [101.168.42.221]:57418: 535 Incorrect authentication data (set_id=admission)101.168.42.2212077456m5  -i% ossec13001gD;Exim Auth failed2025-03-18 15:30:27 dovecot_login authenticator failed for ([141.94.18.69]) [141.94.18.69]:33782: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)141.94.18.693017382Q4  -1% ossec13001gBBExim Auth failed2025-03-18 15:22:01 dovecot_login authenticator failed for ([102.53.15.17]) [102.53.15.17]:55034: 535 Incorrect authentication data (set_id=sales)102.53.15.172542007g3  -[' ossec13001gB.Exim Auth failed2025-03-18 15:21:42 dovecot_login authenticator failed for ([58.49.113.138]) [58.49.113.138]:15830: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)58.49.113.1381814991`2  -O% ossec13001g={Exim Auth failed2025-03-18 15:01:38 dovecot_plain authenticator failed for ([14.35.218.58]) [14.35.218.58]:41959: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)14.35.218.581835841v1  -y' ossec13001g=iExim Auth failed2025-03-18 15:01:21 dovecot_plain authenticator failed for ([49.124.145.62]) [49.124.145.62]:53022: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)49.124.145.621733045[0  -A) ossec13001g=]Exim Auth failed2025-03-18 15:01:09 dovecot_login authenticator failed for ([45.251.108.124]) [45.251.108.124]:62784: 535 Incorrect authentication data (set_id=admission)45.251.108.1241819730 S  5Mu(SQQ  -1% ossec13001gWExim Auth failed2025-03-18 16:53:06 dovecot_login authenticator failed for ([12.44.246.82]) [12.44.246.82]:41971: 535 Incorrect authentication data (set_id=sales)12.44.246.826252001cP  -W% ossec13001gWExim Auth failed2025-03-18 16:52:41 dovecot_login authenticator failed for ([5.11.172.131]) [5.11.172.131]:41654: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)5.11.172.131298795`O  -O% ossec13001gWdExim Auth failed2025-03-18 16:52:11 dovecot_plain authenticator failed for ([218.22.0.200]) [218.22.0.200]:33256: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)218.22.0.2001814991yN  -}) ossec13001gWRExim Auth failed2025-03-18 16:51:54 dovecot_plain authenticator failed for ([95.167.250.158]) [95.167.250.158]:53010: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)95.167.250.1582017370eM  -W' ossec13001gVExim Auth failed2025-03-18 16:48:30 dovecot_login authenticator failed for (rokamauka.com) [111.56.54.202]:32834: 535 Incorrect authentication data (set_id=postmaster@rokamauka.com)111.56.54.2021814991TL  -5' ossec13001gVjExim Auth failed2025-03-18 16:48:01 dovecot_login authenticator failed for (rokamauka.com) [111.56.54.202]:58584: 535 Incorrect authentication data (set_id=nologin)111.56.54.2021814991KK  -)! ossec13001gVExim Auth failed2025-03-18 16:46:15 dovecot_plain authenticator failed for ([5.79.241.9]) [5.79.241.9]:51292: 535 Incorrect authentication data (set_id=sales)5.79.241.92017370qJ  -m) ossec13001gUExim Auth failed2025-03-18 16:45:51 dovecot_plain authenticator failed for nz119l213.bb60246.ctm.net [60.246.119.213]:43399: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)60.246.119.2131821275TI  -5' ossec13001gUExim Auth failed2025-03-18 16:45:35 dovecot_login authenticator failed for ([46.163.154.14]) [46.163.154.14]:39970: 535 Incorrect authentication data (set_id=sales)46.163.154.142017370dH  -W% ossec13001gUExim Auth failed2025-03-18 16:45:13 dovecot_login authenticator failed for ([221.10.10.20]) [221.10.10.20]:43547: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)221.10.10.201814991bG  -Q' ossec13001gTExim Auth failed2025-03-18 16:38:07 dovecot_login authenticator failed for 60-249-207-53.hinet-ip.hinet.net [60.249.207.53]:43218: 535 Incorrect authentication data (set_id=info)60.249.207.531668284XF  -=' ossec13001gSExim Auth failed2025-03-18 16:37:30 dovecot_login authenticator failed for ([154.127.43.35]) [154.127.43.35]:40075: 535 Incorrect authentication data (set_id=admission)154.127.43.352395170hE  -_% ossec13001gT Exim Auth failed2025-03-18 16:37:55 dovecot_login authenticator failed for ([27.24.141.90]) [27.24.141.90]:57596: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)27.24.141.901814991fD  -a! ossec13001gSExim Auth failed2025-03-18 16:36:52 dovecot_login authenticator failed for ([5.31.15.56]) [5.31.15.56]:60287: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)5.31.15.56290557vC  -y' ossec13001gSExim Auth failed2025-03-18 16:33:53 dovecot_plain authenticator failed for ([106.227.87.29]) [106.227.87.29]:44490: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)106.227.87.291814991GB  =+ ossec13008gQMail Reciepient rejected2025-03-18 16:27:39 H=(mail.s2seducationtrust.com) [165.154.227.155]:54830 F= rejected RCPT : Rejected relay attempt: '165.154.227.155' From: 'oihlwgm@s2seducationtrust.com' To: 'goofile@fastmail.com'165.154.227.1551668284jA  -a' ossec13001gP|Exim Auth failed2025-03-18 16:22:44 dovecot_login authenticator failed for ([1.244.246.221]) [1.244.246.221]:39468: 535 Incorrect authentication data (set_id=services@heipowersystem.com)1.244.246.2211835841 ** C W ` h z*ib  -_) ossec13001ghExim Auth failed2025-03-18 18:05:45 dovecot_plain authenticator failed for ([94.204.208.189]) [94.204.208.189]:59398: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)94.204.208.189290557ua  -}# ossec13001ghExim Auth failed2025-03-18 18:05:27 dovecot_plain authenticator failed for (95.0.252.76.static.ttnet.com.tr) [95.0.252.76]:35140: 535 Incorrect authentication data (set_id=services@heipowersystem.com)95.0.252.76298795^`  -E+ ossec13001gfExim Auth failed2025-03-18 17:58:44 dovecot_login authenticator failed for ([183.230.252.103]) [183.230.252.103]:52836: 535 Incorrect authentication data (set_id=admission)183.230.252.1031814991s_  -q) ossec13001gfExim Auth failed2025-03-18 17:58:22 dovecot_login authenticator failed for ([49.124.133.103]) [49.124.133.103]:56118: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)49.124.133.1031733045Q^  -1% ossec13001ge*Exim Auth failed2025-03-18 17:50:57 dovecot_login authenticator failed for ([59.2.141.155]) [59.2.141.155]:35178: 535 Incorrect authentication data (set_id=sales)59.2.141.1551835841z]  -}+ ossec13001geExim Auth failed2025-03-18 17:50:44 dovecot_login authenticator failed for (197-255-202-195.netpagedns.net) [197.255.202.195]:37623: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)197.255.202.1952413451n\  -g) ossec13001gdzExim Auth failed2025-03-18 17:48:01 dovecot_plain authenticator failed for (107-175-76-146-host.colocrossing.com) [107.175.76.146]:56050: 535 Incorrect authentication data (set_id=services)107.175.76.1466252001g[  -Y) ossec13001gdfExim Auth failed2025-03-18 17:47:41 dovecot_plain authenticator failed for 140.82.157.126.360broadband.net [140.82.157.126]:51771: 535 Incorrect authentication data (set_id=services)140.82.157.1266252001mZ  -e) ossec13001gdPExim Auth failed2025-03-18 17:47:20 dovecot_plain authenticator failed for ([101.168.24.115]) [101.168.24.115]:37452: 535 Incorrect authentication data (set_id=services@heipowersystem.com)101.168.24.1152077456lY  -a+ ossec13001gcxExim Auth failed2025-03-18 17:43:43 dovecot_login authenticator failed for 178-220-118-201.static.isp.telekom.rs [178.220.118.201]:48719: 535 Incorrect authentication data (set_id=sales)178.220.118.2016290252jX  -_) ossec13001gcPExim Auth failed2025-03-18 17:43:02 dovecot_login authenticator failed for ([110.172.159.18]) [110.172.159.18]:59778: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)110.172.159.181269750tW  -u' ossec13001g`Exim Auth failed2025-03-18 17:33:02 dovecot_login authenticator failed for 131.0.245.186.core3.com.br [131.0.245.186]:50613: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)131.0.245.1863469034sV  -q) ossec13001g^Exim Auth failed2025-03-18 17:23:44 dovecot_login authenticator failed for ([193.234.119.19]) [193.234.119.19]:60688: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)193.234.119.192661886hU  -]' ossec13001g^~Exim Auth failed2025-03-18 17:22:30 dovecot_login authenticator failed for net-130-0-149-238.cust.vodafonedsl.it [130.0.149.238]:34886: 535 Incorrect authentication data (set_id=sales)130.0.149.2383175395cT  -W% ossec13001g^lExim Auth failed2025-03-18 17:22:12 dovecot_login authenticator failed for ([91.222.80.77]) [91.222.80.77]:55968: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)91.222.80.77690791TS  -5' ossec13001g\Exim Auth failed2025-03-18 17:15:15 dovecot_login authenticator failed for ([103.177.204.4]) [103.177.204.4]:45331: 535 Incorrect authentication data (set_id=sales)103.177.204.41269750zR  -}+ ossec13001g\Exim Auth failed2025-03-18 17:14:49 dovecot_login authenticator failed for (197-255-202-195.netpagedns.net) [197.255.202.195]:36330: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)197.255.202.1952413451 o%3 b h 8aWVocs  -U% ossec13001gpExim Auth failed2025-03-18 18:39:24 dovecot_login authenticator failed for ([59.2.141.155]) [59.2.141.155]:54184: 535 Incorrect authentication data (set_id=info@heipowersystem.com)59.2.141.1551835841}r  -) ossec13001gpmExim Auth failed2025-03-18 18:38:59 dovecot_login authenticator failed for ip4-193-93-156-147.blue-net.com.pl ([193.93.156.149]) [193.93.156.147]:50186: 535 Incorrect authentication data (set_id=admission)193.93.156.147798544q  -' ossec13001gpSExim Auth failed2025-03-18 18:38:33 dovecot_login authenticator failed for ip-213-124-221-2.ip.prioritytelecom.net [213.124.221.2]:42022: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)213.124.221.22750405Sp  -3' ossec13001gn2Exim Auth failed2025-03-18 18:29:30 dovecot_login authenticator failed for ([103.47.74.210]) [103.47.74.210]:46302: 535 Incorrect authentication data (set_id=info)103.47.74.2101269750Uo  -3+ ossec13001gn0Exim Auth failed2025-03-18 18:29:28 dovecot_login authenticator failed for p99162-obmd01.tokyo.ocn.ne.jp [124.101.255.162]:50459: 535 Incorrect authentication data124.101.255.1621861060qn  -k+ ossec13001gmExim Auth failed2025-03-18 18:28:32 dovecot_login authenticator failed for ([118.122.196.230]) [118.122.196.230]:59523: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)118.122.196.2301814991Zm  -C% ossec13001glExim Auth failed2025-03-18 18:24:20 dovecot_plain authenticator failed for (183.82.97.80.actcorp.in) [183.82.97.80]:39672: 535 Incorrect authentication data (set_id=sales)183.82.97.801269750gl  -[' ossec13001glExim Auth failed2025-03-18 18:23:57 dovecot_plain authenticator failed for ([180.129.88.20]) [180.129.88.20]:50105: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)180.129.88.201880251Tk  -5' ossec13001glExim Auth failed2025-03-18 18:20:32 dovecot_login authenticator failed for ([57.128.19.228]) [57.128.19.228]:41842: 535 Incorrect authentication data (set_id=sales)57.128.19.2283017382j  - + ossec13001glExim Auth failed2025-03-18 18:20:24 dovecot_login authenticator failed for (static.ill.117.250.119.122.bsnl.co.in) [117.250.119.122]:42116: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)117.250.119.1221269750Wi  -9) ossec13001gkExim Auth failed2025-03-18 18:19:02 dovecot_login authenticator failed for ([117.159.234.69]) [117.159.234.69]:44686: 535 Incorrect authentication data (set_id=sales)117.159.234.691814991vh  -y' ossec13001gkExim Auth failed2025-03-18 18:18:34 dovecot_login authenticator failed for 24-119-144-86.cpe.sparklight.net [24.119.144.86]:57346: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)24.119.144.866252001cg  -S' ossec13001giExim Auth failed2025-03-18 18:11:35 dovecot_login authenticator failed for 24-119-144-86.cpe.sparklight.net [24.119.144.86]:46264: 535 Incorrect authentication data (set_id=sales)24.119.144.866252001vf  -y' ossec13001giExim Auth failed2025-03-18 18:11:15 dovecot_login authenticator failed for 111-70-42-100.emome-ip.hinet.net [111.70.42.100]:36534: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)111.70.42.1001668284Me  -+# ossec13001giExim Auth failed2025-03-18 18:10:17 dovecot_login authenticator failed for ([1.83.169.63]) [1.83.169.63]:39982: 535 Incorrect authentication data (set_id=info)1.83.169.631814991nd  -g) ossec13001giExim Auth failed2025-03-18 18:10:06 dovecot_login authenticator failed for ([210.94.189.169]) [210.94.189.169]:55270: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)210.94.189.1691835841Wc  -9) ossec13001ghExim Auth failed2025-03-18 18:06:10 dovecot_plain authenticator failed for ([212.220.113.55]) [212.220.113.55]:58764: 535 Incorrect authentication data (set_id=sales)212.220.113.552017370 )8 S {  <_pS  -3' ossec13001gفExim Auth failed2025-03-18 19:53:52 dovecot_login authenticator failed for ([118.182.32.16]) [118.182.32.16]:47230: 535 Incorrect authentication data (set_id=info)118.182.32.161814991k  -c' ossec13001gفExim Auth failed2025-03-18 19:53:31 dovecot_login authenticator failed for ([120.157.0.117]) [120.157.0.117]:51744: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)120.157.0.1172077456Y  -?' ossec13001gـYExim Auth failed2025-03-18 19:46:55 dovecot_login authenticator failed for ([222.76.248.54]) [222.76.248.54]:34974: 535 Incorrect authentication data (set_id=postmaster)222.76.248.541814991Y  -C% ossec13001gـEExim Auth failed2025-03-18 19:46:37 dovecot_login authenticator failed for 77-85-52-109.ip.btc-net.bg [77.85.52.109]:54652: 535 Incorrect authentication data (set_id=info)77.85.52.109732800k  -c' ossec13001gـ=Exim Auth failed2025-03-18 19:46:28 dovecot_login authenticator failed for ([222.68.54.173]) [222.68.54.173]:34926: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)222.68.54.1731814991}  - # ossec13001gـ;Exim Auth failed2025-03-18 19:46:27 dovecot_login authenticator failed for (98.4.27.218.adsl-pool.jlccptt.net.cn) [218.27.4.98]:13118: 535 Incorrect authentication data (set_id=postmaster@heipowersystem.com)218.27.4.981814991U~  -9% ossec13001g}Exim Auth failed2025-03-18 19:35:37 dovecot_login authenticator failed for ([141.94.18.69]) [141.94.18.69]:38912: 535 Incorrect authentication data (set_id=admission)141.94.18.693017382{}  -% ossec13001g}Exim Auth failed2025-03-18 19:35:23 dovecot_login authenticator failed for 60-199-134-8.static.tfn.net.tw [60.199.134.8]:16447: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)60.199.134.81668284T|  -5' ossec13001gzExim Auth failed2025-03-18 19:23:49 dovecot_login authenticator failed for ([203.190.150.4]) [203.190.150.4]:38080: 535 Incorrect authentication data (set_id=admin)203.190.150.41269750p{  -o' ossec13001gzExim Auth failed2025-03-18 19:23:36 dovecot_login authenticator failed for (82.193.122.91.cl.ipnet.ua) [82.193.122.91]:42152: 535 Incorrect authentication data (set_id=admin@heipowersystem.com)82.193.122.91690791kz  -a) ossec13001gxExim Auth failed2025-03-18 19:13:57 dovecot_login authenticator failed for (104.226.75.138.unknown.m1.com.sg) [138.75.226.104]:39883: 535 Incorrect authentication data (set_id=admission)138.75.226.1041880251sy  -q) ossec13001gxExim Auth failed2025-03-18 19:13:36 dovecot_login authenticator failed for ([112.164.225.77]) [112.164.225.77]:55427: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)112.164.225.771835841dx  -W% ossec13001guExim Auth failed2025-03-18 19:01:22 dovecot_login authenticator failed for ([59.2.141.155]) [59.2.141.155]:55292: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)59.2.141.1551835841Tw  -5' ossec13001guExim Auth failed2025-03-18 19:01:36 dovecot_login authenticator failed for ([121.154.90.47]) [121.154.90.47]:54568: 535 Incorrect authentication data (set_id=sales)121.154.90.471835841av  -Q% ossec13001grExim Auth failed2025-03-18 18:48:23 dovecot_login authenticator failed for 95-30-250-44.broadband.corbina.ru [95.30.250.44]:60458: 535 Incorrect authentication data (set_id=info)95.30.250.442017370mu  -c+ ossec13001grExim Auth failed2025-03-18 18:48:07 dovecot_login authenticator failed for ([211.53.58.1]) [211.169.212.206]:50437: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)211.169.212.2061835841St  -3' ossec13001gpExim Auth failed2025-03-18 18:39:39 dovecot_login authenticator failed for ([111.0.127.202]) [111.0.127.202]:32253: 535 Incorrect authentication data (set_id=info)111.0.127.2021814991 0xk^QD7*tgZM@3 ~qdWJ=0# zm`SF9, v i \ O B 5 (     }pcVI< |obUH;.!dA4' uh[yl_RE8+&WJ=~qN/" G : -   0 { n a T  $ w j ] P C 6 )    s f Y L ? 2 %    r e X K > 1 1814991:\ 18149919 18149919 18149919 18149919n 18149919 18149919 18149919z 1814991: 1814991: 18149919 18149919 18149919~ 1814991:$ 1814991:! 1814991: 18149919 18149919 18149919 18149919 18149919 18149919 1814991:% 18149919 18149919 18149919 18149919 18149919 18149919 18149919 18149919 18149919 18149919 18149919 1814991:* 1814991:) 1814991:( 1814991:' 1814991:& 18149919 18149919 18149919 18149919 18149919 18149919 18149919 18149919 18149919 1814991:` 1814991:_ 1814991:^ 1814991:] 1814991:J 1814991:A 1814991:@ 1814991:? 1814991:> 1814991:< 1814991:2 1814991:+ 18149919 18149919 18149919 18149919 18149918 18149918 18149918 18149918 18149918 18149918 18149918 18149918 18149918 18149918 18149918 18149918 18149918 18149918 18149919 18149917 18149917 18149917 18149916 18149916 18149916 18149916 18149916 18149916 18149916 18149916 18149916 18149916 18149916 18149916 18149916 18149916 18149916 18149916 18149916 18149916 18149916 18149916 18149916 18149916 18149916 18149916z 1814991:| 1814991:{ 1814991:x 1814991:w 1814991:j 1814991:i 1814991:h 18149919g 18149919d 18149919c 18149919T 18149919R 18149919Q 18149919P 18149919O 18149919N 18149919L 18149919D 18149919C 18149919= 18149919< 18149919; 181499198 181499194 181499191 18149919, 18149919+ 18149919( 18149919# 18149919  1814991: 1814991: 1814991: 1814991: 1814991: 1814991:} 18149917n 18149917f 18149917e 18149917c 18149917I 18149917; 18149917: 1814991:[ 1814991:S 1814991:R 1814991:Q 1814991:O 1814991:N 1814991:M 1814991:L 1814991:K 1814991:g 1814991:f 1814991:e 1814991:d 1814991:c 1814991:b 1814991:a 1814991:v 1814991:t 1814991:q 1814991:o 1814991:l 1814991:k 1' 1814991:z[ 18149918 18149918 18149918 18149918 18149918 18149918 18149918 18149918 18149918 18149918 18149918 18149918 18149918 18149918 18149918 18149918 18149918 18149918 18149918 18149918 18149918 18149918z 18149918t 18149918l 18149918a 18149918_ 18149918T 18149918O 18149918M 18149918C 18149918A 18149918@ 18149918? 18149918> 18149918= 181499184 181499180 18149918 18149918 18149918 18149918 18149918 18149918 18149917 18149917 18149917 18149917 18149917 18149917 18149917 18149917 18149917 18149917 18149917 18149917 18149917 18149917 18149917 18149917 18149917 18149917 18149917 18149917 18149917 18149917 18149917w " 5 9 W e   -)' ossec13001g٘Exim Auth failed2025-03-18 21:31:17 dovecot_login authenticator failed for (172-125-13-11.lightspeed.rcsntx.sbcglobal.net) [172.125.13.11]:36468: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)172.125.13.116252001x  -y+ ossec13001gٕExim Auth failed2025-03-18 21:19:02 dovecot_plain authenticator failed for (static-146.220.149.202-tataidc.co.in) [202.149.220.148]:57110: 535 Incorrect authentication data (set_id=vikas.khandelwal)202.149.220.1481269750  -) ossec13001gٕExim Auth failed2025-03-18 21:18:52 dovecot_plain authenticator failed for adsl-84-226-219-137.adslplus.ch [84.226.219.137]:45158: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)84.226.219.1372658434e  -Y% ossec13001gٕExim Auth failed2025-03-18 21:18:49 dovecot_login authenticator failed for 7.248.146.34.bc.googleusercontent.com [34.146.248.7]:57894: 535 Incorrect authentication data (set_id=info)34.146.248.71861060|  -' ossec13001gٕExim Auth failed2025-03-18 21:18:33 dovecot_login authenticator failed for 119-46-148-53.static.asianet.co.th [119.46.148.53]:35958: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)119.46.148.531605651s  -q) ossec13001gٓ(Exim Auth failed2025-03-18 21:07:11 dovecot_login authenticator failed for ([112.102.48.193]) [112.102.48.193]:47405: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)112.102.48.1931814991[  -A) ossec13001gٓ@Exim Auth failed2025-03-18 21:07:35 dovecot_login authenticator failed for ([120.157.15.188]) [120.157.15.188]:60486: 535 Incorrect authentication data (set_id=admission)120.157.15.1882077456_  -K' ossec13001gّlExim Auth failed2025-03-18 20:59:46 dovecot_plain authenticator failed for ([186.179.80.12]) [186.179.80.12]:39310: 535 Incorrect authentication data (set_id=vikas.khandelwal)186.179.80.123895114o  -o# ossec13001gّ]Exim Auth failed2025-03-18 20:59:33 dovecot_plain authenticator failed for ([136.232.73.130]) [1.7.229.162]:50894: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)1.7.229.1621269750P  -/% ossec13001gًExim Auth failed2025-03-18 20:32:41 dovecot_login authenticator failed for ([62.16.40.223]) [62.16.40.223]:55384: 535 Incorrect authentication data (set_id=info)62.16.40.2232017370n  -g) ossec13001gيExim Auth failed2025-03-18 20:32:14 dovecot_login authenticator failed for ([120.157.255.25]) [120.157.255.25]:40550: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)120.157.255.252077456^  -E+ ossec13001gوExim Auth failed2025-03-18 20:22:54 dovecot_login authenticator failed for ([180.188.143.166]) [180.188.143.166]:45377: 535 Incorrect authentication data (set_id=admission)180.188.143.1661819730x  -% ossec13001gوExim Auth failed2025-03-18 20:22:30 dovecot_login authenticator failed for agencijaiiz1-155.bih.net.ba [80.65.90.155]:44408: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)80.65.90.1553277605i  -a% ossec13001gنExim Auth failed2025-03-18 20:14:40 dovecot_login authenticator failed for net-93-64-108-27.cust.vodafonedsl.it [93.64.108.27]:44863: 535 Incorrect authentication data (set_id=admission)93.64.108.273175395v  -u+ ossec13001gنExim Auth failed2025-03-18 20:14:25 dovecot_login authenticator failed for ([221.163.227.238]) [221.163.227.238]:51279: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)221.163.227.2381835841` -I) ossec13001gكExim Auth failed2025-03-18 20:02:10 dovecot_login authenticator failed for (amplifypowerglobal.com) [42.193.105.109]:37514: 535 Incorrect authentication data (set_id=nologin)42.193.105.1091814991 { ! R t ,Hj{%  W% ossec9708g١%Dovecot Aborted Login with empty userMar 18 22:06:51 vm1 dovecot[611135]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=71.6.134.233, lip=103.74.54.108, TLS, session=71.6.134.2336252001i$  -[+ ossec13001g٠-Exim Auth failed2025-03-18 22:02:44 dovecot_plain authenticator failed for ([107.150.100.139]) [107.150.100.139]:50562: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)107.150.100.1396252001v#  -y' ossec13001g٠Exim Auth failed2025-03-18 22:02:20 dovecot_plain authenticator failed for ([103.48.194.21]) [103.48.194.21]:33142: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)103.48.194.211562822f"  -[' ossec13001gٞExim Auth failed2025-03-18 21:56:39 dovecot_plain authenticator failed for ([94.201.79.121]) [94.201.79.121]:34942: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)94.201.79.121290557Z!  -A' ossec13001gٞExim Auth failed2025-03-18 21:56:49 dovecot_plain authenticator failed for (made-again.tmesis.com) [24.187.213.29]:44262: 535 Incorrect authentication data (set_id=sales)24.187.213.296252001`  -M) ossec13001gٜfExim Auth failed2025-03-18 21:46:37 dovecot_login authenticator failed for 170.120.221.62.dyn.idknet.com [62.221.120.170]:33284: 535 Incorrect authentication data (set_id=info)62.221.120.170617790b  -W! ossec13001gٜPExim Auth failed2025-03-18 21:46:15 dovecot_login authenticator failed for ([1.183.1.82]) [1.183.1.82]:56947: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)1.183.1.821814991Q  -1% ossec13001gٜLExim Auth failed2025-03-18 21:46:12 dovecot_login authenticator failed for ([211.93.6.230]) [211.93.6.230]:60614: 535 Incorrect authentication data (set_id=sales)211.93.6.2301814991f  -[' ossec13001gٜ>Exim Auth failed2025-03-18 21:45:58 dovecot_login authenticator failed for ([91.72.148.106]) [91.72.148.106]:43399: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)91.72.148.106290557f  -W) ossec13001gٛExim Auth failed2025-03-18 21:43:21 dovecot_plain authenticator failed for ([113.140.95.250]) [113.140.95.250]:42314: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)113.140.95.2501814991v  -y' ossec13001gٛExim Auth failed2025-03-18 21:43:10 dovecot_plain authenticator failed for ([58.246.100.27]) [58.246.100.27]:43636: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)58.246.100.271814991J  -)! ossec13001gٚExim Auth failed2025-03-18 21:39:18 dovecot_login authenticator failed for ([5.32.107.6]) [5.32.107.6]:57992: 535 Incorrect authentication data (set_id=sales)5.32.107.6290557m  -c+ ossec13001gٚExim Auth failed2025-03-18 21:39:06 dovecot_login authenticator failed for ([103.106.154.138]) [103.106.154.138]:56032: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)103.106.154.1381269750Z  -=+ ossec13001gٚNExim Auth failed2025-03-18 21:37:41 dovecot_plain authenticator failed for ([181.177.143.217]) [181.177.143.217]:52749: 535 Incorrect authentication data (set_id=sales)181.177.143.2173923057K  -+ ossec13001gٚ@Exim Auth failed2025-03-18 21:37:27 dovecot_plain authenticator failed for ([203.172.213.166]) [203.172.213.166]:51780: 535 Incorrect authentication data203.172.213.1661605651g  -[' ossec13001gٚ0Exim Auth failed2025-03-18 21:37:10 dovecot_plain authenticator failed for ([222.86.58.117]) [222.86.58.117]:60636: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)222.86.58.1171814991p  -o% ossec13001g٘Exim Auth failed2025-03-18 21:31:27 dovecot_login authenticator failed for (201-048-032-049.static.ctbctelecom.com.br) [201.48.32.49]:35103: 535 Incorrect authentication data (set_id=admission)201.48.32.493469034 ( K d {  FYj6  -_) ossec13001gٮ%Exim Auth failed2025-03-18 23:02:21 dovecot_login authenticator failed for ([222.239.231.61]) [222.239.231.61]:28051: 535 Incorrect authentication data (set_id=admin@heipowersystem.com)222.239.231.611835841v5  -u+ ossec13001gٮ Exim Auth failed2025-03-18 23:01:51 dovecot_login authenticator failed for ([109.124.195.218]) [109.124.195.218]:59842: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)109.124.195.2182017370S4  -3' ossec13001g٭ZExim Auth failed2025-03-18 22:58:58 dovecot_login authenticator failed for ([101.168.1.233]) [101.168.1.233]:47494: 535 Incorrect authentication data (set_id=info)101.168.1.2332077456i3  -c' ossec13001g٭HExim Auth failed2025-03-18 22:58:39 dovecot_login authenticator failed for ([65.20.193.144]) [65.20.193.144]:40375: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)65.20.193.14499237V2  -;' ossec13001g٭Exim Auth failed2025-03-18 22:57:55 dovecot_plain authenticator failed for ([91.239.23.149]) [91.239.23.149]:52912: 535 Incorrect authentication data (set_id=services)91.239.23.149458258m1  -e) ossec13001g٭ Exim Auth failed2025-03-18 22:57:40 dovecot_plain authenticator failed for ([168.121.46.162]) [168.121.46.162]:48306: 535 Incorrect authentication data (set_id=services@heipowersystem.com)168.121.46.1623932488V0  -7) ossec13001g٩hExim Auth failed2025-03-18 22:42:07 dovecot_login authenticator failed for ([121.189.198.60]) [121.189.198.60]:50680: 535 Incorrect authentication data (set_id=info)121.189.198.601835841g/  -_% ossec13001g٩JExim Auth failed2025-03-18 22:41:37 dovecot_login authenticator failed for ([149.0.19.108]) [149.0.19.108]:44132: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)149.0.19.108298795c.  -S' ossec13001g٨Exim Auth failed2025-03-18 22:40:21 dovecot_login authenticator failed for 24-119-144-86.cpe.sparklight.net [24.119.144.86]:55970: 535 Incorrect authentication data (set_id=sales)24.119.144.866252001g-  -Y) ossec13001g٨Exim Auth failed2025-03-18 22:40:06 dovecot_login authenticator failed for (hn.kd.ny.adsl) [219.157.124.84]:39500: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)219.157.124.841814991[,  -A) ossec13001g٨Exim Auth failed2025-03-18 22:39:38 dovecot_login authenticator failed for ([191.59.206.191]) [191.59.206.191]:42132: 535 Incorrect authentication data (set_id=admission)191.59.206.1913469034p+  -m' ossec13001g٨Exim Auth failed2025-03-18 22:39:14 dovecot_login authenticator failed for ([217.24.185.98]) [217.24.185.98]:47504: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)217.24.185.982017370e*  -[# ossec13001g٨Exim Auth failed2025-03-18 22:38:34 dovecot_login authenticator failed for ([121.22.99.2]) [121.22.99.2]:35065: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)121.22.99.21814991c)  -U% ossec13001g٣Exim Auth failed2025-03-18 22:17:51 dovecot_login authenticator failed for ([102.53.15.56]) [102.53.15.56]:47130: 535 Incorrect authentication data (set_id=info@heipowersystem.com)102.53.15.562542007Y(  -;+ ossec13001g٣Exim Auth failed2025-03-18 22:18:01 dovecot_login authenticator failed for ([212.164.211.155]) [212.164.211.155]:59236: 535 Incorrect authentication data (set_id=info)212.164.211.1552017370s'  -s' ossec13001g٢*Exim Auth failed2025-03-18 22:11:12 dovecot_login authenticator failed for (amplifypowerglobal.com) [111.207.12.99]:34074: 535 Incorrect authentication data (set_id=office@amplifypowerglobal.com)111.207.12.991814991]&  -G' ossec13001g٢Exim Auth failed2025-03-18 22:10:49 dovecot_login authenticator failed for (amplifypowerglobal.com) [111.207.12.99]:58590: 535 Incorrect authentication data (set_id=nologin)111.207.12.991814991 'H ]  +MgyWG  -9) ossec13001gٹHExim Auth failed2025-03-18 23:49:51 dovecot_login authenticator failed for ([193.234.119.69]) [193.234.119.69]:45686: 535 Incorrect authentication data (set_id=sales)193.234.119.692661886jF  -_) ossec13001gٹ3Exim Auth failed2025-03-18 23:49:30 dovecot_login authenticator failed for ([101.168.12.126]) [101.168.12.126]:59500: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)101.168.12.1262077456bE  -Q' ossec13001gٸExim Auth failed2025-03-18 23:46:59 dovecot_login authenticator failed for (88.201.163.65.pool.sknt.ru) [88.201.163.65]:55788: 535 Incorrect authentication data (set_id=services)88.201.163.652017370ZD  -=+ ossec13001gٸExim Auth failed2025-03-18 23:46:57 dovecot_login authenticator failed for ([112.123.199.111]) [112.123.199.111]:53728: 535 Incorrect authentication data (set_id=sales)112.123.199.1111814991jC  -a' ossec13001gٸExim Auth failed2025-03-18 23:46:46 dovecot_login authenticator failed for ([186.177.88.96]) [186.177.88.96]:42624: 535 Incorrect authentication data (set_id=services@heipowersystem.com)186.177.88.963624060mB  -c+ ossec13001gٸExim Auth failed2025-03-18 23:46:42 dovecot_login authenticator failed for ([103.106.154.137]) [103.106.154.137]:54448: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)103.106.154.1371269750^A  -E+ ossec13001gٸAExim Auth failed2025-03-18 23:45:28 dovecot_login authenticator failed for ([123.210.152.243]) [123.210.152.243]:56194: 535 Incorrect authentication data (set_id=admission)123.210.152.2432077456q@  -o' ossec13001gٸ5Exim Auth failed2025-03-18 23:45:16 dovecot_login authenticator failed for ([113.117.83.201]) [59.39.221.224]:12413: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)59.39.221.2241814991V?  -7) ossec13001gٶaExim Auth failed2025-03-18 23:37:28 dovecot_login authenticator failed for ([37.112.186.205]) [37.112.186.205]:58952: 535 Incorrect authentication data (set_id=info)37.112.186.2052017370j>  -c' ossec13001gٶGExim Auth failed2025-03-18 23:37:03 dovecot_login authenticator failed for ([41.59.201.180]) [41.59.201.180]:49917: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)41.59.201.180149590m=  -c+ ossec13001gٶ=Exim Auth failed2025-03-18 23:36:52 dovecot_plain authenticator failed for ([183.109.195.179]) [183.109.195.179]:49530: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)183.109.195.1791835841i<  -a% ossec13001gٳExim Auth failed2025-03-18 23:26:16 dovecot_login authenticator failed for ([102.53.15.54]) [102.53.15.54]:46147: 535 Incorrect authentication data (set_id=postmaster@heipowersystem.com)102.53.15.542542007u;  -u) ossec13001gٳExim Auth failed2025-03-18 23:25:50 dovecot_login authenticator failed for (31-220-168-116.rdtc.ru) [31.220.168.116]:56735: 535 Incorrect authentication data (set_id=postmaster@heipowersystem.com)31.220.168.1162017370Y:  -E# ossec13001gٱExim Auth failed2025-03-18 23:17:05 dovecot_plain authenticator failed for (2-55-88-152.orange.net.il) [2.55.88.152]:48480: 535 Incorrect authentication data (set_id=sales)2.55.88.152294640g9  -[' ossec13001gٱzExim Auth failed2025-03-18 23:16:32 dovecot_plain authenticator failed for ([122.252.246.1]) [122.252.246.1]:36826: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)122.252.246.11269750[8  -A) ossec13001gٮExim Auth failed2025-03-18 23:02:10 dovecot_login authenticator failed for ([223.220.167.38]) [223.220.167.38]:53678: 535 Incorrect authentication data (set_id=admission)223.220.167.381814991U7  -5) ossec13001gٮ9Exim Auth failed2025-03-18 23:02:40 dovecot_login authenticator failed for ([106.10.69.50]) [183.108.201.20]:54785: 535 Incorrect authentication data (set_id=admin)183.108.201.201835841 M@X#|{naTG:|H- wj]PC6)sfYL?2% e>1$ zm`SF9, v i \ O B 5 (     o0r@Xo;.  r e X K > 1 $  bI ebU { n a T G : -   w j ] PdXL@4(V=YM4Krwj]PC6)sfYL?2%  3175395H 3144096!b 3277605H 3175395H 3175395r 3175395H( 3175395G 3175395DN 3175395D 3175395C 3175395C= 3144096# 3277605AW 3144096&R 3144096& 3175395@V 3277605@ 3277605? 3175395? 3144096'G 3175395?u 3175395?e 3144096) 3144096' 3175395> 31753956 3175395 $I 3175395O 3175395O 3144096N# 3277605M4 3277605L 3175395L< 3144096L/ 3175395K 3144096K 3144096J 3175395U 3175395 3175395 3175395 3175395 3175395 3175395 3175395 3175395 3175395 3175395 3175395B 3175395 3175395~ 3175395i 31753950 3175395 31753956 3175395 3175395 3175395 3175395 3175395] 3175395H 3175395d 3175395 3175395 3175395H 3175395 3175395 3175395 3175395 3175395 3175395 3175395 I 3175395 ! 3175395 3175395 3175395 | 3175395 R 3175395 3175395 3175395 y 3175395 s 3175395 t 3175395 \ 3175395 3175395H 3175395 3175395 3144096G 3144096C 3144096B 3144096B] 3144096= 31440966 31440962- 31440962 3144096+ 3144096* 3277605> 3175395> 3175395> 3175395= 3175395= 3277605< 3175395<8 3175395;K, 3374766 3374766z 3374766 3374766 3374766} 3374766 3374766C 3374766 3374766 3374766j 3374766 3374766 3374766 3374766 3374766 3374766 3374766 / 3374766  3374766 3374766 B 33553385 33553385 33553385 33553384 3355338+$ 3355338 3277605;M 3277605:3 32776058 3277605, 3277605& 3277605%B 3277605$ 3277605! 3277605 3277605 3277605r 3277605 3202326v 3202326B 3202326 3202326 3202326 Z 31905383D 3190538'< 3175395; 3175395: 3175395: 3175395: 3175395: 3175395: 3175395: 3175395: 31753957 31753957k 31753956b 31753954 31753953 31753952* 31753950, 3175395/ 3175395/ 3175395/ 3175395/ 3175395/Y 3175395/< 3175395/ 3175395. 3175395.6 3175395-S 3175395, 3175395,U 3175395," 3175395+ 3175395+Q 3175395++ 3175395) 3175395) 3175395) 3175395)` 3175395)L 3175395( 3175395( 3175395( 3175395(@ 3175395' 3175395'M 3175395& 3175395&< 3175395&* 3175395Ga 3175395# 3175395!d 3175395 3175395 3175395 31753954 3175395r 3175395IK 3175395j 3277605F% 3175395% 3175395% 3175395% 3175395% 3175395% 3175395% 3175395$ 3175395$; # j $ "D7Xj|PY  -1% ossec13001geExim Auth failed2025-03-19 00:45:48 dovecot_login authenticator failed for ([94.206.93.90]) [94.206.93.90]:45719: 535 Incorrect authentication data (set_id=sales)94.206.93.90290557jX  -_) ossec13001g/Exim Auth failed2025-03-19 00:44:53 dovecot_login authenticator failed for ([211.228.113.27]) [211.228.113.27]:50475: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)211.228.113.271835841jW  -_) ossec13001gĠExim Auth failed2025-03-19 00:38:16 dovecot_login authenticator failed for ([45.118.136.243]) [45.118.136.243]:50181: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)45.118.136.2431562822[V  -A) ossec13001gExim Auth failed2025-03-19 00:35:54 dovecot_login authenticator failed for ([161.43.199.131]) [161.43.199.131]:47244: 535 Incorrect authentication data (set_id=admission)161.43.199.1312077456 U  -) ossec13001gExim Auth failed2025-03-19 00:35:41 dovecot_login authenticator failed for (63.230.182.190.unassigned.ridsa.com.ar) [190.182.230.63]:55959: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)190.182.230.633865483ZT  -=+ ossec13001gYExim Auth failed2025-03-19 00:20:01 dovecot_login authenticator failed for ([197.251.195.105]) [197.251.195.105]:49758: 535 Incorrect authentication data (set_id=sales)197.251.195.1052300660jS  -_) ossec13001g5Exim Auth failed2025-03-19 00:19:24 dovecot_login authenticator failed for ([202.117.92.118]) [202.117.92.118]:36476: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)202.117.92.1181814991SR  -3' ossec13001gٿExim Auth failed2025-03-19 00:17:32 dovecot_login authenticator failed for ([120.157.5.115]) [120.157.5.115]:49262: 535 Incorrect authentication data (set_id=info)120.157.5.1152077456yQ  -}) ossec13001gٿExim Auth failed2025-03-19 00:17:03 dovecot_login authenticator failed for p5dd3e89f.dip0.t-ipconnect.de [93.211.232.159]:45815: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)93.211.232.1592921044TP  -7% ossec13001gپExim Auth failed2025-03-19 00:12:56 dovecot_login authenticator failed for ([114.242.175.187]) [36.112.75.46]:38500: 535 Incorrect authentication data (set_id=sales)36.112.75.461814991vO  -y' ossec13001gپExim Auth failed2025-03-19 00:12:43 dovecot_login authenticator failed for 111-70-42-100.emome-ip.hinet.net [111.70.42.100]:15710: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)111.70.42.1001668284ZN  -A) ossec13001gٽExim Auth failed2025-03-19 00:06:12 dovecot_login authenticator failed for ([146.19.200.215]) [146.19.200.215]:36572: 535 Incorrect authentication data (set_id=admission)146.19.200.215660013M  -' ossec13001gٽExim Auth failed2025-03-19 00:05:52 dovecot_login authenticator failed for syn-047-038-202-184.res.spectrum.com [47.38.202.184]:41934: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)47.38.202.1846252001L  ?/ ossec1008gٽ2Process exiting (killed).Mar 19 00:06:33 vm1 spamd[934191]: spamd: server killed by SIGTERM, shutting downCK  77 ossec502gټOssec server started.ossec: Ossec started.5J  ; ossec9703gټDovecot is Starting Up.Mar 19 00:04:43 vm1 dovecot[1250584]: master: Dovecot v2.3.21.1 (d492236fa0) starting up for lmtp, imap, pop3 (core dumps disabled)iI  -]) ossec13001gٺ:Exim Auth failed2025-03-18 23:53:53 dovecot_login authenticator failed for syn-172-090-227-255.res.spectrum.com [172.90.227.255]:46698: 535 Incorrect authentication data (set_id=sales)172.90.227.2556252001lH  -c) ossec13001gٺExim Auth failed2025-03-18 23:53:24 dovecot_login authenticator failed for (static.vinacis.com) [180.93.172.213]:36108: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)180.93.172.2131562822 n 8 [ r .-8AJnXj  -=' ossec13001gExim Auth failed2025-03-19 01:47:45 dovecot_login authenticator failed for ([221.206.7.126]) [221.206.7.126]:49300: 535 Incorrect authentication data (set_id=admission)221.206.7.1261814991si  -q) ossec13001gExim Auth failed2025-03-19 01:47:33 dovecot_login authenticator failed for ([46.138.247.195]) [46.138.247.195]:51964: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)46.138.247.1952017370sh  -y# ossec13001gXExim Auth failed2025-03-19 01:45:20 dovecot_login authenticator failed for 77-78-14-54.ip.btc-net.bg [77.78.14.54]:46180: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)77.78.14.54732800qg  -k+ ossec13001gExim Auth failed2025-03-19 01:40:03 dovecot_login authenticator failed for ([163.179.105.241]) [163.179.105.241]:42574: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)163.179.105.2411814991}f  - % ossec13001gнExim Auth failed2025-03-19 01:29:56 dovecot_login authenticator failed for (static.ip.81.22.19.176.kalaam-telecom.com) [81.22.19.176]:54958: 535 Incorrect authentication data (set_id=info@heipowersystem.com)81.22.19.176290291Re  -5# ossec13001gΉExim Auth failed2025-03-19 01:20:31 dovecot_login authenticator failed for ([59.0.10.191]) [59.0.10.191]:60236: 535 Incorrect authentication data (set_id=admission)59.0.10.1911835841rd  -q) ossec13001g}Exim Auth failed2025-03-19 01:20:21 dovecot_login authenticator failed for ([94.204.208.189]) [94.204.208.189]:54144: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)94.204.208.189290557kc  -_+ ossec13001gMExim Auth failed2025-03-19 01:19:32 dovecot_login authenticator failed for (customer-PUE-229-135.megared.net.mx) [177.227.229.188]:45381: 535 Incorrect authentication data (set_id=info)177.227.229.1883996063qb  -k+ ossec13001g)Exim Auth failed2025-03-19 01:18:55 dovecot_login authenticator failed for ([118.122.196.230]) [118.122.196.230]:46651: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)118.122.196.2301814991Qa  -1% ossec13001gTExim Auth failed2025-03-19 01:11:07 dovecot_login authenticator failed for ([124.216.0.10]) [124.216.0.10]:48551: 535 Incorrect authentication data (set_id=sales)124.216.0.101835841j`  -_) ossec13001g.Exim Auth failed2025-03-19 01:10:29 dovecot_login authenticator failed for ([123.178.21.162]) [123.178.21.162]:28590: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)123.178.21.1621814991M_  -+# ossec13001gExim Auth failed2025-03-19 01:10:12 dovecot_login authenticator failed for ([101.13.5.39]) [101.13.5.39]:35860: 535 Incorrect authentication data (set_id=info)101.13.5.391668284e^  -[# ossec13001gExim Auth failed2025-03-19 01:09:49 dovecot_login authenticator failed for ([38.79.83.28]) [38.79.83.28]:42766: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)38.79.83.286252001Y]  -=) ossec13001gExim Auth failed2025-03-19 01:04:39 dovecot_login authenticator failed for (static.vinacis.com) [180.93.172.127]:49144: 535 Incorrect authentication data (set_id=sales)180.93.172.1271562822d\  -W% ossec13001gʾExim Auth failed2025-03-19 01:04:20 dovecot_login authenticator failed for ([211.93.6.230]) [211.93.6.230]:59912: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)211.93.6.2301814991U[  -7) ossec13001gơExim Auth failed2025-03-19 00:46:47 dovecot_login authenticator failed for ([185.116.231.33]) [185.116.231.33]:35246: 535 Incorrect authentication data (set_id=info)185.116.231.33690791Z  -) ossec13001gƙExim Auth failed2025-03-19 00:46:39 dovecot_login authenticator failed for 131.196.100.34.bc.googleusercontent.com [34.100.196.131]:53334: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)34.100.196.1311269750 1 \ O B 5>1 (  r e X K > 1 $  { n a T z n b V J > 2 &    ~ r f Z M @ 3 &  }pcVI</"yl_RE8+uh[NA4' ~qdWJ=0# zm`SF9,vi\OB5(reXK~qdWJ=0# zm`SF9, v i    6252001 6252001 6251999Cg 6251999B` 6252001 6252001 6252001 6252001 6252001 6252001 6252001 } 6252001 | 6252001 z 6252001 s 6252001 q 6252001 o 6252001 m 6252001 c 6252001 ] 6252001 ( 6252001 & 6252001 % 6252001  6252001  6252001  6252001  6252001  6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001~ 6252001n 6252001` 6252001[ 6252001W 6252001S 6252001P 6252001O 6252001K 6252001F 6252001E 6252001: 6252001- 6252001% 6252001! 6252001 6252001 6252001 6252001 6252001V 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001s 6252001T 6252001B 6252001^ 6252001/ 6252001. 6252001- 6252001$ 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001w 6252001q 6252001k 6252001T 6252001P 6252001O 6252001N 6252001K 6252001E 6252001@ 6252001: 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001| 6252001{ 6252001x 6252001w 6252001s 6252001o 6252001_ 6252001^ 6252001] 6252001U 6252001T 6252001S 6252001R 6252001E 6252001/ 6252001. 6252001, 6252001+ 6252001( 6252001' 6252001& 6252001$ 6252001 6252001 6252001  6252001 6251999@ 6251999@ 6251999@ 6251999@ 6251999O 6251999O 6251999O 6251999O 6251999Of 6251999N 6251999N 6251999Ng 6251999N8 6251999M 6251999Mb 6251999MA 6251999L 6251999K 6251999K 6251999Kq 6251999KL 6251999J 6251999JY 6251999JW 6251999I 6251999Ie 6251999H 6251999H\ 6251999HC 6251999G 6251999F 6251999Fb 6251999FE 6251999F 6251999D 6251999D 6252001 _ 6252001 Z 6252001 I 6252001 C 6251999Ct 6251999B 6251999A 6251999A 6251999@ 6252001 > 6252001 = 6252001 4 6252001 0 6252001 / 6252001 % 6252001 ! 6252001  6252001  6252001  6252001  6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 | 6252001 f 6252001 _ 6252001 S 6252001 P 6252001 K 6252001 9 6252001 * 6252001 ) 6252001 $ 6252001  6252001  6252001  6252001 6252001  6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6251999B\ *\~tj`VLB8.$zpf\H>4*   v l b X N D : 0 &    ~ t j ` V L B 8 . $    z p f \ R H > 4 *  vlbXND:0&|rhT^J@6,"nxdZPF<2( ~tj`VLB8.$zpf\ | r h ^ T J @ 6 , "    x n d Z P F < 2 (   RRH>4*  vlbXND:0& gl-k glp-j gj-i gg-h gg-g ga[-f gaA-e g]-d gZ-c gZ-b gZh-a gZW-` gY1-_ gR-^ gS-] gM-\ gN -[ gN-Z gN-Y gKF-X gK>-W gH-V gH-U gH-T gH-S gE~-R gEn-Q gDv-P gDf-O gDZ-N gDZ-M gA-L gA-K gA -J g@-I g>-H g=-G g=d-F g<-E g<-D g6-C g5-B g5-A g5-@ g3x-? g/-> g/-= g/-< g/-; g.!-: g.-9 g,-8 g,|-7 g)'-6 g)1-5 g(-4 g(-3 g&A-2 g&5-1 g$-0 g"-/ g -. g-- g-, g-+ g-* g]-) gO-( g5-' g)-& g -% g-$ g-# g-" g -! g - g - g - g - g - g - g +- g- g- g- g- g- gC- g- g- g- gx- g>- g- g- g- g- g- g- g- g- g- g- g>- g&- g- g- g- g, g, gn, g?, g, g, g, g޷, gޫ, gݸ, gx, gj, g, g, gص, g{, gg, g, gվ, gN, g<, g, g, gX, g, gн, gΉ, g}, gM, g), gT, g., g, g, g, gʾ, gơ, gƙ, ge, g/, gĠ, g, g, gY, g5, gٿ, gٿ, gپ, gپ, gٽ2, gٽ, gٽ, gټ, gټ, gٺ:, gٺ, gٹH, gٹ3, gٸ, gٸ, gٸ, gٸ, gک- gڥn- gڥD- gڤJ- gڤ4- gڣ- gڣ- gڠ- gڠ- gښ- gښ- gڒ- gڒ- gڐ- gڐ- gڏ- gڌ- gڌ- gڋi- gڋG- gډ- gڅ- gڃ- gڂ- gڀ-~ gڀU-} g-| gp-{ g{-z g{-y gz-x gz-w gy-v gy-u gw-s gw -t gu-r gq -q goX-p gm-o gm-n gl-m gl-l gٸA, gٸ5, gٶa, gٶG, gٶ=, gٳ, gٳ, gٱ, gٱz, gٮ9, gٮ%, gٮ, gٮ , g٭Z, g٭H, g٭, g٭ , g٩h, g٩J, g٨, g٨, g٨, g٨, g٨, g٣, g٣, g٢*, g٢, g١%, g٠-, g٠, gٞ, gٞ, gٜf, gٜP, gٜL, gٜ>, gٛ, gٛ, gٚ, gٚ, gٚN, gک- gٚ@, gٚ0, g٘, g٘, gٕ, gٕ, gٕ, gٕ, gٓ@, gٓ(, gّl, gّ], gً, gي, gو, gو, gن, gن, gك, gف, gف, gـY, gـE, gـ=, gـ;, g},~ g},} gz,| gz,{ gx,z gx,y gu,w gu,x gr,v gr,u gp,t gp,s gpm,r gpS,q gn2,p gn0,o gm,n J- : [ e U x!8Jj{  -_) ossec13001gExim Auth failed2025-03-19 02:51:12 dovecot_plain authenticator failed for ([193.234.119.36]) [193.234.119.36]:38376: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)193.234.119.362661886ez  -S+ ossec13001gExim Auth failed2025-03-19 02:34:16 dovecot_plain authenticator failed for ([123.210.152.243]) [123.210.152.243]:42998: 535 Incorrect authentication data (set_id=vikas.khandelwal)123.210.152.2432077456uy  -u) ossec13001gExim Auth failed2025-03-19 02:34:05 dovecot_plain authenticator failed for ([176.104.218.56]) [176.104.218.56]:45013: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)176.104.218.562017370Vx  -;% ossec13001g޷Exim Auth failed2025-03-19 02:29:34 dovecot_login authenticator failed for ([59.2.141.155]) [59.2.141.155]:56184: 535 Incorrect authentication data (set_id=postmaster)59.2.141.1551835841pw  -m+ ossec13001gޫExim Auth failed2025-03-19 02:29:22 dovecot_login authenticator failed for ([192.145.171.159]) [192.145.171.159]:56794: 535 Incorrect authentication data (set_id=postmaster@heipowersystem.com)192.145.171.15951537`v  -M) ossec13001gݸExim Auth failed2025-03-19 02:25:19 dovecot_login authenticator failed for (User) [193.46.255.184]:41894: 535 Incorrect authentication data (set_id=afdsfwrwgfwr@technobases.in)193.46.255.184798549Pu  -/% ossec13001gxExim Auth failed2025-03-19 02:11:27 dovecot_login authenticator failed for ([14.21.36.111]) [14.21.36.111]:54983: 535 Incorrect authentication data (set_id=info)14.21.36.1111814991gt  -_% ossec13001gjExim Auth failed2025-03-19 02:11:14 dovecot_login authenticator failed for ([87.200.181.5]) [87.200.181.5]:43822: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)87.200.181.5290557{s  -+ ossec13001gExim Auth failed2025-03-19 02:09:10 dovecot_login authenticator failed for (173-166-112-154-newengland.hfc.comcastbusiness.net) [173.166.112.154]:61305: 535 Incorrect authentication data (set_id=admin)173.166.112.1546252001jr  -_) ossec13001gExim Auth failed2025-03-19 02:08:59 dovecot_login authenticator failed for ([79.170.189.164]) [79.170.189.164]:59301: 535 Incorrect authentication data (set_id=admin@heipowersystem.com)79.170.189.1641220409Yq -?% ossec13001gصExim Auth failed2025-03-19 02:03:57 dovecot_login authenticator failed for (thepsindustries.com) [119.96.131.8]:50326: 535 Incorrect authentication data (set_id=nologin)119.96.131.81814991 p  =% ossec13008g{Mail Reciepient rejected2025-03-19 01:58:42 H=(da.semanta.ir) [45.147.78.99]:34908 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 CV=no F= rejected RCPT : Sender verify failed45.147.78.99130758ro  -q) ossec13001ggExim Auth failed2025-03-19 01:58:22 dovecot_login authenticator failed for ([87.200.232.247]) [87.200.232.247]:37124: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)87.200.232.247290557[n  -A) ossec13001gExim Auth failed2025-03-19 01:51:54 dovecot_login authenticator failed for ([123.209.107.18]) [123.209.107.18]:35920: 535 Incorrect authentication data (set_id=admission)123.209.107.182077456om  -m' ossec13001gվExim Auth failed2025-03-19 01:51:17 dovecot_login authenticator failed for ([45.240.88.249]) [45.240.88.249]:44232: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)45.240.88.249357994Wl  -9) ossec13001gNExim Auth failed2025-03-19 01:49:26 dovecot_login authenticator failed for ([110.172.159.18]) [110.172.159.18]:55812: 535 Incorrect authentication data (set_id=sales)110.172.159.181269750tk  -u' ossec13001g<Exim Auth failed2025-03-19 01:49:08 dovecot_login authenticator failed for p7001160-ipoefx.ipoe.ocn.ne.jp [118.3.227.159]:54488: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)118.3.227.1591861060  %S?  gQ' ossec11307gMultiple connection attempts from same sourceMar 19 03:50:57 vm1 pure-ftpd[1300395]: (?@206.168.34.77) [INFO] New connection from 206.168.34.77206.168.34.776252001& 3Q' ossec11301gNew FTP connection.Mar 19 03:50:52 vm1 pure-ftpd[1300318]: (?@206.168.34.77) [INFO] New connection from 206.168.34.77206.168.34.776252001& 3Q' ossec11301gNew FTP connection.Mar 19 03:50:45 vm1 pure-ftpd[1300271]: (?@206.168.34.77) [INFO] New connection from 206.168.34.77206.168.34.776252001_  -K' ossec13001gExim Auth failed2025-03-19 03:46:29 dovecot_login authenticator failed for ([49.124.151.35]) [49.124.151.35]:53944: 535 Incorrect authentication data (set_id=vikas.khandelwal)49.124.151.351733045q  -q' ossec13001gExim Auth failed2025-03-19 03:46:09 dovecot_login authenticator failed for ([185.167.56.24]) [185.167.56.24]:54544: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)185.167.56.24617790"  3M% ossec11301gNew FTP connection.Mar 19 03:37:41 vm1 pure-ftpd[1297418]: (?@20.65.194.49) [INFO] New connection from 20.65.194.4920.65.194.496252001X  -;+ ossec13001gExim Auth failed2025-03-19 03:22:01 dovecot_login authenticator failed for ([196.189.126.185]) [196.189.126.185]:34300: 535 Incorrect authentication data (set_id=info)196.189.126.185337996z  -' ossec13001gExim Auth failed2025-03-19 03:21:33 dovecot_login authenticator failed for 111-70-23-216.emome-ip.hinet.net [111.70.23.216]:46714: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)111.70.23.2161668284}  -' ossec13001g>Exim Auth failed2025-03-19 03:18:45 dovecot_plain authenticator failed for nz117l15.bb60246.ctm.net ([60.246.119.213]) [60.246.117.15]:43030: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)60.246.117.151821275y  -}) ossec13001g&Exim Auth failed2025-03-19 03:18:21 dovecot_plain authenticator failed for ([121.128.84.224]) [121.128.84.224]:37546: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)121.128.84.2241835841V  -7) ossec13001gExim Auth failed2025-03-19 03:12:10 dovecot_login authenticator failed for ([60.175.146.138]) [60.175.146.138]:52713: 535 Incorrect authentication data (set_id=info)60.175.146.1381814991f  -[' ossec13001gExim Auth failed2025-03-19 03:12:05 dovecot_plain authenticator failed for ([94.201.79.121]) [94.201.79.121]:38116: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)94.201.79.121290557z  -' ossec13001gExim Auth failed2025-03-19 03:11:49 dovecot_login authenticator failed for 216.106.67.50.reverse.socket.net [216.106.67.50]:45678: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)216.106.67.506252001.  =[% ossec13008gMail Reciepient rejected2025-03-19 03:09:40 H=(mail.gurukuljaipur.com) [45.197.14.29]:64196 F= rejected RCPT : Rejected relay attempt: '45.197.14.29' From: 'zmvil@gurukuljaipur.com' To: 'goofile@fastmail.com'45.197.14.296252001~  - ) ossec13001gExim Auth failed2025-03-19 03:08:37 dovecot_login authenticator failed for (136-34-165-114.googlefiber.net) [136.34.165.114]:35369: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)136.34.165.1146252001r}  -u# ossec13001gnExim Auth failed2025-03-19 02:58:13 dovecot_plain authenticator failed for syn-071-071-064-052.res.spectrum.com [71.71.64.52]:37719: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)71.71.64.526252001|  --' ossec13001g?Exim Auth failed2025-03-19 02:57:26 dovecot_plain authenticator failed for pool-99-251-252-98.cpe.net.cable.rogers.com [99.251.252.98]:43968: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)99.251.252.986251999 {&4 J ]  ~ *3<b\m{n  -g) ossec13001g Exim Auth failed2025-03-19 05:44:58 dovecot_login authenticator failed for ([193.234.119.53]) [193.234.119.53]:45404: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)193.234.119.532661886k  -c' ossec13001g Exim Auth failed2025-03-19 05:33:49 dovecot_login authenticator failed for ([46.188.106.71]) [46.188.106.71]:59165: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)46.188.106.712017370  -) ossec13001g Exim Auth failed2025-03-19 05:30:22 dovecot_login authenticator failed for 47-158-210-137.lsan.ca.frontiernet.net [47.158.210.137]:57418: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)47.158.210.1376252001V  -7) ossec13001g +Exim Auth failed2025-03-19 05:30:42 dovecot_login authenticator failed for ([218.94.115.164]) [218.94.115.164]:56048: 535 Incorrect authentication data (set_id=info)218.94.115.1641814991s  -q) ossec13001gExim Auth failed2025-03-19 05:19:48 dovecot_login authenticator failed for ([175.116.66.199]) [175.116.66.199]:36980: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)175.116.66.1991835841s  -q) ossec13001gExim Auth failed2025-03-19 04:54:22 dovecot_login authenticator failed for ([222.160.99.210]) [222.160.99.210]:53395: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)222.160.99.2101814991d  -W% ossec13001gExim Auth failed2025-03-19 04:51:24 dovecot_plain authenticator failed for ([193.93.237.8]) [193.93.237.8]:55078: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)193.93.237.82017370Z  -A) ossec13001gExim Auth failed2025-03-19 04:46:11 dovecot_login authenticator failed for (User) [193.46.255.184]:54060: 535 Incorrect authentication data (set_id=backup@technobases.in)193.46.255.184798549Y -=) ossec13001gExim Auth failed2025-03-19 04:45:13 dovecot_login authenticator failed for (User) [193.46.255.184]:57452: 535 Incorrect authentication data (set_id=info@technobases.in)193.46.255.184798549Y -=) ossec13001gCExim Auth failed2025-03-19 04:44:09 dovecot_login authenticator failed for (User) [193.46.255.184]:52886: 535 Incorrect authentication data (set_id=root@technobases.in)193.46.255.184798549P  -/% ossec13001gExim Auth failed2025-03-19 04:42:50 dovecot_login authenticator failed for ([221.4.48.164]) [221.4.48.164]:44974: 535 Incorrect authentication data (set_id=info)221.4.48.1641814991}  -' ossec13001gExim Auth failed2025-03-19 04:42:26 dovecot_login authenticator failed for dhcp-4-bc-9f-52-b7-f.cpe.i-zoom.net [24.244.93.233]:35285: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)24.244.93.2336251999Z  -?) ossec13001gExim Auth failed2025-03-19 04:32:26 dovecot_plain authenticator failed for ([37.113.117.120]) [37.113.117.120]:53284: 535 Incorrect authentication data (set_id=services)37.113.117.1202017370i  -a' ossec13001gxExim Auth failed2025-03-19 04:32:16 dovecot_plain authenticator failed for ([46.30.163.125]) [46.30.163.125]:51836: 535 Incorrect authentication data (set_id=services@heipowersystem.com)46.30.163.125690791f  -[' ossec13001g>Exim Auth failed2025-03-19 04:31:16 dovecot_plain authenticator failed for ([94.204.100.40]) [94.204.100.40]:60435: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)94.204.100.40290557n  -g) ossec13001gExim Auth failed2025-03-19 04:16:22 dovecot_login authenticator failed for ([46.138.247.195]) [46.138.247.195]:52102: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)46.138.247.1952017370V  -7) ossec13001gExim Auth failed2025-03-19 04:16:37 dovecot_login authenticator failed for ([103.115.31.219]) [103.115.31.219]:54108: 535 Incorrect authentication data (set_id=info)103.115.31.2191643084 3 ; N 5SaU.  -9% ossec13001g Exim Auth failed2025-03-19 07:08:35 dovecot_login authenticator failed for ([60.174.35.18]) [60.174.35.18]:44784: 535 Incorrect authentication data (set_id=admission)60.174.35.181814991s-  -q) ossec13001gExim Auth failed2025-03-19 07:07:46 dovecot_login authenticator failed for ([186.96.101.123]) [186.96.101.123]:55304: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)186.96.101.1233686110k,  -c' ossec13001gExim Auth failed2025-03-19 07:06:44 dovecot_login authenticator failed for ([27.40.100.131]) [27.40.100.131]:59649: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)27.40.100.1311814991b+  -O) ossec13001gExim Auth failed2025-03-19 06:46:07 dovecot_login authenticator failed for ([223.177.160.78]) [223.177.160.78]:37804: 535 Incorrect authentication data (set_id=vikas.khandelwal)223.177.160.781269750l*  -i# ossec13001gExim Auth failed2025-03-19 06:45:26 dovecot_login authenticator failed for ([59.0.10.191]) [59.0.10.191]:43922: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)59.0.10.1911835841S)  -3' ossec13001g]Exim Auth failed2025-03-19 06:39:48 dovecot_login authenticator failed for ([90.188.40.123]) [90.188.40.123]:54444: 535 Incorrect authentication data (set_id=info)90.188.40.1232017370n(  -g) ossec13001gOExim Auth failed2025-03-19 06:39:34 dovecot_login authenticator failed for ([218.98.160.117]) [218.98.160.117]:30196: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)218.98.160.1171814991^'  -E+ ossec13001g5Exim Auth failed2025-03-19 06:34:53 dovecot_login authenticator failed for ([123.209.118.166]) [123.209.118.166]:39282: 535 Incorrect authentication data (set_id=admission)123.209.118.1662077456"&  3M% ossec11301g)New FTP connection.Mar 19 06:34:39 vm1 pure-ftpd[1336924]: (?@139.162.77.6) [INFO] New connection from 139.162.77.6139.162.77.61861060s%  -q) ossec13001g Exim Auth failed2025-03-19 06:34:09 dovecot_login authenticator failed for ([67.213.230.122]) [67.213.230.122]:16403: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)67.213.230.1226252001o$  -k' ossec13001gExim Auth failed2025-03-19 06:32:59 dovecot_login authenticator failed for (heipowersystem.com) [111.56.54.202]:50034: 535 Incorrect authentication data (set_id=postmaster@heipowersystem.com)111.56.54.2021814991Y#  -?' ossec13001gExim Auth failed2025-03-19 06:32:18 dovecot_login authenticator failed for (heipowersystem.com) [111.56.54.202]:46542: 535 Incorrect authentication data (set_id=nologin)111.56.54.2021814991("  3U) ossec11301gNew FTP connection.Mar 19 06:19:40 vm1 pure-ftpd[1333813]: (?@167.94.138.167) [INFO] New connection from 167.94.138.167167.94.138.1676252001i!  -a% ossec13001g Exim Auth failed2025-03-19 05:51:31 dovecot_login authenticator failed for p5b2d5cb1.dip0.t-ipconnect.de [91.45.92.177]:43356: 535 Incorrect authentication data (set_id=vikas.khandelwal)91.45.92.1772921044t  -u) ossec13001g Exim Auth failed2025-03-19 05:50:53 dovecot_login authenticator failed for ([147.235.226.51]) [147.235.226.51]:51354: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)147.235.226.51294640g  -a! ossec13001g Exim Auth failed2025-03-19 05:49:16 dovecot_login authenticator failed for ([5.79.241.9]) [5.79.241.9]:55841: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)5.79.241.92017370^  -E+ ossec13001g Exim Auth failed2025-03-19 05:49:48 dovecot_login authenticator failed for ([115.144.115.150]) [115.144.115.150]:38871: 535 Incorrect authentication data (set_id=admission)115.144.115.1501835841  ! E  /BZez?  -' ossec13001g3xExim Auth failed2025-03-19 08:31:10 dovecot_login authenticator failed for d54c70cda.static.telenet.be [84.199.12.218]:35136: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)84.199.12.2182802361y>  -}) ossec13001g/Exim Auth failed2025-03-19 08:14:15 dovecot_plain authenticator failed for ([49.124.154.172]) [49.124.154.172]:39842: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)49.124.154.1721733045t=  -w% ossec13001g/Exim Auth failed2025-03-19 08:14:42 dovecot_plain authenticator failed for syn-097-092-033-136.res.spectrum.com [97.92.33.136]:48288: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)97.92.33.1366252001b<  -Q' ossec13001g/Exim Auth failed2025-03-19 08:12:28 dovecot_login authenticator failed for 24-119-144-86.cpe.sparklight.net [24.119.144.86]:53656: 535 Incorrect authentication data (set_id=info)24.119.144.866252001q;  -k+ ossec13001g/Exim Auth failed2025-03-19 08:12:12 dovecot_login authenticator failed for ([193.234.119.149]) [193.234.119.149]:53266: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)193.234.119.1492661886d:  -S) ossec13001g.!Exim Auth failed2025-03-19 08:08:23 dovecot_plain authenticator failed for (207.122.87.116.starhub.net.sg) [116.87.122.207]:47850: 535 Incorrect authentication data (set_id=sales)116.87.122.2071880251i9  -_) ossec13001g.Exim Auth failed2025-03-19 08:07:56 dovecot_plain authenticator failed for ([196.189.59.226]) [196.189.59.226]:49523: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)196.189.59.226337996X8  -=' ossec13001g,Exim Auth failed2025-03-19 08:01:35 dovecot_login authenticator failed for ([180.113.14.60]) [180.113.14.60]:43768: 535 Incorrect authentication data (set_id=admission)180.113.14.601814991m7  -i% ossec13001g,|Exim Auth failed2025-03-19 08:01:24 dovecot_login authenticator failed for ([103.4.103.61]) [103.4.103.61]:36348: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)103.4.103.6111685796  -) ossec13001g)'Exim Auth failed2025-03-19 07:47:11 dovecot_plain authenticator failed for (104.226.75.138.unknown.m1.com.sg) [138.75.226.104]:40623: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)138.75.226.1041880251d5  -W% ossec13001g)1Exim Auth failed2025-03-19 07:47:21 dovecot_plain authenticator failed for vps-0b1302de.vps.ovh.net [51.91.10.114]:51446: 535 Incorrect authentication data (set_id=vikas.khandelwal)51.91.10.1143017382(4  3U) ossec11301g(New FTP connection.Mar 19 07:45:50 vm1 pure-ftpd[1352255]: (?@104.152.52.179) [INFO] New connection from 104.152.52.179104.152.52.1796252001(3  3U) ossec11301g(New FTP connection.Mar 19 07:45:32 vm1 pure-ftpd[1352226]: (?@104.152.52.231) [INFO] New connection from 104.152.52.231104.152.52.2316252001X2  -=' ossec13001g&AExim Auth failed2025-03-19 07:34:48 dovecot_login authenticator failed for ([41.224.62.206]) [41.224.62.206]:33006: 535 Incorrect authentication data (set_id=admission)41.224.62.2062464461s1  -q) ossec13001g&5Exim Auth failed2025-03-19 07:34:35 dovecot_login authenticator failed for ([111.207.231.67]) [111.207.231.65]:62711: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)111.207.231.651814991u0  -u) ossec13001g$Exim Auth failed2025-03-19 07:29:10 dovecot_plain authenticator failed for ([101.168.24.115]) [101.168.24.115]:42882: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)101.168.24.1152077456k/  -c' ossec13001g"Exim Auth failed2025-03-19 07:18:50 dovecot_login authenticator failed for ([219.91.172.21]) [219.91.172.21]:33774: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)219.91.172.211269750 9 7 f !CUsTP  -7% ossec13001gDvExim Auth failed2025-03-19 09:43:42 dovecot_plain authenticator failed for ([60.172.53.82]) [60.172.53.82]:58046: 535 Incorrect authentication data (set_id=services)60.172.53.821814991YO  -;+ ossec13001gDfExim Auth failed2025-03-19 09:43:25 dovecot_login authenticator failed for ([178.178.194.203]) [178.178.194.203]:56996: 535 Incorrect authentication data (set_id=info)178.178.194.2032017370kN  -c' ossec13001gDZExim Auth failed2025-03-19 09:43:14 dovecot_login authenticator failed for ([60.15.194.158]) [60.15.194.158]:55499: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)60.15.194.1581814991mM  -e) ossec13001gDZExim Auth failed2025-03-19 09:43:13 dovecot_plain authenticator failed for ([49.124.133.103]) [49.124.133.103]:45980: 535 Incorrect authentication data (set_id=services@heipowersystem.com)49.124.133.1031733045^L  -E+ ossec13001gAExim Auth failed2025-03-19 09:32:10 dovecot_login authenticator failed for ([103.186.221.174]) [103.186.221.174]:48066: 535 Incorrect authentication data (set_id=admission)103.186.221.1741269750jK  -e# ossec13001gAExim Auth failed2025-03-19 09:32:01 dovecot_login authenticator failed for ([59.96.62.29]) [59.96.62.29]:43098: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)59.96.62.291269750ZJ  -?) ossec13001gA Exim Auth failed2025-03-19 09:29:05 dovecot_plain authenticator failed for ([193.234.119.22]) [193.234.119.22]:43700: 535 Incorrect authentication data (set_id=services)193.234.119.222661886mI  -e) ossec13001g@Exim Auth failed2025-03-19 09:28:54 dovecot_plain authenticator failed for ([50.188.204.213]) [50.188.204.213]:58082: 535 Incorrect authentication data (set_id=services@heipowersystem.com)50.188.204.2136252001&H 3Q' ossec11301g>New FTP connection.Mar 19 09:19:26 vm1 pure-ftpd[1372155]: (?@152.32.211.35) [INFO] New connection from 152.32.211.35152.32.211.351819730YG  -;+ ossec13001g=Exim Auth failed2025-03-19 09:14:07 dovecot_login authenticator failed for ([223.241.214.127]) [223.241.214.127]:32845: 535 Incorrect authentication data (set_id=info)223.241.214.1271814991qF  -k+ ossec13001g=dExim Auth failed2025-03-19 09:13:32 dovecot_login authenticator failed for ([211.104.166.110]) [211.104.166.110]:54515: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)211.104.166.1101835841vE  -u+ ossec13001g<Exim Auth failed2025-03-19 09:10:38 dovecot_login authenticator failed for ([223.167.121.164]) [223.167.121.164]:53446: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)223.167.121.1641814991ZD  -?) ossec13001g<Exim Auth failed2025-03-19 09:10:50 dovecot_login authenticator failed for ([121.168.210.98]) [121.168.210.98]:2137: 535 Incorrect authentication data (set_id=admission)121.168.210.981835841MC  -+# ossec13001g6Exim Auth failed2025-03-19 08:41:59 dovecot_login authenticator failed for ([59.0.10.191]) [59.0.10.191]:58292: 535 Incorrect authentication data (set_id=info)59.0.10.1911835841~B  -) ossec13001g5Exim Auth failed2025-03-19 08:41:48 dovecot_login authenticator failed for (104.226.75.138.unknown.m1.com.sg) [138.75.226.104]:39094: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)138.75.226.1041880251VA  -9) ossec13001g5Exim Auth failed2025-03-19 08:40:17 dovecot_login authenticator failed for ([172.104.238.129]) [147.235.221.57]:5894: 535 Incorrect authentication data (set_id=sales)147.235.221.57294640i@  -_) ossec13001g5Exim Auth failed2025-03-19 08:39:51 dovecot_login authenticator failed for ([85.159.165.216]) [85.159.165.216]:32880: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)85.159.165.216294640 @ U ^  /=amprPa  -/% ossec13001gZhExim Auth failed2025-03-19 11:17:19 dovecot_login authenticator failed for ([175.4.106.99]) [175.4.106.99]:41476: 535 Incorrect authentication data (set_id=info)175.4.106.991814991z`  -' ossec13001gZWExim Auth failed2025-03-19 11:17:03 dovecot_login authenticator failed for 61-220-220-99.hinet-ip.hinet.net [61.220.220.99]:39470: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)61.220.220.991668284y_  -% ossec13001gY1Exim Auth failed2025-03-19 11:12:08 dovecot_plain authenticator failed for 48.211.41.34.bc.googleusercontent.com [34.41.211.48]:56488: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)34.41.211.486252001p^  -m' ossec13001gRExim Auth failed2025-03-19 10:45:28 dovecot_login authenticator failed for ([116.88.187.44]) [116.88.187.44]:47230: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)116.88.187.441880251X]  -=' ossec13001gSExim Auth failed2025-03-19 10:45:45 dovecot_login authenticator failed for ([221.157.85.22]) [221.157.85.22]:52210: 535 Incorrect authentication data (set_id=admission)221.157.85.221835841n\  -g) ossec13001gMExim Auth failed2025-03-19 10:24:11 dovecot_login authenticator failed for ([218.150.170.10]) [218.150.170.10]:59304: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)218.150.170.101835841X[  -=' ossec13001gN Exim Auth failed2025-03-19 10:24:55 dovecot_login authenticator failed for ([61.185.30.170]) [61.185.30.170]:34476: 535 Incorrect authentication data (set_id=admission)61.185.30.1701814991pZ  -m' ossec13001gNExim Auth failed2025-03-19 10:24:30 dovecot_login authenticator failed for ([221.157.85.22]) [221.157.85.22]:37268: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)221.157.85.221835841VY  -7) ossec13001gNExim Auth failed2025-03-19 10:24:29 dovecot_login authenticator failed for ([191.59.177.235]) [191.59.177.235]:41960: 535 Incorrect authentication data (set_id=info)191.59.177.2353469034VX  -7) ossec13001gKFExim Auth failed2025-03-19 10:12:45 dovecot_login authenticator failed for mail-02.03.perm.ru [46.146.210.180]:20026: 535 Incorrect authentication data (set_id=info)46.146.210.1802017370qW  -k+ ossec13001gK>Exim Auth failed2025-03-19 10:12:37 dovecot_login authenticator failed for ([111.194.239.233]) [111.194.239.233]:42662: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)111.194.239.2331814991WV  -;' ossec13001gHExim Auth failed2025-03-19 10:01:56 dovecot_login authenticator failed for ([106.86.209.86]) [106.86.209.86]:9166: 535 Incorrect authentication data (set_id=admission)106.86.209.861814991WU  -9) ossec13001gHExim Auth failed2025-03-19 10:01:36 dovecot_plain authenticator failed for ([37.113.117.120]) [37.113.117.120]:54290: 535 Incorrect authentication data (set_id=sales)37.113.117.1202017370sT  -q) ossec13001gHExim Auth failed2025-03-19 10:01:26 dovecot_login authenticator failed for ([123.209.83.241]) [123.209.83.241]:51046: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)123.209.83.2412077456gS  -[' ossec13001gHExim Auth failed2025-03-19 10:01:22 dovecot_plain authenticator failed for ([213.137.44.74]) [213.137.44.74]:47924: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)213.137.44.743175395XR  -;) ossec13001gE~Exim Auth failed2025-03-19 09:48:05 dovecot_plain authenticator failed for ([159.223.250.131]) [161.35.200.202]:50818: 535 Incorrect authentication data (set_id=sales)161.35.200.2022921044`Q  -S# ossec13001gEnExim Auth failed2025-03-19 09:47:50 dovecot_plain authenticator failed for ([5.30.215.71]) [5.30.215.71]:39346: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)5.30.215.71290557 1 B h z !CLmvr  -u+ ossec13001guExim Auth failed2025-03-19 13:13:00 dovecot_login authenticator failed for ([111.194.239.233]) [111.194.239.233]:49450: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)111.194.239.2331814991aq  -S# ossec13001gq Exim Auth failed2025-03-19 12:53:52 dovecot_plain authenticator failed for ([112.94.6.54]) [112.94.6.54]:20384: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)112.94.6.541814991xp  -y+ ossec13001goXExim Auth failed2025-03-19 12:46:40 dovecot_plain authenticator failed for ([112.172.126.158]) [112.172.126.158]:57225: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)112.172.126.1581835841go  -[' ossec13001gmExim Auth failed2025-03-19 12:37:06 dovecot_login authenticator failed for (nyaystambh.com) [111.56.54.202]:34210: 535 Incorrect authentication data (set_id=postmaster@nyaystambh.com)111.56.54.2021814991Un  -7' ossec13001gmExim Auth failed2025-03-19 12:36:39 dovecot_login authenticator failed for (nyaystambh.com) [111.56.54.202]:59278: 535 Incorrect authentication data (set_id=nologin)111.56.54.2021814991[m  -A) ossec13001glExim Auth failed2025-03-19 12:36:02 dovecot_login authenticator failed for ([178.178.222.59]) [178.178.222.59]:43020: 535 Incorrect authentication data (set_id=admission)178.178.222.592017370sl  -q) ossec13001glExim Auth failed2025-03-19 12:35:48 dovecot_login authenticator failed for ([191.210.87.101]) [191.210.87.101]:54883: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)191.210.87.1013469034Zk  -?) ossec13001glExim Auth failed2025-03-19 12:34:48 dovecot_plain authenticator failed for ([121.189.198.60]) [121.189.198.60]:51236: 535 Incorrect authentication data (set_id=services)121.189.198.601835841pj  -i+ ossec13001glpExim Auth failed2025-03-19 12:34:14 dovecot_plain authenticator failed for ([221.162.190.163]) [221.162.190.163]:50566: 535 Incorrect authentication data (set_id=services@heipowersystem.com)221.162.190.1631835841i  3I# ossec11301gjNew FTP connection.Mar 19 12:26:50 vm1 pure-ftpd[1412185]: (?@5.62.61.195) [INFO] New connection from 5.62.61.1955.62.61.1953077311Ph  -/% ossec13001ggExim Auth failed2025-03-19 12:11:25 dovecot_login authenticator failed for ([113.192.1.27]) [113.192.1.26]:57020: 535 Incorrect authentication data (set_id=info)113.192.1.261643084jg  -c' ossec13001ggExim Auth failed2025-03-19 12:11:10 dovecot_login authenticator failed for ([94.201.79.121]) [94.201.79.121]:60146: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)94.201.79.121290557jf  -e# ossec13001ga[Exim Auth failed2025-03-19 11:46:59 dovecot_login authenticator failed for (thepsindustries.com) [14.18.77.99]:35606: 535 Incorrect authentication data (set_id=support@thepsindustries.com)14.18.77.991814991Ve  -=# ossec13001gaAExim Auth failed2025-03-19 11:46:33 dovecot_login authenticator failed for (thepsindustries.com) [14.18.77.99]:59390: 535 Incorrect authentication data (set_id=nologin)14.18.77.991814991kd  -c' ossec13001g]Exim Auth failed2025-03-19 11:31:19 dovecot_login authenticator failed for ([49.245.10.228]) [49.245.10.228]:46857: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)49.245.10.2281880251^c  -E+ ossec13001gZExim Auth failed2025-03-19 11:19:07 dovecot_login authenticator failed for ([114.215.211.223]) [114.215.211.223]:38204: 535 Incorrect authentication data (set_id=admission)114.215.211.2231814991ib  -e# ossec13001gZExim Auth failed2025-03-19 11:18:55 dovecot_login authenticator failed for ([5.30.177.55]) [5.30.177.55]:60610: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)5.30.177.55290557 P)  , = [ f8Pd  -Y# ossec13001gڋGExim Auth failed2025-03-19 14:45:50 dovecot_plain authenticator failed for ([24.121.0.70]) [24.121.0.70]:48841: 535 Incorrect authentication data (set_id=services@heipowersystem.com)24.121.0.706252001+  3Y+ ossec11301gډNew FTP connection.Mar 19 14:40:00 vm1 pure-ftpd[1441093]: (?@172.172.245.168) [INFO] New connection from 172.172.245.168172.172.245.1686252001m  -i% ossec13001gڅExim Auth failed2025-03-19 14:21:44 dovecot_login authenticator failed for ([36.48.70.211]) [36.48.70.211]:54574: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)36.48.70.2111814991O  -/% ossec13001gڃExim Auth failed2025-03-19 14:10:34 dovecot_login authenticator failed for ([185.226.88.5]) [185.226.88.5]:41840: 535 Incorrect authentication data (set_id=info)185.226.88.5783754z  -) ossec13001gڂExim Auth failed2025-03-19 14:10:26 dovecot_login authenticator failed for ip72-199-156-231.sd.sd.cox.net [72.199.156.231]:39259: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)72.199.156.2316252001S~  -3' ossec13001gڀExim Auth failed2025-03-19 13:59:55 dovecot_login authenticator failed for ([49.124.153.59]) [49.124.153.59]:57686: 535 Incorrect authentication data (set_id=info)49.124.153.591733045}  - ) ossec13001gڀUExim Auth failed2025-03-19 13:59:07 dovecot_login authenticator failed for syn-172-100-186-071.res.spectrum.com [172.100.186.71]:33418: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)172.100.186.716252001|  -' ossec13001gExim Auth failed2025-03-19 13:55:54 dovecot_login authenticator failed for syn-172-090-128-097.res.spectrum.com [172.90.128.97]:59869: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)172.90.128.976252001{  - + ossec13001gpExim Auth failed2025-03-19 13:55:20 dovecot_login authenticator failed for p50163-obmd01.osaka.ocn.ne.jp [153.141.237.163]:45820: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)153.141.237.1631861060Sz  -3' ossec13001g{Exim Auth failed2025-03-19 13:39:35 dovecot_login authenticator failed for ([106.37.103.82]) [106.37.103.82]:49923: 535 Incorrect authentication data (set_id=info)106.37.103.821814991qy  -k+ ossec13001g{Exim Auth failed2025-03-19 13:39:17 dovecot_login authenticator failed for ([201.183.225.156]) [201.183.225.156]:38751: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)201.183.225.1563658394^x  -I' ossec13001gzExim Auth failed2025-03-19 13:35:00 dovecot_login authenticator failed for (6-red145.ceviamonte.com.ar) [143.202.145.6]:56831: 535 Incorrect authentication data (set_id=info)143.202.145.63865483kw  -c' ossec13001gzExim Auth failed2025-03-19 13:34:38 dovecot_login authenticator failed for ([106.37.103.82]) [106.37.103.82]:38166: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)106.37.103.821814991cv  -S' ossec13001gyExim Auth failed2025-03-19 13:31:44 dovecot_plain authenticator failed for ([125.21.141.54]) [125.21.141.54]:61721: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)125.21.141.541269750u  --+ ossec13001gyExim Auth failed2025-03-19 13:31:19 dovecot_plain authenticator failed for broadband-178-140-152-209.ip.moscow.rt.ru [178.140.152.209]:51100: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)178.140.152.2092017370mt  -i% ossec13001gw Exim Auth failed2025-03-19 13:19:30 dovecot_login authenticator failed for ([60.11.250.94]) [60.11.250.94]:41557: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)60.11.250.941814991bs  -M+ ossec13001gwExim Auth failed2025-03-19 13:19:39 dovecot_login authenticator failed for vps-c0881553.vps.ovh.ca [148.113.201.143]:57178: 535 Incorrect authentication data (set_id=admission)148.113.201.1436251999 t j g d b XSMGE@<< '13.76.211.253BLACKgg۝Blacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests1880251 Llocal} #4.185.54.73BLACKgɕgۚBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests29210446Ilocal'128.24.77.171BLACKggۗBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests6252001Mlocal~%13.74.101.96BLACKggێBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests2963597 Je`local~%52.163.95.69BLACKggۂBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests18802514_Elocal%192.99.13.69BLACKg'gہ'Blacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests6251999c Elocal'37.60.249.237BLACKg譹g~Blacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests2921044%<local'185.4.176.103BLACKg8g[8Blacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests2635167glocal~%13.79.52.158BLACKg$gU$Blacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests2963597 O4local~%13.74.154.95BLACKg~;gO;Blacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests2963597 J_local)20.169.151.131BLACKg{gLBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests6252001local)170.39.218.246BLACKgugFBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests6251999'local~)52.169.181.211BLACKgVg'Blacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests29635974local}'13.74.185.216BLACKgTg%Blacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests2963597 Jlocal}|#4.185.55.85BLACKgK&g&Blacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests29210447Ulocal{'74.225.150.60BLACKg9 g Blacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests1269750J<local~z%4.185.49.209BLACKggϙBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests29210441local~y%23.102.2.211BLACKgXgXBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests2963597flocalx'13.74.255.122BLACKggڿBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests2963597 Jzlocalw)135.235.156.42BLACKg]gڽ]Blacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests1269750*localv%192.99.36.61BLACKgEgڽEBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests6251999c$=localu)152.69.220.151BLACKggڹBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests1880251Eܗlocalt'128.24.77.249BLACKg繻gڊBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests6252001Mlocal~s%20.246.27.88BLACKggڄBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests6252001Xlocal h"* T f p <5Yhm  -m! ossec13001gڥDExim Auth failed2025-03-19 16:36:43 dovecot_plain authenticator failed for ([27.0.61.49]) [27.0.61.49]:48350: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)27.0.61.491269750X  -=' ossec13001gڤJExim Auth failed2025-03-19 16:32:32 dovecot_login authenticator failed for ([14.29.244.223]) [14.29.244.223]:47894: 535 Incorrect authentication data (set_id=admission)14.29.244.2231814991  -' ossec13001gڤ4Exim Auth failed2025-03-19 16:32:10 dovecot_login authenticator failed for syn-097-089-202-226.biz.spectrum.com [97.89.202.226]:51877: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)97.89.202.2266252001W  -9) ossec13001gڣExim Auth failed2025-03-19 16:31:00 dovecot_plain authenticator failed for ([121.189.226.81]) [121.189.226.81]:45926: 535 Incorrect authentication data (set_id=sales)121.189.226.811835841j  -_) ossec13001gڣExim Auth failed2025-03-19 16:30:19 dovecot_plain authenticator failed for ([114.202.80.152]) [114.202.80.152]:47870: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)114.202.80.1521835841S  -3' ossec13001gڠExim Auth failed2025-03-19 16:17:41 dovecot_login authenticator failed for ([92.255.190.69]) [92.255.190.69]:46716: 535 Incorrect authentication data (set_id=info)92.255.190.692017370z  -' ossec13001gڠExim Auth failed2025-03-19 16:17:20 dovecot_login authenticator failed for 211-20-26-201.hinet-ip.hinet.net [211.20.26.201]:56554: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)211.20.26.2011668284[  -G% ossec13001gښExim Auth failed2025-03-19 15:52:02 dovecot_plain authenticator failed for ([154.73.19.69]) [154.73.19.69]:36740: 535 Incorrect authentication data (set_id=vikas.khandelwal)154.73.19.69953987u  -u) ossec13001gښExim Auth failed2025-03-19 15:51:39 dovecot_plain authenticator failed for ([95.167.133.126]) [95.167.133.126]:43188: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)95.167.133.1262017370}  -) ossec13001gڒExim Auth failed2025-03-19 15:18:24 dovecot_login authenticator failed for 125-228-225-91.hinet-ip.hinet.net [125.228.225.91]:55868: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)125.228.225.911668284V  -7) ossec13001gڒExim Auth failed2025-03-19 15:18:39 dovecot_login authenticator failed for ([107.172.86.133]) [107.172.86.133]:39032: 535 Incorrect authentication data (set_id=info)107.172.86.1336252001_  -K' ossec13001gڐExim Auth failed2025-03-19 15:10:06 dovecot_login authenticator failed for ([14.49.245.167]) [14.49.245.167]:47430: 535 Incorrect authentication data (set_id=vikas.khandelwal)14.49.245.1671835841r  -q' ossec13001gڐExim Auth failed2025-03-19 15:09:47 dovecot_login authenticator failed for ([102.221.65.24]) [102.221.65.24]:35990: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)102.221.65.242413451j  -_) ossec13001gڏExim Auth failed2025-03-19 15:05:21 dovecot_plain authenticator failed for ([121.11.145.133]) [121.11.145.133]:53862: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)121.11.145.1331814991R  -5# ossec13001gڌExim Auth failed2025-03-19 14:52:11 dovecot_login authenticator failed for ([49.0.129.12]) [49.0.129.12]:57194: 535 Incorrect authentication data (set_id=admission)49.0.129.122029969t  -w% ossec13001gڌExim Auth failed2025-03-19 14:51:49 dovecot_login authenticator failed for vps-7ab348b7.vps.ovh.ca [51.79.159.68]:40144: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)51.79.159.681880251Z  -?) ossec13001gڋiExim Auth failed2025-03-19 14:46:24 dovecot_plain authenticator failed for ([112.15.144.140]) [112.15.144.140]:37296: 535 Incorrect authentication data (set_id=services)112.15.144.1401814991  6 J `  $0SbYkj$  -_) ossec13001gڻ?Exim Auth failed2025-03-19 18:10:30 dovecot_plain authenticator failed for ([217.115.87.186]) [217.115.87.186]:50351: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)217.115.87.1862017370_#  -K' ossec13001gڹeExim Auth failed2025-03-19 18:02:35 dovecot_plain authenticator failed for ([122.252.246.1]) [122.252.246.1]:50986: 535 Incorrect authentication data (set_id=vikas.khandelwal)122.252.246.11269750x"  -y+ ossec13001gڹUExim Auth failed2025-03-19 18:02:20 dovecot_plain authenticator failed for ([176.118.213.147]) [176.118.213.147]:59624: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)176.118.213.1472017370V!  -7) ossec13001gڷExim Auth failed2025-03-19 17:55:27 dovecot_login authenticator failed for ([221.167.21.148]) [221.167.21.148]:60632: 535 Incorrect authentication data (set_id=info)221.167.21.1481835841j  -c' ossec13001gڷExim Auth failed2025-03-19 17:55:04 dovecot_login authenticator failed for ([185.167.59.53]) [185.167.59.53]:58400: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)185.167.59.53617790  -) ossec13001gڷ"Exim Auth failed2025-03-19 17:52:57 dovecot_login authenticator failed for syn-070-122-139-172.res.spectrum.com [70.122.139.172]:55824: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)70.122.139.1726252001m  -e) ossec13001gڶExim Auth failed2025-03-19 17:51:51 dovecot_plain authenticator failed for ([39.164.127.195]) [39.164.127.195]:41812: 535 Incorrect authentication data (set_id=services@heipowersystem.com)39.164.127.1951814991Y  -;+ ossec13001gڴExim Auth failed2025-03-19 17:42:19 dovecot_login authenticator failed for ([119.145.188.130]) [119.145.188.130]:47736: 535 Incorrect authentication data (set_id=info)119.145.188.1301814991p  -o% ossec13001gڴxExim Auth failed2025-03-19 17:41:35 dovecot_login authenticator failed for vps-79f20bfc.vps.ovh.net [51.75.24.107]:11816: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)51.75.24.1073017382s  -s) ossec13001gڱExim Auth failed2025-03-19 17:29:24 dovecot_login authenticator failed for ([172.104.238.129]) [147.235.219.22]:10352: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)147.235.219.22294640A  =% ossec13008gگMail Reciepient rejected2025-03-19 17:20:35 H=(mail.amplifypowerglobal.com) [45.197.14.29]:54981 F= rejected RCPT : Rejected relay attempt: '45.197.14.29' From: 'mzyfxqp@amplifypowerglobal.com' To: 'goofile@fastmail.com'45.197.14.296252001f  -[% ossec13001gڭExim Auth failed2025-03-19 17:09:45 dovecot_login authenticator failed for broadband-77-37-200-33.ip.moscow.rt.ru [77.37.200.33]:60252: 535 Incorrect authentication data (set_id=info)77.37.200.332017370h  -_% ossec13001gڬExim Auth failed2025-03-19 17:09:12 dovecot_login authenticator failed for ([103.68.38.78]) [103.68.38.78]:53230: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)103.68.38.781269750[  -A) ossec13001gکExim Auth failed2025-03-19 16:56:34 dovecot_login authenticator failed for ([109.194.243.49]) [109.194.243.49]:57700: 535 Incorrect authentication data (set_id=admission)109.194.243.492017370  - ' ossec13001gکExim Auth failed2025-03-19 16:55:57 dovecot_login authenticator failed for b217-29-190-97.pppoe.mark-itt.net [217.29.190.97]:55588: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)217.29.190.972017370c  -S' ossec13001gڥnExim Auth failed2025-03-19 16:37:25 dovecot_plain authenticator failed for ([58.246.100.27]) [58.246.100.27]:29426: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)58.246.100.271814991 (3 E m j !B<Mg5  -[' ossec13001gExim Auth failed2025-03-19 19:47:19 dovecot_login authenticator failed for ([58.248.159.20]) [58.248.159.20]:55810: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)58.248.159.201814991j4  -a' ossec13001ggExim Auth failed2025-03-19 19:45:03 dovecot_login authenticator failed for ([45.250.249.12]) [45.250.249.12]:43810: 535 Incorrect authentication data (set_id=services@heipowersystem.com)45.250.249.121269750v3  -u+ ossec13001gϮExim Auth failed2025-03-19 19:37:42 dovecot_login authenticator failed for ([113.108.180.218]) [113.108.180.218]:45864: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)113.108.180.2181814991I2  -'! ossec13001g2Exim Auth failed2025-03-19 19:27:05 dovecot_login authenticator failed for ([149.0.16.4]) [149.0.16.4]:54942: 535 Incorrect authentication data (set_id=info)149.0.16.4298795k1  -c' ossec13001g$Exim Auth failed2025-03-19 19:26:50 dovecot_login authenticator failed for ([45.117.10.134]) [45.117.10.134]:53530: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)45.117.10.13418149910  -) ossec13001ǧExim Auth failed2025-03-19 19:24:18 dovecot_login authenticator failed for 47-158-210-137.lsan.ca.frontiernet.net [47.158.210.137]:56268: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)47.158.210.1376252001[/  -A) ossec13001gɍExim Auth failed2025-03-19 19:11:33 dovecot_login authenticator failed for ([107.172.86.133]) [107.172.86.133]:49308: 535 Incorrect authentication data (set_id=admission)107.172.86.1336252001p.  -m' ossec13001gExim Auth failed2025-03-19 19:11:18 dovecot_login authenticator failed for ([136.56.34.147]) [136.56.34.147]:43342: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)136.56.34.1476252001"-  3M% ossec11301gFNew FTP connection.Mar 19 19:01:49 vm1 pure-ftpd[1498516]: (?@103.203.59.5) [INFO] New connection from 103.203.59.5103.203.59.51814991T,  -5' ossec13001gƨExim Auth failed2025-03-19 18:59:11 dovecot_login authenticator failed for ([103.48.194.21]) [103.48.194.21]:52184: 535 Incorrect authentication data (set_id=sales)103.48.194.211562822i+  -_) ossec13001gxExim Auth failed2025-03-19 18:58:23 dovecot_login authenticator failed for ([31.141.216.143]) [31.141.216.143]:44316: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)31.141.216.143298795f*  -W) ossec13001gExim Auth failed2025-03-19 18:47:32 dovecot_plain authenticator failed for ([191.59.176.133]) [191.59.176.133]:58674: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)191.59.176.1333469034)  - ' ossec13001gExim Auth failed2025-03-19 18:47:09 dovecot_plain authenticator failed for 46-10-103-204.ip.btc-net.bg [46.10.103.204]:34646: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)46.10.103.204732800T(  -5' ossec13001gyExim Auth failed2025-03-19 18:41:20 dovecot_plain authenticator failed for ([58.51.122.230]) [58.51.122.230]:32996: 535 Incorrect authentication data (set_id=sales)58.51.122.2301814991j'  -_) ossec13001gkExim Auth failed2025-03-19 18:41:07 dovecot_plain authenticator failed for ([116.227.56.171]) [116.227.56.171]:34082: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)116.227.56.1711814991q&  -o' ossec13001gExim Auth failed2025-03-19 18:33:11 dovecot_login authenticator failed for vps-0aeff849.vps.ovh.ca [51.222.206.10]:50914: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)51.222.206.106251999T%  -5' ossec13001gڻUExim Auth failed2025-03-19 18:10:53 dovecot_plain authenticator failed for ([182.55.101.39]) [182.55.101.39]:43560: 535 Incorrect authentication data (set_id=sales)182.55.101.391880251     3 -AU`gryr[E  -A) ossec13001g[Exim Auth failed2025-03-19 21:27:13 dovecot_login authenticator failed for ([193.234.119.22]) [193.234.119.22]:59564: 535 Incorrect authentication data (set_id=admission)193.234.119.222661886D  -' ossec13001gGExim Auth failed2025-03-19 21:26:53 dovecot_login authenticator failed for syn-024-090-169-209.res.spectrum.com [24.90.169.209]:44859: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)24.90.169.2096252001uC  -u) ossec13001g<Exim Auth failed2025-03-19 21:18:12 dovecot_login authenticator failed for (92x255x198x142.static-customer.kzn.ertelecom.ru) [92.255.198.142]:53249: 535 Incorrect authentication data (set_id=info)92.255.198.1422017370qB  -k+ ossec13001g4Exim Auth failed2025-03-19 21:18:04 dovecot_login authenticator failed for ([223.190.207.223]) [223.190.207.223]:55760: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)223.190.207.2231269750uA  -u) ossec13001glExim Auth failed2025-03-19 21:10:27 dovecot_plain authenticator failed for ([191.59.177.235]) [191.59.177.235]:56944: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)191.59.177.2353469034@  W' ossec9708gDovecot Aborted Login with empty userMar 19 21:06:38 vm1 dovecot[1250588]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=87.236.176.81, lip=103.74.54.108, TLS, session=87.236.176.812635167P?  -/% ossec13001gCExim Auth failed2025-03-19 21:05:30 dovecot_login authenticator failed for ([98.70.127.17]) [98.70.127.17]:41656: 535 Incorrect authentication data (set_id=info)98.70.127.171269750h>  -_% ossec13001g3Exim Auth failed2025-03-19 21:05:15 dovecot_login authenticator failed for ([103.95.156.1]) [42.1.117.226]:61305: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)42.1.117.2261562822h=  -[) ossec13001g/Exim Auth failed2025-03-19 20:52:23 dovecot_login authenticator failed for adsl-84-226-219-137.adslplus.ch [84.226.219.137]:35158: 535 Incorrect authentication data (set_id=admission)84.226.219.1372658434<  -' ossec13001g!Exim Auth failed2025-03-19 20:52:08 dovecot_login authenticator failed for dhcp-4-bc-9f-52-b7-f.cpe.i-zoom.net [24.244.93.233]:50929: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)24.244.93.2336251999[; -A' ossec13001gExim Auth failed2025-03-19 20:50:21 dovecot_login authenticator failed for (thepsindustries.com) [58.240.171.59]:41052: 535 Incorrect authentication data (set_id=nologin)58.240.171.591814991:  -) ossec13001gqExim Auth failed2025-03-19 20:27:53 dovecot_login authenticator failed for ppp-210-86-163-194.revip.asianet.co.th [210.86.163.194]:61367: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)210.86.163.1941605651|9  -) ossec13001gExim Auth failed2025-03-19 20:21:50 dovecot_plain authenticator failed for (unicordis-saomateus.fla.gvt.net.br) [177.19.150.182]:51564: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)177.19.150.1823469034R8  -3' ossec13001gExim Auth failed2025-03-19 20:08:18 dovecot_login authenticator failed for ([185.167.56.24]) [185.167.56.24]:40146: 535 Incorrect authentication data (set_id=info)185.167.56.246177907  -A% ossec13001g֬Exim Auth failed2025-03-19 20:07:32 dovecot_login authenticator failed for 61-216-7-163.hinet-ip.hinet.net (61-216-7-164.hinet-ip.hinet.net) [61.216.7.163]:55106: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)61.216.7.1631668284l6  -c) ossec13001gզExim Auth failed2025-03-19 20:03:09 dovecot_plain authenticator failed for ([175.116.66.199]) [175.116.66.199]:2144: 535 Incorrect authentication data (set_id=services@heipowersystem.com)175.116.66.1991835841 1' = = F H r+1vV  -u+ ossec13001g Exim Auth failed2025-03-19 23:45:50 dovecot_login authenticator failed for ([115.144.115.150]) [115.144.115.150]:54113: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)115.144.115.1501835841jU  -_) ossec13001gExim Auth failed2025-03-19 23:28:51 dovecot_plain authenticator failed for ([120.48.231.200]) [120.48.231.200]:36322: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)120.48.231.2001814991sT  -q) ossec13001g}Exim Auth failed2025-03-19 23:18:44 dovecot_login authenticator failed for ([119.62.156.161]) [119.62.156.161]:35118: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)119.62.156.1611814991_S  -K' ossec13001gExim Auth failed2025-03-19 23:18:54 dovecot_plain authenticator failed for ([88.84.209.146]) [88.84.209.146]:49426: 535 Incorrect authentication data (set_id=vikas.khandelwal)88.84.209.1462017370R  -) ossec13001g}Exim Auth failed2025-03-19 23:18:45 dovecot_plain authenticator failed for syn-070-122-139-172.res.spectrum.com [70.122.139.172]:50933: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)70.122.139.1726252001WQ  -;' ossec13001geExim Auth failed2025-03-19 23:09:48 dovecot_plain authenticator failed for ([120.157.0.117]) [120.157.0.117]:42558: 535 Incorrect authentication data (set_id=services)120.157.0.1172077456gP  -]% ossec13001gNExim Auth failed2025-03-19 23:09:25 dovecot_plain authenticator failed for ([222.180.2.62]) [222.180.2.62]:43021: 535 Incorrect authentication data (set_id=services@heipowersystem.com)222.180.2.621814991YO  -;+ ossec13001g|Exim Auth failed2025-03-19 23:01:40 dovecot_login authenticator failed for ([120.157.249.180]) [120.157.249.180]:44036: 535 Incorrect authentication data (set_id=info)120.157.249.1802077456kN  -c' ossec13001g^Exim Auth failed2025-03-19 23:01:09 dovecot_login authenticator failed for ([95.161.95.132]) [95.161.95.132]:50004: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)95.161.95.1322017370^M  -K% ossec13001g-Exim Auth failed2025-03-19 22:47:32 dovecot_login authenticator failed for (rokamauka.com) [125.72.54.81]:47708: 535 Incorrect authentication data (set_id=sales@rokamauka.com)125.72.54.811814991RL  -3% ossec13001gExim Auth failed2025-03-19 22:46:38 dovecot_login authenticator failed for (rokamauka.com) [125.72.54.81]:43012: 535 Incorrect authentication data (set_id=nologin)125.72.54.811814991zK  -' ossec13001g\Exim Auth failed2025-03-19 22:31:16 dovecot_login authenticator failed for d54c70cda.static.telenet.be [84.199.12.218]:50874: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)84.199.12.2182802361sJ  -q) ossec13001gExim Auth failed2025-03-19 21:58:33 dovecot_login authenticator failed for ([176.194.20.240]) [176.194.20.240]:33539: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)176.194.20.2402017370|I  -+ ossec13001gExim Auth failed2025-03-19 21:54:35 dovecot_plain authenticator failed for ([115.242.200.126]) [115.242.200.126]:44220: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)115.242.200.1261269750fH  -W) ossec13001gExim Auth failed2025-03-19 21:54:52 dovecot_plain authenticator failed for ([116.50.251.164]) [116.50.251.164]:56901: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)116.50.251.1641694008TG  -5' ossec13001grExim Auth failed2025-03-19 21:48:57 dovecot_plain authenticator failed for ([186.72.38.110]) [186.72.38.110]:53106: 535 Incorrect authentication data (set_id=sales)186.72.38.1103703430}F  -+ ossec13001g\Exim Auth failed2025-03-19 21:48:36 dovecot_plain authenticator failed for cpe-148-163-232-103.wireline.com.au [103.232.163.148]:46524: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)103.232.163.1482077456 B N p &Q_yh  -' ossec13001gExim Auth failed2025-03-20 01:18:33 dovecot_plain authenticator failed for 211-20-26-201.hinet-ip.hinet.net [211.20.26.201]:44768: 535 Incorrect authentication data (set_id=services@heipowersystem.com)211.20.26.2011668284Vg  -7) ossec13001g.Exim Auth failed2025-03-20 01:12:37 dovecot_login authenticator failed for ([195.122.224.64]) [195.122.224.64]:51894: 535 Incorrect authentication data (set_id=info)195.122.224.642017370nf  -g) ossec13001g$Exim Auth failed2025-03-20 01:12:28 dovecot_login authenticator failed for ([49.124.150.253]) [49.124.150.253]:56824: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)49.124.150.2531733045Qe  -1% ossec13001g4Exim Auth failed2025-03-20 01:04:11 dovecot_login authenticator failed for ([182.109.1.49]) [182.109.1.49]:39530: 535 Incorrect authentication data (set_id=sales)182.109.1.491814991md  -c+ ossec13001g$Exim Auth failed2025-03-20 01:03:56 dovecot_login authenticator failed for ([112.194.142.167]) [112.194.142.167]:42680: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)112.194.142.1671814991Pc  -/% ossec13001gExim Auth failed2025-03-20 01:01:53 dovecot_login authenticator failed for ([14.63.46.186]) [14.63.46.186]:60292: 535 Incorrect authentication data (set_id=info)14.63.46.1861835841hb  -_% ossec13001gExim Auth failed2025-03-20 01:01:35 dovecot_login authenticator failed for ([58.16.49.250]) [58.16.49.250]:35530: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)58.16.49.2501814991~a  -) ossec13001gExim Auth failed2025-03-20 00:57:55 dovecot_login authenticator failed for (182.90.156.175.unknown.m1.com.sg) [175.156.90.182]:32843: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)175.156.90.1821880251g`  -[' ossec13001gExim Auth failed2025-03-20 00:57:28 dovecot_login authenticator failed for 211-20-26-201.hinet-ip.hinet.net [211.20.26.201]:38842: 535 Incorrect authentication data (set_id=admission)211.20.26.2011668284p_  -m' ossec13001gExim Auth failed2025-03-20 00:57:18 dovecot_login authenticator failed for ([43.139.182.85]) [43.139.182.85]:37828: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)43.139.182.851814991r^  -q) ossec13001gGExim Auth failed2025-03-20 00:43:09 dovecot_login authenticator failed for ([91.103.249.179]) [91.103.249.179]:52290: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)91.103.249.179174982O]  -/% ossec13001gZExim Auth failed2025-03-20 00:39:14 dovecot_login authenticator failed for ([154.73.19.69]) [154.73.19.69]:59289: 535 Incorrect authentication data (set_id=info)154.73.19.69953987k\  -c' ossec13001gJExim Auth failed2025-03-20 00:38:57 dovecot_login authenticator failed for ([140.249.20.14]) [140.249.20.14]:52934: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)140.249.20.141814991Z[  -A) ossec13001gExim Auth failed2025-03-20 00:12:14 dovecot_login authenticator failed for ([185.167.58.121]) [185.167.58.121]:43146: 535 Incorrect authentication data (set_id=admission)185.167.58.121617790pZ  -m' ossec13001gExim Auth failed2025-03-20 00:12:05 dovecot_login authenticator failed for ([92.255.190.69]) [92.255.190.69]:60250: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)92.255.190.692017370Y  ?1 ossec1008gxProcess exiting (killed).Mar 20 00:05:36 vm1 spamd[1252212]: spamd: server killed by SIGTERM, shutting downCX  77 ossec502gOssec server started.ossec: Ossec started.jW  -_) ossec13001g Exim Auth failed2025-03-19 23:57:35 dovecot_plain authenticator failed for ([210.222.15.113]) [210.222.15.113]:39442: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)210.222.15.1131835841 1 / * . 9 R ~ 1jy  -a' ossec13001g-Exim Auth failed2025-03-20 02:18:44 dovecot_login authenticator failed for (static.199.38.85.125.macminivault.com) [199.38.85.125]:60950: 535 Incorrect authentication data (set_id=admin)199.38.85.1256252001hx  -]' ossec13001g-Exim Auth failed2025-03-20 02:18:22 dovecot_login authenticator failed for ([218.106.120.18]) [58.49.113.138]:18379: 535 Incorrect authentication data (set_id=admin@heipowersystem.com)58.49.113.1381814991Xw  -=' ossec13001g&LExim Auth failed2025-03-20 01:47:15 dovecot_login authenticator failed for ([60.166.31.198]) [60.166.31.198]:36900: 535 Incorrect authentication data (set_id=admission)60.166.31.1981814991sv  -q) ossec13001g&4Exim Auth failed2025-03-20 01:46:51 dovecot_login authenticator failed for ([83.239.108.218]) [83.239.108.218]:36088: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)83.239.108.2182017370u  -% ossec13001g%0Exim Auth failed2025-03-20 01:42:31 dovecot_login authenticator failed for 81.236.86.34.bc.googleusercontent.com (ADMIN) [34.86.236.81]:39564: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)34.86.236.816252001tt  -w% ossec13001g%Exim Auth failed2025-03-20 01:41:44 dovecot_plain authenticator failed for syn-072-017-090-246.biz.spectrum.com [72.17.90.246]:46352: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)72.17.90.2466252001s  -% ossec13001g$Exim Auth failed2025-03-20 01:41:27 dovecot_plain authenticator failed for c-71-229-1-186.hsd1.al.comcast.net [71.229.1.186]:41472: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)71.229.1.1866252001Wr  -9) ossec13001g#Exim Auth failed2025-03-20 01:37:11 dovecot_plain authenticator failed for ([114.250.93.159]) [114.250.93.159]:40954: 535 Incorrect authentication data (set_id=sales)114.250.93.1591814991gq  -[' ossec13001g#Exim Auth failed2025-03-20 01:36:55 dovecot_plain authenticator failed for ([14.49.195.142]) [14.49.195.142]:39678: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)14.49.195.1421835841Pp  -/% ossec13001g#Exim Auth failed2025-03-20 01:35:56 dovecot_login authenticator failed for ([109.63.246.9]) [109.63.246.9]:51432: 535 Incorrect authentication data (set_id=info)109.63.246.92017370Po  -/% ossec13001g#fExim Auth failed2025-03-20 01:34:53 dovecot_login authenticator failed for ([36.112.75.46]) [36.112.75.46]:37808: 535 Incorrect authentication data (set_id=info)36.112.75.461814991cn  -U% ossec13001g#VExim Auth failed2025-03-20 01:34:37 dovecot_login authenticator failed for ([61.73.190.98]) [61.73.190.98]:49140: 535 Incorrect authentication data (set_id=info@heipowersystem.com)61.73.190.981835841qm  -k+ ossec13001g#Exim Auth failed2025-03-20 01:35:22 dovecot_login authenticator failed for ([123.116.142.131]) [123.116.142.131]:52606: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)123.116.142.1311814991xl  -% ossec13001g#uExim Auth failed2025-03-20 01:35:09 dovecot_plain authenticator failed for syn-097-092-033-136.res.spectrum.com [97.92.33.136]:48338: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)97.92.33.1366252001k  =}) ossec13008g Mail Reciepient rejected2025-03-20 01:24:36 H=([195.211.191.49]) [195.211.191.49]:56755 F= rejected RCPT : SMTP AUTH is required for message submission on port 587195.211.191.492750405Wj  -9) ossec13001gExim Auth failed2025-03-20 01:19:52 dovecot_login authenticator failed for ([211.248.31.142]) [211.248.31.142]:57816: 535 Incorrect authentication data (set_id=sales)211.248.31.1421835841ri  -s% ossec13001gExim Auth failed2025-03-20 01:19:38 dovecot_login authenticator failed for 85.208.6.106.mixvoip.solutions [85.208.6.106]:48366: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)85.208.6.1062960313 & 4 W c !3I\f  -Y' ossec13001g:Exim Auth failed2025-03-20 03:14:38 dovecot_plain authenticator failed for ([58.250.157.83]) [58.250.157.83]:2067: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)58.250.157.831814991T  -5' ossec13001g9Exim Auth failed2025-03-20 03:09:50 dovecot_login authenticator failed for ([183.182.99.92]) [183.182.99.92]:56998: 535 Incorrect authentication data (set_id=sales)183.182.99.921655842i  -_) ossec13001g9Exim Auth failed2025-03-20 03:09:39 dovecot_login authenticator failed for ([80.227.102.242]) [80.227.102.242]:33798: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)80.227.102.242290557f  -Y' ossec13001g8Exim Auth failed2025-03-20 03:03:04 dovecot_login authenticator failed for 24.115.47.199.res-cmts.hzl3.ptd.net [24.115.47.199]:49750: 535 Incorrect authentication data (set_id=sales)24.115.47.1996252001j  -_) ossec13001g7Exim Auth failed2025-03-20 03:02:44 dovecot_login authenticator failed for ([117.200.101.98]) [117.200.101.98]:55164: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)117.200.101.981269750m  -e) ossec13001g6`Exim Auth failed2025-03-20 02:55:52 dovecot_plain authenticator failed for ([182.151.45.136]) [182.151.45.136]:54458: 535 Incorrect authentication data (set_id=services@heipowersystem.com)182.151.45.1361814991Q  -3# ossec13001g6xExim Auth failed2025-03-20 02:56:15 dovecot_plain authenticator failed for ([59.7.57.174]) [59.7.57.174]:44762: 535 Incorrect authentication data (set_id=services)59.7.57.1741835841h  -_% ossec13001g5~Exim Auth failed2025-03-20 02:52:05 dovecot_login authenticator failed for ([59.34.17.130]) [59.34.17.130]:46032: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)59.34.17.1301814991R  -3' ossec13001g5Exim Auth failed2025-03-20 02:52:15 dovecot_login authenticator failed for ([45.240.88.249]) [45.240.88.249]:36988: 535 Incorrect authentication data (set_id=info)45.240.88.249357994\  -C) ossec13001g2Exim Auth failed2025-03-20 02:40:25 dovecot_login authenticator failed for ([43.246.138.100]) [43.246.138.100]:32922: 535 Incorrect authentication data (set_id=postmaster)43.246.138.1001269750}  - % ossec13001g2Exim Auth failed2025-03-20 02:40:15 dovecot_login authenticator failed for syn-072-017-090-246.biz.spectrum.com [72.17.90.246]:56234: 535 Incorrect authentication data (set_id=postmaster@heipowersystem.com)72.17.90.2466252001U  -9% ossec13001g1Exim Auth failed2025-03-20 02:35:09 dovecot_login authenticator failed for ([103.4.103.61]) [103.4.103.61]:33376: 535 Incorrect authentication data (set_id=admission)103.4.103.611168579p~  -m' ossec13001g1{Exim Auth failed2025-03-20 02:34:59 dovecot_login authenticator failed for ([159.75.92.136]) [159.75.92.136]:52420: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)159.75.92.1361814991Y}  -;+ ossec13001g0Exim Auth failed2025-03-20 02:32:40 dovecot_login authenticator failed for ([103.114.147.198]) [103.114.147.194]:34256: 535 Incorrect authentication data (set_id=info)103.114.147.1941655842n|  -g) ossec13001g0Exim Auth failed2025-03-20 02:32:17 dovecot_login authenticator failed for ([119.200.229.33]) [119.200.229.33]:52315: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)119.200.229.331835841W{  -=' ossec13001g-Exim Auth failed2025-03-20 02:20:04 dovecot_login authenticator failed for ([94.204.78.117]) [94.204.78.117]:40920: 535 Incorrect authentication data (set_id=admission)94.204.78.117290557{z  -% ossec13001g-Exim Auth failed2025-03-20 02:19:46 dovecot_login authenticator failed for p387168-obmd01.tokyo.ocn.ne.jp [60.45.47.167]:33120: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)60.45.47.1671861060  D V v %:Tgn  -g) ossec13001gIMExim Auth failed2025-03-20 04:16:36 dovecot_login authenticator failed for ([121.189.198.60]) [121.189.198.60]:39978: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)121.189.198.601835841v  -u+ ossec13001gFTExim Auth failed2025-03-20 04:03:55 dovecot_login authenticator failed for ([182.163.122.133]) [182.163.122.133]:42791: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)182.163.122.1331210997P  -1% ossec13001gEExim Auth failed2025-03-20 04:02:00 dovecot_login authenticator failed for ([94.200.20.66]) [94.200.20.66]:50227: 535 Incorrect authentication data (set_id=sales)94.200.20.66290557i  -_) ossec13001gEExim Auth failed2025-03-20 04:01:33 dovecot_login authenticator failed for ([80.227.102.242]) [80.227.102.242]:57381: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)80.227.102.242290557b  -O) ossec13001gDfExim Auth failed2025-03-20 03:55:42 dovecot_login authenticator failed for host-196-47-172-253.afnet.net [196.47.172.253]:33597: 535 Incorrect authentication data (set_id=sales)196.47.172.2532287781g  -[' ossec13001gD<Exim Auth failed2025-03-20 03:54:59 dovecot_login authenticator failed for ([41.215.216.72]) [41.215.216.72]:38691: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)41.215.216.723374766M  -+# ossec13001gBExim Auth failed2025-03-20 03:49:14 dovecot_login authenticator failed for ([5.16.44.206]) [5.16.44.206]:60878: 535 Incorrect authentication data (set_id=info)5.16.44.2062017370n  -g) ossec13001gBExim Auth failed2025-03-20 03:48:29 dovecot_login authenticator failed for ([120.157.61.138]) [120.157.61.138]:44496: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)120.157.61.1382077456f  -]# ossec13001g@Exim Auth failed2025-03-20 03:40:51 dovecot_login authenticator failed for (gurukuljaipur.com) [14.18.77.99]:55440: 535 Incorrect authentication data (set_id=support@gurukuljaipur.com)14.18.77.991814991Y  -;+ ossec13001g@Exim Auth failed2025-03-20 03:40:38 dovecot_login authenticator failed for ([190.121.193.126]) [190.121.193.126]:58094: 535 Incorrect authentication data (set_id=info)190.121.193.1263595528k  -e% ossec13001g@Exim Auth failed2025-03-20 03:39:58 dovecot_login authenticator failed for ws215-79.maryno.net [81.88.215.79]:40529: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)81.88.215.792017370T  -9# ossec13001g@Exim Auth failed2025-03-20 03:40:24 dovecot_login authenticator failed for (gurukuljaipur.com) [14.18.77.99]:51652: 535 Incorrect authentication data (set_id=nologin)14.18.77.991814991\  -G' ossec13001g?Exim Auth failed2025-03-20 03:35:48 dovecot_login authenticator failed for (62-73-121-209.btc-net.bg) [62.73.121.209]:41972: 535 Incorrect authentication data (set_id=sales)62.73.121.209732800j  -_) ossec13001g?Exim Auth failed2025-03-20 03:35:29 dovecot_login authenticator failed for ([218.150.170.10]) [218.150.170.10]:36802: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)218.150.170.101835841V  -=' ossec13001g=Exim Auth failed2025-03-20 03:27:16 dovecot_login authenticator failed for ([65.20.169.151]) [65.20.169.151]:56692: 535 Incorrect authentication data (set_id=admission)65.20.169.15199237p  -m' ossec13001g=Exim Auth failed2025-03-20 03:27:07 dovecot_login authenticator failed for ([120.78.172.20]) [120.78.172.20]:54882: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)120.78.172.201814991j  -a' ossec13001g:Exim Auth failed2025-03-20 03:14:48 dovecot_plain authenticator failed for broadband-95-84-186-218.ip.moscow.rt.ru [95.84.186.218]:60396: 535 Incorrect authentication data (set_id=sales)95.84.186.2182017370 *\~tj`VLB8.$zpf\H>4*   v l b X N D : 0 &    ~ t j ` V L B 8 . $    z p f \ R H > 4 *  lvbXN0&D:|rh^TJ@6,"xndZPF2(< ~tj`VLB8.$zpf\ | r h ^ T J @ 6 , "    x n d Z P F < 2 (   RRH>4*  vlbXND:0& gv. gd. g. g. g. g. g. g. g. g. g. gx. gԞ. g. gʑ. g. g. gs. gǟ. g. g۾,. g۽. g۽. gۼG. g۸.~ g۷b.} g۷B.| g۷2.{ g۴.z g۳.y g۳.x g۲.w g۲.v g۰y.u g۰R.t gۭb.s gۭJ.r g۬$.q g۬,.p g۩.o g۩.n gۥ.m gۥ.l gۡ).k gۡ.j g۟.i g۟.h g۟.g g۟.f g۟P.e g۟H.d gۜ.c gۜ.b gۜ|.a gۘ[.` gۖ._ gۖ.^ gۓ.] gۓ.\ gێ.[ gیf.Z gیP.Y gۆ.X gۄ.W gۄ.V gۀG.U gۀ=.T g{.S g{.R g|.Q gy.P gy.O gxC.N gso.M gsN.L gs<.K gs/.J gqE.I gq#.H gpK.G go.F go.E gn.D gn.C gmT.B gmB.A gm0.@ gm.? gl.> gl.= gj.< gh.; gh.: gg.9 gg.8 gd..7 g_.6 g_.5 g^.4 g_.3 g_ .2 g]N.1 gZ.0 gZ_./ gZ .. gZ.- gX3., gX?.+ gWt.* gU.) gUd.( gUX.' gUJ.& gU<.% gP.$ gP.# gM." gM.! gL$. gL. gJ. gJY. gIW. gIM. gFT. gE. gE. gDf. gD<. gB. gB. g@. g@. g@. g@. g?. g?. g=. g=. g:. g:. g9. g9. g8. g7. g6x. g6`. g5. g5~. g2. g2. g1- g1{- g0- g0- g-- g-- g-- g-- g&L- g&4- g%0- g%- g$- g#- g#- g#- g#- g#u- g#f- g. g. g. g. gv. gV. gT. gK. g. g. g{. g. g. g". g. g. g. g. g. gM. g9. g. g. g. g. g. g. g. g. g. g. gI. g?. gf. g<. g. g. g<. g,. g. g. g/. g. g#V- g - g- g- g- g.- g$- g4- g$- g- g- g- g- g- gG- gZ- gJ- g- g- gx- g- g - g - g- g- g}- g}- ge- gN- g|- g^- g-- g- g\- g- g- g- gr- g\- g[- gG- g<- g G. g4- gl- g- gC- g3- g/- g!- g- gq- g- g- g֬- gզ- g- gg- gϮ- g2- g$- ǧ- gɍ- g- gF- gƨ- gx- g- g- gy- gk- g- gڻU- gڻ?- gڹe- gڹU- gڷ- gڷ- gڷ"- gڶ- gڴ- gڴx- gڱ- gگ- gڭ- g" G E p g -3\gq,  -k+ ossec13001gX3Exim Auth failed2025-03-20 05:20:10 dovecot_login authenticator failed for ([175.156.102.192]) [175.156.102.192]:41080: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)175.156.102.1921880251S+  -3' ossec13001gX?Exim Auth failed2025-03-20 05:20:22 dovecot_login authenticator failed for ([116.237.85.95]) [223.166.75.68]:23504: 535 Incorrect authentication data (set_id=info)223.166.75.681814991v*  -y' ossec13001gWtExim Auth failed2025-03-20 05:16:59 dovecot_plain authenticator failed for ([197.211.47.66]) [197.211.47.66]:59547: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)197.211.47.662328926f)  -[' ossec13001gUExim Auth failed2025-03-20 05:10:29 dovecot_plain authenticator failed for ([213.55.79.199]) [213.55.79.195]:37642: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)213.55.79.195337996Z(  -=+ ossec13001gUdExim Auth failed2025-03-20 05:08:11 dovecot_login authenticator failed for ([154.144.255.210]) [154.144.255.210]:32994: 535 Incorrect authentication data (set_id=sales)154.144.255.2102542007Z'  -?) ossec13001gUXExim Auth failed2025-03-20 05:08:00 dovecot_login authenticator failed for ([121.168.210.98]) [121.168.210.98]:4808: 535 Incorrect authentication data (set_id=admission)121.168.210.981835841m&  -c+ ossec13001gUJExim Auth failed2025-03-20 05:07:46 dovecot_login authenticator failed for ([154.144.255.208]) [154.144.255.208]:49412: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)154.144.255.2082542007z%  -% ossec13001gU<Exim Auth failed2025-03-20 05:07:31 dovecot_login authenticator failed for p72033-obmd01.osaka.ocn.ne.jp [180.7.119.32]:44427: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)180.7.119.321861060[$  -E' ossec13001gPExim Auth failed2025-03-20 04:48:02 dovecot_login authenticator failed for (62-73-121-209.btc-net.bg) [62.73.121.209]:59292: 535 Incorrect authentication data (set_id=info)62.73.121.209732800b#  -U% ossec13001gPExim Auth failed2025-03-20 04:47:47 dovecot_login authenticator failed for ([94.206.93.90]) [94.206.93.90]:38754: 535 Incorrect authentication data (set_id=info@heipowersystem.com)94.206.93.90290557\"  -G% ossec13001gMExim Auth failed2025-03-20 04:32:53 dovecot_plain authenticator failed for ([77.41.156.64]) [77.41.156.64]:53860: 535 Incorrect authentication data (set_id=vikas.khandelwal)77.41.156.642017370!  -) ossec13001gMExim Auth failed2025-03-20 04:32:43 dovecot_plain authenticator failed for 198-91-188-226.cpe.distributel.net [198.91.188.226]:51138: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)198.91.188.2266251999Q  -1% ossec13001gL$Exim Auth failed2025-03-20 04:28:43 dovecot_login authenticator failed for ([60.174.35.18]) [60.174.35.18]:52390: 535 Incorrect authentication data (set_id=sales)60.174.35.181814991~  -) ossec13001gLExim Auth failed2025-03-20 04:28:08 dovecot_login authenticator failed for (nsg-static-245.215.75.182-airtel.com) [182.75.215.245]:42640: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)182.75.215.2451269750T  -5' ossec13001gJExim Auth failed2025-03-20 04:21:54 dovecot_login authenticator failed for ([120.133.17.20]) [120.133.17.20]:36830: 535 Incorrect authentication data (set_id=sales)120.133.17.201814991  -+ ossec13001gJYExim Auth failed2025-03-20 04:21:05 dovecot_login authenticator failed for (static-97.224.143.114-tataidc.co.in) [182.156.133.169]:45125: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)182.156.133.1691269750Z  -E# ossec13001gIWExim Auth failed2025-03-20 04:16:46 dovecot_login authenticator failed for bb121-6-81-59.singnet.com.sg [121.6.81.59]:56300: 535 Incorrect authentication data (set_id=info)121.6.81.591880251 D~qkdWJ=0D#  a $ zm`SF9,^ v i \ P C 6 )     s f Y L ? 3 '  Qx  s g [ O B 5 (     r e X K > 1  { n T G : -   sfYL?2% }pcVI</"{nbUH;.!xk^QD7*tgZM@3& ,th\PE9 1819730 2921044 1880251 130758 294640 1814991 1861060 1814991 1880251 1861060 1880251 1880251 2921044 1880251 2921044 2635167 2963597 2963597 2963597 2963597 2963597 2963597 1861060 2963597 2963597 2963597 1861060 2963597 1861060 2963597 2963597 2963597 2963597 2963597 2963597 2963597 2963597 1861060 2963597 2963597 2963597 2963597 2963597 2963597 2963597 2963597 2963597f 2963597e 2963597d 2963597M 2963597L 2963597K 2963597I 29635970 2963597 2963597 2963597 2963597 2963597 2963597 2963597o 2963597T 2963597R 2963597D 2963597 2921044| 2921044z 2921044l 2921044a 2921044Y 2921044$ 2921044 2921044 2802361 2750405 2750405 2750405r 2750405 2750405 2658434% 2658434 2658434 2658434 2658434 2658434 2658434 2658434 2658434 2658434 2658434 2658434 2635167b 2635167 2635167y 2635167x 2635167J 2635167 2635167 2635167 2635167 2635167H 2629691 2542007 2542007 2542007 2542007 2077456 2077456 2077456 2077456 2077456 2077456 2077456 2077456 2077456 2017370 1880251u 1880251T 1880251 1880251 1880251 1880251 1880251 1880251 1880251 1880251F 1880251 1861060F 1861060E 1861060< 1861060 1861060 1861060 1861060 1861060^ 1861060 1831722 1819730 1814991 1814991 1643084# 1643084 1269750{ 1269750w 1269750_ 1269750[ 1269750 1269750m 1269750j 1269750b 1269750= 12697509 12697501 a~qdWJ0# zm`SF9, pVI"ylE+\= w j ] P C 6 )      u h [}</R O B 5 (     r e X K > 1 $  { n a T G : -   c_8iOB5(reXK>1$ {na x l ` T H < 0 % v 6252001% 6252001$ 6252001 6252001 6252001 6252001 6252001 6252001 6252001 3996063 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 2963597 2963597 6252001 6252001 6252001 2963597 6252001 6252001 2963597 3017382 2963597 6252001 6252001 6252001 6252001 6252001 2963597 6252001 732800 2963597 2963597 6252001 2963597 2963597 6252001 6252001 6252001 6252001 6252001 6252001 6252001 2963597 2963597 6252001 2963597 6251999 6252001 2963597 2963597 6252001 2963597 2963597 6252001 6252001 6252001 6252001 6252001 6252001 2963597 2963597 6252001 2963597 6251999 6251999 2963597 2963597 6252001 2963597 6251999 6251999 6251999 2963597 6252001 6252001 2963597 2963597 6252001 2963597 6251999 2963597 732800 7328009 690791 690791 660013i 660013S 660013* 660013 660013 6252001 6252001t 6252001s 6252001r 6252001q 6252001p 6252001n 6252001m 6252001j 6252001h 6252001V 6252001U 6252001R 6252001N 6252001G 6252001D 6252001C 6252001B 6252001> 6252001; 6252001: 62520014 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001} 6252001z 6252001c 6252001+ 6252001) 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001F 6251999 6251999v 6251999 6251999 453733 3932488 357994 31753953 3175395 3144096e 3017382( 3017382 3017382 3017382 3017382 3017382 3017382 3017382~ 3017382 3017382 3017382 3017382 3017382 3017382 3017382E 2963597 2963597~ 2963597} 2963597y 2963597x 2963597o 2963597k 2963597g 2963597f 2963597d 2963597c 2963597` 2963597^ 2963597] 2963597\ 2963597Z 2963597X 2963597W 2963597= 29635975 29635972 29635971 29635970 2963597/ 2963597. 2963597- 2963597 2963597+ 2963597* 2963597) 2963597' 2963597& 2963597 2963597! 2963597 2963597 2963597 2963597 2963597 2963597 2963597 2963597 2963597 2963597 2963597 2963597 2963597  ' S R X tm=  -i% ossec13001glExim Auth failed2025-03-20 06:47:33 dovecot_login authenticator failed for ([121.8.209.94]) [121.8.209.94]:59952: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)121.8.209.941814991"<  3M% ossec11301gjNew FTP connection.Mar 20 06:40:18 vm1 pure-ftpd[1651972]: (?@20.168.7.137) [INFO] New connection from 20.168.7.13720.168.7.1376252001Z;  -?) ossec13001ghExim Auth failed2025-03-20 06:31:03 dovecot_plain authenticator failed for ([37.151.212.229]) [37.151.212.229]:52583: 535 Incorrect authentication data (set_id=services)37.151.212.2291522867i:  -_' ossec13001ghExim Auth failed2025-03-20 06:30:51 dovecot_plain authenticator failed for ([106.86.209.86]) [106.86.209.86]:6886: 535 Incorrect authentication data (set_id=services@heipowersystem.com)106.86.209.861814991Y9  -;+ ossec13001ggExim Auth failed2025-03-20 06:26:31 dovecot_login authenticator failed for ([123.116.142.131]) [123.116.142.131]:54566: 535 Incorrect authentication data (set_id=info)123.116.142.1311814991n8  -g) ossec13001ggExim Auth failed2025-03-20 06:26:19 dovecot_login authenticator failed for ([118.140.135.25]) [118.140.135.25]:18886: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)118.140.135.251819730l7  -i# ossec13001gd.Exim Auth failed2025-03-20 06:11:17 dovecot_plain authenticator failed for ([8.30.189.46]) [8.30.189.46]:33935: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)8.30.189.4662520016  -# ossec13001g_Exim Auth failed2025-03-20 05:49:13 dovecot_login authenticator failed for host-94-93-3-147.business.telecomitalia.it [94.93.3.147]:35692: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)94.93.3.1473175395a5  -S# ossec13001g_Exim Auth failed2025-03-20 05:49:13 dovecot_login authenticator failed for host79.sub-63-45-11.myvzw.com [63.45.11.79]:45345: 535 Incorrect authentication data (set_id=postmaster)63.45.11.796252001i4  -a% ossec13001g^Exim Auth failed2025-03-20 05:48:39 dovecot_login authenticator failed for ([221.10.10.20]) [221.10.10.20]:52096: 535 Incorrect authentication data (set_id=postmaster@heipowersystem.com)221.10.10.201814991U3  -9% ossec13001g_Exim Auth failed2025-03-20 05:49:36 dovecot_login authenticator failed for ([103.7.183.17]) [103.7.183.17]:52433: 535 Incorrect authentication data (set_id=admission)103.7.183.171269750v2  -u+ ossec13001g_ Exim Auth failed2025-03-20 05:49:24 dovecot_login authenticator failed for ([121.185.212.234]) [121.185.212.234]:36026: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)121.185.212.2341835841}1  -' ossec13001g]NExim Auth failed2025-03-20 05:41:57 dovecot_login authenticator failed for (88.201.163.65.pool.sknt.ru) [88.201.163.65]:56120: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)88.201.163.652017370P0  -/% ossec13001gZExim Auth failed2025-03-20 05:30:08 dovecot_login authenticator failed for ([121.8.209.94]) [121.8.209.94]:54020: 535 Incorrect authentication data (set_id=info)121.8.209.941814991h/  -_% ossec13001gZ_Exim Auth failed2025-03-20 05:29:27 dovecot_login authenticator failed for ([103.7.183.17]) [103.7.183.17]:61625: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)103.7.183.171269750}.  -' ossec13001gZ Exim Auth failed2025-03-20 05:28:02 dovecot_login authenticator failed for (static.199.38.85.125.macminivault.com) [199.38.85.125]:60187: 535 Incorrect authentication data (set_id=admin@heipowersystem.com)199.38.85.1256252001h-  -[) ossec13001gZExim Auth failed2025-03-20 05:28:21 dovecot_login authenticator failed for 128-75-243-203.broadband.corbina.ru [128.75.243.203]:43830: 535 Incorrect authentication data (set_id=admin)128.75.243.2032017370 I)B p Ze=IpO  -m' ossec13001gyExim Auth failed2025-03-20 07:43:05 dovecot_login authenticator failed for ([58.246.100.27]) [58.246.100.27]:41042: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)58.246.100.271814991%N  3Q' ossec11301gxCNew FTP connection.Mar 20 07:36:57 vm1 pure-ftpd[1663490]: (?@20.221.66.141) [INFO] New connection from 20.221.66.14120.221.66.1416252001sM  -o+ ossec13001gsoExim Auth failed2025-03-20 07:16:22 dovecot_login authenticator failed for ppp-124-120-170-149.revip2.asianet.co.th [124.120.170.149]:56824: 535 Incorrect authentication data (set_id=admission)124.120.170.1491605651oL  -m' ossec13001gsNExim Auth failed2025-03-20 07:15:49 dovecot_login authenticator failed for ([87.200.73.165]) [87.200.73.165]:43093: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)87.200.73.165290557SK  -3' ossec13001gs<Exim Auth failed2025-03-20 07:15:31 dovecot_login authenticator failed for ([212.75.154.16]) [212.75.154.16]:41630: 535 Incorrect authentication data (set_id=info)212.75.154.162017370ZJ  -I ossec13001gs/Exim Auth failed2025-03-20 07:15:18 dovecot_login authenticator failed for ([4.4.89.74]) [4.4.89.74]:56982: 535 Incorrect authentication data (set_id=info@heipowersystem.com)4.4.89.746252001\I  -C) ossec13001gqEExim Auth failed2025-03-20 07:07:08 dovecot_login authenticator failed for vps-9109ac84.vps.ovh.net [141.95.159.204]:38946: 535 Incorrect authentication data (set_id=info)141.95.159.2043017382qH  -k+ ossec13001gq#Exim Auth failed2025-03-20 07:06:35 dovecot_login authenticator failed for ([178.178.194.203]) [178.178.194.203]:60618: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)178.178.194.2032017370"G  3M% ossec11301gpKNew FTP connection.Mar 20 07:02:58 vm1 pure-ftpd[1656581]: (?@139.162.77.6) [INFO] New connection from 139.162.77.6139.162.77.61861060uF  -w' ossec13001goExim Auth failed2025-03-20 07:01:07 dovecot_login authenticator failed for wsip-64-207-225-55.tu.ok.cox.net ([64.207.241.177]) [64.207.225.55]:56614: 535 Incorrect authentication data (set_id=info)64.207.225.556252001hE  -_% ossec13001goExim Auth failed2025-03-20 07:00:57 dovecot_login authenticator failed for ([58.18.90.114]) [58.18.90.114]:52709: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)58.18.90.1141814991(D  3U) ossec11301gnNew FTP connection.Mar 20 06:55:55 vm1 pure-ftpd[1655169]: (?@147.45.112.181) [INFO] New connection from 147.45.112.181147.45.112.1812134431C  -' ossec13001gnExim Auth failed2025-03-20 06:56:01 dovecot_plain authenticator failed for 60-249-207-53.hinet-ip.hinet.net [60.249.207.53]:55823: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)60.249.207.531668284dB  -S) ossec13001gmTExim Auth failed2025-03-20 06:50:18 dovecot_plain authenticator failed for 140.82.157.126.360broadband.net [140.82.157.126]:45557: 535 Incorrect authentication data (set_id=sales)140.82.157.1266252001jA  -_) ossec13001gmBExim Auth failed2025-03-20 06:50:02 dovecot_plain authenticator failed for ([58.210.188.130]) [58.210.188.130]:28182: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)58.210.188.1301814991N@  --# ossec13001gm0Exim Auth failed2025-03-20 06:49:43 dovecot_plain authenticator failed for ([94.251.8.83]) [94.251.8.83]:47428: 535 Incorrect authentication data (set_id=sales)94.251.8.832017370c?  -W% ossec13001gmExim Auth failed2025-03-20 06:49:22 dovecot_plain authenticator failed for ([94.204.96.91]) [94.204.96.91]:48137: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)94.204.96.91290557S>  -7% ossec13001glExim Auth failed2025-03-20 06:47:42 dovecot_login authenticator failed for ([46.56.85.227]) [46.56.85.227]:3683: 535 Incorrect authentication data (set_id=admission)46.56.85.227630336    A P d m$5%`  3Q' ossec11301gۘ[New FTP connection.Mar 20 09:53:52 vm1 pure-ftpd[1691705]: (?@20.65.194.119) [INFO] New connection from 20.65.194.11920.65.194.1196252001k_  -c' ossec13001gۖExim Auth failed2025-03-20 09:46:55 dovecot_login authenticator failed for ([112.102.48.29]) [112.102.48.29]:54636: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)112.102.48.291814991V^  -7) ossec13001gۖExim Auth failed2025-03-20 09:47:12 dovecot_login authenticator failed for ([112.165.220.64]) [112.165.220.64]:47372: 535 Incorrect authentication data (set_id=info)112.165.220.641835841U]  -9% ossec13001gۓExim Auth failed2025-03-20 09:34:03 dovecot_login authenticator failed for ([20.83.155.49]) [20.83.155.49]:42018: 535 Incorrect authentication data (set_id=admission)20.83.155.496252001i\  -e# ossec13001gۓExim Auth failed2025-03-20 09:33:48 dovecot_login authenticator failed for ([95.0.252.72]) [95.0.252.72]:51306: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)95.0.252.72298795m[  -e) ossec13001gێExim Auth failed2025-03-20 09:13:19 dovecot_login authenticator failed for ([175.116.66.199]) [175.116.66.199]:3379: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)175.116.66.1991835841jZ  -_) ossec13001gیfExim Auth failed2025-03-20 09:02:52 dovecot_login authenticator failed for (189.218.168.30-clientes-izzi.mx) [189.218.168.30]:36090: 535 Incorrect authentication data (set_id=admission)189.218.168.303996063sY  -q) ossec13001gیPExim Auth failed2025-03-20 09:02:31 dovecot_login authenticator failed for ([121.202.152.26]) [121.202.152.26]:52120: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)121.202.152.261819730wX  -y) ossec13001gۆExim Auth failed2025-03-20 08:38:47 dovecot_login authenticator failed for (azteca-comunicaciones.com) [186.148.187.91]:55793: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)186.148.187.913686110TW  -5' ossec13001gۄExim Auth failed2025-03-20 08:30:16 dovecot_plain authenticator failed for ([46.73.156.221]) [46.73.156.221]:51424: 535 Incorrect authentication data (set_id=sales)46.73.156.2212017370sV  -u% ossec13001gۄExim Auth failed2025-03-20 08:29:55 dovecot_plain authenticator failed for 1-34-162-249.hinet-ip.hinet.net [1.34.162.249]:41421: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)1.34.162.2491668284hU  -_% ossec13001gۀGExim Auth failed2025-03-20 08:11:09 dovecot_plain authenticator failed for syn-072-017-090-246.biz.spectrum.com [72.17.90.246]:48568: 535 Incorrect authentication data (set_id=services)72.17.90.2466252001mT  -e) ossec13001gۀ=Exim Auth failed2025-03-20 08:10:59 dovecot_plain authenticator failed for ([14.194.100.134]) [14.194.100.134]:38654: 535 Incorrect authentication data (set_id=services@heipowersystem.com)14.194.100.1341269750XS  -=' ossec13001g{Exim Auth failed2025-03-20 07:52:47 dovecot_login authenticator failed for ([136.56.34.147]) [136.56.34.147]:59358: 535 Incorrect authentication data (set_id=admission)136.56.34.1476252001vR  -u+ ossec13001g{Exim Auth failed2025-03-20 07:52:38 dovecot_login authenticator failed for ([167.250.119.207]) [167.250.119.207]:56622: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)167.250.119.2073865483Q  -' ossec13001g|Exim Auth failed2025-03-20 07:53:21 dovecot_login authenticator failed for pool-99-251-252-98.cpe.net.cable.rogers.com [99.251.252.98]:60004: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)99.251.252.986251999\P  -C) ossec13001gyExim Auth failed2025-03-20 07:43:29 dovecot_login authenticator failed for (wimax37218.grn.es) [185.38.131.145]:51292: 535 Incorrect authentication data (set_id=admission)185.38.131.1452510769 ^'  ) > j y1R^pq  -m' ossec13001g۬$Exim Auth failed2025-03-20 11:18:18 dovecot_login authenticator failed for ([220.74.63.183]) [220.74.63.183]:46040: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)220.74.63.1831835841[p  -A) ossec13001g۬,Exim Auth failed2025-03-20 11:18:26 dovecot_login authenticator failed for ([103.180.240.96]) [103.180.240.96]:39914: 535 Incorrect authentication data (set_id=admission)103.180.240.961282988Yo  -;+ ossec13001g۩Exim Auth failed2025-03-20 11:07:27 dovecot_login authenticator failed for ([115.144.115.150]) [115.144.115.150]:59316: 535 Incorrect authentication data (set_id=info)115.144.115.1501835841mn  -g) ossec13001g۩Exim Auth failed2025-03-20 11:07:14 dovecot_login authenticator failed for ([185.101.16.250]) [185.101.16.250]:58956: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)185.101.16.250272103Qm  -1% ossec13001gۥExim Auth failed2025-03-20 10:48:20 dovecot_login authenticator failed for ([14.35.218.58]) [14.35.218.58]:60588: 535 Incorrect authentication data (set_id=sales)14.35.218.581835841jl  -_) ossec13001gۥExim Auth failed2025-03-20 10:47:53 dovecot_login authenticator failed for ([117.159.234.69]) [117.159.234.69]:52110: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)117.159.234.691814991fk  -W) ossec13001gۡ)Exim Auth failed2025-03-20 10:31:27 dovecot_plain authenticator failed for ([188.244.154.53]) [188.244.154.53]:49550: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)188.244.154.532017370|j  -+ ossec13001gۡExim Auth failed2025-03-20 10:30:54 dovecot_plain authenticator failed for ([223.239.130.245]) [223.239.130.245]:19249: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)223.239.130.2451269750Zi  -=+ ossec13001g۟Exim Auth failed2025-03-20 10:25:08 dovecot_plain authenticator failed for ([123.210.128.249]) [123.210.128.249]:44584: 535 Incorrect authentication data (set_id=sales)123.210.128.2492077456kh  -c' ossec13001g۟Exim Auth failed2025-03-20 10:25:08 dovecot_login authenticator failed for ([175.202.82.16]) [175.202.82.16]:56686: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)175.202.82.161835841mg  -c+ ossec13001g۟Exim Auth failed2025-03-20 10:24:51 dovecot_plain authenticator failed for ([211.104.166.110]) [211.104.166.110]:44166: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)211.104.166.1101835841Pf  -/% ossec13001g۟Exim Auth failed2025-03-20 10:25:34 dovecot_login authenticator failed for ([59.34.17.130]) [59.34.17.130]:53012: 535 Incorrect authentication data (set_id=info)59.34.17.1301814991ge  -[' ossec13001g۟PExim Auth failed2025-03-20 10:23:36 dovecot_login authenticator failed for 217-76-83-103.cust.bredband2.com [217.76.83.103]:47602: 535 Incorrect authentication data (set_id=admission)217.76.83.1032661886od  -k' ossec13001g۟HExim Auth failed2025-03-20 10:23:27 dovecot_login authenticator failed for ([118.39.230.40]) [118.39.230.40]:3624: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)118.39.230.401835841c  -+ ossec13001gۜExim Auth failed2025-03-20 10:12:03 dovecot_login authenticator failed for broadband-178-140-152-209.ip.moscow.rt.ru [178.140.152.209]:54030: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)178.140.152.2092017370[b  -A) ossec13001gۜExim Auth failed2025-03-20 10:11:48 dovecot_login authenticator failed for ([123.209.107.18]) [123.209.107.18]:59858: 535 Incorrect authentication data (set_id=admission)123.209.107.182077456va  -u+ ossec13001gۜ|Exim Auth failed2025-03-20 10:11:31 dovecot_login authenticator failed for ([165.154.202.101]) [165.154.202.101]:32792: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)165.154.202.1016252001 5 2 S b >SV3n  -g) ossec13001g۽Exim Auth failed2025-03-20 12:34:20 dovecot_login authenticator failed for ([183.100.18.224]) [183.100.18.224]:38282: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)183.100.18.2241835841  Ug) ossec11001g۽Deferred login on the cpanel service[2025-03-20 12:33:50 +0530] info [webmaild] 157.38.229.190 - kps@amplifypowerglobal.com "POST /cpsess5111971879/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [157.38.245.187] != Current IP Address [157.38.229.190]157.38.229.1901269750  W!) ossec9708gۼGDovecot Aborted Login with empty userMar 20 12:27:09 vm1 dovecot[1250588]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=87.236.176.135, lip=103.74.54.108, TLS, session=<6yiRpcAwKcxX7LCH>87.236.176.1352635167y~  -}) ossec13001g۸Exim Auth failed2025-03-20 12:12:46 dovecot_plain authenticator failed for ([121.189.198.60]) [121.189.198.60]:46480: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)121.189.198.601835841g}  -[' ossec13001g۷bExim Auth failed2025-03-20 12:06:18 dovecot_plain authenticator failed for ([5.149.155.141]) [5.149.155.141]:54226: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)5.149.155.1412017370Q|  -1% ossec13001g۷BExim Auth failed2025-03-20 12:05:45 dovecot_plain authenticator failed for ([58.96.247.71]) [58.96.247.71]:35267: 535 Incorrect authentication data (set_id=sales)58.96.247.711880251y{  -' ossec13001g۷2Exim Auth failed2025-03-20 12:05:29 dovecot_plain authenticator failed for c9vpn.cirrus9.net ([98.143.249.75]) [199.59.135.22]:60620: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)199.59.135.226251999$z  3Q' ossec11301g۴New FTP connection.Mar 20 11:54:09 vm1 pure-ftpd[1718433]: (?@185.16.38.158) [INFO] New connection from 185.16.38.158185.16.38.158798544Yy  -;+ ossec13001g۳Exim Auth failed2025-03-20 11:50:06 dovecot_login authenticator failed for ([103.186.221.174]) [103.186.221.174]:37538: 535 Incorrect authentication data (set_id=info)103.186.221.1741269750zx  -' ossec13001g۳Exim Auth failed2025-03-20 11:49:51 dovecot_login authenticator failed for 211-20-26-201.hinet-ip.hinet.net [211.20.26.201]:35316: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)211.20.26.2011668284Kw  -+ ossec13001g۲Exim Auth failed2025-03-20 11:46:47 dovecot_plain authenticator failed for ([4.4.89.74]) [4.4.89.74]:41302: 535 Incorrect authentication data (set_id=services)4.4.89.746252001mv  -e) ossec13001g۲Exim Auth failed2025-03-20 11:46:21 dovecot_plain authenticator failed for ([193.234.119.53]) [193.234.119.53]:42610: 535 Incorrect authentication data (set_id=services@heipowersystem.com)193.234.119.532661886[u  -A) ossec13001g۰yExim Auth failed2025-03-20 11:36:47 dovecot_login authenticator failed for ([192.199.190.53]) [192.199.190.53]:44507: 535 Incorrect authentication data (set_id=admission)192.199.190.536252001t  - ' ossec13001g۰RExim Auth failed2025-03-20 11:36:10 dovecot_login authenticator failed for 111-70-23-216.emome-ip.hinet.net [111.70.23.216]:38827: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)111.70.23.2161668284Zs  -=+ ossec13001gۭbExim Auth failed2025-03-20 11:23:38 dovecot_login authenticator failed for ([197.255.196.225]) [197.255.196.225]:50614: 535 Incorrect authentication data (set_id=sales)197.255.196.2252413451ir  -_) ossec13001gۭJExim Auth failed2025-03-20 11:23:12 dovecot_login authenticator failed for ([168.167.55.230]) [168.167.55.230]:42550: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)168.167.55.230933860 & e k q e$;  Ie) ossec11331g Stealth FTP brute force attackMar 20 14:30:06 vm1 pure-ftpd[1752334]: (?@39.106.121.135) [WARNING] Authentication failed for user [123123]39.106.121.1351814991_  k) ossec11321gActive Response. FTP brute force attack (Port 21 is protected)Mar 20 14:30:00 vm1 pure-ftpd[1752175]: (?@39.106.121.135) [WARNING] Authentication failed for user [rokamauka]39.106.121.1351814991B  gU) ossec11307gMultiple connection attempts from same sourceMar 20 14:30:00 vm1 pure-ftpd[1752187]: (?@39.106.121.135) [INFO] New connection from 39.106.121.13539.106.121.1351814991  S) ossec211321gPreventing FTP brute force attempt.[Active Response] is disabled for rule 11321. Greylisting 39.106.121.13539.106.121.1351814991) 3U) ossec11301gNew FTP connection.Mar 20 14:29:42 vm1 pure-ftpd[1752108]: (?@39.106.121.135) [INFO] New connection from 39.106.121.13539.106.121.1351814991H A) ossec11302gFTP Authentication failed.Mar 20 14:29:41 vm1 pure-ftpd[1752081]: (?@39.106.121.135) [WARNING] Authentication failed for user [saintsoldiercollegecom]39.106.121.1351814991D  A) ossec11302gFTP Authentication failed.Mar 20 14:29:36 vm1 pure-ftpd[1752072]: (?@39.106.121.135) [WARNING] Authentication failed for user [saintsoldiercollege]39.106.121.1351814991) 3U) ossec11301gNew FTP connection.Mar 20 14:29:30 vm1 pure-ftpd[1752072]: (?@39.106.121.135) [INFO] New connection from 39.106.121.13539.106.121.1351814991(  3U) ossec11301gxNew FTP connection.Mar 20 14:23:11 vm1 pure-ftpd[1750831]: (?@46.101.122.229) [INFO] New connection from 46.101.122.22946.101.122.2292921044m  -i% ossec13001gԞExim Auth failed2025-03-20 14:11:00 dovecot_login authenticator failed for ([154.127.42.2]) [154.127.42.2]:50317: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)154.127.42.22395170r  -s% ossec13001gExim Auth failed2025-03-20 13:47:24 dovecot_plain authenticator failed for 60-199-134-8.static.tfn.net.tw [60.199.134.8]:12200: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)60.199.134.81668284l  -e) ossec13001gʑExim Auth failed2025-03-20 13:28:09 dovecot_plain authenticator failed for ([94.201.236.143]) [94.201.236.143]:53268: 535 Incorrect authentication data (set_id=services@heipowersystem.com)94.201.236.143290557X  -=' ossec13001gExim Auth failed2025-03-20 13:25:17 dovecot_login authenticator failed for ([75.149.43.157]) [75.149.43.157]:58314: 535 Incorrect authentication data (set_id=admission)75.149.43.1576252001v  -u+ ossec13001gExim Auth failed2025-03-20 13:25:07 dovecot_login authenticator failed for ([103.123.114.215]) [103.123.114.215]:37232: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)103.123.114.2151168579v  -{% ossec13001gsExim Auth failed2025-03-20 13:23:22 dovecot_login authenticator failed for (undefined.hostname.localhost) [103.90.97.98]:53464: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)103.90.97.981269750"  3M% ossec11301gǟNew FTP connection.Mar 20 13:15:32 vm1 pure-ftpd[1735689]: (?@103.74.54.23) [INFO] New connection from 103.74.54.23103.74.54.231269750  -9) ossec13001gExim Auth failed2025-03-20 12:47:44 dovecot_login authenticator failed for (host-232.185.15.189.0.0xffffff00.STERLING.stercom.ru) [185.15.189.232]:36632: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)185.15.189.2322017370V  -7) ossec13001g۾,Exim Auth failed2025-03-20 12:35:15 dovecot_login authenticator failed for ([120.157.204.71]) [120.157.204.71]:40444: 535 Incorrect authentication data (set_id=info)120.157.204.712077456 EB~s l c a _ \SLIC=:0)128.24.109.135BLACKg*gBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests6252001mlocal~/%13.79.25.151BLACKggBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests2963597 Olocal.'52.169.95.105BLACKg xgxBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests29635974_ilocal~-%13.79.20.152BLACKggъBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests2963597 Olocal,'128.24.111.93BLACKg,g޿,Blacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests6252001o]local~+%74.176.48.53BLACKgݒgޮBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests1861060J05local{)!k39.106.121.135GRAYgCImunify360gAutomatically blocked due to distributed attack1814991'jylocal~%45.148.10.34BLACKgXgXBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests2750405- "local'13.76.211.166BLACKggۨBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests1880251 LӦlocal '13.76.215.190BLACKggۧBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests1880251 L׾local '40.87.157.138BLACKggۦBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests2963597(Wlocal*'74.176.48.234BLACKggޔBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests1861060J0local~)%13.79.25.141BLACKg=gޏ=Blacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests2963597 Olocal~(%74.176.51.76BLACKg뻞gތBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests1861060J3Llocal')170.39.218.202BLACKg!gކ!Blacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests6251999'local&'170.39.218.12BLACKgg}Blacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests6251999' local%)52.178.205.103BLACKggqBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests29635974glocal$'52.169.183.89BLACKgghBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests29635974Ylocal~!%23.96.86.163BLACKgYg*Blacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests6252001`Vlocal~ %74.176.48.88BLACKgMgBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests1861060J0Xlocal~%74.176.48.83BLACKg(gBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests1861060J0Slocal~%74.176.51.84BLACKggBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests1861060J3Tlocal~%52.178.202.5BLACKggBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests29635974local%192.99.7.188BLACKg\gݣ\Blacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests6251999clocal'192.95.30.177BLACKgjg;Blacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests6251999_local)170.39.218.138BLACKggg8Blacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests6251999'ڊlocal~%13.74.62.165BLACKg鸷g܉Blacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests2963597 J>local)164.92.127.117BLACKg+gp+Blacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests6252001\ulocal'128.24.77.112BLACKggBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests6252001Mplocal'52.169.88.234BLACKg gۭBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests29635974Xlocal  > O Y  ;Suy$  -}) ossec13001gExim Auth failed2025-03-20 15:49:23 dovecot_plain authenticator failed for ([109.191.68.111]) [109.191.68.111]:60828: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)109.191.68.1112017370g#  -]% ossec13001gExim Auth failed2025-03-20 15:49:08 dovecot_login authenticator failed for ([58.18.90.114]) [58.18.90.114]:43288: 535 Incorrect authentication data (set_id=services@heipowersystem.com)58.18.90.1141814991Z"  -=+ ossec13001gIExim Auth failed2025-03-20 15:43:29 dovecot_plain authenticator failed for ([197.255.204.238]) [197.255.204.238]:34658: 535 Incorrect authentication data (set_id=sales)197.255.204.2382413451d!  -W% ossec13001g?Exim Auth failed2025-03-20 15:43:18 dovecot_plain authenticator failed for ([66.55.74.113]) [66.55.74.113]:36292: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)66.55.74.1136252001V  -7) ossec13001gfExim Auth failed2025-03-20 15:31:10 dovecot_login authenticator failed for ([118.26.153.102]) [118.26.153.102]:29872: 535 Incorrect authentication data (set_id=info)118.26.153.1021819730p  -o% ossec13001g<Exim Auth failed2025-03-20 15:30:28 dovecot_login authenticator failed for vps-79f20bfc.vps.ovh.net [51.75.24.107]:33099: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)51.75.24.1073017382T  -7% ossec13001gExim Auth failed2025-03-20 15:29:03 dovecot_login authenticator failed for ([103.78.23.30]) [103.78.23.30]:33382: 535 Incorrect authentication data (set_id=services)103.78.23.301269750g  -]% ossec13001gExim Auth failed2025-03-20 15:28:10 dovecot_login authenticator failed for ([59.2.141.155]) [59.2.141.155]:49732: 535 Incorrect authentication data (set_id=services@heipowersystem.com)59.2.141.1551835841X  -=' ossec13001g<Exim Auth failed2025-03-20 15:17:39 dovecot_login authenticator failed for ([45.117.153.72]) [45.117.153.72]:41404: 535 Incorrect authentication data (set_id=admission)45.117.153.721282988s  -q) ossec13001g,Exim Auth failed2025-03-20 15:17:22 dovecot_login authenticator failed for ([178.178.222.59]) [178.178.222.59]:46406: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)178.178.222.592017370`  -O% ossec13001gExim Auth failed2025-03-20 15:06:38 dovecot_login authenticator failed for (rokamauka.com) [119.96.131.8]:33426: 535 Incorrect authentication data (set_id=contact@rokamauka.com)119.96.131.81814991R  -3% ossec13001gExim Auth failed2025-03-20 15:06:13 dovecot_login authenticator failed for (rokamauka.com) [119.96.131.8]:58254: 535 Incorrect authentication data (set_id=nologin)119.96.131.81814991r  -q' ossec13001g/Exim Auth failed2025-03-20 15:04:37 dovecot_plain authenticator failed for syn-071-012-241-225.res.spectrum.com [71.12.241.225]:36390: 535 Incorrect authentication data (set_id=vikas.khandelwal)71.12.241.2256252001k  -i# ossec13001gExim Auth failed2025-03-20 15:04:09 dovecot_plain authenticator failed for ([5.77.213.29]) [5.77.213.29]:40529: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)5.77.213.29174982[  -A) ossec13001gvExim Auth failed2025-03-20 14:57:17 dovecot_login authenticator failed for ([114.202.80.152]) [114.202.80.152]:44215: 535 Incorrect authentication data (set_id=admission)114.202.80.1521835841p  -m' ossec13001gdExim Auth failed2025-03-20 14:57:00 dovecot_login authenticator failed for ([14.53.126.112]) [14.53.126.112]:48940: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)14.53.126.1121835841k  -c' ossec13001gExim Auth failed2025-03-20 14:45:42 dovecot_login authenticator failed for ([222.100.159.2]) [222.100.159.2]:56595: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)222.100.159.21835841 ~qdWJ=0# zm`SF9, v i \ O B 5 (     r e X K > 1 $  { n a T G : -   w j ] P C 6 )    s f Y L ? 2 %  |obUH;.!xk^QD7*tgZM@3& }pcVI</"yl_RE8+uh[NA4' ~qdWJ=0  3469034( 3469034(u 3469034(4 3469034' 3469034' 3469034' 3469034& 3469034& 3469034& 3469034& 3469034& 3469034& 3469034&~ 3469034&l 3469034& 3469034& 3469034& 3469034& 3469034% 3469034% 3469034%T 3469034%0 3469034$ 3469034$ 3469034$? 3469034$' 3469034$% 3469034$ 3469034$ 3469034$ 3469034# 3469034# 3469034# 3469034#q 3469034#: 3469034#* 3469034" 3469034" 3469034" 3469034" 3469034" 3469034" 3469034"} 3469034"8 3469034" 3469034" 3469034! 3469034! 3469034!y 3469034!i 3469034!` 3469034!L 3469034 3469034 3469034 a 3469034 3469034 3469034 3469034 3469034 3469034r 34690341 3469034# 3469034 3469034 3469034 3469034 3469034 3469034t 3469034n 3469034P 34690340 3469034 3469034 3469034 3469034 3469034 3469034l 3469034 3469034 3469034 3469034^ 3469034* 3469034 3469034 3469034L 3469034 3469034 3469034S 3469034' 3469034 3469034 3469034 3469034 3469034 3469034n 3469034d 3469034O 3469034< 3469034( 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034o 3469034k 3469034< 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034V 3469034- 3469034 3469034 3469034 3469034 3469034 3469034} 3469034e 34690348 34690342 3469034- 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034l 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034p 3469034k 3469034F 3469034& 3469034 3469034 3469034 3469034 3469034 3469034( 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034l 3469034a 3469034O 3469034 3469034 3469034 3469034 3469034 3469034 3469034u 3469034o 3469034[ 3469034? 3469034, 3469034$ 3469034 3469034 3469034 3469034 3469034 3469034% 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034 3469034o 3469034B 3469034& 3469034 3469034 3469034 3469034 3469034 3469034 3469034p 3469034L 34690344 3469034 3469034 3469034 3469034 O 3469034 F 3469034 = 3469034 : 3469034  3469034 3469034 3469034 s 3469034 c 3469034 S 3469034 K 3469034 & 3469034 3469034 3469034 3469034 c 3469034 ` 3469034 X 0 0 A  'ENo~W5  -A# ossec13001gExim Auth failed2025-03-20 17:09:57 dovecot_login authenticator failed for (host-29.213.77.5.ucom.am) [5.77.213.29]:52936: 535 Incorrect authentication data (set_id=info)5.77.213.29174982V4  -;' ossec13001g"Exim Auth failed2025-03-20 17:03:53 dovecot_plain authenticator failed for ([91.75.105.190]) [91.75.105.190]:50778: 535 Incorrect authentication data (set_id=services)91.75.105.190290557m3  -e) ossec13001gExim Auth failed2025-03-20 17:03:42 dovecot_plain authenticator failed for ([37.112.186.205]) [37.112.186.205]:55696: 535 Incorrect authentication data (set_id=services@heipowersystem.com)37.112.186.2052017370[2  -A) ossec13001gExim Auth failed2025-03-20 16:57:32 dovecot_login authenticator failed for ([61.150.123.106]) [61.150.123.106]:53420: 535 Incorrect authentication data (set_id=admission)61.150.123.1061814991s1  -q) ossec13001gExim Auth failed2025-03-20 16:57:18 dovecot_login authenticator failed for ([176.104.218.56]) [176.104.218.56]:35312: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)176.104.218.562017370^0  -E+ ossec13001gExim Auth failed2025-03-20 16:24:34 dovecot_login authenticator failed for ([193.234.119.149]) [193.234.119.149]:55762: 535 Incorrect authentication data (set_id=admission)193.234.119.1492661886p/  -m' ossec13001gExim Auth failed2025-03-20 16:24:20 dovecot_login authenticator failed for ([218.4.205.242]) [218.4.205.242]:57144: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)218.4.205.2421814991l.  -e' ossec13001gMExim Auth failed2025-03-20 16:21:56 dovecot_login authenticator failed for (200-205-71-9.customer.tdatabrasil.net.br) [189.56.33.177]:47458: 535 Incorrect authentication data (set_id=info)189.56.33.1773469034n-  -g) ossec13001g9Exim Auth failed2025-03-20 16:21:36 dovecot_login authenticator failed for ([191.59.177.235]) [191.59.177.235]:52080: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)191.59.177.2353469034],  -G' ossec13001gExim Auth failed2025-03-20 16:03:24 dovecot_login authenticator failed for (atm23-13-1.pae.gvt.net.br) [200.175.88.85]:56071: 535 Incorrect authentication data (set_id=info)200.175.88.853469034z+  -' ossec13001gExim Auth failed2025-03-20 16:03:12 dovecot_login authenticator failed for 60-249-207-53.hinet-ip.hinet.net [60.249.207.53]:52518: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)60.249.207.531668284%*  3Q' ossec11301gNew FTP connection.Mar 20 15:54:05 vm1 pure-ftpd[1769857]: (?@51.81.181.165) [INFO] New connection from 51.81.181.16551.81.181.16562520018)  Ai' ossec11302gFTP Authentication failed.Mar 20 15:54:12 vm1 pure-ftpd[1769857]: (?@51.81.181.165) [WARNING] Authentication failed for user [anonymous]51.81.181.1656252001k(  -a) ossec13001gExim Auth failed2025-03-20 15:51:07 dovecot_login authenticator failed for 47-158-210-137.lsan.ca.frontiernet.net [47.158.210.137]:35916: 535 Incorrect authentication data (set_id=sales)47.158.210.1376252001|'  -) ossec13001gExim Auth failed2025-03-20 15:50:50 dovecot_login authenticator failed for 109.46.246.220.static.netvigator.com [220.246.46.109]:64447: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)220.246.46.1091819730R&  -5# ossec13001gExim Auth failed2025-03-20 15:50:34 dovecot_login authenticator failed for ([38.79.83.28]) [38.79.83.28]:34246: 535 Incorrect authentication data (set_id=admission)38.79.83.286252001v%  -u+ ossec13001gExim Auth failed2025-03-20 15:50:10 dovecot_login authenticator failed for ([211.104.166.110]) [211.104.166.110]:49350: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)211.104.166.1101835841 ) Q c u AVgvF  -y' ossec13001g Exim Auth failed2025-03-20 18:06:29 dovecot_plain authenticator failed for ([221.228.232.5]) [221.228.232.5]:30692: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)221.228.232.51814991VE  -7) ossec13001g Exim Auth failed2025-03-20 18:01:54 dovecot_login authenticator failed for ([123.110.20.194]) [123.110.20.194]:33508: 535 Incorrect authentication data (set_id=info)123.110.20.1941668284kD  -c' ossec13001g Exim Auth failed2025-03-20 18:01:35 dovecot_login authenticator failed for ([218.4.205.242]) [218.4.205.242]:48766: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)218.4.205.2421814991gC  -[' ossec13001g GExim Auth failed2025-03-20 17:59:58 dovecot_plain authenticator failed for ([116.88.187.44]) [116.88.187.44]:48924: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)116.88.187.441880251WB  -9) ossec13001g YExim Auth failed2025-03-20 18:00:17 dovecot_plain authenticator failed for ([117.53.254.144]) [117.53.254.144]:60256: 535 Incorrect authentication data (set_id=sales)117.53.254.1441835841XA  -=' ossec13001gExim Auth failed2025-03-20 17:36:21 dovecot_login authenticator failed for ([102.221.65.24]) [102.221.65.24]:43103: 535 Incorrect authentication data (set_id=admission)102.221.65.242413451v@  -y' ossec13001gExim Auth failed2025-03-20 17:36:00 dovecot_login authenticator failed for vps-0aeff849.vps.ovh.ca [51.222.206.10]:59078: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)51.222.206.106251999V?  -7) ossec13001gExim Auth failed2025-03-20 17:32:50 dovecot_login authenticator failed for ([95.167.250.158]) [95.167.250.158]:52030: 535 Incorrect authentication data (set_id=info)95.167.250.1582017370n>  -g) ossec13001gExim Auth failed2025-03-20 17:32:34 dovecot_login authenticator failed for ([120.48.231.200]) [120.48.231.200]:39190: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)120.48.231.2001814991Q=  -1% ossec13001gvExim Auth failed2025-03-20 17:30:52 dovecot_login authenticator failed for ([12.44.246.82]) [12.44.246.82]:45391: 535 Incorrect authentication data (set_id=sales)12.44.246.826252001x<  -}) ossec13001gKExim Auth failed2025-03-20 17:30:11 dovecot_plain authenticator failed for ([94.204.230.110]) [94.204.230.110]:57318: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)94.204.230.110290557b;  -S' ossec13001gVExim Auth failed2025-03-20 17:30:21 dovecot_plain authenticator failed for ([87.200.73.165]) [87.200.73.165]:59668: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)87.200.73.165290557j:  -_) ossec13001gTExim Auth failed2025-03-20 17:30:19 dovecot_login authenticator failed for ([120.29.140.140]) [120.29.140.140]:54192: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)120.29.140.1401835841j9  -_) ossec13001gExim Auth failed2025-03-20 17:23:52 dovecot_plain authenticator failed for ([39.183.162.243]) [39.183.162.243]:55886: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)39.183.162.2431814991T8  -5' ossec13001gExim Auth failed2025-03-20 17:22:42 dovecot_plain authenticator failed for ([57.128.19.228]) [57.128.19.228]:39454: 535 Incorrect authentication data (set_id=sales)57.128.19.2283017382d7  -W% ossec13001g{Exim Auth failed2025-03-20 17:22:27 dovecot_plain authenticator failed for ([141.94.18.69]) [141.94.18.69]:45886: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)141.94.18.693017382k6  -c' ossec13001gExim Auth failed2025-03-20 17:09:48 dovecot_login authenticator failed for ([106.37.103.82]) [106.37.103.82]:55645: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)106.37.103.821814991  6'EgkV  -' ossec13001g*VExim Auth failed2025-03-20 20:16:45 dovecot_login authenticator failed for 216.106.67.50.reverse.socket.net [216.106.67.50]:46590: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)216.106.67.506252001SU  -3' ossec13001g*vExim Auth failed2025-03-20 20:17:18 dovecot_login authenticator failed for ([14.53.126.112]) [14.53.126.112]:51094: 535 Incorrect authentication data (set_id=info)14.53.126.1121835841mT  -g' ossec13001g*rExim Auth failed2025-03-20 20:17:12 dovecot_login authenticator failed for 24-220-250-67-dynamic.midco.net [24.220.250.67]:46318: 535 Incorrect authentication data (set_id=vikas.khandelwal)24.220.250.676252001+S  3Y+ ossec11301g)New FTP connection.Mar 20 20:14:17 vm1 pure-ftpd[1824603]: (?@184.105.247.195) [INFO] New connection from 184.105.247.195184.105.247.1956252001xR  -# ossec13001g$Exim Auth failed2025-03-20 19:49:43 dovecot_login authenticator failed for net-2-36-64-247.cust.vodafonedsl.it [2.36.64.247]:55336: 535 Incorrect authentication data (set_id=services@heipowersystem.com)2.36.64.2473175395ZQ  -?) ossec13001g$ Exim Auth failed2025-03-20 19:49:56 dovecot_login authenticator failed for ([119.203.137.21]) [119.203.137.21]:36426: 535 Incorrect authentication data (set_id=services)119.203.137.211835841^P  -E+ ossec13001g!Exim Auth failed2025-03-20 19:40:43 dovecot_login authenticator failed for ([121.204.171.142]) [121.204.171.142]:59488: 535 Incorrect authentication data (set_id=admission)121.204.171.1421814991 O  -#' ossec13001g!Exim Auth failed2025-03-20 19:40:04 dovecot_login authenticator failed for (ip-107-12-61-200.static.silicanetworks.com) [200.61.12.107]:54011: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)200.61.12.1073865483UN  -7' ossec13001g;Exim Auth failed2025-03-20 18:50:57 dovecot_login authenticator failed for (www.safecleen.com) [58.49.113.138]:11237: 535 Incorrect authentication data (set_id=info)58.49.113.1381814991kM  -c' ossec13001g.Exim Auth failed2025-03-20 18:50:45 dovecot_login authenticator failed for ([57.128.19.228]) [57.128.19.228]:40774: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)57.128.19.2283017382zL  -) ossec13001gExim Auth failed2025-03-20 18:43:44 dovecot_plain authenticator failed for 140.82.157.126.360broadband.net [140.82.157.126]:46885: 535 Incorrect authentication data (set_id=services@heipowersystem.com)140.82.157.1266252001gK  -]% ossec13001g0Exim Auth failed2025-03-20 18:37:59 dovecot_login authenticator failed for c-71-229-1-186.hsd1.al.comcast.net [71.229.1.186]:43734: 535 Incorrect authentication data (set_id=admission)71.229.1.1866252001sJ  -q) ossec13001gExim Auth failed2025-03-20 18:37:31 dovecot_login authenticator failed for ([218.150.170.10]) [218.150.170.10]:60482: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)218.150.170.101835841pI  -m' ossec13001g Exim Auth failed2025-03-20 18:10:54 dovecot_login authenticator failed for ([121.33.207.58]) [121.33.207.58]:50698: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)121.33.207.581814991=H  =s+ ossec13008g dMail Reciepient rejected2025-03-20 18:08:59 H=(mail.thepsindustries.com) [165.154.226.139]:61579 F= rejected RCPT : Rejected relay attempt: '165.154.226.139' From: 'lqiwl@thepsindustries.com' To: 'goofile@fastmail.com'165.154.226.1391668284iG  -[+ ossec13001g Exim Auth failed2025-03-20 18:06:38 dovecot_plain authenticator failed for ([176.210.118.102]) [176.210.118.102]:44496: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)176.210.118.1022017370 q .  6Elyqg  -' ossec13001gBExim Auth failed2025-03-20 22:00:22 dovecot_plain authenticator failed for c9vpn.cirrus9.net ([98.143.249.75]) [199.59.135.22]:55132: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)199.59.135.226251999of  -m% ossec13001gBExim Auth failed2025-03-20 22:00:05 dovecot_plain authenticator failed for ([191.59.165.4]) [191.59.165.4]:48628: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)191.59.165.43469034Ue  -9% ossec13001g>Exim Auth failed2025-03-20 21:44:24 dovecot_login authenticator failed for ([58.96.247.71]) [58.96.247.71]:13871: 535 Incorrect authentication data (set_id=admission)58.96.247.711880251md  -i% ossec13001g>Exim Auth failed2025-03-20 21:43:56 dovecot_login authenticator failed for ([5.59.141.152]) [5.59.141.152]:49924: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)5.59.141.1522017370Pc  -/% ossec13001g<Exim Auth failed2025-03-20 21:34:48 dovecot_login authenticator failed for ([50.82.12.128]) [50.82.12.128]:39880: 535 Incorrect authentication data (set_id=info)50.82.12.1286252001qb  -k+ ossec13001g<Exim Auth failed2025-03-20 21:34:33 dovecot_login authenticator failed for ([193.234.119.254]) [193.234.119.254]:59924: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)193.234.119.2542661886ha  -_% ossec13001g4TExim Auth failed2025-03-20 20:59:24 dovecot_login authenticator failed for ([85.152.57.60]) [85.152.57.60]:33280: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)85.152.57.602510769`  -' ossec13001g3Exim Auth failed2025-03-20 20:56:14 dovecot_login authenticator failed for syn-071-066-157-177.biz.spectrum.com [71.66.157.177]:60620: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)71.66.157.1776252001v_  -u+ ossec13001g3Exim Auth failed2025-03-20 20:56:10 dovecot_login authenticator failed for ([120.157.249.180]) [120.157.249.180]:50566: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)120.157.249.1802077456g^  -[' ossec13001g2Exim Auth failed2025-03-20 20:52:12 dovecot_login authenticator failed for ([186.179.80.12]) [186.179.80.12]:36354: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)186.179.80.123895114[]  -A) ossec13001g1Exim Auth failed2025-03-20 20:49:20 dovecot_login authenticator failed for ([222.174.187.202]) [113.122.233.92]:37278: 535 Incorrect authentication data (set_id=services)113.122.233.921814991Z\  -?) ossec13001g1Exim Auth failed2025-03-20 20:49:09 dovecot_login authenticator failed for ([113.64.208.228]) [113.64.208.228]:53767: 535 Incorrect authentication data (set_id=services)113.64.208.2281814991j[  -a' ossec13001g1Exim Auth failed2025-03-20 20:48:41 dovecot_login authenticator failed for ([48.218.170.53]) [48.218.170.53]:38126: 535 Incorrect authentication data (set_id=services@heipowersystem.com)48.218.170.531861060(Z  3U) ossec11301g16New FTP connection.Mar 20 20:46:04 vm1 pure-ftpd[1831162]: (?@205.210.31.239) [INFO] New connection from 205.210.31.239205.210.31.2396252001UY  -9% ossec13001g-]Exim Auth failed2025-03-20 20:29:39 dovecot_login authenticator failed for ([5.59.141.152]) [5.59.141.152]:49806: 535 Incorrect authentication data (set_id=admission)5.59.141.1522017370X  -' ossec13001g-?Exim Auth failed2025-03-20 20:29:10 dovecot_login authenticator failed for syn-071-066-157-177.biz.spectrum.com [71.66.157.177]:65176: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)71.66.157.1776252001nW  -g) ossec13001g*dExim Auth failed2025-03-20 20:16:58 dovecot_login authenticator failed for ([118.140.135.25]) [118.140.135.25]:45934: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)118.140.135.251819730 T  C U ,RTzx  -' ossec13001gT}Exim Auth failed2025-03-20 23:16:36 dovecot_plain authenticator failed for 041.148.48.116.static.netvigator.com [116.48.148.41]:53186: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)116.48.148.411819730Vw  -7) ossec13001gNExim Auth failed2025-03-20 22:51:34 dovecot_login authenticator failed for ([121.147.25.111]) [121.147.25.111]:38326: 535 Incorrect authentication data (set_id=info)121.147.25.1111835841ev  -[# ossec13001gNExim Auth failed2025-03-20 22:51:15 dovecot_login authenticator failed for ([59.7.57.174]) [59.7.57.174]:40712: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)59.7.57.1741835841Nu  --# ossec13001gMExim Auth failed2025-03-20 22:47:28 dovecot_login authenticator failed for ([60.174.86.4]) [60.174.86.4]:38187: 535 Incorrect authentication data (set_id=sales)60.174.86.41814991ct  -S' ossec13001gMExim Auth failed2025-03-20 22:47:14 dovecot_login authenticator failed for 24-119-144-86.cpe.sparklight.net [24.119.144.86]:34886: 535 Incorrect authentication data (set_id=sales)24.119.144.866252001ms  -c+ ossec13001gMExim Auth failed2025-03-20 22:46:46 dovecot_login authenticator failed for ([183.167.193.127]) [183.167.193.127]:48170: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)183.167.193.1271814991{r  -+ ossec13001gLExim Auth failed2025-03-20 22:44:24 dovecot_plain authenticator failed for ([196.191.212.232]) [196.191.212.232]:59440: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)196.191.212.232337996hq  -Y+ ossec13001gLExim Auth failed2025-03-20 22:43:11 dovecot_login authenticator failed for 119.sub-166-145-160.myvzw.com [166.145.160.119]:55517: 535 Incorrect authentication data (set_id=admission)166.145.160.1196252001pp  -m' ossec13001gLExim Auth failed2025-03-20 22:42:46 dovecot_login authenticator failed for ([39.152.196.78]) [39.152.196.78]:42377: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)39.152.196.781814991eo  -S+ ossec13001gKExim Auth failed2025-03-20 22:38:43 dovecot_plain authenticator failed for ([123.116.142.131]) [123.116.142.131]:37009: 535 Incorrect authentication data (set_id=vikas.khandelwal)123.116.142.1311814991un  -u) ossec13001gKExim Auth failed2025-03-20 22:38:18 dovecot_plain authenticator failed for ([109.191.68.111]) [109.191.68.111]:55729: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)109.191.68.1112017370Qm  -1% ossec13001gKExim Auth failed2025-03-20 22:38:17 dovecot_plain authenticator failed for ([20.83.155.49]) [20.83.155.49]:43974: 535 Incorrect authentication data (set_id=sales)20.83.155.496252001jl  -_) ossec13001gKxExim Auth failed2025-03-20 22:38:08 dovecot_plain authenticator failed for ([222.160.99.210]) [222.160.99.210]:54141: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)222.160.99.2101814991Pk  -/% ossec13001gF'Exim Auth failed2025-03-20 22:15:26 dovecot_login authenticator failed for ([60.166.8.174]) [60.166.8.174]:53374: 535 Incorrect authentication data (set_id=info)60.166.8.1741814991hj  -_% ossec13001gFExim Auth failed2025-03-20 22:15:13 dovecot_login authenticator failed for ([193.93.237.8]) [193.93.237.8]:55940: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)193.93.237.82017370}i  -) ossec13001gC,Exim Auth failed2025-03-20 22:02:43 dovecot_login authenticator failed for ip4-193-93-156-147.blue-net.com.pl ([193.93.156.149]) [193.93.156.147]:34610: 535 Incorrect authentication data (set_id=admission)193.93.156.147798544xh  -}' ossec13001gCExim Auth failed2025-03-20 22:02:08 dovecot_login authenticator failed for 126.64.125.78.rev.sfr.net [78.125.64.126]:54674: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)78.125.64.1263017382 w   - < A g>R|i{w  - ' ossec13001goLExim Auth failed2025-03-21 01:10:59 dovecot_login authenticator failed for h88-129-31-231.cust.bredband2.com [88.129.31.231]:45039: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)88.129.31.2312661886j  -_) ossec13001gkExim Auth failed2025-03-21 00:55:49 dovecot_plain authenticator failed for ([161.35.200.202]) [161.35.200.202]:51748: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)161.35.200.2022921044  --% ossec13001gj#Exim Auth failed2025-03-21 00:48:57 dovecot_login authenticator failed for 206.81.4.146.static.wline.lns.sme.cust.swisscom.ch [146.4.81.206]:51689: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)146.4.81.2062658434R  -5# ossec13001gj)Exim Auth failed2025-03-21 00:49:05 dovecot_login authenticator failed for ([101.58.1.77]) [101.58.1.77]:43140: 535 Incorrect authentication data (set_id=admission)101.58.1.773175395h  -_% ossec13001geExim Auth failed2025-03-21 00:30:11 dovecot_login authenticator failed for ([218.70.9.114]) [218.70.9.114]:42107: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)218.70.9.1141814991R  -5# ossec13001gbExim Auth failed2025-03-21 00:17:18 dovecot_login authenticator failed for ([101.13.1.58]) [101.13.1.58]:37514: 535 Incorrect authentication data (set_id=admission)101.13.1.581668284p  -m' ossec13001gbExim Auth failed2025-03-21 00:16:56 dovecot_login authenticator failed for ([165.16.34.111]) [165.16.34.111]:46221: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)165.16.34.1112215636W  -9) ossec13001gaExim Auth failed2025-03-21 00:14:13 dovecot_plain authenticator failed for ([213.255.219.43]) [213.255.219.43]:43330: 535 Incorrect authentication data (set_id=sales)213.255.219.432782113v  -y' ossec13001gaExim Auth failed2025-03-21 00:14:05 dovecot_plain authenticator failed for 89-253-90-113.customers.ownit.se [89.253.90.113]:53422: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)89.253.90.1132661886  ?1 ossec1008g_Process exiting (killed).Mar 21 00:05:30 vm1 spamd[1567245]: spamd: server killed by SIGTERM, shutting downV  -7) ossec13001g^)Exim Auth failed2025-03-20 23:57:53 dovecot_login authenticator failed for ([176.104.218.56]) [176.104.218.56]:44064: 535 Incorrect authentication data (set_id=info)176.104.218.562017370w~  -}% ossec13001g]Exim Auth failed2025-03-20 23:56:54 dovecot_login authenticator failed for 89-160-38-13.cust.bredband2.com [89.160.38.13]:36826: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)89.160.38.132661886m}  -e) ossec13001g]Exim Auth failed2025-03-20 23:56:45 dovecot_plain authenticator failed for ([103.115.31.219]) [103.115.31.219]:57880: 535 Incorrect authentication data (set_id=services@heipowersystem.com)103.115.31.2191643084j|  -a' ossec13001g]Exim Auth failed2025-03-20 23:56:18 dovecot_plain authenticator failed for ([222.75.248.46]) [222.75.248.46]:49928: 535 Incorrect authentication data (set_id=services@heipowersystem.com)222.75.248.461814991p{  -m' ossec13001g[Exim Auth failed2025-03-20 23:44:24 dovecot_login authenticator failed for ([59.37.169.160]) [59.37.169.160]:33653: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)59.37.169.1601814991vz  -y' ossec13001gVExim Auth failed2025-03-20 23:23:20 dovecot_plain authenticator failed for ([49.124.153.15]) [49.124.153.15]:38340: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)49.124.153.151733045sy  -q) ossec13001gU;Exim Auth failed2025-03-20 23:19:46 dovecot_login authenticator failed for ([187.76.173.246]) [187.76.173.246]:42079: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)187.76.173.2463469034 $ J V w .8\TbP  -/% ossec13001g܊9Exim Auth failed2025-03-21 03:05:52 dovecot_login authenticator failed for ([46.254.94.15]) [46.254.94.15]:45668: 535 Incorrect authentication data (set_id=info)46.254.94.152017370n  -g) ossec13001g܊Exim Auth failed2025-03-21 03:05:24 dovecot_login authenticator failed for ([182.191.122.84]) [182.191.122.84]:30010: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)182.191.122.841168579  -' ossec13001g܉Exim Auth failed2025-03-21 03:04:02 dovecot_login authenticator failed for 212-88-27-103.hdsl.highway.telekom.at [212.88.27.103]:35823: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)212.88.27.1032782113X  -=' ossec13001g܉Exim Auth failed2025-03-21 03:04:21 dovecot_login authenticator failed for ([181.94.220.74]) [181.94.220.74]:38660: 535 Incorrect authentication data (set_id=admission)181.94.220.743437598r  -q' ossec13001g܉Exim Auth failed2025-03-21 03:02:52 dovecot_plain authenticator failed for ([218.4.205.242]) [218.4.205.242]:45964: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)218.4.205.2421814991e  -S+ ossec13001g܉Exim Auth failed2025-03-21 03:03:04 dovecot_plain authenticator failed for ([123.210.128.249]) [123.210.128.249]:36750: 535 Incorrect authentication data (set_id=vikas.khandelwal)123.210.128.2492077456S  -3' ossec13001g܈Exim Auth failed2025-03-21 03:00:36 dovecot_login authenticator failed for ([186.96.89.101]) [186.96.89.101]:39342: 535 Incorrect authentication data (set_id=info)186.96.89.1013624060k  -c' ossec13001g܈Exim Auth failed2025-03-21 03:00:12 dovecot_login authenticator failed for ([218.4.205.242]) [218.4.205.242]:37747: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)218.4.205.2421814991O  -/% ossec13001g܂Exim Auth failed2025-03-21 02:33:50 dovecot_login authenticator failed for ([46.56.85.227]) [46.56.85.227]:59999: 535 Incorrect authentication data (set_id=info)46.56.85.227630336w  -}% ossec13001g܂Exim Auth failed2025-03-21 02:33:41 dovecot_login authenticator failed for 89-160-38-13.cust.bredband2.com [89.160.38.13]:44038: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)89.160.38.132661886W  -=' ossec13001g܀vExim Auth failed2025-03-21 02:24:14 dovecot_login authenticator failed for ([94.207.17.213]) [94.207.17.213]:40712: 535 Incorrect authentication data (set_id=admission)94.207.17.213290557m  -i% ossec13001g܀lExim Auth failed2025-03-21 02:24:04 dovecot_login authenticator failed for ([186.73.22.20]) [186.73.22.20]:45252: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)186.73.22.203703430[  -A) ossec13001gyExim Auth failed2025-03-21 01:56:19 dovecot_login authenticator failed for ([41.224.252.123]) [41.224.252.123]:34770: 535 Incorrect authentication data (set_id=admission)41.224.252.1232464461p  -m' ossec13001gyExim Auth failed2025-03-21 01:55:46 dovecot_login authenticator failed for ([45.229.19.241]) [45.229.19.241]:35828: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)45.229.19.2413865483P  -/% ossec13001gqExim Auth failed2025-03-21 01:18:43 dovecot_login authenticator failed for ([219.139.41.6]) [219.139.41.6]:40749: 535 Incorrect authentication data (set_id=info)219.139.41.61814991  -) ossec13001gqExim Auth failed2025-03-21 01:18:31 dovecot_login authenticator failed for ppp-210-86-163-194.revip.asianet.co.th [210.86.163.194]:61222: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)210.86.163.1941605651X  -=' ossec13001godExim Auth failed2025-03-21 01:11:24 dovecot_login authenticator failed for ([138.122.98.22]) [138.122.98.22]:51069: 535 Incorrect authentication data (set_id=admission)138.122.98.223996063 >  C L O \s )>g+  -]% ossec13001gܡExim Auth failed2025-03-21 04:45:23 dovecot_plain authenticator failed for ([98.70.127.17]) [98.70.127.17]:40998: 535 Incorrect authentication data (set_id=services@heipowersystem.com)98.70.127.171269750`*  -O% ossec13001gܞExim Auth failed2025-03-21 04:34:28 dovecot_plain authenticator failed for ([1.189.209.19]) [1.189.209.19]:45145: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)1.189.209.191814991s)  -u% ossec13001gܞExim Auth failed2025-03-21 04:34:10 dovecot_plain authenticator failed for ([59.7.203.177]) [59.7.203.177]:21719: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)59.7.203.1771835841W(  -9) ossec13001gܝ~Exim Auth failed2025-03-21 04:28:04 dovecot_plain authenticator failed for ([218.150.170.10]) [218.150.170.10]:47494: 535 Incorrect authentication data (set_id=sales)218.150.170.101835841r'  -q' ossec13001gܝ_Exim Auth failed2025-03-21 04:27:35 dovecot_plain authenticator failed for (089-101-036159.ntlworld.ie) [89.101.36.159]:55099: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)89.101.36.1592963597X&  -=' ossec13001gܚExim Auth failed2025-03-21 04:16:57 dovecot_login authenticator failed for ([121.157.28.10]) [121.157.28.10]:49919: 535 Incorrect authentication data (set_id=admission)121.157.28.101835841p%  -m' ossec13001gܚExim Auth failed2025-03-21 04:16:46 dovecot_login authenticator failed for ([49.245.10.228]) [49.245.10.228]:37964: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)49.245.10.2281880251b$  -O) ossec13001gܕExim Auth failed2025-03-21 03:55:56 dovecot_login authenticator failed for host-196-47-172-253.afnet.net [196.47.172.253]:59785: 535 Incorrect authentication data (set_id=sales)196.47.172.2532287781d#  -W% ossec13001gܕExim Auth failed2025-03-21 03:55:13 dovecot_login authenticator failed for ([60.174.35.18]) [60.174.35.18]:46943: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)60.174.35.181814991e"  -S+ ossec13001gܔExim Auth failed2025-03-21 03:50:05 dovecot_plain authenticator failed for ([223.239.130.245]) [223.239.130.245]:12426: 535 Incorrect authentication data (set_id=vikas.khandelwal)223.239.130.2451269750o!  -m% ossec13001gܔExim Auth failed2025-03-21 03:49:44 dovecot_plain authenticator failed for ([58.96.247.71]) [58.96.247.71]:34262: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)58.96.247.711880251y  -}) ossec13001gܓExim Auth failed2025-03-21 03:43:43 dovecot_plain authenticator failed for ([203.193.147.37]) [203.193.147.37]:60044: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)203.193.147.371269750s  -q) ossec13001gܑExim Auth failed2025-03-21 03:37:46 dovecot_login authenticator failed for ([210.222.15.113]) [210.222.15.113]:53390: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)210.222.15.1131835841X  -=' ossec13001g܎zExim Auth failed2025-03-21 03:24:01 dovecot_login authenticator failed for ([186.177.28.83]) [186.177.28.83]:36834: 535 Incorrect authentication data (set_id=admission)186.177.28.833624060p  -m' ossec13001g܎`Exim Auth failed2025-03-21 03:23:34 dovecot_login authenticator failed for ([5.149.155.141]) [5.149.155.141]:56868: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)5.149.155.1412017370k  -c' ossec13001g܎0Exim Auth failed2025-03-21 03:22:47 dovecot_login authenticator failed for ([46.148.139.39]) [46.148.139.39]:58480: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)46.148.139.392017370z  -' ossec13001g܌]Exim Auth failed2025-03-21 03:15:00 dovecot_login authenticator failed for wsip-174-79-91-142.br.br.cox.net [174.79.91.142]:54377: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)174.79.91.1426252001 Q0D7*tgZM@3& yl_RE8+uh[NA4' ~qdWJ=0 -   w j ] P C 6 )    s f Y L ? 2 %    r e X K > 1 $  { n a T G :|o (    bUH;. v i \ O B 5}pcVI </ "9,SFm`z! !  1 183584  1 1835841A 1835841A 1835841A 1835841@ 1835841@ 1835841@ 1835841@ 1835841@ 1835841@ 1835841@ 1835841@ 1835841@ 1835841@ 1835841@ 1835841@k 1835841@P 1835841@J 1835841@I 1835841@C 1835841@B 1835841@> 1835841@9 1835841@3 1835841@1 1835841@& 1835841@# 1835841@ 1835841@ 1835841? 1835841? 1835841? 1835841? 1835841? 1835841? 1835841? 1835841? 1835841? 1835841? 1835841? 1835841? 1835841? 1835841? 1835841? 1835841? 1835841? 1835841?z 1835841?` 1835841?X 1835841?L 1835841?I 1835841?H 1835841?F 1835841?E 1835841I? 1835841I/ 1835841I 1835841H 1835841H 1835841H 1835841H' 1835841H" 1835841G< 1835841G 1835841G 1835841G 1835841G 1835841F 1835841FI 1835841I 1835841I 1835841I 1835841I 1835841I 1835841Iq 1835841In 1835841I] 1835841?D 1835841?7 1835841?0 1835841?& 1835841?% 1835841? 1835841? 1835841? 1835841> 1835841> 1835841> 1835841> 1835841> 1835841> 1835841>m 1835841>b 1835841>U 1835841>K 1835841> 1835841> 1835841> 1835841> 1835841> 1835841= 1835841=N 1835841Jw 1835841Jt 1835841Jn 1835841Jk 1835841Jc 1835841JX 1835841J< 1835841J0 1835841J& 1835841J% 1835841J 1835841Ft 1835841Fh 1835841Ff 1835841Fe 1835841FT 1835841E 1835841E 1835841D 1835841D 1835841D 1835841D 1835841D 1835841D 1835841Ds 1835841CE 1835841CB 1835841C< 1835841C7 1835841C4 1835841C* 1835841C 1835841B 1835841B 1835841B 1835841B 1835841B 1835841B 1835841B 1835841B 1835841Bx 1835841Bq 1835841Bo 1835841Bn 1835841Bm 1835841BY 1835841BO 1835841BN 1835841BK 1835841BI 1835841BB 1835841B 1835841B 1835841A 1835841A 1835841A 1835841A 1835841A 1835841A 1835841A 1835841Ar 1835841Ao 1835841An 1835841AJ 1835841A@ 1835841A; 1835841A 1835841A 1835841A 1835841A 1835841A 1835841De 1835841DY 1835841DM 1835841DI 1835841D> 1835841D< 1835841D8 1835841D$ 1835841D" 1835841D 1835841D 1835841C 1835841C 1835841C 1835841C 1835841C 1835841C 1835841C 1835841C 1835841C 1835841C 1835841C 1835841C 1835841CY 1835841CT 1835841CI 1835841FC 1835841F- 1835841E 1835841E 1835841E 1835841E 1835841E 1835841EU 1835841EN 1835841E% 1835841E 1835841E 1835841E 1835841F 1835841F 1835841F 1835841F 1835841F 1835841F 1835841F 1835841F 1835841F 1835841G 1835841G 1835841G 1835841G= 1835841Hw 1835841Hf 1835841He 1835841Ha 1835841HG 1835841H 1835841H 1835841H 1835841I 1835841I 1835841I6 1835841I1 1835841I< 1835841I; 1835841IZ 1835841J 1835841I 1835841I 1835841I 1835841I 1835841I 1835841I B"" ) Z u z (Bb<  -U# ossec13001gܷExim Auth failed2025-03-21 06:19:29 dovecot_login authenticator failed for net-2-38-71-159.cust.vodafonedsl.it [2.38.71.159]:20461: 535 Incorrect authentication data (set_id=sales)2.38.71.1593175395Z;  -?) ossec13001gܷ Exim Auth failed2025-03-21 06:17:28 dovecot_login authenticator failed for ([61.143.241.150]) [61.143.241.150]:39112: 535 Incorrect authentication data (set_id=services)61.143.241.1501814991j:  -a' ossec13001gܷ Exim Auth failed2025-03-21 06:17:04 dovecot_login authenticator failed for ([120.157.60.38]) [120.157.60.38]:34006: 535 Incorrect authentication data (set_id=services@heipowersystem.com)120.157.60.382077456k9  -c' ossec13001gܶExim Auth failed2025-03-21 06:16:15 dovecot_login authenticator failed for syn-097-089-202-226.biz.spectrum.com [97.89.202.226]:59936: 535 Incorrect authentication data (set_id=admission)97.89.202.2266252001p8  -m' ossec13001gܶExim Auth failed2025-03-21 06:15:24 dovecot_login authenticator failed for ([106.86.209.86]) [106.86.209.86]:30750: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)106.86.209.861814991g7  -_% ossec13001gܲ3Exim Auth failed2025-03-21 05:56:26 dovecot_login authenticator failed for ([41.60.23.246]) [41.60.23.246]:51959: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)41.60.23.246895949e6  -U) ossec13001gܰ"Exim Auth failed2025-03-21 05:47:37 dovecot_plain authenticator failed for p5dd3e89f.dip0.t-ipconnect.de [93.211.232.159]:58262: 535 Incorrect authentication data (set_id=services)93.211.232.1592921044u5  -y% ossec13001gܰExim Auth failed2025-03-21 05:47:28 dovecot_plain authenticator failed for 85.208.6.106.mixvoip.solutions [85.208.6.106]:48554: 535 Incorrect authentication data (set_id=services@heipowersystem.com)85.208.6.10629603134  -) ossec13001gܯDExim Auth failed2025-03-21 05:43:56 dovecot_login authenticator failed for (189.218.168.30-clientes-izzi.mx) [189.218.168.30]:55868: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)189.218.168.303996063[3  -A) ossec13001gܩ7Exim Auth failed2025-03-21 05:18:05 dovecot_login authenticator failed for ([107.172.86.133]) [107.172.86.133]:36226: 535 Incorrect authentication data (set_id=admission)107.172.86.1336252001m2  -i% ossec13001gܩ'Exim Auth failed2025-03-21 05:17:50 dovecot_login authenticator failed for ([95.79.57.221]) [95.79.57.221]:59740: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)95.79.57.2212017370w1  -}% ossec13001gܦvExim Auth failed2025-03-21 05:06:21 dovecot_login authenticator failed for 45-237-92-19.infonet-isp.com.br [45.237.92.19]:55190: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)45.237.92.193469034a0  -O) ossec13001gܥFExim Auth failed2025-03-21 05:01:17 dovecot_login authenticator failed for ([94.207.113.133]) [94.207.113.133]:48359: 535 Incorrect authentication data (set_id=vikas.khandelwal)94.207.113.133290557K/  -)! ossec13001gܥ@Exim Auth failed2025-03-21 05:01:11 dovecot_plain authenticator failed for ([45.6.80.40]) [45.6.80.40]:58128: 535 Incorrect authentication data (set_id=sales)45.6.80.403469034u.  -u) ossec13001gܥ0Exim Auth failed2025-03-21 05:00:54 dovecot_login authenticator failed for ([117.53.254.144]) [117.53.254.144]:56085: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)117.53.254.1441835841|-  -) ossec13001gܥ*Exim Auth failed2025-03-21 05:00:48 dovecot_plain authenticator failed for 166.46.246.220.static.netvigator.com [220.246.46.166]:50857: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)220.246.46.1661819730Z,  -?) ossec13001gܡExim Auth failed2025-03-21 04:45:34 dovecot_plain authenticator failed for ([116.50.251.164]) [116.50.251.164]:32938: 535 Incorrect authentication data (set_id=services)116.50.251.1641694008  $ J S Z t qvo wL  -{' ossec13001gExim Auth failed2025-03-21 08:03:23 dovecot_plain authenticator failed for ([218.106.120.18]) [58.49.113.138]:17481: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)58.49.113.1381814991TK  -5' ossec13001gExim Auth failed2025-03-21 07:58:58 dovecot_plain authenticator failed for ([112.196.60.13]) [112.196.60.13]:51124: 535 Incorrect authentication data (set_id=sales)112.196.60.131269750jJ  -_) ossec13001gExim Auth failed2025-03-21 07:58:50 dovecot_plain authenticator failed for ([111.21.226.150]) [111.21.226.150]:16829: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)111.21.226.1501814991YI  -;+ ossec13001g@Exim Auth failed2025-03-21 07:47:35 dovecot_login authenticator failed for ([176.119.132.230]) [176.119.132.230]:50989: 535 Incorrect authentication data (set_id=info)176.119.132.2302510769kH  -c' ossec13001g6Exim Auth failed2025-03-21 07:47:25 dovecot_login authenticator failed for ([106.86.209.86]) [106.86.209.86]:43250: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)106.86.209.861814991UG  -9% ossec13001gExim Auth failed2025-03-21 07:42:31 dovecot_login authenticator failed for ([59.34.17.130]) [59.34.17.130]:49206: 535 Incorrect authentication data (set_id=admission)59.34.17.1301814991F  -' ossec13001gExim Auth failed2025-03-21 07:42:19 dovecot_login authenticator failed for syn-071-012-241-225.res.spectrum.com [71.12.241.225]:46514: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)71.12.241.2256252001E  W!) ossec9708ggDovecot Aborted Login with empty userMar 21 07:35:25 vm1 dovecot[1250588]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=185.180.141.39, lip=103.74.54.108, TLS, session=185.180.141.392264397TD  -9% ossec13001gExim Auth failed2025-03-21 07:33:13 dovecot_login authenticator failed for ([45.93.94.125]) [45.93.94.125]:43744: 535 Incorrect authentication data (set_id=admission)45.93.94.125294640C  - ) ossec13001gExim Auth failed2025-03-21 07:32:56 dovecot_login authenticator failed for (m121-202-152-40.smartone.com) [121.202.152.40]:58353: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)121.202.152.401819730bB  -O) ossec13001gǚExim Auth failed2025-03-21 07:27:46 dovecot_plain authenticator failed for ([87.225.108.138]) [87.225.108.138]:56796: 535 Incorrect authentication data (set_id=vikas.khandelwal)87.225.108.1382017370uA  -u) ossec13001gǎExim Auth failed2025-03-21 07:27:34 dovecot_plain authenticator failed for ([188.244.154.53]) [188.244.154.53]:56958: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)188.244.154.532017370s@  -q) ossec13001gExim Auth failed2025-03-21 07:00:04 dovecot_login authenticator failed for ([180.173.51.183]) [180.173.51.183]:42221: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)180.173.51.1831814991V?  -7) ossec13001gܹExim Auth failed2025-03-21 06:28:24 dovecot_login authenticator failed for ([222.114.84.175]) [222.114.84.175]:56930: 535 Incorrect authentication data (set_id=info)222.114.84.1751835841k>  -c' ossec13001gܹExim Auth failed2025-03-21 06:28:11 dovecot_login authenticator failed for ([67.55.189.215]) [67.55.189.215]:59845: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)67.55.189.2156252001i=  -_) ossec13001gܷExim Auth failed2025-03-21 06:19:14 dovecot_login authenticator failed for ([94.205.100.219]) [94.205.100.219]:50511: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)94.205.100.219290557 *\~tj`VLB8.$zpf\H>4*   v l b X N D : 0 &    ~ t j ` V L B 8 . $    z p f \ R H > 4 *  vlbXND0:&|rh^TJ@6,"xndPZF< 2(~tj`VLB8.$zpf\ | r h ^ T J @ 6 , "    x n d Z P F < 2 (   RRH>4*  vlbXND:0& gHu/ gHa/ gGM/ gE/ gE/ gEB/ gEP/ gE/ gD/ gD/ gC/ gC/ gAM/ g?/ g>/ g>B/ g>/ g/q gv/p gp/o g\/n g:/m g/l g/k g/j g/i g/h g/g g?/f g5/e g/d gN/c gD/b g/a g/` g /_ g/^ g/] g/\ g/[ g/Z ga/Y gM/X g/W g/V g/U gݐ/T g/S g /R g0/Q g>/P g/O gӧ/N g/M g/L g/K g/J g@/I g6/H g/G g/F gg/E g/D g/C gǚ/B gǎ/A g/@ gܹ/? gܹ/> gܷ/< gܷ/= gܷ /; gܷ /: gܶ/9 gܶ/8 gܲ3/7 gܰ"/6 gܰ/5 gܯD/4 gܩ7/3 gܩ'/2 gܦv/1 gܥF/0 gܥ@// gܥ0/. gܥ*/- gܡ/, gܡ/+ gܞ/* gܞ/) gܝ~/( gܝ_/' gܚ/& gܚ/% gܕ/$ gܕ/# gܔ/" gܔ/! gܓ/ gܑ/ g܎z/ g܎`/ g܎0/ g܌]/ g܊9/ g܊/ g܉/ gc@/ gc8/ gc / gbx/ gb^/ ga!/ ga/ g`/ g_{/ g_i/ g_G/ g_=/ g_5/ g]t/ g]\/ g]N/ g]. g>. g<. g<. g4T. g3. g3. g2. g1. g1. g1. g16. g-]. g-?. g*v. g*r. g*d. g*V. g). g$ . g$. g!. g!. g;. g.. g. g0. g. g . g d. g . g . g . g .   s  5ZnZ]  -A' ossec13001gExim Auth failed2025-03-21 09:24:35 dovecot_login authenticator failed for (thepsindustries.com) [111.207.12.99]:52444: 535 Incorrect authentication data (set_id=nologin)111.207.12.991814991n\  -g) ossec13001gExim Auth failed2025-03-21 09:24:09 dovecot_login authenticator failed for ([103.253.201.19]) [103.253.201.19]:34438: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)103.253.201.191269750V[  -7) ossec13001gExim Auth failed2025-03-21 09:20:37 dovecot_login authenticator failed for ([94.181.187.192]) [94.181.187.192]:56134: 535 Incorrect authentication data (set_id=info)94.181.187.1922017370hZ  -_% ossec13001gExim Auth failed2025-03-21 09:20:27 dovecot_login authenticator failed for ([59.41.184.10]) [59.41.184.10]:46385: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)59.41.184.101814991WY  -9) ossec13001gaExim Auth failed2025-03-21 09:13:27 dovecot_plain authenticator failed for ([109.70.203.114]) [109.70.203.114]:49934: 535 Incorrect authentication data (set_id=sales)109.70.203.1143175395gX  -[' ossec13001gMExim Auth failed2025-03-21 09:13:07 dovecot_plain authenticator failed for ([103.48.194.21]) [103.48.194.21]:35248: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)103.48.194.211562822[W  -A) ossec13001gExim Auth failed2025-03-21 09:07:41 dovecot_login authenticator failed for mail-02.03.perm.ru [46.146.210.180]:32684: 535 Incorrect authentication data (set_id=admission)46.146.210.1802017370sV  -q) ossec13001gExim Auth failed2025-03-21 09:07:25 dovecot_login authenticator failed for ([94.181.187.192]) [94.181.187.192]:56114: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)94.181.187.1922017370rU  -q' ossec13001gExim Auth failed2025-03-21 09:02:21 dovecot_plain authenticator failed for ([41.224.62.206]) [41.224.62.206]:44761: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)41.224.62.2062464461oT  -m' ossec13001gݐExim Auth failed2025-03-21 09:01:27 dovecot_login authenticator failed for (62-73-121-209.btc-net.bg) [62.73.121.209]:34236: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)62.73.121.209732800SS  -7% ossec13001gExim Auth failed2025-03-21 08:59:22 dovecot_plain authenticator failed for ([87.200.181.5]) [87.200.181.5]:50394: 535 Incorrect authentication data (set_id=services)87.200.181.5290557pR  -i+ ossec13001g Exim Auth failed2025-03-21 08:59:13 dovecot_plain authenticator failed for ([163.179.101.202]) [163.179.101.202]:42671: 535 Incorrect authentication data (set_id=services@heipowersystem.com)163.179.101.2021814991jQ  -c' ossec13001g0Exim Auth failed2025-03-21 08:29:58 dovecot_login authenticator failed for ([185.167.56.24]) [185.167.56.24]:52794: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)185.167.56.24617790WP  -?% ossec13001g>Exim Auth failed2025-03-21 08:30:12 dovecot_login authenticator failed for vps-eed33ea4.vps.ovh.net [51.38.133.48]:34232: 535 Incorrect authentication data (set_id=info)51.38.133.48798544"O  3M% ossec11301gNew FTP connection.Mar 21 08:28:06 vm1 pure-ftpd[1981018]: (?@71.6.134.233) [INFO] New connection from 71.6.134.23371.6.134.2336252001pN  -m' ossec13001gӧExim Auth failed2025-03-21 08:19:11 dovecot_login authenticator failed for ([58.246.100.27]) [58.246.100.27]:56052: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)58.246.100.271814991oM  -i) ossec13001gExim Auth failed2025-03-21 08:03:34 dovecot_plain authenticator failed for (183.83.188.236.actcorp.in) [183.83.188.236]:60254: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)183.83.188.2361269750 ) ; f o :Maevsn  -q) ossec13001g\Exim Auth failed2025-03-21 10:47:16 dovecot_login authenticator failed for ([27.128.162.146]) [27.128.162.146]:49096: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)27.128.162.1461814991Ym  -C# ossec13001g:Exim Auth failed2025-03-21 10:42:26 dovecot_login authenticator failed for ([61.233.4.50]) [61.233.4.50]:48946: 535 Incorrect authentication data (set_id=vikas.khandelwal)61.233.4.501814991ql  -q' ossec13001gExim Auth failed2025-03-21 10:41:57 dovecot_login authenticator failed for ([46.153.85.132]) [46.153.85.132]:45750: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)46.153.85.132102358kk  -c' ossec13001gExim Auth failed2025-03-21 10:28:01 dovecot_login authenticator failed for ([191.59.254.45]) [191.59.254.45]:41878: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)191.59.254.453469034xj  -}' ossec13001gExim Auth failed2025-03-21 10:27:32 dovecot_login authenticator failed for p173071-obmd01.osaka.ocn.ne.jp [61.118.248.70]:43365: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)61.118.248.701861060hi  -]' ossec13001gExim Auth failed2025-03-21 10:14:53 dovecot_login authenticator failed for 202-4-196-180.static.pccw-hkt.com [202.4.196.180]:42999: 535 Incorrect authentication data (set_id=admission)202.4.196.1801819730ih  -e# ossec13001gExim Auth failed2025-03-21 10:14:26 dovecot_login authenticator failed for ([95.0.252.72]) [95.0.252.72]:57178: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)95.0.252.72298795+g  3Y+ ossec11301gNew FTP connection.Mar 21 09:59:03 vm1 pure-ftpd[2000049]: (?@162.142.125.213) [INFO] New connection from 162.142.125.213162.142.125.2136252001rf  -q) ossec13001g?Exim Auth failed2025-03-21 09:51:18 dovecot_login authenticator failed for ([94.204.103.216]) [94.204.103.216]:33806: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)94.204.103.216290557e  - ) ossec13001g5Exim Auth failed2025-03-21 09:51:07 dovecot_login authenticator failed for p157227-obmd01.osaka.ocn.ne.jp [61.112.100.226]:37798: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)61.112.100.2261861060(d  3U) ossec11301gNew FTP connection.Mar 21 09:49:40 vm1 pure-ftpd[1998026]: (?@20.150.206.233) [INFO] New connection from 20.150.206.23320.150.206.2336252001]c  -K# ossec13001gNExim Auth failed2025-03-21 09:47:17 dovecot_plain authenticator failed for ([81.13.62.77]) [81.13.62.77]:59716: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)81.13.62.772017370sb  -u% ossec13001gDExim Auth failed2025-03-21 09:47:07 dovecot_plain authenticator failed for ([190.61.8.149]) [190.61.8.149]:41132: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)190.61.8.1493595528Qa  -1% ossec13001gExim Auth failed2025-03-21 09:40:59 dovecot_plain authenticator failed for ([218.68.0.210]) [218.68.0.210]:47398: 535 Incorrect authentication data (set_id=sales)218.68.0.2101814991j`  -_) ossec13001gExim Auth failed2025-03-21 09:40:44 dovecot_plain authenticator failed for ([183.220.247.85]) [183.220.247.85]:33320: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)183.220.247.851814991b_  -W! ossec13001g Exim Auth failed2025-03-21 09:24:48 dovecot_login authenticator failed for 80-15-81-3.ftth.fr.orangecustomers.net [80.15.81.3]:48758: 535 Incorrect authentication data (set_id=info)80.15.81.33017382m^  -g' ossec13001gExim Auth failed2025-03-21 09:25:00 dovecot_login authenticator failed for (thepsindustries.com) [111.207.12.99]:56970: 535 Incorrect authentication data (set_id=office@thepsindustries.com)111.207.12.991814991 $ 2Ws~  -u% ossec13001g(Exim Auth failed2025-03-21 11:54:40 dovecot_plain authenticator failed for ([113.192.1.27]) [113.192.1.26]:35009: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)113.192.1.261643084*}  3Y+ ossec11301gNew FTP connection.Mar 21 11:53:16 vm1 pure-ftpd[2025049]: (?@185.247.137.125) [INFO] New connection from 185.247.137.125185.247.137.125298795W|  -9) ossec13001g~Exim Auth failed2025-03-21 11:51:49 dovecot_plain authenticator failed for ([157.122.199.25]) [157.122.199.25]:33913: 535 Incorrect authentication data (set_id=sales)157.122.199.251814991a{  -S# ossec13001gdExim Auth failed2025-03-21 11:51:24 dovecot_plain authenticator failed for ([49.0.129.12]) [49.0.129.12]:46996: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)49.0.129.122029969Uz  -7) ossec13001gExim Auth failed2025-03-21 11:45:09 dovecot_login authenticator failed for ([94.207.113.133]) [94.207.113.133]:54575: 535 Incorrect authentication data (set_id=info)94.207.113.133290557qy  -k+ ossec13001gExim Auth failed2025-03-21 11:44:52 dovecot_login authenticator failed for ([176.118.213.147]) [176.118.213.147]:52722: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)176.118.213.1472017370"x  3M% ossec11301gNew FTP connection.Mar 21 11:32:22 vm1 pure-ftpd[2020158]: (?@20.171.27.13) [INFO] New connection from 20.171.27.1320.171.27.136252001w  Uc' ossec11001gXDeferred login on the cpanel service[2025-03-21 11:25:35 +0530] info [webmaild] 157.38.195.22 - kps@amplifypowerglobal.com "POST /cpsess2890686938/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [157.38.197.211] != Current IP Address [157.38.195.22]157.38.195.221269750kv  -i# ossec13001g,Exim Auth failed2025-03-21 11:24:51 dovecot_plain authenticator failed for ([5.31.16.135]) [5.31.16.135]:38308: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)5.31.16.135290557Tu  -5' ossec13001g\Exim Auth failed2025-03-21 11:21:23 dovecot_plain authenticator failed for ([165.90.98.163]) [165.90.98.163]:34185: 535 Incorrect authentication data (set_id=sales)165.90.98.1633374766ct  -W% ossec13001gNExim Auth failed2025-03-21 11:21:10 dovecot_plain authenticator failed for ([87.200.181.5]) [87.200.181.5]:41034: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)87.200.181.5290557s  - ' ossec13001gExim Auth failed2025-03-21 11:17:42 dovecot_login authenticator failed for wsip-174-79-91-142.br.br.cox.net [174.79.91.142]:53577: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)174.79.91.1426252001Vr  -7) ossec13001gVExim Auth failed2025-03-21 11:17:01 dovecot_login authenticator failed for ([202.108.14.226]) [202.108.14.226]:44080: 535 Incorrect authentication data (set_id=info)202.108.14.2261814991q  -' ossec13001g>Exim Auth failed2025-03-21 11:16:37 dovecot_login authenticator failed for (mobile-166-195-004-247.mycingular.net) [166.195.4.247]:47078: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)166.195.4.2476252001p  Ug) ossec11001gvDeferred login on the cpanel service[2025-03-21 11:13:16 +0530] info [webmaild] 157.38.197.211 - kps@amplifypowerglobal.com "POST /cpsess6393606790/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [157.38.233.166] != Current IP Address [157.38.197.211]157.38.197.2111269750Xo  -=' ossec13001gpExim Auth failed2025-03-21 10:47:34 dovecot_login authenticator failed for ([118.38.239.52]) [118.38.239.52]:38914: 535 Incorrect authentication data (set_id=admission)118.38.239.521835841 3 2 Z c %1H]`  -S# ossec13001g#Exim Auth failed2025-03-21 14:00:59 dovecot_login authenticator failed for ([5.32.107.98]) [5.32.107.98]:42552: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)5.32.107.98290557S  -5' ossec13001g#Exim Auth failed2025-03-21 14:01:08 dovecot_login authenticator failed for ([91.72.171.210]) [91.72.171.210]:49002: 535 Incorrect authentication data (set_id=sales)91.72.171.210290557g  -_% ossec13001g!Exim Auth failed2025-03-21 13:51:27 dovecot_login authenticator failed for ([194.28.91.40]) [194.28.91.40]:37974: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)194.28.91.40690791e  -W' ossec13001gdExim Auth failed2025-03-21 13:38:04 dovecot_login authenticator failed for p160093-obmd01.tokyo.ocn.ne.jp [153.141.53.93]:34313: 535 Incorrect authentication data (set_id=admission)153.141.53.931861060p  -m' ossec13001gHExim Auth failed2025-03-21 13:37:36 dovecot_login authenticator failed for ([67.55.189.215]) [67.55.189.215]:37718: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)67.55.189.2156252001T  -3) ossec13001gExim Auth failed2025-03-21 13:18:00 dovecot_login authenticator failed for ([125.16.12.73]) [128.185.253.90]:50686: 535 Incorrect authentication data (set_id=info)128.185.253.901269750n  -g) ossec13001gExim Auth failed2025-03-21 13:17:51 dovecot_login authenticator failed for ([46.138.247.195]) [46.138.247.195]:54118: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)46.138.247.1952017370s  -q) ossec13001gExim Auth failed2025-03-21 13:04:55 dovecot_login authenticator failed for ([193.234.119.22]) [193.234.119.22]:52838: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)193.234.119.222661886[  -A) ossec13001gExim Auth failed2025-03-21 13:05:15 dovecot_login authenticator failed for ([209.38.100.151]) [209.38.100.151]:60152: 535 Incorrect authentication data (set_id=admission)209.38.100.1512750405Q  -1% ossec13001gkExim Auth failed2025-03-21 12:42:43 dovecot_plain authenticator failed for ([98.70.127.17]) [98.70.127.17]:33900: 535 Incorrect authentication data (set_id=sales)98.70.127.171269750d  -W% ossec13001gKExim Auth failed2025-03-21 12:42:09 dovecot_plain authenticator failed for ([218.22.0.200]) [218.22.0.200]:58058: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)218.22.0.2001814991]  -C+ ossec13001g0Exim Auth failed2025-03-21 12:33:12 dovecot_plain authenticator failed for ([163.204.112.147]) [163.204.112.147]:48142: 535 Incorrect authentication data (set_id=services)163.204.112.1471814991s  -q) ossec13001gExim Auth failed2025-03-21 12:32:32 dovecot_plain authenticator failed for vps-9109ac84.vps.ovh.net [141.95.159.204]:34182: 535 Incorrect authentication data (set_id=services@heipowersystem.com)141.95.159.2043017382T  -3) ossec13001gExim Auth failed2025-03-21 12:28:13 dovecot_login authenticator failed for ([125.16.12.73]) [128.185.253.90]:39416: 535 Incorrect authentication data (set_id=info)128.185.253.901269750}  - % ossec13001g Exim Auth failed2025-03-21 12:27:33 dovecot_login authenticator failed for 48.211.41.34.bc.googleusercontent.com [34.41.211.48]:32846: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)34.41.211.486252001X  -=' ossec13001gExim Auth failed2025-03-21 12:05:54 dovecot_login authenticator failed for ([31.173.20.146]) [31.173.20.146]:59372: 535 Incorrect authentication data (set_id=admission)31.173.20.1462017370m  -i% ossec13001gExim Auth failed2025-03-21 12:05:26 dovecot_login authenticator failed for ([219.139.41.6]) [219.139.41.6]:51914: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)219.139.41.61814991 R/ 9 _ -FRp  -i+ ossec13001g-Exim Auth failed2025-03-21 14:44:15 dovecot_login authenticator failed for (203.173.209.139.adsl-pool.jlccptt.net.cn) [139.209.173.203]:60440: 535 Incorrect authentication data (set_id=info)139.209.173.2031814991c  -U% ossec13001g-Exim Auth failed2025-03-21 14:43:38 dovecot_login authenticator failed for ([2.110.10.192]) [2.110.10.192]:42478: 535 Incorrect authentication data (set_id=info@heipowersystem.com)2.110.10.1922623032c  -S' ossec13001g*Exim Auth failed2025-03-21 14:31:41 dovecot_plain authenticator failed for ([175.202.82.16]) [175.202.82.16]:43078: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)175.202.82.161835841k  -g# ossec13001g*Exim Auth failed2025-03-21 14:31:18 dovecot_plain authenticator failed for p85005-obmd01.osaka.ocn.ne.jp [180.7.156.4]:32822: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)180.7.156.41861060v  -y' ossec13001g*Exim Auth failed2025-03-21 14:30:49 dovecot_plain authenticator failed for ([43.139.182.85]) [43.139.182.85]:46322: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)43.139.182.851814991j  -_) ossec13001g*9Exim Auth failed2025-03-21 14:28:32 dovecot_plain authenticator failed for ([193.234.119.22]) [193.234.119.22]:60164: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)193.234.119.222661886e  -[# ossec13001g))Exim Auth failed2025-03-21 14:24:01 dovecot_login authenticator failed for ([59.96.62.29]) [59.96.62.29]:51928: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)59.96.62.291269750W  -7+ ossec13001g)?Exim Auth failed2025-03-21 14:24:23 dovecot_login authenticator failed for ([124.43.78.147]) [112.134.141.182]:32661: 535 Incorrect authentication data (set_id=info)112.134.141.1821227603u  -u) ossec13001g(;Exim Auth failed2025-03-21 14:20:01 dovecot_plain authenticator failed for ([120.157.12.107]) [120.157.12.107]:58040: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)120.157.12.1072077456k  -c' ossec13001g&Exim Auth failed2025-03-21 14:10:51 dovecot_login authenticator failed for syn-156-019-080-138.biz.spectrum.com [156.19.80.138]:54815: 535 Incorrect authentication data (set_id=admission)156.19.80.1386252001f  -[' ossec13001g&Exim Auth failed2025-03-21 14:10:50 dovecot_login authenticator failed for ([91.72.148.106]) [91.72.148.106]:44494: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)91.72.148.106290557}  - % ossec13001g&Exim Auth failed2025-03-21 14:10:37 dovecot_login authenticator failed for (95.105.76.13.dynamic.ufanet.ru) [95.105.76.13]:22693: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)95.105.76.132017370Y  -C# ossec13001g&2Exim Auth failed2025-03-21 14:11:22 dovecot_plain authenticator failed for ([112.94.6.54]) [112.94.6.54]:23490: 535 Incorrect authentication data (set_id=vikas.khandelwal)112.94.6.541814991V  -9) ossec13001g&&Exim Auth failed2025-03-21 14:11:09 dovecot_login authenticator failed for ([80.227.102.242]) [80.227.102.242]:56894: 535 Incorrect authentication data (set_id=sales)80.227.102.242290557r  -q' ossec13001g&Exim Auth failed2025-03-21 14:11:00 dovecot_plain authenticator failed for ([58.252.222.82]) [58.252.222.82]:34306: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)58.252.222.821814991_  -M% ossec13001g$jExim Auth failed2025-03-21 14:03:44 dovecot_login authenticator failed for (144.121.245.65.lightower.net) [64.72.74.162]:58002: 535 Incorrect authentication data (set_id=sales)64.72.74.1626252001j  -_) ossec13001g$XExim Auth failed2025-03-21 14:03:27 dovecot_login authenticator failed for ([222.128.80.201]) [222.128.80.201]:31044: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)222.128.80.2011814991 { $DCh|s0  -q) ossec13001g<Exim Auth failed2025-03-21 15:47:54 dovecot_login authenticator failed for ([36.110.161.134]) [36.110.161.134]:47924: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)36.110.161.1341814991Q/  -1% ossec13001g8Exim Auth failed2025-03-21 15:30:16 dovecot_login authenticator failed for ([109.244.68.3]) [109.244.68.3]:32350: 535 Incorrect authentication data (set_id=admin)109.244.68.31814991j.  -_) ossec13001g8Exim Auth failed2025-03-21 15:29:59 dovecot_login authenticator failed for ([14.231.218.134]) [14.231.218.134]:58706: 535 Incorrect authentication data (set_id=admin@heipowersystem.com)14.231.218.1341562822f-  -Y' ossec13001g7kExim Auth failed2025-03-21 15:24:49 dovecot_login authenticator failed for syn-072-177-091-103.res.spectrum.com [72.177.91.103]:52035: 535 Incorrect authentication data (set_id=info)72.177.91.1036252001h,  -_% ossec13001g7SExim Auth failed2025-03-21 15:24:25 dovecot_login authenticator failed for ([191.59.165.4]) [191.59.165.4]:42620: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)191.59.165.43469034W+  -9) ossec13001g3vExim Auth failed2025-03-21 15:07:56 dovecot_login authenticator failed for ([178.68.164.165]) [178.68.164.165]:53084: 535 Incorrect authentication data (set_id=sales)178.68.164.1652017370}*  -' ossec13001g3,Exim Auth failed2025-03-21 15:06:42 dovecot_login authenticator failed for (static.199.38.85.125.macminivault.com) [199.38.85.125]:65276: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)199.38.85.1256252001\)  -I# ossec13001g2Exim Auth failed2025-03-21 15:05:04 dovecot_plain authenticator failed for ([58.27.253.6]) [58.27.253.6]:5655: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)58.27.253.61168579T(  -5' ossec13001g2Exim Auth failed2025-03-21 15:04:52 dovecot_plain authenticator failed for ([103.84.101.30]) [103.84.101.30]:56527: 535 Incorrect authentication data (set_id=sales)103.84.101.301327865v'  -y' ossec13001g2Exim Auth failed2025-03-21 15:04:47 dovecot_plain authenticator failed for ([213.137.44.74]) [213.137.44.74]:37278: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)213.137.44.743175395j&  -_) ossec13001g2Exim Auth failed2025-03-21 15:04:30 dovecot_plain authenticator failed for ([103.180.240.96]) [103.180.240.96]:53472: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)103.180.240.961282988P%  -3# ossec13001g1Exim Auth failed2025-03-21 14:57:58 dovecot_plain authenticator failed for ([2.189.87.66]) [2.189.87.68]:38157: 535 Incorrect authentication data (set_id=services)2.189.87.68130758j$  -a' ossec13001g1Exim Auth failed2025-03-21 14:57:47 dovecot_plain authenticator failed for ([124.228.32.34]) [124.228.32.34]:37893: 535 Incorrect authentication data (set_id=services@heipowersystem.com)124.228.32.341814991r#  -q) ossec13001g/FExim Auth failed2025-03-21 14:50:05 dovecot_login authenticator failed for ([196.200.227.78]) [196.200.227.78]:38614: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)196.200.227.78149590["  -A) ossec13001g/VExim Auth failed2025-03-21 14:50:21 dovecot_login authenticator failed for ([122.163.118.64]) [122.163.118.64]:56298: 535 Incorrect authentication data (set_id=admission)122.163.118.641269750!  Ue) ossec11001g.<Deferred login on the cpanel service[2025-03-21 14:45:39 +0530] info [webmaild] 157.38.249.123 - kps@amplifypowerglobal.com "POST /cpsess8386767482/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [157.38.195.22] != Current IP Address [157.38.249.123]157.38.249.1231269750 :  C J _ rx %:gA  -[' ossec13001gHuExim Auth failed2025-03-21 16:37:32 dovecot_login authenticator failed for 111-70-22-153.emome-ip.hinet.net [111.70.22.153]:35704: 535 Incorrect authentication data (set_id=admission)111.70.22.1531668284p@  -m' ossec13001gHaExim Auth failed2025-03-21 16:37:11 dovecot_login authenticator failed for ([151.40.26.236]) [151.40.26.236]:38288: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)151.40.26.2363175395p?  -q# ossec13001gGMExim Auth failed2025-03-21 16:32:36 dovecot_plain authenticator failed for ([8.209.221.7]) [8.209.221.7]:52724: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)8.209.221.71861060S>  -5' ossec13001gEExim Auth failed2025-03-21 16:26:12 dovecot_plain authenticator failed for ([80.227.138.32]) [80.227.138.32]:52113: 535 Incorrect authentication data (set_id=sales)80.227.138.32290557m=  -c+ ossec13001gEExim Auth failed2025-03-21 16:26:02 dovecot_plain authenticator failed for ([163.179.105.235]) [163.179.105.235]:47710: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)163.179.105.2351814991d<  -W% ossec13001gEBExim Auth failed2025-03-21 16:23:54 dovecot_login authenticator failed for ([14.35.218.58]) [14.35.218.58]:37694: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)14.35.218.581835841T;  -7% ossec13001gEPExim Auth failed2025-03-21 16:24:08 dovecot_login authenticator failed for ([114.242.175.187]) [36.112.75.46]:52054: 535 Incorrect authentication data (set_id=sales)36.112.75.461814991p:  -k) ossec13001gEExim Auth failed2025-03-21 16:22:47 dovecot_login authenticator failed for p4693108-ipngnfx01marunouchi.tokyo.ocn.ne.jp [153.156.70.108]:40368: 535 Incorrect authentication data (set_id=info)153.156.70.1081861060k9  -c' ossec13001gDExim Auth failed2025-03-21 16:22:30 dovecot_login authenticator failed for ([31.41.228.179]) [31.41.228.179]:61907: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)31.41.228.1792017370v8  -y' ossec13001gDExim Auth failed2025-03-21 16:21:05 dovecot_plain authenticator failed for ([218.4.205.242]) [218.4.205.242]:36802: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)218.4.205.2421814991i7  -a% ossec13001gCExim Auth failed2025-03-21 16:17:42 dovecot_login authenticator failed for host81-143-51-58.in-addr.btopenworld.com [81.143.51.58]:47396: 535 Incorrect authentication data (set_id=sales)81.143.51.582635167g6  -[' ossec13001gCExim Auth failed2025-03-21 16:17:31 dovecot_login authenticator failed for ([103.177.204.4]) [103.177.204.4]:40545: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)103.177.204.41269750u5  -u) ossec13001gAMExim Auth failed2025-03-21 16:07:00 dovecot_plain authenticator failed for ([175.125.68.208]) [175.125.68.208]:41054: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)175.125.68.2081835841U4  -7) ossec13001g?Exim Auth failed2025-03-21 15:57:14 dovecot_login authenticator failed for ([94.203.210.111]) [94.203.210.111]:37960: 535 Incorrect authentication data (set_id=info)94.203.210.111290557j3  -_) ossec13001g>Exim Auth failed2025-03-21 15:56:36 dovecot_login authenticator failed for ([58.131.97.5]) [111.202.190.32]:3420: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)111.202.190.321814991l2  -e' ossec13001g>BExim Auth failed2025-03-21 15:54:02 dovecot_login authenticator failed for syn-097-089-202-226.biz.spectrum.com [97.89.202.226]:39406: 535 Incorrect authentication data (set_id=postmaster)97.89.202.22662520011  -' ossec13001g>Exim Auth failed2025-03-21 15:53:13 dovecot_login authenticator failed for (static.199.38.85.125.macminivault.com) [199.38.85.125]:49871: 535 Incorrect authentication data (set_id=postmaster@heipowersystem.com)199.38.85.1256252001 5 P u 4{R  -' ossec13001gVExim Auth failed2025-03-21 17:39:06 dovecot_login authenticator failed for net-130-0-149-238.cust.vodafonedsl.it [130.0.149.238]:51178: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)130.0.149.2383175395XQ  -;+ ossec13001gTExim Auth failed2025-03-21 17:29:17 dovecot_login authenticator failed for ([196.189.126.185]) [196.189.126.185]:58140: 535 Incorrect authentication data (set_id=info)196.189.126.185337996P  -% ossec13001gTExim Auth failed2025-03-21 17:29:05 dovecot_login authenticator failed for vps-79f20bfc.vps.ovh.net (ip193.ip-87-98-249.eu) [51.75.24.107]:51136: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)51.75.24.1073017382%O  3Q' ossec11301gTNew FTP connection.Mar 21 17:29:04 vm1 pure-ftpd[2096557]: (?@20.168.122.17) [INFO] New connection from 20.168.122.1720.168.122.176252001PN  -/% ossec13001gRDExim Auth failed2025-03-21 17:19:22 dovecot_login authenticator failed for ([8.243.166.66]) [8.243.166.66]:4501: 535 Incorrect authentication data (set_id=sales)8.243.166.663686110iM  -_) ossec13001gR1Exim Auth failed2025-03-21 17:19:04 dovecot_login authenticator failed for ([80.227.102.242]) [80.227.102.242]:34935: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)80.227.102.242290557L  - ' ossec13001gQgExim Auth failed2025-03-21 17:15:42 dovecot_login authenticator failed for (dynamic-ip-18150025078.cable.net.co) [181.50.250.78]:60058: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)181.50.250.783686110TK  -5' ossec13001gPExim Auth failed2025-03-21 17:12:13 dovecot_login authenticator failed for ([46.163.154.14]) [46.163.154.14]:38106: 535 Incorrect authentication data (set_id=sales)46.163.154.142017370~J  - % ossec13001gPExim Auth failed2025-03-21 17:11:54 dovecot_login authenticator failed for (static.ip.81.22.19.176.kalaam-telecom.com) [81.22.19.176]:58895: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)81.22.19.176290291WI  -9) ossec13001gKExim Auth failed2025-03-21 16:51:28 dovecot_login authenticator failed for ([14.139.107.146]) [14.139.107.146]:35156: 535 Incorrect authentication data (set_id=sales)14.139.107.1461269750nH  -k% ossec13001gKExim Auth failed2025-03-21 16:51:19 dovecot_login authenticator failed for (n54-c40.client.tomica.ru) [78.140.54.40]:45468: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)78.140.54.402017370dG  -Q+ ossec13001gJ/Exim Auth failed2025-03-21 16:44:54 dovecot_login authenticator failed for 229.sub-166-141-241.myvzw.com [166.141.241.229]:60350: 535 Incorrect authentication data (set_id=sales)166.141.241.2296252001jF  -_) ossec13001gJExim Auth failed2025-03-21 16:44:08 dovecot_login authenticator failed for ([202.117.92.118]) [202.117.92.118]:60012: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)202.117.92.1181814991WE  -9) ossec13001gIExim Auth failed2025-03-21 16:43:20 dovecot_plain authenticator failed for ([158.140.39.128]) [158.140.39.128]:55623: 535 Incorrect authentication data (set_id=sales)158.140.39.1286252001aD  -S# ossec13001gIExim Auth failed2025-03-21 16:42:51 dovecot_plain authenticator failed for ([112.94.6.54]) [112.94.6.54]:60750: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)112.94.6.541814991ZC  -?) ossec13001gHExim Auth failed2025-03-21 16:38:58 dovecot_plain authenticator failed for ([45.251.108.124]) [45.251.108.124]:64812: 535 Incorrect authentication data (set_id=services)45.251.108.1241819730iB  -a' ossec13001gHExim Auth failed2025-03-21 16:38:30 dovecot_plain authenticator failed for ([45.240.88.249]) [45.240.88.249]:36386: 535 Incorrect authentication data (set_id=services@heipowersystem.com)45.240.88.249357994 2= > L [  >:_hZc  -A) ossec13001g_iExim Auth failed2025-03-21 18:15:27 dovecot_login authenticator failed for ([196.200.227.78]) [196.200.227.78]:42896: 535 Incorrect authentication data (set_id=admission)196.200.227.78149590sb  -q) ossec13001g_GExim Auth failed2025-03-21 18:14:54 dovecot_login authenticator failed for ([193.234.119.22]) [193.234.119.22]:58416: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)193.234.119.222661886Wa  -=' ossec13001g_=Exim Auth failed2025-03-21 18:14:45 dovecot_login authenticator failed for ([94.207.17.213]) [94.207.17.213]:57282: 535 Incorrect authentication data (set_id=admission)94.207.17.213290557`  - ' ossec13001g_5Exim Auth failed2025-03-21 18:14:37 dovecot_login authenticator failed for b217-29-190-97.pppoe.mark-itt.net [217.29.190.97]:52526: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)217.29.190.972017370Z_  -=+ ossec13001g]tExim Auth failed2025-03-21 18:07:08 dovecot_plain authenticator failed for ([123.116.142.131]) [123.116.142.131]:48048: 535 Incorrect authentication data (set_id=sales)123.116.142.1311814991j^  -_) ossec13001g]\Exim Auth failed2025-03-21 18:06:43 dovecot_plain authenticator failed for ([183.167.196.62]) [183.167.196.62]:49540: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)183.167.196.621814991R]  -3' ossec13001g]NExim Auth failed2025-03-21 18:06:30 dovecot_login authenticator failed for ([91.73.195.150]) [91.73.195.150]:33370: 535 Incorrect authentication data (set_id=info)91.73.195.150290557e\  -Y% ossec13001g]<Exim Auth failed2025-03-21 18:06:11 dovecot_login authenticator failed for ([144.121.245.65]) [64.72.74.162]:48217: 535 Incorrect authentication data (set_id=info@heipowersystem.com)64.72.74.1626252001Y[  -;+ ossec13001g[Exim Auth failed2025-03-21 18:00:23 dovecot_login authenticator failed for ([193.234.119.254]) [193.234.119.254]:48206: 535 Incorrect authentication data (set_id=info)193.234.119.2542661886qZ  -k+ ossec13001g[Exim Auth failed2025-03-21 18:00:15 dovecot_login authenticator failed for ([119.145.189.139]) [119.145.189.139]:46691: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)119.145.189.1391814991dY  -W% ossec13001gYExim Auth failed2025-03-21 17:48:13 dovecot_plain authenticator failed for ([60.174.35.18]) [60.174.35.18]:44729: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)60.174.35.181814991TX  -7% ossec13001gXExim Auth failed2025-03-21 17:47:48 dovecot_plain authenticator failed for ([222.180.2.62]) [222.180.2.62]:60969: 535 Incorrect authentication data (set_id=services)222.180.2.621814991mW  -e) ossec13001gXExim Auth failed2025-03-21 17:47:29 dovecot_plain authenticator failed for ([201.173.238.25]) [201.173.238.25]:38166: 535 Incorrect authentication data (set_id=services@heipowersystem.com)201.173.238.253996063nV  -i' ossec13001gXExim Auth failed2025-03-21 17:46:50 dovecot_login authenticator failed for (186-201-10-10.customer.tdatabrasil.net.br) [186.201.10.10]:58873: 535 Incorrect authentication data (set_id=sales)186.201.10.103469034{U  -' ossec13001gXExim Auth failed2025-03-21 17:46:30 dovecot_login authenticator failed for (cust-72-26-178-196.wireless.t6b.com) [72.26.178.196]:40604: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)72.26.178.1966252001qT  -s% ossec13001gX1Exim Auth failed2025-03-21 17:44:39 dovecot_plain authenticator failed for (host-191.215.77.5.ucom.am) [5.77.215.191]:51144: 535 Incorrect authentication data (set_id=services@heipowersystem.com)5.77.215.191174982JS  -)! ossec13001gVExim Auth failed2025-03-21 17:39:25 dovecot_login authenticator failed for ([5.32.107.6]) [5.32.107.6]:37635: 535 Incorrect authentication data (set_id=sales)5.32.107.6290557    1 C Giuys  -' ossec13001g݂Exim Auth failed2025-03-21 20:43:21 dovecot_login authenticator failed for syn-074-218-095-154.biz.spectrum.com [74.218.95.154]:55635: 535 Incorrect authentication data (set_id=info@heipowersystem.com)74.218.95.1546252001Xr  -=' ossec13001gpExim Auth failed2025-03-21 19:26:47 dovecot_login authenticator failed for ([220.92.25.189]) [220.92.25.189]:58080: 535 Incorrect authentication data (set_id=admission)220.92.25.1891835841pq  -m' ossec13001goExim Auth failed2025-03-21 19:26:11 dovecot_login authenticator failed for ([112.98.177.66]) [112.98.177.66]:35251: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)112.98.177.661814991|p  -' ossec13001ggExim Auth failed2025-03-21 18:50:58 dovecot_login authenticator failed for p54a51fdc.dip0.t-ipconnect.de [84.165.31.220]:46416: 535 Incorrect authentication data (set_id=admission@saintsoldiercollege.com)84.165.31.2202921044Qo  -1% ossec13001ggExim Auth failed2025-03-21 18:50:38 dovecot_login authenticator failed for ([103.78.23.30]) [103.78.23.30]:40188: 535 Incorrect authentication data (set_id=admin)103.78.23.301269750n  -+ ossec13001ggExim Auth failed2025-03-21 18:50:10 dovecot_login authenticator failed for (159.14.132.112.adsl-pool.ah.cnuninet.net) [112.123.199.111]:37640: 535 Incorrect authentication data (set_id=admin@heipowersystem.com)112.123.199.1111814991Vm  -7) ossec13001gc@Exim Auth failed2025-03-21 18:31:51 dovecot_login authenticator failed for ([102.50.245.141]) [102.50.245.141]:54727: 535 Incorrect authentication data (set_id=info)102.50.245.1412542007pl  -o% ossec13001gc8Exim Auth failed2025-03-21 18:31:43 dovecot_login authenticator failed for vps-79f20bfc.vps.ovh.net [51.75.24.107]:10232: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)51.75.24.1073017382Zk  -?) ossec13001gcFExim Auth failed2025-03-21 18:31:56 dovecot_plain authenticator failed for ([193.234.119.60]) [193.234.119.60]:57138: 535 Incorrect authentication data (set_id=services)193.234.119.602661886xj  -}' ossec13001gc Exim Auth failed2025-03-21 18:31:19 dovecot_plain authenticator failed for 24-220-250-67-dynamic.midco.net [24.220.250.67]:50208: 535 Incorrect authentication data (set_id=services@heipowersystem.com)24.220.250.676252001ji  -_) ossec13001gbxExim Auth failed2025-03-21 18:28:31 dovecot_login authenticator failed for ([183.193.94.254]) [101.224.38.123]:35247: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)101.224.38.1231814991jh  -_) ossec13001gb^Exim Auth failed2025-03-21 18:28:04 dovecot_login authenticator failed for ([188.17.153.162]) [188.17.153.162]:34032: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)188.17.153.1622017370yg  -}) ossec13001ga!Exim Auth failed2025-03-21 18:22:49 dovecot_plain authenticator failed for ([46.138.247.195]) [46.138.247.195]:54352: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)46.138.247.1952017370Wf  -9) ossec13001gaExim Auth failed2025-03-21 18:22:16 dovecot_plain authenticator failed for ([119.195.87.140]) [119.195.87.140]:43204: 535 Incorrect authentication data (set_id=sales)119.195.87.1401835841ae  -S# ossec13001g`Exim Auth failed2025-03-21 18:22:04 dovecot_plain authenticator failed for ([101.58.1.77]) [101.58.1.77]:44960: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)101.58.1.773175395 d  W#+ ossec9708g_{Dovecot Aborted Login with empty userMar 21 18:15:46 vm1 dovecot[1250588]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=185.247.137.248, lip=103.74.54.108, TLS, session=185.247.137.248298795 4#A K f i 1zez4C  77 ossec502gݴOssec server started.ossec: Ossec started.g  -[' ossec13001gݳExim Auth failed2025-03-22 00:16:03 dovecot_login authenticator failed for ([89.175.253.49]) [89.175.253.49]:35854: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)89.175.253.4920173705  ; ossec9703gݳDovecot is Starting Up.Mar 22 00:15:39 vm1 dovecot[2180899]: master: Dovecot v2.3.21.1 (d492236fa0) starting up for lmtp, imap, pop3 (core dumps disabled)f  -U+ ossec13001gݫ7Exim Auth failed2025-03-21 23:38:55 dovecot_login authenticator failed for (rokamauka.com) [202.107.197.211]:53406: 535 Incorrect authentication data (set_id=service@rokamauka.com)202.107.197.2111814991V  -7) ossec13001gݫ Exim Auth failed2025-03-21 23:38:12 dovecot_login authenticator failed for (rokamauka.com) [124.160.63.122]:26782: 535 Incorrect authentication data (set_id=nologin)124.160.63.1221814991q  -q% ossec13001gݨ8Exim Auth failed2025-03-21 23:26:08 dovecot_plain authenticator failed for p5b2d5cb1.dip0.t-ipconnect.de [91.45.92.177]:34419: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)91.45.92.1772921044k  -a) ossec13001gݣExim Auth failed2025-03-21 23:08:01 dovecot_plain authenticator failed for nova-185-040-122-250.cpe.novanet.is [185.40.122.250]:51677: 535 Incorrect authentication data (set_id=services)185.40.122.2502629691m  -e) ossec13001gݣExim Auth failed2025-03-21 23:07:12 dovecot_plain authenticator failed for ([119.195.87.140]) [119.195.87.140]:33130: 535 Incorrect authentication data (set_id=services@heipowersystem.com)119.195.87.1401835841d~  -Y# ossec13001gݣExim Auth failed2025-03-21 23:06:59 dovecot_plain authenticator failed for ([94.251.8.83]) [94.251.8.83]:54664: 535 Incorrect authentication data (set_id=services@heipowersystem.com)94.251.8.832017370W}  E!+ ossec2501gݚUser authentication failure.Mar 21 22:29:40 vm1 sshd[2158626]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=195.211.191.199195.211.191.19927504053| a;+ ossec5710gݚAttempt to login using a non-existent userMar 21 22:29:38 vm1 sshd[2158626]: Invalid user zhuting from 195.211.191.199 port 52828195.211.191.1992750405W{  E!+ ossec2501gݙ~User authentication failure.Mar 21 22:23:18 vm1 sshd[2157346]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=195.211.191.199195.211.191.19927504053z a;+ ossec5710gݙ|Attempt to login using a non-existent userMar 21 22:23:15 vm1 sshd[2157346]: Invalid user zhuting from 195.211.191.199 port 58828195.211.191.1992750405"y  3M% ossec11301gݒ&New FTP connection.Mar 21 21:51:56 vm1 pure-ftpd[2151008]: (?@103.74.54.23) [INFO] New connection from 103.74.54.23103.74.54.231269750yx  -}) ossec13001gݒExim Auth failed2025-03-21 21:51:46 dovecot_plain authenticator failed for ([49.124.152.223]) [49.124.152.223]:58798: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)49.124.152.2231733045aw  -S# ossec13001gݐExim Auth failed2025-03-21 21:45:41 dovecot_plain authenticator failed for ([94.251.8.83]) [94.251.8.83]:35682: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)94.251.8.832017370rv  -m+ ossec13001gݏExim Auth failed2025-03-21 21:41:57 dovecot_login authenticator failed for (thepsindustries.com) [202.107.197.211]:56864: 535 Incorrect authentication data (set_id=service@thepsindustries.com)202.107.197.2111814991^u  -E+ ossec13001gݏExim Auth failed2025-03-21 21:41:29 dovecot_login authenticator failed for (thepsindustries.com) [202.107.197.211]:53330: 535 Incorrect authentication data (set_id=nologin)202.107.197.2111814991Yt  -;+ ossec13001g݂&Exim Auth failed2025-03-21 20:43:40 dovecot_login authenticator failed for ([220.189.239.206]) [220.189.239.206]:50466: 535 Incorrect authentication data (set_id=info)220.189.239.2061814991 B 2 W Z  \]|1Vhr  -q' ossec13001gPExim Auth failed2025-03-22 02:21:27 dovecot_plain authenticator failed for ([106.86.209.86]) [106.86.209.86]:39592: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)106.86.209.861814991, 3Y+ ossec11301gNew FTP connection.Mar 22 01:20:48 vm1 pure-ftpd[2197989]: (?@165.154.205.155) [INFO] New connection from 165.154.205.155165.154.205.1551880251W  -9) ossec13001gݾwExim Auth failed2025-03-22 01:01:02 dovecot_login authenticator failed for ([210.97.109.192]) [210.97.109.192]:50582: 535 Incorrect authentication data (set_id=sales)210.97.109.1921835841j  -_) ossec13001gݾkExim Auth failed2025-03-22 01:00:50 dovecot_login authenticator failed for ([60.175.146.138]) [60.175.146.138]:60461: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)60.175.146.1381814991W  E!+ ossec2501gݸUser authentication failure.Mar 22 00:37:41 vm1 sshd[2189303]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=195.211.191.176195.211.191.17627504054 a=+ ossec5710gݸAttempt to login using a non-existent userMar 22 00:37:38 vm1 sshd[2189303]: Invalid user caoxiang from 195.211.191.176 port 36156195.211.191.1762750405W  E!+ ossec2501gݷUser authentication failure.Mar 22 00:31:25 vm1 sshd[2188068]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=195.211.191.176195.211.191.17627504054 a=+ ossec5710gݷAttempt to login using a non-existent userMar 22 00:31:22 vm1 sshd[2188068]: Invalid user caoxiang from 195.211.191.176 port 53900195.211.191.1762750405]  -E) ossec13001gݷ=Exim Auth failed2025-03-22 00:30:13 dovecot_login authenticator failed for vps-9109ac84.vps.ovh.net [141.95.159.204]:47618: 535 Incorrect authentication data (set_id=sales)141.95.159.2043017382{  -+ ossec13001gݷ/Exim Auth failed2025-03-22 00:29:59 dovecot_login authenticator failed for (105.215.163.124.adsl-pool.sx.cn) [124.163.215.105]:56207: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)124.163.215.1051814991  W!) ossec9708gݷDovecot Aborted Login with empty userMar 22 00:29:29 vm1 dovecot[2184869]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 7 secs): user=<>, rip=87.236.176.192, lip=103.74.54.108, TLS, session=<1pWf2t4wQZlX7LDA>87.236.176.1922635167W  -;' ossec13001gݶExim Auth failed2025-03-22 00:28:21 dovecot_login authenticator failed for ([41.224.62.206]) [41.224.62.206]:35506: 535 Incorrect authentication data (set_id=services)41.224.62.2062464461y  -% ossec13001gݶExim Auth failed2025-03-22 00:28:06 dovecot_login authenticator failed for c-71-229-1-186.hsd1.al.comcast.net [71.229.1.186]:44718: 535 Incorrect authentication data (set_id=services@heipowersystem.com)71.229.1.1866252001W  E!+ ossec2501gݶUser authentication failure.Mar 22 00:25:17 vm1 sshd[2186806]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=195.211.191.176195.211.191.17627504054 a=+ ossec5710gݶAttempt to login using a non-existent userMar 22 00:25:15 vm1 sshd[2186806]: Invalid user caoxiang from 195.211.191.176 port 56280195.211.191.1762750405(  3U) ossec11301gݵINew FTP connection.Mar 22 00:21:52 vm1 pure-ftpd[2186192]: (?@165.232.53.152) [INFO] New connection from 165.232.53.152165.232.53.1526252001(  3U) ossec11301gݴNew FTP connection.Mar 22 00:19:18 vm1 pure-ftpd[2185251]: (?@74.207.240.208) [INFO] New connection from 74.207.240.20874.207.240.2086252001:  Ak) ossec11302gݴFTP Authentication failed.Mar 22 00:19:24 vm1 pure-ftpd[2185251]: (?@74.207.240.208) [WARNING] Authentication failed for user [anonymous]74.207.240.2086252001 + , `!+r)  -q' ossec13001g#Exim Auth failed2025-03-22 08:13:37 dovecot_plain authenticator failed for (089-101-036159.ntlworld.ie) [89.101.36.159]:47113: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)89.101.36.1592963597X(  -A% ossec13001g#Exim Auth failed2025-03-22 08:13:57 dovecot_plain authenticator failed for vps-eed33ea4.vps.ovh.net [51.38.133.48]:50666: 535 Incorrect authentication data (set_id=sales)51.38.133.48798544j'  -_) ossec13001gExim Auth failed2025-03-22 06:18:15 dovecot_login authenticator failed for ([191.59.173.129]) [191.59.173.129]:59726: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)191.59.173.1293469034j&  -a' ossec13001gbExim Auth failed2025-03-22 06:16:26 dovecot_login authenticator failed for syn-172-090-128-097.res.spectrum.com [172.90.128.97]:52477: 535 Incorrect authentication data (set_id=services)172.90.128.976252001|%  -) ossec13001gXExim Auth failed2025-03-22 06:16:15 dovecot_login authenticator failed for (189.218.168.30-clientes-izzi.mx) [189.218.168.30]:41752: 535 Incorrect authentication data (set_id=services@heipowersystem.com)189.218.168.303996063$  - % ossec13001gExim Auth failed2025-03-22 05:17:52 dovecot_login authenticator failed for host81-143-51-58.in-addr.btopenworld.com [81.143.51.58]:53089: 535 Incorrect authentication data (set_id=services@heipowersystem.com)81.143.51.582635167T#  -7% ossec13001gExim Auth failed2025-03-22 05:18:09 dovecot_login authenticator failed for ([102.53.15.54]) [102.53.15.54]:37658: 535 Incorrect authentication data (set_id=services)102.53.15.542542007("  3U) ossec11301gNew FTP connection.Mar 22 05:13:52 vm1 pure-ftpd[2246832]: (?@42.200.108.110) [INFO] New connection from 42.200.108.11042.200.108.1101819730"!  3M% ossec11301gNew FTP connection.Mar 22 04:53:10 vm1 pure-ftpd[2242467]: (?@45.151.62.96) [INFO] New connection from 45.151.62.9645.151.62.962017370W  -9) ossec13001gExim Auth failed2025-03-22 04:39:04 dovecot_plain authenticator failed for ([175.156.90.182]) [175.156.90.182]:35064: 535 Incorrect authentication data (set_id=sales)175.156.90.1821880251m  -c+ ossec13001gExim Auth failed2025-03-22 04:38:49 dovecot_plain authenticator failed for ([167.250.119.253]) [167.250.119.253]:39435: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)167.250.119.2533865483f  -[% ossec13001g9Exim Auth failed2025-03-22 04:20:33 dovecot_plain authenticator failed for ([27.18.224.32]) [27.18.224.32]:3122: 535 Incorrect authentication data (set_id=services@heipowersystem.com)27.18.224.321814991m  -g' ossec13001gvExim Auth failed2025-03-22 03:34:37 dovecot_login authenticator failed for (gurukuljaipur.com) [111.56.54.202]:44772: 535 Incorrect authentication data (set_id=postmaster@gurukuljaipur.com)111.56.54.2021814991X  -=' ossec13001gXExim Auth failed2025-03-22 03:34:07 dovecot_login authenticator failed for (gurukuljaipur.com) [111.56.54.202]:41298: 535 Incorrect authentication data (set_id=nologin)111.56.54.2021814991  3I# ossec11301g/New FTP connection.Mar 22 03:07:49 vm1 pure-ftpd[2220141]: (?@8.216.67.37) [INFO] New connection from 8.216.67.378.216.67.371861060p  -q# ossec13001gExim Auth failed2025-03-22 03:06:15 dovecot_plain authenticator failed for ([62.148.6.46]) [62.148.6.46]:34538: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)62.148.6.462017370\  -G% ossec13001g`Exim Auth failed2025-03-22 02:21:43 dovecot_plain authenticator failed for ([60.172.53.82]) [60.172.53.82]:51601: 535 Incorrect authentication data (set_id=vikas.khandelwal)60.172.53.821814991 w  @ D i xG>B#w(=  3U) ossec11301gޤNew FTP connection.Mar 22 17:20:48 vm1 pure-ftpd[2397780]: (?@209.38.244.145) [INFO] New connection from 209.38.244.145209.38.244.1452921044(<  3U) ossec11301gޤNew FTP connection.Mar 22 17:20:48 vm1 pure-ftpd[2397782]: (?@209.38.210.131) [INFO] New connection from 209.38.210.131209.38.210.1312921044B;  gU) ossec11307gޗMultiple connection attempts from same sourceMar 22 16:27:27 vm1 pure-ftpd[2386641]: (?@167.172.183.81) [INFO] New connection from 167.172.183.81167.172.183.812921044): 3U) ossec11301gޗ New FTP connection.Mar 22 16:27:23 vm1 pure-ftpd[2386624]: (?@167.172.183.81) [INFO] New connection from 167.172.183.81167.172.183.812921044)9  EK% ossec5715gށSSHD authentication success.Mar 22 14:54:27 vm1 sshd[2367477]: Accepted password for root from 103.190.54.7 port 57182 ssh2103.190.54.712697508  3I# ossec11301gށNew FTP connection.Mar 22 14:53:42 vm1 pure-ftpd[2367348]: (?@20.65.194.6) [INFO] New connection from 20.65.194.620.65.194.66252001(7  3U) ossec11301gr8New FTP connection.Mar 22 13:47:59 vm1 pure-ftpd[2353811]: (?@104.248.44.218) [INFO] New connection from 104.248.44.218104.248.44.2182921044)6  EK% ossec5715gmSSHD authentication success.Mar 22 13:29:17 vm1 sshd[2350186]: Accepted password for root from 103.190.54.7 port 57136 ssh2103.190.54.71269750+5  3Y+ ossec11301gjhNew FTP connection.Mar 22 13:14:40 vm1 pure-ftpd[2347204]: (?@172.212.102.240) [INFO] New connection from 172.212.102.240172.212.102.2406252001)4  EK% ossec5715ghSSHD authentication success.Mar 22 13:06:39 vm1 sshd[2345524]: Accepted password for root from 103.190.54.7 port 57031 ssh2103.190.54.71269750(3  3U) ossec11301gTNew FTP connection.Mar 22 11:39:23 vm1 pure-ftpd[2327520]: (?@167.94.145.106) [INFO] New connection from 167.94.145.106167.94.145.1066252001)2  EK% ossec5715gL;SSHD authentication success.Mar 22 11:05:53 vm1 sshd[2320579]: Accepted password for root from 103.190.54.7 port 56816 ssh2103.190.54.71269750T1  -5' ossec13001g;_Exim Auth failed2025-03-22 09:53:57 dovecot_plain authenticator failed for ([64.52.161.161]) [64.52.161.161]:55318: 535 Incorrect authentication data (set_id=sales)64.52.161.1616252001m0  -c+ ossec13001g;9Exim Auth failed2025-03-22 09:53:20 dovecot_plain authenticator failed for ([221.149.233.245]) [221.149.233.245]:33442: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)221.149.233.2451835841W/  -;' ossec13001g8Exim Auth failed2025-03-22 09:43:36 dovecot_login authenticator failed for ([68.183.85.183]) [68.183.85.183]:50094: 535 Incorrect authentication data (set_id=services)68.183.85.1831269750x.  -{) ossec13001g8Exim Auth failed2025-03-22 09:42:42 dovecot_login authenticator failed for (ipoe-static.mosoblast.rt.ru) [89.109.233.181]:54795: 535 Incorrect authentication data (set_id=services@heipowersystem.com)89.109.233.1812017370Z-  -?) ossec13001g6Exim Auth failed2025-03-22 09:35:08 dovecot_plain authenticator failed for ([183.101.143.82]) [183.101.143.82]:36218: 535 Incorrect authentication data (set_id=services)183.101.143.821835841j,  -a' ossec13001g6Exim Auth failed2025-03-22 09:34:56 dovecot_plain authenticator failed for ([213.137.44.74]) [213.137.44.74]:39818: 535 Incorrect authentication data (set_id=services@heipowersystem.com)213.137.44.743175395c+  -U% ossec13001g%mExim Auth failed2025-03-22 08:20:21 dovecot_plain authenticator failed for ws215-79.maryno.net [81.88.215.79]:38861: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)81.88.215.792017370 *  -) ossec13001g%]Exim Auth failed2025-03-22 08:20:05 dovecot_plain authenticator failed for 198-91-188-226.cpe.distributel.net [198.91.188.226]:45654: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)198.91.188.2266251999 ldI.qV; dJ0{aG,oToT9 9 | a F +  n S 9   | a F +  n S 8   } b G , VVBLACK+BLACKFZBLACKPBLACKz~BLACKGRAY|BLACK yBLACKNBLACK*BLACKw;BLACKSzaQBLACKHBLACKoBLACKӰBLACK.BLACK!BUBLACKE!>gBLACKFՖYBLACKBLACKo]BLACKnBLACKmBLACKfBLACKGMBLACKtMBLACKMpBLACK)6BLACKٺGRAY[ GRAYGRAYՈQBLACKònBLACKBLACK]fjBLACK'HBLACK' BLACK'BLACKٶ}BLACKٚPSBLACKَBLACKFBLACK&BLACKbν]BLACK]BLACK?WBLACKT>BLACKwBLACKs1BLACKK1BLACK3ònGRAY9BLACKcBLACKFQtBLACK FQgBLACK)BLACK)νBLACK)bBLACK)HBLACK()BLACK) BLACKBLACK$c$=BLACKvc#^BLACKc EBLACKcBLACK_BLACK_ BLACKՀBLACKBLACK>BLACKgBLACKDGRAY1+zBLACK%BLACK A(BLACK&BLACK*BLACK BLACKBLACK}:BLACKhBLACKBLACKNJ{BLACKjBLACKdBLACKBLACKBLACK@ZBLACK'BLACK'ڊBLACK'mBLACKV}BLACK~sBLACKBLACK\uBLACK+_BLACKFB6BLACKB6BLACK#:6BLACKcEܗBLACKu;lGRAY=;lFGRAYj:cGRAYm:cGRAY9zBLACKp>BLACKEBLACK [W @ - %|6['R  3U) ossec11301gNew FTP connection.Mar 24 07:30:36 vm1 pure-ftpd[2868669]: (?@185.247.137.63) [INFO] New connection from 185.247.137.63185.247.137.63298795"Q  3M% ossec11301gUNew FTP connection.Mar 24 00:09:58 vm1 pure-ftpd[2777129]: (?@94.102.56.99) [INFO] New connection from 94.102.56.9994.102.56.992750405P  ?1 ossec1008gTtProcess exiting (killed).Mar 24 00:05:30 vm1 spamd[2482197]: spamd: server killed by SIGTERM, shutting down"O  3M% ossec11301gQNew FTP connection.Mar 23 23:53:55 vm1 pure-ftpd[2772690]: (?@117.99.58.64) [INFO] New connection from 117.99.58.64117.99.58.6412697502N  A_% ossec11302gQFTP Authentication failed.Mar 23 23:54:01 vm1 pure-ftpd[2772690]: (?@117.99.58.64) [WARNING] Authentication failed for user [login]117.99.58.641269750M  W!) ossec9708gDovecot Aborted Login with empty userMar 23 15:53:21 vm1 dovecot[2184869]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=87.236.176.173, lip=103.74.54.108, TLS, session=87.236.176.1732635167pL  -q' ossec13001gԨExim Auth failed2025-03-23 15:00:16 dovecot_login authenticator failed for ([65.20.193.144]) [65.20.193.144]:33794: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)65.20.193.14499237dK  -W% ossec13001gߵExim Auth failed2025-03-23 12:48:15 dovecot_plain authenticator failed for ([14.43.137.90]) [14.43.137.90]:40192: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)14.43.137.901835841gJ  -[' ossec13001gߨExim Auth failed2025-03-23 11:53:53 dovecot_plain authenticator failed for ([61.184.119.61]) [61.184.119.61]:49200: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)61.184.119.611814991%I  3Q' ossec11301gߩNew FTP connection.Mar 23 11:54:00 vm1 pure-ftpd[2626145]: (?@20.171.26.150) [INFO] New connection from 20.171.26.15020.171.26.1506252001H  3E! ossec11301gߥNew FTP connection.Mar 23 11:40:28 vm1 pure-ftpd[2623659]: (?@8.211.52.6) [INFO] New connection from 8.211.52.68.211.52.629210448G  Ai' ossec11302g\FTP Authentication failed.Mar 23 06:25:28 vm1 pure-ftpd[2560161]: (?@91.196.152.32) [WARNING] Authentication failed for user [anonymous]91.196.152.323017382(F  3U) ossec11301g[New FTP connection.Mar 23 06:25:23 vm1 pure-ftpd[2560159]: (?@91.196.152.127) [INFO] New connection from 91.196.152.12791.196.152.1273017382%E  3Q' ossec11301g[New FTP connection.Mar 23 06:25:23 vm1 pure-ftpd[2560161]: (?@91.196.152.32) [INFO] New connection from 91.196.152.3291.196.152.323017382 D  W#+ ossec9708gMDovecot Aborted Login with empty userMar 23 05:21:42 vm1 dovecot[2184869]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=185.247.137.170, lip=103.74.54.108, TLS, session=185.247.137.170298795CC  77 ossec502gEOssec server started.ossec: Ossec started.B  ?1 ossec1008gProcess exiting (killed).Mar 23 00:05:58 vm1 spamd[2185795]: spamd: server killed by SIGTERM, shutting downA  W!) ossec9708goDovecot Aborted Login with empty userMar 22 22:25:10 vm1 dovecot[2184869]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=118.193.57.218, lip=103.74.54.108, TLS, session=118.193.57.2181605651:@  Ak) ossec11302gFTP Authentication failed.Mar 22 21:47:30 vm1 pure-ftpd[2452903]: (?@195.184.76.241) [WARNING] Authentication failed for user [anonymous]195.184.76.2416252001(?  3U) ossec11301gNew FTP connection.Mar 22 21:47:24 vm1 pure-ftpd[2452903]: (?@195.184.76.241) [INFO] New connection from 195.184.76.241195.184.76.2416252001%>  3Q' ossec11301gNew FTP connection.Mar 22 21:47:24 vm1 pure-ftpd[2452901]: (?@195.184.76.36) [INFO] New connection from 195.184.76.36195.184.76.366252001  c_X|v s QOIF97 r l e H)52.169.209.144BLACKgg{Blacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests29635974ѐlocal~G%13.68.118.80BLACKggoBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests6252001 DvPlocal~F%13.68.116.66BLACKggdBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests6252001 DtBlocalE+172.177.131.186BLACKgrgCBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests6252001localD)172.93.102.106BLACKg_Fg0FBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests6252001]fjlocalC'20.14.160.237BLACKg^g/Blacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests6252001local~B%74.235.1.185BLACKgQig"iBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests6252001JlocalA)74.235.238.205BLACKg*gBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests6252001Jlocal@'13.79.101.137BLACKggBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests2963597 Oelocal~?%13.79.246.74BLACKggϴBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests2963597 OJlocal~>%20.7.172.247BLACKggBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests6252001local='52.169.55.117BLACKgOgOBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests296359747ulocal<'170.39.218.72BLACKg.gx.Blacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests6251999'Hlocal5)128.24.110.220BLACKgn}g?}Blacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests6252001nlocal~4%13.77.98.167BLACKg^wg/wBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests6252001 Mblocal3'52.147.173.60BLACKg^g/Blacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests62520014<local2'52.167.122.34BLACKgVg'Blacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests62520014z"local}1#52.177.15.3BLACKg-gBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests62520014local};#40.84.7.184BLACKgg}Blacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests6252001(Tlocal:'13.74.148.126BLACKgvgGBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests2963597 J~local~9%13.74.96.186BLACKgI6g6Blacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests2963597 J`local8)43.135.186.236BLACKg.gBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests6252001+local7'52.169.81.106BLACKggBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests29635974Qjlocal6)52.138.176.121BLACKggBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests29635974ylocal 9#waVlK@5* zodYNC8-"  } r g 1 < \ Q    b W L A 6 +   { p e Z O 9 . #   u j _ T I (   x m b W A 6 L +   m{peZD .#9   x D~sh >]RG<1&vk`U4?J) yncXMB7,! |qf[PE:/$  u j_TI &3>(O  G  3 BLACK BLACKO BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK  BLACK 3 BLACK BLACK  BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK  BLACK BLACK D BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK x BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK~ BLACK} BLACK BLACKz BLACKr BLACKy & BLACKx BLACKf BLACKe BLACKd BLACKc BLACK BLACK^ BLACKb BLACKM BLACKL G BLACKF BLACKI BLACKK BLACKJ BLACK0 BLACK* BLACK) BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACKo BLACKT BLACKR BLACKH BLACKD BLACKE BLACK BLACKF {|qf[P:/$ti^SH=2' w l a V K @ 5 *   z o d Y N C 8 - "   } r g \ Q F ; 0 %    u j _ T I > 3 (    = 2 '   wlaVK@5* E{pe z p f \ R HPZE;&0{ee GRAY$ GRAY GRAY% GRAY GRAY GRAY GRAY GRAY GRAY GRAY GRAY GRAY GRAY GRAY GRAY GRAY GRAY GRAY GRAY GRAY GRAY GRAY GRAY BLACK BLACK BLACK BLACK BLACK GRAY BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK GRAY GRAY GRAY GRAY GRAY GRAYm GRAYj GRAY= GRAY9 GRAY1 GRAY+ GRAYGRAY9GRAYGRAY BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK~ BLACK} BLACK| BLACK{ BLACKz BLACKy BLACKx BLACKw BLACKv BLACKu BLACKt BLACKs BLACKr BLACKq BLACKp BLACKo BLACKn BLACKm BLACKl BLACKk BLACKj BLACKi BLACKh BLACKg BLACKf BLACKe BLACKd BLACKc BLACKb BLACKa BLACK` BLACK_ BLACK^ BLACK] BLACK\ BLACK[ BLACKZ BLACKY BLACKX BLACKW BLACKV BLACKU BLACKT BLACKS BLACKR BLACKN BLACKG BLACKF BLACKE BLACKD BLACKC BLACKB BLACK> BLACK= BLACK< BLACK; BLACK: BLACK5 BLACK4 BLACK3 BLACK2 BLACK1 BLACK0 BLACK/ BLACK. BLACK- BLACK BLACK+ BLACK* BLACK) BLACK( BLACK' BLACK& BLACK% BLACK$ BLACK# BLACK BLACK! BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK BLACK 9  l  q Nj_3B6(b  3U) ossec11301g#New FTP connection.Mar 24 14:50:52 vm1 pure-ftpd[2961560]: (?@172.212.103.91) [INFO] New connection from 172.212.103.91172.212.103.916252001a  Ug) ossec11001g#[Deferred login on the cpanel service[2025-03-24 14:48:17 +0530] info [webmaild] 157.38.203.142 - kps@amplifypowerglobal.com "POST /cpsess9455903548/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [157.38.195.134] != Current IP Address [157.38.203.142]157.38.203.1421269750`  Ug) ossec11001gDeferred login on the cpanel service[2025-03-24 14:24:42 +0530] info [webmaild] 157.38.195.134 - kps@amplifypowerglobal.com "POST /cpsess6886746689/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [157.38.214.169] != Current IP Address [157.38.195.134]157.38.195.1341269750m_  -e) ossec13001gExim Auth failed2025-03-24 14:17:03 dovecot_plain authenticator failed for ([60.171.137.226]) [60.171.137.226]:32822: 535 Incorrect authentication data (set_id=services@heipowersystem.com)60.171.137.2261814991^  Ug) ossec11001gDeferred login on the cpanel service[2025-03-24 14:16:09 +0530] info [webmaild] 157.38.214.169 - kps@amplifypowerglobal.com "POST /cpsess1076486088/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [157.38.203.173] != Current IP Address [157.38.214.169]157.38.214.1691269750"]  3M% ossec11301gNew FTP connection.Mar 24 12:51:37 vm1 pure-ftpd[2936224]: (?@103.203.59.5) [INFO] New connection from 103.203.59.5103.203.59.51814991\  -) ossec13001gExim Auth failed2025-03-24 12:20:53 dovecot_plain authenticator failed for (200-168-190-25.customer.tdatabrasil.net.br) [189.56.178.158]:56549: 535 Incorrect authentication data (set_id=services@heipowersystem.com)189.56.178.1583469034`[  -Q# ossec13001gExim Auth failed2025-03-24 12:21:16 dovecot_plain authenticator failed for 111-70-9-41.emome-ip.hinet.net [111.70.9.41]:34126: 535 Incorrect authentication data (set_id=services)111.70.9.411668284Z  W!) ossec9708gDovecot Aborted Login with empty userMar 24 11:42:50 vm1 dovecot[2184869]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=87.236.176.151, lip=103.74.54.108, TLS, session=<4sBxfhAxCcJX7LCX>87.236.176.1512635167"Y  3M% ossec11301gNew FTP connection.Mar 24 11:21:20 vm1 pure-ftpd[2917372]: (?@4.246.230.82) [INFO] New connection from 4.246.230.824.246.230.826252001+X  3Y+ ossec11301gDNew FTP connection.Mar 24 10:36:10 vm1 pure-ftpd[2907962]: (?@162.142.125.123) [INFO] New connection from 162.142.125.123162.142.125.1236252001"W  3M% ossec11301gmNew FTP connection.Mar 24 10:24:03 vm1 pure-ftpd[2905000]: (?@139.162.77.6) [INFO] New connection from 139.162.77.6139.162.77.61861060(V  3U) ossec11301gNew FTP connection.Mar 24 09:35:46 vm1 pure-ftpd[2894301]: (?@198.235.24.116) [INFO] New connection from 198.235.24.116198.235.24.1166252001U  W' ossec9708gDovecot Aborted Login with empty userMar 24 08:56:24 vm1 dovecot[2184869]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=45.156.129.68, lip=103.74.54.108, TLS, session=45.156.129.682264397"T  3M% ossec11301g͉New FTP connection.Mar 24 08:42:08 vm1 pure-ftpd[2883226]: (?@103.74.54.23) [INFO] New connection from 103.74.54.23103.74.54.231269750S  W' ossec9708guDovecot Aborted Login with empty userMar 24 08:03:23 vm1 dovecot[2184869]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=45.249.246.17, lip=103.74.54.108, TLS, session=45.249.246.171819730 X # E !0XTs  -7% ossec13001gGxExim Auth failed2025-03-24 17:22:23 dovecot_login authenticator failed for ([218.22.0.200]) [218.22.0.200]:32848: 535 Incorrect authentication data (set_id=services)218.22.0.2001814991mr  -e) ossec13001gGdExim Auth failed2025-03-24 17:22:03 dovecot_login authenticator failed for ([110.49.145.233]) [110.49.145.233]:44816: 535 Incorrect authentication data (set_id=services@heipowersystem.com)110.49.145.2331605651bq  -O) ossec13001gA Exim Auth failed2025-03-24 16:54:57 dovecot_login authenticator failed for p92062-obmd01.tokyo.ocn.ne.jp [124.101.248.62]:51916: 535 Incorrect authentication data (set_id=sales)124.101.248.621861060vp  -y' ossec13001g@Exim Auth failed2025-03-24 16:54:33 dovecot_login authenticator failed for 89-233-245-84.cust.bredband2.com [89.233.245.84]:45470: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)89.233.245.842661886yo  -) ossec13001g?Exim Auth failed2025-03-24 16:49:51 dovecot_plain authenticator failed for ip4-193-93-156-147.blue-net.com.pl ([193.93.156.149]) [193.93.156.147]:33426: 535 Incorrect authentication data (set_id=sales)193.93.156.147798544jn  -_) ossec13001g?Exim Auth failed2025-03-24 16:49:40 dovecot_plain authenticator failed for ([60.171.237.143]) [60.171.237.143]:49956: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)60.171.237.1431814991pm  -i+ ossec13001g;{Exim Auth failed2025-03-24 16:31:14 dovecot_plain authenticator failed for ([221.162.190.163]) [221.162.190.163]:37048: 535 Incorrect authentication data (set_id=services@heipowersystem.com)221.162.190.1631835841Zl  -=+ ossec13001g:{Exim Auth failed2025-03-24 16:26:58 dovecot_plain authenticator failed for ([193.234.119.149]) [193.234.119.149]:48580: 535 Incorrect authentication data (set_id=sales)193.234.119.1492661886gk  -[' ossec13001g:sExim Auth failed2025-03-24 16:26:49 dovecot_plain authenticator failed for ([197.211.47.66]) [197.211.47.66]:38278: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)197.211.47.662328926rj  -q' ossec13001g4Exim Auth failed2025-03-24 16:01:31 dovecot_plain authenticator failed for 60-249-207-53.hinet-ip.hinet.net [60.249.207.53]:37144: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)60.249.207.531668284vi  -y' ossec13001g4qExim Auth failed2025-03-24 16:01:13 dovecot_plain authenticator failed for ([120.78.172.20]) [120.78.172.20]:58288: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)120.78.172.201814991(h  3U) ossec11301g4New FTP connection.Mar 24 15:59:50 vm1 pure-ftpd[2976369]: (?@104.152.52.133) [INFO] New connection from 104.152.52.133104.152.52.1336252001(g  3U) ossec11301g45New FTP connection.Mar 24 16:00:12 vm1 pure-ftpd[2976679]: (?@104.152.52.225) [INFO] New connection from 104.152.52.225104.152.52.2256252001.f  =W) ossec13008g*Mail Reciepient rejected2025-03-24 15:18:54 H=(mail.msnews24.in) [165.154.210.52]:54511 F= rejected RCPT : Rejected relay attempt: '165.154.210.52' From: 'mymhnme@msnews24.in' To: 'extradomcom@fastmail.com'165.154.210.521694008fe  -W) ossec13001g* Exim Auth failed2025-03-24 15:16:50 dovecot_plain authenticator failed for ([193.234.119.36]) [193.234.119.36]:49994: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)193.234.119.362661886vd  -y' ossec13001g)Exim Auth failed2025-03-24 15:16:13 dovecot_plain authenticator failed for ([27.40.100.228]) [27.40.100.228]:53203: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)27.40.100.2281814991uc  -u) ossec13001g%Exim Auth failed2025-03-24 14:59:15 dovecot_login authenticator failed for ([120.157.12.107]) [120.157.12.107]:47852: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)120.157.12.1072077456 *\~tj`VLB8.$zpf\H>4*   v l b X N D : 0 &    ~ t j ` V L B 8 . $    z p f \ R H > 4 *   vlbXND:0&|r^hTJ@6,"xndZPF<2( ~tj`VLB8.$zpf\ | r h ^ T J @ 6 , "    x n d Z P F < 2 (   RRH>4*  vlbXND:0& gd0 gc0 gX0 gV]0 gV=0 gU 0 gQp0 gQd0 gMH0 gM<0 gF0 gA 0 g@0 g@0 g@0 g80 g40 g$0 g;0 g0 g90 g0 g0 g=0 gs0 gc0 gV0 gH0 g0 g0 g0 g0 g0 g0 g0 g0 g]0 gA0 g0 g0 g0 gx0 gD0 gB0 gB0 gR0 g<0 g0 g]0 gi0 gi0 gi0 g0 g0 g0 g0 g|0 gl0 g\0 g0 g0 g0 g"0 g:0 g0 gϲ0 g0 gȒ0 gX0 g0 g0 gỡ0 gị0 g0 g0 g0 g%0 gᮩ0 g᮳0 gᦼ0 go0 g0 g᠉0 g{0 gᏽ0 gc0 gW0 g 0 g0 g0 g0 gtE0 gr0 gr0 gr0 gn0 gn0 gi0 gi0 gi0 ge%0 ge 0 gcK0 ga>0 g_0 g_0 g_0 g^80 g\ 0 gVj0 gV:0~ gV60} gV40| gV20{ gU0z gU0y gRm0x gRe0w gQ0v gH0u gH0t gGx0s gGd0r gA 0q g@0p g?0o g?0n g;{0m g:{0l g:s0k g40j g4q0i g450g g40h g*0f g* 0e g)0d g%0c g#0b g#[0a g0` g0_ g0^ g0] g0[ g0\ g0Z g0Y gD0X gm0W g0V g0U g͉0T gu0S g0R gU0Q gTt0P gQ0N gQ0O g0M gԨ0L gߵ0K gߩ0I gߨ0J gߥ0H g\0G g[0F g[0E gM0D gE0C g1 g1 gi1 g{1 gvz1 gh1 ggq1 gU1 gG1 g$b1 g$1 g#1 g#1 g#1 g#^1 g#1 g"1 g"1 g"1 g"1 g"i1 g"11 g1 g1 g 0 g 0 g0 gg0 g00 g0 g$0 g0 gL0 gH0 g0 gP0 g☢0 g0 gvt0 gu 0 gt20 gt00 gf0 g0B go0A g0@ g0? g0> gޤ0= gޤ0< gޗ0; gޗ0: gށ09 gށ08 gr807 gm06 gjh05 gh04 gT03 gL;02 g;_01 g;900 g80/ g80. g60- g60, g%m0+ g%]0* g#0( g#0) g0' gb0& gX0% g0# g0$ g0" g0! g0 g0 g90 gv0 gX0 g/0 g0 g`0 g1 gP0 g0 gݾw0 gݾk0 gݸ0 gݸ0 gݷ0 gݷ0 gݷ=0 gݷ/0 gݷ0 gݶ0 gݶ0 gݶ0 gݶ0 gݵI0 gݴ0 gݴ0 gݴ0 gݳ0 gݳ0 gݫ70 gݫ 0 gݨ80 gݣ0 gݣ/ gݣ/ gݚ/ gݚ/ gݙ~/ gݙ|/ gݒ&/ gݒ/ gݐ/ gݏ/ gݏ/ g݂&/ g݂/ gp/ go/ gg/ gg/ ]  b %|(5U!14K]j  -_) ossec13001ga>Exim Auth failed2025-03-24 19:12:21 dovecot_login authenticator failed for ([171.217.70.151]) [171.217.70.151]:59804: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)171.217.70.1511814991e  -U) ossec13001g_Exim Auth failed2025-03-24 19:06:09 dovecot_login authenticator failed for p57078-obmd01.osaka.ocn.ne.jp [153.141.244.78]:58834: 535 Incorrect authentication data (set_id=services)153.141.244.781861060y  -' ossec13001g_Exim Auth failed2025-03-24 19:05:39 dovecot_login authenticator failed for 61-220-220-99.hinet-ip.hinet.net [61.220.220.99]:43454: 535 Incorrect authentication data (set_id=services@heipowersystem.com)61.220.220.991668284l  -a+ ossec13001g_Exim Auth failed2025-03-24 19:06:17 dovecot_login authenticator failed for (189.218.168.228-clientes-izzi.mx) [189.218.168.228]:38867: 535 Incorrect authentication data (set_id=services)189.218.168.22839960630  =[) ossec13008g^8Mail Reciepient rejected2025-03-24 18:59:26 H=(mail.msnews24.in) [165.154.228.93]:56124 F= rejected RCPT : Rejected relay attempt: '165.154.228.93' From: 'qcajtega@msnews24.in' To: 'extradomcom@fastmail.com'165.154.228.931643084\ -E% ossec13001g\ Exim Auth failed2025-03-24 18:50:11 dovecot_login authenticator failed for (amplifypowerglobal.com) [150.5.145.36]:38452: 535 Incorrect authentication data (set_id=nologin)150.5.145.361880251o  -m% ossec13001gVjExim Auth failed2025-03-24 18:26:08 dovecot_login authenticator failed for ([103.83.9.138]) [103.83.9.138]:50318: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)103.83.9.1381269750&~ 3Q' ossec11301gV:New FTP connection.Mar 24 18:25:19 vm1 pure-ftpd[3008322]: (?@45.156.128.96) [INFO] New connection from 45.156.128.9645.156.128.962264397&} 3Q' ossec11301gV6New FTP connection.Mar 24 18:25:16 vm1 pure-ftpd[3008313]: (?@45.156.128.97) [INFO] New connection from 45.156.128.9745.156.128.972264397%|  3Q' ossec11301gV4New FTP connection.Mar 24 18:25:15 vm1 pure-ftpd[3008311]: (?@45.156.128.98) [INFO] New connection from 45.156.128.9845.156.128.982264397&{ 3Q' ossec11301gV2New FTP connection.Mar 24 18:25:13 vm1 pure-ftpd[3008300]: (?@45.156.128.99) [INFO] New connection from 45.156.128.9945.156.128.992264397oz  -k' ossec13001gUExim Auth failed2025-03-24 18:23:53 dovecot_login authenticator failed for (s2seducationtrust.com) [111.207.12.99]:59104: 535 Incorrect authentication data (set_id=info@s2seducationtrust.com)111.207.12.991814991\y  -E' ossec13001gUExim Auth failed2025-03-24 18:23:30 dovecot_login authenticator failed for (s2seducationtrust.com) [111.207.12.99]:55644: 535 Incorrect authentication data (set_id=nologin)111.207.12.991814991[mS  -3' ossec13001g Exim Auth failed2025-03-24 22:06:24 dovecot_login authenticator failed for ([58.250.157.83]) [58.250.157.83]:2066: 535 Incorrect authentication data (set_id=sales)58.250.157.831814991f  -[' ossec13001gExim Auth failed2025-03-24 22:05:59 dovecot_login authenticator failed for ([41.164.173.53]) [41.164.173.53]:48516: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)41.164.173.539539872  =_) ossec13008gMail Reciepient rejected2025-03-24 21:57:35 H=(mail.msnews24.in) [165.154.210.52]:61539 F= rejected RCPT : Rejected relay attempt: '165.154.210.52' From: 'dzmhpyqqm@msnews24.in' To: 'extradomcom@fastmail.com'165.154.210.521694008m  -e) ossec13001gExim Auth failed2025-03-24 21:48:32 dovecot_plain authenticator failed for ([123.209.67.169]) [123.209.67.169]:58324: 535 Incorrect authentication data (set_id=services@heipowersystem.com)123.209.67.1692077456v  -y' ossec13001gtEExim Auth failed2025-03-24 20:33:33 dovecot_plain authenticator failed for ([218.4.205.242]) [218.4.205.242]:53723: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)218.4.205.2421814991W  -9) ossec13001grExim Auth failed2025-03-24 20:27:19 dovecot_plain authenticator failed for ([201.182.235.67]) [201.182.235.67]:41360: 535 Incorrect authentication data (set_id=sales)201.182.235.673469034N  --# ossec13001grExim Auth failed2025-03-24 20:27:07 dovecot_plain authenticator failed for ([50.81.70.80]) [50.81.70.80]:53164: 535 Incorrect authentication data (set_id=sales)50.81.70.806252001j  -_) ossec13001grExim Auth failed2025-03-24 20:26:49 dovecot_plain authenticator failed for ([121.190.129.68]) [121.190.129.68]:38823: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)121.190.129.681835841_  -K' ossec13001gnExim Auth failed2025-03-24 20:09:35 dovecot_login authenticator failed for ([39.165.61.209]) [39.165.61.209]:45756: 535 Incorrect authentication data (set_id=vikas.khandelwal)39.165.61.2091814991  -!% ossec13001gnExim Auth failed2025-03-24 20:09:13 dovecot_login authenticator failed for vps-79f20bfc.vps.ovh.net ([87.98.249.193]) [51.75.24.107]:61200: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)51.75.24.1073017382  -+ ossec13001giExim Auth failed2025-03-24 19:48:43 dovecot_plain authenticator failed for static-200-105-141-170.acelerate.net ([200.105.141.161]) [200.105.141.170]:52944: 535 Incorrect authentication data (set_id=vikas.khandelwal)200.105.141.1703923057c  -Q+ ossec13001giExim Auth failed2025-03-24 19:48:21 dovecot_plain authenticator failed for ([196.200.227.78]) [196.200.227.194]:52646: 535 Incorrect authentication data (set_id=vikas.khandelwal)196.200.227.194149590  - + ossec13001giExim Auth failed2025-03-24 19:48:04 dovecot_plain authenticator failed for 118.sub-166-169-117.myvzw.com [166.169.117.118]:58623: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)166.169.117.1186252001W  -9) ossec13001ge%Exim Auth failed2025-03-24 19:29:00 dovecot_login authenticator failed for ([117.159.234.69]) [117.159.234.69]:35826: 535 Incorrect authentication data (set_id=sales)117.159.234.691814991j  -_) ossec13001ge Exim Auth failed2025-03-24 19:28:36 dovecot_login authenticator failed for ([218.150.170.10]) [218.150.170.10]:56754: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)218.150.170.101835841m  -c+ ossec13001gcKExim Auth failed2025-03-24 19:21:07 dovecot_plain authenticator failed for ([197.149.125.227]) [197.149.125.227]:36384: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)197.149.125.2272328926  u i 3 8[mS'  -5' ossec13001gExim Auth failed2025-03-25 01:44:15 dovecot_plain authenticator failed for ([94.205.250.78]) [94.205.250.78]:59282: 535 Incorrect authentication data (set_id=sales)94.205.250.78290557j&  -_) ossec13001gExim Auth failed2025-03-25 01:43:46 dovecot_plain authenticator failed for ([120.157.12.107]) [120.157.12.107]:55178: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)120.157.12.10720774566%  =g) ossec13008gỡMail Reciepient rejected2025-03-25 01:38:00 H=(mail.msnews24.in) [165.154.247.20]:55698 F= rejected RCPT : Rejected relay attempt: '165.154.247.20' From: 'sizxkvqwqgk@msnews24.in' To: 'extradomcom@fastmail.com'165.154.247.201605651$  3I# ossec11301gịNew FTP connection.Mar 25 01:37:38 vm1 pure-ftpd[3101419]: (?@71.6.232.28) [INFO] New connection from 71.6.232.2871.6.232.286252001Z#  -A' ossec13001gExim Auth failed2025-03-25 01:22:53 dovecot_login authenticator failed for (thepsindustries.com) [58.240.171.59]:46770: 535 Incorrect authentication data (set_id=nologin)58.240.171.591814991X"  -;) ossec13001gExim Auth failed2025-03-25 01:09:03 dovecot_plain authenticator failed for ([159.223.250.131]) [161.35.200.202]:46268: 535 Incorrect authentication data (set_id=sales)161.35.200.2022921044c!  -W% ossec13001gExim Auth failed2025-03-25 01:08:40 dovecot_plain authenticator failed for ([194.28.91.40]) [194.28.91.40]:51964: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)194.28.91.40690791x  -y+ ossec13001g%Exim Auth failed2025-03-25 01:06:04 dovecot_plain authenticator failed for ([176.118.213.147]) [176.118.213.147]:53216: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)176.118.213.1472017370f  -[' ossec13001gᮩExim Auth failed2025-03-25 00:42:41 dovecot_login authenticator failed for ([80.227.99.162]) [80.227.99.162]:60583: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)80.227.99.162290557f  -W) ossec13001g᮳Exim Auth failed2025-03-25 00:42:50 dovecot_login authenticator failed for (189.219.36.213-clientes-izzi.mx) [189.219.36.213]:55860: 535 Incorrect authentication data (set_id=sales)189.219.36.2133996063  ?1 ossec1008gᦼProcess exiting (killed).Mar 25 00:08:49 vm1 spamd[2776088]: spamd: server killed by SIGTERM, shutting down2  =_) ossec13008goMail Reciepient rejected2025-03-25 00:07:34 H=(mail.msnews24.in) [165.154.210.52]:53521 F= rejected RCPT : Rejected relay attempt: '165.154.210.52' From: 'cjucyqyin@msnews24.in' To: 'extradomcom@fastmail.com'165.154.210.521694008C  77 ossec502gOssec server started.ossec: Ossec started.Q  -1% ossec13001g᠉Exim Auth failed2025-03-24 23:42:24 dovecot_plain authenticator failed for ([141.94.18.69]) [141.94.18.69]:34232: 535 Incorrect authentication data (set_id=sales)141.94.18.693017382m  -c+ ossec13001g{Exim Auth failed2025-03-24 23:42:11 dovecot_plain authenticator failed for ([103.123.114.215]) [103.123.114.215]:40838: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)103.123.114.2151168579  3E! ossec11301gᏽNew FTP connection.Mar 24 22:30:43 vm1 pure-ftpd[3058111]: (?@65.49.1.31) [INFO] New connection from 65.49.1.3165.49.1.316252001g  -[' ossec13001gcExim Auth failed2025-03-24 22:07:55 dovecot_plain authenticator failed for ([1.224.173.231]) [1.224.173.231]:54186: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)1.224.173.2311835841|  -% ossec13001gWExim Auth failed2025-03-24 22:07:41 dovecot_plain authenticator failed for (45.201.33.36.adsl-pool.ah.cnuninet.net) [36.33.201.45]:50252: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)36.33.201.451814991 9 8 'IrT8  -7% ossec13001gExim Auth failed2025-03-25 03:55:46 dovecot_plain authenticator failed for ([219.139.41.6]) [219.139.41.6]:51868: 535 Incorrect authentication data (set_id=services)219.139.41.61814991}7  -' ossec13001gExim Auth failed2025-03-25 03:55:17 dovecot_plain authenticator failed for syn-047-038-202-184.res.spectrum.com [47.38.202.184]:58054: 535 Incorrect authentication data (set_id=services@heipowersystem.com)47.38.202.1846252001j6  -_) ossec13001gExim Auth failed2025-03-25 03:47:35 dovecot_login authenticator failed for ([201.182.235.67]) [201.182.235.67]:52470: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)201.182.235.673469034S5  -1) ossec13001gExim Auth failed2025-03-25 03:47:07 dovecot_login authenticator failed for p37046-obmd01.osaka.ocn.ne.jp [153.141.224.46]:47752: 535 Incorrect authentication data153.141.224.461861060Z4  -?) ossec13001g|Exim Auth failed2025-03-25 03:41:07 dovecot_login authenticator failed for ([114.250.93.159]) [114.250.93.159]:44173: 535 Incorrect authentication data (set_id=services)114.250.93.1591814991g3  -]% ossec13001glExim Auth failed2025-03-25 03:40:51 dovecot_login authenticator failed for ([1.180.230.98]) [1.180.230.98]:42863: 535 Incorrect authentication data (set_id=services@heipowersystem.com)1.180.230.981814991%2  3Q' ossec11301g\New FTP connection.Mar 25 03:36:18 vm1 pure-ftpd[3126100]: (?@194.187.176.6) [INFO] New connection from 194.187.176.6194.187.176.62921044n1  -i' ossec13001gExim Auth failed2025-03-25 03:22:26 dovecot_plain authenticator failed for nz117l15.bb60246.ctm.net ([60.246.119.213]) [60.246.117.15]:46828: 535 Incorrect authentication data (set_id=sales)60.246.117.1518212750  W!) ossec9708gDovecot Aborted Login with empty userMar 25 03:22:23 vm1 dovecot[2184869]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=195.154.56.122, lip=103.74.54.108, TLS, session=195.154.56.1223017382t/  -q+ ossec13001gExim Auth failed2025-03-25 03:22:14 dovecot_plain authenticator failed for (126-209-236-109.sv-en.ru) [109.236.209.126]:37746: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)109.236.209.1262017370r.  -q' ossec13001g"Exim Auth failed2025-03-25 03:14:02 dovecot_login authenticator failed for (089-101-036159.ntlworld.ie) [89.101.36.159]:59853: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)89.101.36.1592963597^-  -K% ossec13001g:Exim Auth failed2025-03-25 03:14:25 dovecot_login authenticator failed for p83028-obmd01.osaka.ocn.ne.jp [180.7.154.27]:53516: 535 Incorrect authentication data (set_id=sales)180.7.154.271861060l,  -e) ossec13001gExim Auth failed2025-03-25 03:04:00 dovecot_plain authenticator failed for ([94.204.230.110]) [94.204.230.110]:60216: 535 Incorrect authentication data (set_id=services@heipowersystem.com)94.204.230.110290557$+  3Q' ossec11301gϲNew FTP connection.Mar 25 03:03:37 vm1 pure-ftpd[3119042]: (?@195.3.222.214) [INFO] New connection from 195.3.222.214195.3.222.214798544}*  -+ ossec13001gExim Auth failed2025-03-25 02:35:17 dovecot_plain authenticator failed for (172.183.199.112.unknown.m1.com.sg) [112.199.183.172]:59302: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)112.199.183.1721880251")  3M% ossec11301gȒNew FTP connection.Mar 25 02:33:13 vm1 pure-ftpd[3112777]: (?@139.162.77.6) [INFO] New connection from 139.162.77.6139.162.77.61861060(  W' ossec9708gXDovecot Aborted Login with empty userMar 25 02:27:58 vm1 dovecot[2184869]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=87.236.176.40, lip=103.74.54.108, TLS, session=87.236.176.402635167 ,b  7 >_coji,;J  [)'1modsec77318034gIM360 WAF: Blocked access to git folderIM360 WAF: Blocked access to git folder||RSV:6.78||T:APACHE||MV:/.git/config||103.102.230.83017382vm1.technobases.inI  G}'1modsec77350309gIM360 WAF: Hidden file accessIM360 WAF: Hidden file access||RSV:6.78||T:APACHE||QS:||103.102.230.83017382vm1.technobases.in\H  -G% ossec13001g]Exim Auth failed2025-03-25 06:14:12 dovecot_plain authenticator failed for ([60.174.35.18]) [60.174.35.18]:32947: 535 Incorrect authentication data (set_id=vikas.khandelwal)60.174.35.181814991}G  - % ossec13001gAExim Auth failed2025-03-25 06:13:44 dovecot_plain authenticator failed for (undefined.hostname.localhost) [103.90.97.98]:49856: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)103.90.97.9812697504F  =c) ossec13008gMail Reciepient rejected2025-03-25 06:04:37 H=(mail.msnews24.in) [165.154.247.20]:60198 F= rejected RCPT : Rejected relay attempt: '165.154.247.20' From: 'lotfzuwybg@msnews24.in' To: 'extradomcom@fastmail.com'165.154.247.201605651[E -A' ossec13001gExim Auth failed2025-03-25 05:29:38 dovecot_login authenticator failed for (thepsindustries.com) [111.56.54.202]:37294: 535 Incorrect authentication data (set_id=nologin)111.56.54.2021814991jD  -a' ossec13001gExim Auth failed2025-03-25 05:21:01 dovecot_plain authenticator failed for ([113.117.83.201]) [59.39.208.248]:4283: 535 Incorrect authentication data (set_id=services@heipowersystem.com)59.39.208.2481814991pC  -o% ossec13001gxExim Auth failed2025-03-25 04:49:20 dovecot_login authenticator failed for (amplifypowerglobal.com) [125.72.54.81]:37668: 535 Incorrect authentication data (set_id=sales@amplifypowerglobal.com)125.72.54.811814991xB  -y+ ossec13001gDExim Auth failed2025-03-25 04:48:27 dovecot_plain authenticator failed for ([223.190.207.223]) [223.190.207.223]:48581: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)223.190.207.2231269750[A  -E% ossec13001gBExim Auth failed2025-03-25 04:48:25 dovecot_login authenticator failed for (amplifypowerglobal.com) [125.72.54.81]:33298: 535 Incorrect authentication data (set_id=nologin)125.72.54.811814991u@  -u) ossec13001gBExim Auth failed2025-03-25 04:44:08 dovecot_login authenticator failed for ([166.195.193.83]) [166.195.193.83]:38352: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)166.195.193.836252001W?  -9) ossec13001gRExim Auth failed2025-03-25 04:14:32 dovecot_login authenticator failed for ([121.11.145.163]) [121.11.145.163]:51490: 535 Incorrect authentication data (set_id=sales)121.11.145.1631814991j>  -_) ossec13001g<Exim Auth failed2025-03-25 04:14:11 dovecot_login authenticator failed for ([209.141.177.55]) [209.141.177.55]:37119: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)209.141.177.556251999l=  -e) ossec13001gExim Auth failed2025-03-25 04:12:06 dovecot_login authenticator failed for ([168.167.55.230]) [168.167.55.230]:43880: 535 Incorrect authentication data (set_id=services@heipowersystem.com)168.167.55.230933860Z< -?' ossec13001g]Exim Auth failed2025-03-25 04:06:13 dovecot_login authenticator failed for (heipowersystem.com) [111.207.12.99]:53422: 535 Incorrect authentication data (set_id=nologin)111.207.12.991814991Q;  [U'1modsec77142160giIM360 WAF: Infectors. Dirb like fuzzingIM360 WAF: Infectors. Dirb like fuzzing||MVN:REQUEST_FILENAME||MV:/.git/config||RSV:6.78||T:APACHE||103.102.230.83017382vm1.technobases.in;:  [)'1modsec77318034giIM360 WAF: Blocked access to git folderIM360 WAF: Blocked access to git folder||RSV:6.78||T:APACHE||MV:/.git/config||103.102.230.83017382vm1.technobases.in9  G}'1modsec77350309giIM360 WAF: Hidden file accessIM360 WAF: Hidden file access||RSV:6.78||T:APACHE||QS:||103.102.230.83017382vm1.technobases.in +S j y tZ  -s) ossec13001g;Exim Auth failed2025-03-25 08:38:42 dovecot_login authenticator failed for 144.46.246.220.static.netvigator.com [220.246.46.144]:64339: 535 Incorrect authentication data (set_id=vikas.khandelwal)220.246.46.1441819730xY  -y+ ossec13001gExim Auth failed2025-03-25 08:38:08 dovecot_login authenticator failed for ([190.121.193.126]) [190.121.193.126]:33932: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)190.121.193.1263595528mX  -c+ ossec13001g9Exim Auth failed2025-03-25 08:34:23 dovecot_plain authenticator failed for ([103.123.114.215]) [103.123.114.215]:52306: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)103.123.114.2151168579W  W) ossec9708gDovecot Aborted Login with empty userMar 25 08:24:16 vm1 dovecot[2184869]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=118.193.56.246, lip=103.74.54.108, session=118.193.56.2461605651jV  -a' ossec13001gExim Auth failed2025-03-25 08:15:28 dovecot_plain authenticator failed for ([14.53.126.112]) [14.53.126.112]:60360: 535 Incorrect authentication data (set_id=services@heipowersystem.com)14.53.126.1121835841mU  -e) ossec13001g=Exim Auth failed2025-03-25 08:13:08 dovecot_plain authenticator failed for ([43.143.231.208]) [43.143.231.208]:56868: 535 Incorrect authentication data (set_id=services@heipowersystem.com)43.143.231.2081814991eT  -S+ ossec13001gsExim Auth failed2025-03-25 07:39:55 dovecot_plain authenticator failed for ([123.116.142.131]) [123.116.142.131]:45196: 535 Incorrect authentication data (set_id=vikas.khandelwal)123.116.142.1311814991S  -' ossec13001gcExim Auth failed2025-03-25 07:39:37 dovecot_plain authenticator failed for 111-70-22-153.emome-ip.hinet.net [111.70.22.153]:51196: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)111.70.22.1531668284tR  -s) ossec13001gVExim Auth failed2025-03-25 07:01:01 dovecot_plain authenticator failed for (136-34-165-114.googlefiber.net) [136.34.165.114]:44379: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)136.34.165.1146252001vQ  -y' ossec13001gHExim Auth failed2025-03-25 07:00:48 dovecot_plain authenticator failed for ([61.169.31.242]) [61.169.31.242]:33023: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)61.169.31.2421814991XP  -A% ossec13001gExim Auth failed2025-03-25 06:54:37 dovecot_plain authenticator failed for vps-eed33ea4.vps.ovh.net [51.38.133.48]:47864: 535 Incorrect authentication data (set_id=sales)51.38.133.48798544mO  -c+ ossec13001gExim Auth failed2025-03-25 06:54:19 dovecot_plain authenticator failed for ([183.109.195.179]) [183.109.195.179]:45540: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)183.109.195.1791835841mN  -e) ossec13001gExim Auth failed2025-03-25 06:46:03 dovecot_plain authenticator failed for ([182.191.122.84]) [182.191.122.84]:55122: 535 Incorrect authentication data (set_id=services@heipowersystem.com)182.191.122.841168579eM  -U) ossec13001gExim Auth failed2025-03-25 06:46:16 dovecot_plain authenticator failed for (23.105.192.225.16clouds.com) [43.250.201.118]:62659: 535 Incorrect authentication data (set_id=services)43.250.201.1181814991TL  -5' ossec13001gExim Auth failed2025-03-25 06:36:47 dovecot_login authenticator failed for (rokamauka.com) [58.240.171.59]:45296: 535 Incorrect authentication data (set_id=nologin)58.240.171.591814991QK  [U'1modsec77142160gIM360 WAF: Infectors. Dirb like fuzzingIM360 WAF: Infectors. Dirb like fuzzing||MVN:REQUEST_FILENAME||MV:/.git/config||RSV:6.78||T:APACHE||103.102.230.83017382vm1.technobases.in  |obUH;.!xk^QD7*tgZM@3& ~qdWJ=0# zm`SF9, v i \ O B 5 (     r e X K > 1 $  { n a T G : -   w j ] P C 6 )    s f Y L ? 2 %  1835841 1835841 1835841 { 1835841 i 1835841 g 1835841 d 1835841 _ 1835841 G 1835841 C 1835841 ? 1835841 3 1835841 " 1835841  1835841  1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 f 1835841 ) 1835841  1835841  1835841  1835841  1835841 1835841 1835841  1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 ] 1835841 T 1835841 @ 1835841 ? 1835841 8 1835841 # 1835841  1835841 1835841  1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841w 1835841n 1835841g 1835841f 1835841e 1835841Z 1835841K 1835841B 1835841= 18358414 1835841* 1835841' 1835841" 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841z 1835841j 1835841g 1835841a 1835841] 1835841P 1835841E 1835841C 1835841= 18358411 1835841# 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841~ 1835841| 1835841i 1835841g 1835841O 1835841H 18358418 18358417 1835841, 1835841& 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 x 1835841 w 1835841 q 1835841 p 1835841 a 1835841 ` 1835841 ^ 1835841 W 1835841 U 1835841 L 1835841 E 1835841 > 1835841 < 1835841 9 1835841 5 1835841 4 1835841  1835841  1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 |:   ;;Wc{|*j  =O) ossec13008gXMail Reciepient rejected2025-03-25 12:45:38 H=(mail.msnews24.in) [165.154.247.20]:58637 F= rejected RCPT : Rejected relay attempt: '165.154.247.20' From: 'eizeq@msnews24.in' To: 'extradomcom@fastmail.com'165.154.247.201605651Mi  --# ossec13001gV]Exim Auth failed2025-03-25 12:38:12 dovecot_plain authenticator failed for ([5.30.215.71]) [5.30.215.71]:52350: 535 Incorrect authentication data (set_id=sales)5.30.215.71290557dh  -W% ossec13001gV=Exim Auth failed2025-03-25 12:37:40 dovecot_plain authenticator failed for ([60.172.1.210]) [60.172.1.210]:46163: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)60.172.1.2101814991pg  -i+ ossec13001gU Exim Auth failed2025-03-25 12:32:33 dovecot_plain authenticator failed for ([178.178.127.114]) [178.178.127.114]:47290: 535 Incorrect authentication data (set_id=services@heipowersystem.com)178.178.127.1142017370`f  -O% ossec13001gQpExim Auth failed2025-03-25 12:17:11 dovecot_plain authenticator failed for ([27.24.141.90]) [27.24.141.90]:52850: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)27.24.141.901814991|e  -+ ossec13001gQdExim Auth failed2025-03-25 12:16:58 dovecot_plain authenticator failed for ([222.170.255.146]) [222.170.255.146]:55432: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)222.170.255.1461814991Yd  -C# ossec13001gMHExim Auth failed2025-03-25 11:59:27 dovecot_plain authenticator failed for ([8.209.221.7]) [8.209.221.7]:60116: 535 Incorrect authentication data (set_id=vikas.khandelwal)8.209.221.71861060nc  -m% ossec13001gM<Exim Auth failed2025-03-25 11:59:15 dovecot_plain authenticator failed for ([45.93.94.125]) [45.93.94.125]:59220: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)45.93.94.125294640vb  -w) ossec13001gFExim Auth failed2025-03-25 11:32:01 dovecot_plain authenticator failed for ([159.223.250.131]) [161.35.200.202]:56448: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)161.35.200.2022921044{a  -+ ossec13001gA Exim Auth failed2025-03-25 11:07:13 dovecot_login authenticator failed for (173-166-112-154-newengland.hfc.comcastbusiness.net) [173.166.112.154]:53731: 535 Incorrect authentication data (set_id=sales)173.166.112.1546252001j`  -_) ossec13001g@Exim Auth failed2025-03-25 11:07:03 dovecot_login authenticator failed for ([190.121.195.38]) [190.121.195.38]:33442: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)190.121.195.383595528]_  -C+ ossec13001g@Exim Auth failed2025-03-25 11:05:19 dovecot_plain authenticator failed for ([176.210.118.102]) [176.210.118.102]:47094: 535 Incorrect authentication data (set_id=services)176.210.118.1022017370f^  -]% ossec13001g@Exim Auth failed2025-03-25 11:05:09 dovecot_plain authenticator failed for ([94.205.82.33]) [94.205.82.33]:51237: 535 Incorrect authentication data (set_id=services@heipowersystem.com)94.205.82.33290557t]  -u) ossec13001g8Exim Auth failed2025-03-25 10:32:26 dovecot_plain authenticator failed for ([94.201.236.143]) [94.201.236.143]:41273: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)94.201.236.143290557\  Ug) ossec11001g4Deferred login on the cpanel service[2025-03-25 10:15:46 +0530] info [webmaild] 157.38.200.133 - kps@amplifypowerglobal.com "POST /cpsess1581780451/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [157.38.201.192] != Current IP Address [157.38.200.133]157.38.200.1331269750B[  -% ossec13001g$Exim Auth failed2025-03-25 09:06:56 dovecot_plain authenticator failed for ([154.127.42.2]) [154.127.42.2]:37944: 535 Incorrect authentication data154.127.42.22395170 g9 O 2  h zg~x  Ua' ossec11001gDeferred login on the cpanel service[2025-03-25 18:17:07 +0530] info [webmaild] 157.38.194.77 - kps@amplifypowerglobal.com "POST /cpsess8897604494/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [157.38.198.62] != Current IP Address [157.38.194.77]157.38.194.771269750cw  W') ossec31129gLAnti-bot protection. Grouped messages123.160.223.74 - - [03/25/2025:12:40:41 -0000] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10131354&pdata=https%253A%252F%252Frokamauka.com%253A52229%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1742906439 HTTP/1.1" 200 0 "https://rokamauka.com:2083/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 11_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36" "-" "-" 2083123.160.223.741814991/v g-) ossec31130gHAnti-bot protection. User passed successfully123.160.223.75 - - [25/Mar/2025:18:10:39 +0530] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9790917&pdata=https%253A%252F%252Fvm1.technobases.in%253A52229%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1742906434 HTTP/1.1" 302 0 vm1.technobases.in "https://vm1.technobases.in:2083/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 11_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:123.160.223.75123.160.223.751814991mu  -m% ossec13001gExim Auth failed2025-03-25 18:01:18 dovecot_plain authenticator failed for ([65.20.155.91]) [65.20.155.91]:56370: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)65.20.155.9199237(t  3U) ossec11301gPNew FTP connection.Mar 25 17:28:07 vm1 pure-ftpd[3309174]: (?@20.150.202.238) [INFO] New connection from 20.150.202.23820.150.202.23862520010s  =[) ossec13008g☢Mail Reciepient rejected2025-03-25 17:20:56 H=(mail.msnews24.in) [165.154.247.20]:63300 F= rejected RCPT : Rejected relay attempt: '165.154.247.20' From: 'weycvvky@msnews24.in' To: 'extradomcom@fastmail.com'165.154.247.201605651"r  3M% ossec11301gNew FTP connection.Mar 25 17:17:46 vm1 pure-ftpd[3306898]: (?@20.171.28.29) [INFO] New connection from 20.171.28.2920.171.28.296252001jq  -a' ossec13001gvtExim Auth failed2025-03-25 14:55:07 dovecot_login authenticator failed for ([31.173.20.146]) [31.173.20.146]:57216: 535 Incorrect authentication data (set_id=services@heipowersystem.com)31.173.20.1462017370%p  3Q' ossec11301gu New FTP connection.Mar 25 14:49:05 vm1 pure-ftpd[3273554]: (?@20.221.68.158) [INFO] New connection from 20.221.68.15820.221.68.1586252001o  W' ossec9708gt2Dovecot Aborted Login with empty userMar 25 14:45:28 vm1 dovecot[2184869]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=45.156.129.73, lip=103.74.54.108, TLS, session=45.156.129.732264397n W' ossec9708gt0Dovecot Aborted Login with empty userMar 25 14:45:27 vm1 dovecot[2184869]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=45.156.129.71, lip=103.74.54.108, session=<+19aKScxjcktnIFH>45.156.129.712264397fm  -[' ossec13001gfExim Auth failed2025-03-25 13:45:18 dovecot_login authenticator failed for ([94.201.79.121]) [94.201.79.121]:45828: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)94.201.79.121290557Kl  -)! ossec13001gdExim Auth failed2025-03-25 13:36:43 dovecot_plain authenticator failed for ([45.6.80.40]) [45.6.80.40]:36974: 535 Incorrect authentication data (set_id=sales)45.6.80.403469034tk  -w% ossec13001gcExim Auth failed2025-03-25 13:36:07 dovecot_plain authenticator failed for h77-53-111-65.cust.bredband2.com [77.53.111.65]:34288: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)77.53.111.652661886 Z- I -^K}T  -9% ossec13001g#Exim Auth failed2025-03-26 03:14:41 dovecot_login authenticator failed for (localhost) [81.30.107.92]:50232: 535 Incorrect authentication data (set_id=rob\303\251rio)81.30.107.92130758J  -#' ossec13001g#Exim Auth failed2025-03-26 03:14:14 dovecot_login authenticator failed for (localhost) [81.30.107.198]:10844: 535 Incorrect authentication data (set_id=h1)81.30.107.198130758I  -#% ossec13001g#^Exim Auth failed2025-03-26 03:12:52 dovecot_login authenticator failed for (localhost) [81.30.107.92]:17552: 535 Incorrect authentication data (set_id=tel)81.30.107.92130758I  -#% ossec13001g#Exim Auth failed2025-03-26 03:11:48 dovecot_login authenticator failed for (localhost) [81.30.107.92]:33420: 535 Incorrect authentication data (set_id=fbe)81.30.107.92130758Q  -1' ossec13001g"Exim Auth failed2025-03-26 03:11:06 dovecot_login authenticator failed for (localhost) [81.30.107.199]:16254: 535 Incorrect authentication data (set_id=katsuzawa)81.30.107.199130758O  -/% ossec13001g"Exim Auth failed2025-03-26 03:10:56 dovecot_login authenticator failed for (localhost) [81.30.107.92]:49198: 535 Incorrect authentication data (set_id=krummholz)81.30.107.92130758M  -)' ossec13001g"Exim Auth failed2025-03-26 03:10:17 dovecot_login authenticator failed for (localhost) [81.30.107.199]:32120: 535 Incorrect authentication data (set_id=amjad)81.30.107.199130758K  -'% ossec13001g"Exim Auth failed2025-03-26 03:10:04 dovecot_login authenticator failed for (localhost) [81.30.107.92]:64890: 535 Incorrect authentication data (set_id=aguni)81.30.107.92130758N -)' ossec13001g"iExim Auth failed2025-03-26 03:08:49 dovecot_login authenticator failed for (localhost) [81.30.107.199]:64314: 535 Incorrect authentication data (set_id=teizo)81.30.107.199130758M  -)' ossec13001g"1Exim Auth failed2025-03-26 03:07:53 dovecot_login authenticator failed for (localhost) [81.30.107.199]:15996: 535 Incorrect authentication data (set_id=popov)81.30.107.199130758E  gY+ ossec11307gMultiple connection attempts from same sourceMar 26 02:54:38 vm1 pure-ftpd[3433287]: (?@162.142.125.223) [INFO] New connection from 162.142.125.223162.142.125.2236252001, 3Y+ ossec11301gNew FTP connection.Mar 26 02:54:37 vm1 pure-ftpd[3433279]: (?@162.142.125.223) [INFO] New connection from 162.142.125.223162.142.125.2236252001, 3Y+ ossec11301g New FTP connection.Mar 26 02:54:28 vm1 pure-ftpd[3433171]: (?@162.142.125.223) [INFO] New connection from 162.142.125.223162.142.125.2236252001S~  -7% ossec13001g Exim Auth failed2025-03-26 01:31:42 dovecot_login authenticator failed for (localhost) [81.30.107.91]:27042: 535 Incorrect authentication data (set_id=oqwroqrwqorqw)81.30.107.911307586}  =g) ossec13008gMail Reciepient rejected2025-03-26 01:06:54 H=(mail.msnews24.in) [165.154.247.20]:65287 F= rejected RCPT : Rejected relay attempt: '165.154.247.20' From: 'lqgnzllnfxt@msnews24.in' To: 'extradomcom@fastmail.com'165.154.247.201605651|  W!) ossec9708ggDovecot Aborted Login with empty userMar 26 00:56:30 vm1 dovecot[2184869]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=87.236.176.205, lip=103.74.54.108, TLS, session=87.236.176.2052635167{  ?1 ossec1008g0Process exiting (killed).Mar 26 00:08:38 vm1 spamd[3082854]: spamd: server killed by SIGTERM, shutting downz  3I# ossec11301gNew FTP connection.Mar 25 22:40:39 vm1 pure-ftpd[3376056]: (?@65.49.1.194) [INFO] New connection from 65.49.1.19465.49.1.1946252001"y  3M% ossec11301g$New FTP connection.Mar 25 20:13:48 vm1 pure-ftpd[3344692]: (?@4.246.230.33) [INFO] New connection from 4.246.230.334.246.230.336252001 EPNGw s o j e ]YYAELS~g%13.86.66.122BLACKg gh Blacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests6252001 VBzlocalxf#!k3.23.97.142GRAYg\Imunify360g[Automatically blocked due to distributed attack6252001alocale)52.138.177.114BLACKgFgTFBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests29635974rlocald'52.164.255.78BLACKg'0g0Blacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests29635974Nlocal~R%23.99.255.11BLACKgBegeBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests6252001c localN+195.178.110.163BLACKggBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests732800ònlocal~M%13.74.164.39BLACKg9g9Blacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests2963597 J'local~L%40.113.91.96BLACKgƜg◜Blacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests2963597(q[`localJ+104.208.158.128BLACKggBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests6252001hОlocalc)52.170.130.194BLACKggBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests62520014local}b#52.169.94.7BLACKggBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests29635974^local}a#52.247.58.9BLACKggBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests62520014: local`)48.211.167.159BLACKgdgdBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests62520010ӧlocal}_#52.169.5.45BLACKgogoBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests29635974-local^'13.74.168.157BLACKggBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests2963597 Jlocal])130.131.208.46BLACKggBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests6252001.local\%128.24.41.54BLACKggBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests6252001)6local~[%52.169.9.153BLACKggBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests29635974 localZ)213.136.81.226BLACKgguBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests3017382ՈQlocal|Y!40.69.69.7BLACKg.go.Blacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests2963597(EElocalX'52.247.61.144BLACKgygJBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests62520014=localW'52.247.62.164BLACKgh+g9+Blacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests62520014>local}V#20.7.172.81BLACKgag2Blacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests6252001QlocalU)104.46.201.152BLACKgZg+Blacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests6252001h.ɘlocalT)137.135.78.166BLACKgIgBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests6252001NlocalS'13.79.101.201BLACKgCgBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests2963597 Oelocal~I%13.74.164.36BLACKgg|Blacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests2963597 J$local .\ Q `  Y  U"  3M% ossec11301g6New FTP connection.Mar 26 15:34:37 vm1 pure-ftpd[3613034]: (?@20.29.33.200) [INFO] New connection from 20.29.33.20020.29.33.2006252001  Ue) ossec11001gDeferred login on the cpanel service[2025-03-26 15:07:08 +0530] info [webmaild] 157.38.208.163 - kps@amplifypowerglobal.com "POST /cpsess8930209024/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [157.38.205.40] != Current IP Address [157.38.208.163]157.38.208.1631269750.  =W) ossec13008gHMail Reciepient rejected2025-03-26 13:05:36 H=(mail.msnews24.in) [165.154.247.20]:50628 F= rejected RCPT : Rejected relay attempt: '165.154.247.20' From: 'soodkze@msnews24.in' To: 'extradomcom@fastmail.com'165.154.247.201605651j  -_) ossec13001gExim Auth failed2025-03-26 10:55:26 dovecot_login authenticator failed for ([117.149.173.90]) [117.149.173.90]:57114: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)117.149.173.901814991  5#' ossec11011gWHM SSO login failed[2025-03-26 10:13:30 +0530] info [whostmgrd] 171.79.150.12 PURGE root:cyVUoXW_af_ew8TK badpass [cookie ip check: IP address has changed: IP Address [106.221.168.89] != Current IP Address [171.79.150.12]]171.79.150.121269750{  U[' ossec11001gDeferred login on the cpanel service[2025-03-26 10:13:30 +0530] info [whostmgrd] 171.79.150.12 - root "GET /cpsess3256860593/scripts4/listaccts?=undefined&login=1&post_login=32344632157499 HTTP/1.1" DEFERRED LOGIN whostmgrd: cookie ip check: IP address has changed: IP Address [106.221.168.89] != Current IP Address [171.79.150.12]171.79.150.121269750  W' ossec9708giDovecot Aborted Login with empty userMar 26 09:58:25 vm1 dovecot[2184869]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=87.236.176.31, lip=103.74.54.108, TLS, session=<4mioRDcxv7NX7LAf>87.236.176.312635167(  3U) ossec11301g{New FTP connection.Mar 26 09:29:22 vm1 pure-ftpd[3525039]: (?@221.229.214.27) [INFO] New connection from 221.229.214.27221.229.214.271814991%  3Q' ossec11301gvzNew FTP connection.Mar 26 09:07:29 vm1 pure-ftpd[3520394]: (?@68.183.113.59) [INFO] New connection from 68.183.113.5968.183.113.596252001+  3Y+ ossec11301ghNew FTP connection.Mar 26 08:08:10 vm1 pure-ftpd[3506766]: (?@162.142.125.119) [INFO] New connection from 162.142.125.119162.142.125.1196252001+  3Y+ ossec11301ggqNew FTP connection.Mar 26 08:03:19 vm1 pure-ftpd[3505515]: (?@172.202.117.219) [INFO] New connection from 172.202.117.219172.202.117.2196252001m  -c+ ossec13001gUExim Auth failed2025-03-26 06:46:52 dovecot_plain authenticator failed for ([124.106.145.241]) [124.106.145.241]:15690: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)124.106.145.24116940089  =k+ ossec13008gGMail Reciepient rejected2025-03-26 05:48:47 H=(mail.msnews24.in) [165.154.232.243]:64865 F= rejected RCPT : Rejected relay attempt: '165.154.232.243' From: 'zutcmptfjpl@msnews24.in' To: 'extradomcom@fastmail.com'165.154.232.2431605651J  -#' ossec13001g$bExim Auth failed2025-03-26 03:17:14 dovecot_login authenticator failed for (localhost) [81.30.107.198]:9668: 535 Incorrect authentication data (set_id=vhs)81.30.107.198130758N -)' ossec13001g$Exim Auth failed2025-03-26 03:15:59 dovecot_login authenticator failed for (localhost) [81.30.107.198]:42858: 535 Incorrect authentication data (set_id=brodt)81.30.107.198130758N  -+' ossec13001g#Exim Auth failed2025-03-26 03:14:59 dovecot_login authenticator failed for (localhost) [81.30.107.198]:59144: 535 Incorrect authentication data (set_id=kashio)81.30.107.198130758 ]{ri`VLB8.$zpf\RH>4*   v l b X N D : 0 &    | r h _ U K A 7 - #    y o e [ Q G = 3 )     u k a W M C 9 / %    { q g ] S I ? 5 + !  wmcYOE;1' }si_UKA7-#yoe[QG=3) ukaWMC9/%{qg]SI?5+! wmcYOE;1'  gC gۨ gu g* g gL gںk ga gR g+ g go gل gf g__ g g gؔ g gw  gu gQ9 gO gLz g. g֐j g։ gր] got gU5 g( g g gɀ g[ g: g2$ gԳE gn g~ grG gN g1 g g g̥ gЯ gm g4 g; g g  gϡ grj g7Y gΒ gk g g gh g g͸P g͘x g͕ g. g!= g/ g6 g̻ g̸R gKo g.r g  g  gX g gٌgU9 gʙ gʗ gX g#c g gv g? g͖ gȾ gȤA g$ g~ g$} g{{z g+'y gŷ2x g[r gĊf g}e gb"d gY$c g=b g gu^ gM gÁKL g[K g/~J g0I g~F gp g0 g^* g| gy) gL  g; g g gr gN g- g, gv g g¢ g gE g g` g/q g gE g gH g gd gO gH gG| g gX g` g6 g/ g gg g, gI gC gb| gF g g gA ggogxTgsRgQHgMFg3EgKZD gm gqjgk g0= gl9 gb 1 gX4+ gg#g_ ~tj`VL8.$zpf\RH>4*     v l b X N D : 0 &    | r h ^ T J @ 6 , "     x n d Z P F < 2 (   v ~ t j ` Vb L B 8 . $    z p f \ R H > 4 *  B lXND:0& hH$ hO h% hk h; hn ht h5 hB g gh gv gm gK g gP  g gX g7 gX' g' g g g( g g" gz g  g\ gF g'0 g g gd g g g g g g. gy gh+ ga gZ gI gC gBe g g9 gƜ g g g g g gr g_F g^ gQi g* g g g gO g. g gv gI6 g. g g gn} g^w g^ gV g- g* g g x g g, gݒ g g= g뻞 g! g g g gY gM g( g g g\ gj gg g鸷 g+ g g  gX g g g g gɕ g g g g' g譹 g8 g$ g~; g{ gu gV~ gT} gK&| g9 { gz gXy gx g]w gEv gu g繻t gs gr g烞q gdp gXo gQn g?Fm g)l g#k gj gi gh gеg gɖf g e gd gc gb gla gY` gP_ g(6^ gD] g\ g[ g Z gY gX gW gV g$U gT guS gOR gN g{G gZF g\OE gD gC gmB gΖ> g= g㼔< g; g: gz 5 gZ4 g3 gy2 g^1 g0 g/ g. go- g gm+ gT* gO) g >( g' g}& g% g\$ gߤ# go gDF! g9f g gݱ g݊ g݇} gG g6 g  g< g g g  gܵ gw gX g9 g* 7 w_1[7 +  W#+ ossec9708gDovecot Aborted Login with empty userMar 27 10:40:51 vm1 dovecot[2184869]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=185.247.137.108, lip=103.74.54.108, TLS, session=<5DtG+ksxQ9e594ls>185.247.137.108298795$*  3Q' ossec11301gNew FTP connection.Mar 27 09:53:45 vm1 pure-ftpd[3886419]: (?@185.247.137.8) [INFO] New connection from 185.247.137.8185.247.137.8298795*)  =O) ossec13008g3Mail Reciepient rejected2025-03-27 08:12:58 H=(mail.msnews24.in) [165.154.247.20]:55497 F= rejected RCPT : Rejected relay attempt: '165.154.247.20' From: 'revqn@msnews24.in' To: 'extradomcom@fastmail.com'165.154.247.201605651*(  =O) ossec13008g䯅Mail Reciepient rejected2025-03-27 07:23:09 H=(mail.msnews24.in) [165.154.210.52]:52711 F= rejected RCPT : Rejected relay attempt: '165.154.210.52' From: 'vaqex@msnews24.in' To: 'extradomcom@fastmail.com'165.154.210.521694008)'  =O' ossec13008gbMail Reciepient rejected2025-03-27 01:55:26 H=(mail.msnews24.in) [45.197.14.156]:49425 F= rejected RCPT : Rejected relay attempt: '45.197.14.156' From: 'rmrbcn@msnews24.in' To: 'extradomcom@fastmail.com'45.197.14.1566252001g&  -[' ossec13001gaSExim Auth failed2025-03-27 01:49:30 dovecot_plain authenticator failed for ([178.71.33.239]) [178.71.33.239]:49190: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)178.71.33.2392017370 %  [{# ossec12004g[Possible Dovecot CVE-2019-11500 attemptMar 27 01:25:19 vm1 dovecot[2184869]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.23.97.142, lip=103.74.54.108, session=3.23.97.1426252001$  ?1 ossec1008gIProcess exiting (killed).Mar 27 00:07:55 vm1 spamd[3396454]: spamd: server killed by SIGTERM, shutting down(#  3U) ossec11301g:FNew FTP connection.Mar 26 23:02:52 vm1 pure-ftpd[3719077]: (?@216.218.206.68) [INFO] New connection from 216.218.206.68216.218.206.686252001u"  -w' ossec13001gExim Auth failed2025-03-26 21:06:28 dovecot_plain authenticator failed for host150.sub-63-40-140.myvzw.com [63.40.140.150]:26331: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)63.40.140.15062520012!  =_) ossec13008g kMail Reciepient rejected2025-03-26 19:42:59 H=(mail.msnews24.in) [165.154.247.20]:52744 F= rejected RCPT : Rejected relay attempt: '165.154.247.20' From: 'vupsjmaei@msnews24.in' To: 'extradomcom@fastmail.com'165.154.247.201605651w  =i) ossec13008g@Mail Reciepient rejected2025-03-26 19:25:10 H=(mail.msnews24.in) [165.154.210.52]:63846 F= temporarily rejected RCPT : host lookup did not complete165.154.210.521694008, 3Y+ ossec11301g&New FTP connection.Mar 26 18:59:09 vm1 pure-ftpd[3663048]: (?@154.212.141.144) [INFO] New connection from 154.212.141.144154.212.141.1441819730/  =[' ossec13008gMail Reciepient rejected2025-03-26 16:50:51 H=(mail.msnews24.in) [45.197.14.156]:62100 F= rejected RCPT : Rejected relay attempt: '45.197.14.156' From: 'iohievdge@msnews24.in' To: 'extradomcom@fastmail.com'45.197.14.1566252001  =y) ossec13008g8Mail Reciepient rejected2025-03-26 16:25:51 H=(natwest.co.uk) [185.208.158.35]:55182 F= temporarily rejected RCPT : Could not complete sender verify185.208.158.356252001/  =[' ossec13008gMail Reciepient rejected2025-03-26 15:50:45 H=(mail.msnews24.in) [45.197.14.168]:56290 F= rejected RCPT : Rejected relay attempt: '45.197.14.168' From: 'fiimkmqje@msnews24.in' To: 'extradomcom@fastmail.com'45.197.14.1686252001 z ( * 4 Y NVayj=  -_) ossec13001g'Exim Auth failed2025-03-27 15:19:26 dovecot_login authenticator failed for ([223.83.138.102]) [223.83.138.102]:38583: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)223.83.138.1021814991H<  -) ossec13001gExim Auth failed2025-03-27 15:08:28 dovecot_plain authenticator failed for ([122.224.179.58]) [122.224.179.58]:46860: 535 Incorrect authentication data122.224.179.581814991d;  -W% ossec13001gtExim Auth failed2025-03-27 15:07:55 dovecot_plain authenticator failed for ([5.59.141.152]) [5.59.141.152]:53712: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)5.59.141.1522017370":  3M% ossec11301ghNew FTP connection.Mar 27 14:29:17 vm1 pure-ftpd[3950838]: (?@117.156.56.4) [INFO] New connection from 117.156.56.4117.156.56.41814991"9  3M% ossec11301g!New FTP connection.Mar 27 14:23:52 vm1 pure-ftpd[3949679]: (?@209.38.33.11) [INFO] New connection from 209.38.33.11209.38.33.112750405g8  -[' ossec13001g4Exim Auth failed2025-03-27 14:11:24 dovecot_plain authenticator failed for ([92.255.190.69]) [92.255.190.69]:48040: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)92.255.190.692017370g7  -[' ossec13001g(Exim Auth failed2025-03-27 14:11:11 dovecot_plain authenticator failed for ([89.101.36.159]) [89.101.36.159]:47960: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)89.101.36.1592963597O6  --% ossec13001g Exim Auth failed2025-03-27 13:56:36 dovecot_login authenticator failed for ([60.172.1.210]) [60.172.1.210]:55954: 535 Incorrect authentication data (set_id=wnn)60.172.1.2101814991t5  -u' ossec13001g Exim Auth failed2025-03-27 13:56:11 dovecot_login authenticator failed for 111-70-23-216.emome-ip.hinet.net [111.70.23.216]:49338: 535 Incorrect authentication data (set_id=wnn@heipowersystem.com)111.70.23.216166828464  Ag% ossec11302gpFTP Authentication failed.Mar 27 13:42:31 vm1 pure-ftpd[3940570]: (?@34.34.173.16) [WARNING] Authentication failed for user [anonymous]34.34.173.162802361#3 3M% ossec11301glNew FTP connection.Mar 27 13:42:27 vm1 pure-ftpd[3940570]: (?@34.34.173.16) [INFO] New connection from 34.34.173.1634.34.173.162802361&2 3Q' ossec11301gNew FTP connection.Mar 27 13:19:00 vm1 pure-ftpd[3935179]: (?@104.152.52.31) [INFO] New connection from 104.152.52.31104.152.52.316252001W1  -9) ossec13001gExim Auth failed2025-03-27 13:14:20 dovecot_plain authenticator failed for ([183.100.18.224]) [183.100.18.224]:51368: 535 Incorrect authentication data (set_id=sales)183.100.18.2241835841r0  -q' ossec13001gExim Auth failed2025-03-27 13:14:09 dovecot_plain authenticator failed for i15-les03-ix2-176-180-52-57.dsl.dyn.abo.bbox.fr [176.180.52.57]:42224: 535 Incorrect authentication data (set_id=sales)176.180.52.573017382z/  -' ossec13001gExim Auth failed2025-03-27 13:13:49 dovecot_plain authenticator failed for syn-068-184-049-166.res.spectrum.com [68.184.49.166]:33064: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)68.184.49.1666252001%.  3Q' ossec11301gaNew FTP connection.Mar 27 10:51:35 vm1 pure-ftpd[3900225]: (?@88.214.25.121) [INFO] New connection from 88.214.25.12188.214.25.1212921044%-  3Q' ossec11301gNew FTP connection.Mar 27 10:49:01 vm1 pure-ftpd[3899594]: (?@88.214.25.121) [INFO] New connection from 88.214.25.12188.214.25.1212921044,  Ug) ossec11001gDeferred login on the cpanel service[2025-03-27 10:41:41 +0530] info [webmaild] 157.38.248.228 - kps@amplifypowerglobal.com "POST /cpsess1839481662/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [157.38.212.223] != Current IP Address [157.38.248.228]157.38.248.2281269750 H"E Z  - @ _-?XlH+O  3Y+ ossec11301gANew FTP connection.Mar 27 17:46:45 vm1 pure-ftpd[3990453]: (?@172.202.117.217) [INFO] New connection from 172.202.117.217172.202.117.2176252001qN  -m) ossec13001g>Exim Auth failed2025-03-27 17:31:17 dovecot_login authenticator failed for (s2seducationtrust.com) [101.89.140.209]:42374: 535 Incorrect authentication data (set_id=info@s2seducationtrust.com)101.89.140.2091814991^M  -G) ossec13001g=Exim Auth failed2025-03-27 17:30:50 dovecot_login authenticator failed for (s2seducationtrust.com) [101.89.140.209]:38282: 535 Incorrect authentication data (set_id=nologin)101.89.140.2091814991WL  -9) ossec13001g8Exim Auth failed2025-03-27 17:05:52 dovecot_login authenticator failed for ([128.185.224.87]) [152.52.243.154]:50126: 535 Incorrect authentication data (set_id=sales)152.52.243.1541269750iK  -[+ ossec13001g7Exim Auth failed2025-03-27 17:05:14 dovecot_login authenticator failed for (tagsdev.click) [199.188.103.179]:36996: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)199.188.103.1796252001RJ  -3% ossec13001g7jExim Auth failed2025-03-27 17:02:57 dovecot_plain authenticator failed for ([203.29.84.253]) [203.63.46.34]:11935: 535 Incorrect authentication data (set_id=sales)203.63.46.342077456hI  -_' ossec13001g7\Exim Auth failed2025-03-27 17:02:42 dovecot_plain authenticator failed for ([196.191.212.226]) [213.55.85.202]:11988: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)213.55.85.202337996cH  -Q) ossec13001g5Exim Auth failed2025-03-27 16:53:04 dovecot_login authenticator failed for 110-25-104-101.adsl.fetnet.net [110.25.104.101]:49420: 535 Incorrect authentication data (set_id=apple)110.25.104.1011668284jG  -_) ossec13001g5 Exim Auth failed2025-03-27 16:52:52 dovecot_login authenticator failed for ([123.209.107.18]) [123.209.107.18]:36032: 535 Incorrect authentication data (set_id=apple@heipowersystem.com)123.209.107.182077456.F  =W) ossec13008g0Mail Reciepient rejected2025-03-27 16:34:27 H=(mail.msnews24.in) [165.154.228.93]:56375 F= rejected RCPT : Rejected relay attempt: '165.154.228.93' From: 'gdxefpv@msnews24.in' To: 'extradomcom@fastmail.com'165.154.228.931643084]E  -E) ossec13001g0Exim Auth failed2025-03-27 16:34:02 dovecot_login authenticator failed for (client.fttb.2day.kz) [176.222.190.69]:60404: 535 Incorrect authentication data (set_id=services)176.222.190.691522867iD  -a% ossec13001g0Exim Auth failed2025-03-27 16:33:38 dovecot_login authenticator failed for ([112.29.109.174]) [112.30.127.9]:43700: 535 Incorrect authentication data (set_id=services@heipowersystem.com)112.30.127.91814991%C  3Q' ossec11301g-3New FTP connection.Mar 27 16:19:22 vm1 pure-ftpd[3972801]: (?@20.64.104.164) [INFO] New connection from 20.64.104.16420.64.104.1646252001%B  3Q' ossec11301g,New FTP connection.Mar 27 16:17:56 vm1 pure-ftpd[3972586]: (?@104.152.52.29) [INFO] New connection from 104.152.52.29104.152.52.296252001WA  -9) ossec13001g)Exim Auth failed2025-03-27 16:05:39 dovecot_plain authenticator failed for ([211.51.140.148]) [211.51.140.148]:50554: 535 Incorrect authentication data (set_id=sales)211.51.140.1481835841g@  -[' ossec13001g)Exim Auth failed2025-03-27 16:05:10 dovecot_plain authenticator failed for ([182.90.207.82]) [182.90.207.82]:52429: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)182.90.207.821814991Y? -=' ossec13001g"Exim Auth failed2025-03-27 15:35:17 dovecot_login authenticator failed for (gurukuljaipur.com) [221.229.216.1]:57478: 535 Incorrect authentication data (set_id=nologin)221.229.216.11814991Z>  -=+ ossec13001g?Exim Auth failed2025-03-27 15:19:50 dovecot_login authenticator failed for ([103.106.154.137]) [103.106.154.137]:40892: 535 Incorrect authentication data (set_id=sales)103.106.154.1371269750 % K v 2W/,Q`Ha  -%! ossec13001gExim Auth failed2025-03-27 22:51:05 dovecot_login authenticator failed for ([2.57.219.14]) [2.57.219.2]:48634: 535 Incorrect authentication data (set_id=ya)2.57.219.2614540m`  -g) ossec13001gExim Auth failed2025-03-27 22:50:53 dovecot_login authenticator failed for (82.193.121.147.ipnet.ua) [82.193.121.147]:45282: 535 Incorrect authentication data (set_id=ya@heipowersystem.com)82.193.121.147690791W_  -;' ossec13001g兺Exim Auth failed2025-03-27 22:37:06 dovecot_plain authenticator failed for ([154.12.182.87]) [154.12.182.87]:50594: 535 Incorrect authentication data (set_id=services)154.12.182.871861060^  - ) ossec13001g兮Exim Auth failed2025-03-27 22:36:53 dovecot_plain authenticator failed for c-69-242-149-240.hsd1.mo.comcast.net [69.242.149.240]:36360: 535 Incorrect authentication data (set_id=services@heipowersystem.com)69.242.149.2406252001%]  3Q' ossec11301gkNew FTP connection.Mar 27 22:27:13 vm1 pure-ftpd[4044598]: (?@198.235.24.93) [INFO] New connection from 198.235.24.93198.235.24.936252001w\  -{' ossec13001gGExim Auth failed2025-03-27 22:22:22 dovecot_login authenticator failed for (amplifypowerglobal.com) [111.56.54.202]:33186: 535 Incorrect authentication data (set_id=postmaster@amplifypowerglobal.com)111.56.54.2021814991][  -G' ossec13001g-Exim Auth failed2025-03-27 22:21:56 dovecot_login authenticator failed for (amplifypowerglobal.com) [111.56.54.202]:57408: 535 Incorrect authentication data (set_id=nologin)111.56.54.2021814991Z  3I# ossec11301gxnNew FTP connection.Mar 27 21:40:20 vm1 pure-ftpd[4035672]: (?@65.49.20.66) [INFO] New connection from 65.49.20.6665.49.20.666252001WY  -9) ossec13001giExim Auth failed2025-03-27 20:37:29 dovecot_login authenticator failed for ([118.36.234.156]) [118.36.234.156]:47742: 535 Incorrect authentication data (set_id=sales)118.36.234.1561835841jX  -_) ossec13001giExim Auth failed2025-03-27 20:37:09 dovecot_login authenticator failed for ([175.202.82.251]) [175.202.82.251]:44126: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)175.202.82.2511835841TW  -5' ossec13001gR\Exim Auth failed2025-03-27 18:57:54 dovecot_plain authenticator failed for ([223.184.0.249]) [223.184.0.249]:43062: 535 Incorrect authentication data (set_id=sales)223.184.0.2491269750gV  -[' ossec13001gRLExim Auth failed2025-03-27 18:57:39 dovecot_plain authenticator failed for ([70.105.245.21]) [70.105.245.21]:56822: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)70.105.245.216252001+U  3Y+ ossec11301gHNew FTP connection.Mar 27 18:17:00 vm1 pure-ftpd[3996755]: (?@162.142.125.206) [INFO] New connection from 162.142.125.206162.142.125.2066252001`T  -Q# ossec13001gGrExim Auth failed2025-03-27 18:11:21 dovecot_login authenticator failed for (nyaystambh.com) [14.18.77.99]:36774: 535 Incorrect authentication data (set_id=support@nyaystambh.com)14.18.77.991814991QS  -3# ossec13001gGVExim Auth failed2025-03-27 18:10:54 dovecot_login authenticator failed for (nyaystambh.com) [14.18.77.99]:33138: 535 Incorrect authentication data (set_id=nologin)14.18.77.991814991VR  -7) ossec13001gDExim Auth failed2025-03-27 18:00:45 dovecot_plain authenticator failed for ([175.214.52.214]) [175.214.52.214]:9697: 535 Incorrect authentication data (set_id=sales)175.214.52.2141835841TQ  -5' ossec13001gDExim Auth failed2025-03-27 18:00:34 dovecot_plain authenticator failed for ([61.153.208.38]) [61.153.208.38]:24826: 535 Incorrect authentication data (set_id=sales)61.153.208.381814991P  -+ ossec13001gDExim Auth failed2025-03-27 18:00:14 dovecot_plain authenticator failed for 165.199.148.122.sta.wbroadband.net.au [122.148.199.165]:44095: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)122.148.199.1652077456 %7  h \&*t  =O) ossec13008gMail Reciepient rejected2025-03-28 01:07:33 H=(mail.msnews24.in) [165.154.210.52]:57559 F= rejected RCPT : Rejected relay attempt: '165.154.210.52' From: 'dpweo@msnews24.in' To: 'extradomcom@fastmail.com'165.154.210.521694008Ts  -5' ossec13001gExim Auth failed2025-03-28 00:28:10 dovecot_plain authenticator failed for 89-233-245-84.cust.bredband2.com [89.233.245.84]:55512: 535 Incorrect authentication data89.233.245.842661886jr  -a' ossec13001g埳Exim Auth failed2025-03-28 00:27:54 dovecot_plain authenticator failed for ([49.124.153.17]) [49.124.153.17]:58340: 535 Incorrect authentication data (set_id=services@heipowersystem.com)49.124.153.171733045"q  3M% ossec11301g垊New FTP connection.Mar 28 00:22:56 vm1 pure-ftpd[4069515]: (?@94.102.56.99) [INFO] New connection from 94.102.56.9994.102.56.992750405p  ?1 ossec1008g嚹Process exiting (killed).Mar 28 00:06:40 vm1 spamd[3747013]: spamd: server killed by SIGTERM, shutting down5o  =c+ ossec13008g嘁Mail Reciepient rejected2025-03-27 23:57:12 H=(mail.msnews24.in) [165.154.232.243]:50316 F= rejected RCPT : Rejected relay attempt: '165.154.232.243' From: 'uqfdwuvxx@msnews24.in' To: 'extradomcom@fastmail.com'165.154.232.24316056515n  Ac) ossec11302gFTP Authentication failed.Mar 27 23:37:08 vm1 pure-ftpd[4058706]: (?@77.125.143.185) [WARNING] Authentication failed for user [admin]77.125.143.1852946406m Ac) ossec11302g哚FTP Authentication failed.Mar 27 23:36:17 vm1 pure-ftpd[4058547]: (?@77.125.143.185) [WARNING] Authentication failed for user [admin]77.125.143.185294640(l 3U) ossec11301g哖 New FTP connection.Mar 27 23:36:11 vm1 pure-ftpd[4058547]: (?@77.125.143.185) [INFO] New connection from 77.125.143.18577.125.143.1852946409k  Ic) ossec11331g Stealth FTP brute force attackMar 27 23:37:03 vm1 pure-ftpd[4058652]: (?@77.125.143.185) [WARNING] Authentication failed for user [admin]77.125.143.185294640Aj  gU) ossec11307g哾Multiple connection attempts from same sourceMar 27 23:36:52 vm1 pure-ftpd[4058636]: (?@77.125.143.185) [INFO] New connection from 77.125.143.18577.125.143.185294640Zi  c) ossec11321g哶Active Response. FTP brute force attack (Port 21 is protected)Mar 27 23:36:45 vm1 pure-ftpd[4058599]: (?@77.125.143.185) [WARNING] Authentication failed for user [admin]77.125.143.185294640h  S) ossec211321g哶Preventing FTP brute force attempt.[Active Response] is disabled for rule 11321. Greylisting 77.125.143.18577.125.143.185294640pg  -i+ ossec13001gExim Auth failed2025-03-27 23:33:13 dovecot_plain authenticator failed for ([116.127.143.140]) [116.127.143.140]:58008: 535 Incorrect authentication data (set_id=services@heipowersystem.com)116.127.143.1401835841gf  -]% ossec13001g咳Exim Auth failed2025-03-27 23:32:26 dovecot_plain authenticator failed for ([223.84.12.30]) [223.84.12.30]:60428: 535 Incorrect authentication data (set_id=services@heipowersystem.com)223.84.12.301814991"e  3M% ossec11301g吓New FTP connection.Mar 27 23:23:22 vm1 pure-ftpd[4055870]: (?@103.203.59.5) [INFO] New connection from 103.203.59.5103.203.59.51814991'd  3U) ossec11301gNew FTP connection.Mar 27 23:03:55 vm1 pure-ftpd[4051688]: (?@77.125.143.185) [INFO] New connection from 77.125.143.18577.125.143.185294640jc  -c% ossec13001gmExim Auth failed2025-03-27 23:01:25 dovecot_login authenticator failed for (heipowersystem.com) [60.2.243.174]:37436: 535 Incorrect authentication data (set_id=contact@heipowersystem.com)60.2.243.1741814991Wb  -=% ossec13001gOExim Auth failed2025-03-27 23:00:55 dovecot_login authenticator failed for (heipowersystem.com) [60.2.243.174]:34552: 535 Incorrect authentication data (set_id=nologin)60.2.243.1741814991 "4 .Z_  -K' ossec13001gΊExim Auth failed2025-03-28 03:47:45 dovecot_plain authenticator failed for ([116.237.85.95]) [223.166.75.68]:48458: 535 Incorrect authentication data (set_id=vikas.khandelwal)223.166.75.681814991u  -u) ossec13001gzExim Auth failed2025-03-28 03:47:29 dovecot_plain authenticator failed for ([171.244.185.15]) [171.244.185.15]:50054: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)171.244.185.151562822@  _/'1modsec77350470gIM360 WAF: Vulnerability scanner detectedIM360 WAF: Vulnerability scanner detected||RSV:6.80||T:APACHE||ResponseStatus:0||205.210.31.896252001vm1.technobases.inP  -1% ossec13001gExim Auth failed2025-03-28 03:06:41 dovecot_login authenticator failed for ([41.72.201.170]) [41.72.202.86]:48562: 535 Incorrect authentication data (set_id=mark)41.72.202.86192950i  -]) ossec13001gExim Auth failed2025-03-28 03:06:30 dovecot_login authenticator failed for ([61.191.163.102]) [61.191.163.102]:47542: 535 Incorrect authentication data (set_id=mark@heipowersystem.com)61.191.163.1021814991%  3Q' ossec11301gåNew FTP connection.Mar 28 03:01:16 vm1 pure-ftpd[4102238]: (?@199.45.155.95) [INFO] New connection from 199.45.155.95199.45.155.956252001k  -a) ossec13001gExim Auth failed2025-03-28 02:36:19 dovecot_login authenticator failed for (heipowersystem.com) [101.89.140.209]:35982: 535 Incorrect authentication data (set_id=info@heipowersystem.com)101.89.140.2091814991[~  -A) ossec13001g影Exim Auth failed2025-03-28 02:35:52 dovecot_login authenticator failed for (heipowersystem.com) [101.89.140.209]:60178: 535 Incorrect authentication data (set_id=nologin)101.89.140.20918149910}  =[) ossec13008g幔Mail Reciepient rejected2025-03-28 02:18:19 H=(mail.msnews24.in) [165.154.228.93]:61161 F= rejected RCPT : Rejected relay attempt: '165.154.228.93' From: 'uumzucvw@msnews24.in' To: 'extradomcom@fastmail.com'165.154.228.931643084i|  -_' ossec13001g幎Exim Auth failed2025-03-28 02:18:14 dovecot_plain authenticator failed for 179-189-85-66.goldnettelecom.com.br [179.189.85.66]:39714: 535 Incorrect authentication data (set_id=services)179.189.85.663469034l{  -c) ossec13001g幂Exim Auth failed2025-03-28 02:18:01 dovecot_plain authenticator failed for ([61.164.202.219]) [61.164.202.218]:8965: 535 Incorrect authentication data (set_id=services@heipowersystem.com)61.164.202.2181814991z  W% ossec9708g\Dovecot Aborted Login with empty userMar 28 02:13:07 vm1 dovecot[2184869]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 2 secs): user=<>, rip=71.6.134.232, lip=103.74.54.108, TLS, session=71.6.134.2326252001Zy  -=+ ossec13001g3Exim Auth failed2025-03-28 01:55:21 dovecot_login authenticator failed for ([178.216.165.187]) [178.216.165.187]:36266: 535 Incorrect authentication data (set_id=sales)178.216.165.1872017370gx  -[' ossec13001g(Exim Auth failed2025-03-28 01:55:12 dovecot_login authenticator failed for ([223.71.98.202]) [223.71.98.202]:47451: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)223.71.98.2021814991%w  3Q' ossec11301g^New FTP connection.Mar 28 01:43:16 vm1 pure-ftpd[4086116]: (?@167.94.145.97) [INFO] New connection from 167.94.145.97167.94.145.976252001jv  -a' ossec13001g嬔Exim Auth failed2025-03-28 01:22:51 dovecot_plain authenticator failed for ([211.57.111.99]) [211.57.111.99]:58594: 535 Incorrect authentication data (set_id=services@heipowersystem.com)211.57.111.991835841Zu  -?) ossec13001g嬞Exim Auth failed2025-03-28 01:23:01 dovecot_plain authenticator failed for ([117.158.166.73]) [117.158.166.73]:14650: 535 Incorrect authentication data (set_id=services)117.158.166.731814991  . S A(m#etT  -7% ossec13001g[Exim Auth failed2025-03-28 05:03:46 dovecot_plain authenticator failed for ([106.3.192.21]) [106.3.192.21]:42458: 535 Incorrect authentication data (set_id=services)106.3.192.211814991m  -e) ossec13001gMExim Auth failed2025-03-28 05:03:31 dovecot_plain authenticator failed for ([112.172.189.90]) [112.172.189.90]:40940: 535 Incorrect authentication data (set_id=services@heipowersystem.com)112.172.189.901835841:  Ia+ ossec11331g޾ Stealth FTP brute force attackMar 28 04:56:52 vm1 pure-ftpd[4126562]: (?@140.224.147.210) [WARNING] Authentication failed for user [www]140.224.147.2101814991E  gY+ ossec11307g޲Multiple connection attempts from same sourceMar 28 04:56:42 vm1 pure-ftpd[4126550]: (?@140.224.147.210) [INFO] New connection from 140.224.147.210140.224.147.2101814991[  a+ ossec11321gޮActive Response. FTP brute force attack (Port 21 is protected)Mar 28 04:56:36 vm1 pure-ftpd[4126499]: (?@140.224.147.210) [WARNING] Authentication failed for user [www]140.224.147.2101814991  S+ ossec211321gޮPreventing FTP brute force attempt.[Active Response] is disabled for rule 11321. Greylisting 140.224.147.210140.224.147.21018149917 Aa+ ossec11302gޔFTP Authentication failed.Mar 28 04:56:12 vm1 pure-ftpd[4126411]: (?@140.224.147.210) [WARNING] Authentication failed for user [www]140.224.147.2101814991, 3Y+ ossec11301gގNew FTP connection.Mar 28 04:56:06 vm1 pure-ftpd[4126411]: (?@140.224.147.210) [INFO] New connection from 140.224.147.210140.224.147.21018149916  Aa+ ossec11302gތFTP Authentication failed.Mar 28 04:56:04 vm1 pure-ftpd[4126380]: (?@140.224.147.210) [WARNING] Authentication failed for user [www]140.224.147.2101814991+  3Y+ ossec11301gވNew FTP connection.Mar 28 04:55:59 vm1 pure-ftpd[4126380]: (?@140.224.147.210) [INFO] New connection from 140.224.147.210140.224.147.2101814991+  3Y+ ossec11301gDNew FTP connection.Mar 28 04:54:51 vm1 pure-ftpd[4126075]: (?@140.224.147.210) [INFO] New connection from 140.224.147.210140.224.147.2101814991o  -i) ossec13001grExim Auth failed2025-03-28 04:42:49 dovecot_plain authenticator failed for cm222-166-167-89.hkcable.com.hk [222.166.167.89]:59412: 535 Incorrect authentication data (set_id=vikas.khandelwal)222.166.167.891819730  -% ossec13001gaExim Auth failed2025-03-28 04:42:33 dovecot_plain authenticator failed for c-67-175-11-47.hsd1.il.comcast.net [67.175.11.47]:60774: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)67.175.11.476252001:  Ak) ossec11302g5FTP Authentication failed.Mar 28 04:24:43 vm1 pure-ftpd[4119558]: (?@118.194.250.60) [WARNING] Authentication failed for user [anonymous]118.194.250.601605651) 3U) ossec11301g-New FTP connection.Mar 28 04:24:34 vm1 pure-ftpd[4119550]: (?@118.194.250.60) [INFO] New connection from 118.194.250.60118.194.250.601605651W  -;' ossec13001gӀExim Auth failed2025-03-28 04:08:55 dovecot_plain authenticator failed for ([14.39.113.250]) [14.39.113.250]:43898: 535 Incorrect authentication data (set_id=services)14.39.113.2501835841g  -]% ossec13001gnExim Auth failed2025-03-28 04:08:37 dovecot_plain authenticator failed for ([103.68.10.51]) [103.68.10.51]:42238: 535 Incorrect authentication data (set_id=services@heipowersystem.com)103.68.10.511269750V  -?! ossec13001gExim Auth failed2025-03-28 03:49:45 dovecot_login authenticator failed for ([61.59.6.81]) [61.59.6.81]:46164: 535 Incorrect authentication data (set_id=vikas.khandelwal)61.59.6.811668284   -) ossec13001gExim Auth failed2025-03-28 03:49:31 dovecot_login authenticator failed for (customer.chcoilx1.pop.starlinkisp.net) [129.222.28.111]:3401: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)129.222.28.1116252001 *\~tj`VLB8.$zpf\H>4*   v l b X N D : 0 &    ~ t j ` V L B 8 . $    z p f \ R H > 4 *  vlbXND:0&|rh^TJ@6,"xndZPF<2( ~tj`VLB8.$zpf\ | r h ^ T J @ 6 , "    x n d Z P F < 2 (   RRH>4*  vlbXND:0& g2 gZ2 gP2 g82 g 2 g2 g2 g2 gd2 g2 g挂2 gz2 gn2 g2 g扥2 g扁2 gg2 g(2 g~2 g~2 gy2 gy 2 gve2 gvY2 gl1 gl1 gk1 gk1 gj1 gj1 gj1 ge1 ge1 gc1 gc1 gc1 gb1 g_1 g_n1 gXa1 gXP1 gR1 gR1 gPz1 gPp1 gM1 gM1 gHr1 gHf1 gG1 gG1 gCm1 gC`1 gB1 gB1 gB1 gB1 gB1 gB1 gA&1 g1 g61 g1 g1 g^1 gX1 gD1 g:1 g(1 g1 g1 gU1 gA1 gP1 gH1 g1 g1 g[1 gM1 g޾1 g޲1 gޮ1 gޮ1 gޔ1 gގ1 gތ1 gވ1 gD1 gr1 ga1 g51 g-1 gӀ1 gn1 g1 g1 gΊ1 gz1 g1 g1 g1 gå1 g1 g影1~ g幔1} g幎1| g幂1{ g\1z g31y g(1x g^1w g嬞1u g嬔1v g1t g1s g埳1r g垊1q g嚹1p g嘁1o g1n g22B g2A g32@ g!2? gf2> g82= g̼2< g̮2; g2: g29 g28 g27 g26 g¥25 g24 g23 g22 g溽21 g`20 gV2/ g泒2, g泆2. g泀2- g2+ g2* g2) g2( g2' g2& g2% gz2$ g>2" g42# gO2 gC2! g2 g2 g(2 g2 g2 g2 g晁2 g2 g1k g哾1j g哶1i g哶1h g哚1m g哖1l g1g g咳1f g吓1e g1d gm1c gO1b g1a g1` g兺1_ g兮1^ gk1] gG1\ g-1[ gxn1Z gi1Y gi1X gR\1W gRL1V gH1U gGr1T gGV1S gD1R gD1Q gD1P gA1O g>1N g=1M g81L g71K g7j1J g7\1I g51H g5 1G g01F g01E g01D gH2C g-31C g,1B g)1A g)1@ g"1? g?1> g'1= g1< gt1; gh1: g!19 g418 g(17 g 16 g 15 gp14 gl13 g12 g11 g10 g1/ ga1. g1- g1, g1+ g1* g31) g䯅1( gb1' gaS1& g[1% gI1$ g:F1# g1" g k1! g@1 g&1 g1 g81 g1 g61 g1 |   3 XjR<dn|n)  -k' ossec13001g>Exim Auth failed2025-03-28 06:32:54 dovecot_plain authenticator failed for (wcdma.178-76-69-221.moldcell.md) [178.76.69.221]:42956: 535 Incorrect authentication data (set_id=vikas.khandelwal)178.76.69.221617790r(  -q' ossec13001g6Exim Auth failed2025-03-28 06:32:45 dovecot_plain authenticator failed for ([82.208.71.101]) [82.208.71.101]:50094: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)82.208.71.1012017370T'  -5' ossec13001gExim Auth failed2025-03-28 06:05:40 dovecot_login authenticator failed for ([180.7.178.181]) [180.7.178.181]:39979: 535 Incorrect authentication data (set_id=bilgi)180.7.178.1811861060&  --+ ossec13001gExim Auth failed2025-03-28 06:05:20 dovecot_login authenticator failed for 186-247-193-126.user.veloxzone.com.br ([187.13.145.153]) [186.247.193.126]:37718: 535 Incorrect authentication data (set_id=bilgi@heipowersystem.com)186.247.193.1263469034:%  Ak) ossec11302g^FTP Authentication failed.Mar 28 05:59:17 vm1 pure-ftpd[4140756]: (?@35.240.127.158) [WARNING] Authentication failed for user [anonymous]35.240.127.1582802361)$ 3U) ossec11301gXNew FTP connection.Mar 28 05:59:10 vm1 pure-ftpd[4140754]: (?@35.240.127.158) [INFO] New connection from 35.240.127.15835.240.127.1582802361X#  -?' ossec13001gDExim Auth failed2025-03-28 05:58:51 dovecot_plain authenticator failed for ([196.191.212.226]) [213.55.85.202]:12062: 535 Incorrect authentication data (set_id=services)213.55.85.202337996j"  -a' ossec13001g:Exim Auth failed2025-03-28 05:58:41 dovecot_plain authenticator failed for ([120.157.8.131]) [120.157.8.131]:54242: 535 Incorrect authentication data (set_id=services@heipowersystem.com)120.157.8.1312077456_!  -K' ossec13001g(Exim Auth failed2025-03-28 05:54:07 dovecot_login authenticator failed for 31-151-70-150.dynamic.upc.nl [31.151.70.150]:51570: 535 Incorrect authentication data (set_id=sales)31.151.70.1502750405j  -_) ossec13001gExim Auth failed2025-03-28 05:53:57 dovecot_login authenticator failed for ([92.119.232.186]) [92.119.232.186]:46403: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)92.119.232.1863017382W -7) ossec13001gExim Auth failed2025-03-28 05:48:33 dovecot_login authenticator failed for (rokamauka.com) [42.193.105.109]:34396: 535 Incorrect authentication data (set_id=nologin)42.193.105.1091814991Y  -C# ossec13001gUExim Auth failed2025-03-28 05:37:47 dovecot_plain authenticator failed for ([218.86.7.65]) [218.86.7.65]:34166: 535 Incorrect authentication data (set_id=vikas.khandelwal)218.86.7.651814991{  -' ossec13001gAExim Auth failed2025-03-28 05:37:29 dovecot_plain authenticator failed for (mail.golfhotel-vesper.de) [195.52.244.84]:45636: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)195.52.244.842921044w  -{' ossec13001gPExim Auth failed2025-03-28 05:24:56 dovecot_login authenticator failed for cpc76956-warw17-2-0-cust761.3-2.cable.virginm.net [86.25.166.250]:59830: 535 Incorrect authentication data (set_id=services)86.25.166.2502635167  - + ossec13001gHExim Auth failed2025-03-28 05:24:47 dovecot_login authenticator failed for cpe-148-163-232-103.wireline.com.au [103.232.163.148]:48014: 535 Incorrect authentication data (set_id=services@heipowersystem.com)103.232.163.1482077456_  -O% ossec13001gExim Auth failed2025-03-28 05:06:12 dovecot_login authenticator failed for ([185.226.88.5]) [185.226.88.5]:33946: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)185.226.88.5783754   -!) ossec13001gExim Auth failed2025-03-28 05:05:55 dovecot_login authenticator failed for 80.111.168.125.sta.wbroadband.net.au [125.168.111.80]:33437: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)125.168.111.802077456 ;  ; h5;v:  -w) ossec13001g=Exim Auth failed2025-03-28 08:45:07 dovecot_login authenticator failed for (s2seducationtrust.com) [42.193.105.109]:43444: 535 Incorrect authentication data (set_id=webmaster@s2seducationtrust.com)42.193.105.1091814991W9  -;' ossec13001geExim Auth failed2025-03-28 08:45:49 dovecot_plain authenticator failed for ([183.6.118.248]) [183.6.118.248]:33961: 535 Incorrect authentication data (set_id=services)183.6.118.2481814991^8  -G) ossec13001g#Exim Auth failed2025-03-28 08:44:42 dovecot_login authenticator failed for (s2seducationtrust.com) [42.193.105.109]:58870: 535 Incorrect authentication data (set_id=nologin)42.193.105.1091814991q7  -k+ ossec13001gbExim Auth failed2025-03-28 08:24:24 dovecot_plain authenticator failed for (ws249-241-252-122.rcil.gov.in) [122.252.241.249]:53514: 535 Incorrect authentication data (set_id=vikas.khandelwal)122.252.241.24912697506  -' ossec13001gRExim Auth failed2025-03-28 08:24:09 dovecot_plain authenticator failed for 079.42.246.220.static.netvigator.com [220.246.42.79]:64005: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)220.246.42.791819730W5  -;' ossec13001gKExim Auth failed2025-03-28 07:49:55 dovecot_plain authenticator failed for ([203.195.208.77]) [116.31.248.75]:2229: 535 Incorrect authentication data (set_id=services)116.31.248.751814991m4  -e) ossec13001gAExim Auth failed2025-03-28 07:49:44 dovecot_plain authenticator failed for ([92.126.223.175]) [92.126.223.175]:34654: 535 Incorrect authentication data (set_id=services@heipowersystem.com)92.126.223.1752017370(3  3U) ossec11301gNew FTP connection.Mar 28 07:36:04 vm1 pure-ftpd[4161688]: (?@45.227.254.156) [INFO] New connection from 45.227.254.15645.227.254.156370343032  =_+ ossec13008g\Mail Reciepient rejected2025-03-28 07:33:07 H=(mail.msnews24.in) [165.154.232.243]:49568 F= rejected RCPT : Rejected relay attempt: '165.154.232.243' From: 'rhpltelp@msnews24.in' To: 'extradomcom@fastmail.com'165.154.232.2431605651p1  -m' ossec13001gZExim Auth failed2025-03-28 07:28:49 dovecot_plain authenticator failed for 24.115.19.225.res-cmts.sm3.ptd.net [24.115.19.225]:57928: 535 Incorrect authentication data (set_id=vikas.khandelwal)24.115.19.2256252001x0  -y+ ossec13001gPExim Auth failed2025-03-28 07:28:38 dovecot_plain authenticator failed for ([128.106.196.150]) [128.106.196.150]:43778: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)128.106.196.1501880251(/  3U) ossec11301g%New FTP connection.Mar 28 07:15:08 vm1 pure-ftpd[4157393]: (?@167.94.138.125) [INFO] New connection from 167.94.138.125167.94.138.1256252001W.  -9) ossec13001g7Exim Auth failed2025-03-28 07:11:09 dovecot_login authenticator failed for ([200.106.49.149]) [200.106.49.149]:57238: 535 Incorrect authentication data (set_id=sales)200.106.49.1493932488`-  -S# ossec13001g'Exim Auth failed2025-03-28 07:10:54 dovecot_login authenticator failed for ([5.32.22.218]) [5.32.22.218]:55812: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)5.32.22.218290557g,  -[' ossec13001ghExim Auth failed2025-03-28 07:03:28 dovecot_plain authenticator failed for ([45.61.161.182]) [45.61.161.182]:56748: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)45.61.161.1822921044,+ Q?' ossec11000g~Login failed on the cpanel service[2025-03-28 07:03:50 +0530] info [webmaild] 45.61.161.182 - sales@heipowersystem.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)45.61.161.1822921044g*  -]% ossec13001g8Exim Auth failed2025-03-28 06:54:07 dovecot_plain authenticator failed for ([58.16.91.144]) [58.16.91.144]:52931: 535 Incorrect authentication data (set_id=services@heipowersystem.com)58.16.91.1441814991 f ) ; Z` fPH U) ossec11001g kDeferred login on the cpanel service[2025-03-28 09:37:06 +0530] info [whostmgrd] 106.206.184.66 - root "GET /cpsess2507502720/json-api/loadavg HTTP/1.1" DEFERRED LOGIN whostmgrd: cookie ip check: IP address has changed: IP Address [106.206.152.88] != Current IP Address [106.206.184.66]106.206.184.661269750OG  U) ossec11001g ]Deferred login on the cpanel service[2025-03-28 09:36:52 +0530] info [whostmgrd] 106.206.184.66 - root "GET /cpsess2507502720/json-api/loadavg HTTP/1.1" DEFERRED LOGIN whostmgrd: cookie ip check: IP address has changed: IP Address [106.206.152.88] != Current IP Address [106.206.184.66]106.206.184.661269750OF  U) ossec11001gDeferred login on the cpanel service[2025-03-28 09:26:51 +0530] info [whostmgrd] 106.206.184.66 - root "GET /cpsess2507502720/json-api/loadavg HTTP/1.1" DEFERRED LOGIN whostmgrd: cookie ip check: IP address has changed: IP Address [106.206.152.88] != Current IP Address [106.206.184.66]106.206.184.661269750OE  U) ossec11001gDeferred login on the cpanel service[2025-03-28 09:25:14 +0530] info [whostmgrd] 106.206.184.66 - root "GET /cpsess2507502720/json-api/loadavg HTTP/1.1" DEFERRED LOGIN whostmgrd: cookie ip check: IP address has changed: IP Address [106.206.152.88] != Current IP Address [106.206.184.66]106.206.184.661269750OD  U) ossec11001gvDeferred login on the cpanel service[2025-03-28 09:24:29 +0530] info [whostmgrd] 106.206.184.66 - root "GET /cpsess2507502720/json-api/loadavg HTTP/1.1" DEFERRED LOGIN whostmgrd: cookie ip check: IP address has changed: IP Address [106.206.152.88] != Current IP Address [106.206.184.66]106.206.184.661269750PC U) ossec11001gDeferred login on the cpanel service[2025-03-28 09:22:30 +0530] info [whostmgrd] 106.206.184.66 - root "GET /cpsess2507502720/json-api/loadavg HTTP/1.1" DEFERRED LOGIN whostmgrd: cookie ip check: IP address has changed: IP Address [106.206.152.88] != Current IP Address [106.206.184.66]106.206.184.661269750PB U) ossec11001gDeferred login on the cpanel service[2025-03-28 09:21:43 +0530] info [whostmgrd] 106.206.184.66 - root "GET /cpsess2507502720/json-api/loadavg HTTP/1.1" DEFERRED LOGIN whostmgrd: cookie ip check: IP address has changed: IP Address [106.206.152.88] != Current IP Address [106.206.184.66]106.206.184.661269750pA  -o% ossec13001gWExim Auth failed2025-03-28 09:19:42 dovecot_plain authenticator failed for syn-074-070-139-017.res.spectrum.com [74.70.139.17]:51100: 535 Incorrect authentication data (set_id=vikas.khandelwal)74.70.139.176252001r@  -q' ossec13001gKExim Auth failed2025-03-28 09:19:31 dovecot_plain authenticator failed for ([124.93.12.184]) [124.93.12.184]:59155: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)124.93.12.1841814991?  3I# ossec11301gNew FTP connection.Mar 28 09:13:05 vm1 pure-ftpd[4182329]: (?@65.49.20.66) [INFO] New connection from 65.49.20.6665.49.20.666252001j>  -a' ossec13001gExim Auth failed2025-03-28 09:04:20 dovecot_login authenticator failed for ([185.77.238.39]) [185.77.238.39]:49536: 535 Incorrect authentication data (set_id=helpdesk@heipowersystem.com)185.77.238.392017370Y=  -?) ossec13001gExim Auth failed2025-03-28 09:04:37 dovecot_login authenticator failed for ([87.200.232.247]) [87.200.232.247]:60566: 535 Incorrect authentication data (set_id=helpdesk)87.200.232.247290557w<  -{' ossec13001gwExim Auth failed2025-03-28 08:46:06 dovecot_plain authenticator failed for (150.54.169.61.dial.xw.sh.dynamic.163data.com.cn) [61.169.54.150]:54783: 535 Incorrect authentication data (set_id=services)61.169.54.1501814991{;  -' ossec13001gEExim Auth failed2025-03-28 08:45:15 dovecot_plain authenticator failed for 81-230-83-162-no600.tbcn.telia.com [81.230.83.162]:37023: 535 Incorrect authentication data (set_id=services@heipowersystem.com)81.230.83.1622661886 l( t i`jjlzY  -) ossec13001g;ZExim Auth failed2025-03-28 11:32:02 dovecot_plain authenticator failed for (sr-25-135-140-118-on-nets.com) [118.140.135.25]:30962: 535 Incorrect authentication data (set_id=services@heipowersystem.com)118.140.135.251819730 X  W#+ ossec9708g9Dovecot Aborted Login with empty userMar 28 11:22:04 vm1 dovecot[2184869]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=185.247.137.191, lip=103.74.54.108, TLS, session=185.247.137.191298795XW  -C# ossec13001g6_Exim Auth failed2025-03-28 11:10:46 dovecot_plain authenticator failed for ([5.30.215.71]) [5.30.215.71]:59991: 535 Incorrect authentication data (set_id=vikas.khandelwal)5.30.215.71290557rV  -q' ossec13001g6UExim Auth failed2025-03-28 11:10:36 dovecot_plain authenticator failed for ([31.173.20.146]) [31.173.20.146]:54826: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)31.173.20.1462017370#U  3M' ossec11301g5New FTP connection.Mar 28 11:07:32 vm1 pure-ftpd[13312]: (?@198.235.24.44) [INFO] New connection from 198.235.24.44198.235.24.4462520016T  Ae' ossec11302g5tFTP Authentication failed.Mar 28 11:06:51 vm1 pure-ftpd[13156]: (?@118.26.104.78) [WARNING] Authentication failed for user [anonymous]118.26.104.782635167$S 3M' ossec11301g5\New FTP connection.Mar 28 11:06:27 vm1 pure-ftpd[13115]: (?@118.26.104.78) [INFO] New connection from 118.26.104.78118.26.104.782635167/R  AY% ossec11302g/_FTP Authentication failed.Mar 28 10:40:53 vm1 pure-ftpd[7113]: (?@27.59.84.104) [WARNING] Authentication failed for user [guest]27.59.84.1041269750Q  3G% ossec11301g/YNew FTP connection.Mar 28 10:40:47 vm1 pure-ftpd[7113]: (?@27.59.84.104) [INFO] New connection from 27.59.84.10427.59.84.1041269750ZP  -?) ossec13001g.LExim Auth failed2025-03-28 10:36:20 dovecot_plain authenticator failed for ([203.193.147.41]) [203.193.147.37]:56053: 535 Incorrect authentication data (set_id=services)203.193.147.371269750mO  -e) ossec13001g.2Exim Auth failed2025-03-28 10:35:54 dovecot_plain authenticator failed for ([75.144.210.178]) [75.144.210.178]:52348: 535 Incorrect authentication data (set_id=services@heipowersystem.com)75.144.210.1786252001bN  -S% ossec13001g)KExim Auth failed2025-03-28 10:14:58 dovecot_plain authenticator failed for dns1.prodatanet.com.ph [202.71.176.2]:58869: 535 Incorrect authentication data (set_id=vikas.khandelwal)202.71.176.21694008 M  -+ ossec13001g);Exim Auth failed2025-03-28 10:14:43 dovecot_plain authenticator failed for syn-208-105-196-214.biz.spectrum.com [208.105.196.214]:58286: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)208.105.196.2146252001PL U) ossec11001g"Deferred login on the cpanel service[2025-03-28 09:44:12 +0530] info [whostmgrd] 106.206.184.66 - root "GET /cpsess2507502720/json-api/loadavg HTTP/1.1" DEFERRED LOGIN whostmgrd: cookie ip check: IP address has changed: IP Address [106.206.152.88] != Current IP Address [106.206.184.66]106.206.184.661269750OK  U) ossec11001g!sDeferred login on the cpanel service[2025-03-28 09:41:29 +0530] info [whostmgrd] 106.206.184.66 - root "GET /cpsess2507502720/json-api/loadavg HTTP/1.1" DEFERRED LOGIN whostmgrd: cookie ip check: IP address has changed: IP Address [106.206.152.88] != Current IP Address [106.206.184.66]106.206.184.661269750ZJ  -?) ossec13001g!OExim Auth failed2025-03-28 09:40:55 dovecot_plain authenticator failed for ([122.170.14.161]) [122.170.14.161]:43102: 535 Incorrect authentication data (set_id=services)122.170.14.1611269750vI  -}# ossec13001g!CExim Auth failed2025-03-28 09:40:42 dovecot_plain authenticator failed for c-24-7-216-47.hsd1.mn.comcast.net [24.7.216.47]:50336: 535 Incorrect authentication data (set_id=services@heipowersystem.com)24.7.216.476252001 ' J 2 />g[yrk  -q' ossec13001gPpExim Auth failed2025-03-28 13:02:00 dovecot_plain authenticator failed for ([196.28.226.66]) [196.28.226.66]:47173: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)196.28.226.661036973^j  -K' ossec13001gMExim Auth failed2025-03-28 12:50:03 dovecot_login authenticator failed for ([77.137.130.12]) [77.137.130.12]:58657: 535 Incorrect authentication data (set_id=vikas.khandelwal)77.137.130.12294640i  -) ossec13001gMExim Auth failed2025-03-28 12:49:53 dovecot_login authenticator failed for (228.pool90-161-217.static.orange.es) [90.161.217.228]:33039: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)90.161.217.2282510769Sh  -7% ossec13001gHrExim Auth failed2025-03-28 12:27:54 dovecot_plain authenticator failed for ([87.200.181.5]) [87.200.181.5]:34790: 535 Incorrect authentication data (set_id=services)87.200.181.5290557mg  -e) ossec13001gHfExim Auth failed2025-03-28 12:27:41 dovecot_plain authenticator failed for ([50.188.204.213]) [50.188.204.213]:38410: 535 Incorrect authentication data (set_id=services@heipowersystem.com)50.188.204.2136252001Tf  -5' ossec13001gGExim Auth failed2025-03-28 12:24:32 dovecot_login authenticator failed for ([46.163.154.14]) [46.163.154.14]:47958: 535 Incorrect authentication data (set_id=sales)46.163.154.142017370|e  -) ossec13001gGExim Auth failed2025-03-28 12:24:15 dovecot_login authenticator failed for syn-173-095-123-220.biz.spectrum.com [173.95.123.220]:39343: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)173.95.123.2206252001ed  -S+ ossec13001gCmExim Auth failed2025-03-28 12:06:27 dovecot_plain authenticator failed for ([211.117.144.194]) [211.117.144.194]:48416: 535 Incorrect authentication data (set_id=vikas.khandelwal)211.117.144.1941835841uc  -u) ossec13001gC`Exim Auth failed2025-03-28 12:06:16 dovecot_plain authenticator failed for ([68.233.177.213]) [68.233.177.213]:35570: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)68.233.177.2136252001!b 3I% ossec11301gBNew FTP connection.Mar 28 12:04:26 vm1 pure-ftpd[25745]: (?@92.255.57.55) [INFO] New connection from 92.255.57.5592.255.57.551819730 a  3I% ossec11301gBNew FTP connection.Mar 28 12:04:26 vm1 pure-ftpd[25747]: (?@92.255.57.45) [INFO] New connection from 92.255.57.4592.255.57.4518197304`  Ac% ossec11302gBFTP Authentication failed.Mar 28 12:04:32 vm1 pure-ftpd[25749]: (?@92.255.57.55) [WARNING] Authentication failed for user [anonymous]92.255.57.551819730L_  -)# ossec13001gBExim Auth failed2025-03-28 12:03:54 dovecot_login authenticator failed for ([5.175.88.56]) [5.175.88.56]:55740: 535 Incorrect authentication data (set_id=irc)5.175.88.562017370h^  -[) ossec13001gBExim Auth failed2025-03-28 12:03:43 dovecot_login authenticator failed for ([211.51.140.148]) [211.51.140.148]:56782: 535 Incorrect authentication data (set_id=irc@heipowersystem.com)211.51.140.1481835841 ]  3I% ossec11301gBNew FTP connection.Mar 28 12:03:41 vm1 pure-ftpd[25573]: (?@92.255.57.61) [INFO] New connection from 92.255.57.6192.255.57.6118197305\  =c+ ossec13008gA&Mail Reciepient rejected2025-03-28 11:56:44 H=(mail.msnews24.in) [165.154.232.243]:60070 F= rejected RCPT : Rejected relay attempt: '165.154.232.243' From: 'rhzaqyhla@msnews24.in' To: 'extradomcom@fastmail.com'165.154.232.2431605651 [  3I% ossec11301g 1 $  { n a T G : -   w j ] P C 6 )    s f Y L ? 2 %  |obUH;.!xk^QD7*tgZM@3& uh[NA4' ~qdWJ=0>2 6252001@, 6252001;6 6252001;2 6252001; 6252001; 6252001; 6252001; 6252001; 6252001; 6252001; 6252001: 6252001: 6252001: 6252001: 6252001: 6252001: 6252001: 6252001: 6252001: 6252001: 6252001: 6252001: 6252001: 6252001:p 6252001:Z 6252001:Y 6252001:B 6252001:= 6252001:1 6252001:/ 6252001:. 6252001: 6252001: 6252001: 6252001@+ 6252001@* 6252001@) 6252001@( 6252001@ 6252001@ 6252001@ 6252001@ 6252001@ 6252001@ 6252001@ 6252001? 6252001? 6252001? 6252001? 6252001? 6252001? 6252001? 6252001? 6252001? 6252001? 6252001? 6252001? 6252001?v 6252001?k 6252001?; 6252001?2 6252001?$ 6252001?! 6252001? 6252001? 6252001? 6252001? 6252001? 6252001? 6252001? 6252001? 6252001? 6252001> 6252001> 6252001> 6252001> 6252001> 6252001> 6252001> 6252001> 6252001> 6252001> 6252001> 6252001> 6252001> 6252001> 6252001> 6252001> 6252001> 6252001> 6252001> 6252001>r 6252001>q 6252001>l 6252001>h 6252001>\ 6252001>X 6252001>M 6252001>: 6252001>. 6252001> 6252001> 6252001> 6252001> 6252001= 6252001= 6252001= 6252001= 6252001= 6252001= 6252001= 6252001= 6252001= 6252001= 6252001= 6252001= 6252001= 6252001= 6252001= 6252001= 6252001= 6252001= 6252001= 6252001= 6252001= 6252001= 6252001= 6252001= 6252001= 6252001= 6252001= 6252001= 6252001= 6252001= 6252001= 6252001= 6252001= 6252001= 6252001= 6252001= 6252001= 6252001=t 6252001=s 6252001=q 6252001=g 6252001=e 6252001=d 6252001=Z 6252001=L 6252001=H 6252001=5 6252001=4 6252001=3 6252001=2 6252001=1 6252001=0 6252001=/ 6252001=. 6252001=- 6252001=, 6252001=+ 6252001=* 6252001=) 6252001=( 6252001=' 6252001=& 6252001=% 6252001=$ 6252001=# 6252001= 6252001= 6252001= 6252001< 6252001< 6252001< 6252001< 6252001< 6252001< 6252001< 6252001< 6252001< 6252001< 6252001< 6252001< 6252001< 6252001< 6252001< 6252001 6252001<9 6252001<0 6252001<& 6252001<% 6252001<$ 6252001< 6252001< 6252001< 6252001< 6252001< 6252001< 6252001; 6252001; 6252001; 6252001; 6252001; 6252001; 6252001; 6252001; 6252001; 6252001; 6252001; 6252001; 6252001; 6252001; 6252001; 6252001; 6252001; 6252001; 6252001; 6252001; 6252001; 6252001; 6252001;~ 6252001;w 6252001;s 6252001;m 6252001;c 6252001;b 6252001;a 6252001;X 6252001;V 6252001;L  2 5 K B X`ld{  -S) ossec13001gjExim Auth failed2025-03-28 14:54:22 dovecot_login authenticator failed for 45-226-127-254.gilsonnet.com.br [45.226.127.254]:58970: 535 Incorrect authentication data (set_id=sales)45.226.127.2543469034Zz  -=+ ossec13001gjExim Auth failed2025-03-28 14:53:51 dovecot_login authenticator failed for ([179.181.133.153]) [179.181.133.153]:53969: 535 Incorrect authentication data (set_id=sales)179.181.133.1533469034^y  -O! ossec13001gjExim Auth failed2025-03-28 14:53:35 dovecot_login authenticator failed for ([78.36.2.54]) [78.36.2.54]:58860: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)78.36.2.542017370lx  -c) ossec13001geExim Auth failed2025-03-28 14:32:56 dovecot_plain authenticator failed for vps-45cb66f2.vps.ovh.net [135.125.204.13]:46568: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)135.125.204.133017382vw  -y' ossec13001geExim Auth failed2025-03-28 14:32:46 dovecot_plain authenticator failed for ([117.40.226.19]) [117.40.226.19]:43291: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)117.40.226.191814991Wv  -;' ossec13001gcExim Auth failed2025-03-28 14:24:46 dovecot_login authenticator failed for ([95.66.153.194]) [95.66.153.194]:54159: 535 Incorrect authentication data (set_id=services)95.66.153.1942017370du  -Y# ossec13001gcExim Auth failed2025-03-28 14:24:35 dovecot_login authenticator failed for ([58.214.8.10]) [58.214.8.10]:43326: 535 Incorrect authentication data (set_id=services@heipowersystem.com)58.214.8.101814991pt  -m) ossec13001gcExim Auth failed2025-03-28 14:21:17 dovecot_plain authenticator failed for 088156225124.unknown.vectranet.pl [88.156.225.124]:54570: 535 Incorrect authentication data (set_id=vikas.khandelwal)88.156.225.124798544ts  -u) ossec13001gbExim Auth failed2025-03-28 14:21:08 dovecot_plain authenticator failed for ([102.23.254.239]) [102.23.254.239]:59625: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)102.23.254.239953987fr  -W) ossec13001g_Exim Auth failed2025-03-28 14:06:21 dovecot_login authenticator failed for ([221.130.87.125]) [221.130.87.125]:41486: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)221.130.87.1251814991q  -' ossec13001g_nExim Auth failed2025-03-28 14:05:57 dovecot_login authenticator failed for 61-219-70-218.hinet-ip.hinet.net [61.219.70.218]:34082: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)61.219.70.2181668284fp  -W) ossec13001gXaExim Auth failed2025-03-28 13:35:51 dovecot_plain authenticator failed for 125-228-225-91.hinet-ip.hinet.net [125.228.225.91]:52265: 535 Incorrect authentication data (set_id=sales)125.228.225.911668284yo  -% ossec13001gXPExim Auth failed2025-03-28 13:35:35 dovecot_plain authenticator failed for 48.211.41.34.bc.googleusercontent.com [34.41.211.48]:52108: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)34.41.211.486252001hn  -a# ossec13001gRExim Auth failed2025-03-28 13:11:12 dovecot_plain authenticator failed for bl19-157-40.dsl.telepac.pt [2.80.157.40]:47502: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)2.80.157.402264397{m  -+ ossec13001gRExim Auth failed2025-03-28 13:11:02 dovecot_plain authenticator failed for ([111.206.233.34]) [123.118.101.233]:57106: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)123.118.101.2331814991_l  -K' ossec13001gPzExim Auth failed2025-03-28 13:02:10 dovecot_plain authenticator failed for ([5.181.208.182]) [5.181.208.182]:55934: 535 Incorrect authentication data (set_id=vikas.khandelwal)5.181.208.1822017370  % ; H b hl{fX  -=' ossec13001gnExim Auth failed2025-03-28 17:17:58 dovecot_plain authenticator failed for syn-024-097-253-246.biz.spectrum.com [24.97.253.246]:48609: 535 Incorrect authentication data24.97.253.2466252001a  -O) ossec13001gExim Auth failed2025-03-28 17:06:34 dovecot_plain authenticator failed for ([196.191.142.67]) [196.191.142.67]:59410: 535 Incorrect authentication data (set_id=vikas.khandelwal)196.191.142.67337996  --% ossec13001g扥Exim Auth failed2025-03-28 17:06:05 dovecot_plain authenticator failed for vps-79f20bfc.vps.ovh.net (ip193.ip-87-98-249.eu) [51.75.24.107]:52093: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)51.75.24.1073017382l  -c) ossec13001g扁Exim Auth failed2025-03-28 17:05:28 dovecot_login authenticator failed for (gurukuljaipur.com) [124.160.63.122]:15262: 535 Incorrect authentication data (set_id=service@gurukuljaipur.com)124.160.63.1221814991\  -A+ ossec13001ggExim Auth failed2025-03-28 17:05:02 dovecot_login authenticator failed for (gurukuljaipur.com) [202.107.197.211]:51906: 535 Incorrect authentication data (set_id=nologin)202.107.197.21118149919  =k+ ossec13008g(Mail Reciepient rejected2025-03-28 16:21:19 H=(mail.msnews24.in) [165.154.232.243]:54893 F= rejected RCPT : Rejected relay attempt: '165.154.232.243' From: 'qxdortpcvdk@msnews24.in' To: 'extradomcom@fastmail.com'165.154.232.2431605651T  -5' ossec13001g~Exim Auth failed2025-03-28 16:20:05 dovecot_plain authenticator failed for ([106.227.87.29]) [106.227.87.29]:47490: 535 Incorrect authentication data (set_id=sales)106.227.87.291814991m  -c+ ossec13001g~Exim Auth failed2025-03-28 16:19:52 dovecot_plain authenticator failed for ([188.114.151.158]) [188.114.151.158]:44925: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)188.114.151.1582623032x  -}' ossec13001gyExim Auth failed2025-03-28 15:55:24 dovecot_plain authenticator failed for 191.72.208.35.bc.googleusercontent.com [35.208.72.191]:39777: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)35.208.72.1916252001v  -y' ossec13001gy Exim Auth failed2025-03-28 15:55:14 dovecot_plain authenticator failed for ([95.220.25.124]) [95.220.25.124]:42648: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)95.220.25.1242017370b  -O) ossec13001gveExim Auth failed2025-03-28 15:43:57 dovecot_plain authenticator failed for ([193.168.158.74]) [193.168.158.74]:42448: 535 Incorrect authentication data (set_id=vikas.khandelwal)193.168.158.743144096o  -m% ossec13001gvYExim Auth failed2025-03-28 15:43:45 dovecot_plain authenticator failed for ([8.139.253.26]) [8.139.253.26]:60322: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)8.139.253.261814991f  -W) ossec13001glExim Auth failed2025-03-28 15:02:11 dovecot_login authenticator failed for nova-185-040-122-250.cpe.novanet.is [185.40.122.250]:40808: 535 Incorrect authentication data (set_id=pop)185.40.122.2502629691h~  -[) ossec13001glExim Auth failed2025-03-28 15:01:55 dovecot_login authenticator failed for ([117.157.246.26]) [117.157.246.26]:48758: 535 Incorrect authentication data (set_id=pop@heipowersystem.com)117.157.246.261814991e}  -U) ossec13001gkExim Auth failed2025-03-28 14:57:43 dovecot_plain authenticator failed for (pppoe-178-217-69-200.elcity.ru) [178.217.69.200]:59234: 535 Incorrect authentication data (set_id=sales)178.217.69.2002017370|  -' ossec13001gkExim Auth failed2025-03-28 14:57:30 dovecot_plain authenticator failed for (ip-107-12-61-200.static.silicanetworks.com) [200.61.12.107]:57663: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)200.61.12.1073865483  P W qy+_  -K' ossec13001gExim Auth failed2025-03-28 18:16:21 dovecot_login authenticator failed for ([120.192.29.74]) [120.192.29.74]:35377: 535 Incorrect authentication data (set_id=vikas.khandelwal)120.192.29.741814991u  -u) ossec13001gExim Auth failed2025-03-28 18:16:07 dovecot_login authenticator failed for ([123.209.97.105]) [123.209.97.105]:47226: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)123.209.97.1052077456'  3S) ossec11301g晁New FTP connection.Mar 28 18:13:44 vm1 pure-ftpd[110316]: (?@20.169.104.204) [INFO] New connection from 20.169.104.20420.169.104.2046252001d  -W' ossec13001gExim Auth failed2025-03-28 18:02:21 dovecot_login authenticator failed for ([91.75.105.190]) [91.75.105.190]:55762: 535 Incorrect authentication data (set_id=tss@heipowersystem.com)91.75.105.190290557Q  -1% ossec13001gExim Auth failed2025-03-28 18:02:15 dovecot_login authenticator failed for 111-70-11-38.emome-ip.hinet.net [111.70.11.38]:56547: 535 Incorrect authentication data111.70.11.381668284b  -Q' ossec13001gZExim Auth failed2025-03-28 17:43:14 dovecot_plain authenticator failed for 42-200-70-134.static.imsbiz.com [42.200.70.134]:50100: 535 Incorrect authentication data (set_id=sales)42.200.70.1341819730d  -W% ossec13001gPExim Auth failed2025-03-28 17:43:03 dovecot_plain authenticator failed for ([182.76.71.82]) [182.76.71.82]:39130: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)182.76.71.821269750Q  -1% ossec13001g8Exim Auth failed2025-03-28 17:42:39 dovecot_login authenticator failed for ([144.48.49.68]) [144.48.49.68]:45251: 535 Incorrect authentication data (set_id=sales)144.48.49.681269750j  -_) ossec13001g Exim Auth failed2025-03-28 17:41:56 dovecot_login authenticator failed for ([116.114.84.242]) [116.114.84.242]:33928: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)116.114.84.2421814991t  -s) ossec13001gExim Auth failed2025-03-28 17:41:38 dovecot_login authenticator failed for syn-067-242-117-151.res.spectrum.com [67.242.117.151]:38016: 535 Incorrect authentication data (set_id=vikas.khandelwal)67.242.117.1516252001b  -O) ossec13001gExim Auth failed2025-03-28 17:41:27 dovecot_login authenticator failed for ([220.182.11.126]) [220.182.11.126]:40746: 535 Incorrect authentication data (set_id=vikas.khandelwal)220.182.11.1261814991u  -u) ossec13001gExim Auth failed2025-03-28 17:41:03 dovecot_login authenticator failed for ([188.126.240.80]) [188.126.240.80]:54962: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)188.126.240.8026618860  =[) ossec13008gdMail Reciepient rejected2025-03-28 17:34:50 H=(mail.msnews24.in) [165.154.228.93]:51083 F= rejected RCPT : Rejected relay attempt: '165.154.228.93' From: 'pnvzrevh@msnews24.in' To: 'extradomcom@fastmail.com'165.154.228.931643084  Uc' ossec11001gDeferred login on the cpanel service[2025-03-28 17:28:26 +0530] info [webmaild] 157.38.241.64 - kps@amplifypowerglobal.com "POST /cpsess9190473104/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [157.38.238.173] != Current IP Address [157.38.241.64]157.38.241.641269750x  -{) ossec13001g挂Exim Auth failed2025-03-28 17:18:18 dovecot_plain authenticator failed for c-50-149-161-131.hsd1.tn.comcast.net [50.149.161.131]:56638: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)50.149.161.1316252001y  -}) ossec13001gzExim Auth failed2025-03-28 17:18:09 dovecot_plain authenticator failed for ([158.140.39.128]) [158.140.39.128]:45340: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)158.140.39.1286252001  : E p 2Wgc,  -S' ossec13001g泒Exim Auth failed2025-03-28 20:04:57 dovecot_plain authenticator failed for ([134.56.58.179]) [134.56.58.179]:49599: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)134.56.58.1796252001b+  -O) ossec13001gExim Auth failed2025-03-28 19:53:35 dovecot_plain authenticator failed for ([103.49.233.104]) [103.49.233.104]:33960: 535 Incorrect authentication data (set_id=vikas.khandelwal)103.49.233.1041269750Z*  -E# ossec13001gExim Auth failed2025-03-28 19:53:16 dovecot_plain authenticator failed for host-94-93-3-147.business.telecomitalia.it [94.93.3.147]:49304: 535 Incorrect authentication data94.93.3.1473175395l)  -i# ossec13001gExim Auth failed2025-03-28 19:52:55 dovecot_plain authenticator failed for ([58.240.2.38]) [58.240.2.38]:54838: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)58.240.2.381814991W(  -9) ossec13001gExim Auth failed2025-03-28 19:07:07 dovecot_plain authenticator failed for ([223.26.225.129]) [210.206.24.234]:64609: 535 Incorrect authentication data (set_id=sales)210.206.24.2341835841d'  -W% ossec13001gExim Auth failed2025-03-28 19:06:35 dovecot_plain authenticator failed for ([24.121.53.76]) [24.121.53.76]:44450: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)24.121.53.766252001j&  -_) ossec13001gExim Auth failed2025-03-28 19:06:26 dovecot_plain authenticator failed for ([121.128.84.224]) [121.128.84.224]:44658: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)121.128.84.2241835841j%  -_) ossec13001gExim Auth failed2025-03-28 19:06:11 dovecot_plain authenticator failed for ([117.53.254.144]) [117.53.254.144]:34788: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)117.53.254.1441835841'$  3S) ossec11301gzNew FTP connection.Mar 28 18:56:16 vm1 pure-ftpd[119911]: (?@20.150.206.166) [INFO] New connection from 20.150.206.16620.150.206.1666252001v#  -y' ossec13001g4Exim Auth failed2025-03-28 18:50:51 dovecot_login authenticator failed for ([83.219.250.17]) [83.219.250.17]:53664: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)83.219.250.172661886f"  -W) ossec13001g>Exim Auth failed2025-03-28 18:51:00 dovecot_login authenticator failed for ([46.138.247.195]) [46.138.247.195]:50660: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)46.138.247.1952017370g!  -]% ossec13001gCExim Auth failed2025-03-28 18:42:35 dovecot_login authenticator failed for ([37.112.53.67]) [37.112.53.67]:47979: 535 Incorrect authentication data (set_id=services@heipowersystem.com)37.112.53.672017370Q  -3# ossec13001gOExim Auth failed2025-03-28 18:42:46 dovecot_login authenticator failed for ([31.43.192.2]) [31.43.192.2]:50900: 535 Incorrect authentication data (set_id=services)31.43.192.22017370q  -o' ossec13001gExim Auth failed2025-03-28 18:33:15 dovecot_login authenticator failed for (amplifypowerglobal.com) [111.207.12.99]:45834: 535 Incorrect authentication data (set_id=info@amplifypowerglobal.com)111.207.12.991814991]  -G' ossec13001gExim Auth failed2025-03-28 18:32:52 dovecot_login authenticator failed for (amplifypowerglobal.com) [111.207.12.99]:42064: 535 Incorrect authentication data (set_id=nologin)111.207.12.991814991{  -) ossec13001gExim Auth failed2025-03-28 18:29:09 dovecot_plain authenticator failed for vps-9109ac84.vps.ovh.net [141.95.159.204]:36656: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)141.95.159.2043017382b  -O) ossec13001g(Exim Auth failed2025-03-28 18:29:20 dovecot_plain authenticator failed for ([180.103.112.85]) [180.103.112.85]:49168: 535 Incorrect authentication data (set_id=vikas.khandelwal)180.103.112.851814991 ]  < 6;]Z<  -=+ ossec13001g̼Exim Auth failed2025-03-28 21:52:18 dovecot_plain authenticator failed for ([190.121.193.126]) [190.121.193.126]:38058: 535 Incorrect authentication data (set_id=sales)190.121.193.1263595528w;  -{' ossec13001g̮Exim Auth failed2025-03-28 21:52:04 dovecot_plain authenticator failed for (228.10.245.49.unknown.m1.com.sg) [49.245.10.228]:48586: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)49.245.10.2281880251:  EU ossec5740gssh connection reset by peerMar 28 21:47:02 vm1 sshd[157527]: error: kex_exchange_identification: read: Connection reset by peer,9  =S) ossec13008gMail Reciepient rejected2025-03-28 21:39:52 H=(mail.msnews24.in) [165.154.210.52]:54492 F= rejected RCPT : Rejected relay attempt: '165.154.210.52' From: 'qlhypc@msnews24.in' To: 'extradomcom@fastmail.com'165.154.210.521694008o8  -m% ossec13001gExim Auth failed2025-03-28 21:28:20 dovecot_plain authenticator failed for 111-70-3-198.emome-ip.hinet.net [111.70.3.198]:45115: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)111.70.3.19816682847  - ) ossec13001gExim Auth failed2025-03-28 21:27:58 dovecot_plain authenticator failed for p4693108-ipngnfx01marunouchi.tokyo.ocn.ne.jp [153.156.70.108]:33140: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)153.156.70.1081861060 6  -#) ossec13001gExim Auth failed2025-03-28 21:27:28 dovecot_plain authenticator failed for h-176-10-197-168.a444.priv.bahnhof.se [176.10.197.168]:54204: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)176.10.197.1682661886,5  =S) ossec13008g¥Mail Reciepient rejected2025-03-28 21:09:16 H=(mail.msnews24.in) [165.154.228.93]:58520 F= rejected RCPT : Rejected relay attempt: '165.154.228.93' From: 'ilaxfq@msnews24.in' To: 'extradomcom@fastmail.com'165.154.228.931643084W4 -;% ossec13001gExim Auth failed2025-03-28 21:06:25 dovecot_login authenticator failed for (gurukuljaipur.com) [119.96.131.8]:52650: 535 Incorrect authentication data (set_id=nologin)119.96.131.81814991X3  -;) ossec13001gExim Auth failed2025-03-28 21:02:21 dovecot_login authenticator failed for ([221.167.21.148]) [221.167.21.148]:43310: 535 Incorrect authentication data (set_id=daniel)221.167.21.1481835841k2  -a) ossec13001gExim Auth failed2025-03-28 21:02:08 dovecot_login authenticator failed for ([221.181.210.98]) [221.181.210.98]:55347: 535 Incorrect authentication data (set_id=daniel@heipowersystem.com)221.181.210.98181499131  =_+ ossec13008g溽Mail Reciepient rejected2025-03-28 20:35:31 H=(mail.msnews24.in) [165.154.232.243]:60276 F= rejected RCPT : Rejected relay attempt: '165.154.232.243' From: 'tjfqtfdc@msnews24.in' To: 'extradomcom@fastmail.com'165.154.232.2431605651W0  -9) ossec13001g`Exim Auth failed2025-03-28 20:29:44 dovecot_plain authenticator failed for ([103.100.234.22]) [103.100.234.22]:43142: 535 Incorrect authentication data (set_id=sales)103.100.234.221210997j/  -_) ossec13001gVExim Auth failed2025-03-28 20:29:34 dovecot_plain authenticator failed for ([120.157.139.80]) [120.157.139.80]:46320: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)120.157.139.802077456 .  -)% ossec13001g泆Exim Auth failed2025-03-28 20:04:46 dovecot_plain authenticator failed for vps-79f20bfc.vps.ovh.net ([87.98.249.193]) [51.75.24.107]:37156: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)51.75.24.1073017382 -  -' ossec13001g泀Exim Auth failed2025-03-28 20:04:39 dovecot_plain authenticator failed for (stale-fjorden-rt.hty-dsl.midtit.no) [217.22.38.208]:59400: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)217.22.38.2083144096 AU% + + = b AM  ?1 ossec1008g3Process exiting (killed).Mar 29 00:06:34 vm1 spamd[4066152]: spamd: server killed by SIGTERM, shutting downtL  -u' ossec13001gExim Auth failed2025-03-29 00:01:56 dovecot_login authenticator failed for 37-190-61-156.dynamic.spd-mgts.ru ([195.91.162.219]) [37.190.61.156]:3707: 535 Incorrect authentication data (set_id=pvm)37.190.61.1562017370hK  -[) ossec13001g Exim Auth failed2025-03-29 00:01:40 dovecot_login authenticator failed for ([58.248.169.140]) [58.248.169.140]:54396: 535 Incorrect authentication data (set_id=pvm@heipowersystem.com)58.248.169.1401814991,J  =S) ossec13008g!Mail Reciepient rejected2025-03-28 23:49:11 H=(mail.msnews24.in) [165.154.210.52]:55567 F= rejected RCPT : Rejected relay attempt: '165.154.210.52' From: 'jejbqt@msnews24.in' To: 'extradomcom@fastmail.com'165.154.210.521694008dI  -S) ossec13001g.Exim Auth failed2025-03-28 23:32:21 dovecot_login authenticator failed for (nyaystambh.com) [124.160.63.122]:44024: 535 Incorrect authentication data (set_id=admin@nyaystambh.com)124.160.63.1221814991YH  -;+ ossec13001g Exim Auth failed2025-03-28 23:31:48 dovecot_login authenticator failed for (nyaystambh.com) [202.107.197.211]:36366: 535 Incorrect authentication data (set_id=nologin)202.107.197.2111814991lG  -g% ossec13001gExim Auth failed2025-03-28 23:17:11 dovecot_login authenticator failed for a94-132-188-6.cpe.netcabo.pt [94.132.188.6]:36388: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)94.132.188.62264397yF  -% ossec13001gyExim Auth failed2025-03-28 23:16:33 dovecot_login authenticator failed for (broadband.actcorp.in) [183.83.51.57]:42630: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)183.83.51.571269750E  -% ossec13001gExim Auth failed2025-03-28 23:14:21 dovecot_plain authenticator failed for (95x79x57x221.static-business.nn.ertelecom.ru) [95.79.57.221]:57682: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)95.79.57.2212017370iD  -_) ossec13001gExim Auth failed2025-03-28 23:14:08 dovecot_plain authenticator failed for ([89.253.183.242]) [89.253.183.242]:33310: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)89.253.183.242732800ZC -?' ossec13001gHExim Auth failed2025-03-28 23:07:11 dovecot_login authenticator failed for (heipowersystem.com) [221.229.216.1]:59482: 535 Incorrect authentication data (set_id=nologin)221.229.216.11814991WB  -9) ossec13001g2Exim Auth failed2025-03-28 22:58:17 dovecot_login authenticator failed for ([220.178.39.106]) [220.178.39.106]:56176: 535 Incorrect authentication data (set_id=sales)220.178.39.1061814991jA  -_) ossec13001gExim Auth failed2025-03-28 22:57:53 dovecot_login authenticator failed for ([190.223.53.234]) [190.223.53.234]:51791: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)190.223.53.2343932488|@  -+ ossec13001g3Exim Auth failed2025-03-28 22:49:47 dovecot_plain authenticator failed for ([112.199.204.125]) [112.199.204.125]:40107: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)112.199.204.1251880251v?  -y' ossec13001g!Exim Auth failed2025-03-28 22:49:28 dovecot_plain authenticator failed for ([187.45.65.102]) [187.45.65.102]:42284: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)187.45.65.1023469034,>  =S) ossec13008gfMail Reciepient rejected2025-03-28 22:29:18 H=(mail.msnews24.in) [165.154.247.20]:55419 F= rejected RCPT : Rejected relay attempt: '165.154.247.20' From: 'bigpce@msnews24.in' To: 'extradomcom@fastmail.com'165.154.247.201605651'=  3S) ossec11301g8New FTP connection.Mar 28 21:54:22 vm1 pure-ftpd[159049]: (?@198.235.24.199) [INFO] New connection from 198.235.24.199198.235.24.1996252001  m DpvT^  -5' ossec13001g$Exim Auth failed2025-03-29 04:08:38 dovecot_login authenticator failed for ([1.227.228.136]) [1.227.228.136]:39486: 535 Incorrect authentication data (set_id=sales)1.227.228.1361835841]  -;' ossec13001g$Exim Auth failed2025-03-29 04:08:27 dovecot_login authenticator failed for 47-206-63-169.e8235131806a02dcb1fe9c7a57eaaeb8.ip.frontiernet.net [47.206.63.169]:44740: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)47.206.63.1696252001l\  -c) ossec13001gExim Auth failed2025-03-29 03:17:20 dovecot_plain authenticator failed for 105.217.146.34.bc.googleusercontent.com [34.146.217.105]:55918: 535 Incorrect authentication data (set_id=sales)34.146.217.1051861060g[  -[' ossec13001gExim Auth failed2025-03-29 03:17:10 dovecot_plain authenticator failed for ([123.122.85.19]) [123.122.85.19]:37733: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)123.122.85.191814991vZ  -w) ossec13001gExim Auth failed2025-03-29 03:00:39 dovecot_login authenticator failed for (host-79-164-139-110.qwerty.ru) [79.164.139.110]:57482: 535 Incorrect authentication data (set_id=paul@heipowersystem.com)79.164.139.1102017370PY  -/% ossec13001gExim Auth failed2025-03-29 03:00:55 dovecot_login authenticator failed for ([103.98.39.30]) [103.98.39.30]:46104: 535 Incorrect authentication data (set_id=paul)103.98.39.301269750TX  -5' ossec13001gExim Auth failed2025-03-29 01:56:27 dovecot_plain authenticator failed for ([124.228.32.34]) [124.228.32.34]:52790: 535 Incorrect authentication data (set_id=sales)124.228.32.341814991gW  -[' ossec13001gExim Auth failed2025-03-29 01:56:13 dovecot_plain authenticator failed for ([103.68.181.59]) [103.68.181.59]:54406: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)103.68.181.591819730hV  -_% ossec13001g6Exim Auth failed2025-03-29 01:19:09 dovecot_login authenticator failed for (heipowersystem.com) [125.72.54.81]:58604: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)125.72.54.811814991WU  -=% ossec13001g Exim Auth failed2025-03-29 01:18:25 dovecot_login authenticator failed for (heipowersystem.com) [125.72.54.81]:53780: 535 Incorrect authentication data (set_id=nologin)125.72.54.811814991tT  -s) ossec13001gExim Auth failed2025-03-29 00:38:59 dovecot_login authenticator failed for 47-157-217-116.fdr01.covn.ca.ip.frontiernet.net [47.157.217.116]:40868: 535 Incorrect authentication data (set_id=sales)47.157.217.1166252001fS  -Y' ossec13001gExim Auth failed2025-03-29 00:38:48 dovecot_login authenticator failed for ([218.25.233.2]) [218.25.233.22]:48222: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)218.25.233.221814991NR  --# ossec13001gExim Auth failed2025-03-29 00:35:34 dovecot_plain authenticator failed for ([223.84.33.2]) [223.84.33.2]:34930: 535 Incorrect authentication data (set_id=sales)223.84.33.21814991gQ  -[' ossec13001gExim Auth failed2025-03-29 00:35:19 dovecot_plain authenticator failed for ([218.90.151.10]) [218.90.151.10]:44604: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)218.90.151.101814991'P  3S) ossec11301gNew FTP connection.Mar 29 00:29:24 vm1 pure-ftpd[194365]: (?@20.169.107.206) [INFO] New connection from 20.169.107.20620.169.107.2066252001gO  -W+ ossec13001gLExim Auth failed2025-03-29 00:11:14 dovecot_plain authenticator failed for ([182.76.69.209]) [128.185.228.134]:36820: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)128.185.228.1341269750yN  -}) ossec13001g:Exim Auth failed2025-03-29 00:10:56 dovecot_plain authenticator failed for ([67.213.230.122]) [67.213.230.122]:52137: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)67.213.230.1226252001  - X 10SZd\vp  -{% ossec13001gKExim Auth failed2025-03-29 06:53:52 dovecot_plain authenticator failed for c-71-62-34-216.hsd1.va.comcast.net [71.62.34.216]:38316: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)71.62.34.2166252001$o  3O' ossec11301gGrNew FTP connection.Mar 29 06:35:53 vm1 pure-ftpd[278091]: (?@64.62.197.132) [INFO] New connection from 64.62.197.13264.62.197.13262520017n  Ag' ossec11302gDFTP Authentication failed.Mar 29 06:24:28 vm1 pure-ftpd[275273]: (?@94.102.49.155) [WARNING] Authentication failed for user [anonymous]94.102.49.1552750405$m  3O' ossec11301gDNew FTP connection.Mar 29 06:24:23 vm1 pure-ftpd[275273]: (?@94.102.49.155) [INFO] New connection from 94.102.49.15594.102.49.1552750405!l  3K% ossec11301gDNew FTP connection.Mar 29 06:23:33 vm1 pure-ftpd[275135]: (?@80.82.77.202) [INFO] New connection from 80.82.77.20280.82.77.2022750405rk  -m+ ossec13001gBExim Auth failed2025-03-29 06:15:12 dovecot_login authenticator failed for ppp-124-120-237-121.revip2.asianet.co.th [124.120.237.121]:54624: 535 Incorrect authentication data (set_id=services)124.120.237.1211605651uj  -}# ossec13001gBExim Auth failed2025-03-29 06:15:01 dovecot_login authenticator failed for (95.0.252.77.static.ttnet.com.tr) [95.0.252.77]:48646: 535 Incorrect authentication data (set_id=services@heipowersystem.com)95.0.252.77298795Yi  -=) ossec13001g>Exim Auth failed2025-03-29 05:59:12 dovecot_login authenticator failed for ([61.143.241.150]) [61.143.241.150]:41280: 535 Incorrect authentication data (set_id=invoice)61.143.241.1501814991}h  -+ ossec13001g>Exim Auth failed2025-03-29 05:58:58 dovecot_login authenticator failed for 158.160.200.177.netflexisp.com.br [177.200.160.158]:61884: 535 Incorrect authentication data (set_id=invoice@heipowersystem.com)177.200.160.1583469034Tg  -5' ossec13001g>Exim Auth failed2025-03-29 05:58:56 dovecot_plain authenticator failed for ([222.92.61.242]) [222.92.61.242]:35037: 535 Incorrect authentication data (set_id=sales)222.92.61.2421814991]f  -O! ossec13001g>Exim Auth failed2025-03-29 05:58:44 dovecot_plain authenticator failed for ([5.31.0.134]) [5.31.0.134]:34280: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)5.31.0.134290557Te  -5' ossec13001g8Exim Auth failed2025-03-29 05:32:53 dovecot_plain authenticator failed for ([212.56.90.205]) [212.56.90.205]:40953: 535 Incorrect authentication data (set_id=sales)212.56.90.2052635167gd  -[' ossec13001g8Exim Auth failed2025-03-29 05:32:43 dovecot_plain authenticator failed for ([121.154.90.47]) [121.154.90.47]:42272: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)121.154.90.471835841'c  3S) ossec11301g1New FTP connection.Mar 29 05:02:30 vm1 pure-ftpd[255624]: (?@194.165.16.161) [INFO] New connection from 194.165.16.161194.165.16.1612993457Qb  -1% ossec13001g+Exim Auth failed2025-03-29 04:38:17 dovecot_plain authenticator failed for ([58.16.49.250]) [58.16.49.250]:52643: 535 Incorrect authentication data (set_id=sales)58.16.49.2501814991ma  -c+ ossec13001g+Exim Auth failed2025-03-29 04:38:03 dovecot_plain authenticator failed for ([223.241.214.127]) [223.241.214.127]:43967: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)223.241.214.1271814991\` -E% ossec13001g)Exim Auth failed2025-03-29 04:29:27 dovecot_login authenticator failed for (amplifypowerglobal.com) [150.5.145.36]:51240: 535 Incorrect authentication data (set_id=nologin)150.5.145.361880251~_  -) ossec13001g%Exim Auth failed2025-03-29 04:11:51 dovecot_plain authenticator failed for (static.ill.117.248.104.34.bsnl.co.in) [117.248.104.34]:40306: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)117.248.104.341269750   1 b qNAtp  -i+ ossec13001gcExim Auth failed2025-03-29 08:36:05 dovecot_plain authenticator failed for ([178.178.194.128]) [178.178.194.128]:43546: 535 Incorrect authentication data (set_id=services@heipowersystem.com)178.178.194.1282017370$  3O' ossec11301gaVNew FTP connection.Mar 29 08:26:20 vm1 pure-ftpd[302936]: (?@46.101.242.20) [INFO] New connection from 46.101.242.2046.101.242.202921044  3G# ossec11301gaVNew FTP connection.Mar 29 08:26:20 vm1 pure-ftpd[302938]: (?@167.71.47.2) [INFO] New connection from 167.71.47.2167.71.47.22921044W  -9) ossec13001g^Exim Auth failed2025-03-29 08:15:01 dovecot_plain authenticator failed for ([180.166.162.78]) [180.166.162.78]:50242: 535 Incorrect authentication data (set_id=sales)180.166.162.781814991v  -y' ossec13001g^Exim Auth failed2025-03-29 08:14:51 dovecot_plain authenticator failed for 111-70-13-246.emome-ip.hinet.net [111.70.13.246]:54446: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)111.70.13.2461668284*~  3W+ ossec11301g]New FTP connection.Mar 29 08:11:07 vm1 pure-ftpd[299679]: (?@185.180.140.123) [INFO] New connection from 185.180.140.123185.180.140.1232264397+} 3W+ ossec11301g]New FTP connection.Mar 29 08:10:53 vm1 pure-ftpd[299618]: (?@185.180.140.122) [INFO] New connection from 185.180.140.122185.180.140.1222264397+| 3W+ ossec11301g]New FTP connection.Mar 29 08:10:52 vm1 pure-ftpd[299615]: (?@185.180.140.123) [INFO] New connection from 185.180.140.123185.180.140.1232264397+{ 3W+ ossec11301g]New FTP connection.Mar 29 08:11:04 vm1 pure-ftpd[299675]: (?@185.180.140.121) [INFO] New connection from 185.180.140.121185.180.140.1212264397$z  3O' ossec11301g]New FTP connection.Mar 29 08:11:03 vm1 pure-ftpd[299667]: (?@185.180.140.9) [INFO] New connection from 185.180.140.9185.180.140.92264397'y  3S) ossec11301g[dNew FTP connection.Mar 29 08:00:58 vm1 pure-ftpd[297303]: (?@147.185.132.87) [INFO] New connection from 147.185.132.87147.185.132.876252001Lx  --# ossec13001gYMExim Auth failed2025-03-29 07:52:05 dovecot_login authenticator failed for ([65.20.171.8]) [65.20.171.8]:34932: 535 Incorrect authentication data (set_id=sales)65.20.171.899237mw  -c+ ossec13001gYCExim Auth failed2025-03-29 07:51:54 dovecot_login authenticator failed for ([222.236.155.146]) [222.236.155.146]:43488: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)222.236.155.1461835841 v  W#+ ossec9708gT^Dovecot Aborted Login with empty userMar 29 07:31:01 vm1 dovecot[2184869]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 7 secs): user=<>, rip=185.247.137.190, lip=103.74.54.108, TLS, session=185.247.137.190298795'u  3S) ossec11301gRNew FTP connection.Mar 29 07:24:29 vm1 pure-ftpd[288896]: (?@167.94.145.107) [INFO] New connection from 167.94.145.107167.94.145.1076252001[t  -G% ossec13001gQExim Auth failed2025-03-29 07:20:01 dovecot_plain authenticator failed for (host-193.211.77.5.ucom.am) [5.77.211.193]:46684: 535 Incorrect authentication data (set_id=sales)5.77.211.193174982ds  -W% ossec13001gQExim Auth failed2025-03-29 07:19:51 dovecot_plain authenticator failed for ([62.231.31.86]) [62.231.31.86]:45535: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)62.231.31.862017370r  W) ossec9708gLDovecot Aborted Login with empty userMar 29 06:59:13 vm1 dovecot[2184869]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=185.180.141.40, lip=103.74.54.108, session=185.180.141.402264397fq  -Y' ossec13001gKExim Auth failed2025-03-29 06:54:05 dovecot_plain authenticator failed for c-98-51-132-203.hsd1.ca.comcast.net [98.51.132.203]:54116: 535 Incorrect authentication data (set_id=sales)98.51.132.2036252001 <"7 I b  )O[<  U!) ossec11001gyDeferred login on the cpanel service[2025-03-29 10:09:35 +0530] info [webmaild] 157.38.254.238 - kps@amplifypowerglobal.com "GET /cpsess6943452890/3rdparty/roundcube/?_task=mail&_mbox=INBOX&login=1&post_login=39545223982448 HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [157.38.248.134] != Current IP Address [157.38.254.238]157.38.254.2381269750  - ) ossec13001gwExim Auth failed2025-03-29 10:02:30 dovecot_plain authenticator failed for (nsg-corporate-65.246.187.122.airtel.in) [122.187.246.65]:38579: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)122.187.246.651269750]  -I' ossec13001gwExim Auth failed2025-03-29 10:02:47 dovecot_plain authenticator failed for (134-1-239-197.r.airtel.ug) [197.239.1.134]:51260: 535 Incorrect authentication data (set_id=sales)197.239.1.134226074j  -a' ossec13001gvExim Auth failed2025-03-29 09:58:03 dovecot_plain authenticator failed for ([49.124.153.42]) [49.124.153.42]:45954: 535 Incorrect authentication data (set_id=services@heipowersystem.com)49.124.153.421733045y  -' ossec13001gvExim Auth failed2025-03-29 09:57:44 dovecot_plain authenticator failed for 125-229-56-26.hinet-ip.hinet.net [125.229.56.26]:33884: 535 Incorrect authentication data (set_id=services@heipowersystem.com)125.229.56.261668284P  -1% ossec13001gqExim Auth failed2025-03-29 09:36:42 dovecot_plain authenticator failed for ([37.25.36.197]) [37.25.36.197]:48871: 535 Incorrect authentication data (set_id=sales)37.25.36.197294640T  -5' ossec13001gqExim Auth failed2025-03-29 09:36:25 dovecot_plain authenticator failed for ([218.69.115.74]) [218.69.115.74]:52543: 535 Incorrect authentication data (set_id=sales)218.69.115.741814991p  -k) ossec13001gqExim Auth failed2025-03-29 09:36:11 dovecot_plain authenticator failed for vps-9109ac84.vps.ovh.net [141.95.159.204]:55696: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)141.95.159.2043017382V  -9) ossec13001gn1Exim Auth failed2025-03-29 09:21:12 dovecot_login authenticator failed for ([168.167.55.230]) [168.167.55.230]:38178: 535 Incorrect authentication data (set_id=sales)168.167.55.230933860m  -i% ossec13001gn%Exim Auth failed2025-03-29 09:21:00 dovecot_login authenticator failed for (hebei.6.60.in-addr.arpa) [60.6.212.150]:47790: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)60.6.212.1501814991>  gO' ossec11307gkMultiple connection attempts from same sourceMar 29 09:11:24 vm1 pure-ftpd[312984]: (?@167.71.48.171) [INFO] New connection from 167.71.48.171167.71.48.1712921044% 3O' ossec11301gk New FTP connection.Mar 29 09:11:14 vm1 pure-ftpd[312964]: (?@167.71.48.171) [INFO] New connection from 167.71.48.171167.71.48.1712921044Y  -=) ossec13001ghExim Auth failed2025-03-29 08:57:55 dovecot_login authenticator failed for ([188.20.248.210]) [188.20.248.210]:53506: 535 Incorrect authentication data (set_id=recruit)188.20.248.2102782113c  -W# ossec13001ghExim Auth failed2025-03-29 08:57:45 dovecot_login authenticator failed for ([61.51.81.78]) [61.51.81.78]:57772: 535 Incorrect authentication data (set_id=recruit@heipowersystem.com)61.51.81.781814991j  -c' ossec13001gdExim Auth failed2025-03-29 08:41:00 dovecot_plain authenticator failed for (160.228-59-41.static-zone.ttcldata.net) [41.59.228.160]:40228: 535 Incorrect authentication data (set_id=sales)41.59.228.160149590g  -[' ossec13001gdExim Auth failed2025-03-29 08:40:49 dovecot_plain authenticator failed for ([90.188.40.123]) [90.188.40.123]:50716: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)90.188.40.1232017370Z  -?) ossec13001gcExim Auth failed2025-03-29 08:36:20 dovecot_plain authenticator failed for ([116.114.84.234]) [116.114.84.234]:33053: 535 Incorrect authentication data (set_id=services)116.114.84.2341814991 @] d &9ajw @Z%  -?) ossec13001gExim Auth failed2025-03-29 11:57:27 dovecot_login authenticator failed for (client.fttb.2day.kz) [176.222.190.69]:43762: 535 Incorrect authentication data (set_id=email)176.222.190.691522867g$  -[' ossec13001gExim Auth failed2025-03-29 11:57:15 dovecot_login authenticator failed for ([138.75.39.215]) [138.75.39.215]:50773: 535 Incorrect authentication data (set_id=email@heipowersystem.com)138.75.39.2151880251(#  EI% ossec5715g琋SSHD authentication success.Mar 29 11:47:45 vm1 sshd[346784]: Accepted password for root from 103.190.54.7 port 54361 ssh2103.190.54.71269750m"  -e) ossec13001gExim Auth failed2025-03-29 11:24:13 dovecot_plain authenticator failed for (nsg-corporate-99.229.187.122.airtel.in) [122.187.229.99]:54762: 535 Incorrect authentication data (set_id=sales)122.187.229.991269750s!  -u% ossec13001gExim Auth failed2025-03-29 11:24:01 dovecot_plain authenticator failed for 111-70-19-17.emome-ip.hinet.net [111.70.19.17]:50166: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)111.70.19.171668284V  -9' ossec13001gExim Auth failed2025-03-29 11:19:24 dovecot_plain authenticator failed for ([223.82.236.69]) [223.82.236.69]:1197: 535 Incorrect authentication data (set_id=services)223.82.236.691814991o  -g+ ossec13001gExim Auth failed2025-03-29 11:19:11 dovecot_plain authenticator failed for ([103.255.182.68]) [114.143.158.178]:36294: 535 Incorrect authentication data (set_id=services@heipowersystem.com)114.143.158.1781269750s -q' ossec13001g7Exim Auth failed2025-03-29 11:16:30 dovecot_login authenticator failed for (ns1011168.ip-92-204-144.us) [92.204.144.53]:51496: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)92.204.144.536252001T  -5' ossec13001gExim Auth failed2025-03-29 10:57:50 dovecot_plain authenticator failed for ([185.60.45.240]) [185.60.45.240]:49046: 535 Incorrect authentication data (set_id=sales)185.60.45.2402017370i  -_) ossec13001gExim Auth failed2025-03-29 10:57:40 dovecot_plain authenticator failed for ([212.90.111.127]) [212.90.111.127]:60547: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)212.90.111.127294640T -5% ossec13001g Exim Auth failed2025-03-29 10:54:25 dovecot_login authenticator failed for (nyaystambh.com) [119.96.131.8]:36562: 535 Incorrect authentication data (set_id=nologin)119.96.131.81814991f  -W) ossec13001gSExim Auth failed2025-03-29 10:51:22 dovecot_login authenticator failed for ([218.149.70.142]) [218.149.70.142]:55638: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)218.149.70.1421835841o  -q# ossec13001gEExim Auth failed2025-03-29 10:51:08 dovecot_login authenticator failed for ([95.0.252.81]) [95.0.252.81]:43306: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)95.0.252.81298795(  EI% ossec5715gSSHD authentication success.Mar 29 10:41:06 vm1 sshd[332316]: Accepted password for root from 103.190.54.7 port 54244 ssh2103.190.54.71269750Y  -C# ossec13001g} Exim Auth failed2025-03-29 10:24:34 dovecot_login authenticator failed for ([103.60.89.9]) [103.60.89.2]:49384: 535 Incorrect authentication data (set_id=vikas.khandelwal)103.60.89.21643084u  -u) ossec13001g|Exim Auth failed2025-03-29 10:24:21 dovecot_login authenticator failed for ([67.213.230.122]) [67.213.230.122]:39630: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)67.213.230.1226252001  U!) ossec11001gyDeferred login on the cpanel service[2025-03-29 10:09:49 +0530] info [webmaild] 157.38.248.134 - kps@amplifypowerglobal.com "GET /cpsess6943452890/3rdparty/roundcube/?_task=mail&_mbox=INBOX&login=1&post_login=39545223982448 HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [157.38.254.238] != Current IP Address [157.38.248.134]157.38.248.1341269750 z &-G>$6  3O' ossec11301guNew FTP connection.Mar 29 13:46:51 vm1 pure-ftpd[373944]: (?@183.95.156.99) [INFO] New connection from 183.95.156.99183.95.156.991814991W5  -9) ossec13001gExim Auth failed2025-03-29 13:40:54 dovecot_plain authenticator failed for ([121.202.198.98]) [121.202.198.98]:33774: 535 Incorrect authentication data (set_id=sales)121.202.198.981819730T4  -5' ossec13001gExim Auth failed2025-03-29 13:40:38 dovecot_plain authenticator failed for ([88.84.209.146]) [88.84.209.146]:51524: 535 Incorrect authentication data (set_id=sales)88.84.209.1462017370j3  -_) ossec13001gExim Auth failed2025-03-29 13:40:27 dovecot_plain authenticator failed for ([112.184.60.138]) [112.184.60.138]:55304: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)112.184.60.1381835841'2  3S) ossec11301g)New FTP connection.Mar 29 13:24:16 vm1 pure-ftpd[368402]: (?@193.105.134.40) [INFO] New connection from 193.105.134.40193.105.134.40266188691  Ai) ossec11302g/FTP Authentication failed.Mar 29 13:24:21 vm1 pure-ftpd[368402]: (?@193.105.134.40) [WARNING] Authentication failed for user [anonymous]193.105.134.402661886b0  -O) ossec13001g3Exim Auth failed2025-03-29 13:15:54 dovecot_login authenticator failed for ([182.70.120.127]) [182.70.120.127]:41572: 535 Incorrect authentication data (set_id=vikas.khandelwal)182.70.120.1271269750u/  -u) ossec13001g!Exim Auth failed2025-03-29 13:15:36 dovecot_login authenticator failed for ([182.160.107.51]) [182.160.107.51]:51410: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)182.160.107.511210997Z.  -=+ ossec13001gExim Auth failed2025-03-29 12:45:35 dovecot_plain authenticator failed for ([120.157.207.228]) [120.157.207.228]:40932: 535 Incorrect authentication data (set_id=sales)120.157.207.2282077456j-  -_) ossec13001g Exim Auth failed2025-03-29 12:45:23 dovecot_plain authenticator failed for ([128.185.253.22]) [128.185.253.22]:42054: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)128.185.253.221269750W,  -;' ossec13001gExim Auth failed2025-03-29 12:40:42 dovecot_plain authenticator failed for ([103.65.227.72]) [103.65.227.72]:53388: 535 Incorrect authentication data (set_id=services)103.65.227.721210997p+  -i+ ossec13001gExim Auth failed2025-03-29 12:40:25 dovecot_plain authenticator failed for ([169.211.232.182]) [169.211.232.182]:54660: 535 Incorrect authentication data (set_id=services@heipowersystem.com)169.211.232.1821835841Z*  -=+ ossec13001gExim Auth failed2025-03-29 12:19:30 dovecot_plain authenticator failed for ([103.185.212.112]) [103.185.212.112]:56200: 535 Incorrect authentication data (set_id=sales)103.185.212.1121269750z)  -' ossec13001gExim Auth failed2025-03-29 12:19:15 dovecot_plain authenticator failed for 079.33.246.220.static.netvigator.com [220.246.33.79]:49436: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)220.246.33.791819730f(  -W) ossec13001g8Exim Auth failed2025-03-29 12:03:28 dovecot_login authenticator failed for ([58.216.101.162]) [58.216.101.162]:35402: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)58.216.101.1621814991o'  -q# ossec13001g,Exim Auth failed2025-03-29 12:03:15 dovecot_login authenticator failed for ([95.0.252.77]) [95.0.252.77]:46976: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)95.0.252.77298795&  Ug) ossec11001gbDeferred login on the cpanel service[2025-03-29 11:59:53 +0530] info [webmaild] 157.38.255.228 - kps@amplifypowerglobal.com "POST /cpsess2441093102/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [223.238.203.45] != Current IP Address [157.38.255.228]157.38.255.2281269750 7 H w<IOWyoG -g) ossec13001g緔Exim Auth failed2025-03-29 14:34:20 dovecot_plain authenticator failed for (DESKTOP-JNN4392) [110.39.156.230]:62516: 535 Incorrect authentication data (set_id=khandelwal@heipowersystem.com)110.39.156.2301168579ZF  -E% ossec13001g^Exim Auth failed2025-03-29 14:33:24 dovecot_login authenticator failed for 77-85-52-109.ip.btc-net.bg [77.85.52.109]:57646: 535 Incorrect authentication data (set_id=sales)77.85.52.109732800tE  -u' ossec13001gTExim Auth failed2025-03-29 14:33:14 dovecot_login authenticator failed for p7001160-ipoefx.ipoe.ocn.ne.jp [118.3.227.159]:56624: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)118.3.227.1591861060vD -u) ossec13001g,Exim Auth failed2025-03-29 14:32:35 dovecot_plain authenticator failed for (8i23y2qbqi8dyirbu1uj0szm13l) [46.191.181.176]:16511: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)46.191.181.1762017370oC -g) ossec13001g$Exim Auth failed2025-03-29 14:32:28 dovecot_plain authenticator failed for (DESKTOP-JNN4392) [110.39.156.230]:61892: 535 Incorrect authentication data (set_id=khandelwal@heipowersystem.com)110.39.156.2301168579WB  -9) ossec13001gExim Auth failed2025-03-29 14:31:58 dovecot_login authenticator failed for ([210.222.15.113]) [210.222.15.113]:56046: 535 Incorrect authentication data (set_id=sales)210.222.15.1131835841jA  -_) ossec13001gExim Auth failed2025-03-29 14:31:43 dovecot_login authenticator failed for ([92.126.223.175]) [92.126.223.175]:37398: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)92.126.223.1752017370p@ -o# ossec13001gExim Auth failed2025-03-29 14:31:20 dovecot_plain authenticator failed for (bphmj88pbli5xyl49mog80oag9y) [77.40.80.72]:41852: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)77.40.80.722017370(? 3S) ossec11301g1New FTP connection.Mar 29 14:24:08 vm1 pure-ftpd[382297]: (?@110.39.156.230) [INFO] New connection from 110.39.156.230110.39.156.2301168579N> A) ossec11302g1FTP Authentication failed.Mar 29 14:24:08 vm1 pure-ftpd[382269]: (?@110.39.156.230) [WARNING] Authentication failed for user [khandelwal@heipowersystem.com]110.39.156.2301168579M=  A) ossec11302gFTP Authentication failed.Mar 29 14:23:40 vm1 pure-ftpd[382164]: (?@110.39.156.230) [WARNING] Authentication failed for user [khandelwal@heipowersystem.com]110.39.156.2301168579(< 3S) ossec11301gNew FTP connection.Mar 29 14:23:33 vm1 pure-ftpd[382164]: (?@110.39.156.230) [INFO] New connection from 110.39.156.230110.39.156.2301168579Q;  -1% ossec13001g Exim Auth failed2025-03-29 14:06:47 dovecot_plain authenticator failed for ([221.162.9.13]) [221.162.9.13]:59979: 535 Incorrect authentication data (set_id=sales)221.162.9.131835841d:  -W% ossec13001gExim Auth failed2025-03-29 14:06:34 dovecot_plain authenticator failed for ([49.124.151.4]) [49.124.151.4]:59240: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)49.124.151.417330459  Ug) ossec11001gBDeferred login on the cpanel service[2025-03-29 14:03:04 +0530] info [webmaild] 157.38.253.193 - kps@amplifypowerglobal.com "POST /cpsess0453462984/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [157.38.232.224] != Current IP Address [157.38.253.193]157.38.253.1931269750W8  -;' ossec13001gExim Auth failed2025-03-29 14:01:47 dovecot_plain authenticator failed for ([14.48.227.118]) [14.48.227.118]:49118: 535 Incorrect authentication data (set_id=services)14.48.227.1181835841j7  -a' ossec13001gExim Auth failed2025-03-29 14:01:34 dovecot_plain authenticator failed for ([92.119.74.196]) [92.119.74.196]:48756: 535 Incorrect authentication data (set_id=services@heipowersystem.com)92.119.74.1962510769 *\~tj`VLB8.$zpf\H>4*   v l b X N D : 0 &    ~ t j ` V L B 8 . $    z p f \ R H > 4 *  vlbXND&:0|rh^TJ@6,"xnPdZF<2( ~tj`VLB8.$zpf\ | r h ^ T J @ 6 , "    x n d Z P F < 2 (   RRH>4*  vlbXND:0& giK3B gg3A gg3@ ge3? gd3> gd3= gbw3< g\3; g\3: g[39 gZ38 gZ37 gZ36 gZ35 gXJ34 gX633 gU32 gU31 gU30 gU3/ gQ^3. gQR3- gQF3, gK3+ gK3* gH3) gH3( gH3' gH3& gG3% gG3$ gG3# gB3" gB3! gB3 gB3 g?3 g@3 g?3 g=3 g;3 g;3 g63 g43 g0P3 g/3 g/3 g%3 g%3 g%3 g#"3 g#<3 g#.3 g#3 g"3 g!3 g""3 g"3 g!3 g!3 g 3 g 3 g3 g3 g3 gh3 g3 g2 gA2 g-2 g!2 g2 g2 g2 gy2 gS2 g 2 g 2 g 2 g2 g2 g2 gT2 g2 g2 g2 g2 g2 g2 g2 g2 g2 g2 gg2 ge2 ge2 gc2 g2 g2 g2 g2 g2 g2 g2 g2 g2 g2 g2 g2 g2 g2 g2 g2 g2 g2 g2 g2 g2 g2 g2 g2 g2 g2 g緔2 g^2 gT2 g,2 g$2 g2 g2 g2 g12 g12 g2 g2 g 2 g2 gB2 g2 g2 gu2 g2 g2 g2 g/2 g)2 g32 g!2 g2 g 2 g2 g2 g2 g2 g82 g,2 gb2 g2 g2 g琋2 g2 g2 g2 g2 g72 g2 g2 g 2 gS2 gE2 gh3m gY3l g93k g/3j g!3i g3h g谯3g g谣3f g3d g3e g訯3c g3a g3b g虪3` g虔3_ g薱3^ g?3] g93\ g33[ g13Z g蒴3Y g蒖3X g'3W g3V g3U g3T g3S g3R g3Q g3P g3O g3N g3M g3L g}3K g}3J g|3I g|3H gv3G go3F go3E gnw3D gnQ3C g2 g} 2 g|2 gy2 gy2 gw2 gw2 gv2 gv2 gq2 gq2 gq2 gn12 gn%2 gk2 gk2 gh2 gh2 gd2 gd2 gc2 gc2 gaV2 gaV2 g^2 g^2 g]2~ g]2{ g]2z g]2} g]2| g[d2y gYM2x gYC2w gT^2v gR2u gQ2t gQ2s gL2r gK2q gK2p gGr2o g3n gD2n gD2m gD2l gB2k gB2j g>2i g>2h g>2g g>2f g82e g82d g12c g+2b g+2a g)2` g%2_ g$2^ g$2] g2\ g2[ g2Y g2Z g2X g2W g62V g 2U g2T g2S g2R g2Q g2P gL2O g:2N g32M g2L g 2K g!2J g.2I g 2H g2G gy2F g2E L ( : A 3 ? av&LVX  -;' ossec13001gExim Auth failed2025-03-29 17:43:30 dovecot_plain authenticator failed for mail.infologic.co.il [85.130.200.51]:46161: 535 Incorrect authentication data (set_id=sales)85.130.200.51294640jW  -_) ossec13001gExim Auth failed2025-03-29 17:43:20 dovecot_plain authenticator failed for ([113.219.177.95]) [113.219.177.95]:56338: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)113.219.177.951814991PV  -3# ossec13001gExim Auth failed2025-03-29 16:43:55 dovecot_plain authenticator failed for ([2.55.89.171]) [2.55.89.171]:42752: 535 Incorrect authentication data (set_id=services)2.55.89.171294640U  - ) ossec13001gExim Auth failed2025-03-29 16:43:46 dovecot_plain authenticator failed for 180.188.76.219.static.netvigator.com [219.76.188.180]:52410: 535 Incorrect authentication data (set_id=services@heipowersystem.com)219.76.188.1801819730WT  -9) ossec13001gExim Auth failed2025-03-29 16:22:54 dovecot_plain authenticator failed for ([182.160.107.51]) [182.160.107.51]:41516: 535 Incorrect authentication data (set_id=sales)182.160.107.511210997jS  -_) ossec13001gExim Auth failed2025-03-29 16:22:44 dovecot_plain authenticator failed for ([209.38.100.151]) [209.38.100.151]:41292: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)209.38.100.1512750405fR  -W) ossec13001gExim Auth failed2025-03-29 16:01:12 dovecot_login authenticator failed for ([45.201.140.227]) [45.201.140.227]:32414: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)45.201.140.2271831722vQ  -y' ossec13001gExim Auth failed2025-03-29 16:01:02 dovecot_login authenticator failed for ([89.207.218.10]) [89.207.218.10]:55300: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)89.207.218.102017370ZP  -=+ ossec13001gExim Auth failed2025-03-29 15:27:47 dovecot_plain authenticator failed for ([125.130.249.158]) [125.130.249.158]:35878: 535 Incorrect authentication data (set_id=sales)125.130.249.1581835841gO  -Y) ossec13001gExim Auth failed2025-03-29 15:27:34 dovecot_plain authenticator failed for ([58.131.97.5]) [123.127.207.75]:37820: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)123.127.207.751814991ZN  -?) ossec13001gExim Auth failed2025-03-29 15:23:10 dovecot_plain authenticator failed for ([178.178.222.59]) [178.178.222.59]:35472: 535 Incorrect authentication data (set_id=services)178.178.222.592017370pM  -i+ ossec13001gExim Auth failed2025-03-29 15:22:40 dovecot_plain authenticator failed for ([163.179.105.241]) [163.179.105.241]:46275: 535 Incorrect authentication data (set_id=services@heipowersystem.com)163.179.105.2411814991 L  -!' ossec13001gExim Auth failed2025-03-29 15:22:55 dovecot_plain authenticator failed for wsip-64-207-225-55.tu.ok.cox.net (wsip-64-207-241-177.tu.ok.cox.net) [64.207.225.55]:44618: 535 Incorrect authentication data (set_id=services)64.207.225.556252001uK  -w' ossec13001gExim Auth failed2025-03-29 15:01:41 dovecot_plain authenticator failed for 79-139-147-15.dynamic.spd-mgts.ru ([77.51.196.152]) [79.139.147.15]:1078: 535 Incorrect authentication data (set_id=sales)79.139.147.152017370jJ  -_) ossec13001gExim Auth failed2025-03-29 15:01:30 dovecot_plain authenticator failed for ([31.207.207.180]) [31.207.207.180]:42354: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)31.207.207.1802017370`I  -I+ ossec13001gExim Auth failed2025-03-29 14:57:34 dovecot_login authenticator failed for ([165.227.129.203]) [165.227.129.203]:57518: 535 Incorrect authentication data (set_id=datenschutz)165.227.129.2032921044pH  -k) ossec13001gExim Auth failed2025-03-29 14:57:24 dovecot_login authenticator failed for ([49.124.154.174]) [49.124.154.174]:55624: 535 Incorrect authentication data (set_id=datenschutz@heipowersystem.com)49.124.154.1741733045   8 M x g =_qnj  -e+ ossec13001gExim Auth failed2025-03-29 19:25:50 dovecot_plain authenticator failed for ([221.195.72.195]) [221.195.208.171]:5934: 535 Incorrect authentication data (set_id=services@heipowersystem.com)221.195.208.1711814991ji  -_) ossec13001gExim Auth failed2025-03-29 19:04:18 dovecot_plain authenticator failed for ([176.32.186.254]) [176.32.186.254]:65014: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)176.32.186.2542017370Zh  -=+ ossec13001gExim Auth failed2025-03-29 19:04:31 dovecot_plain authenticator failed for ([122.224.164.194]) [122.224.164.194]:52319: 535 Incorrect authentication data (set_id=sales)122.224.164.1941814991Zg  -?) ossec13001gExim Auth failed2025-03-29 18:59:19 dovecot_login authenticator failed for ([150.253.98.232]) [150.253.98.232]:33247: 535 Incorrect authentication data (set_id=services)150.253.98.2326252001mf  -e) ossec13001gExim Auth failed2025-03-29 18:59:06 dovecot_login authenticator failed for ([85.194.161.135]) [85.194.161.135]:59878: 535 Incorrect authentication data (set_id=services@heipowersystem.com)85.194.161.1352661886(e 3S) ossec11301ggNew FTP connection.Mar 29 18:11:09 vm1 pure-ftpd[433334]: (?@185.180.140.13) [INFO] New connection from 185.180.140.13185.180.140.132264397+d 3W+ ossec11301geNew FTP connection.Mar 29 18:11:08 vm1 pure-ftpd[433332]: (?@185.180.140.137) [INFO] New connection from 185.180.140.137185.180.140.1372264397+c 3W+ ossec11301geNew FTP connection.Mar 29 18:11:07 vm1 pure-ftpd[433325]: (?@185.180.140.138) [INFO] New connection from 185.180.140.138185.180.140.1382264397+b 3W+ ossec11301gcNew FTP connection.Mar 29 18:11:04 vm1 pure-ftpd[433321]: (?@185.180.140.139) [INFO] New connection from 185.180.140.139185.180.140.1392264397aa  -S# ossec13001gExim Auth failed2025-03-29 18:09:13 dovecot_plain authenticator failed for ([1.28.87.246]) [1.28.87.246]:46168: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)1.28.87.2461814991\`  -G' ossec13001gExim Auth failed2025-03-29 18:09:32 dovecot_plain authenticator failed for (185-189-123-105.laser.ir) [37.235.18.145]:52818: 535 Incorrect authentication data (set_id=sales)37.235.18.145130758j_  -_) ossec13001gExim Auth failed2025-03-29 18:09:22 dovecot_plain authenticator failed for ([223.82.241.142]) [223.82.241.142]:53306: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)223.82.241.1421814991Q^  -3# ossec13001gExim Auth failed2025-03-29 18:04:28 dovecot_plain authenticator failed for ([177.174.0.3]) [177.174.0.3]:50065: 535 Incorrect authentication data (set_id=services)177.174.0.33469034g]  -]% ossec13001gExim Auth failed2025-03-29 18:04:17 dovecot_plain authenticator failed for ([5.188.96.157]) [5.188.96.157]:56476: 535 Incorrect authentication data (set_id=services@heipowersystem.com)5.188.96.1572017370\\  -A+ ossec13001gExim Auth failed2025-03-29 17:56:46 dovecot_login authenticator failed for ([200.165.66.249]) [200.216.172.182]:41606: 535 Incorrect authentication data (set_id=feedback)200.216.172.1823469034{[  -% ossec13001gExim Auth failed2025-03-29 17:56:34 dovecot_login authenticator failed for syn-072-017-090-246.biz.spectrum.com [72.17.90.246]:46446: 535 Incorrect authentication data (set_id=feedback@heipowersystem.com)72.17.90.2466252001lZ  -a+ ossec13001gExim Auth failed2025-03-29 17:51:58 dovecot_login authenticator failed for (448990.cloudwaysapps.com) [128.199.118.234]:32412: 535 Incorrect authentication data (set_id=vikas.khandelwal)128.199.118.2341880251uY  -u) ossec13001gExim Auth failed2025-03-29 17:51:47 dovecot_login authenticator failed for ([138.75.252.175]) [138.75.252.175]:35310: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)138.75.252.1751880251 A( S k 3An{  -o# ossec13001gExim Auth failed2025-03-29 20:51:56 dovecot_plain authenticator failed for 89-67-38-27.dynamic.chello.pl [89.67.38.27]:59518: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)89.67.38.27798544Zz  -?) ossec13001gExim Auth failed2025-03-29 20:47:15 dovecot_plain authenticator failed for ([118.45.101.159]) [118.45.101.159]:37747: 535 Incorrect authentication data (set_id=services)118.45.101.1591835841{y  -% ossec13001gExim Auth failed2025-03-29 20:46:56 dovecot_plain authenticator failed for syn-074-062-020-170.biz.spectrum.com [74.62.20.170]:36504: 535 Incorrect authentication data (set_id=services@heipowersystem.com)74.62.20.1706252001}x  -+ ossec13001gyExim Auth failed2025-03-29 20:45:04 dovecot_login authenticator failed for (mobile-166-195-195-159.mycingular.net) [166.195.195.159]:54623: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)166.195.195.1596252001sw  -u% ossec13001gSExim Auth failed2025-03-29 20:44:25 dovecot_login authenticator failed for ([59.22.68.213]) [59.22.68.213]:53484: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)59.22.68.2131835841Wv  -9) ossec13001g Exim Auth failed2025-03-29 20:26:18 dovecot_plain authenticator failed for ([221.199.172.66]) [221.199.172.66]:56036: 535 Incorrect authentication data (set_id=sales)221.199.172.661814991Qu  -1% ossec13001g Exim Auth failed2025-03-29 20:26:06 dovecot_plain authenticator failed for ([183.6.43.236]) [183.6.43.236]:59499: 535 Incorrect authentication data (set_id=sales)183.6.43.2361814991zt  -' ossec13001g Exim Auth failed2025-03-29 20:25:47 dovecot_plain authenticator failed for syn-024-097-253-246.biz.spectrum.com [24.97.253.246]:54361: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)24.97.253.2466252001s  Q # ossec11000gLogin failed on the cpanel service[2025-03-29 20:00:40 +0530] info [cpaneld] 84.17.37.57 - heipowersystem "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipowersystem (has_cpuser_file failed)84.17.37.571819730r  Qs% ossec11000gLogin failed on the cpanel service[2025-03-29 20:00:39 +0530] info [cpaneld] 45.74.55.233 - heipower "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipower (has_cpuser_file failed)45.74.55.233357994q  Q) ossec11000gLogin failed on the cpanel service[2025-03-29 20:00:42 +0530] info [cpaneld] 103.46.140.241 - heipowersystemco "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipowersystemco (has_cpuser_file failed)103.46.140.2411210997!p  3K% ossec11301gTNew FTP connection.Mar 29 19:57:30 vm1 pure-ftpd[456746]: (?@45.82.78.104) [INFO] New connection from 45.82.78.10445.82.78.1041819730Wo  -9) ossec13001gExim Auth failed2025-03-29 19:43:18 dovecot_login authenticator failed for ([104.37.101.117]) [104.37.101.117]:41059: 535 Incorrect authentication data (set_id=sales)104.37.101.1176252001dn  -W% ossec13001gExim Auth failed2025-03-29 19:43:00 dovecot_login authenticator failed for ([60.174.34.26]) [60.174.34.26]:32827: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)60.174.34.261814991Qm  -1% ossec13001gExim Auth failed2025-03-29 19:30:54 dovecot_plain authenticator failed for ([197.5.144.31]) [197.5.144.31]:47674: 535 Incorrect authentication data (set_id=sales)197.5.144.312464461jl  -_) ossec13001gExim Auth failed2025-03-29 19:30:37 dovecot_plain authenticator failed for ([216.126.65.234]) [216.126.65.234]:44473: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)216.126.65.2346251999fk  -[% ossec13001gExim Auth failed2025-03-29 19:26:00 dovecot_plain authenticator failed for static-84-242-88-70.bb.vodafone.cz [84.242.88.70]:36466: 535 Incorrect authentication data (set_id=services)84.242.88.703077311 * T /Pfh  -a' ossec13001g"Exim Auth failed2025-03-29 22:08:28 dovecot_plain authenticator failed for ([65.20.205.228]) [65.20.205.228]:43995: 535 Incorrect authentication data (set_id=services@heipowersystem.com)65.20.205.22899237m  -e) ossec13001g!Exim Auth failed2025-03-29 22:08:13 dovecot_plain authenticator failed for ([222.85.107.135]) [222.85.107.135]:41522: 535 Incorrect authentication data (set_id=services@heipowersystem.com)222.85.107.1351814991m  -g' ossec13001g""Exim Auth failed2025-03-29 22:08:58 dovecot_plain authenticator failed for broadband-77-37-226-228.ip.moscow.rt.ru [77.37.226.228]:58718: 535 Incorrect authentication data (set_id=services)77.37.226.2282017370]  -C+ ossec13001g"Exim Auth failed2025-03-29 22:08:46 dovecot_plain authenticator failed for ([218.149.235.152]) [218.149.235.152]:34072: 535 Incorrect authentication data (set_id=services)218.149.235.1521835841T  -5' ossec13001g!Exim Auth failed2025-03-29 22:07:57 dovecot_login authenticator failed for ([125.20.46.114]) [125.20.46.114]:39112: 535 Incorrect authentication data (set_id=sales)125.20.46.1141269750f  -[' ossec13001g!Exim Auth failed2025-03-29 22:07:46 dovecot_login authenticator failed for ([78.142.41.167]) [78.142.41.167]:57762: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)78.142.41.167732800[ -C% ossec13001g Exim Auth failed2025-03-29 22:00:06 dovecot_login authenticator failed for (s2seducationtrust.com) [125.72.54.81]:40564: 535 Incorrect authentication data (set_id=nologin)125.72.54.811814991\  -M ossec13001g Exim Auth failed2025-03-29 21:47:11 dovecot_plain authenticator failed for net-5-95-24-4.cust.vodafonedsl.it [5.95.24.4]:37656: 535 Incorrect authentication data (set_id=sales)5.95.24.43175395Y  -C# ossec13001gExim Auth failed2025-03-29 21:47:06 dovecot_plain authenticator failed for bl19-157-40.dsl.telepac.pt [2.80.157.40]:37834: 535 Incorrect authentication data (set_id=sales)2.80.157.402264397v  -y' ossec13001gExim Auth failed2025-03-29 21:46:46 dovecot_plain authenticator failed for 57-45-246-103.southernonline.net [103.246.45.57]:41894: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)103.246.45.571269750   W#+ ossec9708gDovecot Aborted Login with empty userMar 29 21:46:41 vm1 dovecot[2184869]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=185.247.137.208, lip=103.74.54.108, TLS, session=185.247.137.208298795] -C) ossec13001ghExim Auth failed2025-03-29 21:40:15 dovecot_login authenticator failed for (thepsindustries.com) [42.193.105.109]:35184: 535 Incorrect authentication data (set_id=nologin)42.193.105.10918149919  Ai) ossec11302gFTP Authentication failed.Mar 29 21:38:06 vm1 pure-ftpd[479010]: (?@130.211.96.179) [WARNING] Authentication failed for user [anonymous]130.211.96.1792802361( 3S) ossec11301gNew FTP connection.Mar 29 21:38:00 vm1 pure-ftpd[479010]: (?@130.211.96.179) [INFO] New connection from 130.211.96.179130.211.96.1792802361R~  -3% ossec13001gAExim Auth failed2025-03-29 20:56:56 dovecot_login authenticator failed for ([180.74.188.5]) [180.74.188.5]:59483: 535 Incorrect authentication data (set_id=andrew)180.74.188.51733045n}  -e+ ossec13001g-Exim Auth failed2025-03-29 20:56:37 dovecot_login authenticator failed for ([175.206.105.126]) [175.206.105.126]:54574: 535 Incorrect authentication data (set_id=andrew@heipowersystem.com)175.206.105.1261835841`|  -K) ossec13001g!Exim Auth failed2025-03-29 20:52:09 dovecot_plain authenticator failed for (91.244.113.178.wirenet.tv) [91.244.113.178]:44918: 535 Incorrect authentication data (set_id=sales)91.244.113.1782017370  D H E Z(y  -}) ossec13001g?Exim Auth failed2025-03-30 00:16:16 dovecot_login authenticator failed for ([27.123.123.185]) [128.185.194.62]:53872: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)128.185.194.621269750a  -S' ossec13001g@Exim Auth failed2025-03-30 00:16:27 dovecot_login authenticator failed for ([65.20.193.144]) [65.20.193.144]:55479: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)65.20.193.14499237  -% ossec13001g?Exim Auth failed2025-03-30 00:15:59 dovecot_login authenticator failed for 1-36-180-128.ptr.netvigator.com [1.36.180.128]:33482: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)1.36.180.1281819730  ?/ ossec1008g=Process exiting (killed).Mar 30 00:06:24 vm1 spamd[189082]: spamd: server killed by SIGTERM, shutting downY  -=) ossec13001g;Exim Auth failed2025-03-29 23:55:28 dovecot_login authenticator failed for ([125.35.109.214]) [125.35.109.214]:40332: 535 Incorrect authentication data (set_id=privacy)125.35.109.2141814991o  -g+ ossec13001g;Exim Auth failed2025-03-29 23:55:07 dovecot_login authenticator failed for ([137.174.129.225]) [137.174.129.186]:47056: 535 Incorrect authentication data (set_id=privacy@heipowersystem.com)137.174.129.1866252001m  -c+ ossec13001g6Exim Auth failed2025-03-29 23:33:44 dovecot_plain authenticator failed for ([103.186.221.174]) [103.186.221.174]:58810: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)103.186.221.1741269750j  -a' ossec13001g4Exim Auth failed2025-03-29 23:28:54 dovecot_plain authenticator failed for ([218.14.157.25]) [218.14.157.25]:47073: 535 Incorrect authentication data (set_id=services@heipowersystem.com)218.14.157.251814991'  3S) ossec11301g0PNew FTP connection.Mar 29 23:09:26 vm1 pure-ftpd[498932]: (?@198.235.24.176) [INFO] New connection from 198.235.24.176198.235.24.1766252001T  -5' ossec13001g/Exim Auth failed2025-03-29 23:07:39 dovecot_plain authenticator failed for ([61.131.46.146]) [61.131.46.146]:49896: 535 Incorrect authentication data (set_id=sales)61.131.46.1461814991g  -[' ossec13001g/Exim Auth failed2025-03-29 23:07:27 dovecot_plain authenticator failed for ([83.219.250.17]) [83.219.250.17]:40660: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)83.219.250.1726618865  Ae% ossec11302g%FTP Authentication failed.Mar 29 22:24:11 vm1 pure-ftpd[488974]: (?@15.204.37.90) [WARNING] Authentication failed for user [anonymous]15.204.37.906252001!  3K% ossec11301g%New FTP connection.Mar 29 22:24:01 vm1 pure-ftpd[488974]: (?@15.204.37.90) [INFO] New connection from 15.204.37.9015.204.37.906252001!  3K% ossec11301g%New FTP connection.Mar 29 22:23:59 vm1 pure-ftpd[488959]: (?@15.204.37.85) [INFO] New connection from 15.204.37.8515.204.37.856252001x  -# ossec13001g#"Exim Auth failed2025-03-29 22:13:13 dovecot_plain authenticator failed for 73.red-83-52-80.dynamicip.rima-tde.net [83.52.80.73]:49469: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)83.52.80.732510769W  -9) ossec13001g#<Exim Auth failed2025-03-29 22:13:39 dovecot_plain authenticator failed for ([103.174.145.34]) [103.174.145.34]:34747: 535 Incorrect authentication data (set_id=sales)103.174.145.341269750r  -s% ossec13001g#.Exim Auth failed2025-03-29 22:13:25 dovecot_plain authenticator failed for laubervilliers-657-1-93-158.w80-14.abo.wanadoo.fr [80.14.31.158]:35614: 535 Incorrect authentication data (set_id=sales)80.14.31.1583017382g  -[' ossec13001g#Exim Auth failed2025-03-29 22:12:44 dovecot_plain authenticator failed for ([60.166.31.198]) [60.166.31.198]:57313: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)60.166.31.1981814991 - X } y 4OQguqX/  -?% ossec13001gUExim Auth failed2025-03-30 01:49:00 dovecot_login authenticator failed for (thepsindustries.com) [119.96.131.8]:56550: 535 Incorrect authentication data (set_id=nologin)119.96.131.81814991Y.  -=) ossec13001gQ^Exim Auth failed2025-03-30 01:30:29 dovecot_login authenticator failed for ([222.105.182.88]) [222.105.182.88]:57188: 535 Incorrect authentication data (set_id=istok91)222.105.182.881835841-  -% ossec13001gQRExim Auth failed2025-03-30 01:30:17 dovecot_login authenticator failed for 32.104.29.34.bc.googleusercontent.com [34.29.104.32]:59758: 535 Incorrect authentication data (set_id=istok91@saintsoldiercollege.com)34.29.104.326252001n,  -i' ossec13001gQFExim Auth failed2025-03-30 01:30:05 dovecot_login authenticator failed for ([221.157.85.22]) [221.157.85.22]:37208: 535 Incorrect authentication data (set_id=istok91@saintsoldiercollege.com)221.157.85.221835841f+  -[' ossec13001gKExim Auth failed2025-03-30 01:06:03 dovecot_login authenticator failed for (wcdma.178-76-69-221.moldcell.md) [178.76.69.221]:47340: 535 Incorrect authentication data (set_id=services)178.76.69.221617790z*  -' ossec13001gKExim Auth failed2025-03-30 01:05:49 dovecot_login authenticator failed for 202-4-196-180.static.pccw-hkt.com [202.4.196.180]:35975: 535 Incorrect authentication data (set_id=services@heipowersystem.com)202.4.196.1801819730a)  -O' ossec13001gHExim Auth failed2025-03-30 00:54:36 dovecot_login authenticator failed for host-85-237-57-200.dsl.sura.ru [85.237.57.200]:36848: 535 Incorrect authentication data (set_id=sales)85.237.57.2002017370^(  -O! ossec13001gHExim Auth failed2025-03-30 00:54:27 dovecot_login authenticator failed for ([1.30.20.98]) [1.30.20.98]:46128: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)1.30.20.981814991T'  -3) ossec13001gHExim Auth failed2025-03-30 00:54:15 dovecot_plain authenticator failed for ([58.131.97.5]) [123.127.207.75]:37160: 535 Incorrect authentication data (set_id=sales)123.127.207.751814991j&  -_) ossec13001gHExim Auth failed2025-03-30 00:53:58 dovecot_plain authenticator failed for ([109.195.69.156]) [109.195.69.156]:26438: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)109.195.69.1562017370&%  3S) ossec11301gGNew FTP connection.Mar 30 00:49:34 vm1 pure-ftpd[521735]: (?@185.247.137.46) [INFO] New connection from 185.247.137.46185.247.137.46298795o$  -g+ ossec13001gGExim Auth failed2025-03-30 00:49:08 dovecot_plain authenticator failed for 217-208-141-101-no2620.tbcn.telia.com [217.208.141.101]:40211: 535 Incorrect authentication data (set_id=services)217.208.141.1012661886#  - ' ossec13001gGExim Auth failed2025-03-30 00:48:59 dovecot_plain authenticator failed for (95-161-95-132.broadband.spb.TiERA.org) [95.161.95.132]:51140: 535 Incorrect authentication data (set_id=services@heipowersystem.com)95.161.95.1322017370W"  -9) ossec13001gBExim Auth failed2025-03-30 00:29:03 dovecot_plain authenticator failed for ([114.247.207.98]) [114.247.207.98]:55297: 535 Incorrect authentication data (set_id=sales)114.247.207.981814991Q!  -1% ossec13001gBExim Auth failed2025-03-30 00:28:49 dovecot_plain authenticator failed for ([220.85.68.71]) [220.85.68.71]:52877: 535 Incorrect authentication data (set_id=sales)220.85.68.711835841a  -S# ossec13001gBExim Auth failed2025-03-30 00:28:12 dovecot_plain authenticator failed for ([1.241.127.6]) [1.241.127.6]:45742: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)1.241.127.61835841j  -_) ossec13001gBExim Auth failed2025-03-30 00:28:00 dovecot_plain authenticator failed for ([111.91.178.253]) [111.91.178.253]:57434: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)111.91.178.2531835841 (9 W ^ w @  -!) ossec13001ggExim Auth failed2025-03-30 03:03:01 dovecot_login authenticator failed for (nsg-corporate-12.229.187.122.airtel.in) [122.187.229.12]:33092: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)122.187.229.121269750!?  3K% ossec11301geNew FTP connection.Mar 30 02:57:03 vm1 pure-ftpd[549692]: (?@20.65.195.51) [INFO] New connection from 20.65.195.5120.65.195.516252001]>  -E) ossec13001gdExim Auth failed2025-03-30 02:53:37 dovecot_login authenticator failed for ([93.188.204.252]) [93.188.204.252]:56442: 535 Incorrect authentication data (set_id=socialmedia)93.188.204.2522017370g=  -_# ossec13001gdExim Auth failed2025-03-30 02:53:27 dovecot_login authenticator failed for ([49.65.1.179]) [49.65.1.179]:31879: 535 Incorrect authentication data (set_id=socialmedia@heipowersystem.com)49.65.1.1791814991$<  3O' ossec11301gbwNew FTP connection.Mar 30 02:43:26 vm1 pure-ftpd[546657]: (?@88.214.25.123) [INFO] New connection from 88.214.25.12388.214.25.1232921044Z;  -=+ ossec13001g\Exim Auth failed2025-03-30 02:16:19 dovecot_plain authenticator failed for ([112.220.235.237]) [112.220.235.237]:41264: 535 Incorrect authentication data (set_id=sales)112.220.235.2371835841u:  -w' ossec13001g\Exim Auth failed2025-03-30 02:16:07 dovecot_plain authenticator failed for 42-200-70-134.static.imsbiz.com [42.200.70.134]:42111: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)42.200.70.1341819730]9  -C+ ossec13001g[Exim Auth failed2025-03-30 02:11:38 dovecot_plain authenticator failed for ([175.208.186.206]) [175.208.186.206]:54996: 535 Incorrect authentication data (set_id=services)175.208.186.2061835841D8  -' ossec13001gZExim Auth failed2025-03-30 02:11:33 dovecot_plain authenticator failed for ([85.159.164.28]) [85.159.164.28]:57352: 535 Incorrect authentication data85.159.164.28294640b7  -S' ossec13001gZExim Auth failed2025-03-30 02:11:31 dovecot_login authenticator failed for ([95.156.54.174]) [95.156.54.174]:53824: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)95.156.54.1747180756  -) ossec13001gZExim Auth failed2025-03-30 02:11:20 dovecot_login authenticator failed for vmi2383323.contaboserver.net [149.102.148.49]:35636: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)149.102.148.492635167p5  -i+ ossec13001gZExim Auth failed2025-03-30 02:11:10 dovecot_plain authenticator failed for ([211.194.173.186]) [211.194.173.186]:42567: 535 Incorrect authentication data (set_id=services@heipowersystem.com)211.194.173.1861835841Z4  -A' ossec13001gXJExim Auth failed2025-03-30 02:00:02 dovecot_login authenticator failed for (pc0.zz.ha.cn) [218.28.98.161]:51297: 535 Incorrect authentication data (set_id=brander-center)218.28.98.1611814991u3  -w' ossec13001gX6Exim Auth failed2025-03-30 01:59:42 dovecot_login authenticator failed for ([165.16.34.111]) [165.16.34.111]:47179: 535 Incorrect authentication data (set_id=brander-center@saintsoldiercollege.com)165.16.34.1112215636^2  -O! ossec13001gUExim Auth failed2025-03-30 01:49:45 dovecot_plain authenticator failed for ([1.30.20.98]) [1.30.20.98]:54732: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)1.30.20.981814991k1  -e% ossec13001gUExim Auth failed2025-03-30 01:49:25 dovecot_login authenticator failed for (thepsindustries.com) [119.96.131.8]:60112: 535 Incorrect authentication data (set_id=office@thepsindustries.com)119.96.131.81814991T0  -5' ossec13001gUExim Auth failed2025-03-30 01:49:55 dovecot_plain authenticator failed for ([114.242.61.19]) [114.242.61.35]:52596: 535 Incorrect authentication data (set_id=sales)114.242.61.351814991 ) > H ] N f}2"R 3K% ossec11301gNew FTP connection.Mar 30 05:44:03 vm1 pure-ftpd[587167]: (?@92.255.57.55) [INFO] New connection from 92.255.57.5592.255.57.551819730!Q  3K% ossec11301gNew FTP connection.Mar 30 05:43:54 vm1 pure-ftpd[586934]: (?@92.255.57.61) [INFO] New connection from 92.255.57.6192.255.57.611819730ZP  -=+ ossec13001gExim Auth failed2025-03-30 05:02:13 dovecot_plain authenticator failed for ([220.158.233.247]) [220.158.233.247]:32804: 535 Incorrect authentication data (set_id=sales)220.158.233.2471831722yO  -}) ossec13001gExim Auth failed2025-03-30 05:01:57 dovecot_plain authenticator failed for 125-228-225-91.hinet-ip.hinet.net [125.228.225.91]:54410: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)125.228.225.911668284mN  -c+ ossec13001gExim Auth failed2025-03-30 04:57:32 dovecot_plain authenticator failed for (172.183.199.112.unknown.m1.com.sg) [112.199.183.172]:41514: 535 Incorrect authentication data (set_id=services)112.199.183.1721880251lM  -c) ossec13001gExim Auth failed2025-03-30 04:57:22 dovecot_plain authenticator failed for ([223.82.232.211]) [223.82.232.211]:1141: 535 Incorrect authentication data (set_id=services@heipowersystem.com)223.82.232.2111814991wL  -{' ossec13001gExim Auth failed2025-03-30 04:57:09 dovecot_plain authenticator failed for p388233-obmd01.tokyo.ocn.ne.jp [60.45.176.232]:55362: 535 Incorrect authentication data (set_id=services@heipowersystem.com)60.45.176.2321861060yK  -' ossec13001g}Exim Auth failed2025-03-30 04:39:47 dovecot_login authenticator failed for static.244.178.161.5.clients.your-server.de [5.161.178.244]:35130: 535 Incorrect authentication data (set_id=vikas.khandelwal)5.161.178.2446252001nJ  -k% ossec13001g}Exim Auth failed2025-03-30 04:39:35 dovecot_login authenticator failed for ([58.96.247.71]) [58.96.247.71]:4950: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)58.96.247.711880251eI  -U) ossec13001g|Exim Auth failed2025-03-30 04:35:44 dovecot_plain authenticator failed for (120.245.223.60.adsl-pool.sx.cn) [60.223.245.120]:37501: 535 Incorrect authentication data (set_id=sales)60.223.245.1201814991dH  -W% ossec13001g|Exim Auth failed2025-03-30 04:35:19 dovecot_plain authenticator failed for ([223.245.8.11]) [223.245.8.11]:53852: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)223.245.8.111814991CG  77 ossec502gvOssec server started.ossec: Ossec started.EF  -' ossec13001goExim Auth failed2025-03-30 03:40:12 dovecot_plain authenticator failed for ([220.122.115.9]) [220.122.115.9]:41907: 535 Incorrect authentication data220.122.115.91835841gE  -[' ossec13001goExim Auth failed2025-03-30 03:39:31 dovecot_plain authenticator failed for ([211.223.41.90]) [211.223.41.90]:53914: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)211.223.41.901835841rD  -u# ossec13001gnwExim Auth failed2025-03-30 03:34:37 dovecot_plain authenticator failed for bsn-61-28-83.dynamic.siol.net [86.61.28.83]:38616: 535 Incorrect authentication data (set_id=services@heipowersystem.com)86.61.28.833190538gC  -]% ossec13001gnQExim Auth failed2025-03-30 03:34:00 dovecot_plain authenticator failed for ([14.37.206.76]) [14.37.206.76]:60505: 535 Incorrect authentication data (set_id=services@heipowersystem.com)14.37.206.761835841mB  -c+ ossec13001giKExim Auth failed2025-03-30 03:12:35 dovecot_plain authenticator failed for ([123.116.142.131]) [123.116.142.131]:53538: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)123.116.142.1311814991bA  -O) ossec13001ggExim Auth failed2025-03-30 03:03:13 dovecot_login authenticator failed for ([213.255.219.43]) [213.255.219.43]:60678: 535 Incorrect authentication data (set_id=vikas.khandelwal)213.255.219.432782113 VGZ } <[1VWd  -;' ossec13001gExim Auth failed2025-03-30 07:44:25 dovecot_plain authenticator failed for ([119.84.241.94]) [119.84.241.94]:50470: 535 Incorrect authentication data (set_id=services)119.84.241.941814991!c  3K% ossec11301g訯New FTP connection.Mar 30 07:43:00 vm1 pure-ftpd[613048]: (?@92.255.57.45) [INFO] New connection from 92.255.57.4592.255.57.451819730zb  -% ossec13001gExim Auth failed2025-03-30 07:22:21 dovecot_plain authenticator failed for broadband-5-228-54-184.ip.moscow.rt.ru [5.228.54.184]:50418: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)5.228.54.1842017370Za  -=+ ossec13001gExim Auth failed2025-03-30 07:22:35 dovecot_plain authenticator failed for ([211.169.212.206]) [211.169.212.206]:55857: 535 Incorrect authentication data (set_id=sales)211.169.212.2061835841q`  -q% ossec13001g虪Exim Auth failed2025-03-30 06:38:58 dovecot_login authenticator failed for 91.red-88-10-205.dynamicip.rima-tde.net [88.10.205.91]:50210: 535 Incorrect authentication data (set_id=brander-center)88.10.205.912510769_  -+ ossec13001g虔Exim Auth failed2025-03-30 06:38:36 dovecot_login authenticator failed for 184.sub-166-145-211.myvzw.com [166.145.211.184]:13308: 535 Incorrect authentication data (set_id=brander-center@saintsoldiercollege.com)166.145.211.1846252001'^  3S) ossec11301g薱New FTP connection.Mar 30 06:26:17 vm1 pure-ftpd[596550]: (?@167.94.145.102) [INFO] New connection from 167.94.145.102167.94.145.1026252001]]  -C+ ossec13001g?Exim Auth failed2025-03-30 06:20:05 dovecot_plain authenticator failed for ([121.202.146.144]) [121.202.146.144]:38877: 535 Incorrect authentication data (set_id=services)121.202.146.1441819730[\  -E% ossec13001g9Exim Auth failed2025-03-30 06:20:01 dovecot_login authenticator failed for 200.19.70.86.rev.sfr.net [86.70.19.200]:59268: 535 Incorrect authentication data (set_id=istok91)86.70.19.2003017382c[  -Y# ossec13001g3Exim Auth failed2025-03-30 06:19:54 dovecot_plain authenticator failed for ([194.31.8.12]) [194.31.8.12]:53402: 535 Incorrect authentication data (set_id=services@heipowersystem.com)194.31.8.12614540nZ  -i' ossec13001g1Exim Auth failed2025-03-30 06:19:52 dovecot_login authenticator failed for ([99.104.223.26]) [99.104.223.26]:58502: 535 Incorrect authentication data (set_id=istok91@saintsoldiercollege.com)99.104.223.266252001ZY  -E% ossec13001g蒴Exim Auth failed2025-03-30 06:09:16 dovecot_login authenticator failed for 77-85-52-109.ip.btc-net.bg [77.85.52.109]:50692: 535 Incorrect authentication data (set_id=sales)77.85.52.109732800jX  -_) ossec13001g蒖Exim Auth failed2025-03-30 06:08:45 dovecot_login authenticator failed for ([119.206.34.142]) [119.206.34.142]:60226: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)119.206.34.1421835841QW  -1% ossec13001g'Exim Auth failed2025-03-30 05:58:23 dovecot_plain authenticator failed for ([103.68.10.51]) [103.68.10.51]:34970: 535 Incorrect authentication data (set_id=sales)103.68.10.511269750dV  -W% ossec13001gExim Auth failed2025-03-30 05:58:15 dovecot_plain authenticator failed for ([113.192.1.27]) [113.192.1.26]:58126: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)113.192.1.261643084YU  -=) ossec13001gExim Auth failed2025-03-30 05:52:48 dovecot_login authenticator failed for ([183.220.243.62]) [183.220.243.62]:54440: 535 Incorrect authentication data (set_id=booking)183.220.243.621814991iT  -_' ossec13001gExim Auth failed2025-03-30 05:52:28 dovecot_login authenticator failed for ([203.81.213.46]) [203.81.213.46]:51906: 535 Incorrect authentication data (set_id=booking@heipowersystem.com)203.81.213.4611685795S  Ae% ossec11302gFTP Authentication failed.Mar 30 05:44:08 vm1 pure-ftpd[587167]: (?@92.255.57.55) [WARNING] Authentication failed for user [anonymous]92.255.57.551819730  / 3 7 T qu`u  -K) ossec13001gExim Auth failed2025-03-30 09:47:53 dovecot_login authenticator failed for ([117.53.254.144]) [117.53.254.144]:59800: 535 Incorrect authentication data (set_id=brander-center)117.53.254.1441835841Yt  -=) ossec13001g%Exim Auth failed2025-03-30 09:31:40 dovecot_login authenticator failed for ([222.68.155.105]) [222.68.155.105]:45560: 535 Incorrect authentication data (set_id=istok91)222.68.155.1051814991rs  -s% ossec13001gExim Auth failed2025-03-30 09:31:11 dovecot_login authenticator failed for (ppp075.bol-online.com) [202.84.34.85]:36560: 535 Incorrect authentication data (set_id=istok91@saintsoldiercollege.com)202.84.34.851210997$r  3O' ossec11301gNew FTP connection.Mar 30 09:22:26 vm1 pure-ftpd[634076]: (?@20.169.104.93) [INFO] New connection from 20.169.104.9320.169.104.936252001Wq  -;' ossec13001gzExim Auth failed2025-03-30 09:07:30 dovecot_plain authenticator failed for ([58.238.74.138]) [58.238.74.138]:26441: 535 Incorrect authentication data (set_id=services)58.238.74.1381835841fp  -]% ossec13001gpExim Auth failed2025-03-30 09:07:18 dovecot_plain authenticator failed for ([185.226.88.5]) [185.226.88.5]:47670: 535 Incorrect authentication data (set_id=services@heipowersystem.com)185.226.88.5783754Zo  -?) ossec13001gExim Auth failed2025-03-30 08:52:38 dovecot_login authenticator failed for ([177.20.171.155]) [177.20.171.155]:38292: 535 Incorrect authentication data (set_id=director)177.20.171.1553469034gn  -]% ossec13001gExim Auth failed2025-03-30 08:52:23 dovecot_login authenticator failed for ([103.4.103.61]) [103.4.103.61]:59367: 535 Incorrect authentication data (set_id=director@heipowersystem.com)103.4.103.611168579Qm  -1% ossec13001ghExim Auth failed2025-03-30 08:45:51 dovecot_plain authenticator failed for ([180.74.188.5]) [180.74.188.5]:53856: 535 Incorrect authentication data (set_id=sales)180.74.188.51733045ml  -c+ ossec13001gYExim Auth failed2025-03-30 08:45:36 dovecot_plain authenticator failed for ([123.116.142.131]) [123.116.142.131]:45140: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)123.116.142.1311814991_k  -K' ossec13001g9Exim Auth failed2025-03-30 08:28:00 dovecot_login authenticator failed for ([89.169.144.44]) [89.169.144.44]:54788: 535 Incorrect authentication data (set_id=vikas.khandelwal)89.169.144.442017370_j  -K' ossec13001g/Exim Auth failed2025-03-30 08:27:51 dovecot_login authenticator failed for ([218.108.45.83]) [218.108.45.83]:50595: 535 Incorrect authentication data (set_id=vikas.khandelwal)218.108.45.831814991xi  -y+ ossec13001g!Exim Auth failed2025-03-30 08:27:36 dovecot_login authenticator failed for ([175.209.109.213]) [175.209.109.213]:41000: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)175.209.109.2131835841xh  -y+ ossec13001gExim Auth failed2025-03-30 08:27:22 dovecot_login authenticator failed for ([206.204.128.245]) [206.204.128.245]:41204: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)206.204.128.2452510769cg  -S' ossec13001g谯Exim Auth failed2025-03-30 08:17:10 dovecot_login authenticator failed for ([49.124.151.72]) [49.124.151.72]:37458: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)49.124.151.721733045xf  -}) ossec13001g谣Exim Auth failed2025-03-30 08:16:59 dovecot_login authenticator failed for ([172.104.238.129]) [147.235.208.61]:8681: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)147.235.208.61294640je  -a' ossec13001gExim Auth failed2025-03-30 07:44:13 dovecot_plain authenticator failed for ([61.186.136.36]) [61.186.136.36]:59919: 535 Incorrect authentication data (set_id=services@heipowersystem.com)61.186.136.361814991    * O a =S~}  -' ossec13001gExim Auth failed2025-03-30 11:52:13 dovecot_login authenticator failed for 24-119-144-86.cpe.sparklight.net [24.119.144.86]:47916: 535 Incorrect authentication data (set_id=istok91@saintsoldiercollege.com)24.119.144.866252001c  -U% ossec13001gbExim Auth failed2025-03-30 11:32:08 dovecot_plain authenticator failed for static-84-242-88-70.bb.vodafone.cz [84.242.88.70]:57994: 535 Incorrect authentication data (set_id=sales)84.242.88.703077311i  -_) ossec13001gXExim Auth failed2025-03-30 11:31:59 dovecot_plain authenticator failed for ([91.224.253.233]) [91.224.253.233]:38832: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)91.224.253.233690791i  -_) ossec13001gKExim Auth failed2025-03-30 11:23:14 dovecot_login authenticator failed for ([94.205.219.157]) [94.205.219.157]:48633: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)94.205.219.157290557Z  -=+ ossec13001gYExim Auth failed2025-03-30 11:23:29 dovecot_login authenticator failed for ([112.123.199.111]) [112.123.199.111]:37364: 535 Incorrect authentication data (set_id=sales)112.123.199.1111814991x  -{) ossec13001gExim Auth failed2025-03-30 11:04:25 dovecot_login authenticator failed for 144.46.246.220.static.netvigator.com [220.246.46.144]:58052: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)220.246.46.1441819730y  -}) ossec13001gExim Auth failed2025-03-30 11:04:14 dovecot_login authenticator failed for ([183.167.217.86]) [183.167.217.86]:50363: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)183.167.217.861814991Q~  -1% ossec13001gExim Auth failed2025-03-30 10:42:36 dovecot_login authenticator failed for ([138.36.24.33]) [138.36.24.33]:45664: 535 Incorrect authentication data (set_id=sales)138.36.24.333508796f}  -[' ossec13001gҴExim Auth failed2025-03-30 10:42:19 dovecot_login authenticator failed for ([95.156.54.174]) [95.156.54.174]:50832: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)95.156.54.174718075 |  W#+ ossec9708gDovecot Aborted Login with empty userMar 30 10:35:08 vm1 dovecot[2184869]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=185.247.137.183, lip=103.74.54.108, TLS, session=185.247.137.183298795j{  -a' ossec13001gExim Auth failed2025-03-30 10:31:04 dovecot_plain authenticator failed for h-62-63-230-115.a980.priv.bahnhof.se [62.63.230.115]:53198: 535 Incorrect authentication data (set_id=services)62.63.230.1152661886Wz  -;' ossec13001gExim Auth failed2025-03-30 10:30:41 dovecot_plain authenticator failed for ([95.139.64.162]) [95.139.64.162]:51573: 535 Incorrect authentication data (set_id=services)95.139.64.1622017370py  -i+ ossec13001gExim Auth failed2025-03-30 10:30:12 dovecot_plain authenticator failed for ([182.176.138.162]) [182.176.138.162]:32768: 535 Incorrect authentication data (set_id=services@heipowersystem.com)182.176.138.1621168579mx  -e) ossec13001gExim Auth failed2025-03-30 10:08:57 dovecot_plain authenticator failed for (nsg-corporate-21.226.187.122.airtel.in) [122.187.226.21]:58893: 535 Incorrect authentication data (set_id=sales)122.187.226.211269750zw  -) ossec13001gExim Auth failed2025-03-30 10:08:45 dovecot_plain authenticator failed for 198-91-194-206.cpe.distributel.net [198.91.194.206]:60058: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)198.91.194.2066251999ov  -o# ossec13001gExim Auth failed2025-03-30 09:47:41 dovecot_login authenticator failed for ([62.4.94.178]) [62.4.94.178]:41734: 535 Incorrect authentication data (set_id=brander-center@saintsoldiercollege.com)62.4.94.1782921044 \& V h OJL\'  3S) ossec11301geNew FTP connection.Mar 30 13:40:11 vm1 pure-ftpd[690794]: (?@185.242.226.22) [INFO] New connection from 185.242.226.22185.242.226.226252001`  -K) ossec13001geExim Auth failed2025-03-30 13:40:12 dovecot_login authenticator failed for ([115.85.251.188]) [115.85.251.188]:39942: 535 Incorrect authentication data (set_id=brander-center)115.85.251.18818149911 CU) ossec11309gyFTP Authentication success.Mar 30 13:40:32 vm1 pure-ftpd[690827]: (?@106.221.168.88) [INFO] user@spexscart.com is now logged in106.221.168.881269750( 3S) ossec11301gwNew FTP connection.Mar 30 13:40:30 vm1 pure-ftpd[690827]: (?@106.221.168.88) [INFO] New connection from 106.221.168.88106.221.168.881269750z  -% ossec13001gSExim Auth failed2025-03-30 13:39:54 dovecot_login authenticator failed for 200.19.70.86.rev.sfr.net [86.70.19.200]:33690: 535 Incorrect authentication data (set_id=brander-center@saintsoldiercollege.com)86.70.19.2003017382 Qo! ossec11000g2Login failed on the cpanel service[2025-03-30 13:22:17 +0530] info [cpaneld] 3.89.49.43 - heipower "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipower (has_cpuser_file failed)3.89.49.436252001*  3W+ ossec11301gNew FTP connection.Mar 30 13:21:41 vm1 pure-ftpd[686671]: (?@147.185.132.177) [INFO] New connection from 147.185.132.177147.185.132.1776252001j  -_) ossec13001g=Exim Auth failed2025-03-30 13:18:12 dovecot_login authenticator failed for 60-241-137-116.tpgi.com.au [60.241.137.116]:39540: 535 Incorrect authentication data (set_id=vikas.khandelwal)60.241.137.1162077456  -' ossec13001g+Exim Auth failed2025-03-30 13:17:55 dovecot_login authenticator failed for syn-024-097-253-246.biz.spectrum.com [24.97.253.246]:53683: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)24.97.253.2466252001Q  -3# ossec13001gExim Auth failed2025-03-30 13:16:34 dovecot_plain authenticator failed for ([1.28.87.246]) [1.28.87.246]:59740: 535 Incorrect authentication data (set_id=services)1.28.87.2461814991m  -e) ossec13001gExim Auth failed2025-03-30 13:16:13 dovecot_plain authenticator failed for ([216.194.174.74]) [216.194.174.27]:34035: 535 Incorrect authentication data (set_id=services@heipowersystem.com)216.194.174.276252001W  -9) ossec13001gExim Auth failed2025-03-30 12:54:56 dovecot_plain authenticator failed for ([49.124.154.167]) [49.124.154.167]:40430: 535 Incorrect authentication data (set_id=sales)49.124.154.1671733045g  -[' ossec13001gExim Auth failed2025-03-30 12:54:41 dovecot_plain authenticator failed for ([189.80.46.250]) [189.80.46.250]:34026: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)189.80.46.2503469034d  -U' ossec13001guExim Auth failed2025-03-30 11:53:48 dovecot_plain authenticator failed for bb119-74-38-254.singnet.com.sg [119.74.38.254]:34515: 535 Incorrect authentication data (set_id=services)119.74.38.2541880251j  -a' ossec13001geExim Auth failed2025-03-30 11:53:33 dovecot_plain authenticator failed for ([92.119.74.245]) [92.119.74.245]:44182: 535 Incorrect authentication data (set_id=services@heipowersystem.com)92.119.74.2452510769L  -)# ossec13001g;Exim Auth failed2025-03-30 11:52:51 dovecot_login authenticator failed for ([101.13.5.37]) [101.13.5.37]:44300: 535 Incorrect authentication data (set_id=tty)101.13.5.371668284k  -_+ ossec13001g%Exim Auth failed2025-03-30 11:52:29 dovecot_login authenticator failed for ([201.234.106.216]) [201.234.106.216]:50660: 535 Incorrect authentication data (set_id=tty@heipowersystem.com)201.234.106.2163865483g  -Y) ossec13001g#Exim Auth failed2025-03-30 11:52:27 dovecot_login authenticator failed for (120.245.223.60.adsl-pool.sx.cn) [60.223.245.120]:50902: 535 Incorrect authentication data (set_id=istok91)60.223.245.1201814991   t  6:VY(  -' ossec13001gExim Auth failed2025-03-30 15:12:18 dovecot_login authenticator failed for (mobile-166-195-004-247.mycingular.net) [166.195.4.247]:45046: 535 Incorrect authentication data (set_id=istok91@saintsoldiercollege.com)166.195.4.2476252001N'  -+% ossec13001g Exim Auth failed2025-03-30 14:54:38 dovecot_login authenticator failed for ([88.87.84.104]) [88.87.84.104]:58518: 535 Incorrect authentication data (set_id=ap)88.87.84.1042017370y&  -}) ossec13001g Exim Auth failed2025-03-30 14:54:21 dovecot_login authenticator failed for c-69-242-149-240.hsd1.mo.comcast.net [69.242.149.240]:59024: 535 Incorrect authentication data (set_id=ap@heipowersystem.com)69.242.149.2406252001`%  -K) ossec13001g Exim Auth failed2025-03-30 14:41:59 dovecot_login authenticator failed for ([211.248.31.142]) [211.248.31.142]:58696: 535 Incorrect authentication data (set_id=brander-center)211.248.31.1421835841x$  -{) ossec13001g Exim Auth failed2025-03-30 14:41:43 dovecot_login authenticator failed for ([112.184.222.12]) [112.184.222.12]:54317: 535 Incorrect authentication data (set_id=brander-center@saintsoldiercollege.com)112.184.222.121835841R#  -1' ossec13001g AExim Auth failed2025-03-30 14:39:19 dovecot_plain authenticator failed for showmyip.xyz [178.128.157.7]:33982: 535 Incorrect authentication data (set_id=services)178.128.157.76252001s"  -q) ossec13001g 1Exim Auth failed2025-03-30 14:39:03 dovecot_plain authenticator failed for 90-176-243-225.rcj.o2.cz [90.176.243.225]:60150: 535 Incorrect authentication data (set_id=services@heipowersystem.com)90.176.243.2253077311`!  -K) ossec13001gWExim Auth failed2025-03-30 14:22:38 dovecot_login authenticator failed for ([222.114.80.158]) [222.114.80.158]:41534: 535 Incorrect authentication data (set_id=brander-center)222.114.80.1581835841r  -s% ossec13001gIExim Auth failed2025-03-30 14:22:24 dovecot_login authenticator failed for ([14.85.155.62]) [14.85.155.62]:53292: 535 Incorrect authentication data (set_id=brander-center@saintsoldiercollege.com)14.85.155.621835841W  -9) ossec13001g-Exim Auth failed2025-03-30 14:17:41 dovecot_plain authenticator failed for ([222.119.124.66]) [222.119.124.66]:55286: 535 Incorrect authentication data (set_id=sales)222.119.124.661835841m  -k% ossec13001gExim Auth failed2025-03-30 14:17:24 dovecot_plain authenticator failed for 77-85-52-109.ip.btc-net.bg [77.85.52.109]:54865: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)77.85.52.109732800  [) ossec12004gNPossible Dovecot CVE-2019-11500 attemptMar 30 13:56:53 vm1 dovecot[2184869]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=15.235.227.163, lip=103.74.54.108, session=15.235.227.1631880251l  -e' ossec13001gExim Auth failed2025-03-30 13:42:14 dovecot_login authenticator failed for ([103.165.227.203]) [103.86.156.90]:61012: 535 Incorrect authentication data (set_id=services@heipowersystem.com)103.86.156.901643084A  gS) ossec11307gMultiple connection attempts from same sourceMar 30 13:42:34 vm1 pure-ftpd[691389]: (?@185.242.226.22) [INFO] New connection from 185.242.226.22185.242.226.226252001( 3S) ossec11301g New FTP connection.Mar 30 13:42:28 vm1 pure-ftpd[691346]: (?@185.242.226.22) [INFO] New connection from 185.242.226.22185.242.226.226252001h  -]) ossec13001gExim Auth failed2025-03-30 13:42:25 dovecot_login authenticator failed for (host-56-130-255-130.sevstar.net) [130.255.130.56]:53169: 535 Incorrect authentication data (set_id=services)130.255.130.56690791p  -k) ossec13001gmExim Auth failed2025-03-30 13:40:19 dovecot_login authenticator failed for (94-190-222-124.static.imsbiz.com) [94.190.222.124]:51352: 535 Incorrect authentication data (set_id=brander-center)94.190.222.1241819730   0 % ) ?*IZuvT9  -5' ossec13001g&mExim Auth failed2025-03-30 16:39:31 dovecot_login authenticator failed for ([118.38.239.52]) [118.38.239.52]:40944: 535 Incorrect authentication data (set_id=sales)118.38.239.521835841p8  -m' ossec13001g&aExim Auth failed2025-03-30 16:39:20 dovecot_login authenticator failed for 179-42-124-80.chtch.com.br [179.42.124.80]:53682: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)179.42.124.803469034n7  -k% ossec13001g"nExim Auth failed2025-03-30 16:22:29 dovecot_login authenticator failed for syn-072-134-003-252.res.spectrum.com [72.134.3.252]:55950: 535 Incorrect authentication data (set_id=brander-center)72.134.3.2526252001{6  -+ ossec13001g"dExim Auth failed2025-03-30 16:22:19 dovecot_login authenticator failed for ([211.117.144.194]) [211.117.144.194]:42890: 535 Incorrect authentication data (set_id=brander-center@saintsoldiercollege.com)211.117.144.1941835841a5  -O' ossec13001g!Exim Auth failed2025-03-30 16:16:53 dovecot_login authenticator failed for n219077029126.netvigator.com [219.77.29.126]:51170: 535 Incorrect authentication data (set_id=istok91)219.77.29.1261819730k4  -e% ossec13001g! Exim Auth failed2025-03-30 16:16:36 dovecot_login authenticator failed for ([14.45.208.48]) [14.45.208.48]:45586: 535 Incorrect authentication data (set_id=istok91@saintsoldiercollege.com)14.45.208.481835841]3  -C+ ossec13001gExim Auth failed2025-03-30 16:02:40 dovecot_plain authenticator failed for ([121.164.135.251]) [121.164.135.251]:42536: 535 Incorrect authentication data (set_id=services)121.164.135.2511835841p2  -i+ ossec13001gExim Auth failed2025-03-30 16:02:27 dovecot_plain authenticator failed for ([211.169.212.206]) [211.169.212.206]:63396: 535 Incorrect authentication data (set_id=services@heipowersystem.com)211.169.212.20618358411  W' ossec9708geDovecot Aborted Login with empty userMar 30 15:43:56 vm1 dovecot[2184869]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=194.164.107.5, lip=103.74.54.108, TLS, session=194.164.107.56252001f0  -Y' ossec13001gExim Auth failed2025-03-30 15:40:57 dovecot_plain authenticator failed for pub-62-171-44-219.dh-lwl.datazug.ch [62.171.44.219]:59771: 535 Incorrect authentication data (set_id=sales)62.171.44.2192658434x/  -% ossec13001gExim Auth failed2025-03-30 15:40:47 dovecot_plain authenticator failed for syn-072-017-090-246.biz.spectrum.com [72.17.90.246]:36144: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)72.17.90.2466252001$.  3O' ossec11301gNew FTP connection.Mar 30 15:24:21 vm1 pure-ftpd[714148]: (?@91.196.152.98) [INFO] New connection from 91.196.152.9891.196.152.9830173827-  Ag' ossec11302gFTP Authentication failed.Mar 30 15:24:26 vm1 pure-ftpd[714151]: (?@91.196.152.99) [WARNING] Authentication failed for user [anonymous]91.196.152.993017382$,  3O' ossec11301gNew FTP connection.Mar 30 15:24:22 vm1 pure-ftpd[714151]: (?@91.196.152.99) [INFO] New connection from 91.196.152.9991.196.152.993017382Y+  -A% ossec13001gLExim Auth failed2025-03-30 15:22:11 dovecot_login authenticator failed for ([27.18.224.32]) [27.18.224.32]:8064: 535 Incorrect authentication data (set_id=brander-center)27.18.224.321814991{*  -+ ossec13001g@Exim Auth failed2025-03-30 15:21:58 dovecot_login authenticator failed for ([182.163.122.133]) [182.163.122.133]:26701: 535 Incorrect authentication data (set_id=brander-center@saintsoldiercollege.com)182.163.122.1331210997p)  -s! ossec13001gExim Auth failed2025-03-30 15:12:28 dovecot_login authenticator failed for cpc117482-shep15-2-0-cust42.8-3.cable.virginm.net [82.8.25.43]:42400: 535 Incorrect authentication data (set_id=istok91)82.8.25.432635167 = K k o  % I  -+ ossec13001g?8Exim Auth failed2025-03-30 18:25:20 dovecot_login authenticator failed for (223-197-153-143.static.imsbiz.com) [223.197.153.143]:56466: 535 Incorrect authentication data (set_id=brander-center@saintsoldiercollege.com)223.197.153.1431819730sH  -w' ossec13001g?0Exim Auth failed2025-03-30 18:25:11 dovecot_login authenticator failed for ([65.20.205.228]) [65.20.205.228]:55414: 535 Incorrect authentication data (set_id=brander-center@saintsoldiercollege.com)65.20.205.22899237lG  -a+ ossec13001g? Exim Auth failed2025-03-30 18:24:35 dovecot_plain authenticator failed for 145.173.198.203.static.netvigator.com [203.198.173.145]:44693: 535 Incorrect authentication data (set_id=sales)203.198.173.1451819730iF  -_) ossec13001g?Exim Auth failed2025-03-30 18:24:24 dovecot_plain authenticator failed for ([87.200.232.247]) [87.200.232.247]:41101: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)87.200.232.247290557XE  -=) ossec13001g:Exim Auth failed2025-03-30 18:07:02 dovecot_login authenticator failed for ([168.167.55.230]) [168.167.55.230]:55515: 535 Incorrect authentication data (set_id=istok91)168.167.55.230933860D  -) ossec13001g:Exim Auth failed2025-03-30 18:06:48 dovecot_login authenticator failed for ppp-124-120-50-241.revip2.asianet.co.th [124.120.50.241]:53136: 535 Incorrect authentication data (set_id=istok91@saintsoldiercollege.com)124.120.50.2411605651`C  -S# ossec13001g7Exim Auth failed2025-03-30 17:52:36 dovecot_login authenticator failed for ([5.11.146.97]) [5.11.146.97]:49093: 535 Incorrect authentication data (set_id=press@heipowersystem.com)5.11.146.97298795gB  -]' ossec13001g7Exim Auth failed2025-03-30 17:53:04 dovecot_login authenticator failed for host-62-106-37-249.dynamic.elmonet.fi [62.106.37.249]:39232: 535 Incorrect authentication data (set_id=press)62.106.37.249660013hA  -]' ossec13001g1Exim Auth failed2025-03-30 17:25:05 dovecot_plain authenticator failed for 81-230-83-162-no600.tbcn.telia.com [81.230.83.162]:33028: 535 Incorrect authentication data (set_id=services)81.230.83.1622661886m@  -e) ossec13001g1Exim Auth failed2025-03-30 17:24:57 dovecot_plain authenticator failed for ([150.253.98.232]) [150.253.98.232]:40977: 535 Incorrect authentication data (set_id=services@heipowersystem.com)150.253.98.2326252001`?  -K) ossec13001g/Exim Auth failed2025-03-30 17:19:50 dovecot_login authenticator failed for ([183.167.196.62]) [183.167.196.62]:40401: 535 Incorrect authentication data (set_id=brander-center)183.167.196.621814991x>  -{) ossec13001g/Exim Auth failed2025-03-30 17:19:37 dovecot_login authenticator failed for ([175.205.191.27]) [175.205.191.27]:49330: 535 Incorrect authentication data (set_id=brander-center@saintsoldiercollege.com)175.205.191.271835841\=  -A+ ossec13001g.Exim Auth failed2025-03-30 17:14:23 dovecot_login authenticator failed for ([122.225.203.106]) [122.225.203.106]:21044: 535 Incorrect authentication data (set_id=istok91)122.225.203.1061814991n<  -i' ossec13001g.Exim Auth failed2025-03-30 17:14:09 dovecot_login authenticator failed for ([103.68.52.210]) [103.68.52.210]:53134: 535 Incorrect authentication data (set_id=istok91@saintsoldiercollege.com)103.68.52.2101269750T;  -5' ossec13001g,,Exim Auth failed2025-03-30 17:04:03 dovecot_plain authenticator failed for ([116.237.85.95]) [223.166.75.68]:37924: 535 Incorrect authentication data (set_id=sales)223.166.75.681814991g:  -[' ossec13001g,Exim Auth failed2025-03-30 17:03:49 dovecot_plain authenticator failed for ([83.239.84.130]) [83.239.84.130]:56039: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)83.239.84.1302017370 =  = 0 V mZy=][  E1' ossec2501gaUser authentication failure.Mar 30 20:51:54 vm1 sshd[786231]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.210.44.227 user=root51.210.44.2273017382KZ  -+ ossec13001g`Exim Auth failed2025-03-30 20:47:35 dovecot_login authenticator failed for ([197.149.125.227]) [197.149.125.227]:49750: 535 Incorrect authentication data197.149.125.2272328926'Y  CG' ossec5716g_;SSHD authentication failed.Mar 30 20:41:53 vm1 sshd[784424]: Failed password for root from 51.210.44.227 port 36154 ssh251.210.44.2273017382]X  E1' ossec2501g_7User authentication failure.Mar 30 20:41:50 vm1 sshd[784424]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.210.44.227 user=root51.210.44.2273017382]W  E1' ossec2501g\RUser authentication failure.Mar 30 20:29:29 vm1 sshd[781994]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.210.44.227 user=root51.210.44.2273017382'V  CG' ossec5716g\TSSHD authentication failed.Mar 30 20:29:31 vm1 sshd[781994]: Failed password for root from 51.210.44.227 port 57496 ssh251.210.44.2273017382WU  -9) ossec13001gR$Exim Auth failed2025-03-30 19:46:02 dovecot_plain authenticator failed for ([58.228.105.192]) [58.228.105.192]:39286: 535 Incorrect authentication data (set_id=sales)58.228.105.1921835841mT  -c+ ossec13001gR Exim Auth failed2025-03-30 19:45:40 dovecot_plain authenticator failed for ([123.139.128.111]) [123.139.128.111]:42180: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)123.139.128.1111814991rS  -o) ossec13001gOExim Auth failed2025-03-30 19:35:56 dovecot_login authenticator failed for syn-070-118-112-230.biz.spectrum.com [70.118.112.230]:52577: 535 Incorrect authentication data (set_id=brander-center)70.118.112.2306252001wR  -{) ossec13001gOExim Auth failed2025-03-30 19:35:44 dovecot_login authenticator failed for ([197.156.115.37]) [197.156.115.37]:51334: 535 Incorrect authentication data (set_id=brander-center@saintsoldiercollege.com)197.156.115.37338010'Q  3S) ossec11301gNNew FTP connection.Mar 30 19:28:45 vm1 pure-ftpd[769395]: (?@216.218.206.68) [INFO] New connection from 216.218.206.68216.218.206.686252001eP  -U) ossec13001gMExim Auth failed2025-03-30 19:28:05 dovecot_login authenticator failed for ip98-177-115-211.ph.ph.cox.net [98.177.115.211]:51136: 535 Incorrect authentication data (set_id=istok91)98.177.115.2116252001VO  -9' ossec13001gMExim Auth failed2025-03-30 19:27:57 dovecot_login authenticator failed for ([222.87.49.250]) [222.87.49.250]:50288: 535 Incorrect authentication data (set_id=istok91)222.87.49.2501814991 N  -' ossec13001gMExim Auth failed2025-03-30 19:27:34 dovecot_login authenticator failed for static-47-190-147-30.dlls.tx.frontiernet.net [47.190.147.30]:61287: 535 Incorrect authentication data (set_id=istok91@saintsoldiercollege.com)47.190.147.306252001[M  -G' ossec13001gGExim Auth failed2025-03-30 19:00:57 dovecot_login authenticator failed for ([65.20.169.151]) [65.20.169.151]:46257: 535 Incorrect authentication data (set_id=brander-center)65.20.169.15199237xL  -{) ossec13001gGExim Auth failed2025-03-30 19:00:40 dovecot_login authenticator failed for ([159.196.221.74]) [159.196.221.74]:11838: 535 Incorrect authentication data (set_id=brander-center@saintsoldiercollege.com)159.196.221.742077456cK  -O+ ossec13001g?DExim Auth failed2025-03-30 18:25:30 dovecot_login authenticator failed for ([103.218.133.106]) [103.218.133.106]:40189: 535 Incorrect authentication data (set_id=brander-center)103.218.133.1061269750}J  -) ossec13001g?:Exim Auth failed2025-03-30 18:25:22 dovecot_login authenticator failed for 47-189-156-222.fdr02.plan.tx.ip.frontiernet.net [47.189.156.222]:55866: 535 Incorrect authentication data (set_id=brander-center)47.189.156.2226252001 RU{ 86=Ie$RNm  --# ossec13001gExim Auth failed2025-03-30 23:40:16 dovecot_login authenticator failed for ([58.214.8.10]) [58.214.8.10]:45155: 535 Incorrect authentication data (set_id=sarah)58.214.8.101814991gl  -[' ossec13001gExim Auth failed2025-03-30 23:39:57 dovecot_login authenticator failed for ([45.117.10.134]) [45.117.10.134]:56698: 535 Incorrect authentication data (set_id=sarah@heipowersystem.com)45.117.10.1341814991'k  3S) ossec11301g-New FTP connection.Mar 30 23:19:30 vm1 pure-ftpd[817115]: (?@194.165.16.163) [INFO] New connection from 194.165.16.163194.165.16.1632993457'j  3S) ossec11301g逌New FTP connection.Mar 30 23:04:03 vm1 pure-ftpd[813665]: (?@198.235.24.164) [INFO] New connection from 198.235.24.164198.235.24.1646252001`i  -K) ossec13001g~Exim Auth failed2025-03-30 22:56:20 dovecot_login authenticator failed for ([196.28.226.123]) [196.28.226.123]:37164: 535 Incorrect authentication data (set_id=brander-center)196.28.226.1231036973ph  -s! ossec13001g~Exim Auth failed2025-03-30 22:55:57 dovecot_login authenticator failed for cpc117482-shep15-2-0-cust42.8-3.cable.virginm.net [82.8.25.43]:57610: 535 Incorrect authentication data (set_id=istok91)82.8.25.432635167ug  -w' ossec13001g~Exim Auth failed2025-03-30 22:55:50 dovecot_login authenticator failed for ([106.37.103.82]) [106.37.103.82]:54289: 535 Incorrect authentication data (set_id=brander-center@saintsoldiercollege.com)106.37.103.821814991~f  - ' ossec13001g~Exim Auth failed2025-03-30 22:55:47 dovecot_login authenticator failed for (static-14.38.103.extranet.co.in) [59.94.179.175]:45466: 535 Incorrect authentication data (set_id=istok91@saintsoldiercollege.com)59.94.179.1751269750We  -9) ossec13001g}Exim Auth failed2025-03-30 22:51:50 dovecot_plain authenticator failed for ([118.91.176.243]) [118.91.176.243]:49101: 535 Incorrect authentication data (set_id=sales)118.91.176.2431269750jd  -_) ossec13001g}Exim Auth failed2025-03-30 22:51:38 dovecot_plain authenticator failed for ([91.244.113.188]) [91.244.113.188]:36592: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)91.244.113.1882017370dc  -Y# ossec13001g|Exim Auth failed2025-03-30 22:46:45 dovecot_plain authenticator failed for ([61.233.4.50]) [61.233.4.50]:41823: 535 Incorrect authentication data (set_id=services@heipowersystem.com)61.233.4.501814991Wb  -;' ossec13001g|Exim Auth failed2025-03-30 22:47:00 dovecot_plain authenticator failed for ([84.238.92.245]) [84.238.92.245]:54396: 535 Incorrect authentication data (set_id=services)84.238.92.2452623032`a  -K) ossec13001gzExim Auth failed2025-03-30 22:39:59 dovecot_login authenticator failed for ([162.255.21.110]) [162.255.21.110]:55210: 535 Incorrect authentication data (set_id=brander-center)162.255.21.1106252001`  -% ossec13001gzExim Auth failed2025-03-30 22:39:48 dovecot_login authenticator failed for 95-30-250-44.broadband.corbina.ru [95.30.250.44]:49792: 535 Incorrect authentication data (set_id=brander-center@saintsoldiercollege.com)95.30.250.442017370S_  -5% ossec13001gyExim Auth failed2025-03-30 22:35:45 dovecot_login authenticator failed for ([110.35.63.27]) [110.35.63.27]:54026: 535 Incorrect authentication data (set_id=istok91)110.35.63.271835841q^  -m) ossec13001gyExim Auth failed2025-03-30 22:35:27 dovecot_login authenticator failed for ([61.184.128.210]) [61.184.128.210]:59639: 535 Incorrect authentication data (set_id=istok91@saintsoldiercollege.com)61.184.128.2101814991V]  -=# ossec13001gjExim Auth failed2025-03-30 21:31:26 dovecot_login authenticator failed for (thepsindustries.com) [14.18.77.99]:52230: 535 Incorrect authentication data (set_id=nologin)14.18.77.991814991'\  CG' ossec5716gaSSHD authentication failed.Mar 30 20:51:55 vm1 sshd[786231]: Failed password for root from 51.210.44.227 port 56982 ssh251.210.44.2273017382 *\~tj`VLB8.$zpf\H>4*   v l b X N D : 0 &    ~ t j ` V L B 8 . $    z p f \ > 4 R H *  lvbXDN:0&|rh^TJ@6,"xndZPF<2( ~tjV`LB8.$zpf\ | r h ^ T J @ 6 , "    x n d Z P F < 2 (   RRH>4*  vlbXND:0& g 4m g `4l g4k g|4j g4i g4h g4g gp4f g4e g4d g4c g 4b g4a g4` g4_ g4^ g4] g4\ g4[ g4Z g4Y gT4X g-4W g4V g4U g4T g4S gb4R gI4Q g;4P g4O g4N g.4M g"4L g4K g4J gy4I gm4H g4G g4F gx4E gh4D gf4C gb4B gj4A gZ4@ g4? g4> g4= g#4< g 4; g4: g49 gݠ48 gݖ47 gܑ46 gܙ45 g44 g 43 gڐ42 gڈ41 gx40 g 4/ g4. g4- gл4, g4+ g4* g4) g94( g-4' g4& g4% g4$ g4# g4" g 4! g4 g黽4 g4 g 4 gt4 g鸀4 gS4 gC4 g.4 g 4 g鱦4 g鱚4 g4 g4 g魷4 g马4 g驸4 g4 g馹4 g馛4 gM4 g餻4 g餯4 g4 g4 g4 g4 g4 g4 g_4 gi4 g4 g4 gi3 gQ3 gG3 g13 g%3 g73 g#3 gQ3 g3 g3 g3 g銦3 g銆3 gF3 g3 g3 g(3 g3 g3 g3 g-3 g逌3 g~3 g~3 g~3 g~3 g}3 g}3 g|3 g|3 gz3 gz3 gy3 gy3 gj3 ga3 ga3 g`3 g_;3 g_73 g\T3 g\R3 gR$3 gR 3 gO3 gO3 gN3 gM3 gM3 gM3 gG3 gG3 g?D3 g?:3 g?83 g?03 g? 3 g?3 g:3 g:3 g1)4 g1)4 g/4 g/4 g,4 g, 4 g+O4 g+=4 g)4 g)4 g(4 g(4 g&z4 g&v4 g&v4 g&t4 g&r4 g&p4 g%"4 g%4 g l4 g4 g4 g4 g{4 g4 g4~ g4} g4| g4{ g4z g4y g4x g4w g4u g4v g4t g4s g4r g4q gr4p gd4o g 4n g73 g73 g13 g13 g/3 g/3 g.3 g.3 g,,3 g,3 g&m3 g&a3 g"n3 g"d3 g!3 g! 3 g3 g3 ge3 g3 g3 g3 g3 g3 gL3 g@3 g3 g3 g 3 g 3 g 3 g 3 g A3 g 13 gW3 gI3 g-3 g3 gN3 g3 g3 g3 g14 g3 gy3 gw3 gm3 ge3 ge3 gS3 g23 g3 g=3 g+3 g3 g3 g3 g3 gu3 ge3 g;3 g%3 g#3 g3 gb3 gX3 gY3 gK3 g3 g3 g3~ gҴ3} g3| g3{ g3z g3y g3x g3w g3u g3v g%3t g3s g3r gz3q gp3p #7 8 B U i }!FXmuZ~  -=+ ossec13001gQExim Auth failed2025-03-31 00:11:21 dovecot_plain authenticator failed for ([178.178.127.114]) [178.178.127.114]:15093: 535 Incorrect authentication data (set_id=sales)178.178.127.1142017370}  - ) ossec13001gGExim Auth failed2025-03-31 00:11:10 dovecot_plain authenticator failed for broadband-178-140-95-221.ip.moscow.rt.ru [178.140.95.221]:58149: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)178.140.95.2212017370h|  -]' ossec13001g1Exim Auth failed2025-03-31 00:10:48 dovecot_login authenticator failed for c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:56740: 535 Incorrect authentication data (set_id=istok91)76.132.238.436252001t{  -q+ ossec13001g%Exim Auth failed2025-03-31 00:10:37 dovecot_login authenticator failed for ([220.174.209.156]) [220.174.209.160]:56240: 535 Incorrect authentication data (set_id=istok91@saintsoldiercollege.com)220.174.209.1601814991gz  -]% ossec13001g7Exim Auth failed2025-03-31 00:06:38 dovecot_plain authenticator failed for ([5.167.92.143]) [5.167.92.143]:57046: 535 Incorrect authentication data (set_id=services@heipowersystem.com)5.167.92.1432017370jy  -a' ossec13001g#Exim Auth failed2025-03-31 00:06:19 dovecot_plain authenticator failed for ([190.52.227.90]) [190.52.227.90]:39683: 535 Incorrect authentication data (set_id=services@heipowersystem.com)190.52.227.903508796Wx  -;' ossec13001gQExim Auth failed2025-03-31 00:07:03 dovecot_plain authenticator failed for ([103.65.227.72]) [103.65.227.72]:49821: 535 Incorrect authentication data (set_id=services)103.65.227.721210997w  ?/ ossec1008gProcess exiting (killed).Mar 31 00:05:46 vm1 spamd[512255]: spamd: server killed by SIGTERM, shutting downZv  -C% ossec13001gExim Auth failed2025-03-30 23:48:13 dovecot_login authenticator failed for ([66.11.25.195]) [66.11.25.195]:42594: 535 Incorrect authentication data (set_id=brander-center)66.11.25.1956252001qu  -s% ossec13001gExim Auth failed2025-03-30 23:47:55 dovecot_login authenticator failed for ([45.93.94.125]) [45.93.94.125]:36142: 535 Incorrect authentication data (set_id=brander-center@saintsoldiercollege.com)45.93.94.125294640ht  -[) ossec13001g銦Exim Auth failed2025-03-30 23:47:10 dovecot_plain authenticator failed for (vmb2bee-product) [20.224.167.102]:56182: 535 Incorrect authentication data (set_id=info@heipowersystem.com)20.224.167.1022750405hs  -[) ossec13001g銆Exim Auth failed2025-03-30 23:46:38 dovecot_plain authenticator failed for (vmb2bee-product) [20.224.167.102]:64903: 535 Incorrect authentication data (set_id=info@heipowersystem.com)20.224.167.1022750405ir -[) ossec13001gFExim Auth failed2025-03-30 23:45:33 dovecot_plain authenticator failed for (vmb2bee-product) [20.224.167.102]:54477: 535 Incorrect authentication data (set_id=info@heipowersystem.com)20.224.167.1022750405rq  -o) ossec13001gExim Auth failed2025-03-30 23:44:28 dovecot_login authenticator failed for 164.46.246.220.static.netvigator.com [220.246.46.164]:61572: 535 Incorrect authentication data (set_id=brander-center)220.246.46.1641819730{p  -+ ossec13001gExim Auth failed2025-03-30 23:44:12 dovecot_login authenticator failed for ([122.187.230.116]) [122.187.230.116]:59948: 535 Incorrect authentication data (set_id=brander-center@saintsoldiercollege.com)122.187.230.1161269750ho  -[) ossec13001g(Exim Auth failed2025-03-30 23:45:03 dovecot_plain authenticator failed for (vmb2bee-product) [20.224.167.102]:49403: 535 Incorrect authentication data (set_id=info@heipowersystem.com)20.224.167.1022750405Yn  -C% ossec13001gExim Auth failed2025-03-30 23:44:40 dovecot_login authenticator failed for ([31.131.73.59]) [31.131.73.59]:55372: 535 Incorrect authentication data (set_id=brander-center)31.131.73.59690791 A 4' ~qdWJ=0# zm`SF9, v i \ O B 5 (     r e X K > 1 $  { n a T G : -   w j ] P C 6 )    s f Y L ? 2 %  |obUH;.!xk^QD7*tgZM@3& }pcVI</"yl_RE8+yl_RE8+~qdWJ=0 1814991 1814991 1814991 1814991y 1814991 1814991 y 1814991 q 1814991 p 1814991 m 1814991 ` 1814991 \ 1814991 [ 1814991 W 1814991 U 1814991 P 1814991 L 1814991 E 1814991 < 1814991 ( 1814991 # 1814991  1814991  1814991  1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 | 1814991 x 1814991 w 1814991 v 1814991 p 1814991 n 1814991 h 1814991 S 1814991 R 1814991 O 1814991 N 1814991 L 1814991 A 1814991 @ 1814991 : 1814991 8 1814991 . 1814991 - 1814991 * 1814991 1814991  1814991  1814991  1814991  1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 } 1814991 q 1814991 p 1814991 k 1814991 g 1814991 \ 1814991 X 1814991 W 1814991 Q 1814991 I 1814991 > 1814991 = 1814991 ; 1814991 5 1814991 / 1814991 ( 1814991 % 1814991 " 1814991  1814991  1814991  1814991  1814991  1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991  1814991 ~ 1814991 u 1814991 j 1814991 d 1814991 ^ 1814991 Z 1814991 Y 1814991 X 1814991 W 1814991 V 1814991 U 1814991 T 1814991 R 1814991 M 1814991 C 1814991 B 1814991 @ 1814991 4 1814991  1814991  1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991z 1814991x 1814991t 1814991s 1814991r 1814991p 1814991o 1814991m 1814991l 1814991T 1814991M 1814991B 1814991@ 1814991< 18149913 18149912 1814991/ 1814991( 1814991' 1814991$ 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 q4dWJ=0# zm`SF9, v i \4uh[NA P D 8 ,   x l ` T H < 0 $   | p d X L @ 4 (    t h \ P D 8 +    u h [ N A 4 '  ~qdWJ=0# zm`SF9,vi\OB5(reXK>1$ {naTG:- wj]PC6)886M> 2 2661886M> 2661886N1 2661886N' 2661886N 2661886N 2661886N 2661886M 2661886M 2661886M 2661886M 272103M 2750405O 2661886O 2661886OI 272103O3 2661886O( 2661886N 2661886Na 2782113/ 2782113/ 2782113)- 2782113 @ 2782113C 2782113 2782113 2782113 2750405L 2750405L 2750405K 2750405KA 2750405I} 2750405I| 2750405I{ 2750405H 2750405H 2750405H/ 2750405F 2750405Fc 2750405F 2750405F 2750405F 2750405E1 2750405C 2750405C 2750405C 2750405C 2750405C 2750405B 2750405B 2750405A 2750405Aw 2750405Ak 2750405Aj 2750405Ai 2750405@% 2750405> 2750405< 2750405<: 2750405<4 2750405; 2750405;_ 2750405;^ 2750405;] 2750405:P 27504059 27504059 27504058 27504058 27504058% 27504057 27504056 27504056 27504056 27504056o 27504055 27504055u 27504055" 27504055! 27504053 27504053 27504053 27504053 27504052 27504052n 27504052m 27504052l 27504051 27504051q 275040519 27504050Q 27504050 27504050 27504050 27504050 27504050 27504050 2750405/ 2750405/ 2750405/ 2750405/ 2750405/ 2750405- 2750405,q 2750405+ 2750405+= 2750405* 2750405) 2750405)@ 2750405(H 2750405& 2750405&x 2750405$ 2750405" 2750405! 2750405! 2750405  2750405 2750405 2750405D 2750405r 27504054 2750405t 2750405L 2750405 2750405 2750405 2750405 2750405 2750405 2750405 2750405. 2750405 2750405 2750405 2750405 2750405g 2750405j 2750405 2750405 2750405 27504053 2750405 2750405 2750405 X 2750405 { 2750405 2750405 2750405 2750405 2750405 2750405# 2750405 2750405 2750405 2750405 2750405 2750405 2750405 2750405d 2750405c 2750405b 2750405a 2750405` 2750405\ 2750405[ 2750405Z 2750405Y 2750405W 2750405V 2750405L 27504059 2750405 2750405 2750405 2750405 2750405 2750405 2750405 2750405 2750405 2750405 2750405 2750405 2750405 2750405 2750405 2750405 2750405 2750405 2750405 2750405 2750405 2750405 272103LW 272103J 272103I 272103H 272103H? 272103ER 272103C 272103C, 272103B 272103AS 272103@A 2721036 2721034 2721034r 272103.n 272103* 272103)' 272103'n 272103'5 272103&p 272103" 272103 272103 272103[ 272103~ 272103c 272103 272103 272103 272103 272103 272103 K 2661886M7 2661886M 2661886L 2661886L^ 2661886LS 2661886L2 2661886K 2661886K 2661886K 2661886K@ 2661886K 2661886K 2661886J 2661886JI 2661886I 2661886I 2661886Ig 2661886I 2661886H 2661886HU 2661886H, 2661886G 2661886G 2661886F 2661886F 2661886F 2661886F; 2661886F: 2661886F+ 2661886D~ 2661886Dh 2661886C 2661886C 2661886C; 2661886B 2661886B 2661886B 2661886B} 2661886Bv 2661886BP 2661886AN 2661886O 2661886O 2661886O 2750405O 2750405O X^ t  /k  -_+ ossec13001g馹Exim Auth failed2025-03-31 01:46:57 dovecot_login authenticator failed for (azteca-comunicaciones.com) [186.148.187.146]:59097: 535 Incorrect authentication data (set_id=brander-center)186.148.187.1463686110  - ) ossec13001g馛Exim Auth failed2025-03-31 01:46:27 dovecot_login authenticator failed for n11923628209.netvigator.com [119.236.28.209]:40524: 535 Incorrect authentication data (set_id=brander-center@saintsoldiercollege.com)119.236.28.2091819730>  =w) ossec13008gMMail Reciepient rejected2025-03-31 01:40:52 H=(mail.thepsindustries.com) [165.154.228.61]:51123 F= rejected RCPT : Rejected relay attempt: '165.154.228.61' From: 'fvguchzey@thepsindustries.com' To: 'file2@fastmail.com'165.154.228.611643084W  -9) ossec13001g餻Exim Auth failed2025-03-31 01:38:26 dovecot_login authenticator failed for ([180.103.112.85]) [180.103.112.85]:34520: 535 Incorrect authentication data (set_id=sales)180.103.112.851814991g  -[' ossec13001g餯Exim Auth failed2025-03-31 01:38:13 dovecot_login authenticator failed for ([39.170.99.169]) [39.170.99.169]:38906: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)39.170.99.1691814991g  -[' ossec13001gExim Auth failed2025-03-31 01:30:20 dovecot_plain authenticator failed for ([213.154.80.21]) [213.154.80.51]:36697: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)213.154.80.512245662W  -9) ossec13001gExim Auth failed2025-03-31 01:30:32 dovecot_plain authenticator failed for ([222.68.155.105]) [222.68.155.105]:59584: 535 Incorrect authentication data (set_id=sales)222.68.155.1051814991[  -G' ossec13001gExim Auth failed2025-03-31 00:56:47 dovecot_login authenticator failed for ([65.20.167.160]) [65.20.167.160]:36283: 535 Incorrect authentication data (set_id=brander-center)65.20.167.16099237  -# ossec13001gExim Auth failed2025-03-31 00:56:21 dovecot_login authenticator failed for 208.red-83-45-6.dynamicip.rima-tde.net [83.45.6.208]:35078: 535 Incorrect authentication data (set_id=brander-center@saintsoldiercollege.com)83.45.6.2082510769  -) ossec13001gExim Auth failed2025-03-31 00:51:46 dovecot_login authenticator failed for (107-175-76-146-host.colocrossing.com) [107.175.76.146]:60938: 535 Incorrect authentication data (set_id=istok91@saintsoldiercollege.com)107.175.76.1466252001Y  -=) ossec13001gExim Auth failed2025-03-31 00:51:59 dovecot_login authenticator failed for ([218.149.70.142]) [218.149.70.142]:53118: 535 Incorrect authentication data (set_id=istok91)218.149.70.1421835841  -) ossec13001g_Exim Auth failed2025-03-31 00:37:11 dovecot_login authenticator failed for 125-228-154-55.hinet-ip.hinet.net [125.228.154.55]:46965: 535 Incorrect authentication data (set_id=brander-center@saintsoldiercollege.com)125.228.154.551668284[  -G' ossec13001giExim Auth failed2025-03-31 00:37:20 dovecot_login authenticator failed for ([65.20.252.105]) [65.20.252.105]:42439: 535 Incorrect authentication data (set_id=brander-center)65.20.252.10599237f  -W) ossec13001gExim Auth failed2025-03-31 00:26:58 dovecot_login authenticator failed for ([178.141.26.105]) [178.141.26.105]:54534: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)178.141.26.1052017370v  -y' ossec13001gExim Auth failed2025-03-31 00:26:44 dovecot_login authenticator failed for ([218.69.115.74]) [218.69.115.74]:37943: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)218.69.115.741814991$  3O' ossec11301giNew FTP connection.Mar 31 00:11:44 vm1 pure-ftpd[829681]: (?@13.89.125.226) [INFO] New connection from 13.89.125.22613.89.125.2266252001 P8 9 7 B ] x!IPu  -s+ ossec13001g黽Exim Auth failed2025-03-31 03:16:36 dovecot_login authenticator failed for ([218.154.54.5]) [222.108.177.110]:33591: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)222.108.177.1101835841T  -5' ossec13001gExim Auth failed2025-03-31 03:05:18 dovecot_login authenticator failed for ([121.154.90.47]) [121.154.90.47]:59202: 535 Incorrect authentication data (set_id=sales)121.154.90.471835841j  -_) ossec13001g Exim Auth failed2025-03-31 03:05:06 dovecot_login authenticator failed for ([120.29.140.140]) [120.29.140.140]:52721: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)120.29.140.1401835841u  -w' ossec13001gtExim Auth failed2025-03-31 03:02:36 dovecot_login authenticator failed for ([103.174.34.49]) [103.174.34.49]:59037: 535 Incorrect authentication data (set_id=brander-center@saintsoldiercollege.com)103.174.34.491269750Z  -C% ossec13001g鸀Exim Auth failed2025-03-31 03:02:47 dovecot_login authenticator failed for ([39.68.50.237]) [39.68.50.237]:34116: 535 Incorrect authentication data (set_id=brander-center)39.68.50.2371814991Q  -1% ossec13001gSExim Auth failed2025-03-31 02:49:14 dovecot_plain authenticator failed for ([59.99.153.21]) [59.99.153.21]:16623: 535 Incorrect authentication data (set_id=sales)59.99.153.211269750p  -q# ossec13001gCExim Auth failed2025-03-31 02:48:59 dovecot_plain authenticator failed for 95.58.59.93.dynamic.telecom.kz [95.58.59.93]:38933: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)95.58.59.931522867W  -?# ossec13001g.Exim Auth failed2025-03-31 02:35:50 dovecot_login authenticator failed for ([5.175.88.56]) [5.175.88.56]:51026: 535 Incorrect authentication data (set_id=brander-center)5.175.88.562017370  -9+ ossec13001g Exim Auth failed2025-03-31 02:35:35 dovecot_login authenticator failed for (159-196-108-155.9fc46c.syd.static.aussiebb.net) [159.196.108.155]:59580: 535 Incorrect authentication data (set_id=brander-center@saintsoldiercollege.com)159.196.108.1552077456N  -+% ossec13001g鱦Exim Auth failed2025-03-31 02:33:33 dovecot_login authenticator failed for ([95.141.228.9]) [95.141.228.9]:58848: 535 Incorrect authentication data (set_id=cs)95.141.228.92017370a  -S# ossec13001g鱚Exim Auth failed2025-03-31 02:33:22 dovecot_login authenticator failed for ([223.30.243.116]) [1.7.229.162]:47756: 535 Incorrect authentication data (set_id=cs@heipowersystem.com)1.7.229.1621269750a  -O) ossec13001gExim Auth failed2025-03-31 02:17:13 dovecot_login authenticator failed for (md-188-69-251-106.omni.lt) [188.69.251.106]:39577: 535 Incorrect authentication data (set_id=istok91)188.69.251.106597427q  -m) ossec13001gExim Auth failed2025-03-31 02:17:04 dovecot_login authenticator failed for ([111.93.178.206]) [111.93.178.206]:39868: 535 Incorrect authentication data (set_id=istok91@saintsoldiercollege.com)111.93.178.2061269750~  -+ ossec13001g魷Exim Auth failed2025-03-31 02:16:47 dovecot_login authenticator failed for p54161-obmd01.osaka.ocn.ne.jp [153.141.241.161]:57420: 535 Incorrect authentication data (set_id=istok91@saintsoldiercollege.com)153.141.241.1611861060{  -+ ossec13001g马Exim Auth failed2025-03-31 01:59:31 dovecot_login authenticator failed for ([212.113.226.222]) [212.113.226.222]:55794: 535 Incorrect authentication data (set_id=brander-center@saintsoldiercollege.com)212.113.226.2222017370`  -K) ossec13001g驸Exim Auth failed2025-03-31 01:59:43 dovecot_login authenticator failed for ([210.222.15.113]) [210.222.15.113]:53998: 535 Incorrect authentication data (set_id=brander-center)210.222.15.1131835841`  -K) ossec13001gExim Auth failed2025-03-31 01:47:05 dovecot_login authenticator failed for ([134.119.176.97]) [134.119.176.97]:42682: 535 Incorrect authentication data (set_id=brander-center)134.119.176.973017382 f ) 7 Z _ { %Qfg0  -]% ossec13001gxExim Auth failed2025-03-31 05:27:43 dovecot_plain authenticator failed for ([186.238.187.117]) [187.8.62.202]:35967: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)187.8.62.2023469034P/  --' ossec13001g Exim Auth failed2025-03-31 05:26:15 dovecot_login authenticator failed for ([48.218.170.53]) [48.218.170.53]:40850: 535 Incorrect authentication data (set_id=a)48.218.170.531861060c.  -S' ossec13001gExim Auth failed2025-03-31 05:26:04 dovecot_login authenticator failed for ([61.184.26.197]) [61.184.26.197]:51264: 535 Incorrect authentication data (set_id=a@heipowersystem.com)61.184.26.1971814991`-  -K) ossec13001gExim Auth failed2025-03-31 04:46:28 dovecot_login authenticator failed for ([114.99.127.122]) [114.99.127.122]:55939: 535 Incorrect authentication data (set_id=brander-center)114.99.127.1221814991u,  -w' ossec13001gлExim Auth failed2025-03-31 04:46:11 dovecot_login authenticator failed for ([120.138.5.219]) [120.138.5.219]:52212: 535 Incorrect authentication data (set_id=brander-center@saintsoldiercollege.com)120.138.5.2191269750]+  -C+ ossec13001gExim Auth failed2025-03-31 04:15:18 dovecot_login authenticator failed for 186-247-193-126.user.veloxzone.com.br [186.247.193.126]:35324: 535 Incorrect authentication data186.247.193.1263469034W*  -9) ossec13001gExim Auth failed2025-03-31 04:08:56 dovecot_plain authenticator failed for ([185.130.158.98]) [185.130.158.98]:56916: 535 Incorrect authentication data (set_id=sales)185.130.158.982635167k)  -a) ossec13001gExim Auth failed2025-03-31 04:08:39 dovecot_plain authenticator failed for ([222.174.187.202]) [113.122.237.86]:36840: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)113.122.237.861814991o(  -m% ossec13001g9Exim Auth failed2025-03-31 03:44:17 dovecot_login authenticator failed for 92-34-29-114.customers.ownit.se [92.34.29.114]:48062: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)92.34.29.1142661886p'  -q# ossec13001g-Exim Auth failed2025-03-31 03:44:05 dovecot_login authenticator failed for ([1.28.87.246]) [1.28.87.246]:34717: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)1.28.87.2461814991`&  -K) ossec13001gExim Auth failed2025-03-31 03:38:47 dovecot_login authenticator failed for ([103.119.171.52]) [103.119.171.52]:50548: 535 Incorrect authentication data (set_id=brander-center)103.119.171.521269750w%  -{) ossec13001gExim Auth failed2025-03-31 03:38:38 dovecot_login authenticator failed for ([185.167.58.121]) [185.167.58.121]:44186: 535 Incorrect authentication data (set_id=brander-center@saintsoldiercollege.com)185.167.58.121617790Y$  -=) ossec13001gExim Auth failed2025-03-31 03:34:16 dovecot_login authenticator failed for ([186.201.32.242]) [177.174.95.245]:57650: 535 Incorrect authentication data (set_id=istok91)177.174.95.2453469034n#  -i' ossec13001gExim Auth failed2025-03-31 03:34:05 dovecot_login authenticator failed for ([202.70.36.122]) [202.70.36.122]:38836: 535 Incorrect authentication data (set_id=istok91@saintsoldiercollege.com)202.70.36.1222029969S"  -5% ossec13001gExim Auth failed2025-03-31 03:22:24 dovecot_login authenticator failed for ([59.2.141.155]) [59.2.141.155]:56604: 535 Incorrect authentication data (set_id=istok91)59.2.141.1551835841!  -5+ ossec13001g Exim Auth failed2025-03-31 03:22:11 dovecot_login authenticator failed for (dynamicip-176-213-105-223.pppoe.chelny.ertelecom.ru) [176.213.105.223]:54399: 535 Incorrect authentication data (set_id=istok91@saintsoldiercollege.com)176.213.105.2232017370b  -O) ossec13001gExim Auth failed2025-03-31 03:16:56 dovecot_login authenticator failed for ([103.79.175.186]) [103.79.175.186]:51717: 535 Incorrect authentication data (set_id=vikas.khandelwal)103.79.175.1862077456 uI P [ z x:1KSuZA  -=+ ossec13001gjExim Auth failed2025-03-31 06:14:26 dovecot_login authenticator failed for ([186.215.225.1]) [186.215.204.109]:49562: 535 Incorrect authentication data (set_id=istok91)186.215.204.1093469034t@  -q+ ossec13001gZExim Auth failed2025-03-31 06:14:09 dovecot_login authenticator failed for ([122.187.238.249]) [122.187.238.249]:59222: 535 Incorrect authentication data (set_id=istok91@saintsoldiercollege.com)122.187.238.2491269750b?  -U# ossec13001gExim Auth failed2025-03-31 06:12:09 dovecot_plain authenticator failed for vps-4a81acc7.vps.ovh.net [51.77.200.6]:51680: 535 Incorrect authentication data (set_id=vikas.khandelwal)51.77.200.63017382>  -+ ossec13001gExim Auth failed2025-03-31 06:12:01 dovecot_plain authenticator failed for (dynamic-ip-adsl.metfone.com.kh) [175.100.107.238]:56372: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)175.100.107.2381831722$=  3O' ossec11301gNew FTP connection.Mar 31 06:08:22 vm1 pure-ftpd[909953]: (?@20.65.194.183) [INFO] New connection from 20.65.194.18320.65.194.1836252001Z<  -=+ ossec13001g#Exim Auth failed2025-03-31 06:00:27 dovecot_login authenticator failed for ([182.224.231.102]) [182.224.231.102]:46120: 535 Incorrect authentication data (set_id=sales)182.224.231.1021835841e;  -[' ossec13001g Exim Auth failed2025-03-31 06:00:04 dovecot_login authenticator failed for ([65.20.235.177]) [65.20.235.177]:47362: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)65.20.235.17799237_:  -K' ossec13001gExim Auth failed2025-03-31 05:55:04 dovecot_login authenticator failed for ([203.81.213.46]) [203.81.213.46]:36985: 535 Incorrect authentication data (set_id=vikas.khandelwal)203.81.213.4611685799  - ' ossec13001gExim Auth failed2025-03-31 05:54:45 dovecot_login authenticator failed for 42-200-141-56.static.imsbiz.com [42.200.141.56]:39142: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)42.200.141.561819730d8  -W% ossec13001gݠExim Auth failed2025-03-31 05:41:10 dovecot_login authenticator failed for 217-209-44-9-no600.tbcn.telia.com [217.209.44.9]:42826: 535 Incorrect authentication data (set_id=istok91)217.209.44.926618867  -) ossec13001gݖExim Auth failed2025-03-31 05:41:00 dovecot_login authenticator failed for ppp-210-86-163-194.revip.asianet.co.th [210.86.163.194]:59228: 535 Incorrect authentication data (set_id=istok91@saintsoldiercollege.com)210.86.163.1941605651u6  -w' ossec13001gܑExim Auth failed2025-03-31 05:36:40 dovecot_login authenticator failed for ([136.56.34.147]) [136.56.34.147]:44920: 535 Incorrect authentication data (set_id=brander-center@saintsoldiercollege.com)136.56.34.1476252001]5  -G' ossec13001gܙExim Auth failed2025-03-31 05:36:49 dovecot_login authenticator failed for ([103.68.52.210]) [103.68.52.210]:45946: 535 Incorrect authentication data (set_id=brander-center)103.68.52.2101269750q4  -k+ ossec13001gExim Auth failed2025-03-31 05:34:40 dovecot_login authenticator failed for d142-179-145-166.abhsia.telus.net [142.179.145.166]:33538: 535 Incorrect authentication data (set_id=brander-center)142.179.145.1666251999u3  -w' ossec13001g Exim Auth failed2025-03-31 05:34:26 dovecot_login authenticator failed for ([117.247.97.20]) [117.247.97.20]:54764: 535 Incorrect authentication data (set_id=brander-center@saintsoldiercollege.com)117.247.97.201269750N2  --# ossec13001gڐExim Auth failed2025-03-31 05:28:07 dovecot_plain authenticator failed for ([103.50.5.94]) [103.50.5.94]:36320: 535 Incorrect authentication data (set_id=sales)103.50.5.941269750a1  -S# ossec13001gڈExim Auth failed2025-03-31 05:27:59 dovecot_plain authenticator failed for ([103.60.89.9]) [103.60.89.2]:37852: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)103.60.89.21643084 [UV G V l/[PS  -1# ossec13001gExim Auth failed2025-03-31 07:12:49 dovecot_login authenticator failed for ([1.30.20.238]) [1.30.20.238]:50056: 535 Incorrect authentication data (set_id=istok91)1.30.20.2381814991`R  -K) ossec13001gbExim Auth failed2025-03-31 07:09:45 dovecot_login authenticator failed for ([122.180.242.91]) [122.180.242.91]:50863: 535 Incorrect authentication data (set_id=brander-center)122.180.242.911269750jQ  -a' ossec13001gIExim Auth failed2025-03-31 07:09:21 dovecot_login authenticator failed for p170020-obmd01.osaka.ocn.ne.jp [61.113.241.19]:33973: 535 Incorrect authentication data (set_id=brander-center)61.113.241.191861060xP  -{) ossec13001g;Exim Auth failed2025-03-31 07:09:06 dovecot_login authenticator failed for ([189.218.169.57]) [189.218.169.57]:51287: 535 Incorrect authentication data (set_id=brander-center@saintsoldiercollege.com)189.218.169.573996063kO  -c' ossec13001gExim Auth failed2025-03-31 07:07:08 dovecot_login authenticator failed for (thepsindustries.com) [111.207.12.99]:36306: 535 Incorrect authentication data (set_id=info@thepsindustries.com)111.207.12.991814991ZN  -A' ossec13001gExim Auth failed2025-03-31 07:06:44 dovecot_login authenticator failed for (thepsindustries.com) [111.207.12.99]:60980: 535 Incorrect authentication data (set_id=nologin)111.207.12.991814991_M  -Q! ossec13001g.Exim Auth failed2025-03-31 06:47:34 dovecot_plain authenticator failed for (static.bb.alp.61.2.44.54.bsnl.in) [61.2.44.54]:34610: 535 Incorrect authentication data (set_id=sales)61.2.44.541269750jL  -_) ossec13001g"Exim Auth failed2025-03-31 06:47:22 dovecot_plain authenticator failed for ([178.141.26.105]) [178.141.26.105]:56344: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)178.141.26.1052017370fK  -[% ossec13001gExim Auth failed2025-03-31 06:33:58 dovecot_login authenticator failed for 66.68.243.35.bc.googleusercontent.com [35.243.68.66]:49456: 535 Incorrect authentication data (set_id=sales)35.243.68.661861060cJ  -W% ossec13001gExim Auth failed2025-03-31 06:33:46 dovecot_login authenticator failed for ([5.11.162.163]) [5.11.162.163]:58569: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)5.11.162.163298795fI  -Y' ossec13001gyExim Auth failed2025-03-31 06:27:28 dovecot_login authenticator failed for 111-70-23-239.emome-ip.hinet.net [111.70.23.239]:60427: 535 Incorrect authentication data (set_id=services)111.70.23.2391668284mH  -e) ossec13001gmExim Auth failed2025-03-31 06:27:16 dovecot_login authenticator failed for ([122.228.228.86]) [122.228.228.86]:45567: 535 Incorrect authentication data (set_id=services@heipowersystem.com)122.228.228.8618149915G  Ae% ossec11302gFTP Authentication failed.Mar 31 06:19:45 vm1 pure-ftpd[912590]: (?@34.77.13.200) [WARNING] Authentication failed for user [anonymous]34.77.13.2002802361"F 3K% ossec11301gNew FTP connection.Mar 31 06:19:42 vm1 pure-ftpd[912588]: (?@34.77.13.200) [INFO] New connection from 34.77.13.20034.77.13.2002802361sE  -q) ossec13001gxExim Auth failed2025-03-31 06:18:56 dovecot_login authenticator failed for (49-158-217-224.dynamic.elinx.com.tw) [49.158.217.224]:60010: 535 Incorrect authentication data (set_id=brander-center)49.158.217.22416682845D  Aa) ossec11302ghFTP Authentication failed.Mar 31 06:18:39 vm1 pure-ftpd[912246]: (?@190.85.151.226) [WARNING] Authentication failed for user [admin]190.85.151.2263686110{C  -+ ossec13001gfExim Auth failed2025-03-31 06:18:38 dovecot_login authenticator failed for ([112.167.158.252]) [112.167.158.252]:56760: 535 Incorrect authentication data (set_id=brander-center@saintsoldiercollege.com)112.167.158.2521835841'B  3S) ossec11301gbNew FTP connection.Mar 31 06:18:32 vm1 pure-ftpd[912246]: (?@190.85.151.226) [INFO] New connection from 190.85.151.226190.85.151.2263686110 *  1 ( A V x *jd  -_) ossec13001gExim Auth failed2025-03-31 08:16:06 dovecot_login authenticator failed for ([183.167.196.62]) [183.167.196.62]:46436: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)183.167.196.621814991c  -+ ossec13001gExim Auth failed2025-03-31 08:15:51 dovecot_login authenticator failed for (203.173.209.139.adsl-pool.jlccptt.net.cn) [139.209.173.203]:42260: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)139.209.173.2031814991nb  -i' ossec13001g Exim Auth failed2025-03-31 08:12:21 dovecot_login authenticator failed for (6.240.213.139.adsl-pool.jlccptt.net.cn) [139.213.240.6]:42624: 535 Incorrect authentication data (set_id=services)139.213.240.61814991ga  -]% ossec13001gExim Auth failed2025-03-31 08:12:02 dovecot_login authenticator failed for ([144.22.61.30]) [144.22.61.30]:41910: 535 Incorrect authentication data (set_id=services@heipowersystem.com)144.22.61.303895114g`  -W+ ossec13001gExim Auth failed2025-03-31 08:07:36 dovecot_plain authenticator failed for (dynamic-ip-adsl.metfone.com.kh) [175.100.107.238]:60378: 535 Incorrect authentication data (set_id=sales)175.100.107.2381831722g_  -[' ossec13001gExim Auth failed2025-03-31 08:07:13 dovecot_plain authenticator failed for ([77.51.214.170]) [77.51.214.170]:50579: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)77.51.214.1702017370Z^  -C% ossec13001gExim Auth failed2025-03-31 08:04:02 dovecot_login authenticator failed for ([60.216.37.11]) [60.216.37.11]:53568: 535 Incorrect authentication data (set_id=brander-center)60.216.37.111814991r]  -s% ossec13001gExim Auth failed2025-03-31 08:03:51 dovecot_login authenticator failed for ([218.22.0.200]) [218.22.0.200]:44834: 535 Incorrect authentication data (set_id=brander-center@saintsoldiercollege.com)218.22.0.2001814991Z\  -C% ossec13001gExim Auth failed2025-03-31 07:54:25 dovecot_login authenticator failed for ([65.181.79.60]) [65.181.79.60]:52762: 535 Incorrect authentication data (set_id=brander-center)65.181.79.601819730o[  -o# ossec13001gExim Auth failed2025-03-31 07:54:14 dovecot_login authenticator failed for ([37.208.97.2]) [37.208.97.2]:50388: 535 Incorrect authentication data (set_id=brander-center@saintsoldiercollege.com)37.208.97.22017370ZZ  -=+ ossec13001gExim Auth failed2025-03-31 07:45:09 dovecot_login authenticator failed for ([175.145.232.217]) [175.145.232.217]:41594: 535 Incorrect authentication data (set_id=sales)175.145.232.2171733045gY  -[' ossec13001gExim Auth failed2025-03-31 07:44:47 dovecot_login authenticator failed for ([183.105.3.221]) [183.105.3.221]:38766: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)183.105.3.2211835841cX  -O+ ossec13001gTExim Auth failed2025-03-31 07:43:38 dovecot_login authenticator failed for ([220.180.249.165]) [220.180.249.165]:38926: 535 Incorrect authentication data (set_id=brander-center)220.180.249.1651814991W  -' ossec13001g-Exim Auth failed2025-03-31 07:43:00 dovecot_login authenticator failed for h87-96-158-252.cust.bredband2.com [87.96.158.252]:38706: 535 Incorrect authentication data (set_id=brander-center@saintsoldiercollege.com)87.96.158.2522661886bV  -O) ossec13001gExim Auth failed2025-03-31 07:32:29 dovecot_plain authenticator failed for ([183.167.196.62]) [183.167.196.62]:60920: 535 Incorrect authentication data (set_id=vikas.khandelwal)183.167.196.621814991rU  -q' ossec13001gExim Auth failed2025-03-31 07:32:08 dovecot_plain authenticator failed for ([218.69.115.74]) [218.69.115.74]:33189: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)218.69.115.741814991oT  -k' ossec13001gExim Auth failed2025-03-31 07:12:38 dovecot_login authenticator failed for ([114.143.137.92]) [49.36.123.143]:47264: 535 Incorrect authentication data (set_id=istok91@saintsoldiercollege.com)49.36.123.1431269750 V(& H R  ~ 'VMu  --# ossec13001gExim Auth failed2025-03-31 09:29:20 dovecot_login authenticator failed for ([95.0.252.77]) [95.0.252.77]:55594: 535 Incorrect authentication data (set_id=sales)95.0.252.77298795Tt  -5' ossec13001gExim Auth failed2025-03-31 09:27:22 dovecot_plain authenticator failed for ([116.237.85.95]) [223.166.75.68]:16486: 535 Incorrect authentication data (set_id=sales)223.166.75.681814991zs  -' ossec13001gExim Auth failed2025-03-31 09:27:04 dovecot_plain authenticator failed for syn-047-037-112-171.res.spectrum.com [47.37.112.171]:34689: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)47.37.112.1716252001_r  -K) ossec13001gExim Auth failed2025-03-31 09:24:59 dovecot_login authenticator failed for ([185.101.16.250]) [185.101.16.250]:53808: 535 Incorrect authentication data (set_id=brander-center)185.101.16.250272103{q  -+ ossec13001gExim Auth failed2025-03-31 09:24:45 dovecot_login authenticator failed for ([175.156.224.192]) [175.156.224.192]:33718: 535 Incorrect authentication data (set_id=brander-center@saintsoldiercollege.com)175.156.224.1921880251Sp  -5% ossec13001grExim Auth failed2025-03-31 09:18:00 dovecot_login authenticator failed for ([60.172.53.82]) [60.172.53.82]:51891: 535 Incorrect authentication data (set_id=istok91)60.172.53.821814991o  -;+ ossec13001gdExim Auth failed2025-03-31 09:17:47 dovecot_login authenticator failed for 186-247-193-126.user.veloxzone.com.br ([187.13.145.153]) [186.247.193.126]:48776: 535 Incorrect authentication data (set_id=istok91@saintsoldiercollege.com)186.247.193.1263469034bn  -S% ossec13001g Exim Auth failed2025-03-31 09:02:02 dovecot_login authenticator failed for 111-70-9-143.emome-ip.hinet.net [111.70.9.143]:49511: 535 Incorrect authentication data (set_id=istok91)111.70.9.1431668284nm  -i' ossec13001g Exim Auth failed2025-03-31 09:01:51 dovecot_login authenticator failed for ([27.45.236.104]) [27.45.236.104]:44686: 535 Incorrect authentication data (set_id=istok91@saintsoldiercollege.com)27.45.236.1041814991ul  -u) ossec13001g `Exim Auth failed2025-03-31 08:52:08 dovecot_plain authenticator failed for ([175.214.52.214]) [175.214.52.214]:55554: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)175.214.52.2141835841Vk  -9' ossec13001gExim Auth failed2025-03-31 08:22:58 dovecot_login authenticator failed for ([92.119.74.245]) [92.119.74.245]:57768: 535 Incorrect authentication data (set_id=istok91)92.119.74.2452510769}j  -) ossec13001g|Exim Auth failed2025-03-31 08:22:44 dovecot_login authenticator failed for 110-25-106-243.adsl.fetnet.net [110.25.106.243]:47504: 535 Incorrect authentication data (set_id=istok91@saintsoldiercollege.com)110.25.106.2431668284Oi  --% ossec13001gExim Auth failed2025-03-31 08:19:32 dovecot_login authenticator failed for ([110.7.52.183]) [110.7.52.183]:55830: 535 Incorrect authentication data (set_id=job)110.7.52.1831814991rh  -s% ossec13001gExim Auth failed2025-03-31 08:19:11 dovecot_login authenticator failed for h77-53-61-147.cust.bredband2.com [77.53.61.147]:58172: 535 Incorrect authentication data (set_id=job@heipowersystem.com)77.53.61.1472661886Zg  -=+ ossec13001gExim Auth failed2025-03-31 08:18:35 dovecot_login authenticator failed for ([111.171.127.190]) [111.171.127.190]:48386: 535 Incorrect authentication data (set_id=sales)111.171.127.1901835841~f  -) ossec13001gpExim Auth failed2025-03-31 08:18:16 dovecot_login authenticator failed for h-213-136-52-219.a1663.priv.bahnhof.se [213.136.52.219]:59464: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)213.136.52.2192661886Te  -5' ossec13001gExim Auth failed2025-03-31 08:16:17 dovecot_login authenticator failed for ([103.48.194.21]) [103.48.194.21]:60488: 535 Incorrect authentication data (set_id=sales)103.48.194.211562822 j 2 B G Y ~4Oja  -K+ ossec13001g%"Exim Auth failed2025-03-31 10:46:17 dovecot_plain authenticator failed for (106.51.70.231.actcorp.in) [180.151.254.218]:49546: 535 Incorrect authentication data (set_id=sales)180.151.254.2181269750a  -S# ossec13001g%Exim Auth failed2025-03-31 10:46:07 dovecot_plain authenticator failed for ([41.63.235.9]) [41.63.235.9]:57180: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)41.63.235.93355338#  3O' ossec11301g lNew FTP connection.Mar 31 10:26:11 vm1 pure-ftpd[968570]: (?@194.0.234.153) [INFO] New connection from 194.0.234.153194.0.234.153130758i  -[+ ossec13001gExim Auth failed2025-03-31 10:22:28 dovecot_plain authenticator failed for ([128.106.196.150]) [128.106.196.150]:60228: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)128.106.196.1501880251~  -) ossec13001gExim Auth failed2025-03-31 10:22:18 dovecot_plain authenticator failed for (h90.msk-0.maverick.ru) [185.238.200.90]:39200: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)185.238.200.902017370Y  -C# ossec13001gExim Auth failed2025-03-31 10:13:46 dovecot_login authenticator failed for vps-4a81acc7.vps.ovh.net [51.77.200.6]:40770: 535 Incorrect authentication data (set_id=istok91)51.77.200.63017382q  -m) ossec13001g{Exim Auth failed2025-03-31 10:13:38 dovecot_login authenticator failed for ([106.255.231.10]) [106.255.231.10]:58728: 535 Incorrect authentication data (set_id=istok91@saintsoldiercollege.com)106.255.231.101835841b  -O) ossec13001gExim Auth failed2025-03-31 10:11:43 dovecot_plain authenticator failed for ([221.199.172.66]) [221.199.172.66]:41652: 535 Incorrect authentication data (set_id=vikas.khandelwal)221.199.172.661814991x~  -y+ ossec13001gExim Auth failed2025-03-31 10:11:32 dovecot_plain authenticator failed for ([103.158.138.179]) [103.158.138.179]:35614: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)103.158.138.1791269750}  - ) ossec13001gExim Auth failed2025-03-31 10:11:16 dovecot_plain authenticator failed for 17.sub-166-248-194.myvzw.com [166.248.194.17]:57390: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)166.248.194.176252001T|  -5' ossec13001gExim Auth failed2025-03-31 10:03:02 dovecot_login authenticator failed for ([183.66.145.42]) [183.66.145.42]:42550: 535 Incorrect authentication data (set_id=sales)183.66.145.421814991j{  -_) ossec13001gExim Auth failed2025-03-31 10:02:47 dovecot_login authenticator failed for ([128.185.12.179]) [128.185.12.179]:38496: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)128.185.12.1791269750wz  -w+ ossec13001gExim Auth failed2025-03-31 09:50:45 dovecot_login authenticator failed for (static.ill.117.248.107.130.bsnl.co.in) [117.248.107.130]:47558: 535 Incorrect authentication data (set_id=brander-center)117.248.107.1301269750ly  -k! ossec13001gExim Auth failed2025-03-31 09:50:36 dovecot_login authenticator failed for ([5.17.16.70]) [5.17.16.70]:49250: 535 Incorrect authentication data (set_id=brander-center@saintsoldiercollege.com)5.17.16.702017370cx  -S' ossec13001gExim Auth failed2025-03-31 09:31:31 dovecot_login authenticator failed for ([49.124.153.43]) [49.124.153.43]:60792: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)49.124.153.431733045yw  -}) ossec13001gExim Auth failed2025-03-31 09:31:21 dovecot_login authenticator failed for ([103.203.210.22]) [103.203.210.22]:39280: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)103.203.210.221269750fv  -[% ossec13001gExim Auth failed2025-03-31 09:29:10 dovecot_login authenticator failed for ([110.227.215.25]) [27.107.113.6]:57796: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)27.107.113.61269750 X < \ 'D( 3S) ossec11301g1)New FTP connection.Mar 31 11:37:35 vm1 pure-ftpd[985129]: (?@106.221.168.88) [INFO] New connection from 106.221.168.88106.221.168.8812697501 CU) ossec11309g1)FTP Authentication success.Mar 31 11:37:36 vm1 pure-ftpd[985129]: (?@106.221.168.88) [INFO] user@spexscart.com is now logged in106.221.168.881269750_  -K' ossec13001g/Exim Auth failed2025-03-31 11:31:21 dovecot_plain authenticator failed for ([103.93.37.178]) [103.93.37.178]:57960: 535 Incorrect authentication data (set_id=vikas.khandelwal)103.93.37.1781269750r  -q' ossec13001g/Exim Auth failed2025-03-31 11:30:52 dovecot_plain authenticator failed for ([58.136.244.21]) [58.136.244.21]:44586: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)58.136.244.211605651}  -) ossec13001g,Exim Auth failed2025-03-31 11:15:57 dovecot_login authenticator failed for (175-180-129-87.adsl.dynamic.seed.net.tw) [175.180.129.87]:43442: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)175.180.129.871668284{  -+ ossec13001g, Exim Auth failed2025-03-31 11:15:46 dovecot_login authenticator failed for ([178.135.121.123]) [178.135.120.209]:43432: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)178.135.120.209272103U  -5) ossec13001g+OExim Auth failed2025-03-31 11:12:39 dovecot_login authenticator failed for ([122.227.206.42]) [122.227.206.42]:40090: 535 Incorrect authentication data (set_id=ben)122.227.206.421814991h  -[) ossec13001g+=Exim Auth failed2025-03-31 11:12:20 dovecot_login authenticator failed for ([168.126.90.210]) [168.126.90.210]:50394: 535 Incorrect authentication data (set_id=ben@heipowersystem.com)168.126.90.2101835841Y  -C% ossec13001g)Exim Auth failed2025-03-31 11:05:33 dovecot_login authenticator failed for ([94.202.99.91]) [94.202.99.91]:38533: 535 Incorrect authentication data (set_id=brander-center)94.202.99.91290557u  -w' ossec13001g)Exim Auth failed2025-03-31 11:05:17 dovecot_login authenticator failed for ([186.96.89.101]) [186.96.89.101]:56362: 535 Incorrect authentication data (set_id=brander-center@saintsoldiercollege.com)186.96.89.1013624060d  -W' ossec13001g(Exim Auth failed2025-03-31 11:01:13 dovecot_login authenticator failed for (host-144-253-28-31.sevstar.net) [31.28.253.144]:34090: 535 Incorrect authentication data (set_id=istok91)31.28.253.144690791q  -m) ossec13001g(Exim Auth failed2025-03-31 11:00:53 dovecot_login authenticator failed for ([117.198.97.126]) [117.198.97.126]:37891: 535 Incorrect authentication data (set_id=istok91@saintsoldiercollege.com)117.198.97.1261269750C  Iy' ossec11331g&z Stealth FTP brute force attackMar 31 10:52:00 vm1 pure-ftpd[974495]: (?@194.0.234.153) [WARNING] Authentication failed for user [uttamclassesjaipur]194.0.234.153130758\  g' ossec11321g&vActive Response. FTP brute force attack (Port 21 is protected)Mar 31 10:51:57 vm1 pure-ftpd[974484]: (?@194.0.234.153) [WARNING] Authentication failed for user [rokamauka]194.0.234.153130758 S' ossec211321g&vPreventing FTP brute force attempt.[Active Response] is disabled for rule 11321. Greylisting 194.0.234.153194.0.234.1531307588 Ai' ossec11302g&tFTP Authentication failed.Mar 31 10:51:55 vm1 pure-ftpd[974470]: (?@194.0.234.153) [WARNING] Authentication failed for user [nyaystambh]194.0.234.153130758> gO' ossec11307g&rMultiple connection attempts from same sourceMar 31 10:51:52 vm1 pure-ftpd[974484]: (?@194.0.234.153) [INFO] New connection from 194.0.234.153194.0.234.153130758$ 3O' ossec11301g&pNew FTP connection.Mar 31 10:51:51 vm1 pure-ftpd[974465]: (?@194.0.234.153) [INFO] New connection from 194.0.234.153194.0.234.153130758 k*-na~qdWJ ' v i!Dl_8+7y~q w P C 6 )   sfYL?2% -   d*^Q#uh[N| { n a T : -   { n a T : Wo TG:=H; o \ B 5 (     r e= 4 0# G ]0 O{! | HJzm`SF.RE9, AbU j n-~qdWJ 3469034> 34690342? 34690340' 3469034> 3469034>  3469034G 357994? 357994? 357994? 357994? 3469034I 3469034( 3469034? 3624060? 3469034?M 3508796?5 3469034? 3469034( 3595528. 357994. 3469034( 3469034I 3469034H 3469034H 3469034)2 3469034)% 357994, 3624060, 3469034I 3469034G 3469034I 3469034I` 3469034I& 3469034*) 3469034H 3469034H 3469034* 3469034HR 3469034H9 3469034? 3576468J' 3469034J 3469034+1 3469034+) 3469034* 3469034* 3469034* 3469034* 3469034H 3469034H 3469034H 3595528* 3469034H 3469034H 3595528H 3469034+4 3469034@' 3469034+g 3469034@ 3469034+ 3508796J 3624060( 3469034A 3469034A 3469034A 3469034Au 3469034+ 3469034B 3595528(Q 3469034BF 3595528(" 3595528( 3469034B 3469034, 3595528' 3469034,W 3469034B 3469034B 34690341 34690341| 34690340 35955280 35955280 34690340 34690340 34690343o 3579942 34690342 34690342 34690342h 35087963 34690343 34690343 34690340\ 3469034, 3469034, 357994/ 3469034/ 3469034/k 3595528/b 3469034Jp 3469034JZ 3624060/ 3624060/ 3469034J 3469034B 3469034JP 3469034Il 3469034C 3469034I 3579143I 3469034I 346903440 34690344+ 3469034-Y 34690344o 34690348 3469034C 34690348k 34690348Z 34690348H 34690348$ 34690348 34690347 34690347 34690347z 34690347O 34690347 36240606 34690346 34690346j 34690346i 34690346? 346903464 34690346 34690345 34690345 34690345 34690345 34690345 34690345 34690345 35735915 36240605} 34690345] 3469034-l 3469034C2 34690344 36240604 3469034Fd 3469034FJ 3469034F# 3469034F" 3469034F! 3469034E 3469034E 3469034E 3469034E 3469034DA 3469034C 3573345J 3469034Cy 3469034CU 3469034C> 3469034C8 3469034J 3469034 3469034O 3469034O 3469034O 3469034N 3469034NS 3469034NA 3469034N- 3469034M 3508796M 3469034M6 3469034M 3469034L 3469034LY 3469034L( 3469034K 3469034Kw 3469034K` 3469034KJ 3579143K9 3469034K 3469034/1 3469034// 3469034. 3469034. 3469034. 3469034. 3469034. 3469034- 3469034- 3469034- 3625428 3624060& 3624060" 3624060. 3624060 t 3624060 3624060 7 3595528$P 3595528!{ 3595528! 3595528# 3595528 3595528 3595528 3595528 3595528 3595528 3582678 w 3580718 S 3580718 3580718 M 3573591 3573345 3573345 3573345 3572887 3508796 357994Gb 3469034G? 3469034>i 34690344A 34690344$ 3469034> 35087963~ 35955282< 35735919F 34690341 34690341 3469034/ MQ ,x{%).SM*  -% ossec13001g3Exim Auth failed2025-03-31 11:48:03 dovecot_login authenticator failed for 91.red-88-10-205.dynamicip.rima-tde.net [88.10.205.91]:43866: 535 Incorrect authentication data (set_id=istok91@saintsoldiercollege.com)88.10.205.912510769W)  -9) ossec13001g3Exim Auth failed2025-03-31 11:47:46 dovecot_login authenticator failed for ([211.248.31.142]) [211.248.31.142]:45622: 535 Incorrect authentication data (set_id=sales)211.248.31.1421835841w(  Cc) ossec11313g2FTP file uploaded to serverMar 31 11:45:09 vm1 pure-ftpd[986724]: (user@spexscart.com@106.221.168.88) [NOTICE] /home/techno/public_html/spexscart.com//header.php uploaded (5743 bytes, 731.31KB/sec)106.221.168.881269750x'  Ce) ossec11313g2FTP file uploaded to serverMar 31 11:44:43 vm1 pure-ftpd[986724]: (user@spexscart.com@106.221.168.88) [NOTICE] /home/techno/public_html/spexscart.com//header.php uploaded (5711 bytes, 8880.89KB/sec)106.221.168.8812697500&  CU) ossec11309g2FTP Authentication success.Mar 31 11:44:43 vm1 pure-ftpd[986724]: (?@106.221.168.88) [INFO] user@spexscart.com is now logged in106.221.168.881269750'%  3S) ossec11301g2New FTP connection.Mar 31 11:44:43 vm1 pure-ftpd[986724]: (?@106.221.168.88) [INFO] New connection from 106.221.168.88106.221.168.881269750w$  Cc) ossec11313g2hFTP file uploaded to serverMar 31 11:42:55 vm1 pure-ftpd[986183]: (user@spexscart.com@106.221.168.88) [NOTICE] /home/techno/public_html/spexscart.com//header.php uploaded (5619 bytes, 836.74KB/sec)106.221.168.881269750x#  -y+ ossec13001g2IExim Auth failed2025-03-31 11:42:25 dovecot_plain authenticator failed for 220-135-248-246.hinet-ip.hinet.net [220.135.248.246]:51656: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)220.135.248.2461668284y"  -}) ossec13001g2=Exim Auth failed2025-03-31 11:42:13 dovecot_plain authenticator failed for ([183.36.126.244]) [183.36.126.244]:59016: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)183.36.126.24418149910!  CU) ossec11309g23FTP Authentication success.Mar 31 11:42:01 vm1 pure-ftpd[986183]: (?@106.221.168.88) [INFO] user@spexscart.com is now logged in106.221.168.881269750'  3S) ossec11301g21New FTP connection.Mar 31 11:42:01 vm1 pure-ftpd[986183]: (?@106.221.168.88) [INFO] New connection from 106.221.168.88106.221.168.881269750f  -Y' ossec13001g1Exim Auth failed2025-03-31 11:41:09 dovecot_login authenticator failed for 111-70-28-243.emome-ip.hinet.net [111.70.28.243]:57187: 535 Incorrect authentication data (set_id=services)111.70.28.2431668284w  Cc) ossec11313g23FTP file uploaded to serverMar 31 11:42:02 vm1 pure-ftpd[986183]: (user@spexscart.com@106.221.168.88) [NOTICE] /home/techno/public_html/spexscart.com//header.php uploaded (5662 bytes, 502.38KB/sec)106.221.168.881269750j  -a' ossec13001g1Exim Auth failed2025-03-31 11:40:56 dovecot_login authenticator failed for ([58.245.210.70]) [58.245.210.70]:57229: 535 Incorrect authentication data (set_id=services@heipowersystem.com)58.245.210.701814991x  Ce) ossec11313g1FTP file uploaded to serverMar 31 11:40:29 vm1 pure-ftpd[985664]: (user@spexscart.com@106.221.168.88) [NOTICE] /home/techno/public_html/spexscart.com//header.php uploaded (5514 bytes, 1008.00KB/sec)106.221.168.881269750'  3S) ossec11301g1New FTP connection.Mar 31 11:39:59 vm1 pure-ftpd[985664]: (?@106.221.168.88) [INFO] New connection from 106.221.168.88106.221.168.8812697500  CU) ossec11309g1FTP Authentication success.Mar 31 11:39:59 vm1 pure-ftpd[985664]: (?@106.221.168.88) [INFO] user@spexscart.com is now logged in106.221.168.881269750w  Cc) ossec11313g1FTP file uploaded to serverMar 31 11:39:59 vm1 pure-ftpd[985664]: (user@spexscart.com@106.221.168.88) [NOTICE] /home/techno/public_html/spexscart.com//header.php uploaded (5525 bytes, 319.73KB/sec)106.221.168.881269750 ]i  H-'GQ]p<  -k) ossec13001gBExim Auth failed2025-03-31 12:49:26 dovecot_login authenticator failed for 198-91-129-195.cpe.distributel.net [198.91.129.195]:43170: 535 Incorrect authentication data (set_id=brander-center)198.91.129.1956251999r;  -s% ossec13001gAExim Auth failed2025-03-31 12:49:16 dovecot_login authenticator failed for ([58.96.247.71]) [58.96.247.71]:47189: 535 Incorrect authentication data (set_id=brander-center@saintsoldiercollege.com)58.96.247.711880251\:  -A+ ossec13001gAExim Auth failed2025-03-31 12:48:01 dovecot_login authenticator failed for ([115.242.200.126]) [115.242.200.126]:59812: 535 Incorrect authentication data (set_id=istok91)115.242.200.12612697509  -' ossec13001gAExim Auth failed2025-03-31 12:47:52 dovecot_login authenticator failed for (static-91.137.143.114-tataidc.co.in) [49.36.123.143]:48488: 535 Incorrect authentication data (set_id=istok91@saintsoldiercollege.com)49.36.123.1431269750l8  -e' ossec13001gA?Exim Auth failed2025-03-31 12:46:15 dovecot_login authenticator failed for ool-457e901e.dyn.optonline.net [69.126.144.30]:55456: 535 Incorrect authentication data (set_id=vikas.khandelwal)69.126.144.306252001u7  -u) ossec13001gA/Exim Auth failed2025-03-31 12:45:58 dovecot_login authenticator failed for ([115.22.247.178]) [115.22.247.178]:37949: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)115.22.247.1781835841Z6  -=+ ossec13001g7Exim Auth failed2025-03-31 12:06:41 dovecot_plain authenticator failed for ([120.157.128.238]) [120.157.128.238]:33350: 535 Incorrect authentication data (set_id=sales)120.157.128.2382077456z5  -' ossec13001g7Exim Auth failed2025-03-31 12:06:30 dovecot_plain authenticator failed for syn-047-038-202-184.res.spectrum.com [47.38.202.184]:37904: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)47.38.202.1846252001'4  3S) ossec11301g7New FTP connection.Mar 31 12:05:09 vm1 pure-ftpd[991482]: (?@195.184.76.129) [INFO] New connection from 195.184.76.129195.184.76.1296252001'3  3S) ossec11301g7New FTP connection.Mar 31 12:05:10 vm1 pure-ftpd[991484]: (?@195.184.76.133) [INFO] New connection from 195.184.76.133195.184.76.133625200192  Ai) ossec11302g7FTP Authentication failed.Mar 31 12:05:15 vm1 pure-ftpd[991484]: (?@195.184.76.133) [WARNING] Authentication failed for user [anonymous]195.184.76.1336252001]1  -G' ossec13001g4Exim Auth failed2025-03-31 11:52:58 dovecot_login authenticator failed for ([12.70.103.162]) [12.70.103.162]:60314: 535 Incorrect authentication data (set_id=brander-center)12.70.103.1626252001r0  -s% ossec13001g4Exim Auth failed2025-03-31 11:52:41 dovecot_login authenticator failed for ([180.94.74.94]) [180.94.74.94]:48662: 535 Incorrect authentication data (set_id=brander-center@saintsoldiercollege.com)180.94.74.941149361x/  -{) ossec13001g4Exim Auth failed2025-03-31 11:52:31 dovecot_login authenticator failed for ([200.199.32.174]) [200.199.32.174]:40576: 535 Incorrect authentication data (set_id=brander-center@saintsoldiercollege.com)200.199.32.1743469034Y.  -=) ossec13001g3Exim Auth failed2025-03-31 11:48:15 dovecot_login authenticator failed for ([168.126.90.210]) [168.126.90.210]:49791: 535 Incorrect authentication data (set_id=istok91)168.126.90.21018358410-  CU) ossec11309g3FTP Authentication success.Mar 31 11:47:39 vm1 pure-ftpd[987487]: (?@106.221.168.88) [INFO] user@spexscart.com is now logged in106.221.168.881269750',  3S) ossec11301g3New FTP connection.Mar 31 11:47:39 vm1 pure-ftpd[987487]: (?@106.221.168.88) [INFO] New connection from 106.221.168.88106.221.168.881269750h+  -_' ossec13001g3tExim Auth failed2025-03-31 11:47:23 dovecot_login authenticator failed for ([196.191.212.226]) [213.55.85.202]:12741: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)213.55.85.202337996 $ . : * C DN`QL  -1% ossec13001gLExim Auth failed2025-03-31 13:32:07 dovecot_login authenticator failed for ([1.82.135.154]) [1.82.135.154]:42045: 535 Incorrect authentication data (set_id=sales)1.82.135.1541814991K  -% ossec13001gKExim Auth failed2025-03-31 13:31:12 dovecot_login authenticator failed for 111-70-19-64.emome-ip.hinet.net [111.70.19.64]:53063: 535 Incorrect authentication data (set_id=brander-center@saintsoldiercollege.com)111.70.19.641668284uJ  -w' ossec13001gKExim Auth failed2025-03-31 13:31:08 dovecot_login authenticator failed for ([31.173.67.108]) [31.173.67.108]:49092: 535 Incorrect authentication data (set_id=brander-center@saintsoldiercollege.com)31.173.67.1082017370gI  -[' ossec13001gKExim Auth failed2025-03-31 13:31:54 dovecot_login authenticator failed for ([182.70.248.10]) [182.70.248.10]:53172: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)182.70.248.101269750xH  -{) ossec13001gKExim Auth failed2025-03-31 13:31:30 dovecot_login authenticator failed for ([114.202.80.152]) [114.202.80.152]:39358: 535 Incorrect authentication data (set_id=brander-center@saintsoldiercollege.com)114.202.80.1521835841vG  -w) ossec13001gKExim Auth failed2025-03-31 13:31:20 dovecot_login authenticator failed for (nsg-corporate-21.226.187.122.airtel.in) [122.187.226.21]:48535: 535 Incorrect authentication data (set_id=brander-center)122.187.226.211269750WF  -9) ossec13001gJExim Auth failed2025-03-31 13:26:26 dovecot_plain authenticator failed for ([219.145.221.21]) [219.145.221.21]:47236: 535 Incorrect authentication data (set_id=sales)219.145.221.211814991jE  -_) ossec13001gJExim Auth failed2025-03-31 13:26:13 dovecot_plain authenticator failed for ([103.100.234.22]) [103.100.234.22]:47406: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)103.100.234.221210997rD  -o) ossec13001gIExim Auth failed2025-03-31 13:21:40 dovecot_login authenticator failed for c-69-242-149-240.hsd1.mo.comcast.net [69.242.149.240]:42466: 535 Incorrect authentication data (set_id=brander-center)69.242.149.2406252001{C  -+ ossec13001gIExim Auth failed2025-03-31 13:21:29 dovecot_login authenticator failed for ([121.184.113.158]) [121.184.113.158]:53446: 535 Incorrect authentication data (set_id=brander-center@saintsoldiercollege.com)121.184.113.1581835841cB  -S' ossec13001gEExim Auth failed2025-03-31 13:02:33 dovecot_plain authenticator failed for ([180.7.180.143]) [180.7.180.143]:38475: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)180.7.180.1431861060 A  -#) ossec13001gEExim Auth failed2025-03-31 13:02:17 dovecot_plain authenticator failed for 123-193-152-64.dynamic.kbronet.com.tw [123.193.152.64]:33764: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)123.193.152.641668284p@  -q# ossec13001gDExim Auth failed2025-03-31 13:00:34 dovecot_login authenticator failed for ([58.16.8.106]) [58.16.8.106]:38633: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)58.16.8.1061814991r?  -q' ossec13001gDExim Auth failed2025-03-31 13:00:47 dovecot_login authenticator failed for 216.106.67.50.reverse.socket.net [216.106.67.50]:41086: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)216.106.67.506252001_>  -K' ossec13001gBvExim Auth failed2025-03-31 12:51:25 dovecot_plain authenticator failed for ([125.72.92.174]) [125.72.92.174]:52259: 535 Incorrect authentication data (set_id=vikas.khandelwal)125.72.92.1741814991u=  -u) ossec13001gBjExim Auth failed2025-03-31 12:51:13 dovecot_plain authenticator failed for ([178.178.222.61]) [178.178.222.61]:57098: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)178.178.222.612017370 # w  x +zzf]  -W) ossec13001g]Exim Auth failed2025-03-31 14:44:55 dovecot_login authenticator failed for ([122.160.69.233]) [122.160.69.233]:50212: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)122.160.69.2331269750|\  -+ ossec13001g]Exim Auth failed2025-03-31 14:44:45 dovecot_login authenticator failed for ([123.139.116.184]) [123.139.116.184]:38160: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)123.139.116.1841814991[  Cw) ossec11313g\FTP file uploaded to serverMar 31 14:40:50 vm1 pure-ftpd[1026313]: (user@spexscart.com@106.221.168.88) [NOTICE] /home/techno/public_html/spexscart.com//single-product.php uploaded (16258 bytes, 353.95KB/sec)106.221.168.881269750(Z  3U) ossec11301g\New FTP connection.Mar 31 14:40:49 vm1 pure-ftpd[1026313]: (?@106.221.168.88) [INFO] New connection from 106.221.168.88106.221.168.8812697501Y  CW) ossec11309g\FTP Authentication success.Mar 31 14:40:49 vm1 pure-ftpd[1026313]: (?@106.221.168.88) [INFO] user@spexscart.com is now logged in106.221.168.881269750_X  -K' ossec13001gYExim Auth failed2025-03-31 14:30:27 dovecot_login authenticator failed for ([82.208.71.101]) [82.208.71.101]:58224: 535 Incorrect authentication data (set_id=vikas.khandelwal)82.208.71.1012017370wW  -y+ ossec13001gYExim Auth failed2025-03-31 14:30:17 dovecot_login authenticator failed for ([178.250.191.189]) [178.250.191.189]:39966: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)178.250.191.189458258rV  -q' ossec13001gYExim Auth failed2025-03-31 14:30:06 dovecot_login authenticator failed for ([223.171.55.59]) [223.171.55.59]:56078: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)223.171.55.591835841tU  -u' ossec13001gWExim Auth failed2025-03-31 14:22:04 dovecot_plain authenticator failed for 89-179-78-247.broadband.corbina.ru [89.179.78.247]:51690: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)89.179.78.2472017370uT  -y' ossec13001gWExim Auth failed2025-03-31 14:21:43 dovecot_plain authenticator failed for ([77.137.130.12]) [77.137.130.12]:49833: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)77.137.130.12294640bS  -O) ossec13001gUExim Auth failed2025-03-31 14:10:50 dovecot_plain authenticator failed for ([118.45.101.159]) [118.45.101.159]:37355: 535 Incorrect authentication data (set_id=vikas.khandelwal)118.45.101.1591835841iR  -g! ossec13001gUExim Auth failed2025-03-31 14:10:38 dovecot_plain authenticator failed for ([2.57.219.14]) [2.57.219.2]:49596: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)2.57.219.2614540Q  -' ossec13001gSExim Auth failed2025-03-31 14:05:57 dovecot_login authenticator failed for host-88-43-231-186.business.telecomitalia.it ([88.43.231.188]) [88.43.231.186]:43766: 535 Incorrect authentication data (set_id=careers)88.43.231.1863175395tP  -u' ossec13001gSExim Auth failed2025-03-31 14:05:47 dovecot_login authenticator failed for (6-red145.ceviamonte.com.ar) [143.202.145.6]:55258: 535 Incorrect authentication data (set_id=careers@heipowersystem.com)143.202.145.63865483(O  3U) ossec11301gOmNew FTP connection.Mar 31 13:46:44 vm1 pure-ftpd[1014148]: (?@147.185.132.60) [INFO] New connection from 147.185.132.60147.185.132.606252001YN  -=) ossec13001gNExim Auth failed2025-03-31 13:43:38 dovecot_login authenticator failed for ([115.22.247.178]) [115.22.247.178]:60434: 535 Incorrect authentication data (set_id=istok91)115.22.247.1781835841|M  -+ ossec13001gNExim Auth failed2025-03-31 13:43:21 dovecot_login authenticator failed for (azteca-comunicaciones.com) [186.148.187.146]:48126: 535 Incorrect authentication data (set_id=istok91@saintsoldiercollege.com)186.148.187.1463686110 7 % p s aFA<1p  CW) ossec11309gaFTP Authentication success.Mar 31 15:03:53 vm1 pure-ftpd[1031456]: (?@106.221.168.88) [INFO] user@spexscart.com is now logged in106.221.168.881269750o  Cw) ossec11313g`FTP file uploaded to serverMar 31 14:57:35 vm1 pure-ftpd[1029891]: (user@spexscart.com@106.221.168.88) [NOTICE] /home/techno/public_html/spexscart.com//single-product.php uploaded (16085 bytes, 344.83KB/sec)106.221.168.881269750n  Cw) ossec11313g_FTP file uploaded to serverMar 31 14:56:55 vm1 pure-ftpd[1029891]: (user@spexscart.com@106.221.168.88) [NOTICE] /home/techno/public_html/spexscart.com//single-product.php uploaded (16173 bytes, 314.03KB/sec)106.221.168.881269750(m  3U) ossec11301g_New FTP connection.Mar 31 14:56:54 vm1 pure-ftpd[1029891]: (?@106.221.168.88) [INFO] New connection from 106.221.168.88106.221.168.8812697501l  CW) ossec11309g_FTP Authentication success.Mar 31 14:56:54 vm1 pure-ftpd[1029891]: (?@106.221.168.88) [INFO] user@spexscart.com is now logged in106.221.168.881269750k  Cw) ossec11313g_HFTP file uploaded to serverMar 31 14:54:23 vm1 pure-ftpd[1029358]: (user@spexscart.com@106.221.168.88) [NOTICE] /home/techno/public_html/spexscart.com//single-product.php uploaded (16198 bytes, 305.18KB/sec)106.221.168.8812697501j  CW) ossec11309g_HFTP Authentication success.Mar 31 14:54:22 vm1 pure-ftpd[1029358]: (?@106.221.168.88) [INFO] user@spexscart.com is now logged in106.221.168.881269750(i  3U) ossec11301g_HNew FTP connection.Mar 31 14:54:22 vm1 pure-ftpd[1029358]: (?@106.221.168.88) [INFO] New connection from 106.221.168.88106.221.168.881269750h  Cw) ossec11313g^FTP file uploaded to serverMar 31 14:52:27 vm1 pure-ftpd[1028871]: (user@spexscart.com@106.221.168.88) [NOTICE] /home/techno/public_html/spexscart.com//single-product.php uploaded (16214 bytes, 304.11KB/sec)106.221.168.8812697501g  CW) ossec11309g^FTP Authentication success.Mar 31 14:52:26 vm1 pure-ftpd[1028871]: (?@106.221.168.88) [INFO] user@spexscart.com is now logged in106.221.168.881269750(f  3U) ossec11301g^New FTP connection.Mar 31 14:52:26 vm1 pure-ftpd[1028871]: (?@106.221.168.88) [INFO] New connection from 106.221.168.88106.221.168.881269750ye Ce) ossec11313g^FTP file uploaded to serverMar 31 14:51:23 vm1 pure-ftpd[1028671]: (user@spexscart.com@106.221.168.88) [NOTICE] /home/techno/public_html/spexscart.com//SUCCESS_URL.php uploaded (0 bytes, 0.00KB/sec)106.221.168.8812697501d  CW) ossec11309g^FTP Authentication success.Mar 31 14:51:23 vm1 pure-ftpd[1028671]: (?@106.221.168.88) [INFO] user@spexscart.com is now logged in106.221.168.881269750(c  3U) ossec11301g^New FTP connection.Mar 31 14:51:22 vm1 pure-ftpd[1028671]: (?@106.221.168.88) [INFO] New connection from 106.221.168.88106.221.168.881269750b  Cw) ossec11313g^FTP file uploaded to serverMar 31 14:49:16 vm1 pure-ftpd[1028150]: (user@spexscart.com@106.221.168.88) [NOTICE] /home/techno/public_html/spexscart.com//single-product.php uploaded (16241 bytes, 268.03KB/sec)106.221.168.8812697501a  CW) ossec11309g^FTP Authentication success.Mar 31 14:49:15 vm1 pure-ftpd[1028150]: (?@106.221.168.88) [INFO] user@spexscart.com is now logged in106.221.168.881269750(`  3U) ossec11301g^New FTP connection.Mar 31 14:49:15 vm1 pure-ftpd[1028150]: (?@106.221.168.88) [INFO] New connection from 106.221.168.88106.221.168.881269750Z_  -=+ ossec13001g]IExim Auth failed2025-03-31 14:45:53 dovecot_plain authenticator failed for ([188.114.151.158]) [188.114.151.158]:59437: 535 Incorrect authentication data (set_id=sales)188.114.151.1582623032g^  -[' ossec13001g]AExim Auth failed2025-03-31 14:45:45 dovecot_plain authenticator failed for ([117.70.94.155]) [117.70.94.155]:58470: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)117.70.94.1551814991 OO e &qTO  Cw) ossec11313ggFTP file uploaded to serverMar 31 15:29:41 vm1 pure-ftpd[1037309]: (user@spexscart.com@106.221.168.88) [NOTICE] /home/techno/public_html/spexscart.com//single-product.php uploaded (15700 bytes, 351.22KB/sec)106.221.168.881269750(  3U) ossec11301ggNew FTP connection.Mar 31 15:29:40 vm1 pure-ftpd[1037309]: (?@106.221.168.88) [INFO] New connection from 106.221.168.88106.221.168.8812697501  CW) ossec11309ggFTP Authentication success.Mar 31 15:29:40 vm1 pure-ftpd[1037309]: (?@106.221.168.88) [INFO] user@spexscart.com is now logged in106.221.168.881269750 Cw) ossec11313gfFTP file uploaded to serverMar 31 15:27:16 vm1 pure-ftpd[1036638]: (user@spexscart.com@106.221.168.88) [NOTICE] /home/techno/public_html/spexscart.com//single-product.php uploaded (16088 bytes, 183.70KB/sec)106.221.168.881269750~  Cw) ossec11313gfFTP file uploaded to serverMar 31 15:26:24 vm1 pure-ftpd[1036638]: (user@spexscart.com@106.221.168.88) [NOTICE] /home/techno/public_html/spexscart.com//single-product.php uploaded (16027 bytes, 342.36KB/sec)106.221.168.881269750}  Cw) ossec11313gfFTP file uploaded to serverMar 31 15:26:00 vm1 pure-ftpd[1036638]: (user@spexscart.com@106.221.168.88) [NOTICE] /home/techno/public_html/spexscart.com//single-product.php uploaded (15561 bytes, 171.97KB/sec)106.221.168.881269750(|  3U) ossec11301gfNew FTP connection.Mar 31 15:25:59 vm1 pure-ftpd[1036638]: (?@106.221.168.88) [INFO] New connection from 106.221.168.88106.221.168.8812697501{  CW) ossec11309gfFTP Authentication success.Mar 31 15:25:59 vm1 pure-ftpd[1036638]: (?@106.221.168.88) [INFO] user@spexscart.com is now logged in106.221.168.881269750Sz  -5' ossec13001gf Exim Auth failed2025-03-31 15:23:14 dovecot_login authenticator failed for ([91.72.171.210]) [91.72.171.210]:32862: 535 Incorrect authentication data (set_id=sales)91.72.171.210290557gy  -[' ossec13001gfExim Auth failed2025-03-31 15:23:04 dovecot_login authenticator failed for ([39.165.236.12]) [39.165.236.12]:49398: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)39.165.236.121814991Tx  -5' ossec13001gdmExim Auth failed2025-03-31 15:16:20 dovecot_login authenticator failed for ([50.249.167.45]) [50.249.167.45]:45108: 535 Incorrect authentication data (set_id=sales)50.249.167.456252001mw  -c+ ossec13001gdaExim Auth failed2025-03-31 15:16:09 dovecot_login authenticator failed for ([178.178.194.126]) [178.178.194.126]:41958: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)178.178.194.1262017370Sv  -5% ossec13001gdSExim Auth failed2025-03-31 15:15:54 dovecot_login authenticator failed for ([113.192.1.27]) [113.192.1.26]:47892: 535 Incorrect authentication data (set_id=istok91)113.192.1.261643084|u  -) ossec13001gdAExim Auth failed2025-03-31 15:15:36 dovecot_login authenticator failed for 80-186-144-129.elisa-mobile.fi [80.186.144.129]:40343: 535 Incorrect authentication data (set_id=istok91@saintsoldiercollege.com)80.186.144.129660013Yt  -?) ossec13001gbExim Auth failed2025-03-31 15:10:01 dovecot_login authenticator failed for ([197.156.115.88]) [197.156.115.88]:47914: 535 Incorrect authentication data (set_id=services)197.156.115.88338010fs  -]% ossec13001gbExim Auth failed2025-03-31 15:09:50 dovecot_login authenticator failed for ([5.11.162.163]) [5.11.162.163]:48029: 535 Incorrect authentication data (set_id=services@heipowersystem.com)5.11.162.163298795(r  3U) ossec11301gaNew FTP connection.Mar 31 15:03:53 vm1 pure-ftpd[1031456]: (?@106.221.168.88) [INFO] New connection from 106.221.168.88106.221.168.881269750q  Cw) ossec11313gaFTP file uploaded to serverMar 31 15:03:53 vm1 pure-ftpd[1031456]: (user@spexscart.com@106.221.168.88) [NOTICE] /home/techno/public_html/spexscart.com//single-product.php uploaded (16088 bytes, 259.64KB/sec)106.221.168.881269750   G d v +&zZgZ  -G% ossec13001grUExim Auth failed2025-03-31 16:15:40 dovecot_login authenticator failed for ([65.20.191.97]) [65.20.191.97]:46310: 535 Incorrect authentication data (set_id=vikas.khandelwal)65.20.191.9799237o  -m% ossec13001grKExim Auth failed2025-03-31 16:15:31 dovecot_login authenticator failed for ([5.167.92.143]) [5.167.92.143]:50668: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)5.167.92.1432017370(  3U) ossec11301gqNew FTP connection.Mar 31 16:13:17 vm1 pure-ftpd[1047095]: (?@106.221.168.88) [INFO] New connection from 106.221.168.88106.221.168.8812697501  CW) ossec11309gqFTP Authentication success.Mar 31 16:13:18 vm1 pure-ftpd[1047095]: (?@106.221.168.88) [INFO] user@spexscart.com is now logged in106.221.168.881269750  Cw) ossec11313gqFTP file uploaded to serverMar 31 16:13:18 vm1 pure-ftpd[1047095]: (user@spexscart.com@106.221.168.88) [NOTICE] /home/techno/public_html/spexscart.com//single-product.php uploaded (15708 bytes, 254.54KB/sec)106.221.168.881269750  Cw) ossec11313gqYFTP file uploaded to serverMar 31 16:11:28 vm1 pure-ftpd[1046757]: (user@spexscart.com@106.221.168.88) [NOTICE] /home/techno/public_html/spexscart.com//single-product.php uploaded (15702 bytes, 375.88KB/sec)106.221.168.8812697501  CW) ossec11309gqYFTP Authentication success.Mar 31 16:11:27 vm1 pure-ftpd[1046757]: (?@106.221.168.88) [INFO] user@spexscart.com is now logged in106.221.168.881269750(  3U) ossec11301gqYNew FTP connection.Mar 31 16:11:27 vm1 pure-ftpd[1046757]: (?@106.221.168.88) [INFO] New connection from 106.221.168.88106.221.168.881269750  Cw) ossec11313gpFTP file uploaded to serverMar 31 16:09:34 vm1 pure-ftpd[1046183]: (user@spexscart.com@106.221.168.88) [NOTICE] /home/techno/public_html/spexscart.com//single-product.php uploaded (15721 bytes, 169.84KB/sec)106.221.168.8812697501  CW) ossec11309gpFTP Authentication success.Mar 31 16:09:34 vm1 pure-ftpd[1046183]: (?@106.221.168.88) [INFO] user@spexscart.com is now logged in106.221.168.881269750(  3U) ossec11301gpNew FTP connection.Mar 31 16:09:34 vm1 pure-ftpd[1046183]: (?@106.221.168.88) [INFO] New connection from 106.221.168.88106.221.168.881269750f  -[% ossec13001gpExim Auth failed2025-03-31 16:06:14 dovecot_plain authenticator failed for 7.248.146.34.bc.googleusercontent.com [34.146.248.7]:42822: 535 Incorrect authentication data (set_id=sales)34.146.248.71861060j  -_) ossec13001gpExim Auth failed2025-03-31 16:06:03 dovecot_plain authenticator failed for ([111.91.178.253]) [111.91.178.253]:34860: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)111.91.178.2531835841_  -M% ossec13001gntExim Auth failed2025-03-31 15:59:08 dovecot_login authenticator failed for (rokamauka.com) [119.96.131.8]:41450: 535 Incorrect authentication data (set_id=office@rokamauka.com)119.96.131.81814991R  -3% ossec13001gn\Exim Auth failed2025-03-31 15:58:43 dovecot_login authenticator failed for (rokamauka.com) [119.96.131.8]:37902: 535 Incorrect authentication data (set_id=nologin)119.96.131.81814991p  -m) ossec13001glExim Auth failed2025-03-31 15:49:00 dovecot_login authenticator failed for ([94.205.100.219]) [94.205.100.219]:36449: 535 Incorrect authentication data (set_id=istok91@saintsoldiercollege.com)94.205.100.219290557j  -a' ossec13001ggExim Auth failed2025-03-31 15:30:58 dovecot_plain authenticator failed for (089-101-036159.ntlworld.ie) [89.101.36.159]:38611: 535 Incorrect authentication data (set_id=vikas.khandelwal)89.101.36.1592963597}  -' ossec13001ggExim Auth failed2025-03-31 15:30:43 dovecot_plain authenticator failed for n219077029126.netvigator.com [219.77.29.126]:34112: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)219.77.29.1261819730 4 L 0MHk%  -c' ossec13001g|Exim Auth failed2025-03-31 16:59:04 dovecot_login authenticator failed for ([106.0.166.123]) [106.0.166.123]:54629: 535 Incorrect authentication data (set_id=christian@heipowersystem.com)106.0.166.1231605651p$  -i+ ossec13001g{Exim Auth failed2025-03-31 16:55:37 dovecot_login authenticator failed for ([182.224.231.102]) [182.224.231.102]:60580: 535 Incorrect authentication data (set_id=services@heipowersystem.com)182.224.231.1021835841i#  -]) ossec13001g{Exim Auth failed2025-03-31 16:55:49 dovecot_login authenticator failed for s75-152-225-154.ab.hsia.telus.net [75.152.225.154]:36554: 535 Incorrect authentication data (set_id=services)75.152.225.1546251999E"  A+ ossec11302gzFTP Authentication failed.Mar 31 16:51:27 vm1 pure-ftpd[1055456]: (?@195.211.191.218) [WARNING] Authentication failed for user [amplifypowerglobal]195.211.191.2182750405+!  3Y+ ossec11301gzNew FTP connection.Mar 31 16:51:22 vm1 pure-ftpd[1055456]: (?@195.211.191.218) [INFO] New connection from 195.211.191.218195.211.191.2182750405  -' ossec13001gzrExim Auth failed2025-03-31 16:50:16 dovecot_plain authenticator failed for 217-76-83-103.cust.bredband2.com [217.76.83.103]:34438: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)217.76.83.1032661886_  -K' ossec13001gz~Exim Auth failed2025-03-31 16:50:28 dovecot_plain authenticator failed for ([62.182.132.94]) [62.182.132.94]:55982: 535 Incorrect authentication data (set_id=vikas.khandelwal)62.182.132.942017370_  -K) ossec13001gyExim Auth failed2025-03-31 16:46:33 dovecot_login authenticator failed for ([185.107.28.112]) [185.107.28.112]:33810: 535 Incorrect authentication data (set_id=brander-center)185.107.28.112130758l  -k! ossec13001gyExim Auth failed2025-03-31 16:46:17 dovecot_login authenticator failed for ([59.9.38.92]) [59.9.38.92]:51086: 535 Incorrect authentication data (set_id=brander-center@saintsoldiercollege.com)59.9.38.921835841V  -9' ossec13001gx{Exim Auth failed2025-03-31 16:41:53 dovecot_login authenticator failed for ([176.123.160.8]) [176.123.160.8]:60528: 535 Incorrect authentication data (set_id=istok91)176.123.160.82017370  -+ ossec13001gxoExim Auth failed2025-03-31 16:41:42 dovecot_login authenticator failed for (pool-192-188-123-181.telecel.com.py) [181.123.188.192]:46934: 535 Incorrect authentication data (set_id=istok91@saintsoldiercollege.com)181.123.188.1923437598  Cu) ossec11313gw2FTP file uploaded to serverMar 31 16:36:26 vm1 pure-ftpd[1052138]: (user@spexscart.com@106.221.168.88) [NOTICE] /home/techno/public_html/spexscart.com//single-product.php uploaded (15751 bytes, 31.98KB/sec)106.221.168.881269750(  3U) ossec11301gw0New FTP connection.Mar 31 16:36:23 vm1 pure-ftpd[1052138]: (?@106.221.168.88) [INFO] New connection from 106.221.168.88106.221.168.8812697501  CW) ossec11309gw0FTP Authentication success.Mar 31 16:36:24 vm1 pure-ftpd[1052138]: (?@106.221.168.88) [INFO] user@spexscart.com is now logged in106.221.168.881269750d  -W% ossec13001gubExim Auth failed2025-03-31 16:28:41 dovecot_login authenticator failed for ([2.63.169.110]) [2.63.169.110]:43594: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)2.63.169.1102017370\  -A+ ossec13001gs)Exim Auth failed2025-03-31 16:19:12 dovecot_login authenticator failed for ([178.178.194.137]) [178.178.194.137]:55990: 535 Incorrect authentication data (set_id=istok91)178.178.194.1372017370h  -a# ossec13001gsExim Auth failed2025-03-31 16:18:54 dovecot_login authenticator failed for ([38.79.83.28]) [38.79.83.28]:48696: 535 Incorrect authentication data (set_id=istok91@saintsoldiercollege.com)38.79.83.286252001 *\~tj`VLB8.$zpf\H>4*   v l b X N D : 0 &    ~ t j ` V L B 8 . $    z p f \ R H > 4 *  vlbXND:0&|h^rTJ@6,"xdnZP<F2( ~tj`VLB8.$zpf\ | r h ^ T J @ 6 , "    x n d Z P F < 2 (   RRH>4*  vlbXND:0& gԒ5 gс5 gm5 g(5 g5 g5 g5 g5 g̃5 gu5 g̩5 gX5 gF5 g<5 g.5 g&5 g5 gſ5 g5 g 5 g5 g@5 g.5 g5 gi5 gU5 gh5~ gT5} g@5| gt5{ gX5z g굣5y g굓5x gi5w ga5v g85u g05t g$5s g5r g5q g5p g5o gꮾ5n g:5m gL5l gB5k g꫊5j g5i g5h g5g g꩹5f gꩵ5e gu5d gꨃ5c g5b gr5a gP5` g5_ g5^ g5] g5\ g5[ g5Z gꠍ5Y gꠖ5X g5W g5V g5U g5T g5S gꕗ5R gꕉ5Q gu5P gꒁ5O gh5N gS5M g5L g5K g5J g5I gꎑ5H gꎇ5G g55F g+5E g5D g5C g5B gg5A g]5@ g?5? g15> g5= g5< g5; g~5: gR59 g258 g257 g256 g55 gꂴ54 gꀳ53 gꀳ52 gꀳ51 gO50 gO5/ g~W5. g}:5- g}45, g}.5+ g},5* g}5) g|5( g|5' g|5& g|5% g{5$ g{5# gz5" gz5! gzr5 gz~5 gy5 gy5 gx{5 gxo5 gw25 gw05 gw05 gub5 gs)5 gs5 grU5 grK5 gq5 gq5 gq5 gqY5 gqY5 gqY5 gp5 gp5 gp5 gp5 gp5 gnt5 gn\5 gl5 gg5 gg5 gg5 gg5 gg5 gf4 gf4 gf4 gf4 gf4 gf 4 gf4 gdm4 gda4 gdS4 gdA4 gb4 gb4 ga4 ga4 ga4 g`4 g5 g5 g5 g5 g5 g5 g~5 g5 g5 g5 g5 g 5 g5 g5 g5 g5 g5 g5 gi5 g5 g5 g~5 ge5 g[5 g&5 g5 g"5 g5 gb5 gV5 g15 g5 g5 g_5 gB5 gB5 g65 g5 g5 gԹ5 gԩ5 gԩ5 gԟ5 g_4 g_4 g_4 g_H4 g_H4 g_H4 g^4 g^4 g^4 g^4 g^4 g^4 g^4 g^4 g^4 g]I4 g]A4 g]4 g]4 g\4 g\4 g\4 gY4 gY4 gY4 gW4 gW4 gU4 gU4 gS4 gS4 gOm4 gN4 gN4 gL4 gK4 gK4 gK4 gK4 gK4 gJ4 gJ4 g5 gI4 gI4 gE4 gE4 gD4 gD4 gBv4 gBj4 gB4 gA4 gA4 gA4 gA?4 gA/4 g74 g74 g74 g74 g74 g44 g44 g44 g34 g34 g34 g34 g34 g3t4 g24 g24 g24 g24 g2h4 g2I4 g2=4 g234 g234 g214 g14 g14 g14 g14 G ) / i toG%7  3Q' ossec11301g2New FTP connection.Mar 31 17:27:37 vm1 pure-ftpd[1063333]: (?@117.98.72.106) [INFO] New connection from 117.98.72.106117.98.72.10612697506  Cu' ossec11313g2FTP file uploaded to serverMar 31 17:27:37 vm1 pure-ftpd[1063333]: (user@spexscart.com@117.98.72.106) [NOTICE] /home/techno/public_html/spexscart.com//single-product.php uploaded (17404 bytes, 357.44KB/sec)117.98.72.1061269750T5  -5' ossec13001gExim Auth failed2025-03-31 17:25:53 dovecot_plain authenticator failed for ([210.245.74.44]) [210.245.74.44]:51378: 535 Incorrect authentication data (set_id=sales)210.245.74.441562822j4  -_) ossec13001gꂴExim Auth failed2025-03-31 17:25:31 dovecot_plain authenticator failed for ([112.102.48.217]) [112.102.48.217]:38801: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)112.102.48.21718149913  Cu' ossec11313gꀳFTP file uploaded to serverMar 31 17:16:58 vm1 pure-ftpd[1061186]: (user@spexscart.com@117.98.72.106) [NOTICE] /home/techno/public_html/spexscart.com//single-product.php uploaded (15812 bytes, 287.68KB/sec)117.98.72.1061269750/2  CU' ossec11309gꀳFTP Authentication success.Mar 31 17:16:57 vm1 pure-ftpd[1061186]: (?@117.98.72.106) [INFO] user@spexscart.com is now logged in117.98.72.1061269750%1  3Q' ossec11301gꀳNew FTP connection.Mar 31 17:16:57 vm1 pure-ftpd[1061186]: (?@117.98.72.106) [INFO] New connection from 117.98.72.106117.98.72.1061269750%0  3Q' ossec11301gONew FTP connection.Mar 31 17:15:17 vm1 pure-ftpd[1060771]: (?@117.98.72.106) [INFO] New connection from 117.98.72.106117.98.72.1061269750//  CU' ossec11309gOFTP Authentication success.Mar 31 17:15:17 vm1 pure-ftpd[1060771]: (?@117.98.72.106) [INFO] user@spexscart.com is now logged in117.98.72.1061269750I.  = + ossec13008g~WMail Reciepient rejected2025-03-31 17:06:54 H=(mail.saintsoldiercollege.com) [165.154.228.109]:61624 F= rejected RCPT : Rejected relay attempt: '165.154.228.109' From: 'prqnqna@saintsoldiercollege.com' To: 'file2@fastmail.com'165.154.228.1091643084Q-  -1% ossec13001g}:Exim Auth failed2025-03-31 17:02:09 dovecot_login authenticator failed for ([203.252.10.5]) [203.252.10.3]:56008: 535 Incorrect authentication data (set_id=sales)203.252.10.31835841h,  -Y+ ossec13001g}4Exim Auth failed2025-03-31 17:02:04 dovecot_plain authenticator failed for ([190.120.255.132]) [190.120.255.132]:9897: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)190.120.255.1323625428c+  -W% ossec13001g}.Exim Auth failed2025-03-31 17:01:57 dovecot_login authenticator failed for ([185.167.56.2]) [185.167.56.2]:51032: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)185.167.56.2617790B*  -% ossec13001g},Exim Auth failed2025-03-31 17:01:55 dovecot_plain authenticator failed for ([41.76.80.100]) [41.76.80.100]:43669: 535 Incorrect authentication data41.76.80.1002328926v)  -y' ossec13001g}Exim Auth failed2025-03-31 17:01:35 dovecot_plain authenticator failed for ([95.66.153.194]) [95.66.153.194]:36072: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)95.66.153.1942017370r(  -q' ossec13001g|Exim Auth failed2025-03-31 17:00:21 dovecot_login authenticator failed for 177.162.84.34.bc.googleusercontent.com [34.84.162.177]:64783: 535 Incorrect authentication data (set_id=brander-center)34.84.162.1771861060r'  -s% ossec13001g|Exim Auth failed2025-03-31 17:00:06 dovecot_login authenticator failed for ([20.41.231.45]) [20.41.231.45]:56062: 535 Incorrect authentication data (set_id=brander-center@saintsoldiercollege.com)20.41.231.451269750g&  -]% ossec13001g|Exim Auth failed2025-03-31 16:59:15 dovecot_login authenticator failed for c-71-62-34-216.hsd1.va.comcast.net [71.62.34.216]:54560: 535 Incorrect authentication data (set_id=christian)71.62.34.2166252001 WMJ '  8 >AWfH  -W) ossec13001gꎑExim Auth failed2025-03-31 18:16:08 dovecot_login authenticator failed for ([217.71.114.181]) [217.71.114.181]:49316: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)217.71.114.1813017382yG  -}) ossec13001gꎇExim Auth failed2025-03-31 18:15:59 dovecot_login authenticator failed for ([122.160.19.163]) [122.160.19.163]:58405: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)122.160.19.1631269750YF  -=) ossec13001g5Exim Auth failed2025-03-31 18:14:36 dovecot_login authenticator failed for ([122.180.242.91]) [122.180.242.91]:41328: 535 Incorrect authentication data (set_id=istok91)122.180.242.911269750TE  -5' ossec13001g+Exim Auth failed2025-03-31 18:14:26 dovecot_login authenticator failed for ([158.140.32.93]) [158.140.32.93]:57075: 535 Incorrect authentication data (set_id=sales)158.140.32.936252001lD  -c+ ossec13001gExim Auth failed2025-03-31 18:14:13 dovecot_login authenticator failed for ([196.190.118.132]) [196.190.118.132]:40880: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)196.190.118.132337996sC  -s' ossec13001gExim Auth failed2025-03-31 18:14:04 dovecot_login authenticator failed for p87238-obmd01.osaka.ocn.ne.jp [180.7.158.237]:47744: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)180.7.158.2371861060nB  -i' ossec13001gExim Auth failed2025-03-31 18:14:05 dovecot_login authenticator failed for ([95.66.178.169]) [95.66.178.169]:50842: 535 Incorrect authentication data (set_id=istok91@saintsoldiercollege.com)95.66.178.1692017370iA  -_' ossec13001ggExim Auth failed2025-03-31 18:11:11 dovecot_login authenticator failed for syn-072-177-091-103.res.spectrum.com [72.177.91.103]:58328: 535 Incorrect authentication data (set_id=istok91)72.177.91.1036252001s@  -o+ ossec13001g]Exim Auth failed2025-03-31 18:11:00 dovecot_login authenticator failed for ([221.195.72.195]) [221.195.208.171]:65304: 535 Incorrect authentication data (set_id=istok91@saintsoldiercollege.com)221.195.208.1711814991b?  -O) ossec13001g?Exim Auth failed2025-03-31 18:10:31 dovecot_plain authenticator failed for ([121.134.31.193]) [121.134.31.193]:52651: 535 Incorrect authentication data (set_id=vikas.khandelwal)121.134.31.1931835841u>  -u) ossec13001g1Exim Auth failed2025-03-31 18:10:15 dovecot_plain authenticator failed for ([87.225.108.138]) [87.225.108.138]:53652: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)87.225.108.1382017370%=  3Q' ossec11301gNew FTP connection.Mar 31 18:00:40 vm1 pure-ftpd[1071165]: (?@20.168.122.37) [INFO] New connection from 20.168.122.3720.168.122.376252001]<  -G' ossec13001gExim Auth failed2025-03-31 17:48:26 dovecot_login authenticator failed for ([218.146.45.68]) [218.146.45.68]:36599: 535 Incorrect authentication data (set_id=brander-center)218.146.45.681835841 ;  -+ ossec13001gExim Auth failed2025-03-31 17:48:14 dovecot_login authenticator failed for (189.218.168.228-clientes-izzi.mx) [189.218.168.228]:38262: 535 Incorrect authentication data (set_id=brander-center@saintsoldiercollege.com)189.218.168.2283996063:  W!) ossec9708g~Dovecot Aborted Login with empty userMar 31 17:33:08 vm1 dovecot[2184869]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=87.236.176.193, lip=103.74.54.108, TLS, session=87.236.176.19326351679  Cu' ossec11313gRFTP file uploaded to serverMar 31 17:28:09 vm1 pure-ftpd[1063333]: (user@spexscart.com@117.98.72.106) [NOTICE] /home/techno/public_html/spexscart.com//single-product.php uploaded (15812 bytes, 321.41KB/sec)117.98.72.1061269750/8  CU' ossec11309g2FTP Authentication success.Mar 31 17:27:37 vm1 pure-ftpd[1063333]: (?@117.98.72.106) [INFO] user@spexscart.com is now logged in117.98.72.1061269750   ; B ^ yX  -{+ ossec13001gꠖExim Auth failed2025-03-31 19:33:02 dovecot_login authenticator failed for (nsg-corporate-247.229.187.122.airtel.in) [122.187.229.247]:34131: 535 Incorrect authentication data (set_id=brander-center)122.187.229.2471269750W  -% ossec13001gExim Auth failed2025-03-31 19:30:47 dovecot_plain authenticator failed for broadband-5-228-139-89.ip.moscow.rt.ru [5.228.139.89]:52114: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)5.228.139.892017370_V  -M' ossec13001gExim Auth failed2025-03-31 19:30:59 dovecot_plain authenticator failed for ([197.156.121.38]) [213.55.85.202]:12809: 535 Incorrect authentication data (set_id=vikas.khandelwal)213.55.85.202337996U  W' ossec9708gDovecot Aborted Login with empty userMar 31 18:47:23 vm1 dovecot[2184869]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=152.32.206.38, lip=103.74.54.108, TLS, session=152.32.206.386252001dT  -U' ossec13001gExim Auth failed2025-03-31 18:47:46 dovecot_login authenticator failed for 62.174.139.16.static.user.ono.com [62.174.139.16]:42700: 535 Incorrect authentication data (set_id=sales)62.174.139.162510769}S  -+ ossec13001gExim Auth failed2025-03-31 18:47:36 dovecot_login authenticator failed for (223-197-153-143.static.imsbiz.com) [223.197.153.143]:57856: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)223.197.153.1431819730VR  -9) ossec13001gꕗExim Auth failed2025-03-31 18:46:07 dovecot_plain authenticator failed for ([196.191.142.67]) [196.191.142.67]:47920: 535 Incorrect authentication data (set_id=sales)196.191.142.67337996gQ  -]% ossec13001gꕉExim Auth failed2025-03-31 18:45:52 dovecot_plain authenticator failed for ws215-79.maryno.net [81.88.215.79]:50927: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)81.88.215.792017370jP  -_) ossec13001guExim Auth failed2025-03-31 18:45:32 dovecot_plain authenticator failed for ([222.116.48.103]) [222.116.48.103]:38801: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)222.116.48.1031835841GO  -+ ossec13001gꒁExim Auth failed2025-03-31 18:32:55 dovecot_login authenticator failed for ([211.53.58.1]) [211.169.212.206]:51785: 535 Incorrect authentication data211.169.212.2061835841`N  -K) ossec13001ghExim Auth failed2025-03-31 18:32:32 dovecot_login authenticator failed for ([175.237.47.229]) [175.237.47.229]:46183: 535 Incorrect authentication data (set_id=brander-center)175.237.47.2291835841uM  -w' ossec13001gSExim Auth failed2025-03-31 18:32:09 dovecot_login authenticator failed for ([176.94.23.130]) [176.94.23.130]:47314: 535 Incorrect authentication data (set_id=brander-center@saintsoldiercollege.com)176.94.23.1302921044]L  -G' ossec13001gExim Auth failed2025-03-31 18:22:08 dovecot_login authenticator failed for ([165.16.34.111]) [165.16.34.111]:32885: 535 Incorrect authentication data (set_id=brander-center)165.16.34.1112215636fK  -W) ossec13001gExim Auth failed2025-03-31 18:21:40 dovecot_plain authenticator failed for ([123.209.200.21]) [123.209.200.21]:56778: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)123.209.200.212077456~J  - % ossec13001gExim Auth failed2025-03-31 18:21:28 dovecot_plain authenticator failed for (2-55-100-104.orange.net.il) [2.55.100.104]:53744: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)2.55.100.104294640tI  -w% ossec13001gExim Auth failed2025-03-31 18:21:59 dovecot_login authenticator failed for ([144.121.245.65]) [64.72.74.162]:50598: 535 Incorrect authentication data (set_id=brander-center@saintsoldiercollege.com)64.72.74.1626252001 4[ ^ w t 4bi  -S% ossec13001gExim Auth failed2025-03-31 20:13:09 dovecot_login authenticator failed for (nyaystambh.com) [125.72.54.81]:34676: 535 Incorrect authentication data (set_id=contact@nyaystambh.com)125.72.54.811814991hh  -[) ossec13001gExim Auth failed2025-03-31 20:12:09 dovecot_login authenticator failed for 125-228-154-55.hinet-ip.hinet.net [125.228.154.55]:42897: 535 Incorrect authentication data (set_id=istok91)125.228.154.551668284Sg  -5% ossec13001gExim Auth failed2025-03-31 20:12:14 dovecot_login authenticator failed for (nyaystambh.com) [125.72.54.81]:58550: 535 Incorrect authentication data (set_id=nologin)125.72.54.811814991f  -+ ossec13001g꩹Exim Auth failed2025-03-31 20:12:01 dovecot_login authenticator failed for p93228-obmd01.tokyo.ocn.ne.jp [124.101.249.228]:55187: 535 Incorrect authentication data (set_id=brander-center@saintsoldiercollege.com)124.101.249.2281861060e  -) ossec13001gꩵExim Auth failed2025-03-31 20:11:56 dovecot_login authenticator failed for syn-076-176-252-225.res.spectrum.com [76.176.252.225]:43308: 535 Incorrect authentication data (set_id=istok91@saintsoldiercollege.com)76.176.252.2256252001jd  -_) ossec13001guExim Auth failed2025-03-31 20:06:36 dovecot_plain authenticator failed for ([49.124.147.105]) [49.124.147.105]:37364: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)49.124.147.1051733045|c  -) ossec13001gꨃExim Auth failed2025-03-31 20:06:50 dovecot_plain authenticator failed for horn-04-b2-v4wan-169972-cust1751.vm10.cable.virginm.net [81.103.158.216]:59262: 535 Incorrect authentication data (set_id=sales)81.103.158.2162635167rb  -o) ossec13001gExim Auth failed2025-03-31 20:00:05 dovecot_login authenticator failed for 60-241-137-116.tpgi.com.au [60.241.137.116]:40118: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)60.241.137.1162077456Sa  -1) ossec13001grExim Auth failed2025-03-31 19:53:46 dovecot_login authenticator failed for ([47.150.123.184]) [47.150.123.184]:49629: 535 Incorrect authentication data (set_id=a)47.150.123.1846252001e`  -W) ossec13001gPExim Auth failed2025-03-31 19:53:12 dovecot_login authenticator failed for ([87.200.232.247]) [87.200.232.247]:34614: 535 Incorrect authentication data (set_id=a@heipowersystem.com)87.200.232.247290557__  -K' ossec13001gExim Auth failed2025-03-31 19:47:24 dovecot_login authenticator failed for ([61.80.161.148]) [61.80.161.148]:51076: 535 Incorrect authentication data (set_id=vikas.khandelwal)61.80.161.1481835841 ^  -+! ossec13001gExim Auth failed2025-03-31 19:46:46 dovecot_login authenticator failed for cpc117482-shep15-2-0-cust42.8-3.cable.virginm.net [82.8.25.43]:59990: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)82.8.25.432635167o]  -m% ossec13001gExim Auth failed2025-03-31 19:46:37 dovecot_login authenticator failed for ([177.37.167.4]) [177.37.167.4]:46102: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)177.37.167.43469034c\  -S' ossec13001gExim Auth failed2025-03-31 19:42:28 dovecot_plain authenticator failed for ([60.220.241.51]) [60.220.241.50]:50499: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)60.220.241.501814991y[  -}) ossec13001gExim Auth failed2025-03-31 19:42:17 dovecot_plain authenticator failed for ([211.252.168.97]) [211.252.168.97]:10265: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)211.252.168.971835841%Z  3Q' ossec11301gNew FTP connection.Mar 31 19:34:28 vm1 pure-ftpd[1091690]: (?@88.214.25.123) [INFO] New connection from 88.214.25.12388.214.25.1232921044xY  -{) ossec13001gꠍExim Auth failed2025-03-31 19:32:52 dovecot_login authenticator failed for ([180.168.60.146]) [180.168.60.146]:36331: 535 Incorrect authentication data (set_id=brander-center@saintsoldiercollege.com)180.168.60.1461814991 Zf }  ?Cbtz  -q+ ossec13001gXExim Auth failed2025-03-31 21:22:56 dovecot_login authenticator failed for ([115.144.115.150]) [115.144.115.150]:52824: 535 Incorrect authentication data (set_id=istok91@saintsoldiercollege.com)115.144.115.1501835841fy  -W) ossec13001g굣Exim Auth failed2025-03-31 21:02:50 dovecot_plain authenticator failed for ([185.176.163.50]) [185.176.163.50]:52116: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)185.176.163.502635167 x  -'# ossec13001g굓Exim Auth failed2025-03-31 21:02:34 dovecot_plain authenticator failed for static-98-110-70-2.cmdnnj.fios.verizon.net [98.110.70.2]:42029: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)98.110.70.26252001Zw  -C% ossec13001giExim Auth failed2025-03-31 21:01:52 dovecot_login authenticator failed for ([84.52.89.218]) [84.52.89.218]:45650: 535 Incorrect authentication data (set_id=brander-center)84.52.89.2182017370yv  -}) ossec13001gaExim Auth failed2025-03-31 21:01:44 dovecot_login authenticator failed for ([117.240.117.170]) [115.247.81.134]:40764: 535 Incorrect authentication data (set_id=brander-center@saintsoldiercollege.com)115.247.81.1341269750"u  3M% ossec11301g8New FTP connection.Mar 31 20:56:48 vm1 pure-ftpd[1109625]: (?@64.227.70.84) [INFO] New connection from 64.227.70.8464.227.70.842750405]t  -G' ossec13001g0Exim Auth failed2025-03-31 20:52:23 dovecot_login authenticator failed for ([58.238.181.96]) [58.238.181.96]:47214: 535 Incorrect authentication data (set_id=brander-center)58.238.181.961835841xs  -{) ossec13001g$Exim Auth failed2025-03-31 20:52:10 dovecot_login authenticator failed for ([58.228.105.192]) [58.228.105.192]:37724: 535 Incorrect authentication data (set_id=brander-center@saintsoldiercollege.com)58.228.105.1921835841\r  -G% ossec13001gExim Auth failed2025-03-31 20:51:34 dovecot_plain authenticator failed for ([83.118.41.55]) [83.118.41.50]:42404: 535 Incorrect authentication data (set_id=vikas.khandelwal)83.118.41.501605651rq  -q' ossec13001gExim Auth failed2025-03-31 20:51:20 dovecot_plain authenticator failed for ([123.212.9.122]) [123.212.9.122]:55611: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)123.212.9.1221835841Sp  -3' ossec13001gExim Auth failed2025-03-31 20:33:49 dovecot_login authenticator failed for ([202.83.16.78]) [202.122.16.36]:50802: 535 Incorrect authentication data (set_id=sales)202.122.16.361269750ko  -g% ossec13001gExim Auth failed2025-03-31 20:33:40 dovecot_login authenticator failed for vps-eed33ea4.vps.ovh.net [51.38.133.48]:42888: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)51.38.133.48798544xn  -{+ ossec13001gꮾExim Auth failed2025-03-31 20:33:25 dovecot_login authenticator failed for (109-120-192-105.ip.btc-net.bg) [109.120.192.105]:34061: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)109.120.192.105732800"m  3M% ossec11301g:New FTP connection.Mar 31 20:31:13 vm1 pure-ftpd[1104108]: (?@139.162.77.6) [INFO] New connection from 139.162.77.6139.162.77.61861060el  -U) ossec13001gLExim Auth failed2025-03-31 20:27:16 dovecot_login authenticator failed for ool-4579c7cb.dyn.optonline.net [69.121.199.203]:36818: 535 Incorrect authentication data (set_id=istok91)69.121.199.2036252001pk  -m) ossec13001gBExim Auth failed2025-03-31 20:27:06 dovecot_login authenticator failed for ([94.204.150.228]) [94.204.150.228]:56777: 535 Incorrect authentication data (set_id=istok91@saintsoldiercollege.com)94.204.150.228290557"j  3M% ossec11301g꫊New FTP connection.Mar 31 20:19:45 vm1 pure-ftpd[1101547]: (?@20.163.15.96) [INFO] New connection from 20.163.15.9620.163.15.966252001  2 Z 3>aip  -q# ossec13001g<Exim Auth failed2025-03-31 22:22:11 dovecot_plain authenticator failed for ([14.54.22.11]) [14.54.22.11]:57617: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)14.54.22.111835841p  -q# ossec13001g.Exim Auth failed2025-03-31 22:17:41 dovecot_login authenticator failed for 50.24.14.46.static.wline.lns.sme.cust.swisscom.ch [46.14.24.50]:63173: 535 Incorrect authentication data (set_id=sales)46.14.24.502658434z  -) ossec13001g&Exim Auth failed2025-03-31 22:17:32 dovecot_login authenticator failed for 198-91-194-206.cpe.distributel.net [198.91.194.206]:56944: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)198.91.194.2066251999^  -K' ossec13001gExim Auth failed2025-03-31 22:11:45 dovecot_plain authenticator failed for ([94.205.82.150]) [94.205.82.150]:54360: 535 Incorrect authentication data (set_id=vikas.khandelwal)94.205.82.150290557t  -u) ossec13001gſExim Auth failed2025-03-31 22:11:35 dovecot_plain authenticator failed for ([94.201.236.143]) [94.201.236.143]:33291: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)94.201.236.143290557Y  -=) ossec13001gExim Auth failed2025-03-31 22:00:16 dovecot_login authenticator failed for ([109.235.54.204]) [109.235.54.204]:59446: 535 Incorrect authentication data (set_id=istok91)109.235.54.2042635167q  -m) ossec13001g Exim Auth failed2025-03-31 22:00:03 dovecot_login authenticator failed for ([61.160.119.116]) [61.160.119.116]:35268: 535 Incorrect authentication data (set_id=istok91@saintsoldiercollege.com)61.160.119.1161814991(  3U) ossec11301gNew FTP connection.Mar 31 21:53:32 vm1 pure-ftpd[1121879]: (?@205.210.31.180) [INFO] New connection from 205.210.31.180205.210.31.1806252001W  -?# ossec13001g@Exim Auth failed2025-03-31 21:48:06 dovecot_login authenticator failed for ([14.23.77.27]) [14.23.77.27]:50426: 535 Incorrect authentication data (set_id=brander-center)14.23.77.271814991x  -{) ossec13001g.Exim Auth failed2025-03-31 21:47:49 dovecot_login authenticator failed for ([103.174.145.34]) [103.174.145.34]:46535: 535 Incorrect authentication data (set_id=brander-center@saintsoldiercollege.com)103.174.145.341269750v  -y' ossec13001gExim Auth failed2025-03-31 21:46:22 dovecot_login authenticator failed for ([103.47.74.210]) [103.47.74.210]:48694: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)103.47.74.2101269750Z  -=+ ossec13001giExim Auth failed2025-03-31 21:44:33 dovecot_login authenticator failed for ([124.106.145.241]) [124.106.145.241]:55780: 535 Incorrect authentication data (set_id=sales)124.106.145.2411694008v  -}# ossec13001gUExim Auth failed2025-03-31 21:44:13 dovecot_login authenticator failed for syn-071-071-064-052.res.spectrum.com [71.71.64.52]:49919: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)71.71.64.526252001N~  --# ossec13001ghExim Auth failed2025-03-31 21:27:28 dovecot_plain authenticator failed for ([5.175.88.56]) [5.175.88.56]:53096: 535 Incorrect authentication data (set_id=sales)5.175.88.562017370T}  -5' ossec13001gTExim Auth failed2025-03-31 21:27:08 dovecot_plain authenticator failed for ([186.96.89.101]) [186.96.89.101]:50866: 535 Incorrect authentication data (set_id=sales)186.96.89.1013624060j|  -_) ossec13001g@Exim Auth failed2025-03-31 21:26:47 dovecot_plain authenticator failed for ([117.141.79.159]) [117.141.79.159]:48067: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)117.141.79.1591814991\{  -A+ ossec13001gtExim Auth failed2025-03-31 21:23:23 dovecot_login authenticator failed for ([196.203.231.220]) [196.203.231.220]:53008: 535 Incorrect authentication data (set_id=istok91)196.203.231.2202464461   % ) T|`  -K) ossec13001gԩExim Auth failed2025-03-31 23:15:12 dovecot_login authenticator failed for ([123.209.124.61]) [123.209.124.61]:59990: 535 Incorrect authentication data (set_id=brander-center)123.209.124.612077456t  -s) ossec13001gԩExim Auth failed2025-03-31 23:15:13 dovecot_login authenticator failed for syn-075-135-141-150.res.spectrum.com [75.135.141.150]:44050: 535 Incorrect authentication data (set_id=vikas.khandelwal)75.135.141.1506252001l  -i# ossec13001gԟExim Auth failed2025-03-31 23:15:02 dovecot_login authenticator failed for ([61.32.68.66]) [61.32.68.66]:38990: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)61.32.68.661835841}  - # ossec13001gԒExim Auth failed2025-03-31 23:14:48 dovecot_login authenticator failed for (192-24-62-4.nftctelecom.com) [192.24.62.4]:41901: 535 Incorrect authentication data (set_id=brander-center@saintsoldiercollege.com)192.24.62.46251999T  -9' ossec13001gсExim Auth failed2025-03-31 23:01:43 dovecot_login authenticator failed for ([65.20.171.116]) [65.20.171.116]:45537: 535 Incorrect authentication data (set_id=istok91)65.20.171.11699237  -+) ossec13001gmExim Auth failed2025-03-31 23:01:24 dovecot_login authenticator failed for (92x255x198x142.static-customer.kzn.ertelecom.ru) [92.255.198.142]:47289: 535 Incorrect authentication data (set_id=istok91@saintsoldiercollege.com)92.255.198.1422017370O  --% ossec13001g(Exim Auth failed2025-03-31 22:47:26 dovecot_login authenticator failed for ([5.59.141.152]) [5.59.141.152]:59700: 535 Incorrect authentication data (set_id=pop)5.59.141.1522017370r  -q' ossec13001gExim Auth failed2025-03-31 22:47:09 dovecot_login authenticator failed for (187.71.182.58.starhub.net.sg) [58.182.71.187]:59362: 535 Incorrect authentication data (set_id=pop@heipowersystem.com)58.182.71.1871880251T  -5' ossec13001gExim Auth failed2025-03-31 22:46:55 dovecot_plain authenticator failed for ([190.58.175.23]) [190.58.175.23]:58951: 535 Incorrect authentication data (set_id=sales)190.58.175.233573591Q  -1% ossec13001gExim Auth failed2025-03-31 22:46:20 dovecot_plain authenticator failed for ([14.97.77.182]) [14.97.77.182]:58882: 535 Incorrect authentication data (set_id=sales)14.97.77.1821269750x  -# ossec13001gExim Auth failed2025-03-31 22:46:01 dovecot_plain authenticator failed for 208.red-83-45-6.dynamicip.rima-tde.net [83.45.6.208]:36316: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)83.45.6.2082510769h  -a# ossec13001g̃Exim Auth failed2025-03-31 22:40:27 dovecot_login authenticator failed for host-74.91.79.23.bpsnetworks.com [74.91.79.23]:52833: 535 Incorrect authentication data (set_id=brander-center)74.91.79.236252001u  -w' ossec13001guExim Auth failed2025-03-31 22:40:12 dovecot_login authenticator failed for ([103.48.194.21]) [103.48.194.21]:33350: 535 Incorrect authentication data (set_id=brander-center@saintsoldiercollege.com)103.48.194.211562822o  -o# ossec13001g̩Exim Auth failed2025-03-31 22:41:05 dovecot_login authenticator failed for ([14.6.16.137]) [14.6.16.137]:56312: 535 Incorrect authentication data (set_id=brander-center@saintsoldiercollege.com)14.6.16.1371835841m  -i% ossec13001gXExim Auth failed2025-03-31 22:22:40 dovecot_plain authenticator failed for p71078-obmd01.osaka.ocn.ne.jp [180.7.118.77]:44448: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)180.7.118.771861060  -)' ossec13001gFExim Auth failed2025-03-31 22:22:22 dovecot_plain authenticator failed for (nsg-corporate-194.153.186.122.airtel.in) [106.51.217.56]:12142: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)106.51.217.561269750 (  4 8 K h7=<^[+  -C' ossec13001g&Exim Auth failed2025-03-31 23:59:57 dovecot_login authenticator failed for (hn.kd.ny.adsl) [222.138.28.60]:37498: 535 Incorrect authentication data (set_id=brander-center)222.138.28.601814991x*  -{) ossec13001gExim Auth failed2025-03-31 23:59:42 dovecot_login authenticator failed for ([222.236.59.174]) [222.236.59.174]:54520: 535 Incorrect authentication data (set_id=brander-center@saintsoldiercollege.com)222.236.59.1741835841\)  -A+ ossec13001g"Exim Auth failed2025-03-31 23:55:37 dovecot_login authenticator failed for ([117.250.253.137]) [117.250.253.137]:58712: 535 Incorrect authentication data (set_id=istok91)117.250.253.1371269750n(  -i' ossec13001gExim Auth failed2025-03-31 23:55:28 dovecot_login authenticator failed for ([41.63.234.236]) [41.63.234.236]:44835: 535 Incorrect authentication data (set_id=istok91@saintsoldiercollege.com)41.63.234.2363355338W'  -9) ossec13001gbExim Auth failed2025-03-31 23:48:09 dovecot_login authenticator failed for ([117.69.210.199]) [117.69.210.199]:44379: 535 Incorrect authentication data (set_id=sales)117.69.210.1991814991Z&  -?) ossec13001gVExim Auth failed2025-03-31 23:47:56 dovecot_login authenticator failed for syn-076-176-252-225.res.spectrum.com [76.176.252.225]:47024: 535 Incorrect authentication data76.176.252.2256252001}%  -+ ossec13001g1Exim Auth failed2025-03-31 23:47:20 dovecot_login authenticator failed for (237-166.adsl.static.espeed.com.bn) [119.160.166.237]:40484: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)119.160.166.2371820814v$  -y' ossec13001gExim Auth failed2025-03-31 23:42:44 dovecot_plain authenticator failed for ([197.211.47.66]) [197.211.47.66]:53027: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)197.211.47.662328926-#  =S+ ossec13008gMail Reciepient rejected2025-03-31 23:37:24 H=(mail.msnews24.in) [165.154.242.137]:63575 F= rejected RCPT : Rejected relay attempt: '165.154.242.137' From: 'bshqttvttsb@msnews24.in' To: 'file2@fastmail.com'165.154.242.1371694008_"  -M% ossec13001g_Exim Auth failed2025-03-31 23:31:02 dovecot_plain authenticator failed for ([179.252.107.105]) [177.6.235.62]:35357: 535 Incorrect authentication data (set_id=vikas.khandelwal)177.6.235.623469034i!  -[+ ossec13001gBExim Auth failed2025-03-31 23:30:34 dovecot_login authenticator failed for ([220.120.224.227]) [220.120.224.227]:45286: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)220.120.224.2271835841x  -{) ossec13001gBExim Auth failed2025-03-31 23:30:33 dovecot_plain authenticator failed for (client.fttb.2day.kz) [176.222.190.70]:51188: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)176.222.190.701522867f  -W) ossec13001g6Exim Auth failed2025-03-31 23:30:21 dovecot_login authenticator failed for ([211.248.31.142]) [211.248.31.142]:53266: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)211.248.31.1421835841  -+ ossec13001gExim Auth failed2025-03-31 23:29:44 dovecot_login authenticator failed for p93228-obmd01.tokyo.ocn.ne.jp [124.101.249.228]:46855: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)124.101.249.2281861060[  -E% ossec13001gExim Auth failed2025-03-31 23:15:38 dovecot_login authenticator failed for ([120.138.5.219]) [152.59.36.50]:49010: 535 Incorrect authentication data (set_id=brander-center)152.59.36.501269750u  -w' ossec13001gԹExim Auth failed2025-03-31 23:15:29 dovecot_login authenticator failed for ([183.47.48.178]) [183.47.48.178]:44105: 535 Incorrect authentication data (set_id=brander-center@saintsoldiercollege.com)183.47.48.1781814991 ? 9Ah<  -]' ossec13001gExim Auth failed2025-04-01 00:58:59 dovecot_login authenticator failed for 179-42-124-80.chtch.com.br [179.42.124.80]:61591: 535 Incorrect authentication data (set_id=vikas.khandelwal)179.42.124.803469034(;  3U) ossec11301gNew FTP connection.Apr 1 00:58:45 vm1 pure-ftpd[1163484]: (?@206.168.34.217) [INFO] New connection from 206.168.34.217206.168.34.2176252001t:  -u) ossec13001gExim Auth failed2025-04-01 00:58:39 dovecot_login authenticator failed for ([154.66.109.244]) [154.66.109.244]:34556: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)154.66.109.244932692\9  -G% ossec13001gExim Auth failed2025-04-01 00:50:55 dovecot_plain authenticator failed for ([36.37.164.66]) [36.37.164.66]:49004: 535 Incorrect authentication data (set_id=vikas.khandelwal)36.37.164.661831722e8  -S+ ossec13001g Exim Auth failed2025-04-01 00:50:45 dovecot_plain authenticator failed for ([103.150.239.208]) [103.150.239.208]:35014: 535 Incorrect authentication data (set_id=vikas.khandelwal)103.150.239.2081168579u7  -u) ossec13001gExim Auth failed2025-04-01 00:50:32 dovecot_plain authenticator failed for ([220.178.201.58]) [220.178.201.58]:53111: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)220.178.201.581814991 6  -) ossec13001gExim Auth failed2025-04-01 00:50:13 dovecot_plain authenticator failed for (122.11.169-112.unknown.starhub.net.sg) [122.11.169.112]:3886: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)122.11.169.1121880251[5  -E% ossec13001gExim Auth failed2025-04-01 00:46:13 dovecot_login authenticator failed for ([120.138.5.219]) [152.59.36.50]:43050: 535 Incorrect authentication data (set_id=brander-center)152.59.36.501269750w4  -y) ossec13001gExim Auth failed2025-04-01 00:46:04 dovecot_login authenticator failed for ([177.19.152.49]) [177.99.225.161]:54869: 535 Incorrect authentication data (set_id=brander-center@saintsoldiercollege.com)177.99.225.1613469034k3  -a) ossec13001gExim Auth failed2025-04-01 00:41:53 dovecot_login authenticator failed for 112.46.246.220.static.netvigator.com [220.246.46.112]:58649: 535 Incorrect authentication data (set_id=istok91)220.246.46.1121819730{2  -' ossec13001gExim Auth failed2025-04-01 00:41:38 dovecot_login authenticator failed for p381232-obmd01.tokyo.ocn.ne.jp [60.38.209.231]:37940: 535 Incorrect authentication data (set_id=istok91@saintsoldiercollege.com)60.38.209.23118610601  W!) ossec9708giDovecot Aborted Login with empty userApr 1 00:26:40 vm1 dovecot[2184869]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=123.58.215.102, lip=103.74.54.108, TLS, session=<4bH8+qcxkLl7Otdm>123.58.215.1021819730T0  -5' ossec13001gExim Auth failed2025-04-01 00:05:54 dovecot_plain authenticator failed for ([106.227.87.29]) [106.227.87.29]:41342: 535 Incorrect authentication data (set_id=sales)106.227.87.291814991g/  -[' ossec13001g~Exim Auth failed2025-04-01 00:05:42 dovecot_plain authenticator failed for ([170.83.54.246]) [170.83.54.246]:53874: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)170.83.54.2463865483.  ?/ ossec1008gProcess exiting (killed).Apr 1 00:05:47 vm1 spamd[828306]: spamd: server killed by SIGTERM, shutting downT-  -5' ossec13001geExim Auth failed2025-04-01 00:00:59 dovecot_login authenticator failed for ([103.187.79.19]) [103.187.79.19]:50412: 535 Incorrect authentication data (set_id=sales)103.187.79.191269750e,  -[' ossec13001g[Exim Auth failed2025-04-01 00:00:50 dovecot_login authenticator failed for ([65.20.153.146]) [65.20.153.146]:57260: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)65.20.153.14699237 @ 2 W |  *4@pM  -m' ossec13001gExim Auth failed2025-04-01 01:46:02 dovecot_login authenticator failed for devops.xn--b1afjhrgvdfla9hb.xn--p1ai [178.177.40.40]:32832: 535 Incorrect authentication data (set_id=brander-center)178.177.40.402017370rL  -s% ossec13001gExim Auth failed2025-04-01 01:45:27 dovecot_login authenticator failed for ([209.38.35.92]) [209.38.35.92]:50014: 535 Incorrect authentication data (set_id=brander-center@saintsoldiercollege.com)209.38.35.922750405QK  -1% ossec13001gExim Auth failed2025-04-01 01:44:29 dovecot_login authenticator failed for ([98.70.127.17]) [98.70.127.17]:41978: 535 Incorrect authentication data (set_id=sales)98.70.127.171269750dJ  -W% ossec13001gExim Auth failed2025-04-01 01:44:19 dovecot_login authenticator failed for ([77.41.156.64]) [77.41.156.64]:59008: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)77.41.156.642017370iI  -_' ossec13001gExim Auth failed2025-04-01 01:40:41 dovecot_login authenticator failed for 89-253-90-113.customers.ownit.se [89.253.90.113]:37590: 535 Incorrect authentication data (set_id=socialmedia)89.253.90.1132661886rH  -o+ ossec13001gExim Auth failed2025-04-01 01:40:30 dovecot_login authenticator failed for ([196.191.212.232]) [196.191.212.232]:54044: 535 Incorrect authentication data (set_id=socialmedia@heipowersystem.com)196.191.212.232337996;G  =q) ossec13008gMail Reciepient rejected2025-04-01 01:29:12 H=(mail.heipowersystem.com) [165.154.228.53]:54919 F= rejected RCPT : Rejected relay attempt: '165.154.228.53' From: 'hgmkvviol@heipowersystem.com' To: 'file2@fastmail.com'165.154.228.531643084cF  -Q) ossec13001gExim Auth failed2025-04-01 01:25:11 dovecot_plain authenticator failed for p164189-obmd01.osaka.ocn.ne.jp [61.112.207.188]:36684: 535 Incorrect authentication data (set_id=sales)61.112.207.1881861060iE  -_) ossec13001g Exim Auth failed2025-04-01 01:24:53 dovecot_plain authenticator failed for ([196.189.59.226]) [196.189.59.226]:60411: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)196.189.59.226337996"D  3M% ossec11301gNew FTP connection.Apr 1 01:23:24 vm1 pure-ftpd[1169010]: (?@45.151.62.96) [INFO] New connection from 45.151.62.9645.151.62.962017370uC  -w' ossec13001gExim Auth failed2025-04-01 01:19:23 dovecot_login authenticator failed for ([124.64.66.168]) [124.64.66.168]:60394: 535 Incorrect authentication data (set_id=brander-center@saintsoldiercollege.com)124.64.66.1681814991WB  -?# ossec13001gExim Auth failed2025-04-01 01:19:33 dovecot_login authenticator failed for ([62.4.94.178]) [62.4.94.178]:33334: 535 Incorrect authentication data (set_id=brander-center)62.4.94.1782921044WA  -9) ossec13001gExim Auth failed2025-04-01 01:11:45 dovecot_login authenticator failed for ([128.185.253.22]) [128.185.253.22]:55694: 535 Incorrect authentication data (set_id=sales)128.185.253.221269750j@  -_) ossec13001gExim Auth failed2025-04-01 01:11:23 dovecot_login authenticator failed for ([119.203.137.21]) [119.203.137.21]:39524: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)119.203.137.211835841z?  -' ossec13001gExim Auth failed2025-04-01 01:11:13 dovecot_login authenticator failed for syn-024-090-169-209.res.spectrum.com [24.90.169.209]:44167: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)24.90.169.2096252001a>  -S' ossec13001gExim Auth failed2025-04-01 01:01:24 dovecot_plain authenticator failed for ([65.20.235.177]) [65.20.235.177]:48739: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)65.20.235.17799237y=  -}) ossec13001g~Exim Auth failed2025-04-01 01:01:09 dovecot_plain authenticator failed for ([103.163.44.118]) [103.163.44.118]:34360: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)103.163.44.1181269750   ' F A MWg^  -]% ossec13001gExim Auth failed2025-04-01 03:23:01 dovecot_login authenticator failed for ([187.6.56.226]) [187.6.56.226]:37023: 535 Incorrect authentication data (set_id=services@heipowersystem.com)187.6.56.2263469034p]  -m) ossec13001gExim Auth failed2025-04-01 03:22:01 dovecot_login authenticator failed for ([197.156.115.37]) [197.156.115.37]:37176: 535 Incorrect authentication data (set_id=istok91@saintsoldiercollege.com)197.156.115.37338010T\  -5' ossec13001gExim Auth failed2025-04-01 02:44:49 dovecot_plain authenticator failed for ([41.63.234.236]) [41.63.234.236]:56275: 535 Incorrect authentication data (set_id=sales)41.63.234.2363355338k[  -e% ossec13001gExim Auth failed2025-04-01 02:44:38 dovecot_plain authenticator failed for (2-74-192-250.kcell.kz) [2.74.192.250]:50762: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)2.74.192.2501522867%Z  3Q' ossec11301gKNew FTP connection.Apr 1 02:42:42 vm1 pure-ftpd[1186619]: (?@198.235.24.89) [INFO] New connection from 198.235.24.89198.235.24.896252001rY  -s% ossec13001g9Exim Auth failed2025-04-01 02:38:08 dovecot_login authenticator failed for ([110.35.63.30]) [110.35.63.30]:42824: 535 Incorrect authentication data (set_id=brander-center@saintsoldiercollege.com)110.35.63.301835841%X  3Q' ossec11301g7New FTP connection.Apr 1 02:38:06 vm1 pure-ftpd[1185542]: (?@20.65.193.225) [INFO] New connection from 20.65.193.22520.65.193.2256252001MW  --! ossec13001gExim Auth failed2025-04-01 02:33:15 dovecot_login authenticator failed for ([45.6.80.40]) [45.6.80.40]:39116: 535 Incorrect authentication data (set_id=istok91)45.6.80.403469034nV  -i' ossec13001gExim Auth failed2025-04-01 02:32:57 dovecot_login authenticator failed for ([41.63.234.238]) [41.63.234.238]:34536: 535 Incorrect authentication data (set_id=istok91@saintsoldiercollege.com)41.63.234.2383355338dU  -U' ossec13001g5Exim Auth failed2025-04-01 02:21:00 dovecot_plain authenticator failed for ([177.174.89.105]) [177.174.89.99]:47166: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)177.174.89.993469034sT  -u% ossec13001g(Exim Auth failed2025-04-01 02:20:47 dovecot_plain authenticator failed for ([27.16.163.70]) [27.16.163.70]:41894: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)27.16.163.701814991%S  3Q' ossec11301gNew FTP connection.Apr 1 02:18:06 vm1 pure-ftpd[1181173]: (?@194.164.107.4) [INFO] New connection from 194.164.107.4194.164.107.46252001R  -' ossec13001gExim Auth failed2025-04-01 02:09:47 dovecot_plain authenticator failed for 111-70-23-245.emome-ip.hinet.net [111.70.23.245]:54862: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)111.70.23.2451668284]Q  -G' ossec13001gExim Auth failed2025-04-01 02:05:16 dovecot_login authenticator failed for ([61.74.170.215]) [61.74.170.215]:45653: 535 Incorrect authentication data (set_id=brander-center)61.74.170.2151835841uP  -w' ossec13001gzExim Auth failed2025-04-01 02:05:04 dovecot_login authenticator failed for ([223.210.27.53]) [223.210.27.53]:37384: 535 Incorrect authentication data (set_id=brander-center@saintsoldiercollege.com)223.210.27.531814991hO  -]' ossec13001gExim Auth failed2025-04-01 01:52:38 dovecot_login authenticator failed for v157-7-200-152.cwit.static.cnode.io [157.7.200.152]:52132: 535 Incorrect authentication data (set_id=istok91)157.7.200.1521861060pN  -m) ossec13001gExim Auth failed2025-04-01 01:52:27 dovecot_login authenticator failed for ([185.116.231.33]) [185.116.231.33]:35100: 535 Incorrect authentication data (set_id=istok91@saintsoldiercollege.com)185.116.231.33690791 #E    4 Vas:)o 3U) ossec11301g New FTP connection.Apr 1 03:58:31 vm1 pure-ftpd[1202946]: (?@206.168.34.208) [INFO] New connection from 206.168.34.208206.168.34.2086252001(n  3U) ossec11301g New FTP connection.Apr 1 03:58:27 vm1 pure-ftpd[1202921]: (?@66.240.236.116) [INFO] New connection from 66.240.236.11666.240.236.1166252001Bm  gU) ossec11307gMultiple connection attempts from same sourceApr 1 03:58:44 vm1 pure-ftpd[1203110]: (?@206.168.34.208) [INFO] New connection from 206.168.34.208206.168.34.2086252001fl  -W) ossec13001g=Exim Auth failed2025-04-01 03:42:13 dovecot_plain authenticator failed for ([123.209.213.81]) [123.209.213.81]:56016: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)123.209.213.812077456vk  -y' ossec13001g1Exim Auth failed2025-04-01 03:42:01 dovecot_plain authenticator failed for ([88.201.163.65]) [88.201.163.65]:60770: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)88.201.163.652017370 j  -) ossec13001gExim Auth failed2025-04-01 03:41:39 dovecot_plain authenticator failed for (223-197-196-92.static.imsbiz.com) [223.197.196.92]:59066: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)223.197.196.921819730ui  -w' ossec13001gExim Auth failed2025-04-01 03:30:42 dovecot_plain authenticator failed for broadband-95-84-158-215.ip.moscow.rt.ru [95.84.158.215]:58989: 535 Incorrect authentication data (set_id=vikas.khandelwal)95.84.158.2152017370Yh  -C# ossec13001gExim Auth failed2025-04-01 03:30:34 dovecot_plain authenticator failed for ([1.241.64.92]) [1.241.64.92]:58604: 535 Incorrect authentication data (set_id=vikas.khandelwal)1.241.64.921835841jg  -_) ossec13001g@Exim Auth failed2025-04-01 03:29:27 dovecot_login authenticator failed for ([222.236.59.174]) [222.236.59.174]:52220: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)222.236.59.1741835841qf  -q% ossec13001gbExim Auth failed2025-04-01 03:30:02 dovecot_plain authenticator failed for ([200.223.243.81]) [201.18.58.62]:51291: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)201.18.58.623469034Ze  -E% ossec13001gJExim Auth failed2025-04-01 03:29:37 dovecot_login authenticator failed for (227.69.57.37.triolan.net) [37.57.69.227]:33511: 535 Incorrect authentication data (set_id=sales)37.57.69.227690791`d  -K) ossec13001gExim Auth failed2025-04-01 03:27:01 dovecot_login authenticator failed for ([222.184.40.150]) [222.184.40.150]:50194: 535 Incorrect authentication data (set_id=brander-center)222.184.40.1501814991c  -) ossec13001gExim Auth failed2025-04-01 03:26:49 dovecot_login authenticator failed for (115-129-69-110.tpgi.com.au) [115.129.69.110]:50971: 535 Incorrect authentication data (set_id=brander-center@saintsoldiercollege.com)115.129.69.1102077456xb  -{) ossec13001gExim Auth failed2025-04-01 03:26:29 dovecot_login authenticator failed for ([182.135.66.173]) [182.135.66.173]:40476: 535 Incorrect authentication data (set_id=brander-center@saintsoldiercollege.com)182.135.66.1731814991'a  =G+ ossec13008glMail Reciepient rejected2025-04-01 03:25:54 H=(mail.msnews24.in) [165.154.232.191]:55095 F= rejected RCPT : Rejected relay attempt: '165.154.232.191' From: 'afhyaekx@msnews24.in' To: 'file2@fastmail.com'165.154.232.1911605651Z`  -?) ossec13001gExim Auth failed2025-04-01 03:23:22 dovecot_login authenticator failed for ([220.93.167.144]) [220.93.167.144]:53060: 535 Incorrect authentication data (set_id=services)220.93.167.1441835841Y_  -=) ossec13001gExim Auth failed2025-04-01 03:22:16 dovecot_login authenticator failed for ([75.144.210.178]) [75.144.210.178]:56814: 535 Incorrect authentication data (set_id=istok91)75.144.210.1786252001 A + ! : H _i]m2Am  -c+ ossec13001g)Exim Auth failed2025-04-01 05:17:17 dovecot_login authenticator failed for ([220.158.233.247]) [220.158.233.247]:29578: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)220.158.233.2471831722a  -M) ossec13001g)Exim Auth failed2025-04-01 05:17:56 dovecot_login authenticator failed for vmi2383323.contaboserver.net [149.102.148.49]:48928: 535 Incorrect authentication data (set_id=sales)149.102.148.492635167Q~  -1% ossec13001g)Exim Auth failed2025-04-01 05:17:46 dovecot_login authenticator failed for ([59.41.197.10]) [59.41.197.10]:50588: 535 Incorrect authentication data (set_id=sales)59.41.197.101814991C}  -' ossec13001g&IExim Auth failed2025-04-01 05:03:27 dovecot_plain authenticator failed for (rainbowisp.in) [45.116.114.61]:57948: 535 Incorrect authentication data45.116.114.611269750p|  -q# ossec13001g&%Exim Auth failed2025-04-01 05:02:52 dovecot_plain authenticator failed for ([37.208.97.2]) [37.208.97.2]:55018: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)37.208.97.22017370W{  -9) ossec13001g!Exim Auth failed2025-04-01 04:43:16 dovecot_login authenticator failed for ([178.178.222.50]) [178.178.222.50]:60616: 535 Incorrect authentication data (set_id=sales)178.178.222.502017370gz  -[' ossec13001g!}Exim Auth failed2025-04-01 04:43:01 dovecot_login authenticator failed for ([106.246.6.133]) [106.246.6.133]:42094: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)106.246.6.1331835841ly  -e' ossec13001gExim Auth failed2025-04-01 04:35:43 dovecot_login authenticator failed for wsip-70-166-207-76.ph.ph.cox.net [70.166.207.76]:58420: 535 Incorrect authentication data (set_id=administracion)70.166.207.766252001x  -) ossec13001gExim Auth failed2025-04-01 04:35:11 dovecot_login authenticator failed for (net190.79.95-231.izhevsk.ertelecom.ru) [46.147.190.231]:60172: 535 Incorrect authentication data (set_id=administracion@heipowersystem.com)46.147.190.2312017370rw  -s% ossec13001g{Exim Auth failed2025-04-01 04:34:25 dovecot_login authenticator failed for ([31.173.2.182]) [31.173.2.182]:43092: 535 Incorrect authentication data (set_id=brander-center@saintsoldiercollege.com)31.173.2.1822017370ev  -S+ ossec13001g~Exim Auth failed2025-04-01 04:30:13 dovecot_login authenticator failed for ([111.171.127.190]) [111.171.127.190]:53790: 535 Incorrect authentication data (set_id=vikas.khandelwal)111.171.127.1901835841nu  -m% ossec13001gpExim Auth failed2025-04-01 04:29:59 dovecot_login authenticator failed for ([94.204.227.7]) [94.204.227.7]:48761: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)94.204.227.7290557ct  -O+ ossec13001gExim Auth failed2025-04-01 04:09:42 dovecot_login authenticator failed for ([211.247.127.250]) [211.247.127.250]:58982: 535 Incorrect authentication data (set_id=brander-center)211.247.127.2501835841s  -% ossec13001gExim Auth failed2025-04-01 04:09:30 dovecot_login authenticator failed for (122.11.169-7.unknown.starhub.net.sg) [122.11.169.7]:4174: 535 Incorrect authentication data (set_id=brander-center@saintsoldiercollege.com)122.11.169.71880251qr  -m) ossec13001g/Exim Auth failed2025-04-01 04:07:35 dovecot_login authenticator failed for ([182.176.125.34]) [182.176.125.34]:38309: 535 Incorrect authentication data (set_id=istok91@saintsoldiercollege.com)182.176.125.341168579nq  -i' ossec13001gExim Auth failed2025-04-01 04:07:17 dovecot_login authenticator failed for ([121.154.90.17]) [121.154.90.17]:35598: 535 Incorrect authentication data (set_id=istok91@saintsoldiercollege.com)121.154.90.171835841jp  -_) ossec13001gExim Auth failed2025-04-01 04:06:23 dovecot_plain authenticator failed for ([165.140.50.170]) [165.140.50.170]:47114: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)165.140.50.1706251999 (= _ J d Z qf   -) ossec13001g9Exim Auth failed2025-04-01 06:27:25 dovecot_login authenticator failed for 144.46.246.220.static.netvigator.com [220.246.46.144]:50399: 535 Incorrect authentication data (set_id=brander-center@saintsoldiercollege.com)220.246.46.1441819730i  -[+ ossec13001g9JExim Auth failed2025-04-01 06:24:33 dovecot_plain authenticator failed for ([220.180.107.193]) [220.180.107.193]:34557: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)220.180.107.1931814991y  -}) ossec13001g9<Exim Auth failed2025-04-01 06:24:19 dovecot_plain authenticator failed for ([165.140.50.170]) [165.140.50.170]:33874: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)165.140.50.1706251999]  -G' ossec13001g7iExim Auth failed2025-04-01 06:16:33 dovecot_login authenticator failed for ([46.73.156.221]) [46.73.156.221]:52890: 535 Incorrect authentication data (set_id=brander-center)46.73.156.2212017370x  -{) ossec13001g7]Exim Auth failed2025-04-01 06:16:20 dovecot_login authenticator failed for ([103.171.47.253]) [103.171.47.253]:34515: 535 Incorrect authentication data (set_id=brander-center@saintsoldiercollege.com)103.171.47.2531269750p  -k) ossec13001g6Exim Auth failed2025-04-01 06:13:18 dovecot_plain authenticator failed for (136-34-165-114.googlefiber.net) [136.34.165.114]:35219: 535 Incorrect authentication data (set_id=vikas.khandelwal)136.34.165.1146252001r  -q' ossec13001g6Exim Auth failed2025-04-01 06:12:51 dovecot_plain authenticator failed for ([170.83.54.246]) [170.83.54.246]:33105: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)170.83.54.2463865483Y  -C% ossec13001g1&Exim Auth failed2025-04-01 05:49:48 dovecot_login authenticator failed for ([91.74.186.57]) [91.74.186.57]:53692: 535 Incorrect authentication data (set_id=brander-center)91.74.186.57290557  -) ossec13001g1Exim Auth failed2025-04-01 05:49:38 dovecot_login authenticator failed for 202-188-035-194.ip-addr.vsenet.de [194.35.188.202]:60331: 535 Incorrect authentication data (set_id=brander-center@saintsoldiercollege.com)194.35.188.2022921044e  -U) ossec13001g/Exim Auth failed2025-04-01 05:43:54 dovecot_login authenticator failed for ool-44c7fcb3.dyn.optonline.net [68.199.252.179]:39311: 535 Incorrect authentication data (set_id=istok91)68.199.252.1796252001  -+ ossec13001g/Exim Auth failed2025-04-01 05:43:33 dovecot_login authenticator failed for (customer-GDL-135-105.megared.net.mx) [177.231.135.105]:22133: 535 Incorrect authentication data (set_id=istok91@saintsoldiercollege.com)177.231.135.1053996063b  -M+ ossec13001g/Exim Auth failed2025-04-01 05:43:25 dovecot_login authenticator failed for ([114.143.224.97]) [182.156.133.169]:56683: 535 Incorrect authentication data (set_id=brander-center)182.156.133.1691269750  -++ ossec13001g/Exim Auth failed2025-04-01 05:43:15 dovecot_login authenticator failed for (nsg-corporate-170.230.187.122.airtel.in) [122.187.230.170]:40448: 535 Incorrect authentication data (set_id=brander-center@saintsoldiercollege.com)122.187.230.1701269750Z  -=+ ossec13001g+Exim Auth failed2025-04-01 05:27:20 dovecot_plain authenticator failed for ([176.195.216.131]) [176.195.216.131]:54952: 535 Incorrect authentication data (set_id=sales)176.195.216.1312017370g  -[' ossec13001g+Exim Auth failed2025-04-01 05:27:08 dovecot_plain authenticator failed for ([213.154.80.21]) [213.154.80.51]:39570: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)213.154.80.512245662T  -5' ossec13001g)Exim Auth failed2025-04-01 05:17:31 dovecot_login authenticator failed for ([36.37.181.181]) [36.37.181.181]:58872: 535 Incorrect authentication data (set_id=sales)36.37.181.1811831722 4 G [LZvkg"  -[' ossec13001gBExim Auth failed2025-04-01 07:05:39 dovecot_login authenticator failed for ([89.101.36.159]) [89.101.36.159]:51295: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)89.101.36.1592963597W!  -9) ossec13001gBExim Auth failed2025-04-01 07:05:51 dovecot_login authenticator failed for ([222.236.59.174]) [222.236.59.174]:54426: 535 Incorrect authentication data (set_id=sales)222.236.59.1741835841  -' ossec13001gAExim Auth failed2025-04-01 07:01:07 dovecot_login authenticator failed for c-98-220-97-188.hsd1.il.comcast.net [98.220.97.188]:34092: 535 Incorrect authentication data (set_id=brander-center@saintsoldiercollege.com)98.220.97.1886252001`  -K) ossec13001gAExim Auth failed2025-04-01 07:01:26 dovecot_login authenticator failed for ([123.209.200.21]) [123.209.200.21]:57422: 535 Incorrect authentication data (set_id=brander-center)123.209.200.212077456n  -i' ossec13001gAExim Auth failed2025-04-01 07:01:04 dovecot_login authenticator failed for ([120.157.60.38]) [120.157.60.38]:46924: 535 Incorrect authentication data (set_id=istok91@saintsoldiercollege.com)120.157.60.3820774568  Ai' ossec11302gAFTP Authentication failed.Apr 1 07:00:15 vm1 pure-ftpd[1244242]: (?@101.36.97.172) [WARNING] Authentication failed for user [anonymous]101.36.97.1722635167& 3Q' ossec11301gANew FTP connection.Apr 1 07:00:07 vm1 pure-ftpd[1244238]: (?@101.36.97.172) [INFO] New connection from 101.36.97.172101.36.97.1722635167%  3Q' ossec11301gANew FTP connection.Apr 1 07:00:06 vm1 pure-ftpd[1244231]: (?@101.36.97.172) [INFO] New connection from 101.36.97.172101.36.97.1722635167%  3Q' ossec11301g@New FTP connection.Apr 1 06:56:27 vm1 pure-ftpd[1243333]: (?@20.221.65.127) [INFO] New connection from 20.221.65.12720.221.65.1276252001f  -[% ossec13001g?$Exim Auth failed2025-04-01 06:49:30 dovecot_plain authenticator failed for 50.35.170.34.bc.googleusercontent.com [34.170.35.50]:38956: 535 Incorrect authentication data (set_id=sales)34.170.35.506252001g  -[' ossec13001g?Exim Auth failed2025-04-01 06:49:19 dovecot_plain authenticator failed for ([77.211.31.222]) [77.211.31.222]:47045: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)77.211.31.2222510769u  -s+ ossec13001g;qExim Auth failed2025-04-01 06:33:43 dovecot_login authenticator failed for (187-93-236-244.customer.tdatabrasil.net.br) [179.184.176.137]:60842: 535 Incorrect authentication data (set_id=istok91)179.184.176.1373469034~  - ' ossec13001g;aExim Auth failed2025-04-01 06:33:27 dovecot_login authenticator failed for ool-6038e495.static.optonline.net [96.56.228.149]:49478: 535 Incorrect authentication data (set_id=istok91@saintsoldiercollege.com)96.56.228.1496252001B  gU) ossec11307g:Multiple connection attempts from same sourceApr 1 06:31:36 vm1 pure-ftpd[1237761]: (?@35.216.217.160) [INFO] New connection from 35.216.217.16035.216.217.1602658434) 3U) ossec11301g: New FTP connection.Apr 1 06:31:32 vm1 pure-ftpd[1237744]: (?@35.216.217.160) [INFO] New connection from 35.216.217.16035.216.217.1602658434i  -a% ossec13001g:Exim Auth failed2025-04-01 06:31:08 dovecot_login authenticator failed for p4095-ipbfpfx02osakakita.osaka.ocn.ne.jp [60.40.45.223]:50491: 535 Incorrect authentication data (set_id=sales)60.40.45.2231861060d  -W% ossec13001g:Exim Auth failed2025-04-01 06:30:50 dovecot_login authenticator failed for ([92.79.70.204]) [92.79.70.204]:60216: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)92.79.70.2042921044`  -K) ossec13001g: Exim Auth failed2025-04-01 06:27:48 dovecot_login authenticator failed for ([168.121.46.162]) [168.121.46.162]:33150: 535 Incorrect authentication data (set_id=brander-center)168.121.46.1623932488 fV gUfk0  -e% ossec13001gl Exim Auth failed2025-04-01 10:01:05 dovecot_login authenticator failed for ([203.252.10.5]) [203.252.10.3]:10013: 535 Incorrect authentication data (set_id=istok91@saintsoldiercollege.com)203.252.10.31835841  -q) ossec13001gLExim Auth failed2025-04-01 11:23:16 dovecot_login authenticator failed for (static-254.178.249.49-tataidc.co.in) [122.163.118.64]:58986: 535 Incorrect authentication data (set_id=brander-center)122.163.118.641269750r=  -o) ossec13001g<Exim Auth failed2025-04-01 11:22:59 dovecot_login authenticator failed for syn-208-105-193-045.biz.spectrum.com [208.105.193.45]:36018: 535 Incorrect authentication data (set_id=brander-center)208.105.193.456252001~<  - ' ossec13001g2Exim Auth failed2025-04-01 11:22:49 dovecot_login authenticator failed for (mail.golfhotel-vesper.de) [195.52.244.84]:58908: 535 Incorrect authentication data (set_id=brander-center@saintsoldiercollege.com)195.52.244.842921044N;  =' ossec13008gvMail Reciepient rejected2025-04-01 10:43:56 H=mail112.atl91.mcsv.net [198.2.130.112]:16390 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 CV=no F= temporarily rejected RCPT : Could not complete sender verify198.2.130.1126252001:  -/' ossec13001gs\Exim Auth failed2025-04-01 10:32:18 dovecot_plain authenticator failed for static-47-190-147-30.dlls.tx.frontiernet.net [47.190.147.30]:55204: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)47.190.147.306252001 9  -#' ossec13001gs7Exim Auth failed2025-04-01 10:31:43 dovecot_plain authenticator failed for 6.112.255.173.bc.googleusercontent.com [173.255.112.6]:33678: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)173.255.112.66252001y8  -}) ossec13001gsEExim Auth failed2025-04-01 10:31:57 dovecot_plain authenticator failed for ([220.119.126.81]) [220.119.126.81]:46283: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)220.119.126.811835841l7  -c) ossec13001griExim Auth failed2025-04-01 10:28:16 dovecot_login authenticator failed for ([212.85.243.184]) [212.85.243.184]:41542: 535 Incorrect authentication data (set_id=invoice@heipowersystem.com)212.85.243.18425107696  -') ossec13001gpoExim Auth failed2025-04-01 10:19:49 dovecot_plain authenticator failed for pool-96-249-234-242.nrflva.fios.verizon.net [96.249.234.242]:49849: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)96.249.234.2426252001~5  Ua' ossec11001glDeferred login on the cpanel service[2025-04-01 10:03:39 +0530] info [webmaild] 157.38.61.184 - kps@amplifypowerglobal.com "POST /cpsess7025066065/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [157.38.41.129] != Current IP Address [157.38.61.184]157.38.61.1841269750K4  -+ ossec13001gl,Exim Auth failed2025-04-01 10:01:39 dovecot_login authenticator failed for ([177.159.150.111]) [177.159.150.111]:33597: 535 Incorrect authentication data177.159.150.1113469034t3  -q+ ossec13001glExim Auth failed2025-04-01 10:01:22 dovecot_login authenticator failed for ([218.146.255.221]) [218.146.255.221]:61473: 535 Incorrect authentication data (set_id=istok91@saintsoldiercollege.com)218.146.255.2211835841|2  Qa' ossec11000glLogin failed on the cpanel service[2025-04-01 10:01:20 +0530] info [webmaild] 157.38.41.129 - kps@amplifypowerglobal.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect157.38.41.1291269750;1  U[' ossec11001gl Deferred login on the cpanel service[2025-04-01 10:01:08 +0530] info [webmaild] 157.38.61.184 - kps@amplifypowerglobal.com "GET /cpsess5490697901/3rdparty/roundcube/?_task=mail&_action=compose&_id=151598093567e4dd6db81c3&login=1&post_login=64050375720860 HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [157.38.41.129] != Current IP Address [157.38.61.184]157.38.61.1841269750 P' # + = J NANWnNQP}O  Co) ossec11313gIFTP file uploaded to serverApr 1 12:57:04 vm1 pure-ftpd[26145]: (user@spexscart.com@106.206.136.78) [NOTICE] /home/techno/public_html/spexscart.com//single-product.php uploaded (15818 bytes, 0.88KB/sec)106.206.136.781269750yN  Cg) ossec11313gFTP file uploaded to serverApr 1 12:56:17 vm1 pure-ftpd[26059]: (user@spexscart.com@106.206.136.78) [NOTICE] /home/techno/public_html/spexscart.com//single-product.php uploaded (0 bytes, 0.00KB/sec)106.206.136.781269750'M 3Q) ossec11301gNew FTP connection.Apr 1 12:55:36 vm1 pure-ftpd[26059]: (?@106.206.136.78) [INFO] New connection from 106.206.136.78106.206.136.7812697500L CS) ossec11309gFTP Authentication success.Apr 1 12:55:36 vm1 pure-ftpd[26059]: (?@106.206.136.78) [INFO] user@spexscart.com is now logged in106.206.136.781269750eK  -W' ossec13001g Exim Auth failed2025-04-01 11:52:00 dovecot_login authenticator failed for (rokamauka.com) [111.56.54.202]:57448: 535 Incorrect authentication data (set_id=postmaster@rokamauka.com)111.56.54.2021814991TJ  -5' ossec13001gExim Auth failed2025-04-01 11:51:16 dovecot_login authenticator failed for (rokamauka.com) [111.56.54.202]:52864: 535 Incorrect authentication data (set_id=nologin)111.56.54.2021814991eI  -[% ossec13001gExim Auth failed2025-04-01 11:43:45 dovecot_login authenticator failed for 77-85-52-109.ip.btc-net.bg [77.85.52.109]:39664: 535 Incorrect authentication data (set_id=vikas.khandelwal)77.85.52.109732800sH  -s' ossec13001g Exim Auth failed2025-04-01 11:43:31 dovecot_login authenticator failed for (www.nettlinx.com) [202.53.94.242]:58594: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)202.53.94.2421269750oG  -m% ossec13001gExim Auth failed2025-04-01 11:43:24 dovecot_plain authenticator failed for ([149.54.51.74]) [149.54.51.74]:53586: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)149.54.51.741149361 F  -+ ossec13001gExim Auth failed2025-04-01 11:43:06 dovecot_plain authenticator failed for 217-209-148-151-no600.tbcn.telia.com [217.209.148.151]:37914: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)217.209.148.1512661886xE  -y+ ossec13001gExim Auth failed2025-04-01 11:42:52 dovecot_login authenticator failed for ([111.171.127.190]) [111.171.127.190]:50665: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)111.171.127.1901835841oD  -m% ossec13001gExim Auth failed2025-04-01 11:42:50 dovecot_plain authenticator failed for ([77.41.156.64]) [77.41.156.64]:60298: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)77.41.156.642017370jC  -_) ossec13001g냇Exim Auth failed2025-04-01 11:41:19 dovecot_login authenticator failed for 17.sub-166-248-194.myvzw.com [166.248.194.17]:61118: 535 Incorrect authentication data (set_id=brander-center)166.248.194.176252001tB  -w' ossec13001gsExim Auth failed2025-04-01 11:40:57 dovecot_login authenticator failed for ([87.200.73.165]) [87.200.73.165]:46701: 535 Incorrect authentication data (set_id=brander-center@saintsoldiercollege.com)87.200.73.165290557A  -% ossec13001gmExim Auth failed2025-04-01 11:40:52 dovecot_login authenticator failed for 66.68.243.35.bc.googleusercontent.com [35.243.68.66]:40924: 535 Incorrect authentication data (set_id=istok91@saintsoldiercollege.com)35.243.68.661861060q@  -m) ossec13001g[Exim Auth failed2025-04-01 11:40:34 dovecot_login authenticator failed for ([42.194.186.118]) [42.194.186.118]:52640: 535 Incorrect authentication data (set_id=istok91@saintsoldiercollege.com)42.194.186.1181814991`?  -K) ossec13001gZExim Auth failed2025-04-01 11:23:30 dovecot_login authenticator failed for ([177.135.206.10]) [177.135.206.10]:59815: 535 Incorrect authentication data (set_id=brander-center)177.135.206.103469034 *\~tj`VLB8.$zpf\H>4*   v l b X N D : 0 &    ~ t j ` V L B 8 . $    z p f \ R H > 4 *  vlbXND:0&|rh^TJ@6,"xnZdPF<2( ~tj`LVB8.$zpf\ | r h ^ T J @ 6 , "    x n d Z P F < 2 (   RRH>4*  vlbXND:0& g|6 g6 g쉞6 g쉒6 gq6 g/6 g!6 g 6 g}6 g}x6 g|6 g|6 gsV6 gi?6 gi6 ggU6 g_6 g_6 gWa6 gWS6 gR6 gR6 gQ6 gQ6 gL6 gL 6 gK6 gK"6 gJ76 gJ+6 gH6 gB6 gB6 g?O6 g?76 g76 g2y6 g16 g/S6 g/a6 g/C6 g-6 g-6 g-6 g,6 g&6 g&6 g& 6 g$6 g$6 g#6 g"6 g"6 g6 gr6 g^6 g 6 g 6 g6 g6 gl6 g6 g6 g6 g6 g6 g 6 g6 g6 g6~ g6} g6| g'6{ gB6z g,6y g 6x gj6w g_6v g6u gf6t gT6s g>6r gd6q gӪ6p gӞ6o g6n g6m g6l gL6k g6j g6i g6h g6g g6f g빡6e g빗6d gn6c gn6b gb6a g먋6` g먁6_ g6^ g6] g6\ gs6[ gg6Z g6Y g럯6X g 6W g뛢6V g뛂6U g뛮6T g6S g6R gA6Q g-6P gI6O g6N g6M g6L g 6K g6J g6I g 6H g6G g6F g6E g6D g냇6C gs6B gm6A g[6@ gZ6? gL6> g<6= g26< gv6; gs\6: gsE68 gs769 gri67 gpo66 gl65 gl,64 gl63 gl62 gl 61 gl 60 gk6/ gk6. gg6- ggz6, gf6+ gdt6* g_6) g_6( g\'6' gTQ6& gR6% gH6$ gH6# gB6! gB6" gA6 gA6 gA6 gA6 gA6 gA6 g@6 g6 g6 g'6 g6 g6 g6 gF6 gB6 g6 g_6 gW6 gQ6 gI6 gA6 gA6 g96 gۙ6 gۍ6 g6 g6 gu6 g!6 g 6 g6 gr6 gh6 gȪ6 gr6 gD6 g6 gu6 g6 g6 g6 gA6 gQ6 g쯗6 gJ6 g<6 g86 g욾6 g6 g왾6 g?$6 g?6 g;q6 g;a6 g:6 g:6 g:6 g:6 g: 6 g96 g9J6 g9<6 g7i6 g7]6 g66 g66 g1&6 g16 g/6 g/6 g/6 g/6 g+6 g+6 g)5 g)5 g)6 g)6 g&I5 g&%5 g!5 g!}5 g5 g5 g{5 g~5 gp5 g5 g5 g/5 g5 g5 g6 g5 g5 g 5 g=5 g15 g5 g5 g5 gb5 gJ5 g@5 g5 g5 g5 gl5 g5 g5 g5 g5 g5 g5 gK5 g95 g75 g5 g5 g55 g(5 g5 g5 g5 gz5 g5 g5 g5 g5 g5 g5 g5 g5 g5 g5 ! $  C # 6&I^d_  -W% ossec13001g먁Exim Auth failed2025-04-01 14:19:04 dovecot_login authenticator failed for ([112.91.67.18]) [112.91.67.18]:35469: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)112.91.67.181814991^  =7+ ossec13008gMail Reciepient rejected2025-04-01 14:11:38 H=(mail.hsnews.in) [165.154.242.137]:64175 F= rejected RCPT : Rejected relay attempt: '165.154.242.137' From: 'fodwrby@hsnews.in' To: 'file2@fastmail.com'165.154.242.1371694008]]  -O! ossec13001gExim Auth failed2025-04-01 13:46:53 dovecot_login authenticator failed for ([80.241.253.238]) [2.57.219.2]:42862: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)2.57.219.2614540y\  -}) ossec13001gExim Auth failed2025-04-01 13:46:43 dovecot_login authenticator failed for ([117.176.123.33]) [117.176.123.33]:60124: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)117.176.123.331814991Q[  -1% ossec13001gsExim Auth failed2025-04-01 13:44:42 dovecot_login authenticator failed for ([88.87.84.104]) [88.87.84.104]:57973: 535 Incorrect authentication data (set_id=sales)88.87.84.1042017370gZ  -[' ossec13001ggExim Auth failed2025-04-01 13:44:31 dovecot_login authenticator failed for ([140.249.20.14]) [140.249.20.14]:55266: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)140.249.20.141814991YY  -;+ ossec13001gExim Auth failed2025-04-01 13:41:48 dovecot_plain authenticator failed for ([103.255.182.68]) [114.143.158.178]:56716: 535 Incorrect authentication data (set_id=sales)114.143.158.1781269750kX  -a) ossec13001g럯Exim Auth failed2025-04-01 13:41:26 dovecot_plain authenticator failed for ([222.174.187.202]) [113.122.237.86]:35891: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)113.122.237.861814991W  W+ ossec9708g Dovecot Aborted Login with empty userApr 1 13:38:44 vm1 dovecot[1526]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=185.247.137.195, lip=103.74.54.108, TLS, session=185.247.137.195298795iV  -]) ossec13001g뛢Exim Auth failed2025-04-01 13:24:09 dovecot_login authenticator failed for ([61.143.134.110]) [61.143.134.110]:47896: 535 Incorrect authentication data (set_id=bind@heipowersystem.com)61.143.134.1101814991U  W) ossec9708g뛂Dovecot Aborted Login with empty userApr 1 13:23:36 vm1 dovecot[1526]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=87.236.176.181, lip=103.74.54.108, TLS, session=87.236.176.1812635167VT  -7) ossec13001g뛮Exim Auth failed2025-04-01 13:24:22 dovecot_login authenticator failed for ([223.75.218.238]) [223.75.218.238]:56822: 535 Incorrect authentication data (set_id=bind)223.75.218.2381814991S  -) ossec13001gExim Auth failed2025-04-01 13:16:51 dovecot_plain authenticator failed for 47-157-217-116.fdr01.covn.ca.ip.frontiernet.net [47.157.217.116]:38116: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)47.157.217.1166252001yR  -}) ossec13001gExim Auth failed2025-04-01 13:16:42 dovecot_plain authenticator failed for ([39.174.209.153]) [39.174.209.153]:33107: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)39.174.209.1531814991bQ  -O) ossec13001gAExim Auth failed2025-04-01 13:05:28 dovecot_plain authenticator failed for ([153.151.21.215]) [153.151.21.215]:55128: 535 Incorrect authentication data (set_id=vikas.khandelwal)153.151.21.2151861060uP  -u) ossec13001g-Exim Auth failed2025-04-01 13:05:08 dovecot_plain authenticator failed for ([121.155.16.231]) [121.155.16.231]:43762: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)121.155.16.2311835841 % $ Rd;_p  -O% ossec13001gӪExim Auth failed2025-04-01 17:23:13 dovecot_login authenticator failed for ([41.220.3.113]) [41.220.3.101]:63815: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)41.220.3.101226074vo  -y' ossec13001gӞExim Auth failed2025-04-01 17:23:00 dovecot_login authenticator failed for ([82.94.216.105]) [82.94.216.107]:58453: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)82.94.216.1072750405#n  3M' ossec11301gNew FTP connection.Apr 1 17:15:15 vm1 pure-ftpd[84826]: (?@45.156.130.11) [INFO] New connection from 45.156.130.1145.156.130.112264397$m 3M' ossec11301gNew FTP connection.Apr 1 17:15:09 vm1 pure-ftpd[84804]: (?@45.156.130.12) [INFO] New connection from 45.156.130.1245.156.130.122264397$l 3M' ossec11301gNew FTP connection.Apr 1 17:15:05 vm1 pure-ftpd[84740]: (?@45.156.130.10) [INFO] New connection from 45.156.130.1045.156.130.102264397'k  =G+ ossec13008gLMail Reciepient rejected2025-04-01 16:21:54 H=(mail.msnews24.in) [165.154.210.189]:53921 F= rejected RCPT : Rejected relay attempt: '165.154.210.189' From: 'mnmujdsw@msnews24.in' To: 'file2@fastmail.com'165.154.210.1891694008Vj  -7) ossec13001gExim Auth failed2025-04-01 16:20:31 dovecot_login authenticator failed for ([191.36.154.175]) [191.36.154.175]:52381: 535 Incorrect authentication data (set_id=ebay)191.36.154.1753469034ri  -s% ossec13001gExim Auth failed2025-04-01 16:20:18 dovecot_login authenticator failed for 45-237-92-19.infonet-isp.com.br [45.237.92.19]:41234: 535 Incorrect authentication data (set_id=ebay@heipowersystem.com)45.237.92.193469034Zh  -=+ ossec13001gExim Auth failed2025-04-01 16:07:41 dovecot_login authenticator failed for ([124.106.145.241]) [124.106.145.241]:65292: 535 Incorrect authentication data (set_id=sales)124.106.145.2411694008jg  -_) ossec13001gExim Auth failed2025-04-01 16:07:27 dovecot_login authenticator failed for ([220.182.17.122]) [220.182.17.122]:39498: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)220.182.17.1221814991#f  3M' ossec11301gNew FTP connection.Apr 1 16:01:51 vm1 pure-ftpd[68150]: (?@91.238.181.91) [INFO] New connection from 91.238.181.9191.238.181.913017382le  -e' ossec13001g빡Exim Auth failed2025-04-01 15:32:09 dovecot_login authenticator failed for (node-115-187-61-70.alliancebroadband.in) [115.187.61.70]:43192: 535 Incorrect authentication data (set_id=sales)115.187.61.701269750qd  -q% ossec13001g빗Exim Auth failed2025-04-01 15:31:59 dovecot_login authenticator failed for cm61-15-25-138.hkcable.com.hk [61.15.25.138]:44938: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)61.15.25.1381819730Bc  =}+ ossec13008gnMail Reciepient rejected2025-04-01 15:14:14 H=(mail.heipowersystem.com) [165.154.242.137]:60076 F= rejected RCPT : Rejected relay attempt: '165.154.242.137' From: 'gkfqtmczmgl@heipowersystem.com' To: 'file2@fastmail.com'165.154.242.1371694008ub  -y% ossec13001gnExim Auth failed2025-04-01 14:27:16 dovecot_plain authenticator failed for host-79-55-28-217.retail.telecomitalia.it [79.55.28.217]:49599: 535 Incorrect authentication data (set_id=vikas.khandelwal)79.55.28.2173175395a  -' ossec13001gbExim Auth failed2025-04-01 14:27:04 dovecot_plain authenticator failed for syn-097-086-134-216.res.spectrum.com [97.86.134.216]:4913: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)97.86.134.2166252001W`  -9) ossec13001g먋Exim Auth failed2025-04-01 14:19:14 dovecot_login authenticator failed for ([83.239.108.218]) [83.239.108.218]:56482: 535 Incorrect authentication data (set_id=sales)83.239.108.2182017370 +Tf ~ Ry +Z  -?) ossec13001g Exim Auth failed2025-04-01 19:41:24 dovecot_login authenticator failed for ([168.126.90.210]) [168.126.90.210]:54831: 535 Incorrect authentication data (set_id=services)168.126.90.2101835841j  -a' ossec13001gExim Auth failed2025-04-01 19:40:44 dovecot_login authenticator failed for syn-097-070-129-101.res.spectrum.com [97.70.129.101]:34729: 535 Incorrect authentication data (set_id=services)97.70.129.1016252001p  -i+ ossec13001gExim Auth failed2025-04-01 19:40:31 dovecot_login authenticator failed for ([120.157.128.238]) [120.157.128.238]:53200: 535 Incorrect authentication data (set_id=services@heipowersystem.com)120.157.128.2382077456f~  -Y' ossec13001gExim Auth failed2025-04-01 19:32:35 dovecot_login authenticator failed for c-98-220-97-188.hsd1.il.comcast.net [98.220.97.188]:41842: 535 Incorrect authentication data (set_id=cyrus)98.220.97.1886252001Q}  -1% ossec13001gExim Auth failed2025-04-01 19:32:15 dovecot_login authenticator failed for ([90.173.78.90]) [90.173.78.90]:54333: 535 Incorrect authentication data (set_id=cyrus)90.173.78.902510769m|  -c+ ossec13001gExim Auth failed2025-04-01 19:31:54 dovecot_login authenticator failed for ([178.216.165.187]) [178.216.165.187]:41708: 535 Incorrect authentication data (set_id=cyrus@heipowersystem.com)178.216.165.1872017370t{  -y' ossec13001g'Exim Auth failed2025-04-01 19:11:57 dovecot_login authenticator failed for ([65.20.169.121]) [65.20.169.121]:52273: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)65.20.169.12199237bz  -Q' ossec13001gBExim Auth failed2025-04-01 19:03:54 dovecot_login authenticator failed for (nyaystambh.com) [111.207.12.99]:48708: 535 Incorrect authentication data (set_id=sales@nyaystambh.com)111.207.12.991814991Uy  -7' ossec13001g,Exim Auth failed2025-04-01 19:03:30 dovecot_login authenticator failed for (nyaystambh.com) [111.207.12.99]:45390: 535 Incorrect authentication data (set_id=nologin)111.207.12.991814991Ix  = + ossec13008g Mail Reciepient rejected2025-04-01 19:02:56 H=(mail.saintsoldiercollege.com) [165.154.208.108]:63512 F= rejected RCPT : Rejected relay attempt: '165.154.208.108' From: 'zjndznu@saintsoldiercollege.com' To: 'file2@fastmail.com'165.154.208.1081668284_w  -K' ossec13001gjExim Auth failed2025-04-01 18:56:01 dovecot_login authenticator failed for ([83.219.250.17]) [83.219.250.17]:40736: 535 Incorrect authentication data (set_id=vikas.khandelwal)83.219.250.172661886xv  -y+ ossec13001g_Exim Auth failed2025-04-01 18:55:50 dovecot_login authenticator failed for ([122.187.227.164]) [122.187.227.164]:39714: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)122.187.227.1641269750'u  =G+ ossec13008gMail Reciepient rejected2025-04-01 18:20:29 H=(mail.rokamauka.com) [165.154.210.189]:60255 F= rejected RCPT : Rejected relay attempt: '165.154.210.189' From: 'qwwip@rokamauka.com' To: 'file2@fastmail.com'165.154.210.1891694008et  -Y% ossec13001gfExim Auth failed2025-04-01 17:56:14 dovecot_login authenticator failed for syn-074-062-020-170.biz.spectrum.com [74.62.20.170]:59104: 535 Incorrect authentication data (set_id=sales)74.62.20.1706252001Ps  -/% ossec13001gTExim Auth failed2025-04-01 17:55:56 dovecot_login authenticator failed for ([27.18.224.32]) [27.18.224.32]:7045: 535 Incorrect authentication data (set_id=sales)27.18.224.321814991jr  -_) ossec13001g>Exim Auth failed2025-04-01 17:55:33 dovecot_login authenticator failed for ([125.35.109.214]) [125.35.109.214]:57850: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)125.35.109.2141814991(q  3U+ ossec11301gdNew FTP connection.Apr 1 17:30:35 vm1 pure-ftpd[88282]: (?@185.247.137.157) [INFO] New connection from 185.247.137.157185.247.137.157298795 4 " }  'qR  -1' ossec13001g$Exim Auth failed2025-04-01 23:09:34 dovecot_login authenticator failed for ([75.127.205.91]) [75.127.205.91]:59408: 535 Incorrect authentication data (set_id=rpc)75.127.205.916252001g  -[) ossec13001g$Exim Auth failed2025-04-01 23:09:08 dovecot_login authenticator failed for ([185.101.16.250]) [185.101.16.250]:38621: 535 Incorrect authentication data (set_id=rpc@heipowersystem.com)185.101.16.250272103'  3S) ossec11301g#New FTP connection.Apr 1 23:05:31 vm1 pure-ftpd[162526]: (?@205.210.31.250) [INFO] New connection from 205.210.31.250205.210.31.2506252001  -) ossec13001g"Exim Auth failed2025-04-01 22:59:43 dovecot_login authenticator failed for (177-174-95-245.user.vivozap.com.br) [177.174.95.245]:50973: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)177.174.95.2453469034^  -K' ossec13001g"Exim Auth failed2025-04-01 22:59:56 dovecot_login authenticator failed for ([46.130.54.153]) [46.130.54.153]:55669: 535 Incorrect authentication data (set_id=vikas.khandelwal)46.130.54.153174982d  Q5# ossec11000gLogin failed on the cpanel service[2025-04-01 22:13:58 +0530] info [whostmgrd] 45.3.35.189 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect45.3.35.1892750405Z  -=+ ossec13001grExim Auth failed2025-04-01 21:51:04 dovecot_login authenticator failed for ([182.163.122.133]) [182.163.122.133]:13043: 535 Incorrect authentication data (set_id=sales)182.163.122.1331210997g  -[' ossec13001g^Exim Auth failed2025-04-01 21:50:45 dovecot_login authenticator failed for ([95.221.179.61]) [95.221.179.61]:53890: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)95.221.179.612017370c  -S' ossec13001g Exim Auth failed2025-04-01 21:14:15 dovecot_login authenticator failed for ([117.247.97.20]) [117.247.97.20]:57175: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)117.247.97.201269750|  -+ ossec13001g Exim Auth failed2025-04-01 21:13:51 dovecot_login authenticator failed for ([122.225.203.106]) [122.225.203.106]:42720: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)122.225.203.1061814991r  -q' ossec13001gExim Auth failed2025-04-01 20:56:28 dovecot_login authenticator failed for ([12.13.221.245]) [12.13.221.245]:60242: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)12.13.221.2456252001b  -O) ossec13001gExim Auth failed2025-04-01 20:56:45 dovecot_login authenticator failed for ([218.50.233.121]) [218.50.233.121]:47860: 535 Incorrect authentication data (set_id=vikas.khandelwal)218.50.233.1211835841!  3K% ossec11301glNew FTP connection.Apr 1 20:17:07 vm1 pure-ftpd[125443]: (?@103.74.54.23) [INFO] New connection from 103.74.54.23103.74.54.231269750'  3S) ossec11301gNew FTP connection.Apr 1 20:06:31 vm1 pure-ftpd[123155]: (?@216.218.206.67) [INFO] New connection from 216.218.206.67216.218.206.676252001Q  -1% ossec13001gExim Auth failed2025-04-01 19:47:59 dovecot_login authenticator failed for ([14.29.170.54]) [14.29.170.54]:57340: 535 Incorrect authentication data (set_id=sales)14.29.170.541814991i  -_) ossec13001gExim Auth failed2025-04-01 19:47:43 dovecot_login authenticator failed for ([212.90.111.127]) [212.90.111.127]:54868: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)212.90.111.127294640!  3K% ossec11301gNew FTP connection.Apr 1 19:43:33 vm1 pure-ftpd[117681]: (?@94.102.56.99) [INFO] New connection from 94.102.56.9994.102.56.992750405H  -) ossec13001gExim Auth failed2025-04-01 19:41:11 dovecot_login authenticator failed for ([118.123.116.93]) [118.123.116.93]:39915: 535 Incorrect authentication data118.123.116.931814991 U  - 9 > TlG2UY% -9+ ossec13001gHExim Auth failed2025-04-02 01:43:17 dovecot_login authenticator failed for (rokamauka.com) [202.107.197.211]:57346: 535 Incorrect authentication data (set_id=nologin)202.107.197.2111814991N$  --# ossec13001gBExim Auth failed2025-04-02 01:17:14 dovecot_login authenticator failed for ([103.55.89.5]) [103.55.89.5]:57358: 535 Incorrect authentication data (set_id=sales)103.55.89.51269750j#  -_) ossec13001gBExim Auth failed2025-04-02 01:17:02 dovecot_login authenticator failed for ([223.84.191.234]) [223.84.191.234]:35710: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)223.84.191.2341814991q"  -m) ossec13001g?OExim Auth failed2025-04-02 01:02:30 dovecot_login authenticator failed for 125-228-225-91.hinet-ip.hinet.net [125.228.225.91]:53803: 535 Incorrect authentication data (set_id=vikas.khandelwal)125.228.225.911668284o!  -m% ossec13001g?7Exim Auth failed2025-04-02 01:02:05 dovecot_login authenticator failed for ([90.173.78.90]) [90.173.78.90]:36456: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)90.173.78.902510769b  Q3! ossec11000g7Login failed on the cpanel service[2025-04-02 00:29:59 +0530] info [whostmgrd] 45.3.36.64 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect45.3.36.642750405  ?+ ossec1008g2yProcess exiting (killed).Apr 2 00:07:44 vm1 spamd[1603]: spamd: server killed by SIGTERM, shutting downC  77 ossec502g1Ossec server started.ossec: Ossec started.  -% ossec13001g/SExim Auth failed2025-04-01 23:54:19 dovecot_login authenticator failed for (246.50.5.122.broad.yt.sd.dynamic.163data.com.cn) [122.5.50.246]:49844: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)122.5.50.2461814991R  -5' ossec13001g/aExim Auth failed2025-04-01 23:54:32 dovecot_login authenticator failed for ([65.20.147.189]) [65.20.147.189]:52693: 535 Incorrect authentication data (set_id=sales)65.20.147.18999237d  -W% ossec13001g/CExim Auth failed2025-04-01 23:54:01 dovecot_login authenticator failed for ([59.41.197.10]) [59.41.197.10]:35345: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)59.41.197.101814991f  -Y' ossec13001g-Exim Auth failed2025-04-01 23:46:48 dovecot_login authenticator failed for 111-70-32-166.emome-ip.hinet.net [111.70.32.166]:51975: 535 Incorrect authentication data (set_id=services)111.70.32.1661668284w  -{' ossec13001g-Exim Auth failed2025-04-01 23:46:36 dovecot_login authenticator failed for (111-86-33-194.intelcom-ug.ru) [194.33.87.111]:58178: 535 Incorrect authentication data (set_id=services@heipowersystem.com)194.33.87.1112017370p  -i+ ossec13001g-Exim Auth failed2025-04-01 23:44:24 dovecot_login authenticator failed for (thepsindustries.com) [202.107.197.211]:33936: 535 Incorrect authentication data (set_id=admin@thepsindustries.com)202.107.197.2111814991^  -E+ ossec13001g,Exim Auth failed2025-04-01 23:44:00 dovecot_login authenticator failed for (thepsindustries.com) [202.107.197.211]:58894: 535 Incorrect authentication data (set_id=nologin)202.107.197.2111814991r  -s% ossec13001g&Exim Auth failed2025-04-01 23:17:30 dovecot_login authenticator failed for c-71-62-34-216.hsd1.va.comcast.net [71.62.34.216]:53530: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)71.62.34.2166252001y  -}) ossec13001g&Exim Auth failed2025-04-01 23:17:08 dovecot_login authenticator failed for ([175.116.66.199]) [175.116.66.199]:37204: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)175.116.66.1991835841z Q[' ossec11000g& Login failed on the cpanel service[2025-04-01 23:14:42 +0530] info [whostmgrd] 204.10.194.42 - kikujiro111@gmail.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect204.10.194.422921044 9 [ n Zk!|c6  -U% ossec13001gi?Exim Auth failed2025-04-02 04:01:27 dovecot_login authenticator failed for (hn.kd.ny.adsl) [123.7.86.144]:37920: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)123.7.86.1441814991!5  3K% ossec11301giNew FTP connection.Apr 2 04:00:28 vm1 pure-ftpd[268671]: (?@20.29.45.209) [INFO] New connection from 20.29.45.20920.29.45.2096252001B4  -% ossec13001ggUExim Auth failed2025-04-02 03:53:16 dovecot_login authenticator failed for ([183.249.1.72]) [183.249.1.72]:50820: 535 Incorrect authentication data183.249.1.721814991Z3  -=+ ossec13001g_Exim Auth failed2025-04-02 03:20:25 dovecot_login authenticator failed for ([115.144.115.150]) [115.144.115.150]:33150: 535 Incorrect authentication data (set_id=sales)115.144.115.1501835841g2  -[' ossec13001g_Exim Auth failed2025-04-02 03:20:05 dovecot_login authenticator failed for ([103.174.34.49]) [103.174.34.49]:58009: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)103.174.34.491269750e1  -U) ossec13001gWaExim Auth failed2025-04-02 02:45:13 dovecot_login authenticator failed for 125-229-102-40.hinet-ip.hinet.net [125.229.102.40]:55972: 535 Incorrect authentication data (set_id=paul)125.229.102.401668284t0  -u' ossec13001gWSExim Auth failed2025-04-02 02:44:57 dovecot_login authenticator failed for 46.79-160-128.customer.lyse.net [79.160.128.46]:38113: 535 Incorrect authentication data (set_id=paul@heipowersystem.com)79.160.128.463144096V/  -7) ossec13001gRExim Auth failed2025-04-02 02:25:50 dovecot_login authenticator failed for ([220.80.192.168]) [220.80.192.168]:53756: 535 Incorrect authentication data (set_id=info)220.80.192.1681835841k.  -c' ossec13001gRExim Auth failed2025-04-02 02:25:40 dovecot_login authenticator failed for ([175.202.82.16]) [175.202.82.16]:48610: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)175.202.82.161835841@-  =y+ ossec13008gQMail Reciepient rejected2025-04-02 02:21:17 H=(mail.heipowersystem.com) [165.154.228.109]:61214 F= rejected RCPT : Rejected relay attempt: '165.154.228.109' From: 'bwtpfcyukt@heipowersystem.com' To: 'file2@fastmail.com'165.154.228.1091643084,  [{) ossec12004gQPossible Dovecot CVE-2019-11500 attemptApr 2 02:18:29 vm1 dovecot[1526]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=15.235.227.163, lip=103.74.54.108, session=15.235.227.1631880251a+  -S# ossec13001gLExim Auth failed2025-04-02 01:56:39 dovecot_login authenticator failed for ([180.71.9.31]) [180.71.9.31]:39412: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)180.71.9.311835841T*  -5' ossec13001gL Exim Auth failed2025-04-02 01:56:48 dovecot_login authenticator failed for ([60.220.241.51]) [60.220.241.50]:48533: 535 Incorrect authentication data (set_id=sales)60.220.241.501814991i)  -_) ossec13001gKExim Auth failed2025-04-02 01:56:18 dovecot_login authenticator failed for ([196.190.180.18]) [196.190.180.19]:18072: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)196.190.180.19337996Z( -?' ossec13001gK"Exim Auth failed2025-04-02 01:52:57 dovecot_login authenticator failed for (heipowersystem.com) [111.56.54.202]:45638: 535 Incorrect authentication data (set_id=nologin)111.56.54.2021814991U'  -;' ossec13001gJ7Exim Auth failed2025-04-02 01:49:03 dovecot_login authenticator failed for ([65.20.247.192]) [65.20.247.192]:41286: 535 Incorrect authentication data (set_id=services)65.20.247.19299237j&  -a' ossec13001gJ+Exim Auth failed2025-04-02 01:48:51 dovecot_login authenticator failed for ([186.96.89.101]) [186.96.89.101]:42532: 535 Incorrect authentication data (set_id=services@heipowersystem.com)186.96.89.1013624060    )N1ES8VG -7' ossec13001g8Exim Auth failed2025-04-02 07:55:59 dovecot_login authenticator failed for (nyaystambh.com) [111.56.54.202]:50914: 535 Incorrect authentication data (set_id=nologin)111.56.54.2021814991!F  3K% ossec11301g욾New FTP connection.Apr 2 07:32:36 vm1 pure-ftpd[316480]: (?@103.74.54.23) [INFO] New connection from 103.74.54.23103.74.54.231269750VE  -9' ossec13001gExim Auth failed2025-04-02 07:28:35 dovecot_login authenticator failed for ([150.242.239.128]) [222.68.153.94]:37873: 535 Incorrect authentication data (set_id=sales)222.68.153.941814991dD  -W% ossec13001g왾Exim Auth failed2025-04-02 07:28:22 dovecot_login authenticator failed for ([221.6.69.226]) [221.6.69.226]:48492: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)221.6.69.2261814991'C  3S) ossec11301g|New FTP connection.Apr 2 07:01:38 vm1 pure-ftpd[309563]: (?@48.216.248.249) [INFO] New connection from 48.216.248.24948.216.248.2496252001*B  3W+ ossec11301gNew FTP connection.Apr 2 06:54:55 vm1 pure-ftpd[307950]: (?@147.185.132.102) [INFO] New connection from 147.185.132.102147.185.132.1026252001nA  -e+ ossec13001g쉞Exim Auth failed2025-04-02 06:19:33 dovecot_login authenticator failed for (nsg-corporate-247.228.187.122.airtel.in) [122.187.228.247]:58857: 535 Incorrect authentication data (set_id=pvm)122.187.228.2471269750h@  -[) ossec13001g쉒Exim Auth failed2025-04-02 06:19:21 dovecot_login authenticator failed for ([87.103.210.232]) [87.103.210.232]:42820: 535 Incorrect authentication data (set_id=pvm@heipowersystem.com)87.103.210.2322017370?  W+ ossec9708gqDovecot Aborted Login with empty userApr 2 06:06:00 vm1 dovecot[1526]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=165.154.182.223, lip=103.74.54.108, session=<3MRj1sAxuHilmrbf>165.154.182.2236252001W>  -9) ossec13001g/Exim Auth failed2025-04-02 06:04:53 dovecot_login authenticator failed for ([123.162.22.231]) [123.162.18.137]:16389: 535 Incorrect authentication data (set_id=sales)123.162.18.1371814991j=  -_) ossec13001g!Exim Auth failed2025-04-02 06:04:40 dovecot_login authenticator failed for ([46.138.247.195]) [46.138.247.195]:51136: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)46.138.247.1952017370g<  -[' ossec13001g Exim Auth failed2025-04-02 06:04:17 dovecot_login authenticator failed for ([31.43.202.110]) [31.43.202.110]:56891: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)31.43.202.1102017370f;  -W) ossec13001g}Exim Auth failed2025-04-02 05:27:59 dovecot_login authenticator failed for ([91.229.151.237]) [91.229.151.237]:46354: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)91.229.151.2371522867 :  -#) ossec13001g}xExim Auth failed2025-04-02 05:27:44 dovecot_login authenticator failed for (static-254.178.249.49-tataidc.co.in) [122.163.118.64]:48226: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)122.163.118.641269750`9  -M' ossec13001g|Exim Auth failed2025-04-02 05:25:16 dovecot_login authenticator failed for 54.126.103.87.rev.vodafone.pt [87.103.126.54]:16164: 535 Incorrect authentication data (set_id=sales)87.103.126.542264397e8  -Y% ossec13001g|Exim Auth failed2025-04-02 05:24:53 dovecot_login authenticator failed for ([203.29.84.253]) [203.63.46.34]:60785: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)203.63.46.34207745637  =a) ossec13008gsVMail Reciepient rejected2025-04-02 04:44:30 H=(mail.nyaystambh.com) [165.154.228.59]:52972 F= rejected RCPT : Rejected relay attempt: '165.154.228.59' From: 'albjekvtaeq@nyaystambh.com' To: 'file2@fastmail.com'165.154.228.591643084 ,C 8 )/T3,F~W  Ua' ossec11001gDeferred login on the cpanel service[2025-04-02 11:36:56 +0530] info [webmaild] 157.38.56.123 - kps@amplifypowerglobal.com "POST /cpsess0416556380/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [157.38.44.126] != Current IP Address [157.38.56.123]157.38.56.1231269750bV  -O) ossec13001grExim Auth failed2025-04-02 11:21:45 dovecot_login authenticator failed for ([95.105.113.109]) [95.105.113.109]:46344: 535 Incorrect authentication data (set_id=vikas.khandelwal)95.105.113.1092017370U  -' ossec13001ghExim Auth failed2025-04-02 11:21:36 dovecot_login authenticator failed for 171-100-8-186.static.asianet.co.th [171.100.8.186]:50664: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)171.100.8.1861605651T  W+ ossec9708gȪDovecot Aborted Login with empty userApr 2 10:48:33 vm1 dovecot[1526]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=185.247.137.122, lip=103.74.54.108, TLS, session=<+cDbyMQxz+O594l6>185.247.137.122298795WS  -9) ossec13001grExim Auth failed2025-04-02 10:13:28 dovecot_login authenticator failed for ([223.177.160.78]) [223.177.160.78]:56289: 535 Incorrect authentication data (set_id=sales)223.177.160.781269750vR  -y' ossec13001gDExim Auth failed2025-04-02 10:12:42 dovecot_login authenticator failed for 125-229-56-26.hinet-ip.hinet.net [125.229.56.26]:51636: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)125.229.56.261668284YQ  -?) ossec13001gExim Auth failed2025-04-02 10:05:11 dovecot_login authenticator failed for ([197.156.115.88]) [197.156.115.88]:53826: 535 Incorrect authentication data (set_id=services)197.156.115.88338010zP  -) ossec13001guExim Auth failed2025-04-02 10:05:00 dovecot_login authenticator failed for adsl-84-226-219-137.adslplus.ch [84.226.219.137]:44938: 535 Incorrect authentication data (set_id=services@heipowersystem.com)84.226.219.1372658434LO  -)# ossec13001gExim Auth failed2025-04-02 09:53:57 dovecot_login authenticator failed for ([59.1.240.96]) [59.1.240.96]:54802: 535 Incorrect authentication data (set_id=tty)59.1.240.961835841 N  -%) ossec13001gExim Auth failed2025-04-02 09:53:45 dovecot_login authenticator failed for (abts-north-dynamic-010.149.176.122.airtelbroadband.in) [122.176.149.10]:55268: 535 Incorrect authentication data (set_id=tty@heipowersystem.com)122.176.149.101269750'M  3S) ossec11301gNew FTP connection.Apr 2 09:53:44 vm1 pure-ftpd[348699]: (?@206.168.34.214) [INFO] New connection from 206.168.34.214206.168.34.2146252001$L  3O' ossec11301gANew FTP connection.Apr 2 09:34:17 vm1 pure-ftpd[344119]: (?@20.98.141.185) [INFO] New connection from 20.98.141.18520.98.141.1856252001AK  _/)1modsec77350470gQIM360 WAF: Vulnerability scanner detectedIM360 WAF: Vulnerability scanner detected||RSV:6.81||T:APACHE||ResponseStatus:0||198.235.24.1586252001vm1.technobases.inBJ  =) ossec13008g쯗Mail Reciepient rejected2025-04-02 09:01:35 H=(mail.thepsindustries.com) [165.154.210.79]:52899 F= rejected RCPT : Rejected relay attempt: '165.154.210.79' From: 'mlhmganeewq@thepsindustries.com' To: 'file2@fastmail.com'165.154.210.791694008eI  -[' ossec13001g<Exim Auth failed2025-04-02 08:08:52 dovecot_login authenticator failed for ([65.20.251.127]) [65.20.251.127]:38957: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)65.20.251.12799237PH  -1% ossec13001gJExim Auth failed2025-04-02 08:09:05 dovecot_login authenticator failed for ([87.200.181.5]) [87.200.181.5]:40223: 535 Incorrect authentication data (set_id=sales)87.200.181.5290557 1 G *h}"Gmi  -m% ossec13001gExim Auth failed2025-04-02 13:25:47 dovecot_login authenticator failed for ([65.20.191.12]) [65.20.191.12]:53950: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)65.20.191.12992375h  Ae% ossec11302gFFTP Authentication failed.Apr 2 13:07:41 vm1 pure-ftpd[393795]: (?@34.76.133.13) [WARNING] Authentication failed for user [anonymous]34.76.133.132802361"g 3K% ossec11301gBNew FTP connection.Apr 2 13:07:37 vm1 pure-ftpd[393795]: (?@34.76.133.13) [INFO] New connection from 34.76.133.1334.76.133.1328023611f  =_' ossec13008gMail Reciepient rejected2025-04-02 12:39:31 H=(mail.msnews24.in) [45.197.14.156]:60074 F= rejected RCPT : Rejected relay attempt: '45.197.14.156' From: 'ppmijj@msnews24.in' To: 'validxxx@gmailhotmail.com.br'45.197.14.1566252001%e 3O' ossec11301gANew FTP connection.Apr 2 12:16:23 vm1 pure-ftpd[382336]: (?@206.168.34.56) [INFO] New connection from 206.168.34.56206.168.34.566252001jd  -_) ossec13001gAExim Auth failed2025-04-02 12:16:24 dovecot_login authenticator failed for ([146.120.209.57]) [146.120.209.57]:52746: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)146.120.209.572017370Nc  --# ossec13001g_Exim Auth failed2025-04-02 12:16:55 dovecot_login authenticator failed for ([14.6.16.137]) [14.6.16.137]:35468: 535 Incorrect authentication data (set_id=sales)14.6.16.1371835841nb  -o! ossec13001gWExim Auth failed2025-04-02 12:16:46 dovecot_login authenticator failed for cpc117482-shep15-2-0-cust42.8-3.cable.virginm.net [82.8.25.43]:39476: 535 Incorrect authentication data (set_id=sales)82.8.25.432635167ga  -[' ossec13001gQExim Auth failed2025-04-02 12:16:41 dovecot_login authenticator failed for ([61.108.83.254]) [61.108.83.139]:48652: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)61.108.83.1391835841>`  gO' ossec11307gIMultiple connection attempts from same sourceApr 2 12:16:33 vm1 pure-ftpd[382370]: (?@206.168.34.56) [INFO] New connection from 206.168.34.56206.168.34.566252001%_ 3O' ossec11301g9New FTP connection.Apr 2 12:16:15 vm1 pure-ftpd[382255]: (?@206.168.34.56) [INFO] New connection from 206.168.34.56206.168.34.566252001[^  -G% ossec13001gۙExim Auth failed2025-04-02 12:09:20 dovecot_login authenticator failed for vps-eed33ea4.vps.ovh.net [51.38.133.48]:37446: 535 Incorrect authentication data (set_id=services)51.38.133.48798544l]  -c) ossec13001gۍExim Auth failed2025-04-02 12:09:08 dovecot_login authenticator failed for ([171.244.142.45]) [171.244.142.45]:7391: 535 Incorrect authentication data (set_id=services@heipowersystem.com)171.244.142.451562822!\  3K% ossec11301gNew FTP connection.Apr 2 11:53:03 vm1 pure-ftpd[376728]: (?@103.74.54.23) [INFO] New connection from 103.74.54.23103.74.54.231269750;[  =q) ossec13008gMail Reciepient rejected2025-04-02 11:50:10 H=(mail.nyaystambh.com) [165.154.242.42]:56252 F= rejected RCPT : Rejected relay attempt: '165.154.242.42' From: 'opegp@nyaystambh.com' To: 'validxxx@gmailhotmail.com.br'165.154.242.421694008'Z  3S) ossec11301guNew FTP connection.Apr 2 11:43:07 vm1 pure-ftpd[374468]: (?@194.165.16.163) [INFO] New connection from 194.165.16.163194.165.16.1632993457ZY  -=+ ossec13001g!Exim Auth failed2025-04-02 11:37:27 dovecot_login authenticator failed for ([116.127.143.140]) [116.127.143.140]:54355: 535 Incorrect authentication data (set_id=sales)116.127.143.1401835841mX  -c+ ossec13001g Exim Auth failed2025-04-02 11:37:07 dovecot_login authenticator failed for ([169.211.232.182]) [169.211.232.182]:48848: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)169.211.232.1821835841 4 % > ? = S S`a1, 4Uy  -7' ossec13001gExim Auth failed2025-04-02 15:44:31 dovecot_login authenticator failed for ([222.67.186.253]) [222.64.21.130]:35884: 535 Incorrect authentication data (set_id=sales)222.64.21.1301814991lx  -a+ ossec13001g Exim Auth failed2025-04-02 15:44:18 dovecot_login authenticator failed for ([136.233.79.218]) [136.232.197.102]:57918: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)136.232.197.1021269750+w  U=% ossec11001g Deferred login on the cpanel service[2025-04-02 15:29:33 +0530] info [webmaild] 157.38.45.86 - kps@amplifypowerglobal.com "POST /cpsess0416556380/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect157.38.45.861269750_v  -K' ossec13001g kExim Auth failed2025-04-02 15:29:05 dovecot_login authenticator failed for ([75.127.205.91]) [75.127.205.91]:49942: 535 Incorrect authentication data (set_id=vikas.khandelwal)75.127.205.916252001nu  -m% ossec13001g ]Exim Auth failed2025-04-02 15:28:53 dovecot_login authenticator failed for ([62.74.208.58]) [62.74.208.58]:38680: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)62.74.208.58390903,t U=% ossec11001g Deferred login on the cpanel service[2025-04-02 15:27:33 +0530] info [webmaild] 157.38.45.86 - kps@amplifypowerglobal.com "POST /cpsess0416556380/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect157.38.45.861269750,s U=% ossec11001g Deferred login on the cpanel service[2025-04-02 15:25:35 +0530] info [webmaild] 157.38.45.86 - kps@amplifypowerglobal.com "POST /cpsess0416556380/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect157.38.45.861269750{r  -) ossec13001gCExim Auth failed2025-04-02 14:20:09 dovecot_login authenticator failed for (abts-north-static-059.221.160.122.airtelbroadband.in) [122.160.221.59]:57290: 535 Incorrect authentication data (set_id=sales)122.160.221.591269750oq  -i) ossec13001g1Exim Auth failed2025-04-02 14:19:52 dovecot_login authenticator failed for vps-e5ece003.vps.ovh.ca [149.56.140.143]:49898: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)149.56.140.1436251999|p  -' ossec13001gExim Auth failed2025-04-02 14:12:50 dovecot_login authenticator failed for v157-7-200-152.cwit.static.cnode.io [157.7.200.152]:51268: 535 Incorrect authentication data (set_id=services@heipowersystem.com)157.7.200.1521861060fo  -W) ossec13001gExim Auth failed2025-04-02 13:43:53 dovecot_login authenticator failed for ([103.100.234.22]) [103.100.234.22]:38046: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)103.100.234.221210997~n  - ' ossec13001gExim Auth failed2025-04-02 13:43:44 dovecot_login authenticator failed for 14-200-247-89.tpgi.com.au [14.200.247.89]:37632: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)14.200.247.892077456{m  -+ ossec13001gExim Auth failed2025-04-02 13:43:28 dovecot_login authenticator failed for ([111.206.233.34]) [123.118.101.233]:38702: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)123.118.101.2331814991cl  -Q) ossec13001g'Exim Auth failed2025-04-02 13:28:31 dovecot_login authenticator failed for adsl-84-226-219-137.adslplus.ch [84.226.219.137]:37264: 535 Incorrect authentication data (set_id=lisa)84.226.219.1372658434`k  -Q# ossec13001gExim Auth failed2025-04-02 13:28:13 dovecot_login authenticator failed for ([31.173.0.26]) [31.173.0.26]:47080: 535 Incorrect authentication data (set_id=lisa@heipowersystem.com)31.173.0.262017370sj  -o+ ossec13001gExim Auth failed2025-04-02 13:26:00 dovecot_login authenticator failed for (208.235.164.124.adsl-pool.sx.cn) [124.164.235.208]:33117: 535 Incorrect authentication data (set_id=vikas.khandelwal)124.164.235.2081814991 " ' 1 S c .@e.8NTV  -9) ossec13001g5JExim Auth failed2025-04-02 18:32:00 dovecot_login authenticator failed for ([102.215.188.37]) [102.215.188.37]:52272: 535 Incorrect authentication data (set_id=sales)102.215.188.37192950g  -[' ossec13001g58Exim Auth failed2025-04-02 18:31:42 dovecot_login authenticator failed for ([166.0.196.227]) [166.0.196.227]:58426: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)166.0.196.2273469034Q  -3# ossec13001g3Exim Auth failed2025-04-02 18:25:47 dovecot_login authenticator failed for ([101.13.5.39]) [101.13.5.39]:53384: 535 Incorrect authentication data (set_id=services)101.13.5.391668284v  -y' ossec13001g3Exim Auth failed2025-04-02 18:25:08 dovecot_login authenticator failed for 110-25-107-43.adsl.fetnet.net [110.25.107.43]:46530: 535 Incorrect authentication data (set_id=services@heipowersystem.com)110.25.107.431668284f  -W) ossec13001g-Exim Auth failed2025-04-02 17:59:49 dovecot_login authenticator failed for ([158.140.35.143]) [158.140.35.143]:53721: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)158.140.35.1436252001r  -u% ossec13001g-Exim Auth failed2025-04-02 17:59:38 dovecot_login authenticator failed for ([194.28.91.40]) [194.28.91.40]:45241: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)194.28.91.406907913  =c' ossec13008g' Mail Reciepient rejected2025-04-02 17:31:36 H=(mail.msnews24.in) [45.197.14.156]:61912 F= rejected RCPT : Rejected relay attempt: '45.197.14.156' From: 'mhxwqkd@msnews24.in' To: 'validxxx@gmailhotmail.com.br'45.197.14.1566252001W  -9) ossec13001g&Exim Auth failed2025-04-02 17:29:44 dovecot_login authenticator failed for ([175.205.191.27]) [175.205.191.27]:35650: 535 Incorrect authentication data (set_id=sales)175.205.191.271835841j  -_) ossec13001g&Exim Auth failed2025-04-02 17:29:31 dovecot_login authenticator failed for ([221.165.172.38]) [221.165.172.38]:34154: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)221.165.172.3818358411  =_' ossec13008g$dMail Reciepient rejected2025-04-02 17:19:55 H=(mail.msnews24.in) [45.197.14.175]:51694 F= rejected RCPT : Rejected relay attempt: '45.197.14.175' From: 'uhcbaf@msnews24.in' To: 'validxxx@gmailhotmail.com.br'45.197.14.1756252001l  -e' ossec13001g"Exim Auth failed2025-04-02 17:12:28 dovecot_login authenticator failed for (thepsindustries.com) [221.229.216.1]:38242: 535 Incorrect authentication data (set_id=admin@thepsindustries.com)221.229.216.11814991Z~  -A' ossec13001g"Exim Auth failed2025-04-02 17:12:01 dovecot_login authenticator failed for (thepsindustries.com) [221.229.216.1]:34740: 535 Incorrect authentication data (set_id=nologin)221.229.216.11814991r}  -s% ossec13001g Exim Auth failed2025-04-02 17:03:50 dovecot_login authenticator failed for (246.50.5.122.broad.yt.sd.dynamic.163data.com.cn) [122.5.50.246]:51462: 535 Incorrect authentication data (set_id=admin)122.5.50.2461814991w|  -# ossec13001g Exim Auth failed2025-04-02 17:03:35 dovecot_login authenticator failed for (95.0.252.72.static.ttnet.com.tr) [95.0.252.72]:56132: 535 Incorrect authentication data (set_id=admin@saintsoldiercollege.com)95.0.252.72298795_{  -O# ossec13001gvExim Auth failed2025-04-02 16:46:05 dovecot_login authenticator failed for 210.0.90.81.static.nexnet.net.au [210.0.90.81]:42618: 535 Incorrect authentication data (set_id=sales)210.0.90.812077456wz  -y) ossec13001gjExim Auth failed2025-04-02 16:45:52 dovecot_login authenticator failed for (207.122.87.116.starhub.net.sg) [116.87.122.207]:43698: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)116.87.122.2071880251 l   / "LJ;?<BZlj  -_) ossec13001gkNExim Auth failed2025-04-02 22:22:29 dovecot_login authenticator failed for ([103.163.44.118]) [103.163.44.118]:33004: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)103.163.44.1181269750d  -U' ossec13001gbExim Auth failed2025-04-02 21:46:31 dovecot_login authenticator failed for ([114.143.137.92]) [49.36.123.143]:33156: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)49.36.123.1431269750v  -y' ossec13001gbExim Auth failed2025-04-02 21:46:20 dovecot_login authenticator failed for ([121.166.85.53]) [121.166.85.53]:47442: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)121.166.85.531835841  -+ ossec13001g^Exim Auth failed2025-04-02 21:29:17 dovecot_login authenticator failed for p4343175-ipxg22901hodogaya.kanagawa.ocn.ne.jp [153.174.235.175]:56558: 535 Incorrect authentication data (set_id=vikas.khandelwal)153.174.235.1751861060x  -y+ ossec13001g^Exim Auth failed2025-04-02 21:29:04 dovecot_login authenticator failed for ([178.178.194.128]) [178.178.194.128]:52478: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)178.178.194.1282017370   [w% ossec12004gVPossible Dovecot CVE-2019-11500 attemptApr 2 20:55:11 vm1 dovecot[1526]: imap-login: Disconnected: Input buffer full (no auth attempts in 1 secs): user=<>, rip=18.227.72.72, lip=103.74.54.108, session=18.227.72.726252001~  -+ ossec13001gNExim Auth failed2025-04-02 20:20:52 dovecot_login authenticator failed for 217-209-148-151-no600.tbcn.telia.com [217.209.148.151]:36356: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)217.209.148.1512661886R  -5' ossec13001gNExim Auth failed2025-04-02 20:21:09 dovecot_login authenticator failed for ([93.191.115.52]) [93.191.115.54]:52569: 535 Incorrect authentication data (set_id=sales)93.191.115.5499237Q  -3# ossec13001gMExim Auth failed2025-04-02 20:13:32 dovecot_login authenticator failed for ([1.31.80.166]) [1.31.80.166]:46244: 535 Incorrect authentication data (set_id=services)1.31.80.1661814991j  -a' ossec13001gMExim Auth failed2025-04-02 20:13:16 dovecot_login authenticator failed for ([45.250.249.12]) [45.250.249.12]:38560: 535 Incorrect authentication data (set_id=services@heipowersystem.com)45.250.249.121269750  3C! ossec11301gJNew FTP connection.Apr 2 20:04:36 vm1 pure-ftpd[489021]: (?@65.49.1.56) [INFO] New connection from 65.49.1.5665.49.1.566252001'  3S) ossec11301gINew FTP connection.Apr 2 20:00:13 vm1 pure-ftpd[488141]: (?@167.94.138.201) [INFO] New connection from 167.94.138.201167.94.138.2016252001c  -S' ossec13001gFExim Auth failed2025-04-02 19:46:25 dovecot_login authenticator failed for ([149.7.203.123]) [149.7.203.123]:36467: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)149.7.203.1232782113v  -y' ossec13001gFExim Auth failed2025-04-02 19:46:06 dovecot_login authenticator failed for ([123.212.9.122]) [123.212.9.122]:33641: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)123.212.9.1221835841o  -m% ossec13001gCExim Auth failed2025-04-02 19:34:28 dovecot_login authenticator failed for (s2seducationtrust.com) [119.96.131.8]:51894: 535 Incorrect authentication data (set_id=office@s2seducationtrust.com)119.96.131.81814991Z  -C% ossec13001gCExim Auth failed2025-04-02 19:34:03 dovecot_login authenticator failed for (s2seducationtrust.com) [119.96.131.8]:48794: 535 Incorrect authentication data (set_id=nologin)119.96.131.81814991  -?+ ossec13001gCExim Auth failed2025-04-02 19:30:49 dovecot_login authenticator failed for (abts-north-static-194.142.160.122.airtelbroadband.in) [117.247.239.202]:47766: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)117.247.239.2021269750 u}pcVI</"yl_RE8+~qdWJ=0# zm`SF9, v i \ O B 5 (     r e X K > 1 $  { n a T G : -   w j ] P C 6 )    s f Y L ? 2 %  |obUH;.!xk^QD7*tgZM@3& uh[NA4' ~qdWJ=0YMA5 6252001D 6252001D 6252001D 6252001D 6252001D 6252001D 6252001D 6252001D 6252001D 6252001A 6252001A 6252001A 6252001A 6252001A 6252001@ 6252001@ 6252001@ 6252001@ 6252001@ 6252001@ 6252001@ 6252001@ 6252001@ 6252001@ 6252001@ 6252001@ 6252001@ 6252001@ 6252001@ 6252001@ 6252001@ 6252001@ 6252001@} 6252001@| 6252001@f 6252001@e 6252001@d 6252001@a 6252001@` 6252001@S 6252001@? 6252001@; 6252001D 6252001D 6252001D 6252001D 6252001D 6252001D 6252001D 6252001D 6252001D 6252001D 6252001D 6252001D 6252001D 6252001D 6252001D 6252001D 6252001D 6252001D 6252001D 6252001D 6252001D 6252001D 6252001D 6252001D 6252001D 6252001D 6252001D 6252001D 6252001D 6252001D 6252001D 6252001D 6252001D 6252001D 6252001D 6252001D 6252001D 6252001D 6252001D 6252001D 6252001D 6252001D 6252001D 6252001Dw 6252001Du 6252001Dq 6252001Dk 6252001Df 6252001Db 6252001DR 6252001DG 6252001DF 6252001DC 6252001D? 6252001D; 6252001D: 6252001D9 6252001D6 6252001D5 6252001D0 6252001D/ 6252001D. 6252001D- 6252001D! 6252001D 6252001D 6252001D 6252001D 6252001D 6252001C 6252001C 6252001C 6252001C 6252001C 6252001C 6252001C 6252001C 6252001C 6252001C 6252001C 6252001C 6252001C 6252001C 6252001C 6252001C 6252001C 6252001C 6252001C 6252001C~ 6252001Cz 6252001Cq 6252001Cp 6252001Co 6252001Cl 6252001Ca 6252001C` 6252001CR 6252001CQ 6252001CP 6252001CL 6252001CC 6252001C. 6252001C$ 6252001C" 6252001B 6252001B 6252001B 6252001B 6252001B 6252001B 6252001B 6252001B 6252001B 6252001B 6252001B 6252001B 6252001B 6252001B 6252001B 6252001B 6252001B 6252001B 6252001B 6252001B 6252001B 6252001B 6252001B 6252001B 6252001B 6252001B 6252001B 6252001B 6252001Bu 6252001Bt 6252001Bl 6252001Bk 6252001Bj 6252001Bi 6252001Bh 6252001Bd 6252001Ba 6252001B_ 6252001BU 6252001BR 6252001BL 6252001BD 6252001B? 6252001B> 6252001B4 6252001B3 6252001B! 6252001B 6252001B 6252001B 6252001B 6252001A 6252001A 6252001A 6252001A 6252001A 6252001A 6252001A 6252001A 6252001A 6252001A 6252001A 6252001A 6252001A 6252001A 6252001A 6252001A 6252001A 6252001A 6252001Ap 6252001Al 6252001AZ 6252001AI 6252001AH 6252001AB 6252001A4 6252001A3 6252001A2 6252001A1 6252001A0 6252001A/ 6252001A. 6252001A- 6252001A, 6252001A+ 6252001A* 6252001A) 6252001A( 6252001A' 6252001A& 6252001A% 6252001A$ 6252001A" 6252001A! 6252001A 6252001A 6252001A 6252001A 6252001A 6252001A 6252001A ~qdWJ=0# zm`SF9, v i \ O B 5 (     r e X ~qdWJ=0# z`SF9,vi\O5( K > 1 $ mB } p c V I < / "   y l _ R E 8 +    u h [ N A 4 '  1643084O: 1643084O 1643084N 1643084L 1655842K 1643084K] 1643084J$ 1643084I 1643084Ib 1643084IV 1643084I 1643084H 1643084HH 1655842H# 1643084H 1643084G 1643084G 1643084G 1643084G 1643084F 1655842F 1643084F 1643084FM 1643084F$ 1643084F 1643084EC 1643084E> 1655842E0 1643084D 1655842D 1643084Dg 1643084C 1643084C' 1643084B 1643084Bb 1643084B 1655842A 1643084A 1643084A 1643084Ac 1643084@ 1643084@Y 1643084? 1643084? 1643084?m 1643084?\ 1643084? 1643084= 1643084=z 1643084= 1643084= 1643084< 1643084< 1643084< 1643084< 1643084< 1643084< 1643084< 1643084: 1643084: 16558429 164308499 164308493 16430848 16430848d 16430848R 16430847 16430847 16430847 1668284G 1668284 1668284 1668284? 1668284 1668284 1668284 1668284 1668284 1668284 1668284 1668284 1668284\ 1668284 1668284 1668284 1668284 1668284 1668284t 1668284* 1668284( 1668284 1668284 1668284 1668284 1668284 1668284 1668284 1668284 1668284 1668284 1668284 1668284 1668284 1668284 1668284j 1668284g 1668284a 1668284R 1668284M 1668284? 1668284= 1668284< 1668284; 1668284 1668284 1668284 1668284 1668284 1668284 1668284 1668284 1668284 1668284 1668284 1668284 1668284 1668284z 1668284m 1655842. 1655842- 1655842+ 1655842)9 1655842)8 16430846 16430846 16430845 16430845. 16430844 164308441 16430844 16430843 16430843V 16430842 164308425 16430842 16430841} 16430841F 16430840 1643084/~ 1643084. 1643084-h 1643084- 1643084+Z 1643084* 1643084*_ 1643084* 1643084) 1643084( 1643084( 1643084(] 1643084(' 1643084' 1643084' 1643084& 1643084& 1643084& 1643084% 1643084% 1643084$ 1643084# 1643084"M 1643084" 1643084! 1643084! 1643084! 1643084! 1643084 1643084 1643084 1643084y 1643084& 1643084" 1643084 1643084G 1643084w 1643084{ 1643084E 1643084 1643084 1643084 1643084 1643084 1643084 1643084 1643084 1643084 1643084x 1643084 1643084H 1643084D 1643084; 1643084 1643084 1643084 1643084Q 1 < ? X rwu" +  Qk) ossec11000g탷Login failed on the cpanel service[2025-04-03 00:06:37 +0530] info [cpaneld] 104.207.45.187 - admin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)104.207.45.1876252001*  Qq' ossec11000g탳Login failed on the cpanel service[2025-04-03 00:06:34 +0530] info [cpaneld] 156.228.90.98 - msnews2 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user msnews2 (has_cpuser_file failed)156.228.90.986252001 )  Q) ossec11000g탳Login failed on the cpanel service[2025-04-03 00:06:34 +0530] info [cpaneld] 156.228.88.212 - msnews24in "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user msnews24in (has_cpuser_file failed)156.228.88.2126252001(  ?/ ossec1008g탳Process exiting (killed).Apr 3 00:06:34 vm1 spamd[216144]: spamd: server killed by SIGTERM, shutting down`'  -O% ossec13001gExim Auth failed2025-04-02 23:49:22 dovecot_login authenticator failed for ([149.54.51.74]) [149.54.51.74]:57840: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)149.54.51.741149361~&  - ' ossec13001gExim Auth failed2025-04-02 23:49:11 dovecot_login authenticator failed for 126.64.125.78.rev.sfr.net [78.125.64.126]:47078: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)78.125.64.1263017382`%  -O% ossec13001gExim Auth failed2025-04-02 23:46:57 dovecot_login authenticator failed for 111-70-13-53.emome-ip.hinet.net [111.70.13.53]:37349: 535 Incorrect authentication data (set_id=sales)111.70.13.531668284~$  -+ ossec13001gExim Auth failed2025-04-02 23:46:34 dovecot_login authenticator failed for 217-209-148-151-no600.tbcn.telia.com [217.209.148.151]:42982: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)217.209.148.1512661886w#  -}% ossec13001g{ZExim Auth failed2025-04-02 23:30:57 dovecot_login authenticator failed for 200.19.70.86.rev.sfr.net [86.70.19.200]:53448: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)86.70.19.2003017382b"  -O) ossec13001g{lExim Auth failed2025-04-02 23:31:15 dovecot_login authenticator failed for ([218.150.170.10]) [218.150.170.10]:43116: 535 Incorrect authentication data (set_id=vikas.khandelwal)218.150.170.101835841c!  -O+ ossec13001guExim Auth failed2025-04-02 23:06:07 dovecot_login authenticator failed for 184.sub-166-143-153.myvzw.com [166.143.153.184]:37566: 535 Incorrect authentication data (set_id=test)166.143.153.1846252001y  -}) ossec13001gulExim Auth failed2025-04-02 23:05:39 dovecot_login authenticator failed for (188.242.173.51.pool.sknt.ru) [188.242.173.51]:54874: 535 Incorrect authentication data (set_id=test@saintsoldiercollege.com)188.242.173.512017370$  3O' ossec11301gq New FTP connection.Apr 2 22:46:58 vm1 pure-ftpd[525814]: (?@167.94.138.49) [INFO] New connection from 167.94.138.49167.94.138.496252001$  3O' ossec11301gpNew FTP connection.Apr 2 22:45:18 vm1 pure-ftpd[525388]: (?@198.235.24.81) [INFO] New connection from 198.235.24.81198.235.24.816252001!  3K% ossec11301goNew FTP connection.Apr 2 22:42:00 vm1 pure-ftpd[524729]: (?@103.74.54.23) [INFO] New connection from 103.74.54.23103.74.54.231269750Z  -=+ ossec13001gkExim Auth failed2025-04-02 22:23:30 dovecot_login authenticator failed for ([221.159.179.177]) [221.159.179.177]:39492: 535 Incorrect authentication data (set_id=sales)221.159.179.1771835841m  -c+ ossec13001gkpExim Auth failed2025-04-02 22:23:03 dovecot_login authenticator failed for ([121.170.218.142]) [121.170.218.142]:53428: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)121.170.218.1421835841   &   * ?PF[X;  -?% ossec13001g허Exim Auth failed2025-04-03 01:31:11 dovecot_login authenticator failed for (thepsindustries.com) [60.2.243.174]:57800: 535 Incorrect authentication data (set_id=nologin)60.2.243.1741814991f:  -W) ossec13001g핰Exim Auth failed2025-04-03 01:23:19 dovecot_login authenticator failed for ([119.62.156.161]) [119.62.156.161]:40364: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)119.62.156.1611814991|9  -+ ossec13001g핢Exim Auth failed2025-04-03 01:23:05 dovecot_login authenticator failed for ([121.164.135.251]) [121.164.135.251]:44905: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)121.164.135.2511835841W8  -9) ossec13001gExim Auth failed2025-04-03 01:20:07 dovecot_login authenticator failed for ([168.126.90.210]) [168.126.90.210]:40432: 535 Incorrect authentication data (set_id=sales)168.126.90.2101835841~7  -) ossec13001gExim Auth failed2025-04-03 01:19:45 dovecot_login authenticator failed for (163.pool90-160-139.dynamic.orange.es) [90.160.139.163]:55003: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)90.160.139.1632510769Q6  -1% ossec13001g툄Exim Auth failed2025-04-03 00:27:07 dovecot_login authenticator failed for ([14.35.218.58]) [14.35.218.58]:46691: 535 Incorrect authentication data (set_id=sales)14.35.218.581835841g5  -[' ossec13001glExim Auth failed2025-04-03 00:26:43 dovecot_login authenticator failed for ([103.48.194.21]) [103.48.194.21]:50230: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)103.48.194.2115628224  Qu' ossec11000g탱Login failed on the cpanel service[2025-04-03 00:06:33 +0530] info [cpaneld] 104.207.58.82 - msnews24 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user msnews24 (has_cpuser_file failed)104.207.58.826252001k3  Q=) ossec11000g탽Login failed on the cpanel service[2025-04-03 00:06:45 +0530] info [whostmgrd] 156.228.125.41 - admin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect156.228.125.416252001g2  Q9% ossec11000g탹Login failed on the cpanel service[2025-04-03 00:06:39 +0530] info [whostmgrd] 156.228.98.7 - admin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect156.228.98.76252001h1  Q9' ossec11000g탷Login failed on the cpanel service[2025-04-03 00:06:38 +0530] info [whostmgrd] 156.228.82.95 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect156.228.82.9562520010  Qm+ ossec11000g탵Login failed on the cpanel service[2025-04-03 00:06:35 +0530] info [cpaneld] 156.228.117.105 - admin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)156.228.117.1056252001/  Qm+ ossec11000g탱Login failed on the cpanel service[2025-04-03 00:06:31 +0530] info [cpaneld] 156.228.102.187 - admin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)156.228.102.1876252001o.  QC+ ossec11000g탽Login failed on the cpanel service[2025-04-03 00:06:43 +0530] info [whostmgrd] 156.228.110.251 - msnews2 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect156.228.110.2516252001p-  QG) ossec11000g탻Login failed on the cpanel service[2025-04-03 00:06:42 +0530] info [whostmgrd] 156.228.86.203 - msnews24in "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect156.228.86.2036252001o, QC) ossec11000g탹Login failed on the cpanel service[2025-04-03 00:06:41 +0530] info [whostmgrd] 156.228.124.99 - msnews24 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect156.228.124.996252001   % P0&{5K  =g' ossec13008gyMail Reciepient rejected2025-04-03 04:59:59 H=(mail.msnews24.in) [45.197.14.156]:57568 F= rejected RCPT : Rejected relay attempt: '45.197.14.156' From: 'rzhisrhk@msnews24.in' To: 'validxxx@gmailhotmail.com.br'45.197.14.1566252001fJ  -W) ossec13001gExim Auth failed2025-04-03 04:23:52 dovecot_login authenticator failed for ([117.205.175.91]) [117.205.175.91]:53288: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)117.205.175.911269750mI  -m! ossec13001gExim Auth failed2025-04-03 04:23:39 dovecot_login authenticator failed for ([182.54.3.2]) [182.54.3.2]:32919: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)182.54.3.21814991'H  3S) ossec11301gNew FTP connection.Apr 3 04:01:28 vm1 pure-ftpd[592727]: (?@64.225.106.199) [INFO] New connection from 64.225.106.19964.225.106.1992921044'G  3S) ossec11301gNew FTP connection.Apr 3 04:01:27 vm1 pure-ftpd[592725]: (?@167.172.182.47) [INFO] New connection from 167.172.182.47167.172.182.472921044F  -+ ossec13001gExim Auth failed2025-04-03 03:43:38 dovecot_login authenticator failed for 145.173.198.203.static.netvigator.com [203.198.173.145]:47629: 535 Incorrect authentication data (set_id=contact@saintsoldiercollege.com)203.198.173.1451819730!E  3K% ossec11301gNew FTP connection.Apr 3 03:07:25 vm1 pure-ftpd[581901]: (?@35.202.9.133) [INFO] New connection from 35.202.9.13335.202.9.1336252001;D  =o+ ossec13008gMail Reciepient rejected2025-04-03 02:23:39 H=(mail.msnews24.in) [165.154.210.189]:55606 F= rejected RCPT : Rejected relay attempt: '165.154.210.189' From: 'ovalypbq@msnews24.in' To: 'validxxx@gmailhotmail.com.br'165.154.210.18916940088C  =k) ossec13008gwMail Reciepient rejected2025-04-03 02:22:06 H=(mail.msnews24.in) [165.154.210.99]:55958 F= rejected RCPT : Rejected relay attempt: '165.154.210.99' From: 'vdantpcc@msnews24.in' To: 'validxxx@gmailhotmail.com.br'165.154.210.991694008QB  -1% ossec13001gExim Auth failed2025-04-03 02:18:43 dovecot_login authenticator failed for ([203.29.84.253]) [203.63.46.34]:1186: 535 Incorrect authentication data (set_id=sales)203.63.46.342077456ZA  -=+ ossec13001gExim Auth failed2025-04-03 02:18:33 dovecot_login authenticator failed for ([122.187.230.116]) [122.187.230.116]:50135: 535 Incorrect authentication data (set_id=sales)122.187.230.1161269750d@  -W% ossec13001gExim Auth failed2025-04-03 02:18:14 dovecot_login authenticator failed for ([1.224.58.243]) [1.224.58.243]:56887: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)1.224.58.2431835841m?  -k% ossec13001gExim Auth failed2025-04-03 02:18:18 dovecot_login authenticator failed for 95-87-213-16.ip.btc-net.bg [95.87.213.16]:46180: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)95.87.213.16732800i>  -_' ossec13001g Exim Auth failed2025-04-03 02:07:30 dovecot_login authenticator failed for c-73-199-208-99.hsd1.nj.comcast.net [73.199.208.99]:47391: 535 Incorrect authentication data (set_id=services)73.199.208.996252001s=  -u' ossec13001gExim Auth failed2025-04-03 02:07:18 dovecot_login authenticator failed for 126-203-29-85.dyn.estpak.ee [85.29.203.126]:46719: 535 Incorrect authentication data (set_id=services@heipowersystem.com)85.29.203.126453733<<  =s) ossec13008g:Mail Reciepient rejected2025-04-03 02:04:01 H=(mail.msnews24.in) [165.154.210.52]:65314 F= rejected RCPT : Rejected relay attempt: '165.154.210.52' From: 'aqxkudtaif@msnews24.in' To: 'validxxx@gmailhotmail.com.br'165.154.210.521694008   C 47qT\  -5' ossec13001gQExim Auth failed2025-04-03 07:11:35 dovecot_login authenticator failed for ([213.154.80.21]) [213.154.80.51]:60188: 535 Incorrect authentication data (set_id=sales)213.154.80.512245662m[  -c+ ossec13001gEExim Auth failed2025-04-03 07:11:24 dovecot_login authenticator failed for ([175.156.224.192]) [175.156.224.192]:32964: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)175.156.224.1921880251eZ  -U) ossec13001gExim Auth failed2025-04-03 07:01:12 dovecot_login authenticator failed for (173-20-253-109.client.mchsi.com) [173.20.253.109]:33676: 535 Incorrect authentication data (set_id=info)173.20.253.1096252001eY  -[# ossec13001gExim Auth failed2025-04-03 07:00:56 dovecot_login authenticator failed for ([14.54.22.11]) [14.54.22.11]:59409: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)14.54.22.111835841#X  3O' ossec11301g New FTP connection.Apr 3 06:57:38 vm1 pure-ftpd[629486]: (?@93.123.109.35) [INFO] New connection from 93.123.109.3593.123.109.35732800[W  -G% ossec13001gaExim Auth failed2025-04-03 06:50:33 dovecot_login authenticator failed for ([185.226.88.5]) [185.226.88.5]:58514: 535 Incorrect authentication data (set_id=vikas.khandelwal)185.226.88.5783754 rejected RCPT : Rejected relay attempt: '165.154.210.99' From: 'dzxmfjyrtq@msnews24.in' To: 'validxxx@gmailhotmail.com.br'165.154.210.991694008yU  -' ossec13001gWExim Auth failed2025-04-03 06:50:23 dovecot_login authenticator failed for vps-b674cd8d.vps.ovh.net [51.68.226.171]:36174: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)51.68.226.1713017382\T -E% ossec13001g߳Exim Auth failed2025-04-03 06:39:06 dovecot_login authenticator failed for (amplifypowerglobal.com) [150.5.145.36]:52710: 535 Incorrect authentication data (set_id=nologin)150.5.145.361880251[S  -?+ ossec13001g۪Exim Auth failed2025-04-03 06:21:53 dovecot_login authenticator failed for ([103.115.254.158]) [103.115.254.158]:38212: 535 Incorrect authentication data (set_id=office)103.115.254.1581210997R  -+ ossec13001g۠Exim Auth failed2025-04-03 06:21:42 dovecot_login authenticator failed for (ws249-241-252-122.rcil.gov.in) [122.252.241.249]:53641: 535 Incorrect authentication data (set_id=office@saintsoldiercollege.com)122.252.241.2491269750$Q  3O' ossec11301gىNew FTP connection.Apr 3 06:12:48 vm1 pure-ftpd[620158]: (?@88.214.25.122) [INFO] New connection from 88.214.25.12288.214.25.1222921044!P  3K% ossec11301gثNew FTP connection.Apr 3 06:09:06 vm1 pure-ftpd[619309]: (?@139.162.77.6) [INFO] New connection from 139.162.77.6139.162.77.61861060TO  -5' ossec13001gExim Auth failed2025-04-03 05:15:07 dovecot_login authenticator failed for ([166.0.196.227]) [166.0.196.227]:57830: 535 Incorrect authentication data (set_id=sales)166.0.196.2273469034WN  -9) ossec13001gExim Auth failed2025-04-03 05:15:22 dovecot_login authenticator failed for ([118.41.142.164]) [118.41.142.164]:44411: 535 Incorrect authentication data (set_id=sales)118.41.142.1641835841jM  -_) ossec13001gExim Auth failed2025-04-03 05:14:52 dovecot_login authenticator failed for ([103.194.249.82]) [103.194.249.82]:55726: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)103.194.249.821269750L  -=' ossec13001gExim Auth failed2025-04-03 05:14:51 dovecot_login authenticator failed for 131-106-31-52.s1842.c3-0.eas-cbr5.atw-eas.pa.cable.rcncustomer.com [131.106.31.52]:33156: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)131.106.31.526252001 " v )=``ws}+m 3W+ ossec11301gCNew FTP connection.Apr 3 08:58:02 vm1 pure-ftpd[657173]: (?@154.212.141.204) [INFO] New connection from 154.212.141.204154.212.141.2041819730ll  -a+ ossec13001gExim Auth failed2025-04-03 08:42:53 dovecot_login authenticator failed for 217-209-148-151-no600.tbcn.telia.com [217.209.148.151]:50132: 535 Incorrect authentication data (set_id=office)217.209.148.1512661886k  -% ossec13001gExim Auth failed2025-04-03 08:42:43 dovecot_login authenticator failed for host-95-228-33-80.business.telecomitalia.it [95.228.33.80]:39279: 535 Incorrect authentication data (set_id=office@saintsoldiercollege.com)95.228.33.803175395ij  -_' ossec13001gExim Auth failed2025-04-03 08:21:44 dovecot_login authenticator failed for syn-131-148-000-202.biz.spectrum.com [131.148.0.202]:57474: 535 Incorrect authentication data (set_id=contact)131.148.0.2026252001i  - ' ossec13001gExim Auth failed2025-04-03 08:21:15 dovecot_login authenticator failed for syn-097-086-134-216.res.spectrum.com [97.86.134.216]:1755: 535 Incorrect authentication data (set_id=contact@saintsoldiercollege.com)97.86.134.2166252001eh  -W' ossec13001gVExim Auth failed2025-04-03 08:07:08 dovecot_login authenticator failed for 81-230-83-162-no600.tbcn.telia.com [81.230.83.162]:58704: 535 Incorrect authentication data (set_id=sales)81.230.83.1622661886|g  -) ossec13001gHExim Auth failed2025-04-03 08:06:55 dovecot_login authenticator failed for syn-098-102-148-242.biz.spectrum.com [98.102.148.242]:54896: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)98.102.148.2426252001Yf  -;+ ossec13001ggExim Auth failed2025-04-03 07:58:55 dovecot_login authenticator failed for ([222.189.211.114]) [222.189.211.114]:59180: 535 Incorrect authentication data (set_id=test)222.189.211.1141814991he  -_% ossec13001gSExim Auth failed2025-04-03 07:58:34 dovecot_login authenticator failed for ([106.3.192.21]) [106.3.192.21]:58536: 535 Incorrect authentication data (set_id=test@saintsoldiercollege.com)106.3.192.211814991Qd  -3# ossec13001gExim Auth failed2025-04-03 07:57:13 dovecot_login authenticator failed for ([45.170.50.2]) [45.170.50.2]:52449: 535 Incorrect authentication data (set_id=services)45.170.50.23932488gc  -]% ossec13001gExim Auth failed2025-04-03 07:56:59 dovecot_login authenticator failed for ([183.6.43.236]) [183.6.43.236]:47735: 535 Incorrect authentication data (set_id=services@heipowersystem.com)183.6.43.2361814991Tb  -7% ossec13001gHExim Auth failed2025-04-03 07:32:47 dovecot_login authenticator failed for ([103.177.205.100]) [58.84.60.229]:14598: 535 Incorrect authentication data (set_id=admin)58.84.60.2291269750la  -e' ossec13001g:Exim Auth failed2025-04-03 07:32:33 dovecot_login authenticator failed for ([103.15.60.138]) [103.15.60.138]:37294: 535 Incorrect authentication data (set_id=admin@saintsoldiercollege.com)103.15.60.1381269750A`  gS) ossec11307gMultiple connection attempts from same sourceApr 3 07:22:52 vm1 pure-ftpd[634827]: (?@165.232.78.237) [INFO] New connection from 165.232.78.237165.232.78.2372921044(_ 3S) ossec11301g New FTP connection.Apr 3 07:22:48 vm1 pure-ftpd[634809]: (?@165.232.78.237) [INFO] New connection from 165.232.78.237165.232.78.2372921044]^  -K# ossec13001g/Exim Auth failed2025-04-03 07:15:18 dovecot_login authenticator failed for ([103.55.89.5]) [103.55.89.5]:58380: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)103.55.89.51269750y]  -}) ossec13001g%Exim Auth failed2025-04-03 07:15:08 dovecot_login authenticator failed for ([161.35.200.202]) [161.35.200.202]:47606: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)161.35.200.2022921044 ~qdWJ=0# zm`SF9, v i \ O B 5 (     r e X K > 1 $  { n a T G : -   w j ] P C 6 )    s f Y L ? 2 %  |obUH;.!xk^QD7*tgZM@3& }pcVI</"yl_RE8+uh[NA4' ~qdWJ=0 1814991= 1814991= 1814991= 1814991= 1814991= 1814991= 1814991= 1814991= 1814991= 1814991= 1814991= 1814991= 1814991= 1814991= 1814991= 1814991= 1814991=y 1814991=x 1814991=w 1814991=f 1814991=a 1814991=] 1814991=\ 1814991=R 1814991=Q 1814991=P 1814991=N 1814991=M 1814991=J 1814991=; 1814991=: 1814991=9 1814991=8 1814991=6 1814991=" 1814991= 1814991= 1814991= 1814991= 1814991= 1814991= 1814991= 1814991= 1814991= 1814991= 1814991= 1814991< 1814991< 1814991< 1814991< 1814991< 1814991< 1814991< 1814991< 1814991< 1814991< 1814991< 1814991< 1814991< 1814991< 1814991< 1814991< 1814991< 1814991< 1814991< 1814991< 1814991< 1814991< 1814991<| 1814991 1814991;= 1814991;; 1814991;: 1814991;9 1814991;7 1814991;- 1814991;, 1814991;+ 1814991;* 1814991;) 1814991;( 1814991;' 1814991;& 1814991;% 1814991;$ 1814991;# 1814991;" 1814991;! 1814991; 1814991; 1814991; 1814991; 1814991; 1814991; 1814991; 1814991; 1814991; 1814991; 1814991; 1814991: 1814991: 1814991: 1814991: 1814991: 1814991: 1814991: 1814991: 1814991: 1814991: 1814991: 1814991: 1814991: 1814991: 1814991: 1814991: 1814991: 1814991: 1814991: 1814991: 1814991: 1814991: 1814991: 1814991: 1814991: 1814991: 1814991: 1814991: 1814991: 1814991: 1814991: 1814991: 1814991: 1814991: 1814991: 1814991: 1814991: 1814991: 1814991: 1814991: 1814991: 1814991: 1814991: 1814991: 1814991: 1814991: 1814991: 1814991: 1814991: 1814991: 1814991: 1814991: 1814991: 1814991: 1814991: 1814991: 1814991: 1814991: 1814991: 1814991: *\~tj`VLB8.$zpf\H>4*   v l b X N D : 0 &    ~ t j ` V L B 8 . $    z p f \ R H > 4 *  vlbXND:0&|rhT^J@6,"xndPZF<( 2~tj`VLB8.$zpf\ | r h ^ T J @ 6 , "    x n d Z P F < 2 (   RRH>4*  vlbXND:0& gv47 gt7 gtx7 gnz7 gnf7 gmn7 gmf7 gmb7 gmt7 gl7 gl7 gk7 gj7 gj7 gj7 gi7 gi7 gi7 gg7 gg7 gg7 gg7 gf7 gf7 gf7 ge\7 ge\7 gc7 gc7 gb7 gb7 gb7 gb7 gaQ7 gag7 g_ 7 g_47 g_(7 g]7 g]7 g]7 g]7 g]7 g]7 g]7 g]7 g]7 g]7 g[7 g[7 g[7 g[7 gZA7 gZ/7 gW 7 gT7 gT7 gQ7 gQ7 gM7 gM7 gL7 gL7 gL7 gI7 gE7 gE7 gE<7 gE.7 gE 7 gD7 gB7 gB7 g>T7 g<7 g<7 g97 g97 g8&7 g87 g667 g67 g2Q7 g2A7 g.g7 g.Q7 g*7 g*|7 g*f7 g*7 g)7 g&7 g#7 g#7 g#=7 g#17 g7 g7 g7 g7 g7 g7 g 7 gq7 gg7 g7 g7 g7 g*7 g77 g7 g7 g7~ gy7} g7| g7{ g%7z g7y g 7x g :7w g 07v g 7u g 7t g|7s gv7r g7q g7p g7o g7n gC7m g7l g7k g7j g7i gV7h gH7g gg7f gS7e g7d g7c gH7b g:7a g7` g7_ g/7^ g%7] gQ7\ gE7[ g7Z g7Y g 7X ga7W g[7V gW7U g߳7T g۪7S g۠7R gى7Q gث7P g7N g7O g7M g7L gy7K g7J g7I g7H g7G g7F g7E g-8 g@8 g8 g8 gA8 g38 g8 g8 g 8 g8 g8 g8 g8 g8 g8 g8 g~8 g~8 g}8 g}8 g|8 g|8 g{8 g{8 gz8 gz8 gz7 gz7 gz7 gy7 gy7 gy}7 gy}7 gx7 gx7 gx}7 gxs7 gx7 gwS7 gwS7 gvb7 gv87 gv87 g7D gw7C g7B g7A g7? g7@ g 7> g7= g:7< g허7; g핰7: g핢79 g78 g77 g툄76 gl75 g탽73 g탽7. g탻7- g탹72 g탹7, g탷71 g탷7+ g탵70 g탳7* g탳7) g탳7( g탱74 g탱7/ g7' g7& g7% g7$ g{l7" g{Z7# gu7! gul7 gq 7 gp7 go7 gk7 gkp7 gq8 gkN7 gb7 gb7 g^7 g^7 gV7 gN7 gN7 gM7 gM7 gJ7 gI7 gF7 gF7 gC7 gC7 gC7 g5J7 g587 g37 g37 g-7 g-7 g' 7 g&7 g&7 g$d7 g"6 g"6 g 6 g 6 gv6 gj6 g6 g 6 g 6 g k6 g ]6 g 6 g 6 gC6 g16 + > d   $Nb8Ean`~  -O% ossec13001gExim Auth failed2025-04-03 10:07:27 dovecot_login authenticator failed for ([211.62.119.4]) [211.62.119.4]:53424: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)211.62.119.41835841o}  -m' ossec13001gyExim Auth failed2025-04-03 10:07:12 dovecot_login authenticator failed for rplus.dp.ua [77.109.33.120]:53926: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)77.109.33.120690791`|  -M' ossec13001gExim Auth failed2025-04-03 10:03:44 dovecot_login authenticator failed for p5df1e80e.dip0.t-ipconnect.de [93.241.232.14]:59495: 535 Incorrect authentication data (set_id=sales)93.241.232.142921044o{  -m% ossec13001gExim Auth failed2025-04-03 10:03:33 dovecot_login authenticator failed for (103.3.246.91.bteleport.ru) [91.246.3.103]:59720: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)91.246.3.1032017370Oz  =) ossec13008g%Mail Reciepient rejected2025-04-03 09:57:15 H=(mail.heipowersystem.com) [165.154.213.26]:63886 F= rejected RCPT : Rejected relay attempt: '165.154.213.26' From: 'uepwvmvmb@heipowersystem.com' To: 'validxxx@gmailhotmail.com.br'165.154.213.263469034Sy  -3' ossec13001gExim Auth failed2025-04-03 09:56:43 dovecot_login authenticator failed for ([211.223.41.90]) [211.223.41.90]:34566: 535 Incorrect authentication data (set_id=test)211.223.41.901835841hx  -_% ossec13001g Exim Auth failed2025-04-03 09:56:28 dovecot_login authenticator failed for ([110.35.63.27]) [110.35.63.27]:56262: 535 Incorrect authentication data (set_id=test@saintsoldiercollege.com)110.35.63.271835841Rw  -3% ossec13001g :Exim Auth failed2025-04-03 09:44:49 dovecot_login authenticator failed for ([116.6.125.26]) [116.6.125.26]:10011: 535 Incorrect authentication data (set_id=office)116.6.125.261814991pv  -k) ossec13001g 0Exim Auth failed2025-04-03 09:44:38 dovecot_login authenticator failed for ([182.72.255.137]) [152.52.243.154]:36132: 535 Incorrect authentication data (set_id=office@saintsoldiercollege.com)152.52.243.1541269750ju  -]+ ossec13001g Exim Auth failed2025-04-03 09:42:53 dovecot_login authenticator failed for 119247187113.ctinets.com [119.247.187.113]:47919: 535 Incorrect authentication data (set_id=vikas.khandelwal)119.247.187.1131819730{t  -' ossec13001g Exim Auth failed2025-04-03 09:42:43 dovecot_login authenticator failed for 126-203-29-85.dyn.estpak.ee [85.29.203.126]:42133: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)85.29.203.1264537335s  Ae% ossec11302g|FTP Authentication failed.Apr 3 09:11:48 vm1 pure-ftpd[660189]: (?@34.78.69.184) [WARNING] Authentication failed for user [anonymous]34.78.69.1842802361"r 3K% ossec11301gvNew FTP connection.Apr 3 09:11:41 vm1 pure-ftpd[660187]: (?@34.78.69.184) [INFO] New connection from 34.78.69.18434.78.69.1842802361Vq  -9' ossec13001gExim Auth failed2025-04-03 09:08:05 dovecot_login authenticator failed for ([223.184.0.249]) [223.184.0.249]:56977: 535 Incorrect authentication data (set_id=contact)223.184.0.2491269750ip  -_' ossec13001gExim Auth failed2025-04-03 09:07:56 dovecot_login authenticator failed for showmyip.xyz [178.128.157.7]:58288: 535 Incorrect authentication data (set_id=contact@saintsoldiercollege.com)178.128.157.76252001bo  -S' ossec13001gExim Auth failed2025-04-03 09:05:42 dovecot_login authenticator failed for (wcdma.178-76-69-221.moldcell.md) [178.76.69.221]:35422: 535 Incorrect authentication data (set_id=info)178.76.69.221617790kn  -c' ossec13001gExim Auth failed2025-04-03 09:05:30 dovecot_login authenticator failed for ([27.40.100.204]) [27.40.100.204]:59645: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)27.40.100.2041814991 + R L p l )-O  -) ossec13001g#1Exim Auth failed2025-04-03 11:27:03 dovecot_login authenticator failed for broadband-188-32-117-155.ip.moscow.rt.ru [188.32.117.155]:36120: 535 Incorrect authentication data (set_id=test@saintsoldiercollege.com)188.32.117.1552017370'  3S) ossec11301gNew FTP connection.Apr 3 11:00:44 vm1 pure-ftpd[684043]: (?@40.124.127.239) [INFO] New connection from 40.124.127.23940.124.127.2396252001Z  -=+ ossec13001gExim Auth failed2025-04-03 10:59:16 dovecot_login authenticator failed for ([110.189.153.136]) [110.189.153.136]:55566: 535 Incorrect authentication data (set_id=sales)110.189.153.1361814991a  -Q% ossec13001gExim Auth failed2025-04-03 10:58:52 dovecot_login authenticator failed for (230.9.245.49.unknown.m1.com.sg) [49.245.9.230]:38418: 535 Incorrect authentication data (set_id=sales)49.245.9.2301880251g  -[' ossec13001gExim Auth failed2025-04-03 10:58:41 dovecot_login authenticator failed for ([49.124.151.59]) [49.124.151.59]:47248: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)49.124.151.591733045(  -]' ossec13001gExim Auth failed2025-04-03 10:58:39 dovecot_login authenticator failed for 37-190-61-156.dynamic.spd-mgts.ru (195x91x162x219.static-business.msk.ertelecom.ru) [37.190.61.156]:1641: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)37.190.61.1562017370T  -7% ossec13001gExim Auth failed2025-04-03 10:48:18 dovecot_login authenticator failed for ([103.98.39.30]) [103.98.39.30]:34862: 535 Incorrect authentication data (set_id=services)103.98.39.301269750h  -a' ossec13001g Exim Auth failed2025-04-03 10:48:03 dovecot_login authenticator failed for ([65.20.213.101]) [65.20.213.101]:34931: 535 Incorrect authentication data (set_id=services@heipowersystem.com)65.20.213.10199237V  -?! ossec13001gqExim Auth failed2025-04-03 10:41:12 dovecot_login authenticator failed for (pool-5-79-241-9.is74.ru) [5.79.241.9]:57186: 535 Incorrect authentication data (set_id=admin)5.79.241.92017370y  -' ossec13001ggExim Auth failed2025-04-03 10:41:02 dovecot_login authenticator failed for ool-18be35b4.dyn.optonline.net [24.190.53.180]:60943: 535 Incorrect authentication data (set_id=admin@saintsoldiercollege.com)24.190.53.1806252001$  3O' ossec11301gNew FTP connection.Apr 3 10:30:39 vm1 pure-ftpd[677942]: (?@38.110.46.248) [INFO] New connection from 38.110.46.24838.110.46.2486252001  - ' ossec13001gExim Auth failed2025-04-03 10:30:38 dovecot_login authenticator failed for 6.112.255.173.bc.googleusercontent.com [173.255.112.6]:38330: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)173.255.112.66252001X  -9+ ossec13001gExim Auth failed2025-04-03 10:30:48 dovecot_login authenticator failed for ([103.231.163.154]) [103.231.163.154]:2302: 535 Incorrect authentication data (set_id=info)103.231.163.1541210997  -) ossec13001g*Exim Auth failed2025-04-03 10:27:14 dovecot_login authenticator failed for syn-098-102-148-242.biz.spectrum.com [98.102.148.242]:38278: 535 Incorrect authentication data (set_id=office@saintsoldiercollege.com)98.102.148.2426252001U  -9' ossec13001g7Exim Auth failed2025-04-03 10:27:25 dovecot_login authenticator failed for ([197.156.121.38]) [213.55.85.202]:13180: 535 Incorrect authentication data (set_id=office)213.55.85.202337996T  -5' ossec13001gExim Auth failed2025-04-03 10:20:33 dovecot_login authenticator failed for ([74.208.177.56]) [74.208.177.56]:57202: 535 Incorrect authentication data (set_id=admin)74.208.177.566252001y  -% ossec13001gExim Auth failed2025-04-03 10:20:23 dovecot_login authenticator failed for h77-53-111-65.cust.bredband2.com [77.53.111.65]:54484: 535 Incorrect authentication data (set_id=admin@saintsoldiercollege.com)77.53.111.652661886 #1 Z  ) -Pm  -c+ ossec13001g8Exim Auth failed2025-04-03 12:56:18 dovecot_login authenticator failed for ([139.167.158.146]) [139.167.158.146]:42240: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)139.167.158.1461269750m  -e) ossec13001g66Exim Auth failed2025-04-03 12:48:12 dovecot_login authenticator failed for (187-13-169-174.user.veloxzone.com.br) [187.13.169.174]:32829: 535 Incorrect authentication data (set_id=contact)187.13.169.1743469034t  -q+ ossec13001g6Exim Auth failed2025-04-03 12:47:47 dovecot_login authenticator failed for ([114.255.134.164]) [114.255.134.165]:61528: 535 Incorrect authentication data (set_id=contact@saintsoldiercollege.com)114.255.134.1651814991k  -a) ossec13001g2QExim Auth failed2025-04-03 12:31:36 dovecot_login authenticator failed for (net190.79.95-231.izhevsk.ertelecom.ru) [46.147.190.231]:49100: 535 Incorrect authentication data (set_id=test)46.147.190.2312017370d  -Y# ossec13001g2AExim Auth failed2025-04-03 12:31:20 dovecot_login authenticator failed for ([49.65.1.179]) [49.65.1.179]:7933: 535 Incorrect authentication data (set_id=test@saintsoldiercollege.com)49.65.1.1791814991a  -O' ossec13001g.gExim Auth failed2025-04-03 12:14:55 dovecot_login authenticator failed for p174090-obmd01.osaka.ocn.ne.jp [61.118.249.89]:57366: 535 Incorrect authentication data (set_id=admin)61.118.249.891861060l  -e' ossec13001g.QExim Auth failed2025-04-03 12:14:32 dovecot_login authenticator failed for ([61.153.208.38]) [61.153.208.38]:39473: 535 Incorrect authentication data (set_id=admin@saintsoldiercollege.com)61.153.208.381814991M  -+# ossec13001g*Exim Auth failed2025-04-03 11:58:25 dovecot_login authenticator failed for ([38.44.65.38]) [38.44.65.38]:49303: 535 Incorrect authentication data (set_id=info)38.44.65.383374766Y  -;+ ossec13001g*|Exim Auth failed2025-04-03 11:58:11 dovecot_login authenticator failed for ([101.231.247.210]) [101.231.247.210]:35428: 535 Incorrect authentication data (set_id=info)101.231.247.2101814991x  -{) ossec13001g*fExim Auth failed2025-04-03 11:57:49 dovecot_login authenticator failed for vmi2383323.contaboserver.net [149.102.148.49]:33940: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)149.102.148.492635167n  -e+ ossec13001g*Exim Auth failed2025-04-03 11:56:10 dovecot_login authenticator failed for (heipowersystem.com) [202.107.197.211]:59062: 535 Incorrect authentication data (set_id=admin@heipowersystem.com)202.107.197.2111814991]  -C+ ossec13001g)Exim Auth failed2025-04-03 11:55:45 dovecot_login authenticator failed for (heipowersystem.com) [202.107.197.211]:55396: 535 Incorrect authentication data (set_id=nologin)202.107.197.2111814991Z  =-+ ossec13008g&Mail Reciepient rejected2025-04-03 11:39:30 H=(mail.amplifypowerglobal.com) [165.154.228.106]:54905 F= rejected RCPT : Rejected relay attempt: '165.154.228.106' From: 'gtjjfuo@amplifypowerglobal.com' To: 'validxxx@gmailhotmail.com.br'165.154.228.1061643084S  -5% ossec13001g#Exim Auth failed2025-04-03 11:28:51 dovecot_login authenticator failed for ([46.72.147.18]) [46.72.147.18]:51636: 535 Incorrect authentication data (set_id=contact)46.72.147.182017370n  -i' ossec13001g#Exim Auth failed2025-04-03 11:28:41 dovecot_login authenticator failed for ([51.250.30.155]) [51.250.30.155]:37868: 535 Incorrect authentication data (set_id=contact@saintsoldiercollege.com)51.250.30.1552017370Y  -;+ ossec13001g#=Exim Auth failed2025-04-03 11:27:16 dovecot_login authenticator failed for ([175.194.181.238]) [175.194.181.238]:51059: 535 Incorrect authentication data (set_id=test)175.194.181.2381835841 -" 4 K q  9P{#-k0  -a) ossec13001gLExim Auth failed2025-04-03 14:24:16 dovecot_login authenticator failed for 212.42.246.220.static.netvigator.com [220.246.42.212]:59919: 535 Incorrect authentication data (set_id=contact)220.246.42.2121819730/  -) ossec13001gLExim Auth failed2025-04-03 14:24:05 dovecot_login authenticator failed for 227.42.246.220.static.netvigator.com [220.246.42.227]:49212: 535 Incorrect authentication data (set_id=contact@saintsoldiercollege.com)220.246.42.2271819730$.  3O' ossec11301gINew FTP connection.Apr 3 14:10:37 vm1 pure-ftpd[725034]: (?@205.210.31.56) [INFO] New connection from 205.210.31.56205.210.31.566252001S-  -3' ossec13001gEExim Auth failed2025-04-03 13:55:10 dovecot_login authenticator failed for ([103.48.84.178]) [103.48.84.178]:60092: 535 Incorrect authentication data (set_id=test)103.48.84.1781562822,  -) ossec13001gEExim Auth failed2025-04-03 13:54:55 dovecot_login authenticator failed for (163.pool90-160-139.dynamic.orange.es) [90.160.139.163]:54135: 535 Incorrect authentication data (set_id=test@saintsoldiercollege.com)90.160.139.1632510769X+  -;) ossec13001gE<Exim Auth failed2025-04-03 13:52:18 dovecot_login authenticator failed for ([171.217.70.151]) [171.217.70.151]:53022: 535 Incorrect authentication data (set_id=office)171.217.70.1511814991s*  -o+ ossec13001gE.Exim Auth failed2025-04-03 13:52:05 dovecot_login authenticator failed for ([117.247.237.131]) [117.247.237.131]:60713: 535 Incorrect authentication data (set_id=office@saintsoldiercollege.com)117.247.237.1311269750Q)  -1% ossec13001gE Exim Auth failed2025-04-03 13:51:28 dovecot_login authenticator failed for ([223.245.8.11]) [223.245.8.11]:45224: 535 Incorrect authentication data (set_id=sales)223.245.8.111814991e(  -[# ossec13001gDExim Auth failed2025-04-03 13:51:14 dovecot_login authenticator failed for ([177.215.153.215]) [189.56.0.19]:55275: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)189.56.0.193469034Z'  -?) ossec13001gBExim Auth failed2025-04-03 13:41:23 dovecot_login authenticator failed for ([114.254.253.71]) [114.254.253.71]:60908: 535 Incorrect authentication data (set_id=services)114.254.253.711814991z&  -}+ ossec13001gBExim Auth failed2025-04-03 13:40:54 dovecot_login authenticator failed for 118.sub-166-169-117.myvzw.com [166.169.117.118]:45038: 535 Incorrect authentication data (set_id=services@heipowersystem.com)166.169.117.1186252001X%  =)+ ossec13008g>TMail Reciepient rejected2025-04-03 13:22:51 H=(mail.amplifypowerglobal.com) [165.154.228.106]:63610 F= rejected RCPT : Rejected relay attempt: '165.154.228.106' From: 'bkyybx@amplifypowerglobal.com' To: 'validxxx@gmailhotmail.com.br'165.154.228.1061643084V$  -7) ossec13001g<Exim Auth failed2025-04-03 13:17:11 dovecot_login authenticator failed for ([117.69.210.199]) [117.69.210.199]:35262: 535 Incorrect authentication data (set_id=info)117.69.210.1991814991e#  -[# ossec13001g<Exim Auth failed2025-04-03 13:16:58 dovecot_login authenticator failed for ([14.98.28.43]) [14.98.28.43]:38862: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)14.98.28.431269750j"  -c% ossec13001g9Exim Auth failed2025-04-03 13:04:05 dovecot_login authenticator failed for ([113.192.69.9]) [113.192.69.9]:48206: 535 Incorrect authentication data (set_id=office@saintsoldiercollege.com)113.192.69.91835841o!  -g+ ossec13001g9Exim Auth failed2025-04-03 13:04:14 dovecot_login authenticator failed for net-188-219-233-235.cust.vodafonedsl.it [188.219.233.235]:38065: 535 Incorrect authentication data (set_id=office)188.219.233.2353175395g  -[' ossec13001g8&Exim Auth failed2025-04-03 12:56:29 dovecot_login authenticator failed for 069.138.48.116.static.netvigator.com [116.48.138.69]:57599: 535 Incorrect authentication data (set_id=sales)116.48.138.691819730 [g IN_ygsthB  -_% ossec13001g]Exim Auth failed2025-04-03 15:36:08 dovecot_login authenticator failed for ([14.45.208.48]) [14.45.208.48]:41934: 535 Incorrect authentication data (set_id=test@saintsoldiercollege.com)14.45.208.481835841$A  3O' ossec11301g]New FTP connection.Apr 3 15:36:06 vm1 pure-ftpd[743400]: (?@195.184.76.86) [INFO] New connection from 195.184.76.86195.184.76.866252001$@  3O' ossec11301g]New FTP connection.Apr 3 15:36:07 vm1 pure-ftpd[743402]: (?@195.184.76.83) [INFO] New connection from 195.184.76.83195.184.76.836252001S?  -3' ossec13001g]Exim Auth failed2025-04-03 15:36:18 dovecot_login authenticator failed for ([213.176.73.56]) [213.176.73.56]:47622: 535 Incorrect authentication data (set_id=test)213.176.73.563017382T>  -7% ossec13001g[Exim Auth failed2025-04-03 15:29:17 dovecot_login authenticator failed for ([121.128.76.110]) [211.196.31.2]:37773: 535 Incorrect authentication data (set_id=office)211.196.31.21835841p=  -k) ossec13001g[Exim Auth failed2025-04-03 15:28:57 dovecot_login authenticator failed for ([124.152.34.229]) [124.152.34.229]:58767: 535 Incorrect authentication data (set_id=office@saintsoldiercollege.com)124.152.34.2291814991<  -%+ ossec13001g[Exim Auth failed2025-04-03 15:27:54 dovecot_login authenticator failed for (nsg-corporate-233.228.187.122.airtel.in) [122.187.228.233]:52604: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)122.187.228.2331269750b;  -O) ossec13001g[Exim Auth failed2025-04-03 15:28:15 dovecot_login authenticator failed for ([115.241.228.34]) [115.241.228.34]:33592: 535 Incorrect authentication data (set_id=vikas.khandelwal)115.241.228.341269750k:  -a) ossec13001gZAExim Auth failed2025-04-03 15:22:01 dovecot_login authenticator failed for 128.27.155.104.bc.googleusercontent.com [104.155.27.128]:53351: 535 Incorrect authentication data (set_id=test)104.155.27.1282802361w9  -y) ossec13001gZ/Exim Auth failed2025-04-03 15:21:43 dovecot_login authenticator failed for (183.83.188.236.actcorp.in) [183.83.188.236]:47532: 535 Incorrect authentication data (set_id=test@saintsoldiercollege.com)183.83.188.23612697508  3G# ossec11301gW New FTP connection.Apr 3 15:08:17 vm1 pure-ftpd[737198]: (?@20.38.37.44) [INFO] New connection from 20.38.37.4420.38.37.446252001V7  -7) ossec13001gTExim Auth failed2025-04-03 14:58:33 dovecot_login authenticator failed for ([49.124.152.253]) [49.124.152.253]:41870: 535 Incorrect authentication data (set_id=test)49.124.152.2531733045n6  -g) ossec13001gTExim Auth failed2025-04-03 14:58:23 dovecot_login authenticator failed for ([188.166.179.34]) [188.166.179.34]:40046: 535 Incorrect authentication data (set_id=test@saintsoldiercollege.com)188.166.179.341880251e5  -W' ossec13001gQExim Auth failed2025-04-03 14:45:22 dovecot_login authenticator failed for c-85-228-121-10.bbcust.telenor.se [85.228.121.10]:58044: 535 Incorrect authentication data (set_id=office)85.228.121.102661886k4  -g' ossec13001gQExim Auth failed2025-04-03 14:45:11 dovecot_login authenticator failed for ([65.20.168.206]) [65.20.168.206]:49947: 535 Incorrect authentication data (set_id=office@saintsoldiercollege.com)65.20.168.20699237T3  -5' ossec13001gMExim Auth failed2025-04-03 14:29:41 dovecot_login authenticator failed for ([109.194.37.36]) [109.194.37.36]:57032: 535 Incorrect authentication data (set_id=admin)109.194.37.362017370p2  -k) ossec13001gMExim Auth failed2025-04-03 14:29:18 dovecot_login authenticator failed for ([222.174.187.202]) [113.122.237.86]:36550: 535 Incorrect authentication data (set_id=admin@saintsoldiercollege.com)113.122.237.861814991!1  3K% ossec11301gLNew FTP connection.Apr 3 14:24:28 vm1 pure-ftpd[727806]: (?@209.38.33.11) [INFO] New connection from 209.38.33.11209.38.33.112750405 En  ^ g LOMQ-C(T 3S) ossec11301ge\New FTP connection.Apr 3 16:09:22 vm1 pure-ftpd[750773]: (?@152.59.117.116) [INFO] New connection from 152.59.117.116152.59.117.1161269750fS  -]# ossec13001gcExim Auth failed2025-04-03 16:02:55 dovecot_login authenticator failed for (heipowersystem.com) [14.18.77.99]:33186: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)14.18.77.991814991UR  -;# ossec13001gcExim Auth failed2025-04-03 16:02:29 dovecot_login authenticator failed for (heipowersystem.com) [14.18.77.99]:57866: 535 Incorrect authentication data (set_id=nologin)14.18.77.991814991YQ  -=) ossec13001gbExim Auth failed2025-04-03 15:58:46 dovecot_login authenticator failed for ([220.80.192.168]) [220.80.192.168]:58022: 535 Incorrect authentication data (set_id=contact)220.80.192.1681835841P  -# ossec13001gbExim Auth failed2025-04-03 15:58:18 dovecot_login authenticator failed for (5x3x152x158.dynamic.kazan.ertelecom.ru) [5.3.152.158]:55472: 535 Incorrect authentication data (set_id=contact@saintsoldiercollege.com)5.3.152.1582017370(O 3S) ossec11301gbNew FTP connection.Apr 3 15:58:13 vm1 pure-ftpd[748223]: (?@152.59.117.116) [INFO] New connection from 152.59.117.116152.59.117.11612697509N Ce) ossec11309gbFTP Authentication success.Apr 3 15:58:14 vm1 pure-ftpd[748223]: (?@152.59.117.116) [INFO] user@s2seducationtrust.com is now logged in152.59.117.1161269750xM  -}' ossec13001gaQExim Auth failed2025-04-03 15:52:09 dovecot_login authenticator failed for sj4e9k.g-service.ru [91.132.21.180]:50052: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)91.132.21.1802017370~L  -+ ossec13001gagExim Auth failed2025-04-03 15:52:30 dovecot_login authenticator failed for (static-181-177-143-217.supernet.com.bo) [181.177.143.217]:60254: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)181.177.143.2173923057yK  -' ossec13001g_ Exim Auth failed2025-04-03 15:42:47 dovecot_login authenticator failed for ool-45701cb5.dyn.optonline.net [69.112.28.181]:44225: 535 Incorrect authentication data (set_id=admin@saintsoldiercollege.com)69.112.28.18162520012J  =_) ossec13008g_4Mail Reciepient rejected2025-04-03 15:43:07 H=(mail.msnews24.in) [165.154.210.52]:64164 F= rejected RCPT : Rejected relay attempt: '165.154.210.52' From: 'kzdnv@msnews24.in' To: 'validxxx@gmailhotmail.com.br'165.154.210.521694008aI  -K+ ossec13001g_(Exim Auth failed2025-04-03 15:42:56 dovecot_login authenticator failed for 100.225.254.193.infosys.su [193.254.225.100]:33089: 535 Incorrect authentication data (set_id=admin)193.254.225.1002017370sH  -u% ossec13001g]Exim Auth failed2025-04-03 15:37:13 dovecot_login authenticator failed for 200.19.70.86.rev.sfr.net [86.70.19.200]:58560: 535 Incorrect authentication data (set_id=contact@saintsoldiercollege.com)86.70.19.20030173829G  Ai) ossec11302g]FTP Authentication failed.Apr 3 15:37:05 vm1 pure-ftpd[743554]: (?@195.184.76.146) [WARNING] Authentication failed for user [anonymous]195.184.76.1466252001$F  3O' ossec11301g]New FTP connection.Apr 3 15:36:56 vm1 pure-ftpd[743552]: (?@195.184.76.80) [INFO] New connection from 195.184.76.80195.184.76.806252001'E  3S) ossec11301g]New FTP connection.Apr 3 15:36:57 vm1 pure-ftpd[743554]: (?@195.184.76.146) [INFO] New connection from 195.184.76.146195.184.76.1466252001SD  -5% ossec13001g]Exim Auth failed2025-04-03 15:37:24 dovecot_login authenticator failed for ([92.47.46.174]) [92.47.46.174]:43728: 535 Incorrect authentication data (set_id=contact)92.47.46.17415228677C  Ag' ossec11302g]FTP Authentication failed.Apr 3 15:36:12 vm1 pure-ftpd[743402]: (?@195.184.76.83) [WARNING] Authentication failed for user [anonymous]195.184.76.836252001 BC" w WB;e  =s' ossec13008glMail Reciepient rejected2025-04-03 16:41:41 H=(mail.msnews24.in) [45.197.14.138]:52547 F= rejected RCPT : Rejected relay attempt: '45.197.14.138' From: 'sgdeunonwsr@msnews24.in' To: 'validxxx@gmailhotmail.com.br'45.197.14.1386252001Sd  =!) ossec13008glMail Reciepient rejected2025-04-03 16:40:04 H=(mail.heipowersystem.com) [165.154.210.79]:62964 F= rejected RCPT : Rejected relay attempt: '165.154.210.79' From: 'qgkvqwadevw@heipowersystem.com' To: 'validxxx@gmailhotmail.com.br'165.154.210.791694008jc  -a' ossec13001gkExim Auth failed2025-04-03 16:33:44 dovecot_login authenticator failed for ([61.185.137.26]) [61.185.137.26]:37806: 535 Incorrect authentication data (set_id=services@heipowersystem.com)61.185.137.261814991fb  -]% ossec13001gjExim Auth failed2025-04-03 16:33:24 dovecot_login authenticator failed for ([212.50.48.86]) [212.50.48.86]:35390: 535 Incorrect authentication data (set_id=services@heipowersystem.com)212.50.48.86298795ma  -e) ossec13001gjExim Auth failed2025-04-03 16:31:34 dovecot_login authenticator failed for 203-174-182-38.ade.static-ipl.aapt.com.au [203.174.182.38]:36885: 535 Incorrect authentication data (set_id=info)203.174.182.382077456f`  -_% ossec13001gjExim Auth failed2025-04-03 16:31:22 dovecot_login authenticator failed for ([65.20.151.34]) [65.20.151.34]:43309: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)65.20.151.3499237_  C/) ossec11313giFTP file uploaded to serverApr 3 16:28:05 vm1 pure-ftpd[755283]: (user@s2seducationtrust.com@152.59.117.116) [NOTICE] /home/techno/public_html/s2seducationtrust.com//Best-sainik-school-coaching.php uploaded (13483 bytes, 174.31KB/sec)152.59.117.1161269750'^  3S) ossec11301giNew FTP connection.Apr 3 16:28:04 vm1 pure-ftpd[755283]: (?@152.59.117.116) [INFO] New connection from 152.59.117.116152.59.117.11612697508]  Ce) ossec11309giFTP Authentication success.Apr 3 16:28:04 vm1 pure-ftpd[755283]: (?@152.59.117.116) [INFO] user@s2seducationtrust.com is now logged in152.59.117.1161269750'\  3S) ossec11301ggNew FTP connection.Apr 3 16:20:19 vm1 pure-ftpd[753599]: (?@152.59.117.116) [INFO] New connection from 152.59.117.116152.59.117.1161269750[  C/) ossec11313ggFTP file uploaded to serverApr 3 16:20:20 vm1 pure-ftpd[753599]: (user@s2seducationtrust.com@152.59.117.116) [NOTICE] /home/techno/public_html/s2seducationtrust.com//Best-sainik-school-coaching.php uploaded (13480 bytes, 377.92KB/sec)152.59.117.11612697508Z  Ce) ossec11309ggFTP Authentication success.Apr 3 16:20:19 vm1 pure-ftpd[753599]: (?@152.59.117.116) [INFO] user@s2seducationtrust.com is now logged in152.59.117.1161269750Y  C-) ossec11313ggFTP file uploaded to serverApr 3 16:16:27 vm1 pure-ftpd[752595]: (user@s2seducationtrust.com@152.59.117.116) [NOTICE] /home/techno/public_html/s2seducationtrust.com//Best-sainik-school-coaching.php uploaded (9428 bytes, 883.18KB/sec)152.59.117.11612697508X  Ce) ossec11309gfFTP Authentication success.Apr 3 16:15:39 vm1 pure-ftpd[752595]: (?@152.59.117.116) [INFO] user@s2seducationtrust.com is now logged in152.59.117.1161269750'W  3S) ossec11301gfNew FTP connection.Apr 3 16:15:39 vm1 pure-ftpd[752595]: (?@152.59.117.116) [INFO] New connection from 152.59.117.116152.59.117.1161269750V  C/) ossec11313gfFTP file uploaded to serverApr 3 16:15:39 vm1 pure-ftpd[752595]: (user@s2seducationtrust.com@152.59.117.116) [NOTICE] /home/techno/public_html/s2seducationtrust.com//Best-sainik-school-coaching.php uploaded (21400 bytes, 415.02KB/sec)152.59.117.11612697509U Ce) ossec11309ge\FTP Authentication success.Apr 3 16:09:22 vm1 pure-ftpd[750773]: (?@152.59.117.116) [INFO] user@s2seducationtrust.com is now logged in152.59.117.1161269750 | 0 a V Q\g|gv  -]% ossec13001gx}Exim Auth failed2025-04-03 17:31:01 dovecot_login authenticator failed for (122.11.169-7.unknown.starhub.net.sg) [122.11.169.7]:1398: 535 Incorrect authentication data (set_id=contact)122.11.169.71880251qu  -m) ossec13001gxsExim Auth failed2025-04-03 17:30:50 dovecot_login authenticator failed for ([218.94.104.181]) [218.94.104.180]:45752: 535 Incorrect authentication data (set_id=contact@saintsoldiercollege.com)218.94.104.18018149914t  =c) ossec13008gxMail Reciepient rejected2025-04-03 17:29:16 H=(mail.msnews24.in) [165.154.228.93]:57482 F= rejected RCPT : Rejected relay attempt: '165.154.228.93' From: 'pipxsj@msnews24.in' To: 'validxxx@gmailhotmail.com.br'165.154.228.9316430849s Ce) ossec11309gwSFTP Authentication success.Apr 3 17:26:02 vm1 pure-ftpd[767528]: (?@152.59.117.116) [INFO] user@s2seducationtrust.com is now logged in152.59.117.1161269750(r 3S) ossec11301gwSNew FTP connection.Apr 3 17:26:01 vm1 pure-ftpd[767528]: (?@152.59.117.116) [INFO] New connection from 152.59.117.116152.59.117.1161269750q  C/) ossec11313gvbFTP file uploaded to serverApr 3 17:22:01 vm1 pure-ftpd[766458]: (user@s2seducationtrust.com@152.59.117.116) [NOTICE] /home/techno/public_html/s2seducationtrust.com//Best-sainik-school-coaching.php uploaded (13488 bytes, 210.22KB/sec)152.59.117.11612697508p  Ce) ossec11309gv8FTP Authentication success.Apr 3 17:21:19 vm1 pure-ftpd[766458]: (?@152.59.117.116) [INFO] user@s2seducationtrust.com is now logged in152.59.117.1161269750o  C/) ossec11313gv8FTP file uploaded to serverApr 3 17:21:20 vm1 pure-ftpd[766458]: (user@s2seducationtrust.com@152.59.117.116) [NOTICE] /home/techno/public_html/s2seducationtrust.com//Best-sainik-school-coaching.php uploaded (13470 bytes, 300.51KB/sec)152.59.117.1161269750'n  3S) ossec11301gv4New FTP connection.Apr 3 17:21:15 vm1 pure-ftpd[766458]: (?@152.59.117.116) [INFO] New connection from 152.59.117.116152.59.117.1161269750dm  -U' ossec13001gtExim Auth failed2025-04-03 17:14:02 dovecot_login authenticator failed for (161.81.121.11.hk.chinamobile.com) [161.81.121.11]:48647: 535 Incorrect authentication data (set_id=info)161.81.121.111819730nl  -g) ossec13001gtxExim Auth failed2025-04-03 17:13:52 dovecot_login authenticator failed for ([221.209.48.204]) [221.209.48.203]:50510: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)221.209.48.2031814991Rk  -3% ossec13001gnzExim Auth failed2025-04-03 16:48:18 dovecot_login authenticator failed for ([222.99.10.11]) [222.99.10.11]:51118: 535 Incorrect authentication data (set_id=office)222.99.10.111835841j  -+ ossec13001gnfExim Auth failed2025-04-03 16:47:58 dovecot_login authenticator failed for (static.ill.117.250.165.114.bsnl.co.in) [117.250.165.114]:36666: 535 Incorrect authentication data (set_id=office@saintsoldiercollege.com)117.250.165.1141269750Ki  -)! ossec13001gmnExim Auth failed2025-04-03 16:43:50 dovecot_login authenticator failed for ([1.30.20.98]) [1.30.20.98]:59850: 535 Incorrect authentication data (set_id=sales)1.30.20.981814991dh  -W% ossec13001gmfExim Auth failed2025-04-03 16:43:42 dovecot_login authenticator failed for ([42.81.140.83]) [42.81.140.83]:44504: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)42.81.140.831814991g  - ) ossec13001gmbExim Auth failed2025-04-03 16:43:38 dovecot_login authenticator failed for (nsg-corporate-99.229.187.122.airtel.in) [122.187.229.99]:58761: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)122.187.229.991269750`f  -O% ossec13001gmtExim Auth failed2025-04-03 16:43:56 dovecot_login authenticator failed for 111-70-13-53.emome-ip.hinet.net [111.70.13.53]:41138: 535 Incorrect authentication data (set_id=sales)111.70.13.531668284  8 | ('M^p  -m' ossec13001g}Exim Auth failed2025-04-03 17:53:41 dovecot_login authenticator failed for (s2seducationtrust.com) [111.207.12.99]:60806: 535 Incorrect authentication data (set_id=sales@s2seducationtrust.com)111.207.12.991814991\  -E' ossec13001g}Exim Auth failed2025-04-03 17:53:17 dovecot_login authenticator failed for (s2seducationtrust.com) [111.207.12.99]:57122: 535 Incorrect authentication data (set_id=nologin)111.207.12.991814991x  -{) ossec13001g|Exim Auth failed2025-04-03 17:49:23 dovecot_login authenticator failed for (dynamic-ip-adsl.viettel.vn) [171.239.169.84]:60589: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)171.239.169.841562822M  -+# ossec13001g|Exim Auth failed2025-04-03 17:49:34 dovecot_login authenticator failed for ([1.31.87.230]) [1.31.87.230]:46386: 535 Incorrect authentication data (set_id=info)1.31.87.2301814991k  -c' ossec13001g{Exim Auth failed2025-04-03 17:44:53 dovecot_login authenticator failed for ([103.174.34.49]) [103.174.34.49]:61057: 535 Incorrect authentication data (set_id=test@saintsoldiercollege.com)103.174.34.491269750V  -7) ossec13001g{Exim Auth failed2025-04-03 17:45:04 dovecot_login authenticator failed for ([199.204.22.133]) [199.204.22.133]:17798: 535 Incorrect authentication data (set_id=test)199.204.22.1336252001d  -U' ossec13001gzExim Auth failed2025-04-03 17:40:58 dovecot_login authenticator failed for 42-200-70-134.static.imsbiz.com [42.200.70.134]:40217: 535 Incorrect authentication data (set_id=contact)42.200.70.1341819730t  -q+ ossec13001gzExim Auth failed2025-04-03 17:40:46 dovecot_login authenticator failed for ([181.177.143.217]) [181.177.143.217]:62238: 535 Incorrect authentication data (set_id=contact@saintsoldiercollege.com)181.177.143.2173923057  C/) ossec11313gzFTP file uploaded to serverApr 3 17:39:45 vm1 pure-ftpd[770522]: (user@s2seducationtrust.com@152.59.117.228) [NOTICE] /home/techno/public_html/s2seducationtrust.com//Best-sainik-school-coaching.php uploaded (12318 bytes, 398.97KB/sec)152.59.117.22812697508~  Ce) ossec11309gzFTP Authentication success.Apr 3 17:39:45 vm1 pure-ftpd[770522]: (?@152.59.117.228) [INFO] user@s2seducationtrust.com is now logged in152.59.117.2281269750'}  3S) ossec11301gzNew FTP connection.Apr 3 17:39:45 vm1 pure-ftpd[770522]: (?@152.59.117.228) [INFO] New connection from 152.59.117.228152.59.117.2281269750|  C/) ossec11313gyFTP file uploaded to serverApr 3 17:35:59 vm1 pure-ftpd[769602]: (user@s2seducationtrust.com@152.59.117.228) [NOTICE] /home/techno/public_html/s2seducationtrust.com//Best-sainik-school-coaching.php uploaded (13488 bytes, 187.21KB/sec)152.59.117.2281269750{  C/) ossec11313gyFTP file uploaded to serverApr 3 17:35:17 vm1 pure-ftpd[769602]: (user@s2seducationtrust.com@152.59.117.228) [NOTICE] /home/techno/public_html/s2seducationtrust.com//Best-sainik-school-coaching.php uploaded (13488 bytes, 434.23KB/sec)152.59.117.2281269750'z  3S) ossec11301gy}New FTP connection.Apr 3 17:35:16 vm1 pure-ftpd[769602]: (?@152.59.117.228) [INFO] New connection from 152.59.117.228152.59.117.22812697508y  Ce) ossec11309gy}FTP Authentication success.Apr 3 17:35:17 vm1 pure-ftpd[769602]: (?@152.59.117.228) [INFO] user@s2seducationtrust.com is now logged in152.59.117.2281269750Qx  -1% ossec13001gxExim Auth failed2025-04-03 17:32:58 dovecot_login authenticator failed for ([36.32.223.199]) [58.242.71.83]:7026: 535 Incorrect authentication data (set_id=admin)58.242.71.831814991ow  -i) ossec13001gxExim Auth failed2025-04-03 17:32:47 dovecot_login authenticator failed for ([110.166.80.135]) [110.166.80.135]:36950: 535 Incorrect authentication data (set_id=admin@saintsoldiercollege.com)110.166.80.1351814991  Q ew}Q  U) ossec11001gDeferred login on the cpanel service[2025-04-03 19:58:36 +0530] info [whostmgrd] 171.79.176.178 - root "GET /cpsess8736441456/scripts4/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: cookie ip check: IP address has changed: IP Address [171.79.151.221] != Current IP Address [171.79.176.178]171.79.176.1781269750g  -[' ossec13001gExim Auth failed2025-04-03 19:37:13 dovecot_login authenticator failed for ([61.153.208.38]) [61.153.208.38]:11082: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)61.153.208.381814991Q  -1% ossec13001gAExim Auth failed2025-04-03 19:38:00 dovecot_login authenticator failed for ([84.52.89.218]) [84.52.89.218]:45231: 535 Incorrect authentication data (set_id=sales)84.52.89.2182017370d  -W% ossec13001g3Exim Auth failed2025-04-03 19:37:46 dovecot_login authenticator failed for ([175.198.18.3]) [175.198.18.3]:60214: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)175.198.18.31835841P  -1% ossec13001gExim Auth failed2025-04-03 19:37:23 dovecot_login authenticator failed for ([194.28.91.40]) [194.28.91.40]:43227: 535 Incorrect authentication data (set_id=sales)194.28.91.40690791j  -_) ossec13001g Exim Auth failed2025-04-03 19:37:05 dovecot_login authenticator failed for ([176.32.186.254]) [176.32.186.254]:52468: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)176.32.186.2542017370r  -q' ossec13001gExim Auth failed2025-04-03 18:45:02 dovecot_login authenticator failed for 95.57.104.252.dynamic.telecom.kz [95.57.104.252]:60764: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)95.57.104.2521522867v  -y' ossec13001gExim Auth failed2025-04-03 18:44:33 dovecot_login authenticator failed for ([144.48.39.222]) [144.48.39.222]:36639: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)144.48.39.2222077456j  -c% ossec13001gExim Auth failed2025-04-03 18:41:23 dovecot_login authenticator failed for (177-37-167-4-tmp.static.brisanet.net.br) [177.37.167.4]:35325: 535 Incorrect authentication data (set_id=sales)177.37.167.43469034h  -]' ossec13001gExim Auth failed2025-04-03 18:41:09 dovecot_login authenticator failed for ([103.215.208.185]) [103.215.208.4]:6017: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)103.215.208.41269750e  =C+ ossec13008gMail Reciepient rejected2025-04-03 18:11:59 H=(mail.saintsoldiercollege.com) [165.154.242.137]:56417 F= rejected RCPT : Rejected relay attempt: '165.154.242.137' From: 'obcivduscxz@saintsoldiercollege.com' To: 'validxxx@gmailhotmail.com.br'165.154.242.1371694008m  -g' ossec13001gExim Auth failed2025-04-03 18:06:53 dovecot_login authenticator failed for ([175.202.82.16]) [175.202.82.16]:36556: 535 Incorrect authentication data (set_id=office@saintsoldiercollege.com)175.202.82.161835841U  -7' ossec13001gExim Auth failed2025-04-03 18:07:07 dovecot_login authenticator failed for ([159.75.92.136]) [159.75.92.136]:55216: 535 Incorrect authentication data (set_id=office)159.75.92.13618149916  =g) ossec13008g~Mail Reciepient rejected2025-04-03 17:57:11 H=(mail.msnews24.in) [165.154.242.42]:64683 F= rejected RCPT : Rejected relay attempt: '165.154.242.42' From: 'rtoiodu@msnews24.in' To: 'validxxx@gmailhotmail.com.br'165.154.242.421694008>  =w) ossec13008g~Mail Reciepient rejected2025-04-03 17:54:34 H=(mail.msnews24.in) [165.154.210.52]:65195 F= rejected RCPT : Rejected relay attempt: '165.154.210.52' From: 'cunyxewzwfe@msnews24.in' To: 'validxxx@gmailhotmail.com.br'165.154.210.521694008 E & 0 PRf'  -Y' ossec13001gExim Auth failed2025-04-03 22:19:22 dovecot_login authenticator failed for 62-122-195-14.broadband.opcom.ru [62.122.195.14]:60052: 535 Incorrect authentication data (set_id=services)62.122.195.142017370f&  -]% ossec13001gExim Auth failed2025-04-03 22:19:10 dovecot_login authenticator failed for ([45.93.94.125]) [45.93.94.125]:60128: 535 Incorrect authentication data (set_id=services@heipowersystem.com)45.93.94.125294640%  W % ossec9708gDovecot Aborted Login with empty userApr 3 22:04:49 vm1 dovecot[1526]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=80.82.77.139, lip=103.74.54.108, session=80.82.77.1392750405O$  -+' ossec13001gNExim Auth failed2025-04-03 21:37:42 dovecot_login authenticator failed for (atm23-13-1.pae.gvt.net.br) [200.175.88.85]:46725: 535 Incorrect authentication data200.175.88.853469034W#  -9) ossec13001gExim Auth failed2025-04-03 21:35:14 dovecot_login authenticator failed for ([207.102.66.226]) [207.102.66.226]:56369: 535 Incorrect authentication data (set_id=sales)207.102.66.2266251999~"  -) ossec13001gExim Auth failed2025-04-03 21:34:46 dovecot_login authenticator failed for (customer.chcoilx1.pop.starlinkisp.net) [129.222.28.111]:8025: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)129.222.28.11162520019!  Ai) ossec11302gFTP Authentication failed.Apr 3 21:30:14 vm1 pure-ftpd[820617]: (?@91.196.152.222) [WARNING] Authentication failed for user [anonymous]91.196.152.2223017382'  3S) ossec11301gNew FTP connection.Apr 3 21:30:08 vm1 pure-ftpd[820617]: (?@91.196.152.222) [INFO] New connection from 91.196.152.22291.196.152.2223017382'  3S) ossec11301gNew FTP connection.Apr 3 21:30:08 vm1 pure-ftpd[820587]: (?@91.196.152.223) [INFO] New connection from 91.196.152.22391.196.152.2233017382$  3O' ossec11301gNew FTP connection.Apr 3 21:18:59 vm1 pure-ftpd[818149]: (?@20.65.192.171) [INFO] New connection from 20.65.192.17120.65.192.1716252001\  -G% ossec13001gExim Auth failed2025-04-03 21:14:11 dovecot_login authenticator failed for ([58.22.255.28]) [58.22.255.28]:49677: 535 Incorrect authentication data (set_id=vikas.khandelwal)58.22.255.281814991r  -q' ossec13001gExim Auth failed2025-04-03 21:13:58 dovecot_login authenticator failed for ([185.67.90.247]) [185.67.90.247]:38120: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)185.67.90.2473017382*  3W+ ossec11301g2New FTP connection.Apr 3 21:03:05 vm1 pure-ftpd[814678]: (?@147.185.132.112) [INFO] New connection from 147.185.132.112147.185.132.11262520014  =c) ossec13008gqMail Reciepient rejected2025-04-03 20:47:03 H=(mail.msnews24.in) [165.154.247.20]:55787 F= rejected RCPT : Rejected relay attempt: '165.154.247.20' From: 'pnnbrq@msnews24.in' To: 'validxxx@gmailhotmail.com.br'165.154.247.2016056515  =g' ossec13008g-Mail Reciepient rejected2025-04-03 20:11:47 H=(mail.msnews24.in) [45.197.14.175]:52312 F= rejected RCPT : Rejected relay attempt: '45.197.14.175' From: 'ibfbgcyp@msnews24.in' To: 'validxxx@gmailhotmail.com.br'45.197.14.1756252001!  3K% ossec11301g@New FTP connection.Apr 3 20:03:34 vm1 pure-ftpd[801995]: (?@64.62.197.14) [INFO] New connection from 64.62.197.1464.62.197.146252001  5') ossec11011gWHM SSO login failed[2025-04-03 19:58:36 +0530] info [whostmgrd] 171.79.176.178 PURGE root:YfrzFg2VO6stgV3j badpass [cookie ip check: IP address has changed: IP Address [171.79.151.221] != Current IP Address [171.79.176.178]]171.79.176.1781269750 )8 Q 8]N)q8  -q% ossec13001gMExim Auth failed2025-04-04 00:45:25 dovecot_login authenticator failed for (dynamicip-95-79-108-51.pppoe.nn.ertelecom.ru) [95.79.108.51]:55040: 535 Incorrect authentication data (set_id=contact)95.79.108.512017370n7  -i' ossec13001gCExim Auth failed2025-04-04 00:45:14 dovecot_login authenticator failed for ([203.81.213.46]) [203.81.213.46]:40675: 535 Incorrect authentication data (set_id=contact@saintsoldiercollege.com)203.81.213.461168579:6  =o) ossec13008gUMail Reciepient rejected2025-04-04 00:37:00 H=(mail.msnews24.in) [165.154.210.99]:49530 F= rejected RCPT : Rejected relay attempt: '165.154.210.99' From: 'mendgjayg@msnews24.in' To: 'validxxx@gmailhotmail.com.br'165.154.210.991694008 5  -#' ossec13001gLExim Auth failed2025-04-04 00:28:20 dovecot_login authenticator failed for 177.162.84.34.bc.googleusercontent.com [34.84.162.177]:55739: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)34.84.162.1771861060W4  -9) ossec13001gقExim Auth failed2025-04-04 00:24:58 dovecot_login authenticator failed for ([39.129.128.108]) [39.129.128.108]:34090: 535 Incorrect authentication data (set_id=sales)39.129.128.1081814991c3  -W% ossec13001gvExim Auth failed2025-04-04 00:24:45 dovecot_login authenticator failed for ([185.167.56.2]) [185.167.56.2]:44234: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)185.167.56.2617790P2  -1% ossec13001gbExim Auth failed2025-04-04 00:24:26 dovecot_login authenticator failed for ([2.55.114.171]) [2.55.114.171]:56372: 535 Incorrect authentication data (set_id=admin)2.55.114.171294640l1  -e' ossec13001gTExim Auth failed2025-04-04 00:24:11 dovecot_login authenticator failed for ([61.108.83.138]) [61.108.83.138]:44989: 535 Incorrect authentication data (set_id=admin@saintsoldiercollege.com)61.108.83.1381835841Y0  -;+ ossec13001g،Exim Auth failed2025-04-04 00:20:52 dovecot_login authenticator failed for ([140.246.176.218]) [140.246.176.218]:45766: 535 Incorrect authentication data (set_id=info)140.246.176.2181814991Q/  -3' ossec13001g$Exim Auth failed2025-04-04 00:19:07 dovecot_login authenticator failed for ([65.20.251.127]) [65.20.251.127]:59850: 535 Incorrect authentication data (set_id=info)65.20.251.12799237i.  -c' ossec13001gExim Auth failed2025-04-04 00:18:27 dovecot_login authenticator failed for ([65.20.169.121]) [65.20.169.121]:48588: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)65.20.169.12199237-  ?/ ossec1008g{Process exiting (killed).Apr 4 00:07:46 vm1 spamd[544222]: spamd: server killed by SIGTERM, shutting downC,  77 ossec502gOssec server started.ossec: Ossec started.8+  =k) ossec13008g%Mail Reciepient rejected2025-04-03 22:58:04 H=(mail.msnews24.in) [165.154.247.20]:61574 F= rejected RCPT : Rejected relay attempt: '165.154.247.20' From: 'ecmyhjaf@msnews24.in' To: 'validxxx@gmailhotmail.com.br'165.154.247.201605651'*  3S) ossec11301g%New FTP connection.Apr 3 22:32:27 vm1 pure-ftpd[834643]: (?@139.162.176.29) [INFO] New connection from 139.162.176.29139.162.176.292921044Y)  -=+ ossec13001g{Exim Auth failed2025-04-03 22:29:38 dovecot_login authenticator failed for ([196.191.212.238]) [196.191.212.238]:44558: 535 Incorrect authentication data (set_id=sales)196.191.212.238337996g(  -[' ossec13001goExim Auth failed2025-04-03 22:29:27 dovecot_login authenticator failed for ([114.30.180.58]) [114.30.180.58]:47487: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)114.30.180.581835841 & 2 N i *zILTiSJ  -3' ossec13001gExim Auth failed2025-04-04 01:29:29 dovecot_login authenticator failed for ([46.253.88.205]) [46.253.88.200]:51588: 535 Incorrect authentication data (set_id=info)46.253.88.2006254930gI  -_% ossec13001gExim Auth failed2025-04-04 01:29:18 dovecot_login authenticator failed for ([89.45.83.229]) [89.45.83.229]:33104: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)89.45.83.229798549tH  -u' ossec13001g-Exim Auth failed2025-04-04 01:19:01 dovecot_login authenticator failed for (mamanguape.static.gvt.net.br) [177.207.248.5]:50661: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)177.207.248.53469034yG  -}) ossec13001gExim Auth failed2025-04-04 01:18:41 dovecot_login authenticator failed for 91-241-150-246-dyn.neotele.com.ru [91.241.150.246]:33154: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)91.241.150.2462017370QF  -1% ossec13001g'Exim Auth failed2025-04-04 01:18:54 dovecot_login authenticator failed for ([117.6.241.38]) [117.6.241.38]:39503: 535 Incorrect authentication data (set_id=sales)117.6.241.381562822mE  -c+ ossec13001gExim Auth failed2025-04-04 01:18:43 dovecot_login authenticator failed for ([183.109.195.179]) [183.109.195.179]:52448: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)183.109.195.1791835841'D  3S) ossec11301gNew FTP connection.Apr 4 01:17:01 vm1 pure-ftpd[877459]: (?@198.235.24.206) [INFO] New connection from 198.235.24.206198.235.24.2066252001PC  -/% ossec13001gExim Auth failed2025-04-04 01:16:49 dovecot_login authenticator failed for ([60.175.91.53]) [60.175.91.53]:40720: 535 Incorrect authentication data (set_id=test)60.175.91.531814991hB  -_% ossec13001gExim Auth failed2025-04-04 01:16:24 dovecot_login authenticator failed for ([50.217.40.11]) [50.217.40.11]:40190: 535 Incorrect authentication data (set_id=test@saintsoldiercollege.com)50.217.40.116252001,A  CM+ ossec5716gSSHD authentication failed.Apr 4 01:14:13 vm1 sshd[876663]: Failed password for mysql from 117.148.110.118 port 47469 ssh2117.148.110.11818149911@ a7+ ossec5710gAttempt to login using a non-existent userApr 4 01:13:55 vm1 sshd[876601]: Invalid user hduser from 117.148.110.118 port 46816117.148.110.1181814991W? E+ ossec2501gUser authentication failure.Apr 4 01:13:55 vm1 sshd[876601]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=117.148.110.118117.148.110.1181814991+>  CK+ ossec5716gSSHD authentication failed.Apr 4 01:13:44 vm1 sshd[876583]: Failed password for root from 117.148.110.118 port 47518 ssh2117.148.110.1181814991a=  E5+ ossec2501gUser authentication failure.Apr 4 01:13:42 vm1 sshd[876583]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=117.148.110.118 user=root117.148.110.1181814991`<  -M' ossec13001gExim Auth failed2025-04-04 01:08:41 dovecot_login authenticator failed for (orlovnikita908.serv.host) [213.176.73.56]:37434: 535 Incorrect authentication data (set_id=services)213.176.73.563017382p;  -i+ ossec13001gExim Auth failed2025-04-04 01:08:32 dovecot_login authenticator failed for ([201.234.106.216]) [201.234.106.216]:39888: 535 Incorrect authentication data (set_id=services@heipowersystem.com)201.234.106.2163865483U:  -7' ossec13001gExim Auth failed2025-04-04 01:03:59 dovecot_login authenticator failed for ([49.124.151.52]) [49.124.151.52]:56762: 535 Incorrect authentication data (set_id=office)49.124.151.521733045}9  -+ ossec13001gExim Auth failed2025-04-04 01:03:46 dovecot_login authenticator failed for p47139-obmd01.osaka.ocn.ne.jp [153.141.234.139]:35685: 535 Incorrect authentication data (set_id=office@saintsoldiercollege.com)153.141.234.1391861060    7cqWZ  -9) ossec13001gExim Auth failed2025-04-04 02:47:39 dovecot_login authenticator failed for ([200.199.32.174]) [200.199.32.174]:45217: 535 Incorrect authentication data (set_id=admin)200.199.32.1743469034{Y  -' ossec13001gExim Auth failed2025-04-04 02:47:26 dovecot_login authenticator failed for 111-70-23-241.emome-ip.hinet.net [111.70.23.241]:41354: 535 Incorrect authentication data (set_id=admin@saintsoldiercollege.com)111.70.23.2411668284[X  -?+ ossec13001gExim Auth failed2025-04-04 02:38:51 dovecot_login authenticator failed for ([175.205.126.214]) [175.205.126.214]:58906: 535 Incorrect authentication data (set_id=office)175.205.126.2141835841mW  -g' ossec13001gExim Auth failed2025-04-04 02:38:32 dovecot_login authenticator failed for ([113.192.69.10]) [113.192.69.10]:35726: 535 Incorrect authentication data (set_id=office@saintsoldiercollege.com)113.192.69.101835841eV  -Y% ossec13001gHExim Auth failed2025-04-04 02:36:15 dovecot_login authenticator failed for syn-074-062-020-170.biz.spectrum.com [74.62.20.170]:42947: 535 Incorrect authentication data (set_id=sales)74.62.20.1706252001`U  -S# ossec13001g:Exim Auth failed2025-04-04 02:36:02 dovecot_login authenticator failed for ([5.32.22.218]) [5.32.22.218]:45096: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)5.32.22.218290557WT  -9) ossec13001gExim Auth failed2025-04-04 02:29:38 dovecot_login authenticator failed for ([36.150.108.132]) [211.90.236.101]:19134: 535 Incorrect authentication data (set_id=admin)211.90.236.1011814991nS  -i' ossec13001gExim Auth failed2025-04-04 02:29:25 dovecot_login authenticator failed for sj4e9k.g-service.ru [91.132.21.180]:54392: 535 Incorrect authentication data (set_id=admin@saintsoldiercollege.com)91.132.21.1802017370PR  -1# ossec13001gzExim Auth failed2025-04-04 01:58:41 dovecot_login authenticator failed for ([103.60.89.251]) [103.60.89.2]:50584: 535 Incorrect authentication data (set_id=admin)103.60.89.21643084TQ  -3) ossec13001gtExim Auth failed2025-04-04 01:58:35 dovecot_login authenticator failed for p236050-obmd01.tokyo.ocn.ne.jp [153.141.145.50]:33476: 535 Incorrect authentication data153.141.145.501861060P  -) ossec13001g\Exim Auth failed2025-04-04 01:58:10 dovecot_login authenticator failed for (customer.chcoilx1.pop.starlinkisp.net) [129.222.28.111]:63146: 535 Incorrect authentication data (set_id=admin@saintsoldiercollege.com)129.222.28.1116252001pO  -m' ossec13001gExim Auth failed2025-04-04 01:50:19 dovecot_login authenticator failed for (s2seducationtrust.com) [221.229.216.1]:53252: 535 Incorrect authentication data (set_id=admin@s2seducationtrust.com)221.229.216.11814991SN  -5% ossec13001gkExim Auth failed2025-04-04 01:49:55 dovecot_login authenticator failed for ([46.72.147.18]) [46.72.147.18]:54656: 535 Incorrect authentication data (set_id=contact)46.72.147.182017370\M  -E' ossec13001giExim Auth failed2025-04-04 01:49:53 dovecot_login authenticator failed for (s2seducationtrust.com) [221.229.216.1]:49202: 535 Incorrect authentication data (set_id=nologin)221.229.216.11814991L  -) ossec13001g]Exim Auth failed2025-04-04 01:49:41 dovecot_login authenticator failed for syn-173-095-123-220.biz.spectrum.com [173.95.123.220]:45519: 535 Incorrect authentication data (set_id=contact@saintsoldiercollege.com)173.95.123.22062520013K  =c' ossec13008gMail Reciepient rejected2025-04-04 01:48:31 H=(mail.msnews24.in) [45.197.14.138]:52388 F= rejected RCPT : Rejected relay attempt: '45.197.14.138' From: 'hetyemo@msnews24.in' To: 'validxxx@gmailhotmail.com.br'45.197.14.1386252001   & M b m  Tj  -5' ossec13001g |Exim Auth failed2025-04-04 03:58:10 dovecot_login authenticator failed for ([5.129.134.103]) [5.129.134.103]:57530: 535 Incorrect authentication data (set_id=admin)5.129.134.1032017370i  - ' ossec13001g nExim Auth failed2025-04-04 03:57:57 dovecot_login authenticator failed for syn-074-218-095-154.biz.spectrum.com [74.218.95.154]:60212: 535 Incorrect authentication data (set_id=admin@saintsoldiercollege.com)74.218.95.1546252001]h  -C+ ossec13001g :Exim Auth failed2025-04-04 03:57:05 dovecot_login authenticator failed for ([103.186.221.174]) [103.186.221.174]:35338: 535 Incorrect authentication data (set_id=services)103.186.221.1741269750mg  -e) ossec13001g 0Exim Auth failed2025-04-04 03:56:55 dovecot_login authenticator failed for ([45.201.140.227]) [45.201.140.227]:56198: 535 Incorrect authentication data (set_id=services@heipowersystem.com)45.201.140.2271831722Pf  -/% ossec13001gExim Auth failed2025-04-04 03:41:51 dovecot_login authenticator failed for ([27.2.214.145]) [27.2.214.145]:43324: 535 Incorrect authentication data (set_id=info)27.2.214.1451562822~e  - ' ossec13001gExim Auth failed2025-04-04 03:41:41 dovecot_login authenticator failed for 069.138.48.116.static.netvigator.com [116.48.138.69]:64393: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)116.48.138.6918197306d  =g) ossec13008gZMail Reciepient rejected2025-04-04 03:36:16 H=(mail.msnews24.in) [165.154.228.93]:59391 F= rejected RCPT : Rejected relay attempt: '165.154.228.93' From: 'pnqgqdy@msnews24.in' To: 'validxxx@gmailhotmail.com.br'165.154.228.931643084ec  -W' ossec13001gExim Auth failed2025-04-04 03:17:46 dovecot_login authenticator failed for (ool-4b7fcd5b.static.optonline.net) [75.127.205.91]:51742: 535 Incorrect authentication data (set_id=info)75.127.205.916252001nb  -g) ossec13001gExim Auth failed2025-04-04 03:17:36 dovecot_login authenticator failed for ([220.93.167.144]) [220.93.167.144]:55044: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)220.93.167.1441835841Ya  -;+ ossec13001gExim Auth failed2025-04-04 03:13:29 dovecot_login authenticator failed for ([220.174.209.156]) [220.174.209.160]:40383: 535 Incorrect authentication data (set_id=test)220.174.209.1601814991T`  -5' ossec13001gExim Auth failed2025-04-04 03:13:21 dovecot_login authenticator failed for ([1.227.228.136]) [1.227.228.136]:50431: 535 Incorrect authentication data (set_id=sales)1.227.228.1361835841q_  -k+ ossec13001gExim Auth failed2025-04-04 03:13:17 dovecot_login authenticator failed for ([222.223.187.146]) [222.223.187.146]:44328: 535 Incorrect authentication data (set_id=test@saintsoldiercollege.com)222.223.187.1461814991g^  -[' ossec13001gExim Auth failed2025-04-04 03:13:05 dovecot_login authenticator failed for ([95.66.153.194]) [95.66.153.194]:51031: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)95.66.153.1942017370U]  -3+ ossec13001gExim Auth failed2025-04-04 03:12:49 dovecot_login authenticator failed for p94238-obmd01.tokyo.ocn.ne.jp [124.101.250.238]:50097: 535 Incorrect authentication data124.101.250.2381861060_\  -K' ossec13001gExim Auth failed2025-04-04 02:52:33 dovecot_login authenticator failed for ([89.175.253.49]) [89.175.253.49]:59542: 535 Incorrect authentication data (set_id=vikas.khandelwal)89.175.253.492017370s[  -s) ossec13001gExim Auth failed2025-04-04 02:52:14 dovecot_login authenticator failed for ([89.211.42.163]) [212.70.106.228]:10669: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)212.70.106.228289688 n# ! D 9 Y en6MTnbz  -O) ossec13001g#Exim Auth failed2025-04-04 05:41:21 dovecot_login authenticator failed for ([122.227.206.42]) [122.227.206.42]:47934: 535 Incorrect authentication data (set_id=vikas.khandelwal)122.227.206.421814991uy  -u) ossec13001g#Exim Auth failed2025-04-04 05:40:43 dovecot_login authenticator failed for ([222.105.182.88]) [222.105.182.88]:45272: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)222.105.182.881835841ex  -S+ ossec13001g#Exim Auth failed2025-04-04 05:40:57 dovecot_login authenticator failed for ([112.172.117.110]) [112.172.117.110]:40930: 535 Incorrect authentication data (set_id=vikas.khandelwal)112.172.117.11018358414w  =c) ossec13008g Mail Reciepient rejected2025-04-04 05:29:36 H=(mail.msnews24.in) [165.154.247.20]:51979 F= rejected RCPT : Rejected relay attempt: '165.154.247.20' From: 'zafmjn@msnews24.in' To: 'validxxx@gmailhotmail.com.br'165.154.247.201605651v  W) ossec9708gDovecot Aborted Login with empty userApr 4 05:24:11 vm1 dovecot[1526]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=185.247.137.32, lip=103.74.54.108, TLS, session=<9UiKfOgxI52594kg>185.247.137.32298795u  W+ ossec9708gDovecot Aborted Login with empty userApr 4 05:12:22 vm1 dovecot[1526]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=185.247.137.111, lip=103.74.54.108, TLS, session=185.247.137.111298795st  -o+ ossec13001gExim Auth failed2025-04-04 05:00:37 dovecot_login authenticator failed for ([157.122.183.220]) [157.122.183.220]:59470: 535 Incorrect authentication data (set_id=office@saintsoldiercollege.com)157.122.183.2201814991fs  -[% ossec13001g'Exim Auth failed2025-04-04 05:00:46 dovecot_login authenticator failed for 47-184-87-26.dlls.tx.frontiernet.net [47.184.87.26]:52528: 535 Incorrect authentication data (set_id=office)47.184.87.266252001Rr  -3% ossec13001gExim Auth failed2025-04-04 04:46:42 dovecot_login authenticator failed for ([31.173.2.182]) [31.173.2.182]:52922: 535 Incorrect authentication data (set_id=office)31.173.2.1822017370pq  -k) ossec13001gExim Auth failed2025-04-04 04:46:33 dovecot_login authenticator failed for ([211.44.170.154]) [211.44.170.154]:33348: 535 Incorrect authentication data (set_id=office@saintsoldiercollege.com)211.44.170.1541835841\p  -A+ ossec13001g Exim Auth failed2025-04-04 04:30:24 dovecot_login authenticator failed for ([119.198.191.130]) [119.198.191.130]:46502: 535 Incorrect authentication data (set_id=contact)119.198.191.1301835841o  -) ossec13001gExim Auth failed2025-04-04 04:30:11 dovecot_login authenticator failed for broadband-188-255-34-171.ip.moscow.rt.ru [188.255.34.171]:58548: 535 Incorrect authentication data (set_id=contact@saintsoldiercollege.com)188.255.34.1712017370Yn  -;+ ossec13001gVExim Auth failed2025-04-04 04:14:37 dovecot_login authenticator failed for ([125.143.215.216]) [125.143.215.216]:41614: 535 Incorrect authentication data (set_id=test)125.143.215.2161835841~m  -) ossec13001gBExim Auth failed2025-04-04 04:14:17 dovecot_login authenticator failed for (static-202-65-144-172.pol.net.in) [202.65.144.172]:49368: 535 Incorrect authentication data (set_id=test@saintsoldiercollege.com)202.65.144.1721269750Zl -?' ossec13001gExim Auth failed2025-04-04 04:13:28 dovecot_login authenticator failed for (heipowersystem.com) [111.207.12.99]:50046: 535 Incorrect authentication data (set_id=nologin)111.207.12.991814991{k  -) ossec13001g Exim Auth failed2025-04-04 04:06:59 dovecot_login authenticator failed for (institutognosis.static.gvt.net.br) [177.99.225.161]:41436: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)177.99.225.1613469034  ) S j v8Phkl  -e' ossec13001g3Exim Auth failed2025-04-04 06:50:41 dovecot_login authenticator failed for ([103.246.45.57]) [103.246.45.57]:54620: 535 Incorrect authentication data (set_id=admin@saintsoldiercollege.com)103.246.45.571269750Z  -?) ossec13001g2Exim Auth failed2025-04-04 06:45:29 dovecot_login authenticator failed for ([158.140.39.128]) [158.140.39.128]:34106: 535 Incorrect authentication data (set_id=services)158.140.39.1286252001m  -e) ossec13001g2Exim Auth failed2025-04-04 06:45:14 dovecot_login authenticator failed for ([207.102.66.226]) [207.102.66.226]:58937: 535 Incorrect authentication data (set_id=services@heipowersystem.com)207.102.66.2266251999c  -S' ossec13001g)9Exim Auth failed2025-04-04 06:05:03 dovecot_login authenticator failed for ([121.154.90.47]) [121.154.90.47]:33156: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)121.154.90.471835841y  -}) ossec13001g)Exim Auth failed2025-04-04 06:04:37 dovecot_login authenticator failed for ([195.222.57.183]) [195.222.57.183]:45896: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)195.222.57.1833277605d  -S) ossec13001g(kExim Auth failed2025-04-04 06:01:37 dovecot_login authenticator failed for ip-142-90-226-196.user.start.ca [142.90.226.196]:48628: 535 Incorrect authentication data (set_id=sales)142.90.226.1966251999d  -W% ossec13001g(YExim Auth failed2025-04-04 06:01:20 dovecot_login authenticator failed for ([61.81.151.97]) [61.81.151.97]:38444: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)61.81.151.9718358417  Ag' ossec11302g'FTP Authentication failed.Apr 4 05:58:54 vm1 pure-ftpd[940316]: (?@34.140.170.97) [WARNING] Authentication failed for user [anonymous]34.140.170.972802361% 3O' ossec11301g'New FTP connection.Apr 4 05:58:48 vm1 pure-ftpd[940316]: (?@34.140.170.97) [INFO] New connection from 34.140.170.9734.140.170.972802361V  -7) ossec13001g'Exim Auth failed2025-04-04 05:57:51 dovecot_login authenticator failed for ([119.201.59.224]) [119.201.59.224]:34269: 535 Incorrect authentication data (set_id=test)119.201.59.2241835841p  -k+ ossec13001g'vExim Auth failed2025-04-04 05:57:33 dovecot_login authenticator failed for ([196.189.124.218]) [196.189.124.218]:47312: 535 Incorrect authentication data (set_id=test@saintsoldiercollege.com)196.189.124.218337996e  -]! ossec13001g'PExim Auth failed2025-04-04 05:56:55 dovecot_login authenticator failed for ([1.30.20.98]) [1.30.20.98]:44422: 535 Incorrect authentication data (set_id=contact@saintsoldiercollege.com)1.30.20.981814991R  -5% ossec13001g'`Exim Auth failed2025-04-04 05:57:12 dovecot_login authenticator failed for ([5.11.162.163]) [5.11.162.163]:42891: 535 Incorrect authentication data (set_id=contact)5.11.162.163298795s~  -u% ossec13001g'Exim Auth failed2025-04-04 05:55:40 dovecot_login authenticator failed for 128.16.3.213.static.wline.lns.sme.cust.swisscom.ch [213.3.16.128]:51680: 535 Incorrect authentication data (set_id=admin)213.3.16.1282658434u}  -u) ossec13001g&Exim Auth failed2025-04-04 05:55:26 dovecot_login authenticator failed for 90-176-243-225.rcj.o2.cz [90.176.243.225]:53090: 535 Incorrect authentication data (set_id=admin@saintsoldiercollege.com)90.176.243.2253077311^|  -K% ossec13001g$Exim Auth failed2025-04-04 05:46:54 dovecot_login authenticator failed for (undefined.hostname.localhost) [103.90.97.98]:52022: 535 Incorrect authentication data (set_id=info)103.90.97.981269750{  -' ossec13001g$Exim Auth failed2025-04-04 05:46:41 dovecot_login authenticator failed for broadband-95-84-131-125.ip.moscow.rt.ru [95.84.131.125]:36050: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)95.84.131.1252017370 ~qdWJ=0# zm`SF9, v i \ O B 5 (     r e X K > 1 $  { n a T G  wj]PC6)sfM@3& }pcVI</"naTG:- w^QD7* ; / #  Z{k  r e X K > 1 $  { n a T G : - 1880251O 1880251Ow 1880251Ov 1880251Ou 1880251Ot 1880251O) 1880251N 1880251N 1880251N 1880251N 192950N 1880251N. 1880251N 1880251M 1880251M 1880251M 1880251Mz 1880251My 1880251Mx 1880251Mu 1880251Mo 1880251L 1880251L 1880251L 1880251L 1880251L 1880251K 1880251K+ 1880251J 1880251J 1880251I 192950Is 1880251H] 1880251HT 192950H 1880251Gc 1880251G8 1880251F 1880251F 1880251F 1880251F 1880251F 1880251E 1880251E 1880251E 1880251E 1880251E 1880251E 1880251E 1880251E 1880251E 1880251E 1880251Ey 1880251Ex 1880251Ew 1880251Ev 1880251Eu 1880251Et 1880251Eg 1880251Ef 1880251E\ 1880251E[ 1880251E 1880251D 1880251D 1880251D 1880251C 1880251C 192950C 1880251Cr 1880251C 1880251B 1880251B 1880251B* 1880251B) 1880251B( 1880251B% 1880251B 1880251A 1880251A 1880251A 1880251Az 1880251@ 1880251@ 1880251@ 1880251@X 1880251@ 1880251? 1880251?} 1880251?| 1880251?{ 1880251= 1880251< 1880251Exim Auth failed2025-04-04 07:36:41 dovecot_login authenticator failed for static-200-105-141-170.acelerate.net (static-200-105-141-161.acelerate.net) [200.105.141.170]:37164: 535 Incorrect authentication data (set_id=office@saintsoldiercollege.com)200.105.141.1703923057u  -w' ossec13001g<Exim Auth failed2025-04-04 07:27:34 dovecot_login authenticator failed for (abts-mp-dynamic-010.248.70.182.airtelbroadband.in) [182.70.248.10]:33206: 535 Incorrect authentication data (set_id=test)182.70.248.101269750e  -[# ossec13001g<Exim Auth failed2025-04-04 07:27:26 dovecot_login authenticator failed for ([101.13.3.72]) [101.13.3.72]:50580: 535 Incorrect authentication data (set_id=test@saintsoldiercollege.com)101.13.3.721668284$  3O' ossec11301g9New FTP connection.Apr 4 07:16:05 vm1 pure-ftpd[958038]: (?@38.110.46.210) [INFO] New connection from 38.110.46.21038.110.46.21062520015  Ae% ossec11302g9FTP Authentication failed.Apr 4 07:14:42 vm1 pure-ftpd[957681]: (?@196.251.73.5) [WARNING] Authentication failed for user [anonymous]196.251.73.52750405!  3K% ossec11301g9New FTP connection.Apr 4 07:14:36 vm1 pure-ftpd[957681]: (?@196.251.73.5) [INFO] New connection from 196.251.73.5196.251.73.52750405z  -' ossec13001g5Exim Auth failed2025-04-04 06:57:38 dovecot_login authenticator failed for h77-94-125-250.static.bashtel.ru [77.94.125.250]:50980: 535 Incorrect authentication data (set_id=info@saintsoldiercollege.com)77.94.125.2502017370f  -Y' ossec13001g5Exim Auth failed2025-04-04 06:57:48 dovecot_login authenticator failed for 042.36.246.220.static.netvigator.com [220.246.36.42]:52841: 535 Incorrect authentication data (set_id=info)220.246.36.421819730b  -Q' ossec13001g5.Exim Auth failed2025-04-04 06:56:05 dovecot_login authenticator failed for (adsl-181-129-31-42.une.net.co) [181.129.31.42]:59072: 535 Incorrect authentication data (set_id=sales)181.129.31.423686110N  --# ossec13001g5$Exim Auth failed2025-04-04 06:55:56 dovecot_login authenticator failed for ([59.0.60.158]) [59.0.60.158]:53084: 535 Incorrect authentication data (set_id=sales)59.0.60.1581835841j  -_) ossec13001g5Exim Auth failed2025-04-04 06:55:35 dovecot_login authenticator failed for ([122.227.77.118]) [122.227.77.118]:45121: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)122.227.77.1181814991g  -[' ossec13001g5Exim Auth failed2025-04-04 06:55:33 dovecot_login authenticator failed for ([49.124.153.14]) [49.124.153.14]:47728: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)49.124.153.141733045$  3O' ossec11301g4New FTP connection.Apr 4 06:55:16 vm1 pure-ftpd[953228]: (?@91.238.181.96) [INFO] New connection from 91.238.181.9691.238.181.963017382q  -k+ ossec13001g4Exim Auth failed2025-04-04 06:54:57 dovecot_login authenticator failed for (134.227.160.222.adsl-pool.jlccptt.net.cn) [222.160.227.134]:42228: 535 Incorrect authentication data (set_id=sales)222.160.227.1341814991g  -[' ossec13001g4Exim Auth failed2025-04-04 06:54:45 dovecot_login authenticator failed for ([184.71.121.54]) [184.71.121.54]:54729: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)184.71.121.546251999V  -9' ossec13001g4dExim Auth failed2025-04-04 06:52:43 dovecot_login authenticator failed for ([222.87.49.250]) [222.87.49.250]:42293: 535 Incorrect authentication data (set_id=contact)222.87.49.2501814991h  -a# ossec13001g4NExim Auth failed2025-04-04 06:52:22 dovecot_login authenticator failed for ([1.85.13.198]) [1.85.13.198]:48490: 535 Incorrect authentication data (set_id=contact@saintsoldiercollege.com)1.85.13.1981814991W  -9) ossec13001g3Exim Auth failed2025-04-04 06:50:58 dovecot_login authenticator failed for ([210.99.223.203]) [210.99.223.203]:57154: 535 Incorrect authentication data (set_id=admin)210.99.223.2031835841 *\~tj`VLB8.$zpf\H>4*   v l b X N D : 0 &    ~ t j ` V L B 8 . $    z p f \ R H > 4 *  vlbXND:0&|rh^TJ@6,"xndZPF<2( ~jt`VL8.B$zpf\ | r h ^ T J @ 6 , "    x n d Z P F < 2 (   RRH>4*  vlbXND:0& g9 gR9 gD9 g?9 g-9 g)9 g9 g"9 g9 gv9 gf9 g 9 g9 g;9 gL9 g;9 g9 gs9 gc9 g\9 gF9 g9 g9 g9 g9 g9 g8 gӽ8 gӿ8 g`8 gT8 gϨ8 gϦ8 gϦ8 gb8 gb8 g8 g8 g8 g8 g8 gȊ8 gȂ8 gȀ8 gǾ8 g8 g~8 gv8 gr8 g8 g8 ga8 g 8 g 8 gﶱ8 gﭷ8 gﭩ8 g8 g8 g8 g8 g琢8 g懲8 g 8 g8 g98 g-8 gp8 gb8 gA8 g8 g8 g8 g8 g8 g~8 gt8 gB8 g.8 g8 g8 g}y8 gw8 gw8 gs8 gs8 grn8 grX8 go 8 go 8 go 8 go8 gbX8 gbX8 gbX8 gam8 gam8 gam8 ga-8 ga-8 ga-8 g`8 g`8 g`8 g_98 g_)8 g_8 g_8 g_98 g]$8 g]8 g]8 g\8 gZ8 gZ8 gQ+8 gQ!8 gP[8 gPi8 gM8 gM8 gJ8 gB8 g>8 g>8 g<8 g<8 g98 g98 g98 g58 g58 g5.8 g5$8 g58 g58 g48 g48 g48 g4d8 g4N8 g38 g38 g28 g28 g)98 g)8 g(k8 g(Y8 g'8 g'8 g'8 g'v8 g'`8 g'P8 g'8~ g&8} g$8| g$8{ g#8z g#8x g#8y g 8w g8v g8u g'8s g8t g8r g8q g 8p g?=9D g;9C g;9B g:9@ g:9A g79? g79> g69= g6 9< g6 9; g4+9: g1)99 g0]98 g0M97 g/96 g/95 g,(94 g,$93 g,"92 g,91 g,90 g,9/ g&9. g%C9- g$T9, g$N9+ g$B9* g$@9) g#9( g"9' g!9& gI9% g99$ g{9# gc9" g9! g9 gE9 g)9 g 9 g9 g9 g9 g8o gV8n gB8m g8l g 8k g |8j g n8i g :8h g 08g g8f g8e gZ8d g8c g8b g8a g8` g8_ g8^ g8] g8\ g8[ g8Z g8Y g8X g8W gH8V g:8U g8T g8S gz8R gt8Q g\8P g8O gk8N gi8M g]8L g8K g8J g8I g-8H g'8F g8E g?K9E g8G g8D g8C g8B g8A g8@ g8? g8> g8= g8< g8; g8: g89 gM88 gC87 gU86 gL85 gق84 gv83 gb82 gT81 g،80 g$8/ g8. g{8- g8, g%8+ g%8* g{8) go8( g8' g8& g8% gN8$ g8# g8" g8! g8 g8 g8 g8 g8 I'N K DYxI%/ CC% ossec5716g_SSHD authentication failed.Apr 4 09:54:57 vm1 sshd[993560]: Failed password for root from 42.94.120.45 port 3138 ssh242.94.120.451814991\. E/% ossec2501g_User authentication failure.Apr 4 09:54:55 vm1 sshd[993560]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=42.94.120.45 user=root42.94.120.451814991"- 3K% ossec11301g_9New FTP connection.Apr 4 09:55:27 vm1 pure-ftpd[993816]: (?@152.58.98.29) [INFO] New connection from 152.58.98.29152.58.98.291269750],  -G' ossec13001g]$Exim Auth failed2025-04-04 09:46:35 dovecot_login authenticator failed for (orlovnikita908.serv.host) [213.176.73.56]:34026: 535 Incorrect authentication data (set_id=sales)213.176.73.563017382g+  -[' ossec13001g]Exim Auth failed2025-04-04 09:46:13 dovecot_login authenticator failed for ([117.211.15.93]) [117.211.15.93]:44836: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)117.211.15.931269750W*  -9) ossec13001g]Exim Auth failed2025-04-04 09:46:08 dovecot_login authenticator failed for ([196.28.226.124]) [196.28.226.124]:56616: 535 Incorrect authentication data (set_id=sales)196.28.226.1241036973x)  -{) ossec13001g\Exim Auth failed2025-04-04 09:45:52 dovecot_login authenticator failed for (134.239.223.60.adsl-pool.sx.cn) [60.223.239.134]:43303: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)60.223.239.1341814991W(  -;' ossec13001gZExim Auth failed2025-04-04 09:36:05 dovecot_login authenticator failed for ([189.39.187.16]) [189.39.187.16]:40076: 535 Incorrect authentication data (set_id=services)189.39.187.163469034p'  -i+ ossec13001gZExim Auth failed2025-04-04 09:35:53 dovecot_login authenticator failed for ([210.177.249.193]) [210.177.249.193]:62222: 535 Incorrect authentication data (set_id=services@heipowersystem.com)210.177.249.1931819730f&  -W) ossec13001gQ+Exim Auth failed2025-04-04 08:55:31 dovecot_login authenticator failed for ([41.159.145.190]) [41.159.145.190]:56104: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)41.159.145.1902400553%  -% ossec13001gQ!Exim Auth failed2025-04-04 08:55:19 dovecot_login authenticator failed for h77-53-111-65.cust.bredband2.com [77.53.111.65]:60840: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)77.53.111.652661886m$  -c+ ossec13001gP[Exim Auth failed2025-04-04 08:52:02 dovecot_login authenticator failed for ([102.207.152.163]) [102.207.152.163]:53327: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)102.207.152.1633374766S#  -5' ossec13001gPiExim Auth failed2025-04-04 08:52:16 dovecot_login authenticator failed for ([196.0.115.198]) [196.0.115.198]:44502: 535 Incorrect authentication data (set_id=sales)196.0.115.198226074$"  3O' ossec11301gMNew FTP connection.Apr 4 08:40:45 vm1 pure-ftpd[976937]: (?@20.65.193.123) [INFO] New connection from 20.65.193.12320.65.193.1236252001'!  3S) ossec11301gMNew FTP connection.Apr 4 08:40:35 vm1 pure-ftpd[976913]: (?@104.152.52.226) [INFO] New connection from 104.152.52.226104.152.52.2266252001T  =#) ossec13008gJMail Reciepient rejected2025-04-04 08:27:40 H=(mail.thepsindustries.com) [165.154.228.59]:58362 F= rejected RCPT : Rejected relay attempt: '165.154.228.59' From: 'yvvdcextuk@thepsindustries.com' To: 'validxxx@gmailhotmail.com.br'165.154.228.591643084U -5' ossec13001gBExim Auth failed2025-04-04 07:51:04 dovecot_login authenticator failed for (rokamauka.com) [221.229.216.1]:40624: 535 Incorrect authentication data (set_id=nologin)221.229.216.11814991U  -7' ossec13001g>Exim Auth failed2025-04-04 07:36:50 dovecot_login authenticator failed for ([110.34.111.22]) [110.34.111.22]:41137: 535 Incorrect authentication data (set_id=office)110.34.111.221835841 ~qdWJ=0# zm`SF9, v i \ O B 5 (     r e X K > 1 $  { n a T G : -   w j ] P C 6 )    s f Y L ? 2 %  1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750 1269750~ 1269750} 1269750| 1269750{ 1269750z 1269750y 1269750x 1269750w 1269750v 1269750u 1269750t 1269750s 1269750r 1269750q 1269750p 1269750o 1269750n 1269750m 1269750l 1269750k 1269750j 1269750i 1269750h 1269750g 1269750f 1269750e 1269750d 1269750c 1269750b 1269750a 1269750` 1269750_ 1269750] 1269750\ 1269750[ 1269750Z 1269750Y 1269750X 1269750W 1269750V 1269750U 1269750T 1269750S 1269750R 1269750Q 1269750P 1269750O 1269750N 1269750M 1269750L 1269750K 1269750J 1269750I 1269750H 1269750G 1269750F 1269750E 1269750D 1269750C 1269750B 1269750A 1269750@ 1269750? 1269750> 1269750= 1269750< 1269750; 1269750: 12697509 12697508 12697507 12697506 12697505 12697504 N 8  F ' kgB  -[' ossec13001grXExim Auth failed2025-04-04 11:17:03 dovecot_login authenticator failed for ([60.166.31.198]) [60.166.31.198]:55821: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)60.166.31.1981814991@A  ;' ossec11325go Active Response. Stealth SSHD brute force attack detectedApr 4 11:02:55 vm1 sshd[1009027]: Invalid user germanyqa from 123.119.237.4 port 13207123.119.237.418149911@ a;' ossec5710go )Attempt to login using a non-existent userApr 4 11:02:55 vm1 sshd[1009035]: Invalid user germanyqa from 123.119.237.4 port 12220123.119.237.41814991T? E' ossec2501go User authentication failure.Apr 4 11:02:55 vm1 sshd[1009019]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=123.119.237.4123.119.237.418149911> a;' ossec5710goAttempt to login using a non-existent userApr 4 11:02:54 vm1 sshd[1009017]: Invalid user germanyqa from 123.119.237.4 port 11712123.119.237.41814991=  C+% ossec11313gbXFTP file uploaded to serverApr 4 10:08:47 vm1 pure-ftpd[996989]: (user@s2seducationtrust.com@152.58.98.29) [NOTICE] /home/techno/public_html/s2seducationtrust.com//Best-sainik-school-coaching.php uploaded (11986 bytes, 726.35KB/sec)152.58.98.2912697504<  Ca% ossec11309gbXFTP Authentication success.Apr 4 10:08:46 vm1 pure-ftpd[996989]: (?@152.58.98.29) [INFO] user@s2seducationtrust.com is now logged in152.58.98.291269750!;  3K% ossec11301gbXNew FTP connection.Apr 4 10:08:45 vm1 pure-ftpd[996989]: (?@152.58.98.29) [INFO] New connection from 152.58.98.29152.58.98.291269750!:  3K% ossec11301gamNew FTP connection.Apr 4 10:04:51 vm1 pure-ftpd[995946]: (?@152.58.98.29) [INFO] New connection from 152.58.98.29152.58.98.29126975049  Ca% ossec11309gamFTP Authentication success.Apr 4 10:04:51 vm1 pure-ftpd[995946]: (?@152.58.98.29) [INFO] user@s2seducationtrust.com is now logged in152.58.98.2912697508  C+% ossec11313gamFTP file uploaded to serverApr 4 10:04:52 vm1 pure-ftpd[995946]: (user@s2seducationtrust.com@152.58.98.29) [NOTICE] /home/techno/public_html/s2seducationtrust.com//Best-sainik-school-coaching.php uploaded (12369 bytes, 264.84KB/sec)152.58.98.291269750!7  3K% ossec11301ga-New FTP connection.Apr 4 10:03:47 vm1 pure-ftpd[995729]: (?@152.58.98.29) [INFO] New connection from 152.58.98.29152.58.98.29126975046  Ca% ossec11309ga-FTP Authentication success.Apr 4 10:03:47 vm1 pure-ftpd[995729]: (?@152.58.98.29) [INFO] user@s2seducationtrust.com is now logged in152.58.98.2912697505  C+% ossec11313ga-FTP file uploaded to serverApr 4 10:03:48 vm1 pure-ftpd[995729]: (user@s2seducationtrust.com@152.58.98.29) [NOTICE] /home/techno/public_html/s2seducationtrust.com//Best-sainik-school-coaching.php uploaded (12387 bytes, 479.36KB/sec)152.58.98.2912697504  C+% ossec11313g`FTP file uploaded to serverApr 4 10:02:40 vm1 pure-ftpd[995530]: (user@s2seducationtrust.com@152.58.98.29) [NOTICE] /home/techno/public_html/s2seducationtrust.com//Best-sainik-school-coaching.php uploaded (12340 bytes, 775.02KB/sec)152.58.98.291269750!3  3K% ossec11301g`New FTP connection.Apr 4 10:02:39 vm1 pure-ftpd[995530]: (?@152.58.98.29) [INFO] New connection from 152.58.98.29152.58.98.29126975042  Ca% ossec11309g`FTP Authentication success.Apr 4 10:02:39 vm1 pure-ftpd[995530]: (?@152.58.98.29) [INFO] user@s2seducationtrust.com is now logged in152.58.98.29126975051 Ca% ossec11309g_9FTP Authentication success.Apr 4 09:55:28 vm1 pure-ftpd[993816]: (?@152.58.98.29) [INFO] user@s2seducationtrust.com is now logged in152.58.98.291269750.0 a7% ossec5710g_)Attempt to login using a non-existent userApr 4 09:55:11 vm1 sshd[993769]: Invalid user tempuser01 from 42.94.120.45 port 359242.94.120.451814991 q( 2 H ]  ^uLqAT  ={+ ossec13008gAMail Reciepient rejected2025-04-04 13:58:48 H=(mail.msnews24.in) [165.154.232.243]:63839 F= rejected RCPT : Rejected relay attempt: '165.154.232.243' From: 'osatlzwjnsc@msnews24.in' To: 'validxxx@gmailhotmail.com.br'165.154.232.2431605651XS E!+ ossec2501gUser authentication failure.Apr 4 12:43:52 vm1 sshd[1031271]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.238.167.181183.238.167.18118149916R aA+ ossec5710gAttempt to login using a non-existent userApr 4 12:43:52 vm1 sshd[1031271]: Invalid user liudanmeng from 183.238.167.181 port 37094183.238.167.1811814991,Q  CM+ ossec5716gSSHD authentication failed.Apr 4 12:43:36 vm1 sshd[1031175]: Failed password for root from 183.238.167.181 port 36212 ssh2183.238.167.1811814991bP  E7+ ossec2501gUser authentication failure.Apr 4 12:43:34 vm1 sshd[1031175]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.238.167.181 user=root183.238.167.1811814991SO  -5' ossec13001gExim Auth failed2025-04-04 12:34:44 dovecot_login authenticator failed for ([82.150.88.194]) [82.150.88.194]:57775: 535 Incorrect authentication data (set_id=sales)82.150.88.194298795iN  -[+ ossec13001g~Exim Auth failed2025-04-04 12:34:30 dovecot_login authenticator failed for (tagsdev.click) [199.188.103.179]:48330: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)199.188.103.1796252001gM  -[' ossec13001gtExim Auth failed2025-04-04 12:34:20 dovecot_login authenticator failed for ([140.249.20.14]) [140.249.20.14]:43545: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)140.249.20.141814991`L  -O' ossec13001gBExim Auth failed2025-04-04 12:24:57 dovecot_login authenticator failed for (82.193.122.91.cl.ipnet.ua) [82.193.122.91]:47342: 535 Incorrect authentication data (set_id=services)82.193.122.91690791eK  -]% ossec13001g.Exim Auth failed2025-04-04 12:24:36 dovecot_login authenticator failed for ([65.20.191.43]) [65.20.191.43]:59171: 535 Incorrect authentication data (set_id=services@heipowersystem.com)65.20.191.4399237%J  3Q' ossec11301gNew FTP connection.Apr 4 12:23:02 vm1 pure-ftpd[1026798]: (?@206.168.34.95) [INFO] New connection from 206.168.34.95206.168.34.956252001$I  3Q' ossec11301gNew FTP connection.Apr 4 12:21:43 vm1 pure-ftpd[1026603]: (?@185.16.38.166) [INFO] New connection from 185.16.38.166185.16.38.166798544*H  3Y+ ossec11301g}yNew FTP connection.Apr 4 12:04:32 vm1 pure-ftpd[1022827]: (?@185.247.137.236) [INFO] New connection from 185.247.137.236185.247.137.236298795gG  -[' ossec13001gwExim Auth failed2025-04-04 11:40:24 dovecot_login authenticator failed for syn-024-043-131-106.biz.spectrum.com [24.43.131.106]:55976: 535 Incorrect authentication data (set_id=sales)24.43.131.1066252001fF  -[' ossec13001gwExim Auth failed2025-04-04 11:40:12 dovecot_login authenticator failed for ([151.252.197.3]) [151.252.197.3]:39262: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)151.252.197.3732800rE  -q' ossec13001gsExim Auth failed2025-04-04 11:20:14 dovecot_login authenticator failed for syn-156-019-080-138.biz.spectrum.com [156.19.80.138]:33097: 535 Incorrect authentication data (set_id=vikas.khandelwal)156.19.80.1386252001sD  -u) ossec13001gsExim Auth failed2025-04-04 11:19:54 dovecot_login authenticator failed for ([196.216.81.126]) [196.216.81.126]:44958: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)196.216.81.12649518]C  -I' ossec13001grnExim Auth failed2025-04-04 11:17:24 dovecot_login authenticator failed for (182.158.57.37.triolan.net) [37.57.158.182]:54776: 535 Incorrect authentication data (set_id=sales)37.57.158.182690791   * O X \ kxd  -y+ ossec13001g Exim Auth failed2025-04-04 16:57:06 dovecot_login authenticator failed for ([175.208.186.206]) [175.208.186.206]:51036: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)175.208.186.2061835841Ac  ={+ ossec13008gﶱMail Reciepient rejected2025-04-04 16:08:41 H=(mail.msnews24.in) [165.154.232.243]:54428 F= rejected RCPT : Rejected relay attempt: '165.154.232.243' From: 'lmhsdyxmwso@msnews24.in' To: 'validxxx@gmailhotmail.com.br'165.154.232.2431605651Nb  --# ossec13001gﭷExim Auth failed2025-04-04 15:30:22 dovecot_login authenticator failed for ([59.46.26.98]) [59.46.26.98]:22905: 535 Incorrect authentication data (set_id=sales)59.46.26.981814991ma  -c+ ossec13001gﭩExim Auth failed2025-04-04 15:30:09 dovecot_login authenticator failed for ([220.189.239.206]) [220.189.239.206]:39014: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)220.189.239.2061814991x`  -{) ossec13001gExim Auth failed2025-04-04 15:22:30 dovecot_login authenticator failed for (136-34-165-114.googlefiber.net) [136.34.165.114]:39839: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)136.34.165.1146252001c_  -S' ossec13001gExim Auth failed2025-04-04 15:22:48 dovecot_login authenticator failed for 221-120-57-56.emome-ip.hinet.net [221.120.57.56]:44326: 535 Incorrect authentication data (set_id=sales)221.120.57.561668284f^  -W) ossec13001gExim Auth failed2025-04-04 15:22:42 dovecot_login authenticator failed for 211-23-109-116.hinet-ip.hinet.net [211.23.109.116]:33018: 535 Incorrect authentication data (set_id=sales)211.23.109.1161668284g]  -[' ossec13001gExim Auth failed2025-04-04 15:22:35 dovecot_login authenticator failed for ([202.70.36.122]) [202.70.36.122]:44626: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)202.70.36.1222029969W\  -;' ossec13001g琢Exim Auth failed2025-04-04 15:12:33 dovecot_login authenticator failed for ([112.196.60.13]) [112.196.60.13]:60430: 535 Incorrect authentication data (set_id=services)112.196.60.131269750m[  -e) ossec13001g懲Exim Auth failed2025-04-04 15:12:23 dovecot_login authenticator failed for ([180.166.162.78]) [180.166.162.78]:64094: 535 Incorrect authentication data (set_id=services@heipowersystem.com)180.166.162.781814991xZ  -y+ ossec13001g Exim Auth failed2025-04-04 14:32:03 dovecot_login authenticator failed for 220-133-225-137.hinet-ip.hinet.net [220.133.225.137]:50966: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)220.133.225.1371668284sY  -u% ossec13001gExim Auth failed2025-04-04 14:31:50 dovecot_login authenticator failed for ([1.28.192.150]) [1.28.192.150]:60291: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)1.28.192.1501814991WX  -9) ossec13001g9Exim Auth failed2025-04-04 14:28:33 dovecot_login authenticator failed for ([211.114.40.201]) [211.114.40.201]:40797: 535 Incorrect authentication data (set_id=sales)211.114.40.2011835841dW  -W% ossec13001g-Exim Auth failed2025-04-04 14:28:21 dovecot_login authenticator failed for ([14.35.218.58]) [14.35.218.58]:56671: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)14.35.218.581835841tV  -s) ossec13001gpExim Auth failed2025-04-04 14:08:07 dovecot_login authenticator failed for syn-104-231-212-078.res.spectrum.com [104.231.212.78]:56235: 535 Incorrect authentication data (set_id=vikas.khandelwal)104.231.212.786252001rU  -q' ossec13001gbExim Auth failed2025-04-04 14:07:54 dovecot_login authenticator failed for ([45.115.173.11]) [45.115.173.11]:45143: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)45.115.173.111269750 {  ;  6?({)w 3U) ossec11301gbNew FTP connection.Apr 4 17:54:00 vm1 pure-ftpd[1101847]: (?@223.185.233.79) [INFO] New connection from 223.185.233.79223.185.233.791269750:v Cg) ossec11309gbFTP Authentication success.Apr 4 17:54:00 vm1 pure-ftpd[1101847]: (?@223.185.233.79) [INFO] user@s2seducationtrust.com is now logged in223.185.233.791269750Uu  E) ossec2501gUser authentication failure.Apr 4 17:43:19 vm1 sshd[1098690]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=39.144.130.16639.144.130.1661814991It ai) ossec5710gAttempt to login using a non-existent userApr 4 17:43:11 vm1 sshd[1098640]: Failed password for invalid user ubuntu from 39.144.130.166 port 18568 ssh239.144.130.1661814991/s  a7) ossec5710gAttempt to login using a non-existent userApr 4 17:43:08 vm1 sshd[1098640]: Invalid user ubuntu from 39.144.130.166 port 1856839.144.130.1661814991*r  CK) ossec5716gSSHD authentication failed.Apr 4 17:43:01 vm1 sshd[1098595]: Failed password for root from 39.144.130.166 port 18567 ssh239.144.130.1661814991aq E5) ossec2501gUser authentication failure.Apr 4 17:42:59 vm1 sshd[1098595]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=39.144.130.166 user=root39.144.130.16618149912p a;) ossec5710gȊAttempt to login using a non-existent userApr 4 17:24:49 vm1 sshd[1094375]: Invalid user hellmood from 39.144.128.102 port 4041739.144.128.1021814991*o  CK) ossec5716gȂSSHD authentication failed.Apr 4 17:24:41 vm1 sshd[1094342]: Failed password for root from 39.144.128.102 port 40416 ssh239.144.128.1021814991an E5) ossec2501gȀUser authentication failure.Apr 4 17:24:38 vm1 sshd[1094342]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=39.144.128.102 user=root39.144.128.1021814991|m  -+ ossec13001gǾExim Auth failed2025-04-04 17:21:26 dovecot_login authenticator failed for ([220.124.196.108]) [220.124.196.108]:32801: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)220.124.196.1081835841tl  -w' ossec13001gExim Auth failed2025-04-04 17:21:39 dovecot_login authenticator failed for (78.186.134.35.static.ttnet.com.tr) [78.186.134.35]:36414: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)78.186.134.35298795Ek  gY+ ossec11307g~Multiple connection attempts from same sourceApr 4 17:20:20 vm1 pure-ftpd[1093531]: (?@162.142.125.212) [INFO] New connection from 162.142.125.212162.142.125.2126252001,j 3Y+ ossec11301gvNew FTP connection.Apr 4 17:20:13 vm1 pure-ftpd[1093428]: (?@162.142.125.212) [INFO] New connection from 162.142.125.212162.142.125.2126252001+i  3Y+ ossec11301grNew FTP connection.Apr 4 17:20:10 vm1 pure-ftpd[1093426]: (?@162.142.125.212) [INFO] New connection from 162.142.125.212162.142.125.2126252001Th  -5' ossec13001gExim Auth failed2025-04-04 17:18:04 dovecot_login authenticator failed for ([175.202.82.16]) [175.202.82.16]:37730: 535 Incorrect authentication data (set_id=sales)175.202.82.161835841fg  -[' ossec13001gExim Auth failed2025-04-04 17:17:51 dovecot_login authenticator failed for ([95.156.54.174]) [95.156.54.174]:37678: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)95.156.54.174718075f  W) ossec9708gaDovecot Aborted Login with empty userApr 4 17:11:20 vm1 dovecot[1526]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=87.236.176.110, lip=103.74.54.108, TLS, session=87.236.176.1102635167_e  -K' ossec13001g Exim Auth failed2025-04-04 16:57:28 dovecot_login authenticator failed for ([183.6.118.248]) [183.6.118.248]:42931: 535 Incorrect authentication data (set_id=vikas.khandelwal)183.6.118.2481814991 T j+DlXU"  3M% ossec11301gNew FTP connection.Apr 4 19:56:15 vm1 pure-ftpd[1128715]: (?@64.62.156.24) [INFO] New connection from 64.62.156.2464.62.156.246252001  -+ ossec13001gsExim Auth failed2025-04-04 19:49:31 dovecot_login authenticator failed for sed08-h03-176-172-239-193.dsl.sta.abo.bbox.fr [176.172.239.193]:55112: 535 Incorrect authentication data (set_id=vikas.khandelwal)176.172.239.1933017382  --' ossec13001gcExim Auth failed2025-04-04 19:49:14 dovecot_login authenticator failed for 47-206-95-195.static.bhpk.fl.ip.frontiernet.net [47.206.95.195]:43641: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)47.206.95.1956252001T  -5' ossec13001g\Exim Auth failed2025-04-04 19:40:35 dovecot_login authenticator failed for ([121.154.90.47]) [121.154.90.47]:59554: 535 Incorrect authentication data (set_id=sales)121.154.90.471835841c  -W% ossec13001gFExim Auth failed2025-04-04 19:40:14 dovecot_login authenticator failed for ([41.220.3.113]) [41.220.3.101]:53890: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)41.220.3.101226074(  CI' ossec5716gSSHD authentication failed.Apr 4 19:21:06 vm1 sshd[1121160]: Failed password for root from 93.14.117.117 port 33202 ssh293.14.117.1173017382_ E3' ossec2501gUser authentication failure.Apr 4 19:21:04 vm1 sshd[1121160]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=93.14.117.117 user=root93.14.117.1173017382, a1' ossec5710gAttempt to login using a non-existent userApr 4 19:21:17 vm1 sshd[1121173]: Invalid user sftp from 93.14.117.117 port 3321293.14.117.1173017382(  3U) ossec11301gNew FTP connection.Apr 4 18:30:38 vm1 pure-ftpd[1110098]: (?@54.193.127.109) [INFO] New connection from 54.193.127.10954.193.127.1096252001T  -5' ossec13001gExim Auth failed2025-04-04 18:13:03 dovecot_login authenticator failed for ([61.185.30.170]) [61.185.30.170]:46524: 535 Incorrect authentication data (set_id=sales)61.185.30.1701814991Q  -1% ossec13001gExim Auth failed2025-04-04 18:13:00 dovecot_login authenticator failed for ([125.90.72.18]) [125.90.72.18]:51382: 535 Incorrect authentication data (set_id=sales)125.90.72.181814991z~  -' ossec13001gӽExim Auth failed2025-04-04 18:12:37 dovecot_login authenticator failed for 069.138.48.116.static.netvigator.com [116.48.138.69]:64679: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)116.48.138.691819730g}  -[' ossec13001gӿExim Auth failed2025-04-04 18:12:39 dovecot_login authenticator failed for ([218.22.187.69]) [218.22.187.66]:44313: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)218.22.187.661814991X|  -?' ossec13001g`Exim Auth failed2025-04-04 18:02:31 dovecot_login authenticator failed for ([196.191.212.235]) [213.55.85.202]:13329: 535 Incorrect authentication data (set_id=services)213.55.85.202337996|{  -) ossec13001gTExim Auth failed2025-04-04 18:02:20 dovecot_login authenticator failed for (rw-0060-209.199.103.rcil.gov.in) [103.199.209.60]:41356: 535 Incorrect authentication data (set_id=services@heipowersystem.com)103.199.209.601269750 z  C ) ossec11313gϨFTP file uploaded to serverApr 4 17:55:10 vm1 pure-ftpd[1102167]: (user@s2seducationtrust.com@223.185.233.79) [NOTICE] /home/techno/public_html/s2seducationtrust.com//Head_web.php uploaded (20168 bytes, 297.00KB/sec)223.185.233.7912697509y  Cg) ossec11309gϦFTP Authentication success.Apr 4 17:55:09 vm1 pure-ftpd[1102167]: (?@223.185.233.79) [INFO] user@s2seducationtrust.com is now logged in223.185.233.791269750(x  3U) ossec11301gϦNew FTP connection.Apr 4 17:55:09 vm1 pure-ftpd[1102167]: (?@223.185.233.79) [INFO] New connection from 223.185.233.79223.185.233.791269750 e  I L q w /d  -S) ossec13001gExim Auth failed2025-04-04 21:34:35 dovecot_plain authenticator failed for (hostglobal.plus) [78.153.140.207]:50084: 535 Incorrect authentication data (set_id=info@nyaystambh.com)78.153.140.2072635167B  gU) ossec11307gMultiple connection attempts from same sourceApr 4 21:13:21 vm1 pure-ftpd[1146225]: (?@196.251.117.40) [INFO] New connection from 196.251.117.40196.251.117.402750405) 3U) ossec11301gNew FTP connection.Apr 4 21:13:19 vm1 pure-ftpd[1146213]: (?@196.251.117.40) [INFO] New connection from 196.251.117.40196.251.117.402750405Z  -=+ ossec13001gRExim Auth failed2025-04-04 21:05:44 dovecot_login authenticator failed for ([175.203.245.102]) [175.203.245.102]:50862: 535 Incorrect authentication data (set_id=sales)175.203.245.1021835841W  -9) ossec13001gDExim Auth failed2025-04-04 21:05:31 dovecot_login authenticator failed for ([116.104.50.190]) [116.104.50.190]:52630: 535 Incorrect authentication data (set_id=sales)116.104.50.1901562822m  -e) ossec13001g?Exim Auth failed2025-04-04 21:05:27 dovecot_login authenticator failed for (nsg-corporate-78.229.187.122.airtel.in) [122.187.229.78]:59978: 535 Incorrect authentication data (set_id=sales)122.187.229.781269750]  -O! ossec13001g-Exim Auth failed2025-04-04 21:05:09 dovecot_login authenticator failed for ([2.55.70.26]) [2.55.70.26]:55830: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)2.55.70.26294640g  -[' ossec13001g)Exim Auth failed2025-04-04 21:05:04 dovecot_login authenticator failed for ([31.173.20.146]) [31.173.20.146]:50700: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)31.173.20.1462017370o  -m% ossec13001gExim Auth failed2025-04-04 20:54:52 dovecot_login authenticator failed for ns505325.ip-192-99-1.net [192.99.1.159]:35450: 535 Incorrect authentication data (set_id=services@heipowersystem.com)192.99.1.1596251999[  -K# ossec13001g"Exim Auth failed2025-04-04 20:13:45 dovecot_login authenticator failed for ([65.20.171.8]) [65.20.171.8]:54523: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)65.20.171.899237v  -y' ossec13001gExim Auth failed2025-04-04 20:13:35 dovecot_login authenticator failed for ([223.184.0.249]) [223.184.0.249]:42028: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)223.184.0.2491269750W  -9) ossec13001gvExim Auth failed2025-04-04 20:10:53 dovecot_login authenticator failed for ([61.143.241.150]) [61.143.241.150]:59598: 535 Incorrect authentication data (set_id=sales)61.143.241.1501814991y  -}) ossec13001gfExim Auth failed2025-04-04 20:10:37 dovecot_login authenticator failed for (173-25-186-130.client.mchsi.com) [173.25.186.130]:58929: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)173.25.186.1306252001:  Ak) ossec11302g FTP Authentication failed.Apr 4 20:09:27 vm1 pure-ftpd[1131668]: (?@34.140.220.111) [WARNING] Authentication failed for user [anonymous]34.140.220.1112802361) 3U) ossec11301gNew FTP connection.Apr 4 20:09:23 vm1 pure-ftpd[1131666]: (?@34.140.220.111) [INFO] New connection from 34.140.220.11134.140.220.1112802361- CM+ ossec5716g;SSHD authentication failed.Apr 4 19:57:07 vm1 sshd[1128856]: Failed password for root from 183.162.107.159 port 53144 ssh2183.162.107.15918149910 a5+ ossec5710gLAttempt to login using a non-existent userApr 4 19:57:22 vm1 sshd[1128897]: Invalid user kong from 183.162.107.159 port 53858183.162.107.1591814991c E7+ ossec2501g;User authentication failure.Apr 4 19:57:05 vm1 sshd[1128856]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.162.107.159 user=root183.162.107.1591814991 k 5 -UZ\~R,  -1' ossec13001g$TExim Auth failed2025-04-04 23:56:28 dovecot_login authenticator failed for ([1.71.191.42]) [223.11.217.59]:20490: 535 Incorrect authentication data (set_id=sales)223.11.217.591814991Z+  -=+ ossec13001g$NExim Auth failed2025-04-04 23:56:21 dovecot_login authenticator failed for ([182.106.213.108]) [182.106.213.108]:42286: 535 Incorrect authentication data (set_id=sales)182.106.213.1081814991z*  -' ossec13001g$BExim Auth failed2025-04-04 23:56:10 dovecot_login authenticator failed for syn-024-090-169-209.res.spectrum.com [24.90.169.209]:35110: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)24.90.169.2096252001w)  -}' ossec13001g$@Exim Auth failed2025-04-04 23:56:08 dovecot_login authenticator failed for bzq-109-67-154-24.red.bezeqint.net [109.67.154.24]:60274: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)109.67.154.24294640T(  -5' ossec13001g#Exim Auth failed2025-04-04 23:50:54 dovecot_login authenticator failed for ([61.184.119.61]) [61.184.119.61]:38847: 535 Incorrect authentication data (set_id=sales)61.184.119.611814991i'  -_) ossec13001g"Exim Auth failed2025-04-04 23:50:43 dovecot_login authenticator failed for ([94.205.219.157]) [94.205.219.157]:48352: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)94.205.219.157290557T&  -7% ossec13001g!Exim Auth failed2025-04-04 23:46:03 dovecot_login authenticator failed for ([103.86.16.88]) [103.86.16.88]:39564: 535 Incorrect authentication data (set_id=services)103.86.16.881269750f%  -W) ossec13001gIExim Auth failed2025-04-04 23:05:05 dovecot_login authenticator failed for ([122.166.249.31]) [122.166.249.31]:55378: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)122.166.249.311269750v$  -y' ossec13001g9Exim Auth failed2025-04-04 23:04:49 dovecot_login authenticator failed for ([49.124.151.20]) [49.124.151.20]:59606: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)49.124.151.201733045W#  -9) ossec13001g{Exim Auth failed2025-04-04 23:01:37 dovecot_login authenticator failed for ([180.158.100.49]) [180.158.100.49]:56838: 535 Incorrect authentication data (set_id=sales)180.158.100.491814991u"  -w' ossec13001gcExim Auth failed2025-04-04 23:01:15 dovecot_login authenticator failed for 42-200-141-56.static.imsbiz.com [42.200.141.56]:54376: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)42.200.141.561819730b!  -O) ossec13001gExim Auth failed2025-04-04 22:40:36 dovecot_login authenticator failed for ([146.235.193.77]) [146.235.193.77]:50572: 535 Incorrect authentication data (set_id=vikas.khandelwal)146.235.193.776252001u  -u) ossec13001gExim Auth failed2025-04-04 22:40:24 dovecot_login authenticator failed for ([49.124.152.211]) [49.124.152.211]:51704: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)49.124.152.2111733045(  3U) ossec11301gENew FTP connection.Apr 4 22:35:07 vm1 pure-ftpd[1164410]: (?@48.216.249.225) [INFO] New connection from 48.216.249.22548.216.249.22562520012  =_) ossec13008g)Mail Reciepient rejected2025-04-04 22:26:07 H=(mail.msnews24.in) [165.154.210.52]:62370 F= rejected RCPT : Rejected relay attempt: '165.154.210.52' From: 'hlpxf@msnews24.in' To: 'validxxx@gmailhotmail.com.br'165.154.210.521694008(  3U) ossec11301g New FTP connection.Apr 4 22:10:57 vm1 pure-ftpd[1159130]: (?@198.235.24.183) [INFO] New connection from 198.235.24.183198.235.24.1836252001e -S) ossec13001gExim Auth failed2025-04-04 21:34:42 dovecot_login authenticator failed for (hostglobal.plus) [78.153.140.207]:50084: 535 Incorrect authentication data (set_id=info@nyaystambh.com)78.153.140.2072635167 U g ` r  +.= a7% ossec5710g6Attempt to login using a non-existent userApr 5 01:12:14 vm1 sshd[1200382]: Invalid user zhuzheng from 219.232.6.42 port 40750219.232.6.421814991&<  CG% ossec5716g6 SSHD authentication failed.Apr 5 01:12:03 vm1 sshd[1200362]: Failed password for root from 219.232.6.42 port 39748 ssh2219.232.6.421814991]; E1% ossec2501g6 User authentication failure.Apr 5 01:12:01 vm1 sshd[1200362]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=219.232.6.42 user=root219.232.6.4218149915:  _)1modsec77350470g4+IM360 WAF: Vulnerability scanner detectedIM360 WAF: Vulnerability scanner detected||RSV:6.83||RS:0||T:APACHE||147.185.132.486252001vm1.technobases.in49  =c) ossec13008g1)Mail Reciepient rejected2025-04-05 00:51:13 H=(mail.msnews24.in) [165.154.228.93]:55770 F= rejected RCPT : Rejected relay attempt: '165.154.228.93' From: 'hjgrwh@msnews24.in' To: 'validxxx@gmailhotmail.com.br'165.154.228.931643084`8  -O% ossec13001g0]Exim Auth failed2025-04-05 00:47:49 dovecot_login authenticator failed for ([58.18.81.242]) [58.18.81.242]:44761: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)58.18.81.24218149917  -% ossec13001g0MExim Auth failed2025-04-05 00:47:33 dovecot_login authenticator failed for c-71-62-34-216.hsd1.va.comcast.net [71.62.34.216]:51842: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)71.62.34.2166252001n6  -i' ossec13001g/Exim Auth failed2025-04-05 00:42:31 dovecot_login authenticator failed for dynamic-186-30-57-201.dynamic.etb.net.co [186.30.57.201]:64482: 535 Incorrect authentication data (set_id=services)186.30.57.2013686110p5  -i+ ossec13001g/Exim Auth failed2025-04-05 00:42:18 dovecot_login authenticator failed for ([125.140.244.144]) [125.140.244.144]:36324: 535 Incorrect authentication data (set_id=services@heipowersystem.com)125.140.244.1441835841W4  -9) ossec13001g,(Exim Auth failed2025-04-05 00:29:52 dovecot_login authenticator failed for ([220.178.39.106]) [220.178.39.106]:58522: 535 Incorrect authentication data (set_id=sales)220.178.39.1061814991Z3  -=+ ossec13001g,$Exim Auth failed2025-04-05 00:29:46 dovecot_login authenticator failed for ([103.152.234.134]) [103.152.234.134]:34568: 535 Incorrect authentication data (set_id=sales)103.152.234.1341643084e2  -U) ossec13001g,"Exim Auth failed2025-04-05 00:29:44 dovecot_login authenticator failed for (222-42-136-186.fibertel.com.ar) [186.136.42.222]:51488: 535 Incorrect authentication data (set_id=sales)186.136.42.2223865483j1  -_) ossec13001g,Exim Auth failed2025-04-05 00:29:37 dovecot_login authenticator failed for ([221.228.237.90]) [221.228.237.90]:27316: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)221.228.237.9018149910  -) ossec13001g,Exim Auth failed2025-04-05 00:29:31 dovecot_login authenticator failed for pool-108-18-206-153.washdc.fios.verizon.net [108.18.206.153]:46940: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)108.18.206.1536252001j/  -_) ossec13001g,Exim Auth failed2025-04-05 00:29:32 dovecot_login authenticator failed for ([74.196.184.120]) [74.196.184.120]:54746: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)74.196.184.1206252001.  ?/ ossec1008g&Process exiting (killed).Apr 5 00:05:56 vm1 spamd[861944]: spamd: server killed by SIGTERM, shutting down-  W+ ossec9708g%CDovecot Aborted Login with empty userApr 5 00:00:25 vm1 dovecot[1526]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=165.154.120.253, lip=103.74.54.108, TLS, session=165.154.120.2531605651 T $=:hTN  -5' ossec13001gLExim Auth failed2025-04-05 02:46:13 dovecot_login authenticator failed for ([140.249.20.14]) [140.249.20.14]:35945: 535 Incorrect authentication data (set_id=sales)140.249.20.141814991dM  -W% ossec13001gKExim Auth failed2025-04-05 02:45:32 dovecot_login authenticator failed for ([222.99.10.11]) [222.99.10.11]:60028: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)222.99.10.111835841NL  --# ossec13001gKExim Auth failed2025-04-05 02:45:32 dovecot_login authenticator failed for ([119.6.55.57]) [119.6.55.57]:56620: 535 Incorrect authentication data (set_id=sales)119.6.55.571814991K  -+ ossec13001gKExim Auth failed2025-04-05 02:45:17 dovecot_login authenticator failed for 123.129.198.203.static.netvigator.com [203.198.129.123]:58031: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)203.198.129.1231819730cJ  -W% ossec13001gKExim Auth failed2025-04-05 02:45:20 dovecot_login authenticator failed for ([5.11.164.165]) [5.11.164.165]:60187: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)5.11.164.165298795fI  -Y' ossec13001gIExim Auth failed2025-04-05 02:35:23 dovecot_login authenticator failed for 61-220-220-99.hinet-ip.hinet.net [61.220.220.99]:42402: 535 Incorrect authentication data (set_id=services)61.220.220.991668284hH  -_% ossec13001gI~Exim Auth failed2025-04-05 02:35:01 dovecot_login authenticator failed for ([187.218.57.50]) [138.84.56.88]:13237: 535 Incorrect authentication data (set_id=services@heipowersystem.com)138.84.56.883996063tG  -w% ossec13001g@Exim Auth failed2025-04-05 01:55:01 dovecot_login authenticator failed for syn-065-031-047-232.res.spectrum.com [65.31.47.232]:47327: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)65.31.47.2326252001 F  -) ossec13001g@ Exim Auth failed2025-04-05 01:54:42 dovecot_login authenticator failed for 186-45-242-231.dynamic.tstt.net.tt [186.45.242.231]:41571: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)186.45.242.2313573591WE  -9) ossec13001g?KExim Auth failed2025-04-05 01:51:31 dovecot_login authenticator failed for ([111.91.178.253]) [111.91.178.253]:58514: 535 Incorrect authentication data (set_id=sales)111.91.178.2531835841gD  -[' ossec13001g?=Exim Auth failed2025-04-05 01:51:16 dovecot_login authenticator failed for ([61.160.105.66]) [61.160.105.66]:56982: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)61.160.105.661814991|C  -+ ossec13001g;Exim Auth failed2025-04-05 01:37:18 dovecot_login authenticator failed for (203.173.209.139.adsl-pool.jlccptt.net.cn) [139.209.173.203]:15148: 535 Incorrect authentication data (set_id=vikas.khandelwal)139.209.173.2031814991zB  -' ossec13001g;Exim Auth failed2025-04-05 01:37:02 dovecot_login authenticator failed for (106.51.79.73.actcorp.in) [122.171.17.95]:17392: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)122.171.17.951269750lA  -i# ossec13001g:Exim Auth failed2025-04-05 01:31:02 dovecot_login authenticator failed for ([47.91.88.67]) [47.91.88.67]:60658: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)47.91.88.672921044b@  -O) ossec13001g:Exim Auth failed2025-04-05 01:31:15 dovecot_login authenticator failed for ([103.203.210.22]) [103.203.210.22]:35001: 535 Incorrect authentication data (set_id=vikas.khandelwal)103.203.210.2212697507?  Ae) ossec11302g7FTP Authentication failed.Apr 5 01:19:13 vm1 pure-ftpd[1201828]: (?@213.230.92.121) [WARNING] Authentication failed for user [server]213.230.92.1211512440(>  3U) ossec11301g7New FTP connection.Apr 5 01:19:08 vm1 pure-ftpd[1201828]: (?@213.230.92.121) [INFO] New connection from 213.230.92.121213.230.92.1211512440 7 AlJ>_  =w) ossec13008gdMail Reciepient rejected2025-04-05 06:59:06 H=(mail.msnews24.in) [165.154.247.20]:55122 F= rejected RCPT : Rejected relay attempt: '165.154.247.20' From: 'cmbnnojfvos@msnews24.in' To: 'validxxx@gmailhotmail.com.br'165.154.247.2016056513^  =c' ossec13008gMail Reciepient rejected2025-04-05 06:47:08 H=(mail.msnews24.in) [45.197.14.175]:52466 F= rejected RCPT : Rejected relay attempt: '45.197.14.175' From: 'vngtova@msnews24.in' To: 'validxxx@gmailhotmail.com.br'45.197.14.17562520016]  =g) ossec13008ghMail Reciepient rejected2025-04-05 04:49:02 H=(mail.msnews24.in) [165.154.247.20]:56120 F= rejected RCPT : Rejected relay attempt: '165.154.247.20' From: 'avjodbs@msnews24.in' To: 'validxxx@gmailhotmail.com.br'165.154.247.201605651d\  -W% ossec13001gfExim Auth failed2025-04-05 04:40:35 dovecot_login authenticator failed for ([27.71.27.213]) [27.71.27.213]:39869: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)27.71.27.2131562822([  3U) ossec11301gfNew FTP connection.Apr 5 04:40:14 vm1 pure-ftpd[1246562]: (?@205.210.31.235) [INFO] New connection from 205.210.31.235205.210.31.2356252001UZ  E) ossec2501geGUser authentication failure.Apr 5 04:33:34 vm1 sshd[1244855]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.214.14.228175.214.14.22818358411Y a9) ossec5710geEAttempt to login using a non-existent userApr 5 04:33:32 vm1 sshd[1244855]: Invalid user zhangyz from 175.214.14.228 port 34274175.214.14.2281835841aX E5) ossec2501ge-User authentication failure.Apr 5 04:33:07 vm1 sshd[1244817]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.214.14.228 user=root175.214.14.22818358412W a;) ossec5710ge9Attempt to login using a non-existent userApr 5 04:33:19 vm1 sshd[1244843]: Invalid user pabloftp from 175.214.14.228 port 40870175.214.14.2281835841*V  CK) ossec5716ge/SSHD authentication failed.Apr 5 04:33:09 vm1 sshd[1244817]: Failed password for root from 175.214.14.228 port 45170 ssh2175.214.14.2281835841_U  -K' ossec13001gbExim Auth failed2025-04-05 04:20:05 dovecot_login authenticator failed for ([188.247.40.70]) [188.247.40.70]:53560: 535 Incorrect authentication data (set_id=vikas.khandelwal)188.247.40.702017370rT  -q' ossec13001gb Exim Auth failed2025-04-05 04:19:48 dovecot_login authenticator failed for ([112.8.207.219]) [112.8.207.219]:40686: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)112.8.207.2191814991jS  -_) ossec13001g]Exim Auth failed2025-04-05 04:00:52 dovecot_login authenticator failed for ([118.45.101.159]) [118.45.101.159]:46420: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)118.45.101.1591835841WR  -9) ossec13001g]Exim Auth failed2025-04-05 04:01:20 dovecot_login authenticator failed for ([221.209.48.204]) [221.209.48.203]:51902: 535 Incorrect authentication data (set_id=sales)221.209.48.2031814991"Q  3M% ossec11301gTNew FTP connection.Apr 5 03:22:33 vm1 pure-ftpd[1229707]: (?@103.203.59.5) [INFO] New connection from 103.203.59.5103.203.59.51814991TP  -7% ossec13001gMExim Auth failed2025-04-05 02:53:25 dovecot_login authenticator failed for ([36.112.75.46]) [36.112.75.46]:47000: 535 Incorrect authentication data (set_id=services)36.112.75.461814991mO  -e) ossec13001gMExim Auth failed2025-04-05 02:53:12 dovecot_login authenticator failed for ([39.165.154.222]) [39.165.154.222]:57828: 535 Incorrect authentication data (set_id=services@heipowersystem.com)39.165.154.2221814991 U ' O R k "9Z U2q  Ac! ossec11302gFTP Authentication failed.Apr 5 09:38:15 vm1 pure-ftpd[1310789]: (?@18.97.5.71) [WARNING] Authentication failed for user [anonymous]18.97.5.716252001p  3E! ossec11301gNew FTP connection.Apr 5 09:38:12 vm1 pure-ftpd[1310789]: (?@18.97.5.71) [INFO] New connection from 18.97.5.7118.97.5.716252001+o  3Y+ ossec11301gNew FTP connection.Apr 5 09:34:46 vm1 pure-ftpd[1309899]: (?@156.229.233.180) [INFO] New connection from 156.229.233.180156.229.233.1806252001[n -A' ossec13001gExim Auth failed2025-04-05 08:34:19 dovecot_login authenticator failed for (thepsindustries.com) [111.61.229.78]:50032: 535 Incorrect authentication data (set_id=nologin)111.61.229.781814991em  -W' ossec13001gyExim Auth failed2025-04-05 08:24:47 dovecot_login authenticator failed for 81-230-83-162-no600.tbcn.telia.com [81.230.83.162]:55443: 535 Incorrect authentication data (set_id=sales)81.230.83.1622661886Wl  -9) ossec13001gkExim Auth failed2025-04-05 08:24:34 dovecot_login authenticator failed for ([103.251.143.14]) [103.251.143.14]:46130: 535 Incorrect authentication data (set_id=sales)103.251.143.141269750jk  -_) ossec13001g_Exim Auth failed2025-04-05 08:24:22 dovecot_login authenticator failed for ([195.122.224.64]) [195.122.224.64]:52784: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)195.122.224.642017370mj  -c+ ossec13001g[Exim Auth failed2025-04-05 08:24:18 dovecot_login authenticator failed for ([103.230.176.152]) [103.230.176.152]:39670: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)103.230.176.1521269750]i  -C+ ossec13001gExim Auth failed2025-04-05 08:14:09 dovecot_login authenticator failed for ([175.156.224.192]) [175.156.224.192]:38367: 535 Incorrect authentication data (set_id=services)175.156.224.1921880251jh  -a' ossec13001gExim Auth failed2025-04-05 08:13:58 dovecot_login authenticator failed for ([88.200.167.83]) [88.200.167.83]:54558: 535 Incorrect authentication data (set_id=services@heipowersystem.com)88.200.167.832017370Tg  -5' ossec13001gExim Auth failed2025-04-05 08:05:39 dovecot_login authenticator failed for ([58.222.184.18]) [58.222.184.18]:44280: 535 Incorrect authentication data (set_id=sales)58.222.184.181814991df  -W% ossec13001gExim Auth failed2025-04-05 08:05:26 dovecot_login authenticator failed for ([105.96.53.70]) [105.96.53.70]:44461: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)105.96.53.702589581ce  -S' ossec13001gjExim Auth failed2025-04-05 07:33:21 dovecot_login authenticator failed for ([170.81.14.113]) [170.81.14.113]:54975: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)170.81.14.1133469034yd  -}) ossec13001g^Exim Auth failed2025-04-05 07:33:08 dovecot_login authenticator failed for ([218.76.175.213]) [218.76.175.213]:43470: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)218.76.175.2131814991Tc  -5' ossec13001gExim Auth failed2025-04-05 07:29:57 dovecot_login authenticator failed for ([113.137.24.18]) [113.137.24.18]:48125: 535 Incorrect authentication data (set_id=sales)113.137.24.181814991gb  -[' ossec13001gExim Auth failed2025-04-05 07:29:42 dovecot_login authenticator failed for ([222.120.176.6]) [222.120.176.6]:45410: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)222.120.176.61835841qa  -q% ossec13001gExim Auth failed2025-04-05 07:09:22 dovecot_login authenticator failed for 50.35.170.34.bc.googleusercontent.com [34.170.35.50]:37116: 535 Incorrect authentication data (set_id=vikas.khandelwal)34.170.35.506252001u`  -u) ossec13001gExim Auth failed2025-04-05 07:08:59 dovecot_login authenticator failed for ([103.190.91.116]) [103.190.91.116]:48149: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)103.190.91.1161269750 $  0 8W]CUz+  3Y+ ossec11301g܎New FTP connection.Apr 5 13:02:29 vm1 pure-ftpd[1357491]: (?@172.171.245.204) [INFO] New connection from 172.171.245.204172.171.245.2046252001o  -m% ossec13001g١Exim Auth failed2025-04-05 12:50:01 dovecot_login authenticator failed for ([211.187.7.14]) [211.187.7.14]:59524: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)211.187.7.141835841m  -e) ossec13001gٵExim Auth failed2025-04-05 12:50:21 dovecot_login authenticator failed for fpda29d9e0.stmb204.ap.nuro.jp [218.41.217.224]:43621: 535 Incorrect authentication data (set_id=vikas.khandelwal)218.41.217.2241861060W  -9) ossec13001gExim Auth failed2025-04-05 12:16:51 dovecot_login authenticator failed for ([117.156.174.28]) [117.156.174.28]:39263: 535 Incorrect authentication data (set_id=sales)117.156.174.281814991j~  -_) ossec13001gExim Auth failed2025-04-05 12:16:29 dovecot_login authenticator failed for ([116.114.84.242]) [116.114.84.242]:47660: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)116.114.84.24218149918}  =k) ossec13008gMail Reciepient rejected2025-04-05 11:25:47 H=(mail.msnews24.in) [165.154.247.20]:63559 F= rejected RCPT : Rejected relay attempt: '165.154.247.20' From: 'suisflee@msnews24.in' To: 'validxxx@gmailhotmail.com.br'165.154.247.201605651Z|  -=+ ossec13001gYExim Auth failed2025-04-05 11:14:56 dovecot_login authenticator failed for ([176.210.118.102]) [176.210.118.102]:35352: 535 Incorrect authentication data (set_id=sales)176.210.118.1022017370v{  -w) ossec13001gOExim Auth failed2025-04-05 11:14:46 dovecot_login authenticator failed for 110-25-105-234.adsl.fetnet.net [110.25.105.234]:33215: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)110.25.105.2341668284]z  -C+ ossec13001gExim Auth failed2025-04-05 11:04:43 dovecot_login authenticator failed for ([124.115.217.162]) [124.115.217.162]:45379: 535 Incorrect authentication data (set_id=services)124.115.217.1621814991dy  -Y# ossec13001gExim Auth failed2025-04-05 11:04:26 dovecot_login authenticator failed for ([62.4.94.178]) [62.4.94.178]:60512: 535 Incorrect authentication data (set_id=services@heipowersystem.com)62.4.94.1782921044"x  3M% ossec11301gNew FTP connection.Apr 5 10:50:59 vm1 pure-ftpd[1327573]: (?@139.162.77.6) [INFO] New connection from 139.162.77.6139.162.77.61861060:w  Ak) ossec11302gFTP Authentication failed.Apr 5 10:29:18 vm1 pure-ftpd[1322522]: (?@193.105.134.40) [WARNING] Authentication failed for user [anonymous]193.105.134.402661886(v  3U) ossec11301gNew FTP connection.Apr 5 10:29:12 vm1 pure-ftpd[1322522]: (?@193.105.134.40) [INFO] New connection from 193.105.134.40193.105.134.402661886Tu  -5' ossec13001g|Exim Auth failed2025-04-05 10:20:02 dovecot_login authenticator failed for ([14.39.113.250]) [14.39.113.250]:46954: 535 Incorrect authentication data (set_id=sales)14.39.113.2501835841t  -=' ossec13001gjExim Auth failed2025-04-05 10:19:45 dovecot_login authenticator failed for 131-106-31-52.s1842.c3-0.eas-cbr5.atw-eas.pa.cable.rcncustomer.com [131.106.31.52]:44862: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)131.106.31.526252001_s  -K' ossec13001gExim Auth failed2025-04-05 09:59:22 dovecot_login authenticator failed for ([58.238.181.96]) [58.238.181.96]:39796: 535 Incorrect authentication data (set_id=vikas.khandelwal)58.238.181.961835841ur  -u) ossec13001gExim Auth failed2025-04-05 09:59:09 dovecot_login authenticator failed for ([119.205.188.80]) [119.205.188.80]:44076: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)119.205.188.801835841    )K/2DVkS  -5' ossec13001g)Exim Auth failed2025-04-05 15:21:35 dovecot_login authenticator failed for ([91.73.195.150]) [91.73.195.150]:55447: 535 Incorrect authentication data (set_id=sales)91.73.195.150290557g  -[' ossec13001g'Exim Auth failed2025-04-05 15:21:33 dovecot_login authenticator failed for ([183.182.99.92]) [183.182.99.92]:49157: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)183.182.99.921655842j  -_) ossec13001g#Exim Auth failed2025-04-05 15:21:29 dovecot_login authenticator failed for (net69.195.109-156.krsk.ertelecom.ru) [109.195.69.156]:19152: 535 Incorrect authentication data (set_id=sales)109.195.69.1562017370j  -_) ossec13001gExim Auth failed2025-04-05 15:21:22 dovecot_login authenticator failed for ([119.206.34.142]) [119.206.34.142]:49096: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)119.206.34.1421835841y  -}) ossec13001gExim Auth failed2025-04-05 15:21:19 dovecot_login authenticator failed for 83-233-242-245.cust.bredband2.com [83.233.242.245]:47792: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)83.233.242.2452661886  W% ossec9708g;Dovecot Aborted Login with empty userApr 5 14:56:18 vm1 dovecot[1526]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 2 secs): user=<>, rip=71.6.134.235, lip=103.74.54.108, TLS, session=71.6.134.2356252001Z  -=+ ossec13001g<Exim Auth failed2025-04-05 14:05:06 dovecot_login authenticator failed for ([125.139.124.120]) [125.139.124.120]:36468: 535 Incorrect authentication data (set_id=sales)125.139.124.1201835841c  -U% ossec13001g(Exim Auth failed2025-04-05 14:04:47 dovecot_login authenticator failed for (hn.kd.ny.adsl) [42.236.91.93]:17456: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)42.236.91.931814991]  -C+ ossec13001gExim Auth failed2025-04-05 13:54:51 dovecot_login authenticator failed for ([103.123.114.215]) [103.123.114.215]:55474: 535 Incorrect authentication data (set_id=services)103.123.114.2151168579j  -a' ossec13001gExim Auth failed2025-04-05 13:54:34 dovecot_login authenticator failed for ([41.224.62.206]) [41.224.62.206]:35526: 535 Incorrect authentication data (set_id=services@heipowersystem.com)41.224.62.20624644616  =g) ossec13008gFMail Reciepient rejected2025-04-05 13:35:24 H=(mail.msnews24.in) [165.154.247.20]:60353 F= rejected RCPT : Rejected relay attempt: '165.154.247.20' From: 'kkrtzsn@msnews24.in' To: 'validxxx@gmailhotmail.com.br'165.154.247.201605651  3I# ossec11301g&New FTP connection.Apr 5 13:26:21 vm1 pure-ftpd[1362838]: (?@65.49.1.202) [INFO] New connection from 65.49.1.20265.49.1.2026252001A  ={+ ossec13008gMail Reciepient rejected2025-04-05 13:19:54 H=(mail.msnews24.in) [165.154.232.243]:64374 F= rejected RCPT : Rejected relay attempt: '165.154.232.243' From: 'zadwlwahskl@msnews24.in' To: 'validxxx@gmailhotmail.com.br'165.154.232.2431605651x  -{) ossec13001g]Exim Auth failed2025-04-05 13:14:28 dovecot_login authenticator failed for 164.46.246.220.static.netvigator.com [220.246.46.164]:51565: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)220.246.46.1641819730y  -}) ossec13001gOExim Auth failed2025-04-05 13:14:15 dovecot_login authenticator failed for ([185.142.223.56]) [185.142.223.56]:38536: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)185.142.223.562510769  -% ossec13001gEExim Auth failed2025-04-05 13:14:04 dovecot_login authenticator failed for 111-70-3-198.emome-ip.hinet.net [111.70.3.198]:49025: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)111.70.3.1981668284 f%y (H9AfW%  E!+ ossec2501g YUser authentication failure.Apr 5 16:22:08 vm1 sshd[1402209]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=120.230.136.213120.230.136.2131814991B$ a_% ossec5710g BAttempt to login using a non-existent userApr 5 16:21:45 vm1 sshd[1402098]: Failed password for invalid user dev from 223.73.55.59 port 56707 ssh2223.73.55.591814991R# E% ossec2501g @User authentication failure.Apr 5 16:21:42 vm1 sshd[1402098]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=223.73.55.59223.73.55.591814991("  a-% ossec5710g >Attempt to login using a non-existent userApr 5 16:21:42 vm1 sshd[1402098]: Invalid user dev from 223.73.55.59 port 56707223.73.55.591814991,! a3% ossec5710g *Attempt to login using a non-existent userApr 5 16:21:21 vm1 sshd[1402066]: Invalid user redhat from 223.73.55.33 port 50638223.73.55.331814991Q  E% ossec2501g *User authentication failure.Apr 5 16:21:22 vm1 sshd[1402066]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=223.73.55.33223.73.55.331814991W  E!+ ossec2501g User authentication failure.Apr 5 16:20:56 vm1 sshd[1401962]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=120.230.136.225120.230.136.22518149911 a7+ ossec5710g Attempt to login using a non-existent userApr 5 16:20:56 vm1 sshd[1401962]: Invalid user flink from 120.230.136.225 port 54536120.230.136.2251814991&  CG% ossec5716g SSHD authentication failed.Apr 5 16:20:33 vm1 sshd[1401915]: Failed password for root from 223.73.55.59 port 52523 ssh2223.73.55.591814991\  E1% ossec2501g User authentication failure.Apr 5 16:20:31 vm1 sshd[1401915]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=223.73.55.59 user=root223.73.55.591814991%  3Q' ossec11301gNew FTP connection.Apr 5 16:10:15 vm1 pure-ftpd[1399581]: (?@194.164.107.6) [INFO] New connection from 194.164.107.6194.164.107.66252001n  -e+ ossec13001gExim Auth failed2025-04-05 16:01:39 dovecot_login authenticator failed for (static.ill.117.248.107.130.bsnl.co.in) [117.248.107.130]:54228: 535 Incorrect authentication data (set_id=sales)117.248.107.1301269750a  -S# ossec13001g{Exim Auth failed2025-04-05 16:01:22 dovecot_login authenticator failed for ([94.251.8.83]) [94.251.8.83]:46662: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)94.251.8.832017370f  -W) ossec13001g4Exim Auth failed2025-04-05 15:38:50 dovecot_login authenticator failed for ([104.37.101.117]) [104.37.101.117]:58343: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)104.37.101.1176252001  -) ossec13001g(Exim Auth failed2025-04-05 15:38:39 dovecot_login authenticator failed for ool-4579c7cb.dyn.optonline.net [69.121.199.203]:49796: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)69.121.199.2036252001l  -c) ossec13001gExim Auth failed2025-04-05 15:33:49 dovecot_login authenticator failed for syn-076-176-252-225.res.spectrum.com [76.176.252.225]:55420: 535 Incorrect authentication data (set_id=services)76.176.252.2256252001j  -a' ossec13001gExim Auth failed2025-04-05 15:33:39 dovecot_login authenticator failed for ([113.192.69.10]) [113.192.69.10]:58534: 535 Incorrect authentication data (set_id=services@heipowersystem.com)113.192.69.101835841(  3U) ossec11301gNew FTP connection.Apr 5 15:32:12 vm1 pure-ftpd[1391120]: (?@20.150.202.103) [INFO] New connection from 20.150.202.10320.150.202.1036252001W  -9) ossec13001g3Exim Auth failed2025-04-05 15:21:45 dovecot_login authenticator failed for ([115.22.247.178]) [115.22.247.178]:34569: 535 Incorrect authentication data (set_id=sales)115.22.247.1781835841 Iv 0 J Q X}6m-@UdY7  -E# ossec13001g_Exim Auth failed2025-04-05 16:56:22 dovecot_login authenticator failed for (2-54-85-220.orange.net.il) [2.54.85.220]:45278: 535 Incorrect authentication data (set_id=sales)2.54.85.220294640m6  -c+ ossec13001gOExim Auth failed2025-04-05 16:56:06 dovecot_login authenticator failed for ([125.139.124.120]) [125.139.124.120]:48926: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)125.139.124.1201835841g5  -]% ossec13001gExim Auth failed2025-04-05 16:45:51 dovecot_login authenticator failed for ([45.229.19.34]) [45.229.19.34]:55561: 535 Incorrect authentication data (set_id=services@heipowersystem.com)45.229.19.343865483i4  -_' ossec13001gExim Auth failed2025-04-05 16:46:04 dovecot_login authenticator failed for syn-097-086-134-216.res.spectrum.com [97.86.134.216]:1932: 535 Incorrect authentication data (set_id=services)97.86.134.2166252001<3  =s) ossec13008g>Mail Reciepient rejected2025-04-05 16:38:44 H=(mail.msnews24.in) [165.154.210.52]:62983 F= rejected RCPT : Rejected relay attempt: '165.154.210.52' From: 'diwbgzjfpq@msnews24.in' To: 'validxxx@gmailhotmail.com.br'165.154.210.521694008E2  ac) ossec5710g<Attempt to login using a non-existent userApr 5 16:38:42 vm1 sshd[1405944]: Failed password for invalid user msn from 218.90.144.222 port 40994 ssh2218.90.144.222181499101 a7) ossec5710g(Attempt to login using a non-existent userApr 5 16:38:22 vm1 sshd[1405866]: Invalid user dev002 from 218.90.144.222 port 35840218.90.144.2221814991*0  CK) ossec5716gSSHD authentication failed.Apr 5 16:38:08 vm1 sshd[1405826]: Failed password for root from 218.90.144.222 port 38954 ssh2218.90.144.2221814991a/ E5) ossec2501gUser authentication failure.Apr 5 16:38:06 vm1 sshd[1405826]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.90.144.222 user=root218.90.144.2221814991W.  -9) ossec13001gExim Auth failed2025-04-05 16:33:55 dovecot_login authenticator failed for ([119.195.77.177]) [119.195.77.177]:40887: 535 Incorrect authentication data (set_id=sales)119.195.77.1771835841u-  -y% ossec13001g Exim Auth failed2025-04-05 16:33:36 dovecot_login authenticator failed for (host-64-72-74-162.lightower.net) [64.72.74.162]:47997: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)64.72.74.1626252001u,  -u) ossec13001g qExim Auth failed2025-04-05 16:26:48 dovecot_login authenticator failed for ([220.182.17.122]) [220.182.17.122]:56342: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)220.182.17.1221814991b+  -O) ossec13001g }Exim Auth failed2025-04-05 16:27:00 dovecot_login authenticator failed for ([218.150.170.10]) [218.150.170.10]:55646: 535 Incorrect authentication data (set_id=vikas.khandelwal)218.150.170.1018358412* a9+ ossec5710g Attempt to login using a non-existent userApr 5 16:23:13 vm1 sshd[1402566]: Invalid user t7inst from 120.230.136.225 port 54648120.230.136.2251814991W)  E!+ ossec2501g User authentication failure.Apr 5 16:23:13 vm1 sshd[1402566]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=120.230.136.225120.230.136.22518149911( a?# ossec5710g Attempt to login using a non-existent userApr 5 16:22:51 vm1 sshd[1402473]: Invalid user elasticsearch from 223.73.55.2 port 58022223.73.55.21814991O'  E# ossec2501g User authentication failure.Apr 5 16:22:52 vm1 sshd[1402473]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=223.73.55.2223.73.55.218149913& a;+ ossec5710g YAttempt to login using a non-existent userApr 5 16:22:07 vm1 sshd[1402209]: Invalid user appldev from 120.230.136.213 port 35464120.230.136.2131814991 yG B ^*~$y'K a+# ossec5710g' Attempt to login using a non-existent userApr 5 18:20:16 vm1 sshd[1429397]: Invalid user zxv from 58.63.2.123 port 1825558.63.2.1231814991OJ  E# ossec2501g' User authentication failure.Apr 5 18:20:17 vm1 sshd[1429397]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=58.63.2.12358.63.2.1231814991$I  CE# ossec5716g&SSHD authentication failed.Apr 5 18:19:28 vm1 sshd[1429101]: Failed password for root from 58.63.2.123 port 17411 ssh258.63.2.1231814991[H E/# ossec2501g&User authentication failure.Apr 5 18:19:26 vm1 sshd[1429101]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=58.63.2.123 user=root58.63.2.1231814991(G a-# ossec5710g&Attempt to login using a non-existent userApr 5 18:19:51 vm1 sshd[1429162]: Invalid user tony from 58.63.2.123 port 1784558.63.2.1231814991ZF  -?) ossec13001gExim Auth failed2025-04-05 17:45:15 dovecot_login authenticator failed for ([119.207.78.191]) [119.207.78.191]:52244: 535 Incorrect authentication data (set_id=services)119.207.78.1911835841jE  -a' ossec13001gExim Auth failed2025-04-05 17:45:01 dovecot_login authenticator failed for ([211.223.41.90]) [211.223.41.90]:34850: 535 Incorrect authentication data (set_id=services@heipowersystem.com)211.223.41.901835841D  C% ossec11313gsFTP file uploaded to serverApr 5 17:39:22 vm1 pure-ftpd[1419822]: (user@s2seducationtrust.com@152.58.71.80) [NOTICE] /home/techno/public_html/s2seducationtrust.com//sitemap.xml uploaded (7279 bytes, 360.01KB/sec)152.58.71.801269750"C  3M% ossec11301gsNew FTP connection.Apr 5 17:39:21 vm1 pure-ftpd[1419822]: (?@152.58.71.80) [INFO] New connection from 152.58.71.80152.58.71.8012697505B  Cc% ossec11309gsFTP Authentication success.Apr 5 17:39:21 vm1 pure-ftpd[1419822]: (?@152.58.71.80) [INFO] user@s2seducationtrust.com is now logged in152.58.71.801269750"A  3M% ossec11301gNew FTP connection.Apr 5 17:35:19 vm1 pure-ftpd[1419000]: (?@152.58.71.80) [INFO] New connection from 152.58.71.80152.58.71.801269750@  C% ossec11313gFTP file uploaded to serverApr 5 17:35:19 vm1 pure-ftpd[1419000]: (user@s2seducationtrust.com@152.58.71.80) [NOTICE] /home/techno/public_html/s2seducationtrust.com//sitemap.xml uploaded (5681 bytes, 99.69KB/sec)152.58.71.8012697505?  Cc% ossec11309gFTP Authentication success.Apr 5 17:35:19 vm1 pure-ftpd[1419000]: (?@152.58.71.80) [INFO] user@s2seducationtrust.com is now logged in152.58.71.801269750>  W' ossec9708gnDovecot Aborted Login with empty userApr 5 17:22:13 vm1 dovecot[1526]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=87.236.176.29, lip=103.74.54.108, TLS, session=87.236.176.292635167"=  3M% ossec11301g8New FTP connection.Apr 5 17:21:18 vm1 pure-ftpd[1415470]: (?@152.58.71.80) [INFO] New connection from 152.58.71.80152.58.71.8012697505<  Cc% ossec11309g8FTP Authentication success.Apr 5 17:21:18 vm1 pure-ftpd[1415470]: (?@152.58.71.80) [INFO] user@s2seducationtrust.com is now logged in152.58.71.801269750";  3M% ossec11301gNew FTP connection.Apr 5 17:20:06 vm1 pure-ftpd[1415175]: (?@152.58.71.80) [INFO] New connection from 152.58.71.80152.58.71.8012697505:  Cc% ossec11309gFTP Authentication success.Apr 5 17:20:07 vm1 pure-ftpd[1415175]: (?@152.58.71.80) [INFO] user@s2seducationtrust.com is now logged in152.58.71.801269750"9  3M% ossec11301g.New FTP connection.Apr 5 17:12:37 vm1 pure-ftpd[1413532]: (?@152.58.71.80) [INFO] New connection from 152.58.71.80152.58.71.80126975058  Cc% ossec11309g2FTP Authentication success.Apr 5 17:12:40 vm1 pure-ftpd[1413532]: (?@152.58.71.80) [INFO] user@s2seducationtrust.com is now logged in152.58.71.801269750 *\~tj`VLB8.$zpf\H>4*   v l b X N D : 0 &    ~ t j ` V L B 8 . $    z p f \ R H 4 * >  vlbXND:0&|rh^TJ@6,"xndZPF<2( ~tj`VLB8.$zpf\ | r h ^ T J @ 6 , "    x n d Z P F < 2 (   RRH>4*  vlbXND:0& gJ:D g<:C g*:B g:A g^:@ g&:? g:> g := g5:< g:; gܘ:: g܊:9 g~:8 g~:7 gl:6 g:5 g:4 gC:3 g9:2 gp:1 g^:0 g:/ g :. gʏ:- gʁ:, gŲ:+ gň:* gp:) g::( g.:' g:& gą:% gU:$ gU:# g:" g:! g: g: g: g: g: g: g : g: g: g: ge: g: gw: g: g: g: gx: g: g: g: g: g: gc: g: g: gO: gE: g: g: g: g: g: g: g9 g9 g!9 g9 g9 g9 g 9 gzE9 gz79 gz'9 gx9 gv9 gt9 gj9 gf~9 gc9 gc9 gc9 gc9 g[9 gY9 gW9 gW9 gW9 gR19 gR!9 gLR9 gLB9 gL89 gL49 gB9 gA9 g?~9 g?9 g>9 g>D9 g=9 g=:9 g=:9 g=09 g=29 g;9 g;9 g9C9 g9&9 g99 g/h9 g/Z9 g*9 g*99 g)9 g)9 g' 9 g' 9 g&9 g&9 g&9 g9 g9 gs9 gs9 gs9 g9 g9 g9 gn9 g89 g89 g9 g9 g29 g.9 g_9 gO9 g9 g9 g>9 g<9 g(9 g9 g9 g9 g 9 g }9 g q9 g 9 g 9 g 9 g 9 g Y9 g Y9 g B9 g @9 g >9 g *9 g *9 g 9 g 9 g 9 g 9 g9 g:o gv:n gl:m g:l g:k g?:j g:i g:h g*:g g:f g:e g:d gW:c gO:b g5:a g:` g:_ g:^ g:] g:\ gw:[ g z:Z g:Y g:X g:W g:V g:U g:T g:S g:R g:Q g:P g:O g:N g:M g:L g:K gw:J g:I g:H g-:G g:F gP:E g9 g{9 g49 g(9 g9 g9 g9 g39 g)9 g'9 g#9 g9 g9 g;9 g<9 g(9 g9 g9 gF9 g&9 g9 g]9 gO9 gE9 g܎9 gٵ9 g١9 g9 g9~ g9} gY9| gO9{ g9z g9y g9x g9w g9v g|9u gj9t g9s g9r g9q g F:q g9p g9o g9n gy9m gk9l g_9k g[9j g9i g9h g9g g9f gj9e g^9d g9c g9b g9a g9` gd9_ g9^ gh9] gf9\ gf9[ geG9Z geE9Y ge99W ge/9V ge-9X gb9U gb 9T g]9R g]9S gT9Q gM9P gM9O gL9N gK9M gK9L gK9J gK9K gI9I gI~9H g@9G ( | <Ty1Udsm]  -c+ ossec13001g>Exim Auth failed2025-04-05 20:01:11 dovecot_plain authenticator failed for (userver100-146) [182.162.100.146]:57832: 535 Incorrect authentication data (set_id=info@amplifypowerglobal.com)182.162.100.1461835841m\  -c+ ossec13001g>DExim Auth failed2025-04-05 19:59:23 dovecot_plain authenticator failed for (userver100-146) [182.162.100.146]:52656: 535 Incorrect authentication data (set_id=info@amplifypowerglobal.com)182.162.100.1461835841m[  -c+ ossec13001g=Exim Auth failed2025-04-05 19:57:33 dovecot_plain authenticator failed for (userver100-146) [182.162.100.146]:63773: 535 Incorrect authentication data (set_id=info@amplifypowerglobal.com)182.162.100.1461835841XZ E!+ ossec2501g=:User authentication failure.Apr 5 19:54:57 vm1 sshd[1449725]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=119.237.246.137119.237.246.1371819730.Y a1+ ossec5710g=:Attempt to login using a non-existent userApr 5 19:54:56 vm1 sshd[1449725]: Invalid user os from 119.237.246.137 port 43926119.237.246.1371819730bX  E7+ ossec2501g=0User authentication failure.Apr 5 19:54:46 vm1 sshd[1449660]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=119.237.246.137 user=root119.237.246.1371819730,W  CM+ ossec5716g=2SSHD authentication failed.Apr 5 19:54:49 vm1 sshd[1449660]: Failed password for root from 119.237.246.137 port 43092 ssh2119.237.246.1371819730WV  -9) ossec13001g;Exim Auth failed2025-04-05 19:47:52 dovecot_login authenticator failed for ([111.93.177.228]) [111.93.177.228]:34826: 535 Incorrect authentication data (set_id=sales)111.93.177.2281269750dU  -W% ossec13001g;Exim Auth failed2025-04-05 19:47:42 dovecot_login authenticator failed for ([138.36.24.33]) [138.36.24.33]:51354: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)138.36.24.333508796TT  -7% ossec13001g9CExim Auth failed2025-04-05 19:38:01 dovecot_login authenticator failed for ([59.1.214.102]) [59.1.214.102]:38760: 535 Incorrect authentication data (set_id=services)59.1.214.1021835841SS  -7% ossec13001g9&Exim Auth failed2025-04-05 19:37:34 dovecot_login authenticator failed for ([212.50.48.86]) [212.50.48.86]:37698: 535 Incorrect authentication data (set_id=services)212.50.48.86298795cR  -Y# ossec13001g9Exim Auth failed2025-04-05 19:37:14 dovecot_login authenticator failed for ([41.93.112.2]) [41.93.112.2]:55674: 535 Incorrect authentication data (set_id=services@heipowersystem.com)41.93.112.2149590gQ  -[) ossec13001g/hExim Auth failed2025-04-05 18:56:00 dovecot_login authenticator failed for (nl188-lv.zamnet.zm) [196.46.203.188]:52155: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)196.46.203.188895949P  -)) ossec13001g/ZExim Auth failed2025-04-05 18:55:46 dovecot_login authenticator failed for broadband-178-140-212-92.ip.moscow.rt.ru [178.140.212.92]:53988: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)178.140.212.922017370(O  3U) ossec11301g*New FTP connection.Apr 5 18:35:01 vm1 pure-ftpd[1432546]: (?@199.45.154.120) [INFO] New connection from 199.45.154.120199.45.154.1206252001(N  3U) ossec11301g*9New FTP connection.Apr 5 18:33:51 vm1 pure-ftpd[1432206]: (?@47.236.186.189) [INFO] New connection from 47.236.186.18947.236.186.1891880251\M  -G% ossec13001g)Exim Auth failed2025-04-05 18:31:42 dovecot_login authenticator failed for ([222.99.10.11]) [222.99.10.11]:56262: 535 Incorrect authentication data (set_id=vikas.khandelwal)222.99.10.111835841tL  -u) ossec13001g)Exim Auth failed2025-04-05 18:31:24 dovecot_login authenticator failed for ([196.190.180.18]) [196.190.180.19]:25398: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)196.190.180.19337996 b = _ } 8Mbgn  -[' ossec13001gcExim Auth failed2025-04-05 22:39:22 dovecot_login authenticator failed for ([60.247.92.186]) [60.247.92.186]:59087: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)60.247.92.1861814991gm  -[' ossec13001gcExim Auth failed2025-04-05 22:39:15 dovecot_login authenticator failed for ([222.87.49.250]) [222.87.49.250]:57047: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)222.87.49.2501814991(l  3U) ossec11301g[New FTP connection.Apr 5 22:05:13 vm1 pure-ftpd[1478809]: (?@205.210.31.232) [INFO] New connection from 205.210.31.232205.210.31.2326252001pk -o# ossec13001gYExim Auth failed2025-04-05 21:57:06 dovecot_plain authenticator failed for (cm0ft4saow7ik26hr4phbl15obx) [77.40.80.72]:59282: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)77.40.80.722017370tj  -u' ossec13001gWExim Auth failed2025-04-05 21:48:27 dovecot_login authenticator failed for 81-230-83-162-no600.tbcn.telia.com [81.230.83.162]:33678: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)81.230.83.1622661886vi  -y' ossec13001gWExim Auth failed2025-04-05 21:48:13 dovecot_login authenticator failed for ([144.48.39.222]) [144.48.39.222]:60310: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)144.48.39.2222077456wh  -{' ossec13001gWExim Auth failed2025-04-05 21:44:55 dovecot_login authenticator failed for h77-53-235-246.cust.bredband2.com [77.53.235.246]:42582: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)77.53.235.2462661886Zg  -G% ossec13001gR1Exim Auth failed2025-04-05 21:24:24 dovecot_login authenticator failed for ([65.20.168.20]) [65.20.168.20]:39409: 535 Incorrect authentication data (set_id=vikas.khandelwal)65.20.168.2099237uf  -u) ossec13001gR!Exim Auth failed2025-04-05 21:24:09 dovecot_login authenticator failed for ([182.135.66.173]) [182.135.66.173]:54492: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)182.135.66.1731814991ne  -i' ossec13001gLRExim Auth failed2025-04-05 20:59:21 dovecot_login authenticator failed for (thepsindustries.com) [58.240.171.59]:53882: 535 Incorrect authentication data (set_id=contact@thepsindustries.com)58.240.171.591814991kd  -a) ossec13001gLBExim Auth failed2025-04-05 20:59:04 dovecot_login authenticator failed for (122.11.169-112.unknown.starhub.net.sg) [122.11.169.112]:2868: 535 Incorrect authentication data (set_id=sales)122.11.169.1121880251^c  -O! ossec13001gL8Exim Auth failed2025-04-05 20:58:55 dovecot_login authenticator failed for ([1.30.20.98]) [1.30.20.98]:51424: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)1.30.20.981814991Zb  -A' ossec13001gL4Exim Auth failed2025-04-05 20:58:50 dovecot_login authenticator failed for (thepsindustries.com) [58.240.171.59]:53780: 535 Incorrect authentication data (set_id=nologin)58.240.171.591814991(a  3U) ossec11301gBNew FTP connection.Apr 5 20:18:45 vm1 pure-ftpd[1455046]: (?@194.165.16.164) [INFO] New connection from 194.165.16.164194.165.16.16429934571`  =_' ossec13008gAMail Reciepient rejected2025-04-05 20:13:18 H=(mail.msnews24.in) [45.197.14.175]:60455 F= rejected RCPT : Rejected relay attempt: '45.197.14.175' From: 'zggmrf@msnews24.in' To: 'validxxx@gmailhotmail.com.br'45.197.14.1756252001m_  -c+ ossec13001g?~Exim Auth failed2025-04-05 20:04:37 dovecot_plain authenticator failed for (userver100-146) [182.162.100.146]:65238: 535 Incorrect authentication data (set_id=info@amplifypowerglobal.com)182.162.100.1461835841m^  -c+ ossec13001g?Exim Auth failed2025-04-05 20:02:54 dovecot_plain authenticator failed for (userver100-146) [182.162.100.146]:61520: 535 Incorrect authentication data (set_id=info@amplifypowerglobal.com)182.162.100.1461835841 0@ 0 +1Ms0S A' ossec11302gFTP Authentication failed.Apr 6 01:17:47 vm1 pure-ftpd[1522338]: (?@182.180.55.93) [WARNING] Authentication failed for user [vikas.khandelwal@heipowersystem.com]182.180.55.931168579?  gQ' ossec11307gMultiple connection attempts from same sourceApr 6 01:18:37 vm1 pure-ftpd[1522537]: (?@182.180.55.93) [INFO] New connection from 182.180.55.93182.180.55.931168579%~  3Q' ossec11301gNew FTP connection.Apr 6 01:17:41 vm1 pure-ftpd[1522338]: (?@182.180.55.93) [INFO] New connection from 182.180.55.93182.180.55.931168579V} -5) ossec13001g!Exim Auth failed2025-04-06 01:01:45 dovecot_plain authenticator failed for (hostglobal.plus) [78.153.140.207]:35296: 535 Incorrect authentication data (set_id=info)78.153.140.2072635167`|  -O% ossec13001gExim Auth failed2025-04-06 00:39:13 dovecot_login authenticator failed for ([14.39.41.171]) [14.39.41.171]:35882: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)14.39.41.1711835841v{  -y' ossec13001gExim Auth failed2025-04-06 00:39:01 dovecot_login authenticator failed for ([1.224.173.231]) [1.224.173.231]:43784: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)1.224.173.2311835841iz  -]+ ossec13001gExim Auth failed2025-04-06 00:36:05 dovecot_login authenticator failed for (213-227-245-154.static.vega-ua.net) [213.227.245.154]:2601: 535 Incorrect authentication data (set_id=sales)213.227.245.154690791dy  -W% ossec13001g Exim Auth failed2025-04-06 00:35:47 dovecot_login authenticator failed for ([117.39.63.46]) [117.39.63.46]:56088: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)117.39.63.461814991bx  -O) ossec13001gzEExim Auth failed2025-04-06 00:15:23 dovecot_login authenticator failed for ([128.185.225.34]) [128.185.225.34]:32838: 535 Incorrect authentication data (set_id=vikas.khandelwal)128.185.225.341269750ww  -y+ ossec13001gz7Exim Auth failed2025-04-06 00:15:11 dovecot_login authenticator failed for ([196.192.176.249]) [196.192.176.249]:45005: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)196.192.176.2499539871v  =_' ossec13008gz'Mail Reciepient rejected2025-04-06 00:14:54 H=(mail.msnews24.in) [45.197.14.138]:62576 F= rejected RCPT : Rejected relay attempt: '45.197.14.138' From: 'liqxcf@msnews24.in' To: 'validxxx@gmailhotmail.com.br'45.197.14.1386252001u  ?1 ossec1008gxProcess exiting (killed).Apr 6 00:05:56 vm1 spamd[1185686]: spamd: server killed by SIGTERM, shutting down rejected RCPT : Rejected relay attempt: '165.154.210.99' From: 'rdqhjzoynh@msnews24.in' To: 'validxxx@gmailhotmail.com.br'165.154.210.991694008%s  3Q' ossec11301gtNew FTP connection.Apr 5 23:52:00 vm1 pure-ftpd[1502492]: (?@45.79.115.134) [INFO] New connection from 45.79.115.13445.79.115.1346252001#r 3M% ossec11301gjNew FTP connection.Apr 5 23:09:24 vm1 pure-ftpd[1492918]: (?@45.79.181.94) [INFO] New connection from 45.79.181.9445.79.181.946252001 q  =) ossec13008gf~Mail Reciepient rejected2025-04-05 22:51:02 H=(hostglobal.plus) [78.153.140.207]:37504 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no F= rejected RCPT : Sender verify failed78.153.140.2072635167Zp  -=+ ossec13001gcExim Auth failed2025-04-05 22:39:33 dovecot_login authenticator failed for ([178.178.194.136]) [178.178.194.136]:40832: 535 Incorrect authentication data (set_id=sales)178.178.194.1362017370^o  -K% ossec13001gcExim Auth failed2025-04-05 22:39:27 dovecot_login authenticator failed for bb121-7-26-195.singnet.com.sg [121.7.26.195]:34730: 535 Incorrect authentication data (set_id=sales)121.7.26.1951880251 V  m  4 =(  CI' ossec5716gSSHD authentication failed.Apr 6 02:26:37 vm1 sshd[1537913]: Failed password for root from 103.99.144.99 port 56376 ssh2103.99.144.991269750_ E3' ossec2501gUser authentication failure.Apr 6 02:26:34 vm1 sshd[1537913]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.99.144.99 user=root103.99.144.991269750p -o# ossec13001gxExim Auth failed2025-04-06 02:07:10 dovecot_plain authenticator failed for (480rnuekgj2oqgm9) [77.40.80.72]:53008: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)77.40.80.722017370  W) ossec9708gDovecot Aborted Login with empty userApr 6 01:39:04 vm1 dovecot[1526]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=118.26.104.179, lip=103.74.54.108, TLS, session=<2W4jkw0yXsB2Gmiz>118.26.104.1792635167]  -G' ossec13001gExim Auth failed2025-04-06 01:30:31 dovecot_login authenticator failed for 179-42-124-80.chtch.com.br [179.42.124.80]:11037: 535 Incorrect authentication data (set_id=sales)179.42.124.803469034g  -Y) ossec13001gExim Auth failed2025-04-06 01:30:14 dovecot_login authenticator failed for (94-190-222-124.static.imsbiz.com) [94.190.222.124]:62181: 535 Incorrect authentication data (set_id=sales)94.190.222.1241819730l  -c+ ossec13001gExim Auth failed2025-04-06 01:30:06 dovecot_login authenticator failed for ([196.189.126.185]) [196.189.126.185]:34770: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)196.189.126.185337996w  -y) ossec13001gExim Auth failed2025-04-06 01:29:54 dovecot_login authenticator failed for (sr-25-135-140-118-on-nets.com) [118.140.135.25]:61171: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)118.140.135.251819730k -a' ossec13001gcExim Auth failed2025-04-06 01:28:27 dovecot_plain authenticator failed for (TJ-DESK) [182.180.55.93]:58978: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)182.180.55.931168579X -;' ossec13001gExim Auth failed2025-04-06 01:26:44 dovecot_plain authenticator failed for (TJ-DESK) [182.180.55.93]:52822: 535 Incorrect authentication data (set_id=vikas.khandelwal)182.180.55.931168579j  -a' ossec13001gExim Auth failed2025-04-06 01:26:37 dovecot_plain authenticator failed for (TJ-DESK) [182.180.55.93]:52638: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)182.180.55.931168579W  -9) ossec13001gOExim Auth failed2025-04-06 01:19:33 dovecot_login authenticator failed for ([115.85.251.188]) [115.85.251.188]:48940: 535 Incorrect authentication data (set_id=sales)115.85.251.1881814991j  -_) ossec13001gEExim Auth failed2025-04-06 01:19:23 dovecot_login authenticator failed for ([220.178.39.106]) [220.178.39.106]:44722: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)220.178.39.1061814991& 3Q' ossec11301gNew FTP connection.Apr 6 01:18:45 vm1 pure-ftpd[1522573]: (?@182.180.55.93) [INFO] New connection from 182.180.55.93182.180.55.9311685795 Aa' ossec11302gFTP Authentication failed.Apr 6 01:18:44 vm1 pure-ftpd[1522537]: (?@182.180.55.93) [WARNING] Authentication failed for user [admin]182.180.55.931168579d  w' ossec11321gActive Response. FTP brute force attack (Port 21 is protected)Apr 6 01:18:37 vm1 pure-ftpd[1522529]: (?@182.180.55.93) [WARNING] Authentication failed for user [vikas.khandelwal]182.180.55.931168579  S' ossec211321gPreventing FTP brute force attempt.[Active Response] is disabled for rule 11321. Greylisting 182.180.55.93182.180.55.931168579& 3Q' ossec11301gNew FTP connection.Apr 6 01:17:48 vm1 pure-ftpd[1522359]: (?@182.180.55.93) [INFO] New connection from 182.180.55.93182.180.55.931168579 N 8   =GN.PbC#  77 ossec502gUOssec server started.ossec: Ossec started.R"  -5' ossec13001gExim Auth failed2025-04-06 04:21:51 dovecot_login authenticator failed for ([62.201.212.54]) [62.201.212.54]:51846: 535 Incorrect authentication data (set_id=sales)62.201.212.5499237^!  -O! ossec13001gExim Auth failed2025-04-06 04:21:39 dovecot_login authenticator failed for ([1.183.1.82]) [1.183.1.82]:55115: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)1.183.1.821814991Q  -1% ossec13001gExim Auth failed2025-04-06 04:21:39 dovecot_login authenticator failed for ([83.239.88.62]) [83.239.88.62]:54990: 535 Incorrect authentication data (set_id=sales)83.239.88.622017370j  -_) ossec13001gExim Auth failed2025-04-06 04:21:26 dovecot_login authenticator failed for ([111.93.177.228]) [111.93.177.228]:36846: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)111.93.177.2281269750Z  -?) ossec13001gExim Auth failed2025-04-06 04:11:47 dovecot_login authenticator failed for ([211.48.113.101]) [211.48.113.101]:51104: 535 Incorrect authentication data (set_id=services)211.48.113.1011835841  -E' ossec13001gExim Auth failed2025-04-06 04:11:16 dovecot_login authenticator failed for wsip-70-166-207-76.ph.ph.cox.net (wsip-70-166-207-65.ph.ph.cox.net) [70.166.207.76]:59864: 535 Incorrect authentication data (set_id=services@heipowersystem.com)70.166.207.766252001u  -y% ossec13001gExim Auth failed2025-04-06 03:29:57 dovecot_login authenticator failed for 32.104.29.34.bc.googleusercontent.com [34.29.104.32]:57414: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)34.29.104.326252001r  -u% ossec13001gExim Auth failed2025-04-06 03:29:45 dovecot_login authenticator failed for ([89.45.83.229]) [89.45.83.229]:32978: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)89.45.83.229798549T  -5' ossec13001g Exim Auth failed2025-04-06 03:26:26 dovecot_login authenticator failed for ([50.218.156.89]) [50.218.156.82]:51620: 535 Incorrect authentication data (set_id=sales)50.218.156.826252001i  -_' ossec13001gExim Auth failed2025-04-06 03:26:12 dovecot_login authenticator failed for ([193.111.124.226]) [103.139.10.28]:26631: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)103.139.10.281643084{  -# ossec13001gExim Auth failed2025-04-06 03:05:24 dovecot_login authenticator failed for 111-70-32-5.emome-ip.hinet.net [111.70.32.5]:37861: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)111.70.32.51668284u  -u) ossec13001gExim Auth failed2025-04-06 03:05:11 dovecot_login authenticator failed for ([87.103.210.232]) [87.103.210.232]:37012: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)87.103.210.2322017370:  =o) ossec13008geMail Reciepient rejected2025-04-06 03:02:20 H=(mail.msnews24.in) [165.154.228.93]:64511 F= rejected RCPT : Rejected relay attempt: '165.154.228.93' From: 'yzvebfiqu@msnews24.in' To: 'validxxx@gmailhotmail.com.br'165.154.228.931643084U -5' ossec13001gExim Auth failed2025-04-06 02:34:37 dovecot_login authenticator failed for (rokamauka.com) [58.240.171.59]:33522: 535 Incorrect authentication data (set_id=nologin)58.240.171.5918149919  =o' ossec13008gwMail Reciepient rejected2025-04-06 02:28:31 H=(mail.msnews24.in) [45.197.14.138]:62479 F= rejected RCPT : Rejected relay attempt: '45.197.14.138' From: 'llmlladgeg@msnews24.in' To: 'validxxx@gmailhotmail.com.br'45.197.14.1386252001. a5' ossec5710gAttempt to login using a non-existent userApr 6 02:26:49 vm1 sshd[1537933]: Invalid user unreal from 103.99.144.99 port 39278103.99.144.991269750 1 I  -5PC4  - + ossec13001gExim Auth failed2025-04-06 07:03:38 dovecot_login authenticator failed for (177-174-122-213.user.vivozap.com.br) [177.174.122.213]:40914: 535 Incorrect authentication data (set_id=services@heipowersystem.com)177.174.122.2133469034f3  -W) ossec13001gCExim Auth failed2025-04-06 06:22:18 dovecot_login authenticator failed for ([195.222.59.157]) [195.222.59.157]:42520: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)195.222.59.1573277605y2  -}) ossec13001g9Exim Auth failed2025-04-06 06:22:07 dovecot_login authenticator failed for ([113.140.95.250]) [113.140.95.250]:60922: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)113.140.95.2501814991e1  -Y% ossec13001gpExim Auth failed2025-04-06 06:18:48 dovecot_login authenticator failed for syn-074-070-139-017.res.spectrum.com [74.70.139.17]:46990: 535 Incorrect authentication data (set_id=sales)74.70.139.176252001g0  -[' ossec13001g^Exim Auth failed2025-04-06 06:18:30 dovecot_login authenticator failed for ([5.129.134.103]) [5.129.134.103]:34882: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)5.129.134.1032017370(/  3U) ossec11301gNew FTP connection.Apr 6 06:07:34 vm1 pure-ftpd[1586430]: (?@205.210.31.176) [INFO] New connection from 205.210.31.176205.210.31.1766252001 .  [u# ossec12004g Possible Dovecot CVE-2019-11500 attemptApr 6 06:04:19 vm1 dovecot[1526]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.139.79.43, lip=103.74.54.108, session=3.139.79.436252001a-  -O) ossec13001gʏExim Auth failed2025-04-06 05:57:58 dovecot_login authenticator failed for ([89.144.187.114]) [89.144.187.114]:57007: 535 Incorrect authentication data (set_id=vikas.khandelwal)89.144.187.114130758t,  -q+ ossec13001gʁExim Auth failed2025-04-06 05:57:45 dovecot_login authenticator failed for ([61.0.238.94]) [136.232.197.102]:57038: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)136.232.197.1021269750d+ -Q) ossec13001gŲExim Auth failed2025-04-06 05:37:12 dovecot_login authenticator failed for (MzRCNXD21) [117.69.234.240]:60358: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)117.69.234.2401814991A* - + ossec13001gňExim Auth failed2025-04-06 05:36:30 dovecot_login authenticator failed for (hrd7RA) [183.164.241.222]:53635: 535 Incorrect authentication data183.164.241.2221814991a) -K) ossec13001gpExim Auth failed2025-04-06 05:36:06 dovecot_login authenticator failed for (xFnzkI) [117.69.245.114]:59310: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)117.69.245.1141814991B(  -) ossec13001g:Exim Auth failed2025-04-06 05:35:13 dovecot_login authenticator failed for (LVb9cVveKZ) [117.69.234.246]:63358: 535 Incorrect authentication data117.69.234.2461814991@'  - ) ossec13001g.Exim Auth failed2025-04-06 05:35:00 dovecot_login authenticator failed for (Epuq2mRg) [117.69.234.246]:62628: 535 Incorrect authentication data117.69.234.2461814991d& -O+ ossec13001gExim Auth failed2025-04-06 05:33:26 dovecot_login authenticator failed for (4wDswVH) [183.164.241.222]:50133: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)183.164.241.2221814991c% -O) ossec13001gąExim Auth failed2025-04-06 05:32:13 dovecot_login authenticator failed for (CsQM1YOS) [117.69.234.246]:61767: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)117.69.234.2461814991d$ -Q) ossec13001gUExim Auth failed2025-04-06 05:31:25 dovecot_login authenticator failed for (E8ZB6L4VF) [117.69.234.246]:50764: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)117.69.234.2461814991 t / A S { @\setmF  -c+ ossec13001gExim Auth failed2025-04-06 09:12:06 dovecot_login authenticator failed for ([106.246.227.218]) [106.246.227.218]:56080: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)106.246.227.21818358416E  Ag% ossec11302gPFTP Authentication failed.Apr 6 08:56:06 vm1 pure-ftpd[1623427]: (?@34.77.25.224) [WARNING] Authentication failed for user [anonymous]34.77.25.2242802361#D 3M% ossec11301gJNew FTP connection.Apr 6 08:56:01 vm1 pure-ftpd[1623427]: (?@34.77.25.224) [INFO] New connection from 34.77.25.22434.77.25.2242802361eC  -S+ ossec13001g<Exim Auth failed2025-04-06 08:51:31 dovecot_login authenticator failed for ([103.230.176.152]) [103.230.176.152]:49646: 535 Incorrect authentication data (set_id=vikas.khandelwal)103.230.176.1521269750B  -/) ossec13001g*Exim Auth failed2025-04-06 08:51:12 dovecot_login authenticator failed for 47-150-123-184.fdr01.vtvl.ca.ip.frontiernet.net [47.150.123.184]:63521: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)47.150.123.1846252001BA  - + ossec13001gExim Auth failed2025-04-06 08:25:12 dovecot_login authenticator failed for (AB3uSLN5) [183.165.246.126]:59871: 535 Incorrect authentication data183.165.246.1261814991d@  -Q+ ossec13001g^Exim Auth failed2025-04-06 08:22:12 dovecot_login authenticator failed for (nYoTpBJa) [183.165.246.126]:50429: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)183.165.246.1261814991e? -Q+ ossec13001g&Exim Auth failed2025-04-06 08:21:16 dovecot_login authenticator failed for (bOkyIPYL) [183.165.246.126]:60477: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)183.165.246.1261814991`> -M% ossec13001gExim Auth failed2025-04-06 08:20:47 dovecot_login authenticator failed for (B2g0lZDwr) [117.70.49.24]:54716: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)117.70.49.241814991+=  3Y+ ossec11301g New FTP connection.Apr 6 07:33:55 vm1 pure-ftpd[1605205]: (?@172.215.145.207) [INFO] New connection from 172.215.145.207172.215.145.2076252001\< -A) ossec13001g5Exim Auth failed2025-04-06 07:30:19 dovecot_login authenticator failed for (heipowersystem.com) [42.193.105.109]:45116: 535 Incorrect authentication data (set_id=nologin)42.193.105.1091814991V; -5) ossec13001gExim Auth failed2025-04-06 07:16:35 dovecot_plain authenticator failed for (hostglobal.plus) [78.153.140.207]:48508: 535 Incorrect authentication data (set_id=info)78.153.140.2072635167N:  --# ossec13001gܘExim Auth failed2025-04-06 07:14:55 dovecot_login authenticator failed for ([103.50.5.94]) [103.50.5.94]:39935: 535 Incorrect authentication data (set_id=sales)103.50.5.941269750T9  -5' ossec13001g܊Exim Auth failed2025-04-06 07:14:41 dovecot_login authenticator failed for ([222.116.33.50]) [222.116.33.50]:36931: 535 Incorrect authentication data (set_id=sales)222.116.33.501835841j8  -_) ossec13001g~Exim Auth failed2025-04-06 07:14:29 dovecot_login authenticator failed for ([188.166.179.34]) [188.166.179.34]:50144: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)188.166.179.341880251j7  -_) ossec13001g~Exim Auth failed2025-04-06 07:14:28 dovecot_login authenticator failed for ([124.197.80.170]) [124.197.80.170]:42076: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)124.197.80.1701880251m6  -c+ ossec13001glExim Auth failed2025-04-06 07:14:11 dovecot_login authenticator failed for ([111.171.127.190]) [111.171.127.190]:48412: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)111.171.127.1901835841\5  -C+ ossec13001gExim Auth failed2025-04-06 07:03:52 dovecot_login authenticator failed for ([196.189.124.229]) [196.189.124.229]:41594: 535 Incorrect authentication data (set_id=services)196.189.124.229337996 ^# $ ; S m -Lc^W  - ) ossec13001gExim Auth failed2025-04-06 10:07:04 dovecot_login authenticator failed for (175-180-129-87.adsl.dynamic.seed.net.tw) [175.180.129.87]:47980: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)175.180.129.871668284eV  -[' ossec13001gExim Auth failed2025-04-06 10:06:59 dovecot_login authenticator failed for ([65.20.204.164]) [65.20.204.164]:43963: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)65.20.204.16499237]U  -C+ ossec13001gExim Auth failed2025-04-06 09:57:01 dovecot_login authenticator failed for ([179.181.133.153]) [179.181.133.153]:46322: 535 Incorrect authentication data (set_id=services)179.181.133.1533469034jT  -a' ossec13001gExim Auth failed2025-04-06 09:56:38 dovecot_login authenticator failed for ([213.154.80.21]) [213.154.80.51]:39412: 535 Incorrect authentication data (set_id=services@heipowersystem.com)213.154.80.512245662bS -O' ossec13001gExim Auth failed2025-04-06 09:53:31 dovecot_login authenticator failed for (6g7c455JR) [183.165.245.2]:52522: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)183.165.245.21814991`R -K' ossec13001gExim Auth failed2025-04-06 09:53:21 dovecot_login authenticator failed for (VJwSz9H) [183.165.245.2]:49934: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)183.165.245.21814991bQ  -M+ ossec13001gExim Auth failed2025-04-06 09:52:44 dovecot_login authenticator failed for (3bhf7U) [114.106.170.110]:57056: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)114.106.170.1101814991P  W # ossec9708gDovecot Aborted Login with empty userApr 6 09:49:55 vm1 dovecot[1526]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=80.82.77.33, lip=103.74.54.108, session=80.82.77.332750405aO -K) ossec13001gExim Auth failed2025-04-06 09:31:25 dovecot_login authenticator failed for (nfj4nR) [114.106.147.95]:64969: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)114.106.147.951814991=N  -' ossec13001gExim Auth failed2025-04-06 09:22:37 dovecot_login authenticator failed for (E9K32Ae) [117.70.48.158]:59650: 535 Incorrect authentication data117.70.48.1581814991cM -Q' ossec13001gExim Auth failed2025-04-06 09:19:24 dovecot_login authenticator failed for (DgAyemkOua) [117.70.48.158]:54280: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)117.70.48.1581814991bL -O' ossec13001gExim Auth failed2025-04-06 09:19:14 dovecot_login authenticator failed for (2xUr8kObu) [117.70.48.158]:51994: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)117.70.48.1581814991dK -O+ ossec13001gExim Auth failed2025-04-06 09:18:22 dovecot_login authenticator failed for (3MTAm8s) [223.215.177.108]:57348: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)223.215.177.1081814991eJ  -S+ ossec13001gwExim Auth failed2025-04-06 09:18:06 dovecot_login authenticator failed for (zes2pqo1F) [223.215.177.108]:54641: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)223.215.177.1081814991{I  -' ossec13001gExim Auth failed2025-04-06 09:15:55 dovecot_login authenticator failed for (nsg-corporate-194.153.186.122.airtel.in) [106.51.217.56]:11426: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)106.51.217.561269750uH  -y' ossec13001gExim Auth failed2025-04-06 09:15:34 dovecot_login authenticator failed for ([80.227.138.32]) [80.227.138.32]:40886: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)80.227.138.32290557`G  -O% ossec13001g-Exim Auth failed2025-04-06 09:12:36 dovecot_login authenticator failed for 221-120-40-2.emome-ip.hinet.net [221.120.40.2]:55020: 535 Incorrect authentication data (set_id=sales)221.120.40.21668284 - ~  4Jc6Pgdi -Q) ossec13001gExim Auth failed2025-04-06 11:28:16 dovecot_login authenticator failed for (CtY9QpjxR) [114.106.134.83]:55470: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)114.106.134.831814991eh -S) ossec13001gExim Auth failed2025-04-06 11:27:40 dovecot_login authenticator failed for (1syfj16ikL) [114.106.134.83]:49685: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)114.106.134.831814991bg  -Q' ossec13001g*Exim Auth failed2025-04-06 11:07:45 dovecot_login authenticator failed for (nyaystambh.com) [221.229.216.1]:51828: 535 Incorrect authentication data (set_id=admin@nyaystambh.com)221.229.216.11814991Uf  -7' ossec13001gExim Auth failed2025-04-06 11:07:21 dovecot_login authenticator failed for (nyaystambh.com) [221.229.216.1]:44788: 535 Incorrect authentication data (set_id=nologin)221.229.216.11814991De -+ ossec13001gExim Auth failed2025-04-06 10:57:04 dovecot_login authenticator failed for (wHNgJlrzM) [114.106.146.205]:54775: 535 Incorrect authentication data114.106.146.2051814991Cd -) ossec13001gExim Auth failed2025-04-06 10:57:02 dovecot_login authenticator failed for (L30Wbv2chW) [117.69.245.203]:52359: 535 Incorrect authentication data117.69.245.2031814991Ac  - ) ossec13001gWExim Auth failed2025-04-06 10:55:41 dovecot_login authenticator failed for (gJbKX45Iv) [114.103.88.211]:51296: 535 Incorrect authentication data114.103.88.2111814991cb -M+ ossec13001gOExim Auth failed2025-04-06 10:55:34 dovecot_login authenticator failed for (couRG5) [183.164.241.150]:51578: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)183.164.241.1501814991fa -S+ ossec13001g5Exim Auth failed2025-04-06 10:55:09 dovecot_login authenticator failed for (QtDCKbn7n) [183.164.241.150]:60897: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)183.164.241.1501814991f` -S+ ossec13001gExim Auth failed2025-04-06 10:53:58 dovecot_login authenticator failed for (AFJVodqwW) [114.106.146.205]:49218: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)114.106.146.2051814991a_ -K) ossec13001gExim Auth failed2025-04-06 10:53:24 dovecot_login authenticator failed for (YulbNu) [117.69.245.203]:57732: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)117.69.245.2031814991a^  -M) ossec13001gExim Auth failed2025-04-06 10:53:08 dovecot_login authenticator failed for (Wxwz3dP) [117.69.245.203]:54399: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)117.69.245.2031814991d] -Q) ossec13001gExim Auth failed2025-04-06 10:52:35 dovecot_login authenticator failed for (nycQA1lic) [114.103.88.211]:65106: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)114.103.88.2111814991c\ -O) ossec13001gExim Auth failed2025-04-06 10:52:09 dovecot_login authenticator failed for (vZlslV1U) [114.103.88.211]:59130: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)114.103.88.2111814991C[  -+ ossec13001gwExim Auth failed2025-04-06 10:51:59 dovecot_login authenticator failed for (4w8uM1yN9) [114.106.137.245]:52088: 535 Incorrect authentication data114.106.137.2451814991+Z  3Y+ ossec11301g zNew FTP connection.Apr 6 10:34:56 vm1 pure-ftpd[1644990]: (?@162.142.125.197) [INFO] New connection from 162.142.125.197162.142.125.1976252001eY  -Y% ossec13001gExim Auth failed2025-04-06 10:07:16 dovecot_login authenticator failed for syn-074-062-020-170.biz.spectrum.com [74.62.20.170]:60267: 535 Incorrect authentication data (set_id=sales)74.62.20.1706252001fX  -[% ossec13001gExim Auth failed2025-04-06 10:07:12 dovecot_login authenticator failed for 66.68.243.35.bc.googleusercontent.com [35.243.68.66]:53846: 535 Incorrect authentication data (set_id=sales)35.243.68.661861060 eV   &y7^&e=|  -' ossec13001g#Exim Auth failed2025-04-06 12:18:27 dovecot_login authenticator failed for (0Jzb1cp) [114.103.89.84]:59977: 535 Incorrect authentication data114.103.89.841814991d{ -Q) ossec13001g#4Exim Auth failed2025-04-06 12:16:12 dovecot_login authenticator failed for (MSwH9Y9eB) [114.103.80.184]:51093: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)114.103.80.1841814991az -M' ossec13001g"Exim Auth failed2025-04-06 12:15:07 dovecot_login authenticator failed for (xpFqHmMy) [114.103.89.84]:54307: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)114.103.89.8418149913y  ai ossec5710g"Attempt to login using a non-existent userApr 6 12:14:29 vm1 sshd[1666590]: Connection reset by invalid user qipeng 60.215.231.220 port 43036 [preauth]0x a7) ossec5710g"~Attempt to login using a non-existent userApr 6 12:13:08 vm1 sshd[1666590]: Invalid user qipeng from 60.215.231.220 port 4303660.215.231.2201814991Uw  E) ossec2501g"User authentication failure.Apr 6 12:13:10 vm1 sshd[1666590]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=60.215.231.22060.215.231.22018149910v  a9) ossec5710g">Attempt to login using a non-existent userApr 6 12:12:04 vm1 sshd[1666417]: Invalid user gyx1991 from 60.215.231.220 port 3980060.215.231.2201814991yu  -}) ossec13001g!Exim Auth failed2025-04-06 12:07:10 dovecot_login authenticator failed for ([222.119.124.66]) [222.119.124.66]:48640: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)222.119.124.661835841`t  -O% ossec13001g!$Exim Auth failed2025-04-06 12:07:23 dovecot_login authenticator failed for ([222.180.2.62]) [222.180.2.62]:32926: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)222.180.2.621814991)s  EK% ossec5715g SSHD authentication success.Apr 6 12:05:53 vm1 sshd[1665058]: Accepted password for root from 103.190.54.7 port 57120 ssh2103.190.54.71269750)r  EK% ossec5715g SSHD authentication success.Apr 6 12:04:46 vm1 sshd[1664705]: Accepted password for root from 103.190.54.7 port 57119 ssh2103.190.54.71269750jq  -_) ossec13001g FExim Auth failed2025-04-06 12:03:41 dovecot_login authenticator failed for ([113.102.20.230]) [113.102.20.230]:41649: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)113.102.20.2301814991wp  -y) ossec13001g TExim Auth failed2025-04-06 12:03:54 dovecot_login authenticator failed for (c-50-187-155-130.unallocated.comcastbusiness.net) [50.187.155.130]:34607: 535 Incorrect authentication data (set_id=sales)50.187.155.1306252001"o  3M% ossec11301gNew FTP connection.Apr 6 11:47:52 vm1 pure-ftpd[1661159]: (?@103.203.59.5) [INFO] New connection from 103.203.59.5103.203.59.51814991Xn  -C# ossec13001gvExim Auth failed2025-04-06 11:43:09 dovecot_login authenticator failed for ([2.55.89.171]) [2.55.89.171]:35517: 535 Incorrect authentication data (set_id=vikas.khandelwal)2.55.89.171294640{m  -# ossec13001glExim Auth failed2025-04-06 11:42:59 dovecot_login authenticator failed for (125-209-116-242.multi.net.pk) [58.27.253.6]:43642: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)58.27.253.61168579Bl - ) ossec13001gExim Auth failed2025-04-06 11:32:29 dovecot_login authenticator failed for (2NNZgSjWK) [223.247.47.197]:60517: 535 Incorrect authentication data223.247.47.1971814991>k  -) ossec13001gExim Auth failed2025-04-06 11:31:23 dovecot_login authenticator failed for (J4hr88) [114.106.134.83]:59008: 535 Incorrect authentication data114.106.134.831814991dj -Q) ossec13001g?Exim Auth failed2025-04-06 11:29:27 dovecot_login authenticator failed for (q1C99c0oc) [223.247.47.197]:57349: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)223.247.47.1971814991  9zm`SF9, v i \ O B 5 (     r e X K > 1 $  { n a T G : -   w j ] P C 6 )    s f Y L ? 2 %  |obUH;.!xk^QD7*tgZM@3& }pcVI</9&"ynbVJ>2&~rfZNB6*vj^RF{ocWK?3 1307584  1269750O 1307584 1307584 1307584 1307584 1307584 1307582 1307581 1307581 1307581 1307581 1307581 1307581 1307581 1307581 1307581 1307581 1307581 1307581 1307581 1307580 130758/ 130758, 130758+ 130758+9 130758*^ 130758' 130758& 130758#9 130758! 130758 x 130758 130758 130758 130758 130758 130758 130758 130758 130758 130758 130758 130758 130758 130758 z 130758X 130758 130758 1282988J 1282988J 1282988I 1282988? 1282988/ 1282988. 1282988.p 1282988#/ 1282988 1282988 1282988 1282988/ 1282988: 1282988 1269750O 1269750O 1269750O 1269750Op 1269750Oo 1269750OK 1269750OD 1269750O2 1269750O% 1269750O 1269750O 1269750O 1269750O 1269750N 1269750N 1269750N 1269750N 1269750N 1269750N 1269750N 1269750N 1269750N 1269750N 1269750N 1269750Np 1269750Nn 1269750Nm 1269750NE 1269750N 1269750N 1269750N 1269750M 1269750M 1269750M 1269750M 1269750M 1269750M 1269750M 1269750Mt 1269750Ml 1269750M[ 1269750MB 1269750M@ 1269750M? 1269750M3 1269750M% 1269750M 1269750M 1269750M 1269750M 1269750M 1269750M 1269750L 1269750L 1269750L 1269750L 1269750L 1269750L 1269750L 1269750L 1269750L 1269750L 1269750L 1269750L 1269750L 1269750L 1269750L 1269750L 1269750L 1269750L 1269750L 1269750L 1269750L 1269750L 1269750L 1269750L 1269750L 1269750L 1269750L 1269750L 1269750L 1269750L 1269750L 1269750L 1269750L 1269750L 1269750L 1269750L 1269750L 1269750L 1269750L 1269750L 1269750L 1269750L 1269750L 1269750L 1269750L 1269750L 1269750L 1269750L 1269750L 1269750L 1269750L 1269750L 1269750L 1269750L 1269750L 1269750L 1269750L 1269750L 1269750L 1269750L 1269750L 1269750L 1269750L 1269750L 1269750L 1269750L 1269750L 1269750L 1269750L~ 1269750L} 1269750L| 1269750Lz 1269750Ly 1269750Lx 1269750Lw 1269750Lv 1269750Lu 1269750Ls 1269750Lp 1269750Lo 1269750Ln 1269750Lm 1269750Ll 1269750Lk 1269750Lj 1269750Lg 1269750Lf 1269750Le 1269750Ld 1269750La 1269750LX 1269750LN 1269750LM 1269750LL 1269750LF 1269750LE 1269750LD 1269750LC 1269750LB 1269750L> 1269750L8 1269750L7 1269750L. 1269750L- 1269750L& 1269750L% 1269750L 1269750L 1269750L 1269750K 1269750K 1269750K 1269750K 1269750K 1269750K 1269750K 1269750K 1269750K 1269750K 1269750K 1269750K 1269750K 1269750K 1269750K 1269750K 1269750K 1269750K 1269750K 1269750K 1269750K 1269750K 1269750K 1269750K 1269750K 1269750KT 1269750KRk 1269750O 130758; 130758; 130758; 130758; 130758; 130758; 130758; 130758; 130758; 130758; 130758; 130758; 130758:- 1307585 1307584 1307584 1269750O ;}  q QZd -U% ossec13001g, rip=185.226.197.27, lip=103.74.54.108, TLS, session=<6Sq9qBgy5dS54sUb>185.226.197.272264397^  E3' ossec2501gF$User authentication failure.Apr 6 14:45:14 vm1 sshd[1699780]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=120.240.92.90 user=root120.240.92.901814991(  CI' ossec5716gF&SSHD authentication failed.Apr 6 14:45:16 vm1 sshd[1699780]: Failed password for root from 120.240.92.90 port 55040 ssh2120.240.92.901814991) CI' ossec5716gFSSHD authentication failed.Apr 6 14:44:40 vm1 sshd[1699595]: Failed password for root from 120.240.92.90 port 58369 ssh2120.240.92.901814991_ E3' ossec2501gFUser authentication failure.Apr 6 14:44:38 vm1 sshd[1699595]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=120.240.92.90 user=root120.240.92.901814991+  3Y+ ossec11301gENew FTP connection.Apr 6 14:43:44 vm1 pure-ftpd[1699430]: (?@172.212.102.208) [INFO] New connection from 172.212.102.208172.212.102.2086252001q  -o' ossec13001gCExim Auth failed2025-04-06 14:34:51 dovecot_login authenticator failed for c-73-199-208-99.hsd1.nj.comcast.net [73.199.208.99]:57193: 535 Incorrect authentication data (set_id=vikas.khandelwal)73.199.208.996252001$  -U' ossec13001gCExim Auth failed2025-04-06 14:34:35 dovecot_login authenticator failed for wsip-70-166-207-76.ph.ph.cox.net (wsip-70-166-207-65.ph.ph.cox.net) [70.166.207.76]:51312: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)70.166.207.766252001>  -) ossec13001g=Exim Auth failed2025-04-06 14:10:17 dovecot_login authenticator failed for (XhJD6f) [117.69.244.190]:61173: 535 Incorrect authentication data117.69.244.1901814991c -Q' ossec13001g=rExim Auth failed2025-04-06 14:08:09 dovecot_login authenticator failed for (G1eFSNH) [117.57.74.142]:56714: 535 Incorrect authentication data (set_id=services@heipowersystem.com)117.57.74.1421814991b  -Q' ossec13001g=hExim Auth failed2025-04-06 14:07:59 dovecot_login authenticator failed for (bXZPi9S) [117.57.74.142]:54799: 535 Incorrect authentication data (set_id=services@heipowersystem.com)117.57.74.1421814991<  -' ossec13001g=dExim Auth failed2025-04-06 14:07:55 dovecot_login authenticator failed for (jQobei) [117.57.74.165]:59973: 535 Incorrect authentication data117.57.74.1651814991h -Y) ossec13001g=@Exim Auth failed2025-04-06 14:07:18 dovecot_login authenticator failed for (xR0h8CBeje) [117.69.244.190]:58683: 535 Incorrect authentication data (set_id=services@heipowersystem.com)117.69.244.1901814991d  -U' ossec13001g<Exim Auth failed2025-04-06 14:05:08 dovecot_login authenticator failed for (7OIu4tMek) [117.57.74.165]:62450: 535 Incorrect authentication data (set_id=services@heipowersystem.com)117.57.74.1651814991c -Q' ossec13001g<Exim Auth failed2025-04-06 14:04:17 dovecot_login authenticator failed for (4pjY26O) [117.57.74.165]:64829: 535 Incorrect authentication data (set_id=services@heipowersystem.com)117.57.74.1651814991 # & N g 4Rz$=Um[3  -E% ossec13001gl"Exim Auth failed2025-04-06 17:27:22 dovecot_login authenticator failed for (amplifypowerglobal.com) [119.96.131.8]:53566: 535 Incorrect authentication data (set_id=nologin)119.96.131.81814991d2 -Q) ossec13001ghExim Auth failed2025-04-06 17:13:19 dovecot_login authenticator failed for (VQ66TH) [114.103.80.237]:63778: 535 Incorrect authentication data (set_id=services@heipowersystem.com)114.103.80.2371814991d1 -S' ossec13001ghExim Auth failed2025-04-06 17:12:16 dovecot_login authenticator failed for (KFPZwSGB) [114.106.136.4]:50952: 535 Incorrect authentication data (set_id=services@heipowersystem.com)114.106.136.41814991c0 -Q' ossec13001ghExim Auth failed2025-04-06 17:11:57 dovecot_login authenticator failed for (fBiypRs) [114.106.136.4]:63832: 535 Incorrect authentication data (set_id=services@heipowersystem.com)114.106.136.41814991"/  3M% ossec11301gdNew FTP connection.Apr 6 16:52:58 vm1 pure-ftpd[1727020]: (?@20.65.195.44) [INFO] New connection from 20.65.195.4420.65.195.446252001,. a1' ossec5710gaAttempt to login using a non-existent userApr 6 16:44:04 vm1 sshd[1725164]: Invalid user pico from 14.241.179.53 port 4221014.241.179.531562822T- E' ossec2501gaUser authentication failure.Apr 6 16:44:04 vm1 sshd[1725164]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.241.179.5314.241.179.531562822^,  E3' ossec2501gaUser authentication failure.Apr 6 16:43:38 vm1 sshd[1725095]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.241.179.53 user=root14.241.179.531562822(+  CI' ossec5716gaSSHD authentication failed.Apr 6 16:43:39 vm1 sshd[1725095]: Failed password for root from 14.241.179.53 port 56694 ssh214.241.179.531562822`*  -M' ossec13001g^Exim Auth failed2025-04-06 16:27:06 dovecot_login authenticator failed for (rokamauka.com) [111.207.12.99]:36238: 535 Incorrect authentication data (set_id=sales@rokamauka.com)111.207.12.991814991T)  -5' ossec13001g]Exim Auth failed2025-04-06 16:26:43 dovecot_login authenticator failed for (rokamauka.com) [111.207.12.99]:32794: 535 Incorrect authentication data (set_id=nologin)111.207.12.991814991a( -K) ossec13001gWqExim Auth failed2025-04-06 15:59:04 dovecot_login authenticator failed for (NRAB23) [183.164.240.40]:50063: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)183.164.240.401814991b'  -Q' ossec13001gW9Exim Auth failed2025-04-06 15:58:08 dovecot_login authenticator failed for (QyYsZP72uX) [117.69.234.71]:61767: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)117.69.234.711814991c&  -Q) ossec13001gWgExim Auth failed2025-04-06 15:58:54 dovecot_login authenticator failed for (r8J1Kk0eN) [183.164.240.40]:62583: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)183.164.240.401814991T%  -5' ossec13001gUExim Auth failed2025-04-06 15:51:17 dovecot_login authenticator failed for ([209.173.10.75]) [209.173.10.75]:44942: 535 Incorrect authentication data (set_id=sales)209.173.10.756252001y$  -' ossec13001gUExim Auth failed2025-04-06 15:51:05 dovecot_login authenticator failed for 185.39.167.72.host.secureserver.net [72.167.39.185]:47014: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)72.167.39.1856252001V#  -;' ossec13001gSExim Auth failed2025-04-06 15:40:38 dovecot_login authenticator failed for ([91.75.110.231]) [91.75.110.231]:59195: 535 Incorrect authentication data (set_id=services)91.75.110.231290557"  - ) ossec13001gSExim Auth failed2025-04-06 15:40:25 dovecot_login authenticator failed for 227.42.246.220.static.netvigator.com [220.246.42.227]:52198: 535 Incorrect authentication data (set_id=services@heipowersystem.com)220.246.42.2271819730 ~qdWJ=0# zm`SF9, v i \ O B 5 (     r e X K > 1 $  { n a T G : -   w j ] P C 6 )    s f Y L ? 2 %  |obUH;.!xk^QD7*tgZM@3& }pcVI</"yl_RE8+uh[NA4' ~qdWJ=0 1814991A 1814991A 1814991A 1814991A 1814991A 1814991A 1814991A 1814991A 1814991A 1814991A 1814991A 1814991A 1814991A 1814991A 1814991A 1814991A 1814991A 1814991A 1814991A 1814991A 1814991A 1814991A 1814991A 1814991A 1814991A 1814991A 1814991A~ 1814991A} 1814991Ay 1814991At 1814991As 1814991Af 1814991AT 1814991AQ 1814991AP 1814991AO 1814991AN 1814991AM 1814991AL 1814991A? 1814991A7 1814991A6 1814991A 1814991A 1814991A 1814991A 1814991@ 1814991@ 1814991@ 1814991@ 1814991@ 1814991@ 1814991@ 1814991@ 1814991@ 1814991@ 1814991@ 1814991@ 1814991@ 1814991@ 1814991@ 1814991@ 1814991@ 1814991@ 1814991@ 1814991@ 1814991@ 1814991@ 1814991@ 1814991@ 1814991@ 1814991@ 1814991@ 1814991@ 1814991@ 1814991@ 1814991@ 1814991@ 1814991@ 1814991@ 1814991@ 1814991@ 1814991@ 1814991@ 1814991@z 1814991@x 1814991@h 1814991@c 1814991@_ 1814991@^ 1814991@] 1814991@U 1814991@Q 1814991@L 1814991@H 1814991@F 1814991@D 1814991@< 1814991@8 1814991@7 1814991@5 1814991@0 1814991@. 1814991@" 1814991@ 1814991@ 1814991@ 1814991@ 1814991@ 1814991@ 1814991@ 1814991@ 1814991@ 1814991@ 1814991? 1814991? 1814991? 1814991? 1814991? 1814991? 1814991? 1814991? 1814991? 1814991? 1814991? 1814991? 1814991? 1814991? 1814991? 1814991? 1814991? 1814991? 1814991? 1814991? 1814991? 1814991? 1814991? 1814991? 1814991?y 1814991?x 1814991?t 1814991?r 1814991?l 1814991?g 1814991?_ 1814991?V 1814991?P 1814991?A 1814991?@ 1814991?? 1814991?> 1814991?= 1814991?8 1814991?/ 1814991?. 1814991?- 1814991?, 1814991?+ 1814991?* 1814991?) 1814991?( 1814991?' 1814991?# 1814991?" 1814991? 1814991? 1814991? 1814991? 1814991? 1814991> 1814991> 1814991> 1814991> 1814991> 1814991> 1814991> 1814991> 1814991> 1814991> 1814991> 1814991> 1814991> 1814991> 1814991> 1814991> 1814991> 1814991> 1814991> 1814991> 1814991> 1814991> 1814991> 1814991> 1814991> 1814991> 1814991> 1814991> 1814991> 1814991> 1814991> 1814991> 1814991>~ 1814991>} 1814991>| 1814991>{ 1814991>z 1814991>j 1814991>` 1814991>^ 1814991>W 1814991>V 1814991>S 1814991>R 1814991>Q 1814991>P 1814991>9 1814991>8 1814991>7 1814991>6 1814991>4 1814991> 1814991> 1814991> 1814991> 1814991> 1814991= 1814991= 1814991= 1814991= 1814991= 1814991= 1814991= 1814991= 1814991= 1814991= 1814991= 1814991= 1814991= m  + 6 B DfVGT[q3Qm`C  -Q# ossec13001gv Exim Auth failed2025-04-06 18:09:39 dovecot_login authenticator failed for (bnLhggPyy) [60.174.1.46]:53041: 535 Incorrect authentication data (set_id=services@heipowersystem.com)60.174.1.461814991^B -K# ossec13001guExim Auth failed2025-04-06 18:08:33 dovecot_login authenticator failed for (XBvsIB) [60.174.1.46]:51838: 535 Incorrect authentication data (set_id=services@heipowersystem.com)60.174.1.461814991:A  =o) ossec13008gsRMail Reciepient rejected2025-04-06 17:58:00 H=(mail.msnews24.in) [165.154.210.99]:62740 F= rejected RCPT : Rejected relay attempt: '165.154.210.99' From: 'ovbnjzuvb@msnews24.in' To: 'validxxx@gmailhotmail.com.br'165.154.210.991694008f@  -W) ossec13001gqExim Auth failed2025-04-06 17:51:30 dovecot_plain authenticator failed for (5yg4jy83r1g6jh3lyuh2wo0ll7vrhct0) [46.191.181.176]:5579: 535 Incorrect authentication data (set_id=sales)46.191.181.1762017370u?  -w' ossec13001gqExim Auth failed2025-04-06 17:51:23 dovecot_login authenticator failed for c-98-220-97-188.hsd1.il.comcast.net [98.220.97.188]:41654: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)98.220.97.1886252001o>  -i) ossec13001gqExim Auth failed2025-04-06 17:51:22 dovecot_plain authenticator failed for (35qv72p1qhbuzdhk4h85fd) [46.191.181.176]:2306: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)46.191.181.1762017370 =  -!) ossec13001gqExim Auth failed2025-04-06 17:51:12 dovecot_login authenticator failed for 143.38.109.208.host.secureserver.net [208.109.38.143]:35458: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)208.109.38.1436252001 <  =) ossec13008gqMail Reciepient rejected2025-04-06 17:50:26 H=(hostglobal.plus) [78.153.140.207]:33670 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no F= rejected RCPT : Sender verify failed78.153.140.2072635167Z;  -=+ ossec13001gpExim Auth failed2025-04-06 17:47:58 dovecot_login authenticator failed for ([211.178.165.251]) [211.178.165.251]:41463: 535 Incorrect authentication data (set_id=sales)211.178.165.2511835841z:  -) ossec13001gpExim Auth failed2025-04-06 17:47:44 dovecot_login authenticator failed for 198-91-194-206.cpe.distributel.net [198.91.194.206]:58570: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)198.91.194.2066251999p9  -m' ossec13001gpExim Auth failed2025-04-06 17:46:41 dovecot_plain authenticator failed for remote.vision-craft.com (Stella2) [24.83.200.235]:1787: 535 Incorrect authentication data (set_id=info@spexscart.com)24.83.200.2356251999q8  -o' ossec13001gpZExim Auth failed2025-04-06 17:45:20 dovecot_plain authenticator failed for remote.vision-craft.com (Stella2) [24.83.200.235]:63519: 535 Incorrect authentication data (set_id=info@spexscart.com)24.83.200.2356251999q7  -o' ossec13001gp Exim Auth failed2025-04-06 17:44:00 dovecot_plain authenticator failed for remote.vision-craft.com (Stella2) [24.83.200.235]:21065: 535 Incorrect authentication data (set_id=info@spexscart.com)24.83.200.2356251999q6  -o' ossec13001goExim Auth failed2025-04-06 17:42:43 dovecot_plain authenticator failed for remote.vision-craft.com (Stella2) [24.83.200.235]:58937: 535 Incorrect authentication data (set_id=info@spexscart.com)24.83.200.2356251999q5  -o' ossec13001gokExim Auth failed2025-04-06 17:41:23 dovecot_plain authenticator failed for remote.vision-craft.com (Stella2) [24.83.200.235]:21142: 535 Incorrect authentication data (set_id=info@spexscart.com)24.83.200.2356251999r4  -s% ossec13001gl:Exim Auth failed2025-04-06 17:27:46 dovecot_login authenticator failed for (amplifypowerglobal.com) [119.96.131.8]:56646: 535 Incorrect authentication data (set_id=support@amplifypowerglobal.com)119.96.131.81814991 Y %:Vbn}lU  -c) ossec13001g}Exim Auth failed2025-04-06 18:43:15 dovecot_login authenticator failed for ipb21876ab.dynamic.kabel-deutschland.de [178.24.118.171]:54966: 535 Incorrect authentication data (set_id=sales)178.24.118.1712921044bT -O' ossec13001g}Exim Auth failed2025-04-06 18:43:10 dovecot_login authenticator failed for (dsgeaa) [223.247.47.86]:63213: 535 Incorrect authentication data (set_id=services@heipowersystem.com)223.247.47.861814991RS  -5' ossec13001g}Exim Auth failed2025-04-06 18:43:05 dovecot_login authenticator failed for ([65.20.250.180]) [65.20.250.180]:60011: 535 Incorrect authentication data (set_id=sales)65.20.250.18099237mR  -c+ ossec13001g}Exim Auth failed2025-04-06 18:42:50 dovecot_login authenticator failed for ([175.209.109.213]) [175.209.109.213]:58530: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)175.209.109.2131835841pQ  -m' ossec13001g}Exim Auth failed2025-04-06 18:42:49 dovecot_login authenticator failed for (183.82.106.51.actcorp.in) [183.82.106.51]:59846: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)183.82.106.511269750"P  3M% ossec11301g|YNew FTP connection.Apr 6 18:36:31 vm1 pure-ftpd[1750718]: (?@18.191.141.9) [INFO] New connection from 18.191.141.918.191.141.96252001#O 3M% ossec11301g{New FTP connection.Apr 6 18:33:32 vm1 pure-ftpd[1750091]: (?@18.191.141.9) [INFO] New connection from 18.191.141.918.191.141.96252001#N 3M% ossec11301g{New FTP connection.Apr 6 18:33:18 vm1 pure-ftpd[1750061]: (?@18.191.141.9) [INFO] New connection from 18.191.141.918.191.141.96252001`M  -M' ossec13001g{xExim Auth failed2025-04-06 18:32:48 dovecot_login authenticator failed for (183.82.106.51.actcorp.in) [183.82.106.51]:36110: 535 Incorrect authentication data (set_id=services)183.82.106.511269750gL  -]% ossec13001g{cExim Auth failed2025-04-06 18:32:25 dovecot_login authenticator failed for ([36.48.70.211]) [36.48.70.211]:41062: 535 Incorrect authentication data (set_id=services@heipowersystem.com)36.48.70.2111814991BK  - + ossec13001gy0Exim Auth failed2025-04-06 18:23:03 dovecot_login authenticator failed for (DK0axNjs) [183.165.246.146]:55402: 535 Incorrect authentication data183.165.246.1461814991fJ -S+ ossec13001gxfExim Auth failed2025-04-06 18:19:41 dovecot_login authenticator failed for (qVCwGv) [183.165.246.146]:51257: 535 Incorrect authentication data (set_id=services@heipowersystem.com)183.165.246.1461814991gI -U+ ossec13001gxFExim Auth failed2025-04-06 18:19:09 dovecot_login authenticator failed for (0EicWxK) [183.165.246.146]:63002: 535 Incorrect authentication data (set_id=services@heipowersystem.com)183.165.246.1461814991gH -U+ ossec13001gx$Exim Auth failed2025-04-06 18:18:34 dovecot_login authenticator failed for (RfUWQqa) [183.165.250.241]:52475: 535 Incorrect authentication data (set_id=services@heipowersystem.com)183.165.250.2411814991fG  -U+ ossec13001gxExim Auth failed2025-04-06 18:18:27 dovecot_login authenticator failed for (AEVzHnb) [183.165.250.241]:52078: 535 Incorrect authentication data (set_id=services@heipowersystem.com)183.165.250.2411814991@F  - ) ossec13001gw Exim Auth failed2025-04-06 18:13:54 dovecot_login authenticator failed for (8MuUuXwt) [223.247.47.152]:54978: 535 Incorrect authentication data223.247.47.15218149919E -# ossec13001gvExim Auth failed2025-04-06 18:12:29 dovecot_login authenticator failed for (ZFPj2w) [60.174.1.46]:53862: 535 Incorrect authentication data60.174.1.461814991fD -U) ossec13001gvAExim Auth failed2025-04-06 18:10:32 dovecot_login authenticator failed for (Iwh0m8Mr) [223.247.47.152]:64059: 535 Incorrect authentication data (set_id=services@heipowersystem.com)223.247.47.1521814991 `2 L g v Wn6`Rf E% ossec2501gQUser authentication failure.Apr 6 19:44:39 vm1 sshd[1765666]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=89.168.18.2589.168.18.253175395Ve a% ossec6003gQImunify PAM. The IP has been locked by RBLApr 6 19:44:39 vm1 sshd[1765666]: pam_imunify(sshd:auth): [IM360_RBL] The IP 89.168.18.25 has been locked due to Imunify RBL89.168.18.253175395Ud  a% ossec6003gCImunify PAM. The IP has been locked by RBLApr 6 19:44:26 vm1 sshd[1765578]: pam_imunify(sshd:auth): [IM360_RBL] The IP 89.168.18.25 has been locked due to Imunify RBL89.168.18.253175395\c  E1% ossec2501gCUser authentication failure.Apr 6 19:44:26 vm1 sshd[1765578]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=89.168.18.25 user=root89.168.18.253175395gb -W) ossec13001g Exim Auth failed2025-04-06 19:43:32 dovecot_login authenticator failed for (5J7OVjbvI) [117.69.244.224]:61142: 535 Incorrect authentication data (set_id=services@heipowersystem.com)117.69.244.2241814991ca -S% ossec13001gCExim Auth failed2025-04-06 19:44:26 dovecot_login authenticator failed for (a38negIgp) [117.57.74.40]:58445: 535 Incorrect authentication data (set_id=services@heipowersystem.com)117.57.74.401814991h` -Y) ossec13001gExim Auth failed2025-04-06 19:43:01 dovecot_login authenticator failed for (BKLLYNDcmc) [117.69.244.224]:55098: 535 Incorrect authentication data (set_id=services@heipowersystem.com)117.69.244.2241814991c_ -M+ ossec13001grExim Auth failed2025-04-06 19:36:42 dovecot_login authenticator failed for (BnV8wy) [183.165.249.212]:52537: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)183.165.249.2121814991e^ -Q+ ossec13001g@Exim Auth failed2025-04-06 19:35:52 dovecot_login authenticator failed for (0V41MN9q) [183.165.249.212]:59063: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)183.165.249.2121814991:]  =o) ossec13008gMail Reciepient rejected2025-04-06 19:34:01 H=(mail.msnews24.in) [165.154.210.52]:64967 F= rejected RCPT : Rejected relay attempt: '165.154.210.52' From: 'dbbfendhx@msnews24.in' To: 'validxxx@gmailhotmail.com.br'165.154.210.521694008]\  -I% ossec13001gzExim Auth failed2025-04-06 19:32:34 dovecot_login authenticator failed for (dBlgXkD) [117.70.48.49]:54475: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)117.70.48.491814991 [  =) ossec13008gHMail Reciepient rejected2025-04-06 19:31:43 H=(hostglobal.plus) [78.153.140.207]:58570 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no F= rejected RCPT : Sender verify failed78.153.140.2072635167]Z -G% ossec13001gHExim Auth failed2025-04-06 19:31:43 dovecot_login authenticator failed for (ga3Mhb) [117.70.48.49]:63061: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)117.70.48.491814991aY -O% ossec13001g,Exim Auth failed2025-04-06 19:31:15 dovecot_login authenticator failed for (LKXlxcaN5s) [117.70.48.49]:57480: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)117.70.48.491814991bX -M) ossec13001gExim Auth failed2025-04-06 18:58:40 dovecot_login authenticator failed for (nw27e2K) [223.215.176.48]:51442: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)223.215.176.481814991cW -O) ossec13001gNExim Auth failed2025-04-06 18:57:41 dovecot_login authenticator failed for (tMYy88Fo) [223.215.176.48]:58248: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)223.215.176.481814991cV -Q' ossec13001g}Exim Auth failed2025-04-06 18:43:29 dovecot_login authenticator failed for (Gjme0rx) [223.247.47.86]:50789: 535 Incorrect authentication data (set_id=services@heipowersystem.com)223.247.47.861814991 Vn  N :Ugxx  -}) ossec13001g;Exim Auth failed2025-04-06 20:44:02 dovecot_login authenticator failed for ([94.205.100.219]) [94.205.100.219]:59402: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)94.205.100.219290557Bw - + ossec13001gExim Auth failed2025-04-06 20:24:47 dovecot_login authenticator failed for (1iQzG7i) [114.106.171.113]:55924: 535 Incorrect authentication data114.106.171.1131814991jv -[+ ossec13001gExim Auth failed2025-04-06 20:21:44 dovecot_login authenticator failed for (6i2eDwbSgr) [114.106.171.113]:53499: 535 Incorrect authentication data (set_id=services@heipowersystem.com)114.106.171.1131814991au -O% ossec13001gExim Auth failed2025-04-06 20:20:38 dovecot_login authenticator failed for (kbi65SK) [60.174.1.241]:59295: 535 Incorrect authentication data (set_id=services@heipowersystem.com)60.174.1.2411814991at  -Q% ossec13001gExim Auth failed2025-04-06 20:20:28 dovecot_login authenticator failed for (q6PppWTT) [60.174.1.241]:57391: 535 Incorrect authentication data (set_id=services@heipowersystem.com)60.174.1.2411814991es  -S+ ossec13001gExim Auth failed2025-04-06 20:19:55 dovecot_login authenticator failed for ([101.231.247.210]) [101.231.247.210]:57970: 535 Incorrect authentication data (set_id=vikas.khandelwal)101.231.247.2101814991rr  -q' ossec13001gExim Auth failed2025-04-06 20:19:41 dovecot_login authenticator failed for ([124.152.90.68]) [124.152.90.68]:58865: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)124.152.90.681814991eq  -S+ ossec13001g3Exim Auth failed2025-04-06 20:09:46 dovecot_login authenticator failed for (NFopN5) [183.165.224.229]:52771: 535 Incorrect authentication data (set_id=services@heipowersystem.com)183.165.224.2291814991ip  -[+ ossec13001gExim Auth failed2025-04-06 20:09:20 dovecot_login authenticator failed for (ymbeLB0Kf2) [183.165.224.229]:62945: 535 Incorrect authentication data (set_id=services@heipowersystem.com)183.165.224.2291814991io  -[+ ossec13001gExim Auth failed2025-04-06 20:08:11 dovecot_login authenticator failed for (YHTow9ofBH) [183.165.224.229]:63453: 535 Incorrect authentication data (set_id=services@heipowersystem.com)183.165.224.2291814991cn  -S' ossec13001gExim Auth failed2025-04-06 20:07:17 dovecot_login authenticator failed for (aiyob2JG) [223.247.46.85]:60339: 535 Incorrect authentication data (set_id=services@heipowersystem.com)223.247.46.851814991"m  3M% ossec11301g^New FTP connection.Apr 6 19:57:40 vm1 pure-ftpd[1768440]: (?@139.162.77.6) [INFO] New connection from 139.162.77.6139.162.77.61861060@l - ' ossec13001gaExim Auth failed2025-04-06 19:49:11 dovecot_login authenticator failed for (4ZPWePeW9) [223.247.47.15]:50599: 535 Incorrect authentication data223.247.47.151814991?k - % ossec13001g Exim Auth failed2025-04-06 19:47:45 dovecot_login authenticator failed for (X8jP3uqkt9) [117.57.74.40]:64967: 535 Incorrect authentication data117.57.74.401814991cj -Q' ossec13001gExim Auth failed2025-04-06 19:46:09 dovecot_login authenticator failed for (7SBqnDP) [223.247.47.15]:63381: 535 Incorrect authentication data (set_id=services@heipowersystem.com)223.247.47.151814991.i a7% ossec5710gQAttempt to login using a non-existent userApr 6 19:44:39 vm1 sshd[1765666]: Invalid user informix from 89.168.18.25 port 5007689.168.18.253175395dh -U% ossec13001gGExim Auth failed2025-04-06 19:44:31 dovecot_login authenticator failed for (2iLJmEwC7F) [117.57.74.40]:58227: 535 Incorrect authentication data (set_id=services@heipowersystem.com)117.57.74.401814991&g  CG% ossec5716gESSHD authentication failed.Apr 6 19:44:28 vm1 sshd[1765578]: Failed password for root from 89.168.18.25 port 39042 ssh289.168.18.253175395 *\~tj`VLB8.$zpf\H>4*   v l b X N D : 0 &    ~ t j ` V L B 8 . $    z p f \ R H > 4 *  vlbXND:0&|rh^TJ@6,"xndZPF2<( ~tj`VLB8.$zpf\ | r h ^ T J @ 6 , "    x n d Z P F < 2 (   RRH>4*  vlbXND:0& g)-;o g);n g) ;m g(;l g(;k g(;j g(;i g(;h g(?;g g(;f g';e g';d g%;c g%;b g$;a g$;` g#;_ g#;^ g#;] g";\ g!;[ g!;Z g!y;Y gB;X g6;W g,;V g$;U g;T g;S gD;R g;Q g;P g;O g-;N g!;M gO;L g;K g;J g;I g;H g;G g;F g ;E g ;D g ~;C g t;B g S;A g ;@ g 8;? g ;> g ;= g ;< g;; gZ;: g5;9 g>;8 g0;7 g;6 g;5 g;4 gg;3 g;2 g;1 g;0 g;/ g;. g;- g};, g;+ g֚;* gZ;) gF;( gB;' g;& g?;% g?;$ g/;# g%;" g#;! gV; gL; gH; g<; g; g; gf; g~; gA; g5; g; g; gz; g=; g;; g); g%; g; gY; g; g|; gT; gL; gX; gB; g; g; g; g; g; gM; g; g; g: g: g: gv: gL: g: g: g;: g: g: g: g: g: g: g3: g: g: g: g^: ga: g : g: gQ: gQ: gQ: gG: gE: gC: gC: gC: g : g: gr: g@: g: gz: gH: gH: g,: g: gN: g}: g}: g}: g}: g}: g}: g|Y: g{: g{: g{x: g{c: gy0: gxf: gxF: gx$: gx: gw : gn; gn; gm`; gmR; gmP; gm@; gm>; gi; gh; gb; gb; gb; ga; g]!; g]; gZ; gU; gU; gU; gN; gN7; gM; gM; gM?; gL; gI; gI~; gF; gF;~ gF;} gF;| gD';{ gD;z g:;y g:p;x g:f;w g9;v g9;u g4;t g+ ;s g*;r g*;q g)c;p gv: gvA: gv : gu: gsR: gq: gq: gq: gq: gq: gp: gp: gp: gpZ: gp : go: gok: gl:: gl": gh: gh: gh: gd: ga: ga: ga: ga: g^: g]: gWq: gWg: gW9: gU: gU: gS: gS: gN*: gIe: gI[: gG: gF&: gF$: gn; gF: gF: gE: gC: gC: g=: g=r: g=h: g=d: g=@: g<: g<: g:v g!$:t g!:u g :s g :r V7 P o +X@Vf  -U+ ossec13001gLExim Auth failed2025-04-06 21:39:48 dovecot_login authenticator failed for (wUsrLy6Aze) [114.106.136.239]:57162: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)114.106.136.2391814991Q  -1% ossec13001gXExim Auth failed2025-04-06 21:35:42 dovecot_login authenticator failed for ([49.124.132.5]) [49.124.132.5]:45778: 535 Incorrect authentication data (set_id=sales)49.124.132.51733045b  -W% ossec13001gBExim Auth failed2025-04-06 21:35:22 dovecot_login authenticator failed for ([46.161.196.5]) [46.161.196.5]:43790: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)46.161.196.599237\  -G% ossec13001gExim Auth failed2025-04-06 21:25:13 dovecot_login authenticator failed for vps-79f20bfc.vps.ovh.net [51.75.24.107]:46962: 535 Incorrect authentication data (set_id=services)51.75.24.1073017382m  -e) ossec13001gExim Auth failed2025-04-06 21:25:02 dovecot_login authenticator failed for ([103.129.201.82]) [103.129.201.81]:60988: 535 Incorrect authentication data (set_id=services@heipowersystem.com)103.129.201.811210997@  - + ossec13001gExim Auth failed2025-04-06 21:16:33 dovecot_login authenticator failed for (KVVgu3) [183.165.247.110]:49283: 535 Incorrect authentication data183.165.247.1101814991D -+ ossec13001gExim Auth failed2025-04-06 21:16:20 dovecot_login authenticator failed for (ZUY5nXcxG) [183.165.247.110]:62628: 535 Incorrect authentication data183.165.247.1101814991?  - ' ossec13001gExim Auth failed2025-04-06 21:15:25 dovecot_login authenticator failed for (KWMBRzVG3) [117.70.48.184]:51184: 535 Incorrect authentication data117.70.48.1841814991   =) ossec13008gMMail Reciepient rejected2025-04-06 21:14:11 H=(hostglobal.plus) [78.153.140.207]:57556 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no F= rejected RCPT : Sender verify failed78.153.140.2072635167g -U+ ossec13001gExim Auth failed2025-04-06 21:13:13 dovecot_login authenticator failed for (fcORHxW) [183.165.247.110]:58753: 535 Incorrect authentication data (set_id=services@heipowersystem.com)183.165.247.1101814991c -Q' ossec13001gExim Auth failed2025-04-06 21:12:34 dovecot_login authenticator failed for (lbGwUy8) [117.70.48.184]:50992: 535 Incorrect authentication data (set_id=services@heipowersystem.com)117.70.48.1841814991_  -M% ossec13001gExim Auth failed2025-04-06 21:11:48 dovecot_login authenticator failed for (MQvqyIAwQ) [60.174.0.191]:53891: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)60.174.0.1911814991b~  -Q' ossec13001gExim Auth failed2025-04-06 21:12:17 dovecot_login authenticator failed for (iHZmlkR) [117.70.48.184]:63028: 535 Incorrect authentication data (set_id=services@heipowersystem.com)117.70.48.1841814991%}  3Q' ossec11301gNew FTP connection.Apr 6 21:10:59 vm1 pure-ftpd[1785001]: (?@104.152.52.84) [INFO] New connection from 104.152.52.84104.152.52.846252001]| -G% ossec13001gvExim Auth failed2025-04-06 21:10:38 dovecot_login authenticator failed for (oiviri) [60.174.0.191]:55173: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)60.174.0.1911814991c{  -O+ ossec13001gLExim Auth failed2025-04-06 21:09:56 dovecot_login authenticator failed for (A2yRjDW) [183.165.246.134]:65249: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)183.165.246.1341814991`z  -K) ossec13001gExim Auth failed2025-04-06 20:56:21 dovecot_login authenticator failed for (i9yLey) [183.164.240.44]:50027: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)183.164.240.441814991ay -K) ossec13001gExim Auth failed2025-04-06 20:55:04 dovecot_login authenticator failed for (8TOGqJ) [183.164.240.44]:58783: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)183.164.240.441814991 ?/ I G 7S5?r  -s' ossec13001g<Exim Auth failed2025-04-07 00:25:54 dovecot_login authenticator failed for (91-219-196-17.planeta.dn.ua) [91.219.196.17]:60138: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)91.219.196.17690791d  -U' ossec13001gExim Auth failed2025-04-07 00:15:56 dovecot_login authenticator failed for (fp5cca5266.gifg408.ap.nuro.jp) [154.47.20.218]:7154: 535 Incorrect authentication data (set_id=services)154.47.20.2181861060f  -]% ossec13001gExim Auth failed2025-04-07 00:15:44 dovecot_login authenticator failed for ([94.204.196.7]) [94.204.196.7]:50254: 535 Incorrect authentication data (set_id=services@heipowersystem.com)94.204.196.7290557  ?1 ossec1008gfProcess exiting (killed).Apr 7 00:05:17 vm1 spamd[1506628]: spamd: server killed by SIGTERM, shutting down  W+ ossec9708g~Dovecot Aborted Login with empty userApr 6 23:40:03 vm1 dovecot[1526]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=185.247.137.162, lip=103.74.54.108, TLS, session=185.247.137.162298795e  -W) ossec13001gAExim Auth failed2025-04-06 23:34:48 dovecot_login authenticator failed for ([197.156.97.198]) [197.156.97.198]:46384: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)197.156.97.198337996  -' ossec13001g5Exim Auth failed2025-04-06 23:34:37 dovecot_login authenticator failed for 125-229-56-26.hinet-ip.hinet.net [125.229.56.26]:43776: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)125.229.56.261668284+  3Y+ ossec11301gNew FTP connection.Apr 6 23:08:13 vm1 pure-ftpd[1810794]: (?@147.185.132.105) [INFO] New connection from 147.185.132.105147.185.132.1056252001`  -O% ossec13001gExim Auth failed2025-04-06 23:06:38 dovecot_login authenticator failed for (rokamauka.com) [125.72.54.81]:37710: 535 Incorrect authentication data (set_id=contact@rokamauka.com)125.72.54.811814991R  -3% ossec13001gzExim Auth failed2025-04-06 23:05:53 dovecot_login authenticator failed for (rokamauka.com) [125.72.54.81]:33022: 535 Incorrect authentication data (set_id=nologin)125.72.54.811814991B  gU) ossec11307g=Multiple connection attempts from same sourceApr 6 23:00:35 vm1 pure-ftpd[1809015]: (?@104.156.155.25) [INFO] New connection from 104.156.155.25104.156.155.256252001) 3U) ossec11301g;New FTP connection.Apr 6 23:00:34 vm1 pure-ftpd[1809009]: (?@104.156.155.25) [INFO] New connection from 104.156.155.25104.156.155.256252001C gU) ossec11307g)Multiple connection attempts from same sourceApr 6 23:00:15 vm1 pure-ftpd[1808852]: (?@104.156.155.25) [INFO] New connection from 104.156.155.25104.156.155.256252001) 3U) ossec11301g%/New FTP connection.Apr 6 23:00:12 vm1 pure-ftpd[1808816]: (?@104.156.155.25) [INFO] New connection from 104.156.155.25104.156.155.256252001%  3Q' ossec11301gNew FTP connection.Apr 6 22:07:50 vm1 pure-ftpd[1797478]: (?@13.89.124.212) [INFO] New connection from 13.89.124.21213.89.124.2126252001(  3U) ossec11301gYNew FTP connection.Apr 6 21:52:47 vm1 pure-ftpd[1794222]: (?@216.218.206.68) [INFO] New connection from 216.218.206.68216.218.206.686252001b -M) ossec13001gExim Auth failed2025-04-06 21:40:44 dovecot_login authenticator failed for (fzhzhno) [183.165.245.98]:57755: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)183.165.245.981814991f  -U+ ossec13001g|Exim Auth failed2025-04-06 21:40:36 dovecot_login authenticator failed for (eX8iZ25WdS) [114.106.136.239]:52107: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)114.106.136.2391814991c -O) ossec13001gTExim Auth failed2025-04-06 21:39:56 dovecot_login authenticator failed for (atFy82sI) [183.165.245.98]:49929: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)183.165.245.981814991 (: H e  X .I+/  CM+ ossec5716gSSHD authentication failed.Apr 7 02:11:14 vm1 sshd[1851826]: Failed password for root from 105.200.199.198 port 45265 ssh2105.200.199.198357994a.  E7+ ossec2501gUser authentication failure.Apr 7 02:11:11 vm1 sshd[1851826]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=105.200.199.198 user=root105.200.199.198357994b-  -O) ossec13001gExim Auth failed2025-04-07 02:01:06 dovecot_login authenticator failed for ([36.135.125.196]) [36.135.125.196]:34132: 535 Incorrect authentication data (set_id=vikas.khandelwal)36.135.125.1961814991o,  -m% ossec13001g}Exim Auth failed2025-04-07 02:00:53 dovecot_login authenticator failed for ([112.91.67.18]) [112.91.67.18]:41122: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)112.91.67.181814991c+  -S' ossec13001gExim Auth failed2025-04-07 01:02:22 dovecot_login authenticator failed for (kh1f1twu) [117.57.74.231]:54712: 535 Incorrect authentication data (set_id=services@heipowersystem.com)117.57.74.2311814991e*  -W' ossec13001g֚Exim Auth failed2025-04-07 01:01:36 dovecot_login authenticator failed for (rx2wdU7vSQ) [117.57.74.231]:59841: 535 Incorrect authentication data (set_id=services@heipowersystem.com)117.57.74.2311814991r)  -o) ossec13001gZExim Auth failed2025-04-07 01:00:32 dovecot_login authenticator failed for (s2seducationtrust.com) [124.160.63.122]:44334: 535 Incorrect authentication data (set_id=admin@s2seducationtrust.com)124.160.63.1221814991e(  -U) ossec13001gFExim Auth failed2025-04-07 01:00:13 dovecot_login authenticator failed for (ygayhkjX) [117.69.234.107]:58643: 535 Incorrect authentication data (set_id=services@heipowersystem.com)117.69.234.1071814991^'  -G) ossec13001gBExim Auth failed2025-04-07 01:00:09 dovecot_login authenticator failed for (s2seducationtrust.com) [124.160.63.122]:15985: 535 Incorrect authentication data (set_id=nologin)124.160.63.1221814991e&  -U) ossec13001gExim Auth failed2025-04-07 00:59:05 dovecot_login authenticator failed for (hdnR6wVU) [117.69.234.107]:59889: 535 Incorrect authentication data (set_id=services@heipowersystem.com)117.69.234.1071814991S%  E' ossec2501g?User authentication failure.Apr 7 00:47:17 vm1 sshd[1833806]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=58.251.168.3258.251.168.321814991,$ a1' ossec5710g?Attempt to login using a non-existent userApr 7 00:47:17 vm1 sshd[1833806]: Invalid user wook from 58.251.168.32 port 4472458.251.168.321814991-# a3' ossec5710g/Attempt to login using a non-existent userApr 7 00:47:01 vm1 sshd[1833737]: Invalid user admin from 58.251.168.32 port 3851658.251.168.321814991("  CI' ossec5716g%SSHD authentication failed.Apr 7 00:46:51 vm1 sshd[1833718]: Failed password for root from 58.251.168.32 port 38828 ssh258.251.168.321814991_! E3' ossec2501g#User authentication failure.Apr 7 00:46:49 vm1 sshd[1833718]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=58.251.168.32 user=root58.251.168.321814991n  -e+ ossec13001gVExim Auth failed2025-04-07 00:30:37 dovecot_login authenticator failed for net-188-219-104-210.cust.vodafonedsl.it [188.219.104.210]:45903: 535 Incorrect authentication data (set_id=sales)188.219.104.2103175395j  -_) ossec13001gLExim Auth failed2025-04-07 00:30:27 dovecot_login authenticator failed for ([154.144.243.93]) [154.144.243.93]:56852: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)154.144.243.932542007T  -5' ossec13001gHExim Auth failed2025-04-07 00:26:07 dovecot_login authenticator failed for ([219.248.65.30]) [219.248.65.30]:54683: 535 Incorrect authentication data (set_id=sales)219.248.65.301835841 ]Ns @ R _ n Ti,C]b@  -S% ossec13001g Exim Auth failed2025-04-07 04:45:37 dovecot_login authenticator failed for (sF46x6W9i) [60.174.0.112]:61625: 535 Incorrect authentication data (set_id=services@heipowersystem.com)60.174.0.1121814991e?  -S+ ossec13001g 8Exim Auth failed2025-04-07 04:46:06 dovecot_login authenticator failed for (L62cPf) [183.165.226.136]:53300: 535 Incorrect authentication data (set_id=services@heipowersystem.com)183.165.226.1361814991a>  -Q% ossec13001g Exim Auth failed2025-04-07 04:45:11 dovecot_login authenticator failed for (uQKaIsx9) [60.174.0.112]:56473: 535 Incorrect authentication data (set_id=services@heipowersystem.com)60.174.0.1121814991c=  -U% ossec13001g Exim Auth failed2025-04-07 04:43:34 dovecot_login authenticator failed for (6FZHVvATzM) [60.174.0.138]:51107: 535 Incorrect authentication data (set_id=services@heipowersystem.com)60.174.0.1381814991V< -5) ossec13001g Exim Auth failed2025-04-07 04:39:40 dovecot_plain authenticator failed for (hostglobal.plus) [78.153.140.207]:54588: 535 Incorrect authentication data (set_id=info)78.153.140.2072635167g; -W) ossec13001gExim Auth failed2025-04-07 04:13:22 dovecot_login authenticator failed for (hv5HUe3Ds) [183.165.226.66]:64124: 535 Incorrect authentication data (set_id=services@heipowersystem.com)183.165.226.661814991f: -U) ossec13001gZExim Auth failed2025-04-07 04:12:33 dovecot_login authenticator failed for (7SHmxpFq) [183.165.226.66]:54793: 535 Incorrect authentication data (set_id=services@heipowersystem.com)183.165.226.661814991f9  -W) ossec13001g5Exim Auth failed2025-04-07 04:11:56 dovecot_login authenticator failed for (yBb0M9THU) [114.106.171.73]:64940: 535 Incorrect authentication data (set_id=services@heipowersystem.com)114.106.171.731814991T8  -5' ossec13001g>Exim Auth failed2025-04-07 03:16:38 dovecot_login authenticator failed for ([154.127.90.34]) [154.127.90.34]:39211: 535 Incorrect authentication data (set_id=sales)154.127.90.342440476g7  -Y) ossec13001g0Exim Auth failed2025-04-07 03:16:24 dovecot_login authenticator failed for (hn.kd.ny.adsl) [218.29.231.106]:59626: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)218.29.231.10618149916  W# ossec9708gDovecot Aborted Login with empty userApr 7 03:07:03 vm1 dovecot[1526]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 2 secs): user=<>, rip=71.6.199.23, lip=103.74.54.108, TLS, session=<2xmb6yIyEtxHBscX>71.6.199.236252001m5  -i% ossec13001gExim Auth failed2025-04-07 03:06:08 dovecot_login authenticator failed for ip47.ip-192-99-98.net ([148.113.193.156]) [192.99.98.47]:37294: 535 Incorrect authentication data (set_id=services)192.99.98.476251999o4  -g+ ossec13001gExim Auth failed2025-04-07 03:05:55 dovecot_login authenticator failed for ([125.21.146.174]) [115.242.200.126]:50836: 535 Incorrect authentication data (set_id=services@heipowersystem.com)115.242.200.1261269750j3  -_) ossec13001ggExim Auth failed2025-04-07 02:21:49 dovecot_login authenticator failed for ([178.178.222.59]) [178.178.222.59]:46794: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)178.178.222.592017370/2  =[' ossec13008gMail Reciepient rejected2025-04-07 02:16:00 H=(mail.msnews24.in) [45.197.14.138]:56064 F= rejected RCPT : Rejected relay attempt: '45.197.14.138' From: 'ogggy@msnews24.in' To: 'validxxx@gmailhotmail.com.br'45.197.14.1386252001W1 E!+ ossec2501gUser authentication failure.Apr 7 02:11:26 vm1 sshd[1851858]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=105.200.199.198105.200.199.198357994.0 a3+ ossec5710gAttempt to login using a non-existent userApr 7 02:11:26 vm1 sshd[1851858]: Invalid user svn from 105.200.199.198 port 48306105.200.199.198357994 y 2 G i &? =_ybR  -Q' ossec13001gDExim Auth failed2025-04-07 05:58:52 dovecot_login authenticator failed for (KRO71vp) [117.69.234.80]:56741: 535 Incorrect authentication data (set_id=services@heipowersystem.com)117.69.234.801814991ZQ  -?) ossec13001gExim Auth failed2025-04-07 05:57:02 dovecot_login authenticator failed for ([111.93.177.228]) [111.93.177.228]:34106: 535 Incorrect authentication data (set_id=services)111.93.177.2281269750WP  -;' ossec13001gExim Auth failed2025-04-07 05:56:49 dovecot_login authenticator failed for ([31.43.202.110]) [31.43.202.110]:40763: 535 Incorrect authentication data (set_id=services)31.43.202.1102017370mO  -e) ossec13001gExim Auth failed2025-04-07 05:56:30 dovecot_login authenticator failed for ([117.69.210.199]) [117.69.210.199]:37238: 535 Incorrect authentication data (set_id=services@heipowersystem.com)117.69.210.1991814991aN  -S' ossec13001g-Exim Auth failed2025-04-07 05:15:48 dovecot_login authenticator failed for ([65.20.136.183]) [65.20.136.183]:55965: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)65.20.136.18399237yM  -}) ossec13001g!Exim Auth failed2025-04-07 05:15:37 dovecot_login authenticator failed for ([195.222.57.183]) [195.222.57.183]:41650: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)195.222.57.1833277605gL  -[' ossec13001gOExim Auth failed2025-04-07 05:12:07 dovecot_login authenticator failed for ([38.84.215.213]) [38.84.215.213]:50184: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)38.84.215.21362520014K a=+ ossec5710gAttempt to login using a non-existent userApr 7 05:09:01 vm1 sshd[1890929]: Invalid user informix from 121.131.192.214 port 52414121.131.192.2141835841-J CM+ ossec5716gSSHD authentication failed.Apr 7 05:08:53 vm1 sshd[1890914]: Failed password for root from 121.131.192.214 port 56142 ssh2121.131.192.2141835841cI E7+ ossec2501gUser authentication failure.Apr 7 05:08:51 vm1 sshd[1890914]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.131.192.214 user=root121.131.192.2141835841)H CI' ossec5716gSSHD authentication failed.Apr 7 05:04:40 vm1 sshd[1889921]: Failed password for root from 42.200.95.105 port 45522 ssh242.200.95.1051819730_G E3' ossec2501gUser authentication failure.Apr 7 05:04:38 vm1 sshd[1889921]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=42.200.95.105 user=root42.200.95.1051819730/F a7' ossec5710gAttempt to login using a non-existent userApr 7 05:04:49 vm1 sshd[1889999]: Invalid user Katashi from 42.200.95.105 port 4644842.200.95.1051819730ZE  -=+ ossec13001g Exim Auth failed2025-04-07 04:52:30 dovecot_login authenticator failed for ([125.140.244.144]) [125.140.244.144]:56676: 535 Incorrect authentication data (set_id=sales)125.140.244.1441835841gD  -[' ossec13001g Exim Auth failed2025-04-07 04:52:08 dovecot_login authenticator failed for ([121.154.90.47]) [121.154.90.47]:54734: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)121.154.90.471835841aC  -O) ossec13001g ~Exim Auth failed2025-04-07 04:51:34 dovecot_login authenticator failed for ([192.109.217.14]) [192.109.217.14]:39531: 535 Incorrect authentication data (set_id=vikas.khandelwal)192.109.217.14783754xB  -y+ ossec13001g tExim Auth failed2025-04-07 04:51:24 dovecot_login authenticator failed for ([178.216.165.187]) [178.216.165.187]:33430: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)178.216.165.1872017370iA  -[+ ossec13001g SExim Auth failed2025-04-07 04:46:34 dovecot_login authenticator failed for (x0HhcNwvLe) [183.165.226.136]:57625: 535 Incorrect authentication data (set_id=services@heipowersystem.com)183.165.226.1361814991 >1 C I o m#w $>be  -Q' ossec13001g'Exim Auth failed2025-04-07 06:48:49 dovecot_login authenticator failed for (MOHOCHw) [114.106.146.3]:54643: 535 Incorrect authentication data (set_id=services@heipowersystem.com)114.106.146.31814991ed  -U) ossec13001g'Exim Auth failed2025-04-07 06:47:47 dovecot_login authenticator failed for (yM6OMshU) [223.215.177.85]:58511: 535 Incorrect authentication data (set_id=services@heipowersystem.com)223.215.177.851814991:c  Ak) ossec11302g%FTP Authentication failed.Apr 7 06:40:14 vm1 pure-ftpd[1911264]: (?@44.220.185.253) [WARNING] Authentication failed for user [anonymous]44.220.185.2536252001(b  3U) ossec11301g%New FTP connection.Apr 7 06:40:08 vm1 pure-ftpd[1911264]: (?@44.220.185.253) [INFO] New connection from 44.220.185.25344.220.185.2536252001(a  3U) ossec11301g$New FTP connection.Apr 7 06:34:13 vm1 pure-ftpd[1909858]: (?@66.240.236.109) [INFO] New connection from 66.240.236.10966.240.236.1096252001a` -Q% ossec13001g$Exim Auth failed2025-04-07 06:31:52 dovecot_plain authenticator failed for static-185-95-84-70.sunucuhub.com [185.95.84.70]:55818: 535 Incorrect authentication data (set_id=info)185.95.84.702987958_  Ai' ossec11302g#FTP Authentication failed.Apr 7 06:31:32 vm1 pure-ftpd[1909372]: (?@94.102.49.155) [WARNING] Authentication failed for user [anonymous]94.102.49.1552750405%^  3Q' ossec11301g#New FTP connection.Apr 7 06:31:26 vm1 pure-ftpd[1909372]: (?@94.102.49.155) [INFO] New connection from 94.102.49.15594.102.49.1552750405"]  3M% ossec11301g#New FTP connection.Apr 7 06:30:39 vm1 pure-ftpd[1909262]: (?@80.82.77.202) [INFO] New connection from 80.82.77.20280.82.77.2022750405>\  -) ossec13001g"Exim Auth failed2025-04-07 06:26:19 dovecot_login authenticator failed for (KiYBrk) [114.103.89.123]:55231: 535 Incorrect authentication data114.103.89.1231814991f[ -U) ossec13001g!Exim Auth failed2025-04-07 06:22:52 dovecot_login authenticator failed for (Qu2rUPzD) [114.103.89.123]:61184: 535 Incorrect authentication data (set_id=services@heipowersystem.com)114.103.89.1231814991gZ -W) ossec13001g!Exim Auth failed2025-04-07 06:21:59 dovecot_login authenticator failed for (KsKeZVosC) [114.103.89.123]:51873: 535 Incorrect authentication data (set_id=services@heipowersystem.com)114.103.89.1231814991iY  -[+ ossec13001g!yExim Auth failed2025-04-07 06:21:04 dovecot_login authenticator failed for (pemusQzPXn) [183.165.225.233]:56070: 535 Incorrect authentication data (set_id=services@heipowersystem.com)183.165.225.2331814991TX  -5' ossec13001gBExim Auth failed2025-04-07 06:07:21 dovecot_login authenticator failed for ([134.56.58.169]) [134.56.58.169]:53482: 535 Incorrect authentication data (set_id=sales)134.56.58.1696252001VW  -9) ossec13001g6Exim Auth failed2025-04-07 06:07:09 dovecot_login authenticator failed for ([46.210.107.161]) [46.210.107.161]:55625: 535 Incorrect authentication data (set_id=sales)46.210.107.161294640vV  -w) ossec13001g,Exim Auth failed2025-04-07 06:07:00 dovecot_login authenticator failed for ool-4579c7cb.dyn.optonline.net [69.121.199.203]:43974: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)69.121.199.2036252001jU  -_) ossec13001g$Exim Auth failed2025-04-07 06:06:52 dovecot_login authenticator failed for ([103.79.175.122]) [103.79.175.122]:33618: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)103.79.175.1222077456dT  -U' ossec13001gExim Auth failed2025-04-07 06:00:55 dovecot_login authenticator failed for (lG7ljMQcx) [117.69.235.86]:49617: 535 Incorrect authentication data (set_id=services@heipowersystem.com)117.69.235.861814991cS  -S' ossec13001gExim Auth failed2025-04-07 06:00:29 dovecot_login authenticator failed for (0FcNHOjH) [117.69.235.86]:60034: 535 Incorrect authentication data (set_id=services@heipowersystem.com)117.69.235.861814991   vi\OB5(reXK>1$ {naTG:- wD7*~qdWJ=0# zm`SF9, v i \ O B 5 (     r e X K > 1 $  { n a T G : -   ^ w j ] P C 6 )    Q w k _ Sk F 9 , sfYL?2% |ocWK?3'ti^SH=23? 3703430O 3686110Oi 3686110OR 3686110O6 3686110O- 3895114O 3865483N 390903N 3686110M 3686110M 3686110M, 3658394K> 3686110@ 3686110@ 3686110> 3686110=E 3686110< 368611096 36861108 36861104 36861104D 36861104B 36861104 3686110/ 3686110/ 3686110.X 3686110-- 3686110+ 3686110* 3686110( 3686110' 3686110% 3686110% 3686110% 3686110# 3686110" 3686110" 3686110! 3686110!0 3686110! 3686110 3686110, 3686110 3686110 3686110 3686110 3686110 3686110 3686110  3686110 , 3686110 3686110} 3686110 3658394-y 3658394)$ 3658394' 3658394& 3658394$D 3658394" 3658394!I 3658394 3658394 3658394& 3658394 3658394 3658394 3658394I 3658394o 3658394 3658394 3625428HS 36254285, 3625428) 3625428%> 3625428#r 3625428 3625428 3625428 3625428 3625428 b 3923057 3923057 3923057 3923057 390903B 3909036 390903+ 390903( 390903 390903; 390903@ 3895114I 3895114=r 38951144a 3895114. 3895114, 3895114&u 3895114# 3895114 6 3895114 3895114 3895114 3895114[ 3895114 3895114> 3895114 3895114J 3895114 3895114 3895114 38951144 3895114 3895114 3895114 3895114 3895114 3895114 . 3865483I 3865483A 3865483@6 3865483? 38654839 386548392 38654838; 38654836 38654835 38654834 38654833 38654831 38654830 3865483/ 3865483. 3865483.R 3865483-x 3865483, 3865483,/ 3865483* 3865483* 3865483)Q 3865483' 3865483' 3865483#] 3865483#> 3865483" 3865483 n 3865483 i 3865483 3865483 3865483{ 3865483 3865483| 3865483D 3865483. 3865483 3865483K 3865483G 3865483 3865483 3865483" 3865483 3865483F 3865483 3865483q 3865483+ 3865483! 3865483 3865483 3865483w 3865483 3865483 3865483o 3865483 3865483 3865483 3865483 3865483F 3865483- 3865483 3865483 3865483 3865483 3865483 3865483 J 3865483 3865483 3865483 x 3865483 n 3865483 8 3865483 3703430I 3703430G 3703430= 3703430: 37034301 3703430/ 3703430- 3703430) 3703430! 3703430/ 3703430| 3703430B 3703430 3703430 3703430q 3703430 3703430 3703430  3703430 3703430 A 3703430Z 3703430 3686110Ij 3686110H% 3686110C 3686110C5 3686110B / E ' n{mu  -c+ ossec13001g9Exim Auth failed2025-04-07 08:03:51 dovecot_login authenticator failed for ([178.178.194.123]) [178.178.194.123]:52600: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)178.178.194.1232017370ot  -m% ossec13001g4Exim Auth failed2025-04-07 07:43:03 dovecot_login authenticator failed for ([218.147.6.84]) [218.147.6.84]:43348: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)218.147.6.841835841(s  3U) ossec11301g+ New FTP connection.Apr 7 07:01:55 vm1 pure-ftpd[1916074]: (?@198.235.24.239) [INFO] New connection from 198.235.24.239198.235.24.2396252001(r  3U) ossec11301g*New FTP connection.Apr 7 07:00:26 vm1 pure-ftpd[1915813]: (?@35.205.178.152) [INFO] New connection from 35.205.178.15235.205.178.1522802361 rejected RCPT : Rejected relay attempt: '165.154.210.52' From: 'hiwkjjrwyf@msnews24.in' To: 'validxxx@gmailhotmail.com.br'165.154.210.521694008hp  -Y+ ossec13001g)cExim Auth failed2025-04-07 06:54:51 dovecot_login authenticator failed for (298CGVZ0X) [114.106.147.246]:56866: 535 Incorrect authentication data (set_id=services@heipowersystem.com)114.106.147.2461814991jo -[+ ossec13001g)-Exim Auth failed2025-04-07 06:53:57 dovecot_login authenticator failed for (0okHo4sQpF) [114.106.147.246]:61124: 535 Incorrect authentication data (set_id=services@heipowersystem.com)114.106.147.2461814991fn  -U+ ossec13001g)Exim Auth failed2025-04-07 06:53:42 dovecot_login authenticator failed for (SagaCnQ) [114.106.147.246]:57974: 535 Incorrect authentication data (set_id=services@heipowersystem.com)114.106.147.24618149917m  =k' ossec13008g) Mail Reciepient rejected2025-04-07 06:53:25 H=(mail.msnews24.in) [45.197.14.175]:58505 F= rejected RCPT : Rejected relay attempt: '45.197.14.175' From: 'mhqjjkdif@msnews24.in' To: 'validxxx@gmailhotmail.com.br'45.197.14.1756252001fl -S+ ossec13001g(Exim Auth failed2025-04-07 06:52:15 dovecot_login authenticator failed for (Hf2hEb) [183.165.224.209]:59268: 535 Incorrect authentication data (set_id=services@heipowersystem.com)183.165.224.2091814991k  W' ossec9708g(Dovecot Aborted Login with empty userApr 7 06:51:23 vm1 dovecot[1526]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=45.156.128.64, lip=103.74.54.108, TLS, session=45.156.128.642264397j W' ossec9708g(Dovecot Aborted Login with empty userApr 7 06:51:22 vm1 dovecot[1526]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=45.156.128.62, lip=103.74.54.108, session=45.156.128.622264397i  W' ossec9708g(Dovecot Aborted Login with empty userApr 7 06:51:28 vm1 dovecot[1526]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=45.156.128.63, lip=103.74.54.108, TLS, session=45.156.128.632264397fh  -U+ ossec13001g(Exim Auth failed2025-04-07 06:51:28 dovecot_login authenticator failed for (4hmECcI) [183.165.224.209]:62285: 535 Incorrect authentication data (set_id=services@heipowersystem.com)183.165.224.2091814991eg  -W' ossec13001g(?Exim Auth failed2025-04-07 06:49:59 dovecot_login authenticator failed for (oSyRB6IDlP) [114.106.146.3]:52804: 535 Incorrect authentication data (set_id=services@heipowersystem.com)114.106.146.31814991df -S' ossec13001g(Exim Auth failed2025-04-07 06:49:02 dovecot_login authenticator failed for (awLa4WjG) [114.106.146.3]:57159: 535 Incorrect authentication data (set_id=services@heipowersystem.com)114.106.146.31814991 "K K U d .  -'+ ossec13001gMExim Auth failed2025-04-07 09:30:21 dovecot_plain authenticator failed for 243.246.153.160.host.secureserver.net (WS16-YATV) [160.153.246.243]:51176: 535 Incorrect authentication data (set_id=info@westerndancecompany.com)160.153.246.2436252001  -'+ ossec13001gMExim Auth failed2025-04-07 09:29:07 dovecot_plain authenticator failed for 243.246.153.160.host.secureserver.net (WS16-YATV) [160.153.246.243]:54693: 535 Incorrect authentication data (set_id=info@westerndancecompany.com)160.153.246.2436252001  -'+ ossec13001gM?Exim Auth failed2025-04-07 09:27:51 dovecot_plain authenticator failed for 243.246.153.160.host.secureserver.net (WS16-YATV) [160.153.246.243]:60125: 535 Incorrect authentication data (set_id=info@westerndancecompany.com)160.153.246.2436252001+  3Y+ ossec11301gLNew FTP connection.Apr 7 09:25:07 vm1 pure-ftpd[1947966]: (?@162.142.125.127) [INFO] New connection from 162.142.125.127162.142.125.1276252001i  -]) ossec13001gIExim Auth failed2025-04-07 09:12:06 dovecot_login authenticator failed for syn-024-104-225-201.res.spectrum.com [24.104.225.201]:53453: 535 Incorrect authentication data (set_id=sales)24.104.225.2016252001  -) ossec13001gI~Exim Auth failed2025-04-07 09:11:49 dovecot_login authenticator failed for pool-108-18-206-153.washdc.fios.verizon.net [108.18.206.153]:52251: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)108.18.206.1536252001T  -5' ossec13001gFExim Auth failed2025-04-07 08:59:25 dovecot_login authenticator failed for ([83.136.176.12]) [83.136.176.12]:25456: 535 Incorrect authentication data (set_id=sales)83.136.176.122510769d~  -Q+ ossec13001gFExim Auth failed2025-04-07 08:59:20 dovecot_login authenticator failed for 132.sub-166-161-200.myvzw.com [166.161.200.132]:42931: 535 Incorrect authentication data (set_id=sales)166.161.200.1326252001m}  -c+ ossec13001gFExim Auth failed2025-04-07 08:59:14 dovecot_login authenticator failed for ([122.225.203.106]) [122.225.203.106]:21692: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)122.225.203.1061814991~|  -) ossec13001gFExim Auth failed2025-04-07 08:59:07 dovecot_login authenticator failed for (163.pool90-160-139.dynamic.orange.es) [90.160.139.163]:39662: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)90.160.139.1632510769\{  -C) ossec13001gD'Exim Auth failed2025-04-07 08:49:02 dovecot_login authenticator failed for emerald.da.hostns.io [91.204.209.203]:58542: 535 Incorrect authentication data (set_id=services)91.204.209.2032635167mz  -e) ossec13001gDExim Auth failed2025-04-07 08:48:51 dovecot_login authenticator failed for ([211.216.193.28]) [211.216.193.28]:48490: 535 Incorrect authentication data (set_id=services@heipowersystem.com)211.216.193.281835841ry  -o) ossec13001g:Exim Auth failed2025-04-07 08:07:50 dovecot_login authenticator failed for (unknown.bwdc.fsg.ordnance.co) [103.79.174.147]:44555: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)103.79.174.1472077456|x  -+ ossec13001g:pExim Auth failed2025-04-07 08:07:36 dovecot_login authenticator failed for ([194.226.155.198]) [194.226.155.198]:52630: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)194.226.155.1982017370Sw  -7# ossec13001g:fExim Auth failed2025-04-07 08:07:26 dovecot_login authenticator failed for d-72-28-237-9.sc.cpe.atlanticbb.net [72.28.237.9]:40327: 535 Incorrect authentication data72.28.237.96252001Zv  -=+ ossec13001g9Exim Auth failed2025-04-07 08:04:09 dovecot_login authenticator failed for ([181.233.140.250]) [181.233.140.250]:51031: 535 Incorrect authentication data (set_id=sales)181.233.140.2503469034 \ J (;+Hf\. a5' ossec5710gm`Attempt to login using a non-existent userApr 7 11:44:54 vm1 sshd[1979556]: Invalid user bbbian from 185.4.146.169 port 41450185.4.146.1692017370(  CI' ossec5716gmRSSHD authentication failed.Apr 7 11:44:40 vm1 sshd[1979503]: Failed password for root from 185.4.146.169 port 41510 ssh2185.4.146.1692017370(  CI' ossec5716gm@SSHD authentication failed.Apr 7 11:44:22 vm1 sshd[1979429]: Failed password for root from 185.4.146.169 port 36936 ssh2185.4.146.1692017370^  E3' ossec2501gm>User authentication failure.Apr 7 11:44:21 vm1 sshd[1979429]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.4.146.169 user=root185.4.146.1692017370(  3U) ossec11301giNew FTP connection.Apr 7 11:28:47 vm1 pure-ftpd[1975969]: (?@194.165.16.166) [INFO] New connection from 194.165.16.166194.165.16.16629934573  =c' ossec13008ghMail Reciepient rejected2025-04-07 11:25:59 H=(mail.msnews24.in) [45.197.14.175]:52642 F= rejected RCPT : Rejected relay attempt: '45.197.14.175' From: 'puwzxoa@msnews24.in' To: 'validxxx@gmailhotmail.com.br'45.197.14.1756252001   -#) ossec13001gbExim Auth failed2025-04-07 10:59:40 dovecot_login authenticator failed for 57-132-150-162.dyn.grandenetworks.net [57.132.150.162]:58260: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)57.132.150.1626252001i  -[+ ossec13001gbExim Auth failed2025-04-07 10:59:53 dovecot_login authenticator failed for ([163.179.102.182]) [163.179.102.182]:40427: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)163.179.102.1821814991c  -Q) ossec13001gbExim Auth failed2025-04-07 10:56:52 dovecot_login authenticator failed for (unknown.bwdc.fsg.ordnance.co) [103.79.174.147]:42782: 535 Incorrect authentication data (set_id=sales)103.79.174.1472077456k  -c' ossec13001gaExim Auth failed2025-04-07 10:56:22 dovecot_login authenticator failed for (hosted-by-soltia.es) [91.126.81.113]:46860: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)91.126.81.1132510769l  -i# ossec13001g]!Exim Auth failed2025-04-07 10:35:37 dovecot_login authenticator failed for (6.41.43.103.cust-fiber.enegan.it) [103.43.41.6]:34470: 535 Incorrect authentication data (set_id=vikas.khandelwal)103.43.41.63175395x  -y+ ossec13001g]Exim Auth failed2025-04-07 10:35:23 dovecot_login authenticator failed for ([218.149.235.152]) [218.149.235.152]:34804: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)218.149.235.1521835841*  3Y+ ossec11301gZNew FTP connection.Apr 7 10:25:07 vm1 pure-ftpd[1961583]: (?@185.247.137.140) [INFO] New connection from 185.247.137.140185.247.137.140298795. a5' ossec5710gUAttempt to login using a non-existent userApr 7 10:04:06 vm1 sshd[1956774]: Invalid user liyabo from 67.43.209.150 port 4118267.43.209.1506252001) CI' ossec5716gUSSHD authentication failed.Apr 7 10:03:35 vm1 sshd[1956640]: Failed password for root from 67.43.209.150 port 39352 ssh267.43.209.1506252001_ E3' ossec2501gUUser authentication failure.Apr 7 10:03:33 vm1 sshd[1956640]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=67.43.209.150 user=root67.43.209.1506252001  -'+ ossec13001gNExim Auth failed2025-04-07 09:33:34 dovecot_plain authenticator failed for 243.246.153.160.host.secureserver.net (WS16-YATV) [160.153.246.243]:61702: 535 Incorrect authentication data (set_id=info@westerndancecompany.com)160.153.246.2436252001  -'+ ossec13001gN7Exim Auth failed2025-04-07 09:31:58 dovecot_plain authenticator failed for 243.246.153.160.host.secureserver.net (WS16-YATV) [160.153.246.243]:65201: 535 Incorrect authentication data (set_id=info@westerndancecompany.com)160.153.246.2436252001 u O B 5 (     r e X K > 1 $  { n a T G : -   w j ] P C 6 )    s f Y L ? 2 %  |obUH;.!xk^QD7*tgZM@3& u}pcVI</"yl_RE8_RE8+h[NA4' ~qdWJ=05200625_RE8+h[NA4' ~qdWJ=05200625 6252001d 6252001` 6252001Y 6252001W 6252001R 6252001P 6252001I 62520012 62520011 \ 6252001! 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001~ 6252001q 6252001p 6252001m 6252001/ 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001v 6252001q 6252001[ 6252001M 6252001< 6252001; 6252001! 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001x 6252001d 6252001U 6252001S 6252001Q 6252001J 6252001I 6252001F 6252001? 6252001< 6252001- 6252001+ 6252001! 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 ~ 6252001 t 6252001 r 6252001 n 6252001 c 6252001 b 6252001 \ 6252001 G 6252001 @ 6252001 0 6252001 * 6252001 ( 6252001 ' 6252001 % 6252001 $ 6252001 # 6252001 " 6252001  6252001  6252001  6252001  6252001 6252001  6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 ~ 6252001 x 6252001 w 6252001 r 6252001 f 6252001 a 6252001 Q 6252001 H 6252001 B 6252001 @ 6252001 0 6252001 - 6252001 6252001  6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001 6252001  6252001 t 6252001 r 6252001 o 6252001 g 2 5 ] 8D( ac% ossec5710gAttempt to login using a non-existent userApr 7 13:06:39 vm1 sshd[1997761]: Failed password for invalid user zheng from 117.61.14.73 port 25598 ssh2117.61.14.731814991*'  a1% ossec5710gAttempt to login using a non-existent userApr 7 13:06:37 vm1 sshd[1997761]: Invalid user zheng from 117.61.14.73 port 25598117.61.14.731814991&&  CG% ossec5716gwSSHD authentication failed.Apr 7 13:06:22 vm1 sshd[1997643]: Failed password for root from 117.61.14.73 port 25595 ssh2117.61.14.731814991]% E1% ossec2501guUser authentication failure.Apr 7 13:06:20 vm1 sshd[1997643]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=117.61.14.73 user=root117.61.14.731814991Z$ -A% ossec13001gcExim Auth failed2025-04-07 13:06:02 dovecot_login authenticator failed for (VhKNTB) [117.57.74.44]:52726: 535 Incorrect authentication data (set_id=hr@heipowersystem.com)117.57.74.441814991# Q) ossec11000g]Login failed on the cpanel service[2025-04-07 13:01:39 +0530] info [cpaneld] 85.239.246.139 - heipowersystem "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipowersystem (has_cpuser_file failed)85.239.246.1396252001A"  ={+ ossec13008g~jMail Reciepient rejected2025-04-07 12:57:37 H=(mail.msnews24.in) [165.154.232.243]:63960 F= rejected RCPT : Rejected relay attempt: '165.154.232.243' From: 'tfawxyupgyx@msnews24.in' To: 'validxxx@gmailhotmail.com.br'165.154.232.2431605651=! -' ossec13001g|Exim Auth failed2025-04-07 12:49:33 dovecot_login authenticator failed for (jGnkA9) [117.69.235.15]:62137: 535 Incorrect authentication data117.69.235.151814991^  -I' ossec13001g{Exim Auth failed2025-04-07 12:46:42 dovecot_login authenticator failed for (xMMZZflho) [117.69.235.15]:59889: 535 Incorrect authentication data (set_id=hr@heipowersystem.com)117.69.235.151814991] -E' ossec13001g{Exim Auth failed2025-04-07 12:46:21 dovecot_login authenticator failed for (y1isNUm) [117.69.235.15]:53023: 535 Incorrect authentication data (set_id=hr@heipowersystem.com)117.69.235.151814991  W) ossec9708gyDovecot Aborted Login with empty userApr 7 12:37:19 vm1 dovecot[1526]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=87.236.176.151, lip=103.74.54.108, TLS, session=87.236.176.1512635167\ -E% ossec13001gxiExim Auth failed2025-04-07 12:31:59 dovecot_login authenticator failed for (amplifypowerglobal.com) [150.5.145.36]:60560: 535 Incorrect authentication data (set_id=nologin)150.5.145.361880251V  -9) ossec13001gnExim Auth failed2025-04-07 11:51:13 dovecot_login authenticator failed for ([94.204.208.158]) [94.204.208.158]:42150: 535 Incorrect authentication data (set_id=sales)94.204.208.158290557T  -5' ossec13001gnExim Auth failed2025-04-07 11:51:12 dovecot_login authenticator failed for ([117.32.102.90]) [117.32.102.90]:28030: 535 Incorrect authentication data (set_id=sales)117.32.102.901814991y  -' ossec13001gnExim Auth failed2025-04-07 11:51:02 dovecot_login authenticator failed for c-98-220-97-188.hsd1.il.comcast.net [98.220.97.188]:59594: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)98.220.97.1886252001g  -[' ossec13001gnExim Auth failed2025-04-07 11:50:58 dovecot_login authenticator failed for ([94.102.51.218]) [94.102.51.218]:42248: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)94.102.51.2182750405_ E3' ossec2501gmPUser authentication failure.Apr 7 11:44:38 vm1 sshd[1979503]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.4.146.169 user=root185.4.146.1692017370 !L i  & 0 35JeeQ9  -1% ossec13001g;Exim Auth failed2025-04-07 13:48:03 dovecot_login authenticator failed for ([49.124.151.9]) [49.124.151.9]:37848: 535 Incorrect authentication data (set_id=sales)49.124.151.91733045|8  -' ossec13001g1Exim Auth failed2025-04-07 13:47:52 dovecot_login authenticator failed for 6.112.255.173.bc.googleusercontent.com [173.255.112.6]:41722: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)173.255.112.66252001a7 -K) ossec13001gExim Auth failed2025-04-07 13:36:52 dovecot_login authenticator failed for (ljeMlaKxh) [183.164.240.46]:56135: 535 Incorrect authentication data (set_id=hr@heipowersystem.com)183.164.240.461814991g6  -W+ ossec13001gqExim Auth failed2025-04-07 13:36:09 dovecot_login authenticator failed for (dynamic-ip-adsl.metfone.com.kh) [175.100.107.238]:36884: 535 Incorrect authentication data (set_id=sales)175.100.107.2381831722z5  -) ossec13001giExim Auth failed2025-04-07 13:36:00 dovecot_login authenticator failed for 198-91-129-195.cpe.distributel.net [198.91.129.195]:37614: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)198.91.129.1956251999^4  -G) ossec13001gYExim Auth failed2025-04-07 13:35:43 dovecot_login authenticator failed for (g0uYKL2) [183.164.240.46]:53018: 535 Incorrect authentication data (set_id=hr@heipowersystem.com)183.164.240.461814991r3  -s% ossec13001gTExim Auth failed2025-04-07 13:27:08 dovecot_login authenticator failed for broadband-5-228-11-207.ip.moscow.rt.ru [5.228.11.207]:49574: 535 Incorrect authentication data (set_id=vikas.khandelwal)5.228.11.20720173702  -+ ossec13001gLExim Auth failed2025-04-07 13:26:59 dovecot_login authenticator failed for (192.102.156.175.unknown.m1.com.sg) [175.156.102.192]:48143: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)175.156.102.19218802511 Q) ossec11000gLogin failed on the cpanel service[2025-04-07 13:25:10 +0530] info [cpaneld] 85.239.246.139 - heipowersystem "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipowersystem (has_cpuser_file failed)85.239.246.1396252001r0  -q' ossec13001gExim Auth failed2025-04-07 13:15:41 dovecot_login authenticator failed for (amplifypowerglobal.com) [221.229.216.1]:46092: 535 Incorrect authentication data (set_id=admin@amplifypowerglobal.com)221.229.216.11814991]/  -G' ossec13001gExim Auth failed2025-04-07 13:15:15 dovecot_login authenticator failed for (amplifypowerglobal.com) [221.229.216.1]:42268: 535 Incorrect authentication data (set_id=nologin)221.229.216.11814991=. -' ossec13001gExim Auth failed2025-04-07 13:11:20 dovecot_login authenticator failed for (nz5g9F) [117.57.75.167]:52968: 535 Incorrect authentication data117.57.75.1671814991<-  -% ossec13001gAExim Auth failed2025-04-07 13:09:44 dovecot_login authenticator failed for (cawAkt21) [117.57.74.44]:50039: 535 Incorrect authentication data117.57.74.441814991], -E' ossec13001gExim Auth failed2025-04-07 13:07:40 dovecot_login authenticator failed for (h04xJrW) [117.57.75.167]:52994: 535 Incorrect authentication data (set_id=hr@heipowersystem.com)117.57.75.1671814991_+  -K' ossec13001gExim Auth failed2025-04-07 13:07:31 dovecot_login authenticator failed for (QGawSlK4mb) [117.57.75.167]:65141: 535 Incorrect authentication data (set_id=hr@heipowersystem.com)117.57.75.1671814991Q*  E% ossec2501gUser authentication failure.Apr 7 13:06:59 vm1 sshd[1997921]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=117.61.14.73117.61.14.731814991[)  -E% ossec13001gExim Auth failed2025-04-07 13:06:51 dovecot_login authenticator failed for (9zw3WW91) [117.57.74.44]:51544: 535 Incorrect authentication data (set_id=hr@heipowersystem.com)117.57.74.441814991 P w RMjP0K a9' ossec5710g.Attempt to login using a non-existent userApr 7 16:00:05 vm1 sshd[2036302]: Invalid user padmapati from 220.180.76.50 port 1139220.180.76.501814991TJ E' ossec2501g.User authentication failure.Apr 7 16:00:06 vm1 sshd[2036302]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=220.180.76.50220.180.76.501814991(I  CI' ossec5716g SSHD authentication failed.Apr 7 15:59:31 vm1 sshd[2035984]: Failed password for root from 220.180.76.50 port 64063 ssh2220.180.76.501814991^H  E3' ossec2501g User authentication failure.Apr 7 15:59:29 vm1 sshd[2035984]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=220.180.76.50 user=root220.180.76.501814991_G E3' ossec2501g=User authentication failure.Apr 7 15:47:31 vm1 sshd[2033475]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.61.35.134 user=root106.61.35.1341814991(F  CI' ossec5716g=SSHD authentication failed.Apr 7 15:47:33 vm1 sshd[2033475]: Failed password for root from 106.61.35.134 port 31286 ssh2106.61.35.1341814991,E a1' ossec5710gIAttempt to login using a non-existent userApr 7 15:47:44 vm1 sshd[2033507]: Invalid user data from 106.61.35.134 port 31392106.61.35.1341814991%D  3Q' ossec11301gNew FTP connection.Apr 7 15:12:04 vm1 pure-ftpd[2025829]: (?@20.168.121.95) [INFO] New connection from 20.168.121.9520.168.121.956252001%C  3Q' ossec11301giNew FTP connection.Apr 7 15:09:51 vm1 pure-ftpd[2025205]: (?@172.210.15.93) [INFO] New connection from 172.210.15.93172.210.15.936252001xB  -y+ ossec13001gExim Auth failed2025-04-07 14:42:18 dovecot_login authenticator failed for 203.141.134.110.static.zoot.jp [203.141.134.110]:61457: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)203.141.134.1101861060eA  -[' ossec13001gExim Auth failed2025-04-07 14:42:14 dovecot_login authenticator failed for ([65.20.138.138]) [65.20.138.138]:38498: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)65.20.138.13899237T@  -5' ossec13001gExim Auth failed2025-04-07 14:42:29 dovecot_login authenticator failed for ([195.158.26.59]) [195.158.26.59]:54294: 535 Incorrect authentication data (set_id=sales)195.158.26.591512440f?  -Y' ossec13001gExim Auth failed2025-04-07 14:42:24 dovecot_login authenticator failed for pub-62-171-44-219.dh-lwl.datazug.ch [62.171.44.219]:52274: 535 Incorrect authentication data (set_id=sales)62.171.44.2192658434Q>  -3# ossec13001gExim Auth failed2025-04-07 14:32:15 dovecot_login authenticator failed for ([206.0.8.204]) [206.0.8.204]:39500: 535 Incorrect authentication data (set_id=services)206.0.8.2043469034=  -% ossec13001gExim Auth failed2025-04-07 14:32:02 dovecot_login authenticator failed for (95x79x57x221.static-business.nn.ertelecom.ru) [95.79.57.221]:54864: 535 Incorrect authentication data (set_id=services@heipowersystem.com)95.79.57.2212017370><  =w) ossec13008gMail Reciepient rejected2025-04-07 14:10:49 H=(mail.msnews24.in) [165.154.210.99]:54614 F= rejected RCPT : Rejected relay attempt: '165.154.210.99' From: 'jxbblpthrms@msnews24.in' To: 'validxxx@gmailhotmail.com.br'165.154.210.991694008;;  =s' ossec13008g Mail Reciepient rejected2025-04-07 14:04:18 H=(mail.msnews24.in) [45.197.14.138]:55631 F= rejected RCPT : Rejected relay attempt: '45.197.14.138' From: 'sfzimqbfwzz@msnews24.in' To: 'validxxx@gmailhotmail.com.br'45.197.14.1386252001{:  -) ossec13001gExim Auth failed2025-04-07 13:51:00 dovecot_login authenticator failed for emerald.da.hostns.io [91.204.209.203]:56970: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)91.204.209.2032635167 ]'  (Jl ])]  CK) ossec5716gSSHD authentication failed.Apr 7 18:32:57 vm1 sshd[2070216]: Failed password for root from 105.245.28.126 port 13806 ssh2105.245.28.126953987`\ E5) ossec2501gUser authentication failure.Apr 7 18:32:55 vm1 sshd[2070216]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=105.245.28.126 user=root105.245.28.126953987W[  -9) ossec13001g Exim Auth failed2025-04-07 17:58:58 dovecot_login authenticator failed for ([119.195.77.177]) [119.195.77.177]:60039: 535 Incorrect authentication data (set_id=sales)119.195.77.1771835841zZ  -' ossec13001gExim Auth failed2025-04-07 17:58:38 dovecot_login authenticator failed for syn-097-089-202-226.biz.spectrum.com [97.89.202.226]:34720: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)97.89.202.2266252001OY  -1% ossec13001gTExim Auth failed2025-04-07 17:34:35 dovecot_login authenticator failed for ([65.20.174.63]) [65.20.174.63]:39012: 535 Incorrect authentication data (set_id=sales)65.20.174.6399237iX  -]) ossec13001gDExim Auth failed2025-04-07 17:34:19 dovecot_login authenticator failed for ([120.55.170.138]) [116.30.140.227]:8569: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)116.30.140.2271814991aW  -S# ossec13001g>Exim Auth failed2025-04-07 17:34:14 dovecot_login authenticator failed for ([27.71.26.64]) [27.71.26.64]:19291: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)27.71.26.641562822ZV  -=+ ossec13001gZExim Auth failed2025-04-07 17:34:41 dovecot_login authenticator failed for ([170.238.144.233]) [170.238.144.233]:50890: 535 Incorrect authentication data (set_id=sales)170.238.144.2333469034ZU  -?) ossec13001gExim Auth failed2025-04-07 17:24:00 dovecot_login authenticator failed for ([195.122.224.64]) [195.122.224.64]:50072: 535 Incorrect authentication data (set_id=services)195.122.224.642017370jT  -a' ossec13001gExim Auth failed2025-04-07 17:23:47 dovecot_login authenticator failed for ([124.167.20.66]) [124.167.20.66]:56348: 535 Incorrect authentication data (set_id=services@heipowersystem.com)124.167.20.661814991iS  -[+ ossec13001gOExim Auth failed2025-04-07 16:43:19 dovecot_login authenticator failed for ([220.189.235.126]) [220.189.235.126]:46370: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)220.189.235.1261814991vR  -y' ossec13001g?Exim Auth failed2025-04-07 16:43:02 dovecot_login authenticator failed for ([61.169.31.242]) [61.169.31.242]:63927: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)61.169.31.2421814991WQ  -9) ossec13001gsExim Auth failed2025-04-07 16:39:37 dovecot_login authenticator failed for ([178.178.222.47]) [178.178.222.47]:50106: 535 Incorrect authentication data (set_id=sales)178.178.222.472017370jP  -_) ossec13001gcExim Auth failed2025-04-07 16:39:21 dovecot_login authenticator failed for ([223.100.15.126]) [223.100.15.126]:47261: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)223.100.15.12618149916O  Ag% ossec11302g FTP Authentication failed.Apr 7 16:33:37 vm1 pure-ftpd[2043439]: (?@35.187.65.14) [WARNING] Authentication failed for user [anonymous]35.187.65.142802361#N 3M% ossec11301gNew FTP connection.Apr 7 16:33:31 vm1 pure-ftpd[2043437]: (?@35.187.65.14) [INFO] New connection from 35.187.65.1435.187.65.142802361eM  -S+ ossec13001gExim Auth failed2025-04-07 16:18:56 dovecot_login authenticator failed for ([103.230.176.152]) [103.230.176.152]:46704: 535 Incorrect authentication data (set_id=vikas.khandelwal)103.230.176.1521269750lL  -i# ossec13001g}Exim Auth failed2025-04-07 16:18:29 dovecot_login authenticator failed for ([46.44.5.135]) [46.44.5.135]:53928: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)46.44.5.1352017370 Mq / _ CoJgLp  -)% ossec13001gExim Auth failed2025-04-07 19:06:49 dovecot_login authenticator failed for (localhost) [81.30.107.40]:10036: 535 Incorrect authentication data (set_id=hisago)81.30.107.40130758_o -I' ossec13001g&Exim Auth failed2025-04-07 19:07:41 dovecot_login authenticator failed for (1POnrzfb8) [117.57.75.219]:52727: 535 Incorrect authentication data (set_id=hr@heipowersystem.com)117.57.75.2191814991On  --' ossec13001gExim Auth failed2025-04-07 19:06:24 dovecot_login authenticator failed for (localhost) [81.30.107.104]:11562: 535 Incorrect authentication data (set_id=upgrade)81.30.107.104130758Im  -#% ossec13001gExim Auth failed2025-04-07 19:05:58 dovecot_login authenticator failed for (localhost) [81.30.107.40]:26042: 535 Incorrect authentication data (set_id=lay)81.30.107.40130758]l -E' ossec13001gԼExim Auth failed2025-04-07 19:05:55 dovecot_login authenticator failed for (FwwUXWa) [117.57.74.141]:54916: 535 Incorrect authentication data (set_id=hr@heipowersystem.com)117.57.74.1411814991Qk  -1' ossec13001gԤExim Auth failed2025-04-07 19:05:31 dovecot_login authenticator failed for (localhost) [81.30.107.125]:51850: 535 Incorrect authentication data (set_id=masaharu1)81.30.107.125130758Kj  -'% ossec13001gԎExim Auth failed2025-04-07 19:05:08 dovecot_login authenticator failed for (localhost) [81.30.107.40]:42072: 535 Incorrect authentication data (set_id=kolea)81.30.107.40130758Pi  -/' ossec13001gԨExim Auth failed2025-04-07 19:05:35 dovecot_login authenticator failed for (localhost) [81.30.107.104]:27558: 535 Incorrect authentication data (set_id=opendoor)81.30.107.104130758Oh  --' ossec13001gmExim Auth failed2025-04-07 19:04:36 dovecot_login authenticator failed for (localhost) [81.30.107.104]:43222: 535 Incorrect authentication data (set_id=siemens)81.30.107.104130758Kg  -%' ossec13001gmExim Auth failed2025-04-07 19:04:37 dovecot_login authenticator failed for (localhost) [81.30.107.125]:2964: 535 Incorrect authentication data (set_id=debi)81.30.107.125130758Mf  -+% ossec13001gRExim Auth failed2025-04-07 19:04:09 dovecot_login authenticator failed for (localhost) [81.30.107.40]:57906: 535 Incorrect authentication data (set_id=mailer1)81.30.107.40130758%e  3Q' ossec11301gNew FTP connection.Apr 7 19:03:01 vm1 pure-ftpd[2076906]: (?@20.163.14.131) [INFO] New connection from 20.163.14.13120.163.14.1316252001Ld -%' ossec13001gExim Auth failed2025-04-07 19:02:53 dovecot_login authenticator failed for (localhost) [81.30.107.125]:34308: 535 Incorrect authentication data (set_id=sas)81.30.107.125130758Mc  -)' ossec13001gExim Auth failed2025-04-07 19:02:03 dovecot_login authenticator failed for (localhost) [81.30.107.125]:50212: 535 Incorrect authentication data (set_id=yohan)81.30.107.125130758Jb  -#' ossec13001gExim Auth failed2025-04-07 19:02:30 dovecot_login authenticator failed for (localhost) [81.30.107.130]:47228: 535 Incorrect authentication data (set_id=rv)81.30.107.130130758Na -)' ossec13001gӋExim Auth failed2025-04-07 19:00:50 dovecot_login authenticator failed for (localhost) [81.30.107.130]:14784: 535 Incorrect authentication data (set_id=igota)81.30.107.130130758M` -'' ossec13001gExim Auth failed2025-04-07 18:58:51 dovecot_login authenticator failed for (localhost) [81.30.107.130]:46872: 535 Incorrect authentication data (set_id=gris)81.30.107.130130758X_ -=% ossec13001gϤExim Auth failed2025-04-07 18:44:12 dovecot_login authenticator failed for (heipowersystem.com) [119.96.131.8]:46832: 535 Incorrect authentication data (set_id=nologin)119.96.131.81814991/^ a7) ossec5710gAttempt to login using a non-existent userApr 7 18:33:13 vm1 sshd[2070253]: Invalid user dirsrv from 105.245.28.126 port 16404105.245.28.126953987 10_ } 5 `-(du1K  -%' ossec13001g@Exim Auth failed2025-04-07 19:12:24 dovecot_login authenticator failed for (localhost) [81.30.107.153]:24622: 535 Incorrect authentication data (set_id=mii)81.30.107.153130758L  -)% ossec13001g6Exim Auth failed2025-04-07 19:12:13 dovecot_login authenticator failed for (localhost) [81.30.107.90]:57786: 535 Incorrect authentication data (set_id=zabbix)81.30.107.90130758O  --' ossec13001g Exim Auth failed2025-04-07 19:11:30 dovecot_login authenticator failed for (localhost) [81.30.107.153]:40448: 535 Incorrect authentication data (set_id=anatoly)81.30.107.153130758N  --% ossec13001gExim Auth failed2025-04-07 19:11:21 dovecot_login authenticator failed for (localhost) [81.30.107.90]:9760: 535 Incorrect authentication data (set_id=yukiyoshi)81.30.107.90130758k  -c' ossec13001gExim Auth failed2025-04-07 19:11:03 dovecot_login authenticator failed for p5df1e80e.dip0.t-ipconnect.de [93.241.232.14]:36695: 535 Incorrect authentication data (set_id=vikas.khandelwal)93.241.232.142921044@~ - ' ossec13001gExim Auth failed2025-04-07 19:11:02 dovecot_login authenticator failed for (EqHxyHTxl) [117.57.75.219]:64053: 535 Incorrect authentication data117.57.75.2191814991}  -' ossec13001gExim Auth failed2025-04-07 19:10:51 dovecot_login authenticator failed for 125-229-56-26.hinet-ip.hinet.net [125.229.56.26]:41114: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)125.229.56.261668284M|  -+% ossec13001gExim Auth failed2025-04-07 19:10:36 dovecot_login authenticator failed for (localhost) [81.30.107.90]:57136: 535 Incorrect authentication data (set_id=yagioka)81.30.107.90130758N{ -)' ossec13001gլExim Auth failed2025-04-07 19:09:55 dovecot_login authenticator failed for (localhost) [81.30.107.153]:8110: 535 Incorrect authentication data (set_id=shungo)81.30.107.153130758Kz -%% ossec13001gզExim Auth failed2025-04-07 19:09:50 dovecot_login authenticator failed for (localhost) [81.30.107.70]:28444: 535 Incorrect authentication data (set_id=nsql)81.30.107.70130758=y -' ossec13001gՖExim Auth failed2025-04-07 19:09:32 dovecot_login authenticator failed for (GOc0lb) [117.57.74.141]:50889: 535 Incorrect authentication data117.57.74.1411814991Qx  -1' ossec13001gzExim Auth failed2025-04-07 19:09:04 dovecot_login authenticator failed for (localhost) [81.30.107.153]:23944: 535 Incorrect authentication data (set_id=centinela)81.30.107.153130758Rw  -5% ossec13001gvExim Auth failed2025-04-07 19:09:01 dovecot_login authenticator failed for (localhost) [81.30.107.70]:44462: 535 Incorrect authentication data (set_id=jacksonville)81.30.107.70130758Nv  -+' ossec13001gPExim Auth failed2025-04-07 19:08:22 dovecot_login authenticator failed for (localhost) [81.30.107.104]:44562: 535 Incorrect authentication data (set_id=manila)81.30.107.104130758Ku  -'% ossec13001gDExim Auth failed2025-04-07 19:08:12 dovecot_login authenticator failed for (localhost) [81.30.107.70]:60322: 535 Incorrect authentication data (set_id=mabel)81.30.107.70130758Mt  -+% ossec13001g,Exim Auth failed2025-04-07 19:07:46 dovecot_login authenticator failed for (localhost) [81.30.107.40]:58796: 535 Incorrect authentication data (set_id=crawler)81.30.107.40130758^s -G' ossec13001g,Exim Auth failed2025-04-07 19:07:46 dovecot_login authenticator failed for (t418ebpW) [117.57.75.219]:52653: 535 Incorrect authentication data (set_id=hr@heipowersystem.com)117.57.75.2191814991Mr  -)' ossec13001gExim Auth failed2025-04-07 19:07:28 dovecot_login authenticator failed for (localhost) [81.30.107.104]:60378: 535 Incorrect authentication data (set_id=young)81.30.107.104130758Lq  -)% ossec13001gExim Auth failed2025-04-07 19:07:22 dovecot_login authenticator failed for (localhost) [81.30.107.70]:11508: 535 Incorrect authentication data (set_id=cimbom)81.30.107.70130758 j-Z  B,>fj  W% ossec9708g|Dovecot Aborted Login with empty userApr 7 20:51:31 vm1 dovecot[1526]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=71.6.134.233, lip=103.74.54.108, TLS, session=71.6.134.2336252001\  -I# ossec13001gExim Auth failed2025-04-07 20:27:14 dovecot_login authenticator failed for (rokamauka.com) [14.18.77.99]:50460: 535 Incorrect authentication data (set_id=sales@rokamauka.com)14.18.77.991814991T  -5' ossec13001gExim Auth failed2025-04-07 20:27:50 dovecot_login authenticator failed for ([58.252.222.81]) [58.252.222.81]:33856: 535 Incorrect authentication data (set_id=sales)58.252.222.811814991j  -_) ossec13001gExim Auth failed2025-04-07 20:27:38 dovecot_login authenticator failed for ([103.129.201.82]) [103.129.201.81]:51772: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)103.129.201.811210997P  -1# ossec13001gExim Auth failed2025-04-07 20:26:49 dovecot_login authenticator failed for (rokamauka.com) [14.18.77.99]:47130: 535 Incorrect authentication data (set_id=nologin)14.18.77.991814991Z  -?) ossec13001gfExim Auth failed2025-04-07 20:17:00 dovecot_login authenticator failed for ([210.212.10.100]) [210.212.10.100]:48070: 535 Incorrect authentication data (set_id=services)210.212.10.1001269750k  -e) ossec13001gVExim Auth failed2025-04-07 20:16:45 dovecot_login authenticator failed for ([196.216.81.126]) [196.216.81.126]:42336: 535 Incorrect authentication data (set_id=services@heipowersystem.com)196.216.81.12649518s  -o+ ossec13001g۽Exim Auth failed2025-04-07 19:35:48 dovecot_login authenticator failed for 184.sub-166-143-153.myvzw.com [166.143.153.184]:35210: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)166.143.153.1846252001y  -}) ossec13001g۪Exim Auth failed2025-04-07 19:35:29 dovecot_login authenticator failed for ([50.223.176.171]) [50.223.176.171]:50048: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)50.223.176.1716252001}  U_' ossec11001gDeferred login on the cpanel service[2025-04-07 19:19:31 +0530] info [webmaild] 157.38.44.110 - kps@amplifypowerglobal.com "POST /cpsess9920981272/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [157.38.61.88] != Current IP Address [157.38.44.110]157.38.44.1101269750L  -'' ossec13001gExim Auth failed2025-04-07 19:15:58 dovecot_login authenticator failed for (localhost) [81.30.107.121]:51338: 535 Incorrect authentication data (set_id=node)81.30.107.121130758L  -'' ossec13001gExim Auth failed2025-04-07 19:15:12 dovecot_login authenticator failed for (localhost) [81.30.107.121]:2838: 535 Incorrect authentication data (set_id=anwar)81.30.107.121130758Q  -1' ossec13001gֶExim Auth failed2025-04-07 19:14:22 dovecot_login authenticator failed for (localhost) [81.30.107.121]:18832: 535 Incorrect authentication data (set_id=mmartinez)81.30.107.121130758L  -)% ossec13001g֘Exim Auth failed2025-04-07 19:13:51 dovecot_login authenticator failed for (localhost) [81.30.107.90]:25618: 535 Incorrect authentication data (set_id=aspnet)81.30.107.90130758O  -/% ossec13001ghExim Auth failed2025-04-07 19:13:03 dovecot_login authenticator failed for (localhost) [81.30.107.90]:41684: 535 Incorrect authentication data (set_id=yoshihiko)81.30.107.90130758O  --' ossec13001gֆExim Auth failed2025-04-07 19:13:33 dovecot_login authenticator failed for (localhost) [81.30.107.121]:34778: 535 Incorrect authentication data (set_id=laposte)81.30.107.121130758O  --' ossec13001gVExim Auth failed2025-04-07 19:12:46 dovecot_login authenticator failed for (localhost) [81.30.107.121]:50810: 535 Incorrect authentication data (set_id=factory)81.30.107.121130758 fW U lDf'  W) ossec9708g fDovecot Aborted Login with empty userApr 7 22:50:37 vm1 dovecot[1526]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=87.236.176.236, lip=103.74.54.108, TLS, session=87.236.176.2362635167:&  Ak) ossec11302gFTP Authentication failed.Apr 7 22:46:50 vm1 pure-ftpd[2126597]: (?@195.184.76.112) [WARNING] Authentication failed for user [anonymous]195.184.76.1126252001(%  3U) ossec11301g}New FTP connection.Apr 7 22:46:44 vm1 pure-ftpd[2126597]: (?@195.184.76.112) [INFO] New connection from 195.184.76.112195.184.76.1126252001%$  3Q' ossec11301g}New FTP connection.Apr 7 22:46:44 vm1 pure-ftpd[2126595]: (?@195.184.76.18) [INFO] New connection from 195.184.76.18195.184.76.186252001q#  -o' ossec13001gEExim Auth failed2025-04-07 22:37:16 dovecot_login authenticator failed for (thepsindustries.com) [111.56.54.202]:44622: 535 Incorrect authentication data (set_id=postmaster@thepsindustries.com)111.56.54.2021814991Z"  -A' ossec13001g+Exim Auth failed2025-04-07 22:36:50 dovecot_login authenticator failed for (thepsindustries.com) [111.56.54.202]:40774: 535 Incorrect authentication data (set_id=nologin)111.56.54.2021814991%!  3Q' ossec11301gtNew FTP connection.Apr 7 22:29:30 vm1 pure-ftpd[2122696]: (?@47.236.252.14) [INFO] New connection from 47.236.252.1447.236.252.141880251i  -[+ ossec13001gExim Auth failed2025-04-07 22:28:06 dovecot_login authenticator failed for ([118.220.149.129]) [118.220.149.129]:36878: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)118.220.149.1291835841y  -}) ossec13001gExim Auth failed2025-04-07 22:27:44 dovecot_login authenticator failed for ([112.91.117.195]) [112.91.117.195]:37368: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)112.91.117.1951814991g  -[' ossec13001g0Exim Auth failed2025-04-07 22:24:08 dovecot_login authenticator failed for ([222.76.248.54]) [222.76.248.54]:33730: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)222.76.248.541814991W  -9) ossec13001g<Exim Auth failed2025-04-07 22:24:20 dovecot_login authenticator failed for ([112.172.189.90]) [112.172.189.90]:50068: 535 Incorrect authentication data (set_id=sales)112.172.189.901835841j  -_) ossec13001g8Exim Auth failed2025-04-07 22:24:15 dovecot_login authenticator failed for ([175.116.66.199]) [175.116.66.199]:51613: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)175.116.66.1991835841:  =o) ossec13008gMail Reciepient rejected2025-04-07 22:13:40 H=(mail.msnews24.in) [165.154.210.99]:60416 F= rejected RCPT : Rejected relay attempt: '165.154.210.99' From: 'rzdajdkvm@msnews24.in' To: 'validxxx@gmailhotmail.com.br'165.154.210.991694008"  3M% ossec11301gNew FTP connection.Apr 7 22:04:28 vm1 pure-ftpd[2117126]: (?@47.245.81.93) [INFO] New connection from 47.245.81.9347.245.81.931880251:  Ak) ossec11302gFTP Authentication failed.Apr 7 21:58:10 vm1 pure-ftpd[2115711]: (?@104.155.43.195) [WARNING] Authentication failed for user [anonymous]104.155.43.1952802361) 3U) ossec11301gNew FTP connection.Apr 7 21:58:05 vm1 pure-ftpd[2115709]: (?@104.155.43.195) [INFO] New connection from 104.155.43.195104.155.43.1952802361%  3Q' ossec11301gzNew FTP connection.Apr 7 21:46:56 vm1 pure-ftpd[2113304]: (?@198.235.24.14) [INFO] New connection from 198.235.24.14198.235.24.146252001(  3U) ossec11301gNew FTP connection.Apr 7 21:34:42 vm1 pure-ftpd[2110556]: (?@216.218.206.66) [INFO] New connection from 216.218.206.66216.218.206.666252001%  3Q' ossec11301g"New FTP connection.Apr 7 21:24:09 vm1 pure-ftpd[2108390]: (?@167.94.146.56) [INFO] New connection from 167.94.146.56167.94.146.566252001 *\~tj`VLB8.$zpf\H>4*   v l b X N D : 0 &    ~ t j ` V L B 8 . $    z p f \ R 4 H > *  vlbXN:D&0|rh^J@T6,"xndZPF<2( ~tj`VLB8.$zpf\ | r h ^ T J @ 6 , "    x n d Z P F < 2 (   RRH>4*  vlbXND:0& g< g֑< g< g< g< g< g< gâ< g< g< g< g< g< g< g< gQ< gE< gC< g[< g< g< g< g< gi< g_< g(< g< g< gn<~ gd<} g<| g<{ g g5<= g,<< g,<; g,^<: g,J<9 g,f<8 g+<7 g+<6 g&<5 g&<4 g%<3 g%{<2 g<1 g<0 g; g; g; gO; g?; gs; gc; g ; g; g; g}; g.; g.; g ; g ; gI; gw< g=; g=; g; gi; g; g; g; g; g; g; g; g ; g; g;; g1; g; gq; gi; gY; gT; gL; g; g; g; g; gA; g; g; g; g; g; g; gw; gu; gc; g]; g~j; g|; g{; g{; gy; gxi; O 4 G f .;:EnkO9  W% ossec9708g,JDovecot Aborted Login with empty userApr 8 01:19:28 vm1 dovecot[1526]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=203.55.131.5, lip=103.74.54.108, TLS, session=203.55.131.562520018  --' ossec13001g,fExim Auth failed2025-04-08 01:19:57 dovecot_login authenticator failed for host-88-43-231-186.business.telecomitalia.it ([88.43.231.188]) [88.43.231.186]:42670: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)88.43.231.1863175395k7  -g# ossec13001g+Exim Auth failed2025-04-08 01:16:21 dovecot_login authenticator failed for (223-30-0-0.lan.sify.net) [1.7.229.162]:57050: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)1.7.229.1621269750S6  -5' ossec13001g+Exim Auth failed2025-04-08 01:16:54 dovecot_login authenticator failed for ([78.142.41.167]) [78.142.41.167]:40978: 535 Incorrect authentication data (set_id=sales)78.142.41.167732800q5  -m) ossec13001g&Exim Auth failed2025-04-08 00:56:16 dovecot_login authenticator failed for 221-120-57-125.emome-ip.hinet.net [221.120.57.125]:45450: 535 Incorrect authentication data (set_id=vikas.khandelwal)221.120.57.1251668284}4  -' ossec13001g&Exim Auth failed2025-04-08 00:56:00 dovecot_login authenticator failed for 31-151-70-150.dynamic.upc.nl [31.151.70.150]:59272: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)31.151.70.1502750405]3 -E' ossec13001g%Exim Auth failed2025-04-08 00:52:13 dovecot_login authenticator failed for (DzkHQzW) [117.57.75.192]:51839: 535 Incorrect authentication data (set_id=hr@heipowersystem.com)117.57.75.1921814991[2  -C' ossec13001g%{Exim Auth failed2025-04-08 00:50:25 dovecot_login authenticator failed for (GEbtO4) [117.57.75.134]:59339: 535 Incorrect authentication data (set_id=hr@heipowersystem.com)117.57.75.13418149911  ?1 ossec1008gProcess exiting (killed).Apr 8 00:05:16 vm1 spamd[1824694]: spamd: server killed by SIGTERM, shutting down%0  3Q' ossec11301gNew FTP connection.Apr 8 00:01:25 vm1 pure-ftpd[2143486]: (?@205.210.31.81) [INFO] New connection from 205.210.31.81205.210.31.816252001Z/ -C# ossec13001gExim Auth failed2025-04-07 23:57:11 dovecot_login authenticator failed for (amplifypowerglobal.com) [14.18.77.99]:57690: 535 Incorrect authentication data (set_id=nologin)14.18.77.991814991,. a3% ossec5710gIAttempt to login using a non-existent userApr 7 23:41:19 vm1 sshd[2138920]: Invalid user albert from 1.237.10.110 port 603761.237.10.1101835841&-  CG% ossec5716gASSHD authentication failed.Apr 7 23:41:11 vm1 sshd[2138887]: Failed password for root from 1.237.10.110 port 48992 ssh21.237.10.1101835841], E1% ossec2501g?User authentication failure.Apr 7 23:41:09 vm1 sshd[2138887]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=1.237.10.110 user=root1.237.10.1101835841i+  -]) ossec13001gYExim Auth failed2025-04-07 23:20:16 dovecot_login authenticator failed for 164.46.246.220.static.netvigator.com [220.246.46.164]:53249: 535 Incorrect authentication data (set_id=sales)220.246.46.1641819730g*  -[' ossec13001g?Exim Auth failed2025-04-07 23:19:51 dovecot_login authenticator failed for ([27.40.100.158]) [27.40.100.158]:40223: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)27.40.100.1581814991p)  -i+ ossec13001g;Exim Auth failed2025-04-07 23:19:46 dovecot_login authenticator failed for (nsg-corporate-177.233.187.122.airtel.in) [122.187.233.177]:57118: 535 Incorrect authentication data (set_id=sales)122.187.233.1771269750i(  -]) ossec13001g-Exim Auth failed2025-04-07 23:19:32 dovecot_login authenticator failed for ([117.158.166.73]) [117.158.166.73]:8662: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)117.158.166.731814991    . 7 N e6  {J  -% ossec13001gAdExim Auth failed2025-04-08 02:49:31 dovecot_login authenticator failed for syn-137-027-032-070.biz.spectrum.com [137.27.32.70]:38580: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)137.27.32.706252001ZI  -C% ossec13001g@jExim Auth failed2025-04-08 02:45:20 dovecot_login authenticator failed for (host24.helenandrews.com) [63.116.23.24]:57974: 535 Incorrect authentication data (set_id=sales)63.116.23.246252001jH  -_) ossec13001g@`Exim Auth failed2025-04-08 02:45:10 dovecot_login authenticator failed for ([218.150.170.10]) [218.150.170.10]:52970: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)218.150.170.101835841*G  CK) ossec5716g<SSHD authentication failed.Apr 8 02:30:44 vm1 sshd[2179490]: Failed password for root from 175.209.43.251 port 53348 ssh2175.209.43.2511835841/F a5) ossec5710g<Attempt to login using a non-existent userApr 8 02:30:25 vm1 sshd[2179466]: Invalid user test9 from 175.209.43.251 port 52386175.209.43.2511835841VE E) ossec2501g<User authentication failure.Apr 8 02:30:25 vm1 sshd[2179466]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.209.43.251175.209.43.2511835841*D  CK) ossec5716g<SSHD authentication failed.Apr 8 02:30:13 vm1 sshd[2179412]: Failed password for root from 175.209.43.251 port 51404 ssh2175.209.43.2511835841`C  E5) ossec2501g<User authentication failure.Apr 8 02:30:12 vm1 sshd[2179412]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.209.43.251 user=root175.209.43.2511835841jB  -_) ossec13001g8sExim Auth failed2025-04-08 02:11:23 dovecot_login authenticator failed for ([117.157.246.26]) [117.157.246.26]:45290: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)117.157.246.261814991QA  -1% ossec13001g8Exim Auth failed2025-04-08 02:11:35 dovecot_login authenticator failed for ([219.159.57.4]) [219.159.57.4]:40877: 535 Incorrect authentication data (set_id=sales)219.159.57.41814991e@  -U) ossec13001g8\Exim Auth failed2025-04-08 02:10:59 dovecot_login authenticator failed for (136-34-165-114.googlefiber.net) [136.34.165.114]:45969: 535 Incorrect authentication data (set_id=sales)136.34.165.1146252001e?  -[' ossec13001g8QExim Auth failed2025-04-08 02:10:49 dovecot_login authenticator failed for ([65.20.204.164]) [65.20.204.164]:40446: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)65.20.204.16499237s>  -q) ossec13001g5Exim Auth failed2025-04-08 01:58:59 dovecot_login authenticator failed for pool-108-18-206-153.washdc.fios.verizon.net [108.18.206.153]:56035: 535 Incorrect authentication data (set_id=purchase)108.18.206.1536252001j=  -a' ossec13001g5Exim Auth failed2025-04-08 01:58:48 dovecot_login authenticator failed for ([36.154.247.90]) [36.154.247.90]:52278: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)36.154.247.901814991d<  -U' ossec13001g,Exim Auth failed2025-04-08 01:21:41 dovecot_login authenticator failed for (pppoe-static.mosoblast.rt.ru) [77.51.214.170]:43698: 535 Incorrect authentication data (set_id=purchase)77.51.214.1702017370{;  -) ossec13001g,Exim Auth failed2025-04-08 01:21:33 dovecot_login authenticator failed for (232.215.221.60.adsl-pool.sx.cn) [60.221.215.232]:56767: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)60.221.215.2321814991y:  -}) ossec13001g,^Exim Auth failed2025-04-08 01:19:49 dovecot_login authenticator failed for ([209.38.100.151]) [209.38.100.151]:55366: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)209.38.100.1512750405 * | ? c sFh\  -a' ossec13001g]Exim Auth failed2025-04-08 04:51:21 dovecot_login authenticator failed for ([65.20.172.194]) [65.20.172.194]:58054: 535 Incorrect authentication data (set_id=services@heipowersystem.com)65.20.172.19499237Z[  -?) ossec13001g^Exim Auth failed2025-04-08 04:51:51 dovecot_login authenticator failed for ([211.51.140.148]) [211.51.140.148]:39436: 535 Incorrect authentication data (set_id=services)211.51.140.1481835841WZ  -;' ossec13001g\(Exim Auth failed2025-04-08 04:43:44 dovecot_login authenticator failed for ([46.163.154.14]) [46.163.154.14]:59926: 535 Incorrect authentication data (set_id=purchase)46.163.154.142017370pY  -o% ossec13001g\!Exim Auth failed2025-04-08 04:43:35 dovecot_login authenticator failed for (host24.helenandrews.com) [63.116.23.24]:35618: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)63.116.23.246252001.X a5' ossec5710g[Attempt to login using a non-existent userApr 8 04:41:59 vm1 sshd[2206753]: Invalid user samika from 120.232.242.4 port 42062120.232.242.41814991(W  CI' ossec5716g[SSHD authentication failed.Apr 8 04:41:52 vm1 sshd[2206727]: Failed password for root from 120.232.242.4 port 41340 ssh2120.232.242.41814991_V E3' ossec2501g[User authentication failure.Apr 8 04:41:49 vm1 sshd[2206727]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=120.232.242.4 user=root120.232.242.41814991NU  --# ossec13001gSExim Auth failed2025-04-08 04:07:01 dovecot_login authenticator failed for ([206.0.8.204]) [206.0.8.204]:50170: 535 Incorrect authentication data (set_id=sales)206.0.8.2043469034mT  -c+ ossec13001gS~Exim Auth failed2025-04-08 04:06:46 dovecot_login authenticator failed for ([175.194.181.238]) [175.194.181.238]:51231: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)175.194.181.2381835841WS  -9) ossec13001gSExim Auth failed2025-04-08 04:07:11 dovecot_login authenticator failed for ([128.185.253.90]) [128.185.253.90]:34398: 535 Incorrect authentication data (set_id=sales)128.185.253.901269750lR  -i# ossec13001gRExim Auth failed2025-04-08 04:03:39 dovecot_login authenticator failed for (s2seducationtrust.com) [14.18.77.99]:37096: 535 Incorrect authentication data (set_id=sales@s2seducationtrust.com)14.18.77.991814991XQ  -A# ossec13001gRExim Auth failed2025-04-08 04:02:52 dovecot_login authenticator failed for (s2seducationtrust.com) [14.18.77.99]:59504: 535 Incorrect authentication data (set_id=nologin)14.18.77.9918149911P a9) ossec5710gHAttempt to login using a non-existent userApr 8 03:20:27 vm1 sshd[2190255]: Invalid user minieye from 111.43.199.174 port 53228111.43.199.1741814991VO E) ossec2501gHUser authentication failure.Apr 8 03:20:27 vm1 sshd[2190255]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.43.199.174111.43.199.1741814991*N  CK) ossec5716gHSSHD authentication failed.Apr 8 03:20:52 vm1 sshd[2190347]: Failed password for root from 111.43.199.174 port 54152 ssh2111.43.199.1741814991*M  CK) ossec5716gHSSHD authentication failed.Apr 8 03:20:11 vm1 sshd[2190115]: Failed password for root from 111.43.199.174 port 52268 ssh2111.43.199.1741814991`L  E5) ossec2501gHUser authentication failure.Apr 8 03:20:08 vm1 sshd[2190115]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.43.199.174 user=root111.43.199.1741814991nK  -g) ossec13001gApExim Auth failed2025-04-08 02:49:42 dovecot_login authenticator failed for (nsg-static-245.215.75.182-airtel.com) [182.75.215.245]:33518: 535 Incorrect authentication data (set_id=purchase)182.75.215.2451269750 ? 3 6 G ( A \x?Zl  -=+ ossec13001g~Exim Auth failed2025-04-08 07:08:32 dovecot_login authenticator failed for ([218.149.235.152]) [218.149.235.152]:33588: 535 Incorrect authentication data (set_id=sales)218.149.235.1521835841gk  -[' ossec13001g}Exim Auth failed2025-04-08 07:07:37 dovecot_login authenticator failed for ([61.136.142.13]) [61.136.142.13]:42858: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)61.136.142.131814991Hj  -) ossec13001g{Exim Auth failed2025-04-08 06:59:01 dovecot_login authenticator failed for ([27.212.156.152]) [27.212.156.152]:26772: 535 Incorrect authentication data27.212.156.1521814991Qi  -1% ossec13001g{Exim Auth failed2025-04-08 06:58:54 dovecot_login authenticator failed for ([109.63.246.9]) [109.63.246.9]:53390: 535 Incorrect authentication data (set_id=sales)109.63.246.92017370|h  -) ossec13001g{Exim Auth failed2025-04-08 06:58:21 dovecot_login authenticator failed for syn-070-122-139-172.res.spectrum.com [70.122.139.172]:34350: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)70.122.139.1726252001bg  -O) ossec13001gvExim Auth failed2025-04-08 06:37:48 dovecot_login authenticator failed for ([106.255.231.10]) [106.255.231.10]:48625: 535 Incorrect authentication data (set_id=vikas.khandelwal)106.255.231.101835841f  -' ossec13001gvExim Auth failed2025-04-08 06:37:36 dovecot_login authenticator failed for 46-162-104-66.cust.bredband2.com [46.162.104.66]:48088: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)46.162.104.662661886`e  -K) ossec13001gtExim Auth failed2025-04-08 06:25:58 dovecot_login authenticator failed for (DdwTNUexz) [117.69.235.222]:62487: 535 Incorrect authentication data (set_id=hr@heipowersystem.com)117.69.235.2221814991`d  -K) ossec13001gsExim Auth failed2025-04-08 06:24:49 dovecot_login authenticator failed for (JdCksX4t8) [117.69.235.222]:52498: 535 Incorrect authentication data (set_id=hr@heipowersystem.com)117.69.235.2221814991ac  -K+ ossec13001gsExim Auth failed2025-04-08 06:23:41 dovecot_login authenticator failed for (tJ3M2rjD) [183.164.241.129]:63924: 535 Incorrect authentication data (set_id=hr@heipowersystem.com)183.164.241.1291814991cb -M+ ossec13001gscExim Auth failed2025-04-08 06:22:51 dovecot_login authenticator failed for (aD2IHwHc6) [183.164.241.129]:61465: 535 Incorrect authentication data (set_id=hr@heipowersystem.com)183.164.241.1291814991a  W) ossec9708giDovecot Aborted Login with empty userApr 8 05:42:25 vm1 dovecot[1526]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=185.247.137.63, lip=103.74.54.108, TLS, session=185.247.137.63298795k`  -_+ ossec13001g`Exim Auth failed2025-04-08 05:02:15 dovecot_login authenticator failed for (customer-GDL-135-105.megared.net.mx) [177.231.135.105]:3398: 535 Incorrect authentication data (set_id=sales)177.231.135.1053996063y_  -' ossec13001g`tExim Auth failed2025-04-08 05:02:03 dovecot_login authenticator failed for 185.39.167.72.host.secureserver.net [72.167.39.185]:35358: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)72.167.39.1856252001R^  -5' ossec13001g`jExim Auth failed2025-04-08 05:01:53 dovecot_login authenticator failed for ([65.20.169.151]) [65.20.169.151]:58702: 535 Incorrect authentication data (set_id=sales)65.20.169.15199237s]  -u% ossec13001g`\Exim Auth failed2025-04-08 05:01:38 dovecot_login authenticator failed for 92-34-29-114.customers.ownit.se [92.34.29.114]:44036: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)92.34.29.1142661886 b! < 9Jh2QYbs~  -u' ossec13001gnExim Auth failed2025-04-08 09:30:46 dovecot_login authenticator failed for (mail110220.dc.sistemdc.commailtr.com) [78.189.21.157]:41359: 535 Incorrect authentication data (set_id=vikas.khandelwal)78.189.21.157298795t}  -u) ossec13001gdExim Auth failed2025-04-08 09:30:36 dovecot_login authenticator failed for ([185.181.41.120]) [185.181.41.120]:53950: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)185.181.41.120617790]| -E' ossec13001gExim Auth failed2025-04-08 09:19:40 dovecot_login authenticator failed for (s2seducationtrust.com) [111.56.54.202]:45614: 535 Incorrect authentication data (set_id=nologin)111.56.54.20218149912{  =_) ossec13008gMail Reciepient rejected2025-04-08 09:10:40 H=(mail.msnews24.in) [165.154.210.52]:61686 F= rejected RCPT : Rejected relay attempt: '165.154.210.52' From: 'xykiz@msnews24.in' To: 'validxxx@gmailhotmail.com.br'165.154.210.521694008^z -G' ossec13001gExim Auth failed2025-04-08 08:28:48 dovecot_login authenticator failed for (amplifypowerglobal.com) [111.207.12.99]:49354: 535 Incorrect authentication data (set_id=nologin)111.207.12.9918149910y a;% ossec5710gAttempt to login using a non-existent userApr 8 08:15:12 vm1 sshd[2254390]: Invalid user zhaoyanjie from 123.115.84.4 port 45696123.115.84.41814991'x CG% ossec5716gSSHD authentication failed.Apr 8 08:14:47 vm1 sshd[2254008]: Failed password for root from 123.115.84.4 port 43938 ssh2123.115.84.41814991]w E1% ossec2501gUser authentication failure.Apr 8 08:14:45 vm1 sshd[2254008]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=123.115.84.4 user=root123.115.84.41814991+v  3Y+ ossec11301gNew FTP connection.Apr 8 08:06:15 vm1 pure-ftpd[2252271]: (?@192.241.131.207) [INFO] New connection from 192.241.131.207192.241.131.2076252001Tu  -5' ossec13001gExim Auth failed2025-04-08 07:53:49 dovecot_login authenticator failed for ([222.100.159.2]) [222.100.159.2]:42504: 535 Incorrect authentication data (set_id=sales)222.100.159.21835841jt  -_) ossec13001gExim Auth failed2025-04-08 07:53:36 dovecot_login authenticator failed for ([87.249.217.180]) [87.249.217.180]:42998: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)87.249.217.1802017370js  -a' ossec13001gJExim Auth failed2025-04-08 07:43:29 dovecot_login authenticator failed for syn-172-090-128-097.res.spectrum.com [172.90.128.97]:61102: 535 Incorrect authentication data (set_id=services)172.90.128.976252001mr  -e) ossec13001g>Exim Auth failed2025-04-08 07:43:16 dovecot_login authenticator failed for ([182.160.114.72]) [182.160.114.72]:41550: 535 Incorrect authentication data (set_id=services@heipowersystem.com)182.160.114.721210997,q a/) ossec5710gAttempt to login using a non-existent userApr 8 07:42:02 vm1 sshd[2246700]: Invalid user lq from 175.208.77.246 port 40362175.208.77.2461835841*p  CK) ossec5716gSSHD authentication failed.Apr 8 07:41:52 vm1 sshd[2246662]: Failed password for root from 175.208.77.246 port 40358 ssh2175.208.77.2461835841ao E5) ossec2501gUser authentication failure.Apr 8 07:41:50 vm1 sshd[2246662]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.208.77.246 user=root175.208.77.2461835841%n  3Q' ossec11301gNew FTP connection.Apr 8 07:36:58 vm1 pure-ftpd[2245589]: (?@91.238.181.91) [INFO] New connection from 91.238.181.9191.238.181.9130173822m  =_) ossec13008g=Mail Reciepient rejected2025-04-08 07:30:28 H=(mail.msnews24.in) [165.154.210.99]:62899 F= rejected RCPT : Rejected relay attempt: '165.154.210.99' From: 'mglkx@msnews24.in' To: 'validxxx@gmailhotmail.com.br'165.154.210.991694008 P]c G\q~>Pj  -_) ossec13001gExim Auth failed2025-04-08 11:30:55 dovecot_login authenticator failed for ([220.80.192.168]) [220.80.192.168]:35092: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)220.80.192.1681835841- a3' ossec5710gAttempt to login using a non-existent userApr 8 10:57:23 vm1 sshd[2289905]: Invalid user dmdba from 110.232.93.98 port 21132110.232.93.981643084(  CI' ossec5716gSSHD authentication failed.Apr 8 10:57:14 vm1 sshd[2289882]: Failed password for root from 110.232.93.98 port 63320 ssh2110.232.93.981643084_ E3' ossec2501gUser authentication failure.Apr 8 10:57:12 vm1 sshd[2289882]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=110.232.93.98 user=root110.232.93.981643084o  -i) ossec13001gQExim Auth failed2025-04-08 10:47:05 dovecot_login authenticator failed for (as142506-239.168.103.khushibroadband.com) [103.168.239.60]:56095: 535 Incorrect authentication data (set_id=sales)103.168.239.601269750g  -[' ossec13001gEExim Auth failed2025-04-08 10:46:52 dovecot_login authenticator failed for ([211.202.71.21]) [211.202.71.21]:39796: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)211.202.71.211835841g  -[' ossec13001gCExim Auth failed2025-04-08 10:46:50 dovecot_login authenticator failed for ([222.117.0.253]) [222.117.0.253]:41780: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)222.117.0.2531835841Q  -1% ossec13001g[Exim Auth failed2025-04-08 10:47:15 dovecot_login authenticator failed for ([183.249.1.81]) [183.249.1.81]:35289: 535 Incorrect authentication data (set_id=sales)183.249.1.811814991Z  -?) ossec13001gExim Auth failed2025-04-08 10:36:29 dovecot_login authenticator failed for ([113.219.177.95]) [113.219.177.95]:50158: 535 Incorrect authentication data (set_id=services)113.219.177.951814991m  -e) ossec13001gExim Auth failed2025-04-08 10:36:14 dovecot_login authenticator failed for ([178.178.222.53]) [178.178.222.53]:43858: 535 Incorrect authentication data (set_id=services@heipowersystem.com)178.178.222.532017370^  -M# ossec13001gExim Auth failed2025-04-08 10:24:47 dovecot_login authenticator failed for (nyaystambh.com) [14.18.77.99]:48510: 535 Incorrect authentication data (set_id=sales@nyaystambh.com)14.18.77.991814991Q  -3# ossec13001gExim Auth failed2025-04-08 10:24:22 dovecot_login authenticator failed for (nyaystambh.com) [14.18.77.99]:44742: 535 Incorrect authentication data (set_id=nologin)14.18.77.991814991d  -S) ossec13001giExim Auth failed2025-04-08 10:13:21 dovecot_login authenticator failed for (ip-20-192.datautama.net.id) [112.109.20.192]:42747: 535 Incorrect authentication data (set_id=purchase)112.109.20.1921643084t  -s) ossec13001g_Exim Auth failed2025-04-08 10:13:10 dovecot_login authenticator failed for (94.140.210.134.ptspb.ru) [94.140.210.134]:51351: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)94.140.210.1342017370]  -K# ossec13001g(Exim Auth failed2025-04-08 09:55:11 dovecot_login authenticator failed for ([36.39.140.2]) [36.39.140.2]:33139: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)36.39.140.21835841v  -y' ossec13001gExim Auth failed2025-04-08 09:54:59 dovecot_login authenticator failed for ([203.124.60.46]) [203.124.60.46]:49410: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)203.124.60.461168579  3I# ossec11301gNew FTP connection.Apr 8 09:32:20 vm1 pure-ftpd[2270928]: (?@71.6.232.27) [INFO] New connection from 71.6.232.2771.6.232.276252001  0Rda  -S# ossec13001gExim Auth failed2025-04-08 13:40:42 dovecot_login authenticator failed for ([36.7.111.87]) [36.7.111.87]:49770: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)36.7.111.871814991j  -_) ossec13001gExim Auth failed2025-04-08 13:40:37 dovecot_login authenticator failed for ([180.166.162.78]) [180.166.162.78]:60090: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)180.166.162.781814991Z  -?) ossec13001gשExim Auth failed2025-04-08 13:30:41 dovecot_login authenticator failed for ([211.186.220.42]) [211.186.220.42]:45423: 535 Incorrect authentication data (set_id=services)211.186.220.421835841j  -a' ossec13001gכExim Auth failed2025-04-08 13:30:27 dovecot_login authenticator failed for ([61.184.119.61]) [61.184.119.61]:35924: 535 Incorrect authentication data (set_id=services@heipowersystem.com)61.184.119.611814991O aw' ossec5710gAttempt to login using a non-existent userApr 8 13:27:15 vm1 sshd[2322402]: Failed password for invalid user vaijayantimala from 37.195.111.33 port 49742 ssh237.195.111.332017370(  CI' ossec5716gSSHD authentication failed.Apr 8 13:27:00 vm1 sshd[2322366]: Failed password for root from 37.195.111.33 port 35394 ssh237.195.111.332017370_ E3' ossec2501gUser authentication failure.Apr 8 13:26:58 vm1 sshd[2322366]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.195.111.33 user=root37.195.111.3320173708  =k) ossec13008g֑Mail Reciepient rejected2025-04-08 13:26:00 H=(mail.msnews24.in) [165.154.210.52]:52628 F= rejected RCPT : Rejected relay attempt: '165.154.210.52' From: 'ywzrjpcx@msnews24.in' To: 'validxxx@gmailhotmail.com.br'165.154.210.5216940088  =k) ossec13008gMail Reciepient rejected2025-04-08 13:02:16 H=(mail.msnews24.in) [165.154.247.20]:59423 F= rejected RCPT : Rejected relay attempt: '165.154.247.20' From: 'uetfnxym@msnews24.in' To: 'validxxx@gmailhotmail.com.br'165.154.247.201605651i  -[+ ossec13001gExim Auth failed2025-04-08 12:49:21 dovecot_login authenticator failed for ([178.178.194.135]) [178.178.194.135]:40968: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)178.178.194.1352017370u  -y' ossec13001gExim Auth failed2025-04-08 12:48:57 dovecot_login authenticator failed for ([185.167.56.34]) [185.167.56.34]:39402: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)185.167.56.34617790Q  -1% ossec13001gExim Auth failed2025-04-08 12:45:41 dovecot_login authenticator failed for ([209.38.35.92]) [209.38.35.92]:42214: 535 Incorrect authentication data (set_id=sales)209.38.35.922750405d  -W% ossec13001gExim Auth failed2025-04-08 12:45:28 dovecot_login authenticator failed for ([59.99.153.21]) [59.99.153.21]:30720: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)59.99.153.211269750C  77 ossec502gâOssec server started.ossec: Ossec started.4  =c) ossec13008gMail Reciepient rejected2025-04-08 11:56:44 H=(mail.msnews24.in) [165.154.210.99]:54340 F= rejected RCPT : Rejected relay attempt: '165.154.210.99' From: 'gihubv@msnews24.in' To: 'validxxx@gmailhotmail.com.br'165.154.210.991694008(  3U) ossec11301gNew FTP connection.Apr 8 11:48:43 vm1 pure-ftpd[2300944]: (?@216.218.206.68) [INFO] New connection from 216.218.206.68216.218.206.6862520017  =k' ossec13008gMail Reciepient rejected2025-04-08 11:33:02 H=(mail.msnews24.in) [45.197.14.138]:63526 F= rejected RCPT : Rejected relay attempt: '45.197.14.138' From: 'nzkebnwff@msnews24.in' To: 'validxxx@gmailhotmail.com.br'45.197.14.1386252001 7 G c *9\n1  -g) ossec13001goExim Auth failed2025-04-08 15:37:42 dovecot_login authenticator failed for (106.107.173.49.adsl.dynamic.seed.net.tw) [106.107.173.49]:57811: 535 Incorrect authentication data (set_id=sales)106.107.173.491668284y0  -) ossec13001gcExim Auth failed2025-04-08 15:37:30 dovecot_login authenticator failed for mobile-user-c3a5b5-16.dhcp.inet.fi [195.165.181.16]:53934: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)195.165.181.16660013Y/  -?' ossec13001gYExim Auth failed2025-04-08 15:28:47 dovecot_login authenticator failed for (User) [45.151.99.230]:58936: 535 Incorrect authentication data (set_id=admin1@technobases.in)45.151.99.2302017370Y. -=' ossec13001gExim Auth failed2025-04-08 15:27:46 dovecot_login authenticator failed for (User) [45.151.99.230]:37462: 535 Incorrect authentication data (set_id=admin@technobases.in)45.151.99.2302017370Y-  -?' ossec13001gExim Auth failed2025-04-08 15:27:16 dovecot_login authenticator failed for (User) [45.151.99.230]:36194: 535 Incorrect authentication data (set_id=696969@technobases.in)45.151.99.2302017370a,  -O' ossec13001gExim Auth failed2025-04-08 15:22:26 dovecot_login authenticator failed for (User) [45.151.99.230]:37594: 535 Incorrect authentication data (set_id=fgfdgfsdfgfdsf@technobases.in)45.151.99.2302017370z+  -) ossec13001gExim Auth failed2025-04-08 15:16:58 dovecot_login authenticator failed for (broadband-37.204-225-138.ip.moscow.rt.ru) [37.204.225.138]:38094: 535 Incorrect authentication data (set_id=vikas.khandelwal)37.204.225.1382017370u*  -u) ossec13001gExim Auth failed2025-04-08 15:16:45 dovecot_login authenticator failed for ([73.231.102.189]) [73.231.102.189]:37286: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)73.231.102.18962520014)  =c) ossec13008gzMail Reciepient rejected2025-04-08 15:12:17 H=(mail.msnews24.in) [165.154.228.93]:51037 F= rejected RCPT : Rejected relay attempt: '165.154.228.93' From: 'iaxclv@msnews24.in' To: 'validxxx@gmailhotmail.com.br'165.154.228.931643084-( a1) ossec5710gAttempt to login using a non-existent userApr 8 15:05:27 vm1 sshd[2344328]: Invalid user szy from 59.146.240.184 port 5062259.146.240.1841861060V' E) ossec2501gUser authentication failure.Apr 8 15:05:28 vm1 sshd[2344328]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=59.146.240.18459.146.240.1841861060*&  CK) ossec5716gSSHD authentication failed.Apr 8 15:05:16 vm1 sshd[2344274]: Failed password for root from 59.146.240.184 port 49126 ssh259.146.240.1841861060`%  E5) ossec2501gUser authentication failure.Apr 8 15:05:14 vm1 sshd[2344274]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=59.146.240.184 user=root59.146.240.1841861060"$  3M% ossec11301gNew FTP connection.Apr 8 15:04:30 vm1 pure-ftpd[2344019]: (?@203.55.131.5) [INFO] New connection from 203.55.131.5203.55.131.56252001F#  = % ossec13008gMail Reciepient rejected2025-04-08 15:02:04 H=static-185-95-84-71.sunucuhub.com [185.95.84.71]:59942 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no F= rejected RCPT : SMTP AUTH is required for message submission on port 587185.95.84.71298795T"  -5' ossec13001g Exim Auth failed2025-04-08 13:40:51 dovecot_login authenticator failed for ([103.68.22.140]) [103.68.22.140]:55163: 535 Incorrect authentication data (set_id=sales)103.68.22.1401269750m!  -c+ ossec13001gExim Auth failed2025-04-08 13:40:46 dovecot_login authenticator failed for (static-146.220.149.202-tataidc.co.in) [202.149.220.145]:35418: 535 Incorrect authentication data (set_id=sales)202.149.220.1451269750  | y { | "(09x$#!k3.145.149.6GRAYhHImunify360hAutomatically blocked due to distributed attack6252001localy%!k18.218.22.99GRAYhOImunify360hNAutomatically blocked due to distributed attack6252001clocalx%#!k3.16.66.211GRAYhImunify360hYAutomatically blocked due to distributed attack6252001Blocaly %!k3.15.177.123GRAYhkImunify360hjtAutomatically blocked due to distributed attack6252001{localy %!k3.137.174.56GRAYh;Imunify360hAutomatically blocked due to distributed attack62520018localz '!k18.224.18.177GRAYhnImunify360hlAutomatically blocked due to distributed attack6252001localz'!k18.117.152.93GRAYhtImunify360hHAutomatically blocked due to distributed attack6252001u]localy%!k3.141.34.194GRAYh5Imunify360h4Automatically blocked due to distributed attack6252001"localy%!k3.139.61.126GRAYhBImunify360hAAutomatically blocked due to distributed attack6252001=~local})!k187.217.186.28GRAYgImunify360gwAutomatically blocked due to distributed attack3996063ٺlocalx#!k3.149.242.7GRAYghImunify360ggsAutomatically blocked due to distributed attack6252001localz'!k103.233.10.48GRAYgvImunify360guVAutomatically blocked due to distributed attack1819730g 0localx#!k3.141.1.115GRAYgmImunify360gldAutomatically blocked due to distributed attack6252001slocaly%!k3.19.246.156GRAYgKImunify360gJAutomatically blocked due to distributed attack6252001local{)!k18.223.111.250GRAYgImunify360goAutomatically blocked due to distributed attack6252001olocalx}#!k3.139.79.43GRAYg7Imunify360g Automatically blocked due to distributed attack6252001O+localy|%!k18.227.72.72GRAYgXImunify360gVAutomatically blocked due to distributed attack6252001HHlocal{y)! k15.235.227.163GRAYgX'Imunify360gQAutomatically blocked due to distributed attack1880251local{x'!k194.0.234.153GRAYg'Imunify360g&zAutomatically blocked due to distributed attack130758local~s+!k140.224.147.210GRAYgImunify360g޾Automatically blocked due to distributed attack1814991localzr)!k77.125.143.185GRAYgImunify360gAutomatically blocked due to distributed attack294640M}local~k%52.242.79.78BLACKg(g(Blacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests62520014ONlocal~j%104.46.1.228BLACKggBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests6252001h.locali'104.46.203.86BLACKg"g"Blacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests6252001h.Vlocalh+130.131.211.176BLACKgzgjzBlacklisted for CAPTCHA_DOS_ALERT after 101 captcha requests6252001Ӱlocalz'!k18.189.22.234GRAYgP Imunify360gNAutomatically blocked due to distributed attack6252001local{~%!k185.91.127.9GRAYgImunify360gAutomatically blocked due to distributed attack2921044[ local  I r5A  =c+ ossec13008gtMail Reciepient rejected2025-04-08 17:24:27 H=(mail.msnews24.in) [165.154.232.243]:63384 F= rejected RCPT : Rejected relay attempt: '165.154.232.243' From: 'ikvzc@msnews24.in' To: 'validxxx@gmailhotmail.com.br'165.154.232.2431605651W@  -;' ossec13001g Exim Auth failed2025-04-08 17:12:46 dovecot_login authenticator failed for ([184.71.121.54]) [184.71.121.54]:56808: 535 Incorrect authentication data (set_id=purchase)184.71.121.546251999m?  -e) ossec13001g Exim Auth failed2025-04-08 17:12:34 dovecot_login authenticator failed for ([222.105.182.88]) [222.105.182.88]:57760: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)222.105.182.881835841%>  3Q' ossec11301g gNew FTP connection.Apr 8 17:02:53 vm1 pure-ftpd[2370750]: (?@4.236.188.106) [INFO] New connection from 4.236.188.1064.236.188.1066252001=  U) ossec11001g&Deferred login on the cpanel service[2025-04-08 16:53:17 +0530] info [webmaild] 157.38.110.196 - kps@amplifypowerglobal.com "GET /cpsess3539828239/3rdparty/roundcube/?_task=mail&_mbox=INBOX&login=1&post_login=70627295020410 HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [157.38.72.102] != Current IP Address [157.38.110.196]157.38.110.1961269750W<  -9) ossec13001gOExim Auth failed2025-04-08 16:32:37 dovecot_login authenticator failed for ([27.128.162.146]) [27.128.162.146]:56510: 535 Incorrect authentication data (set_id=sales)27.128.162.1461814991j;  -_) ossec13001gAExim Auth failed2025-04-08 16:32:24 dovecot_login authenticator failed for ([118.41.142.164]) [118.41.142.164]:54635: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)118.41.142.1641835841Y:  -=) ossec13001gExim Auth failed2025-04-08 16:22:15 dovecot_login authenticator failed for ([218.15.222.74]) [125.90.173.236]:54481: 535 Incorrect authentication data (set_id=services)125.90.173.2361814991m9  -e) ossec13001gExim Auth failed2025-04-08 16:22:00 dovecot_login authenticator failed for ([116.114.84.170]) [116.114.84.170]:44672: 535 Incorrect authentication data (set_id=services@heipowersystem.com)116.114.84.1701814991y8  -' ossec13001gvExim Auth failed2025-04-08 15:54:54 dovecot_login authenticator failed for c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:47430: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)76.132.238.436252001W7  -9) ossec13001gExim Auth failed2025-04-08 15:55:12 dovecot_login authenticator failed for ([223.83.138.102]) [223.83.138.102]:54254: 535 Incorrect authentication data (set_id=sales)223.83.138.1021814991B6  gU) ossec11307gMultiple connection attempts from same sourceApr 8 15:42:48 vm1 pure-ftpd[2352478]: (?@35.216.134.165) [INFO] New connection from 35.216.134.16535.216.134.1652658434)5 3U) ossec11301g New FTP connection.Apr 8 15:42:44 vm1 pure-ftpd[2352454]: (?@35.216.134.165) [INFO] New connection from 35.216.134.16535.216.134.1652658434v4  -y' ossec13001g3Exim Auth failed2025-04-08 15:40:59 dovecot_login authenticator failed for ([58.238.181.96]) [58.238.181.96]:34771: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)58.238.181.961835841f3  -W) ossec13001gAExim Auth failed2025-04-08 15:41:12 dovecot_login authenticator failed for ([123.209.124.61]) [123.209.124.61]:53524: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)123.209.124.612077456"2  [%% ossec12004gPossible Dovecot CVE-2019-11500 attemptApr 8 15:39:14 vm1 dovecot[1526]: imap-login: Disconnected: Input buffer full (disconnected before auth was ready, waited 0 secs): user=<>, rip=185.91.127.9, lip=103.74.54.108, session=185.91.127.92921044 <}  ! z Xr>J<9<yP  -# ossec13001g"Exim Auth failed2025-04-08 18:27:06 dovecot_login authenticator failed for (58-27-253-6.wateen.net) [58.27.253.6]:61087: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)58.27.253.61168579O  -+ ossec13001gExim Auth failed2025-04-08 18:24:41 dovecot_login authenticator failed for 217-208-141-101-no2620.tbcn.telia.com [217.208.141.101]:56465: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)217.208.141.1012661886WN  -9) ossec13001gExim Auth failed2025-04-08 18:24:55 dovecot_login authenticator failed for ([73.231.102.189]) [73.231.102.189]:45018: 535 Incorrect authentication data (set_id=sales)73.231.102.1896252001/M  UA) ossec11001g Deferred login on the cpanel service[2025-04-08 18:09:38 +0530] info [webmaild] 157.38.106.183 - kps@amplifypowerglobal.com "POST /cpsess5237543917/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect157.38.106.1831269750pL  -q' ossec13001gExim Auth failed2025-04-08 18:08:26 dovecot_login authenticator failed for ([65.20.235.177]) [65.20.235.177]:40172: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)65.20.235.177992370K UA) ossec11001gDeferred login on the cpanel service[2025-04-08 18:08:38 +0530] info [webmaild] 157.38.106.183 - kps@amplifypowerglobal.com "POST /cpsess5237543917/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect157.38.106.1831269750bJ  -O) ossec13001gExim Auth failed2025-04-08 18:08:36 dovecot_login authenticator failed for ([103.251.143.14]) [103.251.143.14]:38226: 535 Incorrect authentication data (set_id=vikas.khandelwal)103.251.143.1412697500I UA) ossec11001gDeferred login on the cpanel service[2025-04-08 18:07:38 +0530] info [webmaild] 157.38.106.183 - kps@amplifypowerglobal.com "POST /cpsess5237543917/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect157.38.106.18312697500H UA) ossec11001gKDeferred login on the cpanel service[2025-04-08 18:06:25 +0530] info [webmaild] 157.38.106.183 - kps@amplifypowerglobal.com "POST /cpsess5237543917/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect157.38.106.18312697506G  Ag% ossec11302g}FTP Authentication failed.Apr 8 18:02:59 vm1 pure-ftpd[2384856]: (?@34.77.13.200) [WARNING] Authentication failed for user [anonymous]34.77.13.2002802361#F 3M% ossec11301gwNew FTP connection.Apr 8 18:02:53 vm1 pure-ftpd[2384845]: (?@34.77.13.200) [INFO] New connection from 34.77.13.20034.77.13.2002802361bE  -S% ossec13001g|Exim Auth failed2025-04-08 17:50:11 dovecot_login authenticator failed for (144.121.245.65.lightower.net) [64.72.74.162]:34919: 535 Incorrect authentication data (set_id=purchase)64.72.74.1626252001mD  -e) ossec13001grExim Auth failed2025-04-08 17:50:00 dovecot_login authenticator failed for ([221.228.237.90]) [221.228.237.90]:25960: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)221.228.237.901814991C  Ue) ossec11001gDeferred login on the cpanel service[2025-04-08 17:47:38 +0530] info [webmaild] 157.38.106.183 - kps@amplifypowerglobal.com "POST /cpsess5237543917/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [157.38.123.12] != Current IP Address [157.38.106.183]157.38.106.1831269750B  Uc' ossec11001g@Deferred login on the cpanel service[2025-04-08 17:27:52 +0530] info [webmaild] 157.38.123.12 - kps@amplifypowerglobal.com "POST /cpsess2480196548/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [157.38.110.196] != Current IP Address [157.38.123.12]157.38.123.121269750   ` ${g`  -[' ossec13001g7Exim Auth failed2025-04-08 20:17:29 dovecot_login authenticator failed for ([95.165.146.62]) [95.165.146.62]:60250: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)95.165.146.622017370V_  -;' ossec13001g2Exim Auth failed2025-04-08 19:58:23 dovecot_login authenticator failed for ([94.200.80.226]) [94.200.80.226]:44915: 535 Incorrect authentication data (set_id=purchase)94.200.80.226290557o^  -g+ ossec13001g2vExim Auth failed2025-04-08 19:58:05 dovecot_login authenticator failed for ([207.188.157.230]) [207.188.157.230]:2465: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)207.188.157.2302510769%]  3Q' ossec11301g.iNew FTP connection.Apr 8 19:40:48 vm1 pure-ftpd[2406969]: (?@40.80.200.216) [INFO] New connection from 40.80.200.21640.80.200.2166252001\  Uc' ossec11001g+,Deferred login on the cpanel service[2025-04-08 19:26:58 +0530] info [webmaild] 157.38.111.41 - kps@amplifypowerglobal.com "POST /cpsess0019859214/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [157.38.106.183] != Current IP Address [157.38.111.41]157.38.111.4112697506[  =g) ossec13008g*lMail Reciepient rejected2025-04-08 19:23:47 H=(mail.msnews24.in) [165.154.247.20]:55521 F= rejected RCPT : Rejected relay attempt: '165.154.247.20' From: 'igrjwnc@msnews24.in' To: 'validxxx@gmailhotmail.com.br'165.154.247.201605651dZ  -S) ossec13001g%.Exim Auth failed2025-04-08 19:01:25 dovecot_login authenticator failed for (73.153.212.218.starhub.net.sg) [101.100.184.80]:50570: 535 Incorrect authentication data (set_id=sales)101.100.184.801880251uY  -w' ossec13001g%"Exim Auth failed2025-04-08 19:01:13 dovecot_login authenticator failed for 202-82-20-241.static.imsbiz.com [202.82.20.241]:61904: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)202.82.20.2411819730hX  -]' ossec13001g%Exim Auth failed2025-04-08 19:01:02 dovecot_login authenticator failed for ([203.195.208.77]) [14.154.100.96]:56246: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)14.154.100.961814991.W a3) ossec5710g$Attempt to login using a non-existent userApr 8 19:00:33 vm1 sshd[2398104]: Invalid user acme from 222.248.12.211 port 51344222.248.12.2111814991*V  CK) ossec5716g$SSHD authentication failed.Apr 8 19:00:22 vm1 sshd[2398068]: Failed password for root from 222.248.12.211 port 50554 ssh2222.248.12.2111814991aU E5) ossec2501g$User authentication failure.Apr 8 19:00:20 vm1 sshd[2398068]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.248.12.211 user=root222.248.12.2111814991sT  -q) ossec13001g"Exim Auth failed2025-04-08 18:51:15 dovecot_login authenticator failed for pool-108-18-206-153.washdc.fios.verizon.net [108.18.206.153]:58649: 535 Incorrect authentication data (set_id=purchase)108.18.206.1536252001mS  -e) ossec13001g"Exim Auth failed2025-04-08 18:51:03 dovecot_login authenticator failed for ([218.150.170.10]) [218.150.170.10]:55568: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)218.150.170.101835841:R  =o) ossec13008g gMail Reciepient rejected2025-04-08 18:41:02 H=(mail.msnews24.in) [165.154.228.93]:65517 F= rejected RCPT : Rejected relay attempt: '165.154.228.93' From: 'xsxrkwpdi@msnews24.in' To: 'validxxx@gmailhotmail.com.br'165.154.228.931643084cQ  -S' ossec13001g0Exim Auth failed2025-04-08 18:27:19 dovecot_login authenticator failed for ([49.124.153.13]) [49.124.153.13]:46574: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)49.124.153.131733045 % %  6 Nvl"f)o 3U) ossec11301gINew FTP connection.Apr 8 21:37:30 vm1 pure-ftpd[2433968]: (?@104.234.115.81) [INFO] New connection from 104.234.115.81104.234.115.8162519996n  =g) ossec13008gHMail Reciepient rejected2025-04-08 21:30:15 H=(mail.msnews24.in) [165.154.247.20]:64644 F= rejected RCPT : Rejected relay attempt: '165.154.247.20' From: 'mzmuczk@msnews24.in' To: 'validxxx@gmailhotmail.com.br'165.154.247.201605651~m  Ua' ossec11001gGDeferred login on the cpanel service[2025-04-08 21:29:00 +0530] info [webmaild] 157.38.72.102 - kps@amplifypowerglobal.com "POST /cpsess0555876652/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [157.38.96.122] != Current IP Address [157.38.72.102]157.38.72.1021269750~l  Ua' ossec11001g@Deferred login on the cpanel service[2025-04-08 20:57:57 +0530] info [webmaild] 157.38.96.122 - kps@amplifypowerglobal.com "POST /cpsess9022833862/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [157.38.111.41] != Current IP Address [157.38.96.122]157.38.96.1221269750Zk  -?) ossec13001g?Exim Auth failed2025-04-08 20:54:41 dovecot_login authenticator failed for ([218.150.170.10]) [218.150.170.10]:55808: 535 Incorrect authentication data (set_id=purchase)218.150.170.101835841fj  -]% ossec13001g?Exim Auth failed2025-04-08 20:54:22 dovecot_login authenticator failed for ([37.57.69.227]) [37.57.69.227]:43164: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)37.57.69.227690791i  -' ossec13001g?Exim Auth failed2025-04-08 20:54:15 dovecot_login authenticator failed for wsip-70-166-207-76.ph.ph.cox.net (wsip-70-166-207-65.ph.ph.cox.net) [70.166.207.76]:53662: 535 Incorrect authentication data (set_id=sales)70.166.207.766252001Th  -5' ossec13001g?Exim Auth failed2025-04-08 20:54:02 dovecot_login authenticator failed for ([27.40.100.203]) [27.40.100.203]:58254: 535 Incorrect authentication data (set_id=sales)27.40.100.2031814991dg  -W% ossec13001g?uExim Auth failed2025-04-08 20:53:33 dovecot_login authenticator failed for ([102.90.34.90]) [102.90.34.90]:59874: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)102.90.34.902328926Nf  --# ossec13001g8Exim Auth failed2025-04-08 20:25:34 dovecot_login authenticator failed for ([59.46.26.98]) [59.46.26.98]:63460: 535 Incorrect authentication data (set_id=sales)59.46.26.981814991ce  -U% ossec13001g8Exim Auth failed2025-04-08 20:25:19 dovecot_login authenticator failed for ([8.243.166.66]) [8.243.166.66]:4501: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)8.243.166.6636861102d  =_) ossec13008g8Mail Reciepient rejected2025-04-08 20:22:05 H=(hostglobal.plus) [78.153.140.207]:34700 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no F= rejected RCPT : SMTP AUTH is required for message submission on port 46578.153.140.2072635167kc  -e% ossec13001g7Exim Auth failed2025-04-08 20:19:58 dovecot_login authenticator failed for agencijaiiz1-155.bih.net.ba [80.65.90.155]:38896: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)80.65.90.1553277605 b  -%) ossec13001g7Exim Auth failed2025-04-08 20:19:46 dovecot_login authenticator failed for h-213-136-52-219.a1663.priv.bahnhof.se [213.136.52.219]:48544: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)213.136.52.2192661886Wa  -9) ossec13001g7Exim Auth failed2025-04-08 20:17:52 dovecot_login authenticator failed for ([103.115.31.219]) [103.115.31.219]:36678: 535 Incorrect authentication data (set_id=sales)103.115.31.2191643084   (=42D`m  -e) ossec13001gs Exim Auth failed2025-04-09 00:34:00 dovecot_login authenticator failed for ([218.92.201.232]) [218.92.201.226]:11087: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)218.92.201.2261814991F~  = % ossec13008gmYMail Reciepient rejected2025-04-09 00:09:20 H=static-185-95-84-71.sunucuhub.com [185.95.84.71]:47462 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no F= rejected RCPT : SMTP AUTH is required for message submission on port 465185.95.84.71298795}  ?1 ossec1008glbProcess exiting (killed).Apr 9 00:05:12 vm1 spamd[2147426]: spamd: server killed by SIGTERM, shutting down`|  -O% ossec13001gkExim Auth failed2025-04-09 00:01:32 dovecot_login authenticator failed for 221-120-40-2.emome-ip.hinet.net [221.120.40.2]:63822: 535 Incorrect authentication data (set_id=sales)221.120.40.21668284j{  -_) ossec13001gkvExim Auth failed2025-04-09 00:01:18 dovecot_login authenticator failed for ([36.135.125.196]) [36.135.125.196]:59416: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)36.135.125.1961814991~z  - ' ossec13001ghcExim Auth failed2025-04-08 23:48:10 dovecot_login authenticator failed for (50-110-19-211.adr01.chtn.wv.ip.frontiernet.net) [50.110.19.211]:56120: 535 Incorrect authentication data (set_id=vikas.khandelwal)50.110.19.2116252001y  -' ossec13001ghMExim Auth failed2025-04-08 23:47:48 dovecot_login authenticator failed for 041.148.48.116.static.netvigator.com [116.48.148.41]:50283: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)116.48.148.411819730(x  3U) ossec11301g_New FTP connection.Apr 8 23:12:07 vm1 pure-ftpd[2455404]: (?@147.185.132.25) [INFO] New connection from 147.185.132.25147.185.132.256252001;w  =o+ ossec13008gZXMail Reciepient rejected2025-04-08 22:48:14 H=(mail.msnews24.in) [165.154.232.243]:53515 F= rejected RCPT : Rejected relay attempt: '165.154.232.243' From: 'qahiypmt@msnews24.in' To: 'validxxx@gmailhotmail.com.br'165.154.232.2431605651Wv  -9) ossec13001gYExim Auth failed2025-04-08 22:45:43 dovecot_login authenticator failed for ([92.126.223.175]) [92.126.223.175]:43788: 535 Incorrect authentication data (set_id=sales)92.126.223.1752017370Yu  -?' ossec13001gYExim Auth failed2025-04-08 22:45:36 dovecot_login authenticator failed for mail.toptronicsinc.com [218.4.156.254]:43559: 535 Incorrect authentication data (set_id=sales)218.4.156.2541814991ot  -i) ossec13001gYExim Auth failed2025-04-08 22:45:22 dovecot_login authenticator failed for (h90.msk-0.maverick.ru) [185.238.200.90]:33668: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)185.238.200.902017370gs  -[' ossec13001gYExim Auth failed2025-04-08 22:45:21 dovecot_login authenticator failed for ([59.37.169.160]) [59.37.169.160]:43056: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)59.37.169.1601814991mr  -e) ossec13001gX1Exim Auth failed2025-04-08 22:39:04 dovecot_login authenticator failed for ([220.93.167.144]) [220.93.167.144]:43590: 535 Incorrect authentication data (set_id=services@heipowersystem.com)220.93.167.1441835841 rejected RCPT : Rejected relay attempt: '165.154.210.52' From: 'smnrhriind@msnews24.in' To: 'validxxx@gmailhotmail.com.br'165.154.210.521694008 p  [y' ossec12004gNPossible Dovecot CVE-2019-11500 attemptApr 8 21:59:18 vm1 dovecot[1526]: imap-login: Disconnected: Input buffer full (no auth attempts in 1 secs): user=<>, rip=18.189.22.234, lip=103.74.54.108, session=18.189.22.2346252001  vi\OB5(reXK>1$ { n a T G : -   w j ] P C 6 )    s f Y L ? 2 %  | o b U H ; . !   x k ^ Q D 7 *  174982K 1814991 1814991 1814991 1814991j 18149919 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991~ 1814991u 1814991Q 1814991 1814991 1814991, 1814991+ 1814991& 1814991% 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991} 1814991z 1814991o 1814991n 1814991m 1814991l 1814991i 1814991h 1814991e 1814991d 1814991Z 1814991Y 1814991X 1814991W 1814991V 1814991U 1814991L 1814991J 1814991I 1814991H 1814991G 1814991F 1814991D 1814991C 1814991A 1814991) 1814991( 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991 1814991y 1814991p 1814991f 1814991X 1749826 %( M \ d ,AfFUf]  -E) ossec13001gIExim Auth failed2025-04-09 02:21:19 dovecot_login authenticator failed for (client.fttb.2day.kz) [176.222.190.70]:51288: 535 Incorrect authentication data (set_id=services)176.222.190.701522867k  -a) ossec13001g5Exim Auth failed2025-04-09 02:21:01 dovecot_login authenticator failed for (182.239.78.124.hk.chinamobile.com) [182.239.78.124]:46052: 535 Incorrect authentication data (set_id=services)182.239.78.1241819730m  -e) ossec13001g%Exim Auth failed2025-04-09 02:20:43 dovecot_login authenticator failed for ([113.108.88.121]) [113.108.88.121]:45452: 535 Incorrect authentication data (set_id=services@heipowersystem.com)113.108.88.12118149919  =m) ossec13008g}iMail Reciepient rejected2025-04-09 01:17:53 H=(hostglobal.plus) [78.153.140.207]:48168 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no F=<0shInIbn@s2seducationtrust.com> rejected RCPT : SMTP AUTH is required for message submission on port 46578.153.140.20726351679  =m) ossec13008g}Mail Reciepient rejected2025-04-09 01:16:23 H=(hostglobal.plus) [78.153.140.207]:52824 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no F= rejected RCPT : SMTP AUTH is required for message submission on port 46578.153.140.2072635167"  3M% ossec11301gyNew FTP connection.Apr 9 01:02:01 vm1 pure-ftpd[2482295]: (?@20.64.105.91) [INFO] New connection from 20.64.105.9120.64.105.916252001W  -9) ossec13001gxExim Auth failed2025-04-09 00:56:58 dovecot_login authenticator failed for ([112.172.189.90]) [112.172.189.90]:45826: 535 Incorrect authentication data (set_id=sales)112.172.189.901835841g  -]% ossec13001gxvExim Auth failed2025-04-09 00:56:45 dovecot_login authenticator failed for ([114.242.175.187]) [36.112.75.46]:20582: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)36.112.75.461814991N au' ossec5710gvAttempt to login using a non-existent userApr 9 00:49:32 vm1 sshd[2479604]: Failed password for invalid user sragvibhushan from 115.246.99.44 port 32974 ssh2115.246.99.441269750T E' ossec2501gvUser authentication failure.Apr 9 00:49:31 vm1 sshd[2479604]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=115.246.99.44115.246.99.441269750(  CI' ossec5716gvSSHD authentication failed.Apr 9 00:49:17 vm1 sshd[2479558]: Failed password for root from 115.246.99.44 port 55006 ssh2115.246.99.441269750^  E3' ossec2501gvUser authentication failure.Apr 9 00:49:15 vm1 sshd[2479558]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=115.246.99.44 user=root115.246.99.441269750t  -q+ ossec13001gvwExim Auth failed2025-04-09 00:48:15 dovecot_login authenticator failed for (203.173.209.139.adsl-pool.jlccptt.net.cn) [139.209.173.203]:63610: 535 Incorrect authentication data (set_id=purchase)139.209.173.2031814991m  -e) ossec13001gviExim Auth failed2025-04-09 00:48:01 dovecot_login authenticator failed for ([220.77.245.227]) [220.77.245.227]:41914: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)220.77.245.2271835841W  -9) ossec13001gsExim Auth failed2025-04-09 00:37:00 dovecot_login authenticator failed for ([27.212.156.152]) [27.212.156.152]:49422: 535 Incorrect authentication data (set_id=sales)27.212.156.1521814991y  -}) ossec13001gsExim Auth failed2025-04-09 00:36:50 dovecot_login authenticator failed for (173-20-253-109.client.mchsi.com) [173.20.253.109]:42896: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)173.20.253.1096252001W  -;' ossec13001gs*Exim Auth failed2025-04-09 00:34:10 dovecot_login authenticator failed for ([103.183.11.30]) [103.183.11.30]:51762: 535 Incorrect authentication data (set_id=purchase)103.183.11.301643084 j U n0LQ?b  -O) ossec13001gExim Auth failed2025-04-09 03:30:36 dovecot_login authenticator failed for ([180.173.51.183]) [180.173.51.183]:58337: 535 Incorrect authentication data (set_id=vikas.khandelwal)180.173.51.1831814991:  =o) ossec13008gMail Reciepient rejected2025-04-09 03:18:36 H=(hostglobal.plus) [78.153.140.207]:44692 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no F= rejected RCPT : SMTP AUTH is required for message submission on port 46578.153.140.2072635167:  =o) ossec13008gTMail Reciepient rejected2025-04-09 03:16:58 H=(hostglobal.plus) [78.153.140.207]:32910 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no F= rejected RCPT : SMTP AUTH is required for message submission on port 46578.153.140.2072635167  -+% ossec13001g0Exim Auth failed2025-04-09 03:12:08 dovecot_login authenticator failed for net-2-32-137-250.cust.vodafonedsl.it (net-2-32-137-250.cust.dsl.teletu.it) [2.32.137.250]:34013: 535 Incorrect authentication data (set_id=purchase)2.32.137.2503175395w  -{' ossec13001gExim Auth failed2025-04-09 03:11:48 dovecot_login authenticator failed for p7001156-ipoefx.ipoe.ocn.ne.jp [118.3.227.155]:41208: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)118.3.227.1551861060`  -U! ossec13001gExim Auth failed2025-04-09 03:11:35 dovecot_login authenticator failed for ([5.32.32.14]) [5.32.32.14]:43397: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)5.32.32.14290557:  =o) ossec13008gMail Reciepient rejected2025-04-09 03:05:35 H=(mail.msnews24.in) [165.154.228.93]:64025 F= rejected RCPT : Rejected relay attempt: '165.154.228.93' From: 'vaqpdxklo@msnews24.in' To: 'validxxx@gmailhotmail.com.br'165.154.228.9316430847  =k' ossec13008g}Mail Reciepient rejected2025-04-09 02:52:04 H=(mail.msnews24.in) [45.197.14.138]:53290 F= rejected RCPT : Rejected relay attempt: '45.197.14.138' From: 'hquwqoyjz@msnews24.in' To: 'validxxx@gmailhotmail.com.br'45.197.14.1386252001(  3U) ossec11301gNew FTP connection.Apr 9 02:45:17 vm1 pure-ftpd[2504650]: (?@45.227.254.155) [INFO] New connection from 45.227.254.15545.227.254.15537034304 a=+ ossec5710gAttempt to login using a non-existent userApr 9 02:28:02 vm1 sshd[2500912]: Invalid user wuzhende from 112.254.162.240 port 50568112.254.162.2401814991,  CM+ ossec5716gSSHD authentication failed.Apr 9 02:27:47 vm1 sshd[2500819]: Failed password for root from 112.254.162.240 port 49774 ssh2112.254.162.2401814991c E7+ ossec2501gUser authentication failure.Apr 9 02:27:45 vm1 sshd[2500819]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=112.254.162.240 user=root112.254.162.2401814991j  -_) ossec13001gExim Auth failed2025-04-09 02:27:22 dovecot_login authenticator failed for ([39.152.114.206]) [39.152.114.206]:24718: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)39.152.114.2061814991T  -5' ossec13001gExim Auth failed2025-04-09 02:27:35 dovecot_login authenticator failed for ([82.208.71.101]) [82.208.71.101]:59692: 535 Incorrect authentication data (set_id=sales)82.208.71.1012017370,  CM+ ossec5716gSSHD authentication failed.Apr 9 02:27:29 vm1 sshd[2500794]: Failed password for root from 112.254.162.240 port 48972 ssh2112.254.162.2401814991b  E7+ ossec2501gUser authentication failure.Apr 9 02:27:27 vm1 sshd[2500794]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=112.254.162.240 user=root112.254.162.2401814991   r/  QM' ossec11000gLogin failed on the cpanel service[2025-04-09 04:05:08 +0530] info [whostmgrd] 104.207.57.79 - heipowersystem "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect104.207.57.796252001m.  Q?+ ossec11000gLogin failed on the cpanel service[2025-04-09 04:05:06 +0530] info [whostmgrd] 156.228.106.192 - admin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect156.228.106.1926252001i- Q9' ossec11000gLogin failed on the cpanel service[2025-04-09 04:05:03 +0530] info [whostmgrd] 104.207.42.45 - user "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect104.207.42.456252001j,  Q;) ossec11000gLogin failed on the cpanel service[2025-04-09 04:05:02 +0530] info [whostmgrd] 104.207.49.124 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect104.207.49.1246252001+  Qg) ossec11000gLogin failed on the cpanel service[2025-04-09 04:04:48 +0530] info [cpaneld] 156.228.79.159 - user "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user user (has_cpuser_file failed)156.228.79.1596252001 *  Qy+ ossec11000gLogin failed on the cpanel service[2025-04-09 04:04:46 +0530] info [cpaneld] 156.228.112.242 - heipowe2 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipowe2 (has_cpuser_file failed)156.228.112.2426252001o)  QC+ ossec11000gLogin failed on the cpanel service[2025-04-09 04:05:23 +0530] info [whostmgrd] 156.228.100.146 - heipowe "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect156.228.100.1466252001(  Qi+ ossec11000gLogin failed on the cpanel service[2025-04-09 04:04:38 +0530] info [cpaneld] 156.228.100.170 - user "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user user (has_cpuser_file failed)156.228.100.1706252001'  Qw) ossec11000gLogin failed on the cpanel service[2025-04-09 04:04:44 +0530] info [cpaneld] 104.207.32.169 - heipowe1 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipowe1 (has_cpuser_file failed)104.207.32.1696252001&  Qu' ossec11000gLogin failed on the cpanel service[2025-04-09 04:04:44 +0530] info [cpaneld] 104.207.38.82 - heipower "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipower (has_cpuser_file failed)104.207.38.826252001%  Q) ossec11000gLogin failed on the cpanel service[2025-04-09 04:04:41 +0530] info [cpaneld] 104.207.33.149 - heipowersystem "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipowersystem (has_cpuser_file failed)104.207.33.1496252001$  Q+ ossec11000gLogin failed on the cpanel service[2025-04-09 04:04:42 +0530] info [cpaneld] 156.228.113.128 - heipowersystemcom "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipowersystemcom (has_cpuser_file failed)156.228.113.1286252001#  Qk) ossec11000gLogin failed on the cpanel service[2025-04-09 04:04:39 +0530] info [cpaneld] 156.228.119.99 - admin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)156.228.119.996252001s"  -u% ossec13001g.Exim Auth failed2025-04-09 03:46:13 dovecot_login authenticator failed for ([222.180.2.62]) [222.180.2.62]:59690: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)222.180.2.621814991l!  -i# ossec13001ggExim Auth failed2025-04-09 03:30:06 dovecot_login authenticator failed for ([36.39.140.2]) [36.39.140.2]:51104: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)36.39.140.21835841    ' ; KZovY?  -?) ossec13001gfExim Auth failed2025-04-09 06:03:41 dovecot_login authenticator failed for ([80.227.102.242]) [80.227.102.242]:60975: 535 Incorrect authentication data (set_id=purchase)80.227.102.242290557Z>  -?) ossec13001gVExim Auth failed2025-04-09 06:03:25 dovecot_login authenticator failed for ([103.203.210.22]) [103.203.210.22]:60104: 535 Incorrect authentication data (set_id=services)103.203.210.221269750=  -% ossec13001gHExim Auth failed2025-04-09 06:03:12 dovecot_login authenticator failed for laubervilliers-657-1-93-158.w80-14.abo.wanadoo.fr [80.14.31.158]:59183: 535 Incorrect authentication data (set_id=services@heipowersystem.com)80.14.31.1583017382~<  -) ossec13001g.Exim Auth failed2025-04-09 06:02:45 dovecot_login authenticator failed for 171-100-245-37.static.asianet.co.th [171.100.245.37]:49249: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)171.100.245.371605651T;  -5' ossec13001gExim Auth failed2025-04-09 05:34:51 dovecot_login authenticator failed for ([61.165.18.212]) [61.165.18.212]:39844: 535 Incorrect authentication data (set_id=sales)61.165.18.2121814991j:  -_) ossec13001gExim Auth failed2025-04-09 05:34:29 dovecot_login authenticator failed for ([61.184.176.231]) [61.184.176.231]:60213: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)61.184.176.2311814991u9  -u) ossec13001glExim Auth failed2025-04-09 05:21:06 dovecot_login authenticator failed for ([221.209.48.204]) [221.209.48.203]:59204: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)221.209.48.2031814991g8  -[' ossec13001gExim Auth failed2025-04-09 04:19:41 dovecot_login authenticator failed for ([124.228.32.34]) [124.228.32.34]:36418: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)124.228.32.341814991m7  -c+ ossec13001gExim Auth failed2025-04-09 04:18:59 dovecot_login authenticator failed for ([119.207.156.209]) [119.207.156.209]:25620: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)119.207.156.2091835841l6  -c) ossec13001g`Exim Auth failed2025-04-09 04:12:38 dovecot_login authenticator failed for ([223.84.248.209]) [223.84.248.209]:1045: 535 Incorrect authentication data (set_id=services@heipowersystem.com)223.84.248.2091814991h5  Q9' ossec11000gLogin failed on the cpanel service[2025-04-09 04:05:26 +0530] info [whostmgrd] 156.228.85.53 - user "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect156.228.85.536252001n4  QC) ossec11000gLogin failed on the cpanel service[2025-04-09 04:05:09 +0530] info [whostmgrd] 104.207.62.147 - heipower "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect104.207.62.1476252001w3  QU) ossec11000gLogin failed on the cpanel service[2025-04-09 04:05:09 +0530] info [whostmgrd] 156.228.87.153 - heipowersystemcom "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect156.228.87.15362520012  Qs) ossec11000gLogin failed on the cpanel service[2025-04-09 04:04:46 +0530] info [cpaneld] 156.228.112.59 - heipowe "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipowe (has_cpuser_file failed)156.228.112.596252001l1  Q=+ ossec11000gLogin failed on the cpanel service[2025-04-09 04:05:27 +0530] info [whostmgrd] 156.228.104.235 - user "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect156.228.104.2356252001n0  QC) ossec11000gLogin failed on the cpanel service[2025-04-09 04:05:19 +0530] info [whostmgrd] 156.228.78.102 - heipowe2 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect156.228.78.1026252001 & > c ' " J=XhO  - + ossec13001gExim Auth failed2025-04-09 09:30:42 dovecot_login authenticator failed for (static-97.224.143.114-tataidc.co.in) [182.156.133.169]:26303: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)182.156.133.1691269750jN  -a' ossec13001gExim Auth failed2025-04-09 08:30:09 dovecot_login authenticator failed for (heipowersystem.com) [221.229.216.1]:52942: 535 Incorrect authentication data (set_id=admin@heipowersystem.com)221.229.216.11814991YM  -?' ossec13001gExim Auth failed2025-04-09 08:29:42 dovecot_login authenticator failed for (heipowersystem.com) [221.229.216.1]:50842: 535 Incorrect authentication data (set_id=nologin)221.229.216.118149915L  _)1modsec77350470g!IM360 WAF: Vulnerability scanner detectedIM360 WAF: Vulnerability scanner detected||RSV:6.83||RS:0||T:APACHE||147.185.132.246252001vm1.technobases.inlK  -a+ ossec13001g[Exim Auth failed2025-04-09 08:02:58 dovecot_login authenticator failed for (pool-192-188-123-181.telecel.com.py) [181.123.188.192]:47424: 535 Incorrect authentication data (set_id=sales)181.123.188.1923437598aJ  -S# ossec13001g;Exim Auth failed2025-04-09 08:02:27 dovecot_login authenticator failed for ([36.7.111.87]) [36.7.111.87]:46210: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)36.7.111.871814991WI  -;' ossec13001gڽExim Auth failed2025-04-09 07:56:04 dovecot_login authenticator failed for ([92.100.72.140]) [92.100.72.140]:40144: 535 Incorrect authentication data (set_id=services)92.100.72.1402017370lH  -c) ossec13001gڥExim Auth failed2025-04-09 07:55:39 dovecot_login authenticator failed for ([216.194.174.27]) [216.194.174.27]:1633: 535 Incorrect authentication data (set_id=services@heipowersystem.com)216.194.174.276252001>G  =w) ossec13008gMail Reciepient rejected2025-04-09 07:26:49 H=(mail.msnews24.in) [165.154.210.99]:54465 F= rejected RCPT : Rejected relay attempt: '165.154.210.99' From: 'qmhpsrhsnwz@msnews24.in' To: 'validxxx@gmailhotmail.com.br'165.154.210.991694008TF  -7' ossec13001gExim Auth failed2025-04-09 07:26:25 dovecot_login authenticator failed for ([196.191.212.226]) [213.55.85.202]:2184: 535 Incorrect authentication data (set_id=sales)213.55.85.202337996E  -' ossec13001gӽExim Auth failed2025-04-09 07:26:13 dovecot_login authenticator failed for (190142265.ip3.static.mediacommerce.com.co) [200.91.234.36]:42108: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)200.91.234.3636861108D  =q% ossec13008gvMail Reciepient rejected2025-04-09 07:16:28 H=static-185-95-84-71.sunucuhub.com [185.95.84.71]:41294 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no F= rejected RCPT : SMTP AUTH is required for message submission on port 465185.95.84.71298795WC  -;' ossec13001gȖExim Auth failed2025-04-09 06:38:37 dovecot_login authenticator failed for ([103.47.74.210]) [103.47.74.210]:56922: 535 Incorrect authentication data (set_id=purchase)103.47.74.2101269750dB  -Y# ossec13001gȌExim Auth failed2025-04-09 06:38:28 dovecot_login authenticator failed for ([62.148.6.46]) [62.148.6.46]:45903: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)62.148.6.462017370fA  -W) ossec13001gExim Auth failed2025-04-09 06:10:10 dovecot_login authenticator failed for (201.173.238.25-clientes-izzi.mx) [201.173.238.25]:44958: 535 Incorrect authentication data (set_id=sales)201.173.238.253996063l@  -g% ossec13001gExim Auth failed2025-04-09 06:09:52 dovecot_login authenticator failed for 200.19.70.86.rev.sfr.net [86.70.19.200]:51850: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)86.70.19.2003017382 *\~tj`VLB8.$zpf\H>4*   v l b X N D : 0 &    ~ t j ` V L B 8 . $    z p f \ R H > 4 *  bvlXND:0&|rh^TJ@6,"nxdZPF<2( ~tj`VLB8.$zpf\ | r h ^ T J @ 6 , "    x n d Z P F < 2 (   RRH>4*  vlbXND:0& g= g= gZ= gX= gW= g = g = g= g= g= g= g= g= gY= gi= g1= g%= g= g= g= gk= g= g = g= g= g = g"= g= g;= g5= g= g = g= gz= gz= guO= guA= gq*= gp= gpw= gn= gn= gnY= gnE= gnE= gmN= gj= gjn= ga'= g` = g_= g]= gZ.= gX = gX!= gTX= gTH= gJ= gI= gI= gH = gH= gE= gE= gD2= gD = gD = g== g== g== g== g==~ g==} g9=| g9={ g/=z g,x=y g,^=x g,\=w g+c=v g+Q=u g$W=t g#=s g#{=r g#m=q g=p g=o g=n g=m gf=l gd=k gR=j gF=i gD=h g=g g =f g =e g=d g 8=c g &=b g=a g=` g=_ gf=^ g=] gn=\ gZ=[ g=Z g=Y g=X g=W g=V g=U g=T g=S g=R g=Q g=P g=O g=N g=M g!=L g[=K g;=J gڽ=I gڥ=H g=G g=F gӽ=E gv=D gȖ=C gȌ=B g=A g=@ gf=? gV=> gH== g.=< g=; g=: gl=9 g=8 g=7 g`=6 g=1 g=5 g=) g=0 g=4 g=3 g=/ g=. g=- g=, g=+ g=2 g=* g=' g=& g=% g=$ g=# g=( g.=" g= gg=! g= gT= g0= g= gC= g,= g= g= g= g= g= g= g = g= g= g= gy= g= g= g= g= g}= g= g= g?= g3= gP= gy= gY= g= g= gf= gR= g>= g2= g= g= g= g = gY= g= g= g= g= g= g= g= g= g= g}= g= g= g= g= g= g= g= g= gI= g5= g%= g}i= g}= gy= gx= gxv= gv= gv= gv= gv= gvw= gvi= gs= gs= gs*= gs < gmY< glb< gk< gkv< ghc< ghM< g_< gZX< gY< gY< gY< gY< gX1< gg= gTh< gN< gI< gH< gG< g@< g?< g?< g?< g?< g?u< g8< g8< g8< g7< g7< g7< g7< g2< g2v< g.i< g+,< g*l< g%.< g%"< g%< g$< g$< g$< g"< g"< g g< g0< g"< g< g< g < g< g< g< g< gK< %7 \ q  P"8^Za  -?) ossec13001gExim Auth failed2025-04-09 11:08:39 dovecot_login authenticator failed for ([116.114.84.242]) [116.114.84.242]:53894: 535 Incorrect authentication data (set_id=purchase)116.114.84.2421814991V`  -;' ossec13001gExim Auth failed2025-04-09 11:08:15 dovecot_login authenticator failed for ([91.72.171.210]) [91.72.171.210]:38672: 535 Incorrect authentication data (set_id=purchase)91.72.171.210290557f_  -]% ossec13001gExim Auth failed2025-04-09 11:07:22 dovecot_login authenticator failed for ([91.222.80.77]) [91.222.80.77]:53375: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)91.222.80.77690791]^  -C+ ossec13001gfExim Auth failed2025-04-09 10:58:05 dovecot_login authenticator failed for ([116.127.143.140]) [116.127.143.140]:58233: 535 Incorrect authentication data (set_id=purchase)116.127.143.1401835841_]  -K' ossec13001gExim Auth failed2025-04-09 10:58:33 dovecot_login authenticator failed for ([114.221.2.199]) [114.221.2.199]:38607: 535 Incorrect authentication data (set_id=vikas.khandelwal)114.221.2.1991814991x\  -y+ ossec13001gnExim Auth failed2025-04-09 10:58:12 dovecot_login authenticator failed for ([180.104.115.210]) [180.104.115.210]:49258: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)180.104.115.2101814991[  -E' ossec13001gZExim Auth failed2025-04-09 10:57:53 dovecot_login authenticator failed for 69-172-79-198.static.imsbiz.com (173-248-234-145.static.imsbiz.com) [69.172.79.198]:52757: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)69.172.79.1981819730(Z  3U) ossec11301gNew FTP connection.Apr 9 10:01:12 vm1 pure-ftpd[2596693]: (?@167.94.138.192) [INFO] New connection from 167.94.138.192167.94.138.1926252001SY  E' ossec2501gUser authentication failure.Apr 9 09:59:15 vm1 sshd[2596023]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=210.62.203.50210.62.203.501668284GX ag' ossec5710gAttempt to login using a non-existent userApr 9 09:59:00 vm1 sshd[2595946]: Failed password for invalid user deploy from 210.62.203.50 port 50638 ssh2210.62.203.501668284-W  a5' ossec5710gAttempt to login using a non-existent userApr 9 09:58:58 vm1 sshd[2595946]: Invalid user deploy from 210.62.203.50 port 50638210.62.203.501668284_V E3' ossec2501gUser authentication failure.Apr 9 09:58:46 vm1 sshd[2595881]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=210.62.203.50 user=root210.62.203.501668284(U  CI' ossec5716gSSHD authentication failed.Apr 9 09:58:47 vm1 sshd[2595881]: Failed password for root from 210.62.203.50 port 32878 ssh2210.62.203.501668284]T  -I' ossec13001gExim Auth failed2025-04-09 09:55:20 dovecot_login authenticator failed for (82.193.122.91.cl.ipnet.ua) [82.193.122.91]:55537: 535 Incorrect authentication data (set_id=sales)82.193.122.91690791gS  -[' ossec13001gExim Auth failed2025-04-09 09:55:00 dovecot_login authenticator failed for ([77.211.31.222]) [77.211.31.222]:40988: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)77.211.31.2222510769WR  -;' ossec13001gExim Auth failed2025-04-09 09:48:36 dovecot_login authenticator failed for ([27.45.235.201]) [27.45.235.201]:45372: 535 Incorrect authentication data (set_id=services)27.45.235.2011814991jQ  -a' ossec13001gExim Auth failed2025-04-09 09:48:22 dovecot_login authenticator failed for ([120.55.170.138]) [116.30.136.35]:8954: 535 Incorrect authentication data (set_id=services@heipowersystem.com)116.30.136.351814991WP  -;' ossec13001gExim Auth failed2025-04-09 09:30:53 dovecot_login authenticator failed for ([61.136.142.13]) [61.136.142.13]:27420: 535 Incorrect authentication data (set_id=purchase)61.136.142.131814991 ^  f oQJTqU^sr  -o+ ossec13001g#{Exim Auth failed2025-04-09 13:06:26 dovecot_login authenticator failed for pc-202-202-120-200.cm.vtr.net [200.120.202.202]:36548: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)200.120.202.2023895114q  -;) ossec13001g#mExim Auth failed2025-04-09 13:06:13 dovecot_login authenticator failed for (47-189-156-222.fdr02.plan.tx.ip.frontiernet.net) [47.189.156.222]:36688: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)47.189.156.2226252001_p  -K' ossec13001gExim Auth failed2025-04-09 12:50:40 dovecot_login authenticator failed for ([115.88.121.73]) [115.88.121.73]:59769: 535 Incorrect authentication data (set_id=vikas.khandelwal)115.88.121.731835841ro  -q' ossec13001gExim Auth failed2025-04-09 12:50:20 dovecot_login authenticator failed for ([95.221.179.61]) [95.221.179.61]:59940: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)95.221.179.612017370n  =) ossec13008gMail Reciepient rejected2025-04-09 12:50:16 H=([45.144.212.207]) [45.144.212.207]:50083 F= rejected RCPT : SMTP AUTH is required for message submission on port 58745.144.212.207690791m  W' ossec9708gDovecot Aborted Login with empty userApr 9 12:43:06 vm1 dovecot[1526]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=87.236.176.84, lip=103.74.54.108, TLS, session=87.236.176.842635167*l  CK) ossec5716gfSSHD authentication failed.Apr 9 12:19:08 vm1 sshd[2626175]: Failed password for root from 223.171.90.190 port 33152 ssh2223.171.90.1901835841`k  E5) ossec2501gdUser authentication failure.Apr 9 12:19:06 vm1 sshd[2626175]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=223.171.90.190 user=root223.171.90.1901835841Nj as) ossec5710gRAttempt to login using a non-existent userApr 9 12:18:50 vm1 sshd[2626130]: Failed password for invalid user zhanghongfu from 223.171.90.190 port 60500 ssh2223.171.90.1901835841*i  CK) ossec5716gFSSHD authentication failed.Apr 9 12:18:37 vm1 sshd[2626116]: Failed password for root from 223.171.90.190 port 59610 ssh2223.171.90.1901835841ah E5) ossec2501gDUser authentication failure.Apr 9 12:18:35 vm1 sshd[2626116]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=223.171.90.190 user=root223.171.90.1901835841(g  3U) ossec11301gNew FTP connection.Apr 9 12:17:41 vm1 pure-ftpd[2625963]: (?@147.185.132.78) [INFO] New connection from 147.185.132.78147.185.132.786252001Zf  -=+ ossec13001g Exim Auth failed2025-04-09 11:48:07 dovecot_login authenticator failed for ([111.194.239.233]) [111.194.239.233]:36384: 535 Incorrect authentication data (set_id=sales)111.194.239.2331814991ye  -% ossec13001g Exim Auth failed2025-04-09 11:47:46 dovecot_login authenticator failed for 48.211.41.34.bc.googleusercontent.com [34.41.211.48]:52620: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)34.41.211.486252001/d  =[' ossec13008gMail Reciepient rejected2025-04-09 11:42:25 H=(mail.msnews24.in) [45.197.14.138]:50553 F= rejected RCPT : Rejected relay attempt: '45.197.14.138' From: 'riorb@msnews24.in' To: 'validxxx@gmailhotmail.com.br'45.197.14.1386252001cc  -S' ossec13001g 8Exim Auth failed2025-04-09 11:14:23 dovecot_login authenticator failed for ([49.124.151.57]) [49.124.151.57]:51322: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)49.124.151.571733045ub  -y' ossec13001g &Exim Auth failed2025-04-09 11:14:06 dovecot_login authenticator failed for ([185.167.59.53]) [185.167.59.53]:42538: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)185.167.59.53617790 [T8 J l (0:L[m  -e) ossec13001gD Exim Auth failed2025-04-09 15:25:22 dovecot_login authenticator failed for ([67.213.230.122]) [67.213.230.122]:52436: 535 Incorrect authentication data (set_id=services@heipowersystem.com)67.213.230.1226252001j  -a' ossec13001g=Exim Auth failed2025-04-09 14:58:25 dovecot_login authenticator failed for syn-074-218-095-154.biz.spectrum.com [74.218.95.154]:45065: 535 Incorrect authentication data (set_id=purchase)74.218.95.1546252001r  -u# ossec13001g=Exim Auth failed2025-04-09 14:58:24 dovecot_login authenticator failed for as007174.dynamic.ppp.asahi-net.or.jp [150.9.7.174]:49468: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)150.9.7.1741861060g  -]% ossec13001g=Exim Auth failed2025-04-09 14:58:21 dovecot_login authenticator failed for net-2-32-137-250.cust.dsl.teletu.it [2.32.137.250]:54880: 535 Incorrect authentication data (set_id=purchase)2.32.137.2503175395f  -]% ossec13001g=Exim Auth failed2025-04-09 14:58:14 dovecot_login authenticator failed for ([94.200.20.66]) [94.200.20.66]:42206: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)94.200.20.66290557 ~  -+ ossec13001g=Exim Auth failed2025-04-09 14:58:11 dovecot_login authenticator failed for 158.160.200.177.netflexisp.com.br [177.200.160.158]:33043: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)177.200.160.1583469034p}  -i+ ossec13001g=Exim Auth failed2025-04-09 14:57:58 dovecot_login authenticator failed for ([207.188.157.230]) [207.188.157.230]:62513: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)207.188.157.2302510769]|  -K# ossec13001g9Exim Auth failed2025-04-09 14:42:30 dovecot_login authenticator failed for ([177.215.153.215]) [189.56.0.19]:34379: 535 Incorrect authentication data (set_id=vikas.khandelwal)189.56.0.193469034{  -+ ossec13001g9Exim Auth failed2025-04-09 14:42:05 dovecot_login authenticator failed for 158.160.200.177.netflexisp.com.br [177.200.160.158]:27704: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)177.200.160.15834690342z  =_) ossec13008g/Mail Reciepient rejected2025-04-09 13:55:50 H=(mail.msnews24.in) [165.154.228.93]:49939 F= rejected RCPT : Rejected relay attempt: '165.154.228.93' From: 'pecwz@msnews24.in' To: 'validxxx@gmailhotmail.com.br'165.154.228.931643084,y a/) ossec5710g,xAttempt to login using a non-existent userApr 9 13:44:46 vm1 sshd[2644659]: Invalid user pi from 223.104.55.178 port 31849223.104.55.1781814991+x CK) ossec5716g,^SSHD authentication failed.Apr 9 13:44:20 vm1 sshd[2644596]: Failed password for root from 223.104.55.178 port 31847 ssh2223.104.55.1781814991aw E5) ossec2501g,\User authentication failure.Apr 9 13:44:19 vm1 sshd[2644596]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=223.104.55.178 user=root223.104.55.1781814991Zv  -=+ ossec13001g+cExim Auth failed2025-04-09 13:40:10 dovecot_login authenticator failed for ([103.120.116.162]) [103.120.116.162]:50608: 535 Incorrect authentication data (set_id=sales)103.120.116.1621168579ju  -_) ossec13001g+QExim Auth failed2025-04-09 13:39:52 dovecot_login authenticator failed for ([205.215.22.222]) [205.215.22.222]:57436: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)205.215.22.2221821275t  W% ossec9708g$WDovecot Aborted Login with empty userApr 9 13:10:05 vm1 dovecot[1526]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=71.6.134.234, lip=103.74.54.108, TLS, session=71.6.134.2346252001(s  3U) ossec11301g#New FTP connection.Apr 9 13:08:04 vm1 pure-ftpd[2636610]: (?@167.94.145.103) [INFO] New connection from 167.94.145.103167.94.145.1036252001  %  I q } Kqs  -q) ossec13001g_Exim Auth failed2025-04-09 17:24:19 dovecot_login authenticator failed for n11923628209.netvigator.com [119.236.28.209]:57226: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)119.236.28.2091819730"  3M% ossec11301g]New FTP connection.Apr 9 17:14:41 vm1 pure-ftpd[2690431]: (?@139.162.77.6) [INFO] New connection from 139.162.77.6139.162.77.61861060(  3U) ossec11301gZ.New FTP connection.Apr 9 16:59:49 vm1 pure-ftpd[2687107]: (?@104.152.52.110) [INFO] New connection from 104.152.52.110104.152.52.1106252001v  -y' ossec13001gX Exim Auth failed2025-04-09 16:50:42 dovecot_login authenticator failed for ([121.154.90.47]) [121.154.90.47]:43728: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)121.154.90.471835841s  -u% ossec13001gX!Exim Auth failed2025-04-09 16:51:05 dovecot_login authenticator failed for (90.pool90-173-78.static.orange.es) [90.173.78.90]:53999: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)90.173.78.902510769_  -K' ossec13001gTXExim Auth failed2025-04-09 16:34:56 dovecot_login authenticator failed for ([95.66.153.194]) [95.66.153.194]:46966: 535 Incorrect authentication data (set_id=vikas.khandelwal)95.66.153.1942017370r  -q' ossec13001gTHExim Auth failed2025-04-09 16:34:39 dovecot_login authenticator failed for ([114.242.61.19]) [114.242.61.35]:58860: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)114.242.61.351814991. U?' ossec11001gJDeferred login on the cpanel service[2025-04-09 15:51:18 +0530] info [webmaild] 49.36.188.123 - kps@amplifypowerglobal.com "POST /cpsess0555876652/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect49.36.188.1231269750. U?' ossec11001gIDeferred login on the cpanel service[2025-04-09 15:50:18 +0530] info [webmaild] 49.36.188.123 - kps@amplifypowerglobal.com "POST /cpsess0555876652/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect49.36.188.1231269750. U?' ossec11001gIDeferred login on the cpanel service[2025-04-09 15:49:18 +0530] info [webmaild] 49.36.188.123 - kps@amplifypowerglobal.com "POST /cpsess0555876652/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect49.36.188.1231269750p  -i+ ossec13001gH Exim Auth failed2025-04-09 15:42:23 dovecot_login authenticator failed for ([103.106.154.138]) [103.106.154.138]:43880: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)103.106.154.1381269750T  -7% ossec13001gHExim Auth failed2025-04-09 15:42:34 dovecot_login authenticator failed for ([124.216.0.10]) [124.216.0.10]:43408: 535 Incorrect authentication data (set_id=purchase)124.216.0.101835841R  -5' ossec13001gEExim Auth failed2025-04-09 15:32:30 dovecot_login authenticator failed for ([65.20.251.127]) [65.20.251.127]:58783: 535 Incorrect authentication data (set_id=sales)65.20.251.12799237  -) ossec13001gEExim Auth failed2025-04-09 15:32:07 dovecot_login authenticator failed for (59-102-188-188.nty.dynamic.tbcnet.net.tw) [59.102.188.188]:46696: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)59.102.188.1881668284d  -U' ossec13001gD2Exim Auth failed2025-04-09 15:26:00 dovecot_login authenticator failed for host-85-237-57-200.dsl.sura.ru [85.237.57.200]:41806: 535 Incorrect authentication data (set_id=services)85.237.57.2002017370o  -i) ossec13001gD Exim Auth failed2025-04-09 15:25:43 dovecot_login authenticator failed for (148-177-82-173-dedicated.multacom.com) [148.135.48.100]:60597: 535 Incorrect authentication data (set_id=services)148.135.48.1006252001 J}pcVI</"yl_RE8+~qdWJ=0# zm`SF9, v i \ O B 5 (     r e X K > 1 $  { n a T G : -   w j ] P C 6 )    s f Y L ? 2 %  |obUH;.!xk^QD7*tgZM@3& uh[NA4' ~qdWJ=0 1814991I 1814991I 1814991I 1814991I 1814991I 1814991I 1814991I 1814991I 1814991I 1814991I 1814991H 1814991H 1814991H 1814991H 1814991H 1814991H 1814991H 1814991H 1814991H 1814991H 1814991H 1814991H 1814991H 1814991H 1814991H 1814991H 1814991H 1814991H 1814991H~ 1814991H{ 1814991Hz 1814991Hl 1814991B 1814991B 1814991B 1814991B 1814991B| 1814991Bp 1814991Be 1814991B[ 1814991BW 1814991BV 1814991BT 1814991BS 1814991BA 1814991B; 1814991B9 1814991B8 1814991B# 1814991B 1814991B 1814991B 1814991B 1814991A 1814991A 1814991A 1814991A 1814991A 1814991A 1814991A 1814991A 1814991A 1814991A 1814991A 1814991A 1814991A 1814991Hk 1814991Hj 1814991Hd 1814991HP 1814991HM 1814991HD 1814991HB 1814991HA 1814991H@ 1814991H1 1814991H! 1814991H 1814991H 1814991H 1814991H 1814991H 1814991G 1814991G 1814991G 1814991G 1814991G 1814991G 1814991G 1814991G 1814991G 1814991GS 1814991G7 1814991G- 1814991G* 1814991G$ 1814991G" 1814991G 1814991G 1814991G 1814991G 1814991F 1814991F 1814991F 1814991F 1814991F 1814991F 1814991F 1814991F 1814991F 1814991F 1814991F 1814991F 1814991F 1814991Fx 1814991Fr 1814991FX 1814991FW 1814991FN 1814991FF 1814991F< 1814991F6 1814991F4 1814991F3 1814991F1 1814991F. 1814991F) 1814991F 1814991F 1814991F 1814991E 1814991E 1814991E 1814991E 1814991E 1814991E 1814991E 1814991E 1814991E 1814991E 1814991E 1814991E 1814991E 1814991Ei 1814991Ea 1814991ET 1814991ES 1814991E= 1814991E; 1814991E4 1814991E# 1814991E 1814991E 1814991E 1814991E 1814991E 1814991E 1814991E 1814991E 1814991E 1814991D 1814991D 1814991D 1814991D 1814991D 1814991D 1814991D 1814991D 1814991D 1814991D 1814991D 1814991D 1814991D 1814991D 1814991D 1814991D 1814991Dz 1814991Dr 1814991Dj 1814991Dd 1814991D^ 1814991D\ 1814991D[ 1814991DW 1814991D@ 1814991D7 1814991D2 1814991D, 1814991D& 1814991D 1814991D 1814991D 1814991D 1814991D 1814991D 1814991C 1814991C 1814991C 1814991C 1814991C 1814991C 1814991C 1814991C 1814991C 1814991C 1814991C 1814991C 1814991C 1814991C 1814991C 1814991C 1814991C 1814991C 1814991C 1814991C 1814991C} 1814991Cw 1814991Cv 1814991Cu 1814991Cs 1814991Ck 1814991Ci 1814991Cb 1814991C_ 1814991C^ 1814991CZ 1814991CS 1814991CK 1814991CH 1814991CF 1814991CD 1814991C? 1814991C1 1814991C+ 1814991C) 1814991C( 1814991C& 1814991C% 1814991C 1814991C 1814991C 1814991C 1814991C 1814991C 1814991B 1814991B 1814991B 1814991B 1814991B 1814991B 1814991B 1814991B 1814991B 1814991B 1814991B 1814991B 1814991B 1814991B 1814991B 1814991B 1814991B 1814991B 1814991B 1814991B 1814991B 1814991B 1814991B 1814991B 1814991B 1814991B +  0 = VV?)% 3U) ossec11301gNew FTP connection.Apr 9 19:41:14 vm1 pure-ftpd[2722743]: (?@66.240.219.146) [INFO] New connection from 66.240.219.14666.240.219.1466252001)$ CI' ossec5716gzSSHD authentication failed.Apr 9 19:18:38 vm1 sshd[2717549]: Failed password for root from 59.148.102.58 port 58736 ssh259.148.102.581819730_# E3' ossec2501gzUser authentication failure.Apr 9 19:18:36 vm1 sshd[2717549]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=59.148.102.58 user=root59.148.102.581819730W"  -9) ossec13001guOExim Auth failed2025-04-09 18:55:33 dovecot_login authenticator failed for ([113.140.95.250]) [113.140.95.250]:58942: 535 Incorrect authentication data (set_id=sales)113.140.95.2501814991y!  -}) ossec13001guAExim Auth failed2025-04-09 18:55:20 dovecot_login authenticator failed for 202-188-035-194.ip-addr.vsenet.de [194.35.188.202]:52595: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)194.35.188.2022921044+  3Y+ ossec11301gq*New FTP connection.Apr 9 18:37:51 vm1 pure-ftpd[2708730]: (?@172.171.245.243) [INFO] New connection from 172.171.245.243172.171.245.2436252001B  gU) ossec11307gpMultiple connection attempts from same sourceApr 9 18:35:01 vm1 pure-ftpd[2707996]: (?@167.94.145.104) [INFO] New connection from 167.94.145.104167.94.145.1046252001) 3U) ossec11301gpw New FTP connection.Apr 9 18:34:55 vm1 pure-ftpd[2707946]: (?@167.94.145.104) [INFO] New connection from 167.94.145.104167.94.145.1046252001\  -G% ossec13001gnExim Auth failed2025-04-09 18:27:21 dovecot_login authenticator failed for ([85.12.240.14]) [85.12.240.14]:35704: 535 Incorrect authentication data (set_id=vikas.khandelwal)85.12.240.142017370r  -q' ossec13001gnExim Auth failed2025-04-09 18:27:01 dovecot_login authenticator failed for ([46.21.240.186]) [46.21.240.186]:55378: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)46.21.240.18620173703 a;+ ossec5710gnYAttempt to login using a non-existent userApr 9 18:25:52 vm1 sshd[2706229]: Invalid user wqq2016 from 222.253.112.245 port 50686222.253.112.2451562822c E7+ ossec2501gnEUser authentication failure.Apr 9 18:25:30 vm1 sshd[2706139]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.253.112.245 user=root222.253.112.2451562822- CM+ ossec5716gnESSHD authentication failed.Apr 9 18:25:32 vm1 sshd[2706139]: Failed password for root from 222.253.112.245 port 43404 ssh2222.253.112.2451562822>  =w) ossec13008gmNMail Reciepient rejected2025-04-09 18:21:26 H=(mail.msnews24.in) [165.154.210.99]:58308 F= rejected RCPT : Rejected relay attempt: '165.154.210.99' From: 'qtofbxvpsyg@msnews24.in' To: 'validxxx@gmailhotmail.com.br'165.154.210.991694008c  -Q) ossec13001gjExim Auth failed2025-04-09 18:09:33 dovecot_login authenticator failed for (nyaystambh.com) [124.160.63.122]:46030: 535 Incorrect authentication data (set_id=test@nyaystambh.com)124.160.63.1221814991W  -9) ossec13001gjnExim Auth failed2025-04-09 18:09:08 dovecot_login authenticator failed for (nyaystambh.com) [124.160.63.122]:47177: 535 Incorrect authentication data (set_id=nologin)124.160.63.12218149915  =g' ossec13008ga'Mail Reciepient rejected2025-04-09 17:29:34 H=(mail.msnews24.in) [45.197.14.138]:54792 F= rejected RCPT : Rejected relay attempt: '45.197.14.138' From: 'nplxxnev@msnews24.in' To: 'validxxx@gmailhotmail.com.br'45.197.14.1386252001Q  -1% ossec13001g` Exim Auth failed2025-04-09 17:24:53 dovecot_login authenticator failed for ([84.54.115.46]) [84.54.115.46]:35996: 535 Incorrect authentication data (set_id=sales)84.54.115.461512440 kB{  . S  qln :*IkZ7  -=+ ossec13001giExim Auth failed2025-04-09 22:16:33 dovecot_login authenticator failed for ([112.172.126.158]) [112.172.126.158]:33681: 535 Incorrect authentication data (set_id=sales)112.172.126.1581835841]6  -C+ ossec13001g1Exim Auth failed2025-04-09 22:15:37 dovecot_login authenticator failed for ([154.144.255.208]) [154.144.255.208]:58266: 535 Incorrect authentication data (set_id=purchase)154.144.255.2082542007 5  -'% ossec13001g%Exim Auth failed2025-04-09 22:15:24 dovecot_login authenticator failed for (88x87x84x104.static-customer.volgograd.ertelecom.ru) [88.87.84.104]:42516: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)88.87.84.1042017370W4  -9) ossec13001gExim Auth failed2025-04-09 21:27:00 dovecot_login authenticator failed for ([183.98.215.147]) [183.98.215.147]:14407: 535 Incorrect authentication data (set_id=sales)183.98.215.1471835841s3  -q) ossec13001gExim Auth failed2025-04-09 21:26:42 dovecot_login authenticator failed for n11923628209.netvigator.com [119.236.28.209]:60640: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)119.236.28.2091819730X2 -9) ossec13001gExim Auth failed2025-04-09 21:15:29 dovecot_login authenticator failed for (nyaystambh.com) [42.193.105.109]:60082: 535 Incorrect authentication data (set_id=nologin)42.193.105.1091814991%1  3Q' ossec11301gkNew FTP connection.Apr 9 21:12:34 vm1 pure-ftpd[2742438]: (?@20.163.15.225) [INFO] New connection from 20.163.15.22520.163.15.2256252001Y0  -A% ossec13001gExim Auth failed2025-04-09 20:37:03 dovecot_login authenticator failed for vps-79f20bfc.vps.ovh.net [51.75.24.107]:60798: 535 Incorrect authentication data (set_id=sales)51.75.24.1073017382z/  -' ossec13001g Exim Auth failed2025-04-09 20:36:51 dovecot_login authenticator failed for 083.46.246.220.static.netvigator.com [220.246.46.83]:64375: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)220.246.46.831819730.  - ) ossec13001gExim Auth failed2025-04-09 20:36:39 dovecot_login authenticator failed for (118.165.138.61.adsl-pool.jlccptt.net.cn) [61.138.165.118]:52786: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)61.138.165.1181814991"-  3M% ossec11301gNew FTP connection.Apr 9 20:35:33 vm1 pure-ftpd[2734574]: (?@64.62.156.16) [INFO] New connection from 64.62.156.1664.62.156.1662520018,  =k) ossec13008g Mail Reciepient rejected2025-04-09 20:32:36 H=(mail.msnews24.in) [165.154.210.99]:50481 F= rejected RCPT : Rejected relay attempt: '165.154.210.99' From: 'oolrzajf@msnews24.in' To: 'validxxx@gmailhotmail.com.br'165.154.210.991694008W+  -9) ossec13001g"Exim Auth failed2025-04-09 19:46:01 dovecot_login authenticator failed for ([220.178.39.106]) [220.178.39.106]:58881: 535 Incorrect authentication data (set_id=sales)220.178.39.1061814991d*  -W% ossec13001gExim Auth failed2025-04-09 19:45:47 dovecot_login authenticator failed for ([96.69.12.213]) [96.69.12.213]:62917: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)96.69.12.21362520018)  Ai' ossec11302g;FTP Authentication failed.Apr 9 19:42:11 vm1 pure-ftpd[2722890]: (?@34.29.249.230) [WARNING] Authentication failed for user [anonymous]34.29.249.2306252001%(  3Q' ossec11301g5New FTP connection.Apr 9 19:42:04 vm1 pure-ftpd[2722890]: (?@34.29.249.230) [INFO] New connection from 34.29.249.23034.29.249.2306252001C' gU) ossec11307gMultiple connection attempts from same sourceApr 9 19:41:26 vm1 pure-ftpd[2722767]: (?@66.240.219.146) [INFO] New connection from 66.240.219.14666.240.219.1466252001:&  Ak) ossec11302g FTP Authentication failed.Apr 9 19:41:20 vm1 pure-ftpd[2722743]: (?@66.240.219.146) [WARNING] Authentication failed for user [anonymous]66.240.219.1466252001  7R +}gH  -[' ossec13001gExim Auth failed2025-04-09 23:55:31 dovecot_login authenticator failed for ([175.194.245.9]) [175.194.245.9]:48049: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)175.194.245.91835841*G  3Y+ ossec11301gNew FTP connection.Apr 9 23:30:38 vm1 pure-ftpd[2772275]: (?@185.247.137.206) [INFO] New connection from 185.247.137.206185.247.137.206298795ZF  -=+ ossec13001gExim Auth failed2025-04-09 23:06:21 dovecot_login authenticator failed for ([203.193.137.250]) [203.193.137.250]:64047: 535 Incorrect authentication data (set_id=sales)203.193.137.2501269750jE  -_) ossec13001gExim Auth failed2025-04-09 23:05:54 dovecot_login authenticator failed for ([218.94.115.164]) [218.94.115.164]:56322: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)218.94.115.1641814991(D  3U) ossec11301gNew FTP connection.Apr 9 23:01:48 vm1 pure-ftpd[2765979]: (?@194.165.16.163) [INFO] New connection from 194.165.16.163194.165.16.1632993457+C CK) ossec5716gZSSHD authentication failed.Apr 9 22:58:56 vm1 sshd[2765304]: Failed password for root from 182.150.91.114 port 56208 ssh2182.150.91.1141814991aB E5) ossec2501gXUser authentication failure.Apr 9 22:58:54 vm1 sshd[2765304]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.150.91.114 user=root182.150.91.1141814991(A  3U) ossec11301gWNew FTP connection.Apr 9 22:54:37 vm1 pure-ftpd[2764315]: (?@205.210.31.226) [INFO] New connection from 205.210.31.226205.210.31.2266252001p@  QE+ ossec11000g Login failed on the cpanel service[2025-04-09 22:23:32 +0530] info [whostmgrd] 156.228.102.180 - msnews24 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect156.228.102.1806252001l? Q=) ossec11000g Login failed on the cpanel service[2025-04-09 22:23:31 +0530] info [whostmgrd] 156.228.96.112 - admin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect156.228.96.1126252001>  Qg) ossec11000gLogin failed on the cpanel service[2025-04-09 22:23:19 +0530] info [cpaneld] 156.228.94.185 - user "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user user (has_cpuser_file failed)156.228.94.1856252001=  Qs) ossec11000gLogin failed on the cpanel service[2025-04-09 22:23:18 +0530] info [cpaneld] 156.228.77.183 - msnews2 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user msnews2 (has_cpuser_file failed)156.228.77.1836252001 <  Q) ossec11000gLogin failed on the cpanel service[2025-04-09 22:23:18 +0530] info [cpaneld] 156.228.108.94 - msnews24in "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user msnews24in (has_cpuser_file failed)156.228.108.946252001 ;  Qy+ ossec11000gLogin failed on the cpanel service[2025-04-09 22:23:17 +0530] info [cpaneld] 156.228.104.142 - msnews24 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user msnews24 (has_cpuser_file failed)156.228.104.1426252001:  Qk) ossec11000gLogin failed on the cpanel service[2025-04-09 22:23:16 +0530] info [cpaneld] 156.228.114.17 - admin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)156.228.114.1762520019  Qg) ossec11000gLogin failed on the cpanel service[2025-04-09 22:23:15 +0530] info [cpaneld] 156.228.116.10 - user "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user user (has_cpuser_file failed)156.228.116.1062520018  -+ ossec13001gYExim Auth failed2025-04-09 22:16:16 dovecot_login authenticator failed for (103.163.200.110.dynamic-mytachyon.in) [103.163.200.110]:6427: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)103.163.200.1101269750 0(X  4 = \t0'Z  3U) ossec11301gPNew FTP connection.Apr 10 02:27:51 vm1 pure-ftpd[2814808]: (?@93.123.109.222) [INFO] New connection from 93.123.109.22293.123.109.222732800TY  -5' ossec13001gyExim Auth failed2025-04-10 02:20:01 dovecot_login authenticator failed for ([217.22.37.184]) [217.22.37.184]:41250: 535 Incorrect authentication data (set_id=sales)217.22.37.1843144096X  -+ ossec13001gYExim Auth failed2025-04-10 02:19:29 dovecot_login authenticator failed for (static.155.239.181.135.clients.your-server.de) [135.181.239.155]:59396: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)135.181.239.155660013uW  -w' ossec13001gExim Auth failed2025-04-10 02:05:17 dovecot_login authenticator failed for c-73-162-50-231.hsd1.ca.comcast.net [73.162.50.231]:50698: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)73.162.50.2316252001V  -7% ossec13001gExim Auth failed2025-04-10 02:05:06 dovecot_login authenticator failed for laubervilliers-657-1-93-158.w80-14.abo.wanadoo.fr [80.14.31.158]:41937: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)80.14.31.1583017382WU  -;' ossec13001gfExim Auth failed2025-04-10 01:54:04 dovecot_login authenticator failed for ([110.34.111.22]) [110.34.111.22]:45543: 535 Incorrect authentication data (set_id=purchase)110.34.111.221835841mT  -e) ossec13001gRExim Auth failed2025-04-10 01:53:45 dovecot_login authenticator failed for ([192.34.128.202]) [192.34.128.202]:37338: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)192.34.128.2026252001TS  -5' ossec13001g>Exim Auth failed2025-04-10 01:32:06 dovecot_login authenticator failed for ([103.183.11.30]) [103.183.11.30]:56374: 535 Incorrect authentication data (set_id=sales)103.183.11.301643084dR  -W% ossec13001g2Exim Auth failed2025-04-10 01:31:54 dovecot_login authenticator failed for ([183.6.43.236]) [183.6.43.236]:40727: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)183.6.43.2361814991]Q  -K# ossec13001gExim Auth failed2025-04-10 01:17:38 dovecot_login authenticator failed for ([102.38.3.73]) [102.38.3.73]:51072: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)102.38.3.732215636sP  -u% ossec13001gExim Auth failed2025-04-10 01:17:27 dovecot_login authenticator failed for ([1.28.192.150]) [1.28.192.150]:36585: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)1.28.192.1501814991WO  -9) ossec13001gExim Auth failed2025-04-10 00:44:32 dovecot_login authenticator failed for ([119.62.156.161]) [119.62.156.161]:55158: 535 Incorrect authentication data (set_id=sales)119.62.156.1611814991mN  -c+ ossec13001g Exim Auth failed2025-04-10 00:44:18 dovecot_login authenticator failed for ([182.224.231.102]) [182.224.231.102]:53012: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)182.224.231.1021835841%M  3Q' ossec11301gYNew FTP connection.Apr 10 00:41:19 vm1 pure-ftpd[2791592]: (?@20.65.193.252) [INFO] New connection from 20.65.193.25220.65.193.2526252001+L  3Y+ ossec11301gNew FTP connection.Apr 10 00:22:20 vm1 pure-ftpd[2787558]: (?@147.185.132.132) [INFO] New connection from 147.185.132.132147.185.132.1326252001K  ?1 ossec1008gProcess exiting (killed).Apr 10 00:09:17 vm1 spamd[2470195]: spamd: server killed by SIGTERM, shutting downCJ  77 ossec502gOssec server started.ossec: Ossec started.TI  -5' ossec13001gExim Auth failed2025-04-09 23:55:44 dovecot_login authenticator failed for ([218.69.115.74]) [218.69.115.74]:37045: 535 Incorrect authentication data (set_id=sales)218.69.115.741814991  + R j WCHf+xql  -k+ ossec13001gExim Auth failed2025-04-10 03:55:50 dovecot_login authenticator failed for (134.227.160.222.adsl-pool.jlccptt.net.cn) [222.160.227.134]:50714: 535 Incorrect authentication data (set_id=sales)222.160.227.1341814991fk  -Y' ossec13001gExim Auth failed2025-04-10 03:55:24 dovecot_login authenticator failed for ([61.153.208.38]) [61.153.208.38]:6385: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)61.153.208.381814991/j a7' ossec5710gAttempt to login using a non-existent userApr 10 03:52:18 vm1 sshd[2833340]: Invalid user mwzhang from 39.144.129.95 port 1414839.144.129.951814991(i  CI' ossec5716gSSHD authentication failed.Apr 10 03:52:06 vm1 sshd[2833253]: Failed password for root from 39.144.129.95 port 14146 ssh239.144.129.951814991_h E3' ossec2501g User authentication failure.Apr 10 03:52:05 vm1 sshd[2833253]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=39.144.129.95 user=root39.144.129.951814991(g  CI' ossec5716gSSHD authentication failed.Apr 10 03:51:53 vm1 sshd[2833238]: Failed password for root from 39.144.129.95 port 14145 ssh239.144.129.951814991^f  E3' ossec2501gUser authentication failure.Apr 10 03:51:51 vm1 sshd[2833238]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=39.144.129.95 user=root39.144.129.951814991we  -w+ ossec13001gExim Auth failed2025-04-10 03:41:24 dovecot_login authenticator failed for (208.235.164.124.adsl-pool.sx.cn) [124.164.235.208]:56564: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)124.164.235.2081814991d  -/% ossec13001gyExim Auth failed2025-04-10 03:41:03 dovecot_login authenticator failed for (23-30-11-253-static.hfc.comcastbusiness.net) [23.30.11.253]:58068: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)23.30.11.2536252001:c  Ak) ossec11302gFTP Authentication failed.Apr 10 03:21:56 vm1 pure-ftpd[2826584]: (?@91.196.152.105) [WARNING] Authentication failed for user [anonymous]91.196.152.1053017382%b  3Q' ossec11301gNew FTP connection.Apr 10 03:21:52 vm1 pure-ftpd[2826582]: (?@91.196.152.22) [INFO] New connection from 91.196.152.2291.196.152.223017382(a  3U) ossec11301gNew FTP connection.Apr 10 03:21:52 vm1 pure-ftpd[2826584]: (?@91.196.152.105) [INFO] New connection from 91.196.152.10591.196.152.1053017382d`  -U' ossec13001gExim Auth failed2025-04-10 03:20:25 dovecot_login authenticator failed for (nyaystambh.com) [111.61.229.78]:41985: 535 Incorrect authentication data (set_id=contact@nyaystambh.com)111.61.229.781814991U_  -7' ossec13001g}Exim Auth failed2025-04-10 03:19:49 dovecot_login authenticator failed for (nyaystambh.com) [111.61.229.78]:41415: 535 Incorrect authentication data (set_id=nologin)111.61.229.781814991Z^  -A' ossec13001gExim Auth failed2025-04-10 03:07:42 dovecot_login authenticator failed for (r552pc2.ee.ntu.edu.tw) [131.107.1.242]:47776: 535 Incorrect authentication data (set_id=sales)131.107.1.2426252001g]  -[' ossec13001gExim Auth failed2025-04-10 03:07:23 dovecot_login authenticator failed for ([96.94.173.238]) [96.94.173.238]:44234: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)96.94.173.2386252001}\  -+ ossec13001g?Exim Auth failed2025-04-10 02:53:11 dovecot_login authenticator failed for (mobile-166-195-195-145.mycingular.net) [166.195.195.145]:38801: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)166.195.195.1456252001[  -+ ossec13001g3Exim Auth failed2025-04-10 02:52:58 dovecot_login authenticator failed for (109-120-192-105.ip.btc-net.bg) [109.120.192.105]:33877: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)109.120.192.105732800  Z||pdXL@4(t 58 Zi^SH=2' w l a V K @ 5 *   z o d Y N C 8 - "   } r g \ Q F ; 0 %    u j _ T I > 3 (    x m b W L A *   yncXMB7,! {peZOD-"|qfOD9.# qfOD9.# 99237O 953987O 99237Oz 99237O5 99237O 99237O 99237N 933860N 99237N 99237N 935317N 99237N~ 99237Nq 99237No 99237N5 99237N 99237M 953987M 99237M 99237Mn 99237Mj 99237MT 99237M 99237M 99237LA 99237L 99237L 99237L 99237K 99237K 953987K 99237Kt 99237K 99237K 99237J 99237J{ 99237J) 99237I 99237I 99237IQ 99237I( 99237H 99237H 99237H 99237H 99237H 953987H 99237Hs 99237G 99237G 953987F 99237F 99237Fy 99237F 99237F 99237E 99237E 99237Ek 99237E& 99237D 933860DX 99237DU 99237D 99237D 99237C 99237C 99237C 99237C 99237C 99237C3 99237C 99237B 99237B 99237B 99237B{ 99237B6 99237A 99237A 99237A 99237A 99237A 99237A{ 953987@V 99237? 99237? 99237? 99237? 99237? 99237?Q 99237> 99237>o 99237>J 99237>A 99237>) 99237> 99237= 953987= 99237= 99237< 99237<^ 99237<\ 99237 rejected RCPT : Rejected relay attempt: '45.197.14.138' From: 'eomxtpyeo@msnews24.in' To: 'validxxx@gmailhotmail.com.br'45.197.14.1386252001\s  -G' ossec13001gExim Auth failed2025-04-10 05:17:07 dovecot_login authenticator failed for rplus.dp.ua [77.109.33.120]:36222: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)77.109.33.120690791 r  -' ossec13001gExim Auth failed2025-04-10 05:16:54 dovecot_login authenticator failed for syn-024-043-131-106.biz.spectrum.com [24.43.131.106]:63225: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)24.43.131.1066252001bq  -S% ossec13001ggExim Auth failed2025-04-10 04:53:18 dovecot_login authenticator failed for (nyaystambh.com) [119.96.131.8]:34570: 535 Incorrect authentication data (set_id=support@nyaystambh.com)119.96.131.81814991Sp  -5% ossec13001gCExim Auth failed2025-04-10 04:52:41 dovecot_login authenticator failed for (nyaystambh.com) [119.96.131.8]:57350: 535 Incorrect authentication data (set_id=nologin)119.96.131.81814991Zo  -=+ ossec13001g,Exim Auth failed2025-04-10 04:43:47 dovecot_login authenticator failed for ([119.207.156.209]) [119.207.156.209]:10159: 535 Incorrect authentication data (set_id=sales)119.207.156.2091835841wn  -y) ossec13001gExim Auth failed2025-04-10 04:43:34 dovecot_login authenticator failed for bb115-66-207-124.singnet.com.sg [115.66.207.124]:56620: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)115.66.207.1241880251Bm - ) ossec13001gExim Auth failed2025-04-10 04:30:22 dovecot_login authenticator failed for (127.0.0.1) [176.65.141.251]:47284: 535 Incorrect authentication data176.65.141.2512921044 + M : ; O Oeiua  -S# ossec13001g,(Exim Auth failed2025-04-10 07:55:44 dovecot_login authenticator failed for ([14.98.28.43]) [14.98.28.43]:38256: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)14.98.28.431269750;  =s' ossec13008g)Mail Reciepient rejected2025-04-10 07:42:34 H=(mail.msnews24.in) [45.197.14.138]:49552 F= rejected RCPT : Rejected relay attempt: '45.197.14.138' From: 'wxayniieptx@msnews24.in' To: 'validxxx@gmailhotmail.com.br'45.197.14.1386252001g  -Y+ ossec13001g(Exim Auth failed2025-04-10 07:41:57 dovecot_login authenticator failed for ([196.189.149.242]) [196.189.149.203]:2118: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)196.189.149.203337996|  -+ ossec13001g(Exim Auth failed2025-04-10 07:41:31 dovecot_login authenticator failed for ([211.199.174.227]) [211.199.174.227]:39956: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)211.199.174.2271835841W  -;' ossec13001g!Exim Auth failed2025-04-10 07:10:28 dovecot_login authenticator failed for ([220.95.14.102]) [220.95.14.102]:47314: 535 Incorrect authentication data (set_id=purchase)220.95.14.1021835841m  -e) ossec13001g!Exim Auth failed2025-04-10 07:10:16 dovecot_login authenticator failed for ([79.170.189.164]) [79.170.189.164]:54239: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)79.170.189.1641220409p  -i+ ossec13001g Exim Auth failed2025-04-10 07:07:38 dovecot_login authenticator failed for (nsg-corporate-228.228.187.122.airtel.in) [122.187.228.228]:46328: 535 Incorrect authentication data (set_id=sales)122.187.228.2281269750x  -% ossec13001g Exim Auth failed2025-04-10 07:07:26 dovecot_login authenticator failed for net-93-65-94-248.cust.vodafonedsl.it [93.65.94.248]:38331: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)93.65.94.2483175395f  -W) ossec13001gExim Auth failed2025-04-10 06:53:15 dovecot_login authenticator failed for ([74.176.176.238]) [74.176.176.238]:30110: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)74.176.176.2381861060|  -+ ossec13001gwExim Auth failed2025-04-10 06:53:02 dovecot_login authenticator failed for ([210.104.222.189]) [210.104.222.189]:34408: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)210.104.222.1891835841h  -_% ossec13001g<Exim Auth failed2025-04-10 06:52:03 dovecot_login authenticator failed for syn-074-062-020-170.biz.spectrum.com [74.62.20.170]:39768: 535 Incorrect authentication data (set_id=purchase)74.62.20.1706252001{  -' ossec13001g Exim Auth failed2025-04-10 06:51:35 dovecot_login authenticator failed for 5.185.233.251.ipv4.public.orange.pl [5.185.233.251]:41510: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)5.185.233.251798544  [{) ossec12004goPossible Dovecot CVE-2019-11500 attemptApr 10 06:31:33 vm1 dovecot[1526]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=18.223.111.250, lip=103.74.54.108, session=18.223.111.2506252001Z  -?) ossec13001gExim Auth failed2025-04-10 06:29:10 dovecot_login authenticator failed for ([120.29.140.140]) [120.29.140.140]:51335: 535 Incorrect authentication data (set_id=purchase)120.29.140.1401835841j  -a' ossec13001gExim Auth failed2025-04-10 06:28:47 dovecot_login authenticator failed for ([103.177.204.4]) [103.177.204.4]:36984: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)103.177.204.41269750c~  -U% ossec13001gExim Auth failed2025-04-10 06:19:51 dovecot_login authenticator failed for c-71-229-1-186.hsd1.al.comcast.net [71.229.1.186]:44872: 535 Incorrect authentication data (set_id=sales)71.229.1.1866252001 C+D * @ U M PNh&jtC-  -g' ossec13001gJExim Auth failed2025-04-10 10:06:19 dovecot_login authenticator failed for host-88-43-231-186.business.telecomitalia.it (host-88-43-231-188.business.telecomitalia.it) [88.43.231.186]:56788: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)88.43.231.1863175395r  -u% ossec13001gJExim Auth failed2025-04-10 10:06:07 dovecot_login authenticator failed for ([95.35.29.192]) [95.35.29.192]:58463: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)95.35.29.1922946408  Ai' ossec11302gHFTP Authentication failed.Apr 10 09:57:10 vm1 pure-ftpd[2912008]: (?@35.205.211.45) [WARNING] Authentication failed for user [anonymous]35.205.211.452802361& 3Q' ossec11301gHNew FTP connection.Apr 10 09:57:04 vm1 pure-ftpd[2912008]: (?@35.205.211.45) [INFO] New connection from 35.205.211.4535.205.211.452802361Z  -?) ossec13001gDExim Auth failed2025-04-10 09:39:40 dovecot_login authenticator failed for ([61.184.176.231]) [61.184.176.231]:16305: 535 Incorrect authentication data (set_id=purchase)61.184.176.2311814991j  -a' ossec13001gDuExim Auth failed2025-04-10 09:39:24 dovecot_login authenticator failed for ([113.192.69.10]) [113.192.69.10]:58294: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)113.192.69.101835841m  -e) ossec13001gDQExim Auth failed2025-04-10 09:38:48 dovecot_login authenticator failed for ([103.146.233.52]) [103.146.233.52]:55798: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)103.146.233.521269750W  -9) ossec13001gBExim Auth failed2025-04-10 09:32:46 dovecot_login authenticator failed for ([180.165.21.168]) [180.165.21.168]:46139: 535 Incorrect authentication data (set_id=sales)180.165.21.1681814991b  -W% ossec13001gBExim Auth failed2025-04-10 09:32:33 dovecot_login authenticator failed for ([65.20.191.43]) [65.20.191.43]:39282: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)65.20.191.4399237~  - ' ossec13001g?Exim Auth failed2025-04-10 09:18:30 dovecot_login authenticator failed for static-47-190-147-30.dlls.tx.frontiernet.net [47.190.147.30]:60711: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)47.190.147.306252001y  -}) ossec13001g?Exim Auth failed2025-04-10 09:18:18 dovecot_login authenticator failed for ([119.62.156.161]) [119.62.156.161]:59492: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)119.62.156.1611814991  Qq' ossec11000g9Login failed on the cpanel service[2025-04-10 08:50:31 +0530] info [cpaneld] 158.69.248.25 - heipowersystem "POST /login HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipowersystem (has_cpuser_file failed)158.69.248.256251999g  -[' ossec13001g7Exim Auth failed2025-04-10 08:44:55 dovecot_login authenticator failed for h-155-4-122-224.a259.priv.bahnhof.se [155.4.122.224]:39726: 535 Incorrect authentication data (set_id=sales)155.4.122.2242661886f  -[' ossec13001g7Exim Auth failed2025-04-10 08:44:44 dovecot_login authenticator failed for ([87.200.73.165]) [87.200.73.165]:53509: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)87.200.73.165290557  -5+ ossec13001g4Exim Auth failed2025-04-10 08:29:28 dovecot_login authenticator failed for (customer-189-216-244-157.cablevision.net.mx) [189.216.244.157]:34644: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)189.216.244.1573996063c  -S' ossec13001g4/Exim Auth failed2025-04-10 08:29:58 dovecot_login authenticator failed for ([45.130.43.106]) [45.130.43.106]:37480: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)45.130.43.1062017370Q  -1% ossec13001g,JExim Auth failed2025-04-10 07:56:18 dovecot_login authenticator failed for ([58.22.255.28]) [58.22.255.28]:53559: 535 Incorrect authentication data (set_id=sales)58.22.255.281814991 ) }  #.  -;) ossec13001glExim Auth failed2025-04-10 12:32:08 dovecot_login authenticator failed for (47-189-156-222.fdr02.plan.tx.ip.frontiernet.net) [47.189.156.222]:42430: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)47.189.156.2226252001e-  -U) ossec13001gfExim Auth failed2025-04-10 12:05:41 dovecot_login authenticator failed for (ipoe-static.mosoblast.rt.ru) [89.109.233.181]:52338: 535 Incorrect authentication data (set_id=purchase)89.109.233.1812017370c,  -Y# ossec13001gfExim Auth failed2025-04-10 12:05:17 dovecot_login authenticator failed for ([5.32.22.218]) [5.32.22.218]:36434: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)5.32.22.218290557~+  -+ ossec13001gdExim Auth failed2025-04-10 11:57:03 dovecot_login authenticator failed for 217-209-148-151-no600.tbcn.telia.com [217.209.148.151]:34911: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)217.209.148.1512661886Z*  -=+ ossec13001gdExim Auth failed2025-04-10 11:57:16 dovecot_login authenticator failed for ([122.166.253.226]) [122.166.253.226]:34440: 535 Incorrect authentication data (set_id=sales)122.166.253.2261269750a)  -S' ossec13001gawExim Auth failed2025-04-10 11:43:10 dovecot_login authenticator failed for ([65.20.172.194]) [65.20.172.194]:52247: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)65.20.172.19499237(  -;) ossec13001gaSExim Auth failed2025-04-10 11:42:33 dovecot_login authenticator failed for (92x255x196x185.static-customer.kzn.ertelecom.ru) [92.255.196.185]:54916: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)92.255.196.1852017370T'  -5' ossec13001gY{Exim Auth failed2025-04-10 11:09:06 dovecot_login authenticator failed for ([45.118.34.218]) [45.118.34.218]:36127: 535 Incorrect authentication data (set_id=sales)45.118.34.2181269750m&  -c+ ossec13001gYpExim Auth failed2025-04-10 11:08:55 dovecot_login authenticator failed for ([175.139.176.161]) [175.139.176.161]:34123: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)175.139.176.16117330456%  =g) ossec13008gXMail Reciepient rejected2025-04-10 11:03:12 H=(mail.msnews24.in) [165.154.210.99]:51632 F= rejected RCPT : Rejected relay attempt: '165.154.210.99' From: 'sctfwrr@msnews24.in' To: 'validxxx@gmailhotmail.com.br'165.154.210.991694008h$  -c# ossec13001gVExim Auth failed2025-04-10 10:54:43 dovecot_login authenticator failed for (2-55-88-152.orange.net.il) [2.55.88.152]:43213: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)2.55.88.152294640~#  - ' ossec13001gVExim Auth failed2025-04-10 10:54:32 dovecot_login authenticator failed for (185-189-123-105.laser.ir) [37.235.18.145]:57182: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)37.235.18.1451307584"  A_) ossec11302gRFTP Authentication failed.Apr 10 10:37:25 vm1 pure-ftpd[2921195]: (?@122.129.88.214) [WARNING] Authentication failed for user [ftp]122.129.88.2141168579(!  3U) ossec11301gRNew FTP connection.Apr 10 10:37:19 vm1 pure-ftpd[2921195]: (?@122.129.88.214) [INFO] New connection from 122.129.88.214122.129.88.2141168579b  -O) ossec13001gN/Exim Auth failed2025-04-10 10:20:54 dovecot_login authenticator failed for (static-137-230.pppoe.tmb.ru) [78.132.137.230]:56766: 535 Incorrect authentication data (set_id=sales)78.132.137.2302017370m  -c+ ossec13001gNExim Auth failed2025-04-10 10:20:34 dovecot_login authenticator failed for ([112.194.142.167]) [112.194.142.167]:57348: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)112.194.142.1671814991 M  ' Y Y Np;M-@ a3' ossec5710gAttempt to login using a non-existent userApr 10 14:13:51 vm1 sshd[2968850]: Invalid user nukri from 188.162.15.89 port 60835188.162.15.892017370)?  CK' ossec5716gSSHD authentication failed.Apr 10 14:13:40 vm1 sshd[2968814]: Failed password for mysql from 188.162.15.89 port 38827 ssh2188.162.15.892017370`> E5' ossec2501gUser authentication failure.Apr 10 14:13:37 vm1 sshd[2968814]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=188.162.15.89 user=mysql188.162.15.892017370(=  CI' ossec5716gSSHD authentication failed.Apr 10 14:13:10 vm1 sshd[2968715]: Failed password for root from 188.162.15.89 port 46524 ssh2188.162.15.892017370^<  E3' ossec2501gUser authentication failure.Apr 10 14:13:07 vm1 sshd[2968715]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=188.162.15.89 user=root188.162.15.892017370{;  -% ossec13001gExim Auth failed2025-04-10 14:08:58 dovecot_login authenticator failed for aorleans-652-1-112-40.w90-19.abo.wanadoo.fr [90.19.235.40]:41048: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)90.19.235.403017382s:  -u% ossec13001gExim Auth failed2025-04-10 14:08:45 dovecot_login authenticator failed for ([73.83.138.64]) [73.83.138.64]:44818: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)73.83.138.646252001F9 ac) ossec5710gAttempt to login using a non-existent userApr 10 14:02:01 vm1 sshd[2966176]: Failed password for invalid user msr from 183.63.218.104 port 54108 ssh2183.63.218.1041814991*8  CK) ossec5716gSSHD authentication failed.Apr 10 14:01:48 vm1 sshd[2966137]: Failed password for root from 183.63.218.104 port 53298 ssh2183.63.218.1041814991a7 E5) ossec2501gUser authentication failure.Apr 10 14:01:45 vm1 sshd[2966137]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.63.218.104 user=root183.63.218.1041814991Z6  -=+ ossec13001g{Exim Auth failed2025-04-10 13:34:55 dovecot_login authenticator failed for ([183.220.241.252]) [183.220.241.252]:59804: 535 Incorrect authentication data (set_id=sales)183.220.241.25218149915  -+ ossec13001g{Exim Auth failed2025-04-10 13:34:42 dovecot_login authenticator failed for p4343175-ipxg22901hodogaya.kanagawa.ocn.ne.jp [153.174.235.175]:60691: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)153.174.235.1751861060|4  -+ ossec13001gxEExim Auth failed2025-04-10 13:20:28 dovecot_login authenticator failed for ([220.180.249.165]) [220.180.249.165]:44665: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)220.180.249.1651814991J3  -)! ossec13001gpaExim Auth failed2025-04-10 12:46:48 dovecot_login authenticator failed for ([2.55.70.26]) [2.55.70.26]:40001: 535 Incorrect authentication data (set_id=sales)2.55.70.26294640j2  -_) ossec13001gpQExim Auth failed2025-04-10 12:46:31 dovecot_login authenticator failed for ([200.106.49.149]) [200.106.49.149]:33996: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)200.106.49.1493932488l1  -c) ossec13001gnExim Auth failed2025-04-10 12:39:33 dovecot_login authenticator failed for 136.151.48.116.static.netvigator.com [116.48.151.136]:62670: 535 Incorrect authentication data (set_id=purchase)116.48.151.13618197300  -') ossec13001gnExim Auth failed2025-04-10 12:39:04 dovecot_login authenticator failed for (abts-mum-static-127.120.70.182.airtelbroadband.in) [182.70.120.127]:58702: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)182.70.120.1271269750e/  -U) ossec13001glExim Auth failed2025-04-10 12:32:20 dovecot_login authenticator failed for works.ssc-gr.info [160.251.121.70]:42568: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)160.251.121.701861060 $ { 6 T aQ E5) ossec2501gUser authentication failure.Apr 10 15:34:55 vm1 sshd[2986696]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=115.203.67.158 user=root115.203.67.1581814991WP  -;' ossec13001gExim Auth failed2025-04-10 15:34:42 dovecot_login authenticator failed for ([58.222.184.18]) [58.222.184.18]:55035: 535 Incorrect authentication data (set_id=purchase)58.222.184.1818149912O UC+ ossec11001gDeferred login on the cpanel service[2025-04-10 15:30:10 +0530] info [webmaild] 106.221.238.167 - kps@amplifypowerglobal.com "POST /cpsess0555876652/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect106.221.238.16712697502N UC+ ossec11001goDeferred login on the cpanel service[2025-04-10 15:29:10 +0530] info [webmaild] 106.221.238.167 - kps@amplifypowerglobal.com "POST /cpsess0555876652/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect106.221.238.1671269750gM  -[' ossec13001g\Exim Auth failed2025-04-10 15:11:48 dovecot_login authenticator failed for ([12.70.103.162]) [12.70.103.162]:58344: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)12.70.103.1626252001NL  --# ossec13001gnExim Auth failed2025-04-10 15:12:06 dovecot_login authenticator failed for ([49.0.129.12]) [49.0.129.12]:52226: 535 Incorrect authentication data (set_id=sales)49.0.129.122029969fK  -W) ossec13001gExim Auth failed2025-04-10 14:57:23 dovecot_login authenticator failed for ([219.251.253.62]) [219.251.253.62]:44584: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)219.251.253.621835841tJ  -y' ossec13001gExim Auth failed2025-04-10 14:57:10 dovecot_login authenticator failed for ([65.20.213.101]) [65.20.213.101]:56311: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)65.20.213.10199237I  W' ossec9708gDovecot Aborted Login with empty userApr 10 14:35:08 vm1 dovecot[1526]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 7 secs): user=<>, rip=87.236.176.21, lip=103.74.54.108, TLS, session=87.236.176.212635167(H  CI' ossec5716g!SSHD authentication failed.Apr 10 14:32:24 vm1 sshd[2972945]: Failed password for root from 116.102.97.95 port 58378 ssh2116.102.97.951562822^G  E3' ossec2501gUser authentication failure.Apr 10 14:32:21 vm1 sshd[2972945]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.102.97.95 user=root116.102.97.9515628222F a=' ossec5710g Attempt to login using a non-existent userApr 10 14:32:01 vm1 sshd[2972900]: Invalid user cloudadmin from 116.102.97.95 port 57578116.102.97.951562822(E  CI' ossec5716gSSHD authentication failed.Apr 10 14:31:48 vm1 sshd[2972809]: Failed password for root from 116.102.97.95 port 56772 ssh2116.102.97.951562822_D E3' ossec2501gUser authentication failure.Apr 10 14:31:46 vm1 sshd[2972809]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.102.97.95 user=root116.102.97.951562822%C  3Q' ossec11301g1New FTP connection.Apr 10 14:24:07 vm1 pure-ftpd[2971170]: (?@64.226.79.183) [INFO] New connection from 64.226.79.18364.226.79.1832921044rB  -q' ossec13001gExim Auth failed2025-04-10 14:23:19 dovecot_login authenticator failed for p5df05771.dip0.t-ipconnect.de ([89.107.163.13]) [93.240.87.113]:50937: 535 Incorrect authentication data (set_id=sales)93.240.87.1132921044bA  -W% ossec13001gExim Auth failed2025-04-10 14:23:10 dovecot_login authenticator failed for ([65.20.130.95]) [65.20.130.95]:37369: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)65.20.130.9599237 R  .  Icc  -S' ossec13001gExim Auth failed2025-04-10 17:22:54 dovecot_login authenticator failed for ([103.65.227.72]) [103.65.227.72]:56993: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)103.65.227.721210997mb  -m! ossec13001gExim Auth failed2025-04-10 17:22:29 dovecot_login authenticator failed for ([59.9.38.92]) [59.9.38.92]:33612: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)59.9.38.921835841Ca  77 ossec502gSOssec server started.ossec: Ossec started.Q`  -1% ossec13001gExim Auth failed2025-04-10 16:48:51 dovecot_login authenticator failed for ([36.26.63.158]) [36.26.63.158]:47838: 535 Incorrect authentication data (set_id=sales)36.26.63.1581814991v_  -y' ossec13001gExim Auth failed2025-04-10 16:48:38 dovecot_login authenticator failed for 62-122-195-14.broadband.opcom.ru [62.122.195.14]:45622: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)62.122.195.142017370f^  -W) ossec13001gExim Auth failed2025-04-10 16:34:22 dovecot_login authenticator failed for ([221.206.104.44]) [221.206.104.44]:48352: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)221.206.104.441814991~]  - ' ossec13001gExim Auth failed2025-04-10 16:34:05 dovecot_login authenticator failed for 37.234.128.77.rev.sfr.net [77.128.234.37]:59642: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)77.128.234.373017382%\  3Q' ossec11301gNew FTP connection.Apr 10 16:04:41 vm1 pure-ftpd[2993213]: (?@20.221.66.114) [INFO] New connection from 20.221.66.11420.221.66.1146252001Q[  -1% ossec13001gExim Auth failed2025-04-10 16:00:33 dovecot_login authenticator failed for ([50.99.36.130]) [50.99.36.130]:50824: 535 Incorrect authentication data (set_id=sales)50.99.36.1306251999|Z  -' ossec13001gExim Auth failed2025-04-10 16:00:15 dovecot_login authenticator failed for (20-172-91-219.static.youbroadband.in) [219.91.172.20]:44448: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)219.91.172.201269750}Y  -+ ossec13001gZExim Auth failed2025-04-10 15:45:53 dovecot_login authenticator failed for (host103-171-169-246.renubroadband.com) [103.171.168.246]:33792: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)103.171.168.2461269750 X  -!) ossec13001gNExim Auth failed2025-04-10 15:45:42 dovecot_login authenticator failed for syn-067-242-117-151.res.spectrum.com [67.242.117.151]:35048: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)67.242.117.1516252001UW  E) ossec2501gUser authentication failure.Apr 10 15:35:43 vm1 sshd[2986964]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=115.203.67.158115.203.67.1581814991/V a5) ossec5710gAttempt to login using a non-existent userApr 10 15:35:42 vm1 sshd[2986964]: Invalid user liumin from 115.203.67.158 port 8871115.203.67.1581814991pU  -i+ ossec13001gExim Auth failed2025-04-10 15:34:28 dovecot_login authenticator failed for ([175.203.245.102]) [175.203.245.102]:47828: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)175.203.245.1021835841kT  -c' ossec13001gExim Auth failed2025-04-10 15:34:18 dovecot_login authenticator failed for (netcomafrica.com) [41.67.143.142]:60242: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)41.67.143.14223289261S a9) ossec5710gAttempt to login using a non-existent userApr 10 15:35:11 vm1 sshd[2986857]: Invalid user ccdgutb from 115.203.67.158 port 12026115.203.67.1581814991*R  CK) ossec5716gSSHD authentication failed.Apr 10 15:34:56 vm1 sshd[2986696]: Failed password for root from 115.203.67.158 port 12085 ssh2115.203.67.1581814991 x0 r e X K > 1 $  { n a T G : -   w j ] P C 6 )    s f Y L ? 2 % 0k^QD7*tgZM@ uE8+/"  h[N~qdWJ=0# zm`SF9, v i \ O B 5 (    =WJqd~A4'yl_R3& }pcVI<|obUx 1835841M 1835841M 1861060 1861060 1861060 1861060 1861060 1861060!; 1861060! 1861060 1861060"; 1861060! 1861060! 1861060%I 1861060% 1861060$ 1861060$ 1861060# 1861060 1861060&f 1861060& 1861060% 1861060% 1861060 1 1861060 0 1861060 $ 1835841O 1835841O 1835841Ox 1835841Om 1861060( 1861060( 1861060(m 1861060(F 1861060(E 1861060' 1861060'k 1861060' 1861060& 1835841O 1835841O 1835841O 1835841O 1861060, 1861060+ 1861060* 1861060* 1861060* 1861060*l 1861060*P 1861060) 1861060)| 1861060) 1861060( 1861060( 1861060( 1835841M 1835841J| 1835841O 1835841O 1835841O 18610600 18610600 18610600q 18610600W 18610600 1861060/ 1861060/ 1861060/ 1861060/ 1861060/j 1861060/e 1861060. 1861060.G 1861060.% 1861060- 1861060-{ 1861060-& 1861060, 1861060, 1861060,o 1835841N 1835841N 1835841N 1835841N 1835841N 1835841N} 1835841Nh 1835841NZ 1835841NW 1835841N@ 1835841N< 1835841N0 1835841N 1835841N 1835841N 1835841N 1835841M 1835841M 1835841M 1835841M 1835841M 1835841M 1835841M 1835841M 186106027 18610601 18610601 18610601_ 18610600 18610600 18610600 1835841O. 1835841O' 1835841O 1835841N 1835841N 1835841N 1835841N 1835841N 1835841M 1835841M 1835841M 1835841M 1835841Mv 1835841Mm 1835841Mh 1835841Ma 1835841MR 1835841MO 1835841M; 1835841M2 1835841M. 1835841M 1835841L 1835841L 1835841L 1835841L 1835841L 1835841L 1835841L 1835841L_ 1835841L\ 1835841LP 1835841LJ 1835841L; 1835841L" 1835841L 1835841L 1835841L 1835841L 1835841K 1835841K 1835841K 1835841K 1835841K 1835841K 1835841K 1835841K 1835841K 1835841K 1835841K 1835841K{ 1835841Kx 1835841Ke 1835841K_ 1835841KY 1835841KI 1835841KC 1835841K5 1861060 1861060 1861060 1861060 1861060 1861060 1861060 1861060 1861060 1835841K4 1835841K) 1835841K 1835841K 1835841J 1835841J 1835841J 1835841J 1861060 1861060 1861060^ 1861060 18610608 1861060 1861060 1861060 1861060 1861060 1861060 1861060 1861060 1861060 1861060~ 1861060w 1861060T 1861060 1861060~ 1861060R 1861060 1861060 1861060f 1861060Z 1861060L 1861060 1861060 1861060 1861060 1861060 1861060} 1861060] 1861060? 1861060 1861060 1861060 1861060 1861060u 1861060_ 1861060Y 1861060D 1861060% 1861060 1861060 1861060 1861060 1861060 1861060b 1861060P 1861060 1861060 1861060 1861060 1861060 1861060 1861060 1861060 1861060 1861060 1861060 1861060 o 1861060 1861060 1861060 = 1835841Oh 1835841OW 1835841OG 1835841O@ 1835841O= S  ! C Q sp5Q-u a3) ossec5710g Attempt to login using a non-existent userApr 10 18:35:16 vm1 sshd[3026698]: Invalid user test from 85.109.184.220 port 4237885.109.184.220298795)t  CK) ossec5716gSSHD authentication failed.Apr 10 18:35:00 vm1 sshd[3026534]: Failed password for root from 85.109.184.220 port 41492 ssh285.109.184.220298795`s E5) ossec2501gUser authentication failure.Apr 10 18:34:58 vm1 sshd[3026534]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=85.109.184.220 user=root85.109.184.220298795(r  3U) ossec11301gfNew FTP connection.Apr 10 18:32:29 vm1 pure-ftpd[3026162]: (?@172.171.247.70) [INFO] New connection from 172.171.247.70172.171.247.706252001cq  -U% ossec13001gExim Auth failed2025-04-10 18:25:13 dovecot_login authenticator failed for c-68-83-220-83.hsd1.md.comcast.net [68.83.220.83]:14412: 535 Incorrect authentication data (set_id=sales)68.83.220.836252001gp  -[' ossec13001gExim Auth failed2025-04-10 18:25:03 dovecot_login authenticator failed for ([91.206.15.245]) [91.206.15.245]:45336: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)91.206.15.2452017370ao  -S' ossec13001gPExim Auth failed2025-04-10 18:10:47 dovecot_login authenticator failed for ([65.20.251.127]) [65.20.251.127]:52351: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)65.20.251.12799237vn  -{' ossec13001gAExim Auth failed2025-04-10 18:10:32 dovecot_login authenticator failed for ([196.191.212.226]) [213.55.85.202]:2452: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)213.55.85.202337996Zm  -?) ossec13001gExim Auth failed2025-04-10 17:51:18 dovecot_login authenticator failed for ([218.150.170.10]) [218.150.170.10]:54598: 535 Incorrect authentication data (set_id=purchase)218.150.170.101835841l  - ) ossec13001gExim Auth failed2025-04-10 17:51:06 dovecot_login authenticator failed for syn-035-130-111-146.biz.spectrum.com [35.130.111.146]:37446: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)35.130.111.1466252001Zk  -?) ossec13001guExim Auth failed2025-04-10 17:41:32 dovecot_login authenticator failed for ([79.170.189.164]) [79.170.189.164]:59395: 535 Incorrect authentication data (set_id=purchase)79.170.189.1641220409nj  -e+ ossec13001gkExim Auth failed2025-04-10 17:41:21 dovecot_login authenticator failed for ([36.154.247.90]) [221.228.167.175]:51806: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)221.228.167.1751814991Zi  -=+ ossec13001gfExim Auth failed2025-04-10 17:37:02 dovecot_login authenticator failed for ([164.152.240.101]) [164.152.240.101]:39412: 535 Incorrect authentication data (set_id=sales)164.152.240.1013469034vh  -y' ossec13001g[Exim Auth failed2025-04-10 17:36:49 dovecot_login authenticator failed for (134.56.58.179.hwccustomers.com) [134.56.58.179]:45135: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)134.56.58.1796252001+g  3Y+ ossec11301gNew FTP connection.Apr 10 17:29:42 vm1 pure-ftpd[3012117]: (?@213.209.150.198) [INFO] New connection from 213.209.150.198213.209.150.1982921044Gf  A+ ossec11302gFTP Authentication failed.Apr 10 17:29:46 vm1 pure-ftpd[3012117]: (?@213.209.150.198) [WARNING] Authentication failed for user [shubham.kulshreshtha]213.209.150.1982921044:e  Ak) ossec11302gFTP Authentication failed.Apr 10 17:25:00 vm1 pure-ftpd[3011121]: (?@34.140.186.203) [WARNING] Authentication failed for user [anonymous]34.140.186.2032802361)d 3U) ossec11301gNew FTP connection.Apr 10 17:24:56 vm1 pure-ftpd[3011121]: (?@34.140.186.203) [INFO] New connection from 34.140.186.20334.140.186.2032802361 *\~tj`VLB8.$zpf\H>4*   v l b X N D : 0 &    ~ t j ` V L B 8 . $    z p f \ R H > 4 *  vlbXND:&0|rh^TJ@6,"xndZPF2(< ~tj`VLB8.$zpf\ | r h ^ T J @ 6 , "    x n d Z P F < 2 (   RRH>4*  vlbXND:0& g> g> g> g3> g!> g> g> g> g> g> g> gc> gK> g> g> g> g> g> g> g > g> g|> g|> gz> gv> gvm> gvg> gq>> gq4> gi$> gi > gg> ge> ge> g]> g]> g]> gZ> gZ> gZ> gZ> gS0> gO> gO> gOy> gOK> gO?> gO3> gOa> gD<> gD"> gD> gC> gC> g8> g8> g8> g8> g-> g-> g-p> g-b> g,> g,> g*> g"> g"s> g"E> g"9> g;> g> g8> g*> g> g> gk> g[> gQ> gn> g ,> g "> g > g > g > g > g > g > g > gX> g> g> g> gl> g> g> g0> g> g> g> g> gZ> g> g> gބ> gx> g> g> g> g > g> gҽ> g\> g> gǸ> g>~ g>} g>| g>{ g>z g>y g>x g>w g>v g >u g>t g>s gf>r g>q g>p gP>o gA>n g>m g>l gu>k gk>j gf>i g[>h g>f g>g g>e g>d g>c g>b gS>a g>` g>_ g>^ g>] g>\ g>[ g>Z gZ>Y gN>X g>W g>V g>S g>R g>Q g>P g>U g>T g>O go>N gn>L g\>M g>K g>J g>I g!>H g>G g? g? g? gp? g{? gq? g? g? g ? g? g ? g? g? g? g9? g5? g? g? gf? gT? g? gf? g? g-? g!? g? g? g? g> gm> gK> gҼ> g > g> g> g> g> gn> g> g> g> g> g> g >F g>E g>D g1>C g>B g>A g>@ g>? g>> g>= g>< g>; g>: g>9 g>8 g>7 g{>6 g{>5 gxE>4 gpa>3 gpQ>2 gn>1 gn>0 gl>/ gl>. gf>- gf>, gd>* gd>+ gaw>) gaS>( gY{>' gYp>& gX>% gV>$ gV># gR>" gR>! gN/> gN> gJ> gJ> g? gH> gH> gD> gDu> gDQ> gB> gB> g?> g?> g9> g7> g7> g4/> g4> g,J> g,(> g)> g(> g(> g!> g!> g > g > g> gw> g<> g > go> g> g= g= g= g= g= g= g= gI= g5= g k= g S= g = g= (u < b!3  ;c) ossec13008gMail Recipient rejected2025-04-10 19:59:56 H=(mail.msnews24.in) [165.154.210.99]:57497 F= rejected RCPT : Rejected relay attempt: '165.154.210.99' From: 'rhjfqh@msnews24.in' To: 'validxxx@gmailhotmail.com.br'165.154.210.991694008b  -S% ossec13001gExim Auth failed2025-04-10 19:47:59 dovecot_login authenticator failed for 40.ip-79-137-78.eu [79.137.78.40]:56192: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)79.137.78.403017382q  -u% ossec13001g Exim Auth failed2025-04-10 19:47:48 dovecot_login authenticator failed for ([65.20.170.59]) [65.20.170.59]:52751: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)65.20.170.59992378  Ai' ossec11302gFTP Authentication failed.Apr 10 19:46:32 vm1 pure-ftpd[3042775]: (?@35.205.211.45) [WARNING] Authentication failed for user [anonymous]35.205.211.452802361& 3Q' ossec11301gҽNew FTP connection.Apr 10 19:46:28 vm1 pure-ftpd[3042775]: (?@35.205.211.45) [INFO] New connection from 35.205.211.4535.205.211.452802361(  3U) ossec11301g\New FTP connection.Apr 10 19:10:43 vm1 pure-ftpd[3034673]: (?@194.165.16.164) [INFO] New connection from 194.165.16.164194.165.16.1642993457i  -[+ ossec13001gExim Auth failed2025-04-10 18:59:46 dovecot_login authenticator failed for ([175.203.245.102]) [175.203.245.102]:47282: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)175.203.245.1021835841s  -u% ossec13001gǸExim Auth failed2025-04-10 18:59:26 dovecot_login authenticator failed for ([209.14.2.218]) [209.14.2.218]:50340: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)209.14.2.21834690343~ a;+ ossec5710gAttempt to login using a non-existent userApr 10 18:52:32 vm1 sshd[3030734]: Invalid user alamgir from 117.176.131.186 port 52530117.176.131.1861814991W}  E!+ ossec2501gUser authentication failure.Apr 10 18:52:32 vm1 sshd[3030734]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=117.176.131.186117.176.131.18618149914| a=+ ossec5710gAttempt to login using a non-existent userApr 10 18:52:02 vm1 sshd[3030537]: Invalid user madanika from 117.176.131.186 port 51018117.176.131.1861814991,{  CM+ ossec5716gSSHD authentication failed.Apr 10 18:51:51 vm1 sshd[3030509]: Failed password for root from 117.176.131.186 port 50204 ssh2117.176.131.1861814991cz E7+ ossec2501gUser authentication failure.Apr 10 18:51:49 vm1 sshd[3030509]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=117.176.131.186 user=root117.176.131.1861814991y  W) ossec9708gDovecot Aborted Login with empty userApr 10 18:42:47 vm1 dovecot[1526]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=118.194.250.95, lip=103.74.54.108, TLS, session=<8ImWV2wycM12wvpf>118.194.250.951605651~x  U_) ossec11001gDeferred login on the cpanel service[2025-04-10 18:38:16 +0530] info [webmaild] 106.221.236.78 - kps@amplifypowerglobal.com "GET /cpsess4070907781/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [106.221.238.167] != Current IP Address [106.221.236.78]106.221.236.781269750/w a7) ossec5710gAttempt to login using a non-existent userApr 10 18:35:33 vm1 sshd[3026791]: Invalid user ubuntu from 85.109.184.220 port 4325885.109.184.220298795Tv  E) ossec2501gUser authentication failure.Apr 10 18:35:33 vm1 sshd[3026791]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=85.109.184.22085.109.184.220298795 ^ L  +I(,<B^`  -O% ossec13001gExim Auth failed2025-04-10 23:02:12 dovecot_login authenticator failed for ([115.46.88.68]) [115.46.88.68]:58236: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)115.46.88.681814991v  -y' ossec13001gExim Auth failed2025-04-10 23:01:53 dovecot_login authenticator failed for ([39.88.252.236]) [39.88.252.236]:40878: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)39.88.252.2361814991l  -c) ossec13001gExim Auth failed2025-04-10 22:53:19 dovecot_login authenticator failed for c-73-106-172-226.hsd1.ga.comcast.net [73.106.172.226]:48952: 535 Incorrect authentication data (set_id=purchase)73.106.172.2266252001x  -{) ossec13001glExim Auth failed2025-04-10 22:52:51 dovecot_login authenticator failed for host-196-47-172-253.afnet.net [196.47.172.253]:50764: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)196.47.172.2532287781  W+ ossec9708gDovecot Aborted Login with empty userApr 10 22:28:20 vm1 dovecot[1526]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=185.247.137.167, lip=103.74.54.108, TLS, session=185.247.137.167298795^ -G' ossec13001gExim Auth failed2025-04-10 22:16:55 dovecot_login authenticator failed for (amplifypowerglobal.com) [111.56.54.202]:49608: 535 Incorrect authentication data (set_id=nologin)111.56.54.2021814991f  -W) ossec13001g0Exim Auth failed2025-04-10 22:13:26 dovecot_login authenticator failed for ([221.235.182.76]) [61.184.128.210]:42611: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)61.184.128.2101814991  -+ ossec13001gExim Auth failed2025-04-10 22:13:08 dovecot_login authenticator failed for 148.sub-166-143-166.myvzw.com [166.143.166.148]:42553: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)166.143.166.1486252001y  -}) ossec13001gExim Auth failed2025-04-10 21:25:05 dovecot_login authenticator failed for ([144.22.210.132]) [144.22.210.132]:36376: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)144.22.210.1323469034v  -y' ossec13001gExim Auth failed2025-04-10 21:25:23 dovecot_login authenticator failed for h-155-4-122-224.a259.priv.bahnhof.se [155.4.122.224]:48612: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)155.4.122.2242661886Y -?% ossec13001gExim Auth failed2025-04-10 21:16:04 dovecot_login authenticator failed for (thepsindustries.com) [119.96.131.8]:33198: 535 Incorrect authentication data (set_id=nologin)119.96.131.81814991%  3Q' ossec11301gZNew FTP connection.Apr 10 21:14:24 vm1 pure-ftpd[3061773]: (?@205.210.31.57) [INFO] New connection from 205.210.31.57205.210.31.576252001, 3Y+ ossec11301gNew FTP connection.Apr 10 20:51:33 vm1 pure-ftpd[3056942]: (?@154.212.141.213) [INFO] New connection from 154.212.141.213154.212.141.2131819730%  3Q' ossec11301gNew FTP connection.Apr 10 20:38:45 vm1 pure-ftpd[3054047]: (?@206.168.34.70) [INFO] New connection from 206.168.34.70206.168.34.706252001n  -k% ossec13001gބExim Auth failed2025-04-10 20:36:42 dovecot_login authenticator failed for wsip-68-15-163-18.no.no.cox.net [68.15.163.18]:8908: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)68.15.163.186252001v  -y' ossec13001gxExim Auth failed2025-04-10 20:36:30 dovecot_login authenticator failed for ([5.181.208.182]) [5.181.208.182]:52940: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)5.181.208.1822017370  W) ossec9708gDovecot Aborted Login with empty userApr 10 20:17:11 vm1 dovecot[1526]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=185.247.137.38, lip=103.74.54.108, TLS, session=<4YY1qW0yTaO594km>185.247.137.38298795 yT bxGNsyv(  -y' ossec13001g*Exim Auth failed2025-04-11 00:38:26 dovecot_login authenticator failed for ([203.45.200.87]) [203.45.200.87]:60478: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)203.45.200.872077456W'  -9) ossec13001gExim Auth failed2025-04-11 00:37:34 dovecot_login authenticator failed for ([129.21.143.195]) [129.21.143.195]:43750: 535 Incorrect authentication data (set_id=sales)129.21.143.1956252001u&  -w' ossec13001gExim Auth failed2025-04-11 00:37:21 dovecot_login authenticator failed for (51.241.220.60.adsl-pool.sx.cn) [60.220.241.50]:42974: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)60.220.241.501814991;%  ;s) ossec13008gkMail Recipient rejected2025-04-11 00:22:26 H=(mail.msnews24.in) [165.154.210.99]:63058 F= rejected RCPT : Rejected relay attempt: '165.154.210.99' From: 'zcobouencp@msnews24.in' To: 'validxxx@gmailhotmail.com.br'165.154.210.991694008n$  -e+ ossec13001g[Exim Auth failed2025-04-11 00:22:11 dovecot_login authenticator failed for (static-97.224.143.114-tataidc.co.in) [182.156.133.169]:5134: 535 Incorrect authentication data (set_id=purchase)182.156.133.1691269750f#  -[% ossec13001gQExim Auth failed2025-04-11 00:22:01 dovecot_login authenticator failed for ([8.243.166.66]) [8.243.166.66]:4501: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)8.243.166.663686110"  ?1 ossec1008gnProcess exiting (killed).Apr 11 00:05:24 vm1 spamd[2784449]: spamd: server killed by SIGTERM, shutting downT!  -7% ossec13001g ,Exim Auth failed2025-04-10 23:55:46 dovecot_login authenticator failed for ([1.27.171.154]) [1.27.171.154]:51800: 535 Incorrect authentication data (set_id=purchase)1.27.171.1541814991`  -U! ossec13001g "Exim Auth failed2025-04-10 23:55:37 dovecot_login authenticator failed for ([5.32.107.6]) [5.32.107.6]:42998: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)5.32.107.6290557  - ) ossec13001g Exim Auth failed2025-04-10 23:55:27 dovecot_login authenticator failed for (163.pool90-160-139.dynamic.orange.es) [90.160.139.163]:51720: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)90.160.139.1632510769c  -S' ossec13001g Exim Auth failed2025-04-10 23:50:27 dovecot_login authenticator failed for ([218.15.222.74]) [218.15.222.74]:49808: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)218.15.222.7418149913  ;c) ossec13008g Mail Recipient rejected2025-04-10 23:51:04 H=(mail.msnews24.in) [165.154.210.52]:59147 F= rejected RCPT : Rejected relay attempt: '165.154.210.52' From: 'ilsrmx@msnews24.in' To: 'validxxx@gmailhotmail.com.br'165.154.210.521694008   -!' ossec13001g Exim Auth failed2025-04-10 23:50:13 dovecot_login authenticator failed for (nsg-static-177.199.72.182.airtel.in) [182.66.222.86]:58080: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)182.66.222.861269750Z  -=+ ossec13001g Exim Auth failed2025-04-10 23:49:29 dovecot_login authenticator failed for ([110.189.153.136]) [110.189.153.136]:49975: 535 Incorrect authentication data (set_id=sales)110.189.153.1361814991m  -c+ ossec13001g Exim Auth failed2025-04-10 23:49:13 dovecot_login authenticator failed for ([188.114.151.158]) [188.114.151.158]:36614: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)188.114.151.1582623032(  3U) ossec11301g New FTP connection.Apr 10 23:40:20 vm1 pure-ftpd[3093747]: (?@135.237.127.76) [INFO] New connection from 135.237.127.76135.237.127.766252001(  3U) ossec11301gXNew FTP connection.Apr 10 23:22:23 vm1 pure-ftpd[3089771]: (?@112.115.155.82) [INFO] New connection from 112.115.155.82112.115.155.821814991 ,> R X m m us,P8  -1% ossec13001g8Exim Auth failed2025-04-11 03:01:34 dovecot_login authenticator failed for ([37.25.36.197]) [37.25.36.197]:55347: 535 Incorrect authentication data (set_id=sales)37.25.36.197294640f7  -[% ossec13001g8Exim Auth failed2025-04-11 03:01:22 dovecot_login authenticator failed for ([203.195.208.77]) [116.30.0.238]:44324: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)116.30.0.2381814991|6  -+ ossec13001g-Exim Auth failed2025-04-11 02:14:07 dovecot_login authenticator failed for ([125.140.244.144]) [125.140.244.144]:46844: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)125.140.244.1441835841b5  -S' ossec13001g-Exim Auth failed2025-04-11 02:14:20 dovecot_login authenticator failed for ([94.204.78.117]) [94.204.78.117]:55781: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)94.204.78.117290557j4  -_+ ossec13001g-pExim Auth failed2025-04-11 02:13:28 dovecot_login authenticator failed for (213-227-245-154.static.vega-ua.net) [213.227.245.154]:58996: 535 Incorrect authentication data (set_id=sales)213.227.245.154690791d3  -W% ossec13001g-bExim Auth failed2025-04-11 02:13:13 dovecot_login authenticator failed for ([42.81.140.83]) [42.81.140.83]:60535: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)42.81.140.831814991m2  -e) ossec13001g,Exim Auth failed2025-04-11 02:10:33 dovecot_login authenticator failed for ([60.191.239.186]) [60.191.239.186]:17009: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)60.191.239.1861814991X1  -=' ossec13001g,Exim Auth failed2025-04-11 02:10:44 dovecot_login authenticator failed for (netcomafrica.com) [41.67.143.142]:45358: 535 Incorrect authentication data (set_id=purchase)41.67.143.1422328926~0  ;{) ossec13008g*Mail Recipient rejected2025-04-11 02:01:53 H=([45.144.212.206]) [45.144.212.206]:58531 F= rejected RCPT : SMTP AUTH is required for message submission on port 58745.144.212.206690791t/  -s) ossec13001g"Exim Auth failed2025-04-11 01:27:02 dovecot_login authenticator failed for ip79-132-125-226.ulk.host.ttk.ru [79.132.125.226]:54256: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)79.132.125.2262017370|.  -+ ossec13001g"sExim Auth failed2025-04-11 01:26:35 dovecot_login authenticator failed for ([220.158.233.247]) [220.158.233.247]:50180: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)220.158.233.2471831722g-  -[' ossec13001g"EExim Auth failed2025-04-11 01:25:49 dovecot_login authenticator failed for syn-047-038-202-184.res.spectrum.com [47.38.202.184]:51460: 535 Incorrect authentication data (set_id=sales)47.38.202.1846252001v,  -w) ossec13001g"9Exim Auth failed2025-04-11 01:25:36 dovecot_login authenticator failed for (undefined.hostname.localhost) [103.66.148.250]:60444: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)103.66.148.2501168579h+  -_% ossec13001g;Exim Auth failed2025-04-11 01:12:50 dovecot_login authenticator failed for (heipowersystem.com) [60.2.243.174]:58182: 535 Incorrect authentication data (set_id=admin@heipowersystem.com)60.2.243.1741814991W*  -=% ossec13001gExim Auth failed2025-04-11 01:12:19 dovecot_login authenticator failed for (heipowersystem.com) [60.2.243.174]:54910: 535 Incorrect authentication data (set_id=nologin)60.2.243.1741814991c)  -S' ossec13001g8Exim Auth failed2025-04-11 00:38:39 dovecot_login authenticator failed for ([1.252.204.203]) [1.252.204.203]:52790: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)1.252.204.2031835841    -UouH  -w' ossec13001gZExim Auth failed2025-04-11 05:25:51 dovecot_login authenticator failed for (51.241.220.60.adsl-pool.sx.cn) [60.220.241.50]:56154: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)60.220.241.501814991)G 3U) ossec11301gS0New FTP connection.Apr 11 04:54:30 vm1 pure-ftpd[3163066]: (?@206.168.34.125) [INFO] New connection from 206.168.34.125206.168.34.1256252001TF  -7% ossec13001gOExim Auth failed2025-04-11 04:39:17 dovecot_login authenticator failed for ([58.16.114.36]) [58.16.114.36]:37812: 535 Incorrect authentication data (set_id=purchase)58.16.114.361814991jE  -a' ossec13001gOExim Auth failed2025-04-11 04:39:02 dovecot_login authenticator failed for ([118.38.239.52]) [118.38.239.52]:53750: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)118.38.239.521835841bD  -S' ossec13001gOyExim Auth failed2025-04-11 04:38:41 dovecot_login authenticator failed for ([185.167.56.70]) [185.167.56.70]:36926: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)185.167.56.70617790TC  -7' ossec13001gOKExim Auth failed2025-04-11 04:37:54 dovecot_login authenticator failed for ([196.191.212.236]) [213.55.85.202]:2527: 535 Incorrect authentication data (set_id=sales)213.55.85.202337996mB  -c+ ossec13001gO?Exim Auth failed2025-04-11 04:37:42 dovecot_login authenticator failed for ([117.232.111.253]) [117.232.111.251]:57974: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)117.232.111.2511269750gA  -[' ossec13001gO3Exim Auth failed2025-04-11 04:37:31 dovecot_login authenticator failed for ([203.81.213.46]) [203.81.213.46]:41875: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)203.81.213.461168579@  -) ossec13001gOaExim Auth failed2025-04-11 04:38:16 dovecot_login authenticator failed for p5de77aeb.dip0.t-ipconnect.de [93.231.122.235]:35455: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)93.231.122.2352921044u?  -s+ ossec13001gD<Exim Auth failed2025-04-11 03:50:44 dovecot_login authenticator failed for (dhcp-192-211-156.in2cable.com) [203.192.211.156]:43070: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)203.192.211.1561269750p>  -q# ossec13001gD"Exim Auth failed2025-04-11 03:50:17 dovecot_login authenticator failed for ([27.71.26.64]) [27.71.26.64]:64391: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)27.71.26.641562822Y=  -;+ ossec13001gDExim Auth failed2025-04-11 03:49:51 dovecot_login authenticator failed for ([143.192.98.134]) [175.139.253.161]:28238: 535 Incorrect authentication data (set_id=sales)175.139.253.16117330454<  ;g' ossec13008gCMail Recipient rejected2025-04-11 03:49:41 H=(mail.msnews24.in) [45.197.14.138]:52508 F= rejected RCPT : Rejected relay attempt: '45.197.14.138' From: 'gufvtapk@msnews24.in' To: 'validxxx@gmailhotmail.com.br'45.197.14.1386252001o;  -m% ossec13001gCExim Auth failed2025-04-11 03:49:24 dovecot_login authenticator failed for agencijaiiz1-155.bih.net.ba [80.65.90.155]:34870: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)80.65.90.1553277605f:  -W) ossec13001g8Exim Auth failed2025-04-11 03:02:47 dovecot_login authenticator failed for ([41.207.168.217]) [41.207.168.162]:57336: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)41.207.168.1622363686 9  -!+ ossec13001g8Exim Auth failed2025-04-11 03:02:28 dovecot_login authenticator failed for (223-197-153-143.static.imsbiz.com) [223.197.153.143]:64373: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)223.197.153.1431819730   * ~ GGq/(Y  3U) ossec11301gzNew FTP connection.Apr 11 07:40:14 vm1 pure-ftpd[3199876]: (?@167.94.138.165) [INFO] New connection from 167.94.138.165167.94.138.1656252001X  Ug) ossec11001gvDeferred login on the cpanel service[2025-04-11 07:27:15 +0530] info [webmaild] 106.221.225.31 - kps@amplifypowerglobal.com "POST /cpsess4070907781/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [106.221.236.78] != Current IP Address [106.221.225.31]106.221.225.3112697505W  Aa) ossec11302gvmFTP Authentication failed.Apr 11 07:24:52 vm1 pure-ftpd[3195967]: (?@95.104.191.248) [WARNING] Authentication failed for user [Alex]95.104.191.2482017370(V  3U) ossec11301gvgNew FTP connection.Apr 11 07:24:46 vm1 pure-ftpd[3195967]: (?@95.104.191.248) [INFO] New connection from 95.104.191.24895.104.191.2482017370kU  -c' ossec13001gq>Exim Auth failed2025-04-11 07:02:46 dovecot_login authenticator failed for (nsg-corporate-70.104.187.122.airtel.in) [117.250.250.2]:43982: 535 Incorrect authentication data (set_id=sales)117.250.250.21269750jT  -_) ossec13001gq4Exim Auth failed2025-04-11 07:02:35 dovecot_login authenticator failed for ([95.221.196.202]) [95.221.196.202]:60824: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)95.221.196.2022017370RS  -1' ossec13001gi$Exim Auth failed2025-04-11 06:28:11 dovecot_login authenticator failed for (hn.kd.ny.adsl) [123.13.237.76]:44498: 535 Incorrect authentication data (set_id=sales)123.13.237.761814991|R  -) ossec13001gi Exim Auth failed2025-04-11 06:27:46 dovecot_login authenticator failed for syn-035-130-111-146.biz.spectrum.com [35.130.111.146]:56959: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)35.130.111.1466252001(Q  3U) ossec11301ggNew FTP connection.Apr 11 06:19:21 vm1 pure-ftpd[3181756]: (?@162.142.125.40) [INFO] New connection from 162.142.125.40162.142.125.406252001pP  -i+ ossec13001geExim Auth failed2025-04-11 06:14:05 dovecot_login authenticator failed for p1602147-ipxg05401yosida.nagano.ocn.ne.jp [153.185.210.147]:61618: 535 Incorrect authentication data (set_id=sales)153.185.210.1471861060aO  -S# ossec13001geExim Auth failed2025-04-11 06:13:45 dovecot_login authenticator failed for ([180.71.9.31]) [180.71.9.31]:59376: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)180.71.9.311835841.N a5' ossec5710g]Attempt to login using a non-existent userApr 11 05:36:32 vm1 sshd[3172661]: Invalid user justin from 106.61.35.134 port 31350106.61.35.1341814991(M  CI' ossec5716g]SSHD authentication failed.Apr 11 05:36:29 vm1 sshd[3172656]: Failed password for root from 106.61.35.134 port 31207 ssh2106.61.35.1341814991_L E3' ossec2501g]User authentication failure.Apr 11 05:36:26 vm1 sshd[3172656]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.61.35.134 user=root106.61.35.1341814991pK  -k) ossec13001gZExim Auth failed2025-04-11 05:27:02 dovecot_login authenticator failed for (18776239145.telemar.net.br) [200.199.32.174]:35403: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)200.199.32.1743469034J  -' ossec13001gZExim Auth failed2025-04-11 05:26:38 dovecot_login authenticator failed for 46-162-104-66.cust.bredband2.com [46.162.104.66]:45970: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)46.162.104.662661886rI  -q' ossec13001gZExim Auth failed2025-04-11 05:26:02 dovecot_login authenticator failed for p5df05771.dip0.t-ipconnect.de ([89.107.163.13]) [93.240.87.113]:11068: 535 Incorrect authentication data (set_id=sales)93.240.87.1132921044 < Z " ( MG_Wk -7) ossec13001gExim Auth failed2025-04-11 10:34:30 dovecot_login authenticator failed for (rokamauka.com) [42.193.105.109]:39568: 535 Incorrect authentication data (set_id=nologin)42.193.105.1091814991gj  -[' ossec13001gExim Auth failed2025-04-11 10:16:38 dovecot_login authenticator failed for syn-097-089-202-226.biz.spectrum.com [97.89.202.226]:44970: 535 Incorrect authentication data (set_id=sales)97.89.202.2266252001|i  -) ossec13001gExim Auth failed2025-04-11 10:16:19 dovecot_login authenticator failed for 171.41.246.220.static.netvigator.com [220.246.41.171]:51767: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)220.246.41.1711819730Zh  -?) ossec13001gExim Auth failed2025-04-11 09:51:16 dovecot_login authenticator failed for ([185.168.173.87]) [185.168.173.87]:35650: 535 Incorrect authentication data (set_id=purchase)185.168.173.873175395dg  -Y# ossec13001gExim Auth failed2025-04-11 09:51:08 dovecot_login authenticator failed for ([27.71.26.64]) [27.71.26.64]:26413: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)27.71.26.641562822%f  3Q' ossec11301gNew FTP connection.Apr 11 09:46:37 vm1 pure-ftpd[3227623]: (?@167.94.146.56) [INFO] New connection from 167.94.146.56167.94.146.566252001be  -Q' ossec13001gcExim Auth failed2025-04-11 09:28:26 dovecot_login authenticator failed for 42-200-141-56.static.imsbiz.com [42.200.141.56]:37318: 535 Incorrect authentication data (set_id=sales)42.200.141.561819730d  - ' ossec13001gKExim Auth failed2025-04-11 09:28:02 dovecot_login authenticator failed for pool-71-246-200-54.washdc.fios.verizon.net [71.246.200.54]:45580: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)71.246.200.546252001Bc  gU) ossec11307gMultiple connection attempts from same sourceApr 11 08:47:02 vm1 pure-ftpd[3214892]: (?@35.216.200.199) [INFO] New connection from 35.216.200.19935.216.200.1992658434)b 3U) ossec11301g New FTP connection.Apr 11 08:46:58 vm1 pure-ftpd[3214871]: (?@35.216.200.199) [INFO] New connection from 35.216.200.19935.216.200.1992658434Wa  -9) ossec13001gExim Auth failed2025-04-11 08:39:52 dovecot_login authenticator failed for ([221.209.48.204]) [221.209.48.203]:55322: 535 Incorrect authentication data (set_id=sales)221.209.48.2031814991v`  -w) ossec13001gExim Auth failed2025-04-11 08:39:34 dovecot_login authenticator failed for ool-4579c7cb.dyn.optonline.net [69.121.199.203]:38444: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)69.121.199.20362520011_ a;' ossec5710gAttempt to login using a non-existent userApr 11 08:01:49 vm1 sshd[3204925]: Invalid user wuyuanfeng from 14.108.50.241 port 969514.108.50.2411814991T^ E' ossec2501gUser authentication failure.Apr 11 08:01:50 vm1 sshd[3204925]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.108.50.24114.108.50.2411814991']  CG' ossec5716g SSHD authentication failed.Apr 11 08:01:36 vm1 sshd[3204888]: Failed password for root from 14.108.50.241 port 9629 ssh214.108.50.2411814991^\  E3' ossec2501gUser authentication failure.Apr 11 08:01:34 vm1 sshd[3204888]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.108.50.241 user=root14.108.50.2411814991V[  -?! ossec13001g|Exim Auth failed2025-04-11 07:51:42 dovecot_login authenticator failed for (h81-61-59-6.seed.net.tw) [61.59.6.81]:45370: 535 Incorrect authentication data (set_id=sales)61.59.6.811668284fZ  -[' ossec13001g|Exim Auth failed2025-04-11 07:51:22 dovecot_login authenticator failed for ([185.167.56.70]) [185.167.56.70]:60496: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)185.167.56.70617790 : > d y EGapw_| -G) ossec13001gҼExim Auth failed2025-04-11 13:58:43 dovecot_login authenticator failed for (s2seducationtrust.com) [42.193.105.109]:58982: 535 Incorrect authentication data (set_id=nologin)42.193.105.1091814991u{  -u+ ossec13001g Exim Auth failed2025-04-11 13:30:08 dovecot_login authenticator failed for (static.155.239.181.135.clients.your-server.de) [135.181.239.155]:60386: 535 Incorrect authentication data (set_id=sales)135.181.239.155660013mz  -c+ ossec13001gExim Auth failed2025-04-11 13:29:56 dovecot_login authenticator failed for ([183.105.138.168]) [183.105.138.168]:42442: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)183.105.138.1681835841by  -S% ossec13001gExim Auth failed2025-04-11 12:42:03 dovecot_login authenticator failed for (20118058062.host.telemar.net.br) [201.18.58.62]:60087: 535 Incorrect authentication data (set_id=sales)201.18.58.623469034zx  -% ossec13001gExim Auth failed2025-04-11 12:41:49 dovecot_login authenticator failed for broadband-188-32-68-79.ip.moscow.rt.ru [188.32.68.79]:54546: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)188.32.68.792017370Nw  --# ossec13001gExim Auth failed2025-04-11 11:53:59 dovecot_login authenticator failed for ([103.50.5.94]) [103.50.5.94]:46613: 535 Incorrect authentication data (set_id=sales)103.50.5.941269750av  -S# ossec13001gnExim Auth failed2025-04-11 11:53:42 dovecot_login authenticator failed for ([31.173.0.26]) [31.173.0.26]:47582: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)31.173.0.262017370hu  -[) ossec13001gExim Auth failed2025-04-11 11:22:20 dovecot_login authenticator failed for (213.33.204.130.moscow.gldn.net) [213.33.204.130]:60026: 535 Incorrect authentication data (set_id=purchase)213.33.204.1302017370it  -a' ossec13001gExim Auth failed2025-04-11 11:22:08 dovecot_login authenticator failed for ([91.73.195.150]) [91.73.195.150]:51446: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)91.73.195.150290557Zs  -=+ ossec13001gExim Auth failed2025-04-11 11:05:00 dovecot_login authenticator failed for ([112.194.143.206]) [112.194.143.206]:38538: 535 Incorrect authentication data (set_id=sales)112.194.143.2061814991jr  -_) ossec13001gExim Auth failed2025-04-11 11:04:47 dovecot_login authenticator failed for ([147.28.180.179]) [147.28.180.179]:44956: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)147.28.180.1796252001Tq  -5' ossec13001gExim Auth failed2025-04-11 10:54:45 dovecot_login authenticator failed for ([60.213.27.250]) [60.213.27.250]:37374: 535 Incorrect authentication data (set_id=sales)60.213.27.2501814991gp  -[' ossec13001gExim Auth failed2025-04-11 10:54:30 dovecot_login authenticator failed for ([103.47.74.210]) [103.47.74.210]:34202: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)103.47.74.2101269750Vo  -;' ossec13001gExim Auth failed2025-04-11 10:42:12 dovecot_login authenticator failed for ([91.73.195.150]) [91.73.195.150]:46116: 535 Incorrect authentication data (set_id=purchase)91.73.195.150290557xn  -}' ossec13001gExim Auth failed2025-04-11 10:42:01 dovecot_login authenticator failed for (72.20.167.124.adsl-pool.sx.cn) [124.167.20.72]:56481: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)124.167.20.721814991Tm  -7% ossec13001g3Exim Auth failed2025-04-11 10:35:54 dovecot_login authenticator failed for ([38.44.66.162]) [38.44.66.162]:44569: 535 Incorrect authentication data (set_id=purchase)38.44.66.1623374766jl  -a' ossec13001g!Exim Auth failed2025-04-11 10:35:36 dovecot_login authenticator failed for ([94.102.51.218]) [94.102.51.218]:56128: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)94.102.51.2182750405 -: 3-W  -9) ossec13001gExim Auth failed2025-04-11 17:32:18 dovecot_login authenticator failed for ([185.137.103.84]) [185.137.103.84]:51888: 535 Incorrect authentication data (set_id=sales)185.137.103.842510769G  ai) ossec5710g9Attempt to login using a non-existent userApr 11 16:55:42 vm1 sshd[3316648]: Failed password for invalid user shaoen from 105.200.195.13 port 43644 ssh2105.200.195.13357994.  a7) ossec5710g5Attempt to login using a non-existent userApr 11 16:55:40 vm1 sshd[3316648]: Invalid user shaoen from 105.200.195.13 port 43644105.200.195.13357994* CK) ossec5716gSSHD authentication failed.Apr 11 16:55:10 vm1 sshd[3316399]: Failed password for root from 105.200.195.13 port 49368 ssh2105.200.195.13357994` E5) ossec2501gUser authentication failure.Apr 11 16:55:08 vm1 sshd[3316399]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=105.200.195.13 user=root105.200.195.13357994Z  -=+ ossec13001gfExim Auth failed2025-04-11 16:43:40 dovecot_login authenticator failed for ([118.220.149.129]) [118.220.149.129]:51856: 535 Incorrect authentication data (set_id=sales)118.220.149.1291835841d  -W% ossec13001gTExim Auth failed2025-04-11 16:43:23 dovecot_login authenticator failed for ([31.173.2.182]) [31.173.2.182]:38272: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)31.173.2.1822017370(  3U) ossec11301gfNew FTP connection.Apr 11 16:35:07 vm1 pure-ftpd[3312496]: (?@172.202.118.39) [INFO] New connection from 172.202.118.39172.202.118.396252001=  ;w) ossec13008gMail Recipient rejected2025-04-11 16:35:33 H=(mail.msnews24.in) [165.154.228.93]:49602 F= rejected RCPT : Rejected relay attempt: '165.154.228.93' From: 'jdudqqomkgw@msnews24.in' To: 'validxxx@gmailhotmail.com.br'165.154.228.931643084) ;K+ ossec13008gMail Recipient rejected2025-04-11 16:25:24 H=([104.167.222.201]) [104.167.222.201]:65454 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 CV=no F= rejected RCPT : SMTP AUTH is required for message submission on port 465104.167.222.2016252001j  -_) ossec13001g-Exim Auth failed2025-04-11 15:55:49 dovecot_login authenticator failed for ([220.178.201.58]) [220.178.201.58]:49169: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)220.178.201.581814991z  -' ossec13001g!Exim Auth failed2025-04-11 15:55:36 dovecot_login authenticator failed for syn-172-222-037-074.res.spectrum.com [172.222.37.74]:49894: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)172.222.37.746252001g  -[' ossec13001gExim Auth failed2025-04-11 15:23:40 dovecot_login authenticator failed for ([221.224.2.202]) [221.224.2.202]:47476: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)221.224.2.2021814991Q  -1% ossec13001gExim Auth failed2025-04-11 15:07:19 dovecot_login authenticator failed for ([41.231.85.75]) [41.231.85.75]:58994: 535 Incorrect authentication data (set_id=sales)41.231.85.752464461j  -_) ossec13001gExim Auth failed2025-04-11 15:07:05 dovecot_login authenticator failed for ([60.175.146.138]) [60.175.146.138]:60725: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)60.175.146.1381814991%  3Q' ossec11301gNew FTP connection.Apr 11 14:37:53 vm1 pure-ftpd[3288334]: (?@91.238.181.92) [INFO] New connection from 91.238.181.9291.238.181.923017382T~  -5' ossec13001gmExim Auth failed2025-04-11 14:18:45 dovecot_login authenticator failed for ([106.227.87.29]) [106.227.87.29]:51534: 535 Incorrect authentication data (set_id=sales)106.227.87.291814991j}  -_) ossec13001gKExim Auth failed2025-04-11 14:18:10 dovecot_login authenticator failed for ([192.34.128.202]) [192.34.128.202]:50690: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)192.34.128.2026252001 v4J *9az8v!  3I# ossec11301g$qNew FTP connection.Apr 11 19:47:19 vm1 pure-ftpd[3352355]: (?@20.14.80.89) [INFO] New connection from 20.14.80.8920.14.80.896252001B  gU) ossec11307g Multiple connection attempts from same sourceApr 11 19:28:50 vm1 pure-ftpd[3348427]: (?@185.242.226.22) [INFO] New connection from 185.242.226.22185.242.226.226252001) 3U) ossec11301g  New FTP connection.Apr 11 19:28:46 vm1 pure-ftpd[3348393]: (?@185.242.226.22) [INFO] New connection from 185.242.226.22185.242.226.226252001(  3U) ossec11301g^New FTP connection.Apr 11 19:25:41 vm1 pure-ftpd[3347935]: (?@185.242.226.22) [INFO] New connection from 185.242.226.22185.242.226.226252001W  -;' ossec13001gExim Auth failed2025-04-11 19:22:19 dovecot_login authenticator failed for ([39.165.236.12]) [39.165.236.12]:34436: 535 Incorrect authentication data (set_id=services)39.165.236.1218149913 a;+ ossec5710gAttempt to login using a non-existent userApr 11 19:22:38 vm1 sshd[3347219]: Invalid user alibaba from 113.161.241.120 port 48236113.161.241.1201562822,  CM+ ossec5716gSSHD authentication failed.Apr 11 19:22:28 vm1 sshd[3347207]: Failed password for root from 113.161.241.120 port 34136 ssh2113.161.241.1201562822c E7+ ossec2501gUser authentication failure.Apr 11 19:22:26 vm1 sshd[3347207]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=113.161.241.120 user=root113.161.241.1201562822T  -7% ossec13001gExim Auth failed2025-04-11 19:22:05 dovecot_login authenticator failed for ([175.198.18.3]) [175.198.18.3]:57675: 535 Incorrect authentication data (set_id=services)175.198.18.31835841m  -e) ossec13001gpExim Auth failed2025-04-11 19:21:43 dovecot_login authenticator failed for ([144.22.247.249]) [144.22.247.249]:44034: 535 Incorrect authentication data (set_id=services@heipowersystem.com)144.22.247.2493469034W  -9) ossec13001g{Exim Auth failed2025-04-11 19:09:07 dovecot_login authenticator failed for ([103.186.221.74]) [103.186.221.74]:37590: 535 Incorrect authentication data (set_id=sales)103.186.221.741269750v  -y' ossec13001gqExim Auth failed2025-04-11 19:08:56 dovecot_login authenticator failed for (170.250.128.5.hwccustomers.com) [170.250.128.5]:41102: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)170.250.128.56252001Q  -3# ossec13001gExim Auth failed2025-04-11 18:32:58 dovecot_login authenticator failed for ([45.170.50.2]) [45.170.50.2]:59612: 535 Incorrect authentication data (set_id=services)45.170.50.23932488p  -i+ ossec13001gExim Auth failed2025-04-11 18:32:46 dovecot_login authenticator failed for ([178.178.194.131]) [178.178.194.131]:35528: 535 Incorrect authentication data (set_id=services@heipowersystem.com)178.178.194.1312017370W  -9) ossec13001g Exim Auth failed2025-04-11 18:20:20 dovecot_login authenticator failed for ([220.77.182.169]) [220.77.182.169]:56454: 535 Incorrect authentication data (set_id=sales)220.77.182.1691835841z  -' ossec13001gExim Auth failed2025-04-11 18:20:02 dovecot_login authenticator failed for syn-071-012-241-225.res.spectrum.com [71.12.241.225]:41486: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)71.12.241.2256252001%  3Q' ossec11301g New FTP connection.Apr 11 18:07:08 vm1 pure-ftpd[3331602]: (?@20.64.105.115) [INFO] New connection from 20.64.105.11520.64.105.1156252001f  -[' ossec13001gExim Auth failed2025-04-11 17:32:02 dovecot_login authenticator failed for ([185.199.98.51]) [185.199.98.51]:50322: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)185.199.98.51690791H  -) ossec13001gExim Auth failed2025-04-11 17:31:48 dovecot_login authenticator failed for ([122.227.77.118]) [122.227.77.118]:57735: 535 Incorrect authentication data122.227.77.1181814991 S%7 L X Bhj(SQ4  -1% ossec13001g2Exim Auth failed2025-04-11 20:47:25 dovecot_login authenticator failed for ([101.13.4.128]) [101.13.4.128]:46152: 535 Incorrect authentication data (set_id=sales)101.13.4.1281668284d3  -W% ossec13001g2sExim Auth failed2025-04-11 20:47:06 dovecot_login authenticator failed for ([14.97.77.182]) [14.97.77.182]:42320: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)14.97.77.1821269750(2  3U) ossec11301g0New FTP connection.Apr 11 20:39:48 vm1 pure-ftpd[3362918]: (?@147.185.132.10) [INFO] New connection from 147.185.132.10147.185.132.106252001`1  -O' ossec13001g-Exim Auth failed2025-04-11 20:26:29 dovecot_login authenticator failed for (82.193.122.91.cl.ipnet.ua) [82.193.122.91]:56943: 535 Incorrect authentication data (set_id=purchase)82.193.122.91690791m0  -e) ossec13001g-Exim Auth failed2025-04-11 20:26:20 dovecot_login authenticator failed for ([118.45.101.159]) [118.45.101.159]:57056: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)118.45.101.1591835841U/  E) ossec2501g+{User authentication failure.Apr 11 20:17:21 vm1 sshd[3358518]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.23.144.224111.23.144.22418149910. a7) ossec5710g+yAttempt to login using a non-existent userApr 11 20:17:20 vm1 sshd[3358518]: Invalid user dbuser from 111.23.144.224 port 52550111.23.144.22418149913- a=) ossec5710g+_Attempt to login using a non-existent userApr 11 20:16:54 vm1 sshd[3358294]: Invalid user glassfish from 111.23.144.224 port 51724111.23.144.2241814991*,  CK) ossec5716g+?SSHD authentication failed.Apr 11 20:16:22 vm1 sshd[3358229]: Failed password for root from 111.23.144.224 port 50872 ssh2111.23.144.2241814991a+ E5) ossec2501g+=User authentication failure.Apr 11 20:16:19 vm1 sshd[3358229]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.23.144.224 user=root111.23.144.2241814991V* E) ossec2501g*User authentication failure.Apr 11 20:13:21 vm1 sshd[3357622]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.65.188.183222.65.188.1831814991.) a3) ossec5710g*Attempt to login using a non-existent userApr 11 20:13:21 vm1 sshd[3357622]: Invalid user jhon from 222.65.188.183 port 48416222.65.188.1831814991*(  CK) ossec5716g*}SSHD authentication failed.Apr 11 20:13:07 vm1 sshd[3357580]: Failed password for root from 222.65.188.183 port 48408 ssh2222.65.188.1831814991`'  E5) ossec2501g*{User authentication failure.Apr 11 20:13:05 vm1 sshd[3357580]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.65.188.183 user=root222.65.188.1831814991N&  -/! ossec13001g*Exim Auth failed2025-04-11 20:11:05 dovecot_login authenticator failed for ([14.33.96.3]) [14.33.96.3]:58020: 535 Incorrect authentication data (set_id=services)14.33.96.31835841p%  -i+ ossec13001g)Exim Auth failed2025-04-11 20:10:51 dovecot_login authenticator failed for ([211.221.130.246]) [211.221.130.246]:41334: 535 Incorrect authentication data (set_id=services@heipowersystem.com)211.221.130.2461835841g$  -[' ossec13001g'Exim Auth failed2025-04-11 19:58:21 dovecot_login authenticator failed for syn-024-097-253-246.biz.spectrum.com [24.97.253.246]:40742: 535 Incorrect authentication data (set_id=sales)24.97.253.2466252001j#  -_) ossec13001g&Exim Auth failed2025-04-11 19:58:09 dovecot_login authenticator failed for ([39.165.154.222]) [39.165.154.222]:58086: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)39.165.154.2221814991W" -=# ossec13001g&%Exim Auth failed2025-04-11 19:54:36 dovecot_login authenticator failed for (thepsindustries.com) [14.18.77.99]:54038: 535 Incorrect authentication data (set_id=nologin)14.18.77.991814991 O= I k i 3OZ\@OmG  -e) ossec13001g@Exim Auth failed2025-04-11 21:48:17 dovecot_login authenticator failed for ([123.209.107.18]) [123.209.107.18]:33490: 535 Incorrect authentication data (set_id=services@heipowersystem.com)123.209.107.182077456.F a5' ossec5710g@Attempt to login using a non-existent userApr 11 21:47:31 vm1 sshd[3377069]: Invalid user mading from 118.40.156.39 port 36821118.40.156.391835841(E  CI' ossec5716g@SSHD authentication failed.Apr 11 21:47:23 vm1 sshd[3377009]: Failed password for root from 118.40.156.39 port 57892 ssh2118.40.156.391835841_D E3' ossec2501g@User authentication failure.Apr 11 21:47:22 vm1 sshd[3377009]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.40.156.39 user=root118.40.156.391835841WC  -9) ossec13001g=Exim Auth failed2025-04-11 21:36:20 dovecot_login authenticator failed for ([180.72.149.185]) [180.72.149.185]:45970: 535 Incorrect authentication data (set_id=sales)180.72.149.1851733045zB  -}+ ossec13001g=Exim Auth failed2025-04-11 21:35:52 dovecot_login authenticator failed for kd113158205225.ppp-bb.dion.ne.jp [113.158.205.225]:36783: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)113.158.205.22518610600A a7) ossec5710g;Attempt to login using a non-existent userApr 11 21:26:28 vm1 sshd[3372371]: Invalid user nigaar from 120.224.46.107 port 38346120.224.46.1071814991*@  CK) ossec5716g;SSHD authentication failed.Apr 11 21:26:19 vm1 sshd[3372338]: Failed password for root from 120.224.46.107 port 52422 ssh2120.224.46.1071814991a? E5) ossec2501g;User authentication failure.Apr 11 21:26:17 vm1 sshd[3372338]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=120.224.46.107 user=root120.224.46.1071814991*>  CK) ossec5716g;SSHD authentication failed.Apr 11 21:26:06 vm1 sshd[3372316]: Failed password for root from 120.224.46.107 port 53996 ssh2120.224.46.1071814991`=  E5) ossec2501g;User authentication failure.Apr 11 21:26:04 vm1 sshd[3372316]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=120.224.46.107 user=root120.224.46.1071814991"<  3M% ossec11301g8New FTP connection.Apr 11 21:14:45 vm1 pure-ftpd[3370039]: (?@139.162.77.6) [INFO] New connection from 139.162.77.6139.162.77.61861060%;  3Q' ossec11301g7New FTP connection.Apr 11 21:07:00 vm1 pure-ftpd[3368489]: (?@64.62.197.209) [INFO] New connection from 64.62.197.20964.62.197.2096252001c:  -S' ossec13001g5rExim Auth failed2025-04-11 20:59:53 dovecot_login authenticator failed for a89-153-62-100.cpe.netcabo.pt [89.153.62.100]:38388: 535 Incorrect authentication data (set_id=services)89.153.62.1002264397~9  -) ossec13001g5gExim Auth failed2025-04-11 20:59:42 dovecot_login authenticator failed for 81-224-104-199-no600.tbcn.telia.com [81.224.104.199]:41023: 535 Incorrect authentication data (set_id=services@heipowersystem.com)81.224.104.1992661886Z8  -?) ossec13001g3yExim Auth failed2025-04-11 20:51:27 dovecot_login authenticator failed for ([221.209.48.204]) [221.209.48.203]:34564: 535 Incorrect authentication data (set_id=purchase)221.209.48.2031814991p7  -i+ ossec13001g3kExim Auth failed2025-04-11 20:51:14 dovecot_login authenticator failed for ([169.211.232.182]) [169.211.232.182]:54358: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)169.211.232.1821835841T6  -7% ossec13001g2Exim Auth failed2025-04-11 20:48:53 dovecot_login authenticator failed for ([38.44.66.162]) [38.44.66.162]:40394: 535 Incorrect authentication data (set_id=purchase)38.44.66.1623374766g5  -]% ossec13001g2Exim Auth failed2025-04-11 20:48:23 dovecot_login authenticator failed for ([138.36.24.33]) [138.36.24.33]:52874: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)138.36.24.333508796 )p -O/]frkY  -c) ossec13001gWExim Auth failed2025-04-11 23:25:13 dovecot_login authenticator failed for (85.105.250.118.static.ttnet.com.tr) [85.105.250.118]:51970: 535 Incorrect authentication data (set_id=services)85.105.250.118298795pX  -i+ ossec13001gWxExim Auth failed2025-04-11 23:25:03 dovecot_login authenticator failed for ([221.163.227.238]) [221.163.227.238]:39894: 535 Incorrect authentication data (set_id=services@heipowersystem.com)221.163.227.2381835841sW  -s' ossec13001gW,Exim Auth failed2025-04-11 23:23:47 dovecot_login authenticator failed for (49.206.244.235.actcorp.in) [49.206.241.22]:2885: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)49.206.241.221269750NV  -/! ossec13001gWFExim Auth failed2025-04-11 23:24:13 dovecot_login authenticator failed for ([1.30.20.98]) [1.30.20.98]:56270: 535 Incorrect authentication data (set_id=purchase)1.30.20.981814991 rejected RCPT : Rejected relay attempt: '165.154.210.52' From: 'fdyffkm@msnews24.in' To: 'validxxx@gmailhotmail.com.br'165.154.210.521694008ne  -g) ossec13001gmExim Auth failed2025-04-12 01:01:05 dovecot_login authenticator failed for net-188-152-225-58.cust.vodafonedsl.it [188.152.225.58]:44461: 535 Incorrect authentication data (set_id=services)188.152.225.583175395d  -% ossec13001gmExim Auth failed2025-04-12 01:00:53 dovecot_login authenticator failed for (customer-187-218-57-50.uninet-ide.com.mx) [138.84.62.31]:19651: 535 Incorrect authentication data (set_id=services@heipowersystem.com)138.84.62.313996063c  -+ ossec13001gkExim Auth failed2025-04-12 00:48:28 dovecot_login authenticator failed for 178.183.110.215.mobile.static.t-mobile.pl [178.183.110.215]:40892: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)178.183.110.215798544hb  -[) ossec13001gk'Exim Auth failed2025-04-12 00:49:02 dovecot_login authenticator failed for nova-185-040-122-250.cpe.novanet.is [185.40.122.250]:46313: 535 Incorrect authentication data (set_id=sales)185.40.122.2502629691ca  -S' ossec13001gkExim Auth failed2025-04-12 00:48:45 dovecot_login authenticator failed for 111-70-23-250.emome-ip.hinet.net [111.70.23.250]:60774: 535 Incorrect authentication data (set_id=sales)111.70.23.2501668284T`  -7% ossec13001gbExim Auth failed2025-04-12 00:13:52 dovecot_login authenticator failed for ([110.35.63.30]) [110.35.63.30]:42512: 535 Incorrect authentication data (set_id=services)110.35.63.301835841m_  -e) ossec13001gbExim Auth failed2025-04-12 00:13:25 dovecot_login authenticator failed for ([117.69.210.199]) [117.69.210.199]:40580: 535 Incorrect authentication data (set_id=services@heipowersystem.com)117.69.210.19918149919^  ;o) ossec13008ga"Mail Recipient rejected2025-04-12 00:06:18 H=(mail.msnews24.in) [165.154.210.99]:55904 F= rejected RCPT : Rejected relay attempt: '165.154.210.99' From: 'bgaeqwtar@msnews24.in' To: 'validxxx@gmailhotmail.com.br'165.154.210.991694008]  ?1 ossec1008ga&Process exiting (killed).Apr 12 00:06:20 vm1 spamd[3100659]: spamd: server killed by SIGTERM, shutting down9\  ;o) ossec13008g`Mail Recipient rejected2025-04-12 00:01:28 H=(mail.msnews24.in) [165.154.228.93]:63983 F= rejected RCPT : Rejected relay attempt: '165.154.228.93' From: 'olnrtzkod@msnews24.in' To: 'validxxx@gmailhotmail.com.br'165.154.228.931643084m[  -c+ ossec13001g_Exim Auth failed2025-04-12 00:00:27 dovecot_login authenticator failed for ([123.209.117.171]) [123.209.117.171]:42260: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)123.209.117.1712077456WZ  -9) ossec13001g_Exim Auth failed2025-04-12 00:00:39 dovecot_login authenticator failed for ([112.196.52.107]) [112.196.52.107]:36550: 535 Incorrect authentication data (set_id=sales)112.196.52.1071269750 B ? [ 2EWbwB"{  3M% ossec11301gcNew FTP connection.Apr 12 03:32:10 vm1 pure-ftpd[3448973]: (?@139.99.35.41) [INFO] New connection from 139.99.35.41139.99.35.411880251]z  -C+ ossec13001gExim Auth failed2025-04-12 03:25:19 dovecot_login authenticator failed for ([218.152.154.217]) [218.152.154.217]:49634: 535 Incorrect authentication data (set_id=services)218.152.154.2171835841jy  -a' ossec13001gExim Auth failed2025-04-12 03:25:04 dovecot_login authenticator failed for ([120.194.50.39]) [120.194.50.39]:20300: 535 Incorrect authentication data (set_id=services@heipowersystem.com)120.194.50.391814991Tx  -5' ossec13001gExim Auth failed2025-04-12 03:13:01 dovecot_login authenticator failed for ([27.45.235.201]) [27.45.235.201]:47330: 535 Incorrect authentication data (set_id=sales)27.45.235.2011814991dw  -Y# ossec13001gExim Auth failed2025-04-12 03:12:47 dovecot_login authenticator failed for (static.ftth.enk.61.2.142.68.bsnl.in) [61.2.142.68]:41567: 535 Incorrect authentication data (set_id=sales)61.2.142.681269750gv  -[' ossec13001gExim Auth failed2025-04-12 03:12:30 dovecot_login authenticator failed for host-68-169-150-36.jenolt2.epbfi.com [68.169.150.36]:56452: 535 Incorrect authentication data (set_id=sales)68.169.150.366252001qu  -q% ossec13001gExim Auth failed2025-04-12 03:12:18 dovecot_login authenticator failed for (78-134-19-99.static.eolo.it) [78.134.19.99]:33666: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)78.134.19.993175395jt  -a' ossec13001goExim Auth failed2025-04-12 02:36:54 dovecot_login authenticator failed for ([218.22.187.69]) [218.22.187.66]:57548: 535 Incorrect authentication data (set_id=services@heipowersystem.com)218.22.187.661814991is  -g! ossec13001gExim Auth failed2025-04-12 02:37:11 dovecot_login authenticator failed for (host-80-241-253-238.customer.magticom.ge) [2.57.219.2]:49602: 535 Incorrect authentication data (set_id=services)2.57.219.2614540Qr  -1% ossec13001gExim Auth failed2025-04-12 02:24:57 dovecot_login authenticator failed for ([60.166.8.174]) [60.166.8.174]:48973: 535 Incorrect authentication data (set_id=sales)60.166.8.1741814991gq  -[' ossec13001gExim Auth failed2025-04-12 02:24:44 dovecot_login authenticator failed for ([196.28.226.66]) [196.28.226.66]:59210: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)196.28.226.6610369736p  Aa+ ossec11302g0FTP Authentication failed.Apr 12 02:14:32 vm1 pure-ftpd[3433203]: (?@104.194.158.102) [WARNING] Authentication failed for user [ftp]104.194.158.1022921044+o  3Y+ ossec11301g,New FTP connection.Apr 12 02:14:27 vm1 pure-ftpd[3433203]: (?@104.194.158.102) [INFO] New connection from 104.194.158.102104.194.158.1022921044+n  3Y+ ossec11301gNew FTP connection.Apr 12 02:14:10 vm1 pure-ftpd[3433115]: (?@104.194.158.102) [INFO] New connection from 104.194.158.102104.194.158.10229210441m  ;_) ossec13008g~Mail Recipient rejected2025-04-12 02:12:30 H=(mail.msnews24.in) [165.154.228.93]:64577 F= rejected RCPT : Rejected relay attempt: '165.154.228.93' From: 'quiig@msnews24.in' To: 'validxxx@gmailhotmail.com.br'165.154.228.931643084Tl  -7% ossec13001gy6Exim Auth failed2025-04-12 01:49:02 dovecot_login authenticator failed for ([58.16.91.144]) [58.16.91.144]:56106: 535 Incorrect authentication data (set_id=services)58.16.91.1441814991zk  -}+ ossec13001gy(Exim Auth failed2025-04-12 01:48:47 dovecot_login authenticator failed for 184.sub-166-143-153.myvzw.com [166.143.153.184]:60166: 535 Incorrect authentication data (set_id=services@heipowersystem.com)166.143.153.1846252001gj  -]% ossec13001gxExim Auth failed2025-04-12 01:43:52 dovecot_login authenticator failed for ([102.53.15.17]) [102.53.15.17]:54937: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)102.53.15.172542007 qZ c r .=LqW  -9) ossec13001gExim Auth failed2025-04-12 07:11:53 dovecot_login authenticator failed for ([118.45.101.159]) [118.45.101.159]:52554: 535 Incorrect authentication data (set_id=sales)118.45.101.1591835841m  -c+ ossec13001gľExim Auth failed2025-04-12 07:11:18 dovecot_login authenticator failed for ([203.128.181.121]) [203.128.181.121]:38954: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)203.128.181.1211835841m  -e) ossec13001gExim Auth failed2025-04-12 06:37:30 dovecot_login authenticator failed for (228.pool90-161-217.static.orange.es) [90.161.217.228]:47408: 535 Incorrect authentication data (set_id=services)90.161.217.2282510769g  -]% ossec13001gExim Auth failed2025-04-12 06:37:16 dovecot_login authenticator failed for ([116.6.125.26]) [116.6.125.26]:57889: 535 Incorrect authentication data (set_id=services@heipowersystem.com)116.6.125.261814991V  -9' ossec13001gExim Auth failed2025-04-12 05:49:29 dovecot_login authenticator failed for ([118.39.230.40]) [118.39.230.40]:1999: 535 Incorrect authentication data (set_id=services)118.39.230.401835841   -%) ossec13001gExim Auth failed2025-04-12 05:49:15 dovecot_login authenticator failed for (dynamicip-188-232-131-13.pppoe.omsk.ertelecom.ru) [188.232.131.13]:53560: 535 Incorrect authentication data (set_id=services@heipowersystem.com)188.232.131.132017370l  -c) ossec13001gExim Auth failed2025-04-12 05:37:24 dovecot_login authenticator failed for c-69-242-149-240.hsd1.mo.comcast.net [69.242.149.240]:41264: 535 Incorrect authentication data (set_id=purchase)69.242.149.2406252001p  -i+ ossec13001gExim Auth failed2025-04-12 05:37:12 dovecot_login authenticator failed for ([125.139.124.120]) [125.139.124.120]:43510: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)125.139.124.1201835841%  3Q' ossec11301gNew FTP connection.Apr 12 05:17:12 vm1 pure-ftpd[3469895]: (?@205.210.31.99) [INFO] New connection from 205.210.31.99205.210.31.9962520011  ;_) ossec13008gPMail Recipient rejected2025-04-12 04:52:55 H=(mail.msnews24.in) [165.154.210.99]:53627 F= rejected RCPT : Rejected relay attempt: '165.154.210.99' From: 'djfdm@msnews24.in' To: 'validxxx@gmailhotmail.com.br'165.154.210.991694008\  -C+ ossec13001gExim Auth failed2025-04-12 04:13:18 dovecot_login authenticator failed for ([194.165.145.133]) [194.165.145.133]:59798: 535 Incorrect authentication data (set_id=services)194.165.145.133248816p  -i+ ossec13001gExim Auth failed2025-04-12 04:13:04 dovecot_login authenticator failed for ([117.232.111.254]) [117.232.111.251]:32860: 535 Incorrect authentication data (set_id=services@heipowersystem.com)117.232.111.2511269750T  -5' ossec13001g1Exim Auth failed2025-04-12 04:01:12 dovecot_login authenticator failed for ([61.133.10.204]) [61.133.10.204]:54536: 535 Incorrect authentication data (set_id=sales)61.133.10.2041814991m  -c+ ossec13001gExim Auth failed2025-04-12 04:00:50 dovecot_login authenticator failed for ([221.226.142.114]) [221.226.142.114]:49426: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)221.226.142.11418149919~  ;o) ossec13008g Mail Recipient rejected2025-04-12 03:43:31 H=(mail.msnews24.in) [165.154.210.52]:60592 F= rejected RCPT : Rejected relay attempt: '165.154.210.52' From: 'banythint@msnews24.in' To: 'validxxx@gmailhotmail.com.br'165.154.210.5216940086}  Ag% ossec11302g{FTP Authentication failed.Apr 12 03:32:34 vm1 pure-ftpd[3449005]: (?@139.99.35.46) [WARNING] Authentication failed for user [anonymous]139.99.35.461880251"|  3M% ossec11301giNew FTP connection.Apr 12 03:32:16 vm1 pure-ftpd[3449005]: (?@139.99.35.46) [INFO] New connection from 139.99.35.46139.99.35.461880251 M~rznbVJ>2&|pdXL@4(th\PD8,  x l ` T H < 0 $  | p d X L @ 4 (    t h \ P D 8 ,   x l ` T H < 0 $  | p d X L @ 4 (   thYM4(\OB5(esfYL?2% |obUH;.!xk^QD7*tgZM@  298795O_ 298795O] 2993457O 298795 298795 298795 298795 298795Y 298795 298795O 298795M 298795M 298795M 298795M 298795LI 298795J 298795> 298795 298795 u 298795 I 298795 A 298795 298795 l 298795 298795 N 298795 298795 298795 298795 298795 298795k 298795e 298795 298795J 298795J* 298795Oq 298795Oc 298795O` 3017382 3017382} 3017382% 3017382 3017382 3017382- 3017382! 3017382 3017382 3017382 3017382 3017382g 3017382Y 3017382 3017382 3017382 3017382N 3017382 3017382S 3017382L 3017382 3017382 3017382> 3017382< 3017382; 3017382 3017382 3017382 3017382 3017382i 3017382 3017382[ 3017382 3017382 3017382t 3017382s 3017382r 3017382l 3017382k 3017382@ 3017382 3017382 3017382 3017382  3017382  3017382 3017382 3017382 u 3017382 j 3017382 F 3017382 3 3017382 3017382 1 3017382 3017382 { 3017382 3017382 3017382 3017382 3017382t 3017382s 3017382r 3017382A 3017382l 2993457F 2993457C| 2993457A 2993457@= 2993457> 2993457= 2993457; 29934579 29934576 29934573 29934572c 2993457* 2993457( 2993457(5 2993457 2993457 2993457 2993457F 298795H 298795G1 298795F 298795F 298795Fs 298795FZ 298795FL 298795F 298795E 298795E 298795E 298795E5 298795E2 298795D 298795D 298795C 298795C 298795Cx 298795Cj 298795CV 298795B 298795B 298795B 298795B 298795A 298795A 298795@ 298795@ 298795@ 298795@ 298795@2 298795? 298795? 298795?Y 298795> 298795> 298795>w 298795>v 298795>u 298795>t 298795>s 298795= 298795=D 298795< 298795< 298795<~ 298795 298795 H 298795 298795 298795j 298795 298795 298795 298795s 298795 298795 298795 298795 298795v 298795 298795 298795a 298795O 298795D 298795 298795 298795 298795G 298795 298795b 298795 298795O 298795. 298795 298795z 298795< 298795, 298795! 298795 298795 298795 298795 298795| 298795 298795 298795  * * O "A r  -s% ossec13001gExim Auth failed2025-04-12 10:18:09 dovecot_login authenticator failed for (amplifypowerglobal.com) [125.72.54.81]:33182: 535 Incorrect authentication data (set_id=contact@amplifypowerglobal.com)125.72.54.811814991[  -E% ossec13001gXExim Auth failed2025-04-12 10:17:19 dovecot_login authenticator failed for (amplifypowerglobal.com) [125.72.54.81]:56322: 535 Incorrect authentication data (set_id=nologin)125.72.54.811814991{  -% ossec13001gExim Auth failed2025-04-12 10:02:33 dovecot_login authenticator failed for syn-074-062-020-170.biz.spectrum.com [74.62.20.170]:52774: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)74.62.20.1706252001h  -[) ossec13001gExim Auth failed2025-04-12 10:02:46 dovecot_login authenticator failed for (222-42-136-186.fibertel.com.ar) [186.136.42.222]:51226: 535 Incorrect authentication data (set_id=purchase)186.136.42.2223865483W  -;' ossec13001g@Exim Auth failed2025-04-12 09:51:20 dovecot_login authenticator failed for ([186.96.89.101]) [186.96.89.101]:60538: 535 Incorrect authentication data (set_id=services)186.96.89.1013624060m  -e) ossec13001g2Exim Auth failed2025-04-12 09:51:06 dovecot_login authenticator failed for ([39.129.128.108]) [39.129.128.108]:40386: 535 Incorrect authentication data (set_id=services@heipowersystem.com)39.129.128.1081814991%  3Q' ossec11301gNew FTP connection.Apr 12 09:49:05 vm1 pure-ftpd[3525816]: (?@88.214.25.121) [INFO] New connection from 88.214.25.12188.214.25.1212921044]  -C+ ossec13001gJExim Auth failed2025-04-12 09:47:12 dovecot_login authenticator failed for ([212.113.226.222]) [212.113.226.222]:36410: 535 Incorrect authentication data (set_id=purchase)212.113.226.2222017370m  -e) ossec13001g2Exim Auth failed2025-04-12 09:46:50 dovecot_login authenticator failed for ([190.223.53.234]) [190.223.53.234]:36622: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)190.223.53.2343932488[  -C' ossec13001gExim Auth failed2025-04-12 09:03:01 dovecot_login authenticator failed for (hosted-by-soltia.es) [91.126.81.113]:53906: 535 Incorrect authentication data (set_id=services)91.126.81.1132510769  - % ossec13001gExim Auth failed2025-04-12 09:02:50 dovecot_login authenticator failed for p4095-ipbfpfx02osakakita.osaka.ocn.ne.jp [60.40.45.223]:53761: 535 Incorrect authentication data (set_id=services@heipowersystem.com)60.40.45.2231861060)  EK% ossec5715gSSHD authentication success.Apr 12 08:49:42 vm1 sshd[3513716]: Accepted password for root from 103.190.54.7 port 58182 ssh2103.190.54.71269750)  EK% ossec5715gSSHD authentication success.Apr 12 08:46:05 vm1 sshd[3512999]: Accepted password for root from 103.190.54.7 port 58106 ssh2103.190.54.71269750W  -;' ossec13001gxExim Auth failed2025-04-12 08:14:08 dovecot_login authenticator failed for ([211.96.160.30]) [211.96.160.30]:39390: 535 Incorrect authentication data (set_id=services)211.96.160.301814991|  -+ ossec13001glExim Auth failed2025-04-12 08:13:56 dovecot_login authenticator failed for (m121-202-206-119.smartone.com) [121.202.206.119]:37092: 535 Incorrect authentication data (set_id=services@heipowersystem.com)121.202.206.1191819730d  -U' ossec13001g%Exim Auth failed2025-04-12 07:25:49 dovecot_login authenticator failed for ip117.net-81-16-170.koping.net [81.16.170.117]:47718: 535 Incorrect authentication data (set_id=services)81.16.170.1172661886j  -a' ossec13001gExim Auth failed2025-04-12 07:25:32 dovecot_login authenticator failed for ([194.26.226.55]) [194.26.226.55]:58452: 535 Incorrect authentication data (set_id=services@heipowersystem.com)194.26.226.552017370 \*R ~tj`VLB8.$zpRH>4*   v l b X N D : 0 &    ~ t j ` V L B 8 . $    z p f \ R H > 4 *  vlbXND:0&|rh^TJ@6,"xndZPF<2( ~tj`VLB8.$zp\Rf | r h ^ T J @ 6 , "    x n d Z P F < 2 (  f\H>4*  vlbXND:0& gg@ g_@ g@ g@ g@ g@ gO@ g=@ g@ g@ g@ g@ g@ g@ g@ g@ g@ g]@ gG@ g@ g@ g@ g@ g@ gW@ gK@ gQ@ g@ gb@ gT? g9? g? g? gF? g? g? g? g? g? g? g~? g~? gzi? gzO? gsR? gsB? gs? go? gn? gn? gn? gld? gg? gg? gcN? gcB? g_? g\^? g\H? gY? gW? gW? gP? gP? gL? gL~? gJ? gG? gG? gG? gEx? gEn? g@? g:? g:? g9!? g6? g6? g5? g5? g5? g.? g.? g*g? g*O? g#O? g#=? g? g? g? g? g? g? g? gv? g? g? g? g? g ? g ? g y? g C? g 3? g ? g ? g"? g? g? gM? gC? g? g? g9? gD? gD? g5? g? g? g? g? g? g? g? g? gR? g:? g? gX? g? g? g@? g2? g? gJ? g2? g? g? g? g? gx? gl? g%? g? g? gľ? g? g? g? g? g? g? g? gP? g? g? g1? g? g ?~ g{?} gi?| gc?{ g?z g?y g?x g?w g?v g?u g?s go?t g?r g ? g^? g[@F g`@E gN@D g@C g@B ga@A gU@@ g@? g@= g@< g@> g@; g@: g@9 g@8 g@7 g@6 g@5 gj@4 g\@3 g@2 g@1 g@0 g՜@/ gՔ@. gՄ@- g"@, gԒ@+ g@* gu@) g@( g[@' gM@& gv@% g^@$ gT@# g@" g@! g@ g@ g@ g@ g?q g0?p g,?o g?n g~?m gy6?l gy(?k gx ?i gx?j gvG?h gv g;?= g8?< g7?; g5r?: g5g?9 g3y?8 g3k?7 g2?6 g2?5 g2?4 g2s?3 g0?2 g-?1 g-?0 g+{?/ g+y?. g+_?- g+??, g+=?+ g*?* g*?) g*}?( g*{?' g*?& g)?% g'?$ g&?# g&%?" g$q?! g ?  l  #0:X /NcW/  -9) ossec13001gMExim Auth failed2025-04-12 11:38:13 dovecot_login authenticator failed for ([210.206.24.238]) [210.206.24.234]:50935: 535 Incorrect authentication data (set_id=sales)210.206.24.2341835841g.  -[' ossec13001gCExim Auth failed2025-04-12 11:38:02 dovecot_login authenticator failed for ([218.4.214.115]) [218.4.214.115]:56233: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)218.4.214.1151814991]-  -K% ossec13001gExim Auth failed2025-04-12 11:28:39 dovecot_login authenticator failed for 15-50-166-83.dyn.estpak.ee [83.166.50.15]:39674: 535 Incorrect authentication data (set_id=services)83.166.50.15453733m,  -e) ossec13001gExim Auth failed2025-04-12 11:28:28 dovecot_login authenticator failed for ([117.252.57.122]) [117.252.57.122]:60886: 535 Incorrect authentication data (set_id=services@heipowersystem.com)117.252.57.1221269750(+  CI' ossec5716g9SSHD authentication failed.Apr 12 11:16:31 vm1 sshd[3543247]: Failed password for root from 223.171.94.26 port 53562 ssh2223.171.94.261835841T* E' ossec2501gDUser authentication failure.Apr 12 11:16:42 vm1 sshd[3543325]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=223.171.94.26223.171.94.2618358410) a9' ossec5710gDAttempt to login using a non-existent userApr 12 11:16:42 vm1 sshd[3543325]: Invalid user postgres from 223.171.94.26 port 45356223.171.94.261835841^(  E3' ossec2501g5User authentication failure.Apr 12 11:16:29 vm1 sshd[3543247]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=223.171.94.26 user=root223.171.94.261835841r'  -q' ossec13001gExim Auth failed2025-04-12 11:10:11 dovecot_login authenticator failed for (61.252.41.124.dynamic.wlink.com.np) [124.41.252.61]:52132: 535 Incorrect authentication data (set_id=vikas.khandelwal)124.41.252.611282988o&  -m% ossec13001gExim Auth failed2025-04-12 11:09:57 dovecot_login authenticator failed for ([154.89.7.106]) [154.89.7.106]:33012: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)154.89.7.1061210997Z%  -?) ossec13001gExim Auth failed2025-04-12 10:52:50 dovecot_login authenticator failed for ([121.189.226.81]) [121.189.226.81]:49982: 535 Incorrect authentication data (set_id=purchase)121.189.226.811835841g$  -]% ossec13001gExim Auth failed2025-04-12 10:52:37 dovecot_login authenticator failed for ([2.110.10.192]) [2.110.10.192]:39976: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)2.110.10.1922623032T#  -7% ossec13001gExim Auth failed2025-04-12 10:39:59 dovecot_login authenticator failed for ([49.124.148.2]) [49.124.148.2]:36042: 535 Incorrect authentication data (set_id=services)49.124.148.21733045h"  -a' ossec13001gExim Auth failed2025-04-12 10:39:42 dovecot_login authenticator failed for ([65.20.237.150]) [65.20.237.150]:53878: 535 Incorrect authentication data (set_id=services@heipowersystem.com)65.20.237.150992378!  Ai' ossec11302gFTP Authentication failed.Apr 12 10:36:24 vm1 pure-ftpd[3535325]: (?@34.22.146.211) [WARNING] Authentication failed for user [anonymous]34.22.146.2112802361& 3Q' ossec11301gNew FTP connection.Apr 12 10:36:19 vm1 pure-ftpd[3535323]: (?@34.22.146.211) [INFO] New connection from 34.22.146.21134.22.146.2112802361m  -k% ossec13001gRExim Auth failed2025-04-12 10:21:30 dovecot_login authenticator failed for (78.186.54.65.static.ttnet.com.tr) [78.186.54.65]:60012: 535 Incorrect authentication data (set_id=vikas.khandelwal)78.186.54.65298795u  -u) ossec13001g:Exim Auth failed2025-04-12 10:21:05 dovecot_login authenticator failed for ([175.205.191.27]) [175.205.191.27]:49608: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)175.205.191.271835841 b)- L a v lb?  -) ossec13001gExim Auth failed2025-04-12 13:05:56 dovecot_login authenticator failed for (106-107-67-185-red-servicios.onlycable.es) [185.67.107.106]:55436: 535 Incorrect authentication data (set_id=services@heipowersystem.com)185.67.107.10625107698>  ;k+ ossec13008gvMail Recipient rejected2025-04-12 12:59:56 H=(mail.msnews24.in) [165.154.228.180]:54131 F= rejected RCPT : Rejected relay attempt: '165.154.228.180' From: 'pdmevpj@msnews24.in' To: 'validxxx@gmailhotmail.com.br'165.154.228.1801643084e=  -S+ ossec13001gExim Auth failed2025-04-12 12:47:46 dovecot_login authenticator failed for ([101.231.247.210]) [101.231.247.210]:54170: 535 Incorrect authentication data (set_id=vikas.khandelwal)101.231.247.2101814991r<  -q' ossec13001gExim Auth failed2025-04-12 12:47:33 dovecot_login authenticator failed for ([115.88.121.73]) [115.88.121.73]:42494: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)115.88.121.731835841>;  ;w+ ossec13008gMail Recipient rejected2025-04-12 12:30:34 H=(mail.msnews24.in) [165.154.233.218]:63502 F= rejected RCPT : Rejected relay attempt: '165.154.233.218' From: 'uohlqktllh@msnews24.in' To: 'validxxx@gmailhotmail.com.br'165.154.233.21816940088:  ;k+ ossec13008gMail Recipient rejected2025-04-12 12:30:25 H=(mail.msnews24.in) [165.154.242.241]:60517 F= rejected RCPT : Rejected relay attempt: '165.154.242.241' From: 'ohewwhm@msnews24.in' To: 'validxxx@gmailhotmail.com.br'165.154.242.2411694008Q9  -3# ossec13001g Exim Auth failed2025-04-12 12:17:43 dovecot_login authenticator failed for ([103.50.5.94]) [103.50.5.94]:38994: 535 Incorrect authentication data (set_id=services)103.50.5.941269750d8  -W' ossec13001g Exim Auth failed2025-04-12 12:17:33 dovecot_login authenticator failed for (46.30.161.197.access.ipnet.ua) [46.30.161.197]:40475: 535 Incorrect authentication data (set_id=services)46.30.161.197690791j7  -a' ossec13001g yExim Auth failed2025-04-12 12:17:20 dovecot_login authenticator failed for ([36.134.78.151]) [36.134.78.151]:40418: 535 Incorrect authentication data (set_id=services@heipowersystem.com)36.134.78.1511814991Z6  -?) ossec13001g CExim Auth failed2025-04-12 12:16:27 dovecot_login authenticator failed for ([118.45.101.159]) [118.45.101.159]:54210: 535 Incorrect authentication data (set_id=purchase)118.45.101.1591835841d5  -Y# ossec13001g 3Exim Auth failed2025-04-12 12:16:10 dovecot_login authenticator failed for ([27.98.249.9]) [27.98.249.9]:56050: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)27.98.249.91814991g4  -[' ossec13001g Exim Auth failed2025-04-12 12:11:29 dovecot_login authenticator failed for ([85.215.236.96]) [85.215.236.96]:62250: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)85.215.236.962921044g3  -[' ossec13001g Exim Auth failed2025-04-12 12:11:23 dovecot_plain authenticator failed for ([85.215.236.96]) [85.215.236.96]:62250: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)85.215.236.962921044]2  -K' ossec13001g"Exim Auth failed2025-04-12 11:58:49 dovecot_login authenticator failed for ([65.20.185.185]) [65.20.185.185]:60152: 535 Incorrect authentication data (set_id=vikas.khandelwal)65.20.185.18599237x1  -y+ ossec13001gExim Auth failed2025-04-12 11:58:39 dovecot_login authenticator failed for ([139.167.158.146]) [139.167.158.146]:55102: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)139.167.158.1461269750S0 -3% ossec13001gExim Auth failed2025-04-12 11:44:47 dovecot_login authenticator failed for (rokamauka.com) [119.96.131.8]:48970: 535 Incorrect authentication data (set_id=nologin)119.96.131.81814991 > H k z bO  E7+ ossec2501g6User authentication failure.Apr 12 15:17:44 vm1 sshd[3591314]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=120.230.136.250 user=root120.230.136.2501814991uN  -s+ ossec13001g5Exim Auth failed2025-04-12 15:13:43 dovecot_login authenticator failed for (223-197-164-188.static.imsbiz.com) [223.197.164.188]:63778: 535 Incorrect authentication data (set_id=vikas.khandelwal)223.197.164.1881819730rM  -q' ossec13001g5Exim Auth failed2025-04-12 15:13:23 dovecot_login authenticator failed for ([103.68.52.210]) [103.68.52.210]:58776: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)103.68.52.2101269750VL  ;'+ ossec13008g5Mail Recipient rejected2025-04-12 15:10:28 H=(mail.s2seducationtrust.com) [165.154.210.137]:50777 F= rejected RCPT : Rejected relay attempt: '165.154.210.137' From: 'dbfrbre@s2seducationtrust.com' To: 'validxxx@gmailhotmail.com.br'165.154.210.1371694008ZK  -?) ossec13001g.Exim Auth failed2025-04-12 14:43:14 dovecot_login authenticator failed for ([124.199.29.111]) [124.199.29.111]:55720: 535 Incorrect authentication data (set_id=services)124.199.29.1111835841yJ  -' ossec13001g.Exim Auth failed2025-04-12 14:43:01 dovecot_login authenticator failed for 89-253-90-113.customers.ownit.se [89.253.90.113]:56569: 535 Incorrect authentication data (set_id=services@heipowersystem.com)89.253.90.1132661886bI  -O) ossec13001g*gExim Auth failed2025-04-12 14:25:02 dovecot_login authenticator failed for ([186.233.219.34]) [186.233.219.34]:38002: 535 Incorrect authentication data (set_id=vikas.khandelwal)186.233.219.343469034pH  -o% ossec13001g*OExim Auth failed2025-04-12 14:24:39 dovecot_login authenticator failed for ([61.170.196.19]) [210.22.90.58]:51732: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)210.22.90.581814991`G  -Q# ossec13001g#OExim Auth failed2025-04-12 13:54:46 dovecot_login authenticator failed for (125-209-116-242.multi.net.pk) [58.27.253.6]:31485: 535 Incorrect authentication data (set_id=services)58.27.253.61168579{F  -) ossec13001g#=Exim Auth failed2025-04-12 13:54:28 dovecot_login authenticator failed for (108.174.182.41.douglasfast.net) [108.174.182.41]:39146: 535 Incorrect authentication data (set_id=services@heipowersystem.com)108.174.182.416252001]E  -C+ ossec13001gExim Auth failed2025-04-12 13:39:19 dovecot_login authenticator failed for ([103.152.234.134]) [103.152.234.134]:54216: 535 Incorrect authentication data (set_id=purchase)103.152.234.1341643084mD  -e) ossec13001gExim Auth failed2025-04-12 13:39:09 dovecot_login authenticator failed for ([120.29.140.140]) [120.29.140.140]:34625: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)120.29.140.1401835841YC  -C# ossec13001gExim Auth failed2025-04-12 13:36:09 dovecot_login authenticator failed for ([45.74.81.58]) [45.74.81.58]:36476: 535 Incorrect authentication data (set_id=vikas.khandelwal)45.74.81.586252001rB  -q' ossec13001gExim Auth failed2025-04-12 13:35:57 dovecot_login authenticator failed for ([95.221.179.61]) [95.221.179.61]:44425: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)95.221.179.612017370]A  -C+ ossec13001gExim Auth failed2025-04-12 13:06:36 dovecot_login authenticator failed for ([102.207.152.163]) [102.207.152.163]:35229: 535 Incorrect authentication data (set_id=services)102.207.152.1633374766]@  -C+ ossec13001gExim Auth failed2025-04-12 13:06:26 dovecot_login authenticator failed for ([218.146.255.221]) [218.146.255.221]:55945: 535 Incorrect authentication data (set_id=services)218.146.255.2211835841 {P  p!{"a  3M% ossec11301gYNew FTP connection.Apr 12 17:44:07 vm1 pure-ftpd[3620638]: (?@20.221.67.48) [INFO] New connection from 20.221.67.4820.221.67.486252001a`  -M) ossec13001gWExim Auth failed2025-04-12 17:39:20 dovecot_login authenticator failed for ([59.94.179.138]) [103.134.135.61]:64511: 535 Incorrect authentication data (set_id=vikas.khandelwal)103.134.135.611269750u_  -u) ossec13001gWExim Auth failed2025-04-12 17:39:07 dovecot_login authenticator failed for ([45.118.136.243]) [45.118.136.243]:64905: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)45.118.136.2431562822h^  -a' ossec13001gPExim Auth failed2025-04-12 17:09:07 dovecot_login authenticator failed for ([65.20.155.205]) [65.20.155.205]:33045: 535 Incorrect authentication data (set_id=services@heipowersystem.com)65.20.155.20599237Y]  -?) ossec13001gPExim Auth failed2025-04-12 17:09:19 dovecot_login authenticator failed for ([196.188.187.85]) [196.188.187.85]:37518: 535 Incorrect authentication data (set_id=services)196.188.187.85337996V\  -?! ossec13001gLExim Auth failed2025-04-12 16:50:44 dovecot_login authenticator failed for ([1.30.20.98]) [1.30.20.98]:60596: 535 Incorrect authentication data (set_id=vikas.khandelwal)1.30.20.981814991 [  -+ ossec13001gL~Exim Auth failed2025-04-12 16:50:29 dovecot_login authenticator failed for syn-173-174-196-141.res.spectrum.com [173.174.196.141]:58822: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)173.174.196.1416252001 Z  [w% ossec12004gJPossible Dovecot CVE-2019-11500 attemptApr 12 16:43:04 vm1 dovecot[1526]: pop3-login: Disconnected: Input buffer full (no auth attempts in 1 secs): user=<>, rip=3.19.246.156, lip=103.74.54.108, session=3.19.246.1566252001.Y a3) ossec5710gGAttempt to login using a non-existent userApr 12 16:29:45 vm1 sshd[3605630]: Invalid user test from 171.217.43.167 port 10798171.217.43.1671814991*X  CK) ossec5716gGSSHD authentication failed.Apr 12 16:29:34 vm1 sshd[3605595]: Failed password for root from 171.217.43.167 port 12075 ssh2171.217.43.1671814991aW E5) ossec2501gGUser authentication failure.Apr 12 16:29:32 vm1 sshd[3605595]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=171.217.43.167 user=root171.217.43.1671814991ZV  -?) ossec13001gExExim Auth failed2025-04-12 16:20:31 dovecot_login authenticator failed for ([195.222.59.157]) [195.222.59.157]:37332: 535 Incorrect authentication data (set_id=services)195.222.59.1573277605yU  -' ossec13001gEnExim Auth failed2025-04-12 16:20:20 dovecot_login authenticator failed for (adsl-ull-236-26.40-151.wind.it) [151.40.26.236]:49442: 535 Incorrect authentication data (set_id=services@heipowersystem.com)151.40.26.2363175395nT  -e+ ossec13001g@Exim Auth failed2025-04-12 15:59:54 dovecot_login authenticator failed for ([36.154.247.90]) [221.228.167.175]:33946: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)221.228.167.1751814991RS  -7% ossec13001g:Exim Auth failed2025-04-12 15:31:51 dovecot_login authenticator failed for ([65.20.211.96]) [65.20.211.96]:55653: 535 Incorrect authentication data (set_id=services)65.20.211.9699237wR  -y) ossec13001g:Exim Auth failed2025-04-12 15:31:38 dovecot_login authenticator failed for n219077108186.netvigator.com [219.77.108.186]:40896: 535 Incorrect authentication data (set_id=services@heipowersystem.com)219.77.108.1861819730+Q  3Y+ ossec11301g9!New FTP connection.Apr 12 15:27:52 vm1 pure-ftpd[3593664]: (?@172.212.200.145) [INFO] New connection from 172.212.200.145172.212.200.1456252001,P  CM+ ossec5716g6SSHD authentication failed.Apr 12 15:17:46 vm1 sshd[3591314]: Failed password for root from 120.230.136.250 port 30868 ssh2120.230.136.2501814991  !   ( H;=NZnlq  -i# ossec13001gzOExim Auth failed2025-04-12 20:05:59 dovecot_login authenticator failed for ([14.98.28.43]) [14.98.28.43]:42418: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)14.98.28.431269750Zp  -?) ossec13001gsRExim Auth failed2025-04-12 19:36:08 dovecot_login authenticator failed for ([211.193.245.27]) [211.193.245.27]:58315: 535 Incorrect authentication data (set_id=services)211.193.245.271835841ho  -_% ossec13001gsBExim Auth failed2025-04-12 19:35:52 dovecot_login authenticator failed for ([190.15.98.153]) [190.15.96.26]:43956: 535 Incorrect authentication data (set_id=services@heipowersystem.com)190.15.96.263469034(n  3U) ossec11301gsNew FTP connection.Apr 12 19:34:48 vm1 pure-ftpd[3642334]: (?@51.159.234.118) [INFO] New connection from 51.159.234.11851.159.234.1183017382hm  -_% ossec13001goExim Auth failed2025-04-12 19:18:00 dovecot_login authenticator failed for syn-071-041-202-012.biz.spectrum.com [71.41.202.12]:52550: 535 Incorrect authentication data (set_id=purchase)71.41.202.126252001pl  -q# ossec13001gnExim Auth failed2025-04-12 19:17:36 dovecot_login authenticator failed for 100.7.61.94.rev.vodafone.pt [94.61.7.100]:36640: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)94.61.7.1002264397kk  -a) ossec13001gnExim Auth failed2025-04-12 19:17:28 dovecot_login authenticator failed for n11923628209.netvigator.com [119.236.28.209]:45392: 535 Incorrect authentication data (set_id=vikas.khandelwal)119.236.28.2091819730zj  -) ossec13001gnExim Auth failed2025-04-12 19:17:17 dovecot_login authenticator failed for (h90.msk-0.maverick.ru) [185.238.200.90]:53004: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)185.238.200.902017370 i  [u# ossec12004gldPossible Dovecot CVE-2019-11500 attemptApr 12 19:06:35 vm1 dovecot[1526]: pop3-login: Disconnected: Input buffer full (no auth attempts in 1 secs): user=<>, rip=3.141.1.115, lip=103.74.54.108, session=3.141.1.1156252001\h  -C+ ossec13001ggExim Auth failed2025-04-12 18:46:28 dovecot_login authenticator failed for ([178.250.191.189]) [178.250.191.189]:53636: 535 Incorrect authentication data (set_id=services)178.250.191.189458258dg  -Y# ossec13001ggExim Auth failed2025-04-12 18:46:19 dovecot_login authenticator failed for ([103.50.5.94]) [103.50.5.94]:45667: 535 Incorrect authentication data (set_id=services@heipowersystem.com)103.50.5.941269750]f  -K' ossec13001gcNExim Auth failed2025-04-12 18:27:48 dovecot_login authenticator failed for ([65.20.155.151]) [65.20.155.151]:54011: 535 Incorrect authentication data (set_id=vikas.khandelwal)65.20.155.15199237 e  -'% ossec13001gcBExim Auth failed2025-04-12 18:27:38 dovecot_login authenticator failed for (178x78x28x55.dynamic.krasnodar.ertelecom.ru) [178.78.28.55]:56044: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)178.78.28.552017370d  W) ossec9708g_Dovecot Aborted Login with empty userApr 12 18:12:34 vm1 dovecot[1526]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 7 secs): user=<>, rip=87.236.176.105, lip=103.74.54.108, TLS, session=87.236.176.1052635167hc  -[+ ossec13001g\^Exim Auth failed2025-04-12 17:58:13 dovecot_login authenticator failed for (109-120-192-105.ip.btc-net.bg) [109.120.192.105]:34582: 535 Incorrect authentication data (set_id=services)109.120.192.105732800ob  -k' ossec13001g\HExim Auth failed2025-04-12 17:57:52 dovecot_login authenticator failed for mail.toptronicsinc.com [218.4.156.254]:54651: 535 Incorrect authentication data (set_id=services@heipowersystem.com)218.4.156.2541814991 4 6 O t c -No  -m% ossec13001gKExim Auth failed2025-04-12 21:44:02 dovecot_login authenticator failed for ([102.90.34.90]) [102.90.34.90]:53699: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)102.90.34.902328926+  3Y+ ossec11301gQNew FTP connection.Apr 12 21:35:36 vm1 pure-ftpd[3666244]: (?@162.142.125.219) [INFO] New connection from 162.142.125.219162.142.125.2196252001"  3M% ossec11301gNew FTP connection.Apr 12 21:28:58 vm1 pure-ftpd[3664843]: (?@20.65.195.25) [INFO] New connection from 20.65.195.2520.65.195.256252001Z  -?) ossec13001gbExim Auth failed2025-04-12 21:14:33 dovecot_login authenticator failed for ([170.238.145.36]) [170.238.145.36]:47964: 535 Incorrect authentication data (set_id=services)170.238.145.363469034Z  -?) ossec13001gTExim Auth failed2025-04-12 21:14:19 dovecot_login authenticator failed for ([117.176.123.33]) [117.176.123.33]:35974: 535 Incorrect authentication data (set_id=services)117.176.123.331814991x~  -% ossec13001g9Exim Auth failed2025-04-12 21:13:52 dovecot_login authenticator failed for 95-31-33-177.broadband.corbina.ru [95.31.33.177]:58376: 535 Incorrect authentication data (set_id=services@heipowersystem.com)95.31.33.1772017370o}  -i) ossec13001gExim Auth failed2025-04-12 20:55:17 dovecot_login authenticator failed for (73.153.212.218.starhub.net.sg) [218.212.153.73]:42390: 535 Incorrect authentication data (set_id=vikas.khandelwal)218.212.153.731880251|  - ) ossec13001gExim Auth failed2025-04-12 20:55:06 dovecot_login authenticator failed for n219077108186.netvigator.com [219.77.108.186]:33956: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)219.77.108.1861819730({  3U) ossec11301gFNew FTP connection.Apr 12 20:48:28 vm1 pure-ftpd[3656768]: (?@198.235.24.222) [INFO] New connection from 198.235.24.222198.235.24.22262520016z  Ag% ossec11302gFTP Authentication failed.Apr 12 20:38:06 vm1 pure-ftpd[3654667]: (?@165.154.41.6) [WARNING] Authentication failed for user [anonymous]165.154.41.61819730#y 3M% ossec11301gNew FTP connection.Apr 12 20:37:58 vm1 pure-ftpd[3654650]: (?@165.154.41.6) [INFO] New connection from 165.154.41.6165.154.41.61819730:x  Ak) ossec11302gFTP Authentication failed.Apr 12 20:37:22 vm1 pure-ftpd[3654587]: (?@193.105.134.40) [WARNING] Authentication failed for user [anonymous]193.105.134.402661886(w  3U) ossec11301gNew FTP connection.Apr 12 20:37:17 vm1 pure-ftpd[3654587]: (?@193.105.134.40) [INFO] New connection from 193.105.134.40193.105.134.402661886Wv  -9) ossec13001gExim Auth failed2025-04-12 20:32:34 dovecot_login authenticator failed for ([116.114.84.234]) [116.114.84.234]:41643: 535 Incorrect authentication data (set_id=sales)116.114.84.2341814991cu  -W% ossec13001gExim Auth failed2025-04-12 20:32:23 dovecot_login authenticator failed for ([41.220.3.113]) [41.220.3.101]:42123: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)41.220.3.101226074zt  -% ossec13001g~Exim Auth failed2025-04-12 20:24:42 dovecot_login authenticator failed for h-46-59-52-199.a980.priv.bahnhof.se [46.59.52.199]:53228: 535 Incorrect authentication data (set_id=services@heipowersystem.com)46.59.52.1992661886Zs  -?) ossec13001g~Exim Auth failed2025-04-12 20:25:04 dovecot_login authenticator failed for ([113.57.119.194]) [113.57.119.194]:34532: 535 Incorrect authentication data (set_id=services)113.57.119.1941814991jr  -g# ossec13001gziExim Auth failed2025-04-12 20:06:24 dovecot_login authenticator failed for (95.0.252.82.static.ttnet.com.tr) [95.0.252.82]:45648: 535 Incorrect authentication data (set_id=vikas.khandelwal)95.0.252.82298795 pa v S2Cjpu  -u) ossec13001g=Exim Auth failed2025-04-12 23:21:57 dovecot_login authenticator failed for ([117.157.246.26]) [117.157.246.26]:60206: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)117.157.246.261814991T  -7% ossec13001gExim Auth failed2025-04-12 22:51:21 dovecot_login authenticator failed for ([103.83.9.138]) [103.83.9.138]:40652: 535 Incorrect authentication data (set_id=services)103.83.9.1381269750j  -a' ossec13001gExim Auth failed2025-04-12 22:51:09 dovecot_login authenticator failed for ([1.244.246.221]) [1.244.246.221]:43908: 535 Incorrect authentication data (set_id=services@heipowersystem.com)1.244.246.2211835841b  -O) ossec13001gExim Auth failed2025-04-12 22:32:42 dovecot_login authenticator failed for ([122.227.77.118]) [122.227.77.118]:41844: 535 Incorrect authentication data (set_id=vikas.khandelwal)122.227.77.1181814991x  -y+ ossec13001gExim Auth failed2025-04-12 22:32:27 dovecot_login authenticator failed for ([178.178.194.123]) [178.178.194.123]:60446: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)178.178.194.1232017370V E) ossec2501gUser authentication failure.Apr 12 22:29:05 vm1 sshd[3676608]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.55.196.253111.55.196.2531814991*  CK) ossec5716gSSHD authentication failed.Apr 12 22:29:22 vm1 sshd[3676634]: Failed password for root from 111.55.196.253 port 45342 ssh2111.55.196.2531814991. a3) ossec5710gAttempt to login using a non-existent userApr 12 22:29:04 vm1 sshd[3676608]: Invalid user shiy from 111.55.196.253 port 45341111.55.196.2531814991*  CK) ossec5716gSSHD authentication failed.Apr 12 22:28:52 vm1 sshd[3676556]: Failed password for root from 111.55.196.253 port 30501 ssh2111.55.196.2531814991`  E5) ossec2501gUser authentication failure.Apr 12 22:28:50 vm1 sshd[3676556]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.55.196.253 user=root111.55.196.2531814991]  -C+ ossec13001g]Exim Auth failed2025-04-12 22:09:57 dovecot_login authenticator failed for ([103.106.154.133]) [103.106.154.133]:58647: 535 Incorrect authentication data (set_id=purchase)103.106.154.1331269750m  -e) ossec13001gGExim Auth failed2025-04-12 22:09:34 dovecot_login authenticator failed for ([125.136.120.34]) [125.136.120.34]:56242: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)125.136.120.341835841U  -7' ossec13001gExim Auth failed2025-04-12 22:02:44 dovecot_login authenticator failed for (hn.kd.ny.adsl) [123.13.237.76]:57962: 535 Incorrect authentication data (set_id=purchase)123.13.237.761814991i  -]) ossec13001gExim Auth failed2025-04-12 22:02:35 dovecot_login authenticator failed for 221-120-57-125.emome-ip.hinet.net [221.120.57.125]:57514: 535 Incorrect authentication data (set_id=services)221.120.57.1251668284n  -m# ossec13001gExim Auth failed2025-04-12 22:02:23 dovecot_login authenticator failed for (223-30-0-0.lan.sify.net) [1.7.229.162]:55928: 535 Incorrect authentication data (set_id=services@heipowersystem.com)1.7.229.1621269750f  -[% ossec13001gExim Auth failed2025-04-12 22:02:24 dovecot_login authenticator failed for ([8.243.166.66]) [8.243.166.66]:4501: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)8.243.166.663686110  3I# ossec11301gNew FTP connection.Apr 12 21:58:30 vm1 pure-ftpd[3670715]: (?@65.49.20.68) [INFO] New connection from 65.49.20.6865.49.20.686252001v  -u+ ossec13001gWExim Auth failed2025-04-12 21:44:15 dovecot_login authenticator failed for syn-173-174-196-141.res.spectrum.com [173.174.196.141]:51322: 535 Incorrect authentication data (set_id=vikas.khandelwal)173.174.196.1416252001 q  7KlYxw'  -}% ossec13001g[Exim Auth failed2025-04-13 01:47:29 dovecot_login authenticator failed for (hospitalperpetuosocorro.static.gvt.net.br) [191.33.74.81]:45616: 535 Incorrect authentication data (set_id=vikas.khandelwal)191.33.74.813469034u&  -u) ossec13001gMExim Auth failed2025-04-13 01:47:16 dovecot_login authenticator failed for ([175.116.66.199]) [175.116.66.199]:41939: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)175.116.66.1991835841 % Sw) ossec11000gvLogin failed on the cpanel service.[2025-04-13 01:35:09 +0530] info [cpaneld] 196.251.84.233 - amplifyp "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user amplifyp (has_cpuser_file failed)196.251.84.2332750405o$  -g+ ossec13001g^Exim Auth failed2025-04-13 01:34:45 dovecot_login authenticator failed for (static-97.224.143.114-tataidc.co.in) [182.156.133.169]:58707: 535 Incorrect authentication data (set_id=purchase)182.156.133.1691269750g#  -]% ossec13001gTExim Auth failed2025-04-13 01:34:35 dovecot_login authenticator failed for ([14.37.206.76]) [14.37.206.76]:59720: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)14.37.206.761835841\"  -G% ossec13001gExim Auth failed2025-04-13 00:58:50 dovecot_login authenticator failed for ([58.34.176.82]) [58.34.176.82]:50268: 535 Incorrect authentication data (set_id=vikas.khandelwal)58.34.176.821814991!  -+% ossec13001gExim Auth failed2025-04-13 00:58:37 dovecot_login authenticator failed for (5x16x138x238.static-business.spb.ertelecom.ru) [5.16.138.238]:18103: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)5.16.138.2382017370Z  -=+ ossec13001gExim Auth failed2025-04-13 00:57:46 dovecot_login authenticator failed for ([221.239.109.147]) [221.239.109.147]:15034: 535 Incorrect authentication data (set_id=sales)221.239.109.1471814991g  -[' ossec13001gExim Auth failed2025-04-13 00:57:35 dovecot_login authenticator failed for ([103.47.74.210]) [103.47.74.210]:37044: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)103.47.74.2101269750\  -G% ossec13001gExim Auth failed2025-04-13 00:10:31 dovecot_login authenticator failed for ([43.159.46.60]) [43.159.46.60]:55542: 535 Incorrect authentication data (set_id=vikas.khandelwal)43.159.46.601880251o  -m% ossec13001gExim Auth failed2025-04-13 00:10:16 dovecot_login authenticator failed for ([218.70.9.114]) [218.70.9.114]:36550: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)218.70.9.1141814991B  gU) ossec11307ggMultiple connection attempts from same sourceApr 13 00:05:18 vm1 pure-ftpd[3696401]: (?@206.168.34.118) [INFO] New connection from 206.168.34.118206.168.34.1186252001) 3U) ossec11301g_ New FTP connection.Apr 13 00:05:09 vm1 pure-ftpd[3696208]: (?@206.168.34.118) [INFO] New connection from 206.168.34.118206.168.34.1186252001  ?1 ossec1008gProcess exiting (killed).Apr 13 00:05:45 vm1 spamd[3406377]: spamd: server killed by SIGTERM, shutting down%  3Q' ossec11301gNew FTP connection.Apr 12 23:49:38 vm1 pure-ftpd[3692429]: (?@20.127.211.52) [INFO] New connection from 20.127.211.5220.127.211.5262520016  Ag% ossec11302gFTP Authentication failed.Apr 12 23:28:43 vm1 pure-ftpd[3688404]: (?@34.78.35.211) [WARNING] Authentication failed for user [anonymous]34.78.35.2112802361# 3M% ossec11301gNew FTP connection.Apr 12 23:28:38 vm1 pure-ftpd[3688404]: (?@34.78.35.211) [INFO] New connection from 34.78.35.21134.78.35.2112802361b  -O) ossec13001gOExim Auth failed2025-04-12 23:22:14 dovecot_login authenticator failed for ([49.124.149.214]) [49.124.149.214]:60954: 535 Incorrect authentication data (set_id=vikas.khandelwal)49.124.149.2141733045 U W % +AC:  77 ossec502gOssec server started.ossec: Ossec started.\9  -G% ossec13001gExim Auth failed2025-04-13 05:02:03 dovecot_login authenticator failed for ([14.39.41.171]) [14.39.41.171]:53089: 535 Incorrect authentication data (set_id=vikas.khandelwal)14.39.41.17118358418  -) ossec13001gExim Auth failed2025-04-13 05:01:41 dovecot_login authenticator failed for (220.224.221.60.adsl-pool.sx.cn) [60.221.224.220]:39747: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)60.221.224.2201814991]7  -C+ ossec13001gExim Auth failed2025-04-13 04:35:33 dovecot_login authenticator failed for ([112.194.143.206]) [112.194.143.206]:50632: 535 Incorrect authentication data (set_id=purchase)112.194.143.2061814991{6  -) ossec13001gExim Auth failed2025-04-13 04:35:11 dovecot_login authenticator failed for (222-42-136-186.fibertel.com.ar) [186.136.42.222]:35696: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)186.136.42.2223865483b5  -O) ossec13001gExim Auth failed2025-04-13 04:13:42 dovecot_login authenticator failed for ([106.55.161.136]) [106.55.161.136]:44100: 535 Incorrect authentication data (set_id=vikas.khandelwal)106.55.161.1361814991r4  -m+ ossec13001gjExim Auth failed2025-04-13 04:12:49 dovecot_login authenticator failed for (dynamic-ip-adsl.metfone.com.kh) [175.100.107.238]:54268: 535 Incorrect authentication data (set_id=vikas.khandelwal)175.100.107.2381831722l3  -i# ossec13001g\Exim Auth failed2025-04-13 04:12:34 dovecot_login authenticator failed for ([14.6.16.137]) [14.6.16.137]:50564: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)14.6.16.1371835841'2  3U) ossec11301gNew FTP connection.Apr 13 03:53:07 vm1 pure-ftpd[3744169]: (?@185.247.137.72) [INFO] New connection from 185.247.137.72185.247.137.72298795e1  -S+ ossec13001gExim Auth failed2025-04-13 03:24:27 dovecot_login authenticator failed for ([221.163.227.238]) [221.163.227.238]:49893: 535 Incorrect authentication data (set_id=vikas.khandelwal)221.163.227.2381835841u0  -u) ossec13001gExim Auth failed2025-04-13 03:24:02 dovecot_login authenticator failed for ([122.227.206.42]) [122.227.206.42]:43530: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)122.227.206.421814991%/  3Q' ossec11301g՜New FTP connection.Apr 13 02:35:30 vm1 pure-ftpd[3728623]: (?@3.148.204.247) [INFO] New connection from 3.148.204.2473.148.204.2476252001_.  -K' ossec13001gՔExim Auth failed2025-04-13 02:35:23 dovecot_login authenticator failed for ([183.47.48.178]) [183.47.48.178]:53959: 535 Incorrect authentication data (set_id=vikas.khandelwal)183.47.48.1781814991u-  -u) ossec13001gՄExim Auth failed2025-04-13 02:35:08 dovecot_login authenticator failed for ([81.208.168.148]) [81.208.168.148]:39830: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)81.208.168.1482635167%,  3Q' ossec11301g"New FTP connection.Apr 13 02:33:28 vm1 pure-ftpd[3728158]: (?@3.148.204.247) [INFO] New connection from 3.148.204.2473.148.204.2476252001%+  3Q' ossec11301gԒNew FTP connection.Apr 13 02:31:04 vm1 pure-ftpd[3727603]: (?@3.148.204.247) [INFO] New connection from 3.148.204.2473.148.204.2476252001%*  3Q' ossec11301gNew FTP connection.Apr 13 02:28:27 vm1 pure-ftpd[3727009]: (?@3.148.204.247) [INFO] New connection from 3.148.204.2473.148.204.2476252001%)  3Q' ossec11301guNew FTP connection.Apr 13 02:26:19 vm1 pure-ftpd[3726667]: (?@3.148.204.247) [INFO] New connection from 3.148.204.2473.148.204.2476252001&( 3Q' ossec11301gNew FTP connection.Apr 13 02:24:20 vm1 pure-ftpd[3726082]: (?@3.148.204.247) [INFO] New connection from 3.148.204.2473.148.204.2476252001   m n :KlwmK  -e) ossec13001gExim Auth failed2025-04-13 07:47:13 dovecot_login authenticator failed for ([154.144.243.93]) [154.144.243.93]:33316: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)154.144.243.932542007pJ  -i+ ossec13001gExim Auth failed2025-04-13 07:47:05 dovecot_login authenticator failed for ([221.149.203.183]) [221.149.203.183]:47774: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)221.149.203.1831835841ZI  -?) ossec13001gExim Auth failed2025-04-13 07:46:48 dovecot_login authenticator failed for ([119.207.78.191]) [119.207.78.191]:41002: 535 Incorrect authentication data (set_id=purchase)119.207.78.1911835841jH  -_) ossec13001gExim Auth failed2025-04-13 07:46:37 dovecot_login authenticator failed for (hn.kd.ny.adsl) [218.29.239.174]:33531: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)218.29.239.1741814991'G  3U) ossec11301gNew FTP connection.Apr 13 07:44:54 vm1 pure-ftpd[3790254]: (?@93.123.109.222) [INFO] New connection from 93.123.109.22293.123.109.222732800]F -C) ossec13001g[Exim Auth failed2025-04-13 07:33:05 dovecot_login authenticator failed for (thepsindustries.com) [42.193.105.109]:50786: 535 Incorrect authentication data (set_id=nologin)42.193.105.1091814991_E  -K' ossec13001g`Exim Auth failed2025-04-13 07:28:55 dovecot_login authenticator failed for ([41.224.62.206]) [41.224.62.206]:38088: 535 Incorrect authentication data (set_id=vikas.khandelwal)41.224.62.2062464461uD  -u) ossec13001gNExim Auth failed2025-04-13 07:28:38 dovecot_login authenticator failed for ([221.10.195.198]) [221.10.195.198]:55810: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)221.10.195.1981814991\C  -G% ossec13001gExim Auth failed2025-04-13 06:39:46 dovecot_login authenticator failed for ([14.43.137.90]) [14.43.137.90]:45016: 535 Incorrect authentication data (set_id=vikas.khandelwal)14.43.137.901835841xB  -y+ ossec13001gExim Auth failed2025-04-13 06:39:05 dovecot_login authenticator failed for ([175.205.126.214]) [175.205.126.214]:46894: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)175.205.126.2141835841eA  -U+ ossec13001gaExim Auth failed2025-04-13 05:50:47 dovecot_login authenticator failed for 3pc100-144.rconx.com [185.115.100.144]:37857: 535 Incorrect authentication data (set_id=vikas.khandelwal)185.115.100.144272103z@  -' ossec13001gUExim Auth failed2025-04-13 05:50:36 dovecot_login authenticator failed for 37.234.128.77.rev.sfr.net [77.128.234.37]:56760: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)77.128.234.373017382(?  3U) ossec11301gNew FTP connection.Apr 13 05:30:11 vm1 pure-ftpd[3763599]: (?@205.210.31.214) [INFO] New connection from 205.210.31.214205.210.31.2146252001j>  -_) ossec13001gExim Auth failed2025-04-13 05:23:00 dovecot_login authenticator failed for ([119.207.78.191]) [119.207.78.191]:52234: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)119.207.78.1911835841(=  3U) ossec11301gNew FTP connection.Apr 13 05:23:50 vm1 pure-ftpd[3762228]: (?@194.165.16.166) [INFO] New connection from 194.165.16.166194.165.16.1662993457q<  -k+ ossec13001gExim Auth failed2025-04-13 05:23:11 dovecot_login authenticator failed for (146.242.161.222.adsl-pool.jlccptt.net.cn) [222.161.242.146]:12260: 535 Incorrect authentication data (set_id=sales)222.161.242.1461814991O;  ;' ossec13008gMail Recipient rejected2025-04-13 05:18:23 H=(mail.heipowersystem.com) [45.197.14.191]:50010 F= rejected RCPT : Rejected relay attempt: '45.197.14.191' From: 'jvgpkeulmdf@heipowersystem.com' To: 'validxxx@gmailhotmail.com.br'45.197.14.1916252001 !' 0  F\f7xZ  -y+ ossec13001gH\Exim Auth failed2025-04-13 10:45:08 dovecot_login authenticator failed for ([178.178.194.134]) [178.178.194.134]:60912: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)178.178.194.1342017370UY  ;%+ ossec13008gFMail Recipient rejected2025-04-13 10:37:29 H=(mail.amplifypowerglobal.com) [165.154.228.109]:58202 F= rejected RCPT : Rejected relay attempt: '165.154.228.109' From: 'sthgf@amplifypowerglobal.com' To: 'validxxx@gmailhotmail.com.br'165.154.228.1091643084\X -E% ossec13001gCExim Auth failed2025-04-13 10:25:59 dovecot_login authenticator failed for (amplifypowerglobal.com) [150.5.145.36]:41242: 535 Incorrect authentication data (set_id=nologin)150.5.145.361880251IW  ;) ossec13008g@ Mail Recipient rejected2025-04-13 10:09:36 H=(mail.thepsindustries.com) [165.154.242.42]:50141 F= rejected RCPT : Rejected relay attempt: '165.154.242.42' From: 'ikhye@thepsindustries.com' To: 'validxxx@gmailhotmail.com.br'165.154.242.421694008qV  -q' ossec13001g<Exim Auth failed2025-04-13 09:56:08 dovecot_login authenticator failed for ([217.29.208.26]) [217.29.208.26]:39193: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)217.29.208.26953987eU  -S+ ossec13001g<Exim Auth failed2025-04-13 09:56:21 dovecot_login authenticator failed for ([114.215.211.223]) [114.215.211.223]:35826: 535 Incorrect authentication data (set_id=vikas.khandelwal)114.215.211.2231814991TT  -5' ossec13001g:Exim Auth failed2025-04-13 09:47:13 dovecot_login authenticator failed for ([103.107.36.18]) [103.107.36.18]:38496: 535 Incorrect authentication data (set_id=sales)103.107.36.181269750wS  -w+ ossec13001g:Exim Auth failed2025-04-13 09:47:04 dovecot_login authenticator failed for 225.sub-166-144-239.myvzw.com [166.144.239.225]:38246: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)166.144.239.2256252001wR -y' ossec13001g3Exim Auth failed2025-04-13 09:16:56 dovecot_plain authenticator failed for ([85.215.236.96]) [85.215.236.96]:58200: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)85.215.236.962921044_Q  -K' ossec13001g1Exim Auth failed2025-04-13 09:07:47 dovecot_login authenticator failed for ([60.166.31.198]) [60.166.31.198]:58672: 535 Incorrect authentication data (set_id=vikas.khandelwal)60.166.31.1981814991uP  -u) ossec13001g1zExim Auth failed2025-04-13 09:07:29 dovecot_login authenticator failed for ([220.77.182.170]) [220.77.182.170]:38249: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)220.77.182.17018358416O  ;i) ossec13008g0lMail Recipient rejected2025-04-13 09:02:59 H=(hostglobal.plus) [78.153.140.207]:49824 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no F= rejected RCPT : SMTP AUTH is required for message submission on port 58778.153.140.2072635167rN  -q' ossec13001g%Exim Auth failed2025-04-13 08:17:58 dovecot_login authenticator failed for xdsl-customer-163-30.spectrum.com.au [202.68.163.30]:49981: 535 Incorrect authentication data (set_id=vikas.khandelwal)202.68.163.302077456uM  -u) ossec13001g%Exim Auth failed2025-04-13 08:17:45 dovecot_login authenticator failed for ([47.238.172.205]) [47.238.172.205]:54772: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)47.238.172.2051819730ZL  -?) ossec13001gExim Auth failed2025-04-13 07:47:24 dovecot_login authenticator failed for ([221.209.48.203]) [221.209.48.203]:34952: 535 Incorrect authentication data (set_id=purchase)221.209.48.2031814991 " I W ?luVk  -?! ossec13001g_JExim Auth failed2025-04-13 12:22:56 dovecot_login authenticator failed for ([59.2.14.33]) [59.2.14.33]:32780: 535 Incorrect authentication data (set_id=vikas.khandelwal)59.2.14.331835841rj  -q' ossec13001g_>Exim Auth failed2025-04-13 12:22:44 dovecot_login authenticator failed for ([31.173.20.146]) [31.173.20.146]:60816: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)31.173.20.1462017370Ni  --# ossec13001gXExim Auth failed2025-04-13 11:56:03 dovecot_login authenticator failed for ([8.209.221.7]) [8.209.221.7]:44968: 535 Incorrect authentication data (set_id=sales)8.209.221.71861060Vh  -7) ossec13001gXExim Auth failed2025-04-13 11:55:50 dovecot_login authenticator failed for ([218.98.26.226]) [58.216.101.162]:50499: 535 Incorrect authentication data (set_id=sales)58.216.101.1621814991}g  -+ ossec13001gXExim Auth failed2025-04-13 11:55:33 dovecot_login authenticator failed for (223-197-153-135.static.imsbiz.com) [223.197.153.135]:60086: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)223.197.153.1351819730^f  -M# ossec13001gU Exim Auth failed2025-04-13 11:39:13 dovecot_plain authenticator failed for (pdt_web1) [66.38.2.202]:28050: 535 Incorrect authentication data (set_id=info@s2seducationtrust.com)66.38.2.2026252001^e  -M# ossec13001gTExim Auth failed2025-04-13 11:37:00 dovecot_plain authenticator failed for (pdt_web1) [66.38.2.202]:32160: 535 Incorrect authentication data (set_id=info@s2seducationtrust.com)66.38.2.2026252001^d  -M# ossec13001gSExim Auth failed2025-04-13 11:34:47 dovecot_plain authenticator failed for (pdt_web1) [66.38.2.202]:42687: 535 Incorrect authentication data (set_id=info@s2seducationtrust.com)66.38.2.2026252001_c  -K' ossec13001gSExim Auth failed2025-04-13 11:34:44 dovecot_login authenticator failed for ([120.36.140.22]) [120.36.140.22]:52914: 535 Incorrect authentication data (set_id=vikas.khandelwal)120.36.140.221814991 b  -)% ossec13001gSExim Auth failed2025-04-13 11:34:25 dovecot_login authenticator failed for (dynamicip-95-79-108-51.pppoe.nn.ertelecom.ru) [95.79.108.51]:49779: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)95.79.108.512017370^a  -M# ossec13001gS}Exim Auth failed2025-04-13 11:32:36 dovecot_plain authenticator failed for (pdt_web1) [66.38.2.202]:22255: 535 Incorrect authentication data (set_id=info@s2seducationtrust.com)66.38.2.2026252001^`  -M# ossec13001gRExim Auth failed2025-04-13 11:30:27 dovecot_plain authenticator failed for (pdt_web1) [66.38.2.202]:65104: 535 Incorrect authentication data (set_id=info@s2seducationtrust.com)66.38.2.2026252001Q_  -3# ossec13001gNExim Auth failed2025-04-13 11:13:03 dovecot_login authenticator failed for ([36.7.111.87]) [36.7.111.87]:45884: 535 Incorrect authentication data (set_id=purchase)36.7.111.871814991m^  -e) ossec13001gNExim Auth failed2025-04-13 11:12:48 dovecot_login authenticator failed for ([221.209.48.203]) [221.209.48.203]:45982: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)221.209.48.2031814991T]  -5' ossec13001gMExim Auth failed2025-04-13 11:07:34 dovecot_login authenticator failed for ([27.45.234.169]) [27.45.234.169]:50245: 535 Incorrect authentication data (set_id=sales)27.45.234.1691814991i\  -_) ossec13001gM}Exim Auth failed2025-04-13 11:07:01 dovecot_login authenticator failed for ([94.205.101.174]) [94.205.101.174]:53330: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)94.205.101.174290557k[  -e% ossec13001gHtExim Auth failed2025-04-13 10:45:31 dovecot_login authenticator failed for 92-34-29-114.customers.ownit.se [92.34.29.114]:43694: 535 Incorrect authentication data (set_id=vikas.khandelwal)92.34.29.1142661886 S >  DO]f}  -1+ ossec13001gvExim Auth failed2025-04-13 14:00:06 dovecot_login authenticator failed for 107-135-117-245.lightspeed.livnmi.sbcglobal.net [107.135.117.245]:15366: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)107.135.117.2456252001i|  -]) ossec13001goExim Auth failed2025-04-13 13:33:36 dovecot_login authenticator failed for syn-208-105-193-045.biz.spectrum.com [208.105.193.45]:51102: 535 Incorrect authentication data (set_id=sales)208.105.193.456252001g{  -[' ossec13001goExim Auth failed2025-04-13 13:33:01 dovecot_login authenticator failed for ([8.209.247.238]) [8.209.247.238]:53384: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)8.209.247.2381861060bz  -O) ossec13001gjExim Auth failed2025-04-13 13:12:02 dovecot_login authenticator failed for ([223.241.100.90]) [223.241.100.90]:56422: 535 Incorrect authentication data (set_id=vikas.khandelwal)223.241.100.901814991ry  -q' ossec13001gjExim Auth failed2025-04-13 13:11:31 dovecot_login authenticator failed for ([103.68.181.59]) [103.68.181.59]:59518: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)103.68.181.591819730mx  -c+ ossec13001gdEExim Auth failed2025-04-13 12:44:12 dovecot_login authenticator failed for ([220.189.235.126]) [220.189.235.126]:51642: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)220.189.235.1261814991pw  -q# ossec13001gdQExim Auth failed2025-04-13 12:44:24 dovecot_login authenticator failed for (46x0x192x86.static-customer.samara.ertelecom.ru) [46.0.192.86]:50558: 535 Incorrect authentication data (set_id=sales)46.0.192.862017370Vv -7) ossec13001g`Exim Auth failed2025-04-13 12:30:10 dovecot_plain authenticator failed for ([45.144.212.167]) [45.144.212.167]:61097: 535 Incorrect authentication data (set_id=user)45.144.212.167690791[u -A) ossec13001g`Exim Auth failed2025-04-13 12:29:22 dovecot_plain authenticator failed for ([45.144.212.167]) [45.144.212.167]:52972: 535 Incorrect authentication data (set_id=rokamauka)45.144.212.167690791[t  e) ossec11321g`Active Response. FTP brute force attack (Port 21 is protected)Apr 13 12:28:27 vm1 pure-ftpd[3847609]: (?@45.144.212.167) [WARNING] Authentication failed for user [rokama]45.144.212.167690791s  S) ossec211321g`Preventing FTP brute force attempt.[Active Response] is disabled for rule 11321. Greylisting 45.144.212.16745.144.212.167690791:r Ak) ossec11302g`FTP Authentication failed.Apr 13 12:28:07 vm1 pure-ftpd[3847562]: (?@45.144.212.167) [WARNING] Authentication failed for user [rokamauka]45.144.212.167690791(q 3U) ossec11301g`|New FTP connection.Apr 13 12:28:02 vm1 pure-ftpd[3847562]: (?@45.144.212.167) [INFO] New connection from 45.144.212.16745.144.212.167690791Zp  -A) ossec13001g`Exim Auth failed2025-04-13 12:28:57 dovecot_plain authenticator failed for ([45.144.212.167]) [45.144.212.167]:64102: 535 Incorrect authentication data (set_id=rokamauka)45.144.212.167690791Ao  gU) ossec11307g`Multiple connection attempts from same sourceApr 13 12:28:27 vm1 pure-ftpd[3847616]: (?@45.144.212.167) [INFO] New connection from 45.144.212.16745.144.212.167690791{n S[) ossec11000g`rLogin failed on the cpanel service.[2025-04-13 12:27:54 +0530] info [cpaneld] 45.144.212.167 - rokamauk "POST /login HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user rokamauk (has_cpuser_file failed)45.144.212.167690791>m  Au) ossec11302g`zFTP Authentication failed.Apr 13 12:28:00 vm1 pure-ftpd[3847549]: (?@45.144.212.167) [WARNING] Authentication failed for user [rokamauka_user]45.144.212.167690791(l 3U) ossec11301g`tNew FTP connection.Apr 13 12:27:55 vm1 pure-ftpd[3847547]: (?@45.144.212.167) [INFO] New connection from 45.144.212.16745.144.212.167690791 \3 D _  ,ECiD\c E7+ ossec2501gUser authentication failure.Apr 13 16:27:39 vm1 sshd[3896071]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=112.118.145.121 user=root112.118.145.12118197301 a7+ ossec5710gAttempt to login using a non-existent userApr 13 16:27:51 vm1 sshd[3896088]: Invalid user wenxp from 112.118.145.121 port 52354112.118.145.1211819730x  -}' ossec13001gExim Auth failed2025-04-13 15:59:46 dovecot_login authenticator failed for s010664777d9d1153.cg.shawcable.net [70.77.225.190]:56946: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)70.77.225.1906251999k  -_+ ossec13001g-Exim Auth failed2025-04-13 16:00:04 dovecot_login authenticator failed for syn-208-105-196-214.biz.spectrum.com [208.105.196.214]:41829: 535 Incorrect authentication data (set_id=sales)208.105.196.2146252001Q  -3# ossec13001g Exim Auth failed2025-04-13 15:55:36 dovecot_login authenticator failed for ([103.55.89.5]) [103.55.89.5]:51914: 535 Incorrect authentication data (set_id=purchase)103.55.89.51269750w  -{' ossec13001gExim Auth failed2025-04-13 15:55:28 dovecot_login authenticator failed for ool-457bdb52.dyn.optonline.net [69.123.219.82]:50757: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)69.123.219.826252001+  3Y+ ossec11301gjNew FTP connection.Apr 13 15:18:25 vm1 pure-ftpd[3882329]: (?@172.174.201.238) [INFO] New connection from 172.174.201.238172.174.201.2386252001U  -9) ossec13001gExim Auth failed2025-04-13 15:10:54 dovecot_login authenticator failed for ([196.216.81.126]) [196.216.81.126]:34076: 535 Incorrect authentication data (set_id=sales)196.216.81.12649518}  -+ ossec13001gExim Auth failed2025-04-13 15:10:37 dovecot_login authenticator failed for (192.102.156.175.unknown.m1.com.sg) [175.156.102.192]:55260: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)175.156.102.1921880251b  -O) ossec13001gExim Auth failed2025-04-13 14:49:05 dovecot_login authenticator failed for ([61.191.163.102]) [61.191.163.102]:40672: 535 Incorrect authentication data (set_id=vikas.khandelwal)61.191.163.1021814991n  -m% ossec13001g|Exim Auth failed2025-04-13 14:48:52 dovecot_login authenticator failed for ([91.74.186.57]) [91.74.186.57]:58189: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)91.74.186.57290557V E) ossec2501gUser authentication failure.Apr 13 14:45:13 vm1 sshd[3875438]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.67.185.104222.67.185.10418149911 a9) ossec5710gAttempt to login using a non-existent userApr 13 14:45:13 vm1 sshd[3875438]: Invalid user chaitra from 222.67.185.104 port 52052222.67.185.1041814991*  CK) ossec5716gSSHD authentication failed.Apr 13 14:44:59 vm1 sshd[3875237]: Failed password for root from 222.67.185.104 port 48358 ssh2222.67.185.1041814991`  E5) ossec2501gUser authentication failure.Apr 13 14:44:56 vm1 sshd[3875237]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.67.185.104 user=root222.67.185.1041814991j  -_) ossec13001g{Exim Auth failed2025-04-13 14:21:34 dovecot_login authenticator failed for ([220.161.52.149]) [220.161.52.149]:54710: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)220.161.52.1491814991W  -9) ossec13001g{#Exim Auth failed2025-04-13 14:21:47 dovecot_login authenticator failed for ([112.102.48.125]) [112.102.48.125]:41089: 535 Incorrect authentication data (set_id=sales)112.102.48.1251814991l~  -c) ossec13001gv*Exim Auth failed2025-04-13 14:00:32 dovecot_login authenticator failed for (91-220-216-178.omsk.mts.ru) [178.216.220.91]:60950: 535 Incorrect authentication data (set_id=vikas.khandelwal)178.216.220.912017370 OY c m w $Yx  -{) ossec13001gExim Auth failed2025-04-13 17:58:36 dovecot_login authenticator failed for (ipoe-static.mosoblast.rt.ru) [89.109.233.181]:42792: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)89.109.233.1812017370(  3U) ossec11301gNew FTP connection.Apr 13 17:40:12 vm1 pure-ftpd[3911013]: (?@47.236.171.141) [INFO] New connection from 47.236.171.14147.236.171.1411880251F  A) ossec11302gFTP Authentication failed.Apr 13 17:40:17 vm1 pure-ftpd[3911013]: (?@47.236.171.141) [WARNING] Authentication failed for user [kikujiro111@gmail.com]47.236.171.1411880251W  -9) ossec13001gExim Auth failed2025-04-13 17:37:53 dovecot_login authenticator failed for ([110.166.80.135]) [110.166.80.135]:56082: 535 Incorrect authentication data (set_id=sales)110.166.80.1351814991T  -5' ossec13001gExim Auth failed2025-04-13 17:37:28 dovecot_login authenticator failed for ([61.153.208.38]) [61.153.208.38]:49784: 535 Incorrect authentication data (set_id=sales)61.153.208.381814991i  -]) ossec13001gExim Auth failed2025-04-13 17:37:10 dovecot_login authenticator failed for ([119.62.156.161]) [119.62.156.161]:8634: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)119.62.156.1611814991{  -% ossec13001gExim Auth failed2025-04-13 16:50:23 dovecot_login authenticator failed for syn-074-062-020-170.biz.spectrum.com [74.62.20.170]:53751: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)74.62.20.1706252001c  -S' ossec13001gExim Auth failed2025-04-13 16:50:57 dovecot_login authenticator failed for (160.72.153.14.lightower.net) [160.72.153.14]:52826: 535 Incorrect authentication data (set_id=purchase)160.72.153.146252001m  -e) ossec13001gExim Auth failed2025-04-13 16:50:46 dovecot_login authenticator failed for ([112.172.189.90]) [112.172.189.90]:47078: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)112.172.189.901835841f  -Y' ossec13001gExim Auth failed2025-04-13 16:48:36 dovecot_login authenticator failed for (customer-CLN-142-4.megared.net.mx) [177.229.142.4]:45006: 535 Incorrect authentication data (set_id=sales)177.229.142.43996063p  -o' ossec13001g}Exim Auth failed2025-04-13 16:48:21 dovecot_login authenticator failed for 95-87-248-223.ip.btc-net.bg [95.87.248.223]:49068: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)95.87.248.223732800q  -m+ ossec13001gQExim Auth failed2025-04-13 16:34:47 dovecot_plain authenticator failed for plesk18.palizct.com (plesk18) [185.226.117.240]:58389: 535 Incorrect authentication data (set_id=info@nyaystambh.com)185.226.117.240130758q  -m+ ossec13001g Exim Auth failed2025-04-13 16:33:37 dovecot_plain authenticator failed for plesk18.palizct.com (plesk18) [185.226.117.240]:57019: 535 Incorrect authentication data (set_id=info@nyaystambh.com)185.226.117.240130758q  -m+ ossec13001gExim Auth failed2025-04-13 16:32:25 dovecot_plain authenticator failed for plesk18.palizct.com (plesk18) [185.226.117.240]:52277: 535 Incorrect authentication data (set_id=info@nyaystambh.com)185.226.117.240130758q  -m+ ossec13001g|Exim Auth failed2025-04-13 16:31:16 dovecot_plain authenticator failed for plesk18.palizct.com (plesk18) [185.226.117.240]:51803: 535 Incorrect authentication data (set_id=info@nyaystambh.com)185.226.117.240130758q  -m+ ossec13001g4Exim Auth failed2025-04-13 16:30:04 dovecot_plain authenticator failed for plesk18.palizct.com (plesk18) [185.226.117.240]:60783: 535 Incorrect authentication data (set_id=info@nyaystambh.com)185.226.117.240130758,  CM+ ossec5716gSSHD authentication failed.Apr 13 16:27:42 vm1 sshd[3896071]: Failed password for root from 112.118.145.121 port 51156 ssh2112.118.145.1211819730 ?    X tgx;Ii?O2  E# ossec2501gȶUser authentication failure.Apr 13 19:52:44 vm1 sshd[3937813]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.76.57.6949.76.57.691814991(1 a-# ossec5710gȢAttempt to login using a non-existent userApr 13 19:52:24 vm1 sshd[3937734]: Invalid user test from 49.76.57.69 port 4395949.76.57.691814991$0  CE# ossec5716gȎSSHD authentication failed.Apr 13 19:52:05 vm1 sshd[3937687]: Failed password for root from 49.76.57.69 port 43506 ssh249.76.57.691814991[/ E/# ossec2501gȌUser authentication failure.Apr 13 19:52:03 vm1 sshd[3937687]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.76.57.69 user=root49.76.57.691814991m.  -e) ossec13001gzExim Auth failed2025-04-13 19:51:46 dovecot_login authenticator failed for (thepsindustries.com) [124.160.63.122]:14501: 535 Incorrect authentication data (set_id=test@thepsindustries.com)124.160.63.1221814991^-  -E+ ossec13001g`Exim Auth failed2025-04-13 19:51:20 dovecot_login authenticator failed for (thepsindustries.com) [202.107.197.211]:46196: 535 Incorrect authentication data (set_id=nologin)202.107.197.2111814991U,  ;%+ ossec13008gMail Recipient rejected2025-04-13 19:23:05 H=(mail.uttamclassesjaipur.com) [165.154.210.137]:61547 F= rejected RCPT : Rejected relay attempt: '165.154.210.137' From: 'ojnom@uttamclassesjaipur.com' To: 'validxxx@gmailhotmail.com.br'165.154.210.1371694008j+  -_) ossec13001gExim Auth failed2025-04-13 19:15:17 dovecot_login authenticator failed for ([60.219.112.193]) [60.219.112.193]:41512: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)60.219.112.1931814991(*  CI' ossec5716gSSHD authentication failed.Apr 13 18:54:29 vm1 sshd[3926076]: Failed password for root from 223.171.88.73 port 37264 ssh2223.171.88.731835841.) a5' ossec5710gAttempt to login using a non-existent userApr 13 18:54:13 vm1 sshd[3926063]: Invalid user debian from 223.171.88.73 port 36326223.171.88.731835841((  CI' ossec5716gSSHD authentication failed.Apr 13 18:54:01 vm1 sshd[3926021]: Failed password for root from 223.171.88.73 port 35288 ssh2223.171.88.731835841_' E3' ossec2501gUser authentication failure.Apr 13 18:53:59 vm1 sshd[3926021]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=223.171.88.73 user=root223.171.88.731835841%&  3Q' ossec11301gNew FTP connection.Apr 13 18:48:23 vm1 pure-ftpd[3925073]: (?@48.217.87.218) [INFO] New connection from 48.217.87.21848.217.87.2186252001%  ;1% ossec13008gPMail Recipient rejected2025-04-13 18:34:14 H=static-185-95-84-71.sunucuhub.com [185.95.84.71]:57424 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no F= rejected RCPT : Sender verify failed185.95.84.71298795d$  -S) ossec13001gmExim Auth failed2025-04-13 18:26:12 dovecot_login authenticator failed for cm222-166-167-89.hkcable.com.hk [222.166.167.89]:36623: 535 Incorrect authentication data (set_id=sales)222.166.167.891819730q#  -s% ossec13001g_Exim Auth failed2025-04-13 18:25:59 dovecot_login authenticator failed for c.88.168.a560.static.cyfra.net [62.80.168.88]:56098: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)62.80.168.88690791"  W) ossec9708gKDovecot Aborted Login with empty userApr 13 18:17:05 vm1 dovecot[1526]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=152.32.170.230, lip=103.74.54.108, TLS, session=152.32.170.2301819730]!  -C+ ossec13001gExim Auth failed2025-04-13 17:58:46 dovecot_login authenticator failed for ([103.194.243.187]) [103.194.243.187]:37047: 535 Incorrect authentication data (set_id=purchase)103.194.243.1871269750 ISf ? J _}I%D  3Q' ossec11301gNew FTP connection.Apr 13 21:48:41 vm1 pure-ftpd[3961671]: (?@64.62.156.205) [INFO] New connection from 64.62.156.20564.62.156.2056252001yC  -}) ossec13001gOExim Auth failed2025-04-13 21:41:58 dovecot_login authenticator failed for 125-229-102-40.hinet-ip.hinet.net [125.229.102.40]:52202: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)125.229.102.401668284\B  -G% ossec13001ggExim Auth failed2025-04-13 21:42:22 dovecot_login authenticator failed for agencijaiiz1-155.bih.net.ba [80.65.90.155]:58892: 535 Incorrect authentication data (set_id=sales)80.65.90.1553277605A  W' ossec9708gDovecot Aborted Login with empty userApr 13 21:23:02 vm1 dovecot[1526]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=87.236.176.79, lip=103.74.54.108, TLS, session=87.236.176.792635167Z@  -=+ ossec13001gExim Auth failed2025-04-13 20:53:26 dovecot_login authenticator failed for ([112.172.117.110]) [112.172.117.110]:56838: 535 Incorrect authentication data (set_id=sales)112.172.117.1101835841d?  -W% ossec13001gExim Auth failed2025-04-13 20:53:14 dovecot_login authenticator failed for ([149.54.51.74]) [149.54.51.74]:53224: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)149.54.51.741149361W>  -;' ossec13001gєExim Auth failed2025-04-13 20:30:36 dovecot_login authenticator failed for ([115.23.23.103]) [115.23.23.103]:37162: 535 Incorrect authentication data (set_id=purchase)115.23.23.1031835841j=  -a' ossec13001gцExim Auth failed2025-04-13 20:30:21 dovecot_login authenticator failed for ([113.192.69.10]) [113.192.69.10]:39296: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)113.192.69.101835841t<  -u' ossec13001gExim Auth failed2025-04-13 20:19:08 dovecot_login authenticator failed for (49.206.244.235.actcorp.in) [49.206.241.22]:58411: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)49.206.241.221269750];  -C+ ossec13001gExim Auth failed2025-04-13 20:19:20 dovecot_login authenticator failed for ([112.194.143.206]) [112.194.143.206]:45640: 535 Incorrect authentication data (set_id=purchase)112.194.143.2061814991f:  -Y' ossec13001g̩Exim Auth failed2025-04-13 20:09:36 dovecot_login authenticator failed for 111-70-42-100.emome-ip.hinet.net [111.70.42.100]:64888: 535 Incorrect authentication data (set_id=purchase)111.70.42.1001668284p9  -i+ ossec13001g̙Exim Auth failed2025-04-13 20:09:21 dovecot_login authenticator failed for ([103.106.154.138]) [103.106.154.138]:37071: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)103.106.154.1381269750*8  CK) ossec5716g/SSHD authentication failed.Apr 13 20:07:33 vm1 sshd[3940810]: Failed password for root from 180.173.78.232 port 56940 ssh2180.173.78.2321814991a7 E5) ossec2501g+User authentication failure.Apr 13 20:07:30 vm1 sshd[3940810]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.173.78.232 user=root180.173.78.2321814991/6 a5) ossec5710g7Attempt to login using a non-existent userApr 13 20:07:41 vm1 sshd[3940872]: Invalid user admin from 180.173.78.232 port 57684180.173.78.2321814991Y5  -?' ossec13001g˙Exim Auth failed2025-04-13 20:05:04 dovecot_login authenticator failed for (broadband.actcorp.in) [106.51.217.56]:11684: 535 Incorrect authentication data (set_id=sales)106.51.217.561269750h4  -[) ossec13001gˇExim Auth failed2025-04-13 20:04:46 dovecot_login authenticator failed for ([36.154.20.34]) [153.37.177.219]:45068: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)153.37.177.2191814991(3 a-# ossec5710gȴAttempt to login using a non-existent userApr 13 19:52:43 vm1 sshd[3937813]: Invalid user user from 49.76.57.69 port 4437949.76.57.691814991 #;  :u"V  3M% ossec11301g New FTP connection.Apr 14 00:29:36 vm1 pure-ftpd[3996040]: (?@103.203.59.5) [INFO] New connection from 103.203.59.5103.203.59.51814991QU  -1% ossec13001gExim Auth failed2025-04-14 00:07:57 dovecot_login authenticator failed for ([64.23.239.89]) [64.23.239.89]:56456: 535 Incorrect authentication data (set_id=sales)64.23.239.896252001cT  -W% ossec13001gyExim Auth failed2025-04-14 00:07:45 dovecot_login authenticator failed for ([5.229.201.88]) [5.229.201.88]:47871: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)5.229.201.88298795S  ?1 ossec1008gSProcess exiting (killed).Apr 14 00:07:05 vm1 spamd[3696824]: spamd: server killed by SIGTERM, shutting down+R  3Y+ ossec11301gxNew FTP connection.Apr 13 23:50:39 vm1 pure-ftpd[3985889]: (?@128.203.201.201) [INFO] New connection from 128.203.201.201128.203.201.2016252001Q  W+ ossec9708gyDovecot Aborted Login with empty userApr 13 23:29:19 vm1 dovecot[1526]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=185.247.137.130, lip=103.74.54.108, TLS, session=185.247.137.1302987958P  Ai' ossec11302gFTP Authentication failed.Apr 13 23:27:41 vm1 pure-ftpd[3981303]: (?@34.140.130.14) [WARNING] Authentication failed for user [anonymous]34.140.130.142802361&O 3Q' ossec11301gNew FTP connection.Apr 13 23:27:36 vm1 pure-ftpd[3981301]: (?@34.140.130.14) [INFO] New connection from 34.140.130.1434.140.130.142802361TN  -5' ossec13001g,Exim Auth failed2025-04-13 23:19:32 dovecot_login authenticator failed for ([61.184.26.197]) [61.184.26.197]:40596: 535 Incorrect authentication data (set_id=sales)61.184.26.1971814991gM  -[' ossec13001gExim Auth failed2025-04-13 23:19:12 dovecot_login authenticator failed for ([222.87.49.250]) [222.87.49.250]:52438: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)222.87.49.2501814991%L  3Q' ossec11301gNew FTP connection.Apr 13 23:06:16 vm1 pure-ftpd[3977040]: (?@203.20.104.18) [INFO] New connection from 203.20.104.18203.20.104.182077456qK  ;]+ ossec13008gMail Recipient rejected2025-04-13 22:47:55 H=(mail.shivelectricaltransformers.com) [165.154.210.137]:53701 F= rejected RCPT : Rejected relay attempt: '165.154.210.137' From: 'poprfsg@shivelectricaltransformers.com' To: 'validxxx@gmailhotmail.com.br'165.154.210.1371694008QJ  -1% ossec13001gExim Auth failed2025-04-13 22:30:33 dovecot_login authenticator failed for ([111.75.243.5]) [111.75.243.5]:56576: 535 Incorrect authentication data (set_id=sales)111.75.243.51814991jI  -_) ossec13001gExim Auth failed2025-04-13 22:30:18 dovecot_login authenticator failed for ([193.111.124.226]) [103.139.10.248]:7047: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)103.139.10.2481643084(H  3U) ossec11301gNew FTP connection.Apr 13 22:23:06 vm1 pure-ftpd[3968516]: (?@51.159.234.118) [INFO] New connection from 51.159.234.11851.159.234.1183017382%G  3Q' ossec11301gNew FTP connection.Apr 13 22:21:28 vm1 pure-ftpd[3968254]: (?@198.235.24.72) [INFO] New connection from 198.235.24.72198.235.24.726252001cF  -O+ ossec13001g|Exim Auth failed2025-04-13 21:59:47 dovecot_login authenticator failed for (rokamauka.com) [202.107.197.211]:45260: 535 Incorrect authentication data (set_id=test@rokamauka.com)202.107.197.2111814991XE  -9+ ossec13001gdExim Auth failed2025-04-13 21:59:22 dovecot_login authenticator failed for (rokamauka.com) [202.107.197.211]:41570: 535 Incorrect authentication data (set_id=nologin)202.107.197.2111814991 *\~tj`VLB8.$zpf\H>4*   v l b X N D : 0 &    ~ t j ` V L B 8 . $    z p f \ R H > 4 *  vlbXN:D0&|rh^T@6J,"xndZPF<2( ~tj`$VLB8.zpf\ | r h ^ T J @ 6 , "    x n d Z P F < 2 (   RRH>4*  vlbXND:0& gAF gXAE gAD gɔAC gAB goAA gőA@ g}A? gA> gA= gA< gA; gA: gA9 gtA8 g_A7 gMA6 g9A5 gA4 gA3 gA2 gA1 gA0 gA/ gA. gA- gA, gA+ gA* gA) gA( gA' gA& gA% gA$ gA# gA" gA! gA gA gA gA gA gjA gLA gA gA gA gA gA gA gfA gZA g#A gA g|2A gvA gvA gkkA gkYA geA gd+A gcA gcA gbJA g_A g_A g__A g]_A gZA gXA gTc@ gT]@ gTC@ gT5@ gTK@ gP^@ gNw@ gNi@ gL@ gJ$@ gH@ gH@ g>@ g=q@ g=a@ g=S@ g=K@ g<@ g@j gX@i gX@h gX@g gU @f gT@e gS@d gS@c gS@b gS}@a gR@` gN@_ gN@^ gM@] gM}@\ gHt@[ gH\@Z gF@Y gC@X g@ @W g<@U g<@V g:@T g:@S g3@R g1@Q g1z@P g0l@O g%@N g%@M g@L g@K g@J g@I 9 ; \ k pSZf  -=+ ossec13001g1Exim Auth failed2025-04-14 03:21:48 dovecot_login authenticator failed for ([121.170.218.142]) [121.170.218.142]:37173: 535 Incorrect authentication data (set_id=sales)121.170.218.1421835841ie  -_) ossec13001g1Exim Auth failed2025-04-14 03:21:37 dovecot_login authenticator failed for ([94.131.211.168]) [94.131.211.168]:54842: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)94.131.211.168690791:d  ;q) ossec13008g*DMail Recipient rejected2025-04-14 02:49:00 H=(hostglobal.plus) [78.153.140.207]:43896 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no F= rejected RCPT : SMTP AUTH is required for message submission on port 58778.153.140.2072635167gc  -[' ossec13001g&EExim Auth failed2025-04-14 02:31:56 dovecot_login authenticator failed for ([157.20.228.20]) [157.20.228.20]:48321: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)157.20.228.201269750Zb  -=+ ossec13001g&WExim Auth failed2025-04-14 02:32:15 dovecot_login authenticator failed for ([121.142.165.111]) [121.142.165.111]:57645: 535 Incorrect authentication data (set_id=sales)121.142.165.1111835841_a  -K' ossec13001g$Exim Auth failed2025-04-14 02:22:43 dovecot_login authenticator failed for sagitario.itmorelia.edu.mx [200.33.171.65]:2392: 535 Incorrect authentication data (set_id=purchase)200.33.171.653996063p`  -i+ ossec13001g$Exim Auth failed2025-04-14 02:22:19 dovecot_login authenticator failed for ([112.194.142.167]) [112.194.142.167]:40844: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)112.194.142.1671814991(_  3U) ossec11301g#New FTP connection.Apr 14 02:20:29 vm1 pure-ftpd[4018495]: (?@198.235.24.183) [INFO] New connection from 198.235.24.183198.235.24.1836252001^  ;3% ossec13008g!TMail Recipient rejected2025-04-14 02:10:51 H=static-185-95-84-71.sunucuhub.com [185.95.84.71]:44714 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no F= rejected RCPT : Sender verify failed185.95.84.71298795]  W' ossec9708gDovecot Aborted Login with empty userApr 14 02:00:03 vm1 dovecot[1526]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=185.226.196.8, lip=103.74.54.108, TLS, session=185.226.196.82264397W\  -9) ossec13001gExim Auth failed2025-04-14 01:43:48 dovecot_login authenticator failed for ([186.96.101.126]) [186.96.101.126]:40521: 535 Incorrect authentication data (set_id=sales)186.96.101.1263686110l[  -e' ossec13001gExim Auth failed2025-04-14 01:43:32 dovecot_login authenticator failed for mail.toptronicsinc.com [218.4.156.254]:51790: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)218.4.156.2541814991ZZ  -?) ossec13001gExim Auth failed2025-04-14 01:00:54 dovecot_login authenticator failed for ([221.209.48.203]) [221.209.48.203]:58706: 535 Incorrect authentication data (set_id=purchase)221.209.48.2031814991yY  -}) ossec13001gExim Auth failed2025-04-14 01:00:41 dovecot_login authenticator failed for ool-4579c7cb.dyn.optonline.net [69.121.199.203]:60286: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)69.121.199.2036252001WX  -9) ossec13001gExim Auth failed2025-04-14 00:55:46 dovecot_login authenticator failed for ([42.194.186.118]) [42.194.186.118]:36798: 535 Incorrect authentication data (set_id=sales)42.194.186.1181814991fW  -[' ossec13001gExim Auth failed2025-04-14 00:55:32 dovecot_login authenticator failed for ([85.206.57.114]) [85.206.57.114]:56738: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)85.206.57.114597427   @ RdZkzv  W' ossec9708gJ$Dovecot Aborted Login with empty userApr 14 05:04:58 vm1 dovecot[1526]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=87.236.176.24, lip=103.74.54.108, TLS, session=87.236.176.242635167Tu  -5' ossec13001gHExim Auth failed2025-04-14 04:59:02 dovecot_login authenticator failed for ([58.253.194.29]) [58.253.194.29]:35572: 535 Incorrect authentication data (set_id=sales)58.253.194.291814991st  -w# ossec13001gHExim Auth failed2025-04-14 04:58:47 dovecot_login authenticator failed for c-68-60-9-216.hsd1.tn.comcast.net [68.60.9.216]:41962: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)68.60.9.2166252001[s  -A) ossec13001g>Exim Auth failed2025-04-14 04:16:35 dovecot_plain authenticator failed for (tsdemo1) [137.135.97.226]:64750: 535 Incorrect authentication data (set_id=info@rokamauka.com)137.135.97.2266252001lr  -g% ossec13001g=qExim Auth failed2025-04-14 04:10:49 dovecot_login authenticator failed for host-95-228-33-80.business.telecomitalia.it [95.228.33.80]:56489: 535 Incorrect authentication data (set_id=sales)95.228.33.803175395lq  -c+ ossec13001g=aExim Auth failed2025-04-14 04:10:33 dovecot_login authenticator failed for ([196.189.149.241]) [196.189.149.241]:56554: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)196.189.149.241337996jp  -_) ossec13001g=SExim Auth failed2025-04-14 04:10:19 dovecot_login authenticator failed for ([218.94.115.164]) [218.94.115.164]:34026: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)218.94.115.1641814991o  -' ossec13001g=KExim Auth failed2025-04-14 04:10:10 dovecot_login authenticator failed for p5df05771.dip0.t-ipconnect.de ([89.107.163.13]) [93.240.87.113]:13439: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)93.240.87.1132921044in  -a% ossec13001g<Exim Auth failed2025-04-14 04:07:05 dovecot_plain authenticator failed for gozapp.net (p7344754) [66.33.56.202]:50738: 535 Incorrect authentication data (set_id=info@thepsindustries.com)66.33.56.2026251999im  -a% ossec13001g rejected RCPT : SMTP AUTH is required for message submission on port 465104.167.222.2016252001[g  -A) ossec13001g4Exim Auth failed2025-04-14 03:32:40 dovecot_plain authenticator failed for (tsdemo1) [137.135.97.226]:49448: 535 Incorrect authentication data (set_id=info@rokamauka.com)137.135.97.2266252001 q 5 Y y  ]}%ESq]  -C+ ossec13001gcExim Auth failed2025-04-14 06:53:58 dovecot_login authenticator failed for ([218.149.235.152]) [218.149.235.152]:55654: 535 Incorrect authentication data (set_id=purchase)218.149.235.1521835841m  -e) ossec13001gcExim Auth failed2025-04-14 06:53:39 dovecot_login authenticator failed for ([202.117.92.118]) [202.117.92.118]:52768: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)202.117.92.1181814991[  -A) ossec13001gbJExim Auth failed2025-04-14 06:48:01 dovecot_plain authenticator failed for (tsdemo1) [137.135.97.226]:59269: 535 Incorrect authentication data (set_id=info@rokamauka.com)137.135.97.2266252001T  -5' ossec13001g_Exim Auth failed2025-04-14 06:37:08 dovecot_login authenticator failed for ([113.192.69.10]) [113.192.69.10]:53442: 535 Incorrect authentication data (set_id=sales)113.192.69.101835841m  -c+ ossec13001g_Exim Auth failed2025-04-14 06:36:57 dovecot_login authenticator failed for ([220.180.166.214]) [220.180.166.214]:38355: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)220.180.166.2141814991[  -A) ossec13001g__Exim Auth failed2025-04-14 06:35:34 dovecot_plain authenticator failed for (tsdemo1) [137.135.97.226]:55403: 535 Incorrect authentication data (set_id=info@rokamauka.com)137.135.97.2266252001(  3U) ossec11301g]_New FTP connection.Apr 14 06:27:01 vm1 pure-ftpd[4069132]: (?@66.240.223.202) [INFO] New connection from 66.240.223.20266.240.223.2026252001[  -A) ossec13001gZExim Auth failed2025-04-14 06:16:31 dovecot_plain authenticator failed for (tsdemo1) [137.135.97.226]:62332: 535 Incorrect authentication data (set_id=info@rokamauka.com)137.135.97.2266252001(  3U) ossec11301gXNew FTP connection.Apr 14 06:07:07 vm1 pure-ftpd[4065086]: (?@162.142.125.41) [INFO] New connection from 162.142.125.41162.142.125.416252001N  --# ossec13001gTcExim Auth failed2025-04-14 05:48:42 dovecot_login authenticator failed for ([62.4.94.178]) [62.4.94.178]:52277: 535 Incorrect authentication data (set_id=sales)62.4.94.1782921044Z~  -=+ ossec13001gT]Exim Auth failed2025-04-14 05:48:36 dovecot_login authenticator failed for ([221.149.233.243]) [221.149.233.243]:37056: 535 Incorrect authentication data (set_id=sales)221.149.233.2431835841Q}  -3# ossec13001gTCExim Auth failed2025-04-14 05:48:10 dovecot_login authenticator failed for ([60.174.86.4]) [60.174.86.4]:51567: 535 Incorrect authentication data (set_id=purchase)60.174.86.41814991i|  -a% ossec13001gT5Exim Auth failed2025-04-14 05:47:55 dovecot_login authenticator failed for ([114.242.175.187]) [36.112.75.46]:1168: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)36.112.75.461814991t{  -u' ossec13001gTKExim Auth failed2025-04-14 05:48:18 dovecot_login authenticator failed for (pppoe-static.mosoblast.rt.ru) [77.51.214.170]:39430: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)77.51.214.1702017370[z  -A) ossec13001gP^Exim Auth failed2025-04-14 05:31:34 dovecot_plain authenticator failed for (tsdemo1) [137.135.97.226]:63153: 535 Incorrect authentication data (set_id=info@rokamauka.com)137.135.97.2266252001Wy  -;' ossec13001gNwExim Auth failed2025-04-14 05:23:26 dovecot_login authenticator failed for ([83.239.84.130]) [83.239.84.130]:55462: 535 Incorrect authentication data (set_id=purchase)83.239.84.1302017370fx  -]% ossec13001gNiExim Auth failed2025-04-14 05:23:13 dovecot_login authenticator failed for ([91.74.98.113]) [91.74.98.113]:55188: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)91.74.98.113290557[w  -A) ossec13001gLExim Auth failed2025-04-14 05:15:40 dovecot_plain authenticator failed for (tsdemo1) [137.135.97.226]:59962: 535 Incorrect authentication data (set_id=info@rokamauka.com)137.135.97.2266252001 U @ T w <MbAUg  -[' ossec13001gLExim Auth failed2025-04-14 10:42:43 dovecot_login authenticator failed for ([58.57.154.146]) [58.57.154.146]:22132: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)58.57.154.1461814991P  --' ossec13001gExim Auth failed2025-04-14 10:02:56 dovecot_login authenticator failed for ([127.0.0.1]) [125.142.39.13]:45015: 535 Incorrect authentication data (set_id=sales)125.142.39.131835841c  -S' ossec13001gExim Auth failed2025-04-14 10:02:47 dovecot_login authenticator failed for ([127.0.0.1]) [58.238.74.138]:42134: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)58.238.74.1381835841W  -9) ossec13001gExim Auth failed2025-04-14 09:58:10 dovecot_login authenticator failed for ([211.228.113.27]) [211.228.113.27]:37015: 535 Incorrect authentication data (set_id=sales)211.228.113.271835841j  -_) ossec13001gExim Auth failed2025-04-14 09:57:59 dovecot_login authenticator failed for ([175.205.191.27]) [175.205.191.27]:46406: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)175.205.191.271835841j  -_) ossec13001gExim Auth failed2025-04-14 09:53:37 dovecot_login authenticator failed for ([27.123.123.185]) [128.185.194.62]:36432: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)128.185.194.621269750%  3Q' ossec11301gNew FTP connection.Apr 14 09:32:59 vm1 pure-ftpd[4107694]: (?@64.62.156.116) [INFO] New connection from 64.62.156.11664.62.156.1166252001f  -Y' ossec13001gfExim Auth failed2025-04-14 09:05:02 dovecot_login authenticator failed for v157-7-200-152.cwit.static.cnode.io [157.7.200.152]:43856: 535 Incorrect authentication data (set_id=sales)157.7.200.1521861060j  -_) ossec13001gZExim Auth failed2025-04-14 09:04:50 dovecot_login authenticator failed for ([182.180.93.208]) [182.180.93.208]:49823: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)182.180.93.2081168579Z  -?) ossec13001g#Exim Auth failed2025-04-14 08:55:22 dovecot_login authenticator failed for ([101.251.197.46]) [101.251.197.46]:55969: 535 Incorrect authentication data (set_id=purchase)101.251.197.461814991j  -a' ossec13001gExim Auth failed2025-04-14 08:55:06 dovecot_login authenticator failed for ([222.100.159.2]) [222.100.159.2]:44022: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)222.100.159.21835841"  3M% ossec11301g|2New FTP connection.Apr 14 08:38:33 vm1 pure-ftpd[4094922]: (?@139.162.77.6) [INFO] New connection from 139.162.77.6139.162.77.61861060N  --# ossec13001gvExim Auth failed2025-04-14 08:16:00 dovecot_login authenticator failed for ([81.13.62.77]) [81.13.62.77]:58448: 535 Incorrect authentication data (set_id=sales)81.13.62.772017370n  -i' ossec13001gvExim Auth failed2025-04-14 08:15:47 dovecot_login authenticator failed for vps-3a914fae.vps.ovh.net [54.36.100.198]:48498: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)54.36.100.1983017382X  -;) ossec13001gkkExim Auth failed2025-04-14 07:26:58 dovecot_login authenticator failed for ([103.143.168.212]) [103.88.239.225]:35308: 535 Incorrect authentication data (set_id=sales)103.88.239.2251269750g  -[' ossec13001gkYExim Auth failed2025-04-14 07:26:40 dovecot_login authenticator failed for ([223.184.0.249]) [223.184.0.249]:50689: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)223.184.0.2491269750[  -A) ossec13001geExim Auth failed2025-04-14 07:00:04 dovecot_plain authenticator failed for (tsdemo1) [137.135.97.226]:64946: 535 Incorrect authentication data (set_id=info@rokamauka.com)137.135.97.2266252001[  -A) ossec13001gd+Exim Auth failed2025-04-14 06:56:02 dovecot_plain authenticator failed for (tsdemo1) [137.135.97.226]:63411: 535 Incorrect authentication data (set_id=info@rokamauka.com)137.135.97.2266252001 0!xk^QD7*uh[NA4'  ~qdWJ=0# zm`SF9, 0 v i \ O B 5 (     r e X K > 1 $  J=~4'yl}pcVI</   qdW P C 6 )  { n a T G : - uh w j ][NA_R L ? 2   E8+ s f Y %  |o"U.;Hb 1814991K 1814991L 1814991L 1814991M 1814991M 1814991M 1814991M 1814991M 1814991M 1814991L 1814991M 1814991M 1814991M 1814991M 1814991NX 1814991NV 1814991NU 1814991M 1814991M 1814991M' 1814991M# 1814991N 1814991N 1814991N 1814991Nc 1814991Nb 1814991N\ 1814991MN 1814991ML 1814991MH 1814991M1 1814991M) 1814991M( 1814991O 1814991O 1814991O 1814991OV 1814991OS 1814991OQ 1814991O 1814991O 1814991N 1814991N 1814991N 1814991MX 1814991MP 1814991Ik 1814991Id 1814991Ia 1814991IR 1814991ID 1814991IC 1814991I7 1814991I5 1814991I4 1814991I3 1814991I0 1814991I 1814991O 1814991M 1814991M 1814991M 1814991M 1814991M} 1814991Ms 1814991Mp 1814991Mi 1814991M_ 1814991J 1814991J 1814991J 1814991J 1814991Jy 1814991Jv 1814991Jo 1814991Jl 1814991Jf 1814991Jd 1814991Jb 1814991J\ 1814991JO 1814991JF 1814991JE 1814991JA 1814991J> 1814991J= 1814991J8 1814991J6 1814991J4 1814991J2 1814991J. 1814991J, 1814991J 1819730% 1814991J 1814991J 1814991J 1814991J 1814991I 1814991I 1814991I 1814991I 1814991I 1814991I 1814991I 1814991I 1814991I 1814991I 1814991I 1814991I 1814991I 1814991I 1814991I 1814991I 1814991I 1814991I 1814991Iz 1814991Iw 1819730 1819730{ 1819730 1814991O 1819730 1814991O 1814991O 1814991O 1814991O 1814991O 1814991O 1814991OZ 1814991OY 1814991O 1814991O 1814991O 1814991O 1814991Ok 1814991O\ 1814991O[ 1814991N 1814991N 1814991N 1814991O> 1814991O8 1814991O4 1814991O" 1814991O 1814991Nl 1814991Nj 1814991Nf 1814991Ne 1814991N 1814991N 1814991N 1814991N 1814991N 1814991N 1814991N 1814991N 1814991N 1814991M 1814991M 1814991N 1814991N 1814991N 1814991N 1814991N 1814991N 1814991Nv 1814991Nu 1814991M 1814991M 1814991M 1814991M 1814991M 1814991M 1814991M 1814991NN 1814991NL 1814991NK 1814991NJ 1814991N9 1814991N4 1814991N, 1814991N 1814991N 1814991N 1814991N 1814991J 1814991J 1814991L 1814991L 1814991L 1814991L 1814991L 1814991L 1814991L 1814991L 1814991Lt 1814991Lr 1814991LR 1814991LO 1814991LH 1814991L@ 1814991L6 1814991L5 1814991L# 1814991L 1814991L 1814991L 1814991L 1814991L 1814991K 1814991K 1814991K 1814991K 1814991K 1814991K 1814991K 1814991K 1814991K 1814991K 1814991K 1814991K 1814991K 1814991K 1814991K 1814991K 1814991K 1814991K 1814991K 1814991K 1814991K 1814991K 1814991K 1814991K 1814991K 1814991K 1814991K 1814991K 1814991K 1814991K 1814991K~ 1814991Kz 1814991Kr 1814991Ko 1814991Kj 1814991Kd 1814991KU 1814991KQ 1814991KN 1814991KB 1814991K; 1814991K0 1814991K/ 1814991K. 1814991K* 1814991K# 1814991K 1814991K 1814991K 1814991K 1814991K 1814991K 1814991K 1814991J 1814991J 1814991J 1814991J 1814991J 1814991J 1814991J 1814991J B5(reXK>1$ ~qdWJ=0# zm`SF9, v i \ O B 5 (     r e X K > 1 $  { n a T G : -   w j ] P C 6 )    s f Y L ? 2 %  |obUH;.!xk^QD7*tgZM@3&{naTG:-  }pcVIwj]PC6) 6252001H[ 6252001HW 6252001HN 6252001HE 6252001H7 6252001H4 6252001H3 6252001H0 6252001H. 6252001H- 6252001H& 6252001H 6252001H 6252001H 6252001H 6252001H 6252001H 6252001H 6252001E 6252001E 6252001E 6252001E 6252001E 6252001E 6252001E 6252001E 6252001E 6252001Ej 6252001E] 6252001EI 6252001EH 6252001EG 6252001EE 6252001EB 6252001E< 6252001E- 6252001E 6252001E 6252001E 6252001E 6252001E 6252001E 6252001E 6252001Hh 6252001H_ 6252001H 6252001H 6252001G 6252001G 6252001G 6252001G 6252001G 6252001G 6252001G 6252001G 6252001G 6252001G 6252001G 6252001G 6252001G 6252001G 6252001G 6252001G 6252001G 6252001G 6252001G 6252001G 6252001G 6252001G 6252001G 6252001G 6252001G 6252001G 6252001G 6252001G 6252001G 6252001G 6252001G 6252001G 6252001G 6252001G 6252001G 6252001G 6252001G 6252001G 6252001G 6252001G 6252001G 6252001G 6252001G 6252001G 6252001G 6252001G 6252001G 6252001G 6252001G 6252001G 6252001G 6252001G 6252001G 6252001G 6252001G 6252001G 6252001G 6252001G 6252001G 6252001G 6252001G 6252001G 6252001G 6252001G 6252001G 6252001G 6252001G 6252001G 6252001G 6252001G 6252001G 6252001G 6252001G 6252001G 6252001G 6252001G 6252001G 6252001G 6252001G 6252001G 6252001G~ 6252001G} 6252001G| 6252001G{ 6252001Gz 6252001Gy 6252001Gx 6252001Gw 6252001Gv 6252001Gu 6252001Gt 6252001Gs 6252001Gr 6252001Gq 6252001Gp 6252001Go 6252001Gn 6252001Gm 6252001Gl 6252001Gk 6252001Gj 6252001Gi 6252001Gh 6252001Gg 6252001Gf 6252001Ge 6252001GQ 6252001GP 6252001GO 6252001GN 6252001GM 6252001GL 6252001GK 6252001GJ 6252001GI 6252001GH 6252001GG 6252001GF 6252001GE 6252001GD 6252001GC 6252001GB 6252001GA 6252001G@ 6252001G6 6252001G. 6252001G& 6252001G! 6252001G 6252001G 6252001G 6252001G 6252001G 6252001F 6252001F 6252001F 6252001F 6252001F 6252001F 6252001F 6252001F 6252001F 6252001F 6252001F 6252001F 6252001F 6252001F 6252001F 6252001F 6252001F 6252001F 6252001F 6252001F 6252001F 6252001F{ 6252001F^ 6252001F] 6252001FY 6252001FP 6252001FO 6252001FD 6252001FA 6252001F> 6252001F9 6252001F5 6252001F0 6252001F, 6252001F& 6252001F 6252001F 6252001F 6252001F 6252001F 6252001E 6252001E 6252001E 6252001E 6252001E 6252001E 6252001E 6252001E 6252001E 6252001E 6252001E 6252001E 6252001E 6252001E 6252001E 6252001E 6252001E 6252001E 6252001E 0 D > L 0 $l\P@2*)  S+ ossec11000gLogin failed on the cpanel service.[2025-04-14 12:09:23 +0530] info [cpaneld] 156.228.103.232 - heipowersystemcom "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipowersystemcom (has_cpuser_file failed)156.228.103.2326252001(  Sk) ossec11000gLogin failed on the cpanel service.[2025-04-14 12:09:19 +0530] info [cpaneld] 156.228.109.61 - sales "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sales (has_cpuser_file failed)156.228.109.616252001 '  Sw) ossec11000gLogin failed on the cpanel service.[2025-04-14 12:09:31 +0530] info [cpaneld] 156.228.78.236 - heipowe7 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipowe7 (has_cpuser_file failed)156.228.78.2366252001 &  Sy+ ossec11000gLogin failed on the cpanel service.[2025-04-14 12:09:32 +0530] info [cpaneld] 156.228.109.246 - heipowe9 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipowe9 (has_cpuser_file failed)156.228.109.2466252001%  Ss) ossec11000gLogin failed on the cpanel service.[2025-04-14 12:09:33 +0530] info [cpaneld] 156.228.81.145 - heipowe "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipowe (has_cpuser_file failed)156.228.81.1456252001 $  Sy+ ossec11000gLogin failed on the cpanel service.[2025-04-14 12:09:24 +0530] info [cpaneld] 156.228.113.165 - heipower "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipower (has_cpuser_file failed)156.228.113.1656252001%#  3Q' ossec11301gNew FTP connection.Apr 14 12:09:35 vm1 pure-ftpd[4139326]: (?@91.238.181.92) [INFO] New connection from 91.238.181.9291.238.181.923017382 "  Sw) ossec11000gLogin failed on the cpanel service.[2025-04-14 12:09:31 +0530] info [cpaneld] 156.228.81.150 - heipowe8 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipowe8 (has_cpuser_file failed)156.228.81.1506252001!  Su' ossec11000gLogin failed on the cpanel service.[2025-04-14 12:09:27 +0530] info [cpaneld] 156.228.76.93 - heipowe3 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipowe3 (has_cpuser_file failed)156.228.76.936252001  S+ ossec11000gLogin failed on the cpanel service.[2025-04-14 12:09:22 +0530] info [cpaneld] 156.228.104.124 - heipowersystem "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipowersystem (has_cpuser_file failed)156.228.104.1246252001m  S=+ ossec11000gLogin failed on the cpanel service.[2025-04-14 12:09:36 +0530] info [whostmgrd] 156.228.125.163 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect156.228.125.1636252001  Si' ossec11000gLogin failed on the cpanel service.[2025-04-14 12:09:36 +0530] info [cpaneld] 156.228.88.89 - sales "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sales (has_cpuser_file failed)156.228.88.896252001g  -[' ossec13001gExim Auth failed2025-04-14 11:31:57 dovecot_login authenticator failed for ([221.157.85.22]) [221.157.85.22]:39386: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)221.157.85.221835841S  -5' ossec13001gExim Auth failed2025-04-14 11:32:25 dovecot_login authenticator failed for ([46.153.85.132]) [46.153.85.132]:34320: 535 Incorrect authentication data (set_id=sales)46.153.85.132102358s  -q) ossec13001gjExim Auth failed2025-04-14 10:43:13 dovecot_login authenticator failed for (75-144-210-178-Miami.hfc.comcastbusiness.net) [75.144.210.178]:54142: 535 Incorrect authentication data (set_id=sales)75.144.210.1786252001    !25AM0Tv9  -y' ossec13001gExim Auth failed2025-04-14 13:10:08 dovecot_login authenticator failed for 89-253-90-113.customers.ownit.se [89.253.90.113]:41580: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)89.253.90.1132661886"8  3M% ossec11301gtNew FTP connection.Apr 14 12:34:18 vm1 pure-ftpd[4144313]: (?@103.74.54.23) [INFO] New connection from 103.74.54.23103.74.54.231269750W7  -9) ossec13001g_Exim Auth failed2025-04-14 12:21:11 dovecot_login authenticator failed for ([61.164.202.219]) [61.164.202.218]:46975: 535 Incorrect authentication data (set_id=sales)61.164.202.2181814991g6  -[' ossec13001gMExim Auth failed2025-04-14 12:20:53 dovecot_login authenticator failed for ([58.18.103.142]) [58.18.103.142]:53393: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)58.18.103.1421814991,5  ;U) ossec13008g9Mail Recipient rejected2025-04-14 12:20:33 H=(hostglobal.plus) [78.153.140.207]:33428 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no F=<4OpCwJUO@hsnews.in> rejected RCPT : SMTP AUTH is required for message submission on port 58778.153.140.2072635167o4  SC) ossec11000gLogin failed on the cpanel service.[2025-04-14 12:09:53 +0530] info [whostmgrd] 156.228.99.154 - heipowe8 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect156.228.99.1546252001o3  SC) ossec11000gLogin failed on the cpanel service.[2025-04-14 12:09:47 +0530] info [whostmgrd] 156.228.76.186 - heipowe6 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect156.228.76.1866252001x2  SU) ossec11000gLogin failed on the cpanel service.[2025-04-14 12:09:41 +0530] info [whostmgrd] 156.228.86.133 - heipowersystemcom "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect156.228.86.1336252001j1  S;' ossec11000gLogin failed on the cpanel service.[2025-04-14 12:09:59 +0530] info [whostmgrd] 156.228.78.13 - sales "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect156.228.78.136252001l0  S=) ossec11000gLogin failed on the cpanel service.[2025-04-14 12:09:58 +0530] info [whostmgrd] 156.228.103.77 - sales "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect156.228.103.776252001o/  SC) ossec11000gLogin failed on the cpanel service.[2025-04-14 12:09:45 +0530] info [whostmgrd] 156.228.92.201 - heipowe4 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect156.228.92.2016252001q.  SE+ ossec11000gLogin failed on the cpanel service.[2025-04-14 12:09:46 +0530] info [whostmgrd] 156.228.124.156 - heipowe5 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect156.228.124.1566252001q-  SE+ ossec11000gLogin failed on the cpanel service.[2025-04-14 12:09:44 +0530] info [whostmgrd] 156.228.101.115 - heipowe2 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect156.228.101.1156252001m,  SA' ossec11000gLogin failed on the cpanel service.[2025-04-14 12:09:42 +0530] info [whostmgrd] 156.228.97.12 - heipower "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect156.228.97.126252001 +  Sy+ ossec11000gLogin failed on the cpanel service.[2025-04-14 12:09:30 +0530] info [cpaneld] 156.228.105.194 - heipowe6 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipowe6 (has_cpuser_file failed)156.228.105.1946252001*  Su' ossec11000gLogin failed on the cpanel service.[2025-04-14 12:09:28 +0530] info [cpaneld] 156.228.87.73 - heipowe4 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipowe4 (has_cpuser_file failed)156.228.87.736252001 f; U  % #;Nat+<fQK  -1% ossec13001gExim Auth failed2025-04-14 14:26:31 dovecot_login authenticator failed for ([102.53.15.56]) [102.53.15.56]:53730: 535 Incorrect authentication data (set_id=sales)102.53.15.562542007jJ  -_) ossec13001gͳExim Auth failed2025-04-14 14:26:18 dovecot_login authenticator failed for ([220.77.245.227]) [220.77.245.227]:59606: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)220.77.245.2271835841&I 3Q' ossec11301g̮ New FTP connection.Apr 14 14:21:58 vm1 pure-ftpd[4165906]: (?@167.94.138.35) [INFO] New connection from 167.94.138.35167.94.138.356252001?H  gQ' ossec11307g̽Multiple connection attempts from same sourceApr 14 14:22:10 vm1 pure-ftpd[4165942]: (?@167.94.138.35) [INFO] New connection from 167.94.138.35167.94.138.356252001hG  -_% ossec13001gExim Auth failed2025-04-14 14:15:18 dovecot_plain authenticator failed for (C57290F) [77.68.32.155]:60256: 535 Incorrect authentication data (set_id=info@shivelectricaltransformers.com)77.68.32.1552635167hF  -_% ossec13001gExim Auth failed2025-04-14 14:13:43 dovecot_plain authenticator failed for (C57290F) [77.68.32.155]:62339: 535 Incorrect authentication data (set_id=info@shivelectricaltransformers.com)77.68.32.1552635167hE  -_% ossec13001gXExim Auth failed2025-04-14 14:12:00 dovecot_plain authenticator failed for (C57290F) [77.68.32.155]:55940: 535 Incorrect authentication data (set_id=info@shivelectricaltransformers.com)77.68.32.1552635167hD  -_% ossec13001gExim Auth failed2025-04-14 14:10:22 dovecot_plain authenticator failed for (C57290F) [77.68.32.155]:60994: 535 Incorrect authentication data (set_id=info@shivelectricaltransformers.com)77.68.32.1552635167hC  -_% ossec13001gɔExim Auth failed2025-04-14 14:08:42 dovecot_plain authenticator failed for (C57290F) [77.68.32.155]:54260: 535 Incorrect authentication data (set_id=info@shivelectricaltransformers.com)77.68.32.1552635167cB  -S' ossec13001gExim Auth failed2025-04-14 13:59:51 dovecot_login authenticator failed for (170.250.128.5.hwccustomers.com) [170.250.128.5]:40948: 535 Incorrect authentication data (set_id=sales)170.250.128.56252001}A  -' ossec13001goExim Auth failed2025-04-14 13:59:35 dovecot_login authenticator failed for broadband-95-84-186-218.ip.moscow.rt.ru [95.84.186.218]:57530: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)95.84.186.2182017370W@  -;' ossec13001gőExim Auth failed2025-04-14 13:51:36 dovecot_login authenticator failed for ([110.34.111.22]) [110.34.111.22]:60181: 535 Incorrect authentication data (set_id=purchase)110.34.111.221835841d?  -Y# ossec13001g}Exim Auth failed2025-04-14 13:51:15 dovecot_login authenticator failed for ([59.46.26.98]) [59.46.26.98]:10566: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)59.46.26.9818149917> aE) ossec5710gAttempt to login using a non-existent userApr 14 13:27:23 vm1 sshd[4154808]: Invalid user gandharvasena from 14.198.201.110 port 4919814.198.201.1101819730*=  CK) ossec5716gSSHD authentication failed.Apr 14 13:27:17 vm1 sshd[4154797]: Failed password for root from 14.198.201.110 port 48350 ssh214.198.201.1101819730a< E5) ossec2501gUser authentication failure.Apr 14 13:27:15 vm1 sshd[4154797]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.198.201.110 user=root14.198.201.1101819730W;  -9) ossec13001gExim Auth failed2025-04-14 13:10:48 dovecot_login authenticator failed for ([220.77.182.169]) [220.77.182.169]:33886: 535 Incorrect authentication data (set_id=sales)220.77.182.1691835841d:  -W% ossec13001gExim Auth failed2025-04-14 13:10:28 dovecot_login authenticator failed for ([38.44.72.184]) [38.44.72.184]:59521: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)38.44.72.1843374766 qp   , MTk8PqZ]  -C% ossec13001gExim Auth failed2025-04-14 15:51:29 dovecot_plain authenticator failed for (TTLIN) [45.119.85.36]:57714: 535 Incorrect authentication data (set_id=info@heipowersystem.com)45.119.85.361562822c\  -S' ossec13001gޙExim Auth failed2025-04-14 15:38:24 dovecot_login authenticator failed for 95.57.104.252.dynamic.telecom.kz [95.57.104.252]:50415: 535 Incorrect authentication data (set_id=sales)95.57.104.2521522867)[  EK% ossec5715gމSSHD authentication success.Apr 14 15:38:07 vm1 sshd[4181374]: Accepted password for root from 103.190.54.7 port 59491 ssh2103.190.54.71269750mZ  -g' ossec13001gއExim Auth failed2025-04-14 15:38:06 dovecot_login authenticator failed for (made-again.tmesis.com) [24.187.213.29]:49638: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)24.187.213.296252001[Y  -C' ossec13001gExim Auth failed2025-04-14 15:09:12 dovecot_login authenticator failed for ([127.0.0.1]) [95.142.90.214]:49820: 535 Incorrect authentication data (set_id=vikas.khandelwal)95.142.90.2141220409nX  -i' ossec13001g׵Exim Auth failed2025-04-14 15:09:01 dovecot_login authenticator failed for ([127.0.0.1]) [149.54.15.162]:52580: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)149.54.15.1621149361RW  -/) ossec13001g6Exim Auth failed2025-04-14 14:49:50 dovecot_login authenticator failed for ([127.0.0.1]) [195.222.59.157]:55026: 535 Incorrect authentication data (set_id=sales)195.222.59.1573277605dV  -U) ossec13001g.Exim Auth failed2025-04-14 14:49:42 dovecot_login authenticator failed for ([127.0.0.1]) [62.182.118.138]:53311: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)62.182.118.138732800dU  -U' ossec13001gExim Auth failed2025-04-14 14:49:14 dovecot_login authenticator failed for host-85-237-57-200.dsl.sura.ru [85.237.57.200]:58886: 535 Incorrect authentication data (set_id=purchase)85.237.57.2002017370tT  -u' ossec13001gExim Auth failed2025-04-14 14:49:04 dovecot_login authenticator failed for (hebei.18.121.in-addr.arpa) [121.18.148.10]:38528: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)121.18.148.101814991ZS  -C' ossec13001gExim Auth failed2025-04-14 14:48:58 dovecot_login authenticator failed for broad2124.cyberia.net.lb [212.28.225.92]:44140: 535 Incorrect authentication data (set_id=sales)212.28.225.92272103aR  -S# ossec13001gExim Auth failed2025-04-14 14:48:46 dovecot_login authenticator failed for ([41.74.133.1]) [41.74.133.1]:42023: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)41.74.133.13374766pQ  -o% ossec13001gExim Auth failed2025-04-14 14:35:48 dovecot_login authenticator failed for (s2seducationtrust.com) [119.96.131.8]:43994: 535 Incorrect authentication data (set_id=support@s2seducationtrust.com)119.96.131.81814991ZP  -C% ossec13001gExim Auth failed2025-04-14 14:35:22 dovecot_login authenticator failed for (s2seducationtrust.com) [119.96.131.8]:40728: 535 Incorrect authentication data (set_id=nologin)119.96.131.81814991TO E' ossec2501gϵUser authentication failure.Apr 14 14:34:52 vm1 sshd[4168384]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=117.67.226.76117.67.226.761814991,N a1' ossec5710gϵAttempt to login using a non-existent userApr 14 14:34:52 vm1 sshd[4168384]: Invalid user guwen from 117.67.226.76 port 6606117.67.226.761814991(M CG' ossec5716gϫSSHD authentication failed.Apr 14 14:34:41 vm1 sshd[4168332]: Failed password for root from 117.67.226.76 port 6158 ssh2117.67.226.761814991^L  E3' ossec2501gϩUser authentication failure.Apr 14 14:34:39 vm1 sshd[4168332]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=117.67.226.76 user=root117.67.226.761814991 Y!B c L jui{<-8YZo  -?) ossec13001gExim Auth failed2025-04-14 17:50:47 dovecot_login authenticator failed for ([175.206.113.91]) [175.206.113.91]:48904: 535 Incorrect authentication data (set_id=purchase)175.206.113.911835841pn  -i+ ossec13001gExim Auth failed2025-04-14 17:50:36 dovecot_login authenticator failed for ([121.142.146.167]) [121.142.146.167]:55205: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)121.142.146.16718358413m  ; ossec9703gGDovecot is Starting Up.Apr 14 17:45:02 vm1 dovecot[13582]: master: Dovecot v2.3.21.1 (d492236fa0) starting up for lmtp, imap, pop3 (core dumps disabled)(l  3S+ ossec11301g/New FTP connection.Apr 14 17:23:17 vm1 pure-ftpd[8388]: (?@135.237.127.112) [INFO] New connection from 135.237.127.112135.237.127.1126252001%k  3O) ossec11301gSNew FTP connection.Apr 14 17:19:38 vm1 pure-ftpd[7563]: (?@213.232.87.230) [INFO] New connection from 213.232.87.230213.232.87.2302750405"j  3K' ossec11301gSNew FTP connection.Apr 14 17:19:37 vm1 pure-ftpd[7559]: (?@109.202.99.46) [INFO] New connection from 109.202.99.46109.202.99.462750405%i  3O) ossec11301gSNew FTP connection.Apr 14 17:19:37 vm1 pure-ftpd[7561]: (?@213.232.87.234) [INFO] New connection from 213.232.87.234213.232.87.2342750405ih  -]) ossec13001gExim Auth failed2025-04-14 17:16:59 dovecot_login authenticator failed for 144.46.246.220.static.netvigator.com [220.246.46.144]:65346: 535 Incorrect authentication data (set_id=sales)220.246.46.1441819730ig  -]) ossec13001gExim Auth failed2025-04-14 17:16:46 dovecot_login authenticator failed for ([91.203.124.210]) [91.203.124.210]:8998: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)91.203.124.2102017370f  -+ ossec13001g#Exim Auth failed2025-04-14 16:44:41 dovecot_login authenticator failed for (159.14.132.112.adsl-pool.ah.cnuninet.net) [112.123.199.111]:41720: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)112.123.199.1111814991pe  -i+ ossec13001gExim Auth failed2025-04-14 16:44:08 dovecot_login authenticator failed for ([154.144.255.208]) [154.144.255.208]:46836: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)154.144.255.2082542007]d  -C+ ossec13001g-Exim Auth failed2025-04-14 16:44:53 dovecot_login authenticator failed for ([178.216.165.187]) [178.216.165.187]:35142: 535 Incorrect authentication data (set_id=purchase)178.216.165.1872017370Gc  ; + ossec13008gwMail Recipient rejected2025-04-14 16:41:51 H=(mail.nyaystambh.com) [165.154.228.109]:57736 F= rejected RCPT : Rejected relay attempt: '165.154.228.109' From: 'vvxmeianjb@nyaystambh.com' To: 'validxxx@gmailhotmail.com.br'165.154.228.1091643084gb  -[' ossec13001gExim Auth failed2025-04-14 16:27:11 dovecot_login authenticator failed for ([36.37.181.181]) [36.37.181.181]:37488: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)36.37.181.1811831722Za  -C% ossec13001g Exim Auth failed2025-04-14 15:57:43 dovecot_plain authenticator failed for (TTLIN) [45.119.85.36]:58448: 535 Incorrect authentication data (set_id=info@heipowersystem.com)45.119.85.361562822Z`  -C% ossec13001gExim Auth failed2025-04-14 15:56:06 dovecot_plain authenticator failed for (TTLIN) [45.119.85.36]:53403: 535 Incorrect authentication data (set_id=info@heipowersystem.com)45.119.85.361562822Z_  -C% ossec13001gdExim Auth failed2025-04-14 15:54:35 dovecot_plain authenticator failed for (TTLIN) [45.119.85.36]:64440: 535 Incorrect authentication data (set_id=info@heipowersystem.com)45.119.85.361562822Z^  -C% ossec13001gExim Auth failed2025-04-14 15:53:02 dovecot_plain authenticator failed for (TTLIN) [45.119.85.36]:57406: 535 Incorrect authentication data (set_id=info@heipowersystem.com)45.119.85.361562822 jXI r H8T"j3 a=) ossec5710gAttempt to login using a non-existent userApr 14 19:15:36 vm1 sshd[32375]: Invalid user zhangliming from 123.149.200.10 port 56218123.149.200.101814991S  E) ossec2501gUser authentication failure.Apr 14 19:15:36 vm1 sshd[32375]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=123.149.200.10123.149.200.101814991(  CG) ossec5716gtSSHD authentication failed.Apr 14 19:15:22 vm1 sshd[32286]: Failed password for root from 123.149.200.10 port 55286 ssh2123.149.200.101814991(~  CG) ossec5716gbSSHD authentication failed.Apr 14 19:15:05 vm1 sshd[32134]: Failed password for root from 123.149.200.10 port 54310 ssh2123.149.200.101814991_} E1) ossec2501g`User authentication failure.Apr 14 19:15:03 vm1 sshd[32134]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=123.149.200.10 user=root123.149.200.101814991 |  -#) ossec13001g Exim Auth failed2025-04-14 18:55:57 dovecot_login authenticator failed for ip4-193-93-156-147.blue-net.com.pl (ip4-193-93-156-149.blue-net.com.pl) [193.93.156.147]:53254: 535 Incorrect authentication data (set_id=sales)193.93.156.147798544R{  -5' ossec13001g Exim Auth failed2025-04-14 18:55:45 dovecot_login authenticator failed for ([65.20.171.116]) [65.20.171.116]:43619: 535 Incorrect authentication data (set_id=sales)65.20.171.11699237jz  -_) ossec13001g Exim Auth failed2025-04-14 18:55:30 dovecot_login authenticator failed for ([188.166.179.34]) [188.166.179.34]:60436: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)188.166.179.341880251Wy  -9) ossec13001g Exim Auth failed2025-04-14 18:55:26 dovecot_login authenticator failed for ([116.113.193.70]) [116.113.193.70]:48317: 535 Incorrect authentication data (set_id=sales)116.113.193.701814991mx  -c+ ossec13001g Exim Auth failed2025-04-14 18:55:10 dovecot_login authenticator failed for ([178.216.165.187]) [178.216.165.187]:36620: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)178.216.165.18720173706w  SS' ossec11000gLogin failed on the cpanel service.[2025-04-14 18:37:56 +0530] info [cpaneld] 196.251.93.17 - heipowersystem "GET /login/?login_only=1&user=heipowersystem&pass=__HIDDEN__ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipowersystem (has_cpuser_file failed)196.251.93.172750405Uv  -7' ossec13001g0Exim Auth failed2025-04-14 18:05:59 dovecot_login authenticator failed for (www.nettlinx.com) [202.53.94.242]:46644: 535 Incorrect authentication data (set_id=sales)202.53.94.2421269750ju  -_) ossec13001g$Exim Auth failed2025-04-14 18:05:47 dovecot_login authenticator failed for ([144.22.247.249]) [144.22.247.249]:42594: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)144.22.247.2493469034)t CG) ossec5716gSSHD authentication failed.Apr 14 17:59:47 vm1 sshd[16537]: Failed password for root from 221.182.43.227 port 32421 ssh2221.182.43.2271814991_s E1) ossec2501gUser authentication failure.Apr 14 17:59:45 vm1 sshd[16537]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=221.182.43.227 user=root221.182.43.2271814991Rr  -/) ossec13001gExim Auth failed2025-04-14 17:51:10 dovecot_login authenticator failed for ([127.0.0.1]) [211.216.193.28]:21357: 535 Incorrect authentication data (set_id=sales)211.216.193.281835841 q  -+ ossec13001gExim Auth failed2025-04-14 17:51:01 dovecot_login authenticator failed for 213-238-254-156.customers.ownit.se ([127.0.0.1]) [213.238.254.156]:60920: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)213.238.254.1562661886#p  3M' ossec11301gNew FTP connection.Apr 14 17:50:54 vm1 pure-ftpd[15066]: (?@20.221.67.142) [INFO] New connection from 20.221.67.14220.221.67.1426252001 Xe  Y s+BZ  -A' ossec13001gCExim Auth failed2025-04-14 22:50:51 dovecot_login authenticator failed for (thepsindustries.com) [58.240.171.59]:36568: 535 Incorrect authentication data (set_id=nologin)58.240.171.591814991#  3M' ossec11301gAbNew FTP connection.Apr 14 22:39:53 vm1 pure-ftpd[72534]: (?@198.235.24.19) [INFO] New connection from 198.235.24.19198.235.24.196252001d  -S) ossec13001g@Exim Auth failed2025-04-14 22:37:22 dovecot_login authenticator failed for (ip-20-192.datautama.net.id) [112.109.20.192]:39444: 535 Incorrect authentication data (set_id=purchase)112.109.20.1921643084  3A! ossec11301g@New FTP connection.Apr 14 22:37:16 vm1 pure-ftpd[72121]: (?@65.49.1.79) [INFO] New connection from 65.49.1.7965.49.1.796252001  - ) ossec13001g@Exim Auth failed2025-04-14 22:37:11 dovecot_login authenticator failed for 123-193-152-64.dynamic.kbronet.com.tw [123.193.152.64]:35800: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)123.193.152.641668284g  -Y) ossec13001g@Exim Auth failed2025-04-14 22:37:07 dovecot_login authenticator failed for (94.124.156.175.unknown.m1.com.sg) [175.156.124.94]:54910: 535 Incorrect authentication data (set_id=sales)175.156.124.941880251l  -c+ ossec13001g@Exim Auth failed2025-04-14 22:36:51 dovecot_login authenticator failed for ([196.188.120.225]) [196.188.120.225]:36138: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)196.188.120.225337996q  -o' ossec13001g5Exim Auth failed2025-04-14 21:47:27 dovecot_login authenticator failed for 111-70-32-179.emome-ip.hinet.net ([127.0.0.1]) [111.70.32.179]:53653: 535 Incorrect authentication data (set_id=sales)111.70.32.1791668284a  -S' ossec13001g5Exim Auth failed2025-04-14 21:47:06 dovecot_login authenticator failed for ([127.0.0.1]) [65.20.167.117]:54108: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)65.20.167.11799237f  -[% ossec13001g0Exim Auth failed2025-04-14 21:28:21 dovecot_login authenticator failed for 48.211.41.34.bc.googleusercontent.com [34.41.211.48]:36650: 535 Incorrect authentication data (set_id=sales)34.41.211.486252001a  -S# ossec13001g0Exim Auth failed2025-04-14 21:28:09 dovecot_login authenticator failed for ([36.7.155.16]) [36.7.155.16]:43646: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)36.7.155.161814991#  3M' ossec11301g/New FTP connection.Apr 14 21:24:19 vm1 pure-ftpd[57814]: (?@167.172.37.60) [INFO] New connection from 167.172.37.60167.172.37.602750405f  -U+ ossec13001g Exim Auth failed2025-04-14 20:19:53 dovecot_login authenticator failed for (m121-202-206-119.smartone.com) [121.202.206.119]:41792: 535 Incorrect authentication data (set_id=sales)121.202.206.1191819730j  -_) ossec13001g Exim Auth failed2025-04-14 20:19:35 dovecot_login authenticator failed for ([113.108.88.121]) [113.108.88.121]:54824: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)113.108.88.1211814991&  3Q) ossec11301gNew FTP connection.Apr 14 20:12:21 vm1 pure-ftpd[43368]: (?@183.160.194.33) [INFO] New connection from 183.160.194.33183.160.194.331814991Z  -=+ ossec13001g~Exim Auth failed2025-04-14 19:45:24 dovecot_login authenticator failed for ([220.180.171.157]) [220.180.171.157]:33504: 535 Incorrect authentication data (set_id=sales)220.180.171.1571814991n  -o! ossec13001gpExim Auth failed2025-04-14 19:45:11 dovecot_login authenticator failed for 42-3-12-078.ptr.netvigator.com [42.3.12.78]:34056: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)42.3.12.781819730#  3M' ossec11301g]New FTP connection.Apr 14 19:40:37 vm1 pure-ftpd[37031]: (?@40.119.43.133) [INFO] New connection from 40.119.43.13340.119.43.1336252001  $ - Fs,T*$J'&  3S) ossec11301gewNew FTP connection.Apr 15 01:13:49 vm1 pure-ftpd[107143]: (?@167.94.145.110) [INFO] New connection from 167.94.145.110167.94.145.1106252001U%  -5) ossec13001gd[Exim Auth failed2025-04-15 01:09:07 dovecot_login authenticator failed for ([127.0.0.1]) [187.12.112.186]:42354: 535 Incorrect authentication data (set_id=services)187.12.112.1863469034$  -% ossec13001gdCExim Auth failed2025-04-15 01:08:42 dovecot_login authenticator failed for ip98-161-232-9.ph.ph.cox.net ([127.0.0.1]) [98.161.232.9]:39058: 535 Incorrect authentication data (set_id=services@heipowersystem.com)98.161.232.96252001T#  -5' ossec13001g`Exim Auth failed2025-04-15 00:54:31 dovecot_login authenticator failed for ([175.202.82.16]) [175.202.82.16]:39810: 535 Incorrect authentication data (set_id=sales)175.202.82.161835841e"  -[' ossec13001g`Exim Auth failed2025-04-15 00:53:57 dovecot_login authenticator failed for ([65.20.169.121]) [65.20.169.121]:49467: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)65.20.169.12199237'!  3S) ossec11301g]INew FTP connection.Apr 15 00:38:55 vm1 pure-ftpd[100403]: (?@15.235.224.227) [INFO] New connection from 15.235.224.22715.235.224.22718802516  Ae' ossec11302gZFTP Authentication failed.Apr 15 00:28:43 vm1 pure-ftpd[98537]: (?@91.196.152.93) [WARNING] Authentication failed for user [anonymous]91.196.152.933017382   3I% ossec11301gZNew FTP connection.Apr 15 00:28:38 vm1 pure-ftpd[98534]: (?@91.196.152.6) [INFO] New connection from 91.196.152.691.196.152.63017382#  3M' ossec11301gZNew FTP connection.Apr 15 00:28:38 vm1 pure-ftpd[98537]: (?@91.196.152.93) [INFO] New connection from 91.196.152.9391.196.152.933017382  ?1 ossec1008gUProcess exiting (killed).Apr 15 00:06:56 vm1 spamd[3991234]: spamd: server killed by SIGTERM, shutting downC  77 ossec502gUYOssec server started.ossec: Ossec started.N  --# ossec13001gPExim Auth failed2025-04-14 23:46:17 dovecot_login authenticator failed for ([1.31.87.230]) [1.31.87.230]:57815: 535 Incorrect authentication data (set_id=sales)1.31.87.2301814991b  -W% ossec13001gPExim Auth failed2025-04-14 23:46:04 dovecot_login authenticator failed for ([65.20.131.63]) [65.20.131.63]:44752: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)65.20.131.6399237r -m) ossec13001gMExim Auth failed2025-04-14 23:32:38 dovecot_plain authenticator failed for (4balt6rme6sum1ts3j8t) [46.191.181.176]:12215: 535 Incorrect authentication data (set_id=services@heipowersystem.com)46.191.181.1762017370W  -9) ossec13001gLExim Auth failed2025-04-14 23:25:27 dovecot_login authenticator failed for ([119.207.78.191]) [119.207.78.191]:47856: 535 Incorrect authentication data (set_id=sales)119.207.78.1911835841x  -{) ossec13001gLExim Auth failed2025-04-14 23:25:17 dovecot_login authenticator failed for (222-42-136-186.fibertel.com.ar) [186.136.42.222]:36054: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)186.136.42.2223865483n -k# ossec13001gK<Exim Auth failed2025-04-14 23:21:56 dovecot_plain authenticator failed for (r1a92fvcm6fm697jyzteol) [77.40.80.72]:40824: 535 Incorrect authentication data (set_id=services@heipowersystem.com)77.40.80.722017370  ;5% ossec13008gDMail Recipient rejected2025-04-14 22:53:20 H=static-185-95-84-71.sunucuhub.com [185.95.84.71]:57222 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no F= rejected RCPT : Sender verify failed185.95.84.71298795m  -g' ossec13001gD Exim Auth failed2025-04-14 22:51:16 dovecot_login authenticator failed for (thepsindustries.com) [58.240.171.59]:52566: 535 Incorrect authentication data (set_id=office@thepsindustries.com)58.240.171.591814991 LY % 6 H L8  3G# ossec11301gmNew FTP connection.Apr 15 03:21:40 vm1 pure-ftpd[133185]: (?@71.6.232.26) [INFO] New connection from 71.6.232.2671.6.232.266252001j7  -a' ossec13001gPExim Auth failed2025-04-15 03:16:56 dovecot_login authenticator failed for ([183.182.99.92]) [183.182.99.92]:48088: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)183.182.99.921655842W6  -;' ossec13001gaExim Auth failed2025-04-15 03:17:11 dovecot_login authenticator failed for ([218.201.62.71]) [218.201.62.71]:37295: 535 Incorrect authentication data (set_id=purchase)218.201.62.711814991T5  -5' ossec13001gExim Auth failed2025-04-15 03:09:50 dovecot_login authenticator failed for ([222.92.61.242]) [222.92.61.242]:57076: 535 Incorrect authentication data (set_id=sales)222.92.61.2421814991g4  -[' ossec13001gExim Auth failed2025-04-15 03:09:35 dovecot_login authenticator failed for ([106.227.87.29]) [106.227.87.29]:51692: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)106.227.87.2918149913  W% ossec9708g~Dovecot Aborted Login with empty userApr 15 02:58:57 vm1 dovecot[90419]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 2 secs): user=<>, rip=71.6.146.130, lip=103.74.54.108, TLS, session=71.6.146.1306252001U2  ;%+ ossec13008gyLMail Recipient rejected2025-04-15 02:38:26 H=(mail.heipowersystem.com) [165.154.228.106]:55913 F= rejected RCPT : Rejected relay attempt: '165.154.228.106' From: 'akkvzwotozw@heipowersystem.com' To: 'validxxx@gmailhotmail.com.br'165.154.228.1061643084^1  -I' ossec13001gtExim Auth failed2025-04-15 02:18:30 dovecot_login authenticator failed for (106.51.79.73.actcorp.in) [122.171.19.76]:9624: 535 Incorrect authentication data (set_id=purchase)122.171.19.761269750T0  -7% ossec13001gtExim Auth failed2025-04-15 02:18:17 dovecot_login authenticator failed for ([61.97.17.208]) [61.97.17.208]:39772: 535 Incorrect authentication data (set_id=purchase)61.97.17.2081835841j/  -a' ossec13001gtExim Auth failed2025-04-15 02:17:59 dovecot_login authenticator failed for ([103.65.227.71]) [103.65.227.71]:37294: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)103.65.227.711210997!.  3K% ossec11301grNew FTP connection.Apr 15 02:09:27 vm1 pure-ftpd[118404]: (?@20.64.105.41) [INFO] New connection from 20.64.105.4120.64.105.416252001i-  -]) ossec13001gpExim Auth failed2025-04-15 02:01:54 dovecot_login authenticator failed for 109.46.246.220.static.netvigator.com [220.246.46.109]:56657: 535 Incorrect authentication data (set_id=sales)220.246.46.1091819730j,  -_) ossec13001gpExim Auth failed2025-04-15 02:01:42 dovecot_login authenticator failed for ([178.178.222.55]) [178.178.222.55]:44024: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)178.178.222.552017370'+  3S) ossec11301glNew FTP connection.Apr 15 01:45:24 vm1 pure-ftpd[113534]: (?@51.159.234.118) [INFO] New connection from 51.159.234.11851.159.234.1183017382j*  -a' ossec13001gk]Exim Auth failed2025-04-15 01:39:00 dovecot_login authenticator failed for ([218.22.253.37]) [218.22.253.37]:57887: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)218.22.253.371814991Z)  -?) ossec13001gkkExim Auth failed2025-04-15 01:39:14 dovecot_login authenticator failed for ([222.128.80.201]) [222.128.80.201]:12788: 535 Incorrect authentication data (set_id=purchase)222.128.80.20118149915(  Ae% ossec11302gj`FTP Authentication failed.Apr 15 01:34:46 vm1 pure-ftpd[111278]: (?@34.22.213.78) [WARNING] Authentication failed for user [anonymous]34.22.213.782802361"' 3K% ossec11301gjZNew FTP connection.Apr 15 01:34:42 vm1 pure-ftpd[111276]: (?@34.22.213.78) [INFO] New connection from 34.22.213.7834.22.213.782802361 4 T 2 =dsuR4J  ;5% ossec13008gMail Recipient rejected2025-04-15 07:14:16 H=static-185-95-84-71.sunucuhub.com [185.95.84.71]:43718 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no F= rejected RCPT : Sender verify failed185.95.84.71298795AI  gS) ossec11307gMultiple connection attempts from same sourceApr 15 06:55:29 vm1 pure-ftpd[175439]: (?@199.45.154.131) [INFO] New connection from 199.45.154.131199.45.154.1316252001(H 3S) ossec11301g New FTP connection.Apr 15 06:55:21 vm1 pure-ftpd[175422]: (?@199.45.154.131) [INFO] New connection from 199.45.154.131199.45.154.1316252001dG  -U' ossec13001gExim Auth failed2025-04-15 06:52:36 dovecot_login authenticator failed for ip117.net-81-16-170.koping.net [81.16.170.117]:37752: 535 Incorrect authentication data (set_id=purchase)81.16.170.1172661886pF  -i+ ossec13001gExim Auth failed2025-04-15 06:52:19 dovecot_login authenticator failed for ([207.188.157.230]) [207.188.157.230]:15859: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)207.188.157.2302510769mE  -c+ ossec13001gYExim Auth failed2025-04-15 06:46:09 dovecot_login authenticator failed for (heipowersystem.com) [202.107.197.211]:52338: 535 Incorrect authentication data (set_id=test@heipowersystem.com)202.107.197.2111814991[D  -A) ossec13001g?Exim Auth failed2025-04-15 06:45:43 dovecot_login authenticator failed for (heipowersystem.com) [124.160.63.122]:32559: 535 Incorrect authentication data (set_id=nologin)124.160.63.1221814991yC  -% ossec13001gExim Auth failed2025-04-15 06:34:57 dovecot_login authenticator failed for c83-255-9-170.bredband.tele2.se ([127.0.0.1]) [83.255.9.170]:48646: 535 Incorrect authentication data (set_id=vikas.khandelwal)83.255.9.1702661886lB  -g% ossec13001gExim Auth failed2025-04-15 06:34:49 dovecot_login authenticator failed for ([127.0.0.1]) [20.41.231.45]:37016: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)20.41.231.451269750TA  -5' ossec13001g~Exim Auth failed2025-04-15 06:33:58 dovecot_login authenticator failed for ([58.57.154.146]) [58.57.154.146]:25570: 535 Incorrect authentication data (set_id=sales)58.57.154.1461814991p@  -q# ossec13001gnExim Auth failed2025-04-15 06:33:42 dovecot_login authenticator failed for 111-70-16-7.emome-ip.hinet.net [111.70.16.7]:53398: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)111.70.16.71668284*?  3W+ ossec11301gtNew FTP connection.Apr 15 06:25:13 vm1 pure-ftpd[169671]: (?@159.223.154.172) [INFO] New connection from 159.223.154.172159.223.154.1726252001Z>  -=+ ossec13001gExim Auth failed2025-04-15 05:25:43 dovecot_login authenticator failed for ([207.219.221.101]) [207.219.221.101]:50631: 535 Incorrect authentication data (set_id=sales)207.219.221.1016251999b=  -W% ossec13001gpExim Auth failed2025-04-15 05:25:28 dovecot_login authenticator failed for ([65.20.130.95]) [65.20.130.95]:44283: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)65.20.130.9599237(< 3S) ossec11301g"New FTP connection.Apr 15 05:19:53 vm1 pure-ftpd[156487]: (?@156.229.16.165) [INFO] New connection from 156.229.16.165156.229.16.16562520019;  Ai) ossec11302g>FTP Authentication failed.Apr 15 05:20:20 vm1 pure-ftpd[156676]: (?@156.229.16.165) [WARNING] Authentication failed for user [anonymous]156.229.16.1656252001w:  -}' ossec13001gExim Auth failed2025-04-15 04:18:30 dovecot_login authenticator failed for bzq-109-67-154-24.red.bezeqint.net [109.67.154.24]:55728: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)109.67.154.24294640m9  -c+ ossec13001gExim Auth failed2025-04-15 04:18:17 dovecot_login authenticator failed for ([123.139.133.238]) [123.139.133.238]:58190: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)123.139.133.2381814991  J  , ~@_^'\  3S) ossec11301gZNew FTP connection.Apr 15 09:15:28 vm1 pure-ftpd[203706]: (?@104.152.52.161) [INFO] New connection from 104.152.52.161104.152.52.1616252001i[  -]) ossec13001gуExim Auth failed2025-04-15 08:54:49 dovecot_login authenticator failed for 83-233-242-245.cust.bredband2.com [83.233.242.245]:55062: 535 Incorrect authentication data (set_id=purchase)83.233.242.2452661886gZ  -]% ossec13001g[Exim Auth failed2025-04-15 08:54:09 dovecot_login authenticator failed for ([221.10.10.20]) [221.10.10.20]:38501: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)221.10.10.201814991ZY  -E% ossec13001gЭExim Auth failed2025-04-15 08:51:16 dovecot_login authenticator failed for 95-87-213-16.ip.btc-net.bg [95.87.213.16]:36147: 535 Incorrect authentication data (set_id=sales)95.87.213.16732800|X  -) ossec13001gВExim Auth failed2025-04-15 08:50:50 dovecot_login authenticator failed for 144.46.246.220.static.netvigator.com [220.246.46.144]:63796: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)220.246.46.14418197300W  ;]) ossec13008g|Mail Recipient rejected2025-04-15 08:46:12 H=(hostglobal.plus) [78.153.140.207]:35910 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no F=<3qmhosf5@spexscart.com> rejected RCPT : SMTP AUTH is required for message submission on port 58778.153.140.2072635167'V  3S) ossec11301grNew FTP connection.Apr 15 08:41:46 vm1 pure-ftpd[196526]: (?@194.165.16.166) [INFO] New connection from 194.165.16.166194.165.16.1662993457TU  E) ossec2501g̈́User authentication failure.Apr 15 08:37:47 vm1 sshd[195778]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=115.198.134.98115.198.134.981814991/T a5) ossec5710g̈́Attempt to login using a non-existent userApr 15 08:37:47 vm1 sshd[195778]: Invalid user hadoop from 115.198.134.98 port 40060115.198.134.981814991,S a/) ossec5710gSAttempt to login using a non-existent userApr 15 08:36:58 vm1 sshd[195560]: Invalid user tai from 115.198.134.98 port 39480115.198.134.981814991)R  CI) ossec5716gESSHD authentication failed.Apr 15 08:36:44 vm1 sshd[195497]: Failed password for root from 115.198.134.98 port 58176 ssh2115.198.134.981814991`Q E3) ossec2501gCUser authentication failure.Apr 15 08:36:42 vm1 sshd[195497]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=115.198.134.98 user=root115.198.134.981814991&P  3S) ossec11301gNew FTP connection.Apr 15 08:34:58 vm1 pure-ftpd[195136]: (?@93.123.109.222) [INFO] New connection from 93.123.109.22293.123.109.222732800^O E1' ossec2501gUser authentication failure.Apr 15 08:09:38 vm1 sshd[190017]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=39.144.128.96 user=root39.144.128.961814991&N  CE' ossec5716gSSHD authentication failed.Apr 15 08:09:40 vm1 sshd[190017]: Failed password for root from 39.144.128.96 port 2615 ssh239.144.128.9618149914M aA' ossec5710gAttempt to login using a non-existent userApr 15 08:09:48 vm1 sshd[190178]: Invalid user ravindrapratap from 39.144.128.96 port 261639.144.128.961814991WL  -9) ossec13001gExim Auth failed2025-04-15 07:42:48 dovecot_login authenticator failed for ([218.234.104.42]) [218.234.104.42]:49329: 535 Incorrect authentication data (set_id=sales)218.234.104.421835841K  -C) ossec13001gExim Auth failed2025-04-15 07:42:28 dovecot_login authenticator failed for 209-150-47-211.s4049.c3-0.wsd-cbr2.qens-wsd.ny.cable.rcncustomer.com [209.150.47.211]:50179: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)209.150.47.2116252001 &  / +  i<Nl  ;+ ossec13008gMail Recipient rejected2025-04-15 12:07:33 H=(mail.thepsindustries.com) [165.154.210.189]:60358 F= rejected RCPT : Rejected relay attempt: '165.154.210.189' From: 'gvguga@thepsindustries.com' To: 'validxxx@gmailhotmail.com.br'165.154.210.1891694008Vk -;# ossec13001gIExim Auth failed2025-04-15 11:48:49 dovecot_login authenticator failed for (heipowersystem.com) [14.18.77.99]:51630: 535 Incorrect authentication data (set_id=nologin)14.18.77.991814991Zj  -?) ossec13001gExim Auth failed2025-04-15 11:25:49 dovecot_login authenticator failed for ([211.252.168.97]) [211.252.168.97]:38771: 535 Incorrect authentication data (set_id=services)211.252.168.971835841hi  -a' ossec13001gExim Auth failed2025-04-15 11:25:36 dovecot_login authenticator failed for ([62.201.212.52]) [62.201.212.52]:58460: 535 Incorrect authentication data (set_id=services@heipowersystem.com)62.201.212.5299237jh  -_) ossec13001gExim Auth failed2025-04-15 11:07:53 dovecot_login authenticator failed for ([220.77.182.169]) [220.77.182.169]:46354: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)220.77.182.1691835841pg  -m' ossec13001gvExim Auth failed2025-04-15 11:02:38 dovecot_login authenticator failed for (s2seducationtrust.com) [221.229.216.1]:54950: 535 Incorrect authentication data (set_id=admin@s2seducationtrust.com)221.229.216.11814991\f  -E' ossec13001gXExim Auth failed2025-04-15 11:02:07 dovecot_login authenticator failed for (s2seducationtrust.com) [221.229.216.1]:50434: 535 Incorrect authentication data (set_id=nologin)221.229.216.11814991We  -;' ossec13001gJExim Auth failed2025-04-15 10:57:37 dovecot_login authenticator failed for ([220.95.14.102]) [220.95.14.102]:35832: 535 Incorrect authentication data (set_id=purchase)220.95.14.1021835841`d  -U! ossec13001g:Exim Auth failed2025-04-15 10:57:22 dovecot_login authenticator failed for ([5.32.99.14]) [5.32.99.14]:40234: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)5.32.99.14290557!c  3K% ossec11301gKNew FTP connection.Apr 15 10:40:34 vm1 pure-ftpd[220331]: (?@20.150.204.7) [INFO] New connection from 20.150.204.720.150.204.76252001b  -9) ossec13001gExim Auth failed2025-04-15 10:16:47 dovecot_login authenticator failed for 179.186.241.15.dynamic.adsl.gvt.net.br (179.186.241.33.dynamic.adsl.gvt.net.br) [179.186.241.15]:33091: 535 Incorrect authentication data (set_id=services)179.186.241.153469034a  - % ossec13001gExim Auth failed2025-04-15 10:16:35 dovecot_login authenticator failed for (45.201.33.36.adsl-pool.ah.cnuninet.net) [36.33.201.45]:42142: 535 Incorrect authentication data (set_id=services@heipowersystem.com)36.33.201.451814991c`  -S' ossec13001gExim Auth failed2025-04-15 09:58:58 dovecot_login authenticator failed for 111-70-23-223.emome-ip.hinet.net [111.70.23.223]:35034: 535 Incorrect authentication data (set_id=sales)111.70.23.2231668284 _  -) ossec13001g|Exim Auth failed2025-04-15 09:58:43 dovecot_login authenticator failed for (abts-tn-static-194.42.165.122.airtelbroadband.in) [122.165.42.194]:37874: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)122.165.42.1941269750c^  -O+ ossec13001gExim Auth failed2025-04-15 09:48:25 dovecot_login authenticator failed for ([127.0.0.1]) [202.137.254.237]:37616: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)202.137.254.2371269750m]  -m# ossec13001gExim Auth failed2025-04-15 09:48:05 dovecot_login authenticator failed for ([127.0.0.1]) [41.75.122.7]:52747: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)41.75.122.7927384 52 & H-s5+} a/' ossec5710gAttempt to login using a non-existent userApr 15 14:19:40 vm1 sshd[263442]: Invalid user saned from 183.234.3.181 port 3270183.234.3.1811814991&|  CE' ossec5716gSSHD authentication failed.Apr 15 14:19:26 vm1 sshd[263426]: Failed password for root from 183.234.3.181 port 3269 ssh2183.234.3.1811814991^{ E1' ossec2501gUser authentication failure.Apr 15 14:19:25 vm1 sshd[263426]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.234.3.181 user=root183.234.3.1811814991$z  3O' ossec11301gNew FTP connection.Apr 15 14:04:08 vm1 pure-ftpd[260385]: (?@205.210.31.42) [INFO] New connection from 205.210.31.42205.210.31.426252001Wy  -;' ossec13001gExim Auth failed2025-04-15 13:43:13 dovecot_login authenticator failed for ([49.124.151.54]) [49.124.151.54]:51058: 535 Incorrect authentication data (set_id=services)49.124.151.541733045nx  -k% ossec13001gExim Auth failed2025-04-15 13:42:54 dovecot_login authenticator failed for (ppp075.bol-online.com) [202.84.34.85]:45932: 535 Incorrect authentication data (set_id=services@heipowersystem.com)202.84.34.851210997gw  -Y) ossec13001gExim Auth failed2025-04-15 13:25:38 dovecot_login authenticator failed for 198-91-129-195.cpe.distributel.net [198.91.129.195]:36268: 535 Incorrect authentication data (set_id=sales)198.91.129.1956251999ov  -i) ossec13001gExim Auth failed2025-04-15 13:25:26 dovecot_login authenticator failed for (OAS.static.gvt.net.br) [177.99.225.161]:54613: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)177.99.225.1613469034]u  ;7) ossec13008gMail Recipient rejected2025-04-15 12:43:27 H=(mail.westerndancecompany.com) [165.154.210.79]:53577 F= rejected RCPT : Rejected relay attempt: '165.154.210.79' From: 'ceimbvemr@westerndancecompany.com' To: 'validxxx@gmailhotmail.com.br'165.154.210.791694008t  W' ossec9708gBDovecot Aborted Login with empty userApr 15 12:39:52 vm1 dovecot[90419]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=45.156.131.15, lip=103.74.54.108, session=45.156.131.152264397Ys  -?) ossec13001gExim Auth failed2025-04-15 12:36:43 dovecot_login authenticator failed for ([80.227.102.242]) [80.227.102.242]:35946: 535 Incorrect authentication data (set_id=purchase)80.227.102.242290557`r  -U! ossec13001grExim Auth failed2025-04-15 12:36:25 dovecot_login authenticator failed for ([5.32.32.14]) [5.32.32.14]:35755: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)5.32.32.14290557Wq  -;' ossec13001gExim Auth failed2025-04-15 12:34:26 dovecot_login authenticator failed for ([39.88.252.236]) [39.88.252.236]:40952: 535 Incorrect authentication data (set_id=services)39.88.252.2361814991gp  -]% ossec13001gExim Auth failed2025-04-15 12:34:05 dovecot_login authenticator failed for ([101.230.0.49]) [124.74.9.190]:55979: 535 Incorrect authentication data (set_id=services@heipowersystem.com)124.74.9.1901814991Zo  ;/+ ossec13008gMail Recipient rejected2025-04-15 12:30:36 H=(mail.s2seducationtrust.com) [165.154.210.137]:56699 F= rejected RCPT : Rejected relay attempt: '165.154.210.137' From: 'nlrhsxydd@s2seducationtrust.com' To: 'validxxx@gmailhotmail.com.br'165.154.210.1371694008Zn  -A' ossec13001gExim Auth failed2025-04-15 12:16:22 dovecot_login authenticator failed for vps-f47b3934.vps.ovh.ca [51.79.161.230]:35844: 535 Incorrect authentication data (set_id=sales)51.79.161.2301880251jm  -_) ossec13001gExim Auth failed2025-04-15 12:16:11 dovecot_login authenticator failed for ([183.245.31.174]) [183.245.31.174]:60325: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)183.245.31.1741814991 *\~tj`VLB8.$zpf\H>4*   v l b X N D : 0 &    ~ t j ` V L B 8 . $    z p f \ R H > 4 *  vlbXND:0&|rh^TJ@6,"xndZPF<2( t~j`VLB8.$zpf\ | r h ^ T J @ 6 , "    x n d Z P F < 2 (   RRH>4*  vlbXND:0& gݝBq gݛBp gݍBo g{Bn gBm gBl gBk gBj gBi gBh gBg gBf gBe g Bd gBc gBb gBa gwB` gaB_ gÙB^ gqB] ghB\ gVB[ gBZ guBY g%BX gBW gBV gBU gBT gBS gBR gBQ ghBP g[BO goBN g{BM giBL gHBK g4BJ gnBI g^BH gBG gBF gBE gBD gBC gBB gBA gB@ gB? gB> gB= gB< gB; gB: g[B9 g>B8 gB7 gB6 gB5 gxB4 guB3 guB2 guVB1 guVB0 guCB/ gu&B. gu B- guJB, guDB+ grUB* gr!B) gqB( gqB' gqqB& gqgB% gpxB$ geB# geB" geB! geB gezB gbMB gbKB gaOB gaCB g^A g"A gA gA gmA gaA gPA gA gA g~A gyLA gtA gtA gtA grA gpA gpA glA gkkA gk]A gj`A gjZA gewA gd[A gdCA g`A g`A g]IA gZA gZA gZA g&B gUA gUYA gPA gPA gMA gLA gLA gK rejected RCPT : Rejected relay attempt: '165.154.228.109' From: 'hykgm@westerndancecompany.com' To: 'validxxx@gmailhotmail.com.br'165.154.228.1091643084p  -i+ ossec13001g1;Exim Auth failed2025-04-15 15:43:15 dovecot_login authenticator failed for (nsg-corporate-210.240.187.122.airtel.in) [122.187.240.210]:46683: 535 Incorrect authentication data (set_id=sales)122.187.240.2101269750s  -s' ossec13001g1#Exim Auth failed2025-04-15 15:42:50 dovecot_login authenticator failed for 110-25-107-51.adsl.fetnet.net [110.25.107.51]:50675: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)110.25.107.511668284i  -]) ossec13001g%$Exim Auth failed2025-04-15 14:51:39 dovecot_login authenticator failed for ool-addc7a34.static.optonline.net [173.220.122.52]:59352: 535 Incorrect authentication data (set_id=services)173.220.122.526252001m  -e) ossec13001g%Exim Auth failed2025-04-15 14:51:23 dovecot_login authenticator failed for ([192.199.57.228]) [192.199.57.228]:42302: 535 Incorrect authentication data (set_id=services@heipowersystem.com)192.199.57.2286251999Q  -1% ossec13001g Exim Auth failed2025-04-15 14:33:42 dovecot_login authenticator failed for ([161.81.25.86]) [161.81.25.86]:40297: 535 Incorrect authentication data (set_id=sales)161.81.25.861819730m  -c+ ossec13001g Exim Auth failed2025-04-15 14:33:31 dovecot_login authenticator failed for ([177.136.246.131]) [177.136.246.131]:53574: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)177.136.246.1313469034g  -]% ossec13001g\Exim Auth failed2025-04-15 14:22:43 dovecot_login authenticator failed for ([211.93.6.230]) [211.93.6.230]:58306: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)211.93.6.2301814991W~  -;' ossec13001ghExim Auth failed2025-04-15 14:22:55 dovecot_login authenticator failed for ([124.67.121.58]) [124.67.121.58]:52201: 535 Incorrect authentication data (set_id=purchase)124.67.121.581814991 ~&7 ^ o + L>xXi~f  -Y' ossec13001geExim Auth failed2025-04-15 19:26:32 dovecot_login authenticator failed for 57-45-246-103.southernonline.net [103.246.45.57]:54898: 535 Incorrect authentication data (set_id=services)103.246.45.571269750j  -a' ossec13001gezExim Auth failed2025-04-15 19:26:09 dovecot_login authenticator failed for ([74.208.177.56]) [74.208.177.56]:53830: 535 Incorrect authentication data (set_id=services@heipowersystem.com)74.208.177.566252001!  3K% ossec11301gbMNew FTP connection.Apr 15 19:12:35 vm1 pure-ftpd[321392]: (?@159.89.18.34) [INFO] New connection from 159.89.18.34159.89.18.342921044$  3O' ossec11301gbKNew FTP connection.Apr 15 19:12:34 vm1 pure-ftpd[321390]: (?@64.225.97.120) [INFO] New connection from 64.225.97.12064.225.97.1202921044S  -5' ossec13001gaOExim Auth failed2025-04-15 19:08:21 dovecot_login authenticator failed for ([94.204.97.125]) [94.204.97.125]:60010: 535 Incorrect authentication data (set_id=sales)94.204.97.125290557t  -w% ossec13001gaCExim Auth failed2025-04-15 19:08:10 dovecot_login authenticator failed for (17.37.245.49.unknown.m1.com.sg) [49.245.37.17]:59728: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)49.245.37.171880251A  gS) ossec11307g^<Multiple connection attempts from same sourceApr 15 18:55:15 vm1 pure-ftpd[318014]: (?@207.154.239.36) [INFO] New connection from 207.154.239.36207.154.239.362921044( 3S) ossec11301g^2 New FTP connection.Apr 15 18:55:04 vm1 pure-ftpd[317985]: (?@207.154.239.36) [INFO] New connection from 207.154.239.36207.154.239.362921044 Su' ossec11000g^Login failed on the cpanel service.[2025-04-15 18:54:39 +0530] info [cpaneld] 31.42.184.150 - heipower "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipower (has_cpuser_file failed)31.42.184.150690791$  3O' ossec11301g[New FTP connection.Apr 15 18:44:06 vm1 pure-ftpd[315860]: (?@161.35.30.233) [INFO] New connection from 161.35.30.233161.35.30.2332921044'  3S) ossec11301g[New FTP connection.Apr 15 18:44:06 vm1 pure-ftpd[315858]: (?@139.59.155.110) [INFO] New connection from 139.59.155.110139.59.155.1102921044Z  -C% ossec13001gYExim Auth failed2025-04-15 18:35:28 dovecot_login authenticator failed for (s2seducationtrust.com) [60.2.243.174]:40768: 535 Incorrect authentication data (set_id=nologin)60.2.243.1741814991`  ;;+ ossec13008gXMail Recipient rejected2025-04-15 18:32:45 H=(mail.westerndancecompany.com) [165.154.210.137]:62219 F= rejected RCPT : Rejected relay attempt: '165.154.210.137' From: 'lkpuvtrcv@westerndancecompany.com' To: 'validxxx@gmailhotmail.com.br'165.154.210.1371694008Z  -?) ossec13001gU`Exim Auth failed2025-04-15 18:17:28 dovecot_login authenticator failed for ([103.194.249.82]) [103.194.249.82]:36224: 535 Incorrect authentication data (set_id=services)103.194.249.821269750j  -a' ossec13001gUVExim Auth failed2025-04-15 18:17:17 dovecot_login authenticator failed for ([46.73.156.221]) [46.73.156.221]:52314: 535 Incorrect authentication data (set_id=services@heipowersystem.com)46.73.156.2212017370T  -5' ossec13001gQAExim Auth failed2025-04-15 17:59:52 dovecot_login authenticator failed for ([124.228.32.34]) [124.228.32.34]:51416: 535 Incorrect authentication data (set_id=sales)124.228.32.341814991j  -_) ossec13001gQ5Exim Auth failed2025-04-15 17:59:39 dovecot_login authenticator failed for ([210.178.251.33]) [210.178.251.33]:35671: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)210.178.251.331835841U -5' ossec13001gGBExim Auth failed2025-04-15 17:17:14 dovecot_login authenticator failed for (rokamauka.com) [221.229.216.1]:52922: 535 Incorrect authentication data (set_id=nologin)221.229.216.11814991 S, G 8 L YKo@3ASi3  -_' ossec13001guExim Auth failed2025-04-15 20:35:21 dovecot_login authenticator failed for c-73-199-208-99.hsd1.nj.comcast.net [73.199.208.99]:51654: 535 Incorrect authentication data (set_id=services)73.199.208.996252001m2  -e) ossec13001guExim Auth failed2025-04-15 20:35:11 dovecot_login authenticator failed for ([178.178.222.55]) [178.178.222.55]:46836: 535 Incorrect authentication data (set_id=services@heipowersystem.com)178.178.222.552017370@1  Iq' ossec11331guV Stealth FTP brute force attackApr 15 20:33:47 vm1 pure-ftpd[337048]: (?@103.233.10.48) [WARNING] Authentication failed for user [heipowersystem]103.233.10.481819730$0  3O' ossec11301guVNew FTP connection.Apr 15 20:33:48 vm1 pure-ftpd[337118]: (?@103.233.10.48) [INFO] New connection from 103.233.10.48103.233.10.481819730/  S' ossec211321guCPreventing FTP brute force attempt.[Active Response] is disabled for rule 11321. Greylisting 103.233.10.48103.233.10.481819730=. Aq' ossec11302gu&FTP Authentication failed.Apr 15 20:33:00 vm1 pure-ftpd[336942]: (?@103.233.10.48) [WARNING] Authentication failed for user [heipowersystem]103.233.10.481819730%- 3O' ossec11301gu New FTP connection.Apr 15 20:32:54 vm1 pure-ftpd[336942]: (?@103.233.10.48) [INFO] New connection from 103.233.10.48103.233.10.481819730>,  gO' ossec11307guJMultiple connection attempts from same sourceApr 15 20:33:36 vm1 pure-ftpd[337036]: (?@103.233.10.48) [INFO] New connection from 103.233.10.48103.233.10.481819730W+  ]' ossec11321guDActive Response. FTP brute force attack (Port 21 is protected)Apr 15 20:33:29 vm1 pure-ftpd[337010]: (?@103.233.10.48) [WARNING] Authentication failed for user [name]103.233.10.481819730**  3W+ ossec11301grUNew FTP connection.Apr 15 20:21:00 vm1 pure-ftpd[334692]: (?@172.236.137.159) [INFO] New connection from 172.236.137.159172.236.137.1591880251+) 3W+ ossec11301gr!New FTP connection.Apr 15 20:20:09 vm1 pure-ftpd[334508]: (?@172.236.137.159) [INFO] New connection from 172.236.137.159172.236.137.1591880251*(  3W+ ossec11301gqNew FTP connection.Apr 15 20:18:31 vm1 pure-ftpd[334146]: (?@172.236.137.159) [INFO] New connection from 172.236.137.159172.236.137.1591880251n'  -k% ossec13001gqExim Auth failed2025-04-15 20:17:29 dovecot_login authenticator failed for (178x78x28x55.dynamic.krasnodar.ertelecom.ru) [178.78.28.55]:60406: 535 Incorrect authentication data (set_id=sales)178.78.28.552017370g&  -[' ossec13001gqqExim Auth failed2025-04-15 20:17:12 dovecot_login authenticator failed for ([45.115.173.11]) [45.115.173.11]:50545: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)45.115.173.111269750*%  3W+ ossec11301gqgNew FTP connection.Apr 15 20:17:02 vm1 pure-ftpd[333894]: (?@172.236.137.159) [INFO] New connection from 172.236.137.159172.236.137.1591880251[$  ;3) ossec13008gpxMail Recipient rejected2025-04-15 20:13:03 H=(mail.westerndancecompany.com) [165.154.242.42]:58977 F= rejected RCPT : Rejected relay attempt: '165.154.242.42' From: 'bdxvepum@westerndancecompany.com' To: 'validxxx@gmailhotmail.com.br'165.154.242.421694008`# -I) ossec13001geExim Auth failed2025-04-15 19:28:09 dovecot_login authenticator failed for (amplifypowerglobal.com) [42.193.105.109]:38678: 535 Incorrect authentication data (set_id=nologin)42.193.105.1091814991N"  --# ossec13001geExim Auth failed2025-04-15 19:27:56 dovecot_login authenticator failed for ([103.55.89.5]) [103.55.89.5]:45604: 535 Incorrect authentication data (set_id=sales)103.55.89.51269750|!  -) ossec13001geExim Auth failed2025-04-15 19:27:09 dovecot_login authenticator failed for c-73-106-172-226.hsd1.ga.comcast.net [73.106.172.226]:53464: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)73.106.172.2266252001  ZR p N h n fVYu 'D  3S) ossec11301gNew FTP connection.Apr 15 22:42:57 vm1 pure-ftpd[362575]: (?@198.235.24.146) [INFO] New connection from 198.235.24.146198.235.24.1466252001PC  -1% ossec13001gExim Auth failed2025-04-15 22:34:11 dovecot_login authenticator failed for ([94.204.196.7]) [94.204.196.7]:53818: 535 Incorrect authentication data (set_id=sales)94.204.196.7290557dB  -W% ossec13001gExim Auth failed2025-04-15 22:33:59 dovecot_login authenticator failed for ([211.187.7.14]) [211.187.7.14]:35940: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)211.187.7.141835841_A  -K' ossec13001gExim Auth failed2025-04-15 22:26:00 dovecot_login authenticator failed for ([218.108.70.38]) [218.108.70.38]:51720: 535 Incorrect authentication data (set_id=vikas.khandelwal)218.108.70.381814991x@  -y+ ossec13001gExim Auth failed2025-04-15 22:25:38 dovecot_login authenticator failed for ([117.239.154.148]) [117.239.154.149]:34864: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)117.239.154.1491269750$?  3O' ossec11301gNew FTP connection.Apr 15 22:10:47 vm1 pure-ftpd[356555]: (?@64.62.156.165) [INFO] New connection from 64.62.156.16564.62.156.1656252001Z>  -?) ossec13001gExim Auth failed2025-04-15 21:43:45 dovecot_login authenticator failed for ([216.194.174.27]) [216.194.174.27]:63587: 535 Incorrect authentication data (set_id=services)216.194.174.276252001{=  -) ossec13001gExim Auth failed2025-04-15 21:43:33 dovecot_login authenticator failed for 175-98-123-245.static.tfn.net.tw [175.98.123.245]:50455: 535 Incorrect authentication data (set_id=services@heipowersystem.com)175.98.123.2451668284*<  3W+ ossec11301gNew FTP connection.Apr 15 21:34:17 vm1 pure-ftpd[349242]: (?@194.187.176.116) [INFO] New connection from 194.187.176.116194.187.176.1162921044T;  -5' ossec13001gExim Auth failed2025-04-15 21:26:00 dovecot_login authenticator failed for ([223.166.75.68]) [223.166.75.68]:21402: 535 Incorrect authentication data (set_id=sales)223.166.75.681814991:  -% ossec13001gExim Auth failed2025-04-15 21:25:45 dovecot_login authenticator failed for (5x16x138x238.static-business.spb.ertelecom.ru) [5.16.138.238]:39852: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)5.16.138.2382017370u9  -s+ ossec13001g[Exim Auth failed2025-04-15 21:25:05 dovecot_login authenticator failed for (amplifypowerglobal.com) [202.107.197.211]:39944: 535 Incorrect authentication data (set_id=test@amplifypowerglobal.com)202.107.197.2111814991a8  -K+ ossec13001g>Exim Auth failed2025-04-15 21:24:38 dovecot_login authenticator failed for (amplifypowerglobal.com) [202.107.197.211]:36358: 535 Incorrect authentication data (set_id=nologin)202.107.197.21118149917  W) ossec9708gDovecot Aborted Login with empty userApr 15 21:22:15 vm1 dovecot[90419]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=87.236.176.132, lip=103.74.54.108, TLS, session=<+WAWJ9MyjZhX7LCE>87.236.176.1322635167]6  -K' ossec13001gExim Auth failed2025-04-15 21:17:44 dovecot_login authenticator failed for ([65.20.235.177]) [65.20.235.177]:52673: 535 Incorrect authentication data (set_id=vikas.khandelwal)65.20.235.177992375  -) ossec13001gExim Auth failed2025-04-15 21:17:32 dovecot_login authenticator failed for (103.182.106.62.ns1.zitatel.com) [103.182.106.62]:49800: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)103.182.106.621269750!4  3K% ossec11301gxNew FTP connection.Apr 15 20:49:08 vm1 pure-ftpd[340097]: (?@35.202.9.133) [INFO] New connection from 35.202.9.13335.202.9.1336252001  5foyU  -' ossec13001gExim Auth failed2025-04-16 00:47:39 dovecot_login authenticator failed for c-98-51-132-203.hsd1.ca.comcast.net [98.51.132.203]:55974: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)98.51.132.2036252001TT  -5' ossec13001gExim Auth failed2025-04-16 00:48:07 dovecot_login authenticator failed for ([221.11.33.116]) [221.11.33.116]:38062: 535 Incorrect authentication data (set_id=sales)221.11.33.1161814991_S  -K' ossec13001gExim Auth failed2025-04-16 00:39:53 dovecot_login authenticator failed for ([60.166.31.198]) [60.166.31.198]:57596: 535 Incorrect authentication data (set_id=vikas.khandelwal)60.166.31.1981814991rR  -q' ossec13001gExim Auth failed2025-04-16 00:39:41 dovecot_login authenticator failed for ([154.81.179.94]) [154.81.179.94]:38184: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)154.81.179.946252001Q  ?- ossec1008gProcess exiting (killed).Apr 16 00:05:32 vm1 spamd[93833]: spamd: server killed by SIGTERM, shutting downgP  -[' ossec13001ghExim Auth failed2025-04-15 23:58:54 dovecot_login authenticator failed for h87-96-158-252.cust.bredband2.com [87.96.158.252]:56162: 535 Incorrect authentication data (set_id=services)87.96.158.2522661886gO  -]% ossec13001g[Exim Auth failed2025-04-15 23:58:43 dovecot_login authenticator failed for ([14.35.218.58]) [14.35.218.58]:56056: 535 Incorrect authentication data (set_id=services@heipowersystem.com)14.35.218.581835841gN  -[' ossec13001goExim Auth failed2025-04-15 23:54:46 dovecot_login authenticator failed for ([121.154.90.47]) [121.154.90.47]:60278: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)121.154.90.471835841TM  -5' ossec13001g{Exim Auth failed2025-04-15 23:54:58 dovecot_login authenticator failed for ([41.216.169.13]) [41.216.169.13]:58728: 535 Incorrect authentication data (set_id=sales)41.216.169.132328926$L  3O' ossec11301giNew FTP connection.Apr 15 23:50:23 vm1 pure-ftpd[375726]: (?@20.169.105.38) [INFO] New connection from 20.169.105.3820.169.105.386252001QK  -1% ossec13001gHExim Auth failed2025-04-15 23:41:19 dovecot_login authenticator failed for ([14.35.218.58]) [14.35.218.58]:50733: 535 Incorrect authentication data (set_id=sales)14.35.218.581835841jJ  -_) ossec13001g4Exim Auth failed2025-04-15 23:41:00 dovecot_login authenticator failed for ([178.178.222.55]) [178.178.222.55]:53428: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)178.178.222.552017370YI  -C# ossec13001gnExim Auth failed2025-04-15 23:33:25 dovecot_login authenticator failed for ([1.241.64.92]) [1.241.64.92]:33951: 535 Incorrect authentication data (set_id=vikas.khandelwal)1.241.64.921835841H  -+ ossec13001g^Exim Auth failed2025-04-15 23:33:08 dovecot_login authenticator failed for (pool-109-191-151-161.is74.ru) [109.191.151.161]:54046: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)109.191.151.16120173708G  ;m) ossec13008gMail Recipient rejected2025-04-15 23:31:17 H=(hostglobal.plus) [78.153.140.207]:49954 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no F= rejected RCPT : SMTP AUTH is required for message submission on port 58778.153.140.2072635167]F  -C+ ossec13001gExim Auth failed2025-04-15 22:51:47 dovecot_login authenticator failed for ([191.241.247.150]) [191.241.247.150]:34396: 535 Incorrect authentication data (set_id=services)191.241.247.1503469034|E  -+ ossec13001gExim Auth failed2025-04-15 22:51:32 dovecot_login authenticator failed for (ws249-241-252-122.rcil.gov.in) [122.252.241.249]:57756: 535 Incorrect authentication data (set_id=services@heipowersystem.com)122.252.241.2491269750 d2  -6[M]T`Kdbe  -O) ossec13001gExim Auth failed2025-04-16 02:52:29 dovecot_login authenticator failed for ([116.114.94.242]) [116.114.94.242]:38060: 535 Incorrect authentication data (set_id=vikas.khandelwal)116.114.94.2421814991d  -+) ossec13001g Exim Auth failed2025-04-16 02:52:17 dovecot_login authenticator failed for (173-167-115-17-sfba.hfc.comcastbusiness.net) [173.167.115.17]:61855: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)173.167.115.176252001oc  -m% ossec13001gExim Auth failed2025-04-16 02:52:02 dovecot_login authenticator failed for ([101.13.4.119]) [101.13.4.119]:46408: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)101.13.4.1191668284Xb  ;++ ossec13008gMail Recipient rejected2025-04-16 02:34:45 H=(mail.westerndancecompany.com) [165.154.228.180]:64152 F= rejected RCPT : Rejected relay attempt: '165.154.228.180' From: 'caanp@westerndancecompany.com' To: 'validxxx@gmailhotmail.com.br'165.154.228.1801643084'a  3S) ossec11301gNew FTP connection.Apr 16 02:26:02 vm1 pure-ftpd[408481]: (?@205.210.31.228) [INFO] New connection from 205.210.31.228205.210.31.2286252001k`  -c' ossec13001gwExim Auth failed2025-04-16 02:11:25 dovecot_login authenticator failed for host-24-207-66-154.public.eastlink.ca [24.207.66.154]:42068: 535 Incorrect authentication data (set_id=services)24.207.66.1546251999 _  -) ossec13001gaExim Auth failed2025-04-16 02:11:03 dovecot_login authenticator failed for 108-239-124-56.lightspeed.hstntx.sbcglobal.net [108.239.124.56]:42930: 535 Incorrect authentication data (set_id=services@heipowersystem.com)108.239.124.566252001V^  -;' ossec13001gÙExim Auth failed2025-04-16 02:07:44 dovecot_login authenticator failed for ([91.72.171.210]) [91.72.171.210]:49426: 535 Incorrect authentication data (set_id=purchase)91.72.171.210290557r]  -s% ossec13001gqExim Auth failed2025-04-16 02:07:04 dovecot_login authenticator failed for (85-19-195-12.telia-isp.no) [85.19.195.12]:52852: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)85.19.195.123144096g\  -Y) ossec13001ghExim Auth failed2025-04-16 01:54:08 dovecot_login authenticator failed for 198-91-188-226.cpe.distributel.net [198.91.188.226]:50372: 535 Incorrect authentication data (set_id=sales)198.91.188.2266251999m[  -c+ ossec13001gVExim Auth failed2025-04-16 01:53:49 dovecot_login authenticator failed for ([122.225.203.106]) [122.225.203.106]:37414: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)122.225.203.1061814991bZ  -O) ossec13001gExim Auth failed2025-04-16 01:46:13 dovecot_login authenticator failed for ([27.123.123.185]) [128.185.194.62]:46398: 535 Incorrect authentication data (set_id=vikas.khandelwal)128.185.194.621269750uY  -u) ossec13001guExim Auth failed2025-04-16 01:45:48 dovecot_login authenticator failed for ([112.168.71.109]) [112.168.71.109]:46730: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)112.168.71.1091835841AX  ;) ossec13008g%Mail Recipient rejected2025-04-16 01:31:40 H=(hostglobal.plus) [78.153.140.207]:54806 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no F=<8wEW0acu@shivelectricaltransformers.com> rejected RCPT : SMTP AUTH is required for message submission on port 58778.153.140.2072635167WW  -;' ossec13001gExim Auth failed2025-04-16 01:05:07 dovecot_login authenticator failed for ([119.29.137.49]) [119.29.137.49]:48808: 535 Incorrect authentication data (set_id=services)119.29.137.491814991mV  -e) ossec13001gExim Auth failed2025-04-16 01:04:53 dovecot_login authenticator failed for ([222.86.168.224]) [222.86.168.224]:55380: 535 Incorrect authentication data (set_id=services@heipowersystem.com)222.86.168.2241814991 9 5 6 x Diw  -]) ossec13001gExim Auth failed2025-04-16 04:24:15 dovecot_login authenticator failed for 221-120-57-125.emome-ip.hinet.net [221.120.57.125]:48456: 535 Incorrect authentication data (set_id=services)221.120.57.1251668284wv  -}% ossec13001gExim Auth failed2025-04-16 04:23:54 dovecot_login authenticator failed for h77-53-61-147.cust.bredband2.com [77.53.61.147]:40928: 535 Incorrect authentication data (set_id=services@heipowersystem.com)77.53.61.1472661886pu  -k) ossec13001gExim Auth failed2025-04-16 04:19:51 dovecot_login authenticator failed for pool-108-18-206-153.washdc.fios.verizon.net [108.18.206.153]:53393: 535 Incorrect authentication data (set_id=sales)108.18.206.1536252001xt  -% ossec13001gExim Auth failed2025-04-16 04:19:41 dovecot_login authenticator failed for syn-071-041-202-012.biz.spectrum.com [71.41.202.12]:38232: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)71.41.202.1262520017s  Ag' ossec11302gMFTP Authentication failed.Apr 16 04:05:55 vm1 pure-ftpd[428627]: (?@34.77.191.221) [WARNING] Authentication failed for user [anonymous]34.77.191.2212802361%r 3O' ossec11301gGNew FTP connection.Apr 16 04:05:50 vm1 pure-ftpd[428627]: (?@34.77.191.221) [INFO] New connection from 34.77.191.22134.77.191.2212802361]q  -C+ ossec13001gݝExim Auth failed2025-04-16 03:58:44 dovecot_login authenticator failed for ([121.160.166.161]) [121.160.166.161]:41114: 535 Incorrect authentication data (set_id=purchase)121.160.166.1611835841bp  -O) ossec13001gݛExim Auth failed2025-04-16 03:58:42 dovecot_login authenticator failed for ([114.251.109.36]) [114.251.109.35]:39018: 535 Incorrect authentication data (set_id=vikas.khandelwal)114.251.109.351814991uo  -u) ossec13001gݍExim Auth failed2025-04-16 03:58:28 dovecot_login authenticator failed for ([118.43.193.199]) [118.43.193.199]:35810: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)118.43.193.1991835841mn  -e) ossec13001g{Exim Auth failed2025-04-16 03:58:10 dovecot_login authenticator failed for ([220.124.240.75]) [220.124.240.66]:63435: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)220.124.240.661835841Pm  -1# ossec13001gExim Auth failed2025-04-16 03:17:34 dovecot_login authenticator failed for ([14.54.22.11]) [14.54.22.11]:4722: 535 Incorrect authentication data (set_id=services)14.54.22.1118358419l  Ai) ossec11302gFTP Authentication failed.Apr 16 03:17:26 vm1 pure-ftpd[419041]: (?@195.184.76.102) [WARNING] Authentication failed for user [anonymous]195.184.76.1026252001zk  -' ossec13001gExim Auth failed2025-04-16 03:17:22 dovecot_login authenticator failed for ool-18bbfd43.static.optonline.net [24.187.253.67]:45744: 535 Incorrect authentication data (set_id=services@heipowersystem.com)24.187.253.676252001$j  3O' ossec11301gNew FTP connection.Apr 16 03:17:19 vm1 pure-ftpd[419039]: (?@195.184.76.98) [INFO] New connection from 195.184.76.98195.184.76.986252001'i  3S) ossec11301gNew FTP connection.Apr 16 03:17:19 vm1 pure-ftpd[419041]: (?@195.184.76.102) [INFO] New connection from 195.184.76.102195.184.76.1026252001*h  3W+ ossec11301gNew FTP connection.Apr 16 03:08:15 vm1 pure-ftpd[417158]: (?@135.119.108.114) [INFO] New connection from 135.119.108.114135.119.108.1146252001Tg  -5' ossec13001gExim Auth failed2025-04-16 03:00:12 dovecot_login authenticator failed for ([95.66.153.194]) [95.66.153.194]:41561: 535 Incorrect authentication data (set_id=sales)95.66.153.1942017370if  -_) ossec13001gExim Auth failed2025-04-16 03:00:01 dovecot_login authenticator failed for ([197.156.115.37]) [197.156.115.37]:37028: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)197.156.115.37338010 +  = Q j {Ft~  -) ossec13001gExim Auth failed2025-04-16 06:37:12 dovecot_login authenticator failed for 81-224-104-199-no600.tbcn.telia.com [81.224.104.199]:58881: 535 Incorrect authentication data (set_id=services@heipowersystem.com)81.224.104.1992661886$  3O' ossec11301gFNew FTP connection.Apr 16 06:30:53 vm1 pure-ftpd[457783]: (?@91.238.181.93) [INFO] New connection from 91.238.181.9391.238.181.933017382n  -g) ossec13001gExim Auth failed2025-04-16 06:19:42 dovecot_login authenticator failed for (175-180-129-87.adsl.dynamic.seed.net.tw) [175.180.129.87]:57372: 535 Incorrect authentication data (set_id=sales)175.180.129.871668284j  -_) ossec13001gExim Auth failed2025-04-16 06:19:30 dovecot_login authenticator failed for ([103.186.221.74]) [103.186.221.74]:58686: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)103.186.221.741269750a  -M) ossec13001gExim Auth failed2025-04-16 06:11:51 dovecot_login authenticator failed for ([216.194.174.74]) [216.194.174.27]:2830: 535 Incorrect authentication data (set_id=vikas.khandelwal)216.194.174.276252001  -) ossec13001gExim Auth failed2025-04-16 06:11:28 dovecot_login authenticator failed for h-213-136-52-219.a1663.priv.bahnhof.se [213.136.52.219]:43984: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)213.136.52.2192661886>  gO' ossec11307g0Multiple connection attempts from same sourceApr 16 06:09:11 vm1 pure-ftpd[453449]: (?@161.35.203.87) [INFO] New connection from 161.35.203.87161.35.203.872921044% 3O' ossec11301g New FTP connection.Apr 16 06:08:54 vm1 pure-ftpd[453396]: (?@161.35.203.87) [INFO] New connection from 161.35.203.87161.35.203.872921044'  3S) ossec11301gNew FTP connection.Apr 16 05:46:55 vm1 pure-ftpd[448619]: (?@51.159.234.118) [INFO] New connection from 51.159.234.11851.159.234.1183017382Z  -?) ossec13001g2Exim Auth failed2025-04-16 05:30:49 dovecot_login authenticator failed for ([125.23.204.106]) [125.23.204.106]:47784: 535 Incorrect authentication data (set_id=services)125.23.204.1061269750j~  -a' ossec13001gExim Auth failed2025-04-16 05:30:23 dovecot_login authenticator failed for ([165.16.34.111]) [165.16.34.111]:48195: 535 Incorrect authentication data (set_id=services@heipowersystem.com)165.16.34.1112215636b}  -U# ossec13001g%Exim Auth failed2025-04-16 05:13:33 dovecot_login authenticator failed for h-46-59-97-98.a1648.priv.bahnhof.se [46.59.97.98]:34806: 535 Incorrect authentication data (set_id=sales)46.59.97.982661886g|  -[' ossec13001g Exim Auth failed2025-04-16 05:13:05 dovecot_login authenticator failed for ([36.134.78.151]) [36.134.78.151]:56346: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)36.134.78.1511814991]{  -K' ossec13001g?Exim Auth failed2025-04-16 05:05:25 dovecot_login authenticator failed for ([65.20.183.209]) [65.20.183.209]:34890: 535 Incorrect authentication data (set_id=vikas.khandelwal)65.20.183.20999237z  -+ ossec13001g)Exim Auth failed2025-04-16 05:05:03 dovecot_login authenticator failed for 220-133-225-137.hinet-ip.hinet.net [220.133.225.137]:50819: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)220.133.225.1371668284dy  -Y# ossec13001gExim Auth failed2025-04-16 04:49:57 dovecot_login authenticator failed for (13-206.adsl.static.espeed.com.bn) [61.6.206.13]:45312: 535 Incorrect authentication data (set_id=purchase)61.6.206.131820814gx  -]% ossec13001gExim Auth failed2025-04-16 04:49:32 dovecot_login authenticator failed for ([61.97.17.208]) [61.97.17.208]:35724: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)61.97.17.2081835841 < M E E E [iYU[  -E% ossec13001gKExim Auth failed2025-04-16 08:00:33 dovecot_login authenticator failed for (amplifypowerglobal.com) [150.5.145.36]:34514: 535 Incorrect authentication data (set_id=nologin)150.5.145.361880251'  3S) ossec11301gNew FTP connection.Apr 16 07:59:12 vm1 pure-ftpd[475069]: (?@18.118.171.253) [INFO] New connection from 18.118.171.25318.118.171.2536252001'  3S) ossec11301gNew FTP connection.Apr 16 07:57:25 vm1 pure-ftpd[474833]: (?@18.118.171.253) [INFO] New connection from 18.118.171.25318.118.171.2536252001'  3S) ossec11301gNew FTP connection.Apr 16 07:55:19 vm1 pure-ftpd[474519]: (?@18.118.171.253) [INFO] New connection from 18.118.171.25318.118.171.2536252001'  3S) ossec11301gzNew FTP connection.Apr 16 07:52:49 vm1 pure-ftpd[473866]: (?@18.118.171.253) [INFO] New connection from 18.118.171.25318.118.171.2536252001'  3S) ossec11301gtNew FTP connection.Apr 16 07:52:43 vm1 pure-ftpd[473861]: (?@18.118.171.253) [INFO] New connection from 18.118.171.25318.118.171.2536252001'  3S) ossec11301gNew FTP connection.Apr 16 07:51:08 vm1 pure-ftpd[473678]: (?@18.118.171.253) [INFO] New connection from 18.118.171.25318.118.171.2536252001e  -W' ossec13001g|Exim Auth failed2025-04-16 07:44:20 dovecot_login authenticator failed for (corporativo.static.gvt.net.br) [177.43.43.211]:56579: 535 Incorrect authentication data (set_id=services)177.43.43.2113469034m  -e) ossec13001ghExim Auth failed2025-04-16 07:43:59 dovecot_login authenticator failed for ([221.235.182.76]) [61.184.128.210]:60178: 535 Incorrect authentication data (set_id=services@heipowersystem.com)61.184.128.2101814991W  -9) ossec13001gkExim Auth failed2025-04-16 07:26:59 dovecot_login authenticator failed for ([122.228.228.86]) [122.228.228.86]:47061: 535 Incorrect authentication data (set_id=sales)122.228.228.861814991m  -c+ ossec13001gQExim Auth failed2025-04-16 07:26:32 dovecot_login authenticator failed for ([197.149.125.227]) [197.149.125.227]:43500: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)197.149.125.2272328926e  -U) ossec13001g Exim Auth failed2025-04-16 07:20:32 dovecot_login authenticator failed for host-196-47-172-253.afnet.net [196.47.172.253]:35002: 535 Incorrect authentication data (set_id=purchase)196.47.172.2532287781{  -% ossec13001g Exim Auth failed2025-04-16 07:20:20 dovecot_login authenticator failed for syn-074-062-020-170.biz.spectrum.com [74.62.20.170]:56996: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)74.62.20.1706252001{  -+ ossec13001g Exim Auth failed2025-04-16 07:18:48 dovecot_login authenticator failed for (nsg-corporate-152.227.187.122.airtel.in) [122.187.227.152]:35245: 535 Incorrect authentication data (set_id=vikas.khandelwal)122.187.227.1521269750  -) ossec13001g hExim Auth failed2025-04-16 07:18:24 dovecot_login authenticator failed for 175-98-123-245.static.tfn.net.tw [175.98.123.245]:59751: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)175.98.123.2451668284j  -a' ossec13001gExim Auth failed2025-04-16 06:58:18 dovecot_login authenticator failed for ([58.222.184.18]) [58.222.184.18]:51278: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)58.222.184.181814991]  -C+ ossec13001gExim Auth failed2025-04-16 06:58:39 dovecot_login authenticator failed for ([221.151.168.237]) [221.151.168.237]:35194: 535 Incorrect authentication data (set_id=purchase)221.151.168.2371835841]  -C+ ossec13001gExim Auth failed2025-04-16 06:37:33 dovecot_login authenticator failed for ([163.179.105.241]) [163.179.105.241]:46042: 535 Incorrect authentication data (set_id=services)163.179.105.2411814991 i _ k m i'+  3S) ossec11301g&New FTP connection.Apr 16 09:11:40 vm1 pure-ftpd[490265]: (?@20.150.202.204) [INFO] New connection from 20.150.202.20420.150.202.2046252001Z*  -?) ossec13001g%aExim Auth failed2025-04-16 09:04:56 dovecot_login authenticator failed for ([119.203.137.21]) [119.203.137.21]:38584: 535 Incorrect authentication data (set_id=purchase)119.203.137.211835841j)  -a' ossec13001g%WExim Auth failed2025-04-16 09:04:45 dovecot_login authenticator failed for ([61.184.119.61]) [61.184.119.61]:40962: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)61.184.119.611814991`(  -U! ossec13001g%5Exim Auth failed2025-04-16 09:04:12 dovecot_login authenticator failed for ([5.32.99.14]) [5.32.99.14]:40960: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)5.32.99.14290557'  ;5% ossec13008g$Mail Recipient rejected2025-04-16 09:01:41 H=static-185-95-84-71.sunucuhub.com [185.95.84.71]:46040 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no F= rejected RCPT : Sender verify failed185.95.84.71298795T&  -7% ossec13001g"PExim Auth failed2025-04-16 08:51:52 dovecot_login authenticator failed for ([121.150.85.2]) [121.150.85.2]:47804: 535 Incorrect authentication data (set_id=services)121.150.85.21835841m%  -e) ossec13001g"FExim Auth failed2025-04-16 08:51:41 dovecot_login authenticator failed for ([223.100.15.126]) [223.100.15.126]:59836: 535 Incorrect authentication data (set_id=services@heipowersystem.com)223.100.15.1261814991p$  -o' ossec13001gExim Auth failed2025-04-16 08:40:52 dovecot_login authenticator failed for 95-87-248-223.ip.btc-net.bg [95.87.248.223]:41746: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)95.87.248.223732800q#  -k+ ossec13001gExim Auth failed2025-04-16 08:41:07 dovecot_login authenticator failed for (159.14.132.112.adsl-pool.ah.cnuninet.net) [112.123.199.111]:48764: 535 Incorrect authentication data (set_id=sales)112.123.199.1111814991u"  -u) ossec13001gkExim Auth failed2025-04-16 08:35:14 dovecot_login authenticator failed for 125-228-154-55.hinet-ip.hinet.net [125.228.154.55]:59499: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)125.228.154.551668284v!  -y' ossec13001g_Exim Auth failed2025-04-16 08:35:02 dovecot_login authenticator failed for ([58.221.244.34]) [58.221.244.34]:44327: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)58.221.244.341814991W  -9) ossec13001gExim Auth failed2025-04-16 08:33:46 dovecot_login authenticator failed for ([218.67.123.202]) [218.67.123.202]:52967: 535 Incorrect authentication data (set_id=sales)218.67.123.2021814991  -)) ossec13001gExim Auth failed2025-04-16 08:33:32 dovecot_login authenticator failed for (abts-north-dynamic-064.118.163.122.airtelbroadband.in) [122.163.118.64]:33192: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)122.163.118.641269750e  -S+ ossec13001g4Exim Auth failed2025-04-16 08:25:47 dovecot_login authenticator failed for ([183.109.195.179]) [183.109.195.179]:46268: 535 Incorrect authentication data (set_id=vikas.khandelwal)183.109.195.1791835841o  -m% ossec13001g&Exim Auth failed2025-04-16 08:25:34 dovecot_login authenticator failed for ([59.46.182.10]) [59.46.182.10]:37671: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)59.46.182.101814991'  3S) ossec11301gkNew FTP connection.Apr 16 08:01:05 vm1 pure-ftpd[475690]: (?@18.118.171.253) [INFO] New connection from 18.118.171.25318.118.171.2536252001p  -o% ossec13001gaExim Auth failed2025-04-16 08:00:57 dovecot_login authenticator failed for (amplifypowerglobal.com) [150.5.145.36]:59274: 535 Incorrect authentication data (set_id=sales@amplifypowerglobal.com)150.5.145.361880251 H - Q G \ pH < G %1modsec77350309g>IM360 WAF: Hidden file accessIM360 WAF: Hidden file access||RSV:6.86||RS:0||T:APACHE||QS:||93.123.109.7732800vm1.technobases.in{;  -) ossec13001g>Exim Auth failed2025-04-16 10:50:22 dovecot_login authenticator failed for 105.217.146.34.bc.googleusercontent.com [34.146.217.105]:49322: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)34.146.217.1051861060 :  -!+ ossec13001g=Exim Auth failed2025-04-16 10:49:54 dovecot_login authenticator failed for (200-217-53-25.host.telemar.net.br) [200.216.168.226]:49244: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)200.216.168.2263469034h9  -a# ossec13001g=Exim Auth failed2025-04-16 10:48:33 dovecot_login authenticator failed for (189-56-0-19.customer.tdatabrasil.net.br) [189.56.0.19]:50440: 535 Incorrect authentication data (set_id=sales)189.56.0.193469034m8  -c+ ossec13001g=Exim Auth failed2025-04-16 10:48:18 dovecot_login authenticator failed for ([118.122.196.230]) [118.122.196.230]:32950: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)118.122.196.2301814991\7  -G% ossec13001g;Exim Auth failed2025-04-16 10:40:14 dovecot_login authenticator failed for ([59.46.182.10]) [59.46.182.10]:44022: 535 Incorrect authentication data (set_id=vikas.khandelwal)59.46.182.101814991x6  -y+ ossec13001g;Exim Auth failed2025-04-16 10:40:01 dovecot_login authenticator failed for ([122.225.203.106]) [122.225.203.106]:50892: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)122.225.203.1061814991\5  -A+ ossec13001g;FExim Auth failed2025-04-16 10:38:21 dovecot_login authenticator failed for ([211.107.21.221]) [121.168.116.150]:61087: 535 Incorrect authentication data (set_id=purchase)121.168.116.1501835841m4  -e) ossec13001g;:Exim Auth failed2025-04-16 10:38:09 dovecot_login authenticator failed for ([220.178.39.106]) [220.178.39.106]:36799: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)220.178.39.1061814991]3  -C+ ossec13001g1Exim Auth failed2025-04-16 09:58:38 dovecot_login authenticator failed for ([178.178.194.136]) [178.178.194.136]:55632: 535 Incorrect authentication data (set_id=services)178.178.194.1362017370g2  -]% ossec13001g1Exim Auth failed2025-04-16 09:58:27 dovecot_login authenticator failed for ([60.174.35.18]) [60.174.35.18]:46725: 535 Incorrect authentication data (set_id=services@heipowersystem.com)60.174.35.181814991f1  -W) ossec13001g.;Exim Auth failed2025-04-16 09:42:42 dovecot_login authenticator failed for ([146.235.193.77]) [146.235.193.77]:53176: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)146.235.193.7762520010  -' ossec13001g.)Exim Auth failed2025-04-16 09:42:24 dovecot_login authenticator failed for (rw-00130-94.59.137.rcil.gov.in) [137.59.94.130]:51424: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)137.59.94.1301269750W/  -9) ossec13001g-Exim Auth failed2025-04-16 09:41:16 dovecot_login authenticator failed for ([221.199.172.66]) [221.199.172.66]:34080: 535 Incorrect authentication data (set_id=sales)221.199.172.661814991j.  -_) ossec13001g-Exim Auth failed2025-04-16 09:40:59 dovecot_login authenticator failed for ([137.131.41.235]) [137.131.41.235]:37142: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)137.131.41.2356252001b-  -O) ossec13001g,Exim Auth failed2025-04-16 09:33:16 dovecot_login authenticator failed for ([103.174.145.35]) [103.174.145.35]:38958: 535 Incorrect authentication data (set_id=vikas.khandelwal)103.174.145.351269750x,  -y+ ossec13001g+Exim Auth failed2025-04-16 09:33:05 dovecot_login authenticator failed for ([118.183.180.108]) [118.183.180.108]:12349: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)118.183.180.1081814991 x;Y 8 b Y jawx"M  ;A) ossec13008gQ@Mail Recipient rejected2025-04-16 12:12:07 H=([199.233.237.24]) [199.233.237.24]:60120 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 CV=no F= rejected RCPT : SMTP AUTH is required for message submission on port 465199.233.237.246252001#L ;A) ossec13008gQ/Mail Recipient rejected2025-04-16 12:11:50 H=([199.233.237.24]) [199.233.237.24]:64053 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 CV=no F= rejected RCPT : SMTP AUTH is required for message submission on port 465199.233.237.246252001bK  -O) ossec13001gMExim Auth failed2025-04-16 11:57:31 dovecot_login authenticator failed for ([49.7.60.14]) [222.128.15.114]:58184: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)222.128.15.1141814991`J  -O% ossec13001gMExim Auth failed2025-04-16 11:57:17 dovecot_login authenticator failed for ([1.212.225.99]) [1.212.225.99]:43724: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)1.212.225.991835841I  -' ossec13001gMExim Auth failed2025-04-16 11:56:56 dovecot_login authenticator failed for (corporativo.static.gvt.net.br) [177.43.43.211]:57807: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)177.43.43.2113469034gH  -Y) ossec13001gMbExim Auth failed2025-04-16 11:55:37 dovecot_login authenticator failed for c-84-216-198-213.bbcust.telenor.se [84.216.198.213]:35518: 535 Incorrect authentication data (set_id=sales)84.216.198.2132661886jG  -_) ossec13001gMYExim Auth failed2025-04-16 11:55:27 dovecot_login authenticator failed for ([222.105.182.88]) [222.105.182.88]:43988: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)222.105.182.881835841eF  -S+ ossec13001gKExim Auth failed2025-04-16 11:47:43 dovecot_login authenticator failed for ([116.148.186.186]) [116.148.186.186]:51394: 535 Incorrect authentication data (set_id=vikas.khandelwal)116.148.186.1861814991E  -' ossec13001gKnExim Auth failed2025-04-16 11:47:17 dovecot_login authenticator failed for c-73-45-216-101.hsd1.il.comcast.net [73.45.216.101]:51580: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)73.45.216.1016252001jD  -_) ossec13001gAExim Auth failed2025-04-16 11:05:56 dovecot_login authenticator failed for (109-126-41-234.pptp.vladlink.net) [109.126.41.234]:49190: 535 Incorrect authentication data (set_id=services)109.126.41.2342017370C  -) ossec13001gAExim Auth failed2025-04-16 11:05:42 dovecot_login authenticator failed for (142.92.214.139.adsl-pool.jlccptt.net.cn) [139.214.92.142]:39605: 535 Incorrect authentication data (set_id=services@heipowersystem.com)139.214.92.1421814991QB  E' ossec2501gA#User authentication failure.Apr 16 11:03:21 vm1 sshd[512321]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.74.235.30178.74.235.30690791CA aa' ossec5710g@Attempt to login using a non-existent userApr 16 11:02:38 vm1 sshd[512177]: Failed password for invalid user help from 178.74.235.30 port 46576 ssh2178.74.235.30690791)@  a/' ossec5710g@Attempt to login using a non-existent userApr 16 11:02:36 vm1 sshd[512177]: Invalid user help from 178.74.235.30 port 46576178.74.235.30690791&?  CG' ossec5716g@SSHD authentication failed.Apr 16 11:02:23 vm1 sshd[512164]: Failed password for root from 178.74.235.30 port 56246 ssh2178.74.235.30690791]> E1' ossec2501g@User authentication failure.Apr 16 11:02:21 vm1 sshd[512164]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.74.235.30 user=root178.74.235.30690791@= [5%1modsec77318034g>IM360 WAF: Blocked access to git folderIM360 WAF: Blocked access to git folder||RSV:6.86||RS:0||T:APACHE||MV:/.git/config||93.123.109.7732800vm1.technobases.in w: H e1-VUjZcwg_  -]% ossec13001ga9Exim Auth failed2025-04-16 13:20:17 dovecot_login authenticator failed for ([58.33.109.90]) [58.33.109.90]:59604: 535 Incorrect authentication data (set_id=services@heipowersystem.com)58.33.109.901814991r^  -o) ossec13001g]Exim Auth failed2025-04-16 13:05:34 dovecot_login authenticator failed for static-50-127-177-194.chtn.wv.frontiernet.net [50.127.177.194]:46456: 535 Incorrect authentication data (set_id=sales)50.127.177.1946252001 ]  -!) ossec13001g]Exim Auth failed2025-04-16 13:05:15 dovecot_login authenticator failed for (abts-mum-static-127.120.70.182.airtelbroadband.in) [182.70.120.127]:50710: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)182.70.120.1271269750f\  -W) ossec13001g]Exim Auth failed2025-04-16 13:04:42 dovecot_login authenticator failed for ([112.161.26.125]) [112.161.26.125]:51056: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)112.161.26.1251835841|[  -+ ossec13001g]~Exim Auth failed2025-04-16 13:04:22 dovecot_login authenticator failed for ([122.225.203.106]) [122.225.203.106]:11504: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)122.225.203.1061814991RZ  -5' ossec13001g]6Exim Auth failed2025-04-16 13:03:09 dovecot_login authenticator failed for ([65.20.153.146]) [65.20.153.146]:59161: 535 Incorrect authentication data (set_id=sales)65.20.153.14699237Y  - ' ossec13001g]&Exim Auth failed2025-04-16 13:02:53 dovecot_login authenticator failed for host81-130-174-76.in-addr.btopenworld.com [81.130.174.76]:45286: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)81.130.174.762635167,X a1' ossec5710g\Attempt to login using a non-existent userApr 16 12:58:03 vm1 sshd[535489]: Invalid user bsftp from 116.228.83.98 port 43988116.228.83.981814991RW  E' ossec2501g\User authentication failure.Apr 16 12:58:03 vm1 sshd[535489]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.228.83.98116.228.83.981814991'V  CG' ossec5716g[SSHD authentication failed.Apr 16 12:57:42 vm1 sshd[535452]: Failed password for root from 116.228.83.98 port 14582 ssh2116.228.83.981814991^U E1' ossec2501g[User authentication failure.Apr 16 12:57:40 vm1 sshd[535452]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.228.83.98 user=root116.228.83.981814991+T a/' ossec5710g[Attempt to login using a non-existent userApr 16 12:57:50 vm1 sshd[535463]: Invalid user kmrr from 116.228.83.98 port 15001116.228.83.981814991_S  -K' ossec13001g[JExim Auth failed2025-04-16 12:54:57 dovecot_login authenticator failed for ([193.32.189.59]) [193.32.189.59]:50498: 535 Incorrect authentication data (set_id=vikas.khandelwal)193.32.189.592017370R  -) ossec13001g[<Exim Auth failed2025-04-16 12:54:44 dovecot_login authenticator failed for ppp85-141-112-242.pppoe.mtu-net.ru [85.141.112.242]:50880: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)85.141.112.2422017370&Q  3S) ossec11301gZNew FTP connection.Apr 16 12:52:50 vm1 pure-ftpd[534460]: (?@185.247.137.50) [INFO] New connection from 185.247.137.50185.247.137.50298795$P  3O' ossec11301gYNew FTP connection.Apr 16 12:47:39 vm1 pure-ftpd[533420]: (?@167.94.138.35) [INFO] New connection from 167.94.138.35167.94.138.356252001TO  -7% ossec13001gQExim Auth failed2025-04-16 12:13:31 dovecot_login authenticator failed for ([8.139.253.26]) [8.139.253.26]:18304: 535 Incorrect authentication data (set_id=services)8.139.253.261814991hN  -a' ossec13001gQuExim Auth failed2025-04-16 12:13:01 dovecot_login authenticator failed for ([65.20.178.114]) [65.20.178.114]:51543: 535 Incorrect authentication data (set_id=services@heipowersystem.com)65.20.178.11499237 ) # C 2 "5Yup  -u) ossec13001gzExim Auth failed2025-04-16 15:09:21 dovecot_login authenticator failed for ([136.233.41.138]) [136.233.41.142]:48405: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)136.233.41.1421269750>o  [5!1modsec77318034gwBIM360 WAF: Blocked access to git folderIM360 WAF: Blocked access to git folder||RSV:6.86||RS:0||T:APACHE||MV:/.git/config||3.80.2.2206252001vm1.technobases.inn  G !1modsec77350309gwBIM360 WAF: Hidden file accessIM360 WAF: Hidden file access||RSV:6.86||RS:0||T:APACHE||QS:||3.80.2.2206252001vm1.technobases.inWm  -;' ossec13001gqExim Auth failed2025-04-16 14:27:55 dovecot_login authenticator failed for ([41.224.62.206]) [41.224.62.206]:45964: 535 Incorrect authentication data (set_id=services)41.224.62.2062464461dl  -Y# ossec13001gpExim Auth failed2025-04-16 14:27:35 dovecot_login authenticator failed for ([103.60.89.2]) [103.60.89.2]:42842: 535 Incorrect authentication data (set_id=services@heipowersystem.com)103.60.89.21643084k  - ) ossec13001gm@Exim Auth failed2025-04-16 14:11:35 dovecot_login authenticator failed for (106-107-67-185-red-servicios.onlycable.es) [185.67.107.106]:41142: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)185.67.107.1062510769yj  -}) ossec13001gm6Exim Auth failed2025-04-16 14:11:25 dovecot_login authenticator failed for ([178.178.222.56]) [178.178.222.56]:47468: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)178.178.222.562017370Qi  -1% ossec13001glExim Auth failed2025-04-16 14:10:25 dovecot_login authenticator failed for ([98.70.127.17]) [98.70.127.17]:58066: 535 Incorrect authentication data (set_id=sales)98.70.127.171269750h  -' ossec13001glExim Auth failed2025-04-16 14:10:03 dovecot_login authenticator failed for (190142265.ip3.static.mediacommerce.com.co) [200.91.234.36]:47143: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)200.91.234.3636861101g ;[+ ossec13008glMail Recipient rejected2025-04-16 14:08:43 H=([104.167.222.201]) [104.167.222.201]:55756 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 CV=no F= rejected RCPT : SMTP AUTH is required for message submission on port 587104.167.222.2016252001'f  3S) ossec11301gkNew FTP connection.Apr 16 14:05:24 vm1 pure-ftpd[549001]: (?@198.58.109.143) [INFO] New connection from 198.58.109.143198.58.109.14362520017e  Ag' ossec11302gkFTP Authentication failed.Apr 16 14:04:20 vm1 pure-ftpd[548715]: (?@165.22.141.51) [WARNING] Authentication failed for user [anonymous]165.22.141.516252001$d  3O' ossec11301gkNew FTP connection.Apr 16 14:04:15 vm1 pure-ftpd[548715]: (?@165.22.141.51) [INFO] New connection from 165.22.141.51165.22.141.516252001[c  -G% ossec13001gk*Exim Auth failed2025-04-16 14:02:41 dovecot_login authenticator failed for ([212.50.48.86]) [212.50.48.86]:35676: 535 Incorrect authentication data (set_id=vikas.khandelwal)212.50.48.86298795rb  -q' ossec13001gk Exim Auth failed2025-04-16 14:02:08 dovecot_login authenticator failed for ([103.190.91.99]) [103.190.91.99]:53639: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)103.190.91.991269750 a  [w# ossec12004ggsPossible Dovecot CVE-2019-11500 attemptApr 16 13:46:49 vm1 dovecot[90419]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.149.242.7, lip=103.74.54.108, session=<0JIy6OAyssgDlfIH>3.149.242.76252001R`  -7% ossec13001gaGExim Auth failed2025-04-16 13:20:30 dovecot_login authenticator failed for ([65.20.219.99]) [65.20.219.99]:57170: 535 Incorrect authentication data (set_id=services)65.20.219.9999237 [ 3 " ) ; Q 3RUI[i  -[+ ossec13001gExim Auth failed2025-04-16 16:26:54 dovecot_login authenticator failed for ([180.188.139.189]) [180.188.139.189]:34738: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)180.188.139.1891819730  -) ossec13001gExim Auth failed2025-04-16 16:26:37 dovecot_login authenticator failed for 50708de6.static.ziggozakelijk.nl [80.112.141.230]:33574: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)80.112.141.2302750405x~  -# ossec13001gExim Auth failed2025-04-16 16:25:17 dovecot_login authenticator failed for (91-221-7-13.broadband.dominion.ru.net) [91.221.7.13]:52324: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)91.221.7.13690791\}  -E' ossec13001gExim Auth failed2025-04-16 16:25:27 dovecot_login authenticator failed for 207.145.9.109.rev.sfr.net [109.9.145.207]:38200: 535 Incorrect authentication data (set_id=sales)109.9.145.2073017382a|  -O' ossec13001gExim Auth failed2025-04-16 16:17:15 dovecot_login authenticator failed for (www.safecleen.com) [58.49.113.138]:18011: 535 Incorrect authentication data (set_id=vikas.khandelwal)58.49.113.1381814991{  -% ossec13001gExim Auth failed2025-04-16 16:16:58 dovecot_login authenticator failed for (turkiye-130-60.bizimhost.com.tr) [91.93.130.60]:36390: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)91.93.130.60298795iz  -_' ossec13001gExim Auth failed2025-04-16 16:16:31 dovecot_login authenticator failed for c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:34422: 535 Incorrect authentication data (set_id=purchase)76.132.238.436252001jy  -a' ossec13001g}Exim Auth failed2025-04-16 16:16:20 dovecot_login authenticator failed for ([39.165.183.70]) [39.165.183.70]:53500: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)39.165.183.701814991Rx  ;!) ossec13008gMail Recipient rejected2025-04-16 16:00:19 H=(mail.uttamclassesjaipur.com) [165.154.242.42]:53223 F= rejected RCPT : Rejected relay attempt: '165.154.242.42' From: 'rakfc@uttamclassesjaipur.com' To: 'validxxx@gmailhotmail.com.br'165.154.242.421694008ew  -W' ossec13001gExim Auth failed2025-04-16 15:35:28 dovecot_login authenticator failed for 46.79-160-128.customer.lyse.net [79.160.128.46]:54415: 535 Incorrect authentication data (set_id=services)79.160.128.463144096iv  -a% ossec13001gExim Auth failed2025-04-16 15:35:06 dovecot_login authenticator failed for 6.ip-92-222-171.eu [92.222.171.6]:37661: 535 Incorrect authentication data (set_id=services@heipowersystem.com)92.222.171.63017382tu  -s) ossec13001g}Exim Auth failed2025-04-16 15:19:13 dovecot_login authenticator failed for (ip72-192-118-213.tu.ok.cox.net) [72.192.118.213]:32928: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)72.192.118.2136252001 t  -'' ossec13001g} Exim Auth failed2025-04-16 15:19:00 dovecot_login authenticator failed for (160.228-59-41.static-zone.ttcldata.net) [41.59.228.160]:46270: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)41.59.228.160149590as  -O' ossec13001g|Exim Auth failed2025-04-16 15:18:06 dovecot_login authenticator failed for ool-457e901e.dyn.optonline.net [69.126.144.30]:52878: 535 Incorrect authentication data (set_id=sales)69.126.144.306252001|r  -) ossec13001g|Exim Auth failed2025-04-16 15:17:36 dovecot_login authenticator failed for syn-104-231-212-078.res.spectrum.com [104.231.212.78]:56781: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)104.231.212.786252001aq  -O) ossec13001gzExim Auth failed2025-04-16 15:09:38 dovecot_login authenticator failed for ([185.101.16.250]) [185.101.16.250]:38717: 535 Incorrect authentication data (set_id=vikas.khandelwal)185.101.16.250272103 n T 5 5EY 0AnN  --# ossec13001gExim Auth failed2025-04-16 17:30:25 dovecot_login authenticator failed for ([27.71.26.64]) [27.71.26.64]:34429: 535 Incorrect authentication data (set_id=sales)27.71.26.641562822j  -_) ossec13001gExim Auth failed2025-04-16 17:30:17 dovecot_login authenticator failed for ([60.173.114.254]) [60.173.114.254]:49277: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)60.173.114.2541814991[  -G% ossec13001gExim Auth failed2025-04-16 17:25:09 dovecot_login authenticator failed for ([94.205.82.33]) [94.205.82.33]:35812: 535 Incorrect authentication data (set_id=vikas.khandelwal)94.205.82.33290557x  -y+ ossec13001gExim Auth failed2025-04-16 17:24:57 dovecot_login authenticator failed for ([180.188.143.166]) [180.188.143.166]:41171: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)180.188.143.1661819730[ -A' ossec13001g{Exim Auth failed2025-04-16 17:24:34 dovecot_login authenticator failed for (thepsindustries.com) [58.240.171.59]:34182: 535 Incorrect authentication data (set_id=nologin)58.240.171.591814991: Ai) ossec11302gFTP Authentication failed.Apr 16 16:46:57 vm1 pure-ftpd[581403]: (?@187.217.186.28) [WARNING] Authentication failed for user [anonymous]187.217.186.283996063( 3S) ossec11301gNew FTP connection.Apr 16 16:46:51 vm1 pure-ftpd[581403]: (?@187.217.186.28) [INFO] New connection from 187.217.186.28187.217.186.283996063g  -Y) ossec13001gExim Auth failed2025-04-16 16:43:12 dovecot_login authenticator failed for (193.190.182.58.starhub.net.sg) [58.182.190.193]:34546: 535 Incorrect authentication data (set_id=services)58.182.190.1931880251k  -c' ossec13001gExim Auth failed2025-04-16 16:43:01 dovecot_login authenticator failed for ([223.75.231.193]) [58.49.113.138]:10500: 535 Incorrect authentication data (set_id=services@heipowersystem.com)58.49.113.13818149917  I]) ossec11331gw Stealth FTP brute force attackApr 16 16:41:50 vm1 pure-ftpd[580397]: (?@187.217.186.28) [WARNING] Authentication failed for user [www]187.217.186.283996063A  gS) ossec11307gmMultiple connection attempts from same sourceApr 16 16:41:40 vm1 pure-ftpd[580373]: (?@187.217.186.28) [INFO] New connection from 187.217.186.28187.217.186.283996063X  ]) ossec11321ggActive Response. FTP brute force attack (Port 21 is protected)Apr 16 16:41:33 vm1 pure-ftpd[580290]: (?@187.217.186.28) [WARNING] Authentication failed for user [www]187.217.186.283996063  S) ossec211321ggPreventing FTP brute force attempt.[Active Response] is disabled for rule 11321. Greylisting 187.217.186.28187.217.186.2839960634 A]) ossec11302gUFTP Authentication failed.Apr 16 16:41:15 vm1 pure-ftpd[580249]: (?@187.217.186.28) [WARNING] Authentication failed for user [www]187.217.186.283996063( 3S) ossec11301gQNew FTP connection.Apr 16 16:41:11 vm1 pure-ftpd[580249]: (?@187.217.186.28) [INFO] New connection from 187.217.186.28187.217.186.2839960634 A]) ossec11302gKFTP Authentication failed.Apr 16 16:41:05 vm1 pure-ftpd[580224]: (?@187.217.186.28) [WARNING] Authentication failed for user [www]187.217.186.283996063( 3S) ossec11301gENew FTP connection.Apr 16 16:40:59 vm1 pure-ftpd[580224]: (?@187.217.186.28) [INFO] New connection from 187.217.186.28187.217.186.283996063'  3S) ossec11301gNew FTP connection.Apr 16 16:39:51 vm1 pure-ftpd[579926]: (?@187.217.186.28) [INFO] New connection from 187.217.186.28187.217.186.283996063N  ;+ ossec13008g*Mail Recipient rejected2025-04-16 16:32:02 H=(mail.thepsindustries.com) [165.154.242.137]:49730 F= rejected RCPT : Rejected relay attempt: '165.154.242.137' From: 'hiuneo@thepsindustries.com' To: 'validxxx@gmailhotmail.com.br'165.154.242.1371694008 8   $!8d#  -W% ossec13001gqExim Auth failed2025-04-16 19:02:33 dovecot_login authenticator failed for ([103.7.183.17]) [103.7.183.17]:65345: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)103.7.183.171269750]"  -C+ ossec13001gExim Auth failed2025-04-16 18:58:45 dovecot_login authenticator failed for ([165.154.202.101]) [165.154.202.101]:64494: 535 Incorrect authentication data (set_id=services)165.154.202.1016252001!  - ) ossec13001gwExim Auth failed2025-04-16 18:58:22 dovecot_login authenticator failed for 166.46.246.220.static.netvigator.com [220.246.46.166]:54080: 535 Incorrect authentication data (set_id=services@heipowersystem.com)220.246.46.1661819730v  -w) ossec13001gExim Auth failed2025-04-16 18:42:22 dovecot_login authenticator failed for (94-190-222-124.static.imsbiz.com) [94.190.222.124]:55624: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)94.190.222.1241819730q  -u% ossec13001gExim Auth failed2025-04-16 18:41:53 dovecot_login authenticator failed for ([65.20.130.45]) [65.20.130.45]:35864: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)65.20.130.4599237N  --# ossec13001g\Exim Auth failed2025-04-16 18:40:51 dovecot_login authenticator failed for ([61.169.6.99]) [61.169.6.99]:37696: 535 Incorrect authentication data (set_id=sales)61.169.6.991814991  -% ossec13001gDExim Auth failed2025-04-16 18:40:27 dovecot_login authenticator failed for (dynamicip-95-79-108-51.pppoe.nn.ertelecom.ru) [95.79.108.51]:36725: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)95.79.108.512017370\  -G% ossec13001gcExim Auth failed2025-04-16 18:32:27 dovecot_login authenticator failed for ([110.7.52.183]) [110.7.52.183]:54964: 535 Incorrect authentication data (set_id=vikas.khandelwal)110.7.52.1831814991u  -u) ossec13001gQExim Auth failed2025-04-16 18:32:09 dovecot_login authenticator failed for ([178.178.222.55]) [178.178.222.55]:42242: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)178.178.222.552017370r  ;a) ossec13008gMail Recipient rejected2025-04-16 18:08:19 H=(mail.shivelectricaltransformers.com) [165.154.213.26]:56974 F= rejected RCPT : Rejected relay attempt: '165.154.213.26' From: 'nfhrntqpy@shivelectricaltransformers.com' To: 'validxxx@gmailhotmail.com.br'165.154.213.263469034Z  -?) ossec13001gExim Auth failed2025-04-16 17:51:01 dovecot_login authenticator failed for ([112.184.22.125]) [112.184.22.125]:58222: 535 Incorrect authentication data (set_id=services)112.184.22.1251835841{  -' ossec13001gExim Auth failed2025-04-16 17:50:48 dovecot_login authenticator failed for 95-31-196-133.broadband.corbina.ru [95.31.196.133]:53570: 535 Incorrect authentication data (set_id=services@heipowersystem.com)95.31.196.1332017370x  -}' ossec13001gExim Auth failed2025-04-16 17:50:38 dovecot_login authenticator failed for (corporativo.static.gvt.net.br) [177.43.43.211]:57322: 535 Incorrect authentication data (set_id=services@heipowersystem.com)177.43.43.2113469034v  - ossec13001gExim Auth failed2025-04-16 17:34:31 dovecot_login authenticator failed for (5x19x5x63.static-business.spb.ertelecom.ru) [5.19.5.63]:60270: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)5.19.5.632017370y  -}) ossec13001gExim Auth failed2025-04-16 17:34:13 dovecot_login authenticator failed for ([218.22.237.108]) [218.22.237.108]:49754: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)218.22.237.1081814991  - + ossec13001gExim Auth failed2025-04-16 17:33:11 dovecot_login authenticator failed for (static-181-177-143-217.supernet.com.bo) [181.177.143.217]:57228: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)181.177.143.2173923057 *\~tj`VLB8.$zpf\H>4*   v l b X N D : 0 &    ~ t j ` V L B 8 . $    z p f \ R H > 4 *  vlbXND:0&|rh^TJ@6,"xndZPF<2( ~tj`VLB8.$zpf\ | r h ^ T J @ 6 , "    x n d Z P F < 2 (   RRH>4*  vlbXND:0& hMC hIC hIC hIC hHC hHC hGC hGC hEjC hCC hCC hCC hAC h>C h>,C h>C h>C h;7C h;C h:UC h82C h8$C h8 C h/C h/fC h.C h.vC h+aC h+YC h+OC h(C~ h(C} h%C| h%NC{ h!gCz hCy hCx hCw hCv hCCu hCt hCs hCr hCq hCp hCo hCn hCm hCl h>Ck h*Cj hDCi h4Ch h Cg h Cf h Ce h Cd h Cc h UCb h FCa hC` hC_ hC^ gC] gC\ gC[ gCZ gCY gCX gCW gCV gCU gCT g:CS g,CR gCQ gECP gCO gCN g CM gCL gCK g+CJ gJCI gVCH gCG gCF gڋCE gځCD gCC gCB gCA g C@ gIC? g;C> gQC= gEC< gC; g̺C: ğC9 gzC8 g@C7 g(C6 gQC5 g=C4 gQC3 g9C2 gmC1 gmC0 gaC/ g6C. gC- gC, gHC+ gB g>B g>B g=B g=B g=B g;B g;B g;FB g;:B g1B g1B g.;B g.)B g-B g-B g,B g+B g&B g%aB g%WB g%5B g$B g"PB g"FB gB gB gkB g_B gB gB F: K   1 Hoq} 5Fj4  -a' ossec13001g=Exim Auth failed2025-04-16 20:52:37 dovecot_login authenticator failed for ([14.48.227.118]) [14.48.227.118]:58642: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)14.48.227.1181835841Z3  -G% ossec13001gQExim Auth failed2025-04-16 20:48:41 dovecot_login authenticator failed for ([65.20.187.47]) [65.20.187.47]:44883: 535 Incorrect authentication data (set_id=vikas.khandelwal)65.20.187.47992372  - ) ossec13001g9Exim Auth failed2025-04-16 20:48:16 dovecot_login authenticator failed for (Vlan2489.static.gvt.net.br) [177.99.209.185]:49307: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)177.99.209.1853469034m1  -c+ ossec13001gmExim Auth failed2025-04-16 20:10:45 dovecot_login authenticator failed for ([220.180.107.193]) [220.180.107.193]:45826: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)220.180.107.1931814991P0  -3# ossec13001gmExim Auth failed2025-04-16 20:06:28 dovecot_login authenticator failed for ([41.75.122.7]) [41.75.122.7]:59545: 535 Incorrect authentication data (set_id=services)41.75.122.7927384y/  -' ossec13001gaExim Auth failed2025-04-16 20:06:15 dovecot_login authenticator failed for (201.173.16.21-clientes-izzi.mx) [201.173.16.21]:35778: 535 Incorrect authentication data (set_id=services@heipowersystem.com)201.173.16.213996063.  3C! ossec11301g6New FTP connection.Apr 16 19:57:00 vm1 pure-ftpd[620549]: (?@65.49.1.37) [INFO] New connection from 65.49.1.3765.49.1.376252001o-  -k) ossec13001gExim Auth failed2025-04-16 19:50:09 dovecot_login authenticator failed for (19.135.150.178.triolan.net) [178.150.135.19]:25829: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)178.150.135.19690791y,  -) ossec13001gExim Auth failed2025-04-16 19:49:56 dovecot_login authenticator failed for ([185.134.179.106]) [185.101.16.250]:37016: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)185.101.16.250272103T+  -5' ossec13001gHExim Auth failed2025-04-16 19:48:47 dovecot_login authenticator failed for ([114.242.61.19]) [114.242.61.35]:53998: 535 Incorrect authentication data (set_id=sales)114.242.61.351814991d*  -W% ossec13001g<Exim Auth failed2025-04-16 19:48:34 dovecot_login authenticator failed for ([14.35.218.58]) [14.35.218.58]:44774: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)14.35.218.581835841d)  -Q+ ossec13001gkExim Auth failed2025-04-16 19:40:50 dovecot_login authenticator failed for ([111.206.233.34]) [123.118.101.233]:51666: 535 Incorrect authentication data (set_id=vikas.khandelwal)123.118.101.2331814991r(  -q' ossec13001gUExim Auth failed2025-04-16 19:40:29 dovecot_login authenticator failed for ([218.22.187.68]) [218.22.187.66]:33685: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)218.22.187.6618149915'  ;g) ossec13008gMail Recipient rejected2025-04-16 19:34:00 H=(mail.hsnews.in) [165.154.228.59]:56074 F= rejected RCPT : Rejected relay attempt: '165.154.228.59' From: 'aodpuaypbi@hsnews.in' To: 'validxxx@gmailhotmail.com.br'165.154.228.591643084j&  -c% ossec13001gMExim Auth failed2025-04-16 19:31:47 dovecot_login authenticator failed for (heipowersystem.com) [125.72.54.81]:49244: 535 Incorrect authentication data (set_id=contact@heipowersystem.com)125.72.54.811814991W%  -=% ossec13001g Exim Auth failed2025-04-16 19:30:43 dovecot_login authenticator failed for (heipowersystem.com) [125.72.54.81]:45046: 535 Incorrect authentication data (set_id=nologin)125.72.54.811814991e$  -Y% ossec13001gExim Auth failed2025-04-16 19:02:46 dovecot_login authenticator failed for syn-074-062-020-170.biz.spectrum.com [74.62.20.170]:42271: 535 Incorrect authentication data (set_id=sales)74.62.20.1706252001 1 ! B 8 G N ct1ZE  -?) ossec13001gڋExim Auth failed2025-04-16 21:57:55 dovecot_login authenticator failed for ([119.207.78.191]) [119.207.78.191]:53416: 535 Incorrect authentication data (set_id=purchase)119.207.78.1911835841jD  -a' ossec13001gځExim Auth failed2025-04-16 21:57:45 dovecot_login authenticator failed for ([60.166.31.198]) [60.166.31.198]:54599: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)60.166.31.1981814991kC  -g# ossec13001gExim Auth failed2025-04-16 21:56:02 dovecot_login authenticator failed for c-24-7-216-47.hsd1.mn.comcast.net [24.7.216.47]:62888: 535 Incorrect authentication data (set_id=vikas.khandelwal)24.7.216.476252001WB  -9) ossec13001gExim Auth failed2025-04-16 21:55:58 dovecot_login authenticator failed for ([121.189.198.60]) [121.189.198.60]:57144: 535 Incorrect authentication data (set_id=sales)121.189.198.601835841uA  -u) ossec13001gExim Auth failed2025-04-16 21:55:50 dovecot_login authenticator failed for ([123.209.107.18]) [123.209.107.18]:34116: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)123.209.107.182077456~@  -) ossec13001g Exim Auth failed2025-04-16 21:55:46 dovecot_login authenticator failed for (nsg-static-245.215.75.182-airtel.com) [182.75.215.245]:47482: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)182.75.215.2451269750R?  -3% ossec13001gIExim Auth failed2025-04-16 21:18:25 dovecot_login authenticator failed for ([203.195.208.77]) [116.30.1.184]:7903: 535 Incorrect authentication data (set_id=sales)116.30.1.1841814991t>  -s) ossec13001g;Exim Auth failed2025-04-16 21:18:10 dovecot_login authenticator failed for (200-168-190-81.jandaia.com) [200.159.14.187]:59142: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)200.159.14.1873469034W=  -;' ossec13001gQExim Auth failed2025-04-16 21:14:16 dovecot_login authenticator failed for ([57.128.19.228]) [57.128.19.228]:48874: 535 Incorrect authentication data (set_id=services)57.128.19.2283017382j<  -a' ossec13001gEExim Auth failed2025-04-16 21:14:04 dovecot_login authenticator failed for ([1.227.228.136]) [1.227.228.136]:52162: 535 Incorrect authentication data (set_id=services@heipowersystem.com)1.227.228.1361835841f;  -Y' ossec13001gExim Auth failed2025-04-16 20:59:10 dovecot_login authenticator failed for 89-253-90-113.customers.ownit.se [89.253.90.113]:39059: 535 Incorrect authentication data (set_id=purchase)89.253.90.1132661886t:  -u' ossec13001g̺Exim Auth failed2025-04-16 20:58:57 dovecot_login authenticator failed for (84-238-92-245.ptr.bnaa.dk) [84.238.92.245]:60453: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)84.238.92.2452623032l9  -c) ossec13001ğExim Auth failed2025-04-16 20:58:05 dovecot_login authenticator failed for (31-220-168-116.rdtc.ru) [31.220.168.116]:57869: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)31.220.168.11620173708  -% ossec13001gzExim Auth failed2025-04-16 20:57:53 dovecot_login authenticator failed for customer-187-49-63-34.f1net.com.br [187.49.63.34]:58493: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)187.49.63.343469034Z7  -=+ ossec13001g@Exim Auth failed2025-04-16 20:56:55 dovecot_login authenticator failed for ([106.246.227.218]) [106.246.227.218]:45098: 535 Incorrect authentication data (set_id=sales)106.246.227.2181835841g6  -[' ossec13001g(Exim Auth failed2025-04-16 20:56:31 dovecot_login authenticator failed for ([120.138.5.219]) [120.138.5.219]:54910: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)120.138.5.2191269750n5  -i' ossec13001gQExim Auth failed2025-04-16 20:52:57 dovecot_login authenticator failed for dynamic-186-30-57-201.dynamic.etb.net.co [186.30.57.201]:64250: 535 Incorrect authentication data (set_id=purchase)186.30.57.2013686110 a" 7 < d x wG:O`aV  W+ ossec9708gDovecot Aborted Login with empty userApr 17 00:01:57 vm1 dovecot[90419]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=185.247.137.123, lip=103.74.54.108, TLS, session=185.247.137.123298795WU  -9) ossec13001gExim Auth failed2025-04-16 23:33:23 dovecot_login authenticator failed for ([170.238.145.36]) [170.238.145.36]:42655: 535 Incorrect authentication data (set_id=sales)170.238.145.363469034jT  -_) ossec13001gExim Auth failed2025-04-16 23:33:03 dovecot_login authenticator failed for ([106.255.231.10]) [106.255.231.10]:47228: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)106.255.231.101835841fS  -W) ossec13001g:Exim Auth failed2025-04-16 23:13:21 dovecot_login authenticator failed for ([220.182.17.122]) [220.182.17.122]:53014: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)220.182.17.1221814991R  -) ossec13001g,Exim Auth failed2025-04-16 23:13:07 dovecot_login authenticator failed for ool-addc7a34.static.optonline.net [173.220.122.52]:33238: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)173.220.122.526252001$Q  3O' ossec11301gNew FTP connection.Apr 16 23:07:11 vm1 pure-ftpd[660372]: (?@205.210.31.87) [INFO] New connection from 205.210.31.87205.210.31.876252001'P  3S) ossec11301gENew FTP connection.Apr 16 23:04:59 vm1 pure-ftpd[659677]: (?@167.94.138.177) [INFO] New connection from 167.94.138.177167.94.138.1776252001bO  -O) ossec13001gExim Auth failed2025-04-16 23:03:42 dovecot_login authenticator failed for ([103.174.145.35]) [103.174.145.35]:36484: 535 Incorrect authentication data (set_id=vikas.khandelwal)103.174.145.351269750N  -/% ossec13001gExim Auth failed2025-04-16 23:03:24 dovecot_login authenticator failed for laubervilliers-657-1-93-158.w80-14.abo.wanadoo.fr [80.14.31.158]:43509: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)80.14.31.1583017382ZM  -=+ ossec13001g Exim Auth failed2025-04-16 22:25:38 dovecot_login authenticator failed for ([117.232.111.254]) [117.232.111.251]:58566: 535 Incorrect authentication data (set_id=sales)117.232.111.2511269750|L  -) ossec13001gExim Auth failed2025-04-16 22:25:26 dovecot_login authenticator failed for c-174-51-180-242.hsd1.co.comcast.net [174.51.180.242]:58422: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)174.51.180.2426252001gK  -]% ossec13001gExim Auth failed2025-04-16 22:21:34 dovecot_login authenticator failed for ([36.26.63.158]) [36.26.63.158]:42885: 535 Incorrect authentication data (set_id=services@heipowersystem.com)36.26.63.1581814991SJ  -7% ossec13001g+Exim Auth failed2025-04-16 22:21:53 dovecot_login authenticator failed for ([194.28.91.40]) [194.28.91.40]:40361: 535 Incorrect authentication data (set_id=services)194.28.91.40690791vI  -y' ossec13001gJExim Auth failed2025-04-16 22:05:20 dovecot_login authenticator failed for ([1.227.228.136]) [1.227.228.136]:53709: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)1.227.228.1361835841fH  -W) ossec13001gVExim Auth failed2025-04-16 22:05:34 dovecot_login authenticator failed for ([180.158.100.49]) [180.158.100.49]:43266: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)180.158.100.491814991jG  -a' ossec13001gExim Auth failed2025-04-16 22:04:00 dovecot_login authenticator failed for ip4d16b6e6.dynamic.kabel-deutschland.de [77.22.182.230]:52067: 535 Incorrect authentication data (set_id=sales)77.22.182.2302921044jF  -_) ossec13001gExim Auth failed2025-04-16 22:03:51 dovecot_login authenticator failed for ([113.120.108.41]) [113.120.108.41]:57315: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)113.120.108.411814991 /5 = ? < Z qi h  -% ossec13001h4Exim Auth failed2025-04-17 01:42:36 dovecot_login authenticator failed for laubervilliers-657-1-93-158.w80-14.abo.wanadoo.fr [80.14.31.158]:56820: 535 Incorrect authentication data (set_id=services@heipowersystem.com)80.14.31.1583017382ig  -_' ossec13001h Exim Auth failed2025-04-17 01:27:14 dovecot_login authenticator failed for vps-a57cc768.vps.ovh.ca [149.56.141.93]:40554: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)149.56.141.936251999 f  -!% ossec13001h Exim Auth failed2025-04-17 01:26:54 dovecot_login authenticator failed for broadband-5-228-54-184.ip.moscow.rt.ru [5.228.54.184]:52068: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)5.228.54.1842017370+e 3W+ ossec11301h New FTP connection.Apr 17 01:24:54 vm1 pure-ftpd[696204]: (?@139.162.119.146) [INFO] New connection from 139.162.119.146139.162.119.1461861060*d  3W+ ossec11301h New FTP connection.Apr 17 01:23:17 vm1 pure-ftpd[695878]: (?@139.162.119.146) [INFO] New connection from 139.162.119.146139.162.119.1461861060*c  3W+ ossec11301h New FTP connection.Apr 17 01:22:47 vm1 pure-ftpd[695815]: (?@139.162.119.146) [INFO] New connection from 139.162.119.146139.162.119.1461861060\b  -G% ossec13001h UExim Auth failed2025-04-17 01:17:31 dovecot_login authenticator failed for ([1.180.230.98]) [1.180.230.98]:35538: 535 Incorrect authentication data (set_id=vikas.khandelwal)1.180.230.981814991wa  -w+ ossec13001h FExim Auth failed2025-04-17 01:17:18 dovecot_login authenticator failed for (node12.vindb.org) [104.236.145.128]:47742: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)104.236.145.1286252001!`  3K% ossec11301hNew FTP connection.Apr 17 00:41:20 vm1 pure-ftpd[686643]: (?@20.64.105.47) [INFO] New connection from 20.64.105.4720.64.105.476252001Q_  -1% ossec13001hExim Auth failed2025-04-17 00:40:05 dovecot_login authenticator failed for ([115.46.88.68]) [115.46.88.68]:37007: 535 Incorrect authentication data (set_id=sales)115.46.88.681814991d^  -W% ossec13001hExim Auth failed2025-04-17 00:39:52 dovecot_login authenticator failed for ([60.166.8.174]) [60.166.8.174]:47641: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)60.166.8.1741814991]]  -C+ ossec13001gExim Auth failed2025-04-17 00:36:10 dovecot_login authenticator failed for ([103.186.221.174]) [103.186.221.174]:56080: 535 Incorrect authentication data (set_id=services)103.186.221.1741269750~\  - ' ossec13001gExim Auth failed2025-04-17 00:35:59 dovecot_login authenticator failed for (static.ill.117.211.15.93.bsnl.co.in) [117.211.15.93]:59798: 535 Incorrect authentication data (set_id=services@heipowersystem.com)117.211.15.931269750y[  -' ossec13001gExim Auth failed2025-04-17 00:19:52 dovecot_login authenticator failed for ip4d16b6e6.dynamic.kabel-deutschland.de [77.22.182.230]:60311: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)77.22.182.2302921044sZ  -u% ossec13001gExim Auth failed2025-04-17 00:19:42 dovecot_login authenticator failed for ([110.7.52.183]) [110.7.52.183]:49084: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)110.7.52.1831814991uY  -u) ossec13001gExim Auth failed2025-04-17 00:10:34 dovecot_login authenticator failed for ([121.159.71.249]) [121.159.71.249]:47744: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)121.159.71.2491835841X  ?/ ossec1008gProcess exiting (killed).Apr 17 00:07:54 vm1 spamd[380974]: spamd: server killed by SIGTERM, shutting downCW  77 ossec502gOssec server started.ossec: Ossec started. Q ) S 5 = c _x @RQ|y  -' ossec13001hExim Auth failed2025-04-17 02:53:20 dovecot_login authenticator failed for (177.43.106.73.static.host.gvt.net.br) [177.43.106.73]:49114: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)177.43.106.733469034ix  -_) ossec13001hExim Auth failed2025-04-17 02:53:32 dovecot_login authenticator failed for (81.213.109.126.dynamic.ttnet.com.tr) [81.213.109.126]:52158: 535 Incorrect authentication data (set_id=sales)81.213.109.126298795Ww  -;' ossec13001hExim Auth failed2025-04-17 02:49:37 dovecot_login authenticator failed for ([106.227.87.29]) [106.227.87.29]:54166: 535 Incorrect authentication data (set_id=services)106.227.87.291814991lv  -c) ossec13001hExim Auth failed2025-04-17 02:49:24 dovecot_login authenticator failed for ([218.15.222.74]) [125.90.173.236]:14196: 535 Incorrect authentication data (set_id=services@heipowersystem.com)125.90.173.2361814991cu  -S' ossec13001hCExim Auth failed2025-04-17 02:34:02 dovecot_login authenticator failed for ([218.14.157.25]) [218.14.157.25]:40843: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)218.14.157.251814991 t  -) ossec13001hExim Auth failed2025-04-17 02:33:27 dovecot_login authenticator failed for 198-91-194-206.cpe.distributel.net [198.91.194.206]:40252: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)198.91.194.2066251999]s  -C+ ossec13001hExim Auth failed2025-04-17 02:32:36 dovecot_login authenticator failed for ([221.239.109.147]) [221.239.109.147]:44508: 535 Incorrect authentication data (set_id=purchase)221.239.109.1471814991gr  -]% ossec13001hExim Auth failed2025-04-17 02:32:06 dovecot_login authenticator failed for ([61.16.89.166]) [61.16.89.166]:49412: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)61.16.89.1661880251"q 3K% ossec11301hNew FTP connection.Apr 17 02:27:07 vm1 pure-ftpd[709483]: (?@66.175.213.4) [INFO] New connection from 66.175.213.466.175.213.46252001bp  -O) ossec13001hExim Auth failed2025-04-17 02:24:10 dovecot_login authenticator failed for ([216.194.174.80]) [216.194.174.27]:19769: 535 Incorrect authentication data (set_id=vikas.khandelwal)216.194.174.276252001o  - ' ossec13001hExim Auth failed2025-04-17 02:23:45 dovecot_login authenticator failed for ool-44c19558.dyn.optonline.net [68.193.149.88]:49816: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)68.193.149.886252001Un  -9) ossec13001hExim Auth failed2025-04-17 02:19:28 dovecot_login authenticator failed for ([196.216.81.126]) [196.216.81.126]:33876: 535 Incorrect authentication data (set_id=sales)196.216.81.12649518sm  -s' ossec13001hExim Auth failed2025-04-17 02:19:17 dovecot_login authenticator failed for 54.126.103.87.rev.vodafone.pt [87.103.126.54]:54844: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)87.103.126.542264397l  W% ossec9708hDovecot Aborted Login with empty userApr 17 02:07:49 vm1 dovecot[90419]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=203.55.131.3, lip=103.74.54.108, TLS, session=203.55.131.36252001Qk  -1% ossec13001h>Exim Auth failed2025-04-17 01:47:02 dovecot_login authenticator failed for ([218.70.9.114]) [218.70.9.114]:51258: 535 Incorrect authentication data (set_id=sales)218.70.9.1141814991rj  -w# ossec13001h*Exim Auth failed2025-04-17 01:46:41 dovecot_login authenticator failed for (95.0.252.73.static.ttnet.com.tr) [95.0.252.73]:55028: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)95.0.252.73298795[i  -G# ossec13001hDExim Auth failed2025-04-17 01:42:51 dovecot_login authenticator failed for (hebei.8.60.in-addr.arpa) [60.8.50.150]:33994: 535 Incorrect authentication data (set_id=services)60.8.50.1501814991 kZ   n .+UXT\KYki  -]) ossec13001h;7Exim Auth failed2025-04-17 04:50:22 dovecot_login authenticator failed for (189.219.36.213-clientes-izzi.mx) [189.219.36.213]:56118: 535 Incorrect authentication data (set_id=purchase)189.219.36.2133996063m  -e) ossec13001h;Exim Auth failed2025-04-17 04:49:51 dovecot_login authenticator failed for ([218.51.148.226]) [218.51.148.226]:34450: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)218.51.148.2261835841  -#) ossec13001h:UExim Auth failed2025-04-17 04:46:37 dovecot_login authenticator failed for 57-132-150-162.dyn.grandenetworks.net [57.132.150.162]:42104: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)57.132.150.1626252001s  -q) ossec13001h82Exim Auth failed2025-04-17 04:37:30 dovecot_login authenticator failed for nova-185-040-122-250.cpe.novanet.is [185.40.122.250]:37751: 535 Incorrect authentication data (set_id=vikas.khandelwal)185.40.122.2502629691  - ) ossec13001h8$Exim Auth failed2025-04-17 04:37:16 dovecot_login authenticator failed for n220246200078.netvigator.com [220.246.200.78]:41449: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)220.246.200.781819730x  -y+ ossec13001h8 Exim Auth failed2025-04-17 04:36:52 dovecot_login authenticator failed for ([109.196.197.118]) [109.196.197.118]:49991: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)109.196.197.1182017370Q  -1% ossec13001h/Exim Auth failed2025-04-17 04:00:24 dovecot_login authenticator failed for ([110.7.52.183]) [110.7.52.183]:55828: 535 Incorrect authentication data (set_id=sales)110.7.52.1831814991~  -+ ossec13001h/fExim Auth failed2025-04-17 03:59:57 dovecot_login authenticator failed for syn-173-174-196-141.res.spectrum.com [173.174.196.141]:37804: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)173.174.196.1416252001e  -W' ossec13001h.Exim Auth failed2025-04-17 03:56:24 dovecot_login authenticator failed for 46.79-160-128.customer.lyse.net [79.160.128.46]:44656: 535 Incorrect authentication data (set_id=services)79.160.128.463144096p  -i+ ossec13001h.vExim Auth failed2025-04-17 03:55:56 dovecot_login authenticator failed for ([220.158.233.247]) [220.158.233.247]:60094: 535 Incorrect authentication data (set_id=services@heipowersystem.com)220.158.233.24718317225  Ae% ossec11302h+aFTP Authentication failed.Apr 17 03:42:48 vm1 pure-ftpd[725739]: (?@92.255.57.55) [WARNING] Authentication failed for user [anonymous]92.255.57.551819730" 3K% ossec11301h+YNew FTP connection.Apr 17 03:42:40 vm1 pure-ftpd[725739]: (?@92.255.57.55) [INFO] New connection from 92.255.57.5592.255.57.551819730" 3K% ossec11301h+ONew FTP connection.Apr 17 03:42:30 vm1 pure-ftpd[725708]: (?@92.255.57.61) [INFO] New connection from 92.255.57.6192.255.57.611819730u~  -u) ossec13001h(Exim Auth failed2025-04-17 03:31:20 dovecot_login authenticator failed for ([137.131.41.235]) [137.131.41.235]:53448: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)137.131.41.2356252001o}  -m% ossec13001h(Exim Auth failed2025-04-17 03:30:57 dovecot_login authenticator failed for ([36.26.63.158]) [36.26.63.158]:49695: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)36.26.63.1581814991'|  3S) ossec11301h%New FTP connection.Apr 17 03:17:58 vm1 pure-ftpd[720703]: (?@194.165.16.167) [INFO] New connection from 194.165.16.167194.165.16.1672993457&{  3S) ossec11301h%NNew FTP connection.Apr 17 03:16:53 vm1 pure-ftpd[720527]: (?@93.123.109.222) [INFO] New connection from 93.123.109.22293.123.109.222732800!z  3K% ossec11301h!gNew FTP connection.Apr 17 03:00:13 vm1 pure-ftpd[717030]: (?@45.33.109.17) [INFO] New connection from 45.33.109.1745.33.109.176252001 %@ a Wne-  -S+ ossec13001hg2Exim Auth failed2025-04-17 07:58:01 dovecot_login authenticator failed for ([119.207.156.209]) [119.207.156.209]:36197: 535 Incorrect authentication data (set_id=vikas.khandelwal)119.207.156.2091835841e,  -U) ossec13001h^VExim Auth failed2025-04-17 07:20:14 dovecot_login authenticator failed for 89-179-241-253.static.corbina.ru [89.179.241.253]:54694: 535 Incorrect authentication data (set_id=sales)89.179.241.2532017370d+  -W% ossec13001h^LExim Auth failed2025-04-17 07:20:04 dovecot_login authenticator failed for ([38.28.125.96]) [38.28.125.96]:33078: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)38.28.125.966252001'*  3S) ossec11301h]New FTP connection.Apr 17 07:18:00 vm1 pure-ftpd[771237]: (?@198.235.24.248) [INFO] New connection from 198.235.24.248198.235.24.2486252001W)  -;' ossec13001h]hExim Auth failed2025-04-17 07:16:14 dovecot_login authenticator failed for ([210.245.95.11]) [210.245.95.11]:59908: 535 Incorrect authentication data (set_id=services)210.245.95.111562822f(  -]% ossec13001h]ZExim Auth failed2025-04-17 07:16:01 dovecot_login authenticator failed for ([185.226.88.5]) [185.226.88.5]:45992: 535 Incorrect authentication data (set_id=services@heipowersystem.com)185.226.88.5783754f'  -W) ossec13001hYExim Auth failed2025-04-17 07:00:15 dovecot_login authenticator failed for ([190.117.96.174]) [190.117.96.174]:53600: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)190.117.96.1743932488p&  -q# ossec13001hYExim Auth failed2025-04-17 06:59:44 dovecot_login authenticator failed for ([112.94.6.54]) [112.94.6.54]:25416: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)112.94.6.541814991R%  ;!) ossec13008hYUMail Recipient rejected2025-04-17 06:58:52 H=(mail.heipowersystem.com) [165.154.228.47]:54694 F= rejected RCPT : Rejected relay attempt: '165.154.228.47' From: 'tnnwhyiprfo@heipowersystem.com' To: 'validxxx@gmailhotmail.com.br'165.154.228.471643084e$  -S+ ossec13001hWXExim Auth failed2025-04-17 06:50:24 dovecot_login authenticator failed for ([116.127.143.140]) [116.127.143.140]:43024: 535 Incorrect authentication data (set_id=vikas.khandelwal)116.127.143.1401835841o#  -o% ossec13001hWJExim Auth failed2025-04-17 06:50:10 dovecot_login authenticator failed for ([41.72.201.170]) [41.72.202.86]:45796: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)41.72.202.86192950e"  -[# ossec13001hUMExim Auth failed2025-04-17 06:41:40 dovecot_login authenticator failed for (98.4.27.218.adsl-pool.jlccptt.net.cn) [218.27.4.98]:34934: 535 Incorrect authentication data (set_id=sales)218.27.4.981814991m!  -c+ ossec13001hU6Exim Auth failed2025-04-17 06:41:16 dovecot_login authenticator failed for ([125.139.124.120]) [125.139.124.120]:35288: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)125.139.124.1201835841!  3K% ossec11301hPrNew FTP connection.Apr 17 06:20:58 vm1 pure-ftpd[758975]: (?@94.102.56.99) [INFO] New connection from 94.102.56.9994.102.56.992750405Z  -=+ ossec13001hNExim Auth failed2025-04-17 06:12:57 dovecot_login authenticator failed for ([194.226.155.198]) [194.226.155.198]:60434: 535 Incorrect authentication data (set_id=sales)194.226.155.1982017370`  -Q# ossec13001hNExim Auth failed2025-04-17 06:12:40 dovecot_login authenticator failed for ([49.65.1.179]) [49.65.1.179]:5963: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)49.65.1.1791814991V  -;' ossec13001hMExim Auth failed2025-04-17 06:09:00 dovecot_login authenticator failed for ([94.204.97.125]) [94.204.97.125]:44167: 535 Incorrect authentication data (set_id=services)94.204.97.125290557  * @ / ! k   -!' ossec13001hMExim Auth failed2025-04-17 06:08:42 dovecot_login authenticator failed for (47-206-95-195.static.bhpk.fl.ip.frontiernet.net) [47.206.95.195]:50563: 535 Incorrect authentication data (set_id=services@heipowersystem.com)47.206.95.1956252001f  -W) ossec13001hIExim Auth failed2025-04-17 05:53:13 dovecot_login authenticator failed for ([128.185.225.34]) [128.185.225.34]:39882: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)128.185.225.341269750c  -S' ossec13001hIExim Auth failed2025-04-17 05:52:57 dovecot_login authenticator failed for ([103.48.194.21]) [103.48.194.21]:57236: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)103.48.194.211562822  -% ossec13001hIExim Auth failed2025-04-17 05:52:42 dovecot_login authenticator failed for 47-184-87-26.dlls.tx.frontiernet.net [47.184.87.26]:53328: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)47.184.87.2662520017  Ac+ ossec11302hHFTP Authentication failed.Apr 17 05:48:44 vm1 pure-ftpd[752017]: (?@213.209.150.198) [WARNING] Authentication failed for user [sales]213.209.150.1982921044*  3W+ ossec11301hHNew FTP connection.Apr 17 05:48:39 vm1 pure-ftpd[752017]: (?@213.209.150.198) [INFO] New connection from 213.209.150.198213.209.150.1982921044m  -g' ossec13001hGExim Auth failed2025-04-17 05:43:34 dovecot_login authenticator failed for (51.241.220.60.adsl-pool.sx.cn) [60.220.241.50]:43811: 535 Incorrect authentication data (set_id=vikas.khandelwal)60.220.241.501814991o  -m% ossec13001hGExim Auth failed2025-04-17 05:43:15 dovecot_login authenticator failed for ([98.70.127.17]) [98.70.127.17]:46940: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)98.70.127.171269750  W) ossec9708hEjDovecot Aborted Login with empty userApr 17 05:33:51 vm1 dovecot[90419]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=185.247.137.91, lip=103.74.54.108, TLS, session=185.247.137.91298795$  3O' ossec11301hCNew FTP connection.Apr 17 05:26:26 vm1 pure-ftpd[747492]: (?@34.140.130.14) [INFO] New connection from 34.140.130.1434.140.130.1428023617  Ag' ossec11302hCFTP Authentication failed.Apr 17 05:26:31 vm1 pure-ftpd[747492]: (?@34.140.130.14) [WARNING] Authentication failed for user [anonymous]34.140.130.142802361$  3O' ossec11301hCNew FTP connection.Apr 17 05:26:09 vm1 pure-ftpd[747456]: (?@34.140.130.14) [INFO] New connection from 34.140.130.1434.140.130.142802361   [y% ossec12004hAPossible Dovecot CVE-2019-11500 attemptApr 17 05:17:18 vm1 dovecot[90419]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.139.61.126, lip=103.74.54.108, session=3.139.61.1266252001e  -[' ossec13001h>Exim Auth failed2025-04-17 05:06:16 dovecot_login authenticator failed for ([65.20.152.118]) [65.20.152.118]:53629: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)65.20.152.11899237Q  -3# ossec13001h>,Exim Auth failed2025-04-17 05:02:58 dovecot_login authenticator failed for ([94.251.8.83]) [94.251.8.83]:43488: 535 Incorrect authentication data (set_id=services)94.251.8.832017370  - ' ossec13001h>Exim Auth failed2025-04-17 05:02:44 dovecot_login authenticator failed for broadband-95-84-186-218.ip.moscow.rt.ru [95.84.186.218]:60328: 535 Incorrect authentication data (set_id=services@heipowersystem.com)95.84.186.2182017370v  -{% ossec13001h>Exim Auth failed2025-04-17 05:02:30 dovecot_login authenticator failed for 1-34-162-249.hinet-ip.hinet.net [1.34.162.249]:53173: 535 Incorrect authentication data (set_id=services@heipowersystem.com)1.34.162.2491668284   " F  0+*K0'>  3S) ossec11301hxNew FTP connection.Apr 17 09:13:16 vm1 pure-ftpd[795609]: (?@18.216.243.106) [INFO] New connection from 18.216.243.10618.216.243.1066252001(= 3S) ossec11301hx?New FTP connection.Apr 17 09:10:44 vm1 pure-ftpd[795184]: (?@18.216.243.106) [INFO] New connection from 18.216.243.10618.216.243.1066252001d<  -Q+ ossec13001hvExim Auth failed2025-04-17 09:05:23 dovecot_login authenticator failed for (node12.vindb.org) [104.236.145.128]:54693: 535 Incorrect authentication data (set_id=vikas.khandelwal)104.236.145.1286252001r;  -q' ossec13001hvExim Auth failed2025-04-17 09:05:11 dovecot_login authenticator failed for ([95.165.146.62]) [95.165.146.62]:49186: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)95.165.146.622017370W:  -;' ossec13001htExim Auth failed2025-04-17 08:56:14 dovecot_login authenticator failed for ([203.190.150.4]) [203.190.150.4]:45916: 535 Incorrect authentication data (set_id=purchase)203.190.150.412697509  - + ossec13001htExim Auth failed2025-04-17 08:56:02 dovecot_login authenticator failed for 165.199.148.122.sta.wbroadband.net.au [122.148.199.165]:53158: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)122.148.199.1652077456&8  3S) ossec11301hr%New FTP connection.Apr 17 08:44:43 vm1 pure-ftpd[789527]: (?@93.123.109.222) [INFO] New connection from 93.123.109.22293.123.109.222732800Z7  -=+ ossec13001hn Exim Auth failed2025-04-17 08:27:15 dovecot_login authenticator failed for ([121.142.146.167]) [121.142.146.167]:55823: 535 Incorrect authentication data (set_id=sales)121.142.146.1671835841|6  -) ossec13001hmExim Auth failed2025-04-17 08:27:01 dovecot_login authenticator failed for 226.149.48.116.static.netvigator.com [116.48.149.226]:53676: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)116.48.149.22618197305  - ) ossec13001hmExim Auth failed2025-04-17 08:23:09 dovecot_login authenticator failed for (static-254.178.249.49-tataidc.co.in) [122.163.118.64]:40324: 535 Incorrect authentication data (set_id=services@heipowersystem.com)122.163.118.641269750W4  -;' ossec13001hm(Exim Auth failed2025-04-17 08:23:27 dovecot_login authenticator failed for ([38.44.145.221]) [38.44.145.221]:57988: 535 Incorrect authentication data (set_id=services)38.44.145.2216252001p3  -o% ossec13001hiYExim Auth failed2025-04-17 08:07:12 dovecot_login authenticator failed for h77-53-111-65.cust.bredband2.com [77.53.111.65]:60416: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)77.53.111.652661886@2  - ' ossec13001hiIExim Auth failed2025-04-17 08:06:56 dovecot_login authenticator failed for host-88-43-231-186.business.telecomitalia.it (host-88-43-231-188.business.telecomitalia.it) [88.43.231.186]:47990: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)88.43.231.1863175395W1  -;' ossec13001hiEExim Auth failed2025-04-17 08:06:51 dovecot_login authenticator failed for ([184.82.131.20]) [184.82.131.20]:56054: 535 Incorrect authentication data (set_id=purchase)184.82.131.201605651p0  -i+ ossec13001hi#Exim Auth failed2025-04-17 08:06:17 dovecot_login authenticator failed for ([221.213.201.190]) [221.213.201.190]:41949: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)221.213.201.1901814991m/  -m% ossec13001hg&Exim Auth failed2025-04-17 07:57:49 dovecot_login authenticator failed for ([65.20.174.38]) [65.20.174.38]:36500: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)65.20.174.3899237r.  -q' ossec13001hgExim Auth failed2025-04-17 07:57:38 dovecot_login authenticator failed for ([218.69.115.74]) [218.69.115.74]:43479: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)218.69.115.741814991|vpjd^XRLF@:4.(" ztnhb\VPJD>82,&  ~ x r l f ` Z T N H B < 6 0 * $     | v p j d ^ X R L F @ : 4 . ( "     z s l e ^ W P I B ; 4 - &     ~ w p i b [ T M F ? 8 1 * #     { t m f _ X Q J C < 5 . '   xqjc\UNG@92+$|ung`YRKD=6/(! yrkd]VOHA:3,% }vohaZSLE>70)" eR@/ {j/YH7b& r`O>c-o xSg쁜V遜F4끜#ၜځ؁qaЁPn@y/ƁÁ }kZH-7*&s8aP>*4unv\zK|:^)\}Tu(dJSxBw1I qm~imj[XJ]8L'U;Fu>e.T9D12+7 ,|'k)Z%J$:") vdTD3"n^M ; *  xeUD3"p_ M =*udSD5&zk[J;큎+쁎끎 ꁍy遍i聍X灍G恍6၍$䁍偍߁r⁌aがP݁@܁.ہځ فy؁gցTՁCҁ1сԁ ӁzÁgāTЁAƁ0ρ΁ {kŁZʁHȁ7ǁ%ˁɁ́xhWF5%r`P>- yhVE4#p_M<+weUD3 }l\J8&o]K9)vfVD2 ~}}k|Z{Kz:y'xwvquatOs?r/pn m{likYjGi4h!gf|ekdYcHb8a(`_]u[cZQY@X.WV U}SlRZQHP7O%MLKrJaHOG?F/E DBAo@`?P>A<1; :9~8l7\6J593'210p/].K-9,(*)(u&e%R$@#/"! xfUC3!|iWF4#n ] K 7 %q_N=, wdTB/ zjZJ8'veTB0~m\K;+ yiWG6%p_O>0"o^M<+ ziXH7%p]L<*udSA0~m[I9(udR@/ l  b   + 9Z$A[MPl_P  -M% ossec13001hExim Auth failed2025-04-17 10:37:52 dovecot_login authenticator failed for (103.3.246.91.bteleport.ru) [91.246.3.103]:33798: 535 Incorrect authentication data (set_id=services)91.246.3.1032017370xO  -}) ossec13001hExim Auth failed2025-04-17 10:37:20 dovecot_login authenticator failed for 80-186-144-129.elisa-mobile.fi [80.186.144.129]:37166: 535 Incorrect authentication data (set_id=services@heipowersystem.com)80.186.144.129660013 N  -) ossec13001hExim Auth failed2025-04-17 10:21:22 dovecot_login authenticator failed for (109-126-41-234.pptp.vladlink.net) [109.126.41.234]:52518: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)109.126.41.2342017370aM  -S' ossec13001hExim Auth failed2025-04-17 10:21:33 dovecot_login authenticator failed for ([65.20.226.246]) [65.20.226.246]:60015: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)65.20.226.24699237^L  -K' ossec13001hExim Auth failed2025-04-17 10:12:08 dovecot_login authenticator failed for ([78.142.41.167]) [78.142.41.167]:41946: 535 Incorrect authentication data (set_id=vikas.khandelwal)78.142.41.167732800uK  -u) ossec13001hExim Auth failed2025-04-17 10:11:52 dovecot_login authenticator failed for ([125.35.109.214]) [125.35.109.214]:41644: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)125.35.109.2141814991*J  3W+ ossec11301hNew FTP connection.Apr 17 10:03:04 vm1 pure-ftpd[806000]: (?@172.202.117.223) [INFO] New connection from 172.202.117.223172.202.117.2236252001\I -A) ossec13001hExim Auth failed2025-04-17 09:44:10 dovecot_plain authenticator failed for (localhost.localdomain) [78.153.140.207]:37456: 535 Incorrect authentication data (set_id=info)78.153.140.2072635167'H  3S) ossec11301h.New FTP connection.Apr 17 09:40:22 vm1 pure-ftpd[801278]: (?@199.45.154.146) [INFO] New connection from 199.45.154.146199.45.154.1466252001ZG  -=+ ossec13001h}Exim Auth failed2025-04-17 09:34:51 dovecot_login authenticator failed for ([165.227.129.203]) [165.227.129.203]:59162: 535 Incorrect authentication data (set_id=sales)165.227.129.2032921044mF  -c+ ossec13001h}Exim Auth failed2025-04-17 09:34:40 dovecot_login authenticator failed for ([221.213.201.190]) [221.213.201.190]:56977: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)221.213.201.1901814991WE  -;' ossec13001h|Exim Auth failed2025-04-17 09:30:44 dovecot_login authenticator failed for ([106.91.215.99]) [106.91.215.99]:60406: 535 Incorrect authentication data (set_id=services)106.91.215.991814991D  -' ossec13001h|Exim Auth failed2025-04-17 09:30:30 dovecot_login authenticator failed for (190142265.ip3.static.mediacommerce.com.co) [200.91.234.36]:40534: 535 Incorrect authentication data (set_id=services@heipowersystem.com)200.91.234.363686110!C  3K% ossec11301h||New FTP connection.Apr 17 09:28:51 vm1 pure-ftpd[798850]: (?@139.162.77.6) [INFO] New connection from 139.162.77.6139.162.77.61861060'B  3S) ossec11301hyNew FTP connection.Apr 17 09:18:03 vm1 pure-ftpd[796614]: (?@18.216.243.106) [INFO] New connection from 18.216.243.10618.216.243.1066252001'A  3S) ossec11301hyNew FTP connection.Apr 17 09:16:24 vm1 pure-ftpd[796375]: (?@18.216.243.106) [INFO] New connection from 18.216.243.10618.216.243.1066252001x@  -{) ossec13001hy7Exim Auth failed2025-04-17 09:14:54 dovecot_login authenticator failed for syn-098-102-148-242.biz.spectrum.com [98.102.148.242]:34216: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)98.102.148.2426252001p?  -q# ossec13001hy-Exim Auth failed2025-04-17 09:14:44 dovecot_login authenticator failed for ([49.65.1.179]) [49.65.1.179]:12174: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)49.65.1.1791814991   ) P Y R`ol_p*`  3W+ ossec11301hNew FTP connection.Apr 17 11:55:56 vm1 pure-ftpd[830805]: (?@118.194.239.161) [INFO] New connection from 118.194.239.161118.194.239.1611694008W_  -9) ossec13001hHExim Auth failed2025-04-17 11:48:48 dovecot_login authenticator failed for ([124.239.169.52]) [124.239.169.52]:37623: 535 Incorrect authentication data (set_id=sales)124.239.169.521814991v^  -y' ossec13001h:Exim Auth failed2025-04-17 11:48:34 dovecot_login authenticator failed for c151-177-95-27.bredband.tele2.se [151.177.95.27]:37804: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)151.177.95.272661886e]  -Y% ossec13001hnExim Auth failed2025-04-17 11:45:09 dovecot_login authenticator failed for 95-30-250-44.broadband.corbina.ru [95.30.250.44]:58092: 535 Incorrect authentication data (set_id=services)95.30.250.442017370j\  -a' ossec13001h\Exim Auth failed2025-04-17 11:44:51 dovecot_login authenticator failed for ([222.87.49.250]) [222.87.49.250]:48643: 535 Incorrect authentication data (set_id=services@heipowersystem.com)222.87.49.2501814991[  -' ossec13001hExim Auth failed2025-04-17 11:28:34 dovecot_login authenticator failed for c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:44578: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)76.132.238.436252001~Z  -) ossec13001hExim Auth failed2025-04-17 11:29:04 dovecot_login authenticator failed for (186-201-3-45.customer.tdatabrasil.net.br) [186.200.158.42]:58729: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)186.200.158.423469034lY  -c) ossec13001hExim Auth failed2025-04-17 11:24:42 dovecot_login authenticator failed for syn-024-104-225-201.res.spectrum.com [24.104.225.201]:43494: 535 Incorrect authentication data (set_id=purchase)24.104.225.2016252001mX  -e) ossec13001hExim Auth failed2025-04-17 11:24:13 dovecot_login authenticator failed for ([116.114.94.242]) [116.114.94.242]:40492: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)116.114.94.2421814991W  -) ossec13001hZExim Auth failed2025-04-17 11:19:13 dovecot_login authenticator failed for (dynamicip-188-232-131-13.pppoe.omsk.ertelecom.ru) [188.232.131.13]:60600: 535 Incorrect authentication data (set_id=vikas.khandelwal)188.232.131.132017370rV  -q' ossec13001hNExim Auth failed2025-04-17 11:19:02 dovecot_login authenticator failed for ([211.58.49.145]) [211.58.49.145]:35000: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)211.58.49.1451835841TU  -5' ossec13001hExim Auth failed2025-04-17 11:03:38 dovecot_login authenticator failed for ([222.120.176.6]) [222.120.176.6]:32990: 535 Incorrect authentication data (set_id=sales)222.120.176.61835841gT  -[' ossec13001hExim Auth failed2025-04-17 11:03:21 dovecot_login authenticator failed for ([211.223.41.90]) [211.223.41.90]:32826: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)211.223.41.901835841WS  -9) ossec13001hExim Auth failed2025-04-17 10:41:37 dovecot_login authenticator failed for ([128.199.242.76]) [128.199.242.76]:55916: 535 Incorrect authentication data (set_id=sales)128.199.242.761880251jR  -_) ossec13001h~Exim Auth failed2025-04-17 10:41:25 dovecot_login authenticator failed for ([178.178.222.61]) [178.178.222.61]:54238: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)178.178.222.612017370Q  W' ossec9708hDovecot Aborted Login with empty userApr 17 10:39:20 vm1 dovecot[90419]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=87.236.176.72, lip=103.74.54.108, TLS, session=87.236.176.722635167  ! 2 X i8W  -=' ossec13001hˠExim Auth failed2025-04-17 15:06:32 dovecot_login authenticator failed for ([196.191.212.236]) [213.55.85.202]:3569: 535 Incorrect authentication data (set_id=services)213.55.85.2023379964  -u' ossec13001hˀExim Auth failed2025-04-17 15:05:59 dovecot_login authenticator failed for host-88-43-231-186.business.telecomitalia.it (host-88-43-231-188.business.telecomitalia.it) [88.43.231.186]:50442: 535 Incorrect authentication data (set_id=services@heipowersystem.com)88.43.231.1863175395   -) ossec13001hDZExim Auth failed2025-04-17 14:49:45 dovecot_login authenticator failed for (109-126-41-234.pptp.vladlink.net) [109.126.41.234]:53138: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)109.126.41.2342017370t  -w% ossec13001hExim Auth failed2025-04-17 14:50:03 dovecot_login authenticator failed for 47-184-87-26.dlls.tx.frontiernet.net [47.184.87.26]:60456: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)47.184.87.266252001\  -G% ossec13001hňExim Auth failed2025-04-17 14:40:31 dovecot_login authenticator failed for ([1.212.225.99]) [1.212.225.99]:56416: 535 Incorrect authentication data (set_id=vikas.khandelwal)1.212.225.991835841k~  -i# ossec13001hvExim Auth failed2025-04-17 14:40:13 dovecot_login authenticator failed for ([85.97.71.67]) [85.97.71.67]:59470: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)85.97.71.67298795!}  3K% ossec11301h0New FTP connection.Apr 17 14:39:02 vm1 pure-ftpd[868092]: (?@203.55.131.4) [INFO] New connection from 203.55.131.4203.55.131.46252001'|  3S) ossec11301hNew FTP connection.Apr 17 14:24:13 vm1 pure-ftpd[864689]: (?@188.166.49.135) [INFO] New connection from 188.166.49.135188.166.49.1352750405${  3O' ossec11301h!New FTP connection.Apr 17 14:17:28 vm1 pure-ftpd[863297]: (?@47.84.179.142) [INFO] New connection from 47.84.179.14247.84.179.1421880251Wz  -9) ossec13001hExim Auth failed2025-04-17 14:03:17 dovecot_login authenticator failed for ([101.168.29.210]) [101.168.29.210]:51658: 535 Incorrect authentication data (set_id=sales)101.168.29.2102077456jy  -_) ossec13001hExim Auth failed2025-04-17 14:02:55 dovecot_login authenticator failed for ([119.200.229.33]) [119.200.229.33]:60546: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)119.200.229.331835841Ux  -;' ossec13001hExim Auth failed2025-04-17 13:59:06 dovecot_login authenticator failed for ([65.20.190.168]) [65.20.190.168]:35752: 535 Incorrect authentication data (set_id=services)65.20.190.16899237jw  -a' ossec13001hExim Auth failed2025-04-17 13:58:55 dovecot_login authenticator failed for ([123.52.202.92]) [123.52.202.92]:50592: 535 Incorrect authentication data (set_id=services@heipowersystem.com)123.52.202.921814991Wv  -;' ossec13001h#Exim Auth failed2025-04-17 13:47:38 dovecot_login authenticator failed for ([218.4.214.115]) [218.4.214.115]:52404: 535 Incorrect authentication data (set_id=purchase)218.4.214.1151814991ju  -a' ossec13001hExim Auth failed2025-04-17 13:47:24 dovecot_login authenticator failed for ([103.174.34.49]) [103.174.34.49]:52726: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)103.174.34.491269750t  -5% ossec13001hExim Auth failed2025-04-17 13:42:52 dovecot_login authenticator failed for vps-79f20bfc.vps.ovh.net (ip193.ip-87-98-249.eu) [51.75.24.107]:41896: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)51.75.24.1073017382ws  -{' ossec13001hExim Auth failed2025-04-17 13:43:04 dovecot_login authenticator failed for (static.ill.117.211.15.93.bsnl.co.in) [117.211.15.93]:33828: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)117.211.15.931269750 [ y 1 . ?^u/O[or  -m% ossec13001hExim Auth failed2025-04-17 13:33:28 dovecot_login authenticator failed for ([27.45.229.71]) [27.45.229.71]:42076: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)27.45.229.711814991[q  -G% ossec13001hExim Auth failed2025-04-17 13:33:39 dovecot_login authenticator failed for ([31.131.73.59]) [31.131.73.59]:56546: 535 Incorrect authentication data (set_id=vikas.khandelwal)31.131.73.596907913p  A]) ossec11302h~FTP Authentication failed.Apr 17 13:32:06 vm1 pure-ftpd[851669]: (?@106.14.226.102) [WARNING] Authentication failed for user [www]106.14.226.1021814991(o 3S) ossec11301hjNew FTP connection.Apr 17 13:31:46 vm1 pure-ftpd[851631]: (?@106.14.226.102) [INFO] New connection from 106.14.226.102106.14.226.1021814991@n  ;{+ ossec13008hMail Recipient rejected2025-04-17 13:16:06 H=(mail.rokamauka.com) [165.154.210.137]:55445 F= rejected RCPT : Rejected relay attempt: '165.154.210.137' From: 'szomiqra@rokamauka.com' To: 'validxxx@gmailhotmail.com.br'165.154.210.1371694008Tm  -7% ossec13001hoExim Auth failed2025-04-17 13:06:13 dovecot_login authenticator failed for ([61.97.17.208]) [61.97.17.208]:58929: 535 Incorrect authentication data (set_id=purchase)61.97.17.2081835841il  -a' ossec13001hYExim Auth failed2025-04-17 13:05:52 dovecot_login authenticator failed for ([91.72.171.210]) [91.72.171.210]:56691: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)91.72.171.210290557Pk  -1% ossec13001h Exim Auth failed2025-04-17 12:56:02 dovecot_login authenticator failed for ([94.205.82.33]) [94.205.82.33]:48916: 535 Incorrect authentication data (set_id=sales)94.205.82.33290557dj  -W% ossec13001hExim Auth failed2025-04-17 12:55:50 dovecot_login authenticator failed for ([47.242.221.8]) [47.242.221.8]:44452: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)47.242.221.81819730\i  -C+ ossec13001hExim Auth failed2025-04-17 12:51:57 dovecot_login authenticator failed for ([178.135.121.123]) [178.135.121.123]:37877: 535 Incorrect authentication data (set_id=services)178.135.121.123272103jh  -a' ossec13001hExim Auth failed2025-04-17 12:51:39 dovecot_login authenticator failed for ([60.167.19.189]) [60.167.19.189]:55000: 535 Incorrect authentication data (set_id=services@heipowersystem.com)60.167.19.1891814991~g  - % ossec13001h=Exim Auth failed2025-04-17 12:35:32 dovecot_login authenticator failed for (84-52-89-218.westcall.net) [84.52.89.218]:44011: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)84.52.89.21820173707f  Ag' ossec11302h%FTP Authentication failed.Apr 17 12:35:07 vm1 pure-ftpd[839273]: (?@94.102.49.155) [WARNING] Authentication failed for user [anonymous]94.102.49.1552750405]e  -K# ossec13001hQExim Auth failed2025-04-17 12:35:52 dovecot_login authenticator failed for ([1.241.64.92]) [1.241.64.92]:32883: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)1.241.64.921835841%d 3O' ossec11301hNew FTP connection.Apr 17 12:35:01 vm1 pure-ftpd[839282]: (?@94.102.49.155) [INFO] New connection from 94.102.49.15594.102.49.1552750405"c 3K% ossec11301h New FTP connection.Apr 17 12:34:44 vm1 pure-ftpd[839082]: (?@80.82.77.202) [INFO] New connection from 80.82.77.20280.82.77.2022750405]b  -K' ossec13001hExim Auth failed2025-04-17 12:26:15 dovecot_login authenticator failed for ([65.20.196.232]) [65.20.196.232]:50290: 535 Incorrect authentication data (set_id=vikas.khandelwal)65.20.196.23299237ya  -# ossec13001hExim Auth failed2025-04-17 12:25:52 dovecot_login authenticator failed for (185-11-23-5.static.eolo.it) [185.11.23.5]:43539: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)185.11.23.53175395 Q* < f w w*6:Qd  -W% ossec13001h;Exim Auth failed2025-04-17 16:17:22 dovecot_login authenticator failed for ([92.47.46.174]) [92.47.46.174]:41482: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)92.47.46.1741522867w  -y) ossec13001hEExim Auth failed2025-04-17 16:17:32 dovecot_login authenticator failed for (dynamicip-188-232-131-13.pppoe.omsk.ertelecom.ru) [188.232.131.13]:60756: 535 Incorrect authentication data (set_id=sales)188.232.131.132017370o  -g+ ossec13001hXExim Auth failed2025-04-17 16:13:36 dovecot_login authenticator failed for 122x220x198x204.ap122.ftth.ucom.ne.jp [122.220.198.204]:42564: 535 Incorrect authentication data (set_id=services)122.220.198.2041861060i  -_' ossec13001hLExim Auth failed2025-04-17 16:13:24 dovecot_login authenticator failed for ([106.12.254.47]) [106.12.254.47]:6738: 535 Incorrect authentication data (set_id=services@heipowersystem.com)106.12.254.471814991  Uc' ossec11001hwDeferred login on the cpanel service[2025-04-17 16:01:19 +0530] info [webmaild] 157.38.155.79 - kps@amplifypowerglobal.com "POST /cpsess6263388808/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [157.38.155.173] != Current IP Address [157.38.155.79]157.38.155.791269750a  -S' ossec13001hףExim Auth failed2025-04-17 15:57:46 dovecot_login authenticator failed for ([65.20.193.144]) [65.20.193.144]:59737: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)65.20.193.14499237  -) ossec13001hדExim Auth failed2025-04-17 15:57:30 dovecot_login authenticator failed for (103.182.106.62.ns1.zitatel.com) [103.182.106.62]:62892: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)103.182.106.621269750l  -e' ossec13001hcExim Auth failed2025-04-17 15:48:10 dovecot_login authenticator failed for 81.60.194.189.dyn.user.ono.com [81.60.194.189]:46533: 535 Incorrect authentication data (set_id=vikas.khandelwal)81.60.194.1892510769s  -u) ossec13001hYExim Auth failed2025-04-17 15:47:59 dovecot_login authenticator failed for ([185.255.47.190]) [185.255.47.190]:48584: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)185.255.47.19099237{  -+ ossec13001hеExim Auth failed2025-04-17 15:28:13 dovecot_login authenticator failed for (173-166-112-154-newengland.hfc.comcastbusiness.net) [173.166.112.154]:50406: 535 Incorrect authentication data (set_id=sales)173.166.112.1546252001j  -_) ossec13001hЫExim Auth failed2025-04-17 15:28:02 dovecot_login authenticator failed for ([50.239.104.252]) [50.239.104.252]:42133: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)50.239.104.2526252001  S+ ossec11000h*Login failed on the cpanel service.[2025-04-17 15:25:53 +0530] info [cpaneld] 192.253.250.249 - heipowersystem "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipowersystem (has_cpuser_file failed)192.253.250.24929603135  Ae% ossec11302hFTP Authentication failed.Apr 17 15:19:56 vm1 pure-ftpd[876741]: (?@34.77.13.200) [WARNING] Authentication failed for user [anonymous]34.77.13.2002802361" 3K% ossec11301hοNew FTP connection.Apr 17 15:19:50 vm1 pure-ftpd[876739]: (?@34.77.13.200) [INFO] New connection from 34.77.13.20034.77.13.2002802361C  77 ossec502hOssec server started.ossec: Ossec started.P  -1% ossec13001h̠Exim Auth failed2025-04-17 15:10:48 dovecot_login authenticator failed for ([87.200.181.5]) [87.200.181.5]:42301: 535 Incorrect authentication data (set_id=sales)87.200.181.5290557|  -' ossec13001ĥExim Auth failed2025-04-17 15:10:18 dovecot_login authenticator failed for 114.185.47.34.bc.googleusercontent.com [34.47.185.114]:60690: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)34.47.185.1141269750 l  / = G X|+13DlS%  -7% ossec13001hExim Auth failed2025-04-17 18:05:31 dovecot_login authenticator failed for ([94.206.93.90]) [94.206.93.90]:34023: 535 Incorrect authentication data (set_id=purchase)94.206.93.90290557j$  -a' ossec13001hExim Auth failed2025-04-17 18:05:21 dovecot_login authenticator failed for ([118.33.246.91]) [118.33.246.91]:56481: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)118.33.246.911835841y#  -% ossec13001hExim Auth failed2025-04-17 18:02:20 dovecot_login authenticator failed for (178x78x28x55.dynamic.krasnodar.ertelecom.ru) [178.78.28.55]:46978: 535 Incorrect authentication data (set_id=vikas.khandelwal)178.78.28.552017370u"  -u) ossec13001hExim Auth failed2025-04-17 18:02:02 dovecot_login authenticator failed for ([218.237.71.112]) [218.237.71.112]:48910: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)218.237.71.1121835841$!  3O' ossec11301hNew FTP connection.Apr 17 17:48:58 vm1 pure-ftpd[908540]: (?@20.163.10.186) [INFO] New connection from 20.163.10.18620.163.10.1866252001m  -i% ossec13001hExim Auth failed2025-04-17 17:40:08 dovecot_login authenticator failed for (s2seducationtrust.com) [125.72.54.81]:58286: 535 Incorrect authentication data (set_id=info@s2seducationtrust.com)125.72.54.811814991Z  -C% ossec13001hcExim Auth failed2025-04-17 17:39:07 dovecot_login authenticator failed for (s2seducationtrust.com) [125.72.54.81]:53934: 535 Incorrect authentication data (set_id=nologin)125.72.54.811814991]  -C+ ossec13001hExim Auth failed2025-04-17 17:32:26 dovecot_login authenticator failed for ([218.149.235.152]) [218.149.235.152]:54784: 535 Incorrect authentication data (set_id=purchase)218.149.235.1521835841p  -i+ ossec13001hExim Auth failed2025-04-17 17:32:12 dovecot_login authenticator failed for ([112.194.143.206]) [112.194.143.206]:33290: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)112.194.143.2061814991W  -9) ossec13001h Exim Auth failed2025-04-17 17:24:48 dovecot_login authenticator failed for ([92.126.223.175]) [92.126.223.175]:51086: 535 Incorrect authentication data (set_id=sales)92.126.223.1752017370j  -_) ossec13001hExim Auth failed2025-04-17 17:24:37 dovecot_login authenticator failed for ([219.251.253.62]) [219.251.253.62]:40838: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)219.251.253.621835841q  -k+ ossec13001hExim Auth failed2025-04-17 17:20:43 dovecot_login authenticator failed for (static.ill.117.248.107.130.bsnl.co.in) [117.248.107.130]:37912: 535 Incorrect authentication data (set_id=services)117.248.107.1301269750m  -e) ossec13001h Exim Auth failed2025-04-17 17:20:33 dovecot_login authenticator failed for ([157.122.199.20]) [157.122.199.20]:51521: 535 Incorrect authentication data (set_id=services@heipowersystem.com)157.122.199.201814991`  -O% ossec13001h[Exim Auth failed2025-04-17 17:04:51 dovecot_login authenticator failed for ([50.217.40.11]) [50.217.40.11]:45238: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)50.217.40.116252001v  -y' ossec13001h?Exim Auth failed2025-04-17 17:04:23 dovecot_login authenticator failed for ([117.156.96.15]) [117.156.96.15]:59430: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)117.156.96.151814991b  -O) ossec13001hExim Auth failed2025-04-17 16:55:03 dovecot_login authenticator failed for ([103.194.249.82]) [103.194.249.82]:44888: 535 Incorrect authentication data (set_id=vikas.khandelwal)103.194.249.821269750  -' ossec13001hExim Auth failed2025-04-17 16:54:51 dovecot_login authenticator failed for syn-172-090-128-097.res.spectrum.com [172.90.128.97]:63279: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)172.90.128.976252001   L ] e m b5  -M+ ossec13001hExim Auth failed2025-04-17 19:54:23 dovecot_plain authenticator failed for (prasad) [209.105.242.139]:58702: 535 Incorrect authentication data (set_id=admin@heipowersystem.com)209.105.242.1396252001j4  -_) ossec13001h Exim Auth failed2025-04-17 19:39:44 dovecot_login authenticator failed for ([95.221.196.202]) [95.221.196.202]:50712: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)95.221.196.2022017370Z3  -?) ossec13001h Exim Auth failed2025-04-17 19:39:40 dovecot_login authenticator failed for ([79.170.189.164]) [79.170.189.164]:38971: 535 Incorrect authentication data (set_id=purchase)79.170.189.1641220409d2  -Y# ossec13001h Exim Auth failed2025-04-17 19:39:30 dovecot_login authenticator failed for ([27.98.249.9]) [27.98.249.9]:47763: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)27.98.249.91814991Q1  -1% ossec13001h Exim Auth failed2025-04-17 19:39:56 dovecot_login authenticator failed for ([62.76.95.152]) [62.76.95.152]:55314: 535 Incorrect authentication data (set_id=sales)62.76.95.1522017370~0  - ' ossec13001hExim Auth failed2025-04-17 19:19:21 dovecot_login authenticator failed for static-47-190-147-28.dlls.tx.frontiernet.net [47.190.147.28]:62529: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)47.190.147.286252001v/  -y' ossec13001hExim Auth failed2025-04-17 19:19:10 dovecot_login authenticator failed for ([154.81.179.94]) [154.81.179.94]:38708: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)154.81.179.946252001.  - ' ossec13001hExim Auth failed2025-04-17 19:10:09 dovecot_login authenticator failed for (c-50-171-64-170.unallocated.comcastbusiness.net) [50.171.64.170]:52072: 535 Incorrect authentication data (set_id=vikas.khandelwal)50.171.64.1706252001-  -' ossec13001hExim Auth failed2025-04-17 19:09:56 dovecot_login authenticator failed for (cust-72-26-178-196.wireless.t6b.com) [72.26.178.196]:49850: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)72.26.178.1966252001W,  -9) ossec13001hExim Auth failed2025-04-17 18:32:20 dovecot_login authenticator failed for ([175.11.195.249]) [175.11.195.249]:34368: 535 Incorrect authentication data (set_id=sales)175.11.195.2491814991s+  -u% ossec13001hExim Auth failed2025-04-17 18:31:44 dovecot_login authenticator failed for 116-59-8-106.emome-ip.hinet.net [116.59.8.106]:40989: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)116.59.8.1061668284s*  -q) ossec13001h1Exim Auth failed2025-04-17 18:12:25 dovecot_login authenticator failed for (customer-187-237-47-214.uninet-ide.com.mx) [187.237.47.214]:54325: 535 Incorrect authentication data (set_id=purchase)187.237.47.2143996063j)  -a' ossec13001h#Exim Auth failed2025-04-17 18:12:11 dovecot_login authenticator failed for ([103.48.194.21]) [103.48.194.21]:46072: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)103.48.194.211562822F(  -' ossec13001hExim Auth failed2025-04-17 18:12:06 dovecot_login authenticator failed for (netcomafrica.com) [41.67.143.142]:36812: 535 Incorrect authentication data41.67.143.1422328926o'  -m% ossec13001h Exim Auth failed2025-04-17 18:11:47 dovecot_login authenticator failed for 111-70-38-56.emome-ip.hinet.net [111.70.38.56]:35210: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)111.70.38.561668284p&  -q# ossec13001hExim Auth failed2025-04-17 18:11:35 dovecot_login authenticator failed for ([61.233.4.50]) [61.233.4.50]:47518: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)61.233.4.501814991 *\~tj`VLB8.$zpf\H>4*   v l b X N D : 0 &    ~ t j ` V L B 8 . $    z p f \ R H > 4 *  vlbXND:0&|rh^TJ@6,"F xn<d2(ZP~tj`VLB8.$zpf\ | r h ^ T J @ 6 , "    x n d Z P F < 2 (   RRH>4*  vlbXND:0& hD htD hiD h7D hփD hpD hD hD hAD h5D hID h=D hD hD hD hD h D hbD h+D hD hD hD h;D h+D h;D h;D h9D hdD hD hrD hD hD hyD hoD hD hD hD h!D hD hD hD h{D hwD huD hD h}D hD hD hyD huD hD hD hD hyD hwD hD hiD hgD hmD heD hZD hiD hgD hkD heD hmD haD h^D hkD heD hD hD hD hD~ heD} hD| hD{ hDz hDy hDx hDw hxDv hxDu htCDt ht7Ds hrDr hrDq ho#Dp hoDo hjDn hitDm hijDl hfDk hdDj hdDi hbDh hbDg hZDf hYDe hUUDd hU?Dc hSDb hSDa hPD` hPD_ hKrD^ hKdD] hJnD\ hJbD[ hIDZ hEDY hEDX hDyDW hCDV hC~DU h:DT h:DS h6DR h6DQ h6DP h3DO h3DN h+,DM h+#DL h)zDK h)pDJ h&}DI h&oDH h$sDG h$ADF h$3DE hDB hDD hvDC hjDA h^D@ hD? hD> hD= hqD< h D; hD: hD9 hD8 hD7 hYD6 hD5 h D1 h D4 h D3 h D2 hD0 hD/ hD. hD- hD, hD+ h1D* h#D) hD( h D' hD& hD% hD$ hD# hD" hD! hD hcD hD h-D h-D h+~D h+~D h+~D h*D h*D h*oD h'D h&D h"+D h"D h D h D h D hD hD h2D hD hiD h_D hD hD h D h D hD hD hD hD hD hJD h 1 $  { n a T G : -   w j ] P C 6 )    s f Y L ? 2 %  |obUH;.!@}ui]QE9-! ymaUI=1% ymaUI=1% }qeYM 6252001O0 6252001O 6252001O 6252001O 6252001O 6252001O 6252001O 6252001O 6252001O 6252001O 6252001O 6252001O 6252001Ic 6252001I_ 6252001I^ 6252001IX 6252001IW 6252001IM 6252001I@ 6252001I> 6252001I9 6252001I8 6252001I2 6252001I$ 6252001I 6252001H 6252001H 6252001H 6252001H 6252001H 6252001H 6252001H 6252001H 6252001H 6252001H 6252001H 6252001H 6252001H 6252001H 6252001H 6252001H} 6252001Hx 6252001Hq 6252001Ho 6252001Hn 690791^ 690791 690791 690791 690791 690791 690791 690791 690791 690791 Y 690791 G 690791  690791 x 690791 690791 690791 690791 690791 690791 660013J 660013D 660013C 660013> 660013= 660013< 6600134 6600133 660013, 660013* 660013s 660013@ 660013 ^ 660013  660013' 630336/ 630336.> 630336' 630336 e 630336 5 630336u 630336 630336Z 630336 630336 630336 r 630336  630336 6290252F 6290252,Y 6290252 62549308J 6252001O 6252001O 6252001O 6252001O 6252001O 6252001Oa 6252001OX 6252001OU 6252001OJ 6252001OC 6252001O< 6252001O1 6252001O! 6252001O 6252001O 6252001N 6252001N 6252001N 6252001N 6252001N 6252001N 6252001N 6252001N 6252001N 6252001N 6252001N 6252001N 6252001N 6252001N 6252001N 6252001N 6252001N| 6252001Nw 6252001Nk 6252001N[ 6252001NO 6252001NM 6252001NF 6252001NC 6252001N? 6252001N+ 6252001N* 6252001N! 6252001N 6252001N 6252001N 6252001M 6252001M 6252001M 6252001M 6252001M 6252001M 6252001M 6252001M 6252001M 6252001M 6252001M 6252001M 6252001M 6252001M` 6252001MW 6252001ME 6252001M< 6252001M9 6252001M* 6252001M" 6252001M 6252001M 6252001M 6252001M 6252001M 6252001M 6252001L 6252001L 6252001L 6252001L 6252001L 6252001L 6252001L 6252001L 6252001L 6252001Lc 6252001LU 6252001L= 6252001L9 6252001L3 6252001L1 6252001L, 6252001L) 6252001L 6252001L 6252001K 6252001K 6252001K 6252001K 6252001K 6252001K 6252001K 6252001K 6252001K 6252001K 6252001Kf 6252001Kc 6252001K\ 6252001KX 6252001KK 6252001K? 6252001K6 6252001K1 6252001K' 6252001K& 6252001K 6252001K 6252001J 6252001J 6252001J 6252001J 6252001J 6252001J 6252001J 6252001J 6252001J 6252001J 6252001J 6252001Jr 6252001Jj 6252001Jh 6252001Ja 6252001J` 6252001J_ 6252001JT 6252001JR 6252001J@ 6252001J3 6252001J/ 6252001J( 6252001J 6252001J 6252001J 6252001I 6252001I 6252001I 6252001I 6252001I 6252001I 6252001I 6252001I 6252001I 6252001I 6252001I 6252001I 6252001Iv 6252001Ir 6252001Ip 6252001Ih  !.JCUlnh  -k% ossec13001hbExim Auth failed2025-04-18 01:50:36 dovecot_login authenticator failed for 81-226-98-75-no2661.tbcn.telia.com [81.226.98.75]:45469: 535 Incorrect authentication data (set_id=vikas.khandelwal)81.226.98.752661886ug  -u) ossec13001hbExim Auth failed2025-04-18 01:50:26 dovecot_login authenticator failed for ([202.169.56.221]) [202.169.56.221]:59082: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)202.169.56.2211643084hf  -]' ossec13001hZExim Auth failed2025-04-18 01:14:01 dovecot_login authenticator failed for (192-3-159-176-host.colocrossing.com) [192.3.159.176]:42350: 535 Incorrect authentication data (set_id=sales)192.3.159.1766252001de  -W% ossec13001hYExim Auth failed2025-04-18 01:13:38 dovecot_login authenticator failed for ([121.150.85.2]) [121.150.85.2]:44364: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)121.150.85.21835841id  -[+ ossec13001hUUExim Auth failed2025-04-18 00:54:04 dovecot_login authenticator failed for ([183.223.156.154]) [183.223.156.154]:42498: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)183.223.156.1541814991c  -% ossec13001hU?Exim Auth failed2025-04-18 00:53:42 dovecot_login authenticator failed for 1-36-115-211.ptr.netvigator.com [1.36.115.211]:45574: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)1.36.115.2111819730_b  -K' ossec13001hSExim Auth failed2025-04-18 00:44:31 dovecot_login authenticator failed for ([208.77.181.10]) [208.77.181.10]:48112: 535 Incorrect authentication data (set_id=vikas.khandelwal)208.77.181.106252001na  -m% ossec13001hSExim Auth failed2025-04-18 00:44:14 dovecot_login authenticator failed for ([85.122.56.15]) [85.122.56.15]:51683: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)85.122.56.15798549W`  -9) ossec13001hPExim Auth failed2025-04-18 00:34:09 dovecot_login authenticator failed for ([45.118.136.243]) [45.118.136.243]:62302: 535 Incorrect authentication data (set_id=sales)45.118.136.2431562822m_  -c+ ossec13001hPExim Auth failed2025-04-18 00:33:58 dovecot_login authenticator failed for ([196.203.231.220]) [196.203.231.220]:39414: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)196.203.231.2202464461W^  -;' ossec13001hKrExim Auth failed2025-04-18 00:11:54 dovecot_login authenticator failed for ([118.188.18.25]) [118.188.18.25]:10353: 535 Incorrect authentication data (set_id=purchase)118.188.18.251814991]  -) ossec13001hKdExim Auth failed2025-04-18 00:11:40 dovecot_login authenticator failed for (nsg-corporate-34.230.187.122.airtel.in) [122.187.230.34]:52339: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)122.187.230.341269750P\  -/% ossec13001hJnExim Auth failed2025-04-18 00:07:33 dovecot_login authenticator failed for (hn.kd.ny.adsl) [123.7.86.144]:34264: 535 Incorrect authentication data (set_id=sales)123.7.86.1441814991g[  -[' ossec13001hJbExim Auth failed2025-04-18 00:07:21 dovecot_login authenticator failed for ([218.14.180.33]) [218.14.180.33]:39942: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)218.14.180.331814991Z  ?/ ossec1008hIProcess exiting (killed).Apr 18 00:05:29 vm1 spamd[679300]: spamd: server killed by SIGTERM, shutting down`Y  -O% ossec13001hEExim Auth failed2025-04-17 23:47:57 dovecot_login authenticator failed for ([14.39.41.171]) [14.39.41.171]:59999: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)14.39.41.1711835841xX  -}) ossec13001hEExim Auth failed2025-04-17 23:47:45 dovecot_login authenticator failed for ([168.167.55.230]) [168.167.55.230]:37127: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)168.167.55.230933860 * T m OarF  -q' ossec13001h$AExim Auth failed2025-04-17 21:24:39 dovecot_login authenticator failed for syn-024-043-131-106.biz.spectrum.com [24.43.131.106]:49280: 535 Incorrect authentication data (set_id=vikas.khandelwal)24.43.131.1066252001E  - ' ossec13001h$3Exim Auth failed2025-04-17 21:24:26 dovecot_login authenticator failed for 42-200-70-134.static.imsbiz.com [42.200.70.134]:54720: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)42.200.70.1341819730*D  3W+ ossec11301hNew FTP connection.Apr 17 20:47:52 vm1 pure-ftpd[947651]: (?@213.209.150.198) [INFO] New connection from 213.209.150.198213.209.150.1982921044iC  -]) ossec13001hvExim Auth failed2025-04-17 20:47:10 dovecot_login authenticator failed for c-76-136-164-157.hsd1.il.comcast.net [76.136.164.157]:35550: 535 Incorrect authentication data (set_id=sales)76.136.164.1576252001FB  A+ ossec11302hFTP Authentication failed.Apr 17 20:47:58 vm1 pure-ftpd[947651]: (?@213.209.150.198) [WARNING] Authentication failed for user [shubham.kulshreshtha]213.209.150.1982921044pA  -m' ossec13001hjExim Auth failed2025-04-17 20:46:58 dovecot_login authenticator failed for 179-42-124-80.chtch.com.br [179.42.124.80]:42333: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)179.42.124.803469034V@ -7' ossec13001h^Exim Auth failed2025-04-17 20:38:12 dovecot_login authenticator failed for (nyaystambh.com) [221.229.216.1]:53776: 535 Incorrect authentication data (set_id=nologin)221.229.216.11814991f?  -W) ossec13001hExim Auth failed2025-04-17 20:27:00 dovecot_login authenticator failed for ([69.166.171.194]) [69.166.171.194]:54448: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)69.166.171.1946252001s>  -u% ossec13001hExim Auth failed2025-04-17 20:26:40 dovecot_login authenticator failed for ([1.212.225.99]) [1.212.225.99]:38896: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)1.212.225.991835841\=  -G% ossec13001hExim Auth failed2025-04-17 20:17:29 dovecot_login authenticator failed for ([103.4.103.61]) [103.4.103.61]:54833: 535 Incorrect authentication data (set_id=vikas.khandelwal)103.4.103.611168579l<  -i# ossec13001hqExim Auth failed2025-04-17 20:17:12 dovecot_login authenticator failed for ([59.1.240.96]) [59.1.240.96]:37844: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)59.1.240.961835841b;  -M+ ossec13001h Exim Auth failed2025-04-17 19:58:46 dovecot_plain authenticator failed for (prasad) [209.105.242.139]:58249: 535 Incorrect authentication data (set_id=admin@heipowersystem.com)209.105.242.1396252001b:  -M+ ossec13001hExim Auth failed2025-04-17 19:57:42 dovecot_plain authenticator failed for (prasad) [209.105.242.139]:62184: 535 Incorrect authentication data (set_id=admin@heipowersystem.com)209.105.242.1396252001b9  -M+ ossec13001hExim Auth failed2025-04-17 19:56:29 dovecot_plain authenticator failed for (prasad) [209.105.242.139]:64180: 535 Incorrect authentication data (set_id=admin@heipowersystem.com)209.105.242.1396252001Q8  -1% ossec13001hExim Auth failed2025-04-17 19:56:18 dovecot_login authenticator failed for ([183.99.89.74]) [183.99.89.74]:37156: 535 Incorrect authentication data (set_id=sales)183.99.89.741835841j7  -_) ossec13001hExim Auth failed2025-04-17 19:56:07 dovecot_login authenticator failed for ([60.191.239.186]) [60.191.239.186]:40412: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)60.191.239.1861814991b6  -M+ ossec13001hYExim Auth failed2025-04-17 19:55:28 dovecot_plain authenticator failed for (prasad) [209.105.242.139]:51300: 535 Incorrect authentication data (set_id=admin@heipowersystem.com)209.105.242.1396252001 TU j v 'N\rRW  -3% ossec13001hDyExim Auth failed2025-04-17 23:42:09 dovecot_login authenticator failed for (rokamauka.com) [60.2.243.174]:41316: 535 Incorrect authentication data (set_id=nologin)60.2.243.1741814991eV  -S+ ossec13001hCExim Auth failed2025-04-17 23:38:11 dovecot_login authenticator failed for ([196.203.231.220]) [196.203.231.220]:56586: 535 Incorrect authentication data (set_id=vikas.khandelwal)196.203.231.2202464461mU  -m% ossec13001hC~Exim Auth failed2025-04-17 23:37:57 dovecot_login authenticator failed for ([65.20.153.60]) [65.20.153.60]:49300: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)65.20.153.6099237TT  -5' ossec13001h:Exim Auth failed2025-04-17 23:00:58 dovecot_login authenticator failed for ([45.127.120.34]) [45.127.120.34]:46512: 535 Incorrect authentication data (set_id=sales)45.127.120.341269750pS  -o' ossec13001h:Exim Auth failed2025-04-17 23:00:49 dovecot_login authenticator failed for 126-203-29-85.dyn.estpak.ee [85.29.203.126]:41978: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)85.29.203.126453733'R  3S) ossec11301h6New FTP connection.Apr 17 22:43:02 vm1 pure-ftpd[973713]: (?@205.210.31.147) [INFO] New connection from 205.210.31.147205.210.31.1476252001sQ  -q) ossec13001h6Exim Auth failed2025-04-17 22:40:40 dovecot_login authenticator failed for (host-79-164-139-110.qwerty.ru) [79.164.139.110]:53864: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)79.164.139.1102017370xP  -}) ossec13001h6Exim Auth failed2025-04-17 22:40:27 dovecot_login authenticator failed for ([87.200.230.169]) [87.200.230.169]:49414: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)87.200.230.169290557nO  -i' ossec13001h3Exim Auth failed2025-04-17 22:31:28 dovecot_login authenticator failed for 111-70-20-166.emome-ip.hinet.net [111.70.20.166]:59161: 535 Incorrect authentication data (set_id=vikas.khandelwal)111.70.20.1661668284 N  -) ossec13001h3Exim Auth failed2025-04-17 22:31:10 dovecot_login authenticator failed for net-188-152-225-58.cust.vodafonedsl.it [188.152.225.58]:39097: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)188.152.225.583175395WM  -9) ossec13001h+,Exim Auth failed2025-04-17 21:54:12 dovecot_login authenticator failed for ([124.199.29.111]) [124.199.29.111]:52894: 535 Incorrect authentication data (set_id=sales)124.199.29.1111835841uL  -s+ ossec13001h+#Exim Auth failed2025-04-17 21:54:01 dovecot_login authenticator failed for (ip-122-133.bol-online.com) [182.163.122.133]:46105: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)182.163.122.1331210997]K  -K# ossec13001h)zExim Auth failed2025-04-17 21:46:57 dovecot_login authenticator failed for 100.7.61.94.rev.vodafone.pt [94.61.7.100]:24062: 535 Incorrect authentication data (set_id=purchase)94.61.7.1002264397oJ  -i+ ossec13001h)pExim Auth failed2025-04-17 21:46:48 dovecot_login authenticator failed for ([185.255.212.178]) [185.255.212.178]:54798: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)185.255.212.178732800fI  -W) ossec13001h&}Exim Auth failed2025-04-17 21:34:12 dovecot_login authenticator failed for ([58.228.105.192]) [58.228.105.192]:34720: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)58.228.105.1921835841zH  -) ossec13001h&oExim Auth failed2025-04-17 21:33:58 dovecot_login authenticator failed for ([117.240.117.171]) [115.247.81.134]:47142: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)115.247.81.1341269750'G  3S) ossec11301h$sNew FTP connection.Apr 17 21:25:30 vm1 pure-ftpd[956133]: (?@184.105.139.67) [INFO] New connection from 184.105.139.67184.105.139.676252001 S  ] yiYS{  Sg) ossec11000h-Login failed on the cpanel service.[2025-04-18 16:16:36 +0530] info [cpaneld] 156.242.43.237 - msne "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user msne (has_cpuser_file failed)156.242.43.2376252001 z  S}' ossec11000h-Login failed on the cpanel service.[2025-04-18 16:16:31 +0530] info [cpaneld] 156.228.93.87 - msnews24in "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user msnews24in (has_cpuser_file failed)156.228.93.876252001 y  Sy+ ossec11000h-Login failed on the cpanel service.[2025-04-18 16:16:29 +0530] info [cpaneld] 156.228.113.181 - msnews24 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user msnews24 (has_cpuser_file failed)156.228.113.1816252001x  Se+ ossec11000h-Login failed on the cpanel service.[2025-04-18 16:16:27 +0530] info [cpaneld] 156.228.102.246 - crm "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user crm (has_cpuser_file failed)156.228.102.2466252001}w  Sa' ossec11000h-Login failed on the cpanel service.[2025-04-18 16:16:40 +0530] info [cpaneld] 156.228.109.1 - crm "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user crm (has_cpuser_file failed)156.228.109.16252001}v  Sa' ossec11000h-Login failed on the cpanel service.[2025-04-18 16:16:37 +0530] info [cpaneld] 156.228.92.99 - msn "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user msn (has_cpuser_file failed)156.228.92.996252001u  Si' ossec11000h-Login failed on the cpanel service.[2025-04-18 16:16:35 +0530] info [cpaneld] 156.228.92.54 - msnew "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user msnew (has_cpuser_file failed)156.228.92.546252001t  Sm' ossec11000h-Login failed on the cpanel service.[2025-04-18 16:16:34 +0530] info [cpaneld] 156.242.40.24 - msnews "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user msnews (has_cpuser_file failed)156.242.40.246252001s  Ss) ossec11000h-Login failed on the cpanel service.[2025-04-18 16:16:32 +0530] info [cpaneld] 156.242.44.168 - msnews2 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user msnews2 (has_cpuser_file failed)156.242.44.1686252001r  Sk) ossec11000h-Login failed on the cpanel service.[2025-04-18 16:16:28 +0530] info [cpaneld] 156.228.114.50 - admin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)156.228.114.506252001q  Sc) ossec11000h-Login failed on the cpanel service.[2025-04-18 16:16:41 +0530] info [cpaneld] 156.228.103.74 - crm "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user crm (has_cpuser_file failed)156.228.103.746252001Sp  E' ossec2501h+~User authentication failure.Apr 18 16:07:48 vm1 sshd[1198615]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=64.235.45.17864.235.45.1781880251Wo  a ' ossec6003h+~Imunify PAM. The IP has been locked by RBLApr 18 16:07:48 vm1 sshd[1198615]: pam_imunify(sshd:auth): [IM360_RBL] The IP 64.235.45.178 has been locked due to Imunify RBL64.235.45.17818802513n a?' ossec5710h+~Attempt to login using a non-existent userApr 18 16:07:48 vm1 sshd[1198615]: Invalid user bansalparul from 64.235.45.178 port 5760064.235.45.1781880251pm  -o% ossec13001h*Exim Auth failed2025-04-18 16:04:51 dovecot_login authenticator failed for p5b2414be.dip0.t-ipconnect.de (ylmf-pc) [91.36.20.190]:63065: 535 Incorrect authentication data (set_id=administrator)91.36.20.1902921044ql -o% ossec13001h*Exim Auth failed2025-04-18 16:03:42 dovecot_login authenticator failed for p5b2414be.dip0.t-ipconnect.de (ylmf-pc) [91.36.20.190]:61143: 535 Incorrect authentication data (set_id=administrator)91.36.20.1902921044 $ 0 D h T Rv}h}pk  -o% ossec13001h*oExim Auth failed2025-04-18 16:03:19 dovecot_login authenticator failed for p5b2414be.dip0.t-ipconnect.de (ylmf-pc) [91.36.20.190]:59655: 535 Incorrect authentication data (set_id=administrator)91.36.20.1902921044Nj  --# ossec13001h'Exim Auth failed2025-04-18 15:48:56 dovecot_login authenticator failed for (hn.kd.ny.adsl) [218.28.18.2]:40936: 535 Incorrect authentication data (set_id=sales)218.28.18.21814991fi  -W) ossec13001h&Exim Auth failed2025-04-18 15:48:35 dovecot_login authenticator failed for (pc0.zz.ha.cn) [218.28.207.208]:33123: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)218.28.207.2081814991h  -)+ ossec13001h"Exim Auth failed2025-04-18 15:27:47 dovecot_login authenticator failed for (static.ill.117.250.253.141.bsnl.co.in) [117.250.253.137]:38252: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)117.250.253.1371269750tg  -w' ossec13001h"+Exim Auth failed2025-04-18 15:28:02 dovecot_login authenticator failed for (78.188.102.28.static.ttnet.com.tr) [78.188.102.28]:49594: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)78.188.102.28298795Wf  a ' ossec6003h Imunify PAM. The IP has been locked by RBLApr 18 15:22:29 vm1 sshd[1188823]: pam_imunify(sshd:auth): [IM360_RBL] The IP 164.68.114.38 has been locked due to Imunify RBL164.68.114.383017382(e  CI' ossec5716h SSHD authentication failed.Apr 18 15:22:32 vm1 sshd[1188823]: Failed password for root from 164.68.114.38 port 47534 ssh2164.68.114.383017382^d  E3' ossec2501h User authentication failure.Apr 18 15:22:29 vm1 sshd[1188823]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=164.68.114.38 user=root164.68.114.383017382Wc  -9) ossec13001hExim Auth failed2025-04-18 14:39:15 dovecot_login authenticator failed for ([103.186.221.74]) [103.186.221.74]:57248: 535 Incorrect authentication data (set_id=sales)103.186.221.741269750db  -W% ossec13001hExim Auth failed2025-04-18 14:39:03 dovecot_login authenticator failed for ([117.39.63.46]) [117.39.63.46]:34619: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)117.39.63.461814991(a  3U) ossec11301hNew FTP connection.Apr 18 14:36:12 vm1 pure-ftpd[1178788]: (?@198.235.24.207) [INFO] New connection from 198.235.24.207198.235.24.2076252001`  ;) ossec13008h2Mail Recipient rejected2025-04-18 14:36:57 H=(localhost.localdomain) [78.153.140.207]:56462 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no F= rejected RCPT : Sender verify failed78.153.140.2072635167W_  -;' ossec13001hiExim Auth failed2025-04-18 14:25:05 dovecot_login authenticator failed for ([103.107.36.18]) [103.107.36.18]:60994: 535 Incorrect authentication data (set_id=purchase)103.107.36.181269750g^  -]% ossec13001h_Exim Auth failed2025-04-18 14:24:54 dovecot_login authenticator failed for ([182.109.1.49]) [182.109.1.49]:24880: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)182.109.1.491814991a]  -S' ossec13001hExim Auth failed2025-04-18 14:18:36 dovecot_login authenticator failed for ([65.20.251.221]) [65.20.251.221]:42776: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)65.20.251.22199237 \  -) ossec13001hExim Auth failed2025-04-18 14:18:23 dovecot_login authenticator failed for 198-91-129-195.cpe.distributel.net [198.91.129.195]:46438: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)198.91.129.1956251999W[  -9) ossec13001h Exim Auth failed2025-04-18 13:44:13 dovecot_login authenticator failed for ([118.36.234.156]) [118.36.234.156]:58332: 535 Incorrect authentication data (set_id=sales)118.36.234.1561835841 v!E + y ";(v-g a3' ossec5710hIAttempt to login using a non-existent userApr 19 08:36:48 vm1 sshd[1411237]: Invalid user admin from 64.235.45.178 port 3829864.235.45.1781880251Sf  E' ossec2501hIUser authentication failure.Apr 19 08:36:49 vm1 sshd[1411237]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=64.235.45.17864.235.45.1781880251*e  CK) ossec5716h-SSHD authentication failed.Apr 19 08:36:19 vm1 sshd[1411128]: Failed password for root from 82.112.236.245 port 38400 ssh282.112.236.2451269750Yd  a ) ossec6003h+Imunify PAM. The IP has been locked by RBLApr 19 08:36:18 vm1 sshd[1411128]: pam_imunify(sshd:auth): [IM360_RBL] The IP 82.112.236.245 has been locked due to Imunify RBL82.112.236.2451269750)c 3U) ossec11301hENew FTP connection.Apr 19 08:28:12 vm1 pure-ftpd[1409405]: (?@88.218.193.107) [INFO] New connection from 88.218.193.10788.218.193.1072921044Vb  -9' ossec13001hExim Auth failed2025-04-19 08:25:27 dovecot_login authenticator failed for ([102.53.15.180]) [102.53.15.180]:5964: 535 Incorrect authentication data (set_id=purchase)102.53.15.1802542007a  -+ ossec13001hExim Auth failed2025-04-19 08:25:15 dovecot_login authenticator failed for (146.242.161.222.adsl-pool.jlccptt.net.cn) [222.161.242.146]:12509: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)222.161.242.1461814991^`  E3' ossec2501h]User authentication failure.Apr 19 08:24:19 vm1 sshd[1408568]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=164.68.114.38 user=root164.68.114.383017382(_  CI' ossec5716h_SSHD authentication failed.Apr 19 08:24:21 vm1 sshd[1408568]: Failed password for root from 164.68.114.38 port 32968 ssh2164.68.114.383017382W^  a ' ossec6003h]Imunify PAM. The IP has been locked by RBLApr 19 08:24:19 vm1 sshd[1408568]: pam_imunify(sshd:auth): [IM360_RBL] The IP 164.68.114.38 has been locked due to Imunify RBL164.68.114.383017382]  [{' ossec12004hHPossible Dovecot CVE-2019-11500 attemptApr 19 08:19:42 vm1 dovecot[90419]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=18.117.152.93, lip=103.74.54.108, session=<8YjYrxgzfoQSdZhd>18.117.152.936252001S\  E' ossec2501hUser authentication failure.Apr 19 08:16:25 vm1 sshd[1407107]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=64.235.45.17864.235.45.1781880251-[ a3' ossec5710hAttempt to login using a non-existent userApr 19 08:16:24 vm1 sshd[1407107]: Invalid user admin from 64.235.45.178 port 3912664.235.45.1781880251MZ  E! ossec2501hHUser authentication failure.Apr 19 08:15:27 vm1 sshd[1406966]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=62.72.58.662.72.58.61269750-Y a9! ossec5710hHAttempt to login using a non-existent userApr 19 08:15:27 vm1 sshd[1406966]: Invalid user bansalparul from 62.72.58.6 port 4660062.72.58.61269750[X  a + ossec6003h +Imunify PAM. The IP has been locked by RBLApr 19 07:57:53 vm1 sshd[1402376]: pam_imunify(sshd:auth): [IM360_RBL] The IP 194.163.162.155 has been locked due to Imunify RBL194.163.162.15529210441W a7+ ossec5710h )Attempt to login using a non-existent userApr 19 07:57:52 vm1 sshd[1402376]: Invalid user admin from 194.163.162.155 port 34678194.163.162.1552921044WV  E!+ ossec2501h +User authentication failure.Apr 19 07:57:53 vm1 sshd[1402376]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=194.163.162.155194.163.162.1552921044ZU  -?) ossec13001h 5Exim Auth failed2025-04-19 07:53:47 dovecot_login authenticator failed for ([220.77.245.227]) [220.77.245.227]:56834: 535 Incorrect authentication data (set_id=purchase)220.77.245.2271835841 ASd z  W 6Nr 3AmT  -e) ossec13001h %Exim Auth failed2025-04-19 07:53:31 dovecot_login authenticator failed for ([202.117.92.118]) [202.117.92.118]:44228: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)202.117.92.1181814991TS  -5' ossec13001h.Exim Auth failed2025-04-19 07:45:09 dovecot_login authenticator failed for ([27.40.100.238]) [27.40.100.238]:38486: 535 Incorrect authentication data (set_id=sales)27.40.100.2381814991iR  -_) ossec13001h Exim Auth failed2025-04-19 07:44:55 dovecot_login authenticator failed for ([185.101.16.250]) [185.101.16.250]:59759: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)185.101.16.2502721037Q aC+ ossec5710h"Attempt to login using a non-existent userApr 19 07:36:25 vm1 sshd[1398019]: Invalid user bansalparul from 194.163.162.155 port 33314194.163.162.1552921044[P  a + ossec6003h$Imunify PAM. The IP has been locked by RBLApr 19 07:36:26 vm1 sshd[1398019]: pam_imunify(sshd:auth): [IM360_RBL] The IP 194.163.162.155 has been locked due to Imunify RBL194.163.162.1552921044WO  E!+ ossec2501h$User authentication failure.Apr 19 07:36:26 vm1 sshd[1398019]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=194.163.162.155194.163.162.1552921044WN  -9) ossec13001hExim Auth failed2025-04-19 07:34:26 dovecot_login authenticator failed for ([175.202.82.251]) [175.202.82.251]:35316: 535 Incorrect authentication data (set_id=sales)175.202.82.2511835841cM  -W% ossec13001hExim Auth failed2025-04-19 07:34:16 dovecot_login authenticator failed for ([94.200.20.66]) [94.200.20.66]:50815: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)94.200.20.66290557)L a/# ossec5710hAttempt to login using a non-existent userApr 19 07:30:32 vm1 sshd[1396929]: Invalid user admin from 94.72.97.36 port 5159494.72.97.362635167OK  E# ossec2501hUser authentication failure.Apr 19 07:30:32 vm1 sshd[1396929]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=94.72.97.3694.72.97.362635167SJ  a# ossec6003hImunify PAM. The IP has been locked by RBLApr 19 07:30:32 vm1 sshd[1396929]: pam_imunify(sshd:auth): [IM360_RBL] The IP 94.72.97.36 has been locked due to Imunify RBL94.72.97.362635167BI  gU) ossec11307hlMultiple connection attempts from same sourceApr 19 07:29:05 vm1 pure-ftpd[1396436]: (?@199.45.154.156) [INFO] New connection from 199.45.154.156199.45.154.1566252001)H 3U) ossec11301hjNew FTP connection.Apr 19 07:29:03 vm1 pure-ftpd[1396432]: (?@199.45.154.156) [INFO] New connection from 199.45.154.156199.45.154.1566252001)G 3U) ossec11301hbNew FTP connection.Apr 19 07:28:56 vm1 pure-ftpd[1396391]: (?@199.45.154.156) [INFO] New connection from 199.45.154.156199.45.154.1566252001VF  -;' ossec13001hExim Auth failed2025-04-19 07:08:12 dovecot_login authenticator failed for ([80.227.99.162]) [80.227.99.162]:48231: 535 Incorrect authentication data (set_id=purchase)80.227.99.162290557gE  -]% ossec13001hpExim Auth failed2025-04-19 07:07:51 dovecot_login authenticator failed for ([12.202.15.69]) [12.202.15.69]:22869: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)12.202.15.696252001eD  -W' ossec13001h=Exim Auth failed2025-04-19 06:37:08 dovecot_login authenticator failed for (as135139-cbe.skylinkfibernet.com) [103.99.148.77]:41426: 535 Incorrect authentication data (set_id=sales)103.99.148.771269750jC  -_) ossec13001h3Exim Auth failed2025-04-19 06:36:57 dovecot_login authenticator failed for ([43.230.131.140]) [43.230.131.140]:34576: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)43.230.131.1401643084(B  3U) ossec11301hNew FTP connection.Apr 19 05:48:38 vm1 pure-ftpd[1375265]: (?@167.94.138.192) [INFO] New connection from 167.94.138.192167.94.138.1926252001 L#| ^ g | K8LgZ  -[' ossec13001h Exim Auth failed2025-04-18 13:43:50 dovecot_login authenticator failed for ([118.188.18.25]) [118.188.18.25]:49123: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)118.188.18.251814991ZY  -=+ ossec13001hExim Auth failed2025-04-18 13:30:29 dovecot_login authenticator failed for ([202.137.254.237]) [202.137.254.237]:50406: 535 Incorrect authentication data (set_id=sales)202.137.254.2371269750vX  -y' ossec13001hExim Auth failed2025-04-18 13:30:13 dovecot_login authenticator failed for (134.56.58.179.hwccustomers.com) [134.56.58.179]:49923: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)134.56.58.1796252001W  -' ossec13001hExim Auth failed2025-04-18 13:09:47 dovecot_login authenticator failed for (abts-del-dynamic-246.48.77.182.airtelbroadband.in) [182.77.48.246]:65063: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)182.77.48.2461269750sV  -u% ossec13001hExim Auth failed2025-04-18 13:09:37 dovecot_login authenticator failed for ([223.82.97.51]) [223.82.97.51]:42062: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)223.82.97.511814991(U  3U) ossec11301hNew FTP connection.Apr 18 12:49:44 vm1 pure-ftpd[1157041]: (?@66.240.236.116) [INFO] New connection from 66.240.236.11666.240.236.1166252001WT  -9) ossec13001hJExim Auth failed2025-04-18 12:20:49 dovecot_login authenticator failed for ([220.94.166.230]) [220.94.166.230]:48392: 535 Incorrect authentication data (set_id=sales)220.94.166.2301835841{S  -) ossec13001h<Exim Auth failed2025-04-18 12:20:35 dovecot_login authenticator failed for dsl-trebng12-b0489e-163.dhcp.inet.fi [176.72.158.163]:35652: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)176.72.158.163660013)R 3U) ossec11301hNew FTP connection.Apr 18 12:13:34 vm1 pure-ftpd[1149239]: (?@139.162.119.94) [INFO] New connection from 139.162.119.94139.162.119.941861060(Q  3U) ossec11301h7New FTP connection.Apr 18 12:11:58 vm1 pure-ftpd[1148395]: (?@139.162.119.94) [INFO] New connection from 139.162.119.94139.162.119.941861060(P  3U) ossec11301hNew FTP connection.Apr 18 12:10:16 vm1 pure-ftpd[1148082]: (?@139.162.119.94) [INFO] New connection from 139.162.119.94139.162.119.941861060rO  -s% ossec13001hjExim Auth failed2025-04-18 12:04:17 dovecot_login authenticator failed for (amplifypowerglobal.com) [119.96.131.8]:60378: 535 Incorrect authentication data (set_id=service@amplifypowerglobal.com)119.96.131.81814991[N  -E% ossec13001hSExim Auth failed2025-04-18 12:03:53 dovecot_login authenticator failed for (amplifypowerglobal.com) [119.96.131.8]:57148: 535 Incorrect authentication data (set_id=nologin)119.96.131.81814991fM  -W) ossec13001h~Exim Auth failed2025-04-18 12:00:21 dovecot_login authenticator failed for ([190.117.96.174]) [190.117.96.174]:41358: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)190.117.96.1743932488rL  -u% ossec13001hrExim Auth failed2025-04-18 12:00:09 dovecot_login authenticator failed for ([185.226.88.5]) [185.226.88.5]:58420: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)185.226.88.5783754K  ;5% ossec13008h5Mail Recipient rejected2025-04-18 11:37:48 H=static-185-95-84-71.sunucuhub.com [185.95.84.71]:49432 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no F= rejected RCPT : Sender verify failed185.95.84.71298795"J  3M% ossec11301hNew FTP connection.Apr 18 11:35:11 vm1 pure-ftpd[1140483]: (?@103.74.54.23) [INFO] New connection from 103.74.54.23103.74.54.231269750XI  -;) ossec13001h7Exim Auth failed2025-04-18 11:12:14 dovecot_login authenticator failed for ([193.111.124.226]) [103.139.10.248]:24081: 535 Incorrect authentication data (set_id=sales)103.139.10.2481643084 3 Q  ,Ps cW0  -;' ossec13001h@Exim Auth failed2025-04-19 01:55:35 dovecot_login authenticator failed for ([183.182.99.92]) [183.182.99.92]:41435: 535 Incorrect authentication data (set_id=purchase)183.182.99.921655842/  W) ossec9708hDovecot Aborted Login with empty userApr 19 01:53:57 vm1 dovecot[90419]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=101.36.106.134, lip=103.74.54.108, session=101.36.106.1341819730%.  3Q' ossec11301hNew FTP connection.Apr 19 01:31:44 vm1 pure-ftpd[1320157]: (?@91.238.181.92) [INFO] New connection from 91.238.181.9291.238.181.923017382%-  3Q' ossec11301hwNew FTP connection.Apr 19 01:09:34 vm1 pure-ftpd[1314878]: (?@198.235.24.58) [INFO] New connection from 198.235.24.58198.235.24.586252001S,  E' ossec2501hUser authentication failure.Apr 19 01:07:42 vm1 sshd[1314575]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=164.68.114.38164.68.114.383017382-+ a3' ossec5710hAttempt to login using a non-existent userApr 19 01:07:41 vm1 sshd[1314575]: Invalid user admin from 164.68.114.38 port 55626164.68.114.383017382W*  a ' ossec6003hImunify PAM. The IP has been locked by RBLApr 19 01:07:42 vm1 sshd[1314575]: pam_imunify(sshd:auth): [IM360_RBL] The IP 164.68.114.38 has been locked due to Imunify RBL164.68.114.383017382X) -?% ossec13001h{Exim Auth failed2025-04-19 01:05:23 dovecot_login authenticator failed for (User) [171.22.28.26]:44248: 535 Incorrect authentication data (set_id=admin01@technobases.in)171.22.28.26732800W( -=% ossec13001hCExim Auth failed2025-04-19 01:04:27 dovecot_login authenticator failed for (User) [171.22.28.26]:38648: 535 Incorrect authentication data (set_id=696969@technobases.in)171.22.28.26732800Q'  -3% ossec13001h%Exim Auth failed2025-04-19 01:03:57 dovecot_login authenticator failed for (User) [171.22.28.26]:58448: 535 Incorrect authentication data (set_id=0@technobases.in)171.22.28.26732800R&  -5' ossec13001h[Exim Auth failed2025-04-19 01:00:33 dovecot_login authenticator failed for ([65.20.155.223]) [65.20.155.223]:49090: 535 Incorrect authentication data (set_id=sales)65.20.155.22399237d%  -W% ossec13001hIExim Auth failed2025-04-19 01:00:16 dovecot_login authenticator failed for ([121.150.85.2]) [121.150.85.2]:39984: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)121.150.85.21835841V$  ;)) ossec13008hMail Recipient rejected2025-04-19 00:57:38 H=(mail.amplifypowerglobal.com) [165.154.242.42]:57858 F= rejected RCPT : Rejected relay attempt: '165.154.242.42' From: 'ftofshu@amplifypowerglobal.com' To: 'validxxx@gmailhotmail.com.br'165.154.242.421694008%#  3Q' ossec11301hNew FTP connection.Apr 19 00:16:11 vm1 pure-ftpd[1303815]: (?@183.56.192.74) [INFO] New connection from 183.56.192.74183.56.192.741814991"  ?/ ossec1008hProcess exiting (killed).Apr 19 00:06:31 vm1 spamd[993963]: spamd: server killed by SIGTERM, shutting down]!  -I' ossec13001h[Exim Auth failed2025-04-18 23:52:18 dovecot_login authenticator failed for 95-87-225-236.ip.btc-net.bg [95.87.225.236]:35756: 535 Incorrect authentication data (set_id=sales)95.87.225.236732800g  -[' ossec13001hQExim Auth failed2025-04-18 23:52:08 dovecot_login authenticator failed for ([61.241.114.78]) [61.241.114.78]:47985: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)61.241.114.781814991\ -E% ossec13001hdExim Auth failed2025-04-18 23:39:40 dovecot_login authenticator failed for (amplifypowerglobal.com) [150.5.145.36]:36276: 535 Incorrect authentication data (set_id=nologin)150.5.145.361880251  k%  -g# ossec13001hExim Auth failed2025-04-18 06:25:05 dovecot_login authenticator failed for (n51-h64.smr-rsk.metromax.ru) [81.22.51.64]:56666: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)81.22.51.642017370$  -' ossec13001hExim Auth failed2025-04-18 06:24:48 dovecot_login authenticator failed for 42-200-70-134.static.imsbiz.com [42.200.70.134]:51826: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)42.200.70.1341819730s#  -u% ossec13001hExim Auth failed2025-04-18 06:24:39 dovecot_login authenticator failed for ([61.141.69.10]) [61.141.69.10]:45534: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)61.141.69.101814991]"  -C+ ossec13001h!Exim Auth failed2025-04-18 05:26:15 dovecot_login authenticator failed for ([183.105.138.168]) [183.105.138.168]:56060: 535 Incorrect authentication data (set_id=purchase)183.105.138.1681835841g!  -]% ossec13001hExim Auth failed2025-04-18 05:26:03 dovecot_login authenticator failed for ([112.78.1.149]) [112.78.1.149]:43944: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)112.78.1.1491562822  ;) ossec13008hMail Recipient rejected2025-04-18 05:25:28 H=(localhost.localdomain) [78.153.140.207]:36806 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no F= rejected RCPT : Sender verify failed78.153.140.2072635167  Sc) ossec11000hLogin failed on the cpanel service.[2025-04-18 05:19:18 +0530] info [cpaneld] 156.248.80.155 - hei "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user hei (has_cpuser_file failed)156.248.80.1556252001  Sg) ossec11000h{Login failed on the cpanel service.[2025-04-18 05:19:14 +0530] info [cpaneld] 156.242.33.255 - heip "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heip (has_cpuser_file failed)156.242.33.2556252001  So) ossec11000hwLogin failed on the cpanel service.[2025-04-18 05:19:09 +0530] info [cpaneld] 156.228.110.94 - heipow "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipow (has_cpuser_file failed)156.228.110.946252001  Ss) ossec11000huLogin failed on the cpanel service.[2025-04-18 05:19:07 +0530] info [cpaneld] 154.213.160.26 - heipowe "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipowe (has_cpuser_file failed)154.213.160.266252001  Se+ ossec11000hLogin failed on the cpanel service.[2025-04-18 05:19:22 +0530] info [cpaneld] 156.228.118.183 - crm "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user crm (has_cpuser_file failed)156.228.118.1836252001  Sg) ossec11000h}Login failed on the cpanel service.[2025-04-18 05:19:16 +0530] info [cpaneld] 156.228.96.125 - heip "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heip (has_cpuser_file failed)156.228.96.1256252001}  S_) ossec11000hLogin failed on the cpanel service.[2025-04-18 05:19:20 +0530] info [cpaneld] 156.242.44.247 - he "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user he (has_cpuser_file failed)156.242.44.2476252001  Sa+ ossec11000hLogin failed on the cpanel service.[2025-04-18 05:19:20 +0530] info [cpaneld] 156.228.116.203 - he "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user he (has_cpuser_file failed)156.228.116.2036252001  Si' ossec11000hyLogin failed on the cpanel service.[2025-04-18 05:19:11 +0530] info [cpaneld] 156.242.38.59 - heipo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipo (has_cpuser_file failed)156.242.38.596252001 V< ; Y d q 8ZbNVs7  -u% ossec13001h Exim Auth failed2025-04-18 08:37:56 dovecot_login authenticator failed for ([77.41.156.64]) [77.41.156.64]:54722: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)77.41.156.6420173706  3I# ossec11301hbNew FTP connection.Apr 18 08:30:48 vm1 pure-ftpd[1101470]: (?@65.49.1.107) [INFO] New connection from 65.49.1.10765.49.1.10762520015  W) ossec9708h+Dovecot Aborted Login with empty userApr 18 08:12:50 vm1 dovecot[90419]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=101.36.106.134, lip=103.74.54.108, TLS, session=101.36.106.1341819730S4  E' ossec2501hUser authentication failure.Apr 18 08:05:58 vm1 sshd[1096252]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=164.68.114.38164.68.114.383017382W3  a ' ossec6003hImunify PAM. The IP has been locked by RBLApr 18 08:05:58 vm1 sshd[1096252]: pam_imunify(sshd:auth): [IM360_RBL] The IP 164.68.114.38 has been locked due to Imunify RBL164.68.114.38301738262 aE' ossec5710hAttempt to login using a non-existent userApr 18 08:05:58 vm1 sshd[1096252]: Invalid user bansalparul900 from 164.68.114.38 port 48850164.68.114.383017382Z1  -=+ ossec13001h;Exim Auth failed2025-04-18 07:51:47 dovecot_login authenticator failed for ([123.139.116.184]) [123.139.116.184]:37428: 535 Incorrect authentication data (set_id=sales)123.139.116.1841814991s0  -u% ossec13001h+Exim Auth failed2025-04-18 07:51:31 dovecot_login authenticator failed for 111-70-51-60.emome-ip.hinet.net [111.70.51.60]:36973: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)111.70.51.601668284Y/  a ) ossec6003h;Imunify PAM. The IP has been locked by RBLApr 18 07:38:56 vm1 sshd[1090650]: pam_imunify(sshd:auth): [IM360_RBL] The IP 193.164.133.17 has been locked due to Imunify RBL193.164.133.172921044U.  E) ossec2501h;User authentication failure.Apr 18 07:38:56 vm1 sshd[1090650]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.164.133.17193.164.133.172921044/- a5) ossec5710h9Attempt to login using a non-existent userApr 18 07:38:56 vm1 sshd[1090650]: Invalid user admin from 193.164.133.17 port 46150193.164.133.172921044&, 3Q' ossec11301hdNew FTP connection.Apr 18 07:35:24 vm1 pure-ftpd[1089971]: (?@152.32.211.35) [INFO] New connection from 152.32.211.35152.32.211.351819730n+  -k% ossec13001hExim Auth failed2025-04-18 07:31:42 dovecot_login authenticator failed for d75-157-64-35.bchsia.telus.net [75.157.64.35]:48690: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)75.157.64.356251999p*  -q# ossec13001hrExim Auth failed2025-04-18 07:31:22 dovecot_login authenticator failed for ([59.1.240.96]) [59.1.240.96]:54072: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)59.1.240.961835841])  -I% ossec13001hExim Auth failed2025-04-18 06:55:24 dovecot_login authenticator failed for (host24.helenandrews.com) [63.116.23.24]:59346: 535 Incorrect authentication data (set_id=purchase)63.116.23.246252001|(  -) ossec13001hExim Auth failed2025-04-18 06:54:56 dovecot_login authenticator failed for 220-135-116-94.hinet-ip.hinet.net [220.135.116.94]:43184: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)220.135.116.941668284P'  -1% ossec13001hyExim Auth failed2025-04-18 06:44:33 dovecot_login authenticator failed for ([37.25.34.200]) [37.25.34.200]:49146: 535 Incorrect authentication data (set_id=sales)37.25.34.200294640j&  -_) ossec13001hoExim Auth failed2025-04-18 06:44:22 dovecot_login authenticator failed for ([103.99.184.170]) [103.99.184.170]:12298: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)103.99.184.1701269750 "   - , MDnTF>4&"  Sc) ossec11000heLogin failed on the cpanel service.[2025-04-18 05:18:51 +0530] info [cpaneld] 156.248.87.176 - crm "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user crm (has_cpuser_file failed)156.248.87.1766252001   Sw) ossec11000hmLogin failed on the cpanel service.[2025-04-18 05:18:59 +0530] info [cpaneld] 156.228.117.46 - heipowe2 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipowe2 (has_cpuser_file failed)156.228.117.466252001  Sm+ ossec11000haLogin failed on the cpanel service.[2025-04-18 05:18:46 +0530] info [cpaneld] 156.228.119.159 - admin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)156.228.119.1596252001  Sk) ossec11000h^Login failed on the cpanel service.[2025-04-18 05:18:46 +0530] info [cpaneld] 156.248.84.166 - admin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)156.248.84.1666252001   Sw) ossec11000hkLogin failed on the cpanel service.[2025-04-18 05:18:58 +0530] info [cpaneld] 156.242.47.248 - heipowe1 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipowe1 (has_cpuser_file failed)156.242.47.2486252001  S) ossec11000heLogin failed on the cpanel service.[2025-04-18 05:18:51 +0530] info [cpaneld] 156.242.37.177 - heipowersystem "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipowersystem (has_cpuser_file failed)156.242.37.1776252001Q  -1% ossec13001hExim Auth failed2025-04-18 04:55:08 dovecot_login authenticator failed for ([124.216.0.10]) [124.216.0.10]:33808: 535 Incorrect authentication data (set_id=sales)124.216.0.101835841  -+ ossec13001hExim Auth failed2025-04-18 04:54:51 dovecot_login authenticator failed for (159.14.132.112.adsl-pool.ah.cnuninet.net) [112.123.199.111]:54860: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)112.123.199.1111814991Z  -?) ossec13001hExim Auth failed2025-04-18 04:42:43 dovecot_login authenticator failed for ([116.114.84.242]) [116.114.84.242]:47160: 535 Incorrect authentication data (set_id=purchase)116.114.84.2421814991|~  -) ossec13001hExim Auth failed2025-04-18 04:42:20 dovecot_login authenticator failed for 83-233-242-245.cust.bredband2.com [83.233.242.245]:50900: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)83.233.242.2452661886f}  -[' ossec13001heExim Auth failed2025-04-18 04:31:56 dovecot_login authenticator failed for ([185.167.59.53]) [185.167.59.53]:33292: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)185.167.59.53617790e|  -W) ossec13001hExim Auth failed2025-04-18 04:12:26 dovecot_login authenticator failed for ([87.200.230.169]) [87.200.230.169]:44163: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)87.200.230.169290557}{  - % ossec13001hExim Auth failed2025-04-18 04:12:13 dovecot_login authenticator failed for (178x78x28x55.dynamic.krasnodar.ertelecom.ru) [178.78.28.55]:56328: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)178.78.28.552017370yz  -}) ossec13001hExim Auth failed2025-04-18 04:11:57 dovecot_login authenticator failed for ([220.182.11.126]) [220.182.11.126]:40930: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)220.182.11.1261814991yy  -' ossec13001hExim Auth failed2025-04-18 04:03:06 dovecot_login authenticator failed for vps-b674cd8d.vps.ovh.net [51.68.226.171]:34248: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)51.68.226.1713017382 k 4 H o PtyvGIakqH  -o' ossec13001h+Exim Auth failed2025-04-18 11:12:03 dovecot_login authenticator failed for d5152f9ea.static.telenet.be [81.82.249.234]:46424: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)81.82.249.2342802361cG  -S' ossec13001hExim Auth failed2025-04-18 10:52:07 dovecot_login authenticator failed for ([222.76.248.54]) [222.76.248.54]:45920: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)222.76.248.541814991yF  -}) ossec13001htExim Auth failed2025-04-18 10:51:55 dovecot_login authenticator failed for ([67.213.230.122]) [67.213.230.122]:42377: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)67.213.230.1226252001(E  3U) ossec11301hiNew FTP connection.Apr 18 10:34:40 vm1 pure-ftpd[1127855]: (?@18.188.188.127) [INFO] New connection from 18.188.188.12718.188.188.1276252001(D  3U) ossec11301h7New FTP connection.Apr 18 10:29:33 vm1 pure-ftpd[1126702]: (?@18.188.188.127) [INFO] New connection from 18.188.188.12718.188.188.1276252001gC  -[' ossec13001hփExim Auth failed2025-04-18 10:05:15 dovecot_login authenticator failed for 083.46.246.220.static.netvigator.com [220.246.46.83]:56017: 535 Incorrect authentication data (set_id=sales)220.246.46.831819730dB  -W% ossec13001hpExim Auth failed2025-04-18 10:04:55 dovecot_login authenticator failed for ([47.83.30.238]) [47.83.30.238]:35496: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)47.83.30.2381819730~A  - % ossec13001hExim Auth failed2025-04-18 09:45:14 dovecot_login authenticator failed for (dynamicip-95-79-108-51.pppoe.nn.ertelecom.ru) [95.79.108.51]:37571: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)95.79.108.512017370v@  -y' ossec13001hExim Auth failed2025-04-18 09:45:03 dovecot_login authenticator failed for ([182.213.57.49]) [182.213.57.49]:34535: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)182.213.57.491835841W?  -=% ossec13001hAExim Auth failed2025-04-18 09:21:28 dovecot_login authenticator failed for ([114.242.175.187]) [36.112.75.46]:10120: 535 Incorrect authentication data (set_id=purchase)36.112.75.461814991>  -A' ossec13001h5Exim Auth failed2025-04-18 09:21:16 dovecot_login authenticator failed for 47-206-63-169.e8235131806a02dcb1fe9c7a57eaaeb8.ip.frontiernet.net [47.206.63.169]:34606: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)47.206.63.1696252001T=  -5' ossec13001hIExim Auth failed2025-04-18 09:17:19 dovecot_login authenticator failed for ([183.182.99.92]) [183.182.99.92]:40629: 535 Incorrect authentication data (set_id=sales)183.182.99.921655842g<  -[' ossec13001h=Exim Auth failed2025-04-18 09:17:08 dovecot_login authenticator failed for ([102.53.15.180]) [102.53.15.180]:40497: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)102.53.15.1802542007R;  -1' ossec13001hExim Auth failed2025-04-18 08:58:38 dovecot_login authenticator failed for (hn.kd.ny.adsl) [123.13.237.76]:35394: 535 Incorrect authentication data (set_id=sales)123.13.237.761814991p:  -o% ossec13001hExim Auth failed2025-04-18 08:58:24 dovecot_login authenticator failed for (dynamic-ip-adsl.viettel.vn) [117.2.123.19]:44460: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)117.2.123.1915628229  ;) ossec13008hMail Recipient rejected2025-04-18 08:46:04 H=(localhost.localdomain) [78.153.140.207]:34672 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no F= rejected RCPT : Sender verify failed78.153.140.2072635167g8  -Y) ossec13001hExim Auth failed2025-04-18 08:38:11 dovecot_login authenticator failed for ([101.230.251.217]) [222.67.234.113]:19491: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)222.67.234.1131814991 D zplbXTPND  Sq' ossec11000huLogin failed on the cpanel service.[2025-04-18 05:19:07 +0530] info [cpaneld] 156.228.97.48 - heipowe "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipowe (has_cpuser_file failed)156.228.97.486252001}  Sa' ossec11000hLogin failed on the cpanel service.[2025-04-18 05:19:27 +0530] info [cpaneld] 156.248.83.87 - crm "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user crm (has_cpuser_file failed)156.248.83.876252001  Sc) ossec11000hLogin failed on the cpanel service.[2025-04-18 05:19:24 +0530] info [cpaneld] 156.228.102.69 - crm "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user crm (has_cpuser_file failed)156.228.102.696252001  Sc) ossec11000hLogin failed on the cpanel service.[2025-04-18 05:19:18 +0530] info [cpaneld] 156.228.80.168 - hei "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user hei (has_cpuser_file failed)156.228.80.1686252001  Sm+ ossec11000hyLogin failed on the cpanel service.[2025-04-18 05:19:11 +0530] info [cpaneld] 154.213.167.122 - heipo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipo (has_cpuser_file failed)154.213.167.1226252001  So) ossec11000hwLogin failed on the cpanel service.[2025-04-18 05:19:09 +0530] info [cpaneld] 156.228.88.165 - heipow "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipow (has_cpuser_file failed)156.228.88.1656252001  Sc) ossec11000hLogin failed on the cpanel service.[2025-04-18 05:19:29 +0530] info [cpaneld] 156.228.93.109 - crm "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user crm (has_cpuser_file failed)156.228.93.1096252001  Ss% ossec11000hiLogin failed on the cpanel service.[2025-04-18 05:18:56 +0530] info [cpaneld] 154.214.1.43 - heipower "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipower (has_cpuser_file failed)154.214.1.436252001  S) ossec11000hgLogin failed on the cpanel service.[2025-04-18 05:18:53 +0530] info [cpaneld] 156.242.39.193 - heipowersystemcom "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipowersystemcom (has_cpuser_file failed)156.242.39.1936252001  Sy+ ossec11000hmLogin failed on the cpanel service.[2025-04-18 05:19:00 +0530] info [cpaneld] 156.228.114.225 - heipowe2 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipowe2 (has_cpuser_file failed)156.228.114.2256252001  S ' ossec11000heLogin failed on the cpanel service.[2025-04-18 05:18:51 +0530] info [cpaneld] 156.228.77.87 - heipowersystem "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipowersystem (has_cpuser_file failed)156.228.77.876252001}  Sa' ossec11000hZLogin failed on the cpanel service.[2025-04-18 05:18:42 +0530] info [cpaneld] 156.228.77.35 - crm "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user crm (has_cpuser_file failed)156.228.77.356252001  Sy+ ossec11000hiLogin failed on the cpanel service.[2025-04-18 05:18:55 +0530] info [cpaneld] 154.213.164.165 - heipower "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipower (has_cpuser_file failed)154.213.164.1656252001  S' ossec11000hgLogin failed on the cpanel service.[2025-04-18 05:18:54 +0530] info [cpaneld] 156.228.81.57 - heipowersystemcom "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipowersystemcom (has_cpuser_file failed)156.228.81.576252001   Sw) ossec11000hkLogin failed on the cpanel service.[2025-04-18 05:18:57 +0530] info [cpaneld] 156.228.124.54 - heipowe1 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipowe1 (has_cpuser_file failed)156.228.124.546252001   V p  rx  -q' ossec13001hExim Auth failed2025-04-18 04:02:57 dovecot_login authenticator failed for ([217.24.185.98]) [217.24.185.98]:40798: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)217.24.185.982017370w  -' ossec13001hExim Auth failed2025-04-18 04:02:43 dovecot_login authenticator failed for (23-94-179-104-host.colocrossing.com) [23.94.179.104]:39572: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)23.94.179.1046252001Tv  -5' ossec13001hxExim Auth failed2025-04-18 03:25:58 dovecot_login authenticator failed for ([183.171.53.82]) [183.171.53.82]:60606: 535 Incorrect authentication data (set_id=sales)183.171.53.821733045u  - % ossec13001hxExim Auth failed2025-04-18 03:25:45 dovecot_login authenticator failed for (74-95-13-185-SFBA.hfc.comcastbusiness.net) [74.95.13.185]:53203: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)74.95.13.1856252001ct  -S' ossec13001htCExim Auth failed2025-04-18 03:06:02 dovecot_login authenticator failed for ([103.134.208.1]) [163.47.36.198]:62271: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)163.47.36.1981210997ys  -}) ossec13001ht7Exim Auth failed2025-04-18 03:05:50 dovecot_login authenticator failed for ([182.162.21.202]) [182.162.21.202]:39382: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)182.162.21.2021835841br  -O) ossec13001hrExim Auth failed2025-04-18 02:56:44 dovecot_login authenticator failed for ([222.173.82.198]) [222.173.82.198]:51422: 535 Incorrect authentication data (set_id=vikas.khandelwal)222.173.82.1981814991lq  -i# ossec13001hrExim Auth failed2025-04-18 02:56:30 dovecot_login authenticator failed for ([64.53.7.231]) [64.53.7.231]:57710: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)64.53.7.2316252001Wp  -;' ossec13001ho#Exim Auth failed2025-04-18 02:44:10 dovecot_login authenticator failed for ([103.47.74.210]) [103.47.74.210]:34026: 535 Incorrect authentication data (set_id=purchase)103.47.74.2101269750}o  -+ ossec13001hoExim Auth failed2025-04-18 02:43:51 dovecot_login authenticator failed for (165-220-130-160.cust.exede.net) [165.220.130.160]:56328: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)165.220.130.1602510769n  Su) ossec11000hjLogin failed on the cpanel service.[2025-04-18 02:22:16 +0530] info [cpaneld] 94.249.171.109 - heipowersystem "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipowersystem (has_cpuser_file failed)94.249.171.1093017382Wm  -9) ossec13001hitExim Auth failed2025-04-18 02:19:55 dovecot_login authenticator failed for ([47.238.172.205]) [47.238.172.205]:34482: 535 Incorrect authentication data (set_id=sales)47.238.172.2051819730al  -S# ossec13001hijExim Auth failed2025-04-18 02:19:44 dovecot_login authenticator failed for ([94.251.8.83]) [94.251.8.83]:60644: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)94.251.8.832017370%k  3Q' ossec11301hfNew FTP connection.Apr 18 02:05:36 vm1 pure-ftpd[1020749]: (?@206.168.34.62) [INFO] New connection from 206.168.34.62206.168.34.626252001zj  -' ossec13001hdExim Auth failed2025-04-18 02:00:01 dovecot_login authenticator failed for (6.105.141.116.adsl-pool.jlccptt.net.cn) [116.141.105.6]:55750: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)116.141.105.61814991|i  -+ ossec13001hdExim Auth failed2025-04-18 01:59:47 dovecot_login authenticator failed for ([103.158.138.179]) [103.158.138.179]:57728: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)103.158.138.1791269750 *\~tj`VLB8.$zpf\H>4*   v l b X N D : 0 &    ~ t j ` V L B 8 . $    z p f \ R H > 4 *   vlbXND:0&|rh^TJ@6",xndZPF<2( ~t`jVLB8.$zpf\ | r h ^ T J @ 6 , "    x n d Z P F < 2 (   RRH>4*  vlbXND:0& hE hE hE hVE hDE hE hE hE hE hE hE hVE hPE hPE hPE hIE hCE hYE hYE hWE h}fE h}fE h}fE h|zE h|jE h|ZE hz%E hz'E hyWE hvE hvpE hvHE hvHE hvHE hr]E ho)E hnE hnE hmDE hm:E hfnE hfE hbkE hbOE h`E h`E h`E h`uE h`uE h`uE h`gE h`gE h`[E h`WE h`SE h_BE h_mE hZE hZE hVE hVE hTE hP1E hNfE hNTE hIE hIE hGE hGE hFE hFE hFE hFE hEE hBE hBE hBE hByE hBUE h=E h=E h6E h6E h6E h6E h6E h5E h5E h2_E h2_E h2_E h0E h0E h0E h/bE h-~E h-|E h-|E h*E h*E h*E h(E h(E h(E h&E h&E h&E h%E h%E h%E h%E h%E h$E h$E h$E h"E h"E~ h"E} h!E| h!E{ h!Ez h )Ey h )Ex h )Ew hEv hEu hEt h!Es h!Er h!Eq hEp hEo hEn hEm hEl h hE= hE< hE; hE: hE9 hƴE8 hÊE7 hzE6 h3E5 h/E4 hE3 hE2 h@E0 h.E1 hE/ hE. hwE- hE, hE+ hE* h{E) hCE( h%E' h[E& hIE% hE$ hE# hE" h[E! hQE hdE hMF h&E hE hE hE hE hME h?E hpcE hhCE hh/E hh E hcE hYE hYE hXE hWE hWE hWE hWE hJ)E hI{E hIeE hGE hGE hCE h@E h@E h8?E h83E h7?E h73E h4D h.zD h.vD h-D h-D h-D h-D h-D h-D h-D h-D S ~ !5Vm  -e) ossec13001hWExim Auth failed2025-04-18 19:16:38 dovecot_login authenticator failed for ([190.223.53.234]) [190.223.53.234]:58084: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)190.223.53.2343932488"  3M% ossec11301hJ)New FTP connection.Apr 18 18:18:40 vm1 pure-ftpd[1227223]: (?@20.84.147.41) [INFO] New connection from 20.84.147.4120.84.147.416252001Z  -=+ ossec13001hI{Exim Auth failed2025-04-18 18:15:47 dovecot_login authenticator failed for ([121.178.185.141]) [121.178.185.141]:55308: 535 Incorrect authentication data (set_id=sales)121.178.185.1411835841g  -[' ossec13001hIeExim Auth failed2025-04-18 18:15:25 dovecot_login authenticator failed for ([121.154.90.47]) [121.154.90.47]:50510: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)121.154.90.471835841W  -9) ossec13001hGExim Auth failed2025-04-18 18:07:46 dovecot_login authenticator failed for ([217.195.94.243]) [217.195.94.243]:41214: 535 Incorrect authentication data (set_id=sales)217.195.94.2432017370o  -k' ossec13001hGExim Auth failed2025-04-18 18:07:29 dovecot_login authenticator failed for (167.200.88-83.samtel.ru) [88.200.167.83]:51208: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)88.200.167.832017370  ;) ossec13008hCMail Recipient rejected2025-04-18 17:50:38 H=(localhost.localdomain) [78.153.140.207]:60376 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no F= rejected RCPT : Sender verify failed78.153.140.2072635167Z  -?) ossec13001h@Exim Auth failed2025-04-18 17:38:06 dovecot_login authenticator failed for ([175.202.82.251]) [175.202.82.251]:42028: 535 Incorrect authentication data (set_id=purchase)175.202.82.2511835841j  -c% ossec13001h@Exim Auth failed2025-04-18 17:37:56 dovecot_login authenticator failed for ([114.242.175.187]) [36.112.75.46]:17828: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)36.112.75.461814991U  -7' ossec13001h8?Exim Auth failed2025-04-18 17:02:14 dovecot_login authenticator failed for (hn.kd.ny.adsl) [123.13.237.76]:36416: 535 Incorrect authentication data (set_id=purchase)123.13.237.761814991g  -]% ossec13001h83Exim Auth failed2025-04-18 17:02:01 dovecot_login authenticator failed for ([36.112.75.46]) [36.112.75.46]:60522: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)36.112.75.461814991t  -q+ ossec13001h7?Exim Auth failed2025-04-18 16:57:57 dovecot_login authenticator failed for sed08-h03-176-172-239-193.dsl.sta.abo.bbox.fr [176.172.239.193]:62184: 535 Incorrect authentication data (set_id=sales)176.172.239.1933017382g  -[' ossec13001h73Exim Auth failed2025-04-18 16:57:46 dovecot_login authenticator failed for ([1.236.156.129]) [1.236.156.129]:56992: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)1.236.156.1291835841   [y% ossec12004h4Possible Dovecot CVE-2019-11500 attemptApr 18 16:47:08 vm1 dovecot[90419]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.141.34.194, lip=103.74.54.108, session=<0l66qAsznNsDjSLC>3.141.34.1946252001?~  gQ' ossec11307h.zMultiple connection attempts from same sourceApr 18 16:20:32 vm1 pure-ftpd[1202136]: (?@35.216.180.98) [INFO] New connection from 35.216.180.9835.216.180.982658434&} 3Q' ossec11301h.v New FTP connection.Apr 18 16:20:29 vm1 pure-ftpd[1202122]: (?@35.216.180.98) [INFO] New connection from 35.216.180.9835.216.180.982658434}|  S_) ossec11000h-Login failed on the cpanel service.[2025-04-18 16:16:39 +0530] info [cpaneld] 156.242.36.213 - ms "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ms (has_cpuser_file failed)156.242.36.2136252001 9 ] ,I7^ -G' ossec13001h&Exim Auth failed2025-04-18 23:00:12 dovecot_login authenticator failed for (amplifypowerglobal.com) [221.229.216.1]:60756: 535 Incorrect authentication data (set_id=nologin)221.229.216.11814991(  3U) ossec11301hNew FTP connection.Apr 18 22:59:36 vm1 pure-ftpd[1285810]: (?@147.185.132.79) [INFO] New connection from 147.185.132.79147.185.132.796252001%  3Q' ossec11301hNew FTP connection.Apr 18 22:55:49 vm1 pure-ftpd[1285221]: (?@20.15.166.220) [INFO] New connection from 20.15.166.22020.15.166.2206252001a  -S# ossec13001hExim Auth failed2025-04-18 22:46:41 dovecot_login authenticator failed for ([1.251.13.72]) [1.251.13.72]:59866: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)1.251.13.721835841g  -W+ ossec13001hExim Auth failed2025-04-18 22:47:03 dovecot_login authenticator failed for (165-220-130-160.cust.exede.net) [165.220.130.160]:42140: 535 Incorrect authentication data (set_id=sales)165.220.130.1602510769m  -g' ossec13001hMExim Auth failed2025-04-18 22:43:49 dovecot_login authenticator failed for (201-63-196-1.customer.tdatabrasil.net.br) [177.25.18.178]:59865: 535 Incorrect authentication data (set_id=sales)177.25.18.1783469034u  -w' ossec13001h?Exim Auth failed2025-04-18 22:43:34 dovecot_login authenticator failed for 42-200-141-56.static.imsbiz.com [42.200.141.56]:51065: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)42.200.141.561819730%  3Q' ossec11301hpcNew FTP connection.Apr 18 21:01:46 vm1 pure-ftpd[1260916]: (?@20.163.15.119) [INFO] New connection from 20.163.15.11920.163.15.1196252001^  -E+ ossec13001hhCExim Auth failed2025-04-18 20:27:05 dovecot_login authenticator failed for (r552pc2.ee.ntu.edu.tw) [131.107.147.178]:21608: 535 Incorrect authentication data (set_id=sales)131.107.147.1786252001Q  -1% ossec13001hh/Exim Auth failed2025-04-18 20:26:47 dovecot_login authenticator failed for ([125.69.195.7]) [125.69.195.7]:33264: 535 Incorrect authentication data (set_id=sales)125.69.195.71814991g  -[' ossec13001hh Exim Auth failed2025-04-18 20:26:12 dovecot_login authenticator failed for ([111.39.167.59]) [111.39.167.59]:52011: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)111.39.167.591814991_ -G) ossec13001hcExim Auth failed2025-04-18 20:08:30 dovecot_login authenticator failed for (s2seducationtrust.com) [124.160.63.122]:24194: 535 Incorrect authentication data (set_id=nologin)124.160.63.1221814991o  SC) ossec11000hYLogin failed on the cpanel service.[2025-04-18 19:24:32 +0530] info [whostmgrd] 156.228.91.220 - msnews24 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect156.228.91.2206252001k  S;) ossec11000hYLogin failed on the cpanel service.[2025-04-18 19:24:30 +0530] info [whostmgrd] 156.228.78.249 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect156.228.78.2496252001"  3M% ossec11301hXNew FTP connection.Apr 18 19:20:07 vm1 pure-ftpd[1239818]: (?@103.74.54.23) [INFO] New connection from 103.74.54.23103.74.54.231269750W  -9) ossec13001hWExim Auth failed2025-04-18 19:17:02 dovecot_login authenticator failed for ([116.198.37.128]) [116.198.37.128]:38938: 535 Incorrect authentication data (set_id=sales)116.198.37.1281814991Z  -?) ossec13001hWExim Auth failed2025-04-18 19:16:49 dovecot_login authenticator failed for ([74.196.184.120]) [74.196.184.120]:41810: 535 Incorrect authentication data (set_id=purchase)74.196.184.1206252001c  -W% ossec13001hWExim Auth failed2025-04-18 19:16:47 dovecot_login authenticator failed for ([91.222.80.75]) [91.222.80.75]:58579: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)91.222.80.75690791 b z z  "IZenzA  -' ossec13001hExim Auth failed2025-04-19 05:30:15 dovecot_login authenticator failed for (static-221.76.249.49-tataidc.co.in) [49.249.76.221]:37530: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)49.249.76.2211269750a@  -S# ossec13001hשExim Auth failed2025-04-19 04:22:23 dovecot_login authenticator failed for ([94.251.8.83]) [94.251.8.83]:36326: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)94.251.8.832017370r?  -s% ossec13001hExim Auth failed2025-04-19 04:23:00 dovecot_login authenticator failed for 89-109-4-133.dynamic.mts-nn.ru [89.109.4.133]:43294: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)89.109.4.13320173707>  ;k) ossec13008hMail Recipient rejected2025-04-19 03:33:09 H=(mail.hsnews.in) [165.154.228.61]:61810 F= rejected RCPT : Rejected relay attempt: '165.154.228.61' From: 'qlnyjntjlfx@hsnews.in' To: 'validxxx@gmailhotmail.com.br'165.154.228.611643084Z=  -?) ossec13001hExim Auth failed2025-04-19 03:15:58 dovecot_login authenticator failed for ([60.175.146.138]) [60.175.146.138]:40133: 535 Incorrect authentication data (set_id=purchase)60.175.146.1381814991<  - ) ossec13001hExim Auth failed2025-04-19 03:15:35 dovecot_login authenticator failed for c-73-106-172-226.hsd1.ga.comcast.net [73.106.172.226]:58986: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)73.106.172.2266252001Q;  -1% ossec13001hExim Auth failed2025-04-19 03:15:17 dovecot_login authenticator failed for ([60.172.1.210]) [60.172.1.210]:47552: 535 Incorrect authentication data (set_id=sales)60.172.1.2101814991j:  -_) ossec13001hExim Auth failed2025-04-19 03:15:03 dovecot_login authenticator failed for ([103.251.143.14]) [103.251.143.14]:59138: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)103.251.143.141269750T9  -5' ossec13001hExim Auth failed2025-04-19 03:10:15 dovecot_login authenticator failed for ([203.190.150.4]) [203.190.150.4]:51650: 535 Incorrect authentication data (set_id=sales)203.190.150.41269750l8  -c+ ossec13001hƴExim Auth failed2025-04-19 03:10:03 dovecot_login authenticator failed for ([185.255.212.178]) [185.255.212.178]:48668: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)185.255.212.17873280047  A_) ossec11302hÊFTP Authentication failed.Apr 19 02:56:32 vm1 pure-ftpd[1338078]: (?@113.22.133.166) [WARNING] Authentication failed for user [www]113.22.133.1661562822)6 3U) ossec11301hzNew FTP connection.Apr 19 02:56:17 vm1 pure-ftpd[1338065]: (?@113.22.133.166) [INFO] New connection from 113.22.133.166113.22.133.16615628225  W) ossec9708h3Dovecot Aborted Login with empty userApr 19 02:12:25 vm1 dovecot[90419]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=185.247.137.42, lip=103.74.54.108, TLS, session=185.247.137.42298795Z4  -=+ ossec13001h/Exim Auth failed2025-04-19 02:08:05 dovecot_login authenticator failed for ([124.225.185.148]) [124.225.185.148]:38372: 535 Incorrect authentication data (set_id=sales)124.225.185.1481814991c3  -W% ossec13001hExim Auth failed2025-04-19 02:07:45 dovecot_login authenticator failed for ([94.205.82.33]) [94.205.82.33]:56442: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)94.205.82.33290557*2  3Y+ ossec11301hNew FTP connection.Apr 19 02:05:50 vm1 pure-ftpd[1327629]: (?@185.247.137.107) [INFO] New connection from 185.247.137.107185.247.137.107298795j1  -a' ossec13001h.Exim Auth failed2025-04-19 01:55:16 dovecot_login authenticator failed for ([94.102.51.218]) [94.102.51.218]:37582: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)94.102.51.2182750405 S}  : ,qImS  E' ossec2501h6User authentication failure.Apr 19 11:07:48 vm1 sshd[1442770]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=164.68.114.38164.68.114.3830173823 a?' ossec5710h6Attempt to login using a non-existent userApr 19 11:07:47 vm1 sshd[1442770]: Invalid user bansalparul from 164.68.114.38 port 58240164.68.114.383017382W  a ' ossec6003h6Imunify PAM. The IP has been locked by RBLApr 19 11:07:48 vm1 sshd[1442770]: pam_imunify(sshd:auth): [IM360_RBL] The IP 164.68.114.38 has been locked due to Imunify RBL164.68.114.383017382W  E!+ ossec2501h5User authentication failure.Apr 19 11:04:17 vm1 sshd[1441856]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=207.180.208.246207.180.208.24630173821 a7+ ossec5710h5Attempt to login using a non-existent userApr 19 11:04:17 vm1 sshd[1441856]: Invalid user admin from 207.180.208.246 port 46814207.180.208.24630173821 a7+ ossec5710h2_Attempt to login using a non-existent userApr 19 10:49:26 vm1 sshd[1438799]: Invalid user admin from 128.199.146.218 port 44644128.199.146.2181880251[  a + ossec6003h2_Imunify PAM. The IP has been locked by RBLApr 19 10:49:26 vm1 sshd[1438799]: pam_imunify(sshd:auth): [IM360_RBL] The IP 128.199.146.218 has been locked due to Imunify RBL128.199.146.2181880251W  E!+ ossec2501h2_User authentication failure.Apr 19 10:49:26 vm1 sshd[1438799]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.146.218128.199.146.21818802516 aE' ossec5710h0Attempt to login using a non-existent userApr 19 10:43:07 vm1 sshd[1437519]: Invalid user bansalparul900 from 64.235.45.178 port 5502464.235.45.1781880251S  E' ossec2501h0User authentication failure.Apr 19 10:43:07 vm1 sshd[1437519]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=64.235.45.17864.235.45.1781880251W  a ' ossec6003h0Imunify PAM. The IP has been locked by RBLApr 19 10:43:07 vm1 sshd[1437519]: pam_imunify(sshd:auth): [IM360_RBL] The IP 64.235.45.178 has been locked due to Imunify RBL64.235.45.1781880251(  3U) ossec11301h/bNew FTP connection.Apr 19 10:36:41 vm1 pure-ftpd[1436136]: (?@206.168.34.121) [INFO] New connection from 206.168.34.121206.168.34.1216252001(  CI' ossec5716h-~SSHD authentication failed.Apr 19 10:28:37 vm1 sshd[1434389]: Failed password for root from 164.68.114.38 port 51752 ssh2164.68.114.383017382W  a ' ossec6003h-|Imunify PAM. The IP has been locked by RBLApr 19 10:28:35 vm1 sshd[1434389]: pam_imunify(sshd:auth): [IM360_RBL] The IP 164.68.114.38 has been locked due to Imunify RBL164.68.114.383017382^  E3' ossec2501h-|User authentication failure.Apr 19 10:28:35 vm1 sshd[1434389]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=164.68.114.38 user=root164.68.114.383017382"  CC! ossec5716h*SSHD authentication failed.Apr 19 10:16:52 vm1 sshd[1432101]: Failed password for root from 62.72.58.6 port 55684 ssh262.72.58.61269750X  E-! ossec2501h*User authentication failure.Apr 19 10:16:50 vm1 sshd[1432101]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=62.72.58.6 user=root62.72.58.61269750Q  a! ossec6003h*Imunify PAM. The IP has been locked by RBLApr 19 10:16:50 vm1 sshd[1432101]: pam_imunify(sshd:auth): [IM360_RBL] The IP 62.72.58.6 has been locked due to Imunify RBL62.72.58.61269750(  CI' ossec5716h(SSHD authentication failed.Apr 19 10:08:50 vm1 sshd[1430429]: Failed password for root from 103.23.155.27 port 36872 ssh2103.23.155.272077456  ' 8 \ m OK>@:1 aI+ ossec5710hIAttempt to login using a non-existent userApr 19 12:29:20 vm1 sshd[1460031]: Invalid user bansalparul900 from 207.180.208.246 port 44112207.180.208.2463017382W0  E!+ ossec2501hIUser authentication failure.Apr 19 12:29:20 vm1 sshd[1460031]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=207.180.208.246207.180.208.2463017382/  W) ossec9708hGDovecot Aborted Login with empty userApr 19 12:21:02 vm1 dovecot[90419]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=152.32.225.108, lip=103.74.54.108, TLS, session=152.32.225.1081819730.  3I# ossec11301hGNew FTP connection.Apr 19 12:17:51 vm1 pure-ftpd[1457720]: (?@3.144.23.71) [INFO] New connection from 3.144.23.713.144.23.716252001T-  -7% ossec13001hFExim Auth failed2025-04-19 12:17:21 dovecot_login authenticator failed for ([211.93.6.230]) [211.93.6.230]:24472: 535 Incorrect authentication data (set_id=purchase)211.93.6.2301814991g,  -[' ossec13001hFExim Auth failed2025-04-19 12:16:29 dovecot_login authenticator failed for ([209.173.10.75]) [209.173.10.75]:38024: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)209.173.10.756252001+  3I# ossec11301hFNew FTP connection.Apr 19 12:15:52 vm1 pure-ftpd[1457422]: (?@3.144.23.71) [INFO] New connection from 3.144.23.713.144.23.716252001*  -# ossec13001hFExim Auth failed2025-04-19 12:16:44 dovecot_login authenticator failed for static-98-110-70-2.cmdnnj.fios.verizon.net [98.110.70.2]:56266: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)98.110.70.26252001 ) 3I# ossec11301hENew FTP connection.Apr 19 12:13:06 vm1 pure-ftpd[1456664]: (?@3.144.23.71) [INFO] New connection from 3.144.23.713.144.23.716252001Z(  -?) ossec13001hBExim Auth failed2025-04-19 11:59:36 dovecot_login authenticator failed for ([221.165.172.38]) [221.165.172.38]:54736: 535 Incorrect authentication data (set_id=purchase)221.165.172.381835841j'  -a' ossec13001hBExim Auth failed2025-04-19 11:59:16 dovecot_login authenticator failed for ([111.0.127.202]) [111.0.127.202]:25257: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)111.0.127.2021814991Q&  -1% ossec13001hBExim Auth failed2025-04-19 11:58:14 dovecot_login authenticator failed for ([102.53.15.56]) [102.53.15.56]:37758: 535 Incorrect authentication data (set_id=sales)102.53.15.562542007P%  -1% ossec13001hByExim Auth failed2025-04-19 11:58:09 dovecot_login authenticator failed for ([41.220.3.113]) [41.220.3.101]:26723: 535 Incorrect authentication data (set_id=sales)41.220.3.101226074j$  -_) ossec13001hBUExim Auth failed2025-04-19 11:57:33 dovecot_login authenticator failed for ([175.202.82.251]) [175.202.82.251]:34624: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)175.202.82.2511835841W#  -;' ossec13001h=Exim Auth failed2025-04-19 11:38:04 dovecot_login authenticator failed for ([61.169.31.242]) [61.169.31.242]:15661: 535 Incorrect authentication data (set_id=purchase)61.169.31.2421814991j"  -a' ossec13001h=Exim Auth failed2025-04-19 11:37:42 dovecot_login authenticator failed for ([83.239.84.130]) [83.239.84.130]:49727: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)83.239.84.1302017370_!  -M% ossec13001h6Exim Auth failed2025-04-19 11:08:53 dovecot_login authenticator failed for (144.121.245.65.lightower.net) [64.72.74.162]:46405: 535 Incorrect authentication data (set_id=sales)64.72.74.1626252001p  -q# ossec13001h6Exim Auth failed2025-04-19 11:08:32 dovecot_login authenticator failed for 111-70-32-8.emome-ip.hinet.net [111.70.32.8]:34414: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)111.70.32.81668284 5 J s  k$P&NrWz  a ' ossec6003h!Imunify PAM. The IP has been locked by RBLApr 19 09:37:25 vm1 sshd[1423873]: pam_imunify(sshd:auth): [IM360_RBL] The IP 79.132.140.43 has been locked due to Imunify RBL79.132.140.432921044Wy  a ' ossec6003h )Imunify PAM. The IP has been locked by RBLApr 19 09:31:44 vm1 sshd[1422732]: pam_imunify(sshd:auth): [IM360_RBL] The IP 64.235.45.178 has been locked due to Imunify RBL64.235.45.1781880251Sx  E' ossec2501h )User authentication failure.Apr 19 09:31:44 vm1 sshd[1422732]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=64.235.45.17864.235.45.17818802513w a?' ossec5710h )Attempt to login using a non-existent userApr 19 09:31:44 vm1 sshd[1422732]: Invalid user bansalparul from 64.235.45.178 port 4843064.235.45.1781880251Wv  E!+ ossec2501hUser authentication failure.Apr 19 09:24:41 vm1 sshd[1421179]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.146.218128.199.146.2181880251[u  a + ossec6003hImunify PAM. The IP has been locked by RBLApr 19 09:24:41 vm1 sshd[1421179]: pam_imunify(sshd:auth): [IM360_RBL] The IP 128.199.146.218 has been locked due to Imunify RBL128.199.146.21818802511t a7+ ossec5710hAttempt to login using a non-existent userApr 19 09:24:41 vm1 sshd[1421179]: Invalid user admin from 128.199.146.218 port 36636128.199.146.2181880251Os  E# ossec2501h!User authentication failure.Apr 19 09:10:16 vm1 sshd[1418345]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=94.72.97.3694.72.97.362635167Sr  a# ossec6003h!Imunify PAM. The IP has been locked by RBLApr 19 09:10:16 vm1 sshd[1418345]: pam_imunify(sshd:auth): [IM360_RBL] The IP 94.72.97.36 has been locked due to Imunify RBL94.72.97.362635167/q a;# ossec5710h!Attempt to login using a non-existent userApr 19 09:10:15 vm1 sshd[1418345]: Invalid user bansalparul from 94.72.97.36 port 4720894.72.97.3626351676p  Ag% ossec11302hFTP Authentication failed.Apr 19 08:59:18 vm1 pure-ftpd[1415779]: (?@34.77.151.17) [WARNING] Authentication failed for user [anonymous]34.77.151.172802361#o 3M% ossec11301hNew FTP connection.Apr 19 08:59:12 vm1 pure-ftpd[1415777]: (?@34.77.151.17) [INFO] New connection from 34.77.151.1734.77.151.172802361Sn  a# ossec6003hImunify PAM. The IP has been locked by RBLApr 19 08:56:40 vm1 sshd[1415203]: pam_imunify(sshd:auth): [IM360_RBL] The IP 94.72.97.36 has been locked due to Imunify RBL94.72.97.362635167Om  E# ossec2501hUser authentication failure.Apr 19 08:56:40 vm1 sshd[1415203]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=94.72.97.3694.72.97.362635167/l a;# ossec5710hAttempt to login using a non-existent userApr 19 08:56:40 vm1 sshd[1415203]: Invalid user bansalparul from 94.72.97.36 port 4434894.72.97.362635167Rk  -5' ossec13001h<Exim Auth failed2025-04-19 08:53:40 dovecot_login authenticator failed for ([65.20.252.105]) [65.20.252.105]:48082: 535 Incorrect authentication data (set_id=sales)65.20.252.10599237fj  -U+ ossec13001h0Exim Auth failed2025-04-19 08:53:27 dovecot_login authenticator failed for (209-217-209-122.northland.net) [209.217.209.122]:39212: 535 Incorrect authentication data (set_id=sales)209.217.209.1226252001ai  -S# ossec13001h"Exim Auth failed2025-04-19 08:53:14 dovecot_login authenticator failed for ([58.214.8.10]) [58.214.8.10]:45643: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)58.214.8.101814991`h  E5) ossec2501h+User authentication failure.Apr 19 08:36:18 vm1 sshd[1411128]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=82.112.236.245 user=root82.112.236.2451269750 Sp N n &:Ncw^  E3' ossec2501h(User authentication failure.Apr 19 10:08:47 vm1 sshd[1430429]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.23.155.27 user=root103.23.155.272077456W  a ' ossec6003h(Imunify PAM. The IP has been locked by RBLApr 19 10:08:47 vm1 sshd[1430429]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.23.155.27 has been locked due to Imunify RBL103.23.155.272077456h  -]' ossec13001h&Exim Auth failed2025-04-19 10:00:50 dovecot_login authenticator failed for (static-91.137.143.114-tataidc.co.in) [49.36.120.161]:49096: 535 Incorrect authentication data (set_id=sales)49.36.120.1611269750g  -[' ossec13001h&Exim Auth failed2025-04-19 10:00:33 dovecot_login authenticator failed for ([125.72.92.174]) [125.72.92.174]:57584: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)125.72.92.1741814991f  -W) ossec13001h&Exim Auth failed2025-04-19 09:57:09 dovecot_login authenticator failed for ool-4579c7cb.dyn.optonline.net [69.121.199.203]:44580: 535 Incorrect authentication data (set_id=purchase)69.121.199.2036252001g  -]% ossec13001h%Exim Auth failed2025-04-19 09:56:26 dovecot_login authenticator failed for ([61.73.190.98]) [61.73.190.98]:41752: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)61.73.190.981835841g  -]% ossec13001h%Exim Auth failed2025-04-19 09:56:05 dovecot_login authenticator failed for ([182.109.1.49]) [182.109.1.49]:64671: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)182.109.1.491814991(  CI' ossec5716h%SSHD authentication failed.Apr 19 09:54:39 vm1 sshd[1427344]: Failed password for root from 103.23.155.27 port 55348 ssh2103.23.155.272077456W  a ' ossec6003h%Imunify PAM. The IP has been locked by RBLApr 19 09:54:37 vm1 sshd[1427344]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.23.155.27 has been locked due to Imunify RBL103.23.155.272077456^  E3' ossec2501h%User authentication failure.Apr 19 09:54:37 vm1 sshd[1427344]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.23.155.27 user=root103.23.155.272077456W  E!+ ossec2501h$User authentication failure.Apr 19 09:50:29 vm1 sshd[1426717]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=207.180.208.246207.180.208.2463017382[  a + ossec6003h$Imunify PAM. The IP has been locked by RBLApr 19 09:50:29 vm1 sshd[1426717]: pam_imunify(sshd:auth): [IM360_RBL] The IP 207.180.208.246 has been locked due to Imunify RBL207.180.208.24630173827 aC+ ossec5710h$Attempt to login using a non-existent userApr 19 09:50:28 vm1 sshd[1426717]: Invalid user bansalparul from 207.180.208.246 port 39314207.180.208.2463017382- a3' ossec5710h"Attempt to login using a non-existent userApr 19 09:39:58 vm1 sshd[1424430]: Invalid user admin from 164.68.114.38 port 50504164.68.114.383017382S~  E' ossec2501h"User authentication failure.Apr 19 09:39:58 vm1 sshd[1424430]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=164.68.114.38164.68.114.383017382W}  a ' ossec6003h"Imunify PAM. The IP has been locked by RBLApr 19 09:39:58 vm1 sshd[1424430]: pam_imunify(sshd:auth): [IM360_RBL] The IP 164.68.114.38 has been locked due to Imunify RBL164.68.114.383017382^|  E3' ossec2501h!User authentication failure.Apr 19 09:37:25 vm1 sshd[1423873]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=79.132.140.43 user=root79.132.140.432921044({  CI' ossec5716h!SSHD authentication failed.Apr 19 09:37:27 vm1 sshd[1423873]: Failed password for root from 79.132.140.43 port 40114 ssh279.132.140.432921044  u a6[C  e) ossec11321h`uActive Response. FTP brute force attack (Port 21 is protected)Apr 19 14:06:04 vm1 pure-ftpd[1480269]: (?@45.144.212.171) [WARNING] Authentication failed for user [rokama]45.144.212.171690791AB  gU) ossec11307h`uMultiple connection attempts from same sourceApr 19 14:06:04 vm1 pure-ftpd[1480283]: (?@45.144.212.171) [INFO] New connection from 45.144.212.17145.144.212.171690791A  S) ossec211321h`uPreventing FTP brute force attempt.[Active Response] is disabled for rule 11321. Greylisting 45.144.212.17145.144.212.171690791(@ 3U) ossec11301h`gNew FTP connection.Apr 19 14:05:50 vm1 pure-ftpd[1480239]: (?@45.144.212.171) [INFO] New connection from 45.144.212.17145.144.212.1716907915? Aa) ossec11302h`gFTP Authentication failed.Apr 19 14:05:49 vm1 pure-ftpd[1480224]: (?@45.144.212.171) [WARNING] Authentication failed for user [user]45.144.212.171690791?> Au) ossec11302h`[FTP Authentication failed.Apr 19 14:05:38 vm1 pure-ftpd[1480208]: (?@45.144.212.171) [WARNING] Authentication failed for user [rokamauka_user]45.144.212.171690791(= 3U) ossec11301h`WNew FTP connection.Apr 19 14:05:32 vm1 pure-ftpd[1480206]: (?@45.144.212.171) [INFO] New connection from 45.144.212.17145.144.212.171690791{< S[) ossec11000h`SLogin failed on the cpanel service.[2025-04-19 14:05:30 +0530] info [cpaneld] 45.144.212.171 - rokamauk "POST /login HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user rokamauk (has_cpuser_file failed)45.144.212.171690791d;  -W% ossec13001h_BExim Auth failed2025-04-19 14:00:58 dovecot_login authenticator failed for ([14.37.206.76]) [14.37.206.76]:52358: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)14.37.206.761835841T:  -5' ossec13001h_mExim Auth failed2025-04-19 14:01:39 dovecot_login authenticator failed for ([49.124.153.55]) [49.124.153.55]:43042: 535 Incorrect authentication data (set_id=sales)49.124.153.551733045r9  -q' ossec13001hZExim Auth failed2025-04-19 13:41:44 dovecot_login authenticator failed for 111-70-11-237.emome-ip.hinet.net [111.70.11.237]:36734: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)111.70.11.23716682848  -' ossec13001hZExim Auth failed2025-04-19 13:41:23 dovecot_login authenticator failed for 185.39.167.72.host.secureserver.net [72.167.39.185]:45962: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)72.167.39.1856252001V7  -9) ossec13001hVExim Auth failed2025-04-19 13:24:13 dovecot_login authenticator failed for ([87.200.230.169]) [87.200.230.169]:51873: 535 Incorrect authentication data (set_id=sales)87.200.230.169290557d6  -W% ossec13001hVExim Auth failed2025-04-19 13:24:01 dovecot_login authenticator failed for ([39.170.5.210]) [39.170.5.210]:50214: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)39.170.5.2101814991X5 -=% ossec13001hTExim Auth failed2025-04-19 13:17:04 dovecot_login authenticator failed for (heipowersystem.com) [119.96.131.8]:42070: 535 Incorrect authentication data (set_id=nologin)119.96.131.81814991"4  3M% ossec11301hP1New FTP connection.Apr 19 12:56:39 vm1 pure-ftpd[1465696]: (?@139.162.77.6) [INFO] New connection from 139.162.77.6139.162.77.61861060s3  -q) ossec13001hNfExim Auth failed2025-04-19 12:49:02 dovecot_login authenticator failed for pool-108-18-206-153.washdc.fios.verizon.net [108.18.206.153]:35379: 535 Incorrect authentication data (set_id=purchase)108.18.206.1536252001g2  -]% ossec13001hNTExim Auth failed2025-04-19 12:48:43 dovecot_login authenticator failed for ([36.37.203.28]) [36.37.203.28]:39388: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)36.37.203.281831722 *!A f /*gT  -[' ossec13001hvpExim Auth failed2025-04-19 15:39:52 dovecot_login authenticator failed for ([39.88.252.236]) [39.88.252.236]:35460: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)39.88.252.2361814991US  E) ossec2501hvHUser authentication failure.Apr 19 15:39:11 vm1 sshd[1500325]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.65.252.168159.65.252.16862520015R aA) ossec5710hvHAttempt to login using a non-existent userApr 19 15:39:10 vm1 sshd[1500325]: Invalid user bansalparul from 159.65.252.168 port 52528159.65.252.1686252001YQ  a ) ossec6003hvHImunify PAM. The IP has been locked by RBLApr 19 15:39:11 vm1 sshd[1500325]: pam_imunify(sshd:auth): [IM360_RBL] The IP 159.65.252.168 has been locked due to Imunify RBL159.65.252.1686252001P  Ug) ossec11001hr]Deferred login on the cpanel service[2025-04-19 15:22:28 +0530] info [webmaild] 178.248.116.70 - kps@amplifypowerglobal.com "POST /cpsess7416179448/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [110.226.173.98] != Current IP Address [178.248.116.70]178.248.116.701269750O  W' ossec9708ho)Dovecot Aborted Login with empty userApr 19 15:08:47 vm1 dovecot[90419]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 7 secs): user=<>, rip=87.236.176.35, lip=103.74.54.108, TLS, session=87.236.176.352635167eN  -Y% ossec13001hnExim Auth failed2025-04-19 15:04:19 dovecot_login authenticator failed for syn-076-169-081-036.res.spectrum.com [76.169.81.36]:34220: 535 Incorrect authentication data (set_id=sales)76.169.81.366252001gM  -[' ossec13001hnExim Auth failed2025-04-19 15:04:09 dovecot_login authenticator failed for ([186.239.41.74]) [186.239.41.74]:47974: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)186.239.41.743469034ZL  -?) ossec13001hmDExim Auth failed2025-04-19 15:00:43 dovecot_login authenticator failed for ([62.140.234.114]) [62.140.234.114]:42071: 535 Incorrect authentication data (set_id=services)62.140.234.1142017370yK  -}) ossec13001hm:Exim Auth failed2025-04-19 15:00:33 dovecot_login authenticator failed for (m182-153-173-49.smartone.com) [182.153.173.49]:57402: 535 Incorrect authentication data (set_id=services@heipowersystem.com)182.153.173.491819730rJ  -s% ossec13001hfnExim Auth failed2025-04-19 14:31:33 dovecot_login authenticator failed for (undefined.hostname.localhost) [103.90.97.98]:40268: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)103.90.97.981269750SI  -5' ossec13001hfExim Auth failed2025-04-19 14:32:05 dovecot_login authenticator failed for ([196.46.200.85]) [196.46.200.85]:52904: 535 Incorrect authentication data (set_id=sales)196.46.200.85895949[H  -G# ossec13001hbkExim Auth failed2025-04-19 14:14:27 dovecot_login authenticator failed for (rokamauka.com) [14.18.77.99]:59338: 535 Incorrect authentication data (set_id=info@rokamauka.com)14.18.77.991814991PG  -1# ossec13001hbOExim Auth failed2025-04-19 14:13:59 dovecot_login authenticator failed for (rokamauka.com) [14.18.77.99]:55922: 535 Incorrect authentication data (set_id=nologin)14.18.77.991814991VF  -9) ossec13001h`Exim Auth failed2025-04-19 14:08:06 dovecot_plain authenticator failed for ([45.144.212.171]) [45.144.212.171]:49904: 535 Incorrect authentication data (set_id=admin)45.144.212.171690791[E -A) ossec13001h`Exim Auth failed2025-04-19 14:06:56 dovecot_plain authenticator failed for ([45.144.212.171]) [45.144.212.171]:65172: 535 Incorrect authentication data (set_id=rokamauka)45.144.212.171690791ZD  -A) ossec13001h`Exim Auth failed2025-04-19 14:06:32 dovecot_plain authenticator failed for ([45.144.212.171]) [45.144.212.171]:61991: 535 Incorrect authentication data (set_id=rokamauka)45.144.212.171690791 &~qdWJ=0# zm`SF9, oUH;.!xk^QD7*tgZM@3& |b v i \ O B 5 (     r e X K > 1 $  { n a T G : -   w j ] P C 6 )    s f Y L ? 2 %  1819730O 1819730O 1819730O{ 1819730OH 1819730O 1819730O 1819730N 1819730N 1819730N 1819730N 1819730N 1819730M 1819730M 1819730M/ 1819730M 1819730L 1819730L 1819730K 1819730K 1819730K" 1819730K 1819730J 1819730J 1819730J 1819730J 1819730J9 1819730J- 1819730J+ 1819730J 1819730I 1819730I 1819730Iy 1819730It 1831722IY 1819730IT 1819730I 1819730H 1819730H 1819730H> 1819730H< 1819730H; 1819730H: 1819730G 1819730GZ 1821275G; 1819730F 1821275F 1819730F 1819730F 1819730F 1819730F 1819730Fw 1819730Fv 1819730Fu 1831722Fj 1819730F 1819730F 1819730E 1835841 v 1835841 _ 1835841 G 1835841 2 1835841 ! 1835841  1835841  1835841  1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841w 1835841U 18358419 18358411 18358410 1835841, 1835841) 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841Q 1835841% 1835841# 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1835841P 1835841 1835841 1835841 1835841 1835841 1835841 1835841 1831722E 1831722C 1831722Ab 1831722@4 1831722> 1831722; 18317228g 18317226& 18317226 18317226 18317225 18317224` 18317224> 18317223P 18317222 1831722) 1831722! 1831722* 1831722 1831722] 1831722 1831722 1831722 < 1831722| 1831722 1821275=u 18212750 1821275- 1821275,J 1820814By 18208145 1820814! 1820814 1820814 1820814  1819730E 1819730E/ 1819730E 1819730D 1819730D 1819730D 1819730D 1819730D 1819730Dm 1819730Dc 1819730DE 1819730C 1819730C 1819730C 1819730C 1819730C 1819730C 1819730C! 1819730C 1819730C 1819730C 1819730B1 1819730B0 1819730B/ 1819730B. 1819730B- 1819730B, 1819730B+ 1819730B 1819730A 1819730A 1819730A 1819730A 1819730Ah 1819730A> 1819730A= 1819730A< 1819730@ !w   A=cGg  ae+ ossec5710hVAttempt to login using a non-existent userApr 19 16:39:08 vm1 sshd[1512653]: Disconnected from invalid user admin 128.199.146.218 port 34154 [preauth]128.199.146.21818802511f a7+ ossec5710hPAttempt to login using a non-existent userApr 19 16:39:03 vm1 sshd[1512653]: Invalid user admin from 128.199.146.218 port 34154128.199.146.2181880251We  E!+ ossec2501hPUser authentication failure.Apr 19 16:39:04 vm1 sshd[1512653]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.146.218128.199.146.2181880251[d  a + ossec6003hPImunify PAM. The IP has been locked by RBLApr 19 16:39:04 vm1 sshd[1512653]: pam_imunify(sshd:auth): [IM360_RBL] The IP 128.199.146.218 has been locked due to Imunify RBL128.199.146.21818802518c  Ai' ossec11302hIFTP Authentication failed.Apr 19 16:34:40 vm1 pure-ftpd[1511657]: (?@34.77.191.221) [WARNING] Authentication failed for user [anonymous]34.77.191.2212802361&b 3Q' ossec11301hCNew FTP connection.Apr 19 16:34:34 vm1 pure-ftpd[1511657]: (?@34.77.191.221) [INFO] New connection from 34.77.191.22134.77.191.2212802361Ua  E) ossec2501hYUser authentication failure.Apr 19 16:17:50 vm1 sshd[1508371]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.65.252.168159.65.252.1686252001Y`  a ) ossec6003hYImunify PAM. The IP has been locked by RBLApr 19 16:17:50 vm1 sshd[1508371]: pam_imunify(sshd:auth): [IM360_RBL] The IP 159.65.252.168 has been locked due to Imunify RBL159.65.252.16862520018_ aG) ossec5710hWAttempt to login using a non-existent userApr 19 16:17:50 vm1 sshd[1508371]: Invalid user bansalparul900 from 159.65.252.168 port 34336159.65.252.1686252001S^  a# ossec6003h}fImunify PAM. The IP has been locked by RBLApr 19 16:09:33 vm1 sshd[1506542]: pam_imunify(sshd:auth): [IM360_RBL] The IP 94.72.97.36 has been locked due to Imunify RBL94.72.97.3626351672] aA# ossec5710h}fAttempt to login using a non-existent userApr 19 16:09:32 vm1 sshd[1506542]: Invalid user bansalparul900 from 94.72.97.36 port 4776894.72.97.362635167O\  E# ossec2501h}fUser authentication failure.Apr 19 16:09:33 vm1 sshd[1506542]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=94.72.97.3694.72.97.362635167[  -% ossec13001h|zExim Auth failed2025-04-19 16:05:36 dovecot_login authenticator failed for 61-216-7-163.hinet-ip.hinet.net (61-216-7-164.hinet-ip.hinet.net) [61.216.7.163]:33091: 535 Incorrect authentication data (set_id=sales)61.216.7.1631668284TZ  -5' ossec13001h|jExim Auth failed2025-04-19 16:05:21 dovecot_login authenticator failed for ([42.177.209.66]) [42.177.209.66]:43072: 535 Incorrect authentication data (set_id=sales)42.177.209.661814991eY  -[' ossec13001h|ZExim Auth failed2025-04-19 16:05:05 dovecot_login authenticator failed for ([62.201.253.23]) [62.201.253.23]:50021: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)62.201.253.2399237bX  E7+ ossec2501hz%User authentication failure.Apr 19 15:55:39 vm1 sshd[1503815]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=189.112.232.169 user=root189.112.232.1693469034,W  CM+ ossec5716hz'SSHD authentication failed.Apr 19 15:55:42 vm1 sshd[1503815]: Failed password for root from 189.112.232.169 port 48692 ssh2189.112.232.1693469034%V  3Q' ossec11301hyWNew FTP connection.Apr 19 15:52:14 vm1 pure-ftpd[1503017]: (?@206.168.34.33) [INFO] New connection from 206.168.34.33206.168.34.336252001ZU  -=+ ossec13001hvExim Auth failed2025-04-19 15:40:08 dovecot_login authenticator failed for ([223.107.146.186]) [223.107.146.186]:36234: 535 Incorrect authentication data (set_id=sales)223.107.146.1861814991 "H 0R7^/y a5) ossec5710hAttempt to login using a non-existent userApr 19 17:18:20 vm1 sshd[1521217]: Invalid user admin from 67.205.165.217 port 3608467.205.165.2176252001Ux  E) ossec2501hUser authentication failure.Apr 19 17:18:20 vm1 sshd[1521217]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=67.205.165.21767.205.165.2176252001Yw  a ) ossec6003hImunify PAM. The IP has been locked by RBLApr 19 17:18:20 vm1 sshd[1521217]: pam_imunify(sshd:auth): [IM360_RBL] The IP 67.205.165.217 has been locked due to Imunify RBL67.205.165.2176252001Tv  -5' ossec13001hMExim Auth failed2025-04-19 17:04:36 dovecot_login authenticator failed for ([1.227.228.136]) [1.227.228.136]:46491: 535 Incorrect authentication data (set_id=sales)1.227.228.1361835841(u  CI' ossec5716hSSHD authentication failed.Apr 19 16:56:58 vm1 sshd[1516387]: Failed password for root from 164.68.114.38 port 36000 ssh2164.68.114.383017382^t  E3' ossec2501hUser authentication failure.Apr 19 16:56:56 vm1 sshd[1516387]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=164.68.114.38 user=root164.68.114.383017382Ws  a ' ossec6003hImunify PAM. The IP has been locked by RBLApr 19 16:56:56 vm1 sshd[1516387]: pam_imunify(sshd:auth): [IM360_RBL] The IP 164.68.114.38 has been locked due to Imunify RBL164.68.114.383017382*r  CK) ossec5716hSSHD authentication failed.Apr 19 16:53:34 vm1 sshd[1515558]: Failed password for root from 159.65.252.168 port 48482 ssh2159.65.252.1686252001Yq  a ) ossec6003hImunify PAM. The IP has been locked by RBLApr 19 16:53:32 vm1 sshd[1515558]: pam_imunify(sshd:auth): [IM360_RBL] The IP 159.65.252.168 has been locked due to Imunify RBL159.65.252.1686252001`p  E5) ossec2501hUser authentication failure.Apr 19 16:53:32 vm1 sshd[1515558]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.65.252.168 user=root159.65.252.1686252001Zo  -=+ ossec13001hVExim Auth failed2025-04-19 16:47:42 dovecot_login authenticator failed for ([103.231.163.154]) [103.231.163.154]:28838: 535 Incorrect authentication data (set_id=sales)103.231.163.1541210997gn  -]% ossec13001hDExim Auth failed2025-04-19 16:47:24 dovecot_login authenticator failed for ([103.215.208.185]) [14.139.247.2]:51859: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)14.139.247.21269750am  -S' ossec13001hExim Auth failed2025-04-19 16:46:46 dovecot_login authenticator failed for ([65.20.193.144]) [65.20.193.144]:37357: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)65.20.193.14499237sl  -u% ossec13001hExim Auth failed2025-04-19 16:46:34 dovecot_login authenticator failed for ([42.81.140.83]) [42.81.140.83]:49137: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)42.81.140.831814991Kk  ao) ossec5710hAttempt to login using a non-existent userApr 19 16:46:08 vm1 sshd[1514177]: Disconnected from invalid user bansalparul 67.205.165.217 port 35938 [preauth]67.205.165.21762520015j aA) ossec5710hAttempt to login using a non-existent userApr 19 16:46:05 vm1 sshd[1514177]: Invalid user bansalparul from 67.205.165.217 port 3593867.205.165.2176252001Ui  E) ossec2501hUser authentication failure.Apr 19 16:46:05 vm1 sshd[1514177]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=67.205.165.21767.205.165.2176252001Yh  a ) ossec6003hImunify PAM. The IP has been locked by RBLApr 19 16:46:05 vm1 sshd[1514177]: pam_imunify(sshd:auth): [IM360_RBL] The IP 67.205.165.217 has been locked due to Imunify RBL67.205.165.2176252001 V%n " D 1Wk"-VR  -5' ossec13001h}Exim Auth failed2025-04-19 18:05:08 dovecot_login authenticator failed for ([65.20.170.167]) [65.20.170.167]:38727: 535 Incorrect authentication data (set_id=sales)65.20.170.16799237p  -o% ossec13001hsExim Auth failed2025-04-19 18:04:58 dovecot_login authenticator failed for 82-65-51-196.subs.proxad.net [82.65.51.196]:34518: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)82.65.51.1963017382]  ;5+ ossec13008hMail Recipient rejected2025-04-19 18:01:31 H=(mail.amplifypowerglobal.com) [165.154.228.180]:60036 F= rejected RCPT : Rejected relay attempt: '165.154.228.180' From: 'sbuiwytgx@amplifypowerglobal.com' To: 'validxxx@gmailhotmail.com.br'165.154.228.1801643084b  -Q' ossec13001h@Exim Auth failed2025-04-19 17:55:35 dovecot_login authenticator failed for 42-200-70-134.static.imsbiz.com [42.200.70.134]:48790: 535 Incorrect authentication data (set_id=sales)42.200.70.1341819730g  -[' ossec13001h2Exim Auth failed2025-04-19 17:55:22 dovecot_login authenticator failed for ([95.56.233.210]) [95.56.233.210]:51200: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)95.56.233.2101522867U  E) ossec2501hTUser authentication failure.Apr 19 17:55:55 vm1 sshd[1529693]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=67.205.165.21767.205.165.2176252001Y  a ) ossec6003hTImunify PAM. The IP has been locked by RBLApr 19 17:55:55 vm1 sshd[1529693]: pam_imunify(sshd:auth): [IM360_RBL] The IP 67.205.165.217 has been locked due to Imunify RBL67.205.165.21762520018 aG) ossec5710hTAttempt to login using a non-existent userApr 19 17:55:55 vm1 sshd[1529693]: Invalid user bansalparul900 from 67.205.165.217 port 5841067.205.165.2176252001\ -A) ossec13001hExim Auth failed2025-04-19 17:52:47 dovecot_plain authenticator failed for (localhost.localdomain) [78.153.140.207]:37064: 535 Incorrect authentication data (set_id=info)78.153.140.2072635167U  E) ossec2501hUser authentication failure.Apr 19 17:50:45 vm1 sshd[1528625]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.134.218.23991.134.218.23930173828 aG) ossec5710hAttempt to login using a non-existent userApr 19 17:50:45 vm1 sshd[1528625]: Invalid user bansalparul900 from 91.134.218.239 port 5018391.134.218.2393017382Y  -C# ossec13001hExim Auth failed2025-04-19 17:40:24 dovecot_login authenticator failed for (amplifypowerglobal.com) [14.18.77.99]:49142: 535 Incorrect authentication data (set_id=nologin)14.18.77.991814991Y  a ) ossec6003hImunify PAM. The IP has been locked by RBLApr 19 17:39:45 vm1 sshd[1526213]: pam_imunify(sshd:auth): [IM360_RBL] The IP 194.238.19.214 has been locked due to Imunify RBL194.238.19.2141269750U~  E) ossec2501hUser authentication failure.Apr 19 17:39:45 vm1 sshd[1526213]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=194.238.19.214194.238.19.21412697508} aG) ossec5710hAttempt to login using a non-existent userApr 19 17:39:45 vm1 sshd[1526213]: Invalid user bansalparul900 from 194.238.19.214 port 33446194.238.19.2141269750R|  E' ossec2501hUser authentication failure.Apr 19 17:25:09 vm1 sshd[1522843]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=5.180.187.1205.180.187.1202987952{ a?' ossec5710hAttempt to login using a non-existent userApr 19 17:25:09 vm1 sshd[1522843]: Invalid user bansalparul from 5.180.187.120 port 515405.180.187.120298795Vz  a ' ossec6003hImunify PAM. The IP has been locked by RBLApr 19 17:25:09 vm1 sshd[1522843]: pam_imunify(sshd:auth): [IM360_RBL] The IP 5.180.187.120 has been locked due to Imunify RBL5.180.187.120298795 U  < d o  1rpT  -5' ossec13001heExim Auth failed2025-04-19 19:47:09 dovecot_login authenticator failed for ([116.86.62.245]) [116.86.62.245]:53462: 535 Incorrect authentication data (set_id=sales)116.86.62.2451880251}  -+ ossec13001h]Exim Auth failed2025-04-19 19:47:00 dovecot_login authenticator failed for (223-197-153-138.static.imsbiz.com) [223.197.153.138]:61059: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)223.197.153.1381819730: aI+ ossec5710hAttempt to login using a non-existent userApr 19 19:45:54 vm1 sshd[1552800]: Invalid user bansalparul900 from 128.199.146.218 port 48848128.199.146.2181880251W  E!+ ossec2501hUser authentication failure.Apr 19 19:45:54 vm1 sshd[1552800]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.146.218128.199.146.2181880251[  a + ossec6003hImunify PAM. The IP has been locked by RBLApr 19 19:45:54 vm1 sshd[1552800]: pam_imunify(sshd:auth): [IM360_RBL] The IP 128.199.146.218 has been locked due to Imunify RBL128.199.146.2181880251b  -S% ossec13001hExim Auth failed2025-04-19 19:14:56 dovecot_login authenticator failed for (144.121.245.65.lightower.net) [64.72.74.162]:34736: 535 Incorrect authentication data (set_id=purchase)64.72.74.1626252001g  -]% ossec13001hExim Auth failed2025-04-19 19:14:39 dovecot_login authenticator failed for ([102.53.15.18]) [102.53.15.18]:37530: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)102.53.15.182542007g  -[' ossec13001hExim Auth failed2025-04-19 19:05:50 dovecot_login authenticator failed for ([211.97.63.206]) [211.97.63.206]:54099: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)211.97.63.2061814991T  -5' ossec13001hExim Auth failed2025-04-19 19:06:04 dovecot_login authenticator failed for ([222.76.248.54]) [222.76.248.54]:41476: 535 Incorrect authentication data (set_id=sales)222.76.248.541814991|  -) ossec13001h=Exim Auth failed2025-04-19 19:03:47 dovecot_login authenticator failed for (81.215.211.182.dynamic.ttnet.com.tr) [81.215.211.182]:33614: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)81.215.211.182298795d  -Q+ ossec13001hExim Auth failed2025-04-19 19:02:21 dovecot_login authenticator failed for (126-209-236-109.sv-en.ru) [109.236.209.126]:46560: 535 Incorrect authentication data (set_id=services)109.236.209.1262017370p  -i+ ossec13001hExim Auth failed2025-04-19 19:02:12 dovecot_login authenticator failed for ([149.248.100.132]) [149.248.100.132]:41986: 535 Incorrect authentication data (set_id=services@heipowersystem.com)149.248.100.1326251999S  E' ossec2501hUser authentication failure.Apr 19 19:02:08 vm1 sshd[1543464]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=164.68.114.38164.68.114.383017382W  a ' ossec6003hImunify PAM. The IP has been locked by RBLApr 19 19:02:08 vm1 sshd[1543464]: pam_imunify(sshd:auth): [IM360_RBL] The IP 164.68.114.38 has been locked due to Imunify RBL164.68.114.3830173826 aE' ossec5710hAttempt to login using a non-existent userApr 19 19:02:07 vm1 sshd[1543464]: Invalid user bansalparul900 from 164.68.114.38 port 41774164.68.114.383017382@ gQ' ossec11307h#Multiple connection attempts from same sourceApr 19 18:42:01 vm1 pure-ftpd[1539372]: (?@89.248.172.16) [INFO] New connection from 89.248.172.1689.248.172.1627504058  Ai' ossec11302hFTP Authentication failed.Apr 19 18:41:57 vm1 pure-ftpd[1539347]: (?@89.248.172.16) [WARNING] Authentication failed for user [anonymous]89.248.172.162750405& 3Q' ossec11301hNew FTP connection.Apr 19 18:41:52 vm1 pure-ftpd[1539347]: (?@89.248.172.16) [INFO] New connection from 89.248.172.1689.248.172.162750405 [+  )7[W.  -9) ossec13001huExim Auth failed2025-04-19 21:21:16 dovecot_login authenticator failed for ([218.23.156.227]) [218.23.156.227]:47375: 535 Incorrect authentication data (set_id=sales)218.23.156.2271814991m-  -c+ ossec13001hExim Auth failed2025-04-19 21:06:47 dovecot_login authenticator failed for ([169.211.232.182]) [169.211.232.182]:58140: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)169.211.232.1821835841g,  -[' ossec13001hExim Auth failed2025-04-19 21:06:58 dovecot_login authenticator failed for syn-024-090-169-209.res.spectrum.com [24.90.169.209]:54329: 535 Incorrect authentication data (set_id=sales)24.90.169.2096252001c+  -U% ossec13001hLExim Auth failed2025-04-19 21:03:31 dovecot_login authenticator failed for c83-255-9-170.bredband.tele2.se [83.255.9.170]:57588: 535 Incorrect authentication data (set_id=services)83.255.9.1702661886{*  -) ossec13001h4Exim Auth failed2025-04-19 21:03:07 dovecot_login authenticator failed for 89-179-119-222.static.corbina.ru [89.179.119.222]:56352: 535 Incorrect authentication data (set_id=services@heipowersystem.com)89.179.119.2222017370Z)  -?) ossec13001hExim Auth failed2025-04-19 21:01:42 dovecot_login authenticator failed for ([116.114.84.242]) [116.114.84.242]:50466: 535 Incorrect authentication data (set_id=purchase)116.114.84.2421814991(  -% ossec13001hExim Auth failed2025-04-19 21:01:07 dovecot_login authenticator failed for (dynamicip-95-79-108-51.pppoe.nn.ertelecom.ru) [95.79.108.51]:47791: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)95.79.108.512017370T'  -9% ossec13001hcExim Auth failed2025-04-19 20:55:23 dovecot_login authenticator failed for (localhost) [81.30.107.91]:23990: 535 Incorrect authentication data (set_id=14212412412412)81.30.107.91130758q&  -o' ossec13001hExim Auth failed2025-04-19 20:40:27 dovecot_login authenticator failed for (ool-4b7fcd5b.static.optonline.net) [75.127.205.91]:33616: 535 Incorrect authentication data (set_id=vikas.khandelwal)75.127.205.916252001u%  -u) ossec13001hExim Auth failed2025-04-19 20:40:14 dovecot_login authenticator failed for ([195.222.59.157]) [195.222.59.157]:47926: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)195.222.59.1573277605R$  ;!) ossec13008h@Mail Recipient rejected2025-04-19 20:33:28 H=(mail.heipowersystem.com) [165.154.228.61]:53807 F= rejected RCPT : Rejected relay attempt: '165.154.228.61' From: 'wlflnvoprey@heipowersystem.com' To: 'validxxx@gmailhotmail.com.br'165.154.228.611643084W#  E!+ ossec2501hUser authentication failure.Apr 19 20:31:54 vm1 sshd[1562783]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=189.112.232.169189.112.232.1693469034:" aI+ ossec5710hAttempt to login using a non-existent userApr 19 20:31:53 vm1 sshd[1562783]: Invalid user bansalparul900 from 189.112.232.169 port 33704189.112.232.1693469034[!  a + ossec6003hImunify PAM. The IP has been locked by RBLApr 19 20:31:54 vm1 sshd[1562783]: pam_imunify(sshd:auth): [IM360_RBL] The IP 189.112.232.169 has been locked due to Imunify RBL189.112.232.1693469034%  3Q' ossec11301h{New FTP connection.Apr 19 20:21:39 vm1 pure-ftpd[1560637]: (?@47.236.12.105) [INFO] New connection from 47.236.12.10547.236.12.1051880251f  -[% ossec13001hYExim Auth failed2025-04-19 20:12:32 dovecot_login authenticator failed for 32.104.29.34.bc.googleusercontent.com [34.29.104.32]:45580: 535 Incorrect authentication data (set_id=sales)34.29.104.326252001e  -[' ossec13001hMExim Auth failed2025-04-19 20:12:20 dovecot_login authenticator failed for ([93.191.115.52]) [93.191.115.54]:46127: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)93.191.115.5499237 ^ { 0(:G@  -) ossec13001hExim Auth failed2025-04-20 01:07:45 dovecot_login authenticator failed for ([85.159.165.216]) [85.159.165.216]:41957: 535 Incorrect authentication data85.159.165.216294640v?  -y' ossec13001hExim Auth failed2025-04-20 01:04:14 dovecot_login authenticator failed for p5df1e80e.dip0.t-ipconnect.de [93.241.232.14]:51798: 535 Incorrect authentication data (set_id=services@heipowersystem.com)93.241.232.142921044(>  3U) ossec11301hyNew FTP connection.Apr 19 23:37:51 vm1 pure-ftpd[1601891]: (?@167.94.145.101) [INFO] New connection from 167.94.145.101167.94.145.1016252001i=  -a' ossec13001hExim Auth failed2025-04-19 23:05:03 dovecot_login authenticator failed for ([46.153.85.132]) [46.153.85.132]:36646: 535 Incorrect authentication data (set_id=services@heipowersystem.com)46.153.85.132102358j<  -a' ossec13001h޹Exim Auth failed2025-04-19 23:04:49 dovecot_login authenticator failed for ([112.102.48.29]) [112.102.48.29]:60431: 535 Incorrect authentication data (set_id=services@heipowersystem.com)112.102.48.291814991:;  Ak) ossec11302hPFTP Authentication failed.Apr 19 22:41:43 vm1 pure-ftpd[1590419]: (?@193.105.134.40) [WARNING] Authentication failed for user [anonymous]193.105.134.402661886(:  3U) ossec11301hLNew FTP connection.Apr 19 22:41:39 vm1 pure-ftpd[1590419]: (?@193.105.134.40) [INFO] New connection from 193.105.134.40193.105.134.402661886(9  3U) ossec11301hNew FTP connection.Apr 19 22:33:58 vm1 pure-ftpd[1588880]: (?@198.235.24.230) [INFO] New connection from 198.235.24.230198.235.24.2306252001%8  3Q' ossec11301h_New FTP connection.Apr 19 22:33:25 vm1 pure-ftpd[1588640]: (?@88.214.25.123) [INFO] New connection from 88.214.25.12388.214.25.12329210447  -)+ ossec13001hsExim Auth failed2025-04-19 22:29:29 dovecot_login authenticator failed for (abts-north-static-194.142.160.122.airtelbroadband.in) [122.160.142.194]:38648: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)122.160.142.1941269750P6  -1# ossec13001hփExim Auth failed2025-04-19 22:29:47 dovecot_login authenticator failed for ([223.99.61.202]) [58.59.46.58]:50684: 535 Incorrect authentication data (set_id=sales)58.59.46.581814991g5  -[' ossec13001hhExim Auth failed2025-04-19 22:07:58 dovecot_login authenticator failed for syn-024-097-253-246.biz.spectrum.com [24.97.253.246]:52783: 535 Incorrect authentication data (set_id=sales)24.97.253.2466252001g4  -[' ossec13001h\Exim Auth failed2025-04-19 22:07:47 dovecot_login authenticator failed for ([39.170.99.169]) [39.170.99.169]:37792: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)39.170.99.1691814991Z3  -?) ossec13001hExim Auth failed2025-04-19 22:06:34 dovecot_login authenticator failed for ([60.171.163.115]) [60.171.163.115]:44872: 535 Incorrect authentication data (set_id=purchase)60.171.163.11518149912  - ) ossec13001hExim Auth failed2025-04-19 22:06:10 dovecot_login authenticator failed for 123-193-152-64.dynamic.kbronet.com.tw [123.193.152.64]:50072: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)123.193.152.641668284Y1 -A# ossec13001hIExim Auth failed2025-04-19 21:58:57 dovecot_login authenticator failed for (s2seducationtrust.com) [14.18.77.99]:58140: 535 Incorrect authentication data (set_id=nologin)14.18.77.991814991+0  3Y+ ossec11301hNew FTP connection.Apr 19 21:44:56 vm1 pure-ftpd[1577908]: (?@184.105.247.254) [INFO] New connection from 184.105.247.254184.105.247.2546252001m/  -c+ ossec13001hiExim Auth failed2025-04-19 21:21:04 dovecot_login authenticator failed for ([117.232.111.253]) [117.232.111.251]:38196: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)117.232.111.2511269750  |oU;.!~qdWJ=0# zm`SF9, v i \ O B 5 (     r e X K > 1 $  { n a T G : -   w j ] P CbH 6 )    s f Y L ? 2 %  1562822NB 1562822M 1562822M~ 1562822MY 1562822M! 1562822M 1562822L 1562822Lq 1562822L' 1605651K 1562822K 1605651J 1562822J 1562822J 1605651J 1605651J* 1605651J 1605651I 1562822I 1562822I 1562822I 1562822H 1562822HI 1562822F 1562822F 1643084K 1643084 1643084 1643084 1643084 D 1643084 v 1643084 ] 1643084 1643084 ? 1643084 1643084 1643084 1643084 1643084d 1643084 1643084 1643084 1643084 1643084 1643084x 1643084[ 1643084@ 1643084 1605651Fk 1605651C 1605651>y 1605651=< 1605651< 1605651< 1605651< 1605651< 1605651< 1605651; 16056519 16056519 16056519} 16056519_ 16056519] 16056519- 16056518 16056518 16056518w 16056518+ 16056518 16056516 16056516) 16056515 16056515r 16056515% 16056514 160565147 16056513 16056512k 16056512> 160565121 16056512 16056511 16056511 16056511 16056511 16056511o 16056511) 16056511! 16056511 16056511 16056510 16056510 16056510 16056510 16056510 16056510 16056510r 16056510A 1605651/ 1605651.M 1605651- 1605651, 1605651, 1605651* 1605651( 1605651(B 1605651(+ 1605651( 1605651' 1605651& 1605651& 1605651% 1605651%_ 1605651# 1605651# 1605651#~ 1605651" 1605651!3 1605651 1605651 g 1605651 1605651 1605651 1605651@ 1605651 16056517 16056516 1605651 1605651 1605651 1605651F 1605651 1605651e 1605651 1605651 1605651 1605651w 1605651 1605651 1605651 1605651X 1605651 1605651  1605651 1605651 1605651 1605651 1605651 1605651 1605651 1605651 1605651 1605651} 1605651 1605651" 1605651 1605651v 1605651 1605651 1562822E7 1562822E6 `5 , H _ w ykO`jr  -_) ossec13001hVExim Auth failed2025-04-20 07:37:23 dovecot_login authenticator failed for ([119.135.233.22]) [119.135.233.22]:50977: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)119.135.233.221814991q  W) ossec9708hVDovecot Aborted Login with empty userApr 20 07:37:08 vm1 dovecot[90419]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=185.165.191.27, lip=103.74.54.108, session=185.165.191.27241170'p  3U) ossec11301hVNew FTP connection.Apr 20 07:36:26 vm1 pure-ftpd[1696692]: (?@93.123.109.222) [INFO] New connection from 93.123.109.22293.123.109.222732800ko  -g# ossec13001hUExim Auth failed2025-04-20 07:29:56 dovecot_login authenticator failed for (223-30-0-0.lan.sify.net) [1.7.229.162]:37730: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)1.7.229.1621269750fn  -W) ossec13001hU'Exim Auth failed2025-04-20 07:30:07 dovecot_login authenticator failed for 61-220-111-185.hinet-ip.hinet.net [61.220.111.185]:32874: 535 Incorrect authentication data (set_id=sales)61.220.111.1851668284Qm  -1% ossec13001hMExim Auth failed2025-04-20 06:57:54 dovecot_login authenticator failed for ([185.43.10.11]) [185.43.10.11]:52682: 535 Incorrect authentication data (set_id=sales)185.43.10.112017370jl  -_) ossec13001hMExim Auth failed2025-04-20 06:57:46 dovecot_login authenticator failed for ([185.116.231.33]) [185.116.231.33]:41084: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)185.116.231.332017370fk  -]# ossec13001hK6Exim Auth failed2025-04-20 06:47:41 dovecot_login authenticator failed for ppp-58-11-36-28.revip2.asianet.co.th [58.11.36.28]:51131: 535 Incorrect authentication data (set_id=purchase)58.11.36.281605651gj  -]% ossec13001hK Exim Auth failed2025-04-20 06:47:19 dovecot_login authenticator failed for ([36.37.203.28]) [36.37.203.28]:46466: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)36.37.203.281831722fi  -W) ossec13001hIExim Auth failed2025-04-20 06:40:45 dovecot_login authenticator failed for ([160.155.229.28]) [160.155.229.28]:39064: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)160.155.229.282287781yh  -}) ossec13001hI|Exim Auth failed2025-04-20 06:40:19 dovecot_login authenticator failed for ([114.202.80.152]) [114.202.80.152]:53454: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)114.202.80.1521835841cg  -U% ossec13001hE?Exim Auth failed2025-04-20 06:22:14 dovecot_login authenticator failed for static-84-242-88-70.bb.vodafone.cz [84.242.88.70]:39052: 535 Incorrect authentication data (set_id=sales)84.242.88.703077311df  -W% ossec13001hE3Exim Auth failed2025-04-20 06:22:03 dovecot_login authenticator failed for ([175.206.1.60]) [175.206.1.60]:40046: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)175.206.1.601835841_e  -K' ossec13001hDExim Auth failed2025-04-20 06:19:13 dovecot_login authenticator failed for ([39.125.67.109]) [39.125.67.109]:57917: 535 Incorrect authentication data (set_id=vikas.khandelwal)39.125.67.1091835841d  -' ossec13001hDwExim Auth failed2025-04-20 06:18:54 dovecot_login authenticator failed for 179-189-85-66.goldnettelecom.com.br [179.189.85.66]:58794: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)179.189.85.663469034Wc  -9) ossec13001h@Exim Auth failed2025-04-20 05:59:59 dovecot_login authenticator failed for ([209.38.100.151]) [209.38.100.151]:38096: 535 Incorrect authentication data (set_id=sales)209.38.100.1512750405jb  -_) ossec13001h?Exim Auth failed2025-04-20 05:59:27 dovecot_login authenticator failed for ([165.140.51.197]) [165.140.50.170]:37334: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)165.140.50.1706251999 *\~tj`VLB8.$zpf\H>4*   v l b X N D : 0 &    ~ t j ` V L B 8 . $    z p f R H \ > 4 *  vlbXN:D0&|hr^TJ@6,"xnZdPF<2( ~tj`VLB8.$zpf\ | r h ^ T J @ 6 , "    x n d Z P F < 2 (   RRH>4*  vlbXND:0& hmG hlG hkIG hk=G hbBG hb2G h`\G h`RG h_G h_G hZG hYG hY\G hYPG hXG hXG hVG hRG hRG hJ.G hG G hFG hEEG hE-G hCG hCG hBG hBG hAG h@rG h@XF h>gF h3F h2F h/F h/F h/F h- F h-F h*"F h&F h&F h%F hF h`F hRF hxF hnF h F h F h F hpF hF hHF h hG= hG< h&G; hG: h G9 hG8 hG7 h|G6 hlG5 h]G4 h8G3 h?G2 h)G1 h[G0 hMG/ hG. hG- h5G, h#G+ hG* hG) hG( hG' hyG& hwG% hwLG$ hw>G# hr(G" hqF^ h5F] h5{F\ h/F[ h,MFY h,?FZ h)FX h(FW h%FV h%FU h FS h tFT hFR hFQ hFP hFO hFN hFM hFL h!FK h FJ h(GQ hFI hFH hFG hlFF hRFE h sFD h FC hFB hFA hF@ hF? hyF> hF= h޹F< hPF; hLF: hF9 h_F8 hփF6 hsF7 hhF5 h\F4 hF3 hF2 hIF1 hF0 huF. hiF/ hF, hF- hLF+ h4F* hF) hF( hcF' hF& hF% h@F$ hF# hF" hF! h{F N!  $ ' ) Mb_>+:Ng$  -[' ossec13001hExim Auth failed2025-04-20 12:00:27 dovecot_login authenticator failed for ([187.92.254.42]) [187.92.254.42]:35742: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)187.92.254.423469034l#  -a+ ossec13001hExim Auth failed2025-04-20 11:51:51 dovecot_login authenticator failed for (170-239-201-206.nortetelecom.net.br) [170.239.201.206]:58063: 535 Incorrect authentication data (set_id=sales)170.239.201.2063469034m"  -o ossec13001hmExim Auth failed2025-04-20 11:51:32 dovecot_login authenticator failed for c-68-50-3-2.hsd1.in.comcast.net [68.50.3.2]:56940: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)68.50.3.26252001!  W) ossec9708hDovecot Aborted Login with empty userApr 20 11:26:26 vm1 dovecot[90419]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=185.247.137.84, lip=103.74.54.108, TLS, session=185.247.137.84298795\  ;3+ ossec13008hMail Recipient rejected2025-04-20 11:07:18 H=(mail.s2seducationtrust.com) [165.154.210.137]:51712 F= rejected RCPT : Rejected relay attempt: '165.154.210.137' From: 'zzhxgbeeov@s2seducationtrust.com' To: 'validxxx@gmailhotmail.com.br'165.154.210.1371694008d  -W% ossec13001hExim Auth failed2025-04-20 10:52:52 dovecot_login authenticator failed for ([112.91.67.18]) [112.91.67.18]:43086: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)112.91.67.181814991R  -5' ossec13001hExim Auth failed2025-04-20 10:52:37 dovecot_login authenticator failed for ([65.20.205.197]) [65.20.205.197]:57995: 535 Incorrect authentication data (set_id=sales)65.20.205.19799237~  -) ossec13001hExim Auth failed2025-04-20 10:52:25 dovecot_login authenticator failed for 47-158-212-153.lsan.ca.frontiernet.net [47.158.212.153]:57672: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)47.158.212.1536252001f  -W) ossec13001hExim Auth failed2025-04-20 10:53:00 dovecot_login authenticator failed for 83-233-242-245.cust.bredband2.com [83.233.242.245]:51404: 535 Incorrect authentication data (set_id=sales)83.233.242.2452661886W  -9) ossec13001hMExim Auth failed2025-04-20 10:47:00 dovecot_login authenticator failed for ([195.211.39.216]) [195.211.39.216]:53702: 535 Incorrect authentication data (set_id=sales)195.211.39.2162017370y  -% ossec13001h-Exim Auth failed2025-04-20 10:46:28 dovecot_login authenticator failed for 66.68.243.35.bc.googleusercontent.com [35.243.68.66]:33058: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)35.243.68.661861060x  -y+ ossec13001h Exim Auth failed2025-04-20 10:41:39 dovecot_login authenticator failed for 122-222-117-139.east.ap.gmo-isp.jp [122.222.117.139]:54455: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)122.222.117.1391861060v  -y' ossec13001hExim Auth failed2025-04-20 10:41:26 dovecot_login authenticator failed for ([103.181.42.31]) [103.181.42.31]:11579: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)103.181.42.311210997{  -# ossec13001h~Exim Auth failed2025-04-20 10:27:14 dovecot_login authenticator failed for 50.24.14.46.static.wline.lns.sme.cust.swisscom.ch [46.14.24.50]:57737: 535 Incorrect authentication data (set_id=vikas.khandelwal)46.14.24.502658434}  - % ossec13001h~Exim Auth failed2025-04-20 10:26:49 dovecot_login authenticator failed for 89-109-4-133.dynamic.mts-nn.ru [89.109.4.133]:39829: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)89.109.4.1332017370Z  -=+ ossec13001htExim Auth failed2025-04-20 09:45:19 dovecot_login authenticator failed for ([178.178.194.126]) [178.178.194.126]:41622: 535 Incorrect authentication data (set_id=sales)178.178.194.1262017370    / , Y ez ga  -[' ossec13001h?Exim Auth failed2025-04-20 05:59:13 dovecot_login authenticator failed for ([37.28.177.141]) [37.28.177.141]:33364: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)37.28.177.1412017370o`  -k' ossec13001h? Exim Auth failed2025-04-20 05:55:47 dovecot_login authenticator failed for host81-130-174-76.in-addr.btopenworld.com [81.130.174.76]:53160: 535 Incorrect authentication data (set_id=services)81.130.174.762635167v_  -{% ossec13001h?Exim Auth failed2025-04-20 05:55:38 dovecot_login authenticator failed for 178.89.181.3.dynamic.telecom.kz [178.89.181.3]:50653: 535 Incorrect authentication data (set_id=services@heipowersystem.com)178.89.181.31522867"^  3M% ossec11301h>New FTP connection.Apr 20 05:55:29 vm1 pure-ftpd[1676178]: (?@20.29.47.110) [INFO] New connection from 20.29.47.11020.29.47.1106252001g]  -[' ossec13001h5Exim Auth failed2025-04-20 05:15:26 dovecot_login authenticator failed for syn-023-242-066-225.res.spectrum.com [23.242.66.225]:38728: 535 Incorrect authentication data (set_id=sales)23.242.66.2256252001f\  -[' ossec13001h5{Exim Auth failed2025-04-20 05:14:58 dovecot_login authenticator failed for ([185.167.56.34]) [185.167.56.34]:53020: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)185.167.56.34617790C[  77 ossec502h/Ossec server started.ossec: Ossec started.}Z  - # ossec13001h,?Exim Auth failed2025-04-20 04:35:34 dovecot_login authenticator failed for (95.0.252.81.static.ttnet.com.tr) [95.0.252.81]:38186: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)95.0.252.81298795nY  -i' ossec13001h,MExim Auth failed2025-04-20 04:35:48 dovecot_login authenticator failed for (170.250.128.5.hwccustomers.com) [170.250.128.5]:55836: 535 Incorrect authentication data (set_id=vikas.khandelwal)170.250.128.56252001]X  -K# ossec13001h)Exim Auth failed2025-04-20 04:22:01 dovecot_login authenticator failed for (nyaystambh.com) [14.18.77.99]:60060: 535 Incorrect authentication data (set_id=info@nyaystambh.com)14.18.77.991814991QW  -3# ossec13001h(Exim Auth failed2025-04-20 04:21:31 dovecot_login authenticator failed for (nyaystambh.com) [14.18.77.99]:55998: 535 Incorrect authentication data (set_id=nologin)14.18.77.991814991NV  --# ossec13001h%Exim Auth failed2025-04-20 04:08:13 dovecot_login authenticator failed for ([61.2.142.21]) [61.2.142.21]:40704: 535 Incorrect authentication data (set_id=sales)61.2.142.211269750~U  -) ossec13001h%Exim Auth failed2025-04-20 04:07:51 dovecot_login authenticator failed for (static.ill.117.248.104.34.bsnl.co.in) [117.248.104.34]:35488: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)117.248.104.341269750gT  -[' ossec13001h tExim Auth failed2025-04-20 03:45:16 dovecot_login authenticator failed for ([14.53.126.112]) [14.53.126.112]:34264: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)14.53.126.1121835841cS  -S' ossec13001h Exim Auth failed2025-04-20 03:45:27 dovecot_login authenticator failed for 111-70-21-178.emome-ip.hinet.net [111.70.21.178]:39508: 535 Incorrect authentication data (set_id=sales)111.70.21.1781668284R  ;) ossec13008hMail Recipient rejected2025-04-20 03:43:06 H=(localhost.localdomain) [78.153.140.207]:43450 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no F= rejected RCPT : Sender verify failed78.153.140.2072635167dQ  -S+ ossec13001hExim Auth failed2025-04-20 03:38:23 dovecot_login authenticator failed for ([196.189.124.218]) [196.189.124.218]:59764: 535 Incorrect authentication data (set_id=vikas.khandelwal)196.189.124.218337996 k h v $ ' Q `WhwkP  -) ossec13001hExim Auth failed2025-04-20 03:37:48 dovecot_login authenticator failed for syn-067-242-117-151.res.spectrum.com [67.242.117.151]:57118: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)67.242.117.1516252001lO  -c) ossec13001hExim Auth failed2025-04-20 03:29:29 dovecot_login authenticator failed for syn-173-095-123-220.biz.spectrum.com [173.95.123.220]:48144: 535 Incorrect authentication data (set_id=purchase)173.95.123.2206252001jN  -a' ossec13001hExim Auth failed2025-04-20 03:29:04 dovecot_login authenticator failed for ([218.87.91.108]) [218.87.91.108]:38536: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)218.87.91.1081814991LM  ;+ ossec13008hMail Recipient rejected2025-04-20 03:22:29 H=(mail.thepsindustries.com) [165.154.228.180]:58539 F= rejected RCPT : Rejected relay attempt: '165.154.228.180' From: 'qhncp@thepsindustries.com' To: 'validxxx@gmailhotmail.com.br'165.154.228.1801643084L  ;5% ossec13008hMail Recipient rejected2025-04-20 03:21:24 H=static-185-95-84-71.sunucuhub.com [185.95.84.71]:36088 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no F= rejected RCPT : Sender verify failed185.95.84.71298795XK  -;) ossec13001h!Exim Auth failed2025-04-20 03:01:12 dovecot_login authenticator failed for ([159.223.250.131]) [161.35.200.202]:38704: 535 Incorrect authentication data (set_id=sales)161.35.200.2022921044dJ  -W% ossec13001h Exim Auth failed2025-04-20 03:00:50 dovecot_login authenticator failed for ([209.14.2.218]) [209.14.2.218]:51804: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)209.14.2.2183469034vI  -y' ossec13001hExim Auth failed2025-04-20 02:47:54 dovecot_login authenticator failed for ([1.236.156.129]) [1.236.156.129]:50162: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)1.236.156.1291835841TH  -5' ossec13001hExim Auth failed2025-04-20 02:46:50 dovecot_login authenticator failed for ([163.47.36.198]) [163.47.36.198]:57709: 535 Incorrect authentication data (set_id=sales)163.47.36.1981210997lG  -g% ossec13001hExim Auth failed2025-04-20 02:46:41 dovecot_login authenticator failed for bl23-65-30.dsl.telepac.pt [144.64.65.30]:3036: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)144.64.65.302264397QF  -1% ossec13001hlExim Auth failed2025-04-20 02:45:23 dovecot_login authenticator failed for ([221.210.9.83]) [221.210.9.82]:41999: 535 Incorrect authentication data (set_id=sales)221.210.9.821814991xE  -{) ossec13001hRExim Auth failed2025-04-20 02:44:57 dovecot_login authenticator failed for d75-155-135-162.bchsia.telus.net [75.155.135.162]:51692: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)75.155.135.1626251999MD  ;% ossec13008h sMail Recipient rejected2025-04-20 02:19:53 H=cloudhost-2913600.us-midwest-1.nxcli.net [8.29.155.219]:45224 X=TLS1.2:ECDHE-RSA-AES128-GCM-SHA256:128 CV=no F= temporarily rejected RCPT : Could not complete sender verify8.29.155.2196252001mC  -e) ossec13001h Exim Auth failed2025-04-20 02:07:56 dovecot_login authenticator failed for ([118.36.234.156]) [118.36.234.156]:50064: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)118.36.234.1561835841B EW ossec5740hssh connection reset by peerApr 20 02:03:09 vm1 sshd[1627849]: error: kex_exchange_identification: read: Connection reset by peerqA  -k+ ossec13001hExim Auth failed2025-04-20 01:08:13 dovecot_login authenticator failed for (r552pc2.ee.ntu.edu.tw) [131.107.147.178]:37706: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)131.107.147.1786252001 v 1 [ U o \:@Q*WPevj  -_) ossec13001htExim Auth failed2025-04-20 09:45:08 dovecot_login authenticator failed for ([119.62.184.134]) [119.62.184.134]:32950: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)119.62.184.1341814991f  -W) ossec13001hr~Exim Auth failed2025-04-20 09:35:17 dovecot_login authenticator failed for ([211.51.140.148]) [211.51.140.148]:43688: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)211.51.140.1481835841  -% ossec13001hrrExim Auth failed2025-04-20 09:35:06 dovecot_login authenticator failed for 111-70-27-30.emome-ip.hinet.net [111.70.27.30]:52271: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)111.70.27.301668284N  --# ossec13001hrBExim Auth failed2025-04-20 09:34:17 dovecot_login authenticator failed for ([46.44.5.135]) [46.44.5.135]:50924: 535 Incorrect authentication data (set_id=sales)46.44.5.1352017370g  -[' ossec13001hr2Exim Auth failed2025-04-20 09:34:01 dovecot_login authenticator failed for ([31.173.66.222]) [31.173.66.222]:47238: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)31.173.66.22220173706  ;g+ ossec13008hqMail Recipient rejected2025-04-20 09:32:24 H=(mail.hsnews.in) [165.154.228.180]:50664 F= rejected RCPT : Rejected relay attempt: '165.154.228.180' From: 'fxxhxctld@hsnews.in' To: 'validxxx@gmailhotmail.com.br'165.154.228.1801643084j  -c% ossec13001hpExim Auth failed2025-04-20 09:27:01 dovecot_login authenticator failed for ool-43531ec7.dyn.optonline.net [67.83.30.199]:44851: 535 Incorrect authentication data (set_id=vikas.khandelwal)67.83.30.1996252001u  -u) ossec13001hp~Exim Auth failed2025-04-20 09:26:44 dovecot_login authenticator failed for ([128.185.253.90]) [128.185.253.90]:39274: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)128.185.253.901269750  W) ossec9708hmDovecot Aborted Login with empty userApr 20 09:14:38 vm1 dovecot[90419]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=87.236.176.143, lip=103.74.54.108, TLS, session=87.236.176.1432635167  [{' ossec12004hlPossible Dovecot CVE-2019-11500 attemptApr 20 09:11:37 vm1 dovecot[90419]: pop3-login: Disconnected: Input buffer full (no auth attempts in 1 secs): user=<>, rip=18.224.18.177, lip=103.74.54.108, session=<1NZRhy0z2N0S4BKx>18.224.18.1776252001a  -O) ossec13001hj}Exim Auth failed2025-04-20 09:01:07 dovecot_login authenticator failed for ([192.109.217.14]) [192.109.217.14]:48648: 535 Incorrect authentication data (set_id=vikas.khandelwal)192.109.217.14783754  -' ossec13001hjmExim Auth failed2025-04-20 09:00:51 dovecot_login authenticator failed for 95.57.104.252.dynamic.telecom.kz [95.57.104.252]:35714: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)95.57.104.2521522867Q  -1% ossec13001hhExim Auth failed2025-04-20 08:54:38 dovecot_login authenticator failed for ([94.228.240.2]) [94.228.240.2]:50704: 535 Incorrect authentication data (set_id=sales)94.228.240.22017370j  -_) ossec13001hhExim Auth failed2025-04-20 08:54:29 dovecot_login authenticator failed for ([123.209.107.18]) [123.209.107.18]:41012: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)123.209.107.182077456l  -e' ossec13001hdExim Auth failed2025-04-20 08:37:39 dovecot_login authenticator failed for (205.124.53.119.adsl-pool.jlccptt.net.cn) [119.53.131.19]:18990: 535 Incorrect authentication data (set_id=sales)119.53.131.191814991j  -_) ossec13001hdExim Auth failed2025-04-20 08:37:24 dovecot_login authenticator failed for ([171.50.144.113]) [171.50.144.113]:47524: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)171.50.144.1131269750 .U : E n WaNw  -y) ossec13001hdExim Auth failed2025-04-20 08:37:05 dovecot_login authenticator failed for nova-185-040-122-250.cpe.novanet.is [185.40.122.250]:43855: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)185.40.122.2502629691y  -}) ossec13001hdExim Auth failed2025-04-20 08:36:53 dovecot_login authenticator failed for ([49.124.147.101]) [49.124.147.101]:47648: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)49.124.147.1011733045_  -K' ossec13001hbExim Auth failed2025-04-20 08:28:28 dovecot_login authenticator failed for ([178.163.29.54]) [178.163.29.54]:52850: 535 Incorrect authentication data (set_id=vikas.khandelwal)178.163.29.542017370o  -m% ossec13001hbExim Auth failed2025-04-20 08:28:15 dovecot_login authenticator failed for ([89.23.69.151]) [89.23.69.151]:37702: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)89.23.69.1516290252(  3U) ossec11301h`^New FTP connection.Apr 20 08:17:57 vm1 pure-ftpd[1705983]: (?@198.235.24.202) [INFO] New connection from 198.235.24.202198.235.24.2026252001E  gY+ ossec11307h_AMultiple connection attempts from same sourceApr 20 08:13:13 vm1 pure-ftpd[1704925]: (?@139.162.119.146) [INFO] New connection from 139.162.119.146139.162.119.1461861060,~ 3Y+ ossec11301h_ANew FTP connection.Apr 20 08:13:13 vm1 pure-ftpd[1704923]: (?@139.162.119.146) [INFO] New connection from 139.162.119.146139.162.119.1461861060,} 3Y+ ossec11301h_New FTP connection.Apr 20 08:12:35 vm1 pure-ftpd[1704756]: (?@139.162.119.146) [INFO] New connection from 139.162.119.146139.162.119.1461861060,| 3Y+ ossec11301h^New FTP connection.Apr 20 08:10:20 vm1 pure-ftpd[1704307]: (?@139.162.119.146) [INFO] New connection from 139.162.119.146139.162.119.1461861060q{  -k+ ossec13001h]Exim Auth failed2025-04-20 08:07:23 dovecot_login authenticator failed for (107-172-132-179-host.colocrossing.com) [107.172.132.179]:44582: 535 Incorrect authentication data (set_id=purchase)107.172.132.1796252001z  --+ ossec13001h]Exim Auth failed2025-04-20 08:07:12 dovecot_login authenticator failed for (abts-mum-dynamic-169.185.170.122-airtelbroadband.in) [122.170.185.169]:34404: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)122.170.185.1691269750Ry  -7% ossec13001hYExim Auth failed2025-04-20 07:46:53 dovecot_login authenticator failed for ([65.20.191.43]) [65.20.191.43]:49786: 535 Incorrect authentication data (set_id=services)65.20.191.4399237px  -i+ ossec13001hXExim Auth failed2025-04-20 07:46:11 dovecot_login authenticator failed for ([175.162.114.139]) [175.162.114.139]:56596: 535 Incorrect authentication data (set_id=services@heipowersystem.com)175.162.114.1391814991:w  Ak) ossec11302hXFTP Authentication failed.Apr 20 07:42:41 vm1 pure-ftpd[1697999]: (?@118.193.35.202) [WARNING] Authentication failed for user [anonymous]118.193.35.2021819730)v 3U) ossec11301hXNew FTP connection.Apr 20 07:42:34 vm1 pure-ftpd[1697999]: (?@118.193.35.202) [INFO] New connection from 118.193.35.202118.193.35.2021819730)u 3U) ossec11301hXNew FTP connection.Apr 20 07:42:15 vm1 pure-ftpd[1697942]: (?@118.193.35.202) [INFO] New connection from 118.193.35.202118.193.35.2021819730Tt  -5' ossec13001hVExim Auth failed2025-04-20 07:37:51 dovecot_login authenticator failed for ([112.182.67.50]) [211.217.50.31]:55933: 535 Incorrect authentication data (set_id=sales)211.217.50.311835841Ms  --# ossec13001hVExim Auth failed2025-04-20 07:37:40 dovecot_login authenticator failed for ([5.11.137.83]) [5.11.137.83]:37339: 535 Incorrect authentication data (set_id=sales)5.11.137.83298795 '8 \ e w _ 3vg6  -]% ossec13001h+Exim Auth failed2025-04-20 13:32:49 dovecot_login authenticator failed for ([212.3.152.47]) [212.3.152.47]:43826: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)212.3.152.472017370"5  3M% ossec11301h#New FTP connection.Apr 20 13:32:41 vm1 pure-ftpd[1772142]: (?@20.65.194.77) [INFO] New connection from 20.65.194.7720.65.194.776252001b4  -O) ossec13001hExim Auth failed2025-04-20 13:22:42 dovecot_login authenticator failed for ([171.50.144.113]) [171.50.144.113]:60830: 535 Incorrect authentication data (set_id=vikas.khandelwal)171.50.144.11312697503  -%+ ossec13001hExim Auth failed2025-04-20 13:22:33 dovecot_login authenticator failed for (nsg-corporate-247.229.187.122.airtel.in) [122.187.229.247]:56253: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)122.187.229.2471269750%2  3Q' ossec11301hkNew FTP connection.Apr 20 13:08:18 vm1 pure-ftpd[1767150]: (?@18.221.119.14) [INFO] New connection from 18.221.119.1418.221.119.146252001a1  -M) ossec13001h_Exim Auth failed2025-04-20 13:08:07 dovecot_login authenticator failed for n218103189089.netvigator.com [218.103.189.89]:52996: 535 Incorrect authentication data (set_id=sales)218.103.189.891819730m0  -c+ ossec13001hMExim Auth failed2025-04-20 13:07:49 dovecot_login authenticator failed for ([178.178.194.136]) [178.178.194.136]:40570: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)178.178.194.1362017370%/  3Q' ossec11301hGNew FTP connection.Apr 20 13:07:41 vm1 pure-ftpd[1766931]: (?@18.221.119.14) [INFO] New connection from 18.221.119.1418.221.119.146252001%.  3Q' ossec11301hNew FTP connection.Apr 20 13:05:53 vm1 pure-ftpd[1766540]: (?@18.221.119.14) [INFO] New connection from 18.221.119.1418.221.119.146252001%-  3Q' ossec11301hNew FTP connection.Apr 20 13:02:21 vm1 pure-ftpd[1765835]: (?@18.221.119.14) [INFO] New connection from 18.221.119.1418.221.119.146252001%,  3Q' ossec11301hNew FTP connection.Apr 20 13:01:55 vm1 pure-ftpd[1765767]: (?@18.221.119.14) [INFO] New connection from 18.221.119.1418.221.119.146252001+  ;) ossec13008hMail Recipient rejected2025-04-20 13:01:54 H=(localhost.localdomain) [78.153.140.207]:37548 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no F= rejected RCPT : Sender verify failed78.153.140.2072635167+*  3Y+ ossec11301hNew FTP connection.Apr 20 12:56:07 vm1 pure-ftpd[1764489]: (?@172.171.247.137) [INFO] New connection from 172.171.247.137172.171.247.1376252001i)  -[+ ossec13001hExim Auth failed2025-04-20 12:32:55 dovecot_login authenticator failed for ([120.157.208.194]) [120.157.208.194]:52016: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)120.157.208.1942077456r(  -u% ossec13001hExim Auth failed2025-04-20 12:32:42 dovecot_login authenticator failed for ([206.42.79.74]) [206.42.79.74]:56716: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)206.42.79.74203312W'  -9) ossec13001hExim Auth failed2025-04-20 12:31:39 dovecot_login authenticator failed for ([165.140.51.221]) [165.140.50.170]:39108: 535 Incorrect authentication data (set_id=sales)165.140.50.1706251999j&  -_) ossec13001hExim Auth failed2025-04-20 12:31:19 dovecot_login authenticator failed for ([112.168.71.109]) [112.168.71.109]:48928: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)112.168.71.1091835841T%  -5' ossec13001hExim Auth failed2025-04-20 12:00:42 dovecot_login authenticator failed for ([114.30.180.58]) [114.30.180.58]:38696: 535 Incorrect authentication data (set_id=sales)114.30.180.581835841 5 G \ a | ~OG  ;) ossec13008h:Mail Recipient rejected2025-04-20 15:15:29 H=(localhost.localdomain) [78.153.140.207]:54424 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no F= rejected RCPT : Sender verify failed78.153.140.2072635167qF  -m) ossec13001h2Exim Auth failed2025-04-20 15:15:21 dovecot_login authenticator failed for nz151l120.bb60246.ctm.net [60.246.151.120]:43365: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)60.246.151.1201821275TE  -7% ossec13001hlExim Auth failed2025-04-20 14:59:15 dovecot_login authenticator failed for ([119.28.16.72]) [119.28.16.72]:36674: 535 Incorrect authentication data (set_id=services)119.28.16.721819730yD  -) ossec13001h`Exim Auth failed2025-04-20 14:59:04 dovecot_login authenticator failed for dsl-197-245-69-221.voxdsl.co.za [197.245.69.221]:38944: 535 Incorrect authentication data (set_id=services@heipowersystem.com)197.245.69.221953987"C  3M% ossec11301hNew FTP connection.Apr 20 14:31:11 vm1 pure-ftpd[1785058]: (?@203.55.131.5) [INFO] New connection from 203.55.131.5203.55.131.56252001)B  EK% ossec5715hSSHD authentication success.Apr 20 14:17:10 vm1 sshd[1782193]: Accepted password for root from 103.190.54.7 port 50915 ssh2103.190.54.71269750)A  EK% ossec5715hHSSHD authentication success.Apr 20 14:15:59 vm1 sshd[1781927]: Accepted password for root from 103.190.54.7 port 50914 ssh2103.190.54.71269750|@  -) ossec13001hExim Auth failed2025-04-20 14:14:54 dovecot_login authenticator failed for c-76-149-165-107.hsd1.ut.comcast.net [76.149.165.107]:56331: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)76.149.165.1076252001Q?  -1% ossec13001hExim Auth failed2025-04-20 14:15:10 dovecot_login authenticator failed for ([98.70.127.17]) [98.70.127.17]:49792: 535 Incorrect authentication data (set_id=sales)98.70.127.171269750w>  -y) ossec13001hExim Auth failed2025-04-20 13:56:14 dovecot_login authenticator failed for 47-157-217-116.fdr01.covn.ca.ip.frontiernet.net [47.157.217.116]:53652: 535 Incorrect authentication data (set_id=services)47.157.217.1166252001y=  -}) ossec13001hExim Auth failed2025-04-20 13:56:03 dovecot_login authenticator failed for (m182-153-173-49.smartone.com) [182.153.173.49]:52880: 535 Incorrect authentication data (set_id=services@heipowersystem.com)182.153.173.491819730`<  -O% ossec13001hExim Auth failed2025-04-20 13:53:44 dovecot_login authenticator failed for ([180.94.74.82]) [180.94.74.82]:37771: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)180.94.74.821149361v;  -y' ossec13001hExim Auth failed2025-04-20 13:53:28 dovecot_login authenticator failed for ([61.108.83.138]) [61.108.83.138]:59409: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)61.108.83.1381835841f:  -[' ossec13001hExim Auth failed2025-04-20 13:47:36 dovecot_login authenticator failed for ([94.205.82.166]) [94.205.82.166]:41146: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)94.205.82.166290557i9  -]) ossec13001hExim Auth failed2025-04-20 13:47:57 dovecot_login authenticator failed for 144.46.246.220.static.netvigator.com [220.246.46.144]:57554: 535 Incorrect authentication data (set_id=sales)220.246.46.1441819730W8  -;' ossec13001h[Exim Auth failed2025-04-20 13:33:38 dovecot_login authenticator failed for ([103.47.74.210]) [103.47.74.210]:36372: 535 Incorrect authentication data (set_id=purchase)103.47.74.2101269750j7  -a' ossec13001hKExim Auth failed2025-04-20 13:33:22 dovecot_login authenticator failed for ([183.182.99.92]) [183.182.99.92]:35837: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)183.182.99.921655842 (I X | 1>BcUs"X  3M% ossec11301hNew FTP connection.Apr 20 17:39:38 vm1 pure-ftpd[1825637]: (?@139.162.77.6) [INFO] New connection from 139.162.77.6139.162.77.61861060]W  -I' ossec13001hExim Auth failed2025-04-20 17:38:11 dovecot_login authenticator failed for (82.193.122.91.cl.ipnet.ua) [82.193.122.91]:55284: 535 Incorrect authentication data (set_id=sales)82.193.122.91690791 V  -) ossec13001hExim Auth failed2025-04-20 17:38:00 dovecot_login authenticator failed for (92x255x196x185.static-customer.kzn.ertelecom.ru) [92.255.196.185]:55564: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)92.255.196.1852017370ZU  -?) ossec13001h4Exim Auth failed2025-04-20 17:06:19 dovecot_login authenticator failed for ([121.179.93.147]) [121.179.93.147]:52294: 535 Incorrect authentication data (set_id=purchase)121.179.93.1471835841wT  -{' ossec13001h$Exim Auth failed2025-04-20 17:06:04 dovecot_login authenticator failed for host-85-237-57-200.dsl.sura.ru [85.237.57.200]:38644: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)85.237.57.2002017370nS  -g) ossec13001h۪Exim Auth failed2025-04-20 17:04:01 dovecot_login authenticator failed for (heipowersystem.com) [42.193.105.109]:45478: 535 Incorrect authentication data (set_id=support@heipowersystem.com)42.193.105.1091814991[R  -A) ossec13001hےExim Auth failed2025-04-20 17:03:37 dovecot_login authenticator failed for (heipowersystem.com) [42.193.105.109]:33540: 535 Incorrect authentication data (set_id=nologin)42.193.105.1091814991QQ  -1% ossec13001hExim Auth failed2025-04-20 16:30:34 dovecot_login authenticator failed for ([47.83.30.238]) [47.83.30.238]:56936: 535 Incorrect authentication data (set_id=sales)47.83.30.2381819730xP  -{) ossec13001hExim Auth failed2025-04-20 16:30:21 dovecot_login authenticator failed for (ip-45-155-145-142.ip.asarta.ru) [45.155.145.142]:57316: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)45.155.145.1422017370fO  -[' ossec13001h%Exim Auth failed2025-04-20 15:45:00 dovecot_login authenticator failed for ([188.56.33.153]) [188.56.33.153]:49746: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)188.56.33.153298795WN  -9) ossec13001h=Exim Auth failed2025-04-20 15:45:25 dovecot_login authenticator failed for ([218.206.52.162]) [218.206.52.162]:39676: 535 Incorrect authentication data (set_id=sales)218.206.52.1621814991cM  -U% ossec13001hExim Auth failed2025-04-20 15:23:06 dovecot_login authenticator failed for c-24-2-163-249.hsd1.ct.comcast.net [24.2.163.249]:34566: 535 Incorrect authentication data (set_id=sales)24.2.163.2496252001dL  -W% ossec13001hExim Auth failed2025-04-20 15:22:49 dovecot_login authenticator failed for ([78.36.41.213]) [78.36.41.213]:55194: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)78.36.41.2132017370WK  -;' ossec13001h^Exim Auth failed2025-04-20 15:20:20 dovecot_login authenticator failed for ([60.166.31.198]) [60.166.31.198]:53407: 535 Incorrect authentication data (set_id=purchase)60.166.31.1981814991lJ  -e' ossec13001hJExim Auth failed2025-04-20 15:20:01 dovecot_login authenticator failed for (www.safecleen.com) [58.49.113.138]:11810: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)58.49.113.1381814991ZI -?' ossec13001hExim Auth failed2025-04-20 15:19:10 dovecot_login authenticator failed for (heipowersystem.com) [221.229.216.1]:33454: 535 Incorrect authentication data (set_id=nologin)221.229.216.11814991SH  -5' ossec13001h<Exim Auth failed2025-04-20 15:15:31 dovecot_login authenticator failed for ([87.200.88.209]) [87.200.88.209]:59709: 535 Incorrect authentication data (set_id=sales)87.200.88.209290557 h  0  #&Jh]i  -K# ossec13001hExim Auth failed2025-04-20 19:54:07 dovecot_login authenticator failed for 111-70-19-8.emome-ip.hinet.net [111.70.19.8]:57561: 535 Incorrect authentication data (set_id=sales)111.70.19.81668284Wh  -9) ossec13001hHExim Auth failed2025-04-20 19:53:03 dovecot_login authenticator failed for ([45.118.136.243]) [45.118.136.243]:59755: 535 Incorrect authentication data (set_id=sales)45.118.136.2431562822gg  -[' ossec13001h<Exim Auth failed2025-04-20 19:52:51 dovecot_login authenticator failed for ([222.99.52.202]) [222.99.52.202]:43626: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)222.99.52.2021835841 f  [y% ossec12004hPossible Dovecot CVE-2019-11500 attemptApr 20 19:39:17 vm1 dovecot[90419]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.137.174.56, lip=103.74.54.108, session=<+5YQTDYzjo8Dia44>3.137.174.566252001de  -U' ossec13001h}Exim Auth failed2025-04-20 19:36:53 dovecot_login authenticator failed for ool-45734cba.dyn.optonline.net [69.115.76.186]:53064: 535 Incorrect authentication data (set_id=services)69.115.76.1866252001dd  -Y# ossec13001huExim Auth failed2025-04-20 19:36:45 dovecot_login authenticator failed for ([112.94.6.54]) [112.94.6.54]:26184: 535 Incorrect authentication data (set_id=services@heipowersystem.com)112.94.6.541814991Vc  -9) ossec13001hExim Auth failed2025-04-20 18:45:48 dovecot_login authenticator failed for ([196.46.200.113]) [196.46.200.113]:46181: 535 Incorrect authentication data (set_id=sales)196.46.200.113895949jb  -_) ossec13001htExim Auth failed2025-04-20 18:45:31 dovecot_login authenticator failed for ([114.254.81.120]) [114.254.81.120]:57060: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)114.254.81.1201814991sa  -s' ossec13001huExim Auth failed2025-04-20 18:32:45 dovecot_login authenticator failed for c-85-225-19-144.bbcust.telenor.se [85.225.19.144]:51515: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)85.225.19.1442661886y`  -}) ossec13001hmExim Auth failed2025-04-20 18:32:37 dovecot_login authenticator failed for ([217.195.94.243]) [217.195.94.243]:34849: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)217.195.94.2432017370j_  -_) ossec13001h#Exim Auth failed2025-04-20 18:27:07 dovecot_login authenticator failed for ([120.157.208.33]) [120.157.208.33]:49898: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)120.157.208.332077456Z^  -=+ ossec13001h/Exim Auth failed2025-04-20 18:27:19 dovecot_login authenticator failed for ([171.244.141.222]) [171.244.141.222]:41403: 535 Incorrect authentication data (set_id=sales)171.244.141.2221562822(]  3U) ossec11301hNew FTP connection.Apr 20 18:20:58 vm1 pure-ftpd[1834155]: (?@194.165.16.165) [INFO] New connection from 194.165.16.165194.165.16.1652993457i\  -[+ ossec13001hVExim Auth failed2025-04-20 18:15:09 dovecot_login authenticator failed for ([211.221.130.246]) [211.221.130.246]:51316: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)211.221.130.2461835841p[  -q# ossec13001hFExim Auth failed2025-04-20 18:14:54 dovecot_login authenticator failed for ([103.60.89.9]) [103.60.89.2]:39268: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)103.60.89.21643084kZ  -e% ossec13001h Exim Auth failed2025-04-20 17:48:20 dovecot_login authenticator failed for 111-70-51-60.emome-ip.hinet.net [111.70.51.60]:38124: 535 Incorrect authentication data (set_id=vikas.khandelwal)111.70.51.601668284xY  -y+ ossec13001hExim Auth failed2025-04-20 17:48:09 dovecot_login authenticator failed for ([119.203.251.186]) [119.203.251.186]:43446: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)119.203.251.1861835841  0(y  3U) ossec11301h/New FTP connection.Apr 20 23:02:10 vm1 pure-ftpd[1892575]: (?@184.105.139.67) [INFO] New connection from 184.105.139.67184.105.139.676252001qx  -o' ossec13001h- Exim Auth failed2025-04-20 22:51:16 dovecot_login authenticator failed for (corporativo.static.gvt.net.br) [177.43.43.211]:52826: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)177.43.43.2113469034w  -# ossec13001h-Exim Auth failed2025-04-20 22:51:04 dovecot_login authenticator failed for 83-81-93-98.cable.dynamic.v4.ziggo.nl [83.81.93.98]:47022: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)83.81.93.982750405v  ;) ossec13008h*"Mail Recipient rejected2025-04-20 22:38:50 H=(localhost.localdomain) [78.153.140.207]:60886 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no F= rejected RCPT : Sender verify failed78.153.140.2072635167]u  -I% ossec13001h&Exim Auth failed2025-04-20 22:24:58 dovecot_login authenticator failed for ([203.29.84.253]) [203.63.46.34]:20372: 535 Incorrect authentication data (set_id=vikas.khandelwal)203.63.46.342077456ot  -m% ossec13001h&Exim Auth failed2025-04-20 22:24:47 dovecot_login authenticator failed for ([1.224.58.243]) [1.224.58.243]:55868: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)1.224.58.2431835841+s  3Y+ ossec11301h%New FTP connection.Apr 20 22:19:58 vm1 pure-ftpd[1883818]: (?@182.138.158.208) [INFO] New connection from 182.138.158.208182.138.158.2081814991%r  3Q' ossec11301hNew FTP connection.Apr 20 21:38:24 vm1 pure-ftpd[1874622]: (?@205.210.31.66) [INFO] New connection from 205.210.31.66205.210.31.666252001Wq  -9) ossec13001h`Exim Auth failed2025-04-20 21:01:44 dovecot_login authenticator failed for ([220.77.182.170]) [220.77.182.170]:38914: 535 Incorrect authentication data (set_id=sales)220.77.182.1701835841op  -k' ossec13001hRExim Auth failed2025-04-20 21:01:29 dovecot_login authenticator failed for 126.64.125.78.rev.sfr.net [78.125.64.126]:36854: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)78.125.64.1263017382no  -e+ ossec13001hxExim Auth failed2025-04-20 20:57:51 dovecot_login authenticator failed for (static.ill.117.248.107.130.bsnl.co.in) [117.248.107.130]:35540: 535 Incorrect authentication data (set_id=sales)117.248.107.1301269750n  -') ossec13001hnExim Auth failed2025-04-20 20:57:42 dovecot_login authenticator failed for (abts-north-dynamic-169.34.173.122.airtelbroadband.in) [122.173.34.169]:54265: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)122.173.34.1691269750dm  -U' ossec13001h Exim Auth failed2025-04-20 20:30:40 dovecot_login authenticator failed for ip117.net-81-16-170.koping.net [81.16.170.117]:36776: 535 Incorrect authentication data (set_id=purchase)81.16.170.1172661886vl  -y' ossec13001h Exim Auth failed2025-04-20 20:30:28 dovecot_login authenticator failed for 54.126.103.87.rev.vodafone.pt [87.103.126.54]:49073: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)87.103.126.542264397Uk  ;') ossec13008h Mail Recipient rejected2025-04-20 19:56:39 H=(mail.saintsoldiercollege.com) [165.154.242.42]:55740 F= rejected RCPT : Rejected relay attempt: '165.154.242.42' From: 'drtgk@saintsoldiercollege.com' To: 'validxxx@gmailhotmail.com.br'165.154.242.421694008 j  -)' ossec13001hpExim Auth failed2025-04-20 19:53:44 dovecot_login authenticator failed for (beer-sheva-hotnet145-cmts7-77-139-82-133.hotnet.net.il) [77.139.82.133]:45379: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)77.139.82.133294640  0 W  Ti  ;) ossec13008hJ.Mail Recipient rejected2025-04-21 00:55:33 H=(localhost.localdomain) [78.153.140.207]:47328 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no F= rejected RCPT : Sender verify failed78.153.140.2072635167c  -S' ossec13001hG Exim Auth failed2025-04-21 00:42:12 dovecot_login authenticator failed for ([39.125.67.109]) [39.125.67.109]:47960: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)39.125.67.1091835841  -' ossec13001hFExim Auth failed2025-04-21 00:41:49 dovecot_login authenticator failed for (rw-00130-94.59.137.rcil.gov.in) [137.59.94.130]:42264: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)137.59.94.1301269750q  -o' ossec13001hEEExim Auth failed2025-04-21 00:34:36 dovecot_login authenticator failed for (ool-4b7fcd5b.static.optonline.net) [75.127.205.91]:34240: 535 Incorrect authentication data (set_id=vikas.khandelwal)75.127.205.916252001v  -w) ossec13001hE-Exim Auth failed2025-04-21 00:34:11 dovecot_login authenticator failed for ([120.238.250.162]) [121.33.189.210]:41844: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)121.33.189.2101814991q  -m) ossec13001hCExim Auth failed2025-04-21 00:28:47 dovecot_login authenticator failed for ool-addc7a34.static.optonline.net [173.220.122.52]:48326: 535 Incorrect authentication data (set_id=vikas.khandelwal)173.220.122.526252001l  -i# ossec13001hCExim Auth failed2025-04-21 00:28:36 dovecot_login authenticator failed for ([94.251.8.83]) [94.251.8.83]:51200: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)94.251.8.832017370T  -5' ossec13001hBExim Auth failed2025-04-21 00:24:40 dovecot_login authenticator failed for ([116.237.2.156]) [116.237.2.156]:40652: 535 Incorrect authentication data (set_id=sales)116.237.2.1561814991f  -[' ossec13001hBExim Auth failed2025-04-21 00:24:21 dovecot_login authenticator failed for ([45.240.88.249]) [45.240.88.249]:37640: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)45.240.88.249357994(  3U) ossec11301hANew FTP connection.Apr 21 00:20:28 vm1 pure-ftpd[1910222]: (?@167.94.145.101) [INFO] New connection from 167.94.145.101167.94.145.1016252001W  -;' ossec13001h@rExim Auth failed2025-04-21 00:14:01 dovecot_login authenticator failed for ([46.163.154.14]) [46.163.154.14]:55728: 535 Incorrect authentication data (set_id=purchase)46.163.154.142017370j  -a' ossec13001h@XExim Auth failed2025-04-21 00:13:34 dovecot_login authenticator failed for ([111.61.176.62]) [111.61.176.62]:37184: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)111.61.176.621814991~  ?1 ossec1008h>gProcess exiting (killed).Apr 21 00:05:19 vm1 spamd[1301071]: spamd: server killed by SIGTERM, shutting downT}  -5' ossec13001h3Exim Auth failed2025-04-20 23:16:57 dovecot_login authenticator failed for ([197.211.47.66]) [197.211.47.66]:46472: 535 Incorrect authentication data (set_id=sales)197.211.47.662328926d|  -W% ossec13001h2Exim Auth failed2025-04-20 23:16:32 dovecot_login authenticator failed for ([120.157.3.49]) [120.157.3.49]:38052: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)120.157.3.492077456]{  -K# ossec13001h/Exim Auth failed2025-04-20 23:03:48 dovecot_login authenticator failed for ([206.0.8.204]) [206.0.8.204]:33324: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)206.0.8.2043469034z  -% ossec13001h/Exim Auth failed2025-04-20 23:03:37 dovecot_login authenticator failed for nympanxc01t.mediacomtools.net [50.81.91.210]:41150: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)50.81.91.2106252001 * )  0 2 JHoru  -u) ossec13001hk=Exim Auth failed2025-04-21 03:16:35 dovecot_login authenticator failed for ([119.164.89.121]) [119.164.89.121]:56721: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)119.164.89.1211814991g  -Y) ossec13001hbBExim Auth failed2025-04-21 02:38:17 dovecot_login authenticator failed for c-84-216-198-213.bbcust.telenor.se [84.216.198.213]:51154: 535 Incorrect authentication data (set_id=sales)84.216.198.2132661886u  -w' ossec13001hb2Exim Auth failed2025-04-21 02:38:01 dovecot_login authenticator failed for 46.79-160-128.customer.lyse.net [79.160.128.46]:53301: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)79.160.128.463144096r  -q' ossec13001h`\Exim Auth failed2025-04-21 02:30:12 dovecot_login authenticator failed for 111-70-21-240.emome-ip.hinet.net [111.70.21.240]:50740: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)111.70.21.2401668284y  -}) ossec13001h`RExim Auth failed2025-04-21 02:30:01 dovecot_login authenticator failed for ([185.216.192.16]) [185.216.192.16]:55566: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)185.216.192.162017370e  -S+ ossec13001h_Exim Auth failed2025-04-21 02:24:42 dovecot_login authenticator failed for ([221.159.179.177]) [221.159.179.177]:36420: 535 Incorrect authentication data (set_id=vikas.khandelwal)221.159.179.1771835841x  -y+ ossec13001h_Exim Auth failed2025-04-21 02:24:26 dovecot_login authenticator failed for ([123.210.145.224]) [123.210.145.224]:57594: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)123.210.145.2242077456T  -9# ossec13001hZExim Auth failed2025-04-21 02:03:23 dovecot_login authenticator failed for (mail.tataidc.com) [61.12.86.90]:53002: 535 Incorrect authentication data (set_id=services)61.12.86.901269750}  -' ossec13001hYExim Auth failed2025-04-21 02:02:58 dovecot_login authenticator failed for syn-024-043-131-106.biz.spectrum.com [24.43.131.106]:59742: 535 Incorrect authentication data (set_id=services@heipowersystem.com)24.43.131.1066252001c  -S' ossec13001hY\Exim Auth failed2025-04-21 02:00:19 dovecot_login authenticator failed for ([183.96.57.241]) [183.96.57.241]:53276: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)183.96.57.2411835841y  -}) ossec13001hYPExim Auth failed2025-04-21 02:00:07 dovecot_login authenticator failed for ([183.17.228.174]) [183.17.228.174]:54478: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)183.17.228.1741814991f  -W) ossec13001hXExim Auth failed2025-04-21 01:57:11 dovecot_login authenticator failed for ([182.180.93.208]) [182.180.93.208]:58998: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)182.180.93.2081168579   -) ossec13001hXExim Auth failed2025-04-21 01:56:44 dovecot_login authenticator failed for 201-61-213-223.bbone.telesp.net.br [201.61.213.223]:47382: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)201.61.213.2233469034|  -' ossec13001hVExim Auth failed2025-04-21 01:49:39 dovecot_login authenticator failed for d54c70cda.static.telenet.be [84.199.12.218]:49324: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)84.199.12.2182802361b  -M+ ossec13001hRExim Auth failed2025-04-21 01:31:35 dovecot_login authenticator failed for (ip-122-133.bol-online.com) [182.163.122.133]:41919: 535 Incorrect authentication data (set_id=sales)182.163.122.1331210997j  -_) ossec13001hRExim Auth failed2025-04-21 01:31:13 dovecot_login authenticator failed for ([103.168.241.32]) [103.168.241.32]:34656: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)103.168.241.321269750 $ ; 8 ? Uff+  -[' ossec13001h#Exim Auth failed2025-04-21 05:02:50 dovecot_login authenticator failed for ([94.204.66.216]) [94.204.66.216]:39479: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)94.204.66.216290557c*  -S' ossec13001hExim Auth failed2025-04-21 04:57:57 dovecot_login authenticator failed for ([183.47.48.178]) [183.47.48.178]:53820: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)183.47.48.1781814991p)  -q# ossec13001hExim Auth failed2025-04-21 04:57:37 dovecot_login authenticator failed for ([46.44.5.135]) [46.44.5.135]:57390: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)46.44.5.1352017370T(  -5' ossec13001hExim Auth failed2025-04-21 04:53:01 dovecot_login authenticator failed for ([89.175.253.49]) [89.175.253.49]:52034: 535 Incorrect authentication data (set_id=sales)89.175.253.492017370j'  -_) ossec13001hExim Auth failed2025-04-21 04:52:35 dovecot_login authenticator failed for ([49.124.154.154]) [49.124.154.154]:52430: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)49.124.154.1541733045(&  3U) ossec11301hyNew FTP connection.Apr 21 04:18:04 vm1 pure-ftpd[1961989]: (?@198.235.24.216) [INFO] New connection from 198.235.24.216198.235.24.2166252001b%  -S% ossec13001hwExim Auth failed2025-04-21 04:09:07 dovecot_login authenticator failed for 95-37-97-198.dynamic.mts-nn.ru [95.37.97.198]:35719: 535 Incorrect authentication data (set_id=services)95.37.97.1982017370j$  -a' ossec13001hwLExim Auth failed2025-04-21 04:08:02 dovecot_login authenticator failed for ([123.52.202.92]) [123.52.202.92]:48498: 535 Incorrect authentication data (set_id=services@heipowersystem.com)123.52.202.921814991#  -+ ossec13001hw>Exim Auth failed2025-04-21 04:07:48 dovecot_login authenticator failed for (host-static-178-132-144-161.moldtelecom.md) [178.132.144.161]:4853: 535 Incorrect authentication data (set_id=services@heipowersystem.com)178.132.144.161617790j"  -_) ossec13001hr(Exim Auth failed2025-04-21 03:46:07 dovecot_login authenticator failed for ([117.69.255.239]) [117.69.255.239]:55540: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)117.69.255.2391814991:!  Ak) ossec11302hq<FTP Authentication failed.Apr 21 03:42:11 vm1 pure-ftpd[1954809]: (?@44.220.185.181) [WARNING] Authentication failed for user [anonymous]44.220.185.1816252001(  3U) ossec11301hq6New FTP connection.Apr 21 03:42:05 vm1 pure-ftpd[1954809]: (?@44.220.185.181) [INFO] New connection from 44.220.185.18144.220.185.1816252001t  -y' ossec13001hp Exim Auth failed2025-04-21 03:37:05 dovecot_login authenticator failed for ([65.20.205.197]) [65.20.205.197]:39249: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)65.20.205.19799237~  - % ossec13001hoExim Auth failed2025-04-21 03:36:31 dovecot_login authenticator failed for (103.3.246.91.bteleport.ru) [91.246.3.103]:50220: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)91.246.3.1032017370d  -U' ossec13001hmExim Auth failed2025-04-21 03:24:15 dovecot_login authenticator failed for (broadband.actcorp.in) [106.51.217.56]:11908: 535 Incorrect authentication data (set_id=vikas.khandelwal)106.51.217.561269750p  -q' ossec13001hlExim Auth failed2025-04-21 03:24:05 dovecot_login authenticator failed for ([93.191.115.52]) [93.191.115.54]:38862: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)93.191.115.5499237b  -O) ossec13001hkIExim Auth failed2025-04-21 03:16:47 dovecot_login authenticator failed for ([211.186.220.42]) [211.186.220.42]:59837: 535 Incorrect authentication data (set_id=vikas.khandelwal)211.186.220.421835841 <'   A J b?C8A4AJ< ;  -) ossec13001h&Exim Auth failed2025-04-21 06:19:42 dovecot_login authenticator failed for nz150l206.bb60246.ctm.net (nz151l120.bb60246.ctm.net) [60.246.150.206]:45476: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)60.246.150.2061821275r:  -u% ossec13001hExim Auth failed2025-04-21 06:19:30 dovecot_login authenticator failed for ([2.179.194.60]) [2.179.194.60]:56194: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)2.179.194.60130758n9  -g) ossec13001h Exim Auth failed2025-04-21 06:15:19 dovecot_login authenticator failed for 110-25-105-161.adsl.fetnet.net [110.25.105.161]:53116: 535 Incorrect authentication data (set_id=vikas.khandelwal)110.25.105.16116682848  -+ ossec13001hExim Auth failed2025-04-21 06:15:07 dovecot_login authenticator failed for (192.102.156.175.unknown.m1.com.sg) [175.156.102.192]:51198: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)175.156.102.1921880251U7  -7' ossec13001hExim Auth failed2025-04-21 06:00:01 dovecot_login authenticator failed for ([219.140.170.34]) [27.17.255.136]:64700: 535 Incorrect authentication data (set_id=sales)27.17.255.13618149916  -=' ossec13001h|Exim Auth failed2025-04-21 05:59:47 dovecot_login authenticator failed for 131-106-31-52.s1842.c3-0.eas-cbr5.atw-eas.pa.cable.rcncustomer.com [131.106.31.52]:49430: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)131.106.31.5262520015  -) ossec13001hlExim Auth failed2025-04-21 05:42:26 dovecot_login authenticator failed for (abts-kk-static-100.70.166.122.airtelbroadband.in) [122.166.70.100]:52868: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)122.166.70.1001269750w4  -y) ossec13001h]Exim Auth failed2025-04-21 05:42:12 dovecot_login authenticator failed for nova-185-040-122-250.cpe.novanet.is [185.40.122.250]:37161: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)185.40.122.25026296913  -G) ossec13001h8Exim Auth failed2025-04-21 05:41:34 dovecot_login authenticator failed for (abts-north-dynamic-066.161.177.122.airtelbroadband.in) [122.177.161.66]:49995: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)122.177.161.661269750c2  -S' ossec13001h?Exim Auth failed2025-04-21 05:37:27 dovecot_login authenticator failed for ([90.188.40.123]) [90.188.40.123]:59466: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)90.188.40.1232017370r1  -u% ossec13001h)Exim Auth failed2025-04-21 05:37:05 dovecot_login authenticator failed for ([5.11.168.173]) [5.11.168.173]:44652: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)5.11.168.173298795U0  -?! ossec13001h[Exim Auth failed2025-04-21 05:25:06 dovecot_login authenticator failed for ([5.31.0.134]) [5.31.0.134]:58198: 535 Incorrect authentication data (set_id=vikas.khandelwal)5.31.0.134290557z/  -' ossec13001hMExim Auth failed2025-04-21 05:24:52 dovecot_login authenticator failed for 66.245.218.46.rev.sfr.net [46.218.245.66]:57750: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)46.218.245.663017382.  -' ossec13001hExim Auth failed2025-04-21 05:21:49 dovecot_login authenticator failed for 131-106-31-52.s1842.c3-0.eas-cbr5.atw-eas.pa.cable.rcncustomer.com [131.106.31.52]:44896: 535 Incorrect authentication data (set_id=purchase)131.106.31.526252001m-  -e) ossec13001hExim Auth failed2025-04-21 05:21:33 dovecot_login authenticator failed for ([60.221.215.232]) [60.221.215.232]:57334: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)60.221.215.2321814991b,  -O) ossec13001h5Exim Auth failed2025-04-21 05:03:09 dovecot_login authenticator failed for (pool-37-140-125-133.is74.ru) [37.140.125.133]:59282: 535 Incorrect authentication data (set_id=sales)37.140.125.1332017370   ! t t z\VTNJ@& J  Sw) ossec11000h(Login failed on the cpanel service.[2025-04-21 06:49:34 +0530] info [cpaneld] 156.242.39.246 - heipowe1 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipowe1 (has_cpuser_file failed)156.242.39.2466252001I  S) ossec11000h"Login failed on the cpanel service.[2025-04-21 06:49:28 +0530] info [cpaneld] 156.242.36.233 - heipowersystem "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipowersystem (has_cpuser_file failed)156.242.36.2336252001H  Sm+ ossec11000h Login failed on the cpanel service.[2025-04-21 06:49:27 +0530] info [cpaneld] 156.228.106.106 - admin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)156.228.106.1066252001G  Sa+ ossec11000h.Login failed on the cpanel service.[2025-04-21 06:49:40 +0530] info [cpaneld] 156.228.104.210 - he "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user he (has_cpuser_file failed)156.228.104.2106252001F  Sg) ossec11000h,Login failed on the cpanel service.[2025-04-21 06:49:38 +0530] info [cpaneld] 156.248.87.159 - heip "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heip (has_cpuser_file failed)156.248.87.1596252001}E  Sa' ossec11000h,Login failed on the cpanel service.[2025-04-21 06:49:39 +0530] info [cpaneld] 156.228.98.21 - hei "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user hei (has_cpuser_file failed)156.228.98.216252001D  Se+ ossec11000h.Login failed on the cpanel service.[2025-04-21 06:49:40 +0530] info [cpaneld] 154.213.163.109 - crm "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user crm (has_cpuser_file failed)154.213.163.1096252001C  S' ossec11000h$Login failed on the cpanel service.[2025-04-21 06:49:31 +0530] info [cpaneld] 156.228.98.40 - heipowersystemcom "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipowersystemcom (has_cpuser_file failed)156.228.98.406252001uB  SO) ossec11000h$Login failed on the cpanel service.[2025-04-21 06:49:31 +0530] info [whostmgrd] 156.242.45.133 - heipowersystem "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect156.242.45.1336252001{A  S_% ossec11000h.Login failed on the cpanel service.[2025-04-21 06:49:41 +0530] info [cpaneld] 156.228.77.8 - crm "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user crm (has_cpuser_file failed)156.228.77.86252001(@  3U) ossec11301hNew FTP connection.Apr 21 06:48:19 vm1 pure-ftpd[1995318]: (?@66.240.236.116) [INFO] New connection from 66.240.236.11666.240.236.1166252001i?  -[+ ossec13001hqExim Auth failed2025-04-21 06:46:32 dovecot_login authenticator failed for ([186.238.247.238]) [186.238.247.238]:57021: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)186.238.247.2383469034 >  -!) ossec13001hfExim Auth failed2025-04-21 06:46:20 dovecot_login authenticator failed for (191-210-87-101.user.vivozap.com.br) [191.210.87.101]:60469: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)191.210.87.1013469034b=  -O) ossec13001hExim Auth failed2025-04-21 06:36:24 dovecot_login authenticator failed for ([121.189.198.60]) [121.189.198.60]:49856: 535 Incorrect authentication data (set_id=vikas.khandelwal)121.189.198.601835841u<  -u) ossec13001hExim Auth failed2025-04-21 06:36:09 dovecot_login authenticator failed for ([111.171.125.94]) [111.171.125.94]:38047: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)111.171.125.941835841  ;*21&[ 3Q' ossec11301h8New FTP connection.Apr 21 07:32:31 vm1 pure-ftpd[2004782]: (?@45.156.129.85) [INFO] New connection from 45.156.129.8545.156.129.852264397|Z  -+ ossec13001hExim Auth failed2025-04-21 07:26:24 dovecot_login authenticator failed for (m121-202-153-145.smartone.com) [121.202.153.145]:42775: 535 Incorrect authentication data (set_id=services@heipowersystem.com)121.202.153.1451819730sY  -o+ ossec13001hExim Auth failed2025-04-21 07:26:33 dovecot_login authenticator failed for (nsg-corporate-228.228.187.122.airtel.in) [122.187.228.228]:54857: 535 Incorrect authentication data (set_id=services)122.187.228.22812697508X  Ai' ossec11302h_FTP Authentication failed.Apr 21 07:07:34 vm1 pure-ftpd[1999481]: (?@91.196.152.50) [WARNING] Authentication failed for user [anonymous]91.196.152.503017382%W  3Q' ossec11301hYNew FTP connection.Apr 21 07:07:27 vm1 pure-ftpd[1999479]: (?@91.196.152.77) [INFO] New connection from 91.196.152.7791.196.152.773017382%V  3Q' ossec11301hYNew FTP connection.Apr 21 07:07:28 vm1 pure-ftpd[1999481]: (?@91.196.152.50) [INFO] New connection from 91.196.152.5091.196.152.503017382WU  -;' ossec13001hKExim Auth failed2025-04-21 07:07:13 dovecot_login authenticator failed for admin.odoogolden.com [161.35.192.16]:32860: 535 Incorrect authentication data (set_id=sales)161.35.192.162921044rT  -s% ossec13001h?Exim Auth failed2025-04-21 07:07:01 dovecot_login authenticator failed for host89.net31.clients.redcom.ru [212.19.31.89]:53652: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)212.19.31.892017370TS  -7% ossec13001hExim Auth failed2025-04-21 06:51:27 dovecot_login authenticator failed for ([111.63.42.76]) [111.63.42.76]:20310: 535 Incorrect authentication data (set_id=purchase)111.63.42.761814991dR  -Y# ossec13001h~Exim Auth failed2025-04-21 06:51:01 dovecot_login authenticator failed for ([103.55.89.5]) [103.55.89.5]:59420: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)103.55.89.51269750 Q  Sw) ossec11000h(Login failed on the cpanel service.[2025-04-21 06:49:35 +0530] info [cpaneld] 156.242.41.140 - heipowe2 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipowe2 (has_cpuser_file failed)156.242.41.1406252001 P  Sy+ ossec11000h&Login failed on the cpanel service.[2025-04-21 06:49:33 +0530] info [cpaneld] 156.228.116.225 - heipower "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipower (has_cpuser_file failed)156.228.116.2256252001mO  S=+ ossec11000h"Login failed on the cpanel service.[2025-04-21 06:49:29 +0530] info [whostmgrd] 156.228.102.158 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect156.228.102.1586252001}N  Sa' ossec11000hLogin failed on the cpanel service.[2025-04-21 06:49:25 +0530] info [cpaneld] 156.248.84.84 - crm "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user crm (has_cpuser_file failed)156.248.84.846252001M  Sk) ossec11000h*Login failed on the cpanel service.[2025-04-21 06:49:37 +0530] info [cpaneld] 156.242.39.197 - heipo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipo (has_cpuser_file failed)156.242.39.1976252001L  Sm' ossec11000h*Login failed on the cpanel service.[2025-04-21 06:49:37 +0530] info [cpaneld] 156.228.78.58 - heipow "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipow (has_cpuser_file failed)156.228.78.586252001 K  Su+ ossec11000h*Login failed on the cpanel service.[2025-04-21 06:49:36 +0530] info [cpaneld] 156.228.101.117 - heipowe "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipowe (has_cpuser_file failed)156.228.101.1176252001 V !   k  Su' ossec11000h Login failed on the cpanel service.[2025-04-21 08:57:05 +0530] info [cpaneld] 156.228.78.25 - heipowe8 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipowe8 (has_cpuser_file failed)156.228.78.256252001 j  Sw) ossec11000hLogin failed on the cpanel service.[2025-04-21 08:57:03 +0530] info [cpaneld] 156.228.93.134 - heipowe5 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipowe5 (has_cpuser_file failed)156.228.93.1346252001 i  Sw) ossec11000hLogin failed on the cpanel service.[2025-04-21 08:56:58 +0530] info [cpaneld] 156.228.92.102 - heipowe1 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipowe1 (has_cpuser_file failed)156.228.92.1026252001 h  Sy+ ossec11000hLogin failed on the cpanel service.[2025-04-21 08:57:03 +0530] info [cpaneld] 156.228.101.187 - heipowe6 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipowe6 (has_cpuser_file failed)156.228.101.1876252001g  Su' ossec11000hLogin failed on the cpanel service.[2025-04-21 08:57:01 +0530] info [cpaneld] 156.228.87.47 - heipowe4 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipowe4 (has_cpuser_file failed)156.228.87.476252001{f  S]' ossec11000hLogin failed on the cpanel service.[2025-04-21 08:56:55 +0530] info [cpaneld] 156.248.87.59 - up "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user up (has_cpuser_file failed)156.248.87.596252001}e  Sa' ossec11000hLogin failed on the cpanel service.[2025-04-21 08:56:53 +0530] info [cpaneld] 156.242.42.90 - crm "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user crm (has_cpuser_file failed)156.242.42.906252001d  ;) ossec13008hOMail Recipient rejected2025-04-21 08:24:07 H=(localhost.localdomain) [78.153.140.207]:34720 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no F= rejected RCPT : Sender verify failed78.153.140.2072635167dc  -S) ossec13001h5Exim Auth failed2025-04-21 08:15:09 dovecot_login authenticator failed for bb115-66-207-124.singnet.com.sg [115.66.207.124]:40339: 535 Incorrect authentication data (set_id=sales)115.66.207.1241880251fb  -[' ossec13001h+Exim Auth failed2025-04-21 08:14:58 dovecot_login authenticator failed for ([45.240.88.249]) [45.240.88.249]:33998: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)45.240.88.249357994Za  -?) ossec13001hExim Auth failed2025-04-21 08:13:46 dovecot_login authenticator failed for ([176.57.118.190]) [176.57.118.190]:47223: 535 Incorrect authentication data (set_id=services)176.57.118.1903175395x`  -}' ossec13001hExim Auth failed2025-04-21 08:13:36 dovecot_login authenticator failed for (fp5cca5266.gifg408.ap.nuro.jp) [154.47.20.206]:48265: 535 Incorrect authentication data (set_id=services@heipowersystem.com)154.47.20.2061861060+_  ;S) ossec13008hMail Recipient rejected2025-04-21 07:47:39 H=(mail.hsnews.in) [165.154.210.79]:56117 F= rejected RCPT : Rejected relay attempt: '165.154.210.79' From: 'nzabd@hsnews.in' To: 'validxxx@gmailhotmail.com.br'165.154.210.791694008&^ 3Q' ossec11301h6New FTP connection.Apr 21 07:32:29 vm1 pure-ftpd[2004779]: (?@45.156.129.88) [INFO] New connection from 45.156.129.8845.156.129.882264397%]  3Q' ossec11301h<New FTP connection.Apr 21 07:32:34 vm1 pure-ftpd[2004799]: (?@45.156.129.86) [INFO] New connection from 45.156.129.8645.156.129.862264397%\  3Q' ossec11301h<New FTP connection.Apr 21 07:32:35 vm1 pure-ftpd[2004801]: (?@45.156.129.87) [INFO] New connection from 45.156.129.8745.156.129.872264397 + scWG9+   Sw) ossec11000h8Login failed on the cpanel service.[2025-04-21 08:57:51 +0530] info [cpaneld] 156.242.37.172 - heipow64 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipow64 (has_cpuser_file failed)156.242.37.1726252001   Sw) ossec11000h0Login failed on the cpanel service.[2025-04-21 08:57:43 +0530] info [cpaneld] 156.228.91.241 - heipow53 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipow53 (has_cpuser_file failed)156.228.91.2416252001   Sy+ ossec11000h&Login failed on the cpanel service.[2025-04-21 08:57:33 +0530] info [cpaneld] 156.228.111.172 - heipow41 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipow41 (has_cpuser_file failed)156.228.111.1726252001  Su' ossec11000h Login failed on the cpanel service.[2025-04-21 08:57:26 +0530] info [cpaneld] 156.242.34.33 - heipow34 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipow34 (has_cpuser_file failed)156.242.34.336252001   Sy+ ossec11000h@Login failed on the cpanel service.[2025-04-21 08:57:59 +0530] info [cpaneld] 156.228.101.187 - heipow75 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipow75 (has_cpuser_file failed)156.228.101.1876252001   Sw) ossec11000h6Login failed on the cpanel service.[2025-04-21 08:57:48 +0530] info [cpaneld] 154.213.160.26 - heipow61 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipow61 (has_cpuser_file failed)154.213.160.266252001  Su' ossec11000h0Login failed on the cpanel service.[2025-04-21 08:57:42 +0530] info [cpaneld] 156.228.84.51 - heipow52 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipow52 (has_cpuser_file failed)156.228.84.516252001   Sw) ossec11000h.Login failed on the cpanel service.[2025-04-21 08:57:41 +0530] info [cpaneld] 156.242.43.216 - heipow51 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipow51 (has_cpuser_file failed)156.242.43.2166252001   Sw) ossec11000h.Login failed on the cpanel service.[2025-04-21 08:57:40 +0530] info [cpaneld] 156.228.107.86 - heipow50 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipow50 (has_cpuser_file failed)156.228.107.866252001   Sw) ossec11000h,Login failed on the cpanel service.[2025-04-21 08:57:38 +0530] info [cpaneld] 156.228.114.79 - heipow47 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipow47 (has_cpuser_file failed)156.228.114.796252001  Sw) ossec11000h"Login failed on the cpanel service.[2025-04-21 08:57:28 +0530] info [cpaneld] 156.228.85.205 - heipow36 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipow36 (has_cpuser_file failed)156.228.85.2056252001  Sy+ ossec11000hLogin failed on the cpanel service.[2025-04-21 08:57:10 +0530] info [cpaneld] 156.228.112.138 - heipow14 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipow14 (has_cpuser_file failed)156.228.112.1386252001  Su' ossec11000h@Login failed on the cpanel service.[2025-04-21 08:57:58 +0530] info [cpaneld] 156.242.38.59 - heipow74 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipow74 (has_cpuser_file failed)156.242.38.596252001  Sw) ossec11000h:Login failed on the cpanel service.[2025-04-21 08:57:52 +0530] info [cpaneld] 156.248.81.148 - heipow66 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipow66 (has_cpuser_file failed)156.248.81.1486252001 Sy+ ossec11000h8Login failed on the cpanel service.[2025-04-21 08:57:50 +0530] info [cpaneld] 156.228.102.231 - heipow63 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipow63 (has_cpuser_file failed)156.228.102.2316252001 6 |n`PD6   Sw) ossec11000hLogin failed on the cpanel service.[2025-04-21 08:57:17 +0530] info [cpaneld] 156.242.39.105 - heipow23 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipow23 (has_cpuser_file failed)156.242.39.1056252001  Su' ossec11000hLogin failed on the cpanel service.[2025-04-21 08:57:08 +0530] info [cpaneld] 156.228.87.91 - heipow11 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipow11 (has_cpuser_file failed)156.228.87.916252001   Sy+ ossec11000h*Login failed on the cpanel service.[2025-04-21 08:57:37 +0530] info [cpaneld] 154.213.162.154 - heipow46 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipow46 (has_cpuser_file failed)154.213.162.1546252001   Sw) ossec11000h*Login failed on the cpanel service.[2025-04-21 08:57:36 +0530] info [cpaneld] 156.242.40.141 - heipow45 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipow45 (has_cpuser_file failed)156.242.40.1416252001   Sw) ossec11000hLogin failed on the cpanel service.[2025-04-21 08:57:14 +0530] info [cpaneld] 156.228.93.151 - heipow19 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipow19 (has_cpuser_file failed)156.228.93.1516252001   Sw) ossec11000hLogin failed on the cpanel service.[2025-04-21 08:57:12 +0530] info [cpaneld] 156.242.35.189 - heipow16 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipow16 (has_cpuser_file failed)156.242.35.1896252001   Sw) ossec11000hDLogin failed on the cpanel service.[2025-04-21 08:58:02 +0530] info [cpaneld] 156.228.110.94 - heipow80 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipow80 (has_cpuser_file failed)156.228.110.946252001  Su' ossec11000hLogin failed on the cpanel service.[2025-04-21 08:57:22 +0530] info [cpaneld] 156.242.44.26 - heipow28 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipow28 (has_cpuser_file failed)156.242.44.266252001  Sy+ ossec11000hLogin failed on the cpanel service.[2025-04-21 08:57:14 +0530] info [cpaneld] 156.228.124.255 - heipow20 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipow20 (has_cpuser_file failed)156.228.124.2556252001   Sw) ossec11000h4Login failed on the cpanel service.[2025-04-21 08:57:47 +0530] info [cpaneld] 156.228.93.104 - heipow59 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipow59 (has_cpuser_file failed)156.228.93.1046252001 ~  Sy+ ossec11000hLogin failed on the cpanel service.[2025-04-21 08:57:23 +0530] info [cpaneld] 156.228.107.220 - heipow29 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipow29 (has_cpuser_file failed)156.228.107.2206252001 }  Sy+ ossec11000hLogin failed on the cpanel service.[2025-04-21 08:57:20 +0530] info [cpaneld] 156.228.100.214 - heipow26 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipow26 (has_cpuser_file failed)156.228.100.2146252001 |  Sw) ossec11000hDLogin failed on the cpanel service.[2025-04-21 08:58:02 +0530] info [cpaneld] 156.228.116.38 - heipow79 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipow79 (has_cpuser_file failed)156.228.116.386252001 {  Sy+ ossec11000h,Login failed on the cpanel service.[2025-04-21 08:57:39 +0530] info [cpaneld] 156.228.112.141 - heipow48 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipow48 (has_cpuser_file failed)156.228.112.1416252001 7 }oaSC7D  Su' ossec11000hRLogin failed on the cpanel service.[2025-04-21 08:58:17 +0530] info [cpaneld] 156.242.38.59 - heipo100 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipo100 (has_cpuser_file failed)156.242.38.596252001 C  Sy+ ossec11000hPLogin failed on the cpanel service.[2025-04-21 08:58:16 +0530] info [cpaneld] 156.228.105.130 - heipow98 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipow98 (has_cpuser_file failed)156.228.105.1306252001 B  Sw) ossec11000hPLogin failed on the cpanel service.[2025-04-21 08:58:14 +0530] info [cpaneld] 156.228.80.188 - heipow96 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipow96 (has_cpuser_file failed)156.228.80.1886252001 A  Sw) ossec11000hNLogin failed on the cpanel service.[2025-04-21 08:58:12 +0530] info [cpaneld] 156.228.85.223 - heipow93 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipow93 (has_cpuser_file failed)156.228.85.2236252001 @  Sw) ossec11000hNLogin failed on the cpanel service.[2025-04-21 08:58:13 +0530] info [cpaneld] 156.228.88.165 - heipow94 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipow94 (has_cpuser_file failed)156.228.88.1656252001 ?  Sw) ossec11000hLLogin failed on the cpanel service.[2025-04-21 08:58:11 +0530] info [cpaneld] 156.228.85.192 - heipow92 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipow92 (has_cpuser_file failed)156.228.85.1926252001 >  Sw) ossec11000hNLogin failed on the cpanel service.[2025-04-21 08:58:13 +0530] info [cpaneld] 156.242.44.186 - heipow95 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipow95 (has_cpuser_file failed)156.242.44.1866252001=  Su' ossec11000hJLogin failed on the cpanel service.[2025-04-21 08:58:08 +0530] info [cpaneld] 156.242.38.74 - heipow88 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipow88 (has_cpuser_file failed)156.242.38.746252001 <  Sw) ossec11000hPLogin failed on the cpanel service.[2025-04-21 08:58:15 +0530] info [cpaneld] 156.228.109.40 - heipow97 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipow97 (has_cpuser_file failed)156.228.109.406252001 ;  Sw) ossec11000h2Login failed on the cpanel service.[2025-04-21 08:57:45 +0530] info [cpaneld] 156.228.109.12 - heipow56 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipow56 (has_cpuser_file failed)156.228.109.126252001 :  Sy+ ossec11000hDLogin failed on the cpanel service.[2025-04-21 08:58:03 +0530] info [cpaneld] 156.228.103.245 - heipow81 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipow81 (has_cpuser_file failed)156.228.103.24562520019 Su' ossec11000h Login failed on the cpanel service.[2025-04-21 08:57:06 +0530] info [cpaneld] 156.248.84.81 - heipowe9 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipowe9 (has_cpuser_file failed)156.248.84.8162520018  Ss% ossec11000h,Login failed on the cpanel service.[2025-04-21 08:57:39 +0530] info [cpaneld] 156.248.83.8 - heipow49 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipow49 (has_cpuser_file failed)156.248.83.862520017  Su' ossec11000h*Login failed on the cpanel service.[2025-04-21 08:57:36 +0530] info [cpaneld] 156.242.45.82 - heipow44 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipow44 (has_cpuser_file failed)156.242.45.8262520016  Su' ossec11000hLogin failed on the cpanel service.[2025-04-21 08:57:25 +0530] info [cpaneld] 156.228.82.58 - heipow33 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipow33 (has_cpuser_file failed)156.228.82.586252001 . ~pbVH:.5  Su' ossec11000hLogin failed on the cpanel service.[2025-04-21 08:57:17 +0530] info [cpaneld] 156.248.80.16 - heipow24 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipow24 (has_cpuser_file failed)156.248.80.166252001 4  Sw) ossec11000hLogin failed on the cpanel service.[2025-04-21 08:57:16 +0530] info [cpaneld] 156.228.79.157 - heipow22 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipow22 (has_cpuser_file failed)156.228.79.1576252001 3  Sw) ossec11000hLogin failed on the cpanel service.[2025-04-21 08:57:13 +0530] info [cpaneld] 156.242.41.219 - heipow18 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipow18 (has_cpuser_file failed)156.242.41.21962520012  Su' ossec11000hLogin failed on the cpanel service.[2025-04-21 08:57:12 +0530] info [cpaneld] 156.228.116.6 - heipow17 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipow17 (has_cpuser_file failed)156.228.116.66252001 1  Sw) ossec11000hLogin failed on the cpanel service.[2025-04-21 08:57:15 +0530] info [cpaneld] 154.213.165.36 - heipow21 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipow21 (has_cpuser_file failed)154.213.165.366252001 0  Sw) ossec11000h<Login failed on the cpanel service.[2025-04-21 08:57:54 +0530] info [cpaneld] 156.228.107.17 - heipow68 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipow68 (has_cpuser_file failed)156.228.107.176252001 /  Sw) ossec11000h(Login failed on the cpanel service.[2025-04-21 08:57:34 +0530] info [cpaneld] 156.228.96.125 - heipow42 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipow42 (has_cpuser_file failed)156.228.96.1256252001.  Su' ossec11000hBLogin failed on the cpanel service.[2025-04-21 08:58:00 +0530] info [cpaneld] 156.228.105.2 - heipow77 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipow77 (has_cpuser_file failed)156.228.105.26252001 -  Sy+ ossec11000h$Login failed on the cpanel service.[2025-04-21 08:57:31 +0530] info [cpaneld] 156.228.101.118 - heipow39 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipow39 (has_cpuser_file failed)156.228.101.1186252001 ,  Sy+ ossec11000h6Login failed on the cpanel service.[2025-04-21 08:57:48 +0530] info [cpaneld] 156.228.105.121 - heipow60 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipow60 (has_cpuser_file failed)156.228.105.1216252001 +  Sy+ ossec11000h&Login failed on the cpanel service.[2025-04-21 08:57:32 +0530] info [cpaneld] 156.228.108.158 - heipow40 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipow40 (has_cpuser_file failed)156.228.108.1586252001 *  Sw) ossec11000h>Login failed on the cpanel service.[2025-04-21 08:57:56 +0530] info [cpaneld] 156.228.77.229 - heipow71 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipow71 (has_cpuser_file failed)156.228.77.2296252001 )  Sw) ossec11000h<Login failed on the cpanel service.[2025-04-21 08:57:54 +0530] info [cpaneld] 156.242.34.224 - heipow69 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipow69 (has_cpuser_file failed)156.242.34.2246252001 (  Sw) ossec11000h6Login failed on the cpanel service.[2025-04-21 08:57:49 +0530] info [cpaneld] 156.248.86.143 - heipow62 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipow62 (has_cpuser_file failed)156.248.86.1436252001 '  Sw) ossec11000h Login failed on the cpanel service.[2025-04-21 08:57:07 +0530] info [cpaneld] 156.228.102.44 - heipow10 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipow10 (has_cpuser_file failed)156.228.102.446252001  vS  -y' ossec13001hêExim Auth failed2025-04-21 09:33:53 dovecot_login authenticator failed for (70.210.245.58.adsl-pool.jlccptt.net.cn) [58.245.210.70]:44250: 535 Incorrect authentication data (set_id=vikas.khandelwal)58.245.210.701814991~R  - % ossec13001hÞExim Auth failed2025-04-21 09:33:41 dovecot_login authenticator failed for c91-130-7-184.bredband.tele2.se [91.130.7.184]:44716: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)91.130.7.1842661886Q  -) ossec13001hExim Auth failed2025-04-21 09:22:59 dovecot_login authenticator failed for (abts-mp-dynamic-141.129.70.182.airtelbroadband.in) [182.70.129.141]:49297: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)182.70.129.1411269750yP  -}) ossec13001hExim Auth failed2025-04-21 09:22:50 dovecot_login authenticator failed for ([106.91.215.100]) [106.91.215.100]:59890: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)106.91.215.1001814991TO  -5' ossec13001hExim Auth failed2025-04-21 09:22:23 dovecot_login authenticator failed for ([203.124.60.46]) [203.124.60.46]:57612: 535 Incorrect authentication data (set_id=sales)203.124.60.461168579jN  -_) ossec13001hExim Auth failed2025-04-21 09:22:10 dovecot_login authenticator failed for ([101.168.41.198]) [101.168.41.198]:60422: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)101.168.41.1982077456eM  -S+ ossec13001hExim Auth failed2025-04-21 09:07:39 dovecot_login authenticator failed for ([188.127.183.144]) [188.127.183.144]:46738: 535 Incorrect authentication data (set_id=vikas.khandelwal)188.127.183.1442510769iL  -e! ossec13001hpExim Auth failed2025-04-21 09:07:20 dovecot_login authenticator failed for ([47.83.2.11]) [47.83.2.11]:55702: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)47.83.2.111819730K  Su' ossec11000hLLogin failed on the cpanel service.[2025-04-21 08:58:10 +0530] info [cpaneld] 156.242.44.64 - heipow90 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipow90 (has_cpuser_file failed)156.242.44.646252001 J  Sw) ossec11000hHLogin failed on the cpanel service.[2025-04-21 08:58:07 +0530] info [cpaneld] 156.228.95.120 - heipow87 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipow87 (has_cpuser_file failed)156.228.95.1206252001 I  Sw) ossec11000hLLogin failed on the cpanel service.[2025-04-21 08:58:10 +0530] info [cpaneld] 156.242.45.131 - heipow91 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipow91 (has_cpuser_file failed)156.242.45.1316252001 H  Sw) ossec11000hHLogin failed on the cpanel service.[2025-04-21 08:58:07 +0530] info [cpaneld] 156.228.101.27 - heipow86 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipow86 (has_cpuser_file failed)156.228.101.276252001 G  Sw) ossec11000hRLogin failed on the cpanel service.[2025-04-21 08:58:16 +0530] info [cpaneld] 156.228.124.12 - heipow99 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipow99 (has_cpuser_file failed)156.228.124.126252001 F  Sw) ossec11000hJLogin failed on the cpanel service.[2025-04-21 08:58:09 +0530] info [cpaneld] 156.242.36.101 - heipow89 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipow89 (has_cpuser_file failed)156.242.36.1016252001 E  Sw) ossec11000hHLogin failed on the cpanel service.[2025-04-21 08:58:06 +0530] info [cpaneld] 156.228.99.230 - heipow85 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipow85 (has_cpuser_file failed)156.228.99.2306252001 H pbVH z  Sw) ossec11000h"Login failed on the cpanel service.[2025-04-21 08:57:28 +0530] info [cpaneld] 156.228.89.216 - heipow35 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipow35 (has_cpuser_file failed)156.228.89.2166252001y  Su' ossec11000hLogin failed on the cpanel service.[2025-04-21 08:57:25 +0530] info [cpaneld] 156.242.45.39 - heipow32 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipow32 (has_cpuser_file failed)156.242.45.396252001 x  Sw) ossec11000hLogin failed on the cpanel service.[2025-04-21 08:57:23 +0530] info [cpaneld] 156.228.99.158 - heipow30 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipow30 (has_cpuser_file failed)156.228.99.1586252001 w  Sy+ ossec11000hLogin failed on the cpanel service.[2025-04-21 08:57:18 +0530] info [cpaneld] 156.228.109.244 - heipow25 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipow25 (has_cpuser_file failed)156.228.109.2446252001 v  Sw) ossec11000hFLogin failed on the cpanel service.[2025-04-21 08:58:04 +0530] info [cpaneld] 156.242.33.255 - heipow82 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipow82 (has_cpuser_file failed)156.242.33.2556252001 u  Sy+ ossec11000hFLogin failed on the cpanel service.[2025-04-21 08:58:05 +0530] info [cpaneld] 156.228.105.131 - heipow84 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipow84 (has_cpuser_file failed)156.228.105.1316252001t  Su' ossec11000h8Login failed on the cpanel service.[2025-04-21 08:57:51 +0530] info [cpaneld] 156.228.77.35 - heipow65 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipow65 (has_cpuser_file failed)156.228.77.356252001 s  Sy+ ossec11000h2Login failed on the cpanel service.[2025-04-21 08:57:46 +0530] info [cpaneld] 156.228.104.172 - heipow57 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipow57 (has_cpuser_file failed)156.228.104.1726252001r  Su' ossec11000hLogin failed on the cpanel service.[2025-04-21 08:57:20 +0530] info [cpaneld] 156.248.80.48 - heipow27 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipow27 (has_cpuser_file failed)156.248.80.486252001 q  Sw) ossec11000h Login failed on the cpanel service.[2025-04-21 08:57:04 +0530] info [cpaneld] 156.242.39.119 - heipowe7 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipowe7 (has_cpuser_file failed)156.242.39.1196252001 p  Sw) ossec11000hLogin failed on the cpanel service.[2025-04-21 08:56:59 +0530] info [cpaneld] 156.228.112.20 - heipowe3 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipowe3 (has_cpuser_file failed)156.228.112.206252001 o  Sw) ossec11000hLogin failed on the cpanel service.[2025-04-21 08:56:59 +0530] info [cpaneld] 156.228.94.185 - heipowe2 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipowe2 (has_cpuser_file failed)156.228.94.1856252001}n  Sa' ossec11000hLogin failed on the cpanel service.[2025-04-21 08:56:56 +0530] info [cpaneld] 156.242.38.14 - dev "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dev (has_cpuser_file failed)156.242.38.146252001m  Sm' ossec11000hLogin failed on the cpanel service.[2025-04-21 08:56:56 +0530] info [cpaneld] 156.242.35.30 - upload "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user upload (has_cpuser_file failed)156.242.35.306252001l  Se+ ossec11000hLogin failed on the cpanel service.[2025-04-21 08:56:53 +0530] info [cpaneld] 154.213.167.110 - erp "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user erp (has_cpuser_file failed)154.213.167.1106252001 . ~n`TD8.&  Ss% ossec11000hFLogin failed on the cpanel service.[2025-04-21 08:58:05 +0530] info [cpaneld] 156.242.32.1 - heipow83 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipow83 (has_cpuser_file failed)156.242.32.16252001%  Su' ossec11000h2Login failed on the cpanel service.[2025-04-21 08:57:44 +0530] info [cpaneld] 156.228.80.51 - heipow55 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipow55 (has_cpuser_file failed)156.228.80.516252001 $  Sy+ ossec11000h(Login failed on the cpanel service.[2025-04-21 08:57:35 +0530] info [cpaneld] 154.213.162.201 - heipow43 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipow43 (has_cpuser_file failed)154.213.162.2016252001#  Su' ossec11000h$Login failed on the cpanel service.[2025-04-21 08:57:30 +0530] info [cpaneld] 156.242.39.90 - heipow38 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipow38 (has_cpuser_file failed)156.242.39.906252001 "  Sw) ossec11000hLogin failed on the cpanel service.[2025-04-21 08:57:24 +0530] info [cpaneld] 156.228.96.190 - heipow31 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipow31 (has_cpuser_file failed)156.228.96.1906252001 !  Sy+ ossec11000hLogin failed on the cpanel service.[2025-04-21 08:57:09 +0530] info [cpaneld] 156.228.125.226 - heipow13 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipow13 (has_cpuser_file failed)156.228.125.2266252001  Sy+ ossec11000h:Login failed on the cpanel service.[2025-04-21 08:57:53 +0530] info [cpaneld] 154.213.163.205 - heipow67 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipow67 (has_cpuser_file failed)154.213.163.2056252001   Sw) ossec11000hLogin failed on the cpanel service.[2025-04-21 08:57:08 +0530] info [cpaneld] 156.242.36.223 - heipow12 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipow12 (has_cpuser_file failed)156.242.36.2236252001   Sy+ ossec11000hBLogin failed on the cpanel service.[2025-04-21 08:58:01 +0530] info [cpaneld] 156.228.118.114 - heipow78 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipow78 (has_cpuser_file failed)156.228.118.1146252001   Sy+ ossec11000h@Login failed on the cpanel service.[2025-04-21 08:58:00 +0530] info [cpaneld] 154.213.166.101 - heipow76 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipow76 (has_cpuser_file failed)154.213.166.1016252001  Su' ossec11000h0Login failed on the cpanel service.[2025-04-21 08:57:43 +0530] info [cpaneld] 156.242.42.10 - heipow54 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipow54 (has_cpuser_file failed)156.242.42.106252001   Sy+ ossec11000h"Login failed on the cpanel service.[2025-04-21 08:57:29 +0530] info [cpaneld] 156.228.101.117 - heipow37 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipow37 (has_cpuser_file failed)156.228.101.1176252001   Sw) ossec11000hLogin failed on the cpanel service.[2025-04-21 08:57:11 +0530] info [cpaneld] 156.228.95.221 - heipow15 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipow15 (has_cpuser_file failed)156.228.95.2216252001  Su' ossec11000h>Login failed on the cpanel service.[2025-04-21 08:57:57 +0530] info [cpaneld] 156.228.82.78 - heipow72 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipow72 (has_cpuser_file failed)156.228.82.786252001   Sw) ossec11000h<Login failed on the cpanel service.[2025-04-21 08:57:55 +0530] info [cpaneld] 156.242.41.197 - heipow70 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipow70 (has_cpuser_file failed)156.242.41.1976252001 *\~tj`VLB8.$zpf\H>4*   v l b X N D : 0 &    ~ t j ` V L B 8 . $    H R > z p f \ 4 *  vlbXND:0&|rh^TJ@6,"xndZPF<2( t~j`LVB8.$zpf\ | r h ^ T J @ 6 , "    x n d Z P F < 2 (   RRH>4*  vlbXND:0& h}HH hz:HG hz.HF hxHE hxHD hv5HC hvHB hq+HA hqH@ hp H? hpH> hoH= hoH< hnH; hnH: hnH9 hn H8 hjsH7 hjH6 hjH5 hdH4 hcH3 h\H2 h\wH1 hZH0 hZH/ hMH. hMH- hMgH, hMuH+ hJH* hJH) hIH( hIH' hGH& hGvH% hGfH$ h@4H# h@@H" h;H! h:H h:H h:H h:H h:H h9H h9H h2vH h2hH h2`H h2JH h2&H h0qH h+jH h*H h*H h$H h$H h$TH h$JH h$*H h$H hH hH hGH hH hH hH h=H h1H hH hH hH hG h G hXG h%G h G hG h-G hJG h@G h&G hG hG hG hG hG hG h{G hoG hG hG h-G h-G hG hG hG hG hݱG hڪG hHG hG hG hG hG hнG hG hG h͟G ḧ́G hG h G hĈG htG hG hG hêG hÞG hG hG hG hG hG hpG hLG hHG hLG hRG hRG hPG hPG hPG hNG hNG hNG hLG hJG hJG hHG hHG hFG hFGv hFGu hDG hDG hDG| hBG hBG h@G h@G h@G h>G h>G h 732800= 732800) 7180758 7180753} 71807537 690791L 690791J 690791I 690791If 690791I% 690791I 690791H2 690791H 732800L 732800@ 7328009 732800 732800 732800 732800 732800 732800 732800 732800 732800 732800 732800 9 732800 - 732800\ 732800 732800 732800K 6907910 690791 690791R 690791x 690791] 732800B 732800B 732800A 732800A 732800AV 732800@ 732800@G 732800? 732800= 732800= 732800<6 7328008 7328007X 7328007? 7328006I 7328005n 7328003 7328003Y 7328003 7328002 7328002D 732800/T 732800.$ 732800. 732800- 732800, 732800, 732800+^ 732800(\ 732800% 732800% 732800$ 732800$ 732800$z 732800$c 732800"7 732800"& 732800!B 732800 732800 732800 732800u 732800 732800L 732800 732800 732800 732800 732800 732800T 732800K 732800JM 732800I 732800I 690791 690791 6907915 732800H 690791, 690791> 690791 732800HJ 690791} 732800H 690791!+ 732800H 732800H i 690791O 690791@p 690791@o 690791@n 690791@m 690791@l 690791? 690791?1 690791? 690791> 690791> 690791= 690791=n 690791=_ 690791=T 690791< 690791; 6907919 6907918 6907918 6907918 6907917} 6907917 6907915 6907915 6907914 6907913 6907913 6907913 6907911` 6907910 690791/ 690791- 690791, 690791,{ 690791,T 690791+ 690791+r 690791+R 690791* 690791* 690791* 690791*C 690791*; 690791) 690791)R 690791(* 690791' 690791' 690791& 690791% 690791% 690791# 690791" 690791" 690791! 783754D 783754C 783754;C 7837547W 7837543p 7837541 783754- 732800Fp 732800E8 732800E) 732800E( 732800E' 732800E! 732800DJ 732800C 732800C 732800C{ 732800B * U M B:QVwM  3I# ossec11301hGNew FTP connection.Apr 21 15:56:14 vm1 pure-ftpd[2114813]: (?@3.128.27.22) [INFO] New connection from 3.128.27.223.128.27.226252001  3I# ossec11301hNew FTP connection.Apr 21 15:55:08 vm1 pure-ftpd[2114645]: (?@3.128.27.22) [INFO] New connection from 3.128.27.223.128.27.226252001T  -5' ossec13001hExim Auth failed2025-04-21 15:46:38 dovecot_login authenticator failed for ([218.22.253.37]) [218.22.253.37]:42241: 535 Incorrect authentication data (set_id=sales)218.22.253.371814991d  -W% ossec13001hExim Auth failed2025-04-21 15:46:24 dovecot_login authenticator failed for ([59.34.17.130]) [59.34.17.130]:59797: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)59.34.17.1301814991S  -5' ossec13001h=Exim Auth failed2025-04-21 15:17:39 dovecot_login authenticator failed for ([78.101.241.84]) [78.101.241.84]:51552: 535 Incorrect authentication data (set_id=sales)78.101.241.84289688g  -[' ossec13001h1Exim Auth failed2025-04-21 15:17:27 dovecot_login authenticator failed for ([31.173.66.222]) [31.173.66.222]:60344: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)31.173.66.2222017370Z  -=+ ossec13001hExim Auth failed2025-04-21 15:12:54 dovecot_login authenticator failed for ([123.210.137.231]) [123.210.137.231]:46952: 535 Incorrect authentication data (set_id=sales)123.210.137.2312077456v  -y' ossec13001hExim Auth failed2025-04-21 15:12:43 dovecot_login authenticator failed for 111-70-23-216.emome-ip.hinet.net [111.70.23.216]:35284: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)111.70.23.2161668284d  -W' ossec13001hExim Auth failed2025-04-21 14:58:46 dovecot_login authenticator failed for (46.30.163.125.access.ipnet.ua) [46.30.163.125]:55706: 535 Incorrect authentication data (set_id=services)46.30.163.125690791  -# ossec13001hExim Auth failed2025-04-21 14:58:31 dovecot_login authenticator failed for (86x62x97x73.static-business.msk.ertelecom.ru) [86.62.97.73]:43586: 535 Incorrect authentication data (set_id=services@heipowersystem.com)86.62.97.732017370+~  3Y+ ossec11301h New FTP connection.Apr 21 14:41:58 vm1 pure-ftpd[2099310]: (?@192.227.232.155) [INFO] New connection from 192.227.232.155192.227.232.1556252001(}  3U) ossec11301hXNew FTP connection.Apr 21 14:26:53 vm1 pure-ftpd[2096149]: (?@45.227.254.152) [INFO] New connection from 45.227.254.15245.227.254.1523703430)| 3U) ossec11301h%New FTP connection.Apr 21 14:13:15 vm1 pure-ftpd[2093343]: (?@172.232.232.10) [INFO] New connection from 172.232.232.10172.232.232.101643084){ 3U) ossec11301h New FTP connection.Apr 21 14:12:47 vm1 pure-ftpd[2092607]: (?@172.232.232.10) [INFO] New connection from 172.232.232.10172.232.232.101643084(z  3U) ossec11301hNew FTP connection.Apr 21 14:11:12 vm1 pure-ftpd[2092174]: (?@172.232.232.10) [INFO] New connection from 172.232.232.10172.232.232.101643084(y  3U) ossec11301h-New FTP connection.Apr 21 14:09:08 vm1 pure-ftpd[2091703]: (?@172.232.232.10) [INFO] New connection from 172.232.232.10172.232.232.101643084Px  -1% ossec13001hJExim Auth failed2025-04-21 14:05:21 dovecot_login authenticator failed for ([81.22.19.176]) [81.22.19.176]:49918: 535 Incorrect authentication data (set_id=sales)81.22.19.176290291lw  -a+ ossec13001h@Exim Auth failed2025-04-21 14:05:11 dovecot_login authenticator failed for ([207.188.157.230]) [207.188.157.230]:1661: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)207.188.157.2302510769`v  -O% ossec13001h&Exim Auth failed2025-04-21 14:00:30 dovecot_login authenticator failed for ([83.239.88.62]) [83.239.88.62]:55037: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)83.239.88.622017370   ]  ] -E) ossec13001hExim Auth failed2025-04-22 06:15:31 dovecot_login authenticator failed for (NQT3aICe) [185.241.208.67]:65105: 535 Incorrect authentication data (set_id=info@nyaystambh.com)185.241.208.67798544e  -W) ossec13001hExim Auth failed2025-04-22 05:57:55 dovecot_login authenticator failed for ([196.188.187.85]) [196.188.187.85]:55152: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)196.188.187.85337996s~  -u% ossec13001hExim Auth failed2025-04-22 05:57:46 dovecot_login authenticator failed for ([58.34.192.68]) [58.34.192.68]:59509: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)58.34.192.681814991l}  -g% ossec13001hExim Auth failed2025-04-22 05:55:17 dovecot_login authenticator failed for ip98-161-232-9.ph.ph.cox.net [98.161.232.9]:44704: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)98.161.232.96252001y|  -}) ossec13001hExim Auth failed2025-04-22 05:54:56 dovecot_login authenticator failed for ([95.167.133.126]) [95.167.133.126]:60230: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)95.167.133.1262017370y{  -}) ossec13001hExim Auth failed2025-04-22 05:54:40 dovecot_login authenticator failed for ([111.192.73.103]) [111.192.73.103]:55594: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)111.192.73.1031814991ez  -S+ ossec13001hExim Auth failed2025-04-22 05:47:17 dovecot_login authenticator failed for ([123.162.133.230]) [123.162.133.230]:60130: 535 Incorrect authentication data (set_id=vikas.khandelwal)123.162.133.2301814991y  - ) ossec13001hExim Auth failed2025-04-22 05:47:04 dovecot_login authenticator failed for (82-102-188-117.orange.net.il) [82.102.188.117]:47012: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)82.102.188.117294640x  W% ossec9708hPDovecot Aborted Login with empty userApr 22 05:44:06 vm1 dovecot[90419]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=203.55.131.5, lip=103.74.54.108, TLS, session=<3cHq3FIzGszLN4MF>203.55.131.56252001Tw  -5' ossec13001hަExim Auth failed2025-04-22 05:41:17 dovecot_login authenticator failed for ([61.75.191.190]) [61.75.191.190]:55668: 535 Incorrect authentication data (set_id=sales)61.75.191.1901835841mv  -c+ ossec13001hސExim Auth failed2025-04-22 05:40:55 dovecot_login authenticator failed for ([103.120.116.162]) [103.120.116.162]:54395: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)103.120.116.1621168579Bu  gU) ossec11307h=Multiple connection attempts from same sourceApr 22 05:26:43 vm1 pure-ftpd[2288826]: (?@157.230.26.127) [INFO] New connection from 157.230.26.127157.230.26.1272921044)t 3U) ossec11301h9 New FTP connection.Apr 22 05:26:39 vm1 pure-ftpd[2288776]: (?@157.230.26.127) [INFO] New connection from 157.230.26.127157.230.26.1272921044[s  -K# ossec13001h8Exim Auth failed2025-04-22 04:39:43 dovecot_login authenticator failed for ([65.20.223.7]) [65.20.223.7]:48512: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)65.20.223.799237sr  -u% ossec13001h$Exim Auth failed2025-04-22 04:39:24 dovecot_login authenticator failed for ([103.83.9.138]) [103.83.9.138]:55210: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)103.83.9.1381269750q  W) ossec9708hϲDovecot Aborted Login with empty userApr 22 04:37:28 vm1 dovecot[90419]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=165.154.36.102, lip=103.74.54.108, session=165.154.36.1026252001    1 E o }QWv Xp  -;) ossec13001hλExim Auth failed2025-04-22 04:33:23 dovecot_login authenticator failed for ([117.240.117.170]) [115.247.81.134]:36938: 535 Incorrect authentication data (set_id=sales)115.247.81.1341269750do  -W% ossec13001hαExim Auth failed2025-04-22 04:33:13 dovecot_login authenticator failed for ([66.11.25.195]) [66.11.25.195]:44036: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)66.11.25.1956252001Zn  ;1) ossec13008hMail Recipient rejected2025-04-22 04:30:13 H=(bluepitz.com) [185.208.158.20]:60997 F= rejected RCPT : Sender verify failed185.208.158.206252001Tm  -5' ossec13001hExim Auth failed2025-04-22 04:29:51 dovecot_login authenticator failed for ([49.249.159.50]) [49.249.159.50]:39472: 535 Incorrect authentication data (set_id=sales)49.249.159.501269750gl  -[' ossec13001hExim Auth failed2025-04-22 04:29:35 dovecot_login authenticator failed for ([122.225.55.98]) [122.225.55.98]:56118: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)122.225.55.981814991\k  -G% ossec13001h+Exim Auth failed2025-04-22 04:26:42 dovecot_login authenticator failed for ([222.180.5.90]) [222.180.5.90]:60800: 535 Incorrect authentication data (set_id=vikas.khandelwal)222.180.5.901814991uj  -u) ossec13001hExim Auth failed2025-04-22 04:26:23 dovecot_login authenticator failed for ([114.254.253.71]) [114.254.253.71]:44889: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)114.254.253.711814991%i  3Q' ossec11301hwNew FTP connection.Apr 22 03:49:33 vm1 pure-ftpd[2268004]: (?@198.235.24.55) [INFO] New connection from 198.235.24.55198.235.24.556252001h  3I# ossec11301hÜNew FTP connection.Apr 22 03:45:56 vm1 pure-ftpd[2267386]: (?@71.6.232.20) [INFO] New connection from 71.6.232.2071.6.232.206252001Yg  -?) ossec13001h+Exim Auth failed2025-04-22 03:35:29 dovecot_login authenticator failed for ([80.227.102.242]) [80.227.102.242]:48637: 535 Incorrect authentication data (set_id=purchase)80.227.102.242290557mf  -e) ossec13001hExim Auth failed2025-04-22 03:35:12 dovecot_login authenticator failed for ([121.179.93.147]) [121.179.93.147]:39374: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)121.179.93.1471835841Qe  -1% ossec13001hExim Auth failed2025-04-22 03:07:50 dovecot_login authenticator failed for ([211.48.60.35]) [211.48.60.35]:49910: 535 Incorrect authentication data (set_id=sales)211.48.60.351835841gd  -[' ossec13001hExim Auth failed2025-04-22 03:07:39 dovecot_login authenticator failed for ([61.136.142.13]) [61.136.142.13]:40786: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)61.136.142.131814991`c  -O% ossec13001h Exim Auth failed2025-04-22 03:01:12 dovecot_login authenticator failed for ([95.79.57.221]) [95.79.57.221]:51842: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)95.79.57.2212017370yb  -}) ossec13001hExim Auth failed2025-04-22 03:01:01 dovecot_login authenticator failed for ([101.168.29.210]) [101.168.29.210]:35832: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)101.168.29.2102077456fa  -W) ossec13001h+Exim Auth failed2025-04-22 02:48:34 dovecot_login authenticator failed for ([220.80.192.168]) [220.80.192.168]:54882: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)220.80.192.1681835841|`  -+ ossec13001hExim Auth failed2025-04-22 02:48:22 dovecot_login authenticator failed for ([123.210.145.224]) [123.210.145.224]:46142: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)123.210.145.2242077456 \X S F _ p 8;\Z  -?) ossec13001hExim Auth failed2025-04-22 08:07:32 dovecot_login authenticator failed for ([27.128.162.146]) [27.128.162.146]:59768: 535 Incorrect authentication data (set_id=services)27.128.162.1461814991x  -# ossec13001hExim Auth failed2025-04-22 08:07:09 dovecot_login authenticator failed for net-2-37-223-58.cust.vodafonedsl.it [2.37.223.58]:59698: 535 Incorrect authentication data (set_id=services@heipowersystem.com)2.37.223.583175395Q  -1% ossec13001hExim Auth failed2025-04-22 07:57:27 dovecot_login authenticator failed for ([14.21.36.111]) [14.21.36.111]:39005: 535 Incorrect authentication data (set_id=sales)14.21.36.1111814991b  -W% ossec13001hExim Auth failed2025-04-22 07:57:11 dovecot_login authenticator failed for ([65.20.168.20]) [65.20.168.20]:39373: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)65.20.168.2099237~  - ' ossec13001h{Exim Auth failed2025-04-22 07:35:45 dovecot_login authenticator failed for (5x166x120x181.dynamic.barnaul.ertelecom.ru) [5.166.120.181]:34212: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)5.166.120.1812017370v  -y' ossec13001hmExim Auth failed2025-04-22 07:35:31 dovecot_login authenticator failed for ([27.40.100.189]) [27.40.100.189]:39034: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)27.40.100.1891814991P  -1% ossec13001hHExim Auth failed2025-04-22 07:26:24 dovecot_login authenticator failed for ([41.220.3.113]) [41.220.3.101]:24145: 535 Incorrect authentication data (set_id=sales)41.220.3.101226074l  -a+ ossec13001h>Exim Auth failed2025-04-22 07:26:13 dovecot_login authenticator failed for ([221.239.109.147]) [221.239.109.147]:3222: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)221.239.109.1471814991\  -G% ossec13001hExim Auth failed2025-04-22 07:23:07 dovecot_login authenticator failed for ([70.89.33.235]) [70.89.33.235]:52771: 535 Incorrect authentication data (set_id=vikas.khandelwal)70.89.33.2356252001r  -q' ossec13001hxExim Auth failed2025-04-22 07:22:56 dovecot_login authenticator failed for ([121.11.160.60]) [121.11.160.60]:56986: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)121.11.160.601814991Z  -=+ ossec13001hExim Auth failed2025-04-22 06:48:57 dovecot_login authenticator failed for ([121.142.146.167]) [121.142.146.167]:34960: 535 Incorrect authentication data (set_id=sales)121.142.146.1671835841j  -_) ossec13001htExim Auth failed2025-04-22 06:48:44 dovecot_login authenticator failed for ([117.69.210.199]) [117.69.210.199]:60149: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)117.69.210.1991814991b  -S' ossec13001hExim Auth failed2025-04-22 06:28:29 dovecot_login authenticator failed for ([217.29.208.26]) [217.29.208.26]:34784: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)217.29.208.26953987  -) ossec13001hExim Auth failed2025-04-22 06:28:12 dovecot_login authenticator failed for (20118168049.host.telemar.net.br) [200.202.250.46]:49022: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)200.202.250.463469034  - ' ossec13001hTExim Auth failed2025-04-22 06:22:35 dovecot_login authenticator failed for (51.241.220.60.adsl-pool.sx.cn) [60.220.241.50]:60357: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)60.220.241.501814991?  - ) ossec13001hExim Auth failed2025-04-22 06:19:30 dovecot_login authenticator failed for (Pqt1FWnA) [185.241.208.67]:49362: 535 Incorrect authentication data185.241.208.67798544_ -I) ossec13001hExim Auth failed2025-04-22 06:15:51 dovecot_login authenticator failed for (xxCQBI3BHl) [185.241.208.67]:51801: 535 Incorrect authentication data (set_id=info@nyaystambh.com)185.241.208.67798544 0 9mJ { n a T G : -   yl_RE8+uh[NA4' dWJ=0# zm`SF9, Wq~~qdW=0# z`SFB5(~qJ=0,}pcVI</"i\Ov w j ] P C 6 )    v i \ Od B 5 (     r e X K > 1 $  M @ 3 &   3017382E} 3017382E` 3017382E_ 30173828! 30773118} 30173828< 3017382E* 3017382E 3017382D 3017382D 3017382D 3017382D 3017382D 3017382D 3017382Dy 3017382Dn 3017382C 3017382 3017382Ch 3017382CN 3017382C= 3017382B 3017382F 3017382E 3017382E 3017382I) 3017382_ 3017382H 3017382H 3017382GX 3017382GW 3017382GV 3017382IH 3017382I. 3017382IJ 3017382I* 3017382. 3017382 3017382 3017382E~ 3017382 L 3017382B 3017382B 3017382B 3017382 3017382A 3017382A 3017382A 3017382A 3017382A# 3017382A 3017382@ 3017382@@ 3017382? 3017382> 3017382> 3017382>] 3017382>; 3017382= 3017382= 3017382= 3017382 3017382= 3017382= 3017382=@ 3017382== 3017382, rip=45.156.128.89, lip=103.74.54.108, TLS, session=<2CMxGlczY9otnIBZ>45.156.128.892264397'-  3U) ossec11301h#New FTP connection.Apr 22 10:36:18 vm1 pure-ftpd[2354804]: (?@93.123.109.222) [INFO] New connection from 93.123.109.22293.123.109.222732800j,  -c% ossec13001h#Exim Auth failed2025-04-22 10:32:59 dovecot_login authenticator failed for (static.vnpt-hanoi.com.vn) [123.25.25.53]:37721: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)123.25.25.531562822+  -7+ ossec13001h"Exim Auth failed2025-04-22 10:32:49 dovecot_login authenticator failed for 107-135-117-245.lightspeed.livnmi.sbcglobal.net [107.135.117.245]:9665: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)107.135.117.2456252001k*  -c' ossec13001h!Exim Auth failed2025-04-22 10:27:35 dovecot_login authenticator failed for (nsg-corporate-49.173.185.122.airtel.in) [27.123.97.106]:48718: 535 Incorrect authentication data (set_id=sales)27.123.97.1061269750v)  -y' ossec13001h!Exim Auth failed2025-04-22 10:27:25 dovecot_login authenticator failed for 111-70-23-246.emome-ip.hinet.net [111.70.23.246]:38961: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)111.70.23.2461668284b(  -O) ossec13001h%Exim Auth failed2025-04-22 10:16:29 dovecot_login authenticator failed for ([137.101.188.80]) [137.101.188.80]:39122: 535 Incorrect authentication data (set_id=vikas.khandelwal)137.101.188.802510769u'  -u) ossec13001hExim Auth failed2025-04-22 10:16:19 dovecot_login authenticator failed for ([81.161.142.133]) [81.161.142.133]:51056: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)81.161.142.1332623032f&  -Y' ossec13001hExim Auth failed2025-04-22 10:14:00 dovecot_login authenticator failed for 78-73-202-153-no2665.tbcn.telia.com [78.73.202.153]:47441: 535 Incorrect authentication data (set_id=sales)78.73.202.1532661886z%  -) ossec13001hExim Auth failed2025-04-22 10:13:49 dovecot_login authenticator failed for 198-91-194-206.cpe.distributel.net [198.91.194.206]:40400: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)198.91.194.2066251999T$  -5' ossec13001hExim Auth failed2025-04-22 09:50:35 dovecot_login authenticator failed for ([114.242.61.19]) [114.242.61.35]:39908: 535 Incorrect authentication data (set_id=sales)114.242.61.351814991j#  -_) ossec13001h Exim Auth failed2025-04-22 09:50:24 dovecot_login authenticator failed for ([195.222.57.183]) [195.222.57.183]:52656: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)195.222.57.1833277605 *\~tj`VLB8.$zpf\H>4*   v l b X N D : 0 &    ~ t j ` V L B 8 . $    z p f \ R H > 4 *  vlbXND:0&|rh^TJ@6,"xnZdPF<2( ~t`jVLB8.$pz\f | r h ^ T J @ 6 , "    x n d Z P F < 2 (   RRH>4*  vlbXND:0& hIs hIr hDIq hRIp hIo hIn hIm hIl hIk hIj hIi h Ih hIg hIf hIe hId hIc hIb hIa hUI` hCI_ h I^ hI] hI\ h.I[ hIZ h)IY h5IX hIW hIV hIU hIT hIS hIR hIQ hIP h$IO hIN h?IM h5IL h)IK hIJ hII hIH hIG hIF hIE hހID hlIC h݄IB hxIA h^I@ hjI? hI> hكI= h}I< heI; hH h>H h7H h6 H h5H h3H h3H h2HH h2(H h/H h/H h/H h.H h.H h,LH h&qH h#H h#H h"H h!H h!H h%H hH hH hH hH h H hAH h/H h(H h-NI hH hH hH h@H h4H hKH hWH hWH hH hH hyH hhH hH hH hH hH hH hH h{H hmH hHH h>H hH hxH hH htH hH hH hTH hH hH hH hH hH~ hH} hH| hH{ hHz hHy hPHx hަHw hސHv SU D f #5V|U  -' ossec13001h`}Exim Auth failed2025-04-22 14:55:15 dovecot_login authenticator failed for (r552pc2.ee.ntu.edu.tw) [131.107.8.114]:17964: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)131.107.8.1146252001iT  -]) ossec13001h^Exim Auth failed2025-04-22 14:47:00 dovecot_login authenticator failed for ([59.94.179.138]) [103.83.244.210]:63133: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)103.83.244.2101269750WS  -9) ossec13001h^Exim Auth failed2025-04-22 14:47:18 dovecot_login authenticator failed for ([102.50.245.141]) [102.50.245.141]:43390: 535 Incorrect authentication data (set_id=sales)102.50.245.1412542007eR  -U) ossec13001h^Exim Auth failed2025-04-22 14:47:15 dovecot_login authenticator failed for 175-98-123-245.static.tfn.net.tw [175.98.123.245]:52120: 535 Incorrect authentication data (set_id=sales)175.98.123.2451668284qQ  -s# ossec13001h^Exim Auth failed2025-04-22 14:47:07 dovecot_login authenticator failed for (113-28-9-22.static.imsbiz.com) [113.28.9.22]:60102: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)113.28.9.221819730%P  3Q' ossec11301h[New FTP connection.Apr 22 14:35:39 vm1 pure-ftpd[2406800]: (?@146.70.59.155) [INFO] New connection from 146.70.59.155146.70.59.1552264397ZO  -?) ossec13001hZeExim Auth failed2025-04-22 14:29:17 dovecot_login authenticator failed for ([220.178.39.106]) [220.178.39.106]:36026: 535 Incorrect authentication data (set_id=services)220.178.39.1061814991iN  -a' ossec13001hZYExim Auth failed2025-04-22 14:29:05 dovecot_login authenticator failed for ([87.200.88.209]) [87.200.88.209]:39666: 535 Incorrect authentication data (set_id=services@heipowersystem.com)87.200.88.209290557VM  -?! ossec13001hZ%Exim Auth failed2025-04-22 14:28:12 dovecot_login authenticator failed for ([47.83.2.11]) [47.83.2.11]:43020: 535 Incorrect authentication data (set_id=vikas.khandelwal)47.83.2.111819730nL  -m% ossec13001hZExim Auth failed2025-04-22 14:28:02 dovecot_login authenticator failed for ([196.0.41.134]) [196.0.41.134]:33847: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)196.0.41.134226074lK  -g% ossec13001hUrExim Auth failed2025-04-22 14:08:09 dovecot_login authenticator failed for (thepsindustries.com) [119.96.131.8]:38872: 535 Incorrect authentication data (set_id=service@thepsindustries.com)119.96.131.81814991XJ  -?% ossec13001hUZExim Auth failed2025-04-22 14:07:44 dovecot_login authenticator failed for (thepsindustries.com) [119.96.131.8]:36192: 535 Incorrect authentication data (set_id=nologin)119.96.131.81814991"I  3M% ossec11301hQNew FTP connection.Apr 22 13:51:55 vm1 pure-ftpd[2397144]: (?@103.203.59.5) [INFO] New connection from 103.203.59.5103.203.59.51814991YH  -=+ ossec13001hNExim Auth failed2025-04-22 13:39:11 dovecot_login authenticator failed for ([196.189.124.218]) [196.189.124.218]:42216: 535 Incorrect authentication data (set_id=sales)196.189.124.218337996 G  [y% ossec12004hNPossible Dovecot CVE-2019-11500 attemptApr 22 13:39:10 vm1 dovecot[90419]: pop3-login: Disconnected: Input buffer full (no auth attempts in 1 secs): user=<>, rip=18.218.22.99, lip=103.74.54.108, session=18.218.22.996252001yF  -}) ossec13001hNExim Auth failed2025-04-22 13:38:52 dovecot_login authenticator failed for 125-228-90-178.hinet-ip.hinet.net [125.228.90.178]:38024: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)125.228.90.1781668284(E  3U) ossec11301hJNew FTP connection.Apr 22 13:22:49 vm1 pure-ftpd[2390954]: (?@45.156.128.112) [INFO] New connection from 45.156.128.11245.156.128.1122264397 $ F X j u }mco}f_  -Y' ossec13001hExim Auth failed2025-04-22 02:38:33 dovecot_login authenticator failed for (134.56.58.179.hwccustomers.com) [134.56.58.179]:49713: 535 Incorrect authentication data (set_id=services)134.56.58.1796252001m^  -e) ossec13001hExim Auth failed2025-04-22 02:38:14 dovecot_login authenticator failed for ([120.157.128.14]) [120.157.128.14]:53516: 535 Incorrect authentication data (set_id=services@heipowersystem.com)120.157.128.142077456o]  -i) ossec13001h Exim Auth failed2025-04-22 02:22:48 dovecot_login authenticator failed for (73.153.212.218.starhub.net.sg) [101.100.184.80]:33798: 535 Incorrect authentication data (set_id=vikas.khandelwal)101.100.184.801880251\  -) ossec13001hExim Auth failed2025-04-22 02:22:38 dovecot_login authenticator failed for 198-91-194-206.cpe.distributel.net [198.91.194.206]:53552: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)198.91.194.2066251999([  3U) ossec11301h9New FTP connection.Apr 22 02:14:39 vm1 pure-ftpd[2248822]: (?@206.168.34.114) [INFO] New connection from 206.168.34.114206.168.34.11462520016Z  Ag% ossec11302hFTP Authentication failed.Apr 22 02:09:12 vm1 pure-ftpd[2247662]: (?@34.140.41.19) [WARNING] Authentication failed for user [anonymous]34.140.41.192802361#Y 3M% ossec11301hNew FTP connection.Apr 22 02:09:06 vm1 pure-ftpd[2247659]: (?@34.140.41.19) [INFO] New connection from 34.140.41.1934.140.41.192802361X  ?1 ossec1008hProcess exiting (killed).Apr 22 00:05:37 vm1 spamd[1906781]: spamd: server killed by SIGTERM, shutting down"W  3M% ossec11301hNew FTP connection.Apr 21 23:59:27 vm1 pure-ftpd[2218851]: (?@20.171.24.93) [INFO] New connection from 20.171.24.9320.171.24.936252001TV  -5' ossec13001hExim Auth failed2025-04-21 23:52:38 dovecot_login authenticator failed for ([85.26.209.236]) [85.26.209.236]:60226: 535 Incorrect authentication data (set_id=sales)85.26.209.2362017370vU  -y' ossec13001hExim Auth failed2025-04-21 23:52:16 dovecot_login authenticator failed for 31-208-161-94.cust.bredband2.com [31.208.161.94]:58006: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)31.208.161.942661886mT  -c+ ossec13001hExim Auth failed2025-04-21 23:36:21 dovecot_login authenticator failed for (135.121.156.175.unknown.m1.com.sg) [175.156.121.135]:34459: 535 Incorrect authentication data (set_id=services)175.156.121.1351880251pS  -i+ ossec13001hExim Auth failed2025-04-21 23:36:11 dovecot_login authenticator failed for ([190.120.255.132]) [190.120.255.132]:12798: 535 Incorrect authentication data (set_id=services@heipowersystem.com)190.120.255.1323625428iR  -]) ossec13001h Exim Auth failed2025-04-21 23:27:27 dovecot_login authenticator failed for ([200.168.249.9]) [187.50.226.182]:44861: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)187.50.226.1823469034iQ  -]) ossec13001hExim Auth failed2025-04-21 23:27:48 dovecot_login authenticator failed for (189.219.36.213-clientes-izzi.mx) [189.219.36.213]:54438: 535 Incorrect authentication data (set_id=purchase)189.219.36.2133996063YP  -;+ ossec13001hExim Auth failed2025-04-21 23:27:42 dovecot_login authenticator failed for ([218.75.123.109]) [183.247.171.186]:48819: 535 Incorrect authentication data (set_id=sales)183.247.171.1861814991iO  -a' ossec13001h Exim Auth failed2025-04-21 23:27:30 dovecot_login authenticator failed for ([91.72.171.210]) [91.72.171.210]:34961: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)91.72.171.210290557iN  -[+ ossec13001hExim Auth failed2025-04-21 23:22:26 dovecot_login authenticator failed for ([166.252.222.193]) [166.252.222.193]:49936: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)166.252.222.1936252001  # D O d ZsNj  -_) ossec13001hExim Auth failed2025-04-22 18:28:46 dovecot_login authenticator failed for ([211.248.31.142]) [211.248.31.142]:56774: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)211.248.31.1421835841"  3M% ossec11301hjNew FTP connection.Apr 22 18:28:16 vm1 pure-ftpd[2457582]: (?@45.133.193.7) [INFO] New connection from 45.133.193.745.133.193.72629691"  3M% ossec11301hfNew FTP connection.Apr 22 18:28:14 vm1 pure-ftpd[2457579]: (?@146.70.11.11) [INFO] New connection from 146.70.11.11146.70.11.113895114\  -C+ ossec13001hExim Auth failed2025-04-22 18:24:43 dovecot_login authenticator failed for ([195.189.226.139]) [195.189.226.139]:46726: 535 Incorrect authentication data (set_id=services)195.189.226.139690791k  -c' ossec13001hExim Auth failed2025-04-22 18:24:29 dovecot_login authenticator failed for ([117.247.204.32]) [117.249.42.53]:33404: 535 Incorrect authentication data (set_id=services@heipowersystem.com)117.249.42.531269750f  -W) ossec13001hExim Auth failed2025-04-22 18:15:58 dovecot_login authenticator failed for ([219.145.221.21]) [219.145.221.21]:36866: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)219.145.221.211814991x  -}) ossec13001htExim Auth failed2025-04-22 18:15:38 dovecot_login authenticator failed for ([196.191.142.67]) [196.191.142.67]:41614: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)196.191.142.67337996T  -5' ossec13001hExim Auth failed2025-04-22 18:12:33 dovecot_login authenticator failed for ([61.177.59.235]) [61.177.59.235]:38919: 535 Incorrect authentication data (set_id=sales)61.177.59.2351814991g  -[' ossec13001hExim Auth failed2025-04-22 18:12:17 dovecot_login authenticator failed for ([1.235.192.131]) [1.235.192.131]:55378: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)1.235.192.1311835841b  -O) ossec13001hExim Auth failed2025-04-22 18:12:00 dovecot_login authenticator failed for ([103.97.213.151]) [103.97.213.151]:53776: 535 Incorrect authentication data (set_id=vikas.khandelwal)103.97.213.1511269750  -' ossec13001hExim Auth failed2025-04-22 18:11:51 dovecot_login authenticator failed for syn-024-097-253-246.biz.spectrum.com [24.97.253.246]:46570: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)24.97.253.2466252001f~  -W) ossec13001hExim Auth failed2025-04-22 18:08:24 dovecot_login authenticator failed for ([178.178.222.53]) [178.178.222.53]:37238: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)178.178.222.532017370p}  -q# ossec13001hExim Auth failed2025-04-22 18:08:07 dovecot_login authenticator failed for ([187.12.8.38]) [187.12.8.38]:47555: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)187.12.8.383469034Z|  -=+ ossec13001hiExim Auth failed2025-04-22 18:06:55 dovecot_login authenticator failed for ([191.241.247.150]) [191.241.247.150]:46952: 535 Incorrect authentication data (set_id=sales)191.241.247.1503469034m{  -c+ ossec13001h]Exim Auth failed2025-04-22 18:06:43 dovecot_login authenticator failed for ([183.109.195.179]) [183.109.195.179]:60684: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)183.109.195.1791835841iz  -[+ ossec13001hExim Auth failed2025-04-22 18:00:52 dovecot_login authenticator failed for ([117.159.174.136]) [117.159.174.136]:50928: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)117.159.174.1361814991xy  -}' ossec13001hExim Auth failed2025-04-22 18:00:39 dovecot_login authenticator failed for 157.ip-51-75-142.eu [51.75.142.157]:46158: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)51.75.142.1573017382 *< A D 8 > hZ*  -=+ ossec13001hJExim Auth failed2025-04-21 19:10:32 dovecot_login authenticator failed for ([178.178.194.192]) [178.178.194.192]:54536: 535 Incorrect authentication data (set_id=sales)178.178.194.1922017370v)  -y' ossec13001hJExim Auth failed2025-04-21 19:10:20 dovecot_login authenticator failed for 111-70-49-104.emome-ip.hinet.net [111.70.49.104]:59065: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)111.70.49.1041668284^(  -M# ossec13001hIExim Auth failed2025-04-21 19:05:44 dovecot_login authenticator failed for (185-11-23-5.static.eolo.it) [185.11.23.5]:42785: 535 Incorrect authentication data (set_id=services)185.11.23.53175395p'  -i+ ossec13001hIExim Auth failed2025-04-21 19:05:36 dovecot_login authenticator failed for ([183.105.138.168]) [183.105.138.168]:50308: 535 Incorrect authentication data (set_id=services@heipowersystem.com)183.105.138.1681835841q&  -o' ossec13001hGExim Auth failed2025-04-21 18:56:27 dovecot_login authenticator failed for c-73-45-216-101.hsd1.il.comcast.net [73.45.216.101]:44804: 535 Incorrect authentication data (set_id=vikas.khandelwal)73.45.216.1016252001 %  -%' ossec13001hGvExim Auth failed2025-04-21 18:56:12 dovecot_login authenticator failed for (190142265.ip3.static.mediacommerce.com.co) [200.91.234.36]:52344: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)200.91.234.363686110u$  -u) ossec13001hGfExim Auth failed2025-04-21 18:55:57 dovecot_login authenticator failed for ([103.163.44.118]) [103.163.44.118]:51680: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)103.163.44.1181269750g#  -[' ossec13001h@4Exim Auth failed2025-04-21 18:25:15 dovecot_login authenticator failed for ([183.182.99.92]) [183.182.99.92]:57368: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)183.182.99.921655842T"  -5' ossec13001h@@Exim Auth failed2025-04-21 18:25:26 dovecot_login authenticator failed for ([113.192.69.10]) [113.192.69.10]:48790: 535 Incorrect authentication data (set_id=sales)113.192.69.101835841Q!  -3# ossec13001h;Exim Auth failed2025-04-21 18:03:05 dovecot_login authenticator failed for ([60.174.86.4]) [60.174.86.4]:45484: 535 Incorrect authentication data (set_id=purchase)60.174.86.41814991u  -y% ossec13001h:Exim Auth failed2025-04-21 18:02:36 dovecot_login authenticator failed for (144.121.245.65.lightower.net) [64.72.74.162]:46900: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)64.72.74.1626252001  -) ossec13001h:Exim Auth failed2025-04-21 18:02:28 dovecot_login authenticator failed for (abts-mp-dynamic-141.129.70.182.airtelbroadband.in) [182.70.129.141]:43847: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)182.70.129.1411269750x  -}) ossec13001h:Exim Auth failed2025-04-21 18:02:18 dovecot_login authenticator failed for ([102.215.188.37]) [102.215.188.37]:41380: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)102.215.188.37192950v  -y' ossec13001h:Exim Auth failed2025-04-21 18:01:49 dovecot_login authenticator failed for (134.56.58.169.hwccustomers.com) [134.56.58.169]:57942: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)134.56.58.1696252001i  -]) ossec13001h:Exim Auth failed2025-04-21 18:02:01 dovecot_login authenticator failed for syn-172-248-047-114.res.spectrum.com [172.248.47.114]:52754: 535 Incorrect authentication data (set_id=sales)172.248.47.1146252001Q  -1% ossec13001h9Exim Auth failed2025-04-21 17:57:07 dovecot_login authenticator failed for ([8.139.253.26]) [8.139.253.26]:12722: 535 Incorrect authentication data (set_id=sales)8.139.253.261814991   $ ? > jZpbD  -S' ossec13001hIExim Auth failed2025-04-22 13:18:58 dovecot_login authenticator failed for ([213.55.79.199]) [213.55.79.195]:60348: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)213.55.79.195337996C  -) ossec13001hIExim Auth failed2025-04-22 13:18:47 dovecot_login authenticator failed for (206.231.170.45.yesfibra.com.br) [45.170.231.206]:37052: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)45.170.231.2063469034TB  -5' ossec13001hHExim Auth failed2025-04-22 13:13:14 dovecot_login authenticator failed for ([101.168.26.97]) [101.168.26.97]:38732: 535 Incorrect authentication data (set_id=sales)101.168.26.972077456eA  -[' ossec13001hHExim Auth failed2025-04-22 13:13:01 dovecot_login authenticator failed for ([65.20.147.189]) [65.20.147.189]:53498: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)65.20.147.18999237%@  3Q' ossec11301hF=New FTP connection.Apr 22 13:03:16 vm1 pure-ftpd[2386034]: (?@13.89.125.231) [INFO] New connection from 13.89.125.23113.89.125.2316252001e?  -S+ ossec13001h@Exim Auth failed2025-04-22 12:37:08 dovecot_login authenticator failed for ([106.112.194.160]) [106.112.194.160]:47320: 535 Incorrect authentication data (set_id=vikas.khandelwal)106.112.194.1601814991>  - ) ossec13001h@Exim Auth failed2025-04-22 12:36:46 dovecot_login authenticator failed for 219-89-198-191.adsl.xtra.co.nz [219.89.198.191]:33900: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)219.89.198.1912186224`=  -O% ossec13001h>Exim Auth failed2025-04-22 12:30:32 dovecot_login authenticator failed for 111-70-38-53.emome-ip.hinet.net [111.70.38.53]:32770: 535 Incorrect authentication data (set_id=sales)111.70.38.531668284b<  -U# ossec13001h>Exim Auth failed2025-04-22 12:30:18 dovecot_login authenticator failed for ([61.37.150.35]) [61.37.150.6]:30251: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)61.37.150.61835841%;  3Q' ossec11301h7New FTP connection.Apr 22 12:01:43 vm1 pure-ftpd[2373362]: (?@91.238.181.92) [INFO] New connection from 91.238.181.9291.238.181.923017382O:  -1% ossec13001h6 Exim Auth failed2025-04-22 11:54:09 dovecot_login authenticator failed for ([65.20.150.36]) [65.20.150.36]:38205: 535 Incorrect authentication data (set_id=sales)65.20.150.3699237|9  -% ossec13001h5Exim Auth failed2025-04-22 11:53:54 dovecot_login authenticator failed for (177-37-167-4-tmp.static.brisanet.net.br) [177.37.167.4]:8744: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)177.37.167.43469034`8  -M' ossec13001h3Exim Auth failed2025-04-22 11:44:51 dovecot_login authenticator failed for a89-153-62-100.cpe.netcabo.pt [89.153.62.100]:58432: 535 Incorrect authentication data (set_id=sales)89.153.62.1002264397j7  -_) ossec13001h3Exim Auth failed2025-04-22 11:44:35 dovecot_login authenticator failed for ([14.139.107.146]) [14.139.107.146]:40436: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)14.139.107.1461269750\6  -C+ ossec13001h2HExim Auth failed2025-04-22 11:38:08 dovecot_login authenticator failed for ([178.135.121.123]) [178.135.121.123]:33453: 535 Incorrect authentication data (set_id=services)178.135.121.1232721035  --) ossec13001h2(Exim Auth failed2025-04-22 11:37:35 dovecot_login authenticator failed for (abts-north-static-059.221.160.122.airtelbroadband.in) [122.160.221.59]:52806: 535 Incorrect authentication data (set_id=services@heipowersystem.com)122.160.221.591269750q4  -o' ossec13001h/Exim Auth failed2025-04-22 11:27:59 dovecot_login authenticator failed for (186-201-10-10.customer.tdatabrasil.net.br) [177.8.167.241]:61925: 535 Incorrect authentication data (set_id=purchase)177.8.167.2413469034 l  2 L s  $KP]dls"  -s' ossec13001hAExim Auth failed2025-04-22 09:42:48 dovecot_login authenticator failed for ool-18bbfd43.static.optonline.net [24.187.253.67]:45486: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)24.187.253.676252001t!  -y' ossec13001h/Exim Auth failed2025-04-22 09:42:29 dovecot_login authenticator failed for ([65.20.205.197]) [65.20.205.197]:43883: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)65.20.205.19799237n  -g) ossec13001h(Exim Auth failed2025-04-22 09:38:07 dovecot_login authenticator failed for (107.770.gatewayfiber.net) [129.228.60.107]:37271: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)129.228.60.1076252001v  -y' ossec13001hExim Auth failed2025-04-22 09:37:48 dovecot_login authenticator failed for ([59.89.148.179]) [59.89.148.179]:56153: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)59.89.148.1791269750T  -7% ossec13001hExim Auth failed2025-04-22 09:32:39 dovecot_login authenticator failed for ([154.127.42.2]) [154.127.42.2]:45469: 535 Incorrect authentication data (set_id=services)154.127.42.22395170b  -Y# ossec13001hExim Auth failed2025-04-22 09:32:25 dovecot_login authenticator failed for ([65.20.171.8]) [65.20.171.8]:40240: 535 Incorrect authentication data (set_id=services@heipowersystem.com)65.20.171.899237[  -G% ossec13001h@Exim Auth failed2025-04-22 09:25:42 dovecot_login authenticator failed for ([196.0.41.134]) [196.0.41.134]:43330: 535 Incorrect authentication data (set_id=vikas.khandelwal)196.0.41.134226074u  -u) ossec13001h4Exim Auth failed2025-04-22 09:25:30 dovecot_login authenticator failed for ([103.234.100.36]) [103.234.100.36]:43305: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)103.234.100.361733045  W) ossec9708hKDovecot Aborted Login with empty userApr 22 09:13:04 vm1 dovecot[90419]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=87.236.176.240, lip=103.74.54.108, TLS, session=87.236.176.2402635167! G %1modsec77350309hWIM360 WAF: Hidden file accessIM360 WAF: Hidden file access||RSV:6.87||RS:0||T:APACHE||QS:||45.148.10.982750405vm1.technobases.inA [5%1modsec77318034hWIM360 WAF: Blocked access to git folderIM360 WAF: Blocked access to git folder||RSV:6.87||RS:0||T:APACHE||MV:/.git/config||45.148.10.982750405vm1.technobases.inT  -5' ossec13001hExim Auth failed2025-04-22 09:06:10 dovecot_login authenticator failed for ([46.21.240.186]) [46.21.240.186]:58104: 535 Incorrect authentication data (set_id=sales)46.21.240.1862017370a  -S# ossec13001hExim Auth failed2025-04-22 09:05:58 dovecot_login authenticator failed for ([59.1.240.96]) [59.1.240.96]:50616: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)59.1.240.961835841f  -W) ossec13001hyExim Auth failed2025-04-22 08:22:40 dovecot_login authenticator failed for ([114.202.80.152]) [114.202.80.152]:45247: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)114.202.80.1521835841|  -+ ossec13001hhExim Auth failed2025-04-22 08:22:22 dovecot_login authenticator failed for ([123.210.137.231]) [123.210.137.231]:32842: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)123.210.137.2312077456n  -e+ ossec13001hExim Auth failed2025-04-22 08:16:53 dovecot_login authenticator failed for (host103-171-169-246.renubroadband.com) [103.171.168.246]:40902: 535 Incorrect authentication data (set_id=sales)103.171.168.2461269750j  -_) ossec13001hExim Auth failed2025-04-22 08:16:29 dovecot_login authenticator failed for ([117.173.18.250]) [117.173.18.250]:56106: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)117.173.18.2501814991  > W _ z XsvM  -y' ossec13001hExim Auth failed2025-04-21 23:22:12 dovecot_login authenticator failed for ([58.253.194.29]) [58.253.194.29]:46894: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)58.253.194.291814991%L  3Q' ossec11301hNew FTP connection.Apr 21 23:00:38 vm1 pure-ftpd[2207276]: (?@87.236.176.78) [INFO] New connection from 87.236.176.7887.236.176.782635167wK SQ) ossec11000h~Login failed on the cpanel service.[2025-04-21 22:51:58 +0530] info [cpaneld] 171.79.178.126 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: root login is not permitted to cpaneld171.79.178.1261269750SJ  -5' ossec13001h}Exim Auth failed2025-04-21 22:48:41 dovecot_login authenticator failed for ([62.182.116.62]) [62.182.116.62]:52642: 535 Incorrect authentication data (set_id=sales)62.182.116.62732800`I  -Q# ossec13001h}Exim Auth failed2025-04-21 22:48:32 dovecot_login authenticator failed for ([27.71.26.64]) [27.71.26.64]:7672: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)27.71.26.641562822]H  ;5+ ossec13008h}Mail Recipient rejected2025-04-21 22:47:55 H=(mail.amplifypowerglobal.com) [165.154.228.180]:63501 F= rejected RCPT : Rejected relay attempt: '165.154.228.180' From: 'gjmatlikg@amplifypowerglobal.com' To: 'validxxx@gmailhotmail.com.br'165.154.228.1801643084fG  -W) ossec13001hz:Exim Auth failed2025-04-21 22:32:48 dovecot_login authenticator failed for ([112.161.26.125]) [112.161.26.125]:33122: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)112.161.26.1251835841F  -) ossec13001hz.Exim Auth failed2025-04-21 22:32:36 dovecot_login authenticator failed for 125-229-102-40.hinet-ip.hinet.net [125.229.102.40]:49348: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)125.229.102.401668284WE  -9) ossec13001hxExim Auth failed2025-04-21 22:27:22 dovecot_login authenticator failed for ([216.194.174.80]) [216.194.174.27]:22024: 535 Incorrect authentication data (set_id=sales)216.194.174.276252001gD  -[' ossec13001hxExim Auth failed2025-04-21 22:27:11 dovecot_login authenticator failed for ([58.240.26.106]) [58.240.26.106]:60001: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)58.240.26.1061814991`C  -O% ossec13001hv5Exim Auth failed2025-04-21 22:15:39 dovecot_login authenticator failed for ([50.99.36.130]) [50.99.36.130]:32996: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)50.99.36.1306251999sB  -u% ossec13001hvExim Auth failed2025-04-21 22:15:06 dovecot_login authenticator failed for ([58.18.89.146]) [58.18.89.146]:51795: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)58.18.89.1461814991bA  -S% ossec13001hq+Exim Auth failed2025-04-21 21:54:11 dovecot_login authenticator failed for (nyaystambh.com) [119.96.131.8]:51410: 535 Incorrect authentication data (set_id=service@nyaystambh.com)119.96.131.81814991S@  -5% ossec13001hqExim Auth failed2025-04-21 21:53:47 dovecot_login authenticator failed for (nyaystambh.com) [119.96.131.8]:47978: 535 Incorrect authentication data (set_id=nologin)119.96.131.81814991e?  -U+ ossec13001hp Exim Auth failed2025-04-21 21:49:23 dovecot_login authenticator failed for 3pc100-144.rconx.com [185.115.100.144]:52338: 535 Incorrect authentication data (set_id=vikas.khandelwal)185.115.100.144272103{>  -# ossec13001hpExim Auth failed2025-04-21 21:49:11 dovecot_login authenticator failed for 1-36-76-185.ptr.netvigator.com [1.36.76.185]:36378: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)1.36.76.1851819730 Y'(  *}#vek)jY =  -#) ossec13001hoExim Auth failed2025-04-21 21:49:08 dovecot_login authenticator failed for (customer-187-218-57-50.uninet-ide.com.mx) [149.19.169.152]:8439: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)149.19.169.1523996063:<  Ak) ossec11302hoFTP Authentication failed.Apr 21 21:44:57 vm1 pure-ftpd[2190711]: (?@152.32.252.233) [WARNING] Authentication failed for user [anonymous]152.32.252.2331819730); 3U) ossec11301hnNew FTP connection.Apr 21 21:44:49 vm1 pure-ftpd[2190692]: (?@152.32.252.233) [INFO] New connection from 152.32.252.233152.32.252.2331819730(:  3U) ossec11301hnNew FTP connection.Apr 21 21:44:48 vm1 pure-ftpd[2190690]: (?@152.32.252.233) [INFO] New connection from 152.32.252.233152.32.252.2331819730b9  -O) ossec13001hnExim Auth failed2025-04-21 21:41:03 dovecot_login authenticator failed for ([177.43.127.217]) [177.99.193.135]:40821: 535 Incorrect authentication data (set_id=vikas.khandelwal)177.99.193.1353469034u8  -u) ossec13001hn Exim Auth failed2025-04-21 21:40:49 dovecot_login authenticator failed for ([128.185.224.87]) [152.52.243.154]:44668: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)152.52.243.1541269750 7  [y% ossec12004hjsPossible Dovecot CVE-2019-11500 attemptApr 21 21:25:29 vm1 dovecot[90419]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.15.177.123, lip=103.74.54.108, session=<58ax5Usz9uoDD7F7>3.15.177.1236252001(6  3U) ossec11301hjNew FTP connection.Apr 21 21:23:58 vm1 pure-ftpd[2186497]: (?@161.35.206.250) [INFO] New connection from 161.35.206.250161.35.206.2502921044%5  3Q' ossec11301hjNew FTP connection.Apr 21 21:23:58 vm1 pure-ftpd[2186495]: (?@159.89.17.123) [INFO] New connection from 159.89.17.123159.89.17.1232921044+4  3Y+ ossec11301hdNew FTP connection.Apr 21 21:00:37 vm1 pure-ftpd[2181480]: (?@184.105.247.194) [INFO] New connection from 184.105.247.194184.105.247.1946252001(3  3U) ossec11301hcNew FTP connection.Apr 21 20:56:23 vm1 pure-ftpd[2180508]: (?@205.210.31.233) [INFO] New connection from 205.210.31.233205.210.31.2336252001S2  -7% ossec13001h\Exim Auth failed2025-04-21 20:26:01 dovecot_login authenticator failed for ([91.222.80.75]) [91.222.80.75]:52582: 535 Incorrect authentication data (set_id=services)91.222.80.75690791j1  -a' ossec13001h\wExim Auth failed2025-04-21 20:25:51 dovecot_login authenticator failed for ([106.86.209.86]) [106.86.209.86]:56864: 535 Incorrect authentication data (set_id=services@heipowersystem.com)106.86.209.861814991g0  -[' ossec13001hZExim Auth failed2025-04-21 20:18:33 dovecot_login authenticator failed for ([96.45.119.159]) [96.45.119.152]:52550: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)96.45.119.1526252001Z/  -=+ ossec13001hZExim Auth failed2025-04-21 20:18:49 dovecot_login authenticator failed for ([103.219.154.156]) [103.219.154.156]:44430: 535 Incorrect authentication data (set_id=sales)103.219.154.1562750405@. [1'1modsec77318034hMIM360 WAF: Blocked access to git folderIM360 WAF: Blocked access to git folder||RSV:6.87||RS:0||T:APACHE||MV:/.git/head||34.162.53.1596252001vm1.technobases.in"- G '1modsec77350309hMIM360 WAF: Hidden file accessIM360 WAF: Hidden file access||RSV:6.87||RS:0||T:APACHE||QS:||34.162.53.1596252001vm1.technobases.inz,  -' ossec13001hMgExim Auth failed2025-04-21 19:21:34 dovecot_login authenticator failed for h-62-63-230-115.a980.priv.bahnhof.se [62.63.230.115]:60798: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)62.63.230.1152661886T+  -5' ossec13001hMuExim Auth failed2025-04-21 19:21:49 dovecot_login authenticator failed for ([95.165.68.172]) [95.165.68.172]:57976: 535 Incorrect authentication data (set_id=sales)95.165.68.1722017370 M!B c +-5Mc;  -U% ossec13001heExim Auth failed2025-04-22 23:31:09 dovecot_login authenticator failed for ([61.72.101.1]) [61.72.58.242]:35684: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)61.72.58.2421835841s:  -o+ ossec13001h<Exim Auth failed2025-04-22 23:04:50 dovecot_login authenticator failed for (nsg-corporate-145.227.187.122.airtel.in) [122.187.227.145]:58117: 535 Incorrect authentication data (set_id=purchase)122.187.227.1451269750y9  -' ossec13001h.Exim Auth failed2025-04-22 23:04:37 dovecot_login authenticator failed for 24-119-144-86.cpe.sparklight.net [24.119.144.86]:51314: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)24.119.144.866252001g8  -[' ossec13001hΊExim Auth failed2025-04-22 22:44:50 dovecot_login authenticator failed for syn-024-043-131-106.biz.spectrum.com [24.43.131.106]:60563: 535 Incorrect authentication data (set_id=sales)24.43.131.1066252001j7  -_) ossec13001h~Exim Auth failed2025-04-22 22:44:37 dovecot_login authenticator failed for ([183.220.247.91]) [183.220.247.91]:34634: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)183.220.247.911814991i6  -[+ ossec13001hExim Auth failed2025-04-22 22:42:05 dovecot_login authenticator failed for ([121.190.211.215]) [121.190.211.215]:58416: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)121.190.211.2151835841|5  -+ ossec13001hExim Auth failed2025-04-22 22:41:52 dovecot_login authenticator failed for ([117.176.204.214]) [117.176.204.214]:49262: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)117.176.204.2141814991Z4  -?) ossec13001h͚Exim Auth failed2025-04-22 22:40:49 dovecot_login authenticator failed for ([111.17.213.162]) [111.17.213.162]:58469: 535 Incorrect authentication data (set_id=services)111.17.213.1621814991d3  -Y# ossec13001h͈Exim Auth failed2025-04-22 22:40:30 dovecot_login authenticator failed for ([60.212.3.42]) [60.212.3.42]:56372: 535 Incorrect authentication data (set_id=services@heipowersystem.com)60.212.3.421814991x2  -y+ ossec13001h̸Exim Auth failed2025-04-22 22:37:04 dovecot_login authenticator failed for (173-165-182-203-atlanta.hfc.comcastbusiness.net) [173.165.182.203]:35012: 535 Incorrect authentication data (set_id=sales)173.165.182.2036252001m1  -c+ ossec13001h̰Exim Auth failed2025-04-22 22:36:54 dovecot_login authenticator failed for ([119.207.156.209]) [119.207.156.209]:43486: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)119.207.156.2091835841\0  -G% ossec13001hƬExim Auth failed2025-04-22 22:11:15 dovecot_login authenticator failed for ([36.26.63.158]) [36.26.63.158]:47011: 535 Incorrect authentication data (set_id=vikas.khandelwal)36.26.63.1581814991r/  -q' ossec13001hƞExim Auth failed2025-04-22 22:11:02 dovecot_login authenticator failed for ([39.125.67.109]) [39.125.67.109]:49804: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)39.125.67.1091835841Z.  -C% ossec13001hĜExim Auth failed2025-04-22 22:02:26 dovecot_plain authenticator failed for (SrvWeb2019) [176.31.46.58]:62396: 535 Incorrect authentication data (set_id=info@rokamauka.com)176.31.46.583017382Z-  -C% ossec13001h[Exim Auth failed2025-04-22 22:01:23 dovecot_plain authenticator failed for (SrvWeb2019) [176.31.46.58]:59725: 535 Incorrect authentication data (set_id=info@rokamauka.com)176.31.46.583017382Z,  -C% ossec13001hExim Auth failed2025-04-22 22:00:21 dovecot_plain authenticator failed for (SrvWeb2019) [176.31.46.58]:54182: 535 Incorrect authentication data (set_id=info@rokamauka.com)176.31.46.583017382Z+  -C% ossec13001hExim Auth failed2025-04-22 21:59:21 dovecot_plain authenticator failed for (SrvWeb2019) [176.31.46.58]:56057: 535 Incorrect authentication data (set_id=info@rokamauka.com)176.31.46.583017382 ) 7 [ l   8DXq{Z*  -C% ossec13001hçExim Auth failed2025-04-22 21:58:22 dovecot_plain authenticator failed for (SrvWeb2019) [176.31.46.58]:58022: 535 Incorrect authentication data (set_id=info@rokamauka.com)176.31.46.583017382q)  -q% ossec13001hExim Auth failed2025-04-22 21:37:56 dovecot_login authenticator failed for vps-79f20bfc.vps.ovh.net (ip193.ip-87-98-249.eu) [51.75.24.107]:15505: 535 Incorrect authentication data (set_id=sales)51.75.24.1073017382b(  -W% ossec13001hExim Auth failed2025-04-22 21:37:41 dovecot_login authenticator failed for ([65.20.155.91]) [65.20.155.91]:36632: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)65.20.155.9199237g'  -[' ossec13001hExim Auth failed2025-04-22 21:37:14 dovecot_login authenticator failed for ([101.168.17.95]) [101.168.17.95]:36596: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)101.168.17.952077456o&  -g+ ossec13001hExim Auth failed2025-04-22 21:33:37 dovecot_login authenticator failed for (170-239-201-226.nortetelecom.net.br) [170.239.201.226]:34175: 535 Incorrect authentication data (set_id=services)170.239.201.2263469034c%  -U' ossec13001hExim Auth failed2025-04-22 21:33:08 dovecot_login authenticator failed for rplus.dp.ua [77.109.33.120]:42400: 535 Incorrect authentication data (set_id=services@heipowersystem.com)77.109.33.120690791Z$  -=+ ossec13001h.Exim Auth failed2025-04-22 21:26:28 dovecot_login authenticator failed for ([165.154.202.101]) [165.154.202.101]:18394: 535 Incorrect authentication data (set_id=sales)165.154.202.1016252001#  -' ossec13001hExim Auth failed2025-04-22 21:25:50 dovecot_login authenticator failed for p5df05771.dip0.t-ipconnect.de ([89.107.163.13]) [93.240.87.113]:31313: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)93.240.87.1132921044f"  -W) ossec13001hExim Auth failed2025-04-22 21:08:23 dovecot_login authenticator failed for 110-25-105-235.adsl.fetnet.net [110.25.105.235]:35395: 535 Incorrect authentication data (set_id=services)110.25.105.2351668284m!  -e) ossec13001hExim Auth failed2025-04-22 21:08:11 dovecot_login authenticator failed for ([103.99.184.170]) [103.99.184.170]:12772: 535 Incorrect authentication data (set_id=services@heipowersystem.com)103.99.184.1701269750(  3U) ossec11301hFNew FTP connection.Apr 22 20:57:00 vm1 pure-ftpd[2488653]: (?@205.210.31.183) [INFO] New connection from 205.210.31.183205.210.31.1836252001T  -3) ossec13001hExim Auth failed2025-04-22 20:30:19 dovecot_login authenticator failed for (hn.kd.ny.adsl) [219.157.124.84]:33996: 535 Incorrect authentication data (set_id=sales)219.157.124.841814991j  -_) ossec13001hExim Auth failed2025-04-22 20:30:09 dovecot_login authenticator failed for ([220.182.17.122]) [220.182.17.122]:38758: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)220.182.17.1221814991W  -9) ossec13001hExim Auth failed2025-04-22 20:29:25 dovecot_login authenticator failed for ([222.87.205.105]) [222.87.205.105]:52618: 535 Incorrect authentication data (set_id=sales)222.87.205.1051814991m  -c+ ossec13001hExim Auth failed2025-04-22 20:28:58 dovecot_login authenticator failed for ([202.138.229.190]) [202.138.229.190]:52545: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)202.138.229.1901643084`  -M' ossec13001hExim Auth failed2025-04-22 20:25:31 dovecot_login authenticator failed for n1164940138.netvigator.com [116.49.40.138]:39955: 535 Incorrect authentication data (set_id=services)116.49.40.1381819730m  -e) ossec13001hExim Auth failed2025-04-22 20:25:17 dovecot_login authenticator failed for ([180.137.151.93]) [180.137.151.93]:39398: 535 Incorrect authentication data (set_id=services@heipowersystem.com)180.137.151.931814991 q @ P c_y^qx  3I# ossec11301hNew FTP connection.Apr 22 17:58:55 vm1 pure-ftpd[2450932]: (?@3.15.237.55) [INFO] New connection from 3.15.237.553.15.237.556252001w  3I# ossec11301hNew FTP connection.Apr 22 17:55:48 vm1 pure-ftpd[2450506]: (?@3.15.237.55) [INFO] New connection from 3.15.237.553.15.237.556252001 v 3I# ossec11301h8New FTP connection.Apr 22 17:53:19 vm1 pure-ftpd[2449881]: (?@3.15.237.55) [INFO] New connection from 3.15.237.553.15.237.556252001+u  EM' ossec5715hSSHD authentication success.Apr 22 17:48:24 vm1 sshd[2448747]: Accepted password for root from 103.190.54.18 port 62547 ssh2103.190.54.181269750)t CI' ossec5716hSSHD authentication failed.Apr 22 17:48:06 vm1 sshd[2448747]: Failed password for root from 103.190.54.18 port 62547 ssh2103.190.54.181269750^s  E3' ossec2501hUser authentication failure.Apr 22 17:48:05 vm1 sshd[2448747]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.190.54.18 user=root103.190.54.181269750nr  -m# ossec13001h Exim Auth failed2025-04-22 17:44:22 dovecot_login authenticator failed for ([45.168.59.130]) [45.168.56.1]:38457: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)45.168.56.13469034bq  -O) ossec13001h6Exim Auth failed2025-04-22 17:44:45 dovecot_login authenticator failed for ([218.202.143.68]) [218.202.143.68]:55863: 535 Incorrect authentication data (set_id=vikas.khandelwal)218.202.143.681814991ap  -O) ossec13001hEExim Auth failed2025-04-22 17:36:29 dovecot_login authenticator failed for ([46.210.107.161]) [46.210.107.161]:52853: 535 Incorrect authentication data (set_id=vikas.khandelwal)46.210.107.161294640o  -+ ossec13001h;Exim Auth failed2025-04-22 17:36:18 dovecot_login authenticator failed for (selinc.static.gvt.net.br) [187.115.164.107]:39367: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)187.115.164.1073469034+n  EM' ossec5715hSSHD authentication success.Apr 22 17:08:22 vm1 sshd[2439921]: Accepted password for root from 103.190.54.18 port 62500 ssh2103.190.54.181269750dm  -W% ossec13001h~Exim Auth failed2025-04-22 17:04:04 dovecot_login authenticator failed for ([14.99.61.248]) [14.99.61.248]:35432: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)14.99.61.2481269750(l  3U) ossec11301h|New FTP connection.Apr 22 16:55:52 vm1 pure-ftpd[2437217]: (?@173.239.205.25) [INFO] New connection from 173.239.205.25173.239.205.253595528"k  3M% ossec11301h|New FTP connection.Apr 22 16:54:59 vm1 pure-ftpd[2436934]: (?@37.19.223.24) [INFO] New connection from 37.19.223.2437.19.223.242782113kj  S;) ossec11000h{&Login failed on the cpanel service.[2025-04-22 16:49:01 +0530] info [whostmgrd] 106.206.168.69 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect106.206.168.691269750(i  3U) ossec11301hyNew FTP connection.Apr 22 16:42:21 vm1 pure-ftpd[2433135]: (?@106.206.168.69) [INFO] New connection from 106.206.168.69106.206.168.691269750%h  C?) ossec11309hyFTP Authentication success.Apr 22 16:42:21 vm1 pure-ftpd[2433135]: (?@106.206.168.69) [INFO] techno is now logged in106.206.168.691269750g  5#) ossec11011hyWHM SSO login failed[2025-04-22 16:42:12 +0530] info [whostmgrd] 106.206.168.69 PURGE root:cX0zWtAqE2aja0y4 badpass [cookie ip check: IP address has changed: IP Address [171.79.178.0] != Current IP Address [106.206.168.69]]106.206.168.691269750Of  U) ossec11001hyDeferred login on the cpanel service[2025-04-22 16:42:12 +0530] info [whostmgrd] 106.206.168.69 - root "GET /cpsess6833416728/scripts4/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: cookie ip check: IP address has changed: IP Address [171.79.178.0] != Current IP Address [106.206.168.69]106.206.168.691269750 }pcVI</"obUH;.!xk^QD7*tgZM@3&  |~qdWJ=0# zm`SF9, v i \ O B 5 (     r e X K > 1 $  { n a T G : -   w j ] P C 6 )    s f Y L ? 2 %  1861060O 1861060O 18610605 18610605 18610605 18610605 18610605 18610605m 18610605f 18610605C 18610605( 18610605 18610604 18610604Q 18610604K 18610604/ 18610604 18610603L 18610602 1861060O+ 1861060O 1861060M 1861060M 1861060F 1861060F 1861060F~ 1861060F} 1861060F| 1861060E 1861060D 1861060D 1861060D 1861060D 1861060C 1861060Ce 1861060Cd 1861060Cc 1861060B 1861060A 1861060A 1861060@{ 1861060@i 1861060? 1861060?B 1861060?< 1861060> 1861060>5 1861060>/ 1861060> 1861060= 1861060= 1861060= 1861060< 1861060< 1861060< 1861060< 1861060; 1861060; 1861060: 1861060:X 18610609 18610609x 18610608] 18610608Q 186106089 186106085 18610607 18610607P 18610607 18610606 18610606Q 18610606A 18610606 1861060MS 1861060L 1861060K 1861060Ka 1861060KP 1861060K! 1861060I 1861060I 1861060I 1861060I 1861060I 1861060Io 1880251" 1880251"k 1880251"N 1880251" 1880251! 1880251! 1880251! 1880251! 1880251! 1880251! 1880251 1880251 { 1880251 l 1880251  1880251  1880251 1880251 1880251 1880251( 1880251 1880251D 1880251 1880251X 1880251O 1880251= 1880251 1880251 1880251 1880251 1880251 1880251 1880251 1880251 1880251 1880251 1880251s 1880251 1880251 1880251 1880251 1880251H 1880251 1880251 1880251 1880251 1880251 1880251 1880251 1880251 1880251W 1880251A 1880251 1880251 1880251i 1880251S 18802511 1880251 1880251 1880251 1880251 1880251 1880251 1880251U 1880251T 1880251D 1880251 1880251 1880251f 1880251] 1880251Y 1880251O 1880251. 1880251 1880251 1880251 1880251 1880251 18802519 1880251 1880251 1880251 1880251 1880251 1880251 1880251p 1880251 1880251 1880251 1880251} 1880251y 1880251c 1880251Q 1880251 1880251 1880251 1880251 1880251 1880251 1880251 1880251n 1880251 1880251 1880251 1880251 1880251: 1880251% 1880251 1880251 1880251 1880251 1880251 1880251 1880251 J 1880251 ) 1880251 s 1880251 U 1880251 ; 1880251 5 1880251  1880251 1880251 1880251 G 1880251 : 1880251 0 1880251 Q 1880251 P 1880251 6 1880251. 18802518 1880251" 1880251> 1861060IU 1861060H 1861060G` 1861060F 1861060F WMs ?b +9W]v  -I' ossec13001hfExim Auth failed2025-04-23 09:34:59 dovecot_login authenticator failed for 126-203-29-85.dyn.estpak.ee [85.29.203.126]:44816: 535 Incorrect authentication data (set_id=sales)85.29.203.126453733mu  -e) ossec13001hfExim Auth failed2025-04-23 09:34:55 dovecot_login authenticator failed for ([220.178.246.43]) [220.178.246.43]:48882: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)220.178.246.431814991ct  -U' ossec13001hfExim Auth failed2025-04-23 09:34:41 dovecot_login authenticator failed for 9497.telnet.bg [87.254.165.99]:56838: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)87.254.165.99732800ts  -s+ ossec13001hfExim Auth failed2025-04-23 09:33:19 dovecot_login authenticator failed for (151.237.115.208.pronet.bg) [151.237.115.208]:39361: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)151.237.115.208732800_r  -M% ossec13001hfExim Auth failed2025-04-23 09:33:28 dovecot_login authenticator failed for (144.121.245.65.lightower.net) [64.72.74.162]:44278: 535 Incorrect authentication data (set_id=sales)64.72.74.1626252001_q  -M' ossec13001hdExim Auth failed2025-04-23 09:26:45 dovecot_login authenticator failed for ([196.191.212.226]) [213.55.85.202]:4214: 535 Incorrect authentication data (set_id=vikas.khandelwal)213.55.85.202337996p  - ) ossec13001hdExim Auth failed2025-04-23 09:26:30 dovecot_login authenticator failed for n220246200078.netvigator.com [220.246.200.78]:35098: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)220.246.200.781819730,o a1' ossec5710h`kAttempt to login using a non-existent userApr 23 09:07:14 vm1 sshd[2647051]: Invalid user test from 164.68.114.38 port 47356164.68.114.383017382Tn E' ossec2501h`kUser authentication failure.Apr 23 09:07:14 vm1 sshd[2647051]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=164.68.114.38164.68.114.383017382Xm a ' ossec6003h`kImunify PAM. The IP has been locked by RBLApr 23 09:07:14 vm1 sshd[2647051]: pam_imunify(sshd:auth): [IM360_RBL] The IP 164.68.114.38 has been locked due to Imunify RBL164.68.114.383017382(l  3U) ossec11301h\New FTP connection.Apr 23 08:52:28 vm1 pure-ftpd[2643876]: (?@198.235.24.128) [INFO] New connection from 198.235.24.128198.235.24.1286252001Zk  -?) ossec13001h\Exim Auth failed2025-04-23 08:52:21 dovecot_login authenticator failed for ([221.199.172.66]) [221.199.172.66]:50144: 535 Incorrect authentication data (set_id=purchase)221.199.172.661814991mj  -e) ossec13001h\Exim Auth failed2025-04-23 08:52:09 dovecot_login authenticator failed for ([190.117.96.174]) [190.117.96.174]:53214: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)190.117.96.1743932488di  -W% ossec13001h\<Exim Auth failed2025-04-23 08:49:24 dovecot_login authenticator failed for ([211.196.31.2]) [211.196.31.2]:59844: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)211.196.31.21835841jh  -a' ossec13001h\PExim Auth failed2025-04-23 08:49:43 dovecot_login authenticator failed for broadband-95-84-186-218.ip.moscow.rt.ru [95.84.186.218]:55264: 535 Incorrect authentication data (set_id=sales)95.84.186.2182017370Yg  a ) ossec6003h\JImunify PAM. The IP has been locked by RBLApr 23 08:49:37 vm1 sshd[2643109]: pam_imunify(sshd:auth): [IM360_RBL] The IP 91.134.218.239 has been locked due to Imunify RBL91.134.218.2393017382Uf  E) ossec2501h\JUser authentication failure.Apr 23 08:49:37 vm1 sshd[2643109]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.134.218.23991.134.218.2393017382.e a3) ossec5710h\JAttempt to login using a non-existent userApr 23 08:49:37 vm1 sshd[2643109]: Invalid user user from 91.134.218.239 port 4580391.134.218.2393017382   ? V )00>6"  Ag% ossec11302h0oFTP Authentication failed.Apr 23 05:42:30 vm1 pure-ftpd[2604263]: (?@34.22.198.16) [WARNING] Authentication failed for user [anonymous]34.22.198.162802361#! 3M% ossec11301h0iNew FTP connection.Apr 23 05:42:24 vm1 pure-ftpd[2604261]: (?@34.22.198.16) [INFO] New connection from 34.22.198.1634.22.198.162802361m  -e) ossec13001h.Exim Auth failed2025-04-23 05:35:48 dovecot_login authenticator failed for ([222.75.179.106]) [222.75.179.106]:51354: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)222.75.179.1061814991{  -# ossec13001h-NExim Auth failed2025-04-23 05:29:09 dovecot_login authenticator failed for 50.24.14.46.static.wline.lns.sme.cust.swisscom.ch [46.14.24.50]:52498: 535 Incorrect authentication data (set_id=vikas.khandelwal)46.14.24.502658434t  -u' ossec13001h-DExim Auth failed2025-04-23 05:28:59 dovecot_login authenticator failed for ([128.185.241.137]) [61.95.199.130]:40130: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)61.95.199.1301269750o  -m% ossec13001h-6Exim Auth failed2025-04-23 05:28:46 dovecot_login authenticator failed for ([1.119.161.42]) [1.119.161.42]:56040: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)1.119.161.421814991\  -A+ ossec13001h,Exim Auth failed2025-04-23 05:27:36 dovecot_login authenticator failed for (vcs-app.naukanet.ru) [185.145.125.212]:57118: 535 Incorrect authentication data (set_id=sales)185.145.125.2122017370m  -k# ossec13001h,Exim Auth failed2025-04-23 05:27:22 dovecot_login authenticator failed for 100.7.61.94.rev.vodafone.pt [94.61.7.100]:35048: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)94.61.7.1002264397x  -}' ossec13001h+Exim Auth failed2025-04-23 05:23:33 dovecot_login authenticator failed for lpointe-a-pitre-656-1-6-174.w81-248.abo.wanadoo.fr [81.248.16.174]:12848: 535 Incorrect authentication data (set_id=services)81.248.16.1743579143  -+ ossec13001h+Exim Auth failed2025-04-23 05:23:19 dovecot_login authenticator failed for (189.218.168.228-clientes-izzi.mx) [189.218.168.228]:55639: 535 Incorrect authentication data (set_id=services@heipowersystem.com)189.218.168.22839960637  Ai' ossec11302h*FTP Authentication failed.Apr 23 05:17:39 vm1 pure-ftpd[2599386]: (?@83.222.190.74) [WARNING] Authentication failed for user [anonymous]83.222.190.74798549$  3Q' ossec11301h*New FTP connection.Apr 23 05:17:33 vm1 pure-ftpd[2599386]: (?@83.222.190.74) [INFO] New connection from 83.222.190.7483.222.190.74798549d  -W% ossec13001h)Exim Auth failed2025-04-23 05:13:19 dovecot_login authenticator failed for ([64.72.74.162]) [64.72.74.162]:54635: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)64.72.74.1626252001T  -5' ossec13001h)Exim Auth failed2025-04-23 05:13:40 dovecot_login authenticator failed for ([183.105.3.221]) [183.105.3.221]:53698: 535 Incorrect authentication data (set_id=sales)183.105.3.2211835841l  -e' ossec13001h(CExim Auth failed2025-04-23 05:07:39 dovecot_login authenticator failed for (cyrela.static.gvt.net.br) [179.185.18.67]:56991: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)179.185.18.673469034f  -W) ossec13001h(=Exim Auth failed2025-04-23 05:07:33 dovecot_login authenticator failed for ([182.106.219.94]) [182.106.219.94]:42484: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)182.106.219.941814991  -' ossec13001h(Exim Auth failed2025-04-23 05:06:57 dovecot_login authenticator failed for s01060030f43b0098.vn.shawcable.net [70.79.120.248]:51197: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)70.79.120.2486251999 % 0 T @ jsu  -u% ossec13001hExim Auth failed2025-04-21 14:00:08 dovecot_login authenticator failed for ([1.212.225.99]) [1.212.225.99]:46296: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)1.212.225.991835841`t  -M' ossec13001hExim Auth failed2025-04-21 13:55:15 dovecot_login authenticator failed for a89-153-62-100.cpe.netcabo.pt [89.153.62.100]:50184: 535 Incorrect authentication data (set_id=sales)89.153.62.1002264397js  -_) ossec13001hExim Auth failed2025-04-21 13:55:06 dovecot_login authenticator failed for ([203.101.181.17]) [203.101.181.17]:36010: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)203.101.181.171168579r  ;) ossec13008hMail Recipient rejected2025-04-21 13:42:44 H=(localhost.localdomain) [78.153.140.207]:33926 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no F= rejected RCPT : Sender verify failed78.153.140.2072635167uq  -s+ ossec13001hExim Auth failed2025-04-21 13:29:16 dovecot_login authenticator failed for (200-217-53-25.host.telemar.net.br) [200.216.168.226]:56521: 535 Incorrect authentication data (set_id=vikas.khandelwal)200.216.168.2263469034up  -u) ossec13001hExim Auth failed2025-04-21 13:29:04 dovecot_login authenticator failed for ([221.235.182.76]) [61.184.128.210]:34790: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)61.184.128.2101814991?o  gQ' ossec11307h{Multiple connection attempts from same sourceApr 21 13:10:41 vm1 pure-ftpd[2079516]: (?@159.65.116.75) [INFO] New connection from 159.65.116.75159.65.116.752921044&n 3Q' ossec11301ho New FTP connection.Apr 21 13:10:30 vm1 pure-ftpd[2079488]: (?@159.65.116.75) [INFO] New connection from 159.65.116.75159.65.116.752921044mm  -e) ossec13001hExim Auth failed2025-04-21 13:07:54 dovecot_login authenticator failed for ([110.172.159.18]) [110.172.159.18]:36802: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)110.172.159.181269750]l  -C+ ossec13001hExim Auth failed2025-04-21 13:08:10 dovecot_login authenticator failed for ([154.144.255.209]) [154.144.255.209]:59310: 535 Incorrect authentication data (set_id=purchase)154.144.255.2092542007%k  3Q' ossec11301h-New FTP connection.Apr 21 13:05:07 vm1 pure-ftpd[2077875]: (?@139.59.157.25) [INFO] New connection from 139.59.157.25139.59.157.252921044(j  3U) ossec11301h-New FTP connection.Apr 21 13:05:07 vm1 pure-ftpd[2077877]: (?@104.248.135.30) [INFO] New connection from 104.248.135.30104.248.135.302921044i  ;) ossec13008hMail Recipient rejected2025-04-21 12:21:20 H=(localhost.localdomain) [78.153.140.207]:56160 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no F= rejected RCPT : Sender verify failed78.153.140.2072635167Wh  -;' ossec13001hExim Auth failed2025-04-21 12:12:19 dovecot_login authenticator failed for ([222.117.0.253]) [222.117.0.253]:58154: 535 Incorrect authentication data (set_id=purchase)222.117.0.2531835841pg  -i+ ossec13001hExim Auth failed2025-04-21 12:11:57 dovecot_login authenticator failed for ([213.195.121.154]) [213.195.121.154]:44158: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)213.195.121.1542510769df  -S) ossec13001hExim Auth failed2025-04-21 11:25:15 dovecot_login authenticator failed for (91-220-216-178.omsk.mts.ru) [178.216.220.91]:56452: 535 Incorrect authentication data (set_id=services)178.216.220.912017370me  -e) ossec13001hݱExim Auth failed2025-04-21 11:24:55 dovecot_login authenticator failed for ([199.73.104.131]) [199.73.104.131]:40861: 535 Incorrect authentication data (set_id=services@heipowersystem.com)199.73.104.1316252001 |'  #  0 ?cx{!05Th|g  -]% ossec13001hExim Auth failed2025-04-22 20:04:58 dovecot_login authenticator failed for ([60.174.35.18]) [60.174.35.18]:54332: 535 Incorrect authentication data (set_id=services@heipowersystem.com)60.174.35.181814991g  -]% ossec13001hExim Auth failed2025-04-22 20:04:47 dovecot_login authenticator failed for ([110.35.63.27]) [110.35.63.27]:53922: 535 Incorrect authentication data (set_id=services@heipowersystem.com)110.35.63.271835841\  -C+ ossec13001h Exim Auth failed2025-04-22 20:05:12 dovecot_login authenticator failed for ([178.250.191.189]) [178.250.191.189]:58756: 535 Incorrect authentication data (set_id=services)178.250.191.189458258v  -y' ossec13001htExim Auth failed2025-04-22 19:58:04 dovecot_login authenticator failed for ([116.132.43.94]) [116.132.43.94]:57960: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)116.132.43.941814991l  -i# ossec13001hExim Auth failed2025-04-22 19:58:15 dovecot_login authenticator failed for 2.135.31.74.dynamic.telecom.kz [2.135.31.74]:33512: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)2.135.31.741522867U  ;') ossec13008hMail Recipient rejected2025-04-22 19:54:34 H=(mail.s2seducationtrust.com) [165.154.213.26]:58770 F= rejected RCPT : Rejected relay attempt: '165.154.213.26' From: 'wwoqzpyx@s2seducationtrust.com' To: 'validxxx@gmailhotmail.com.br'165.154.213.263469034x  -{) ossec13001hExim Auth failed2025-04-22 19:52:07 dovecot_login authenticator failed for (132.251.223.60.adsl-pool.sx.cn) [60.223.251.132]:39901: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)60.223.251.1321814991f  -Y' ossec13001hExim Auth failed2025-04-22 19:52:18 dovecot_login authenticator failed for 78-73-202-153-no2665.tbcn.telia.com [78.73.202.153]:59588: 535 Incorrect authentication data (set_id=sales)78.73.202.1532661886W  -9) ossec13001hExim Auth failed2025-04-22 19:21:04 dovecot_login authenticator failed for ([220.172.203.43]) [220.172.203.43]:54304: 535 Incorrect authentication data (set_id=sales)220.172.203.431814991l  -c+ ossec13001hExim Auth failed2025-04-22 19:20:43 dovecot_login authenticator failed for ([196.189.124.229]) [196.189.124.229]:51648: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)196.189.124.229337996h  -Y+ ossec13001hExim Auth failed2025-04-22 19:15:42 dovecot_login authenticator failed for ([111.206.233.34]) [123.118.101.233]:33923: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)123.118.101.2331814991  - ) ossec13001hyExim Auth failed2025-04-22 19:15:28 dovecot_login authenticator failed for (static.vnpt-hanoi.com.vn) [222.252.16.237]:59023: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)222.252.16.2371562822_  -K' ossec13001hExim Auth failed2025-04-22 19:00:15 dovecot_login authenticator failed for ([116.237.85.95]) [223.166.75.68]:62962: 535 Incorrect authentication data (set_id=vikas.khandelwal)223.166.75.681814991o  -m% ossec13001hExim Auth failed2025-04-22 19:00:04 dovecot_login authenticator failed for ([79.105.224.8]) [79.105.224.8]:51270: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)79.105.224.82017370'  w; ossec6070hAttempt to upload malware through cPanel file managerApr 22 18:31:16 vm1.technobases.in cpanel_fileman_hook[2458462]: 0 BAILOUT malware detected when upload 'sainikschoolcoachinginjaipur.zip' in /home/techno/public_html/sainikschoolcoachinginjaipur.com for user technoT  -5' ossec13001hExim Auth failed2025-04-22 18:28:59 dovecot_login authenticator failed for ([103.134.208.1]) [103.134.208.6]:50665: 535 Incorrect authentication data (set_id=sales)103.134.208.61210997 \) 0 5 ( . ' .6PK\je  -a' ossec13001hsExim Auth failed2025-04-22 16:17:12 dovecot_login authenticator failed for syn-071-012-241-225.res.spectrum.com [71.12.241.225]:48960: 535 Incorrect authentication data (set_id=purchase)71.12.241.2256252001d  - ) ossec13001hsExim Auth failed2025-04-22 16:16:54 dovecot_login authenticator failed for 123-193-152-64.dynamic.kbronet.com.tw [123.193.152.64]:57828: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)123.193.152.641668284ac  -O' ossec13001hqExim Auth failed2025-04-22 16:09:14 dovecot_login authenticator failed for p7001160-ipoefx.ipoe.ocn.ne.jp [118.3.227.159]:58356: 535 Incorrect authentication data (set_id=sales)118.3.227.1591861060sb  -s' ossec13001hqExim Auth failed2025-04-22 16:09:04 dovecot_login authenticator failed for 54.126.103.87.rev.vodafone.pt [87.103.126.54]:18644: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)87.103.126.542264397Za  -?) ossec13001hp[Exim Auth failed2025-04-22 16:02:58 dovecot_login authenticator failed for ([137.131.41.235]) [137.131.41.235]:55426: 535 Incorrect authentication data (set_id=services)137.131.41.2356252001`  -+ ossec13001hpQExim Auth failed2025-04-22 16:02:48 dovecot_login authenticator failed for 178.183.110.215.mobile.static.t-mobile.pl [178.183.110.215]:55830: 535 Incorrect authentication data (set_id=services@heipowersystem.com)178.183.110.215798544Z_  -=+ ossec13001hnExim Auth failed2025-04-22 15:56:20 dovecot_login authenticator failed for ([191.241.247.150]) [191.241.247.150]:51450: 535 Incorrect authentication data (set_id=sales)191.241.247.1503469034m^  -c+ ossec13001hnExim Auth failed2025-04-22 15:56:07 dovecot_login authenticator failed for ([182.224.231.102]) [182.224.231.102]:36450: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)182.224.231.1021835841:]  ;o+ ossec13008hiMail Recipient rejected2025-04-22 15:35:17 H=(mail.hsnews.in) [165.154.228.180]:56746 F= rejected RCPT : Rejected relay attempt: '165.154.228.180' From: 'tjexvvtackd@hsnews.in' To: 'validxxx@gmailhotmail.com.br'165.154.228.1801643084\  -' ossec13001hfExim Auth failed2025-04-22 15:22:22 dovecot_login authenticator failed for (dsl-kk-static-130.199.95.61.airtelbroadband.in) [61.95.199.130]:38044: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)61.95.199.1301269750u[  -y' ossec13001hfExim Auth failed2025-04-22 15:22:07 dovecot_login authenticator failed for ([87.200.88.209]) [87.200.88.209]:49468: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)87.200.88.209290557Z  -+ ossec13001hdfExim Auth failed2025-04-22 15:11:58 dovecot_login authenticator failed for cpe-148-163-232-103.wireline.com.au [103.232.163.148]:51518: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)103.232.163.1482077456vY  -w) ossec13001hdpExim Auth failed2025-04-22 15:12:06 dovecot_login authenticator failed for net-188-152-225-58.cust.vodafonedsl.it [188.152.225.58]:46861: 535 Incorrect authentication data (set_id=vikas.khandelwal)188.152.225.583175395tX -q) ossec13001haExim Auth failed2025-04-22 15:00:58 dovecot_login authenticator failed for (JvAqWGHe3R) [206.217.129.94]:51968: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)206.217.129.946252001pW -i) ossec13001haExim Auth failed2025-04-22 15:00:37 dovecot_login authenticator failed for (cT3Amz) [206.217.129.94]:51390: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)206.217.129.946252001]V  -K# ossec13001h`Exim Auth failed2025-04-22 14:55:25 dovecot_login authenticator failed for ([62.4.94.178]) [62.4.94.178]:32802: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)62.4.94.1782921044 \ ! ? f %<`jb  -U# ossec13001h9Exim Auth failed2025-04-21 17:56:56 dovecot_login authenticator failed for ([103.60.89.88]) [103.60.89.2]:39850: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)103.60.89.21643084e  -S+ ossec13001h2vExim Auth failed2025-04-21 17:26:37 dovecot_login authenticator failed for ([154.118.162.194]) [154.118.162.194]:40762: 535 Incorrect authentication data (set_id=vikas.khandelwal)154.118.162.1942453866q  -q' ossec13001h2hExim Auth failed2025-04-21 17:26:22 dovecot_login authenticator failed for ([62.90.251.153]) [62.90.251.153]:18633: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)62.90.251.153294640W  -;' ossec13001h2`Exim Auth failed2025-04-21 17:26:14 dovecot_login authenticator failed for ([61.184.119.61]) [61.184.119.61]:49957: 535 Incorrect authentication data (set_id=purchase)61.184.119.611814991d  -Y# ossec13001h2JExim Auth failed2025-04-21 17:25:53 dovecot_login authenticator failed for ([218.27.4.98]) [218.27.4.98]:58526: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)218.27.4.981814991>  -# ossec13001h2&Exim Auth failed2025-04-21 17:25:18 dovecot_login authenticator failed for ([5.26.34.188]) [5.26.34.188]:60086: 535 Incorrect authentication data5.26.34.188298795%  3Q' ossec11301h0qNew FTP connection.Apr 21 17:18:00 vm1 pure-ftpd[2134005]: (?@40.124.176.81) [INFO] New connection from 40.124.176.8140.124.176.816252001  W) ossec9708h+jDovecot Aborted Login with empty userApr 21 16:56:33 vm1 dovecot[90419]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=87.236.176.219, lip=103.74.54.108, TLS, session=87.236.176.2192635167W  -9) ossec13001h*Exim Auth failed2025-04-21 16:54:05 dovecot_login authenticator failed for ([216.194.174.103]) [216.194.174.27]:2154: 535 Incorrect authentication data (set_id=sales)216.194.174.276252001q  -o' ossec13001h*Exim Auth failed2025-04-21 16:53:46 dovecot_login authenticator failed for d54c70cda.static.telenet.be [84.199.12.218]:48944: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)84.199.12.2182802361[  -C) ossec13001h$Exim Auth failed2025-04-21 16:27:21 dovecot_login authenticator failed for (User) [193.46.255.184]:48746: 535 Incorrect authentication data (set_id=clayton@technobases.in)193.46.255.184798549T -7% ossec13001h$Exim Auth failed2025-04-21 16:27:12 dovecot_login authenticator failed for (User) [171.22.28.26]:36712: 535 Incorrect authentication data (set_id=vds@technobases.in)171.22.28.26732800] -E) ossec13001h$TExim Auth failed2025-04-21 16:26:18 dovecot_login authenticator failed for (User) [193.46.255.184]:35594: 535 Incorrect authentication data (set_id=clarissa@technobases.in)193.46.255.184798549X -?% ossec13001h$JExim Auth failed2025-04-21 16:26:08 dovecot_login authenticator failed for (User) [171.22.28.26]:34470: 535 Incorrect authentication data (set_id=modules@technobases.in)171.22.28.26732800U  -;% ossec13001h$*Exim Auth failed2025-04-21 16:25:37 dovecot_login authenticator failed for (User) [171.22.28.26]:55508: 535 Incorrect authentication data (set_id=pskov@technobases.in)171.22.28.26732800[ -A) ossec13001h$Exim Auth failed2025-04-21 16:25:23 dovecot_login authenticator failed for (User) [193.46.255.184]:47574: 535 Incorrect authentication data (set_id=claire@technobases.in)193.46.255.184798549  3I# ossec11301hNew FTP connection.Apr 21 15:59:05 vm1 pure-ftpd[2115244]: (?@3.128.27.22) [INFO] New connection from 3.128.27.223.128.27.226252001  3I# ossec11301hNew FTP connection.Apr 21 15:57:36 vm1 pure-ftpd[2115042]: (?@3.128.27.22) [INFO] New connection from 3.128.27.223.128.27.226252001  " ? cm$C+  3Y+ ossec11301hNew FTP connection.Apr 23 03:56:59 vm1 pure-ftpd[2581603]: (?@139.162.119.146) [INFO] New connection from 139.162.119.146139.162.119.1461861060\  -A+ ossec13001hExim Auth failed2025-04-23 03:44:33 dovecot_login authenticator failed for ([103.231.163.154]) [103.231.163.154]:2664: 535 Incorrect authentication data (set_id=services)103.231.163.1541210997m~  -e) ossec13001hExim Auth failed2025-04-23 03:44:19 dovecot_login authenticator failed for ([128.185.225.34]) [128.185.225.34]:35372: 535 Incorrect authentication data (set_id=services@heipowersystem.com)128.185.225.341269750%}  3Q' ossec11301h7New FTP connection.Apr 23 03:37:49 vm1 pure-ftpd[2577524]: (?@109.202.99.46) [INFO] New connection from 109.202.99.46109.202.99.462750405(|  3U) ossec11301h3New FTP connection.Apr 23 03:37:46 vm1 pure-ftpd[2577519]: (?@213.232.87.228) [INFO] New connection from 213.232.87.228213.232.87.2282750405({  3U) ossec11301h/New FTP connection.Apr 23 03:37:41 vm1 pure-ftpd[2577503]: (?@213.232.87.230) [INFO] New connection from 213.232.87.230213.232.87.2302750405dz  -W% ossec13001h vExim Auth failed2025-04-23 03:13:17 dovecot_login authenticator failed for ([222.216.2.74]) [222.216.2.74]:60754: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)222.216.2.741814991gy  -Y) ossec13001h Exim Auth failed2025-04-23 03:13:29 dovecot_login authenticator failed for (223-197-172-72.static.imsbiz.com) [223.197.172.72]:53467: 535 Incorrect authentication data (set_id=sales)223.197.172.721819730Xx  -;) ossec13001h Exim Auth failed2025-04-23 03:09:13 dovecot_login authenticator failed for ([125.16.12.73]) [128.185.253.90]:44570: 535 Incorrect authentication data (set_id=services)128.185.253.901269750kw  -a) ossec13001h wExim Auth failed2025-04-23 03:09:03 dovecot_login authenticator failed for ([36.154.20.34]) [153.37.177.219]:30794: 535 Incorrect authentication data (set_id=services@heipowersystem.com)153.37.177.2191814991"v  3M% ossec11301h New FTP connection.Apr 23 02:56:46 vm1 pure-ftpd[2569107]: (?@20.83.34.223) [INFO] New connection from 20.83.34.22320.83.34.2236252001Wu  -9) ossec13001hnExim Auth failed2025-04-23 02:51:50 dovecot_login authenticator failed for ([49.124.154.153]) [49.124.154.153]:43162: 535 Incorrect authentication data (set_id=sales)49.124.154.1531733045^t  -O! ossec13001hbExim Auth failed2025-04-23 02:51:37 dovecot_login authenticator failed for ([47.83.2.11]) [47.83.2.11]:36380: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)47.83.2.111819730ds  -Y% ossec13001hExim Auth failed2025-04-23 02:49:07 dovecot_login authenticator failed for ([41.72.201.170]) [41.72.202.86]:35120: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)41.72.202.86192950gr  -[' ossec13001hExim Auth failed2025-04-23 02:49:17 dovecot_login authenticator failed for syn-074-074-235-208.res.spectrum.com [74.74.235.208]:47142: 535 Incorrect authentication data (set_id=sales)74.74.235.2086252001yq  -}) ossec13001hDExim Auth failed2025-04-23 02:42:36 dovecot_login authenticator failed for ([175.214.123.75]) [175.214.123.75]:47570: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)175.214.123.751835841p  -7' ossec13001hRExim Auth failed2025-04-23 02:42:48 dovecot_login authenticator failed for wsip-70-166-207-76.ph.ph.cox.net (wsip-70-166-207-65.ph.ph.cox.net) [70.166.207.76]:57829: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)70.166.207.766252001lo  -c) ossec13001hExim Auth failed2025-04-23 02:37:25 dovecot_login authenticator failed for 105.217.146.34.bc.googleusercontent.com [34.146.217.105]:44930: 535 Incorrect authentication data (set_id=sales)34.146.217.1051861060 BPa AI]>BQ  -1% ossec13001h'Exim Auth failed2025-04-23 05:05:49 dovecot_login authenticator failed for ([180.74.188.5]) [180.74.188.5]:56120: 535 Incorrect authentication data (set_id=sales)180.74.188.51733045}  -' ossec13001h'Exim Auth failed2025-04-23 05:05:34 dovecot_login authenticator failed for (208-77-181-10-bdn-pool1.mycomspan.com) [208.77.181.10]:60328: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)208.77.181.106252001  W!) ossec9708h'<Dovecot Aborted Login with empty userApr 23 05:03:16 vm1 dovecot[2521491]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=87.236.176.130, lip=103.74.54.108, TLS, session=87.236.176.1302635167`  ;;+ ossec13008h"qMail Recipient rejected2025-04-23 04:42:48 H=(mail.saintsoldiercollege.com) [165.154.228.180]:51185 F= rejected RCPT : Rejected relay attempt: '165.154.228.180' From: 'xpsxrzfhu@saintsoldiercollege.com' To: 'validxxx@gmailhotmail.com.br'165.154.228.1801643084Z  -?) ossec13001hExim Auth failed2025-04-23 04:27:20 dovecot_login authenticator failed for ([125.35.109.214]) [125.35.109.214]:59932: 535 Incorrect authentication data (set_id=purchase)125.35.109.2141814991  - + ossec13001hExim Auth failed2025-04-23 04:26:50 dovecot_login authenticator failed for (135.121.156.175.unknown.m1.com.sg) [175.156.121.135]:45274: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)175.156.121.1351880251Q  -1% ossec13001h*Exim Auth failed2025-04-23 04:20:17 dovecot_login authenticator failed for ([119.194.1.22]) [119.194.1.22]:36490: 535 Incorrect authentication data (set_id=sales)119.194.1.221835841g  -[' ossec13001hExim Auth failed2025-04-23 04:20:03 dovecot_login authenticator failed for ([119.208.45.34]) [119.208.45.34]:35133: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)119.208.45.341835841s  -s' ossec13001hExim Auth failed2025-04-23 04:00:24 dovecot_login authenticator failed for h87-96-158-252.cust.bredband2.com [87.96.158.252]:47014: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)87.96.158.2522661886, 3Y+ ossec11301h{New FTP connection.Apr 23 04:00:17 vm1 pure-ftpd[2582504]: (?@139.162.119.146) [INFO] New connection from 139.162.119.146139.162.119.1461861060  -' ossec13001hwExim Auth failed2025-04-23 04:00:13 dovecot_login authenticator failed for (134.56.58.179.hwccustomers.com) [134.56.58.179]:39342: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)134.56.58.1796252001, 3Y+ ossec11301heNew FTP connection.Apr 23 03:59:56 vm1 pure-ftpd[2582282]: (?@139.162.119.146) [INFO] New connection from 139.162.119.146139.162.119.1461861060W  -9) ossec13001hcExim Auth failed2025-04-23 03:59:53 dovecot_login authenticator failed for ([221.206.104.44]) [221.206.104.44]:48351: 535 Incorrect authentication data (set_id=sales)221.206.104.441814991w  -}% ossec13001hWExim Auth failed2025-04-23 03:59:42 dovecot_login authenticator failed for (90.pool90-173-78.static.orange.es) [90.173.78.90]:55196: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)90.173.78.902510769W  -9) ossec13001h#Exim Auth failed2025-04-23 03:58:50 dovecot_login authenticator failed for ([218.234.104.42]) [218.234.104.42]:33894: 535 Incorrect authentication data (set_id=sales)218.234.104.421835841j  -_) ossec13001hExim Auth failed2025-04-23 03:58:36 dovecot_login authenticator failed for ([171.244.142.45]) [171.244.142.45]:15895: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)171.244.142.451562822+  3Y+ ossec11301hNew FTP connection.Apr 23 03:58:18 vm1 pure-ftpd[2581814]: (?@139.162.119.146) [INFO] New connection from 139.162.119.146139.162.119.1461861060 p" + G ^ l |!ENpY3  -C# ossec13001h:Exim Auth failed2025-04-23 06:26:17 dovecot_login authenticator failed for ([59.1.240.96]) [59.1.240.96]:58802: 535 Incorrect authentication data (set_id=vikas.khandelwal)59.1.240.961835841r2  -q' ossec13001h:Exim Auth failed2025-04-23 06:26:04 dovecot_login authenticator failed for ([112.196.60.13]) [112.196.60.13]:33512: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)112.196.60.131269750W1  E!+ ossec2501h:User authentication failure.Apr 23 06:25:58 vm1 sshd[2613181]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=189.112.232.169189.112.232.169346903430 a;+ ossec5710h:Attempt to login using a non-existent userApr 23 06:25:57 vm1 sshd[2613181]: Invalid user bitcoin from 189.112.232.169 port 35560189.112.232.1693469034e/  -W) ossec13001h7Exim Auth failed2025-04-23 06:14:06 dovecot_login authenticator failed for ([196.188.187.85]) [196.188.187.85]:48844: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)196.188.187.85337996.  -9% ossec13001h7Exim Auth failed2025-04-23 06:13:37 dovecot_login authenticator failed for 206.81.4.146.static.wline.lns.sme.cust.swisscom.ch [146.4.81.206]:32907: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)146.4.81.2062658434V-  -9) ossec13001h7Exim Auth failed2025-04-23 06:13:14 dovecot_login authenticator failed for ([94.204.208.189]) [94.204.208.189]:40202: 535 Incorrect authentication data (set_id=sales)94.204.208.189290557j,  -_) ossec13001h7qExim Auth failed2025-04-23 06:12:25 dovecot_login authenticator failed for ([136.248.70.150]) [136.248.70.150]:58804: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)136.248.70.1503469034a+  -O' ossec13001h7cExim Auth failed2025-04-23 06:12:10 dovecot_login authenticator failed for host-85-237-57-200.dsl.sura.ru [85.237.57.200]:47308: 535 Incorrect authentication data (set_id=sales)85.237.57.2002017370j*  -_) ossec13001h7YExim Auth failed2025-04-23 06:11:59 dovecot_login authenticator failed for ([223.226.85.103]) [223.226.85.103]:57233: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)223.226.85.1031269750k)  -a) ossec13001h7Exim Auth failed2025-04-23 06:12:55 dovecot_login authenticator failed for ([120.238.250.162]) [121.33.189.210]:42976: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)121.33.189.2101814991m(  -e) ossec13001h6Exim Auth failed2025-04-23 06:09:38 dovecot_login authenticator failed for h-176-10-197-168.a444.priv.bahnhof.se [176.10.197.168]:45398: 535 Incorrect authentication data (set_id=services)176.10.197.1682661886d'  -Y# ossec13001h6Exim Auth failed2025-04-23 06:09:25 dovecot_login authenticator failed for ([110.34.2.99]) [110.34.2.99]:40890: 535 Incorrect authentication data (set_id=services@heipowersystem.com)110.34.2.991282988_&  -M% ossec13001h3Exim Auth failed2025-04-23 05:57:42 dovecot_login authenticator failed for ([223.84.17.16]) [223.84.17.16]:1202: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)223.84.17.161814991r%  -u% ossec13001h3Exim Auth failed2025-04-23 05:57:27 dovecot_login authenticator failed for ([41.59.97.139]) [41.59.97.139]:40405: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)41.59.97.139149590W$  -9) ossec13001h3Exim Auth failed2025-04-23 05:56:43 dovecot_login authenticator failed for ([123.210.142.26]) [123.210.142.26]:48276: 535 Incorrect authentication data (set_id=sales)123.210.142.262077456}#  -' ossec13001h3Exim Auth failed2025-04-23 05:56:29 dovecot_login authenticator failed for (208-77-181-10-bdn-pool1.mycomspan.com) [208.77.181.10]:56422: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)208.77.181.106252001 5 ; ] ~ !5YnvD  -y' ossec13001hF1Exim Auth failed2025-04-23 07:15:21 dovecot_login authenticator failed for ([89.175.253.49]) [89.175.253.49]:45520: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)89.175.253.492017370WC  -9) ossec13001hEExim Auth failed2025-04-23 07:14:05 dovecot_login authenticator failed for ([121.189.198.60]) [121.189.198.60]:46236: 535 Incorrect authentication data (set_id=sales)121.189.198.601835841oB  -i) ossec13001hEExim Auth failed2025-04-23 07:13:41 dovecot_login authenticator failed for (stilsoft.sevkavkaz.ru) [88.215.141.146]:60096: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)88.215.141.1462017370mA  -i' ossec13001hEUExim Auth failed2025-04-23 07:11:39 dovecot_login authenticator failed for (host-191-223-30-78.sevstar.net) [78.30.223.191]:51746: 535 Incorrect authentication data (set_id=vikas.khandelwal)78.30.223.191690791@  -%+ ossec13001hECExim Auth failed2025-04-23 07:11:22 dovecot_login authenticator failed for (nsg-corporate-247.228.187.122.airtel.in) [122.187.228.247]:52140: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)122.187.228.2471269750W?  -9) ossec13001hEExim Auth failed2025-04-23 07:10:22 dovecot_login authenticator failed for ([129.80.228.231]) [129.80.228.231]:43164: 535 Incorrect authentication data (set_id=sales)129.80.228.2316252001f>  -Y' ossec13001hDExim Auth failed2025-04-23 07:10:06 dovecot_login authenticator failed for ([210.12.48.11]) [111.198.18.45]:53572: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)111.198.18.451814991W=  -;' ossec13001hCExim Auth failed2025-04-23 07:04:10 dovecot_login authenticator failed for ([222.76.248.54]) [222.76.248.54]:47484: 535 Incorrect authentication data (set_id=purchase)222.76.248.541814991g<  -]% ossec13001hCExim Auth failed2025-04-23 07:03:52 dovecot_login authenticator failed for ([14.35.218.58]) [14.35.218.58]:51237: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)14.35.218.581835841B;  -% ossec13001hCtExim Auth failed2025-04-23 07:03:40 dovecot_login authenticator failed for ([60.174.34.26]) [60.174.34.26]:55612: 535 Incorrect authentication data60.174.34.261814991m:  -e) ossec13001hC\Exim Auth failed2025-04-23 07:03:15 dovecot_login authenticator failed for ([79.170.189.164]) [79.170.189.164]:39653: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)79.170.189.16412204099  3I# ossec11301h>New FTP connection.Apr 23 06:43:52 vm1 pure-ftpd[2616642]: (?@65.49.1.139) [INFO] New connection from 65.49.1.13965.49.1.1396252001Z8  -=+ ossec13001h<Exim Auth failed2025-04-23 06:34:42 dovecot_login authenticator failed for ([121.167.217.147]) [121.167.217.147]:45208: 535 Incorrect authentication data (set_id=sales)121.167.217.1471835841Y7  -=+ ossec13001h<Exim Auth failed2025-04-23 06:34:22 dovecot_login authenticator failed for ([185.246.255.174]) [185.246.255.174]:57236: 535 Incorrect authentication data (set_id=sales)185.246.255.174294640u6  -w' ossec13001h, rip=87.236.176.212, lip=103.74.54.108, TLS, session=87.236.176.2122635167d_  -Y# ossec13001h[DExim Auth failed2025-04-23 08:45:16 dovecot_login authenticator failed for ([218.76.73.4]) [218.76.73.4]:19974: 535 Incorrect authentication data (set_id=services@heipowersystem.com)218.76.73.41814991W^  -9) ossec13001hXExim Auth failed2025-04-23 08:34:50 dovecot_login authenticator failed for ([41.159.145.190]) [41.159.145.190]:37978: 535 Incorrect authentication data (set_id=sales)41.159.145.1902400553g]  -[' ossec13001hXExim Auth failed2025-04-23 08:34:24 dovecot_login authenticator failed for ([119.29.137.49]) [119.29.137.49]:41514: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)119.29.137.491814991\  ;) ossec13008hWMail Recipient rejected2025-04-23 08:30:52 H=(localhost.localdomain) [78.153.140.207]:51692 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no F= rejected RCPT : Sender verify failed78.153.140.2072635167Y[  -?) ossec13001hWExim Auth failed2025-04-23 08:29:27 dovecot_login authenticator failed for ([85.130.229.175]) [85.130.229.175]:62175: 535 Incorrect authentication data (set_id=services)85.130.229.175294640 Z  -!+ ossec13001hWwExim Auth failed2025-04-23 08:29:03 dovecot_login authenticator failed for 107-135-116-109.lightspeed.livnmi.sbcglobal.net [107.135.116.109]:32576: 535 Incorrect authentication data (set_id=services@heipowersystem.com)107.135.116.1096252001iY  -[+ ossec13001hWaExim Auth failed2025-04-23 08:28:41 dovecot_login authenticator failed for ([124.156.212.167]) [124.156.212.167]:48842: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)124.156.212.1671861060yX  -}) ossec13001hWQExim Auth failed2025-04-23 08:28:24 dovecot_login authenticator failed for ([146.235.193.77]) [146.235.193.77]:54954: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)146.235.193.776252001NW  --# ossec13001hW Exim Auth failed2025-04-23 08:27:14 dovecot_login authenticator failed for ([103.50.5.94]) [103.50.5.94]:35964: 535 Incorrect authentication data (set_id=sales)103.50.5.941269750V  -# ossec13001hWExim Auth failed2025-04-23 08:27:04 dovecot_login authenticator failed for (46x0x192x86.static-customer.samara.ertelecom.ru) [46.0.192.86]:57078: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)46.0.192.862017370uU  -u) ossec13001hUExim Auth failed2025-04-23 08:19:00 dovecot_login authenticator failed for ([112.196.52.107]) [112.196.52.107]:46487: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)112.196.52.1071269750 @ I B I X T@36DL]{lT  -e' ossec13001hU=Exim Auth failed2025-04-23 08:19:31 dovecot_login authenticator failed for (mamanguape.static.gvt.net.br) [177.207.248.5]:38632: 535 Incorrect authentication data (set_id=vikas.khandelwal)177.207.248.53469034mS  -e) ossec13001hU-Exim Auth failed2025-04-23 08:19:15 dovecot_login authenticator failed for 45-228-190-124.obercom.net.ar [45.228.190.124]:34891: 535 Incorrect authentication data (set_id=vikas.khandelwal)45.228.190.1243865483]R  -C+ ossec13001hU Exim Auth failed2025-04-23 08:19:03 dovecot_login authenticator failed for ([178.178.194.135]) [178.178.194.135]:46040: 535 Incorrect authentication data (set_id=services)178.178.194.1352017370jQ  -c' ossec13001hU Exim Auth failed2025-04-23 08:18:43 dovecot_login authenticator failed for ([196.191.212.235]) [213.55.85.202]:4205: 535 Incorrect authentication data (set_id=services@heipowersystem.com)213.55.85.202337996sP  -q) ossec13001hLhExim Auth failed2025-04-23 07:41:52 dovecot_login authenticator failed for (202-44-251-169.inet.co.th) [202.44.251.169]:54306: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)202.44.251.1691605651mO  -c+ ossec13001hL`Exim Auth failed2025-04-23 07:41:43 dovecot_login authenticator failed for ([221.213.201.190]) [221.213.201.190]:54493: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)221.213.201.1901814991xN  -' ossec13001hKRExim Auth failed2025-04-23 07:37:14 dovecot_login authenticator failed for (dsl-213-204-72-90.terra.net.lb) [213.204.72.90]:58706: 535 Incorrect authentication data (set_id=services@heipowersystem.com)213.204.72.90272103M  -' ossec13001hKjExim Auth failed2025-04-23 07:37:37 dovecot_login authenticator failed for 131-106-31-52.s1842.c3-0.eas-cbr5.atw-eas.pa.cable.rcncustomer.com [131.106.31.52]:49376: 535 Incorrect authentication data (set_id=services)131.106.31.526252001L  ;) ossec13008hHQMail Recipient rejected2025-04-23 07:24:24 H=(localhost.localdomain) [78.153.140.207]:45958 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no F= rejected RCPT : Sender verify failed78.153.140.2072635167K  -# ossec13001hGExim Auth failed2025-04-23 07:21:03 dovecot_login authenticator failed for 111-70-16-7.emome-ip.hinet.net [111.70.16.7]:50231: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)111.70.16.71668284lJ  -g% ossec13001hGExim Auth failed2025-04-23 07:21:21 dovecot_login authenticator failed for (dynamic-ip-adsl.viettel.vn) [117.2.123.19]:57748: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)117.2.123.191562822tI  -y' ossec13001hG/Exim Auth failed2025-04-23 07:19:33 dovecot_login authenticator failed for ([65.20.251.221]) [65.20.251.221]:58149: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)65.20.251.22199237H  -) ossec13001hG+Exim Auth failed2025-04-23 07:19:31 dovecot_login authenticator failed for (broadband-37.204-193-141.ip.moscow.rt.ru) [37.204.193.141]:55374: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)37.204.193.1412017370rG  -q' ossec13001hG?Exim Auth failed2025-04-23 07:19:50 dovecot_login authenticator failed for (201.173.16.21-clientes-izzi.mx) [201.173.16.21]:36089: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)201.173.16.213996063YF  -;+ ossec13001hG9Exim Auth failed2025-04-23 07:19:43 dovecot_login authenticator failed for ([143.192.98.134]) [175.139.253.161]:49211: 535 Incorrect authentication data (set_id=sales)175.139.253.1611733045]E  -K# ossec13001hF=Exim Auth failed2025-04-23 07:15:32 dovecot_login authenticator failed for ([36.39.140.2]) [36.39.140.2]:41198: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)36.39.140.21835841 C  F N f besCW^  -9) ossec13001h Exim Auth failed2025-04-23 01:20:35 dovecot_login authenticator failed for ([50.223.176.171]) [50.223.176.171]:58979: 535 Incorrect authentication data (set_id=sales)50.223.176.1716252001j]  -_) ossec13001hExim Auth failed2025-04-23 01:20:16 dovecot_login authenticator failed for ([211.44.170.154]) [211.44.170.154]:34512: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)211.44.170.1541835841M\  -)' ossec13001hExim Auth failed2025-04-23 01:19:14 dovecot_login authenticator failed for (User) [185.93.89.218]:61454: 535 Incorrect authentication data (set_id=postmaster)185.93.89.218130758c[  -S' ossec13001h.Exim Auth failed2025-04-23 00:59:48 dovecot_login authenticator failed for (82.208.71.101.static.mts-nn.ru) [82.208.71.101]:59828: 535 Incorrect authentication data (set_id=sales)82.208.71.1012017370dZ  -W% ossec13001hExim Auth failed2025-04-23 00:59:32 dovecot_login authenticator failed for ([59.1.214.102]) [59.1.214.102]:47046: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)59.1.214.1021835841pY  -i+ ossec13001h)Exim Auth failed2025-04-23 00:55:29 dovecot_login authenticator failed for ([220.158.233.247]) [220.158.233.247]:41362: 535 Incorrect authentication data (set_id=services@heipowersystem.com)220.158.233.2471831722lX  -c) ossec13001h5Exim Auth failed2025-04-23 00:55:41 dovecot_login authenticator failed for 143.38.109.208.host.secureserver.net [208.109.38.143]:46540: 535 Incorrect authentication data (set_id=services)208.109.38.1436252001WW  -9) ossec13001hExim Auth failed2025-04-23 00:53:13 dovecot_login authenticator failed for ([192.34.128.202]) [192.34.128.202]:34018: 535 Incorrect authentication data (set_id=sales)192.34.128.2026252001mV  -c+ ossec13001hExim Auth failed2025-04-23 00:52:52 dovecot_login authenticator failed for ([103.152.234.134]) [103.152.234.134]:46422: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)103.152.234.1341643084xU  -}' ossec13001hExim Auth failed2025-04-23 00:50:14 dovecot_login authenticator failed for (fp5cca5266.gifg408.ap.nuro.jp) [154.47.20.206]:15728: 535 Incorrect authentication data (set_id=services@heipowersystem.com)154.47.20.2061861060T  - ) ossec13001hExim Auth failed2025-04-23 00:50:00 dovecot_login authenticator failed for 136.151.48.116.static.netvigator.com [116.48.151.136]:51641: 535 Incorrect authentication data (set_id=services@heipowersystem.com)116.48.151.1361819730cS  -S' ossec13001hExim Auth failed2025-04-23 00:42:25 dovecot_login authenticator failed for ([31.173.20.146]) [31.173.20.146]:50836: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)31.173.20.1462017370sR  -u% ossec13001hExim Auth failed2025-04-23 00:42:13 dovecot_login authenticator failed for ([58.246.81.19]) [58.246.81.19]:38324: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)58.246.81.191814991RQ  -5' ossec13001hExim Auth failed2025-04-23 00:41:58 dovecot_login authenticator failed for ([65.20.212.154]) [65.20.212.154]:35836: 535 Incorrect authentication data (set_id=sales)65.20.212.15499237}P  - ' ossec13001hExim Auth failed2025-04-23 00:41:36 dovecot_login authenticator failed for (160.228-59-41.static-zone.ttcldata.net) [41.59.228.160]:60746: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)41.59.228.160149590ZO  -=+ ossec13001h$Exim Auth failed2025-04-23 00:38:20 dovecot_login authenticator failed for ([106.201.252.122]) [106.201.252.122]:52651: 535 Incorrect authentication data (set_id=sales)106.201.252.1221269750}N  -+ ossec13001hExim Auth failed2025-04-23 00:38:09 dovecot_login authenticator failed for cpe-148-163-232-103.wireline.com.au [103.232.163.148]:35919: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)103.232.163.1482077456 $} l <WM  3I# ossec11301h?New FTP connection.Apr 23 00:13:10 vm1 pure-ftpd[2534555]: (?@65.49.1.169) [INFO] New connection from 65.49.1.16965.49.1.1696252001kL  -e% ossec13001h5Exim Auth failed2025-04-23 00:13:01 dovecot_login authenticator failed for 95.58.93.189.dynamic.telecom.kz [95.58.93.189]:58175: 535 Incorrect authentication data (set_id=vikas.khandelwal)95.58.93.1891522867 K  -) ossec13001h)Exim Auth failed2025-04-23 00:12:49 dovecot_login authenticator failed for net-188-152-225-58.cust.vodafonedsl.it [188.152.225.58]:37951: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)188.152.225.583175395:J  Ak) ossec11302hFTP Authentication failed.Apr 23 00:07:06 vm1 pure-ftpd[2533288]: (?@91.196.152.113) [WARNING] Authentication failed for user [anonymous]91.196.152.1133017382(I  3U) ossec11301hNew FTP connection.Apr 23 00:07:01 vm1 pure-ftpd[2533273]: (?@91.196.152.114) [INFO] New connection from 91.196.152.11491.196.152.1143017382(H  3U) ossec11301hNew FTP connection.Apr 23 00:07:02 vm1 pure-ftpd[2533288]: (?@91.196.152.113) [INFO] New connection from 91.196.152.11391.196.152.1133017382G  ?1 ossec1008hProcess exiting (killed).Apr 23 00:06:05 vm1 spamd[2221409]: spamd: server killed by SIGTERM, shutting down^F  -I) ossec13001hExim Auth failed2025-04-22 23:54:31 dovecot_login authenticator failed for 87-119-184-143.ip.elisa.ee [87.119.184.143]:54200: 535 Incorrect authentication data (set_id=sales)87.119.184.143453733jE  -_) ossec13001hExim Auth failed2025-04-22 23:54:17 dovecot_login authenticator failed for ([123.209.91.149]) [123.209.91.149]:43622: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)123.209.91.1492077456TD  -5' ossec13001hހExim Auth failed2025-04-22 23:52:55 dovecot_login authenticator failed for ([61.160.105.66]) [61.160.105.66]:35957: 535 Incorrect authentication data (set_id=sales)61.160.105.661814991gC  -[' ossec13001hlExim Auth failed2025-04-22 23:52:35 dovecot_login authenticator failed for ([222.88.64.163]) [222.88.64.163]:54450: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)222.88.64.1631814991ZB  -?) ossec13001h݄Exim Auth failed2025-04-22 23:48:43 dovecot_login authenticator failed for ([178.178.222.56]) [178.178.222.56]:33814: 535 Incorrect authentication data (set_id=services)178.178.222.562017370mA  -e) ossec13001hxExim Auth failed2025-04-22 23:48:32 dovecot_login authenticator failed for ([123.209.96.208]) [123.209.96.208]:34682: 535 Incorrect authentication data (set_id=services@heipowersystem.com)123.209.96.2082077456d@  -Y# ossec13001h^Exim Auth failed2025-04-22 23:39:33 dovecot_login authenticator failed for ([4.35.66.243]) [4.35.66.243]:57865: 535 Incorrect authentication data (set_id=services@heipowersystem.com)4.35.66.2436252001Z?  -?) ossec13001hjExim Auth failed2025-04-22 23:39:44 dovecot_login authenticator failed for ([106.245.246.26]) [106.245.246.26]:39831: 535 Incorrect authentication data (set_id=services)106.245.246.261835841 >  [{# ossec12004hPossible Dovecot CVE-2019-11500 attemptApr 22 23:38:27 vm1 dovecot[2521491]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.145.149.6, lip=103.74.54.108, session=<3TMM32EzgO0DkZUG>3.145.149.66252001"=  3M% ossec11301hكNew FTP connection.Apr 22 23:31:38 vm1 pure-ftpd[2521927]: (?@45.84.102.21) [INFO] New connection from 45.84.102.2145.84.102.213439705W<  -9) ossec13001h}Exim Auth failed2025-04-22 23:31:32 dovecot_login authenticator failed for ([211.248.31.142]) [211.248.31.142]:60010: 535 Incorrect authentication data (set_id=sales)211.248.31.1421835841 ~qdWJ=0$ |pdXL@4( t h \ P D 8 ,   x l ` T H < 0 $  | p d !  X L @ 4 (      r e X K > 1 $  { n a T G : - 3437598On 3374766N 337996N3 337996M 337996Mq 337996M 337996K 337996K 338010J 337996J~ 337996I 3469034 " 3469034 3469034 3469034 [ 3469034 Z 3469034 ' 3469034  3469034 3469034 3469034 3469034 3469034 l 3469034 3469034  3469034 3469034 3469034 3469034 3469034y 3469034C 3469034* 3469034 3469034 3469034 3469034 3469034' 3469034 3469034 3469034 3469034p 3469034f 3469034` 3469034S 3439705I= 3437598=K 34375985 3437598/ 3437598 3437598 T 338010Bf 3380106 3380105 3380104 3380103 337996I 337996I 337996I 337996I 337996H 337996H 337996H 337996G 337996FQ 337996D 337996A 337996@ 337996? 337996> 337996>n 337996> 337996=F 337996; 337996:5 337996: 3379969 3379968 3379968 3379968) 3379967 3379966 3379965 3379965 3379965V 3379965R 3379965D 3379964 3379962 3379961 3379961I 337996/ 337996. 337996.) 337996-9 337996- 337996, 337996* 337996) 337996( 337996({ 337996'% 337996& 337996%Q 337996$ 337996$# 337996# 337996# 337996#' 337996! 337996!v 337996 337996 337996 337996 337996 337996i 337996 337996 337996 337996 337996# 337996 337996 337996 337996t 337996 337996 337996 337996{ 337996 337996 337996 337996 & 337996  337996 337996 3374766AR 3374766A: 3374766? 3374766?6 3374766> 33747668 33747667 3374766/u 3374766. 3374766+ 3374766) 3374766( 3374766& 3374766# 3374766 3374766   p \pw  -{' ossec13001hyExim Auth failed2025-04-23 10:55:27 dovecot_login authenticator failed for host-85-237-57-200.dsl.sura.ru [85.237.57.200]:32882: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)85.237.57.2002017370`  -O% ossec13001hwExim Auth failed2025-04-23 10:43:38 dovecot_login authenticator failed for ([116.7.248.50]) [116.7.248.50]:44759: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)116.7.248.501814991y  -}) ossec13001hvExim Auth failed2025-04-23 10:43:25 dovecot_login authenticator failed for ([183.167.196.62]) [183.167.196.62]:40517: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)183.167.196.621814991T  -5' ossec13001hvExim Auth failed2025-04-23 10:42:22 dovecot_login authenticator failed for ([46.18.231.221]) [46.18.231.221]:58877: 535 Incorrect authentication data (set_id=sales)46.18.231.2213017382g  -[' ossec13001hvExim Auth failed2025-04-23 10:42:04 dovecot_login authenticator failed for ([61.51.184.194]) [61.51.184.194]:40588: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)61.51.184.1941814991< Ck) ossec11309htFTP Authentication success.Apr 23 10:34:11 vm1 pure-ftpd[2665888]: (?@223.185.236.66) [INFO] user@saintsoldiercollege.com is now logged in223.185.236.661269750) 3U) ossec11301htNew FTP connection.Apr 23 10:34:11 vm1 pure-ftpd[2665888]: (?@223.185.236.66) [INFO] New connection from 223.185.236.66223.185.236.661269750r  -q' ossec13001htExim Auth failed2025-04-23 10:34:01 dovecot_login authenticator failed for syn-156-019-080-138.biz.spectrum.com [156.19.80.138]:38343: 535 Incorrect authentication data (set_id=vikas.khandelwal)156.19.80.1386252001  -%+ ossec13001htExim Auth failed2025-04-23 10:33:47 dovecot_login authenticator failed for (nsg-corporate-154.230.187.122.airtel.in) [122.187.230.154]:33805: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)122.187.230.1541269750Y~  -=) ossec13001hlExim Auth failed2025-04-23 09:56:43 dovecot_login authenticator failed for d187-135.cl.rinet.ru [195.91.187.135]:59682: 535 Incorrect authentication data (set_id=sales)195.91.187.1352017370j}  -_) ossec13001hkExim Auth failed2025-04-23 09:56:17 dovecot_login authenticator failed for ([221.224.133.98]) [221.224.133.98]:51122: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)221.224.133.981814991Z|  -?) ossec13001hjExim Auth failed2025-04-23 09:52:21 dovecot_login authenticator failed for ([95.165.131.226]) [95.165.131.226]:58092: 535 Incorrect authentication data (set_id=services)95.165.131.2262017370j{  -a' ossec13001hjExim Auth failed2025-04-23 09:52:04 dovecot_login authenticator failed for ([59.89.148.179]) [59.89.148.179]:50900: 535 Incorrect authentication data (set_id=services@heipowersystem.com)59.89.148.1791269750(z  3U) ossec11301hhNew FTP connection.Apr 23 09:42:05 vm1 pure-ftpd[2654392]: (?@45.227.254.155) [INFO] New connection from 45.227.254.15545.227.254.1553703430fy  -W) ossec13001hg3Exim Auth failed2025-04-23 09:36:11 dovecot_login authenticator failed for ([112.25.140.211]) [112.25.140.211]:33018: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)112.25.140.2111814991 x  -!) ossec13001hg'Exim Auth failed2025-04-23 09:35:58 dovecot_login authenticator failed for 146.47.246.220.static.netvigator.com [220.246.47.146]:57096: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)220.246.47.1461819730cw  -S' ossec13001hfExim Auth failed2025-04-23 09:35:05 dovecot_login authenticator failed for a89-153-62-100.cpe.netcabo.pt [89.153.62.100]:39624: 535 Incorrect authentication data (set_id=purchase)89.153.62.1002264397 K3? M n  K;  Ck) ossec11309hIFTP Authentication success.Apr 23 11:48:48 vm1 pure-ftpd[2682773]: (?@223.185.236.66) [INFO] user@saintsoldiercollege.com is now logged in223.185.236.661269750(  3U) ossec11301hINew FTP connection.Apr 23 11:48:48 vm1 pure-ftpd[2682773]: (?@223.185.236.66) [INFO] New connection from 223.185.236.66223.185.236.661269750  C) ossec11313hKFTP file uploaded to serverApr 23 11:48:49 vm1 pure-ftpd[2682773]: (user@saintsoldiercollege.com@223.185.236.66) [NOTICE] /home/techno/public_html/saintsoldiercollege.com//Head_web.php uploaded (19981 bytes, 279.51KB/sec)223.185.236.661269750t  -s) ossec13001hExim Auth failed2025-04-23 11:41:37 dovecot_login authenticator failed for 208.46.246.220.static.netvigator.com [220.246.46.208]:58926: 535 Incorrect authentication data (set_id=vikas.khandelwal)220.246.46.2081819730  -) ossec13001hExim Auth failed2025-04-23 11:41:25 dovecot_login authenticator failed for 201-61-213-223.bbone.telesp.net.br [201.61.213.223]:42064: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)201.61.213.2233469034  W% ossec9708hDovecot Aborted Login with empty userApr 23 11:37:05 vm1 dovecot[2521491]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=203.55.131.4, lip=103.74.54.108, TLS, session=203.55.131.46252001\  -G% ossec13001hExim Auth failed2025-04-23 11:33:21 dovecot_login authenticator failed for ([1.247.245.61]) [1.247.245.61]:38063: 535 Incorrect authentication data (set_id=vikas.khandelwal)1.247.245.611835841z  -) ossec13001hExim Auth failed2025-04-23 11:33:04 dovecot_login authenticator failed for (stilsoft.sevkavkaz.ru) [88.215.141.146]:50540: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)88.215.141.1462017370{  -+ ossec13001h|Exim Auth failed2025-04-23 11:07:18 dovecot_login authenticator failed for (nsg-corporate-193.227.187.122.airtel.in) [122.187.227.193]:53964: 535 Incorrect authentication data (set_id=vikas.khandelwal)122.187.227.1931269750e  -S+ ossec13001h||Exim Auth failed2025-04-23 11:06:59 dovecot_login authenticator failed for ([103.146.233.123]) [103.146.233.123]:33673: 535 Incorrect authentication data (set_id=vikas.khandelwal)103.146.233.1231269750l  -i# ossec13001h|pExim Auth failed2025-04-23 11:06:47 dovecot_login authenticator failed for ([59.1.240.96]) [59.1.240.96]:58578: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)59.1.240.961835841Q  -1% ossec13001h{Exim Auth failed2025-04-23 11:03:53 dovecot_login authenticator failed for ([14.21.36.101]) [14.21.36.101]:57543: 535 Incorrect authentication data (set_id=sales)14.21.36.1011814991i  -]) ossec13001h{Exim Auth failed2025-04-23 11:03:34 dovecot_login authenticator failed for ([91.203.124.210]) [91.203.124.210]:6186: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)91.203.124.2102017370Z  -?) ossec13001hzExim Auth failed2025-04-23 11:00:02 dovecot_login authenticator failed for ([124.246.94.135]) [124.246.94.135]:39802: 535 Incorrect authentication data (set_id=services)124.246.94.1351880251m  -e) ossec13001hzExim Auth failed2025-04-23 10:59:40 dovecot_login authenticator failed for ([123.209.99.248]) [123.209.99.248]:39982: 535 Incorrect authentication data (set_id=services@heipowersystem.com)123.209.99.2482077456o  -i) ossec13001hyExim Auth failed2025-04-23 10:56:15 dovecot_login authenticator failed for ppp-171-96-205-148.revip8.asianet.co.th [171.96.205.148]:34893: 535 Incorrect authentication data (set_id=purchase)171.96.205.1481605651H  -) ossec13001hyExim Auth failed2025-04-23 10:56:02 dovecot_login authenticator failed for ([74.213.234.212]) [74.213.234.212]:44221: 535 Incorrect authentication data74.213.234.2126252001  q~q uh[NA4'yl_RE8+VI</"tgZM@3& }pc |obUH;.!xk^QD7*~qdWJ=0# zm`SF9, v i \ O B 5 (     r e X K > 1 $  { n a T G : -   w j ] P C 6 )    s f Y L ? 2 %  1819730 1819730 18197302 1819730 1819730 1819730 1819730 1819730 1819730 1819730 1819730 1819730 1819730 1819730 1819730 1819730 1819730 1819730 1819730 1819730 1819730 1819730 1819730 1819730 1819730R 1819730I 1819730A 1819730> 1819730# 1819730 1819730 1819730 1819730 1819730 1819730 1819730 e 1819730 E 1819730 ; 1819730 : 1819730  1819730 1819730 1819730 1819730 1819730 1819730S 18197306 1819730 1819730 1819730 1819730 N 1819730 ; 1819730 - 1819730 1819730 1819730 i 1819730 E 1819730  1819730 1819730J 18197303 1819730 18197305 1819730 1819730 1819730X 1819730R 1819730I 1819730 1819730+ 1819730 1819730 1819730 1819730 1819730 1819730 1819730 1819730- 1819730 1819730 1819730% 1819730% 1819730$ 1819730$ 1819730$ 1819730$ 1819730$x 1819730$f 1819730$Y 1819730$! 1819730$ 1819730# 1819730# 1819730" 1819730" 1819730" 1819730" 1819730"x 1819730"6 1819730! 1819730!R 1819730 1819730 1819730H 1819730 1819730 1819730D 18197305 1819730 1819730 1819730n 1819730_ 1819730[ 1819730! 1819730 18197305 1819730" 1819730 1819730 1819730 1819730 1819730 1819730l 1819730 1819730 1819730D 1819730) 1819730 1819730 1819730 1819730 1819730@ 1819730@ 1819730@ 1819730@y 1819730@g 1819730@M 1819730? 1819730? 1819730? 1819730? 1819730? 1819730? 1819730? 1819730?O 1819730> 1819730> 1819730> 1819730> 1819730>1 1819730= 1819730= 1819730= 1819730= 1819730= 1819730=[ 1819730= 1819730< 1819730< 1819730<+ 1819730;H 1819730;G 1819730;F 1819730: 1819730: 1819730: 18197309 18197309 18197309 18197309 18197309 18197309K 18197309" 18197308 18197308 18197308 18197308e 18197308 18197307 18197307 18197307 18197307 18197307u 18197307m 18197307F 18197306d 18197306 18197305 18197305 18197305 18197305S 18197305 18197304\ 181973049 18197304 18197303 18197303 18197303 18197303 18197303 18197303 18197303c 18197303] 18197303S 18197303R 18197303Q 18197303: 18197303* 18197303 18197302 18197302 18197302 18197302 18197302 18197302W 18197302 18197301 18197301 18197301 18197301 18197301 18197301 18197301 18197301 18197300 18197300S 18197300" 1819730/ 1819730/i 1819730/C 1819730/- 1819730. 1819730. 1819730. 1819730. 1819730.Y 1819730.8 1819730-H 1819730, 1819730,0 1819730,% 1819730+ 1819730+o 1819730+W 1819730+ 1819730* 1819730* 1819730* 1819730) 1819730) 1819730) 1819730)J 1819730)C 1819730)? 1819730) 1819730( 1819730(| 1819730(U 1819730( 1819730' 1819730'C 1819730'- 1819730'" 1819730&V 1819730&P 1819730&! 1819730& 9 # 7&@O)  -1% ossec13001hExim Auth failed2025-04-23 12:11:32 dovecot_login authenticator failed for ([65.20.129.71]) [65.20.129.71]:55834: 535 Incorrect authentication data (set_id=sales)65.20.129.7199237s(  -u% ossec13001hExim Auth failed2025-04-23 12:11:14 dovecot_login authenticator failed for wsip-68-15-163-18.no.no.cox.net [68.15.163.18]:55042: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)68.15.163.186252001W'  -;' ossec13001hExim Auth failed2025-04-23 12:07:36 dovecot_login authenticator failed for ([104.218.218.5]) [104.218.218.5]:27060: 535 Incorrect authentication data (set_id=services)104.218.218.53576468j&  -a' ossec13001hExim Auth failed2025-04-23 12:07:18 dovecot_login authenticator failed for ([58.238.74.138]) [58.238.74.138]:21080: 535 Incorrect authentication data (set_id=services@heipowersystem.com)58.238.74.1381835841i%  -[+ ossec13001hExim Auth failed2025-04-23 11:55:15 dovecot_login authenticator failed for ([183.109.195.179]) [183.109.195.179]:38846: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)183.109.195.1791835841v$  -y' ossec13001hExim Auth failed2025-04-23 11:55:03 dovecot_login authenticator failed for ([103.31.118.12]) [103.31.118.12]:35138: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)103.31.118.121643084;#  Ck) ossec11309h=FTP Authentication success.Apr 23 11:52:53 vm1 pure-ftpd[2683693]: (?@223.185.236.66) [INFO] user@saintsoldiercollege.com is now logged in223.185.236.661269750a"  -S# ossec13001h3Exim Auth failed2025-04-23 11:52:43 dovecot_login authenticator failed for ([94.251.8.83]) [94.251.8.83]:42232: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)94.251.8.832017370 !  C ) ossec11313h?FTP file uploaded to serverApr 23 11:52:54 vm1 pure-ftpd[2683693]: (user@saintsoldiercollege.com@223.185.236.66) [NOTICE] /home/techno/public_html/saintsoldiercollege.com//index.php uploaded (29076 bytes, 316.54KB/sec)223.185.236.661269750g  -Y) ossec13001h?Exim Auth failed2025-04-23 11:52:54 dovecot_login authenticator failed for (109-126-41-234.pptp.vladlink.net) [109.126.41.234]:56202: 535 Incorrect authentication data (set_id=sales)109.126.41.2342017370(  3U) ossec11301h=New FTP connection.Apr 23 11:52:52 vm1 pure-ftpd[2683693]: (?@223.185.236.66) [INFO] New connection from 223.185.236.66223.185.236.661269750v  -}# ossec13001hExim Auth failed2025-04-23 11:51:13 dovecot_login authenticator failed for (88.60.79.202.ether.static.wlink.com.np) [110.34.2.99]:40390: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)110.34.2.991282988|  -+ ossec13001hExim Auth failed2025-04-23 11:51:02 dovecot_login authenticator failed for ([183.253.125.205]) [183.253.125.205]:47861: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)183.253.125.2051814991;  Ck) ossec11309hFTP Authentication success.Apr 23 11:50:02 vm1 pure-ftpd[2683117]: (?@223.185.236.66) [INFO] user@saintsoldiercollege.com is now logged in223.185.236.661269750(  3U) ossec11301hNew FTP connection.Apr 23 11:50:01 vm1 pure-ftpd[2683117]: (?@223.185.236.66) [INFO] New connection from 223.185.236.66223.185.236.661269750W  -9) ossec13001hExim Auth failed2025-04-23 11:49:50 dovecot_login authenticator failed for ([103.180.240.96]) [103.180.240.96]:44730: 535 Incorrect authentication data (set_id=sales)103.180.240.961282988f  -[' ossec13001h}Exim Auth failed2025-04-23 11:49:40 dovecot_login authenticator failed for ([80.227.138.32]) [80.227.138.32]:42510: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)80.227.138.32290557 *\~tj`VLB8.$zpf\H>4*   v l b X N D : 0 &    ~ t j ` V L B 8 . $    z p f \ 4 R * H >  vlbXND:0&r|h^TJ@6,"xndPZF<2( ~tVj`LB8$.pzf\ | r h ^ T J @ 6 , "    x n d Z P F < 2 (   RRH>4*  vlbXND:0& h'J hJ h7J hAJ h?J h7J hJ hJ hAJ h)J hJ hJ hJ htJ hJ hJ hͿJ h͵J h9J h1J hJ hJ hKJ h=J h1J hyJ hʧJ hʗJ hgJ hɀJ hvJ hJ hbJ~ hSJ} hJ| hJ{ hJz hŽJy hŅJx hsJw hJv hJu hYJt hKJs híJr hÅJq hÃJp h}Jo h]Jn hKJm hJl hJk h@Jj h6Ji hJh hJg hJf hJe hJd hJc hJb hJa hJ` hJ_ hJ^ hJ] hJ\ hJ[ hJZ hJY hJX hJW hiJV hYJU hYJT hJS hJR hJQ hJP h,JO h:JN hJM hJL hGJK h=JJ hJI hJH h JG hJF hJE hJD hJC hJB hVJA hHJ@ hJ? hJ> hxJ= hjJ< hJ; hJ: hWJ9 hEJ8 hgJ7 h[J6 hI h  -a' ossec13001hExim Auth failed2025-04-23 13:15:19 dovecot_login authenticator failed for ([122.225.55.98]) [122.225.55.98]:34968: 535 Incorrect authentication data (set_id=services@heipowersystem.com)122.225.55.981814991T=  -7% ossec13001hxExim Auth failed2025-04-23 13:14:55 dovecot_login authenticator failed for ([221.210.9.83]) [221.210.9.82]:34630: 535 Incorrect authentication data (set_id=services)221.210.9.821814991j<  -a' ossec13001hjExim Auth failed2025-04-23 13:14:42 dovecot_login authenticator failed for ([211.217.50.31]) [211.217.50.31]:58759: 535 Incorrect authentication data (set_id=services@heipowersystem.com)211.217.50.311835841f;  -W) ossec13001hExim Auth failed2025-04-23 12:58:30 dovecot_login authenticator failed for ([122.179.201.94]) [122.179.201.94]:54260: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)122.179.201.941269750 %_nVh {"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 03:52:11 dovecot_login authenticator failed for ([1.235.192.130]) [1.235.192.130]:34652: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)","attackers_ip":"1.235.192.130","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745533331,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}:h {"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 03:56:17 dovecot_login authenticator failed for a89-153-62-100.cpe.netcabo.pt [89.153.62.100]:49196: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)","attackers_ip":"89.153.62.100","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745533578,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}"h {"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 03:52:24 dovecot_login authenticator failed for 111-70-19-64.emome-ip.hinet.net [111.70.19.64]:49947: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)","attackers_ip":"111.70.19.64","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745533345,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 03:52:30 dovecot_login authenticator failed for ([165.154.202.101]) [165.154.202.101]:55718: 535 Incorrect authentication data (set_id=sales)","attackers_ip":"165.154.202.101","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745533352,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 03:52:35 dovecot_login authenticator failed for 181sdl30m44.codetel.net.do [66.98.79.181]:42732: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)","attackers_ip":"66.98.79.181","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745533356,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 03:52:45 dovecot_login authenticator failed for d142-179-145-166.abhsia.telus.net [142.179.145.166]:40156: 535 Incorrect authentication data (set_id=sales)","attackers_ip":"142.179.145.166","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745533366,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0} 3 2 K 3:[]dgZk  -?) ossec13001hExim Auth failed2025-04-23 16:04:04 dovecot_login authenticator failed for ([121.179.93.147]) [121.179.93.147]:37248: 535 Incorrect authentication data (set_id=purchase)121.179.93.1471835841bj  -O) ossec13001h@Exim Auth failed2025-04-23 15:51:51 dovecot_login authenticator failed for ([50.252.195.114]) [50.252.195.114]:54644: 535 Incorrect authentication data (set_id=vikas.khandelwal)50.252.195.1146252001xi  -y+ ossec13001h6Exim Auth failed2025-04-23 15:51:40 dovecot_login authenticator failed for ([117.232.111.253]) [117.232.111.251]:54580: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)117.232.111.2511269750th  -s) ossec13001hExim Auth failed2025-04-23 15:46:52 dovecot_login authenticator failed for 143.38.109.208.host.secureserver.net [208.109.38.143]:43456: 535 Incorrect authentication data (set_id=vikas.khandelwal)208.109.38.1436252001yg  -# ossec13001hExim Auth failed2025-04-23 15:46:38 dovecot_login authenticator failed for ppp5-11-66-171.tis-dialog.ru [5.11.66.171]:54950: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)5.11.66.1712017370Zf  -?) ossec13001hExim Auth failed2025-04-23 15:46:12 dovecot_login authenticator failed for ([101.251.197.46]) [101.251.197.46]:45740: 535 Incorrect authentication data (set_id=purchase)101.251.197.461814991te  -u' ossec13001hExim Auth failed2025-04-23 15:45:45 dovecot_login authenticator failed for (49.206.244.235.actcorp.in) [49.206.241.22]:18612: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)49.206.241.221269750Wd  -9) ossec13001hExim Auth failed2025-04-23 15:32:59 dovecot_login authenticator failed for ([220.182.17.122]) [220.182.17.122]:55924: 535 Incorrect authentication data (set_id=sales)220.182.17.1221814991mc  -c+ ossec13001hExim Auth failed2025-04-23 15:32:43 dovecot_login authenticator failed for ([221.151.168.237]) [221.151.168.237]:32798: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)221.151.168.2371835841jb  -a' ossec13001hExim Auth failed2025-04-23 15:28:51 dovecot_login authenticator failed for ([112.28.137.26]) [112.28.137.26]:57481: 535 Incorrect authentication data (set_id=services@heipowersystem.com)112.28.137.261814991ga  -[' ossec13001hExim Auth failed2025-04-23 15:29:04 dovecot_login authenticator failed for ool-18bbfd43.static.optonline.net [24.187.253.67]:39720: 535 Incorrect authentication data (set_id=services)24.187.253.676252001?`  gQ' ossec11307hMultiple connection attempts from same sourceApr 23 15:24:49 vm1 pure-ftpd[2729673]: (?@167.94.146.50) [INFO] New connection from 167.94.146.50167.94.146.506252001&_ 3Q' ossec11301h New FTP connection.Apr 23 15:24:43 vm1 pure-ftpd[2729644]: (?@167.94.146.50) [INFO] New connection from 167.94.146.50167.94.146.506252001b^  -S' ossec13001hExim Auth failed2025-04-23 15:12:39 dovecot_login authenticator failed for ([94.205.250.78]) [94.205.250.78]:51797: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)94.205.250.78290557|]  -+ ossec13001hExim Auth failed2025-04-23 15:12:28 dovecot_login authenticator failed for ([154.146.240.123]) [154.146.240.123]:53604: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)154.146.240.1232542007W\  -9) ossec13001hExim Auth failed2025-04-23 15:11:19 dovecot_login authenticator failed for ([222.222.242.94]) [222.222.242.94]:37808: 535 Incorrect authentication data (set_id=sales)222.222.242.941814991l[  -a+ ossec13001hExim Auth failed2025-04-23 15:11:06 dovecot_login authenticator failed for ([143.192.98.134]) [175.139.253.161]:34624: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)175.139.253.1611733045 e + i z /'EG_eud  -u) ossec13001h (Exim Auth failed2025-04-24 09:55:11 dovecot_login authenticator failed for ([207.219.222.44]) [207.219.222.44]:54258: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)207.219.222.446251999cc  -S' ossec13001h Exim Auth failed2025-04-24 09:49:00 dovecot_login authenticator failed for ([221.228.232.5]) [221.228.232.5]:14390: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)221.228.232.51814991yb  -}) ossec13001h Exim Auth failed2025-04-24 09:48:44 dovecot_login authenticator failed for ([149.40.106.202]) [149.40.106.202]:59726: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)149.40.106.2022635167]a  -C+ ossec13001h Exim Auth failed2025-04-24 09:48:44 dovecot_login authenticator failed for ([181.233.140.250]) [181.233.140.250]:53388: 535 Incorrect authentication data (set_id=purchase)181.233.140.2503469034`  -) ossec13001h Exim Auth failed2025-04-24 09:48:30 dovecot_login authenticator failed for (static.162.255.21.110.macminivault.com) [162.255.21.110]:60663: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)162.255.21.1106252001b_  -Q' ossec13001h \Exim Auth failed2025-04-24 09:47:32 dovecot_login authenticator failed for 42-200-75-233.static.imsbiz.com [42.200.75.233]:51032: 535 Incorrect authentication data (set_id=sales)42.200.75.2331819730|^  -' ossec13001h HExim Auth failed2025-04-24 09:47:12 dovecot_login authenticator failed for (21-172-91-219.static.youbroadband.in) [219.91.172.21]:41680: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)219.91.172.211269750Q]  -1% ossec13001h pExim Auth failed2025-04-24 09:18:00 dovecot_login authenticator failed for ([1.247.245.61]) [1.247.245.61]:60613: 535 Incorrect authentication data (set_id=sales)1.247.245.611835841m\  -c+ ossec13001h RExim Auth failed2025-04-24 09:17:30 dovecot_login authenticator failed for ([178.178.194.126]) [178.178.194.126]:49286: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)178.178.194.1262017370Z[  -=+ ossec13001h Exim Auth failed2025-04-24 09:16:20 dovecot_login authenticator failed for ([121.190.211.215]) [121.190.211.215]:61592: 535 Incorrect authentication data (set_id=sales)121.190.211.2151835841QZ  -1% ossec13001h Exim Auth failed2025-04-24 09:15:32 dovecot_login authenticator failed for ([58.115.51.27]) [58.115.51.27]:42400: 535 Incorrect authentication data (set_id=sales)58.115.51.271668284aY  -S# ossec13001h Exim Auth failed2025-04-24 09:15:19 dovecot_login authenticator failed for ([64.53.7.231]) [64.53.7.231]:58962: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)64.53.7.2316252001jX  -a' ossec13001h |Exim Auth failed2025-04-24 09:13:56 dovecot_login authenticator failed for ([112.91.253.46]) [112.91.253.46]:47028: 535 Incorrect authentication data (set_id=services@heipowersystem.com)112.91.253.461814991=W  Cm+ ossec11309h FTP Authentication success.Apr 24 09:10:27 vm1 pure-ftpd[2962482]: (?@106.207.151.191) [INFO] user@saintsoldiercollege.com is now logged in106.207.151.1911269750+V  3Y+ ossec11301h New FTP connection.Apr 24 09:10:25 vm1 pure-ftpd[2962482]: (?@106.207.151.191) [INFO] New connection from 106.207.151.191106.207.151.1911269750 U C+ ossec11313h FTP file uploaded to serverApr 24 09:10:24 vm1 pure-ftpd[2962009]: (user@saintsoldiercollege.com@106.207.151.191) [NOTICE] /home/techno/public_html/saintsoldiercollege.com//index.php uploaded (0 bytes, 0.00KB/sec)106.207.151.1911269750T C+ ossec11313h hFTP file uploaded to serverApr 24 09:09:18 vm1 pure-ftpd[2962009]: (user@saintsoldiercollege.com@106.207.151.191) [NOTICE] /home/techno/public_html/saintsoldiercollege.com//Head_web.php uploaded (19308 bytes, 316.19KB/sec)106.207.151.1911269750 , M e g u aZ  -M) ossec13001hExim Auth failed2025-04-23 15:03:12 dovecot_login authenticator failed for ([200.168.249.9]) [187.50.226.182]:40993: 535 Incorrect authentication data (set_id=vikas.khandelwal)187.50.226.1823469034Y  -!# ossec13001hExim Auth failed2025-04-23 15:02:58 dovecot_login authenticator failed for 96-1-40-151-staticipeast.wireless.telus.com [96.1.40.151]:33247: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)96.1.40.1516251999QX  -1% ossec13001hExim Auth failed2025-04-23 14:46:49 dovecot_login authenticator failed for ([175.198.18.3]) [175.198.18.3]:50658: 535 Incorrect authentication data (set_id=sales)175.198.18.31835841yW  -' ossec13001hExim Auth failed2025-04-23 14:46:37 dovecot_login authenticator failed for dhcp-4-bc-9f-52-b7-f.cpe.i-zoom.net [24.244.93.233]:43086: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)24.244.93.2336251999cV  -U% ossec13001hiExim Auth failed2025-04-23 14:40:01 dovecot_login authenticator failed for 111-70-19-64.emome-ip.hinet.net [111.70.19.64]:55865: 535 Incorrect authentication data (set_id=services)111.70.19.641668284gU  -]% ossec13001hYExim Auth failed2025-04-23 14:39:44 dovecot_login authenticator failed for ([203.29.84.253]) [203.63.46.34]:9777: 535 Incorrect authentication data (set_id=services@heipowersystem.com)203.63.46.342077456 T  [{# ossec12004hYPossible Dovecot CVE-2019-11500 attemptApr 23 14:35:27 vm1 dovecot[2521491]: pop3-login: Disconnected: Input buffer full (no auth attempts in 1 secs): user=<>, rip=3.16.66.211, lip=103.74.54.108, session=<2w34Zm4zDpIDEELT>3.16.66.2116252001`S  -K) ossec13001hExim Auth failed2025-04-23 14:25:35 dovecot_login authenticator failed for (183.83.188.236.actcorp.in) [183.83.188.236]:60108: 535 Incorrect authentication data (set_id=sales)183.83.188.2361269750sR  -u% ossec13001hExim Auth failed2025-04-23 14:25:15 dovecot_login authenticator failed for (50-82-12-128.client.mchsi.com) [50.82.12.128]:60746: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)50.82.12.1286252001kQ  -a) ossec13001hExim Auth failed2025-04-23 14:21:25 dovecot_login authenticator failed for nova-185-040-122-250.cpe.novanet.is [185.40.122.250]:48217: 535 Incorrect authentication data (set_id=services)185.40.122.2502629691mP  -e) ossec13001hExim Auth failed2025-04-23 14:21:13 dovecot_login authenticator failed for ([144.22.247.249]) [144.22.247.249]:46256: 535 Incorrect authentication data (set_id=services@heipowersystem.com)144.22.247.2493469034yO  -}) ossec13001h,Exim Auth failed2025-04-23 14:13:22 dovecot_login authenticator failed for ([111.10.209.160]) [111.10.209.160]:64776: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)111.10.209.1601814991cN  -S' ossec13001h:Exim Auth failed2025-04-23 14:13:37 dovecot_login authenticator failed for ([101.168.2.207]) [101.168.2.207]:42204: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)101.168.2.2072077456ZM  -E% ossec13001hExim Auth failed2025-04-23 14:11:48 dovecot_login authenticator failed for 95-87-213-16.ip.btc-net.bg [95.87.213.16]:35719: 535 Incorrect authentication data (set_id=sales)95.87.213.16732800dL  -W% ossec13001hExim Auth failed2025-04-23 14:11:19 dovecot_login authenticator failed for ([180.74.188.5]) [180.74.188.5]:44566: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)180.74.188.51733045fK  -W) ossec13001hGExim Auth failed2025-04-23 14:05:19 dovecot_login authenticator failed for ([178.178.222.52]) [178.178.222.52]:54288: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)178.178.222.522017370 4 + ' K RXc*H4&  ;) ossec13008h cMail Recipient rejected2025-04-24 21:47:02 H=(localhost.localdomain) [78.153.140.207]:54152 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no F= rejected RCPT : Sender verify failed78.153.140.2072635167]%  -C+ ossec13001h cExim Auth failed2025-04-24 21:46:26 dovecot_login authenticator failed for ([117.232.111.254]) [117.232.111.251]:36362: 535 Incorrect authentication data (set_id=services)117.232.111.2511269750F$  -' ossec13001h c Exim Auth failed2025-04-24 21:42:56 dovecot_login authenticator failed for (User) [185.93.89.218]:36270: 535 Incorrect authentication data (set_id=www)185.93.89.218130758Q#  -1% ossec13001h b/Exim Auth failed2025-04-24 21:39:18 dovecot_login authenticator failed for ([60.166.8.174]) [60.166.8.174]:46928: 535 Incorrect authentication data (set_id=sales)60.166.8.1741814991f"  -W) ossec13001h b&Exim Auth failed2025-04-24 21:39:09 dovecot_login authenticator failed for (173-20-253-109.client.mchsi.com) [173.20.253.109]:60382: 535 Incorrect authentication data (set_id=sales)173.20.253.1096252001f!  -Y' ossec13001h b"Exim Auth failed2025-04-24 21:39:05 dovecot_login authenticator failed for (static.vnpt.vn) [14.226.64.124]:50652: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)14.226.64.1241562822g  -[' ossec13001h bExim Auth failed2025-04-24 21:38:57 dovecot_login authenticator failed for ([103.161.93.53]) [103.161.93.53]:24611: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)103.161.93.531269750Q  -3# ossec13001h a<Exim Auth failed2025-04-24 21:35:15 dovecot_login authenticator failed for ([101.13.5.37]) [101.13.5.37]:54506: 535 Incorrect authentication data (set_id=services)101.13.5.371668284p  -i+ ossec13001h aExim Auth failed2025-04-24 21:34:43 dovecot_login authenticator failed for ([183.105.138.168]) [183.105.138.168]:60426: 535 Incorrect authentication data (set_id=services@heipowersystem.com)183.105.138.1681835841u  -u) ossec13001h aExim Auth failed2025-04-24 21:34:38 dovecot_login authenticator failed for c188-150-45-140.bredband.tele2.se [188.150.45.140]:46562: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)188.150.45.1402661886t  -y' ossec13001h aExim Auth failed2025-04-24 21:34:21 dovecot_login authenticator failed for ([65.20.237.191]) [65.20.237.191]:37142: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)65.20.237.19199237W  -9) ossec13001h `Exim Auth failed2025-04-24 21:33:53 dovecot_login authenticator failed for ([160.155.229.28]) [160.155.229.28]:43676: 535 Incorrect authentication data (set_id=sales)160.155.229.282287781  - ' ossec13001h `Exim Auth failed2025-04-24 21:33:30 dovecot_login authenticator failed for (node-115-187-61-70.alliancebroadband.in) [115.187.61.70]:53384: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)115.187.61.701269750Z  -?) ossec13001h _Exim Auth failed2025-04-24 21:28:11 dovecot_login authenticator failed for ([192.34.128.202]) [192.34.128.202]:56926: 535 Incorrect authentication data (set_id=purchase)192.34.128.2026252001   -'% ossec13001h _Exim Auth failed2025-04-24 21:27:58 dovecot_login authenticator failed for (88x87x84x104.static-customer.volgograd.ertelecom.ru) [88.87.84.104]:50762: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)88.87.84.1042017370Z  -?) ossec13001h ^XExim Auth failed2025-04-24 21:22:54 dovecot_login authenticator failed for ([171.244.142.45]) [171.244.142.45]:58260: 535 Incorrect authentication data (set_id=services)171.244.142.451562822  - ) ossec13001h ^JExim Auth failed2025-04-24 21:22:41 dovecot_login authenticator failed for 47-158-212-153.lsan.ca.frontiernet.net [47.158.212.153]:55768: 535 Incorrect authentication data (set_id=services@heipowersystem.com)47.158.212.1536252001   ! Q e | C<Mzv  -y' ossec13001h^Exim Auth failed2025-04-23 17:26:12 dovecot_login authenticator failed for ([114.242.61.35]) [114.242.61.35]:35698: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)114.242.61.351814991N  --# ossec13001h'Exim Auth failed2025-04-23 17:25:19 dovecot_login authenticator failed for ([14.54.22.11]) [14.54.22.11]:29224: 535 Incorrect authentication data (set_id=sales)14.54.22.111835841j  -_) ossec13001hExim Auth failed2025-04-23 17:25:05 dovecot_login authenticator failed for ([123.209.200.21]) [123.209.200.21]:57908: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)123.209.200.212077456(  3U) ossec11301h7New FTP connection.Apr 23 17:21:17 vm1 pure-ftpd[2754843]: (?@110.226.161.56) [INFO] New connection from 110.226.161.56110.226.161.561269750]  -G' ossec13001hAExim Auth failed2025-04-23 17:21:28 dovecot_login authenticator failed for n1164940138.netvigator.com [116.49.40.138]:39939: 535 Incorrect authentication data (set_id=sales)116.49.40.1381819730;  Ck) ossec11309h?FTP Authentication success.Apr 23 17:21:26 vm1 pure-ftpd[2754843]: (?@110.226.161.56) [INFO] user@saintsoldiercollege.com is now logged in110.226.161.561269750s  -u% ossec13001h7Exim Auth failed2025-04-23 17:21:18 dovecot_login authenticator failed for (50-82-12-128.client.mchsi.com) [50.82.12.128]:42220: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)50.82.12.1286252001;  Ck) ossec11309hFTP Authentication success.Apr 23 17:20:19 vm1 pure-ftpd[2754663]: (?@110.226.161.56) [INFO] user@saintsoldiercollege.com is now logged in110.226.161.561269750) 3U) ossec11301hNew FTP connection.Apr 23 17:20:16 vm1 pure-ftpd[2754663]: (?@110.226.161.56) [INFO] New connection from 110.226.161.56110.226.161.561269750b  -O) ossec13001hAExim Auth failed2025-04-23 17:17:12 dovecot_login authenticator failed for ([59.144.219.169]) [27.123.114.166]:37148: 535 Incorrect authentication data (set_id=vikas.khandelwal)27.123.114.1661269750r  -q' ossec13001h)Exim Auth failed2025-04-23 17:16:49 dovecot_login authenticator failed for ([120.55.170.138]) [116.30.140.56]:8099: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)116.30.140.561814991(  3U) ossec11301hNew FTP connection.Apr 23 17:16:30 vm1 pure-ftpd[2753796]: (?@110.226.161.56) [INFO] New connection from 110.226.161.56110.226.161.561269750d  -U' ossec13001hExim Auth failed2025-04-23 17:16:02 dovecot_login authenticator failed for ool-1826d6c2.dyn.optonline.net [24.38.214.194]:51373: 535 Incorrect authentication data (set_id=services)24.38.214.1946252001g  -]% ossec13001hExim Auth failed2025-04-23 17:15:52 dovecot_login authenticator failed for ([98.70.127.17]) [98.70.127.17]:47396: 535 Incorrect authentication data (set_id=services@heipowersystem.com)98.70.127.171269750K  -%' ossec13001htExim Auth failed2025-04-23 17:01:00 dovecot_login authenticator failed for (User) [185.93.89.218]:14892: 535 Incorrect authentication data (set_id=account1)185.93.89.218130758f  -W) ossec13001hExim Auth failed2025-04-23 16:55:15 dovecot_login authenticator failed for ([128.185.224.87]) [152.52.243.154]:46956: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)152.52.243.1541269750{  -+ ossec13001hExim Auth failed2025-04-23 16:55:05 dovecot_login authenticator failed for ([195.133.158.175]) [195.133.158.175]:49497: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)195.133.158.175294640o  -i) ossec13001hͿExim Auth failed2025-04-23 16:53:42 dovecot_login authenticator failed for (broadband-37.204-193-141.ip.moscow.rt.ru) [37.204.193.141]:58080: 535 Incorrect authentication data (set_id=sales)37.204.193.1412017370 - @ E N c _s -W|  -;' ossec13001hExim Auth failed2025-04-23 16:20:03 dovecot_login authenticator failed for ([220.95.14.102]) [220.95.14.102]:41946: 535 Incorrect authentication data (set_id=services)220.95.14.1021835841a{  -S' ossec13001hExim Auth failed2025-04-23 16:19:43 dovecot_login authenticator failed for ([65.20.155.151]) [65.20.155.151]:33239: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)65.20.155.15199237pz  -i+ ossec13001hExim Auth failed2025-04-23 16:19:36 dovecot_login authenticator failed for ([112.164.244.205]) [112.164.244.205]:38692: 535 Incorrect authentication data (set_id=services@heipowersystem.com)112.164.244.2051835841zy  -# ossec13001hŽExim Auth failed2025-04-23 16:19:33 dovecot_login authenticator failed for (hebei.8.60.in-addr.arpa) [60.8.50.150]:54374: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)60.8.50.1501814991Px  -1% ossec13001hŅExim Auth failed2025-04-23 16:18:37 dovecot_login authenticator failed for ([41.59.97.200]) [41.59.97.200]:58048: 535 Incorrect authentication data (set_id=sales)41.59.97.200149590jw  -_) ossec13001hsExim Auth failed2025-04-23 16:18:19 dovecot_login authenticator failed for ([175.205.191.27]) [175.205.191.27]:52452: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)175.205.191.271835841cv  -S' ossec13001hExim Auth failed2025-04-23 16:15:44 dovecot_login authenticator failed for ([27.45.235.146]) [27.45.235.146]:48455: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)27.45.235.1461814991 u  -' ossec13001hExim Auth failed2025-04-23 16:15:32 dovecot_login authenticator failed for (aes-static-233.85.144.59.airtel.in) [125.20.245.94]:56846: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)125.20.245.941269750Qt  -1% ossec13001hYExim Auth failed2025-04-23 16:13:37 dovecot_login authenticator failed for ([121.150.85.2]) [121.150.85.2]:37350: 535 Incorrect authentication data (set_id=sales)121.150.85.21835841gs  -[' ossec13001hKExim Auth failed2025-04-23 16:13:23 dovecot_login authenticator failed for ([195.24.215.70]) [195.24.215.70]:45458: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)195.24.215.702233387r  - ' ossec13001híExim Auth failed2025-04-23 16:10:44 dovecot_login authenticator failed for (47-206-95-195.static.bhpk.fl.ip.frontiernet.net) [47.206.95.195]:45421: 535 Incorrect authentication data (set_id=vikas.khandelwal)47.206.95.1956252001fq  -W) ossec13001hÅExim Auth failed2025-04-23 16:10:04 dovecot_login authenticator failed for ([103.168.241.32]) [103.168.241.32]:54576: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)103.168.241.321269750rp  -q' ossec13001hÃExim Auth failed2025-04-23 16:10:01 dovecot_login authenticator failed for ([45.164.98.205]) [45.164.98.205]:35761: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)45.164.98.2053469034vo  -y' ossec13001h}Exim Auth failed2025-04-23 16:09:56 dovecot_login authenticator failed for ([58.18.212.238]) [58.18.212.238]:43528: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)58.18.212.2381814991Wn  -9) ossec13001h]Exim Auth failed2025-04-23 16:09:24 dovecot_login authenticator failed for ([211.46.203.176]) [211.46.203.176]:52086: 535 Incorrect authentication data (set_id=sales)211.46.203.1761835841mm  -c+ ossec13001hKExim Auth failed2025-04-23 16:09:05 dovecot_login authenticator failed for ([178.178.194.192]) [178.178.194.192]:53892: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)178.178.194.1922017370ml  -e) ossec13001hExim Auth failed2025-04-23 16:03:52 dovecot_login authenticator failed for ([60.173.114.254]) [60.173.114.254]:47615: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)60.173.114.2541814991 " L @BWhsh7  -[) ossec13001h r Exim Auth failed2025-04-24 22:46:59 dovecot_login authenticator failed for 213-67-136-103-no600.tbcn.telia.com [213.67.136.103]:53412: 535 Incorrect authentication data (set_id=sales)213.67.136.1032661886p6  -m' ossec13001h qExim Auth failed2025-04-24 22:46:46 dovecot_login authenticator failed for 179-42-124-80.chtch.com.br [179.42.124.80]:28640: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)179.42.124.803469034j5  -a' ossec13001h q"Exim Auth failed2025-04-24 22:43:05 dovecot_login authenticator failed for ([154.127.90.34]) [154.127.90.34]:43366: 535 Incorrect authentication data (set_id=services@heipowersystem.com)154.127.90.342440476f4  -W) ossec13001h mEExim Auth failed2025-04-24 22:26:37 dovecot_login authenticator failed for ([195.222.57.183]) [195.222.57.183]:60356: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)195.222.57.1833277605y3  -}) ossec13001h m5Exim Auth failed2025-04-24 22:26:20 dovecot_login authenticator failed for ([103.49.233.104]) [103.49.233.104]:36451: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)103.49.233.1041269750W2  -9) ossec13001h lExim Auth failed2025-04-24 22:25:22 dovecot_login authenticator failed for ([220.77.182.169]) [220.77.182.169]:55448: 535 Incorrect authentication data (set_id=sales)220.77.182.1691835841g1  -[' ossec13001h lExim Auth failed2025-04-24 22:25:06 dovecot_login authenticator failed for ([111.8.153.131]) [111.8.153.131]:54275: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)111.8.153.1311814991e0  -S+ ossec13001h k!Exim Auth failed2025-04-24 22:17:27 dovecot_login authenticator failed for ([123.209.106.109]) [123.209.106.109]:50738: 535 Incorrect authentication data (set_id=vikas.khandelwal)123.209.106.1092077456x/  -y+ ossec13001h kExim Auth failed2025-04-24 22:17:12 dovecot_login authenticator failed for ([118.141.222.158]) [118.141.222.158]:41706: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)118.141.222.1581819730x.  -y+ ossec13001h jExim Auth failed2025-04-24 22:16:54 dovecot_login authenticator failed for ([121.182.160.144]) [121.182.160.144]:40750: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)121.182.160.1441835841J-  -#' ossec13001h jExim Auth failed2025-04-24 22:15:05 dovecot_login authenticator failed for (User) [185.93.89.218]:23380: 535 Incorrect authentication data (set_id=account)185.93.89.218130758m,  -e) ossec13001h eEExim Auth failed2025-04-24 21:52:28 dovecot_login authenticator failed for (c20029232-114.consulnetworks.com.co) [200.29.232.114]:44980: 535 Incorrect authentication data (set_id=purchase)200.29.232.1143686110s+  -u' ossec13001h e1Exim Auth failed2025-04-24 21:52:09 dovecot_login authenticator failed for (92.62.243.154.fibermax.bg) [92.62.243.154]:46176: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)92.62.243.154732800"*  3M% ossec11301h dNew FTP connection.Apr 24 21:49:52 vm1 pure-ftpd[3132228]: (?@20.163.14.19) [INFO] New connection from 20.163.14.1920.163.14.196252001Q)  -1% ossec13001h dExim Auth failed2025-04-24 21:49:49 dovecot_login authenticator failed for ([60.168.131.3]) [60.168.131.3]:49025: 535 Incorrect authentication data (set_id=sales)60.168.131.31814991g(  -[' ossec13001h dExim Auth failed2025-04-24 21:49:20 dovecot_login authenticator failed for ([218.78.11.246]) [218.78.11.246]:50552: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)218.78.11.2461814991m'  -e) ossec13001h cExim Auth failed2025-04-24 21:46:16 dovecot_login authenticator failed for ([180.158.100.49]) [180.158.100.49]:42356: 535 Incorrect authentication data (set_id=services@heipowersystem.com)180.158.100.491814991 B q z WT  -9) ossec13001hExim Auth failed2025-04-23 18:31:35 dovecot_login authenticator failed for ([203.252.159.12]) [203.252.159.12]:57474: 535 Incorrect authentication data (set_id=sales)203.252.159.121835841fS  -W) ossec13001hExim Auth failed2025-04-23 18:31:29 dovecot_login authenticator failed for ([182.72.255.137]) [152.52.243.154]:48434: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)152.52.243.1541269750R  -' ossec13001hExim Auth failed2025-04-23 18:31:21 dovecot_login authenticator failed for 47-150-220-54.fdr04.hnbh.ca.ip.frontiernet.net [47.150.220.54]:47610: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)47.150.220.546252001Q  -% ossec13001hExim Auth failed2025-04-23 18:31:14 dovecot_login authenticator failed for h-46-59-52-199.a980.priv.bahnhof.se [46.59.52.199]:53360: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)46.59.52.1992661886pP  -k) ossec13001hExim Auth failed2025-04-23 18:28:19 dovecot_login authenticator failed for pool-173-70-227-235.nwrknj.fios.verizon.net [173.70.227.235]:60018: 535 Incorrect authentication data (set_id=sales)173.70.227.2356252001jO  -_) ossec13001hExim Auth failed2025-04-23 18:28:10 dovecot_login authenticator failed for ([171.244.142.45]) [171.244.142.45]:53671: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)171.244.142.451562822bN  -O) ossec13001hExim Auth failed2025-04-23 18:23:32 dovecot_login authenticator failed for ([58.252.212.233]) [58.252.212.233]:41696: 535 Incorrect authentication data (set_id=vikas.khandelwal)58.252.212.2331814991M  -% ossec13001hExim Auth failed2025-04-23 18:23:17 dovecot_login authenticator failed for 47-184-87-26.dlls.tx.frontiernet.net [47.184.87.26]:59455: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)47.184.87.266252001WL  -;' ossec13001h3Exim Auth failed2025-04-23 18:20:58 dovecot_login authenticator failed for ([218.201.62.71]) [218.201.62.71]:52713: 535 Incorrect authentication data (set_id=purchase)218.201.62.711814991K  - ) ossec13001h'Exim Auth failed2025-04-23 18:20:45 dovecot_login authenticator failed for 195-159-217-71.customer.powertech.no [195.159.217.71]:45962: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)195.159.217.713144096aJ  -O) ossec13001hExim Auth failed2025-04-23 18:15:15 dovecot_login authenticator failed for ([197.156.115.37]) [197.156.115.37]:39912: 535 Incorrect authentication data (set_id=vikas.khandelwal)197.156.115.37338010rI  -q' ossec13001hExim Auth failed2025-04-23 18:14:58 dovecot_login authenticator failed for ([111.26.100.88]) [111.26.100.88]:41820: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)111.26.100.881814991 H  C ) ossec11313hFTP file uploaded to serverApr 23 18:11:58 vm1 pure-ftpd[2766059]: (user@saintsoldiercollege.com@106.221.168.78) [NOTICE] /home/techno/public_html/saintsoldiercollege.com//index.php uploaded (29077 bytes, 331.00KB/sec)106.221.168.781269750;G  Ck) ossec11309hFTP Authentication success.Apr 23 18:11:58 vm1 pure-ftpd[2766059]: (?@106.221.168.78) [INFO] user@saintsoldiercollege.com is now logged in106.221.168.781269750(F  3U) ossec11301hNew FTP connection.Apr 23 18:11:58 vm1 pure-ftpd[2766059]: (?@106.221.168.78) [INFO] New connection from 106.221.168.78106.221.168.781269750 E  C ) ossec11313hFTP file uploaded to serverApr 23 18:07:21 vm1 pure-ftpd[2764888]: (user@saintsoldiercollege.com@106.221.168.78) [NOTICE] /home/techno/public_html/saintsoldiercollege.com//index.php uploaded (29076 bytes, 478.15KB/sec)106.221.168.781269750   9 T V k$VUxmY  -c+ ossec13001h 3IExim Auth failed2025-04-26 06:43:45 dovecot_login authenticator failed for ([180.104.103.146]) [180.104.103.146]:54799: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)180.104.103.1461814991WX  -;' ossec13001h 2Exim Auth failed2025-04-26 06:41:47 dovecot_login authenticator failed for ([66.209.97.254]) [66.209.97.254]:60818: 535 Incorrect authentication data (set_id=services)66.209.97.2546252001mW  -e) ossec13001h 2Exim Auth failed2025-04-26 06:41:33 dovecot_login authenticator failed for ([114.202.80.152]) [114.202.80.152]:44239: 535 Incorrect authentication data (set_id=services@heipowersystem.com)114.202.80.1521835841XV  -=' ossec13001h 1_Exim Auth failed2025-04-26 06:35:34 dovecot_login authenticator failed for ([218.106.120.18]) [58.49.113.138]:14162: 535 Incorrect authentication data (set_id=purchase)58.49.113.1381814991|U  -' ossec13001h 1SExim Auth failed2025-04-26 06:35:22 dovecot_login authenticator failed for c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:54470: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)76.132.238.436252001IT  -!' ossec13001h /2Exim Auth failed2025-04-26 06:26:17 dovecot_login authenticator failed for (User) [185.93.89.218]:1340: 535 Incorrect authentication data (set_id=admin01)185.93.89.218130758ZS  -?) ossec13001h -xExim Auth failed2025-04-26 06:18:56 dovecot_login authenticator failed for ([183.167.196.62]) [183.167.196.62]:57390: 535 Incorrect authentication data (set_id=purchase)183.167.196.621814991fR  -[% ossec13001h -lExim Auth failed2025-04-26 06:18:43 dovecot_login authenticator failed for ([8.243.166.66]) [8.243.166.66]:4501: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)8.243.166.663686110+Q  3Y+ ossec11301h +New FTP connection.Apr 26 06:08:39 vm1 pure-ftpd[3567515]: (?@220.200.180.123) [INFO] New connection from 220.200.180.123220.200.180.1231814991HP  -' ossec13001h 'Exim Auth failed2025-04-26 05:53:59 dovecot_login authenticator failed for (User) [185.93.89.218]:59898: 535 Incorrect authentication data (set_id=admin)185.93.89.218130758fO  -W) ossec13001h $TExim Auth failed2025-04-26 05:39:55 dovecot_login authenticator failed for ([102.50.245.141]) [102.50.245.141]:46214: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)102.50.245.1412542007yN  -}) ossec13001h $FExim Auth failed2025-04-26 05:39:40 dovecot_login authenticator failed for ([49.124.205.169]) [49.124.205.169]:37634: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)49.124.205.1691733045`M  -M' ossec13001h #Exim Auth failed2025-04-26 05:36:29 dovecot_login authenticator failed for p5df1e80e.dip0.t-ipconnect.de [93.241.232.14]:48698: 535 Incorrect authentication data (set_id=sales)93.241.232.142921044QL  -1% ossec13001h #Exim Auth failed2025-04-26 05:36:44 dovecot_login authenticator failed for ([85.93.42.104]) [85.93.42.104]:39548: 535 Incorrect authentication data (set_id=sales)85.93.42.1042017370uK  -w' ossec13001h #iExim Auth failed2025-04-26 05:36:01 dovecot_login authenticator failed for (dsl-mp-dynamic-020.133.23.125.airtelbroadband.in) [125.23.132.74]:57942: 535 Incorrect authentication data (set_id=sales)125.23.132.741269750yJ  -' ossec13001h #]Exim Auth failed2025-04-26 05:35:48 dovecot_login authenticator failed for c-73-162-50-231.hsd1.ca.comcast.net [73.162.50.231]:49232: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)73.162.50.2316252001tI  -w% ossec13001h #QExim Auth failed2025-04-26 05:35:37 dovecot_login authenticator failed for h77-53-111-65.cust.bredband2.com [77.53.111.65]:43734: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)77.53.111.652661886 Lz@4(th\PD8,  x l ` T H < 0 $  <, xl`0$ TH | p d X L @ 4 (    t h \ P D 8 ,   x l ` T H < 0 $  { ozth\PD8}qeYMA5)wk_SG;/" b U H ; . !  xk^QD7*tgZM@3&   130758O 130758M 130758M 130758M 130758M| 130758Mr 130758Mg 1522867Me 130758M^ 130758O 130758MQ 130758MD 130758M: 130758M8 130758M- 130758M$ 130758K 130758M 130758M 130758M 130758L 130758L 130758L 130758L 130758L 130758L 130758L 130758L 130758L 130758L 130758L 130758K 130758K 130758K 130758K 130758K 130758K 149590 149590 149590 ` 146669L+ 146669G 1327865/ 130758L 130758Lh 130758LZ 130758LQ 130758LG 130758L: 130758L4 130758L* 149590& 149590$ 149590"w 149590! 149590 149590 149590* 149590 149590 149590 149590 149590n 149590E 149590A 149590 ? 149590 149590 1512440= 1512440; 15124409? 15124409> 1512440) 1512440 1512440 1512440 1512440N 1512440 149590Jx 149590I 149590IP 149590B 1495909 1495902 1495900 149590/ 149590/ 149590, 149590* 149590' 149590'$ 1527747 1527747 1522867Ki 1522867IL 1522867I 1522867F 1522867F_ 1522867F 1522867D 1522867A\ 1522867= 15228678 15228677 15228676 15228675 15228675 15228674 15228672 15228671E 1522867.; 1522867*\ 1522867) 1522867( 1522867& 1522867&( 1522867# 1522867" 15228673 1522867 1522867 1522867 1522867A 1522867 1522867 1522867 1522867 15228670 1522867# 1522867` 1522867| 1522867 1522867 1522867= 1522867# 1522867 1522867 1522867 1522867 1522867 1522867 z 1522867  1522867 130758O 130758O 130758O 1522867O 130758O 130758O 130758O 130758O 130758O 130758O 130758O 130758O 130758O 130758O 130758O 130758O~ 130758Os 130758Oj 130758Og 130758Ob 130758O^ 130758OT 130758OP 130758OB 130758O9 130758O0 130758O* 130758O& 130758O# 130758O 130758O 130758O 130758O 130758N 130758N 130758N 130758N 130758N 130758N 130758N 130758N 130758N 130758N 130758N 130758N 130758N 130758N 130758N 130758N 130758N 130758N 130758Nx 130758Nt 130758Ni 130758N] 130758NT 130758NG 130758N> 130758N) 130758N 130758N 130758N 130758N 130758M 130758M 130758M 130758M 130758M 130758K 130758K 130758K 130758K 130758K| 130758Ky 130758Kv 130758Kk 130758Kb 130758KW 130758KS 130758KD 130758K= 130758K8 130758K2 130758K$ 130758K 130758K 130758K 130758J 130758J 130758J 130758J 130758J 130758J 130758J 130758I\ 130758G: 130758F' 130758@ 130758@ 130758@ 130758@ 130758@ 130758># 130758< 130758< 130758< 130758< 130758< 130758< 130758< 130758< 130758< 130758< 130758< 130758; 130758; 130758; 130758; 130758; 130758; 130758; 130758; 130758; 130758; 130758;< 130758O 130758O 130758O 130758O 130758O 130758O 130758O 130758O 130758O 130758O g 9 G L#cb2  -Q' ossec13001h"Exim Auth failed2025-04-23 17:42:18 dovecot_login authenticator failed for (188.243.62.66.pool.sknt.ru) [188.243.62.66]:47024: 535 Incorrect authentication data (set_id=services)188.243.62.662017370i1  -a% ossec13001hExim Auth failed2025-04-23 17:42:06 dovecot_login authenticator failed for ([103.177.205.100]) [58.84.60.238]:3265: 535 Incorrect authentication data (set_id=services@heipowersystem.com)58.84.60.2381269750 0  C ) ossec11313hؠFTP file uploaded to serverApr 23 17:40:08 vm1 pure-ftpd[2759195]: (user@saintsoldiercollege.com@106.221.168.78) [NOTICE] /home/techno/public_html/saintsoldiercollege.com//index.php uploaded (29076 bytes, 528.61KB/sec)106.221.168.781269750 7985448 7985446 7985445o 7985442 7985441 7985440 7985440 7985440o 7985440( 798544/P 798544. 798544.z 798544,r 798544) 798544' 798544& 798544& 798544% 798544%- 798544% 798544$ 798544$s 798544#E 798544" 798544!^ 798544 798544o 798544 798544} 798544 798544W 798544 798544" 798544 798544n 798544 798544 798544 798544 798544 798544} 798544 798544 798544 798544 ; 798544 798544 d 798544  798544 798544 798544 + 798544 7985445 798544 798544 798544v 798544 798544 783754M  @zh {"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 03:57:22 dovecot_login authenticator failed for (ool-4b7fcd5b.static.optonline.net) [75.127.205.91]:47956: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)","attackers_ip":"75.127.205.91","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745533644,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 03:57:45 dovecot_login authenticator failed for ([65.20.252.101]) [65.20.252.101]:40384: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)","attackers_ip":"65.20.252.101","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745533666,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}iLh {"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 03:56:31 dovecot_login authenticator failed for ([58.252.212.233]) [58.252.212.233]:37098: 535 Incorrect authentication data (set_id=vikas.khandelwal)","attackers_ip":"58.252.212.233","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745533592,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0} DB4 ? P  0(jmD9  Cg) ossec11309h KFTP Authentication success.Apr 24 16:41:06 vm1 pure-ftpd[3062009]: (?@152.59.109.221) [INFO] user@s2seducationtrust.com is now logged in152.59.109.2211269750(  3U) ossec11301h New FTP connection.Apr 24 16:40:20 vm1 pure-ftpd[3061914]: (?@152.59.109.221) [INFO] New connection from 152.59.109.221152.59.109.22112697509  Cg) ossec11309h FTP Authentication success.Apr 24 16:40:20 vm1 pure-ftpd[3061914]: (?@152.59.109.221) [INFO] user@s2seducationtrust.com is now logged in152.59.109.2211269750(~  3U) ossec11301h New FTP connection.Apr 24 16:38:50 vm1 pure-ftpd[3061303]: (?@152.59.109.221) [INFO] New connection from 152.59.109.221152.59.109.22112697509}  Cg) ossec11309h FTP Authentication success.Apr 24 16:38:50 vm1 pure-ftpd[3061303]: (?@152.59.109.221) [INFO] user@s2seducationtrust.com is now logged in152.59.109.2211269750|  C) ossec11313h FTP file uploaded to serverApr 24 16:38:50 vm1 pure-ftpd[3061303]: (user@s2seducationtrust.com@152.59.109.221) [NOTICE] /home/techno/public_html/s2seducationtrust.com//robots.txt uploaded (75 bytes, 245.76KB/sec)152.59.109.2211269750_{  -K' ossec13001h UExim Auth failed2025-04-24 16:36:59 dovecot_login authenticator failed for ([193.32.189.59]) [193.32.189.59]:59276: 535 Incorrect authentication data (set_id=vikas.khandelwal)193.32.189.592017370qz  -o' ossec13001h CExim Auth failed2025-04-24 16:36:41 dovecot_login authenticator failed for (rediffmail.com) [122.160.68.46]:56622: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)122.160.68.461269750(y  3U) ossec11301h New FTP connection.Apr 24 16:34:41 vm1 pure-ftpd[3060496]: (?@152.59.109.221) [INFO] New connection from 152.59.109.221152.59.109.22112697509x  Cg) ossec11309h FTP Authentication success.Apr 24 16:34:41 vm1 pure-ftpd[3060496]: (?@152.59.109.221) [INFO] user@s2seducationtrust.com is now logged in152.59.109.2211269750w  C{) ossec11313h FTP file uploaded to serverApr 24 16:34:37 vm1 pure-ftpd[3059630]: (user@s2seducationtrust.com@152.59.109.221) [NOTICE] /home/techno/public_html/s2seducationtrust.com//robots.txt uploaded (0 bytes, 0.00KB/sec)152.59.109.2211269750Mv  A) ossec11302h FTP Authentication failed.Apr 24 16:30:13 vm1 pure-ftpd[3059622]: (?@152.59.109.221) [WARNING] Authentication failed for user [user@westerndancecompany.com]152.59.109.2211269750)u 3U) ossec11301h New FTP connection.Apr 24 16:30:06 vm1 pure-ftpd[3059622]: (?@152.59.109.221) [INFO] New connection from 152.59.109.221152.59.109.2211269750]t  -C+ ossec13001h Exim Auth failed2025-04-24 16:30:16 dovecot_login authenticator failed for ([112.123.199.111]) [112.123.199.111]:48862: 535 Incorrect authentication data (set_id=purchase)112.123.199.11118149919s  Cg) ossec11309h FTP Authentication success.Apr 24 16:30:15 vm1 pure-ftpd[3059630]: (?@152.59.109.221) [INFO] user@s2seducationtrust.com is now logged in152.59.109.2211269750jr  -a' ossec13001h Exim Auth failed2025-04-24 16:29:54 dovecot_login authenticator failed for ([111.53.129.92]) [111.53.129.92]:58336: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)111.53.129.921814991pq  -i+ ossec13001h Exim Auth failed2025-04-24 16:29:41 dovecot_login authenticator failed for ([113.177.115.252]) [113.177.115.252]:34605: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)113.177.115.2521562822 p  C) ossec11313h FFTP file uploaded to serverApr 24 16:28:13 vm1 pure-ftpd[3058972]: (user@s2seducationtrust.com@152.59.109.221) [NOTICE] /home/techno/public_html/s2seducationtrust.com//sitemap.xml uploaded (6500 bytes, 930.06KB/sec)152.59.109.22112697509o  Cg) ossec11309h FFTP Authentication success.Apr 24 16:28:12 vm1 pure-ftpd[3058972]: (?@152.59.109.221) [INFO] user@s2seducationtrust.com is now logged in152.59.109.2211269750 *\~tj`VLB8.$zpf\H>4*   v l b X N D : 0 &    ~ t j ` V L B 8 . $    z p f \ R H > 4 *  vlb:XND0&|rh^TJ@6,"xndZPF<2( ~jt`VLB8.$zpf\ | r h ^ T J @ 6 , "    x n d Z P F < 2 (   RRH>4*  vlbXND:0& h K h K h FK h K h K h K h K h K h K h K h JK h xK h MK h AK h IK h =K h WK h IK h K h K h K h LK h BK h ~kK h ~aK h }KK h {0K h zK h { K h zrK h yK h yK h yK h yK h xvK h xbK h w-K h w)K h uK h sK h qK h pK h pK h plK h pFK h oK h oK h oK h oK h nK h mK h mAK h m%K h k~K h kVK h kHK h f}K h fwK h fSK h f?K h eK h e[K h eOK h dK h dK h cK h cK h aK h aK h aVK h aJK h `K h `K h `K h `K h _{K~ h _eK} h \K| h VK{ h VKz h VKy h UKx h UKw h UKv h R Ku h RKt h QKs h QKr h QKq h QKp h OKo h O Kn h NKm h NKl h MKk h JxKj h JbKi h GsKh h GYKg h F]Kf h FyKe h FmKd h FkKc h F5Kb h EKa h BK` h BK_ h BdK^ h BZK] h AK\ h @K[ h @KZ h @KY h >KX h >KW h =dKV h 7KU h 7KT h 7WKS h 6KR h 6KQ h 6KP h 6KO h 5@KN h 52KM h 3TKL h 3 h (yK= h (aK< h 'wK; h !K: h !K9 h !K8 h @K7 h 6K6 h K5 h K4 h K3 h K1 h K2 h K0 h K/ h K. h K- h K, h K+ h K* h K) h NK( h ,K' h K& h K% h =K$ h K# h K" h K! h K h K h K h K h uK h 5K h K h K h wK h cK h OK h EK h K h K h K h K h ;K h (K h K h K h K h K h \K h HK h pK h RK h K h K h K h |K h K h K h K h hK h fK h fK h K h K h K h sK h K h K h K h K h -K h %K h K h K h (K h K h K h K h K h K h K h EK h 9K h WK h IK h mK h K h K h K h K h FK h 4K h iK h eK h UK hK hK hK hK hK h7K h!K hJ hJ hJ hJ hJ hJ hJ hJ hzJ hJ h K hJ hJ hJ h rejected RCPT : Sender verify failed185.95.84.71298795S  -7% ossec13001h=Exim Auth failed2025-04-23 16:43:00 dovecot_login authenticator failed for ([5.11.168.195]) [5.11.168.195]:33599: 535 Incorrect authentication data (set_id=purchase)5.11.168.195298795  -+ ossec13001h1Exim Auth failed2025-04-23 16:42:48 dovecot_login authenticator failed for ppp-124-121-162-213.revip2.asianet.co.th [124.121.162.213]:41525: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)124.121.162.2131605651W  -9) ossec13001hyExim Auth failed2025-04-23 16:39:44 dovecot_login authenticator failed for ([183.249.230.27]) [183.249.230.27]:58670: 535 Incorrect authentication data (set_id=sales)183.249.230.271814991i  -g! ossec13001hʧExim Auth failed2025-04-23 16:40:29 dovecot_login authenticator failed for (host-80-241-253-238.customer.magticom.ge) [2.57.219.2]:53208: 535 Incorrect authentication data (set_id=services)2.57.219.2614540p  -m' ossec13001hʗExim Auth failed2025-04-23 16:40:13 dovecot_login authenticator failed for vps-a57cc768.vps.ovh.ca [149.56.141.93]:45190: 535 Incorrect authentication data (set_id=services@heipowersystem.com)149.56.141.936251999g  -[' ossec13001hgExim Auth failed2025-04-23 16:39:26 dovecot_login authenticator failed for ([178.163.29.54]) [178.163.29.54]:53718: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)178.163.29.542017370U  -;' ossec13001hɀExim Auth failed2025-04-23 16:35:36 dovecot_login authenticator failed for ([62.201.212.52]) [62.201.212.52]:54918: 535 Incorrect authentication data (set_id=services)62.201.212.5299237v  -w) ossec13001hvExim Auth failed2025-04-23 16:35:25 dovecot_login authenticator failed for n11923628209.netvigator.com [119.236.28.209]:52300: 535 Incorrect authentication data (set_id=services@heipowersystem.com)119.236.28.2091819730J  -#' ossec13001hExim Auth failed2025-04-23 16:28:44 dovecot_login authenticator failed for (User) [185.93.89.218]:39548: 535 Incorrect authentication data (set_id=account)185.93.89.218130758V~  -9) ossec13001hbExim Auth failed2025-04-23 16:22:17 dovecot_login authenticator failed for ([196.188.187.85]) [196.188.187.85]:50776: 535 Incorrect authentication data (set_id=sales)196.188.187.85337996g}  -[' ossec13001hSExim Auth failed2025-04-23 16:22:03 dovecot_login authenticator failed for ([103.47.74.210]) [103.47.74.210]:53778: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)103.47.74.2101269750 5 + , ] q $T8a  Ai' ossec11302h 5FTP Authentication failed.Apr 24 18:30:22 vm1 pure-ftpd[3087988]: (?@34.34.132.221) [WARNING] Authentication failed for user [anonymous]34.34.132.2212802361&` 3Q' ossec11301h 5New FTP connection.Apr 24 18:30:18 vm1 pure-ftpd[3087988]: (?@34.34.132.221) [INFO] New connection from 34.34.132.22134.34.132.2212802361K_  -%' ossec13001h 5Exim Auth failed2025-04-24 18:29:59 dovecot_login authenticator failed for (User) [185.93.89.218]:38700: 535 Incorrect authentication data (set_id=testmail)185.93.89.218130758Z^  -=+ ossec13001h 4Exim Auth failed2025-04-24 18:24:28 dovecot_login authenticator failed for ([124.106.145.241]) [124.106.145.241]:51649: 535 Incorrect authentication data (set_id=sales)124.106.145.2411694008y]  -' ossec13001h 4wExim Auth failed2025-04-24 18:24:15 dovecot_login authenticator failed for c-73-45-216-101.hsd1.il.comcast.net [73.45.216.101]:37221: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)73.45.216.1016252001T\  -5' ossec13001h 2Exim Auth failed2025-04-24 18:13:47 dovecot_login authenticator failed for ([210.245.95.11]) [210.245.95.11]:41052: 535 Incorrect authentication data (set_id=sales)210.245.95.111562822g[  -[' ossec13001h 1Exim Auth failed2025-04-24 18:13:29 dovecot_login authenticator failed for ([112.182.67.50]) [211.217.50.31]:46873: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)211.217.50.311835841fZ  -Y' ossec13001h 1$Exim Auth failed2025-04-24 18:10:04 dovecot_login authenticator failed for (170.250.128.5.hwccustomers.com) [170.250.128.5]:53376: 535 Incorrect authentication data (set_id=services)170.250.128.56252001ZY  -?) ossec13001h 1Exim Auth failed2025-04-24 18:09:49 dovecot_login authenticator failed for ([120.157.40.146]) [120.157.40.146]:42130: 535 Incorrect authentication data (set_id=services)120.157.40.1462077456mX  -e) ossec13001h 1Exim Auth failed2025-04-24 18:09:33 dovecot_login authenticator failed for ([118.45.101.159]) [118.45.101.159]:58594: 535 Incorrect authentication data (set_id=services@heipowersystem.com)118.45.101.1591835841jW  -_) ossec13001h 0Exim Auth failed2025-04-24 18:07:38 dovecot_login authenticator failed for (109-126-41-234.pptp.vladlink.net) [109.126.41.234]:50084: 535 Incorrect authentication data (set_id=services)109.126.41.2342017370gV  -]% ossec13001h 0Exim Auth failed2025-04-24 18:07:24 dovecot_login authenticator failed for ([37.200.77.33]) [37.200.77.33]:57128: 535 Incorrect authentication data (set_id=services@heipowersystem.com)37.200.77.332017370JU  -#' ossec13001h .KExim Auth failed2025-04-24 17:57:55 dovecot_login authenticator failed for (User) [185.93.89.218]:55282: 535 Incorrect authentication data (set_id=testing)185.93.89.218130758zT  -' ossec13001h -EExim Auth failed2025-04-24 17:53:32 dovecot_login authenticator failed for (6.105.141.116.adsl-pool.jlccptt.net.cn) [116.141.105.6]:50032: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)116.141.105.61814991S  -% ossec13001h -5Exim Auth failed2025-04-24 17:53:17 dovecot_login authenticator failed for c-67-175-11-47.hsd1.il.comcast.net [67.175.11.47]:39082: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)67.175.11.476252001TR  -5' ossec13001h ,Exim Auth failed2025-04-24 17:52:10 dovecot_login authenticator failed for ([61.184.119.61]) [61.184.119.61]:36476: 535 Incorrect authentication data (set_id=sales)61.184.119.611814991mQ  -c+ ossec13001h ,Exim Auth failed2025-04-24 17:51:53 dovecot_login authenticator failed for ([103.194.243.187]) [103.194.243.187]:58389: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)103.194.243.1871269750 f " 3 ` O 1df(D  3U) ossec11301hNew FTP connection.Apr 23 18:06:34 vm1 pure-ftpd[2764888]: (?@106.221.168.78) [INFO] New connection from 106.221.168.78106.221.168.781269750;C  Ck) ossec11309hFTP Authentication success.Apr 23 18:06:34 vm1 pure-ftpd[2764888]: (?@106.221.168.78) [INFO] user@saintsoldiercollege.com is now logged in106.221.168.781269750 B C ) ossec11313hFTP file uploaded to serverApr 23 18:06:34 vm1 pure-ftpd[2764888]: (user@saintsoldiercollege.com@106.221.168.78) [NOTICE] /home/techno/public_html/saintsoldiercollege.com//index.php uploaded (29124 bytes, 357.61KB/sec)106.221.168.781269750 A C ) ossec11313hLFTP file uploaded to serverApr 23 18:04:20 vm1 pure-ftpd[2764412]: (user@saintsoldiercollege.com@106.221.168.78) [NOTICE] /home/techno/public_html/saintsoldiercollege.com//index.php uploaded (29076 bytes, 176.83KB/sec)106.221.168.781269750;@  Ck) ossec11309hLFTP Authentication success.Apr 23 18:04:19 vm1 pure-ftpd[2764412]: (?@106.221.168.78) [INFO] user@saintsoldiercollege.com is now logged in106.221.168.781269750(?  3U) ossec11301hLNew FTP connection.Apr 23 18:04:18 vm1 pure-ftpd[2764412]: (?@106.221.168.78) [INFO] New connection from 106.221.168.78106.221.168.781269750H>  -' ossec13001hRExim Auth failed2025-04-23 18:04:25 dovecot_login authenticator failed for (User) [185.93.89.218]:11170: 535 Incorrect authentication data (set_id=admin)185.93.89.218130758f=  -W) ossec13001h6Exim Auth failed2025-04-23 17:59:41 dovecot_login authenticator failed for ([171.244.185.15]) [171.244.185.15]:57914: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)171.244.185.151562822y<  -}) ossec13001h&Exim Auth failed2025-04-23 17:59:25 dovecot_login authenticator failed for ([196.28.226.123]) [196.28.226.123]:51084: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)196.28.226.1231036973Z;  -=+ ossec13001h܅Exim Auth failed2025-04-23 17:56:45 dovecot_login authenticator failed for ([164.152.240.101]) [164.152.240.101]:53456: 535 Incorrect authentication data (set_id=sales)164.152.240.1013469034d:  -W% ossec13001hyExim Auth failed2025-04-23 17:56:33 dovecot_login authenticator failed for ([41.231.85.75]) [41.231.85.75]:36902: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)41.231.85.752464461(9  3U) ossec11301hsNew FTP connection.Apr 23 17:52:09 vm1 pure-ftpd[2761902]: (?@106.221.168.78) [INFO] New connection from 106.221.168.78106.221.168.781269750;8  Ck) ossec11309hsFTP Authentication success.Apr 23 17:52:10 vm1 pure-ftpd[2761902]: (?@106.221.168.78) [INFO] user@saintsoldiercollege.com is now logged in106.221.168.781269750 7  C ) ossec11313hsFTP file uploaded to serverApr 23 17:52:11 vm1 pure-ftpd[2761902]: (user@saintsoldiercollege.com@106.221.168.78) [NOTICE] /home/techno/public_html/saintsoldiercollege.com//index.php uploaded (29081 bytes, 370.79KB/sec)106.221.168.781269750N6  -+' ossec13001hExim Auth failed2025-04-23 17:46:25 dovecot_login authenticator failed for (spd.net.tr) [178.20.231.54]:63889: 535 Incorrect authentication data (set_id=sales)178.20.231.54298795j5  -_) ossec13001hExim Auth failed2025-04-23 17:46:14 dovecot_login authenticator failed for ([113.64.211.128]) [113.64.211.128]:58553: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)113.64.211.1281814991b4  -U# ossec13001hWExim Auth failed2025-04-23 17:43:10 dovecot_login authenticator failed for (46-44-24-40.silinet.ru) [46.44.24.40]:60681: 535 Incorrect authentication data (set_id=vikas.khandelwal)46.44.24.402017370r3  -q' ossec13001hMExim Auth failed2025-04-23 17:43:00 dovecot_login authenticator failed for ([171.79.124.24]) [171.79.124.24]:42651: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)171.79.124.241269750 fFh {&{"content":[{"rule":"11313","retries":1,"severity":3,"name":"FTP file uploaded to server","message":"Apr 25 17:37:37 vm1 pure-ftpd[3400562]: (user@amplifypowerglobal.com@171.79.150.205) [NOTICE] /home/techno/public_html/amplifypowerglobal.com//config.php uploaded (106 bytes, 26.01KB/sec)","attackers_ip":"171.79.150.205","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745582859,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":true,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"11075","retries":1,"severity":3,"name":"FTP file manipulations","message":"Fri Apr 25 17:37:37 2025 0 171.79.150.205 106 /home/techno/public_html/amplifypowerglobal.com/config.php a _ i r user@amplifypowerglobal.com ftp 1 * c","attackers_ip":"171.79.150.205","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":["noshow"],"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745582859,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":true,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"11309","retries":1,"severity":3,"name":"FTP Authentication success.","message":"Apr 25 17:37:37 vm1 pure-ftpd[3400562]: (?@171.79.150.205) [INFO] user@amplifypowerglobal.com is now logged in","attackers_ip":"171.79.150.205","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745582859,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":true,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 17:37:43 dovecot_login authenticator failed for c151-177-95-27.bredband.tele2.se [151.177.95.27]:36002: 535 Incorrect authentication data (set_id=services@heipowersystem.com)","attackers_ip":"151.177.95.27","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745582863,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 17:37:55 dovecot_login authenticator failed for ([185.216.192.16]) [185.216.192.16]:59464: 535 Incorrect authentication data (set_id=services)","attackers_ip":"185.216.192.16","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745582875,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 17:37:28 dovecot_login authenticator failed for (customer-gdl-135-105.megared.net.mx) [177.231.135.105]:34966: 535 Incorrect authentication data (set_id=services)","attackers_ip":"177.231.135.105","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745582849,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"11301","retries":1,"severity":3,"name":"New FTP connection.","message":"Apr 25 17:37:36 vm1 pure-ftpd[3400562]: (?@171.79.150.205) [INFO] New connection from 171.79.150.205","attackers_ip":"171.79.150.205","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745582857,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":true,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0} V ? q Y j  D;V`  -O% ossec13001hExim Auth failed2025-04-23 20:26:39 dovecot_login authenticator failed for ([85.93.42.104]) [85.93.42.104]:42638: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)85.93.42.1042017370  -' ossec13001hExim Auth failed2025-04-23 20:26:28 dovecot_login authenticator failed for (51.241.220.60.adsl-pool.sx.cn) [60.220.241.50]:60017: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)60.220.241.501814991W  -9) ossec13001hExim Auth failed2025-04-23 20:22:19 dovecot_login authenticator failed for ([45.118.136.243]) [45.118.136.243]:50053: 535 Incorrect authentication data (set_id=sales)45.118.136.2431562822r  -o) ossec13001hExim Auth failed2025-04-23 20:22:04 dovecot_login authenticator failed for 182-155-192-25.veetime.com [182.155.192.25]:47522: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)182.155.192.251668284L  -'' ossec13001hExim Auth failed2025-04-23 20:11:02 dovecot_login authenticator failed for (User) [185.93.89.218]:45366: 535 Incorrect authentication data (set_id=comercial)185.93.89.218130758e  -S+ ossec13001h7Exim Auth failed2025-04-23 20:03:26 dovecot_login authenticator failed for ([178.178.194.126]) [178.178.194.126]:44000: 535 Incorrect authentication data (set_id=vikas.khandelwal)178.178.194.1262017370r  -q' ossec13001h!Exim Auth failed2025-04-23 20:03:04 dovecot_login authenticator failed for ([83.219.250.17]) [83.219.250.17]:44128: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)83.219.250.172661886Z  -C' ossec13001hExim Auth failed2025-04-23 20:01:02 dovecot_login authenticator failed for broad2124.cyberia.net.lb [212.28.225.92]:50424: 535 Incorrect authentication data (set_id=sales)212.28.225.92272103h~  -]' ossec13001hExim Auth failed2025-04-23 20:00:45 dovecot_login authenticator failed for ([114.242.172.76]) [61.51.184.194]:53694: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)61.51.184.1941814991h}  -[) ossec13001hExim Auth failed2025-04-23 19:56:36 dovecot_login authenticator failed for (108.174.182.41.douglasfast.net) [108.174.182.41]:49814: 535 Incorrect authentication data (set_id=services)108.174.182.416252001c|  -W# ossec13001hExim Auth failed2025-04-23 19:56:22 dovecot_login authenticator failed for ([223.82.86.2]) [223.82.86.2]:9618: 535 Incorrect authentication data (set_id=services@heipowersystem.com)223.82.86.21814991j{  -c% ossec13001hExim Auth failed2025-04-23 19:40:31 dovecot_login authenticator failed for 181sdl30m44.codetel.net.do [66.98.79.181]:48998: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)66.98.79.1813508796z  -1+ ossec13001hExim Auth failed2025-04-23 19:40:20 dovecot_login authenticator failed for (host-static-178-132-144-161.moldtelecom.md) [178.132.144.161]:3810: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)178.132.144.161617790Iy  -!' ossec13001hExim Auth failed2025-04-23 19:39:19 dovecot_login authenticator failed for (User) [185.93.89.218]:23872: 535 Incorrect authentication data (set_id=clamav)185.93.89.218130758Wx  -9) ossec13001hExim Auth failed2025-04-23 19:39:11 dovecot_login authenticator failed for ([183.108.79.230]) [183.108.79.230]:55864: 535 Incorrect authentication data (set_id=sales)183.108.79.2301835841gw  -[' ossec13001hzExim Auth failed2025-04-23 19:38:57 dovecot_login authenticator failed for ([45.238.133.92]) [45.238.133.92]:37719: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)45.238.133.923469034tv  -s) ossec13001hExim Auth failed2025-04-23 19:30:58 dovecot_login authenticator failed for c-69-242-149-240.hsd1.mo.comcast.net [69.242.149.240]:34734: 535 Incorrect authentication data (set_id=vikas.khandelwal)69.242.149.2406252001 - - S-6h w{"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-26 21:44:12 dovecot_login authenticator failed for ([65.20.129.71]) [65.20.129.71]:35727: 535 Incorrect authentication data (set_id=services@heipowersystem.com)","attackers_ip":"65.20.129.71","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745684053,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-26 21:44:37 dovecot_login authenticator failed for (171-118-158-5.pride-net.ru) [5.158.118.171]:50992: 535 Incorrect authentication data (set_id=services)","attackers_ip":"5.158.118.171","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745684078,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}:nh ;{"content":[{"rule":"11301","retries":12,"severity":3,"name":"New FTP connection.","message":"Apr 26 21:43:11 vm1 pure-ftpd[3833073]: (?@35.216.165.97) [INFO] New connection from 35.216.165.97","attackers_ip":"35.216.165.97","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745683992,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"11307","retries":1,"severity":3,"name":"Multiple connection attempts from same source","message":"Apr 26 21:43:16 vm1 pure-ftpd[3833088]: (?@35.216.165.97) [INFO] New connection from 35.216.165.97","attackers_ip":"35.216.165.97","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745683998,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}FQh {"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-26 21:07:36 dovecot_login authenticator failed for (User) [185.93.89.218]:19692: 535 Incorrect authentication data (set_id=prueba)","attackers_ip":"185.93.89.218","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745681857,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}T"h {"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-26 21:40:23 dovecot_login authenticator failed for (User) [185.93.89.218]:39882: 535 Incorrect authentication data (set_id=reception)","attackers_ip":"185.93.89.218","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745683823,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0} %~qdWJ=0# zm`SF9, v i \ O B 5 (     r e X K > 1 $  { n a T G : -   w j ] P C 6 )    s f Y L ? 2 % 1562822D 1562822D` 1562822D) 1562822C 1562822C 1562822C 1562822Aa 1562822A` 1562822A_ 1562822A^ 1562822A] 1562822? 1562822? 1562822? 1562822? 1562822> 1562822> 1562822>H 1562822>G 1562822>F 1562822>E 1562822>D 1562822= 1562822= 1562822= 1562822; 1562822: 1562822: 1562822: 1562822: 15628229\ 15628229 15628228f 15628228F 15628228 15628227 156282275 15628226 15628225 156282255 15628224e 15628221 1562822/ 1562822/X 1562822- 1562822- 1562822, 1562822, 1562822, 1562822, 1562822,# 1562822+u 1562822* 1562822* 1562822*7 1562822* 1562822) 1562822)z 1562822(` 1562822' 1562822'a 1562822& 1562822% 1562822%q 1562822% 1562822#m 1562822!P 1562822!O 1562822 1562822 1562822? 1562822 1562822{ 1562822 1562822T 1562822Q 1562822B 1562822 1562822 1562822 1562822 1562822 1562822 1562822 1562822s 1562822p 1562822 1562822> 1562822 1562822 1562822z 1562822h 1562822: 15628224 1562822 1562822 1562822 1562822 1562822 1562822 1562822 1562822. 1562822 1562822e 1562822 1562822 1562822 1562822 1562822 1562822 1562822 1562822 g 1562822 1562822 / 1562822 1562822 1562822 6 1562822 1562822 1562822 i 1562822 g 1562822 . 1562822  1562822? 1562822& 1562822 1562822 1562822 1562822 1562822 1562822 1562822 1562822 1562822 1562822    I Q ?p\ rejected RCPT : Sender verify failed78.153.140.2072635167 a  C) ossec11313hFTP file uploaded to serverApr 23 18:46:02 vm1 pure-ftpd[2773231]: (user@saintsoldiercollege.com@106.221.168.78) [NOTICE] /home/techno/public_html/saintsoldiercollege.com//Head_web.php uploaded (5 bytes, 6.72KB/sec)106.221.168.781269750(`  3U) ossec11301hNew FTP connection.Apr 23 18:46:01 vm1 pure-ftpd[2773231]: (?@106.221.168.78) [INFO] New connection from 106.221.168.78106.221.168.781269750;_  Ck) ossec11309hFTP Authentication success.Apr 23 18:46:01 vm1 pure-ftpd[2773231]: (?@106.221.168.78) [INFO] user@saintsoldiercollege.com is now logged in106.221.168.781269750^ C) ossec11313hpFTP file uploaded to serverApr 23 18:43:18 vm1 pure-ftpd[2772655]: (user@saintsoldiercollege.com@106.221.168.78) [NOTICE] /home/techno/public_html/saintsoldiercollege.com//Head_web.php uploaded (19037 bytes, 108.95KB/sec)106.221.168.781269750(]  3U) ossec11301hnNew FTP connection.Apr 23 18:43:17 vm1 pure-ftpd[2772655]: (?@106.221.168.78) [INFO] New connection from 106.221.168.78106.221.168.781269750;\  Ck) ossec11309hnFTP Authentication success.Apr 23 18:43:17 vm1 pure-ftpd[2772655]: (?@106.221.168.78) [INFO] user@saintsoldiercollege.com is now logged in106.221.168.781269750K[  -)! ossec13001h`Exim Auth failed2025-04-23 18:43:04 dovecot_login authenticator failed for ([78.36.2.54]) [78.36.2.54]:54288: 535 Incorrect authentication data (set_id=sales)78.36.2.542017370sZ  -u% ossec13001hVExim Auth failed2025-04-23 18:42:54 dovecot_login authenticator failed for wsip-68-15-163-18.no.no.cox.net [68.15.163.18]:57552: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)68.15.163.186252001JY  -#' ossec13001hExim Auth failed2025-04-23 18:36:04 dovecot_login authenticator failed for (User) [185.93.89.218]:64632: 535 Incorrect authentication data (set_id=admin01)185.93.89.218130758iX  -_' ossec13001hEExim Auth failed2025-04-23 18:34:05 dovecot_login authenticator failed for c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:46022: 535 Incorrect authentication data (set_id=services)76.132.238.436252001|W  -) ossec13001h9Exim Auth failed2025-04-23 18:33:53 dovecot_login authenticator failed for mobile-user-c3a5b5-16.dhcp.inet.fi [195.165.181.16]:57494: 535 Incorrect authentication data (set_id=services@heipowersystem.com)195.165.181.16660013rV  -o) ossec13001hExim Auth failed2025-04-23 18:33:01 dovecot_login authenticator failed for (m182-153-173-49.smartone.com) [182.153.173.49]:52434: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)182.153.173.491819730}U  -' ossec13001hExim Auth failed2025-04-23 18:32:48 dovecot_login authenticator failed for 119247124004.ctinets.com [119.247.124.4]:65404: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)119.247.124.41819730  w GnVh s-{"content":[{"rule":"11009","retries":2,"severity":4,"name":"WHM login success","message":"[2025-04-25 17:03:29 +0530] info [whostmgrd] 103.190.54.25 NEW root:VkibSSSD86sVDfw5 address=103.190.54.25,app=whostmgrd,creator=root,method=handle_form_login,path=form,possessed=0","attackers_ip":"103.190.54.25","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745580809,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":true,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"11006","retries":1,"severity":4,"name":"cPanel login success","message":"[2025-04-25 17:03:39 +0530] info [cpaneld] 103.190.54.25 NEW techno:7BG3bktMbTuWN_nd address=103.190.54.25,app=cpaneld,creator=techno,method=handle_form_login,path=loadsession:techno:BXfvGYj3fdHEGkZa,possessed=1,possessor=root","attackers_ip":"103.190.54.25","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745580819,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":true,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}_8h eZ{"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 16:04:45 dovecot_login authenticator failed for (rokamauka.com) [202.107.197.211]:34986: 535 Incorrect authentication data (set_id=nologin)","attackers_ip":"202.107.197.211","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745577286,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0},Rh Qm{"content":[{"rule":"11301","retries":1,"severity":3,"name":"New FTP connection.","message":"Apr 25 14:39:46 vm1 pure-ftpd[3360544]: (?@20.65.194.168) [INFO] New connection from 20.65.194.168","attackers_ip":"20.65.194.168","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745572189,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}}h Bm{"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 13:35:09 dovecot_login authenticator failed for (151.237.115.206.pronet.bg) [151.237.115.206]:54752: 535 Incorrect authentication data (set_id=sales)","attackers_ip":"151.237.115.206","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745568309,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 13:35:33 dovecot_login authenticator failed for ([101.13.5.37]) [101.13.5.37]:35646: 535 Incorrect authentication data (set_id=sales)","attackers_ip":"101.13.5.37","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745568333,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0} s MsCV&h ̊{"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 05:12:53 dovecot_login authenticator failed for ([101.229.184.223]) [101.229.184.223]:58730: 535 Incorrect authentication data (set_id=sales)","attackers_ip":"101.229.184.223","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745538174,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 05:12:20 dovecot_login authenticator failed for ([177.25.59.5]) [177.25.59.5]:43324: 535 Incorrect authentication data (set_id=sales)","attackers_ip":"177.25.59.5","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745538140,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 05:12:20 dovecot_login authenticator failed for (User) [185.93.89.218]:35538: 535 Incorrect authentication data (set_id=fax)","attackers_ip":"185.93.89.218","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745538140,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 05:12:24 dovecot_login authenticator failed for c-73-95-112-29.hsd1.co.comcast.net [73.95.112.29]:57326: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)","attackers_ip":"73.95.112.29","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745538144,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}/Xh N{"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 05:11:52 dovecot_login authenticator failed for 111-70-49-188.emome-ip.hinet.net [111.70.49.188]:57177: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)","attackers_ip":"111.70.49.188","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745538112,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 05:12:04 dovecot_login authenticator failed for ([185.226.88.5]) [185.226.88.5]:53164: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)","attackers_ip":"185.226.88.5","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745538124,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0} *\~tj`VLB8.$zpf\H>4*   v l b X N D : 0 &    ~ t j ` V L B 8 . $    z p R H f \ > 4 *  vlbXN&D:0|rh^TJ@6,"xndZPF<2( ~tj`VLB8.$zpf\ | r h ^ T J @ 6 , "    x n d Z P F < 2 (   RRH>4*  vlbXND:0& h CL h AL h AL h @L h @L h =WL h =%L h =L h =L h L` h 4La h L_ h L^ h L] h L\ h `L[ h JLZ h HLY h LW h LX h LU h LV h LT h LS h LR h LQ h 4LP h (LO h LL h LN h LM h LK h a h yL= h L< h L; h L: h L9 h L8 h L7 h $L6 h L5 h ^L4 h ,L3 h L2 h VL1 h sL0 h cL/ h )L. h L- h CL, h 5L+ h L* h 6L) h *L( h L' h L& h UL% h CL$ h 3L" h %L# h vL! h bM h lL h dL h L h rL h ޻L h ޱL h ދL h kL h ܋L h L h L h WL h ML h ;L h /L h L h L h xL h L h ӸL h ӬL h ӢL h L h L h L h L h L h L h L h L h L h L h BL h 4*   v l b X N D : 0 &    ~ t j ` V L B 8 . $    z p f \ R H > 4 *  vlbXD:0N&|rh^TJ@6,"xndZPF<2( ~tj`VLB8.$zpf\ | r h ^ T J @ 6 , "    x n d Z P F < 2 (   vlbXND:0&zpf\R h uN h JN h >N h N h N h N h N h N h N h N h ?N h 5N h iN h N h N h N h N h N h N h N h /N h /N h +N h !N h N h N h N h N h N h N h mN h N h M h M h M h M h LM h :M h .M h CM h M h M h M h M h M h M h M h M h M h M h M h 4M h &M h M h M h M h M h M h M h M h M h M h mM h M h M h cM h M h M h ݪM h ݶM h ܸM h ܮM h fM h VM h lM h ؛M h ؙM h M h +M h M h ։M h M h хM h wM h oM h eM h YM h M h M h M h cM h fM h @M h 6M h M h M h ̎M h ̴M h `M h \M h \M h ~M h LM h @M h M h nM h ^M h RM h ʲM h ʤM h ʘM h ʄM h M h M h 3M h +M h M h M h M h M h M h SM h M h M h M h vM h M h M h M h M h M h M h M h M h M h M h M h M h M h M h M h M h M h M h M h M h ~M h rM h aM h PM h M h M h !M h M h EM h M h M h M h M h M h nM h M~ h M} h M| h mM{ h ^Mz h 8My h Mx h Mw h Mv h (NK h 'NI h 'zNH h &NG h $dNF h $ZNE h !NB h !NA h !ND h !NC h N@ h N? h N> h 4N= h &N< h  N9 h  N8 h N; h N: h N6 h N7 h |N5 h fN4 h N3 h N2 h N1 h N0 h iN/ h _N. h ?N- h #N, h N+ h N* h pN) h N( h N' h  N& h  N% h N$ h N# h N" h N! h N h JMu h Mt h Ms h IMr h Mq h Mp h Mn h Mo h Mm h Ml h Mk h xMj h Mi h |Mh h Mg h Mf h Me h Md h Mc h Mb h Ma h }M` h hM_ h >M^ h CM] h %M\ h M[ h MZ h MY h {MX h MW h MV h MU h MT h vMS h dMR h MQ h MP h MO h MN h [MM h CML h MK h hMJ h TMI h FMH h 6MG h MF h ME h 0MD h MC h MB h }GMA h }3M@ h |M> h |M? h {M= h {M< h zM; h yM: h uKM9 h rM8 h r M7 h qM6 h q"M5 h mEM4 h m5M3 h lM2 h lM1 h k!M0 h kM/ h jM. h jM- h eEM, h e1M+ h dM* h dM) h dM( h cM& h cM% h cM' h c M$ h b/M# h b&M" BV ?VVsv`h {"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 06:42:33 dovecot_login authenticator failed for (customer.chcoilx1.pop.starlinkisp.net) [129.222.28.111]:17617: 535 Incorrect authentication data (set_id=sales)","attackers_ip":"129.222.28.111","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745543553,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}qu\h e{"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 06:42:03 dovecot_login authenticator failed for ([175.156.226.36]) [175.156.226.36]:51504: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)","attackers_ip":"175.156.226.36","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745543523,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}fx h {"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 07:50:46 dovecot_login authenticator failed for ([211.93.6.230]) [211.93.6.230]:53220: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)","attackers_ip":"211.93.6.230","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745547647,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 07:50:55 dovecot_login authenticator failed for ([94.200.80.226]) [94.200.80.226]:43027: 535 Incorrect authentication data (set_id=purchase)","attackers_ip":"94.200.80.226","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745547657,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}=rth {"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 07:42:41 dovecot_login authenticator failed for ([85.122.56.15]) [85.122.56.15]:41071: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)","attackers_ip":"85.122.56.15","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745547163,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 07:42:57 dovecot_login authenticator failed for (SCZ-181-188-149-00243.tigo.bo) [181.188.149.243]:48242: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)","attackers_ip":"181.188.149.243","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745547179,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}  ';lzu  -' ossec13001hExim Auth failed2025-04-23 19:30:41 dovecot_login authenticator failed for 24.115.19.225.res-cmts.sm3.ptd.net [24.115.19.225]:57912: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)24.115.19.2256252001Tt  -5' ossec13001hExim Auth failed2025-04-23 19:19:40 dovecot_login authenticator failed for ([218.55.177.39]) [218.55.177.39]:54462: 535 Incorrect authentication data (set_id=sales)218.55.177.391835841js  -_) ossec13001hExim Auth failed2025-04-23 19:19:28 dovecot_login authenticator failed for ([178.178.222.52]) [178.178.222.52]:44810: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)178.178.222.522017370r  ;) ossec13008h<Mail Recipient rejected2025-04-23 19:16:36 H=(localhost.localdomain) [78.153.140.207]:35114 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no F= rejected RCPT : Sender verify failed78.153.140.2072635167[q  -A) ossec13001hExim Auth failed2025-04-23 19:09:57 dovecot_login authenticator failed for ([120.238.250.162]) [121.33.189.210]:47074: 535 Incorrect authentication data (set_id=services)121.33.189.2101814991mp  -e) ossec13001hExim Auth failed2025-04-23 19:09:38 dovecot_login authenticator failed for ([221.234.48.147]) [221.234.48.147]:35490: 535 Incorrect authentication data (set_id=services@heipowersystem.com)221.234.48.1471814991Jo  -#' ossec13001h(Exim Auth failed2025-04-23 19:07:43 dovecot_login authenticator failed for (User) [185.93.89.218]:14472: 535 Incorrect authentication data (set_id=billing)185.93.89.218130758gn  -]% ossec13001h%Exim Auth failed2025-04-23 18:59:08 dovecot_login authenticator failed for ([102.53.15.56]) [102.53.15.56]:56471: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)102.53.15.562542007lm  -c) ossec13001h7Exim Auth failed2025-04-23 18:59:27 dovecot_login authenticator failed for syn-076-176-252-225.res.spectrum.com [76.176.252.225]:39218: 535 Incorrect authentication data (set_id=purchase)76.176.252.2256252001Wl  -9) ossec13001hExim Auth failed2025-04-23 18:53:14 dovecot_login authenticator failed for ([221.181.210.98]) [221.181.210.98]:38362: 535 Incorrect authentication data (set_id=sales)221.181.210.981814991jk  -_) ossec13001hExim Auth failed2025-04-23 18:52:57 dovecot_login authenticator failed for ([171.50.144.113]) [171.50.144.113]:57604: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)171.50.144.1131269750j  C) ossec11313hFTP file uploaded to serverApr 23 18:49:16 vm1 pure-ftpd[2773737]: (user@saintsoldiercollege.com@106.221.168.78) [NOTICE] /home/techno/public_html/saintsoldiercollege.com//Head_web.php uploaded (19306 bytes, 375.07KB/sec)106.221.168.781269750ui  -u) ossec13001hExim Auth failed2025-04-23 18:49:08 dovecot_login authenticator failed for node-184t.pool-125-27.dynamic.totinternet.net [125.27.223.109]:60104: 535 Incorrect authentication data (set_id=services)125.27.223.1091605651 h  C ) ossec11313hFTP file uploaded to serverApr 23 18:49:03 vm1 pure-ftpd[2773737]: (user@saintsoldiercollege.com@106.221.168.78) [NOTICE] /home/techno/public_html/saintsoldiercollege.com//index.php uploaded (29042 bytes, 354.38KB/sec)106.221.168.781269750sg EW) ossec11314hFTP file deleted from serverApr 23 18:48:56 vm1 pure-ftpd[2773819]: (user@saintsoldiercollege.com@106.221.168.78) [NOTICE] Deleted /home/techno/public_html/saintsoldiercollege.com//Head_web.php106.221.168.781269750f  -' ossec13001hExim Auth failed2025-04-23 18:48:51 dovecot_login authenticator failed for (nsg-corporate-70.104.187.122.airtel.in) [117.250.250.2]:33364: 535 Incorrect authentication data (set_id=services@heipowersystem.com)117.250.250.21269750  }fFh {"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 09:38:09 dovecot_login authenticator failed for ([14.53.126.112]) [14.53.126.112]:54158: 535 Incorrect authentication data (set_id=vikas.khandelwal)","attackers_ip":"14.53.126.112","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745554089,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}vfh {"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 09:37:49 dovecot_login authenticator failed for ([58.16.49.250]) [58.16.49.250]:40675: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)","attackers_ip":"58.16.49.250","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745554069,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}2^h @{"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 09:31:57 dovecot_login authenticator failed for 46-162-104-66.cust.bredband2.com [46.162.104.66]:52764: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)","attackers_ip":"46.162.104.66","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745553717,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 09:32:07 dovecot_login authenticator failed for ([65.20.253.17]) [65.20.253.17]:48958: 535 Incorrect authentication data (set_id=vikas.khandelwal)","attackers_ip":"65.20.253.17","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745553727,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}O|h {"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 09:28:32 dovecot_login authenticator failed for (User) [185.93.89.218]:10284: 535 Incorrect authentication data (set_id=mail)","attackers_ip":"185.93.89.218","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745553513,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}  P h {"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 09:47:34 dovecot_login authenticator failed for ([175.162.114.139]) [175.162.114.139]:39146: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)","attackers_ip":"175.162.114.139","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745554654,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 09:47:53 dovecot_login authenticator failed for ([8.155.38.230]) [49.77.14.208]:35382: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)","attackers_ip":"49.77.14.208","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745554674,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 09:48:04 dovecot_login authenticator failed for c188-150-54-235.bredband.tele2.se [188.150.54.235]:48490: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)","attackers_ip":"188.150.54.235","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745554684,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}, Rh {"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 09:46:12 dovecot_login authenticator failed for (r552pc2.ee.ntu.edu.tw) [131.107.8.114]:55755: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)","attackers_ip":"131.107.8.114","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745554572,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 09:46:33 dovecot_login authenticator failed for 123-193-152-64.dynamic.kbronet.com.tw [123.193.152.64]:35554: 535 Incorrect authentication data (set_id=sales)","attackers_ip":"123.193.152.64","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745554594,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0} U  8 <cii  -]) ossec13001h pExim Auth failed2025-04-24 04:29:40 dovecot_login authenticator failed for ([222.128.44.171]) [222.128.44.171]:2080: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)222.128.44.1711814991m  -c+ ossec13001h pExim Auth failed2025-04-24 04:29:18 dovecot_login authenticator failed for ([123.210.134.125]) [123.210.134.125]:55196: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)123.210.134.1252077456b  -O) ossec13001h plExim Auth failed2025-04-24 04:27:46 dovecot_login authenticator failed for ([113.117.83.195]) [116.16.244.229]:21659: 535 Incorrect authentication data (set_id=vikas.khandelwal)116.16.244.2291814991"  -Q' ossec13001h pFExim Auth failed2025-04-24 04:27:08 dovecot_login authenticator failed for 47-206-63-169.e8235131806a02dcb1fe9c7a57eaaeb8.ip.frontiernet.net [47.206.63.169]:43132: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)47.206.63.1696252001Q  -3# ossec13001h oExim Auth failed2025-04-24 04:25:02 dovecot_login authenticator failed for ([1.31.80.166]) [1.31.80.166]:52913: 535 Incorrect authentication data (set_id=purchase)1.31.80.1661814991f  -[% ossec13001h oExim Auth failed2025-04-24 04:24:30 dovecot_login authenticator failed for ([36.112.75.46]) [36.112.75.46]:7912: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)36.112.75.461814991e  -S+ ossec13001h oExim Auth failed2025-04-24 04:22:04 dovecot_login authenticator failed for ([117.198.103.116]) [117.198.103.116]:38103: 535 Incorrect authentication data (set_id=vikas.khandelwal)117.198.103.1161269750u  -u) ossec13001h oExim Auth failed2025-04-24 04:21:49 dovecot_login authenticator failed for ([128.185.12.179]) [128.185.12.179]:60864: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)128.185.12.1791269750T  -5' ossec13001h nExim Auth failed2025-04-24 04:17:27 dovecot_login authenticator failed for ([36.134.78.151]) [36.134.78.151]:43687: 535 Incorrect authentication data (set_id=sales)36.134.78.1511814991w  -{' ossec13001h mExim Auth failed2025-04-24 04:17:08 dovecot_login authenticator failed for h87-96-158-252.cust.bredband2.com [87.96.158.252]:56114: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)87.96.158.2522661886`  -O% ossec13001h mAExim Auth failed2025-04-24 04:14:16 dovecot_login authenticator failed for (rokamauka.com) [119.96.131.8]:51860: 535 Incorrect authentication data (set_id=service@rokamauka.com)119.96.131.81814991R  -3% ossec13001h m%Exim Auth failed2025-04-24 04:13:49 dovecot_login authenticator failed for (rokamauka.com) [119.96.131.8]:46842: 535 Incorrect authentication data (set_id=nologin)119.96.131.81814991K  -%' ossec13001h k~Exim Auth failed2025-04-24 04:06:45 dovecot_login authenticator failed for (User) [185.93.89.218]:20748: 535 Incorrect authentication data (set_id=mailtest)185.93.89.218130758T  -7% ossec13001h kVExim Auth failed2025-04-24 04:06:05 dovecot_login authenticator failed for ([125.90.72.62]) [125.90.72.62]:57227: 535 Incorrect authentication data (set_id=services)125.90.72.621814991v  -{% ossec13001h kHExim Auth failed2025-04-24 04:05:51 dovecot_login authenticator failed for wsip-174-79-82-26.br.br.cox.net [174.79.82.26]:33025: 535 Incorrect authentication data (set_id=services@heipowersystem.com)174.79.82.2662520018  Ai' ossec11302h f}FTP Authentication failed.Apr 24 03:45:24 vm1 pure-ftpd[2890047]: (?@34.78.196.158) [WARNING] Authentication failed for user [anonymous]34.78.196.1582802361& 3Q' ossec11301h fwNew FTP connection.Apr 24 03:45:18 vm1 pure-ftpd[2890047]: (?@34.78.196.158) [INFO] New connection from 34.78.196.15834.78.196.1582802361    7 . A?p6IN+S  3Y+ ossec11301h fNew FTP connection.Apr 24 09:09:17 vm1 pure-ftpd[2962009]: (?@106.207.151.191) [INFO] New connection from 106.207.151.191106.207.151.1911269750=R  Cm+ ossec11309h fFTP Authentication success.Apr 24 09:09:17 vm1 pure-ftpd[2962009]: (?@106.207.151.191) [INFO] user@saintsoldiercollege.com is now logged in106.207.151.1911269750vQ  -y' ossec13001h Exim Auth failed2025-04-24 08:57:42 dovecot_login authenticator failed for ([183.249.1.112]) [183.249.1.112]:58704: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)183.249.1.1121814991hP  -_% ossec13001h Exim Auth failed2025-04-24 08:57:52 dovecot_login authenticator failed for (22.32.117.87.donpac.ru) [87.117.32.22]:50158: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)87.117.32.222017370HO  -) ossec13001h Exim Auth failed2025-04-24 08:56:59 dovecot_login authenticator failed for ([39.129.133.184]) [39.129.133.184]:40582: 535 Incorrect authentication data39.129.133.1841814991sN  -w# ossec13001h sExim Auth failed2025-04-24 08:56:42 dovecot_login authenticator failed for c-24-7-216-47.hsd1.mn.comcast.net [24.7.216.47]:52300: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)24.7.216.476252001IM  -!' ossec13001h Exim Auth failed2025-04-24 08:55:02 dovecot_login authenticator failed for (User) [185.93.89.218]:19696: 535 Incorrect authentication data (set_id=prueba)185.93.89.218130758"L  3M% ossec11301h New FTP connection.Apr 24 08:50:26 vm1 pure-ftpd[2958131]: (?@80.64.30.193) [INFO] New connection from 80.64.30.19380.64.30.1932017370JK  -#' ossec13001h Exim Auth failed2025-04-24 08:23:06 dovecot_login authenticator failed for (User) [185.93.89.218]:28936: 535 Incorrect authentication data (set_id=printer)185.93.89.218130758}J  -' ossec13001h Exim Auth failed2025-04-24 07:11:52 dovecot_login authenticator failed for ip-213-124-221-2.ip.prioritytelecom.net [213.124.221.2]:57300: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)213.124.221.22750405hI  -a' ossec13001h Exim Auth failed2025-04-24 07:07:25 dovecot_login authenticator failed for ([65.20.235.177]) [65.20.235.177]:45896: 535 Incorrect authentication data (set_id=services@heipowersystem.com)65.20.235.17799237H  -+ ossec13001h Exim Auth failed2025-04-24 06:59:32 dovecot_login authenticator failed for net-188-219-104-210.cust.vodafonedsl.it [188.219.104.210]:60764: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)188.219.104.2103175395]G  -C+ ossec13001h FExim Auth failed2025-04-24 06:56:30 dovecot_login authenticator failed for ([103.106.154.133]) [103.106.154.133]:47001: 535 Incorrect authentication data (set_id=purchase)103.106.154.1331269750jF  -a' ossec13001h Exim Auth failed2025-04-24 06:55:34 dovecot_login authenticator failed for ([39.165.183.70]) [39.165.183.70]:48360: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)39.165.183.701814991iE  -_) ossec13001h Exim Auth failed2025-04-24 06:42:15 dovecot_login authenticator failed for ([212.90.111.127]) [212.90.111.127]:50693: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)212.90.111.127294640kD  -i# ossec13001h Exim Auth failed2025-04-24 06:34:15 dovecot_login authenticator failed for ([5.30.182.35]) [5.30.182.35]:39490: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)5.30.182.35290557C  5++ ossec11011h WHM SSO login failed[2025-04-24 06:32:06 +0530] info [whostmgrd] 106.207.160.102 PURGE root:vOdu8G_12IrOjjgg badpass [cookie ip check: IP address has changed: IP Address [106.221.168.78] != Current IP Address [106.207.160.102]]106.207.160.1021269750  < A R Q _ p  '  -#' ossec13001h ,Exim Auth failed2025-04-23 21:54:12 dovecot_login authenticator failed for 6.112.255.173.bc.googleusercontent.com [173.255.112.6]:37708: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)173.255.112.66252001i&  -]) ossec13001h Exim Auth failed2025-04-23 21:53:00 dovecot_login authenticator failed for syn-066-169-194-115.res.spectrum.com [66.169.194.115]:51057: 535 Incorrect authentication data (set_id=sales)66.169.194.1156252001j%  -_) ossec13001h Exim Auth failed2025-04-23 21:52:49 dovecot_login authenticator failed for ([120.157.57.136]) [120.157.57.136]:39940: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)120.157.57.1362077456G$  -' ossec13001h =Exim Auth failed2025-04-23 21:45:57 dovecot_login authenticator failed for (User) [185.93.89.218]:3138: 535 Incorrect authentication data (set_id=david)185.93.89.218130758_#  -K' ossec13001h Exim Auth failed2025-04-23 21:45:01 dovecot_login authenticator failed for ([183.47.48.178]) [183.47.48.178]:43035: 535 Incorrect authentication data (set_id=vikas.khandelwal)183.47.48.1781814991{"  -# ossec13001h Exim Auth failed2025-04-23 21:44:46 dovecot_login authenticator failed for 1-36-76-185.ptr.netvigator.com [1.36.76.185]:34672: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)1.36.76.1851819730g!  -W+ ossec13001h Exim Auth failed2025-04-23 21:36:21 dovecot_login authenticator failed for kd113158205225.ppp-bb.dion.ne.jp [113.158.205.225]:50167: 535 Incorrect authentication data (set_id=sales)113.158.205.2251861060j  -_) ossec13001h Exim Auth failed2025-04-23 21:36:09 dovecot_login authenticator failed for ([183.17.228.174]) [183.17.228.174]:37767: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)183.17.228.1741814991h  -]' ossec13001h -Exim Auth failed2025-04-23 21:32:52 dovecot_login authenticator failed for 89-179-78-247.broadband.corbina.ru [89.179.78.247]:53434: 535 Incorrect authentication data (set_id=services)89.179.78.2472017370j  -a' ossec13001h %Exim Auth failed2025-04-23 21:32:43 dovecot_login authenticator failed for ([116.237.2.156]) [116.237.2.156]:32864: 535 Incorrect authentication data (set_id=services@heipowersystem.com)116.237.2.1561814991m  -g' ossec13001h Exim Auth failed2025-04-23 21:31:04 dovecot_login authenticator failed for (201-63-196-1.customer.tdatabrasil.net.br) [177.25.18.178]:60066: 535 Incorrect authentication data (set_id=sales)177.25.18.1783469034|  -) ossec13001h Exim Auth failed2025-04-23 21:30:46 dovecot_login authenticator failed for syn-208-105-193-045.biz.spectrum.com [208.105.193.45]:43409: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)208.105.193.456252001j  -e% ossec13001h (Exim Auth failed2025-04-23 21:19:59 dovecot_login authenticator failed for (host-153.215.77.5.ucom.am) [5.77.215.153]:53618: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)5.77.215.153174982v  -y' ossec13001h Exim Auth failed2025-04-23 21:19:50 dovecot_login authenticator failed for ([117.70.94.155]) [117.70.94.155]:54328: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)117.70.94.1551814991V  -7) ossec13001h Exim Auth failed2025-04-23 21:18:58 dovecot_login authenticator failed for ([222.174.142.78]) [222.174.142.78]:1300: 535 Incorrect authentication data (set_id=sales)222.174.142.781814991d  -W% ossec13001h Exim Auth failed2025-04-23 21:18:45 dovecot_login authenticator failed for ([141.94.18.69]) [141.94.18.69]:26060: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)141.94.18.693017382 r `rjNh %{"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 20:49:07 dovecot_login authenticator failed for ohgtex.static.otenet.gr [195.167.114.221]:50064: 535 Incorrect authentication data (set_id=services@heipowersystem.com)","attackers_ip":"195.167.114.221","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745594349,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 20:49:18 dovecot_login authenticator failed for visaustralia.com [216.70.104.41]:58342: 535 Incorrect authentication data (set_id=services@heipowersystem.com)","attackers_ip":"216.70.104.41","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745594359,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 20:49:57 dovecot_login authenticator failed for syn-172-090-128-097.res.spectrum.com [172.90.128.97]:58842: 535 Incorrect authentication data (set_id=services)","attackers_ip":"172.90.128.97","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745594399,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}2h {"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 20:48:18 dovecot_login authenticator failed for ([115.238.31.114]) [115.238.31.114]:53997: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)","attackers_ip":"115.238.31.114","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745594299,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 20:48:29 dovecot_login authenticator failed for ([103.171.12.170]) [103.171.12.170]:40402: 535 Incorrect authentication data (set_id=purchase)","attackers_ip":"103.171.12.170","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745594311,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}  Ze0Zh {"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 05:14:07 dovecot_login authenticator failed for (vcs-app.naukanet.ru) [185.145.125.212]:64881: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)","attackers_ip":"185.145.125.212","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745538248,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 05:14:19 dovecot_login authenticator failed for (448990.cloudwaysapps.com) [128.199.118.234]:53192: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)","attackers_ip":"128.199.118.234","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745538260,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}">h {"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 05:13:47 dovecot_login authenticator failed for ([117.247.204.32]) [120.60.107.227]:43478: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)","attackers_ip":"120.60.107.227","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745538228,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 05:13:10 dovecot_login authenticator failed for ([31.173.20.146]) [31.173.20.146]:58544: 535 Incorrect authentication data (set_id=sales)","attackers_ip":"31.173.20.146","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745538190,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}  'S h  {"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 10:00:34 dovecot_login authenticator failed for (User) [185.93.89.218]:58808: 535 Incorrect authentication data (set_id=mailtest)","attackers_ip":"185.93.89.218","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745555435,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}2^h {"content":[{"rule":"11301","retries":1,"severity":3,"name":"New FTP connection.","message":"Apr 25 09:58:35 vm1 pure-ftpd[3297677]: (?@147.185.132.144) [INFO] New connection from 147.185.132.144","attackers_ip":"147.185.132.144","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745555317,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}U $h x{"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 09:49:10 dovecot_login authenticator failed for 107-135-117-245.lightspeed.livnmi.sbcglobal.net [107.135.117.245]:4661: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)","attackers_ip":"107.135.117.245","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745554750,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 09:49:22 dovecot_login authenticator failed for ([115.144.115.150]) [115.144.115.150]:40983: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)","attackers_ip":"115.144.115.150","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745554762,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}  Kp 1\h V{"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 11:01:18 dovecot_login authenticator failed for ([125.140.244.144]) [125.140.244.144]:43352: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)","attackers_ip":"125.140.244.144","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745559078,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitela& rejected RCPT : Sender verify failed78.153.140.2072635167ZX  -G! ossec13001h 1+Exim Auth failed2025-04-25 12:22:27 dovecot_login authenticator failed for ([1.25.18.18]) [1.25.18.18]:56604: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)1.25.18.181814991gW  -[' ossec13001h 0Exim Auth failed2025-04-25 12:17:51 dovecot_login authenticator failed for ([58.238.74.138]) [58.238.74.138]:54628: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)58.238.74.1381835841 n mzu  -% ossec13001h Exim Auth failed2025-04-24 10:24:23 dovecot_login authenticator failed for broadband-5-228-54-184.ip.moscow.rt.ru [5.228.54.184]:57916: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)5.228.54.1842017370jt  -a' ossec13001h Exim Auth failed2025-04-24 10:20:13 dovecot_login authenticator failed for ([211.217.50.31]) [211.217.50.31]:58023: 535 Incorrect authentication data (set_id=services@heipowersystem.com)211.217.50.311835841bs  -Q' ossec13001h Exim Auth failed2025-04-24 10:09:49 dovecot_login authenticator failed for (136-62-72-219.googlefiber.net) [136.62.72.219]:47076: 535 Incorrect authentication data (set_id=sales)136.62.72.2196252001Wr  -9) ossec13001h Exim Auth failed2025-04-24 10:09:45 dovecot_login authenticator failed for ([119.201.59.224]) [119.201.59.224]:39885: 535 Incorrect authentication data (set_id=sales)119.201.59.2241835841vq  -y' ossec13001h uExim Auth failed2025-04-24 10:09:17 dovecot_login authenticator failed for 111-70-29-130.emome-ip.hinet.net [111.70.29.130]:48174: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)111.70.29.1301668284Gp  -' ossec13001h 5Exim Auth failed2025-04-24 10:08:12 dovecot_login authenticator failed for (User) [185.93.89.217]:31972: 535 Incorrect authentication data (set_id=root)185.93.89.217130758'o  3U) ossec11301h New FTP connection.Apr 24 10:06:48 vm1 pure-ftpd[2974219]: (?@93.123.109.222) [INFO] New connection from 93.123.109.22293.123.109.222732800cn  -S' ossec13001h cExim Auth failed2025-04-24 10:04:42 dovecot_login authenticator failed for ([218.78.11.246]) [218.78.11.246]:47338: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)218.78.11.2461814991rm  -q' ossec13001h Exim Auth failed2025-04-24 10:05:21 dovecot_login authenticator failed for (77x106x78x215.dynamic.barnaul.ertelecom.ru) [77.106.78.215]:40953: 535 Incorrect authentication data (set_id=services)77.106.78.2152017370hl  -a' ossec13001h wExim Auth failed2025-04-24 10:05:02 dovecot_login authenticator failed for ([65.20.196.232]) [65.20.196.232]:47720: 535 Incorrect authentication data (set_id=services@heipowersystem.com)65.20.196.23299237k  - ' ossec13001h OExim Auth failed2025-04-24 10:04:23 dovecot_login authenticator failed for (183.82.32.104.actcorp.in) [183.82.32.104]:56723: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)183.82.32.1041269750sj  -u% ossec13001h EExim Auth failed2025-04-24 10:04:13 dovecot_login authenticator failed for ([58.16.91.144]) [58.16.91.144]:60634: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)58.16.91.1441814991Qi  -1% ossec13001h Exim Auth failed2025-04-24 10:03:06 dovecot_login authenticator failed for ([60.11.250.94]) [60.11.250.94]:48556: 535 Incorrect authentication data (set_id=sales)60.11.250.941814991ch  -W% ossec13001h Exim Auth failed2025-04-24 10:02:52 dovecot_login authenticator failed for ([94.204.227.7]) [94.204.227.7]:36281: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)94.204.227.7290557Jg  -#' ossec13001h Exim Auth failed2025-04-24 09:58:47 dovecot_login authenticator failed for (User) [185.93.89.218]:46478: 535 Incorrect authentication data (set_id=recruit)185.93.89.218130758%f  3Q' ossec11301h New FTP connection.Apr 24 09:58:36 vm1 pure-ftpd[2972211]: (?@120.237.18.56) [INFO] New connection from 120.237.18.56120.237.18.561814991ce  -W# ossec13001h ;Exim Auth failed2025-04-24 09:55:29 dovecot_login authenticator failed for (223-30-0-0.lan.sify.net) [1.7.229.162]:48430: 535 Incorrect authentication data (set_id=vikas.khandelwal)1.7.229.1621269750  A U   %7cZ  -?) ossec13001h Exim Auth failed2025-04-23 21:17:45 dovecot_login authenticator failed for ([110.49.145.163]) [110.49.145.163]:43440: 535 Incorrect authentication data (set_id=services)110.49.145.1631605651r  -s% ossec13001h Exim Auth failed2025-04-23 21:17:30 dovecot_login authenticator failed for 58.89-10-140.nextgentel.com [89.10.140.58]:41030: 535 Incorrect authentication data (set_id=services@heipowersystem.com)89.10.140.583144096I  -!' ossec13001h Exim Auth failed2025-04-23 21:14:20 dovecot_login authenticator failed for (User) [185.93.89.218]:50524: 535 Incorrect authentication data (set_id=copier)185.93.89.218130758O  -1% ossec13001h EExim Auth failed2025-04-23 21:07:40 dovecot_login authenticator failed for ([65.20.204.34]) [65.20.204.34]:53231: 535 Incorrect authentication data (set_id=sales)65.20.204.3499237i  -_) ossec13001h 9Exim Auth failed2025-04-23 21:07:28 dovecot_login authenticator failed for ([196.190.43.139]) [196.190.41.137]:16991: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)196.190.41.137337996W  -;' ossec13001h WExim Auth failed2025-04-23 21:03:42 dovecot_login authenticator failed for ([58.240.26.106]) [58.240.26.106]:56801: 535 Incorrect authentication data (set_id=services)58.240.26.1061814991m  -e) ossec13001h IExim Auth failed2025-04-23 21:03:27 dovecot_login authenticator failed for ([220.77.182.170]) [220.77.182.170]:52342: 535 Incorrect authentication data (set_id=services@heipowersystem.com)220.77.182.1701835841(  3U) ossec11301h mNew FTP connection.Apr 23 20:59:48 vm1 pure-ftpd[2802558]: (?@198.235.24.170) [INFO] New connection from 198.235.24.170198.235.24.1706252001k  -a) ossec13001h Exim Auth failed2025-04-23 20:53:47 dovecot_login authenticator failed for bl23-153-189.dsl.telepac.pt [144.64.153.189]:57906: 535 Incorrect authentication data (set_id=vikas.khandelwal)144.64.153.1892264397p  -q' ossec13001h Exim Auth failed2025-04-23 20:53:38 dovecot_login authenticator failed for ([65.20.155.223]) [65.20.155.223]:35793: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)65.20.155.22399237u  -u) ossec13001h Exim Auth failed2025-04-23 20:47:39 dovecot_login authenticator failed for c151-177-147-36.bredband.tele2.se [151.177.147.36]:49204: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)151.177.147.362661886{  -% ossec13001h Exim Auth failed2025-04-23 20:47:23 dovecot_login authenticator failed for 014199052062.ctinets.com [14.199.52.62]:49328: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)14.199.52.621819730Q  -1% ossec13001h FExim Auth failed2025-04-23 20:46:21 dovecot_login authenticator failed for ([1.247.245.61]) [1.247.245.61]:49695: 535 Incorrect authentication data (set_id=sales)1.247.245.611835841g  -[' ossec13001h 4Exim Auth failed2025-04-23 20:46:02 dovecot_login authenticator failed for ([49.124.153.28]) [49.124.153.28]:55052: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)49.124.153.281733045J  -#' ossec13001h iExim Auth failed2025-04-23 20:42:41 dovecot_login authenticator failed for (User) [185.93.89.218]:35880: 535 Incorrect authentication data (set_id=contact)185.93.89.218130758e  -S+ ossec13001h eExim Auth failed2025-04-23 20:38:20 dovecot_login authenticator failed for ([221.182.185.190]) [221.182.185.190]:58742: 535 Incorrect authentication data (set_id=vikas.khandelwal)221.182.185.1901814991  -' ossec13001h UExim Auth failed2025-04-23 20:38:05 dovecot_login authenticator failed for 114-34-205-57.hinet-ip.hinet.net [114.34.205.57]:52130: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)114.34.205.571668284 D (3DkCPh {"content":[{"rule":"11009","retries":1,"severity":4,"name":"WHM login success","message":"[2025-04-25 18:40:47 +0530] info [whostmgrd] 103.190.54.25 NEW techno:UuIMfZP9ravx143A address=103.190.54.25,app=cpaneld,creator=root,method=handle_auth_transfer,path=xfercpanel","attackers_ip":"103.190.54.25","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745586647,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":true,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"11006","retries":1,"severity":4,"name":"cPanel login success","message":"[2025-04-25 18:40:47 +0530] info [cpaneld] 103.190.54.25 NEW techno:_I3ujh4rZdw5iFqh address=103.190.54.25,app=cpaneld,creator=techno,method=handle_form_login,path=loadsession:techno:UuIMfZP9ravx143A,possessed=1,possessor=root","attackers_ip":"103.190.54.25","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745586649,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":true,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}q@\h 6{"content":[{"rule":"11009","retries":1,"severity":4,"name":"WHM login success","message":"[2025-04-25 18:37:09 +0530] info [whostmgrd] 171.79.150.205 NEW techno:n3LjcQH2prXWUc6M address=171.79.150.205,app=cpaneld,creator=root,method=handle_auth_transfer,path=xfercpanel","attackers_ip":"171.79.150.205","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745586431,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":true,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"11006","retries":1,"severity":4,"name":"cPanel login success","message":"[2025-04-25 18:37:10 +0530] info [cpaneld] 171.79.150.205 NEW techno:nZU_4HUTfuf79SvB address=171.79.150.205,app=cpaneld,creator=techno,method=handle_form_login,path=loadsession:techno:n3LjcQH2prXWUc6M,possessed=1,possessor=root","attackers_ip":"171.79.150.205","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745586431,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":true,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}~?vh {"content":[{"rule":"11009","retries":1,"severity":4,"name":"WHM login success","message":"[2025-04-25 18:37:00 +0530] info [whostmgrd] 171.79.150.205 NEW root:pA78c0Bk6EJDYFcv address=171.79.150.205,app=whostmgrd,creator=root,method=handle_form_login,path=form,possessed=0","attackers_ip":"171.79.150.205","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745586421,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":true,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}R=h {"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 18:34:46 dovecot_login authenticator failed for (User) [185.93.89.218]:6210: 535 Incorrect authentication data (set_id=security)","attackers_ip":"185.93.89.218","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745586287,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0} ~qdWJ=0# zm`SF9,  v i \ O B 5 (     r e X K > 1 $  { n a T G : -   w j ]  Q E 9 - !  y m b W L A 6 + 3932488N 458258N 3996063N 3996063N 3923057M 3996063LK 3932488L 51537*o 51537( 49518Cn 49518@ 49518< 495188 49518) 458258I 458258? 4582584 458258, 458258'' 458258& 458258 458258 458258 458258m 458258 458258G 458258 7 458258 453733I 453733IF 453733DS 453733? 4537337t 4537337= 3996063I 3996063I 3996063HQ 3996063H= 3996063D* 3996063C 3996063C/ 3996063C 3996063C 3996063C 3996063C 3996063C 3996063C 3996063C 3996063C 3996063C 3996063C 3996063C 3996063@ 3996063@ 3996063?d 3996063> 3996063=A 3996063<` 39960639H 39960636 39960635; 39960634P 39960630 39960630 39960630% 3996063/ 3996063/4 3996063/ 3996063.Z 3996063, 3996063+ 3996063+ 3996063*| 3996063) 3996063) 3996063(o 3996063(n 3996063& 3996063& 3996063# 3996063#% 3996063" 3996063 ! 3996063 3996063 3996063 3996063 3996063 3996063 3996063 3996063j 3996063 3996063 3996063 3996063{ 3996063 3996063 3996063m 3996063g 3996063 3996063 3996063 3996063x 3996063 3996063] 3996063 k 3996063 3996063 3932488I 3932488E 3932488D 3932488C 3932488? 3932488? 3932488>2 39324887d 39324886 39324882A 39324881 3932488, 3932488* 3932488) 3932488) 3932488& 3932488&{ 3932488" 3932488 c 3932488 3932488 3932488 3932488 3932488 3932488 3932488 3932488E 3932488 3932488 3932488 3932488 M 3923057C 39230578 39230578 39230577 39230570 3923057,  ? P 9guhJ  -[) ossec13001h 3Exim Auth failed2025-04-24 00:05:46 dovecot_login authenticator failed for (177-20-171-155.zaaztelecom.com.br) [177.20.171.155]:39230: 535 Incorrect authentication data (set_id=sales)177.20.171.1553469034mI  -c+ ossec13001h 2Exim Auth failed2025-04-24 00:05:30 dovecot_login authenticator failed for ([211.247.127.250]) [211.247.127.250]:54145: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)211.247.127.2501835841H  ?1 ossec1008h 2Process exiting (killed).Apr 24 00:05:40 vm1 spamd[2532807]: spamd: server killed by SIGTERM, shutting downCG  77 ossec502h 2tOssec server started.ossec: Ossec started.YF  -C# ossec13001h 1Exim Auth failed2025-04-23 23:57:42 dovecot_login authenticator failed for ([31.173.0.46]) [31.173.0.46]:42580: 535 Incorrect authentication data (set_id=vikas.khandelwal)31.173.0.462017370uE  -u) ossec13001h 1 Exim Auth failed2025-04-23 23:57:25 dovecot_login authenticator failed for ([182.176.125.34]) [182.176.125.34]:57880: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)182.176.125.341168579HD  -' ossec13001h /Exim Auth failed2025-04-23 23:52:29 dovecot_login authenticator failed for (User) [185.93.89.218]:48914: 535 Incorrect authentication data (set_id=guest)185.93.89.218130758TC  -5' ossec13001h .Exim Auth failed2025-04-23 23:47:44 dovecot_login authenticator failed for ([14.39.113.250]) [14.39.113.250]:55978: 535 Incorrect authentication data (set_id=sales)14.39.113.2501835841mB  -c+ ossec13001h .Exim Auth failed2025-04-23 23:47:26 dovecot_login authenticator failed for ([114.255.134.164]) [114.255.134.165]:63462: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)114.255.134.1651814991]A  -C+ ossec13001h +Exim Auth failed2025-04-23 23:31:43 dovecot_login authenticator failed for ([103.219.154.156]) [103.219.154.156]:39294: 535 Incorrect authentication data (set_id=services)103.219.154.1562750405v@  -{% ossec13001h *Exim Auth failed2025-04-23 23:31:31 dovecot_login authenticator failed for c83-255-9-170.bredband.tele2.se [83.255.9.170]:48186: 535 Incorrect authentication data (set_id=services@heipowersystem.com)83.255.9.1702661886E?  -' ossec13001h +&Exim Auth failed2025-04-23 23:32:13 dovecot_login authenticator failed for ([104.152.58.17]) [104.152.58.17]:51688: 535 Incorrect authentication data104.152.58.176252001j>  -_) ossec13001h (Exim Auth failed2025-04-23 23:21:16 dovecot_login authenticator failed for ([181.78.195.107]) [181.78.195.107]:37192: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)181.78.195.1073658394F=  -' ossec13001h (yExim Auth failed2025-04-23 23:20:48 dovecot_login authenticator failed for (User) [185.93.89.218]:13742: 535 Incorrect authentication data (set_id=fax)185.93.89.218130758|<  -' ossec13001h (aExim Auth failed2025-04-23 23:20:25 dovecot_login authenticator failed for 114.185.47.34.bc.googleusercontent.com [34.47.185.114]:41454: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)34.47.185.1141269750n;  -g) ossec13001h 'wExim Auth failed2025-04-23 23:16:30 dovecot_login authenticator failed for ([150.129.138.198]) [112.96.229.159]:12749: 535 Incorrect authentication data (set_id=services@heipowersystem.com)112.96.229.1591814991e:  -S+ ossec13001h !Exim Auth failed2025-04-23 22:51:37 dovecot_login authenticator failed for ([122.166.253.226]) [122.166.253.226]:36506: 535 Incorrect authentication data (set_id=vikas.khandelwal)122.166.253.22612697509  -3' ossec13001h !Exim Auth failed2025-04-23 22:51:12 dovecot_login authenticator failed for lpointe-a-pitre-656-1-6-174.w81-248.abo.wanadoo.fr [81.248.16.174]:23770: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)81.248.16.1743579143 0 /0qg\h x{"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-26 01:03:10 dovecot_login authenticator failed for ([186.201.32.242]) [177.174.95.245]:44764: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)","attackers_ip":"177.174.95.245","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745609591,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}SW h {"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-26 00:30:34 dovecot_login authenticator failed for (User) [185.93.89.218]:21340: 535 Incorrect authentication data (set_id=testmail)","attackers_ip":"185.93.89.218","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745607635,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}/QXh ǎ{"content":[{"rule":"11301","retries":1,"severity":3,"name":"New FTP connection.","message":"Apr 25 23:03:58 vm1 pure-ftpd[3473253]: (?@47.236.242.102) [INFO] New connection from 47.236.242.102","attackers_ip":"47.236.242.102","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745602440,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}nOVh {"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 23:01:23 dovecot_login authenticator failed for ([203.81.213.46]) [203.81.213.46]:53986: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)","attackers_ip":"203.81.213.46","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745602284,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}[N0h {"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 21:51:05 dovecot_login authenticator failed for ([113.192.69.10]) [113.192.69.10]:52518: 535 Incorrect authentication data (set_id=sales)","attackers_ip":"113.192.69.10","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745598066,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0} C CU%$h ~2{"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 17:50:16 dovecot_login authenticator failed for ([59.7.57.174]) [59.7.57.174]:51308: 535 Incorrect authentication data (set_id=sales)","attackers_ip":"59.7.57.174","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745583616,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}u#dh }{"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 17:49:57 dovecot_login authenticator failed for vps-b674cd8d.vps.ovh.net [51.68.226.171]:41162: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)","attackers_ip":"51.68.226.171","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745583598,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}*"Nh o1{"content":[{"rule":"13008","retries":1,"severity":3,"name":"Mail Recipient rejected","message":"2025-04-25 16:46:27 H=(localhost.localdomain) [78.153.140.207]:40116 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no F=\u003cno-reply@no-reply.com\u003e rejected RCPT \u003ca@b11.siagabaja.com\u003e: Sender verify failed","attackers_ip":"78.153.140.207","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745579788,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}9lh nA{"content":[{"rule":"11301","retries":9,"severity":3,"name":"New FTP connection.","message":"Apr 25 16:42:13 vm1 pure-ftpd[3387279]: (?@206.168.34.83) [INFO] New connection from 206.168.34.83","attackers_ip":"206.168.34.83","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745579534,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"11307","retries":1,"severity":3,"name":"Multiple connection attempts from same source","message":"Apr 25 16:42:23 vm1 pure-ftpd[3387311]: (?@206.168.34.83) [INFO] New connection from 206.168.34.83","attackers_ip":"206.168.34.83","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745579544,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}  2ft]bh F{"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 13:53:07 dovecot_login authenticator failed for (thepsindustries.com) [124.160.63.122]:21488: 535 Incorrect authentication data (set_id=test@thepsindustries.com)","attackers_ip":"124.160.63.122","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745569388,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}c[@h Fi{"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 13:52:43 dovecot_login authenticator failed for (thepsindustries.com) [124.160.63.122]:20187: 535 Incorrect authentication data (set_id=nologin)","attackers_ip":"124.160.63.122","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745569364,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}8)_Lh G{"content":[{"rule":"11301","retries":1,"severity":3,"name":"New FTP connection.","message":"Apr 25 13:55:48 vm1 pure-ftpd[3351173]: (?@20.163.1.211) [INFO] New connection from 20.163.1.211","attackers_ip":"20.163.1.211","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745569548,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}eYDh E{"content":[{"rule":"13013","retries":1,"severity":3,"name":"Mailbox created","message":"2025-04-25 13:50:37 1u8EIb-0000000E3Up-10Wr \u003c= cpanel@amplifypowerglobal.com H=(localhost.localdomain) [127.0.0.1]:59444 P=esmtpa A=dovecot_plain:__cpanel__service__auth__icontact__sfzfilskcw_8eblm S=82995 id=1745569237.JzAoaxjIKoo0Ah1h@vm1.technobases.in T=\"[amplifypowerglobal.com] Client configuration settings for \\342\\200\\234kps@amplifypowerglobal.com\\342\\200\\235.\" for kps@amplifypowerglobal.com","attackers_ip":"127.0.0.1","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":["noshow"],"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745569238,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":true,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}aX 2287781/$ 2287781. 2275384"n 2264397M 2264397K 2264397I 2264397I 2264397H 2264397H 2264397H 2264397H 2264397H 2264397G 2264397G^ 2264397G] 2264397G\ 2264397G[ 2264397F 2264397FG 2264397DK 2264397Cm 2264397B 2264397A 2264397@ 2264397? 2264397?: 2264397;k 2264397;j 2264397;i 2264397: 22643976 22643976n 22643976m 22643976l 22643973 22643972 22643972 22643972 22643972 22643972~ 22643972} 22643972| 22643972{ 22643972z 22643972r 22643972G 22643971 22643970 22643970 22643970~ 22643970} 22643970| 22643970{ 22643970U 2264397/E 2264397+O 2264397*r 2264397( 2264397' 2264397': 2264397'9 2264397& 2264397$ 2264397" 2264397 0 2264397 2264397 2264397> 2264397 2264397 e 2264397  2264397 2264397 2264397 2264397 226074H 226074H 226074H 226074E 226074? 2260749 2260748 2260746p 2260742 226074*0 226074( 226074%b 226074# 226074! 226074 226074 226074< 226074 226074 2245662:T 22456627\ 22456626 22456624 2233387Js 2233387 22333878 2233387 2233387 2215636B~ 2215636= 22156365L 221563633 2215636/ 2186224H 2134431.D 2134431+z 2134431*F 2134431)] 2134431' 2134431 2134431 , 2134431 2134431 I 2134431  2077456N 2077456N= 2077456N %6 ] h }  NuL&  -'' ossec13001h Exim Auth failed2025-04-26 03:12:42 dovecot_login authenticator failed for (User) [185.93.89.218]:27380: 535 Incorrect authentication data (set_id=webmaster)185.93.89.218130758a%  -S# ossec13001h XExim Auth failed2025-04-26 02:49:18 dovecot_login authenticator failed for ([14.195.1.77]) [14.195.1.77]:34757: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)14.195.1.771269750T$  -5' ossec13001h dExim Auth failed2025-04-26 02:49:30 dovecot_login authenticator failed for ([95.221.179.61]) [95.221.179.61]:45119: 535 Incorrect authentication data (set_id=sales)95.221.179.612017370H#  -' ossec13001h MExim Auth failed2025-04-26 02:40:36 dovecot_login authenticator failed for (User) [185.93.89.218]:20418: 535 Incorrect authentication data (set_id=vmail)185.93.89.218130758{"  -+ ossec13001h Exim Auth failed2025-04-26 02:35:19 dovecot_login authenticator failed for (105.215.163.124.adsl-pool.sx.cn) [124.163.215.105]:36490: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)124.163.215.1051814991l!  -i# ossec13001h Exim Auth failed2025-04-26 02:35:13 dovecot_login authenticator failed for static-98-110-70-2.cmdnnj.fios.verizon.net [98.110.70.2]:53526: 535 Incorrect authentication data (set_id=services)98.110.70.26252001W  -9) ossec13001h Exim Auth failed2025-04-26 02:35:32 dovecot_login authenticator failed for ([175.153.164.15]) [175.153.164.15]:43294: 535 Incorrect authentication data (set_id=sales)175.153.164.151814991m  -e) ossec13001h Exim Auth failed2025-04-26 02:35:03 dovecot_login authenticator failed for ([58.252.212.232]) [58.252.212.232]:47890: 535 Incorrect authentication data (set_id=services@heipowersystem.com)58.252.212.2321814991j  -a' ossec13001h %Exim Auth failed2025-04-26 02:31:24 dovecot_login authenticator failed for 063.40.246.220.static.netvigator.com [220.246.40.63]:49742: 535 Incorrect authentication data (set_id=services)220.246.40.631819730r  -u# ossec13001h Exim Auth failed2025-04-26 02:31:11 dovecot_login authenticator failed for (n51-h64.smr-rsk.metromax.ru) [81.22.51.64]:57082: 535 Incorrect authentication data (set_id=services@heipowersystem.com)81.22.51.642017370i  -[+ ossec13001h Exim Auth failed2025-04-26 02:15:55 dovecot_login authenticator failed for ([218.152.154.217]) [218.152.154.217]:64752: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)218.152.154.2171835841J  -'# ossec13001h nExim Auth failed2025-04-26 02:15:32 dovecot_login authenticator failed for (2-54-85-220.orange.net.il) [2.54.85.220]:54080: 535 Incorrect authentication data2.54.85.220294640f  -W) ossec13001h `Exim Auth failed2025-04-26 02:15:17 dovecot_login authenticator failed for ([128.185.225.34]) [128.185.225.34]:40780: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)128.185.225.341269750p  -q# ossec13001h FExim Auth failed2025-04-26 02:14:52 dovecot_login authenticator failed for ([14.195.1.74]) [14.195.1.77]:35943: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)14.195.1.771269750T  -5' ossec13001h Exim Auth failed2025-04-26 02:13:46 dovecot_login authenticator failed for ([217.24.185.98]) [217.24.185.98]:58744: 535 Incorrect authentication data (set_id=sales)217.24.185.982017370j  -_) ossec13001h Exim Auth failed2025-04-26 02:13:34 dovecot_login authenticator failed for ([45.251.108.124]) [45.251.108.124]:63491: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)45.251.108.1241819730V  -;% ossec13001h Exim Auth failed2025-04-26 02:13:24 dovecot_login authenticator failed for syn-076-169-081-036.res.spectrum.com [76.169.81.36]:53840: 535 Incorrect authentication data76.169.81.366252001 R  AMZ#|J-  -#' ossec13001h oExim Auth failed2025-04-25 18:34:46 dovecot_login authenticator failed for (User) [185.93.89.218]:6210: 535 Incorrect authentication data (set_id=security)185.93.89.218130758",  3M% ossec11301h DNew FTP connection.Apr 25 18:29:47 vm1 pure-ftpd[3412159]: (?@20.171.30.14) [INFO] New connection from 20.171.30.1420.171.30.146252001V+  -9) ossec13001h Exim Auth failed2025-04-25 18:10:01 dovecot_login authenticator failed for ([94.204.208.189]) [94.204.208.189]:52528: 535 Incorrect authentication data (set_id=sales)94.204.208.189290557j*  -_) ossec13001h Exim Auth failed2025-04-25 18:09:50 dovecot_login authenticator failed for ([81.161.142.133]) [81.161.142.133]:43400: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)81.161.142.1332623032J)  -#' ossec13001h Exim Auth failed2025-04-25 18:02:28 dovecot_login authenticator failed for (User) [185.93.89.218]:35430: 535 Incorrect authentication data (set_id=scanner)185.93.89.218130758W(  -9) ossec13001h ,Exim Auth failed2025-04-25 17:55:16 dovecot_login authenticator failed for ([111.192.73.103]) [111.192.73.103]:60306: 535 Incorrect authentication data (set_id=sales)111.192.73.1031814991j'  -_) ossec13001h Exim Auth failed2025-04-25 17:54:54 dovecot_login authenticator failed for ([112.102.48.161]) [112.102.48.161]:36953: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)112.102.48.1611814991N&  --# ossec13001h ~Exim Auth failed2025-04-25 17:50:16 dovecot_login authenticator failed for ([59.7.57.174]) [59.7.57.174]:51308: 535 Incorrect authentication data (set_id=sales)59.7.57.1741835841n%  -i' ossec13001h }Exim Auth failed2025-04-25 17:49:57 dovecot_login authenticator failed for vps-b674cd8d.vps.ovh.net [51.68.226.171]:41162: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)51.68.226.1713017382o$  -g+ ossec13001h {Exim Auth failed2025-04-25 17:37:28 dovecot_login authenticator failed for (customer-gdl-135-105.megared.net.mx) [177.231.135.105]:34966: 535 Incorrect authentication data (set_id=services)177.231.135.1053996063Z#  -?) ossec13001h {Exim Auth failed2025-04-25 17:37:55 dovecot_login authenticator failed for ([185.216.192.16]) [185.216.192.16]:59464: 535 Incorrect authentication data (set_id=services)185.216.192.162017370y"  -' ossec13001h {Exim Auth failed2025-04-25 17:37:43 dovecot_login authenticator failed for c151-177-95-27.bredband.tele2.se [151.177.95.27]:36002: 535 Incorrect authentication data (set_id=services@heipowersystem.com)151.177.95.272661886j!  -a' ossec13001h zExim Auth failed2025-04-25 17:37:00 dovecot_login authenticator failed for ([101.168.2.207]) [101.168.2.207]:36754: 535 Incorrect authentication data (set_id=services@heipowersystem.com)101.168.2.2072077456Q  -3# ossec13001h yExim Auth failed2025-04-25 17:31:14 dovecot_login authenticator failed for ([27.98.249.9]) [27.98.249.9]:49120: 535 Incorrect authentication data (set_id=purchase)27.98.249.91814991p  -i+ ossec13001h y}Exim Auth failed2025-04-25 17:31:00 dovecot_login authenticator failed for ([183.167.230.105]) [183.167.230.105]:43322: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)183.167.230.1051814991G  -' ossec13001h yGExim Auth failed2025-04-25 17:30:06 dovecot_login authenticator failed for (User) [185.93.89.218]:14066: 535 Incorrect authentication data (set_id=scan)185.93.89.218130758)  EK% ossec5715h sySSHD authentication success.Apr 25 17:05:19 vm1 sshd[3392729]: Accepted password for root from 103.190.54.7 port 54788 ssh2103.190.54.71269750)  EK% ossec5715h sKSSHD authentication success.Apr 25 17:04:35 vm1 sshd[3392410]: Accepted password for root from 103.190.54.7 port 54786 ssh2103.190.54.71269750  q'\h "{"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 17:54:54 dovecot_login authenticator failed for ([112.102.48.161]) [112.102.48.161]:36953: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)","attackers_ip":"112.102.48.161","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745583894,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}o&Xh o{"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 16:48:16 dovecot_login authenticator failed for ([50.123.92.130]) [50.123.92.130]:43604: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)","attackers_ip":"50.123.92.130","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745579896,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 16:48:18 dovecot_login authenticator failed for 107-210-71-89.lightspeed.gdrpmi.sbcglobal.net [107.210.71.89]:35881: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)","attackers_ip":"107.210.71.89","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745579898,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 16:48:42 dovecot_login authenticator failed for 42-200-70-134.static.imsbiz.com [42.200.70.134]:47604: 535 Incorrect authentication data (set_id=sales)","attackers_ip":"42.200.70.134","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745579922,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0} R~tj`VLB8.$zpf\RH>4*   v l b X N D : 0 &    ~ t j ` V L B 8 . $    z p f \ R H > 4 *  vlbXND:0&|rh^TJ@6,"xndZPF<2( ~tj`VLB8.$zpf\RH>4*   v l b X N D : 0 &    | r h ^ T J @ 6 , "    x n d Z P F < 2 (   h #iOK h #]OJ h #QOI h #?OH h #5OG h *NL h #1OE h #)OD h #OC h OB h OA h O@ h O? h O> h O= h  O< h O; h O: h vO9 h ;O8 h 3O7 h  O6 h O5 h mO4 h SO3 h O2 h wO1 h O0 h nO/ h bO. h RO- h O, h O+ h aO* h nO) h YO( h MO' h O& h XO% h dO$ h MO# h O" h O! h O h O h %O h O h O h nO h `O h FO h O h O h O h xO h O h O h O h O h O h %O h sO h gO h O h mO h O h O h O h O h yO h wO h O h VO h ԼO h ԬO h ԖO h 2N h {N h mN h ϨN h φN h ̨N h ̚N h ̔N h ǎN h LjN h N h N h N h N h pN h N h øN h ÉN h qN h ?N h N h N h dN h N h N h N h vN h `N h rN h \N h N h lN h YN h GN h 9N h ]N h N h N h N h N h /N h N h HN h N h N h N h N h N h N h N h N h N h N h N h N h N h N h N h |N h aN h 6N h $N h N h yN h +N h N h N h N h N h N h N h N h NN h ,N h &N h $N h N h N h N h N h N h N h oN h DN h N h N h N h ,N h N h ~N h }N h {N h {N h {N h zN h yN h y}N h yGN h syN h sKN h rN h rN h r{N h qN h pUN h pKN h oN h ozN h oxN h o N h nN h nN h mNew FTP connection.Apr 24 00:56:08 vm1 pure-ftpd[2854977]: (?@135.233.112.11) [INFO] New connection from 135.233.112.11135.233.112.116252001EW  -' ossec13001h >Exim Auth failed2025-04-24 00:55:53 dovecot_login authenticator failed for (User) [185.93.89.218]:13036: 535 Incorrect authentication data (set_id=hr)185.93.89.218130758QV  ;+ ossec13008h =dMail Recipient rejected2025-04-24 00:50:03 H=(mail.heipowersystem.com) [165.154.210.189]:57039 F= rejected RCPT : Rejected relay attempt: '165.154.210.189' From: 'jjwfyyvjg@heipowersystem.com' To: 'validxxx@gmailhotmail.com.br'165.154.210.1891694008YU  -;+ ossec13001h 7Exim Auth failed2025-04-24 00:26:42 dovecot_login authenticator failed for ([111.206.233.34]) [123.118.101.233]:48054: 535 Incorrect authentication data (set_id=sales)123.118.101.2331814991jT  -_) ossec13001h 7Exim Auth failed2025-04-24 00:26:29 dovecot_login authenticator failed for ([182.72.255.137]) [152.52.243.154]:41726: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)152.52.243.1541269750ES  -' ossec13001h 7WExim Auth failed2025-04-24 00:24:13 dovecot_login authenticator failed for (User) [185.93.89.218]:35398: 535 Incorrect authentication data (set_id=hp)185.93.89.218130758jR  -a' ossec13001h 6Exim Auth failed2025-04-24 00:22:41 dovecot_login authenticator failed for (static-221.76.249.49-tataidc.co.in) [49.249.76.221]:51792: 535 Incorrect authentication data (set_id=services)49.249.76.2211269750mQ  -e) ossec13001h 6Exim Auth failed2025-04-24 00:22:32 dovecot_login authenticator failed for ([221.209.48.204]) [221.209.48.203]:58386: 535 Incorrect authentication data (set_id=services@heipowersystem.com)221.209.48.2031814991vP  -y' ossec13001h 6Exim Auth failed2025-04-24 00:20:51 dovecot_login authenticator failed for ([8.209.247.238]) [8.209.247.238]:44676: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)8.209.247.2381861060fO  -W) ossec13001h 6Exim Auth failed2025-04-24 00:21:04 dovecot_login authenticator failed for ([77.238.129.173]) [77.238.129.173]:58492: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)77.238.129.1732017370NN  --# ossec13001h 5@Exim Auth failed2025-04-24 00:15:20 dovecot_login authenticator failed for ([61.51.81.78]) [61.51.81.78]:36648: 535 Incorrect authentication data (set_id=sales)61.51.81.781814991M  - + ossec13001h 52Exim Auth failed2025-04-24 00:15:05 dovecot_login authenticator failed for (static.ill.117.250.253.141.bsnl.co.in) [117.250.253.137]:41218: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)117.250.253.1371269750cL  -S' ossec13001h 3TExim Auth failed2025-04-24 00:07:08 dovecot_login authenticator failed for ([38.147.244.61]) [38.147.244.61]:47444: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)38.147.244.616251999K  -%+ ossec13001h 3<Exim Auth failed2025-04-24 00:06:43 dovecot_login authenticator failed for mobile-166-130-176-136.mycingular.net [166.130.176.136]:44028: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)166.130.176.1366252001 : Q:+ h "{"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 11:17:32 dovecot_login authenticator failed for (visaotur.sdr.gvt.net.br) [186.215.245.175]:45935: 535 Incorrect authentication data (set_id=sales)","attackers_ip":"186.215.245.175","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745560053,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 11:17:41 dovecot_login authenticator failed for ([27.71.26.64]) [27.71.26.64]:16190: 535 Incorrect authentication data (set_id=purchase)","attackers_ip":"27.71.26.64","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745560061,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 11:17:09 dovecot_login authenticator failed for syn-137-027-032-070.biz.spectrum.com [137.27.32.70]:47722: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)","attackers_ip":"137.27.32.70","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745560029,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 11:17:18 dovecot_login authenticator failed for 110-25-101-237.adsl.fetnet.net [110.25.101.237]:40664: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)","attackers_ip":"110.25.101.237","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745560039,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}+*Ph {"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 10:25:38 dovecot_login authenticator failed for 217-209-81-167-no2813.tbcn.telia.com [217.209.81.167]:57058: 535 Incorrect authentication data (set_id=services@heipowersystem.com)","attackers_ip":"217.209.81.167","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745556938,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 10:25:47 dovecot_login authenticator failed for ([95.221.179.61]) [95.221.179.61]:53259: 535 Incorrect authentication data (set_id=services)","attackers_ip":"95.221.179.61","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745556948,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}  N h jE{"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 16:25:33 dovecot_login authenticator failed for (User) [185.93.89.218]:8306: 535 Incorrect authentication data (set_id=root)","attackers_ip":"185.93.89.218","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745578533,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}) Lh i{"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 16:20:35 dovecot_login authenticator failed for ([103.107.36.18]) [103.107.36.18]:49494: 535 Incorrect authentication data (set_id=sales)","attackers_ip":"103.107.36.18","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745578235,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 16:20:23 dovecot_login authenticator failed for pool-72-76-194-159.nwrknj.fios.verizon.net [72.76.194.159]:60884: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)","attackers_ip":"72.76.194.159","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745578225,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}0Zh s{"content":[{"rule":"5715","retries":1,"severity":3,"name":"SSHD authentication success.","message":"Apr 25 17:05:19 vm1 sshd[3392729]: Accepted password for root from 103.190.54.7 port 54788 ssh2","attackers_ip":"103.190.54.7","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745580921,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}0Zh si{"content":[{"rule":"5715","retries":1,"severity":3,"name":"SSHD authentication success.","message":"Apr 25 17:04:35 vm1 sshd[3392410]: Accepted password for root from 103.190.54.7 port 54786 ssh2","attackers_ip":"103.190.54.7","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745580875,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0} & 0 L i .Bcb~  -O) ossec13001h _{Exim Auth failed2025-04-24 03:15:30 dovecot_login authenticator failed for ([180.158.234.88]) [180.158.234.88]:40348: 535 Incorrect authentication data (set_id=vikas.khandelwal)180.158.234.881814991x}  -y+ ossec13001h _eExim Auth failed2025-04-24 03:15:08 dovecot_login authenticator failed for ([103.123.114.215]) [103.123.114.215]:34788: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)103.123.114.2151168579H|  -' ossec13001h \Exim Auth failed2025-04-24 03:03:04 dovecot_login authenticator failed for (User) [185.93.89.218]:39034: 535 Incorrect authentication data (set_id=info2)185.93.89.218130758Z{  -=+ ossec13001h VExim Auth failed2025-04-24 02:38:18 dovecot_login authenticator failed for ([111.171.127.190]) [111.171.127.190]:42292: 535 Incorrect authentication data (set_id=sales)111.171.127.1901835841gz  -[' ossec13001h VExim Auth failed2025-04-24 02:38:03 dovecot_login authenticator failed for ([58.252.222.81]) [58.252.222.81]:39478: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)58.252.222.811814991Gy  -' ossec13001h VExim Auth failed2025-04-24 02:37:11 dovecot_login authenticator failed for (User) [185.93.89.217]:49250: 535 Incorrect authentication data (set_id=root)185.93.89.217130758Qx  -3# ossec13001h UExim Auth failed2025-04-24 02:34:25 dovecot_login authenticator failed for ([14.54.22.11]) [14.54.22.11]:14314: 535 Incorrect authentication data (set_id=services)14.54.22.111835841 w  -+ ossec13001h UExim Auth failed2025-04-24 02:34:10 dovecot_login authenticator failed for (187-93-236-244.customer.tdatabrasil.net.br) [179.184.176.137]:45019: 535 Incorrect authentication data (set_id=services@heipowersystem.com)179.184.176.1373469034Hv  -' ossec13001h UExim Auth failed2025-04-24 02:31:15 dovecot_login authenticator failed for (User) [185.93.89.218]:22482: 535 Incorrect authentication data (set_id=info1)185.93.89.218130758ju  -a' ossec13001h R Exim Auth failed2025-04-24 02:18:31 dovecot_login authenticator failed for vps-b674cd8d.vps.ovh.net [51.68.226.171]:52404: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)51.68.226.1713017382qt  -u% ossec13001h RExim Auth failed2025-04-24 02:18:17 dovecot_login authenticator failed for ([65.20.174.38]) [65.20.174.38]:33668: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)65.20.174.3899237Ts  -5' ossec13001h QExim Auth failed2025-04-24 02:17:23 dovecot_login authenticator failed for ([57.128.19.228]) [57.128.19.228]:58664: 535 Incorrect authentication data (set_id=sales)57.128.19.2283017382^r  -O! ossec13001h QExim Auth failed2025-04-24 02:17:12 dovecot_login authenticator failed for ([1.25.18.18]) [1.25.18.18]:57856: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)1.25.18.181814991_q  -K' ossec13001h QExim Auth failed2025-04-24 02:16:10 dovecot_login authenticator failed for ([38.147.244.61]) [38.147.244.61]:57060: 535 Incorrect authentication data (set_id=vikas.khandelwal)38.147.244.616251999qp  -q' ossec13001h QExim Auth failed2025-04-24 02:15:51 dovecot_login authenticator failed for ([185.167.56.34]) [185.167.56.34]:56824: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)185.167.56.34617790ro  -q' ossec13001h OExim Auth failed2025-04-24 02:09:07 dovecot_login authenticator failed for ([218.90.151.10]) [218.90.151.10]:54268: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)218.90.151.101814991^n -K% ossec13001h O Exim Auth failed2025-04-24 02:05:25 dovecot_login authenticator failed for (User) [80.94.95.228]:43172: 535 Incorrect authentication data (set_id=administrator@technobases.in)80.94.95.228798549    / / SDIKrk@  -_+ ossec13001h Exim Auth failed2025-04-25 05:14:07 dovecot_login authenticator failed for (vcs-app.naukanet.ru) [185.145.125.212]:64881: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)185.145.125.2122017370T?  -5' ossec13001h ̎Exim Auth failed2025-04-25 05:13:10 dovecot_login authenticator failed for ([31.173.20.146]) [31.173.20.146]:58544: 535 Incorrect authentication data (set_id=sales)31.173.20.1462017370y>  -}) ossec13001h ̴Exim Auth failed2025-04-25 05:13:47 dovecot_login authenticator failed for ([117.247.204.32]) [120.60.107.227]:43478: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)120.60.107.2271269750v=  -{% ossec13001h `Exim Auth failed2025-04-25 05:12:24 dovecot_login authenticator failed for c-73-95-112-29.hsd1.co.comcast.net [73.95.112.29]:57326: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)73.95.112.296252001F<  -' ossec13001h \Exim Auth failed2025-04-25 05:12:20 dovecot_login authenticator failed for (User) [185.93.89.218]:35538: 535 Incorrect authentication data (set_id=fax)185.93.89.218130758N;  --# ossec13001h \Exim Auth failed2025-04-25 05:12:20 dovecot_login authenticator failed for ([177.25.59.5]) [177.25.59.5]:43324: 535 Incorrect authentication data (set_id=sales)177.25.59.53469034Z:  -=+ ossec13001h ~Exim Auth failed2025-04-25 05:12:53 dovecot_login authenticator failed for ([101.229.184.223]) [101.229.184.223]:58730: 535 Incorrect authentication data (set_id=sales)101.229.184.2231814991c9  -W% ossec13001h LExim Auth failed2025-04-25 05:12:04 dovecot_login authenticator failed for ([185.226.88.5]) [185.226.88.5]:53164: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)185.226.88.5783754v8  -y' ossec13001h @Exim Auth failed2025-04-25 05:11:52 dovecot_login authenticator failed for 111-70-49-188.emome-ip.hinet.net [111.70.49.188]:57177: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)111.70.49.1881668284*7  3Y+ ossec11301h New FTP connection.Apr 25 05:10:44 vm1 pure-ftpd[3234254]: (?@185.247.137.206) [INFO] New connection from 185.247.137.206185.247.137.206298795W6  -;' ossec13001h nExim Auth failed2025-04-25 05:08:21 dovecot_login authenticator failed for ([117.156.80.55]) [117.156.80.55]:33006: 535 Incorrect authentication data (set_id=purchase)117.156.80.551814991{5  -% ossec13001h ^Exim Auth failed2025-04-25 05:08:04 dovecot_login authenticator failed for (122.11.169-7.unknown.starhub.net.sg) [122.11.169.7]:1918: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)122.11.169.71880251j4  -a' ossec13001h RExim Auth failed2025-04-25 05:07:53 dovecot_login authenticator failed for ([182.42.113.10]) [182.42.113.10]:48814: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)182.42.113.101814991u3  -u) ossec13001h ʲExim Auth failed2025-04-25 05:05:12 dovecot_login authenticator failed for ([103.174.145.35]) [103.174.145.35]:35551: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)103.174.145.351269750x2  -y+ ossec13001h ʤExim Auth failed2025-04-25 05:04:58 dovecot_login authenticator failed for ([123.116.142.131]) [123.116.142.131]:47334: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)123.116.142.1311814991m1  -k# ossec13001h ʘExim Auth failed2025-04-25 05:04:46 dovecot_login authenticator failed for ([61.37.150.35]) [61.37.150.6]:49401: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)61.37.150.61835841t0  -u) ossec13001h ʄExim Auth failed2025-04-25 05:04:26 dovecot_login authenticator failed for ([85.159.165.216]) [85.159.165.216]:60376: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)85.159.165.216294640 0 5 M 7 #7/HJLa  -S# ossec13001h rExim Auth failed2025-04-25 17:01:27 dovecot_login authenticator failed for ([14.23.77.27]) [14.23.77.27]:36470: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)14.23.77.271814991W -7) ossec13001h rExim Auth failed2025-04-25 17:01:23 dovecot_login authenticator failed for (rokamauka.com) [42.193.105.109]:34938: 535 Incorrect authentication data (set_id=nologin)42.193.105.1091814991`  -S# ossec13001h r{Exim Auth failed2025-04-25 17:01:07 dovecot_login authenticator failed for ([5.30.85.215]) [5.30.85.215]:39202: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)5.30.85.215290557H  -' ossec13001h qExim Auth failed2025-04-25 16:57:51 dovecot_login authenticator failed for (User) [185.93.89.218]:11140: 535 Incorrect authentication data (set_id=sales)185.93.89.218130758y  -' ossec13001h pUExim Auth failed2025-04-25 16:51:56 dovecot_login authenticator failed for lfbn-reu-1-14-205.w83-198.abo.wanadoo.fr [83.198.11.205]:51623: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)83.198.11.205935317y  -}) ossec13001h pKExim Auth failed2025-04-25 16:51:45 dovecot_login authenticator failed for ([91.202.199.145]) [91.202.199.145]:56120: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)91.202.199.1452017370b  -Q' ossec13001h oExim Auth failed2025-04-25 16:48:42 dovecot_login authenticator failed for 42-200-70-134.static.imsbiz.com [42.200.70.134]:47604: 535 Incorrect authentication data (set_id=sales)42.200.70.1341819730  -' ossec13001h ozExim Auth failed2025-04-25 16:48:18 dovecot_login authenticator failed for 107-210-71-89.lightspeed.gdrpmi.sbcglobal.net [107.210.71.89]:35881: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)107.210.71.896252001g  -[' ossec13001h oxExim Auth failed2025-04-25 16:48:16 dovecot_login authenticator failed for ([50.123.92.130]) [50.123.92.130]:43604: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)50.123.92.1306252001  ;) ossec13008h o Mail Recipient rejected2025-04-25 16:46:27 H=(localhost.localdomain) [78.153.140.207]:40116 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no F= rejected RCPT : Sender verify failed78.153.140.2072635167?  gQ' ossec11307h nMultiple connection attempts from same sourceApr 25 16:42:23 vm1 pure-ftpd[3387311]: (?@206.168.34.83) [INFO] New connection from 206.168.34.83206.168.34.836252001& 3Q' ossec11301h n New FTP connection.Apr 25 16:42:13 vm1 pure-ftpd[3387279]: (?@206.168.34.83) [INFO] New connection from 206.168.34.83206.168.34.836252001"  3M% ossec11301h m<New FTP connection.Apr 25 16:38:42 vm1 pure-ftpd[3386578]: (?@20.29.52.224) [INFO] New connection from 20.29.52.22420.29.52.2246252001c  -S' ossec13001h jaExim Auth failed2025-04-25 16:26:33 dovecot_login authenticator failed for ([58.18.212.238]) [58.18.212.238]:50972: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)58.18.212.2381814991v  -y' ossec13001h jUExim Auth failed2025-04-25 16:26:21 dovecot_login authenticator failed for ([223.71.98.202]) [223.71.98.202]:53697: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)223.71.98.2021814991F  -' ossec13001h j%Exim Auth failed2025-04-25 16:25:33 dovecot_login authenticator failed for (User) [185.93.89.218]:8306: 535 Incorrect authentication data (set_id=root)185.93.89.218130758  - ' ossec13001h hExim Auth failed2025-04-25 16:20:23 dovecot_login authenticator failed for pool-72-76-194-159.nwrknj.fios.verizon.net [72.76.194.159]:60884: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)72.76.194.1596252001 5 4 L O v  -Bcd  -U' ossec13001h fSExim Auth failed2025-04-24 03:44:41 dovecot_login authenticator failed for c-85-228-121-10.bbcust.telenor.se [85.228.121.10]:58952: 535 Incorrect authentication data (set_id=sales)85.228.121.102661886m  -g' ossec13001h f?Exim Auth failed2025-04-24 03:44:21 dovecot_login authenticator failed for vps-e8345fbe.vps.ovh.ca [51.222.141.10]:34140: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)51.222.141.106251999X -9) ossec13001h eExim Auth failed2025-04-24 03:42:20 dovecot_login authenticator failed for (nyaystambh.com) [42.193.105.109]:47444: 535 Incorrect authentication data (set_id=nologin)42.193.105.1091814991Z  -?) ossec13001h e[Exim Auth failed2025-04-24 03:40:34 dovecot_login authenticator failed for ([210.219.232.34]) [210.219.232.34]:54078: 535 Incorrect authentication data (set_id=services)210.219.232.341835841f  -]% ossec13001h eOExim Auth failed2025-04-24 03:40:22 dovecot_login authenticator failed for ([85.122.56.15]) [85.122.56.15]:46214: 535 Incorrect authentication data (set_id=services@heipowersystem.com)85.122.56.15798549Z  -?) ossec13001h dExim Auth failed2025-04-24 03:35:02 dovecot_login authenticator failed for ([210.206.24.238]) [210.206.24.234]:28142: 535 Incorrect authentication data (set_id=purchase)210.206.24.2341835841G  -' ossec13001h dExim Auth failed2025-04-24 03:34:55 dovecot_login authenticator failed for (User) [185.93.89.218]:58616: 535 Incorrect authentication data (set_id=mail)185.93.89.218130758m  -e) ossec13001h cExim Auth failed2025-04-24 03:34:41 dovecot_login authenticator failed for ([60.173.114.254]) [60.173.114.254]:47945: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)60.173.114.2541814991B  -% ossec13001h cExim Auth failed2025-04-24 03:34:35 dovecot_login authenticator failed for ([212.3.152.47]) [212.3.152.47]:47156: 535 Incorrect authentication data212.3.152.472017370v  -{' ossec13001h aExim Auth failed2025-04-24 03:24:35 dovecot_login authenticator failed for ([196.191.212.226]) [213.55.85.202]:4462: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)213.55.85.202337996e  -W) ossec13001h aExim Auth failed2025-04-24 03:24:54 dovecot_login authenticator failed for ([102.23.254.239]) [102.23.254.239]:44895: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)102.23.254.239953987T  -5' ossec13001h aVExim Auth failed2025-04-24 03:23:24 dovecot_login authenticator failed for ([45.115.173.11]) [45.115.173.11]:42721: 535 Incorrect authentication data (set_id=sales)45.115.173.111269750x  -{) ossec13001h aJExim Auth failed2025-04-24 03:23:12 dovecot_login authenticator failed for (134.239.223.60.adsl-pool.sx.cn) [60.223.239.134]:42533: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)60.223.239.1341814991c  -S' ossec13001h `Exim Auth failed2025-04-24 03:21:48 dovecot_login authenticator failed for ([180.97.90.143]) [180.97.90.143]:49935: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)180.97.90.1431814991|  -+ ossec13001h `Exim Auth failed2025-04-24 03:21:36 dovecot_login authenticator failed for ([203.123.219.137]) [203.123.219.137]:33140: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)203.123.219.1371835841W  -9) ossec13001h `Exim Auth failed2025-04-24 03:18:11 dovecot_login authenticator failed for ([112.91.124.108]) [112.91.124.108]:48844: 535 Incorrect authentication data (set_id=sales)112.91.124.1081814991j  -_) ossec13001h `Exim Auth failed2025-04-24 03:17:59 dovecot_login authenticator failed for ([121.11.145.163]) [121.11.145.163]:49256: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)121.11.145.1631814991 \~tj`VLB8.$zpf\RH>4*   v l b X N D : 0 &    | r h ^ T J @ 6 , "    x n d Z P F < 2 (   ~ t j ` V L B 8 . $    z p f \ h %uO h %iO h $AO h #QO h O h O h DO h O h &O h %O h O h O h O h WO h KO h O h O h nO h UO h O h O h oO h iO h O h O h O h pO h ^O h RO h O h O h 4O h $O h O h gO h O h O h O h O h O h wO h qO h O h O h O h O h O h tO h 8O h "O h ԅO h ԅO h O h O h O h O h O h O h O h hO h O h O h O h O h O h O h O h O h HO h O h O h O h "O h O h O h :O h (O h O h cO h 5O h -O h O h O h O h O h oO h O h O h cO h O h O h O h O h O h !O h O h {O h wO h wO h uGO h u;O h sO h sO h sO h rO h q:O h pO h ppO h o>O h lmO h l_O h l5O h kO h kO h g O h ezO h dO h cO h cO h \O~ h \#O} h \O| h ZO{ h ZOz h XOy h XOx h V0Ow h V0Ov h VOu h UOt h UOOs h SOr h SwOq h SwOp h SgOo h QOm h QOn h QmOl h Q]Ok h MOj h JOi h JkOh h EOg h CuOf h CiOe h BGOd h @Oc h >ROb h 9oOa h 8RO` h 8GO_ h 6O^ h 6tO] h 6fO\ h 5 O[ h 3YOZ h 3IOY h 2OX h 2OW h 1_OV h 1SOU h /2OT h -xOS h -lOR h +OQ h 'OP h $TOO h $FON h #OL h #OM xjh #p{"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-26 05:36:03 dovecot_login authenticator failed for ([5.31.0.134]) [5.31.0.134]:56418: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)","attackers_ip":"5.31.0.134","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745625963,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-26 05:35:09 dovecot_login authenticator failed for ([211.216.193.28]) [211.216.193.28]:53793: 535 Incorrect authentication data (set_id=sales)","attackers_ip":"211.216.193.28","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745625909,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-26 05:35:19 dovecot_login authenticator failed for ([221.127.75.94]) [221.127.75.94]:35502: 535 Incorrect authentication data (set_id=sales)","attackers_ip":"221.127.75.94","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745625919,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-26 05:35:37 dovecot_login authenticator failed for h77-53-111-65.cust.bredband2.com [77.53.111.65]:43734: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)","attackers_ip":"77.53.111.65","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745625937,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-26 05:35:48 dovecot_login authenticator failed for c-73-162-50-231.hsd1.ca.comcast.net [73.162.50.231]:49232: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)","attackers_ip":"73.162.50.231","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745625949,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-26 05:36:01 dovecot_login authenticator failed for (dsl-mp-dynamic-020.133.23.125.airtelbroadband.in) [125.23.132.74]:57942: 535 Incorrect authentication data (set_id=sales)","attackers_ip":"125.23.132.74","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745625961,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0} 8 > _ L X |Zk4@^8(n  3U) ossec11301h FNew FTP connection.Apr 24 16:28:12 vm1 pure-ftpd[3058972]: (?@152.59.109.221) [INFO] New connection from 152.59.109.221152.59.109.2211269750 m  C) ossec11313h FTP file uploaded to serverApr 24 16:26:14 vm1 pure-ftpd[3058638]: (user@s2seducationtrust.com@152.59.109.221) [NOTICE] /home/techno/public_html/s2seducationtrust.com//sitemap.xml uploaded (7279 bytes, 585.68KB/sec)152.59.109.2211269750(l  3U) ossec11301h New FTP connection.Apr 24 16:26:13 vm1 pure-ftpd[3058638]: (?@152.59.109.221) [INFO] New connection from 152.59.109.221152.59.109.22112697509k  Cg) ossec11309h FTP Authentication success.Apr 24 16:26:14 vm1 pure-ftpd[3058638]: (?@152.59.109.221) [INFO] user@s2seducationtrust.com is now logged in152.59.109.2211269750]j  -C+ ossec13001h rExim Auth failed2025-04-24 16:24:41 dovecot_login authenticator failed for ([103.146.233.187]) [103.146.233.187]:41223: 535 Incorrect authentication data (set_id=services)103.146.233.1871269750oi  -o# ossec13001h dExim Auth failed2025-04-24 16:24:26 dovecot_login authenticator failed for (48.81.6.185.in-addr.arpa) [185.6.81.48]:58456: 535 Incorrect authentication data (set_id=services@heipowersystem.com)185.6.81.482017370Gh  -' ossec13001h Exim Auth failed2025-04-24 16:21:45 dovecot_login authenticator failed for (User) [185.93.89.218]:15204: 535 Incorrect authentication data (set_id=test)185.93.89.2181307589g  Cg) ossec11309h FTP Authentication success.Apr 24 16:21:33 vm1 pure-ftpd[3057561]: (?@152.59.109.221) [INFO] user@s2seducationtrust.com is now logged in152.59.109.2211269750(f  3U) ossec11301h New FTP connection.Apr 24 16:21:28 vm1 pure-ftpd[3057561]: (?@152.59.109.221) [INFO] New connection from 152.59.109.221152.59.109.2211269750je  -a' ossec13001h Exim Auth failed2025-04-24 16:16:38 dovecot_login authenticator failed for (106.51.79.73.actcorp.in) [122.171.18.50]:6259: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)122.171.18.501269750d  -E) ossec13001h Exim Auth failed2025-04-24 16:16:28 dovecot_login authenticator failed for (abts-north-static-059.221.160.122.airtelbroadband.in) [122.160.221.59]:41138: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)122.160.221.591269750Wc  -9) ossec13001h oExim Auth failed2025-04-24 16:16:06 dovecot_login authenticator failed for ([73.231.102.189]) [73.231.102.189]:59726: 535 Incorrect authentication data (set_id=sales)73.231.102.1896252001ob  -i) ossec13001h aExim Auth failed2025-04-24 16:15:53 dovecot_login authenticator failed for (stilsoft.sevkavkaz.ru) [88.215.141.146]:37844: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)88.215.141.1462017370a  -') ossec13001h 4Exim Auth failed2025-04-24 16:02:20 dovecot_login authenticator failed for (abts-mum-static-127.120.70.182.airtelbroadband.in) [182.70.120.127]:55476: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)182.70.120.1271269750Z`  -?) ossec13001h >Exim Auth failed2025-04-24 16:02:30 dovecot_login authenticator failed for ([154.144.243.93]) [154.144.243.93]:34168: 535 Incorrect authentication data (set_id=purchase)154.144.243.932542007Z_  -=+ ossec13001h Exim Auth failed2025-04-24 15:59:45 dovecot_login authenticator failed for ([203.128.181.121]) [203.128.181.121]:55250: 535 Incorrect authentication data (set_id=sales)203.128.181.1211835841x^  -}' ossec13001h Exim Auth failed2025-04-24 15:59:23 dovecot_login authenticator failed for 217-211-89-23-no600.tbcn.telia.com [217.211.89.23]:56274: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)217.211.89.232661886a]  -Q' ossec13001h Exim Auth failed2025-04-24 15:55:40 dovecot_login authenticator failed for 157.253.94.80.dyn.idknet.com [80.94.253.157]:52096: 535 Incorrect authentication data (set_id=services)80.94.253.157617790 d/ %5Jda\  -U! ossec13001h Exim Auth failed2025-04-24 15:55:23 dovecot_login authenticator failed for ([14.33.96.3]) [14.33.96.3]:56328: 535 Incorrect authentication data (set_id=services@heipowersystem.com)14.33.96.31835841f[  -W) ossec13001h `Exim Auth failed2025-04-24 15:50:14 dovecot_login authenticator failed for ([196.28.226.124]) [196.28.226.124]:48343: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)196.28.226.1241036973GZ  -' ossec13001h JExim Auth failed2025-04-24 15:49:53 dovecot_login authenticator failed for (User) [185.93.89.218]:15352: 535 Incorrect authentication data (set_id=tech)185.93.89.218130758 Y  -) ossec13001h HExim Auth failed2025-04-24 15:49:51 dovecot_login authenticator failed for (177-20-171-155.zaaztelecom.com.br) [177.20.171.155]:52248: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)177.20.171.1553469034X  -)+ ossec13001h Exim Auth failed2025-04-24 15:39:17 dovecot_login authenticator failed for (static.ill.117.250.236.234.bsnl.co.in) [117.250.236.234]:58379: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)117.250.236.2341269750iW  -a' ossec13001h Exim Auth failed2025-04-24 15:39:35 dovecot_login authenticator failed for broad2124.cyberia.net.lb [212.28.225.92]:45923: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)212.28.225.92272103oV  -k' ossec13001h Exim Auth failed2025-04-24 15:38:05 dovecot_login authenticator failed for 104.178.69.85.rev.sfr.net [85.69.178.104]:35392: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)85.69.178.1043017382TU  -5' ossec13001h Exim Auth failed2025-04-24 15:38:17 dovecot_login authenticator failed for ([209.173.10.75]) [209.173.10.75]:59422: 535 Incorrect authentication data (set_id=sales)209.173.10.756252001jT  -a' ossec13001h Exim Auth failed2025-04-24 15:30:25 dovecot_login authenticator failed for (PPPoE-88-147-148-51.san.ru) [88.147.148.51]:58354: 535 Incorrect authentication data (set_id=vikas.khandelwal)88.147.148.512017370S  -) ossec13001h Exim Auth failed2025-04-24 15:30:08 dovecot_login authenticator failed for c151-177-147-36.bredband.tele2.se [151.177.147.36]:40793: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)151.177.147.362661886uR  -u) ossec13001h Exim Auth failed2025-04-24 15:29:58 dovecot_login authenticator failed for ([114.254.81.120]) [114.254.81.120]:59718: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)114.254.81.1201814991JQ  -#' ossec13001h Exim Auth failed2025-04-24 15:18:01 dovecot_login authenticator failed for (User) [185.93.89.218]:39532: 535 Incorrect authentication data (set_id=support)185.93.89.218130758bP  -O) ossec13001h 4Exim Auth failed2025-04-24 15:15:22 dovecot_login authenticator failed for ([114.202.80.152]) [114.202.80.152]:50935: 535 Incorrect authentication data (set_id=vikas.khandelwal)114.202.80.1521835841uO  -u) ossec13001h (Exim Auth failed2025-04-24 15:15:11 dovecot_login authenticator failed for ([61.143.241.150]) [61.143.241.150]:34255: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)61.143.241.1501814991(N  3U) ossec11301h New FTP connection.Apr 24 15:13:04 vm1 pure-ftpd[3042738]: (?@106.206.152.93) [INFO] New connection from 106.206.152.93106.206.152.931269750;M  Ck) ossec11309h FTP Authentication success.Apr 24 15:13:05 vm1 pure-ftpd[3042738]: (?@106.206.152.93) [INFO] user@saintsoldiercollege.com is now logged in106.206.152.931269750 L  C ) ossec11313h FTP file uploaded to serverApr 24 15:13:39 vm1 pure-ftpd[3042738]: (user@saintsoldiercollege.com@106.206.152.93) [NOTICE] /home/techno/public_html/saintsoldiercollege.com//index.php uploaded (30576 bytes, 319.03KB/sec)106.206.152.931269750 E3 A - L N x/P<Er1  -q' ossec13001h ~aExim Auth failed2025-04-24 05:27:20 dovecot_login authenticator failed for ([39.165.183.70]) [39.165.183.70]:42692: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)39.165.183.7018149910  ;) ossec13008h }KMail Recipient rejected2025-04-24 05:22:41 H=(localhost.localdomain) [78.153.140.207]:49042 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no F= rejected RCPT : Sender verify failed78.153.140.2072635167Z/  -?) ossec13001h {0Exim Auth failed2025-04-24 05:13:44 dovecot_login authenticator failed for ([117.158.243.50]) [117.158.243.50]:58768: 535 Incorrect authentication data (set_id=purchase)117.158.243.501814991Z.  -?) ossec13001h zExim Auth failed2025-04-24 05:12:45 dovecot_login authenticator failed for 222.42.246.220.static.netvigator.com [220.246.42.222]:52326: 535 Incorrect authentication data220.246.42.2221819730d-  -Y# ossec13001h { Exim Auth failed2025-04-24 05:13:27 dovecot_login authenticator failed for ([27.98.249.9]) [27.98.249.9]:59881: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)27.98.249.91814991L,  -'' ossec13001h zrExim Auth failed2025-04-24 05:10:33 dovecot_login authenticator failed for (User) [185.93.89.218]:13252: 535 Incorrect authentication data (set_id=marketing)185.93.89.218130758f+  -W) ossec13001h yExim Auth failed2025-04-24 05:07:46 dovecot_login authenticator failed for ([220.77.182.169]) [220.77.182.169]:34893: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)220.77.182.1691835841g*  -]% ossec13001h yExim Auth failed2025-04-24 05:07:43 dovecot_login authenticator failed for ([183.99.89.74]) [183.99.89.74]:48582: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)183.99.89.741835841x)  -}) ossec13001h yExim Auth failed2025-04-24 05:07:33 dovecot_login authenticator failed for ([196.216.12.176]) [196.216.12.176]:51132: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)196.216.12.176927384W(  -;' ossec13001h yExim Auth failed2025-04-24 05:07:54 dovecot_login authenticator failed for ([183.182.99.92]) [183.182.99.92]:35811: 535 Incorrect authentication data (set_id=purchase)183.182.99.921655842Q'  -1% ossec13001h xvExim Auth failed2025-04-24 05:02:05 dovecot_login authenticator failed for ([39.170.5.210]) [39.170.5.210]:54122: 535 Incorrect authentication data (set_id=sales)39.170.5.2101814991y&  -}) ossec13001h xbExim Auth failed2025-04-24 05:01:44 dovecot_login authenticator failed for 125-228-90-178.hinet-ip.hinet.net [125.228.90.178]:52551: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)125.228.90.1781668284\% -E% ossec13001h w-Exim Auth failed2025-04-24 04:56:37 dovecot_login authenticator failed for (amplifypowerglobal.com) [150.5.145.36]:54744: 535 Incorrect authentication data (set_id=nologin)150.5.145.361880251$  ;) ossec13008h w)Mail Recipient rejected2025-04-24 04:56:33 H=(localhost.localdomain) [78.153.140.207]:44840 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no F= rejected RCPT : Sender verify failed78.153.140.2072635167m#  -c+ ossec13001h uExim Auth failed2025-04-24 04:50:36 dovecot_login authenticator failed for ([119.207.156.209]) [119.207.156.209]:32579: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)119.207.156.2091835841J"  -#' ossec13001h sExim Auth failed2025-04-24 04:38:50 dovecot_login authenticator failed for (User) [185.93.89.218]:60540: 535 Incorrect authentication data (set_id=manager)185.93.89.218130758y!  -}) ossec13001h qExim Auth failed2025-04-24 04:30:33 dovecot_login authenticator failed for ([129.80.228.231]) [129.80.228.231]:41042: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)129.80.228.2316252001  0 8 V f1B  UC+ ossec11001h Deferred login on the cpanel service[2025-04-24 06:32:06 +0530] info [whostmgrd] 106.207.160.102 - root "GET / HTTP/1.1" DEFERRED LOGIN whostmgrd: cookie ip check: IP address has changed: IP Address [106.221.168.78] != Current IP Address [106.207.160.102]106.207.160.1021269750=A  Cm+ ossec11309h FTP Authentication success.Apr 24 06:29:53 vm1 pure-ftpd[2924171]: (?@106.207.160.102) [INFO] user@saintsoldiercollege.com is now logged in106.207.160.1021269750+@  3Y+ ossec11301h New FTP connection.Apr 24 06:29:52 vm1 pure-ftpd[2924171]: (?@106.207.160.102) [INFO] New connection from 106.207.160.102106.207.160.1021269750%?  3Q' ossec11301h JNew FTP connection.Apr 24 06:22:24 vm1 pure-ftpd[2922829]: (?@88.214.25.125) [INFO] New connection from 88.214.25.12588.214.25.1252921044H>  -' ossec13001h xExim Auth failed2025-04-24 06:14:40 dovecot_login authenticator failed for (User) [185.93.89.218]:32008: 535 Incorrect authentication data (set_id=mysql)185.93.89.218130758n=  -i' ossec13001h MExim Auth failed2025-04-24 06:05:25 dovecot_login authenticator failed for 111-70-13-246.emome-ip.hinet.net [111.70.13.246]:33617: 535 Incorrect authentication data (set_id=vikas.khandelwal)111.70.13.2461668284s<  -u% ossec13001h AExim Auth failed2025-04-24 06:05:13 dovecot_login authenticator failed for 183-69.soderhamn.com [81.94.69.183]:46360: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)81.94.69.1832661886Z;  -=+ ossec13001h IExim Auth failed2025-04-24 05:56:47 dovecot_login authenticator failed for ([123.232.187.243]) [123.232.187.243]:47918: 535 Incorrect authentication data (set_id=sales)123.232.187.2431814991g:  -[' ossec13001h =Exim Auth failed2025-04-24 05:56:35 dovecot_login authenticator failed for ([36.135.62.103]) [36.135.62.103]:42968: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)36.135.62.1031814991k9  -_+ ossec13001h WExim Auth failed2025-04-24 05:52:45 dovecot_login authenticator failed for (208.235.164.124.adsl-pool.sx.cn) [124.164.235.208]:37083: 535 Incorrect authentication data (set_id=services)124.164.235.20818149918  - ' ossec13001h IExim Auth failed2025-04-24 05:52:32 dovecot_login authenticator failed for (static-186.136.143.114-tataidc.co.in) [49.36.120.161]:34288: 535 Incorrect authentication data (set_id=services@heipowersystem.com)49.36.120.1611269750J7  -#' ossec13001h Exim Auth failed2025-04-24 05:42:23 dovecot_login authenticator failed for (User) [185.93.89.218]:43200: 535 Incorrect authentication data (set_id=monitor)185.93.89.218130758]6  -K# ossec13001h Exim Auth failed2025-04-24 05:37:00 dovecot_login authenticator failed for ([1.241.64.92]) [1.241.64.92]:51059: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)1.241.64.921835841s5  -u% ossec13001h Exim Auth failed2025-04-24 05:36:42 dovecot_login authenticator failed for ([98.70.127.17]) [98.70.127.17]:45610: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)98.70.127.171269750_4  -M% ossec13001h LExim Auth failed2025-04-24 05:35:31 dovecot_login authenticator failed for (144.121.245.65.lightower.net) [64.72.74.162]:35142: 535 Incorrect authentication data (set_id=sales)64.72.74.1626252001z3  -}+ ossec13001h BExim Auth failed2025-04-24 05:35:20 dovecot_login authenticator failed for kd113158205225.ppp-bb.dion.ne.jp [113.158.205.225]:60705: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)113.158.205.2251861060h2  -_% ossec13001h ~kExim Auth failed2025-04-24 05:27:31 dovecot_login authenticator failed for (p185.224.8-47.samaralan.ru) [185.224.8.47]:59052: 535 Incorrect authentication data (set_id=vikas.khandelwal)185.224.8.472017370 f & : U j p;FOfd/  -U' ossec13001h Exim Auth failed2025-04-25 04:58:28 dovecot_login authenticator failed for mail.toptronicsinc.com [218.4.156.254]:55334: 535 Incorrect authentication data (set_id=vikas.khandelwal)218.4.156.2541814991r.  -q' ossec13001h Exim Auth failed2025-04-25 04:58:09 dovecot_login authenticator failed for ([117.32.97.246]) [117.32.97.246]:59048: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)117.32.97.2461814991p-  -m' ossec13001h 3Exim Auth failed2025-04-25 04:58:50 dovecot_login authenticator failed for 81-225-238-64-no600.tbcn.telia.com [81.225.238.64]:34382: 535 Incorrect authentication data (set_id=vikas.khandelwal)81.225.238.642661886_,  -K' ossec13001h +Exim Auth failed2025-04-25 04:58:42 dovecot_login authenticator failed for ([49.124.153.33]) [49.124.153.33]:51820: 535 Incorrect authentication data (set_id=vikas.khandelwal)49.124.153.331733045p+  -i+ ossec13001h Exim Auth failed2025-04-25 04:57:20 dovecot_login authenticator failed for ([117.198.103.116]) [117.198.103.116]:43365: 535 Incorrect authentication data (set_id=services@heipowersystem.com)117.198.103.1161269750G*  -' ossec13001h Exim Auth failed2025-04-25 04:40:17 dovecot_login authenticator failed for (User) [185.93.89.218]:24634: 535 Incorrect authentication data (set_id=demo)185.93.89.218130758d)  -W% ossec13001h Exim Auth failed2025-04-25 04:27:07 dovecot_login authenticator failed for ([1.247.245.61]) [1.247.245.61]:38598: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)1.247.245.611835841j(  -_) ossec13001h Exim Auth failed2025-04-25 04:26:47 dovecot_login authenticator failed for ([157.122.198.56]) [157.122.198.56]:55297: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)157.122.198.561814991i'  -_) ossec13001h Exim Auth failed2025-04-25 04:26:35 dovecot_login authenticator failed for ([109.233.21.109]) [109.233.21.109]:47020: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)109.233.21.109272103E&  -' ossec13001h SExim Auth failed2025-04-25 04:08:10 dovecot_login authenticator failed for (User) [185.93.89.218]:55608: 535 Incorrect authentication data (set_id=db)185.93.89.218130758u%  -w' ossec13001h Exim Auth failed2025-04-25 04:05:51 dovecot_login authenticator failed for visaustralia.com [216.70.104.41]:48100: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)216.70.104.416252001f$  -W) ossec13001h Exim Auth failed2025-04-25 04:06:10 dovecot_login authenticator failed for ([220.77.182.169]) [220.77.182.169]:51204: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)220.77.182.1691835841`#  -O% ossec13001h Exim Auth failed2025-04-25 04:04:52 dovecot_login authenticator failed for 111-70-9-143.emome-ip.hinet.net [111.70.9.143]:48350: 535 Incorrect authentication data (set_id=sales)111.70.9.1431668284g"  -[' ossec13001h vExim Auth failed2025-04-25 04:04:29 dovecot_login authenticator failed for ([125.72.92.174]) [125.72.92.174]:45923: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)125.72.92.1741814991a!  -S' ossec13001h Exim Auth failed2025-04-25 03:57:45 dovecot_login authenticator failed for ([65.20.252.101]) [65.20.252.101]:40384: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)65.20.252.10199237  -' ossec13001h Exim Auth failed2025-04-25 03:57:22 dovecot_login authenticator failed for (ool-4b7fcd5b.static.optonline.net) [75.127.205.91]:47956: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)75.127.205.916252001b  -O) ossec13001h Exim Auth failed2025-04-25 03:56:31 dovecot_login authenticator failed for ([58.252.212.233]) [58.252.212.233]:37098: 535 Incorrect authentication data (set_id=vikas.khandelwal)58.252.212.2331814991 7 l g  17]K  -G' ossec13001h Exim Auth failed2025-04-24 14:52:20 dovecot_login authenticator failed for sagitario.itmorelia.edu.mx [200.33.171.65]:18381: 535 Incorrect authentication data (set_id=sales)200.33.171.653996063jJ  -_) ossec13001h Exim Auth failed2025-04-24 14:52:07 dovecot_login authenticator failed for ([211.48.113.101]) [211.48.113.101]:37704: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)211.48.113.1011835841kI  -c) ossec13001h Exim Auth failed2025-04-24 14:48:27 dovecot_login authenticator failed for (88.248.250.143.static.ttnet.com.tr) [88.248.250.143]:53666: 535 Incorrect authentication data (set_id=services)88.248.250.143298795dH  -Y# ossec13001h Exim Auth failed2025-04-24 14:48:01 dovecot_login authenticator failed for ([218.76.73.4]) [218.76.73.4]:11168: 535 Incorrect authentication data (set_id=services@heipowersystem.com)218.76.73.41814991JG  -#' ossec13001h PExim Auth failed2025-04-24 14:46:00 dovecot_login authenticator failed for (User) [185.93.89.218]:7104: 535 Incorrect authentication data (set_id=software)185.93.89.218130758F  C) ossec11313h FTP file uploaded to serverApr 24 14:44:43 vm1 pure-ftpd[3036402]: (user@saintsoldiercollege.com@106.206.152.93) [NOTICE] /home/techno/public_html/saintsoldiercollege.com//Head_web.php uploaded (20055 bytes, 305.39KB/sec)106.206.152.931269750;E  Ck) ossec11309h FTP Authentication success.Apr 24 14:44:43 vm1 pure-ftpd[3036402]: (?@106.206.152.93) [INFO] user@saintsoldiercollege.com is now logged in106.206.152.931269750(D  3U) ossec11301h New FTP connection.Apr 24 14:44:43 vm1 pure-ftpd[3036402]: (?@106.206.152.93) [INFO] New connection from 106.206.152.93106.206.152.931269750;C  Ck) ossec11309h FTP Authentication success.Apr 24 14:34:24 vm1 pure-ftpd[3034048]: (?@106.206.152.93) [INFO] user@saintsoldiercollege.com is now logged in106.206.152.931269750(B  3U) ossec11301h New FTP connection.Apr 24 14:34:24 vm1 pure-ftpd[3034048]: (?@106.206.152.93) [INFO] New connection from 106.206.152.93106.206.152.931269750^A  -O% ossec13001h Exim Auth failed2025-04-24 14:32:07 dovecot_login authenticator failed for ([65.20.151.34]) [65.20.151.34]:46132: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)65.20.151.3499237y@  -}) ossec13001h Exim Auth failed2025-04-24 14:31:55 dovecot_login authenticator failed for ([183.167.217.86]) [183.167.217.86]:48014: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)183.167.217.861814991c?  -U% ossec13001h Exim Auth failed2025-04-24 14:30:46 dovecot_login authenticator failed for 57.pool85-54-109.dynamic.orange.es [85.54.109.57]:46932: 535 Incorrect authentication data (set_id=sales)85.54.109.572510769>  - ) ossec13001h Exim Auth failed2025-04-24 14:30:35 dovecot_login authenticator failed for (nsg-corporate-88.249.187.122.airtel.in) [122.187.249.88]:54022: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)122.187.249.881269750+=  3Y+ ossec11301h yNew FTP connection.Apr 24 14:25:19 vm1 pure-ftpd[3032251]: (?@192.241.155.120) [INFO] New connection from 192.241.155.120192.241.155.1206252001e<  -S+ ossec13001h Exim Auth failed2025-04-24 14:22:41 dovecot_login authenticator failed for ([185.132.229.196]) [185.132.229.196]:34442: 535 Incorrect authentication data (set_id=vikas.khandelwal)185.132.229.1963175395u;  -u) ossec13001h Exim Auth failed2025-04-24 14:22:31 dovecot_login authenticator failed for ([203.252.159.12]) [203.252.159.12]:62388: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)203.252.159.121835841  TG6sfh `m{"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 15:43:19 dovecot_login authenticator failed for ([111.175.39.76]) [111.175.39.76]:40927: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)","attackers_ip":"111.175.39.76","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745576000,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 15:43:31 dovecot_login authenticator failed for (95.105.71.128.dynamic.ufanet.ru) [95.105.71.128]:42578: 535 Incorrect authentication data (set_id=vikas.khandelwal)","attackers_ip":"95.105.71.128","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745576013,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}(rJh @{"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 13:28:38 dovecot_login authenticator failed for ([65.20.149.26]) [65.20.149.26]:56860: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)","attackers_ip":"65.20.149.26","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745567919,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 13:28:50 dovecot_login authenticator failed for (as142506-239.168.103.khushibroadband.com) [103.168.239.60]:52633: 535 Incorrect authentication data (set_id=sales)","attackers_ip":"103.168.239.60","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745567931,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0} 26 = 5 = 9 CGI:  -!' ossec13001h Exim Auth failed2025-04-24 14:14:08 dovecot_login authenticator failed for (User) [185.93.89.218]:60186: 535 Incorrect authentication data (set_id=shared)185.93.89.218130758(9  3U) ossec11301h New FTP connection.Apr 24 14:06:23 vm1 pure-ftpd[3027681]: (?@135.119.16.173) [INFO] New connection from 135.119.16.173135.119.16.1736252001(8  3U) ossec11301h New FTP connection.Apr 24 13:48:13 vm1 pure-ftpd[3023657]: (?@223.185.235.50) [INFO] New connection from 223.185.235.50223.185.235.501269750;7  Ck) ossec11309h FTP Authentication success.Apr 24 13:48:13 vm1 pure-ftpd[3023657]: (?@223.185.235.50) [INFO] user@saintsoldiercollege.com is now logged in223.185.235.501269750W6  -9) ossec13001h $Exim Auth failed2025-04-24 13:45:32 dovecot_login authenticator failed for ([222.68.155.105]) [222.68.155.105]:55065: 535 Incorrect authentication data (set_id=sales)222.68.155.1051814991j5  -_) ossec13001h Exim Auth failed2025-04-24 13:45:17 dovecot_login authenticator failed for ([219.153.13.161]) [219.153.13.161]:44711: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)219.153.13.1611814991J4  -#' ossec13001h ^Exim Auth failed2025-04-24 13:42:13 dovecot_login authenticator failed for (User) [185.93.89.218]:62256: 535 Incorrect authentication data (set_id=service)185.93.89.218130758t3  -w% ossec13001h ,Exim Auth failed2025-04-24 13:41:24 dovecot_login authenticator failed for (static-50-43-62-166.bvtn.or.ptr.ziplyfiber.com) [50.43.62.166]:55325: 535 Incorrect authentication data (set_id=services)50.43.62.1666252001z2  -% ossec13001h Exim Auth failed2025-04-24 13:41:11 dovecot_login authenticator failed for h-46-59-52-199.a980.priv.bahnhof.se [46.59.52.199]:52372: 535 Incorrect authentication data (set_id=services@heipowersystem.com)46.59.52.1992661886%1  3Q' ossec11301h VNew FTP connection.Apr 24 13:33:32 vm1 pure-ftpd[3020432]: (?@198.235.24.59) [INFO] New connection from 198.235.24.59198.235.24.596252001q0  -m) ossec13001h sExim Auth failed2025-04-24 13:25:31 dovecot_login authenticator failed for (static-137-230.pppoe.tmb.ru) [78.132.137.230]:51206: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)78.132.137.2302017370/  - % ossec13001h cExim Auth failed2025-04-24 13:25:15 dovecot_login authenticator failed for ti0125a400-8455.bb.online.no [88.90.181.62]:47632: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)88.90.181.623144096s.  -u% ossec13001h )Exim Auth failed2025-04-24 13:24:16 dovecot_login authenticator failed for (abts-del-dynamic-90.28.77.182.airtelbroadband.in) [182.77.28.90]:50120: 535 Incorrect authentication data (set_id=sales)182.77.28.901269750-  -+ ossec13001h Exim Auth failed2025-04-24 13:24:01 dovecot_login authenticator failed for (nsg-corporate-214.246.187.122.airtel.in) [122.187.246.214]:38446: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)122.187.246.2141269750t,  -s) ossec13001h CExim Auth failed2025-04-24 13:16:09 dovecot_login authenticator failed for c-76-149-165-107.hsd1.ut.comcast.net [76.149.165.107]:52984: 535 Incorrect authentication data (set_id=vikas.khandelwal)76.149.165.1076252001w+  -y+ ossec13001h 5Exim Auth failed2025-04-24 13:15:56 dovecot_login authenticator failed for ([185.205.184.167]) [185.205.184.167]:57936: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)185.205.184.167146669I*  -!' ossec13001h Exim Auth failed2025-04-24 13:10:20 dovecot_login authenticator failed for (User) [185.93.89.218]:12956: 535 Incorrect authentication data (set_id=seller)185.93.89.218130758 'e ' w W 6;nu  -u) ossec13001h Exim Auth failed2025-04-24 11:19:20 dovecot_login authenticator failed for ([210.206.24.238]) [210.206.24.234]:61283: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)210.206.24.2341835841`  -O% ossec13001h Exim Auth failed2025-04-24 11:11:36 dovecot_login authenticator failed for ([149.54.51.42]) [149.54.51.42]:43330: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)149.54.51.421149361  - ' ossec13001h Exim Auth failed2025-04-24 11:11:15 dovecot_login authenticator failed for (54.71.232.212.at-home.ru) [212.232.71.54]:52764: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)212.232.71.542017370Z  -=+ ossec13001h Exim Auth failed2025-04-24 11:10:16 dovecot_login authenticator failed for ([183.109.195.179]) [183.109.195.179]:56840: 535 Incorrect authentication data (set_id=sales)183.109.195.1791835841H  -' ossec13001h Exim Auth failed2025-04-24 11:02:43 dovecot_login authenticator failed for (User) [185.93.89.218]:58634: 535 Incorrect authentication data (set_id=sales)185.93.89.218130758_  -K' ossec13001h Exim Auth failed2025-04-24 11:02:23 dovecot_login authenticator failed for ([103.181.42.31]) [103.181.42.31]:50120: 535 Incorrect authentication data (set_id=vikas.khandelwal)103.181.42.311210997p  -q' ossec13001h Exim Auth failed2025-04-24 11:01:59 dovecot_login authenticator failed for ([65.20.149.210]) [65.20.149.210]:59861: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)65.20.149.21099237B  gU) ossec11307h BMultiple connection attempts from same sourceApr 24 10:55:20 vm1 pure-ftpd[2985165]: (?@185.242.226.22) [INFO] New connection from 185.242.226.22185.242.226.226252001) 3U) ossec11301h < New FTP connection.Apr 24 10:55:15 vm1 pure-ftpd[2985131]: (?@185.242.226.22) [INFO] New connection from 185.242.226.22185.242.226.226252001(~  3U) ossec11301h New FTP connection.Apr 24 10:53:41 vm1 pure-ftpd[2984578]: (?@185.242.226.22) [INFO] New connection from 185.242.226.22185.242.226.226252001} C)+ ossec11313h ]FTP file uploaded to serverApr 24 10:38:44 vm1 pure-ftpd[2980654]: (user@saintsoldiercollege.com@106.207.151.191) [NOTICE] /home/techno/public_html/saintsoldiercollege.com//admin/class/delete.php uploaded (10507 bytes, 338.90KB/sec)106.207.151.1911269750|  C)+ ossec11313h OFTP file uploaded to serverApr 24 10:38:30 vm1 pure-ftpd[2980654]: (user@saintsoldiercollege.com@106.207.151.191) [NOTICE] /home/techno/public_html/saintsoldiercollege.com//admin/class/update.php uploaded (10507 bytes, 342.00KB/sec)106.207.151.1911269750+{  3Y+ ossec11301h New FTP connection.Apr 24 10:36:36 vm1 pure-ftpd[2980654]: (?@106.207.151.191) [INFO] New connection from 106.207.151.191106.207.151.1911269750=z  Cm+ ossec11309h FTP Authentication success.Apr 24 10:36:36 vm1 pure-ftpd[2980654]: (?@106.207.151.191) [INFO] user@saintsoldiercollege.com is now logged in106.207.151.1911269750Gy  -' ossec13001h {Exim Auth failed2025-04-24 10:30:42 dovecot_login authenticator failed for (User) [185.93.89.218]:63124: 535 Incorrect authentication data (set_id=root)185.93.89.218130758+x  3Y+ ossec11301h New FTP connection.Apr 24 10:28:54 vm1 pure-ftpd[2978950]: (?@106.207.151.191) [INFO] New connection from 106.207.151.191106.207.151.1911269750=w  Cm+ ossec11309h FTP Authentication success.Apr 24 10:28:54 vm1 pure-ftpd[2978950]: (?@106.207.151.191) [INFO] user@saintsoldiercollege.com is now logged in106.207.151.1911269750Tv  -5' ossec13001h Exim Auth failed2025-04-24 10:24:41 dovecot_login authenticator failed for ([218.22.187.70]) [218.22.187.66]:49160: 535 Incorrect authentication data (set_id=sales)218.22.187.661814991 {fffqo\h ?{"content":[{"rule":"11011","retries":1,"severity":3,"name":"WHM SSO login failed","message":"[2025-04-25 13:24:41 +0530] info [whostmgrd] 171.79.150.205 PURGE root:LLsQJW9SJMI8XujC badpass [cookie ip check: IP address has changed: IP Address [106.206.168.85] != Current IP Address [171.79.150.205]]","attackers_ip":"171.79.150.205","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745567683,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"11001","retries":1,"severity":3,"name":"Deferred login on the cpanel service","message":"[2025-04-25 13:24:41 +0530] info [whostmgrd] 171.79.150.205 - root \"GET /cpsess7254907573/scripts4/listaccts?=undefined\u0026login=1\u0026post_login=23126918081569 HTTP/1.1\" DEFERRED LOGIN whostmgrd: cookie ip check: IP address has changed: IP Address [106.206.168.85] != Current IP Address [171.79.150.205]","attackers_ip":"171.79.150.205","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745567683,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0} , c,&h 3`{"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-26 06:43:45 dovecot_login authenticator failed for ([180.104.103.146]) [180.104.103.146]:54799: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)","attackers_ip":"180.104.103.146","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745630025,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-26 06:44:00 dovecot_login authenticator failed for ([116.237.85.95]) [223.166.75.68]:12216: 535 Incorrect authentication data (set_id=sales)","attackers_ip":"223.166.75.68","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745630041,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0},h 2{"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-26 06:41:33 dovecot_login authenticator failed for ([114.202.80.152]) [114.202.80.152]:44239: 535 Incorrect authentication data (set_id=services@heipowersystem.com)","attackers_ip":"114.202.80.152","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745629895,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-26 06:41:47 dovecot_login authenticator failed for ([66.209.97.254]) [66.209.97.254]:60818: 535 Incorrect authentication data (set_id=services)","attackers_ip":"66.209.97.254","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745629907,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0},h {"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-26 04:27:23 dovecot_login authenticator failed for ([185.134.179.106]) [185.101.16.250]:44515: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)","attackers_ip":"185.101.16.250","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745621843,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-26 04:27:48 dovecot_login authenticator failed for ([183.56.179.201]) [119.123.173.194]:27912: 535 Incorrect authentication data (set_id=sales)","attackers_ip":"119.123.173.194","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745621869,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0} a NaX*h y{"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 17:31:14 dovecot_login authenticator failed for ([27.98.249.9]) [27.98.249.9]:49120: 535 Incorrect authentication data (set_id=purchase)","attackers_ip":"27.98.249.9","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745582475,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0} h y{"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 17:30:06 dovecot_login authenticator failed for (User) [185.93.89.218]:14066: 535 Incorrect authentication data (set_id=scan)","attackers_ip":"185.93.89.218","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745582407,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 17:31:00 dovecot_login authenticator failed for ([183.167.230.105]) [183.167.230.105]:43322: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)","attackers_ip":"183.167.230.105","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745582461,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}.Vh j{"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 16:26:21 dovecot_login authenticator failed for ([223.71.98.202]) [223.71.98.202]:53697: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)","attackers_ip":"223.71.98.202","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745578581,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 16:26:33 dovecot_login authenticator failed for ([58.18.212.238]) [58.18.212.238]:50972: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)","attackers_ip":"58.18.212.238","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745578593,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0} 2   -JI[aasO  -q+ ossec13001h Exim Auth failed2025-04-25 20:49:07 dovecot_login authenticator failed for ohgtex.static.otenet.gr [195.167.114.221]:50064: 535 Incorrect authentication data (set_id=services@heipowersystem.com)195.167.114.221390903ZN  -?) ossec13001h Exim Auth failed2025-04-25 20:48:29 dovecot_login authenticator failed for ([103.171.12.170]) [103.171.12.170]:40402: 535 Incorrect authentication data (set_id=purchase)103.171.12.1701269750mM  -e) ossec13001h Exim Auth failed2025-04-25 20:48:18 dovecot_login authenticator failed for ([115.238.31.114]) [115.238.31.114]:53997: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)115.238.31.1141814991KL  -%' ossec13001h Exim Auth failed2025-04-25 20:43:59 dovecot_login authenticator failed for (User) [185.93.89.218]:44486: 535 Incorrect authentication data (set_id=software)185.93.89.218130758{K  -) ossec13001h Exim Auth failed2025-04-25 20:43:24 dovecot_login authenticator failed for pool-96-249-234-242.nrflva.fios.verizon.net [96.249.234.242]:39449: 535 Incorrect authentication data (set_id=vikas.khandelwal)96.249.234.2426252001uJ  -u) ossec13001h Exim Auth failed2025-04-25 20:43:14 dovecot_login authenticator failed for ([220.80.192.168]) [220.80.192.168]:55752: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)220.80.192.1681835841iI  -[+ ossec13001h Exim Auth failed2025-04-25 20:32:17 dovecot_login authenticator failed for ([211.169.212.206]) [211.169.212.206]:59922: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)211.169.212.2061835841|H  -+ ossec13001h Exim Auth failed2025-04-25 20:31:55 dovecot_login authenticator failed for ([182.106.213.108]) [182.106.213.108]:52339: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)182.106.213.1081814991^G  -K% ossec13001h Exim Auth failed2025-04-25 20:31:03 dovecot_login authenticator failed for bb42-60-108-52.singnet.com.sg [42.60.108.52]:43642: 535 Incorrect authentication data (set_id=sales)42.60.108.521880251jF  -_) ossec13001h Exim Auth failed2025-04-25 20:30:33 dovecot_login authenticator failed for ([36.154.134.146]) [36.154.134.146]:35853: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)36.154.134.1461814991tE  -s) ossec13001h |Exim Auth failed2025-04-25 20:30:10 dovecot_login authenticator failed for (s2seducationtrust.com) [42.193.105.109]:60738: 535 Incorrect authentication data (set_id=support@s2seducationtrust.com)42.193.105.1091814991^D  -G) ossec13001h aExim Auth failed2025-04-25 20:29:45 dovecot_login authenticator failed for (s2seducationtrust.com) [42.193.105.109]:42024: 535 Incorrect authentication data (set_id=nologin)42.193.105.1091814991iC  -]) ossec13001h 6Exim Auth failed2025-04-25 20:29:01 dovecot_login authenticator failed for 212.42.246.220.static.netvigator.com [220.246.42.212]:58540: 535 Incorrect authentication data (set_id=sales)220.246.42.2121819730dB  -Y# ossec13001h $Exim Auth failed2025-04-25 20:28:43 dovecot_login authenticator failed for (zimbra.pragma.ru) [81.22.48.19]:43419: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)81.22.48.1920173706A  Ag% ossec11302h FTP Authentication failed.Apr 25 20:17:25 vm1 pure-ftpd[3437636]: (?@34.78.45.249) [WARNING] Authentication failed for user [anonymous]34.78.45.2492802361#@ 3M% ossec11301h yNew FTP connection.Apr 25 20:17:19 vm1 pure-ftpd[3437634]: (?@34.78.45.249) [INFO] New connection from 34.78.45.24934.78.45.2492802361I?  -!' ossec13001h +Exim Auth failed2025-04-25 20:11:45 dovecot_login authenticator failed for (User) [185.93.89.218]:30518: 535 Incorrect authentication data (set_id=shared)185.93.89.218130758 0}}}P/h q{"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 16:57:51 dovecot_login authenticator failed for (User) [185.93.89.218]:11140: 535 Incorrect authentication data (set_id=sales)","attackers_ip":"185.93.89.218","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745580473,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0} M2&h {"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 18:09:50 dovecot_login authenticator failed for ([81.161.142.133]) [81.161.142.133]:43400: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)","attackers_ip":"81.161.142.133","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745584791,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 18:10:01 dovecot_login authenticator failed for ([94.204.208.189]) [94.204.208.189]:52528: 535 Incorrect authentication data (set_id=sales)","attackers_ip":"94.204.208.189","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745584801,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0} Y F j  =nT  -5' ossec13001h hExim Auth failed2025-04-25 16:20:35 dovecot_login authenticator failed for ([103.107.36.18]) [103.107.36.18]:49494: 535 Incorrect authentication data (set_id=sales)103.107.36.181269750c  -O+ ossec13001h e^Exim Auth failed2025-04-25 16:05:10 dovecot_login authenticator failed for (rokamauka.com) [202.107.197.211]:38124: 535 Incorrect authentication data (set_id=test@rokamauka.com)202.107.197.2111814991X  -9+ ossec13001h eFExim Auth failed2025-04-25 16:04:45 dovecot_login authenticator failed for (rokamauka.com) [202.107.197.211]:34986: 535 Incorrect authentication data (set_id=nologin)202.107.197.2111814991J  -#' ossec13001h bExim Auth failed2025-04-25 15:53:20 dovecot_login authenticator failed for (User) [185.93.89.218]:11740: 535 Incorrect authentication data (set_id=recruit)185.93.89.218130758W  -9) ossec13001h bExim Auth failed2025-04-25 15:52:55 dovecot_login authenticator failed for ([125.23.204.106]) [125.23.204.106]:51820: 535 Incorrect authentication data (set_id=sales)125.23.204.1061269750w  -{' ossec13001h bsExim Auth failed2025-04-25 15:52:43 dovecot_login authenticator failed for 201-61-40-117.bbone.telesp.net.br [201.61.40.117]:39364: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)201.61.40.1173469034o  -k' ossec13001h `MExim Auth failed2025-04-25 15:43:31 dovecot_login authenticator failed for (95.105.71.128.dynamic.ufanet.ru) [95.105.71.128]:42578: 535 Incorrect authentication data (set_id=vikas.khandelwal)95.105.71.1282017370r  -q' ossec13001h `@Exim Auth failed2025-04-25 15:43:19 dovecot_login authenticator failed for ([111.175.39.76]) [111.175.39.76]:40927: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)111.175.39.761814991e  -S+ ossec13001h ^Exim Auth failed2025-04-25 15:33:42 dovecot_login authenticator failed for ([223.178.218.234]) [223.178.218.234]:43742: 535 Incorrect authentication data (set_id=vikas.khandelwal)223.178.218.2341269750u  -u) ossec13001h ]Exim Auth failed2025-04-25 15:33:34 dovecot_login authenticator failed for mail-02.03.perm.ru [46.146.210.180]:25145: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)46.146.210.1802017370L  -'' ossec13001h [Exim Auth failed2025-04-25 15:21:17 dovecot_login authenticator failed for (User) [185.93.89.218]:43896: 535 Incorrect authentication data (set_id=reception)185.93.89.218130758I  -!' ossec13001h SExim Auth failed2025-04-25 14:49:21 dovecot_login authenticator failed for (User) [185.93.89.218]:35690: 535 Incorrect authentication data (set_id=prueba)185.93.89.218130758b~  -W% ossec13001h RGExim Auth failed2025-04-25 14:43:43 dovecot_login authenticator failed for ([65.20.170.59]) [65.20.170.59]:40540: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)65.20.170.5999237W}  -9) ossec13001h R]Exim Auth failed2025-04-25 14:44:04 dovecot_login authenticator failed for ([168.126.90.210]) [168.126.90.210]:40213: 535 Incorrect authentication data (set_id=sales)168.126.90.2101835841%|  3Q' ossec11301h Q]New FTP connection.Apr 25 14:39:46 vm1 pure-ftpd[3360544]: (?@20.65.194.168) [INFO] New connection from 20.65.194.16820.65.194.1686252001#{ 3M% ossec11301h O New FTP connection.Apr 25 14:30:07 vm1 pure-ftpd[3358524]: (?@165.22.83.49) [INFO] New connection from 165.22.83.49165.22.83.492921044  -O) ossec13001h Exim Auth failed2025-04-26 05:04:51 dovecot_login authenticator failed for ([124.65.160.234]) [124.65.160.234]:36738: 535 Incorrect authentication data (set_id=vikas.khandelwal)124.65.160.2341814991r=  -q' ossec13001h Exim Auth failed2025-04-26 05:04:38 dovecot_login authenticator failed for ([14.39.113.250]) [14.39.113.250]:60684: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)14.39.113.2501835841Y<  -=) ossec13001h  Exim Auth failed2025-04-26 05:00:20 dovecot_login authenticator failed for zdomainaccess.com [216.70.114.230]:34188: 535 Incorrect authentication data (set_id=purchase)216.70.114.2306252001;  ;) ossec13008h Mail Recipient rejected2025-04-26 05:00:38 H=(localhost.localdomain) [78.153.140.207]:33310 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no F= rejected RCPT : Sender verify failed78.153.140.2072635167p:  -i+ ossec13001h Exim Auth failed2025-04-26 05:00:07 dovecot_login authenticator failed for ([103.152.234.134]) [103.152.234.134]:42024: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)103.152.234.1341643084K9  -%' ossec13001h vExim Auth failed2025-04-26 04:49:17 dovecot_login authenticator failed for (User) [185.93.89.218]:31610: 535 Incorrect authentication data (set_id=account1)185.93.89.218130758Z8  -?) ossec13001h ;Exim Auth failed2025-04-26 04:48:18 dovecot_login authenticator failed for ([113.57.119.194]) [113.57.119.194]:20978: 535 Incorrect authentication data (set_id=purchase)113.57.119.1941814991  g* |rh {"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-26 05:17:02 dovecot_login authenticator failed for 89-109-4-133.dynamic.mts-nn.ru [89.109.4.133]:57121: 535 Incorrect authentication data (set_id=services@heipowersystem.com)","attackers_ip":"89.109.4.133","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745624822,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}O h {"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-26 04:19:27 dovecot_login authenticator failed for syn-074-218-095-154.biz.spectrum.com [74.218.95.154]:56079: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)","attackers_ip":"74.218.95.154","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745621367,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-26 04:19:48 dovecot_login authenticator failed for (abts-kk-static-226.253.166.122.airtelbroadband.in) [122.166.253.226]:45234: 535 Incorrect authentication data (set_id=purchase)","attackers_ip":"122.166.253.226","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745621389,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}Q h /d{"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-26 06:26:17 dovecot_login authenticator failed for (User) [185.93.89.218]:1340: 535 Incorrect authentication data (set_id=admin01)","attackers_ip":"185.93.89.218","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745628978,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}$h -{"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-26 06:18:43 dovecot_login authenticator failed for ([8.243.166.66]) [8.243.166.66]:4501: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)","attackers_ip":"8.243.166.66","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745628524,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-26 06:18:56 dovecot_login authenticator failed for ([183.167.196.62]) [183.167.196.62]:57390: 535 Incorrect authentication data (set_id=purchase)","attackers_ip":"183.167.196.62","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745628536,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0} }}eDh z{"content":[{"rule":"11301","retries":2,"severity":3,"name":"New FTP connection.","message":"Apr 25 17:35:46 vm1 pure-ftpd[3399843]: (?@171.79.150.205) [INFO] New connection from 171.79.150.205","attackers_ip":"171.79.150.205","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745582747,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":true,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"11309","retries":2,"severity":3,"name":"FTP Authentication success.","message":"Apr 25 17:35:50 vm1 pure-ftpd[3399843]: (?@171.79.150.205) [INFO] user@amplifypowerglobal.com is now logged in","attackers_ip":"171.79.150.205","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745582751,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":true,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"11075","retries":1,"severity":3,"name":"FTP file manipulations","message":"Fri Apr 25 17:36:01 2025 0 171.79.150.205 108 /home/techno/public_html/amplifypowerglobal.com/config.php a _ o r user@amplifypowerglobal.com ftp 1 * c","attackers_ip":"171.79.150.205","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":["noshow"],"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745582761,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":true,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}&h zr{"content":[{"rule":"11001","retries":1,"severity":3,"name":"Deferred login on the cpanel service","message":"[2025-04-25 17:34:08 +0530] info [whostmgrd] 171.79.150.205 - root \"GET / HTTP/1.1\" DEFERRED LOGIN whostmgrd: security token missing","attackers_ip":"171.79.150.205","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745582649,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"11009","retries":2,"severity":4,"name":"WHM login success","message":"[2025-04-25 17:34:35 +0530] info [whostmgrd] 171.79.150.205 NEW root:xEsybybFsP5XQsQh address=171.79.150.205,app=whostmgrd,creator=root,method=handle_form_login,path=form,possessed=0","attackers_ip":"171.79.150.205","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745582677,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"11010","retries":1,"severity":4,"name":"WHM SSO login success","message":"[2025-04-25 17:34:35 +0530] info [whostmgrd] 171.79.150.205 PURGE root:ZOEKqKOrwdR7mdun loginsuccess","attackers_ip":"171.79.150.205","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745582677,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"11006","retries":1,"severity":4,"name":"cPanel login success","message":"[2025-04-25 17:34:51 +0530] info [cpaneld] 171.79.150.205 NEW techno:EqZXwtjQZKPi9LMq address=171.79.150.205,app=cpaneld,creator=techno,method=handle_form_login,path=loadsession:techno:_OaAduMfLqBXEmJG,possessed=1,possessor=root","attackers_ip":"171.79.150.205","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745582691,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":true,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}  ^ ^q\h z{"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 17:37:00 dovecot_login authenticator failed for ([101.168.2.207]) [101.168.2.207]:36754: 535 Incorrect authentication data (set_id=services@heipowersystem.com)","attackers_ip":"101.168.2.207","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745582821,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0})Lh mQ{"content":[{"rule":"11301","retries":1,"severity":3,"name":"New FTP connection.","message":"Apr 25 16:38:42 vm1 pure-ftpd[3386578]: (?@20.29.52.224) [INFO] New connection from 20.29.52.224","attackers_ip":"20.29.52.224","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745579324,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0} P  B\a>  -S' ossec13001h Exim Auth failed2025-04-25 20:02:58 dovecot_login authenticator failed for ([65.20.138.138]) [65.20.138.138]:33739: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)65.20.138.13899237r=  -s% ossec13001h Exim Auth failed2025-04-25 20:02:46 dovecot_login authenticator failed for ([61.72.101.1]) [61.72.58.242]:53619: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)61.72.58.2421835841T<  -7% ossec13001h Exim Auth failed2025-04-25 19:53:33 dovecot_login authenticator failed for ([221.210.9.88]) [221.210.9.82]:43694: 535 Incorrect authentication data (set_id=services)221.210.9.821814991g;  -]% ossec13001h Exim Auth failed2025-04-25 19:53:14 dovecot_login authenticator failed for ([47.238.163.1]) [47.238.163.1]:38914: 535 Incorrect authentication data (set_id=services@heipowersystem.com)47.238.163.11819730:  -' ossec13001h Exim Auth failed2025-04-25 19:44:31 dovecot_login authenticator failed for (customer-CLN-142-4.megared.net.mx) [177.229.142.4]:58062: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)177.229.142.43996063k9  -e% ossec13001h Exim Auth failed2025-04-25 19:44:42 dovecot_login authenticator failed for (50-82-12-128.client.mchsi.com) [50.82.12.128]:50974: 535 Incorrect authentication data (set_id=vikas.khandelwal)50.82.12.1286252001J8  -#' ossec13001h Exim Auth failed2025-04-25 19:39:22 dovecot_login authenticator failed for (User) [185.93.89.218]:28574: 535 Incorrect authentication data (set_id=service)185.93.89.218130758a7  -K+ ossec13001h NExim Auth failed2025-04-25 19:29:42 dovecot_login authenticator failed for (448990.cloudwaysapps.com) [128.199.118.234]:24854: 535 Incorrect authentication data (set_id=sales)128.199.118.2341880251W6  -9) ossec13001h ,Exim Auth failed2025-04-25 19:29:07 dovecot_login authenticator failed for ([210.219.232.34]) [210.219.232.34]:34127: 535 Incorrect authentication data (set_id=sales)210.219.232.341835841a5  -S# ossec13001h &Exim Auth failed2025-04-25 19:29:01 dovecot_login authenticator failed for ([59.96.62.29]) [59.96.62.29]:54404: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)59.96.62.291269750V4  -9) ossec13001h $Exim Auth failed2025-04-25 19:28:58 dovecot_login authenticator failed for ([102.215.188.37]) [102.215.188.37]:60219: 535 Incorrect authentication data (set_id=sales)102.215.188.37192950d3  -W% ossec13001h Exim Auth failed2025-04-25 19:28:48 dovecot_login authenticator failed for ([36.26.63.158]) [36.26.63.158]:49578: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)36.26.63.1581814991j2  -_) ossec13001h Exim Auth failed2025-04-25 19:28:37 dovecot_login authenticator failed for ([220.77.245.227]) [220.77.245.227]:59536: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)220.77.245.2271835841c1  -Q) ossec13001h Exim Auth failed2025-04-25 19:19:16 dovecot_login authenticator failed for (host-91-202-199-145.baza.net) [91.202.199.145]:52370: 535 Incorrect authentication data (set_id=sales)91.202.199.1452017370^0  -O! ossec13001h Exim Auth failed2025-04-25 19:19:05 dovecot_login authenticator failed for ([47.83.2.11]) [47.83.2.11]:35240: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)47.83.2.111819730I/  -!' ossec13001h Exim Auth failed2025-04-25 19:07:08 dovecot_login authenticator failed for (User) [185.93.89.218]:35744: 535 Incorrect authentication data (set_id=seller)185.93.89.218130758+.  EM' ossec5715h SSHD authentication success.Apr 25 18:53:06 vm1 sshd[3418781]: Accepted password for root from 103.190.54.18 port 51410 ssh2103.190.54.181269750 bmm ^qE\h {"content":[{"rule":"11006","retries":1,"severity":4,"name":"cPanel login success","message":"[2025-04-25 18:43:30 +0530] info [cpaneld] 171.79.150.205 NEW techno:XFKXvZKnJ0Yiru6Q address=171.79.150.205,app=cpaneld,creator=techno,method=handle_form_login,path=loadsession:techno:xv1m8iPsCIhr6yi8,possessed=1,possessor=root","attackers_ip":"171.79.150.205","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745586811,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":true,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"11009","retries":1,"severity":4,"name":"WHM login success","message":"[2025-04-25 18:43:29 +0530] info [whostmgrd] 171.79.150.205 NEW techno:xv1m8iPsCIhr6yi8 address=171.79.150.205,app=cpaneld,creator=root,method=handle_auth_transfer,path=xfercpanel","attackers_ip":"171.79.150.205","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745586811,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":true,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0} $QSh >{"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 19:07:08 dovecot_login authenticator failed for (User) [185.93.89.218]:35744: 535 Incorrect authentication data (set_id=seller)","attackers_ip":"185.93.89.218","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745588229,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}2K^h {"content":[{"rule":"5715","retries":1,"severity":3,"name":"SSHD authentication success.","message":"Apr 25 18:53:06 vm1 sshd[3418781]: Accepted password for root from 103.190.54.18 port 51410 ssh2","attackers_ip":"103.190.54.18","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745587388,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0} R ( z / V;!c(*  3U) ossec11301h New FTP connection.Apr 24 16:59:05 vm1 pure-ftpd[3065855]: (?@152.59.109.221) [INFO] New connection from 152.59.109.221152.59.109.22112697509)  Cg) ossec11309h LFTP Authentication success.Apr 24 16:58:10 vm1 pure-ftpd[3065683]: (?@152.59.109.221) [INFO] user@s2seducationtrust.com is now logged in152.59.109.2211269750((  3U) ossec11301h LNew FTP connection.Apr 24 16:58:10 vm1 pure-ftpd[3065683]: (?@152.59.109.221) [INFO] New connection from 152.59.109.221152.59.109.2211269750:' Cg) ossec11309h FTP Authentication success.Apr 24 16:57:01 vm1 pure-ftpd[3065358]: (?@152.59.109.221) [INFO] user@s2seducationtrust.com is now logged in152.59.109.2211269750)& 3U) ossec11301h New FTP connection.Apr 24 16:57:00 vm1 pure-ftpd[3065358]: (?@152.59.109.221) [INFO] New connection from 152.59.109.221152.59.109.2211269750:% Cg) ossec11309h FTP Authentication success.Apr 24 16:56:14 vm1 pure-ftpd[3065209]: (?@152.59.109.221) [INFO] user@s2seducationtrust.com is now logged in152.59.109.2211269750)$ 3U) ossec11301h New FTP connection.Apr 24 16:56:14 vm1 pure-ftpd[3065209]: (?@152.59.109.221) [INFO] New connection from 152.59.109.221152.59.109.2211269750)# 3U) ossec11301h New FTP connection.Apr 24 16:55:10 vm1 pure-ftpd[3065037]: (?@152.59.109.221) [INFO] New connection from 152.59.109.221152.59.109.2211269750:" Cg) ossec11309h FTP Authentication success.Apr 24 16:55:11 vm1 pure-ftpd[3065037]: (?@152.59.109.221) [INFO] user@s2seducationtrust.com is now logged in152.59.109.2211269750W!  -9) ossec13001h Exim Auth failed2025-04-24 16:54:51 dovecot_login authenticator failed for ([221.218.214.32]) [221.218.214.32]:64253: 535 Incorrect authentication data (set_id=sales)221.218.214.321814991%  a') ossec11h {Excessive number of events (above normal).The average number of logs between 16:00 and 17:00 is 4829. We reached 12074.152.59.109.2211269750a  -S# ossec13001h wExim Auth failed2025-04-24 16:54:38 dovecot_login authenticator failed for ([103.50.5.94]) [103.50.5.94]:60290: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)103.50.5.941269750) 3U) ossec11301h RNew FTP connection.Apr 24 16:54:00 vm1 pure-ftpd[3064712]: (?@152.59.109.221) [INFO] New connection from 152.59.109.221152.59.109.2211269750: Cg) ossec11309h RFTP Authentication success.Apr 24 16:54:00 vm1 pure-ftpd[3064712]: (?@152.59.109.221) [INFO] user@s2seducationtrust.com is now logged in152.59.109.2211269750H  -' ossec13001h :Exim Auth failed2025-04-24 16:53:36 dovecot_login authenticator failed for (User) [185.93.89.218]:64236: 535 Incorrect authentication data (set_id=test1)185.93.89.218130758: Cg) ossec11309h $FTP Authentication success.Apr 24 16:53:14 vm1 pure-ftpd[3064552]: (?@152.59.109.221) [INFO] user@s2seducationtrust.com is now logged in152.59.109.2211269750) 3U) ossec11301h $New FTP connection.Apr 24 16:53:14 vm1 pure-ftpd[3064552]: (?@152.59.109.221) [INFO] New connection from 152.59.109.221152.59.109.22112697509  Cg) ossec11309h FTP Authentication success.Apr 24 16:52:46 vm1 pure-ftpd[3064491]: (?@152.59.109.221) [INFO] user@s2seducationtrust.com is now logged in152.59.109.2211269750(  3U) ossec11301h New FTP connection.Apr 24 16:52:46 vm1 pure-ftpd[3064491]: (?@152.59.109.221) [INFO] New connection from 152.59.109.221152.59.109.2211269750: Cg) ossec11309h FTP Authentication success.Apr 24 16:51:35 vm1 pure-ftpd[3064184]: (?@152.59.109.221) [INFO] user@s2seducationtrust.com is now logged in152.59.109.2211269750) 3U) ossec11301h New FTP connection.Apr 24 16:51:35 vm1 pure-ftpd[3064184]: (?@152.59.109.221) [INFO] New connection from 152.59.109.221152.59.109.2211269750 S ) = NShN`: Cg) ossec11309h qFTP Authentication success.Apr 24 16:50:16 vm1 pure-ftpd[3063915]: (?@152.59.109.221) [INFO] user@s2seducationtrust.com is now logged in152.59.109.2211269750) 3U) ossec11301h qNew FTP connection.Apr 24 16:50:15 vm1 pure-ftpd[3063915]: (?@152.59.109.221) [INFO] New connection from 152.59.109.221152.59.109.2211269750: Cg) ossec11309h #FTP Authentication success.Apr 24 16:48:57 vm1 pure-ftpd[3063584]: (?@152.59.109.221) [INFO] user@s2seducationtrust.com is now logged in152.59.109.2211269750Z  -?) ossec13001h ;Exim Auth failed2025-04-24 16:49:23 dovecot_login authenticator failed for ([125.23.204.106]) [125.23.204.106]:48718: 535 Incorrect authentication data (set_id=services)125.23.204.1061269750p  -i+ ossec13001h 1Exim Auth failed2025-04-24 16:49:12 dovecot_login authenticator failed for ([222.170.230.238]) [222.170.230.238]:37540: 535 Incorrect authentication data (set_id=services@heipowersystem.com)222.170.230.2381814991(  3U) ossec11301h /New FTP connection.Apr 24 16:49:09 vm1 pure-ftpd[3063622]: (?@152.59.109.221) [INFO] New connection from 152.59.109.221152.59.109.2211269750(  3U) ossec11301h !New FTP connection.Apr 24 16:48:56 vm1 pure-ftpd[3063584]: (?@152.59.109.221) [INFO] New connection from 152.59.109.221152.59.109.2211269750) 3U) ossec11301h New FTP connection.Apr 24 16:47:05 vm1 pure-ftpd[3063294]: (?@152.59.109.221) [INFO] New connection from 152.59.109.221152.59.109.2211269750: Cg) ossec11309h FTP Authentication success.Apr 24 16:47:06 vm1 pure-ftpd[3063294]: (?@152.59.109.221) [INFO] user@s2seducationtrust.com is now logged in152.59.109.2211269750f  -W) ossec13001h Exim Auth failed2025-04-24 16:46:40 dovecot_login authenticator failed for ([116.198.37.128]) [116.198.37.128]:44180: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)116.198.37.1281814991v  -y' ossec13001h Exim Auth failed2025-04-24 16:46:21 dovecot_login authenticator failed for ([42.185.154.33]) [42.185.154.33]:47350: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)42.185.154.331814991(  3U) ossec11301h kNew FTP connection.Apr 24 16:45:53 vm1 pure-ftpd[3063112]: (?@152.59.109.221) [INFO] New connection from 152.59.109.221152.59.109.22112697509  Cg) ossec11309h kFTP Authentication success.Apr 24 16:45:53 vm1 pure-ftpd[3063112]: (?@152.59.109.221) [INFO] user@s2seducationtrust.com is now logged in152.59.109.2211269750Q  -1% ossec13001h 3Exim Auth failed2025-04-24 16:44:58 dovecot_login authenticator failed for ([91.126.40.54]) [91.126.40.54]:54191: 535 Incorrect authentication data (set_id=sales)91.126.40.542510769) 3U) ossec11301h New FTP connection.Apr 24 16:44:30 vm1 pure-ftpd[3062618]: (?@152.59.109.221) [INFO] New connection from 152.59.109.221152.59.109.2211269750g  -[' ossec13001h 'Exim Auth failed2025-04-24 16:44:47 dovecot_login authenticator failed for ([222.99.52.202]) [222.99.52.202]:53316: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)222.99.52.2021835841: Cg) ossec11309h FTP Authentication success.Apr 24 16:44:30 vm1 pure-ftpd[3062618]: (?@152.59.109.221) [INFO] user@s2seducationtrust.com is now logged in152.59.109.2211269750(  3U) ossec11301h New FTP connection.Apr 24 16:43:48 vm1 pure-ftpd[3062448]: (?@152.59.109.221) [INFO] New connection from 152.59.109.221152.59.109.22112697509  Cg) ossec11309h FTP Authentication success.Apr 24 16:43:48 vm1 pure-ftpd[3062448]: (?@152.59.109.221) [INFO] user@s2seducationtrust.com is now logged in152.59.109.2211269750(  3U) ossec11301h KNew FTP connection.Apr 24 16:41:05 vm1 pure-ftpd[3062009]: (?@152.59.109.221) [INFO] New connection from 152.59.109.221152.59.109.2211269750 o soS h ({"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-26 05:21:36 dovecot_login authenticator failed for (User) [185.93.89.218]:22552: 535 Incorrect authentication data (set_id=accounts)","attackers_ip":"185.93.89.218","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745625096,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0})Lh 1{"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-26 06:35:22 dovecot_login authenticator failed for c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:54470: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)","attackers_ip":"76.132.238.43","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745629523,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-26 06:35:34 dovecot_login authenticator failed for ([218.106.120.18]) [58.49.113.138]:14162: 535 Incorrect authentication data (set_id=purchase)","attackers_ip":"58.49.113.138","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745629535,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}  h 8{"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-26 05:17:26 dovecot_login authenticator failed for ([61.75.191.190]) [61.75.191.190]:39667: 535 Incorrect authentication data (set_id=services)","attackers_ip":"61.75.191.190","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745624846,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-26 05:17:35 dovecot_login authenticator failed for ([195.189.226.139]) [195.189.226.139]:44870: 535 Incorrect authentication data (set_id=services)","attackers_ip":"195.189.226.139","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745624856,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0} B r ! bEk?:> Cg) ossec11309h #FTP Authentication success.Apr 24 17:12:37 vm1 pure-ftpd[3069404]: (?@152.59.109.221) [INFO] user@s2seducationtrust.com is now logged in152.59.109.2211269750:= Cg) ossec11309h #eFTP Authentication success.Apr 24 17:11:23 vm1 pure-ftpd[3069185]: (?@152.59.109.221) [INFO] user@s2seducationtrust.com is now logged in152.59.109.2211269750)< 3U) ossec11301h #cNew FTP connection.Apr 24 17:11:22 vm1 pure-ftpd[3069185]: (?@152.59.109.221) [INFO] New connection from 152.59.109.221152.59.109.2211269750:; Cg) ossec11309h #?FTP Authentication success.Apr 24 17:10:45 vm1 pure-ftpd[3069089]: (?@152.59.109.221) [INFO] user@s2seducationtrust.com is now logged in152.59.109.2211269750): 3U) ossec11301h #?New FTP connection.Apr 24 17:10:45 vm1 pure-ftpd[3069089]: (?@152.59.109.221) [INFO] New connection from 152.59.109.221152.59.109.2211269750:9 Cg) ossec11309h "FTP Authentication success.Apr 24 17:09:23 vm1 pure-ftpd[3068697]: (?@152.59.109.221) [INFO] user@s2seducationtrust.com is now logged in152.59.109.2211269750)8 3U) ossec11301h "New FTP connection.Apr 24 17:09:23 vm1 pure-ftpd[3068697]: (?@152.59.109.221) [INFO] New connection from 152.59.109.221152.59.109.2211269750:7 Cg) ossec11309h "FTP Authentication success.Apr 24 17:08:37 vm1 pure-ftpd[3068548]: (?@152.59.109.221) [INFO] user@s2seducationtrust.com is now logged in152.59.109.2211269750)6 3U) ossec11301h "New FTP connection.Apr 24 17:08:37 vm1 pure-ftpd[3068548]: (?@152.59.109.221) [INFO] New connection from 152.59.109.221152.59.109.2211269750S5  -5' ossec13001h "FExim Auth failed2025-04-24 17:06:38 dovecot_login authenticator failed for ([46.153.85.132]) [46.153.85.132]:50154: 535 Incorrect authentication data (set_id=sales)46.153.85.132102358d4  -W% ossec13001h "<Exim Auth failed2025-04-24 17:06:27 dovecot_login authenticator failed for ([103.83.9.138]) [103.83.9.138]:60642: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)103.83.9.1381269750)3 3U) ossec11301h "bNew FTP connection.Apr 24 17:07:05 vm1 pure-ftpd[3068071]: (?@152.59.109.221) [INFO] New connection from 152.59.109.221152.59.109.2211269750:2 Cg) ossec11309h "bFTP Authentication success.Apr 24 17:07:05 vm1 pure-ftpd[3068071]: (?@152.59.109.221) [INFO] user@s2seducationtrust.com is now logged in152.59.109.2211269750Q1  -1% ossec13001h !Exim Auth failed2025-04-24 17:04:30 dovecot_login authenticator failed for ([203.252.10.5]) [203.252.10.3]:35262: 535 Incorrect authentication data (set_id=sales)203.252.10.31835841g0  -[' ossec13001h !Exim Auth failed2025-04-24 17:04:17 dovecot_login authenticator failed for ([58.56.151.234]) [58.56.151.234]:46406: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)58.56.151.2341814991(/  3U) ossec11301h New FTP connection.Apr 24 17:00:04 vm1 pure-ftpd[3066189]: (?@152.59.109.221) [INFO] New connection from 152.59.109.221152.59.109.2211269750].  -K# ossec13001h Exim Auth failed2025-04-24 17:00:30 dovecot_login authenticator failed for ([81.4.219.19]) [81.4.219.19]:52842: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)81.4.219.192017370 -  -%) ossec13001h Exim Auth failed2025-04-24 17:00:21 dovecot_login authenticator failed for (107-175-76-146-host.colocrossing.com) [107.175.76.146]:60152: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)107.175.76.14662520019,  Cg) ossec11309h FTP Authentication success.Apr 24 17:00:04 vm1 pure-ftpd[3066189]: (?@152.59.109.221) [INFO] user@s2seducationtrust.com is now logged in152.59.109.22112697509+  Cg) ossec11309h FTP Authentication success.Apr 24 16:59:06 vm1 pure-ftpd[3065855]: (?@152.59.109.221) [INFO] user@s2seducationtrust.com is now logged in152.59.109.2211269750  g)>Lh g){"content":[{"rule":"11301","retries":1,"severity":3,"name":"New FTP connection.","message":"Apr 26 10:24:34 vm1 pure-ftpd[3640959]: (?@139.162.77.6) [INFO] New connection from 139.162.77.6","attackers_ip":"139.162.77.6","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745643274,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}98h c{"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-26 10:09:45 dovecot_login authenticator failed for 46-162-104-66.cust.bredband2.com [46.162.104.66]:38636: 535 Incorrect authentication data (set_id=sales)","attackers_ip":"46.162.104.66","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745642385,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-26 10:09:33 dovecot_login authenticator failed for ([218.22.187.70]) [218.22.187.66]:34200: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)","attackers_ip":"218.22.187.66","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745642373,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}n Vh 6l{"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-26 06:57:01 dovecot_login authenticator failed for ([123.182.89.19]) [123.182.89.19]:55880: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)","attackers_ip":"123.182.89.19","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745630822,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}  Rm6h {"content":[{"rule":"11000","retries":1,"severity":3,"name":"Login failed on the cpanel service.","message":"[2025-04-26 01:07:16 +0530] info [cpaneld] 45.74.62.249 - heipowersystemco \"POST /login/?login_only=1 HTTP/1.1\" FAILED LOGIN cpaneld: invalid cpanel user heipowersystemco (has_cpuser_file failed)","attackers_ip":"45.74.62.249","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745609837,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}Mkh ,{"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-26 01:05:29 dovecot_login authenticator failed for (103.182.106.62.ns1.zitatel.com) [103.182.106.62]:65411: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)","attackers_ip":"103.182.106.62","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745609729,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-26 01:05:57 dovecot_login authenticator failed for (static-206.168.107.27-tataidc.co.in) [27.107.168.206]:33482: 535 Incorrect authentication data (set_id=vikas.khandelwal)","attackers_ip":"27.107.168.206","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745609757,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}*iNh {"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-26 01:03:13 dovecot_login authenticator failed for (User) [185.93.89.218]:20722: 535 Incorrect authentication data (set_id=testtest)","attackers_ip":"185.93.89.218","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745609593,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-26 01:03:27 dovecot_login authenticator failed for ([188.127.183.144]) [188.127.183.144]:53158: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)","attackers_ip":"188.127.183.144","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745609607,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-26 01:03:40 dovecot_login authenticator failed for ([65.20.202.4]) [65.20.202.4]:53649: 535 Incorrect authentication data (set_id=sales)","attackers_ip":"65.20.202.4","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745609621,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}  b*SNh o]{"content":[{"rule":"13008","retries":1,"severity":3,"name":"Mail Recipient rejected","message":"2025-04-26 10:59:34 H=(localhost.localdomain) [78.153.140.207]:55528 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no F=\u003cno-reply@no-reply.com\u003e rejected RCPT \u003ca@b11.siagabaja.com\u003e: Sender verify failed","attackers_ip":"78.153.140.207","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745645374,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0},LRh l{"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-26 10:47:33 dovecot_login authenticator failed for ([192.34.128.202]) [192.34.128.202]:33454: 535 Incorrect authentication data (set_id=services)","attackers_ip":"192.34.128.202","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745644653,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-26 10:47:18 dovecot_login authenticator failed for kd113158205225.ppp-bb.dion.ne.jp [113.158.205.225]:42893: 535 Incorrect authentication data (set_id=services@heipowersystem.com)","attackers_ip":"113.158.205.225","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745644639,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}NJh lQ{"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-26 10:46:36 dovecot_login authenticator failed for (User) [185.93.89.218]:3838: 535 Incorrect authentication data (set_id=demo)","attackers_ip":"185.93.89.218","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745644597,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}HG h k{"content":[{"rule":"11001","retries":2,"severity":3,"name":"Deferred login on the cpanel service","message":"[2025-04-26 10:43:58 +0530] info [cpaneld] 171.79.151.186 - techno \"GET /cpsess3894121332/frontend/jupiter/backup/index.html HTTP/1.1\" DEFERRED LOGIN cpaneld: cookie ip check: IP address has changed: IP Address [171.79.150.205] != Current IP Address [171.79.151.186]","attackers_ip":"171.79.151.186","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745644439,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"11011","retries":1,"severity":3,"name":"WHM SSO login failed","message":"[2025-04-26 10:44:00 +0530] info [whostmgrd] 171.79.151.186 PURGE root:pA78c0Bk6EJDYFcv badpass [cookie ip check: IP address has changed: IP Address [171.79.150.205] != Current IP Address [171.79.151.186]]","attackers_ip":"171.79.151.186","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745644441,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}  , 5 F  (}*ZYnZs  -=+ ossec13001h AExim Auth failed2025-04-24 19:21:10 dovecot_login authenticator failed for ([210.204.108.217]) [210.204.108.217]:44627: 535 Incorrect authentication data (set_id=sales)210.204.108.2171835841dr  -W% ossec13001h AExim Auth failed2025-04-24 19:20:56 dovecot_login authenticator failed for ([50.217.40.11]) [50.217.40.11]:53134: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)50.217.40.116252001fq  -Y' ossec13001h @Exim Auth failed2025-04-24 19:16:59 dovecot_login authenticator failed for 111-70-23-233.emome-ip.hinet.net [111.70.23.233]:34865: 535 Incorrect authentication data (set_id=services)111.70.23.2331668284|p  -' ossec13001h @Exim Auth failed2025-04-24 19:16:46 dovecot_login authenticator failed for 78-73-202-153-no2665.tbcn.telia.com [78.73.202.153]:34060: 535 Incorrect authentication data (set_id=services@heipowersystem.com)78.73.202.1532661886Ko  -%' ossec13001h =WExim Auth failed2025-04-24 19:02:06 dovecot_login authenticator failed for (User) [185.93.89.218]:36106: 535 Incorrect authentication data (set_id=testtest)185.93.89.218130758?n  gQ' ossec11307h =%Multiple connection attempts from same sourceApr 24 19:01:16 vm1 pure-ftpd[3094748]: (?@139.162.3.141) [INFO] New connection from 139.162.3.141139.162.3.1411880251%m  3Q' ossec11301h =New FTP connection.Apr 24 19:01:08 vm1 pure-ftpd[3094742]: (?@139.162.3.141) [INFO] New connection from 139.162.3.141139.162.3.1411880251bl  -S% ossec13001h =Exim Auth failed2025-04-24 19:00:46 dovecot_login authenticator failed for ([200.223.243.81]) [201.18.58.62]:41758: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)201.18.58.623469034yk  -}) ossec13001h <Exim Auth failed2025-04-24 19:00:33 dovecot_login authenticator failed for ([220.77.182.170]) [220.77.182.170]:46696: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)220.77.182.1701835841&j 3Q' ossec11301h <New FTP connection.Apr 24 19:00:32 vm1 pure-ftpd[3094529]: (?@139.162.3.141) [INFO] New connection from 139.162.3.141139.162.3.1411880251Wi  -9) ossec13001h <Exim Auth failed2025-04-24 18:59:18 dovecot_login authenticator failed for ([195.222.57.183]) [195.222.57.183]:48544: 535 Incorrect authentication data (set_id=sales)195.222.57.1833277605ih  -_) ossec13001h <Exim Auth failed2025-04-24 18:59:08 dovecot_login authenticator failed for ([62.182.118.138]) [62.182.118.138]:47536: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)62.182.118.138732800%g  3Q' ossec11301h <New FTP connection.Apr 24 18:58:53 vm1 pure-ftpd[3094034]: (?@139.162.3.141) [INFO] New connection from 139.162.3.141139.162.3.1411880251%f  3Q' ossec11301h <[New FTP connection.Apr 24 18:57:53 vm1 pure-ftpd[3093863]: (?@139.162.3.141) [INFO] New connection from 139.162.3.141139.162.3.1411880251je  -c% ossec13001h :Exim Auth failed2025-04-24 18:51:14 dovecot_login authenticator failed for (144.121.245.65.lightower.net) [64.72.74.162]:35709: 535 Incorrect authentication data (set_id=vikas.khandelwal)64.72.74.1626252001rd  -q' ossec13001h :Exim Auth failed2025-04-24 18:51:03 dovecot_login authenticator failed for ([60.247.92.186]) [60.247.92.186]:35501: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)60.247.92.1861814991Zc  -?) ossec13001h 6cExim Auth failed2025-04-24 18:32:26 dovecot_login authenticator failed for ([117.158.243.50]) [117.158.243.50]:42992: 535 Incorrect authentication data (set_id=purchase)117.158.243.501814991pb  -i+ ossec13001h 6KExim Auth failed2025-04-24 18:32:02 dovecot_login authenticator failed for ([103.152.234.134]) [103.152.234.134]:59144: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)103.152.234.1341643084 J )Lh ,{"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-26 05:04:38 dovecot_login authenticator failed for ([14.39.113.250]) [14.39.113.250]:60684: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)","attackers_ip":"14.39.113.250","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745624079,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-26 05:04:51 dovecot_login authenticator failed for ([124.65.160.234]) [124.65.160.234]:36738: 535 Incorrect authentication data (set_id=vikas.khandelwal)","attackers_ip":"124.65.160.234","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745624092,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0} NRh {"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-26 04:17:02 dovecot_login authenticator failed for (User) [185.93.89.218]:29528: 535 Incorrect authentication data (set_id=account)","attackers_ip":"185.93.89.218","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745621223,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}|2^h +,{"content":[{"rule":"11301","retries":1,"severity":3,"name":"New FTP connection.","message":"Apr 26 06:08:39 vm1 pure-ftpd[3567515]: (?@220.200.180.123) [INFO] New connection from 220.200.180.123","attackers_ip":"220.200.180.123","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745627921,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}   $ylh {"content":[{"rule":"13001","retries":2,"severity":3,"name":"Exim Auth failed","message":"2025-04-26 14:14:12 dovecot_login authenticator failed for (WIN-9DVAMKIGFGL) [2.58.56.194]:30343: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)","attackers_ip":"2.58.56.194","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745657053,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0} Ph {"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-26 15:07:11 dovecot_login authenticator failed for (User) [185.93.89.218]:32592: 535 Incorrect authentication data (set_id=info2)","attackers_ip":"185.93.89.218","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745660232,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}y~lh {"content":[{"rule":"13001","retries":2,"severity":3,"name":"Exim Auth failed","message":"2025-04-26 14:13:57 dovecot_login authenticator failed for (WIN-9DVAMKIGFGL) [2.58.56.194]:28591: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)","attackers_ip":"2.58.56.194","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745657037,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}_ R ; } " c D$8K~_P  -K' ossec13001h + Exim Auth failed2025-04-24 17:44:00 dovecot_login authenticator failed for ([222.218.17.45]) [222.218.17.45]:39936: 535 Incorrect authentication data (set_id=vikas.khandelwal)222.218.17.451814991O  - ) ossec13001h *Exim Auth failed2025-04-24 17:43:47 dovecot_login authenticator failed for n219077108186.netvigator.com [219.77.108.186]:58882: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)219.77.108.1861819730GN  -' ossec13001h )VExim Auth failed2025-04-24 17:36:45 dovecot_login authenticator failed for (User) [185.93.89.217]:38782: 535 Incorrect authentication data (set_id=root)185.93.89.217130758HM  -' ossec13001h &Exim Auth failed2025-04-24 17:25:41 dovecot_login authenticator failed for (User) [185.93.89.218]:30530: 535 Incorrect authentication data (set_id=test2)185.93.89.218130758hL  -_% ossec13001h %IExim Auth failed2025-04-24 17:19:28 dovecot_login authenticator failed for syn-072-134-003-252.res.spectrum.com [72.134.3.252]:50352: 535 Incorrect authentication data (set_id=purchase)72.134.3.2526252001gK  -]% ossec13001h %-Exim Auth failed2025-04-24 17:19:00 dovecot_login authenticator failed for ([111.63.42.76]) [111.63.42.76]:47478: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)111.63.42.761814991)J 3U) ossec11301h $New FTP connection.Apr 24 17:16:20 vm1 pure-ftpd[3070340]: (?@152.59.109.221) [INFO] New connection from 152.59.109.221152.59.109.2211269750mI CM) ossec11313h $FTP file uploaded to serverApr 24 17:16:24 vm1 pure-ftpd[3070340]: (user@s2seducationtrust.com@152.59.109.221) [NOTICE] /home/techno/public_html/s2seducationtrust.com//blog/wp-content/plugins/wordpress-seo/vendor_prefixed/psr/http-factory/src/UploadedFileFactoryInterface.php downloaded (1177 bytes, 1578.58KB/sec)152.59.109.2211269750:H Cg) ossec11309h $FTP Authentication success.Apr 24 17:16:20 vm1 pure-ftpd[3070340]: (?@152.59.109.221) [INFO] user@s2seducationtrust.com is now logged in152.59.109.2211269750[G  C+) ossec11313h $FTP file uploaded to serverApr 24 17:16:17 vm1 pure-ftpd[3070246]: (user@s2seducationtrust.com@152.59.109.221) [NOTICE] /home/techno/public_html/s2seducationtrust.com//blog/wp-content/plugins/wordpress-seo/vendor_prefixed/guzzlehttp/psr7/src/UploadedFile.php downloaded (5067 bytes, 5407.62KB/sec)152.59.109.2211269750:F Cg) ossec11309h $kFTP Authentication success.Apr 24 17:15:46 vm1 pure-ftpd[3070246]: (?@152.59.109.221) [INFO] user@s2seducationtrust.com is now logged in152.59.109.2211269750)E 3U) ossec11301h $kNew FTP connection.Apr 24 17:15:46 vm1 pure-ftpd[3070246]: (?@152.59.109.221) [INFO] New connection from 152.59.109.221152.59.109.2211269750(D  3U) ossec11301h $=New FTP connection.Apr 24 17:14:59 vm1 pure-ftpd[3069848]: (?@152.59.109.221) [INFO] New connection from 152.59.109.221152.59.109.22112697509C  Cg) ossec11309h $=FTP Authentication success.Apr 24 17:14:59 vm1 pure-ftpd[3069848]: (?@152.59.109.221) [INFO] user@s2seducationtrust.com is now logged in152.59.109.2211269750:B Cg) ossec11309h #FTP Authentication success.Apr 24 17:13:23 vm1 pure-ftpd[3069514]: (?@152.59.109.221) [INFO] user@s2seducationtrust.com is now logged in152.59.109.2211269750)A 3U) ossec11301h #New FTP connection.Apr 24 17:13:23 vm1 pure-ftpd[3069514]: (?@152.59.109.221) [INFO] New connection from 152.59.109.221152.59.109.2211269750%@  a') ossec11h #Excessive number of events (above normal).The average number of logs between 17:00 and 18:00 is 4719. We reached 11799.152.59.109.2211269750)? 3U) ossec11301h #New FTP connection.Apr 24 17:12:37 vm1 pure-ftpd[3069404]: (?@152.59.109.221) [INFO] New connection from 152.59.109.221152.59.109.2211269750 ? v?4qbh $`{"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-26 05:39:40 dovecot_login authenticator failed for ([49.124.205.169]) [49.124.205.169]:37634: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)","attackers_ip":"49.124.205.169","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745626182,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-26 05:39:55 dovecot_login authenticator failed for ([102.50.245.141]) [102.50.245.141]:46214: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)","attackers_ip":"102.50.245.141","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745626196,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0})tLh 0{"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-26 04:47:40 dovecot_login authenticator failed for ([65.20.170.167]) [65.20.170.167]:48350: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)","attackers_ip":"65.20.170.167","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745623060,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-26 04:47:52 dovecot_login authenticator failed for ([190.65.62.234]) [190.65.62.234]:53432: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)","attackers_ip":"190.65.62.234","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745623072,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}nh #{"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-26 05:36:44 dovecot_login authenticator failed for ([85.93.42.104]) [85.93.42.104]:39548: 535 Incorrect authentication data (set_id=sales)","attackers_ip":"85.93.42.104","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745626005,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-26 05:36:29 dovecot_login authenticator failed for p5df1e80e.dip0.t-ipconnect.de [93.241.232.14]:48698: 535 Incorrect authentication data (set_id=sales)","attackers_ip":"93.241.232.14","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745625989,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}  m Pyh '{"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-26 05:53:59 dovecot_login authenticator failed for (User) [185.93.89.218]:59898: 535 Incorrect authentication data (set_id=admin)","attackers_ip":"185.93.89.218","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745627040,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}Sx h {"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-26 04:49:17 dovecot_login authenticator failed for (User) [185.93.89.218]:31610: 535 Incorrect authentication data (set_id=account1)","attackers_ip":"185.93.89.218","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745623158,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}aw, rip=87.236.176.121, lip=103.74.54.108, TLS, session=<0XdJDqUzhdVX7LB5>87.236.176.1212635167c  W!) ossec9708h @Dovecot Aborted Login with empty userApr 26 07:41:18 vm1 dovecot[3350413]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=185.247.137.71, lip=103.74.54.108, TLS, session=185.247.137.71298795Ib  -!' ossec13001h >RExim Auth failed2025-04-26 07:30:48 dovecot_login authenticator failed for (User) [185.93.89.218]:35910: 535 Incorrect authentication data (set_id=clamav)185.93.89.218130758%a  3Q' ossec11301h 9oNew FTP connection.Apr 26 07:09:57 vm1 pure-ftpd[3580977]: (?@20.65.193.190) [INFO] New connection from 20.65.193.19020.65.193.1906252001`  ;5% ossec13008h 8RMail Recipient rejected2025-04-26 07:05:12 H=static-185-95-84-71.sunucuhub.com [185.95.84.71]:59602 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no F= rejected RCPT : Sender verify failed185.95.84.71298795_  ;5% ossec13008h 8GMail Recipient rejected2025-04-26 07:05:02 H=static-185-95-84-71.sunucuhub.com [185.95.84.71]:60054 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no F= rejected RCPT : Sender verify failed185.95.84.71298795J^  -#' ossec13001h 6Exim Auth failed2025-04-26 06:58:39 dovecot_login authenticator failed for (User) [185.93.89.218]:62426: 535 Incorrect authentication data (set_id=billing)185.93.89.218130758N]  -+' ossec13001h 6tExim Auth failed2025-04-26 06:57:15 dovecot_login authenticator failed for (spd.net.tr) [178.20.231.54]:50224: 535 Incorrect authentication data (set_id=sales)178.20.231.54298795g\  -[' ossec13001h 6fExim Auth failed2025-04-26 06:57:01 dovecot_login authenticator failed for ([123.182.89.19]) [123.182.89.19]:55880: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)123.182.89.191814991[[ -C% ossec13001h 5 Exim Auth failed2025-04-26 06:51:14 dovecot_login authenticator failed for (s2seducationtrust.com) [119.96.131.8]:53032: 535 Incorrect authentication data (set_id=nologin)119.96.131.81814991TZ  -5' ossec13001h 3YExim Auth failed2025-04-26 06:44:00 dovecot_login authenticator failed for ([116.237.85.95]) [223.166.75.68]:12216: 535 Incorrect authentication data (set_id=sales)223.166.75.681814991   V&h p{"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-26 11:04:40 dovecot_login authenticator failed for ([67.213.230.122]) [67.213.230.122]:42098: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)","attackers_ip":"67.213.230.122","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745645680,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-26 11:05:03 dovecot_login authenticator failed for ([94.205.102.156]) [94.205.102.156]:48813: 535 Incorrect authentication data (set_id=sales)","attackers_ip":"94.205.102.156","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745645704,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0} RK/YXh q={"content":[{"rule":"11301","retries":1,"severity":3,"name":"New FTP connection.","message":"Apr 26 11:08:02 vm1 pure-ftpd[3651995]: (?@45.142.193.205) [INFO] New connection from 45.142.193.205","attackers_ip":"45.142.193.205","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745645882,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}MWh d{"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-26 10:14:01 dovecot_login authenticator failed for (User) [185.93.89.218]:24508: 535 Incorrect authentication data (set_id=db)","attackers_ip":"185.93.89.218","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745642641,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}[6h e{"content":[{"rule":"11","retries":1,"severity":4,"name":"Excessive number of events (above normal).","message":"The average number of logs between 10:00 and 11:00 is 5104. We reached 12762.","attackers_ip":"","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745642874,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0} ; + = D v lhr68,;l  -e) ossec13001h PExim Auth failed2025-04-24 20:25:51 dovecot_login authenticator failed for ([196.189.59.226]) [196.189.59.226]:35747: 535 Incorrect authentication data (set_id=services@heipowersystem.com)196.189.59.226337996  -) ossec13001h O^Exim Auth failed2025-04-24 20:19:01 dovecot_login authenticator failed for (abts-tn-dynamic-206.187.65.182.airtelbroadband.in) [182.65.187.206]:59685: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)182.65.187.2061269750y  -}) ossec13001h OVExim Auth failed2025-04-24 20:18:52 dovecot_login authenticator failed for ([61.150.123.106]) [61.150.123.106]:43700: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)61.150.123.10618149916 Cc% ossec11309h NFTP Authentication success.Apr 24 20:17:10 vm1 pure-ftpd[3111215]: (?@152.59.98.50) [INFO] user@s2seducationtrust.com is now logged in152.59.98.501269750# 3M% ossec11301h NNew FTP connection.Apr 24 20:17:10 vm1 pure-ftpd[3111217]: (?@152.59.98.50) [INFO] New connection from 152.59.98.50152.59.98.501269750T  -5' ossec13001h NExim Auth failed2025-04-24 20:13:43 dovecot_login authenticator failed for ([96.27.243.248]) [96.27.243.248]:51902: 535 Incorrect authentication data (set_id=sales)96.27.243.2486252001q~  -o' ossec13001h NExim Auth failed2025-04-24 20:13:19 dovecot_login authenticator failed for (84-238-92-245.ptr.bnaa.dk) [84.238.92.245]:39865: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)84.238.92.2452623032}  -+ ossec13001h M-Exim Auth failed2025-04-24 20:09:41 dovecot_login authenticator failed for (nsg-corporate-228.228.187.122.airtel.in) [122.187.228.228]:39472: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)122.187.228.2281269750|  -?) ossec13001h MExim Auth failed2025-04-24 20:09:25 dovecot_login authenticator failed for (abts-mum-static-139.98.170.122.airtelbroadband.in) [122.170.98.139]:36282: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)122.170.98.1391269750w{  -y) ossec13001h LExim Auth failed2025-04-24 20:08:13 dovecot_login authenticator failed for (dynamicip-188-232-131-13.pppoe.omsk.ertelecom.ru) [188.232.131.13]:60298: 535 Incorrect authentication data (set_id=sales)188.232.131.132017370jz  -_) ossec13001h LExim Auth failed2025-04-24 20:08:02 dovecot_login authenticator failed for ([178.178.222.50]) [178.178.222.50]:54830: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)178.178.222.502017370Iy  -!' ossec13001h LkExim Auth failed2025-04-24 20:06:27 dovecot_login authenticator failed for (User) [185.93.89.218]:22688: 535 Incorrect authentication data (set_id=ubuntu)185.93.89.218130758tx  -s) ossec13001h JExim Auth failed2025-04-24 19:59:54 dovecot_login authenticator failed for syn-173-095-123-220.biz.spectrum.com [173.95.123.220]:36240: 535 Incorrect authentication data (set_id=vikas.khandelwal)173.95.123.2206252001iw  -e! ossec13001h JExim Auth failed2025-04-24 19:59:44 dovecot_login authenticator failed for ([59.9.38.92]) [59.9.38.92]:38804: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)59.9.38.921835841Kv  -%' ossec13001h DExim Auth failed2025-04-24 19:34:20 dovecot_login authenticator failed for (User) [185.93.89.218]:63204: 535 Incorrect authentication data (set_id=training)185.93.89.218130758bu  -O) ossec13001h CExim Auth failed2025-04-24 19:29:04 dovecot_login authenticator failed for ([209.38.100.151]) [209.38.100.151]:40748: 535 Incorrect authentication data (set_id=vikas.khandelwal)209.38.100.1512750405t  -=) ossec13001h CExim Auth failed2025-04-24 19:28:55 dovecot_login authenticator failed for (abts-north-static-059.221.160.122.airtelbroadband.in) [122.160.221.59]:54148: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)122.160.221.591269750 3Sf FN23z  -' ossec13001h Exim Auth failed2025-04-26 13:35:03 dovecot_login authenticator failed for syn-023-242-066-225.res.spectrum.com [23.242.66.225]:53338: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)23.242.66.2256252001G  -' ossec13001h cExim Auth failed2025-04-26 13:29:29 dovecot_login authenticator failed for (User) [185.93.89.218]:52368: 535 Incorrect authentication data (set_id=info)185.93.89.218130758e  -S+ ossec13001h Exim Auth failed2025-04-26 13:23:55 dovecot_login authenticator failed for ([121.178.185.141]) [121.178.185.141]:51872: 535 Incorrect authentication data (set_id=vikas.khandelwal)121.178.185.1411835841o  -m% ossec13001h Exim Auth failed2025-04-26 13:23:37 dovecot_login authenticator failed for ([218.70.9.114]) [218.70.9.114]:53911: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)218.70.9.1141814991E  -' ossec13001h Exim Auth failed2025-04-26 12:56:56 dovecot_login authenticator failed for (User) [185.93.89.218]:57590: 535 Incorrect authentication data (set_id=hr)185.93.89.218130758g  -[' ossec13001h Exim Auth failed2025-04-26 12:26:44 dovecot_login authenticator failed for syn-174-083-149-085.res.spectrum.com [174.83.149.85]:50978: 535 Incorrect authentication data (set_id=sales)174.83.149.856252001m  -c+ ossec13001h Exim Auth failed2025-04-26 12:26:31 dovecot_login authenticator failed for ([154.146.238.122]) [154.146.238.122]:54084: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)154.146.238.1222542007E  -' ossec13001h !Exim Auth failed2025-04-26 12:24:23 dovecot_login authenticator failed for (User) [185.93.89.218]:46658: 535 Incorrect authentication data (set_id=hp)185.93.89.218130758s  ;a+ ossec13008h Mail Recipient rejected2025-04-26 12:11:00 H=([195.211.191.209]) [195.211.191.209]:53572 F= temporarily rejected RCPT : Could not complete sender verify195.211.191.2092750405H  -' ossec13001h {Exim Auth failed2025-04-26 11:51:50 dovecot_login authenticator failed for (User) [185.93.89.218]:28102: 535 Incorrect authentication data (set_id=guest)185.93.89.218130758a  -O' ossec13001h wExim Auth failed2025-04-26 11:35:12 dovecot_login authenticator failed for (84-238-92-245.ptr.bnaa.dk) [84.238.92.245]:58132: 535 Incorrect authentication data (set_id=purchase)84.238.92.2452623032y  -# ossec13001h wExim Auth failed2025-04-26 11:35:01 dovecot_login authenticator failed for syn-024-097-133-002.biz.spectrum.com [24.97.133.2]:65057: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)24.97.133.26252001]  -C+ ossec13001h uGExim Auth failed2025-04-26 11:25:19 dovecot_login authenticator failed for ([121.142.165.111]) [121.142.165.111]:57249: 535 Incorrect authentication data (set_id=purchase)121.142.165.1111835841g  -]% ossec13001h u;Exim Auth failed2025-04-26 11:25:07 dovecot_login authenticator failed for ([61.73.190.98]) [61.73.190.98]:55634: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)61.73.190.981835841F  -' ossec13001h sExim Auth failed2025-04-26 11:19:12 dovecot_login authenticator failed for (User) [185.93.89.218]:59452: 535 Incorrect authentication data (set_id=fax)185.93.89.218130758Q  -3# ossec13001h sExim Auth failed2025-04-26 11:18:40 dovecot_login authenticator failed for (zimbra.pragma.ru) [81.22.48.19]:50748: 535 Incorrect authentication data (set_id=sales)81.22.48.192017370h  -]' ossec13001h sExim Auth failed2025-04-26 11:18:28 dovecot_login authenticator failed for (netcomafrica.com) [41.67.143.142]:42204: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)41.67.143.1422328926(  3U) ossec11301h rNew FTP connection.Apr 26 11:14:57 vm1 pure-ftpd[3653952]: (?@205.210.31.221) [INFO] New connection from 205.210.31.221205.210.31.2216252001 K _ %VgwJ@  -#' ossec13001h Exim Auth failed2025-04-26 17:51:36 dovecot_login authenticator failed for (User) [185.93.89.218]:27486: 535 Incorrect authentication data (set_id=monitor)185.93.89.218130758L?  -'' ossec13001h Exim Auth failed2025-04-26 17:18:40 dovecot_login authenticator failed for (User) [185.93.89.218]:61264: 535 Incorrect authentication data (set_id=marketing)185.93.89.218130758W>  -9) ossec13001h Exim Auth failed2025-04-26 17:10:15 dovecot_login authenticator failed for ([146.235.193.77]) [146.235.193.77]:56820: 535 Incorrect authentication data (set_id=sales)146.235.193.776252001=  -# ossec13001h Exim Auth failed2025-04-26 17:10:03 dovecot_login authenticator failed for (46x0x192x86.static-customer.samara.ertelecom.ru) [46.0.192.86]:58348: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)46.0.192.862017370c<  -U% ossec13001h Exim Auth failed2025-04-26 16:52:09 dovecot_login authenticator failed for (50-82-12-128.client.mchsi.com) [50.82.12.128]:36836: 535 Incorrect authentication data (set_id=services)50.82.12.1286252001j;  -a' ossec13001h Exim Auth failed2025-04-26 16:51:57 dovecot_login authenticator failed for ([149.54.15.162]) [149.54.15.162]:39893: 535 Incorrect authentication data (set_id=services@heipowersystem.com)149.54.15.1621149361J:  -#' ossec13001h hExim Auth failed2025-04-26 16:45:51 dovecot_login authenticator failed for (User) [185.93.89.218]:52750: 535 Incorrect authentication data (set_id=manager)185.93.89.218130758Z9  -?) ossec13001h Exim Auth failed2025-04-26 16:14:10 dovecot_login authenticator failed for ([119.207.78.191]) [119.207.78.191]:60116: 535 Incorrect authentication data (set_id=purchase)119.207.78.19118358418  - ) ossec13001h Exim Auth failed2025-04-26 16:13:49 dovecot_login authenticator failed for 209.66.246.220.static.netvigator.com [220.246.66.209]:59021: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)220.246.66.2091819730J7  -#' ossec13001h Exim Auth failed2025-04-26 16:12:59 dovecot_login authenticator failed for (User) [185.93.89.218]:9740: 535 Incorrect authentication data (set_id=mailtest)185.93.89.218130758`6  -O% ossec13001h Exim Auth failed2025-04-26 15:40:33 dovecot_login authenticator failed for ([92.47.46.174]) [92.47.46.174]:42616: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)92.47.46.1741522867v5  -y' ossec13001h Exim Auth failed2025-04-26 15:40:17 dovecot_login authenticator failed for ([111.8.153.131]) [111.8.153.131]:43246: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)111.8.153.1311814991G4  -' ossec13001h Exim Auth failed2025-04-26 15:40:12 dovecot_login authenticator failed for (User) [185.93.89.218]:32602: 535 Incorrect authentication data (set_id=mail)185.93.89.218130758W3  -9) ossec13001h Exim Auth failed2025-04-26 15:34:13 dovecot_login authenticator failed for ([83.239.108.218]) [83.239.108.218]:51967: 535 Incorrect authentication data (set_id=sales)83.239.108.2182017370g2  -[' ossec13001h Exim Auth failed2025-04-26 15:34:02 dovecot_login authenticator failed for ([45.164.98.205]) [45.164.98.205]:41154: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)45.164.98.2053469034H1  -' ossec13001h HExim Auth failed2025-04-26 15:07:11 dovecot_login authenticator failed for (User) [185.93.89.218]:32592: 535 Incorrect authentication data (set_id=info2)185.93.89.218130758c0  -Q) ossec13001h Exim Auth failed2025-04-26 14:43:12 dovecot_login authenticator failed for ip98-177-115-211.ph.ph.cox.net [98.177.115.211]:64018: 535 Incorrect authentication data (set_id=sales)98.177.115.2116252001 x* 5 g o w t7jxm/  -c+ ossec13001h Exim Auth failed2025-04-26 14:42:59 dovecot_login authenticator failed for ([170.133.232.119]) [170.133.232.119]:34966: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)170.133.232.1196251999H.  -' ossec13001h Exim Auth failed2025-04-26 14:34:39 dovecot_login authenticator failed for (User) [185.93.89.218]:17052: 535 Incorrect authentication data (set_id=info1)185.93.89.218130758!-  3M% ossec11301h "New FTP connection.Apr 26 14:32:26 vm1 pure-ftpd[3700532]: (?@154.47.30.14) [INFO] New connection from 154.47.30.14154.47.30.14953987`,  -O% ossec13001h Exim Auth failed2025-04-26 14:31:24 dovecot_login authenticator failed for 1-36-115-211.ptr.netvigator.com [1.36.115.211]:41290: 535 Incorrect authentication data (set_id=sales)1.36.115.2111819730 +  -+ ossec13001h Exim Auth failed2025-04-26 14:30:55 dovecot_login authenticator failed for 107-135-117-245.lightspeed.livnmi.sbcglobal.net [107.135.117.245]:19758: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)107.135.117.2456252001l*  -a+ ossec13001h :Exim Auth failed2025-04-26 14:28:32 dovecot_login authenticator failed for 213-238-254-156.customers.ownit.se [213.238.254.156]:57488: 535 Incorrect authentication data (set_id=services)213.238.254.1562661886j)  -a' ossec13001h (Exim Auth failed2025-04-26 14:28:15 dovecot_login authenticator failed for ([218.22.187.70]) [218.22.187.66]:43912: 535 Incorrect authentication data (set_id=services@heipowersystem.com)218.22.187.661814991c(  -S' ossec13001h Exim Auth failed2025-04-26 14:16:56 dovecot_login authenticator failed for ([177.5.229.122]) [177.5.229.122]:52317: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)177.5.229.1223469034|'  -+ ossec13001h cExim Auth failed2025-04-26 14:16:27 dovecot_login authenticator failed for ([211.104.177.132]) [211.104.177.132]:44756: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)211.104.177.1321835841V&  -9' ossec13001h 5Exim Auth failed2025-04-26 14:15:41 dovecot_login authenticator failed for 157.ip-51-75-142.eu [51.75.142.157]:56578: 535 Incorrect authentication data (set_id=sales)51.75.142.1573017382~%  - ' ossec13001h -Exim Auth failed2025-04-26 14:15:32 dovecot_login authenticator failed for (70.210.245.58.adsl-pool.jlccptt.net.cn) [58.245.210.70]:18355: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)58.245.210.701814991s$ -u# ossec13001h Exim Auth failed2025-04-26 14:14:12 dovecot_login authenticator failed for (WIN-9DVAMKIGFGL) [2.58.56.194]:30343: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)2.58.56.1942750405s# -u# ossec13001h Exim Auth failed2025-04-26 14:13:57 dovecot_login authenticator failed for (WIN-9DVAMKIGFGL) [2.58.56.194]:28591: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)2.58.56.1942750405I"  -!' ossec13001h Exim Auth failed2025-04-26 14:02:04 dovecot_login authenticator failed for (User) [185.93.89.218]:56336: 535 Incorrect authentication data (set_id=info01)185.93.89.218130758b!  -O) ossec13001h Exim Auth failed2025-04-26 13:47:07 dovecot_login authenticator failed for ([220.77.245.227]) [220.77.245.227]:37338: 535 Incorrect authentication data (set_id=vikas.khandelwal)220.77.245.2271835841  -' ossec13001h oExim Auth failed2025-04-26 13:46:46 dovecot_login authenticator failed for (nsg-corporate-70.104.187.122.airtel.in) [117.250.250.2]:39438: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)117.250.250.21269750Q  -1% ossec13001h Exim Auth failed2025-04-26 13:35:15 dovecot_login authenticator failed for ([8.155.38.230]) [49.77.14.208]:33858: 535 Incorrect authentication data (set_id=sales)49.77.14.2081814991  kk442z^h {"content":[{"rule":"11301","retries":1,"severity":3,"name":"New FTP connection.","message":"Apr 26 14:59:09 vm1 pure-ftpd[3707564]: (?@117.98.85.101) [INFO] New connection from 117.98.85.101","attackers_ip":"117.98.85.101","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745659750,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":true,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"11075","retries":1,"severity":3,"name":"FTP file manipulations","message":"Sat Apr 26 14:59:10 2025 0 117.98.85.101 485 /home/techno/public_html/msnews24.in/v1/public/index.php a _ o r techno ftp 1 * c","attackers_ip":"117.98.85.101","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":["noshow"],"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745659752,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":true,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"11309","retries":1,"severity":3,"name":"FTP Authentication success.","message":"Apr 26 14:59:09 vm1 pure-ftpd[3707564]: (?@117.98.85.101) [INFO] techno is now logged in","attackers_ip":"117.98.85.101","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745659752,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":true,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}  G _ s  m&GE1Bg'  3U) ossec11301h q:New FTP connection.Apr 26 11:08:02 vm1 pure-ftpd[3651995]: (?@45.142.193.205) [INFO] New connection from 45.142.193.20545.142.193.205798549V  -9) ossec13001h pExim Auth failed2025-04-26 11:05:03 dovecot_login authenticator failed for ([94.205.102.156]) [94.205.102.156]:48813: 535 Incorrect authentication data (set_id=sales)94.205.102.156290557j  -_) ossec13001h ppExim Auth failed2025-04-26 11:04:40 dovecot_login authenticator failed for ([67.213.230.122]) [67.213.230.122]:42098: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)67.213.230.1226252001  ;) ossec13008h o>Mail Recipient rejected2025-04-26 10:59:34 H=(localhost.localdomain) [78.153.140.207]:55528 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no F= rejected RCPT : Sender verify failed78.153.140.2072635167}  -+ ossec13001h l_Exim Auth failed2025-04-26 10:47:18 dovecot_login authenticator failed for kd113158205225.ppp-bb.dion.ne.jp [113.158.205.225]:42893: 535 Incorrect authentication data (set_id=services@heipowersystem.com)113.158.205.2251861060Z  -?) ossec13001h lmExim Auth failed2025-04-26 10:47:33 dovecot_login authenticator failed for ([192.34.128.202]) [192.34.128.202]:33454: 535 Incorrect authentication data (set_id=services)192.34.128.2026252001F  -' ossec13001h l5Exim Auth failed2025-04-26 10:46:36 dovecot_login authenticator failed for (User) [185.93.89.218]:3838: 535 Incorrect authentication data (set_id=demo)185.93.89.218130758  5') ossec11011h kWHM SSO login failed[2025-04-26 10:44:00 +0530] info [whostmgrd] 171.79.151.186 PURGE root:pA78c0Bk6EJDYFcv badpass [cookie ip check: IP address has changed: IP Address [171.79.150.205] != Current IP Address [171.79.151.186]]171.79.151.1861269750` U!) ossec11001h kDeferred login on the cpanel service[2025-04-26 10:43:58 +0530] info [cpaneld] 171.79.151.186 - techno "GET /cpsess3894121332/frontend/jupiter/backup/index.html HTTP/1.1" DEFERRED LOGIN cpaneld: cookie ip check: IP address has changed: IP Address [171.79.150.205] != Current IP Address [171.79.151.186]171.79.151.1861269750"  3M% ossec11301h g New FTP connection.Apr 26 10:24:34 vm1 pure-ftpd[3640959]: (?@139.162.77.6) [INFO] New connection from 139.162.77.6139.162.77.61861060  a' ossec11h ezExcessive number of events (above normal).The average number of logs between 10:00 and 11:00 is 5104. We reached 12762.E  -' ossec13001h dExim Auth failed2025-04-26 10:14:01 dovecot_login authenticator failed for (User) [185.93.89.218]:24508: 535 Incorrect authentication data (set_id=db)185.93.89.218130758g  -[' ossec13001h cExim Auth failed2025-04-26 10:09:33 dovecot_login authenticator failed for ([218.22.187.70]) [218.22.187.66]:34200: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)218.22.187.661814991c  -S' ossec13001h cExim Auth failed2025-04-26 10:09:45 dovecot_login authenticator failed for 46-162-104-66.cust.bredband2.com [46.162.104.66]:38636: 535 Incorrect authentication data (set_id=sales)46.162.104.662661886H~  -' ossec13001h \Exim Auth failed2025-04-26 09:41:29 dovecot_login authenticator failed for (User) [185.93.89.218]:26040: 535 Incorrect authentication data (set_id=david)185.93.89.218130758f}  -W) ossec13001h \#Exim Auth failed2025-04-26 09:38:03 dovecot_login authenticator failed for ([196.28.226.125]) [196.28.226.125]:56462: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)196.28.226.1251036973||  -+ ossec13001h \Exim Auth failed2025-04-26 09:37:44 dovecot_login authenticator failed for ([103.231.163.154]) [103.231.163.154]:17511: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)103.231.163.1541210997 !& 9  W AVcnza  -Q% ossec13001h ]iExim Auth failed2025-04-24 21:18:57 dovecot_login authenticator failed for ([36.32.223.199]) [58.242.71.98]:31864: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)58.242.71.981814991t  -y' ossec13001h ]]Exim Auth failed2025-04-24 21:18:45 dovecot_login authenticator failed for ([65.20.138.138]) [65.20.138.138]:51003: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)65.20.138.13899237T  -5' ossec13001h ]Exim Auth failed2025-04-24 21:17:16 dovecot_login authenticator failed for ([64.52.161.161]) [64.52.161.161]:35772: 535 Incorrect authentication data (set_id=sales)64.52.161.1616252001m  -c+ ossec13001h \Exim Auth failed2025-04-24 21:17:00 dovecot_login authenticator failed for ([180.188.143.166]) [180.188.143.166]:58192: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)180.188.143.1661819730b  -O) ossec13001h [CExim Auth failed2025-04-24 21:09:46 dovecot_login authenticator failed for ([176.192.250.81]) [176.192.250.81]:55878: 535 Incorrect authentication data (set_id=vikas.khandelwal)176.192.250.812017370o  -k' ossec13001h [9Exim Auth failed2025-04-24 21:09:36 dovecot_login authenticator failed for ool-6038e495.static.optonline.net [96.56.228.149]:38730: 535 Incorrect authentication data (set_id=vikas.khandelwal)96.56.228.1496252001p  -k) ossec13001h [Exim Auth failed2025-04-24 21:09:00 dovecot_login authenticator failed for (132.251.223.60.adsl-pool.sx.cn) [60.223.251.132]:33208: 535 Incorrect authentication data (set_id=vikas.khandelwal)60.223.251.1321814991n  -m% ossec13001h ZExim Auth failed2025-04-24 21:08:38 dovecot_login authenticator failed for ([185.167.58.9]) [185.167.58.9]:56390: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)185.167.58.9617790f  -[% ossec13001h ZExim Auth failed2025-04-24 21:04:51 dovecot_login authenticator failed for (selinc.static.gvt.net.br) [177.136.2.66]:59033: 535 Incorrect authentication data (set_id=vikas.khandelwal)177.136.2.663469034  -1% ossec13001h ZExim Auth failed2025-04-24 21:04:39 dovecot_login authenticator failed for 206.81.4.146.static.wline.lns.sme.cust.swisscom.ch [146.4.81.206]:57510: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)146.4.81.20626584348  Ai' ossec11302h TFTP Authentication failed.Apr 24 20:41:49 vm1 pure-ftpd[3116492]: (?@123.58.207.81) [WARNING] Authentication failed for user [anonymous]123.58.207.812635167& 3Q' ossec11301h TNew FTP connection.Apr 24 20:41:40 vm1 pure-ftpd[3116483]: (?@123.58.207.81) [INFO] New connection from 123.58.207.81123.58.207.812635167H  -' ossec13001h SExim Auth failed2025-04-24 20:38:36 dovecot_login authenticator failed for (User) [185.93.89.218]:56284: 535 Incorrect authentication data (set_id=vmail)185.93.89.218130758(  3U) ossec11301h RNew FTP connection.Apr 24 20:34:09 vm1 pure-ftpd[3114716]: (?@184.105.139.67) [INFO] New connection from 184.105.139.67184.105.139.676252001h  -]' ossec13001h QExim Auth failed2025-04-24 20:30:13 dovecot_login authenticator failed for (static.ill.117.211.15.93.bsnl.co.in) [117.211.15.93]:39378: 535 Incorrect authentication data (set_id=sales)117.211.15.931269750v  -w) ossec13001h QExim Auth failed2025-04-24 20:30:01 dovecot_login authenticator failed for ip72-199-156-231.sd.sd.cox.net [72.199.156.231]:33118: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)72.199.156.2316252001Z  -?) ossec13001h QExim Auth failed2025-04-24 20:26:21 dovecot_login authenticator failed for ([183.60.143.195]) [183.60.143.195]:37120: 535 Incorrect authentication data (set_id=services)183.60.143.1951814991 C ;G '9CqR  -k+ ossec13001h Exim Auth failed2025-04-26 19:59:11 dovecot_login authenticator failed for net-188-219-104-210.cust.vodafonedsl.it [188.219.104.210]:54885: 535 Incorrect authentication data (set_id=purchase)188.219.104.2103175395YQ  -C# ossec13001h Exim Auth failed2025-04-26 19:59:06 dovecot_login authenticator failed for ([218.76.73.4]) [218.76.73.4]:52502: 535 Incorrect authentication data (set_id=vikas.khandelwal)218.76.73.41814991 P  -!) ossec13001h Exim Auth failed2025-04-26 19:58:52 dovecot_login authenticator failed for (106.107.173.49.adsl.dynamic.seed.net.tw) [106.107.173.49]:6809: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)106.107.173.491668284`O  -U! ossec13001h Exim Auth failed2025-04-26 19:58:44 dovecot_login authenticator failed for ([5.32.32.14]) [5.32.32.14]:46454: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)5.32.32.14290557JN  -#' ossec13001h Exim Auth failed2025-04-26 19:29:22 dovecot_login authenticator failed for (User) [185.93.89.218]:54384: 535 Incorrect authentication data (set_id=postfix)185.93.89.218130758:M  Ak) ossec11302h wFTP Authentication failed.Apr 26 19:23:58 vm1 pure-ftpd[3771508]: (?@193.105.134.40) [WARNING] Authentication failed for user [anonymous]193.105.134.402661886(L  3U) ossec11301h qNew FTP connection.Apr 26 19:23:52 vm1 pure-ftpd[3771508]: (?@193.105.134.40) [INFO] New connection from 193.105.134.40193.105.134.402661886(K  3U) ossec11301h New FTP connection.Apr 26 19:16:16 vm1 pure-ftpd[3769783]: (?@88.218.193.254) [INFO] New connection from 88.218.193.25488.218.193.2542921044JJ  -#' ossec13001h Exim Auth failed2025-04-26 18:56:48 dovecot_login authenticator failed for (User) [185.93.89.218]:32234: 535 Incorrect authentication data (set_id=noreply)185.93.89.218130758:I gI# ossec11307h Multiple connection attempts from same sourceApr 26 18:44:05 vm1 pure-ftpd[3762209]: (?@86.54.31.34) [INFO] New connection from 86.54.31.3486.54.31.3462519994H  Ae# ossec11302h FTP Authentication failed.Apr 26 18:44:01 vm1 pure-ftpd[3761973]: (?@86.54.31.34) [WARNING] Authentication failed for user [anonymous]86.54.31.346251999 G 3I# ossec11301h New FTP connection.Apr 26 18:43:54 vm1 pure-ftpd[3761973]: (?@86.54.31.34) [INFO] New connection from 86.54.31.3486.54.31.346251999HF  -' ossec13001h tExim Auth failed2025-04-26 18:24:10 dovecot_login authenticator failed for (User) [185.93.89.218]:46072: 535 Incorrect authentication data (set_id=mysql)185.93.89.218130758]E  -M! ossec13001h 8Exim Auth failed2025-04-26 18:18:54 dovecot_login authenticator failed for (8-20-22-58.hwccustomers.com) [8.20.22.58]:65346: 535 Incorrect authentication data (set_id=purchase)8.20.22.586252001mD  -e) ossec13001h "Exim Auth failed2025-04-26 18:18:33 dovecot_login authenticator failed for ([122.224.213.66]) [122.224.213.66]:41814: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)122.224.213.661814991C  5%) ossec11011h ԅWHM SSO login failed[2025-04-26 18:11:40 +0530] info [whostmgrd] 106.206.184.64 PURGE root:kkvb7PScoCwEoShg badpass [cookie ip check: IP address has changed: IP Address [117.98.85.101] != Current IP Address [106.206.184.64]]106.206.184.641269750PB  U) ossec11001h ԅDeferred login on the cpanel service[2025-04-26 18:11:40 +0530] info [whostmgrd] 106.206.184.64 - root "GET /cpsess7237305776/scripts4/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: cookie ip check: IP address has changed: IP Address [117.98.85.101] != Current IP Address [106.206.184.64]106.206.184.641269750A  ;) ossec13008h Mail Recipient rejected2025-04-26 17:56:00 H=(localhost.localdomain) [78.153.140.207]:43966 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no F= rejected RCPT : Sender verify failed78.153.140.2072635167 y._ h * )3e#s3Ibyde  -W% ossec13001h Exim Auth failed2025-04-26 21:59:41 dovecot_login authenticator failed for ([43.159.46.60]) [43.159.46.60]:42022: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)43.159.46.601880251bd  -Q' ossec13001h nExim Auth failed2025-04-26 21:44:37 dovecot_login authenticator failed for (171-118-158-5.pride-net.ru) [5.158.118.171]:50992: 535 Incorrect authentication data (set_id=services)5.158.118.1712017370ec  -]% ossec13001h UExim Auth failed2025-04-26 21:44:12 dovecot_login authenticator failed for ([65.20.129.71]) [65.20.129.71]:35727: 535 Incorrect authentication data (set_id=services@heipowersystem.com)65.20.129.7199237?b  gQ' ossec11307h Multiple connection attempts from same sourceApr 26 21:43:16 vm1 pure-ftpd[3833088]: (?@35.216.165.97) [INFO] New connection from 35.216.165.9735.216.165.972658434&a 3Q' ossec11301h  New FTP connection.Apr 26 21:43:11 vm1 pure-ftpd[3833073]: (?@35.216.165.97) [INFO] New connection from 35.216.165.9735.216.165.972658434L`  -'' ossec13001h oExim Auth failed2025-04-26 21:40:23 dovecot_login authenticator failed for (User) [185.93.89.218]:39882: 535 Incorrect authentication data (set_id=reception)185.93.89.218130758+_  3Y+ ossec11301h iNew FTP connection.Apr 26 21:27:27 vm1 pure-ftpd[3829681]: (?@172.104.210.105) [INFO] New connection from 172.104.210.105172.104.210.1056252001^  a' ossec11h Excessive number of events (above normal).The average number of logs between 21:00 and 22:00 is 4863. We reached 12159.(]  3U) ossec11301h New FTP connection.Apr 26 21:15:09 vm1 pure-ftpd[3811724]: (?@198.235.24.232) [INFO] New connection from 198.235.24.232198.235.24.2326252001I\  -!' ossec13001h Exim Auth failed2025-04-26 21:07:36 dovecot_login authenticator failed for (User) [185.93.89.218]:19692: 535 Incorrect authentication data (set_id=prueba)185.93.89.218130758q[  -s# ossec13001h ^Exim Auth failed2025-04-26 20:44:36 dovecot_login authenticator failed for net-2-39-108-78.cust.vodafonedsl.it [2.39.108.78]:58426: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)2.39.108.783175395|Z  -+ ossec13001h RExim Auth failed2025-04-26 20:44:25 dovecot_login authenticator failed for ([211.199.248.212]) [211.199.248.212]:40563: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)211.199.248.2121835841Y  a' ossec11h pExcessive number of events (above normal).The average number of logs between 20:00 and 21:00 is 5040. We reached 12602.pX  -m' ossec13001h Exim Auth failed2025-04-26 20:43:34 dovecot_login authenticator failed for (s2seducationtrust.com) [221.229.216.1]:59864: 535 Incorrect authentication data (set_id=admin@s2seducationtrust.com)221.229.216.11814991\W  -E' ossec13001h Exim Auth failed2025-04-26 20:43:06 dovecot_login authenticator failed for (s2seducationtrust.com) [221.229.216.1]:56208: 535 Incorrect authentication data (set_id=nologin)221.229.216.11814991NV  --# ossec13001h 4Exim Auth failed2025-04-26 20:39:39 dovecot_login authenticator failed for ([103.50.5.94]) [103.50.5.94]:51591: 535 Incorrect authentication data (set_id=sales)103.50.5.941269750rU  -s% ossec13001h $Exim Auth failed2025-04-26 20:39:23 dovecot_login authenticator failed for ool-43531ec7.dyn.optonline.net [67.83.30.199]:35381: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)67.83.30.1996252001JT  -#' ossec13001h Exim Auth failed2025-04-26 20:34:50 dovecot_login authenticator failed for (User) [185.93.89.218]:38612: 535 Incorrect authentication data (set_id=printer)185.93.89.218130758MS  -)' ossec13001h gExim Auth failed2025-04-26 20:02:06 dovecot_login authenticator failed for (User) [185.93.89.218]:55054: 535 Incorrect authentication data (set_id=postmaster)185.93.89.218130758 Ft 6LmyXZ  -A# ossec13001h Exim Auth failed2025-04-25 00:41:24 dovecot_login authenticator failed for (92-62-74-41.saimanet.kg) [92.62.74.41]:51967: 535 Incorrect authentication data (set_id=sales)92.62.74.411527747zY  -) ossec13001h Exim Auth failed2025-04-25 00:40:59 dovecot_login authenticator failed for (118-69-225-128-static.hcm.fpt.vn) [118.69.225.128]:38866: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)118.69.225.1281562822&X 3Q' ossec11301h {New FTP connection.Apr 25 00:39:46 vm1 pure-ftpd[3174529]: (?@106.75.64.169) [INFO] New connection from 106.75.64.169106.75.64.1691814991rW  -q' ossec13001h Exim Auth failed2025-04-25 00:33:02 dovecot_login authenticator failed for syn-024-043-131-106.biz.spectrum.com [24.43.131.106]:49942: 535 Incorrect authentication data (set_id=vikas.khandelwal)24.43.131.1066252001oV  -m% ossec13001h Exim Auth failed2025-04-25 00:32:45 dovecot_login authenticator failed for ([85.12.240.14]) [85.12.240.14]:46242: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)85.12.240.142017370ZU  -?) ossec13001h Exim Auth failed2025-04-25 00:28:53 dovecot_login authenticator failed for ([120.157.57.136]) [120.157.57.136]:42362: 535 Incorrect authentication data (set_id=purchase)120.157.57.1362077456eT  -]% ossec13001h Exim Auth failed2025-04-25 00:28:34 dovecot_login authenticator failed for ([65.20.151.34]) [65.20.151.34]:47200: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)65.20.151.3499237TS  -5' ossec13001h vExim Auth failed2025-04-25 00:26:52 dovecot_login authenticator failed for ([48.218.170.53]) [48.218.170.53]:58506: 535 Incorrect authentication data (set_id=sales)48.218.170.531861060gR  -[' ossec13001h dExim Auth failed2025-04-25 00:26:36 dovecot_login authenticator failed for ([14.39.113.250]) [14.39.113.250]:55502: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)14.39.113.2501835841IQ  -!' ossec13001h Exim Auth failed2025-04-25 00:23:43 dovecot_login authenticator failed for (User) [185.93.89.218]:8150: 535 Incorrect authentication data (set_id=admin01)185.93.89.218130758eP  -S+ ossec13001h Exim Auth failed2025-04-25 00:11:00 dovecot_login authenticator failed for ([122.225.203.106]) [122.225.203.106]:38775: 535 Incorrect authentication data (set_id=vikas.khandelwal)122.225.203.1061814991uO  -u) ossec13001h Exim Auth failed2025-04-25 00:10:50 dovecot_login authenticator failed for ([121.189.198.60]) [121.189.198.60]:55658: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)121.189.198.601835841uN  -u) ossec13001h Exim Auth failed2025-04-25 00:10:39 dovecot_login authenticator failed for ([113.108.191.82]) [113.108.191.82]:59143: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)113.108.191.821814991YM  -?) ossec13001h [Exim Auth failed2025-04-25 00:09:22 dovecot_login authenticator failed for ([130.185.96.113]) [130.185.96.113]:37898: 535 Incorrect authentication data (set_id=services)130.185.96.113294640jL  -a' ossec13001h CExim Auth failed2025-04-25 00:08:58 dovecot_login authenticator failed for ([61.177.59.235]) [61.177.59.235]:35512: 535 Incorrect authentication data (set_id=services@heipowersystem.com)61.177.59.2351814991K  ?1 ossec1008h Process exiting (killed).Apr 25 00:07:31 vm1 spamd[2844274]: spamd: server killed by SIGTERM, shutting downCJ  77 ossec502h hOssec server started.ossec: Ossec started.5I  ; ossec9703h TDovecot is Starting Up.Apr 25 00:05:00 vm1 dovecot[3163691]: master: Dovecot v2.3.21.1 (d492236fa0) starting up for lmtp, imap, pop3 (core dumps disabled)  S 6h {"content":[{"rule":"11","retries":1,"severity":4,"name":"Excessive number of events (above normal).","message":"The average number of logs between 21:00 and 22:00 is 4863. We reached 12159.","attackers_ip":"","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745682654,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}>2^h {{"content":[{"rule":"11301","retries":1,"severity":3,"name":"New FTP connection.","message":"Apr 26 21:27:27 vm1 pure-ftpd[3829681]: (?@172.104.210.105) [INFO] New connection from 172.104.210.105","attackers_ip":"172.104.210.105","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745683049,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0})Lh Q{"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-26 14:15:32 dovecot_login authenticator failed for (70.210.245.58.adsl-pool.jlccptt.net.cn) [58.245.210.70]:18355: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)","attackers_ip":"58.245.210.70","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745657133,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-26 14:15:41 dovecot_login authenticator failed for 157.ip-51-75-142.eu [51.75.142.157]:56578: 535 Incorrect authentication data (set_id=sales)","attackers_ip":"51.75.142.157","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745657141,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0} 0 3AgpZH  -?) ossec13001h FExim Auth failed2025-04-24 23:56:13 dovecot_login authenticator failed for ([116.113.193.70]) [116.113.193.70]:32634: 535 Incorrect authentication data (set_id=purchase)116.113.193.701814991rG  -q' ossec13001h 6Exim Auth failed2025-04-24 23:55:58 dovecot_login authenticator failed for 104.178.69.85.rev.sfr.net [85.69.178.104]:43108: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)85.69.178.1043017382UF  -9% ossec13001h Exim Auth failed2025-04-24 23:55:18 dovecot_login authenticator failed for 747449767.vpn.mgn.ru [79.134.8.218]:59618: 535 Incorrect authentication data (set_id=sales)79.134.8.2182017370mE  -c+ ossec13001h Exim Auth failed2025-04-24 23:55:01 dovecot_login authenticator failed for ([172.171.241.233]) [172.171.241.233]:48986: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)172.171.241.2336252001HD  -' ossec13001h 0Exim Auth failed2025-04-24 23:51:35 dovecot_login authenticator failed for (User) [185.93.89.218]:17946: 535 Incorrect authentication data (set_id=admin)185.93.89.218130758`C  -O' ossec13001h Exim Auth failed2025-04-24 23:51:07 dovecot_login authenticator failed for (82.193.122.91.cl.ipnet.ua) [82.193.122.91]:38588: 535 Incorrect authentication data (set_id=services)82.193.122.91690791~B  - ' ossec13001h Exim Auth failed2025-04-24 23:50:50 dovecot_login authenticator failed for (static.ill.117.211.15.93.bsnl.co.in) [117.211.15.93]:37960: 535 Incorrect authentication data (set_id=services@heipowersystem.com)117.211.15.931269750uA  -w' ossec13001h }GExim Auth failed2025-04-24 23:34:54 dovecot_login authenticator failed for dhcp-4-bc-9f-52-b7-f.cpe.i-zoom.net [24.244.93.233]:45557: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)24.244.93.2336251999 @  -) ossec13001h }3Exim Auth failed2025-04-24 23:34:34 dovecot_login authenticator failed for (103.253.201.30.threesainfoway.net) [103.253.201.30]:40402: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)103.253.201.301269750g?  -[' ossec13001h |Exim Auth failed2025-04-24 23:33:12 dovecot_login authenticator failed for ([103.194.88.66]) [103.194.88.65]:33842: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)103.194.88.651269750d>  -U' ossec13001h |Exim Auth failed2025-04-24 23:33:22 dovecot_login authenticator failed for c-85-228-126-81.bbcust.telenor.se [85.228.126.81]:48484: 535 Incorrect authentication data (set_id=sales)85.228.126.812661886h=  -a# ossec13001h {Exim Auth failed2025-04-24 23:25:32 dovecot_login authenticator failed for (125-209-116-242.multi.net.pk) [58.27.253.6]:50333: 535 Incorrect authentication data (set_id=vikas.khandelwal)58.27.253.61168579<  -) ossec13001h {Exim Auth failed2025-04-24 23:25:19 dovecot_login authenticator failed for syn-070-118-112-230.biz.spectrum.com [70.118.112.230]:44921: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)70.118.112.2306252001r;  -q' ossec13001h zExim Auth failed2025-04-24 23:25:07 dovecot_login authenticator failed for ([183.96.57.241]) [183.96.57.241]:43360: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)183.96.57.2411835841K:  -%' ossec13001h yExim Auth failed2025-04-24 23:19:24 dovecot_login authenticator failed for (User) [185.93.89.218]:16798: 535 Incorrect authentication data (set_id=accounts)185.93.89.218130758%9  3Q' ossec11301h uKNew FTP connection.Apr 24 23:00:50 vm1 pure-ftpd[3147836]: (?@205.210.31.86) [INFO] New connection from 205.210.31.86205.210.31.866252001K8  -%' ossec13001h rExim Auth failed2025-04-24 22:47:15 dovecot_login authenticator failed for (User) [185.93.89.218]:22436: 535 Incorrect authentication data (set_id=account1)185.93.89.218130758   H \ .[qWk  -9) ossec13001h Exim Auth failed2025-04-25 01:39:38 dovecot_login authenticator failed for ([62.140.234.114]) [62.140.234.114]:59825: 535 Incorrect authentication data (set_id=sales)62.140.234.1142017370ej  -[' ossec13001h xExim Auth failed2025-04-25 01:39:27 dovecot_login authenticator failed for ([65.20.235.177]) [65.20.235.177]:43625: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)65.20.235.17799237Ni  -/! ossec13001h Exim Auth failed2025-04-25 01:31:11 dovecot_login authenticator failed for ([1.183.1.82]) [1.183.1.82]:42244: 535 Incorrect authentication data (set_id=services)1.183.1.821814991jh  -a' ossec13001h |Exim Auth failed2025-04-25 01:30:59 dovecot_login authenticator failed for ([61.108.83.254]) [61.108.83.139]:47574: 535 Incorrect authentication data (set_id=services@heipowersystem.com)61.108.83.1391835841Ig  -!' ossec13001h Exim Auth failed2025-04-25 01:27:53 dovecot_login authenticator failed for (User) [185.93.89.218]:64964: 535 Incorrect authentication data (set_id=clamav)185.93.89.218130758ef  -W' ossec13001h Exim Auth failed2025-04-25 01:02:49 dovecot_login authenticator failed for 95-31-196-133.broadband.corbina.ru [95.31.196.133]:50428: 535 Incorrect authentication data (set_id=sales)95.31.196.1332017370ve  -y' ossec13001h Exim Auth failed2025-04-25 01:02:38 dovecot_login authenticator failed for 95.57.104.252.dynamic.telecom.kz [95.57.104.252]:37210: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)95.57.104.2521522867Zd  -G! ossec13001h Exim Auth failed2025-04-25 00:59:14 dovecot_login authenticator failed for ([78.36.2.54]) [78.36.2.54]:56042: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)78.36.2.542017370pc  -q# ossec13001h Exim Auth failed2025-04-25 00:59:04 dovecot_login authenticator failed for ([94.251.8.83]) [94.251.8.83]:44702: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)94.251.8.832017370hb  -[) ossec13001h Exim Auth failed2025-04-25 00:58:47 dovecot_login authenticator failed for d207-81-158-101.bchsia.telus.net [207.81.158.101]:55110: 535 Incorrect authentication data (set_id=services)207.81.158.1016251999ma  -e) ossec13001h Exim Auth failed2025-04-25 00:58:31 dovecot_login authenticator failed for ([175.116.66.199]) [175.116.66.199]:23589: 535 Incorrect authentication data (set_id=services@heipowersystem.com)175.116.66.1991835841T`  -5' ossec13001h }Exim Auth failed2025-04-25 00:56:53 dovecot_login authenticator failed for ([104.152.58.17]) [104.152.58.17]:40595: 535 Incorrect authentication data (set_id=sales)104.152.58.176252001g_  -[' ossec13001h hExim Auth failed2025-04-25 00:56:30 dovecot_login authenticator failed for ([58.253.194.27]) [58.253.194.27]:56707: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)58.253.194.271814991J^  -#' ossec13001h >Exim Auth failed2025-04-25 00:55:48 dovecot_login authenticator failed for (User) [185.93.89.218]:36862: 535 Incorrect authentication data (set_id=billing)185.93.89.218130758s]  -s' ossec13001h CExim Auth failed2025-04-25 00:43:07 dovecot_login authenticator failed for (109-126-34-84.pptp.vladlink.net) [109.126.34.84]:60428: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)109.126.34.842017370n\  -m# ossec13001h %Exim Auth failed2025-04-25 00:42:36 dovecot_login authenticator failed for 210.0.90.82.static.nexnet.net.au [210.0.90.82]:60660: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)210.0.90.822077456y[  -}) ossec13001h Exim Auth failed2025-04-25 00:42:22 dovecot_login authenticator failed for ([128.185.253.90]) [128.185.253.90]:55150: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)128.185.253.901269750 \ ( ( ^ o (\Ga  -' ossec13001h mExim Auth failed2025-04-25 07:20:37 dovecot_login authenticator failed for (User) [185.93.89.218]:27754: 535 Incorrect authentication data (set_id=info)185.93.89.218130758E`  -' ossec13001h Exim Auth failed2025-04-25 06:48:36 dovecot_login authenticator failed for (User) [185.93.89.218]:11922: 535 Incorrect authentication data (set_id=hr)185.93.89.218130758l_  -c) ossec13001h Exim Auth failed2025-04-25 06:42:33 dovecot_login authenticator failed for (customer.chcoilx1.pop.starlinkisp.net) [129.222.28.111]:17617: 535 Incorrect authentication data (set_id=sales)129.222.28.1116252001j^  -_) ossec13001h cExim Auth failed2025-04-25 06:42:03 dovecot_login authenticator failed for ([175.156.226.36]) [175.156.226.36]:51504: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)175.156.226.361880251k]  -c' ossec13001h Exim Auth failed2025-04-25 06:31:49 dovecot_login authenticator failed for dynamic-186-30-57-201.dynamic.etb.net.co [186.30.57.201]:52850: 535 Incorrect authentication data (set_id=sales)186.30.57.2013686110\  - ) ossec13001h Exim Auth failed2025-04-25 06:31:38 dovecot_login authenticator failed for (106.107.173.49.adsl.dynamic.seed.net.tw) [106.107.173.49]:47137: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)106.107.173.491668284g[  -]% ossec13001h ݪExim Auth failed2025-04-25 06:26:10 dovecot_login authenticator failed for ([103.7.183.17]) [103.7.183.17]:58555: 535 Incorrect authentication data (set_id=services@heipowersystem.com)103.7.183.171269750kZ  -c' ossec13001h ݶExim Auth failed2025-04-25 06:26:21 dovecot_login authenticator failed for (103-48-161-42.Dhaka.carnival.com.bd) [103.48.161.42]:49967: 535 Incorrect authentication data (set_id=services)103.48.161.421210997cY  -S' ossec13001h ܸExim Auth failed2025-04-25 06:22:08 dovecot_login authenticator failed for ([95.221.179.61]) [95.221.179.61]:36486: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)95.221.179.612017370X  -' ossec13001h ܮExim Auth failed2025-04-25 06:21:57 dovecot_login authenticator failed for 82-65-140-218.subs.proxad.net [82.65.140.218]:33608: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)82.65.140.2183017382WW  -9) ossec13001h fExim Auth failed2025-04-25 06:20:45 dovecot_login authenticator failed for ([87.226.205.113]) [87.226.205.113]:38334: 535 Incorrect authentication data (set_id=sales)87.226.205.1132017370jV  -_) ossec13001h VExim Auth failed2025-04-25 06:20:29 dovecot_login authenticator failed for ([175.207.243.95]) [175.207.243.95]:45401: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)175.207.243.951835841EU  -' ossec13001h lExim Auth failed2025-04-25 06:16:34 dovecot_login authenticator failed for (User) [185.93.89.218]:56790: 535 Incorrect authentication data (set_id=hp)185.93.89.218130758{T  -) ossec13001h ؛Exim Auth failed2025-04-25 06:04:34 dovecot_login authenticator failed for 105.217.146.34.bc.googleusercontent.com [34.146.217.105]:58638: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)34.146.217.1051861060]S  -K# ossec13001h ؙExim Auth failed2025-04-25 06:04:33 dovecot_login authenticator failed for ([101.13.5.37]) [101.13.5.37]:42348: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)101.13.5.371668284R  -' ossec13001h Exim Auth failed2025-04-25 06:04:06 dovecot_login authenticator failed for c-85-225-19-144.bbcust.telenor.se [85.225.19.144]:57325: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)85.225.19.1442661886fQ  -W) ossec13001h +Exim Auth failed2025-04-25 06:02:42 dovecot_login authenticator failed for (173-16-158-176.client.mchsi.com) [173.16.158.176]:58308: 535 Incorrect authentication data (set_id=sales)173.16.158.1766252001 / ? = < O ~o)/u}  -u) ossec13001h Exim Auth failed2025-04-25 02:47:59 dovecot_login authenticator failed for ([27.128.162.146]) [27.128.162.146]:47408: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)27.128.162.1461814991I|  -!' ossec13001h Exim Auth failed2025-04-25 02:31:58 dovecot_login authenticator failed for (User) [185.93.89.218]:3682: 535 Incorrect authentication data (set_id=contact)185.93.89.218130758{  W' ossec9708h mDovecot Aborted Login with empty userApr 25 02:21:55 vm1 dovecot[3163698]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 7 secs): user=<>, rip=87.236.176.85, lip=103.74.54.108, TLS, session=87.236.176.852635167&z 3Q' ossec11301h ^New FTP connection.Apr 25 02:13:08 vm1 pure-ftpd[3194666]: (?@139.162.3.141) [INFO] New connection from 139.162.3.141139.162.3.1411880251&y 3Q' ossec11301h 8New FTP connection.Apr 25 02:12:31 vm1 pure-ftpd[3194509]: (?@139.162.3.141) [INFO] New connection from 139.162.3.141139.162.3.1411880251%x  3Q' ossec11301h New FTP connection.Apr 25 02:10:53 vm1 pure-ftpd[3194220]: (?@139.162.3.141) [INFO] New connection from 139.162.3.141139.162.3.1411880251Vw  -9) ossec13001h Exim Auth failed2025-04-25 02:10:27 dovecot_login authenticator failed for ([94.204.208.189]) [94.204.208.189]:43396: 535 Incorrect authentication data (set_id=sales)94.204.208.189290557mv  -c+ ossec13001h Exim Auth failed2025-04-25 02:10:15 dovecot_login authenticator failed for ([222.236.155.146]) [222.236.155.146]:35950: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)222.236.155.1461835841%u  3Q' ossec11301h JNew FTP connection.Apr 25 02:08:31 vm1 pure-ftpd[3193676]: (?@139.162.3.141) [INFO] New connection from 139.162.3.141139.162.3.1411880251t  - + ossec13001h Exim Auth failed2025-04-25 02:06:23 dovecot_login authenticator failed for (abts-north-static-194.142.160.122.airtelbroadband.in) [122.160.142.194]:55796: 535 Incorrect authentication data (set_id=services)122.160.142.1941269750ds  -Y# ossec13001h Exim Auth failed2025-04-25 02:06:12 dovecot_login authenticator failed for ([112.30.7.45]) [112.30.7.45]:43788: 535 Incorrect authentication data (set_id=services@heipowersystem.com)112.30.7.451814991Lr  -'' ossec13001h IExim Auth failed2025-04-25 02:00:01 dovecot_login authenticator failed for (User) [185.93.89.218]:12528: 535 Incorrect authentication data (set_id=comercial)185.93.89.218130758hq  -[+ ossec13001h Exim Auth failed2025-04-25 01:50:12 dovecot_login authenticator failed for ([196.188.120.225]) [196.188.120.225]:57286: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)196.188.120.225337996|p  -+ ossec13001h Exim Auth failed2025-04-25 01:50:00 dovecot_login authenticator failed for ([118.122.220.235]) [118.122.220.235]:37362: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)118.122.220.2351814991}o  -+ ossec13001h Exim Auth failed2025-04-25 01:48:33 dovecot_login authenticator failed for (192.102.156.175.unknown.m1.com.sg) [175.156.102.192]:48175: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)175.156.102.1921880251Rn  -5' ossec13001h Exim Auth failed2025-04-25 01:48:46 dovecot_login authenticator failed for ([65.20.136.183]) [65.20.136.183]:45489: 535 Incorrect authentication data (set_id=sales)65.20.136.18399237_m  -K' ossec13001h Exim Auth failed2025-04-25 01:40:36 dovecot_login authenticator failed for ([183.96.57.241]) [183.96.57.241]:50266: 535 Incorrect authentication data (set_id=vikas.khandelwal)183.96.57.2411835841l  -' ossec13001h Exim Auth failed2025-04-25 01:40:23 dovecot_login authenticator failed for 57-45-246-103.southernonline.net [103.246.45.57]:46802: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)103.246.45.571269750 % L ? Z c   -?' ossec13001h Exim Auth failed2025-04-25 03:18:16 dovecot_login authenticator failed for (47-206-63-169.e8235131806a02dcb1fe9c7a57eaaeb8.ip.frontiernet.net) [47.206.63.169]:45132: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)47.206.63.1696252001z  -}+ ossec13001h Exim Auth failed2025-04-25 03:18:01 dovecot_login authenticator failed for (165-220-130-160.cust.exede.net) [165.220.130.160]:52648: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)165.220.130.1602510769j  -_) ossec13001h aExim Auth failed2025-04-25 03:17:13 dovecot_login authenticator failed for ([218.22.237.108]) [218.22.237.108]:51043: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)218.22.237.1081814991g  -[' ossec13001h PExim Auth failed2025-04-25 03:16:55 dovecot_login authenticator failed for ([110.14.192.20]) [110.14.192.20]:44998: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)110.14.192.201835841o  -g+ ossec13001h Exim Auth failed2025-04-25 03:14:05 dovecot_login authenticator failed for mobile-166-130-176-136.mycingular.net [166.130.176.136]:33819: 535 Incorrect authentication data (set_id=services)166.130.176.1366252001  -) ossec13001h Exim Auth failed2025-04-25 03:13:47 dovecot_login authenticator failed for (nsg-corporate-78.246.187.122.airtel.in) [122.187.246.78]:36846: 535 Incorrect authentication data (set_id=services@heipowersystem.com)122.187.246.781269750b  -O) ossec13001h !Exim Auth failed2025-04-25 03:11:53 dovecot_login authenticator failed for ([103.97.213.151]) [103.97.213.151]:55901: 535 Incorrect authentication data (set_id=vikas.khandelwal)103.97.213.1511269750u  -u) ossec13001h Exim Auth failed2025-04-25 03:11:41 dovecot_login authenticator failed for ([219.251.253.62]) [219.251.253.62]:60201: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)219.251.253.621835841H  -' ossec13001h EExim Auth failed2025-04-25 03:03:57 dovecot_login authenticator failed for (User) [185.93.89.218]:3002: 535 Incorrect authentication data (set_id=copier)185.93.89.218130758_  -K' ossec13001h Exim Auth failed2025-04-25 03:00:56 dovecot_login authenticator failed for ([1.235.192.131]) [1.235.192.131]:41598: 535 Incorrect authentication data (set_id=vikas.khandelwal)1.235.192.1311835841r  -q' ossec13001h Exim Auth failed2025-04-25 03:00:44 dovecot_login authenticator failed for ([95.165.146.62]) [95.165.146.62]:55148: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)95.165.146.622017370`  -O% ossec13001h Exim Auth failed2025-04-25 02:58:03 dovecot_login authenticator failed for ([221.210.9.88]) [221.210.9.82]:34314: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)221.210.9.821814991  -' ossec13001h Exim Auth failed2025-04-25 02:57:46 dovecot_login authenticator failed for (95-165-68-172.dynamic.spd-mgts.ru) [95.165.68.172]:49508: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)95.165.68.1722017370T  -5' ossec13001h Exim Auth failed2025-04-25 02:56:24 dovecot_login authenticator failed for ([101.168.26.97]) [101.168.26.97]:41352: 535 Incorrect authentication data (set_id=sales)101.168.26.972077456s  -u% ossec13001h nExim Auth failed2025-04-25 02:56:05 dovecot_login authenticator failed for 111-70-19-63.emome-ip.hinet.net [111.70.19.63]:44822: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)111.70.19.631668284^~  -I' ossec13001h Exim Auth failed2025-04-25 02:48:30 dovecot_login authenticator failed for (static.vnpt.vn) [14.226.64.124]:49106: 535 Incorrect authentication data (set_id=vikas.khandelwal)14.226.64.1241562822 # J R m &'K_g~  - ' ossec13001h Exim Auth failed2025-04-25 03:56:17 dovecot_login authenticator failed for a89-153-62-100.cpe.netcabo.pt [89.153.62.100]:49196: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)89.153.62.1002264397h  -Y+ ossec13001h Exim Auth failed2025-04-25 03:52:45 dovecot_login authenticator failed for d142-179-145-166.abhsia.telus.net [142.179.145.166]:40156: 535 Incorrect authentication data (set_id=sales)142.179.145.1666251999n  -k% ossec13001h Exim Auth failed2025-04-25 03:52:35 dovecot_login authenticator failed for 181sdl30m44.codetel.net.do [66.98.79.181]:42732: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)66.98.79.1813508796Z  -=+ ossec13001h Exim Auth failed2025-04-25 03:52:30 dovecot_login authenticator failed for ([165.154.202.101]) [165.154.202.101]:55718: 535 Incorrect authentication data (set_id=sales)165.154.202.1016252001s  -u% ossec13001h Exim Auth failed2025-04-25 03:52:24 dovecot_login authenticator failed for 111-70-19-64.emome-ip.hinet.net [111.70.19.64]:49947: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)111.70.19.641668284g  -[' ossec13001h Exim Auth failed2025-04-25 03:52:11 dovecot_login authenticator failed for ([1.235.192.130]) [1.235.192.130]:34652: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)1.235.192.1301835841W  -;' ossec13001h Exim Auth failed2025-04-25 03:48:48 dovecot_login authenticator failed for ([61.169.31.242]) [61.169.31.242]:58230: 535 Incorrect authentication data (set_id=purchase)61.169.31.2421814991z  -) ossec13001h Exim Auth failed2025-04-25 03:48:32 dovecot_login authenticator failed for (197-255-202-18.netpagedns.net) [197.255.202.18]:38410: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)197.255.202.182413451Z  -?) ossec13001h Exim Auth failed2025-04-25 03:45:31 dovecot_login authenticator failed for ([118.142.14.250]) [118.142.14.250]:54951: 535 Incorrect authentication data (set_id=services)118.142.14.2501819730l  -e) ossec13001h Exim Auth failed2025-04-25 03:45:21 dovecot_login authenticator failed for ([130.185.96.126]) [130.185.96.126]:54117: 535 Incorrect authentication data (set_id=services@heipowersystem.com)130.185.96.126294640H  -' ossec13001h Exim Auth failed2025-04-25 03:36:01 dovecot_login authenticator failed for (User) [185.93.89.218]:20788: 535 Incorrect authentication data (set_id=david)185.93.89.218130758%  3Q' ossec11301h New FTP connection.Apr 25 03:23:30 vm1 pure-ftpd[3210117]: (?@88.214.25.122) [INFO] New connection from 88.214.25.12288.214.25.1222921044`  -O% ossec13001h Exim Auth failed2025-04-25 03:19:27 dovecot_login authenticator failed for ([211.44.80.88]) [211.44.80.88]:60978: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)211.44.80.881835841s  -u% ossec13001h Exim Auth failed2025-04-25 03:18:56 dovecot_login authenticator failed for ([222.180.5.90]) [222.180.5.90]:37258: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)222.180.5.901814991T  -5' ossec13001h Exim Auth failed2025-04-25 03:18:29 dovecot_login authenticator failed for ([110.34.111.22]) [110.34.111.22]:46124: 535 Incorrect authentication data (set_id=sales)110.34.111.221835841i  -[+ ossec13001h ~Exim Auth failed2025-04-25 03:17:40 dovecot_login authenticator failed for 220-135-248-246.hinet-ip.hinet.net [220.135.248.246]:38010: 535 Incorrect authentication data (set_id=sales)220.135.248.2461668284j  -_) ossec13001h rExim Auth failed2025-04-25 03:17:29 dovecot_login authenticator failed for ([49.124.154.170]) [49.124.154.170]:35372: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)49.124.154.1701733045  /!0h c{"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-26 22:05:34 dovecot_login authenticator failed for ([218.4.205.242]) [218.4.205.242]:38242: 535 Incorrect authentication data (set_id=services)","attackers_ip":"218.4.205.242","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745685335,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-26 22:05:21 dovecot_login authenticator failed for (nl139-lv.zamnet.zm) [196.46.203.139]:47433: 535 Incorrect authentication data (set_id=services@heipowersystem.com)","attackers_ip":"196.46.203.139","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745685323,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}^6h 7{"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-26 22:00:02 dovecot_login authenticator failed for ([222.125.48.142]) [222.125.48.142]:45190: 535 Incorrect authentication data (set_id=sales)","attackers_ip":"222.125.48.142","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745685003,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}kPh {"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-26 21:59:41 dovecot_login authenticator failed for ([43.159.46.60]) [43.159.46.60]:42022: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)","attackers_ip":"43.159.46.60","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745684982,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0} $H U i  ?n_u  -K' ossec13001h %uExim Auth failed2025-04-26 23:57:00 dovecot_login authenticator failed for ([8.152.209.213]) [8.152.209.213]:56074: 535 Incorrect authentication data (set_id=vikas.khandelwal)8.152.209.2131814991ut  -u) ossec13001h %iExim Auth failed2025-04-26 23:56:49 dovecot_login authenticator failed for ([210.206.24.238]) [210.206.24.234]:62099: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)210.206.24.2341835841Gs  -' ossec13001h $AExim Auth failed2025-04-26 23:51:52 dovecot_login authenticator failed for (User) [185.93.89.218]:36684: 535 Incorrect authentication data (set_id=scan)185.93.89.218130758(r  3U) ossec11301h #QNew FTP connection.Apr 26 23:47:52 vm1 pure-ftpd[3862232]: (?@199.45.154.141) [INFO] New connection from 199.45.154.141199.45.154.1416252001(q  3U) ossec11301h New FTP connection.Apr 26 23:36:06 vm1 pure-ftpd[3859736]: (?@45.227.254.152) [INFO] New connection from 45.227.254.15245.227.254.1523703430Hp  -' ossec13001h Exim Auth failed2025-04-26 23:18:58 dovecot_login authenticator failed for (User) [185.93.89.218]:21618: 535 Incorrect authentication data (set_id=sales)185.93.89.218130758%o  3Q' ossec11301h DNew FTP connection.Apr 26 23:00:43 vm1 pure-ftpd[3851779]: (?@20.64.105.149) [INFO] New connection from 20.64.105.14920.64.105.1496252001Fn  -' ossec13001h Exim Auth failed2025-04-26 22:46:07 dovecot_login authenticator failed for (User) [185.93.89.218]:3026: 535 Incorrect authentication data (set_id=root)185.93.89.218130758m  ;) ossec13008h &Mail Recipient rejected2025-04-26 22:21:49 H=(localhost.localdomain) [78.153.140.207]:54210 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no F= rejected RCPT : Sender verify failed78.153.140.2072635167Jl  -#' ossec13001h %Exim Auth failed2025-04-26 22:13:17 dovecot_login authenticator failed for (User) [185.93.89.218]:27732: 535 Incorrect authentication data (set_id=recruit)185.93.89.218130758k  3I# ossec11301h New FTP connection.Apr 26 22:11:58 vm1 pure-ftpd[3839492]: (?@65.49.20.67) [INFO] New connection from 65.49.20.6765.49.20.676252001Sj  -5' ossec13001h Exim Auth failed2025-04-26 22:07:12 dovecot_login authenticator failed for ([185.199.98.51]) [185.199.98.51]:37685: 535 Incorrect authentication data (set_id=sales)185.199.98.51690791gi  -[' ossec13001h Exim Auth failed2025-04-26 22:07:03 dovecot_login authenticator failed for ([222.100.159.2]) [222.100.159.2]:39340: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)222.100.159.21835841nh  -i) ossec13001h KExim Auth failed2025-04-26 22:05:21 dovecot_login authenticator failed for (nl139-lv.zamnet.zm) [196.46.203.139]:47433: 535 Incorrect authentication data (set_id=services@heipowersystem.com)196.46.203.139895949Wg  -;' ossec13001h WExim Auth failed2025-04-26 22:05:34 dovecot_login authenticator failed for ([218.4.205.242]) [218.4.205.242]:38242: 535 Incorrect authentication data (set_id=services)218.4.205.2421814991Wf  -9) ossec13001h Exim Auth failed2025-04-26 22:00:02 dovecot_login authenticator failed for ([222.125.48.142]) [222.125.48.142]:45190: 535 Incorrect authentication data (set_id=sales)222.125.48.1421814991  O/$Xh {"content":[{"rule":"11301","retries":1,"severity":3,"name":"New FTP connection.","message":"Apr 26 21:15:09 vm1 pure-ftpd[3811724]: (?@198.235.24.232) [INFO] New connection from 198.235.24.232","attackers_ip":"198.235.24.232","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745682310,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0} y#h {"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-26 22:07:03 dovecot_login authenticator failed for ([222.100.159.2]) [222.100.159.2]:39340: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)","attackers_ip":"222.100.159.2","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745685423,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-26 22:07:12 dovecot_login authenticator failed for ([185.199.98.51]) [185.199.98.51]:37685: 535 Incorrect authentication data (set_id=sales)","attackers_ip":"185.199.98.51","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745685433,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}&'Fh {"content":[{"rule":"11301","retries":1,"severity":3,"name":"New FTP connection.","message":"Apr 26 22:11:58 vm1 pure-ftpd[3839492]: (?@65.49.20.67) [INFO] New connection from 65.49.20.67","attackers_ip":"65.49.20.67","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745685719,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0} 5 0Zh {"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 04:06:10 dovecot_login authenticator failed for ([220.77.182.169]) [220.77.182.169]:51204: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)","attackers_ip":"220.77.182.169","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745534170,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 04:05:51 dovecot_login authenticator failed for visaustralia.com [216.70.104.41]:48100: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)","attackers_ip":"216.70.104.41","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745534152,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0} 2h {"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 04:04:29 dovecot_login authenticator failed for ([125.72.92.174]) [125.72.92.174]:45923: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)","attackers_ip":"125.72.92.174","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745534070,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 04:04:52 dovecot_login authenticator failed for 111-70-9-143.emome-ip.hinet.net [111.70.9.143]:48350: 535 Incorrect authentication data (set_id=sales)","attackers_ip":"111.70.9.143","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745534092,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}zMh `{"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 04:08:10 dovecot_login authenticator failed for (User) [185.93.89.218]:55608: 535 Incorrect authentication data (set_id=db)","attackers_ip":"185.93.89.218","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745534291,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0} k U q\h ^{"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 05:07:53 dovecot_login authenticator failed for ([182.42.113.10]) [182.42.113.10]:48814: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)","attackers_ip":"182.42.113.10","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745537874,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}2^h {"content":[{"rule":"11301","retries":1,"severity":3,"name":"New FTP connection.","message":"Apr 25 05:10:44 vm1 pure-ftpd[3234254]: (?@185.247.137.206) [INFO] New connection from 185.247.137.206","attackers_ip":"185.247.137.206","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745538046,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}'Hh ˚{"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 05:08:04 dovecot_login authenticator failed for (122.11.169-7.unknown.starhub.net.sg) [122.11.169.7]:1918: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)","attackers_ip":"122.11.169.7","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745537886,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 05:08:21 dovecot_login authenticator failed for ([117.156.80.55]) [117.156.80.55]:33006: 535 Incorrect authentication data (set_id=purchase)","attackers_ip":"117.156.80.55","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745537902,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}  " C F #  ,AUhaP  -S# ossec13001h Exim Auth failed2025-04-25 06:02:27 dovecot_login authenticator failed for ([101.13.5.27]) [101.13.5.27]:35116: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)101.13.5.271668284oO  -m% ossec13001h ։Exim Auth failed2025-04-25 05:55:44 dovecot_login authenticator failed for ([211.48.60.35]) [211.48.60.35]:55626: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)211.48.60.351835841HN  -' ossec13001h Exim Auth failed2025-04-25 05:44:25 dovecot_login authenticator failed for (User) [185.93.89.218]:62286: 535 Incorrect authentication data (set_id=guest)185.93.89.218130758bM  -Q' ossec13001h хExim Auth failed2025-04-25 05:34:21 dovecot_login authenticator failed for (adsl-181-129-31-42.une.net.co) [181.129.31.42]:34955: 535 Incorrect authentication data (set_id=sales)181.129.31.423686110hL  -]' ossec13001h wExim Auth failed2025-04-25 05:34:07 dovecot_login authenticator failed for ([218.106.120.18]) [58.49.113.138]:14680: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)58.49.113.1381814991VK  -9) ossec13001h oExim Auth failed2025-04-25 05:29:42 dovecot_login authenticator failed for ([130.185.101.86]) [130.185.101.86]:54215: 535 Incorrect authentication data (set_id=sales)130.185.101.86294640hJ  -[) ossec13001h eExim Auth failed2025-04-25 05:29:32 dovecot_login authenticator failed for 81-224-104-199-no600.tbcn.telia.com [81.224.104.199]:40803: 535 Incorrect authentication data (set_id=sales)81.224.104.1992661886gI  -[' ossec13001h YExim Auth failed2025-04-25 05:29:20 dovecot_login authenticator failed for ([123.209.88.99]) [123.209.88.99]:38764: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)123.209.88.992077456fH  -Y' ossec13001h Exim Auth failed2025-04-25 05:27:23 dovecot_login authenticator failed for 125-229-56-26.hinet-ip.hinet.net [125.229.56.26]:48078: 535 Incorrect authentication data (set_id=services)125.229.56.261668284gG  -]% ossec13001h Exim Auth failed2025-04-25 05:27:08 dovecot_login authenticator failed for ([73.83.138.64]) [73.83.138.64]:46764: 535 Incorrect authentication data (set_id=services@heipowersystem.com)73.83.138.646252001F  -' ossec13001h Exim Auth failed2025-04-25 05:26:58 dovecot_login authenticator failed for (70-91-135-181-ma-ne.hfc.comcastbusiness.net) [70.91.135.181]:51510: 535 Incorrect authentication data (set_id=services@heipowersystem.com)70.91.135.1816252001E  W!) ossec9708h cDovecot Aborted Login with empty userApr 25 05:25:14 vm1 dovecot[3163698]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=185.247.137.91, lip=103.74.54.108, TLS, session=185.247.137.91298795xD  -y+ ossec13001h fExim Auth failed2025-04-25 05:16:46 dovecot_login authenticator failed for (hn.kd.ny.adsl) [222.139.245.137]:39517: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)222.139.245.1371814991ZC  -=+ ossec13001h @Exim Auth failed2025-04-25 05:16:07 dovecot_login authenticator failed for ([103.231.163.154]) [103.231.163.154]:45542: 535 Incorrect authentication data (set_id=sales)103.231.163.1541210997dB  -W% ossec13001h 6Exim Auth failed2025-04-25 05:15:57 dovecot_login authenticator failed for ([103.91.177.2]) [103.91.177.2]:57928: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)103.91.177.21814991pA  -i+ ossec13001h Exim Auth failed2025-04-25 05:14:19 dovecot_login authenticator failed for (448990.cloudwaysapps.com) [128.199.118.234]:53192: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)128.199.118.2341880251  ' Hh z{"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 05:16:07 dovecot_login authenticator failed for ([103.231.163.154]) [103.231.163.154]:45542: 535 Incorrect authentication data (set_id=sales)","attackers_ip":"103.231.163.154","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745538368,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 05:16:46 dovecot_login authenticator failed for (hn.kd.ny.adsl) [222.139.245.137]:39517: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)","attackers_ip":"222.139.245.137","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745538406,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}kPh >{"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 05:15:57 dovecot_login authenticator failed for ([103.91.177.2]) [103.91.177.2]:57928: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)","attackers_ip":"103.91.177.2","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745538358,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0} ) S^))):&nh ϖ{"content":[{"rule":"9708","retries":1,"severity":3,"name":"Dovecot Aborted Login with empty user","message":"Apr 25 05:25:14 vm1 dovecot[3163698]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=\u003c\u003e, rip=185.247.137.91, lip=103.74.54.108, TLS, session=\u003cJ6Py8o4zR7u594lb\u003e","attackers_ip":"185.247.137.91","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745538915,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}wk$Ph {"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 04:27:07 dovecot_login authenticator failed for ([1.247.245.61]) [1.247.245.61]:38598: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)","attackers_ip":"1.247.245.61","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745535427,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0})"Lh {"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 04:26:35 dovecot_login authenticator failed for ([109.233.21.109]) [109.233.21.109]:47020: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)","attackers_ip":"109.233.21.109","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745535395,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 04:26:47 dovecot_login authenticator failed for ([157.122.198.56]) [157.122.198.56]:55297: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)","attackers_ip":"157.122.198.56","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745535407,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0} T oTT")>h {"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 05:27:08 dovecot_login authenticator failed for ([73.83.138.64]) [73.83.138.64]:46764: 535 Incorrect authentication data (set_id=services@heipowersystem.com)","attackers_ip":"73.83.138.64","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745539029,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 05:27:23 dovecot_login authenticator failed for 125-229-56-26.hinet-ip.hinet.net [125.229.56.26]:48078: 535 Incorrect authentication data (set_id=services)","attackers_ip":"125.229.56.26","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745539045,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}u 'h {"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 05:26:58 dovecot_login authenticator failed for (70-91-135-181-ma-ne.hfc.comcastbusiness.net) [70.91.135.181]:51510: 535 Incorrect authentication data (set_id=services@heipowersystem.com)","attackers_ip":"70.91.135.181","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745539019,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}  3 3I* h І{"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 05:29:20 dovecot_login authenticator failed for ([123.209.88.99]) [123.209.88.99]:38764: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)","attackers_ip":"123.209.88.99","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745539161,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 05:29:32 dovecot_login authenticator failed for 81-224-104-199-no600.tbcn.telia.com [81.224.104.199]:40803: 535 Incorrect authentication data (set_id=sales)","attackers_ip":"81.224.104.199","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745539173,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 05:29:42 dovecot_login authenticator failed for ([130.185.101.86]) [130.185.101.86]:54215: 535 Incorrect authentication data (set_id=sales)","attackers_ip":"130.185.101.86","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745539183,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}  ] <w;hh {"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 04:57:20 dovecot_login authenticator failed for ([117.198.103.116]) [117.198.103.116]:43365: 535 Incorrect authentication data (set_id=services@heipowersystem.com)","attackers_ip":"117.198.103.116","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745537241,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}v:fh ֞{"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 05:55:44 dovecot_login authenticator failed for ([211.48.60.35]) [211.48.60.35]:55626: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)","attackers_ip":"211.48.60.35","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745540745,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}P3h {"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 05:44:25 dovecot_login authenticator failed for (User) [185.93.89.218]:62286: 535 Incorrect authentication data (set_id=guest)","attackers_ip":"185.93.89.218","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745540066,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}O0h {"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 04:40:17 dovecot_login authenticator failed for (User) [185.93.89.218]:24634: 535 Incorrect authentication data (set_id=demo)","attackers_ip":"185.93.89.218","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745536218,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}.8h Ѳ{"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 05:34:07 dovecot_login authenticator failed for ([218.106.120.18]) [58.49.113.138]:14680: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)","attackers_ip":"58.49.113.138","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745539447,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 05:34:21 dovecot_login authenticator failed for (adsl-181-129-31-42.une.net.co) [181.129.31.42]:34955: 535 Incorrect authentication data (set_id=sales)","attackers_ip":"181.129.31.42","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745539461,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0} FF>2h B{"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 06:02:27 dovecot_login authenticator failed for ([101.13.5.27]) [101.13.5.27]:35116: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)","attackers_ip":"101.13.5.27","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745541147,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 06:02:42 dovecot_login authenticator failed for (173-16-158-176.client.mchsi.com) [173.16.158.176]:58308: 535 Incorrect authentication data (set_id=sales)","attackers_ip":"173.16.158.176","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745541163,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}=&h B{"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 04:58:42 dovecot_login authenticator failed for ([49.124.153.33]) [49.124.153.33]:51820: 535 Incorrect authentication data (set_id=vikas.khandelwal)","attackers_ip":"49.124.153.33","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745537323,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 04:58:50 dovecot_login authenticator failed for 81-225-238-64-no600.tbcn.telia.com [81.225.238.64]:34382: 535 Incorrect authentication data (set_id=vikas.khandelwal)","attackers_ip":"81.225.238.64","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745537331,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 04:58:09 dovecot_login authenticator failed for ([117.32.97.246]) [117.32.97.246]:59048: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)","attackers_ip":"117.32.97.246","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745537289,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 04:58:28 dovecot_login authenticator failed for mail.toptronicsinc.com [218.4.156.254]:55334: 535 Incorrect authentication data (set_id=vikas.khandelwal)","attackers_ip":"218.4.156.254","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745537309,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0} fII ,h {"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 10:08:12 dovecot_login authenticator failed for (136-62-72-219.googlefiber.net) [136.62.72.219]:37126: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)","attackers_ip":"136.62.72.219","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745555893,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 10:08:30 dovecot_login authenticator failed for ([185.43.10.11]) [185.43.10.11]:51618: 535 Incorrect authentication data (set_id=sales)","attackers_ip":"185.43.10.11","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745555911,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 10:08:56 dovecot_login authenticator failed for (ip-199-1-248-87.eidsiva.net) [87.248.1.199]:41611: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)","attackers_ip":"87.248.1.199","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745555937,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 10:09:04 dovecot_login authenticator failed for vps-926fddc5.vps.ovh.net [79.137.82.102]:58152: 535 Incorrect authentication data (set_id=vikas.khandelwal)","attackers_ip":"79.137.82.102","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745555945,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}t">h ({"content":[{"rule":"11301","retries":1,"severity":3,"name":"New FTP connection.","message":"Apr 25 10:09:40 vm1 pure-ftpd[3300202]: (?@138.68.99.122) [INFO] New connection from 138.68.99.122","attackers_ip":"138.68.99.122","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745555981,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"11301","retries":1,"severity":3,"name":"New FTP connection.","message":"Apr 25 10:09:40 vm1 pure-ftpd[3300200]: (?@134.122.80.154) [INFO] New connection from 134.122.80.154","attackers_ip":"134.122.80.154","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745555981,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}   5 < N Tryrq  -u% ossec13001h Exim Auth failed2025-04-25 07:42:41 dovecot_login authenticator failed for ([85.122.56.15]) [85.122.56.15]:41071: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)85.122.56.15798549cp  -S' ossec13001h Exim Auth failed2025-04-25 07:40:00 dovecot_login authenticator failed for h014-014-160-190.gd.netyou.jp [14.14.160.190]:44166: 535 Incorrect authentication data (set_id=purchase)14.14.160.1901861060mo  -e) ossec13001h Exim Auth failed2025-04-25 07:39:49 dovecot_login authenticator failed for ([120.29.140.140]) [120.29.140.140]:49147: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)120.29.140.1401835841Wn  -9) ossec13001h Exim Auth failed2025-04-25 07:39:41 dovecot_login authenticator failed for ([180.72.149.185]) [180.72.149.185]:37574: 535 Incorrect authentication data (set_id=sales)180.72.149.1851733045um  -w' ossec13001h Exim Auth failed2025-04-25 07:39:25 dovecot_login authenticator failed for (l5-129-134-103.novotelecom.ru) [5.129.134.103]:43116: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)5.129.134.1032017370Yl  -C# ossec13001h 4Exim Auth failed2025-04-25 07:32:28 dovecot_login authenticator failed for ([58.18.64.54]) [58.18.64.54]:50776: 535 Incorrect authentication data (set_id=vikas.khandelwal)58.18.64.541814991uk  -u) ossec13001h &Exim Auth failed2025-04-25 07:32:14 dovecot_login authenticator failed for ([50.217.255.171]) [50.217.255.171]:37153: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)50.217.255.1716252001tj  -u' ossec13001h Exim Auth failed2025-04-25 07:31:26 dovecot_login authenticator failed for 81-225-238-64-no600.tbcn.telia.com [81.225.238.64]:52284: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)81.225.238.642661886]i  -K# ossec13001h Exim Auth failed2025-04-25 07:31:14 dovecot_login authenticator failed for ([180.71.9.31]) [180.71.9.31]:39864: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)180.71.9.311835841uh  -u) ossec13001h Exim Auth failed2025-04-25 07:31:35 dovecot_login authenticator failed for ([175.116.66.199]) [175.116.66.199]:35543: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)175.116.66.1991835841ig  -[+ ossec13001h Exim Auth failed2025-04-25 07:30:54 dovecot_login authenticator failed for ([220.180.171.157]) [220.180.171.157]:42711: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)220.180.171.1571814991tf  -y' ossec13001h Exim Auth failed2025-04-25 07:30:36 dovecot_login authenticator failed for ([65.20.160.228]) [65.20.160.228]:35996: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)65.20.160.22899237^e  -I' ossec13001h Exim Auth failed2025-04-25 07:26:13 dovecot_login authenticator failed for (static.vnpt.vn) [113.166.93.78]:41992: 535 Incorrect authentication data (set_id=vikas.khandelwal)113.166.93.781562822rd  -q' ossec13001h Exim Auth failed2025-04-25 07:26:03 dovecot_login authenticator failed for ([91.185.40.201]) [91.185.40.201]:33456: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)91.185.40.2012017370sc  -q) ossec13001h Exim Auth failed2025-04-25 07:21:06 dovecot_login authenticator failed for nova-185-040-122-250.cpe.novanet.is [185.40.122.250]:52229: 535 Incorrect authentication data (set_id=vikas.khandelwal)185.40.122.2502629691tb  -u) ossec13001h Exim Auth failed2025-04-25 07:20:54 dovecot_login authenticator failed for ([154.66.109.244]) [154.66.109.244]:41686: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)154.66.109.244953987 p Vp;;MHh {"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 06:48:36 dovecot_login authenticator failed for (User) [185.93.89.218]:11922: 535 Incorrect authentication data (set_id=hr)","attackers_ip":"185.93.89.218","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745543918,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}&EFh ڕ{"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 06:12:06 dovecot_login authenticator failed for ([115.247.81.134]) [115.247.81.134]:47830: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)","attackers_ip":"115.247.81.134","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745541728,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 06:12:20 dovecot_login authenticator failed for ([175.198.18.3]) [175.198.18.3]:58107: 535 Incorrect authentication data (set_id=vikas.khandelwal)","attackers_ip":"175.198.18.3","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745541742,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}  ? N x AcDYasm  -e) ossec13001h Exim Auth failed2025-04-25 08:25:23 dovecot_login authenticator failed for ([123.209.193.39]) [123.209.193.39]:41618: 535 Incorrect authentication data (set_id=services@heipowersystem.com)123.209.193.392077456H  -' ossec13001h mExim Auth failed2025-04-25 08:24:37 dovecot_login authenticator failed for (User) [185.93.89.218]:18632: 535 Incorrect authentication data (set_id=info1)185.93.89.218130758T  -7% ossec13001h Exim Auth failed2025-04-25 08:21:58 dovecot_login authenticator failed for ([43.159.46.60]) [43.159.46.60]:32794: 535 Incorrect authentication data (set_id=services)43.159.46.601880251i  -a' ossec13001h Exim Auth failed2025-04-25 08:21:48 dovecot_login authenticator failed for ([178.242.2.250]) [178.242.2.250]:41079: 535 Incorrect authentication data (set_id=services@heipowersystem.com)178.242.2.250298795s~  -u% ossec13001h Exim Auth failed2025-04-25 08:00:09 dovecot_login authenticator failed for ([103.7.183.17]) [103.7.183.17]:53200: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)103.7.183.171269750f}  -W) ossec13001h Exim Auth failed2025-04-25 08:00:19 dovecot_login authenticator failed for ([217.195.94.243]) [217.195.94.243]:54081: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)217.195.94.2432017370| ;5% ossec13008h Mail Recipient rejected2025-04-25 07:59:37 H=static-185-95-84-71.sunucuhub.com [185.95.84.71]:51250 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no F= rejected RCPT : Sender verify failed185.95.84.71298795Y{  -;+ ossec13001h LExim Auth failed2025-04-25 07:58:27 dovecot_login authenticator failed for (node12.vindb.org) [104.236.145.128]:41832: 535 Incorrect authentication data (set_id=sales)104.236.145.1286252001Qz  -1% ossec13001h :Exim Auth failed2025-04-25 07:58:09 dovecot_login authenticator failed for ([1.189.209.19]) [1.189.209.19]:48164: 535 Incorrect authentication data (set_id=sales)1.189.209.191814991dy  -W% ossec13001h .Exim Auth failed2025-04-25 07:57:56 dovecot_login authenticator failed for ([47.83.202.14]) [47.83.202.14]:56744: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)47.83.202.141819730%x  3Q' ossec11301h CNew FTP connection.Apr 25 07:54:03 vm1 pure-ftpd[3270327]: (?@206.168.34.40) [INFO] New connection from 206.168.34.40206.168.34.406252001Iw  -!' ossec13001h Exim Auth failed2025-04-25 07:52:37 dovecot_login authenticator failed for (User) [185.93.89.218]:29854: 535 Incorrect authentication data (set_id=info01)185.93.89.218130758Qv  -1% ossec13001h Exim Auth failed2025-04-25 07:51:28 dovecot_login authenticator failed for ([125.69.195.7]) [125.69.195.7]:52760: 535 Incorrect authentication data (set_id=sales)125.69.195.71814991lu  -c+ ossec13001h Exim Auth failed2025-04-25 07:51:11 dovecot_login authenticator failed for ([196.188.120.225]) [196.188.120.225]:34342: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)196.188.120.225337996Vt  -;' ossec13001h Exim Auth failed2025-04-25 07:50:55 dovecot_login authenticator failed for ([94.200.80.226]) [94.200.80.226]:43027: 535 Incorrect authentication data (set_id=purchase)94.200.80.226290557gs  -]% ossec13001h Exim Auth failed2025-04-25 07:50:46 dovecot_login authenticator failed for ([211.93.6.230]) [211.93.6.230]:53220: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)211.93.6.2301814991ur  -s+ ossec13001h Exim Auth failed2025-04-25 07:42:57 dovecot_login authenticator failed for (SCZ-181-188-149-00243.tigo.bo) [181.188.149.243]:48242: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)181.188.149.2433923057 vv@|h غ{"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 06:04:06 dovecot_login authenticator failed for c-85-225-19-144.bbcust.telenor.se [85.225.19.144]:57325: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)","attackers_ip":"85.225.19.144","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745541247,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 06:04:33 dovecot_login authenticator failed for ([101.13.5.37]) [101.13.5.37]:42348: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)","attackers_ip":"101.13.5.37","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745541273,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 06:04:34 dovecot_login authenticator failed for 105.217.146.34.bc.googleusercontent.com [34.146.217.105]:58638: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)","attackers_ip":"34.146.217.105","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745541275,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}/ <|Drh {"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 05:05:12 dovecot_login authenticator failed for ([103.174.145.35]) [103.174.145.35]:35551: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)","attackers_ip":"103.174.145.35","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745537714,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}}Bth ʪ{"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 05:04:26 dovecot_login authenticator failed for ([85.159.165.216]) [85.159.165.216]:60376: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)","attackers_ip":"85.159.165.216","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745537668,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 05:04:46 dovecot_login authenticator failed for ([61.37.150.35]) [61.37.150.6]:49401: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)","attackers_ip":"61.37.150.6","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745537688,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 05:04:58 dovecot_login authenticator failed for ([123.116.142.131]) [123.116.142.131]:47334: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)","attackers_ip":"123.116.142.131","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745537700,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}  Mh q{"content":[{"rule":"11011","retries":1,"severity":3,"name":"WHM SSO login failed","message":"[2025-04-25 06:54:25 +0530] info [whostmgrd] 106.206.168.85 PURGE root:Y3qGLnpTFwzm0Ca3 badpass [cookie ip check: IP address has changed: IP Address [106.206.152.93] != Current IP Address [106.206.168.85]]","attackers_ip":"106.206.168.85","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745544266,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"11009","retries":2,"severity":4,"name":"WHM login success","message":"[2025-04-25 06:54:42 +0530] info [whostmgrd] 106.206.168.85 NEW root:LLsQJW9SJMI8XujC address=106.206.168.85,app=whostmgrd,creator=root,method=handle_form_login,path=form,possessed=0","attackers_ip":"106.206.168.85","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745544282,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"11006","retries":1,"severity":4,"name":"cPanel login success","message":"[2025-04-25 06:54:48 +0530] info [cpaneld] 106.206.168.85 NEW techno:G_HdkCX3t1GkutyA address=106.206.168.85,app=cpaneld,creator=techno,method=handle_form_login,path=loadsession:techno:IxL22parJhhwlMiY,possessed=1,possessor=root","attackers_ip":"106.206.168.85","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745544290,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":true,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"11001","retries":2,"severity":3,"name":"Deferred login on the cpanel service","message":"[2025-04-25 06:54:08 +0530] info [cpaneld] 106.206.168.85 - techno \"GET /cpsess2319855709/3rdparty/phpMyAdmin/index.php?route=/import HTTP/1.1\" DEFERRED LOGIN cpaneld: cookie ip check: IP address has changed: IP Address [106.206.152.93] != Current IP Address [106.206.168.85]","attackers_ip":"106.206.168.85","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745544248,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}  -OTh {"content":[{"rule":"11301","retries":1,"severity":3,"name":"New FTP connection.","message":"Apr 25 06:56:29 vm1 pure-ftpd[3257985]: (?@106.206.168.85) [INFO] New connection from 106.206.168.85","attackers_ip":"106.206.168.85","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745544390,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":true,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"11309","retries":1,"severity":3,"name":"FTP Authentication success.","message":"Apr 25 06:56:29 vm1 pure-ftpd[3257985]: (?@106.206.168.85) [INFO] techno is now logged in","attackers_ip":"106.206.168.85","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745544390,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":true,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"11075","retries":1,"severity":3,"name":"FTP file manipulations","message":"Fri Apr 25 06:56:30 2025 0 106.206.168.85 119 /home/techno/public_html/alps/Db_Connect.php a _ o r techno ftp 1 * c","attackers_ip":"106.206.168.85","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":["noshow"],"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745544390,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":true,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0} N:h {"content":[{"rule":"11309","retries":1,"severity":3,"name":"FTP Authentication success.","message":"Apr 25 06:55:55 vm1 pure-ftpd[3257932]: (?@106.206.168.85) [INFO] techno is now logged in","attackers_ip":"106.206.168.85","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745544356,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":true,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"11301","retries":1,"severity":3,"name":"New FTP connection.","message":"Apr 25 06:55:55 vm1 pure-ftpd[3257932]: (?@106.206.168.85) [INFO] New connection from 106.206.168.85","attackers_ip":"106.206.168.85","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745544356,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":true,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0} rr RQh %{"content":[{"rule":"11301","retries":1,"severity":3,"name":"New FTP connection.","message":"Apr 25 06:57:57 vm1 pure-ftpd[3258272]: (?@106.206.168.85) [INFO] New connection from 106.206.168.85","attackers_ip":"106.206.168.85","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745544478,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":true,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"11309","retries":1,"severity":3,"name":"FTP Authentication success.","message":"Apr 25 06:57:57 vm1 pure-ftpd[3258272]: (?@106.206.168.85) [INFO] techno is now logged in","attackers_ip":"106.206.168.85","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745544478,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":true,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"11313","retries":1,"severity":3,"name":"FTP file uploaded to server","message":"Apr 25 06:57:58 vm1 pure-ftpd[3258272]: (techno@106.206.168.85) [NOTICE] /home/techno//public_html/alps/Db_Connect.php uploaded (92 bytes, 157.60KB/sec)","attackers_ip":"106.206.168.85","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745544480,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":true,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}MWh ۉ{"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 06:16:34 dovecot_login authenticator failed for (User) [185.93.89.218]:56790: 535 Incorrect authentication data (set_id=hp)","attackers_ip":"185.93.89.218","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745541996,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}  f [ h ܵ{"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 06:21:57 dovecot_login authenticator failed for 82-65-140-218.subs.proxad.net [82.65.140.218]:33608: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)","attackers_ip":"82.65.140.218","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745542318,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}TY&h y{"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 06:20:29 dovecot_login authenticator failed for ([175.207.243.95]) [175.207.243.95]:45401: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)","attackers_ip":"175.207.243.95","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745542230,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 06:20:45 dovecot_login authenticator failed for ([87.226.205.113]) [87.226.205.113]:38334: 535 Incorrect authentication data (set_id=sales)","attackers_ip":"87.226.205.113","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745542246,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0} ' 6  .L-BuK  -+ ossec13001h Exim Auth failed2025-04-25 08:59:33 dovecot_login authenticator failed for ([222.108.177.110]) [222.108.177.110]:33084: 535 Incorrect authentication data222.108.177.1101835841W  -9) ossec13001h Exim Auth failed2025-04-25 08:59:52 dovecot_login authenticator failed for ([180.158.100.49]) [180.158.100.49]:59416: 535 Incorrect authentication data (set_id=sales)180.158.100.491814991d  -W% ossec13001h Exim Auth failed2025-04-25 08:59:42 dovecot_login authenticator failed for ([180.94.76.14]) [180.94.76.14]:60992: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)180.94.76.141149361H  -' ossec13001h Exim Auth failed2025-04-25 08:56:33 dovecot_login authenticator failed for (User) [185.93.89.218]:59652: 535 Incorrect authentication data (set_id=info2)185.93.89.218130758f  -W) ossec13001h Exim Auth failed2025-04-25 08:39:57 dovecot_login authenticator failed for ([58.216.101.166]) [58.216.101.162]:39183: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)58.216.101.1621814991i  -[+ ossec13001h Exim Auth failed2025-04-25 08:39:26 dovecot_login authenticator failed for ([119.203.251.186]) [119.203.251.186]:45348: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)119.203.251.1861835841v  -y' ossec13001h Exim Auth failed2025-04-25 08:39:11 dovecot_login authenticator failed for ([27.40.100.131]) [27.40.100.131]:45975: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)27.40.100.13118149911 SE) ossec11000h /Login failed on the cpanel service.[2025-04-25 08:32:06 +0530] info [webmaild] 178.248.116.54 - kps@amplifypowerglobal.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)178.248.116.541269750]  -I% ossec13001h /Exim Auth failed2025-04-25 08:32:07 dovecot_login authenticator failed for (p185.224.8-47.samaralan.ru) [185.224.8.47]:50066: 535 Incorrect authentication data (set_id=sales)185.224.8.472017370a  -M) ossec13001h +Exim Auth failed2025-04-25 08:32:03 dovecot_login authenticator failed for n220246200078.netvigator.com [220.246.200.78]:38480: 535 Incorrect authentication data (set_id=sales)220.246.200.781819730f  -[' ossec13001h !Exim Auth failed2025-04-25 08:31:52 dovecot_login authenticator failed for ([94.204.78.117]) [94.204.78.117]:57884: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)94.204.78.117290557|  -' ossec13001h Exim Auth failed2025-04-25 08:31:44 dovecot_login authenticator failed for (20-172-91-219.static.youbroadband.in) [219.91.172.20]:56122: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)219.91.172.2012697501 SE) ossec11000h Login failed on the cpanel service.[2025-04-25 08:31:09 +0530] info [webmaild] 178.248.116.54 - kps@amplifypowerglobal.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)178.248.116.541269750b  -O) ossec13001h Exim Auth failed2025-04-25 08:29:49 dovecot_login authenticator failed for ([49.124.154.167]) [49.124.154.167]:46180: 535 Incorrect authentication data (set_id=vikas.khandelwal)49.124.154.1671733045  -) ossec13001h Exim Auth failed2025-04-25 08:29:29 dovecot_login authenticator failed for c-83-227-140-125.bbcust.telenor.se [83.227.140.125]:43046: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)83.227.140.1252661886T  -7% ossec13001h Exim Auth failed2025-04-25 08:25:55 dovecot_login authenticator failed for ([103.91.177.2]) [103.91.177.2]:32882: 535 Incorrect authentication data (set_id=services)103.91.177.21814991  Jn4Vh >{"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 10:35:37 dovecot_login authenticator failed for ([117.173.18.71]) [117.173.18.71]:41840: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)","attackers_ip":"117.173.18.71","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745557539,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0};3ph {"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 10:34:48 dovecot_login authenticator failed for ip72-199-156-231.sd.sd.cox.net [72.199.156.231]:53148: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)","attackers_ip":"72.199.156.231","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745557489,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 10:35:02 dovecot_login authenticator failed for (70-91-135-181-ma-ne.hfc.comcastbusiness.net) [70.91.135.181]:50652: 535 Incorrect authentication data (set_id=sales)","attackers_ip":"70.91.135.181","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745557503,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}14h $n{"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 11:27:45 dovecot_login authenticator failed for ([61.3.27.244]) [61.3.27.244]:57350: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)","attackers_ip":"61.3.27.244","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745560666,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 11:27:55 dovecot_login authenticator failed for ([64.23.239.89]) [64.23.239.89]:33976: 535 Incorrect authentication data (set_id=vikas.khandelwal)","attackers_ip":"64.23.239.89","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745560676,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}R0h {"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 10:32:40 dovecot_login authenticator failed for (User) [185.93.89.218]:62844: 535 Incorrect authentication data (set_id=manager)","attackers_ip":"185.93.89.218","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745557360,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}  (j_Nh {"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 06:22:08 dovecot_login authenticator failed for ([95.221.179.61]) [95.221.179.61]:36486: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)","attackers_ip":"95.221.179.61","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745542328,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}j^Nh M{"content":[{"rule":"11301","retries":2,"severity":3,"name":"New FTP connection.","message":"Apr 25 07:19:21 vm1 pure-ftpd[3262934]: (?@106.206.168.85) [INFO] New connection from 106.206.168.85","attackers_ip":"106.206.168.85","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745545763,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":true,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"11309","retries":2,"severity":3,"name":"FTP Authentication success.","message":"Apr 25 07:19:22 vm1 pure-ftpd[3262934]: (?@106.206.168.85) [INFO] user@saintsoldiercollege.com is now logged in","attackers_ip":"106.206.168.85","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745545763,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":true,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"11075","retries":32,"severity":3,"name":"FTP file manipulations","message":"Fri Apr 25 07:19:22 2025 0 106.206.168.85 31300 /home/techno/public_html/saintsoldiercollege.com/index.php a _ o r user@saintsoldiercollege.com ftp 1 * c","attackers_ip":"106.206.168.85","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":["noshow"],"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745545763,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":true,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}6]fh {"content":[{"rule":"11309","retries":1,"severity":3,"name":"FTP Authentication success.","message":"Apr 25 07:18:40 vm1 pure-ftpd[3262819]: (?@106.206.168.85) [INFO] user@saintsoldiercollege.com is now logged in","attackers_ip":"106.206.168.85","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745545721,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":true,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"11301","retries":1,"severity":3,"name":"New FTP connection.","message":"Apr 25 07:18:40 vm1 pure-ftpd[3262819]: (?@106.206.168.85) [INFO] New connection from 106.206.168.85","attackers_ip":"106.206.168.85","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745545721,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":true,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}0  jzanh {"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 07:21:06 dovecot_login authenticator failed for nova-185-040-122-250.cpe.novanet.is [185.40.122.250]:52229: 535 Incorrect authentication data (set_id=vikas.khandelwal)","attackers_ip":"185.40.122.250","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745545868,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}`h {"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 07:20:37 dovecot_login authenticator failed for (User) [185.93.89.218]:27754: 535 Incorrect authentication data (set_id=info)","attackers_ip":"185.93.89.218","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745545837,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 07:20:54 dovecot_login authenticator failed for ([154.66.109.244]) [154.66.109.244]:41686: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)","attackers_ip":"154.66.109.244","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745545856,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0} k efDh {"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 07:26:13 dovecot_login authenticator failed for (static.vnpt.vn) [113.166.93.78]:41992: 535 Incorrect authentication data (set_id=vikas.khandelwal)","attackers_ip":"113.166.93.78","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745546174,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}!ydlh {"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 07:26:03 dovecot_login authenticator failed for ([91.185.40.201]) [91.185.40.201]:33456: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)","attackers_ip":"91.185.40.201","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745546164,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}sc`h ݥ{"content":[{"rule":"11006","retries":1,"severity":4,"name":"cPanel login success","message":"[2025-04-25 06:25:25 +0530] info [cpaneld] 106.206.152.93 NEW techno:v0Xoko2W4P0dOExs address=106.206.152.93,app=cpaneld,creator=techno,method=handle_form_login,path=loadsession:techno:EGi87N2llLvjhw3l,possessed=1,possessor=root","attackers_ip":"106.206.152.93","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745542526,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"11009","retries":1,"severity":4,"name":"WHM login success","message":"[2025-04-25 06:25:25 +0530] info [whostmgrd] 106.206.152.93 NEW techno:EGi87N2llLvjhw3l address=106.206.152.93,app=cpaneld,creator=root,method=handle_auth_transfer,path=xfercpanel","attackers_ip":"106.206.152.93","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745542526,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}  U4ibh {"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 07:30:36 dovecot_login authenticator failed for ([65.20.160.228]) [65.20.160.228]:35996: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)","attackers_ip":"65.20.160.228","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745546436,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 07:30:54 dovecot_login authenticator failed for ([220.180.171.157]) [220.180.171.157]:42711: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)","attackers_ip":"220.180.171.157","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745546454,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}'gHh {"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 06:26:21 dovecot_login authenticator failed for (103-48-161-42.Dhaka.carnival.com.bd) [103.48.161.42]:49967: 535 Incorrect authentication data (set_id=services)","attackers_ip":"103.48.161.42","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745542582,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 06:26:10 dovecot_login authenticator failed for ([103.7.183.17]) [103.7.183.17]:58555: 535 Incorrect authentication data (set_id=services@heipowersystem.com)","attackers_ip":"103.7.183.17","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745542570,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}  #l@h Y{"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 07:32:14 dovecot_login authenticator failed for ([50.217.255.171]) [50.217.255.171]:37153: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)","attackers_ip":"50.217.255.171","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745546534,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 07:32:28 dovecot_login authenticator failed for ([58.18.64.54]) [58.18.64.54]:50776: 535 Incorrect authentication data (set_id=vikas.khandelwal)","attackers_ip":"58.18.64.54","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745546548,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}wijLh {"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 07:31:35 dovecot_login authenticator failed for ([175.116.66.199]) [175.116.66.199]:35543: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)","attackers_ip":"175.116.66.199","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745546496,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 07:31:14 dovecot_login authenticator failed for ([180.71.9.31]) [180.71.9.31]:39864: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)","attackers_ip":"180.71.9.31","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745546474,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 07:31:26 dovecot_login authenticator failed for 81-225-238-64-no600.tbcn.telia.com [81.225.238.64]:52284: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)","attackers_ip":"81.225.238.64","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745546486,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0} * ;*& ph {"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 07:39:25 dovecot_login authenticator failed for (l5-129-134-103.novotelecom.ru) [5.129.134.103]:43116: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)","attackers_ip":"5.129.134.103","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745546966,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 07:39:41 dovecot_login authenticator failed for ([180.72.149.185]) [180.72.149.185]:37574: 535 Incorrect authentication data (set_id=sales)","attackers_ip":"180.72.149.185","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745546982,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 07:39:49 dovecot_login authenticator failed for ([120.29.140.140]) [120.29.140.140]:49147: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)","attackers_ip":"120.29.140.140","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745546990,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 07:40:00 dovecot_login authenticator failed for h014-014-160-190.gd.netyou.jp [14.14.160.190]:44166: 535 Incorrect authentication data (set_id=purchase)","attackers_ip":"14.14.160.190","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745547000,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}Am|h {"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 06:31:38 dovecot_login authenticator failed for (106.107.173.49.adsl.dynamic.seed.net.tw) [106.107.173.49]:47137: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)","attackers_ip":"106.107.173.49","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745542899,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 06:31:49 dovecot_login authenticator failed for dynamic-186-30-57-201.dynamic.etb.net.co [186.30.57.201]:52850: 535 Incorrect authentication data (set_id=sales)","attackers_ip":"186.30.57.201","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745542911,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0} 4)b  O Zi4\F  -G% ossec13001h $dExim Auth failed2025-04-25 11:27:55 dovecot_login authenticator failed for ([64.23.239.89]) [64.23.239.89]:33976: 535 Incorrect authentication data (set_id=vikas.khandelwal)64.23.239.896252001lE  -i# ossec13001h $ZExim Auth failed2025-04-25 11:27:45 dovecot_login authenticator failed for ([61.3.27.244]) [61.3.27.244]:57350: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)61.3.27.2441269750vD  -w) ossec13001h !Exim Auth failed2025-04-25 11:17:18 dovecot_login authenticator failed for 110-25-101-237.adsl.fetnet.net [110.25.101.237]:40664: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)110.25.101.2371668284{C  -% ossec13001h !Exim Auth failed2025-04-25 11:17:09 dovecot_login authenticator failed for syn-137-027-032-070.biz.spectrum.com [137.27.32.70]:47722: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)137.27.32.706252001QB  -3# ossec13001h !Exim Auth failed2025-04-25 11:17:41 dovecot_login authenticator failed for ([27.71.26.64]) [27.71.26.64]:16190: 535 Incorrect authentication data (set_id=purchase)27.71.26.641562822`A  -I+ ossec13001h !Exim Auth failed2025-04-25 11:17:32 dovecot_login authenticator failed for (visaotur.sdr.gvt.net.br) [186.215.245.175]:45935: 535 Incorrect authentication data (set_id=sales)186.215.245.1753469034Z@  -?) ossec13001h Exim Auth failed2025-04-25 11:08:13 dovecot_login authenticator failed for ([118.36.234.156]) [118.36.234.156]:36824: 535 Incorrect authentication data (set_id=purchase)118.36.234.1561835841x?  -% ossec13001h Exim Auth failed2025-04-25 11:08:00 dovecot_login authenticator failed for (host-64-72-74-162.lightower.net) [64.72.74.162]:49032: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)64.72.74.1626252001L>  -'' ossec13001h Exim Auth failed2025-04-25 11:04:42 dovecot_login authenticator failed for (User) [185.93.89.218]:23484: 535 Incorrect authentication data (set_id=marketing)185.93.89.218130758l=  -c) ossec13001h 4Exim Auth failed2025-04-25 11:01:31 dovecot_login authenticator failed for 122-150-44-146.sta.wbroadband.net.au [122.150.44.146]:40053: 535 Incorrect authentication data (set_id=purchase)122.150.44.1462077456p<  -i+ ossec13001h &Exim Auth failed2025-04-25 11:01:18 dovecot_login authenticator failed for ([125.140.244.144]) [125.140.244.144]:43352: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)125.140.244.1441835841C; gU) ossec11307h Multiple connection attempts from same sourceApr 25 10:56:15 vm1 pure-ftpd[3310893]: (?@62.171.161.160) [INFO] New connection from 62.171.161.16062.171.161.1603017382): 3U) ossec11301h New FTP connection.Apr 25 10:56:07 vm1 pure-ftpd[3310850]: (?@62.171.161.160) [INFO] New connection from 62.171.161.16062.171.161.1603017382i9  -[+ ossec13001h  Exim Auth failed2025-04-25 10:56:54 dovecot_login authenticator failed for ([221.224.159.220]) [221.224.159.218]:56412: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)221.224.159.2181814991|8  -' ossec13001h  Exim Auth failed2025-04-25 10:56:34 dovecot_login authenticator failed for vps-e8345fbe.vps.ovh.ca [51.222.141.10]:48218: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)51.222.141.106251999)7 3U) ossec11301h  New FTP connection.Apr 25 10:55:51 vm1 pure-ftpd[3310741]: (?@62.171.161.160) [INFO] New connection from 62.171.161.16062.171.161.1603017382B6  gU) ossec11307h Multiple connection attempts from same sourceApr 25 10:56:00 vm1 pure-ftpd[3310816]: (?@62.171.161.160) [INFO] New connection from 62.171.161.16062.171.161.1603017382R5  -5' ossec13001h |Exim Auth failed2025-04-25 10:54:11 dovecot_login authenticator failed for ([65.20.138.138]) [65.20.138.138]:58104: 535 Incorrect authentication data (set_id=sales)65.20.138.13899237  A{;ph F{"content":[{"rule":"11009","retries":1,"severity":4,"name":"WHM login success","message":"[2025-04-25 18:33:05 +0530] info [whostmgrd] 103.190.54.25 NEW root:fszxzMx1CX3yYdRU address=103.190.54.25,app=whostmgrd,creator=root,method=handle_form_login,path=form,possessed=0","attackers_ip":"103.190.54.25","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745586186,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":true,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0})8Lh V{"content":[{"rule":"11301","retries":1,"severity":3,"name":"New FTP connection.","message":"Apr 25 18:29:47 vm1 pure-ftpd[3412159]: (?@20.171.30.14) [INFO] New connection from 20.171.30.14","attackers_ip":"20.171.30.14","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745585988,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0};3ph r{"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 17:01:07 dovecot_login authenticator failed for ([5.30.85.215]) [5.30.85.215]:39202: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)","attackers_ip":"5.30.85.215","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745580667,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"13001","retries":2,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 17:01:23 dovecot_login authenticator failed for (rokamauka.com) [42.193.105.109]:34938: 535 Incorrect authentication data (set_id=nologin)","attackers_ip":"42.193.105.109","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745580683,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 17:01:27 dovecot_login authenticator failed for ([14.23.77.27]) [14.23.77.27]:36470: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)","attackers_ip":"14.23.77.27","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745580687,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0} H4. O [ w IH|#  -% ossec13001h Exim Auth failed2025-04-25 10:08:56 dovecot_login authenticator failed for (ip-199-1-248-87.eidsiva.net) [87.248.1.199]:41611: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)87.248.1.1993144096Q"  -1% ossec13001h Exim Auth failed2025-04-25 10:08:30 dovecot_login authenticator failed for ([185.43.10.11]) [185.43.10.11]:51618: 535 Incorrect authentication data (set_id=sales)185.43.10.112017370u!  -w' ossec13001h Exim Auth failed2025-04-25 10:08:12 dovecot_login authenticator failed for (136-62-72-219.googlefiber.net) [136.62.72.219]:37126: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)136.62.72.2196252001K  -%' ossec13001h Exim Auth failed2025-04-25 10:00:34 dovecot_login authenticator failed for (User) [185.93.89.218]:58808: 535 Incorrect authentication data (set_id=mailtest)185.93.89.218130758+  3Y+ ossec11301h uNew FTP connection.Apr 25 09:58:35 vm1 pure-ftpd[3297677]: (?@147.185.132.144) [INFO] New connection from 147.185.132.144147.185.132.1446252001i  -[+ ossec13001h JExim Auth failed2025-04-25 09:49:22 dovecot_login authenticator failed for ([115.144.115.150]) [115.144.115.150]:40983: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)115.144.115.1501835841  -7+ ossec13001h >Exim Auth failed2025-04-25 09:49:10 dovecot_login authenticator failed for 107-135-117-245.lightspeed.livnmi.sbcglobal.net [107.135.117.245]:4661: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)107.135.117.2456252001u  -u) ossec13001h Exim Auth failed2025-04-25 09:48:04 dovecot_login authenticator failed for c188-150-54-235.bredband.tele2.se [188.150.54.235]:48490: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)188.150.54.2352661886s  -u% ossec13001h Exim Auth failed2025-04-25 09:47:53 dovecot_login authenticator failed for ([8.155.38.230]) [49.77.14.208]:35382: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)49.77.14.2081814991|  -+ ossec13001h Exim Auth failed2025-04-25 09:47:34 dovecot_login authenticator failed for ([175.162.114.139]) [175.162.114.139]:39146: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)175.162.114.1391814991j  -_) ossec13001h Exim Auth failed2025-04-25 09:46:33 dovecot_login authenticator failed for 123-193-152-64.dynamic.kbronet.com.tw [123.193.152.64]:35554: 535 Incorrect authentication data (set_id=sales)123.193.152.641668284m  -g' ossec13001h Exim Auth failed2025-04-25 09:46:12 dovecot_login authenticator failed for (r552pc2.ee.ntu.edu.tw) [131.107.8.114]:55755: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)131.107.8.1146252001_  -K' ossec13001h Exim Auth failed2025-04-25 09:38:09 dovecot_login authenticator failed for ([14.53.126.112]) [14.53.126.112]:54158: 535 Incorrect authentication data (set_id=vikas.khandelwal)14.53.126.1121835841o  -m% ossec13001h Exim Auth failed2025-04-25 09:37:49 dovecot_login authenticator failed for ([58.16.49.250]) [58.16.49.250]:40675: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)58.16.49.2501814991Z  -G% ossec13001h ?Exim Auth failed2025-04-25 09:32:07 dovecot_login authenticator failed for ([65.20.253.17]) [65.20.253.17]:48958: 535 Incorrect authentication data (set_id=vikas.khandelwal)65.20.253.1799237  -' ossec13001h 5Exim Auth failed2025-04-25 09:31:57 dovecot_login authenticator failed for 46-162-104-66.cust.bredband2.com [46.162.104.66]:52764: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)46.162.104.662661886G  -' ossec13001h iExim Auth failed2025-04-25 09:28:32 dovecot_login authenticator failed for (User) [185.93.89.218]:10284: 535 Incorrect authentication data (set_id=mail)185.93.89.218130758 1E ] u w lV  -e' ossec13001h /Exim Auth failed2025-04-25 12:16:20 dovecot_login authenticator failed for (thepsindustries.com) [221.229.216.1]:49532: 535 Incorrect authentication data (set_id=admin@thepsindustries.com)221.229.216.11814991ZU  -A' ossec13001h /Exim Auth failed2025-04-25 12:15:54 dovecot_login authenticator failed for (thepsindustries.com) [221.229.216.1]:46306: 535 Incorrect authentication data (set_id=nologin)221.229.216.11814991HT  -' ossec13001h .Exim Auth failed2025-04-25 12:09:09 dovecot_login authenticator failed for (User) [185.93.89.218]:52328: 535 Incorrect authentication data (set_id=mysql)185.93.89.218130758~S  -+ ossec13001h +Exim Auth failed2025-04-25 11:58:32 dovecot_login authenticator failed for (187-93-236-244.customer.tdatabrasil.net.br) [179.184.176.137]:55212: 535 Incorrect authentication data (set_id=vikas.khandelwal)179.184.176.1373469034dR  -[# ossec13001h +Exim Auth failed2025-04-25 11:58:14 dovecot_login authenticator failed for (2-55-85-196.orange.net.il) [2.55.85.196]:42107: 535 Incorrect authentication data (set_id=vikas.khandelwal)2.55.85.196294640oQ  -m% ossec13001h +gExim Auth failed2025-04-25 11:57:50 dovecot_login authenticator failed for ([180.94.74.82]) [180.94.74.82]:37944: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)180.94.74.821149361P  ;) ossec13008h +Mail Recipient rejected2025-04-25 11:56:38 H=(localhost.localdomain) [78.153.140.207]:51012 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no F= rejected RCPT : Sender verify failed78.153.140.2072635167 O  -) ossec13001h +Exim Auth failed2025-04-25 11:56:24 dovecot_login authenticator failed for 47-158-212-153.lsan.ca.frontiernet.net [47.158.212.153]:41220: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)47.158.212.1536252001]N  -I% ossec13001h +Exim Auth failed2025-04-25 11:56:15 dovecot_login authenticator failed for (rokamauka.com) [125.72.54.81]:38876: 535 Incorrect authentication data (set_id=info@rokamauka.com)125.72.54.811814991M  -1' ossec13001h *Exim Auth failed2025-04-25 11:55:51 dovecot_login authenticator failed for (c-50-171-64-170.unallocated.comcastbusiness.net) [50.171.64.170]:60616: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)50.171.64.1706252001RL  -3% ossec13001h *Exim Auth failed2025-04-25 11:55:21 dovecot_login authenticator failed for (rokamauka.com) [125.72.54.81]:33392: 535 Incorrect authentication data (set_id=nologin)125.72.54.811814991yK  -}) ossec13001h (Exim Auth failed2025-04-25 11:46:37 dovecot_login authenticator failed for ([218.28.171.213]) [218.28.171.213]:43982: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)218.28.171.2131814991cJ  -S' ossec13001h (Exim Auth failed2025-04-25 11:46:52 dovecot_login authenticator failed for ([111.26.80.228]) [111.26.80.229]:48940: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)111.26.80.2291814991cI  -Q) ossec13001h 'Exim Auth failed2025-04-25 11:41:18 dovecot_login authenticator failed for 110-25-103-200.adsl.fetnet.net [110.25.103.200]:57148: 535 Incorrect authentication data (set_id=sales)110.25.103.2001668284gH  -[' ossec13001h 'zExim Auth failed2025-04-25 11:41:05 dovecot_login authenticator failed for ([193.95.21.147]) [193.95.21.147]:44418: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)193.95.21.1472464461JG  -#' ossec13001h &Exim Auth failed2025-04-25 11:37:05 dovecot_login authenticator failed for (User) [185.93.89.218]:31112: 535 Incorrect authentication data (set_id=monitor)185.93.89.218130758  Y=|th P{"content":[{"rule":"11001","retries":1,"severity":3,"name":"Deferred login on the cpanel service","message":"[2025-04-25 14:33:48 +0530] info [whostmgrd] 171.79.150.205 - root \"GET /cpsess7254907573/scripts4/listaccts?=undefined\u0026login=1\u0026post_login=23126918081569 HTTP/1.1\" DEFERRED LOGIN whostmgrd: security token incorrect","attackers_ip":"171.79.150.205","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745571828,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":true,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}R{h b{"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 15:53:20 dovecot_login authenticator failed for (User) [185.93.89.218]:11740: 535 Incorrect authentication data (set_id=recruit)","attackers_ip":"185.93.89.218","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745576601,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}nzVh B1{"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 13:34:59 dovecot_login authenticator failed for ([65.20.205.197]) [65.20.205.197]:53836: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)","attackers_ip":"65.20.205.197","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745568299,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}#y@h b{"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 15:52:43 dovecot_login authenticator failed for 201-61-40-117.bbone.telesp.net.br [201.61.40.117]:39364: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)","attackers_ip":"201.61.40.117","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745576563,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 15:52:55 dovecot_login authenticator failed for ([125.23.204.106]) [125.23.204.106]:51820: 535 Incorrect authentication data (set_id=sales)","attackers_ip":"125.23.204.106","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745576575,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}   :8h '{"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 11:41:05 dovecot_login authenticator failed for ([193.95.21.147]) [193.95.21.147]:44418: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)","attackers_ip":"193.95.21.147","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745561466,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 11:41:18 dovecot_login authenticator failed for 110-25-103-200.adsl.fetnet.net [110.25.103.200]:57148: 535 Incorrect authentication data (set_id=sales)","attackers_ip":"110.25.103.200","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745561479,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}R7h &{"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 11:37:05 dovecot_login authenticator failed for (User) [185.93.89.218]:31112: 535 Incorrect authentication data (set_id=monitor)","attackers_ip":"185.93.89.218","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745561226,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}w6hh z{"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 10:36:05 dovecot_login authenticator failed for ([205.164.235.34]) [205.164.235.38]:33562: 535 Incorrect authentication data (set_id=sales)","attackers_ip":"205.164.235.38","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745557567,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 10:36:37 dovecot_login authenticator failed for (135.121.156.175.unknown.m1.com.sg) [175.156.121.135]:38076: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)","attackers_ip":"175.156.121.135","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745557599,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 10:36:48 dovecot_login authenticator failed for (static-137-230.pppoe.tmb.ru) [78.132.137.230]:56308: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)","attackers_ip":"78.132.137.230","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745557609,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0} --O[h m{"content":[{"rule":"11075","retries":15,"severity":3,"name":"FTP file manipulations","message":"Fri Apr 25 19:59:54 2025 0 171.79.150.205 3384 /home/techno/public_html/amplifypowerglobal.com/assets/css/owl.css a _ i r user@amplifypowerglobal.com ftp 1 * c","attackers_ip":"171.79.150.205","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":["noshow"],"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745591396,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":true,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"11301","retries":2,"severity":3,"name":"New FTP connection.","message":"Apr 25 19:59:53 vm1 pure-ftpd[3433641]: (?@171.79.150.205) [INFO] New connection from 171.79.150.205","attackers_ip":"171.79.150.205","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745591396,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":true,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"11309","retries":2,"severity":3,"name":"FTP Authentication success.","message":"Apr 25 19:59:54 vm1 pure-ftpd[3433639]: (?@171.79.150.205) [INFO] user@amplifypowerglobal.com is now logged in","attackers_ip":"171.79.150.205","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745591396,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":true,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"11313","retries":15,"severity":3,"name":"FTP file uploaded to server","message":"Apr 25 19:59:54 vm1 pure-ftpd[3433639]: (user@amplifypowerglobal.com@171.79.150.205) [NOTICE] /home/techno/public_html/amplifypowerglobal.com//assets/css/owl.css uploaded (3384 bytes, 230.55KB/sec)","attackers_ip":"171.79.150.205","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745591396,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":true,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0} "Y"3w`h OQ{"content":[{"rule":"11307","retries":1,"severity":3,"name":"Multiple connection attempts from same source","message":"Apr 25 14:30:09 vm1 pure-ftpd[3358556]: (?@165.22.83.49) [INFO] New connection from 165.22.83.49","attackers_ip":"165.22.83.49","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745571610,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"11301","retries":9,"severity":3,"name":"New FTP connection.","message":"Apr 25 14:30:07 vm1 pure-ftpd[3358524]: (?@165.22.83.49) [INFO] New connection from 165.22.83.49","attackers_ip":"165.22.83.49","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745571608,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0})vLh O{"content":[{"rule":"11301","retries":1,"severity":3,"name":"New FTP connection.","message":"Apr 25 14:29:59 vm1 pure-ftpd[3358355]: (?@165.22.83.49) [INFO] New connection from 165.22.83.49","attackers_ip":"165.22.83.49","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745571600,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}z  K$Azh {"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 10:50:01 dovecot_login authenticator failed for 111-70-29-157.emome-ip.hinet.net [111.70.29.157]:40202: 535 Incorrect authentication data (set_id=services@heipowersystem.com)","attackers_ip":"111.70.29.157","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745558401,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}<>rh {"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 10:46:53 dovecot_login authenticator failed for ([222.236.155.146]) [222.236.155.146]:53513: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)","attackers_ip":"222.236.155.146","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745558213,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 10:47:05 dovecot_login authenticator failed for h-79-136-82-70.a463.priv.bahnhof.se [79.136.82.70]:53005: 535 Incorrect authentication data (set_id=vikas.khandelwal)","attackers_ip":"79.136.82.70","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745558225,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}1=\h ({"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 11:46:52 dovecot_login authenticator failed for ([111.26.80.228]) [111.26.80.229]:48940: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)","attackers_ip":"111.26.80.229","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745561813,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 11:46:37 dovecot_login authenticator failed for ([218.28.171.213]) [218.28.171.213]:43982: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)","attackers_ip":"218.28.171.213","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745561799,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0} ~qdWJ=0# zm`SF9, v i \ O B 5 (     r e X K > 1 $  { n a T G : -   w j ] P C 6 )     v j ^ R F : . " 1733045ON 174982/ 174982. 174982. 174982- 174982) 174982% 174982$ 174982+ 174982* 174982  1733045N 1733045M 1733045M 1733045M 1733045K 1733045J[ 1733045JL 1733045I 1733045I 1733045Iu 1733045H 1733045G' 1733045F 1733045E 1733045Dv 1733045A 1733045@ 1733045? 1733045?C 1733045> 1733045>& 1733045=c 1733045< 1733045; 1733045; 1733045: 17330459$ 17330459 17330458 17330458: 17330457 17330457 17330455d 17330454x 17330454Z 17330453 17330453m 17330453g 17330452 17330452 17330452 17330452 17330451r 1733045/ 1733045. 1733045- 1733045-~ 1733045-M 1733045-> 1733045- 1733045,_ 1733045,1 1733045, 1733045* 1733045) 1733045( 1733045(9 1733045'x 1733045'h 1733045' 1733045& 1733045&z 1733045&h 1733045&D 1733045&@ 1733045%V 1733045%2 1733045%+ 1733045% 1733045$0 1733045$ 1733045# 1733045" 1733045" 1733045! 1733045! 1733045 1733045 + 1733045 1733045* 1733045 1733045 1733045 1733045 1733045\ 1733045 1733045 1733045 1733045F 1733045 1733045I 1733045 1733045 1733045 1733045 1733045 1733045k 1733045 1733045 1733045 1733045 1733045C 1733045g 1733045 1733045 1733045 1733045 1733045 1733045 1733045 1733045 1733045 1733045{ 1733045V 1733045 1733045 1733045 17330457 17330453 1733045a 1733045% 1733045 1733045 1733045G 1733045 17330457  CaE l>>US$h D{"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 13:45:16 dovecot_login authenticator failed for (User) [185.93.89.218]:48684: 535 Incorrect authentication data (set_id=postmaster)","attackers_ip":"185.93.89.218","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745568918,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}Qh R]{"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 14:44:04 dovecot_login authenticator failed for ([168.126.90.210]) [168.126.90.210]:40213: 535 Incorrect authentication data (set_id=sales)","attackers_ip":"168.126.90.210","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745572445,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 14:43:43 dovecot_login authenticator failed for ([65.20.170.59]) [65.20.170.59]:40540: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)","attackers_ip":"65.20.170.59","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745572423,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0} /mXh ^{"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 15:33:34 dovecot_login authenticator failed for mail-02.03.perm.ru [46.146.210.180]:25145: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)","attackers_ip":"46.146.210.180","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745575414,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 15:33:42 dovecot_login authenticator failed for ([223.178.218.234]) [223.178.218.234]:43742: 535 Incorrect authentication data (set_id=vikas.khandelwal)","attackers_ip":"223.178.218.234","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745575424,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}Rlh LE{"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 14:17:17 dovecot_login authenticator failed for (User) [185.93.89.218]:10588: 535 Incorrect authentication data (set_id=printer)","attackers_ip":"185.93.89.218","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745570837,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0} e# < ` '4=eS`  -5' ossec13001h lExim Auth failed2025-04-25 21:38:10 dovecot_login authenticator failed for ([91.239.23.149]) [91.239.23.149]:36770: 535 Incorrect authentication data (set_id=sales)91.239.23.149458258r_  -s% ossec13001h YExim Auth failed2025-04-25 21:37:53 dovecot_login authenticator failed for 95-37-97-198.dynamic.mts-nn.ru [95.37.97.198]:30867: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)95.37.97.1982017370n^  -m# ossec13001h GExim Auth failed2025-04-25 21:37:35 dovecot_login authenticator failed for ([103.60.89.251]) [103.60.89.2]:41594: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)103.60.89.21643084r]  -q' ossec13001h 9Exim Auth failed2025-04-25 21:37:20 dovecot_login authenticator failed for ([125.21.141.54]) [125.21.141.54]:60902: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)125.21.141.541269750u\  -{# ossec13001h ]Exim Auth failed2025-04-25 21:37:56 dovecot_login authenticator failed for 96-1-40-151-staticipeast.wireless.telus.com [96.1.40.151]:34265: 535 Incorrect authentication data (set_id=vikas.khandelwal)96.1.40.1516251999a[  -O) ossec13001h Exim Auth failed2025-04-25 21:32:30 dovecot_login authenticator failed for ([168.167.55.230]) [168.167.55.230]:39217: 535 Incorrect authentication data (set_id=vikas.khandelwal)168.167.55.230933860~Z  - % ossec13001h Exim Auth failed2025-04-25 21:32:15 dovecot_login authenticator failed for wsip-68-15-163-18.no.no.cox.net [68.15.163.18]:43603: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)68.15.163.186252001uY  -y% ossec13001h Exim Auth failed2025-04-25 21:26:03 dovecot_login authenticator failed for 32.104.29.34.bc.googleusercontent.com [34.29.104.32]:48190: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)34.29.104.326252001 X  -%' ossec13001h Exim Auth failed2025-04-25 21:25:52 dovecot_login authenticator failed for broadband-46-242-107-60.ip.moscow.rt.ru [46.242.107.60]:56220: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)46.242.107.602017370ZW  -=+ ossec13001h /Exim Auth failed2025-04-25 21:20:06 dovecot_login authenticator failed for ([211.238.237.254]) [211.238.237.254]:42786: 535 Incorrect authentication data (set_id=sales)211.238.237.2541835841tV  -s) ossec13001h Exim Auth failed2025-04-25 21:19:48 dovecot_login authenticator failed for (se5-0-0.rwp44d4.pie.net.pk) [202.125.155.85]:54560: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)202.125.155.851168579JU  -#' ossec13001h HExim Auth failed2025-04-25 21:16:15 dovecot_login authenticator failed for (User) [185.93.89.218]:14464: 535 Incorrect authentication data (set_id=support)185.93.89.218130758(T  3U) ossec11301h New FTP connection.Apr 25 21:06:12 vm1 pure-ftpd[3447897]: (?@147.185.132.33) [INFO] New connection from 147.185.132.33147.185.132.336252001WS  -9) ossec13001h Exim Auth failed2025-04-25 20:53:48 dovecot_login authenticator failed for ([195.211.39.216]) [195.211.39.216]:60328: 535 Incorrect authentication data (set_id=sales)195.211.39.2162017370bR  -W% ossec13001h Exim Auth failed2025-04-25 20:53:34 dovecot_login authenticator failed for ([65.20.158.10]) [65.20.158.10]:57737: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)65.20.158.1099237jQ  -a' ossec13001h Exim Auth failed2025-04-25 20:49:57 dovecot_login authenticator failed for syn-172-090-128-097.res.spectrum.com [172.90.128.97]:58842: 535 Incorrect authentication data (set_id=services)172.90.128.976252001iP  -_' ossec13001h Exim Auth failed2025-04-25 20:49:18 dovecot_login authenticator failed for visaustralia.com [216.70.104.41]:58342: 535 Incorrect authentication data (set_id=services@heipowersystem.com)216.70.104.416252001 > l3>[qZ\h {"content":[{"rule":"11009","retries":1,"severity":4,"name":"WHM login success","message":"[2025-04-25 19:57:11 +0530] info [whostmgrd] 171.79.150.205 NEW techno:KUOZmIIapCrDg66h address=171.79.150.205,app=cpaneld,creator=root,method=handle_auth_transfer,path=xfercpanel","attackers_ip":"171.79.150.205","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745591231,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":true,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"11006","retries":1,"severity":4,"name":"cPanel login success","message":"[2025-04-25 19:57:12 +0530] info [cpaneld] 171.79.150.205 NEW techno:jKQiDlaGw5TU5AiO address=171.79.150.205,app=cpaneld,creator=techno,method=handle_form_login,path=loadsession:techno:KUOZmIIapCrDg66h,possessed=1,possessor=root","attackers_ip":"171.79.150.205","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745591233,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":true,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}5Xdh {"content":[{"rule":"11301","retries":1,"severity":3,"name":"New FTP connection.","message":"Apr 25 19:56:24 vm1 pure-ftpd[3432859]: (?@171.79.150.205) [INFO] New connection from 171.79.150.205","attackers_ip":"171.79.150.205","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745591185,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":true,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"11309","retries":1,"severity":3,"name":"FTP Authentication success.","message":"Apr 25 19:56:24 vm1 pure-ftpd[3432859]: (?@171.79.150.205) [INFO] user@amplifypowerglobal.com is now logged in","attackers_ip":"171.79.150.205","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745591185,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":true,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}Vh {"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 19:53:14 dovecot_login authenticator failed for ([47.238.163.1]) [47.238.163.1]:38914: 535 Incorrect authentication data (set_id=services@heipowersystem.com)","attackers_ip":"47.238.163.1","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745590995,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 19:53:33 dovecot_login authenticator failed for ([221.210.9.88]) [221.210.9.82]:43694: 535 Incorrect authentication data (set_id=services)","attackers_ip":"221.210.9.82","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745591013,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0} kk^h !{"content":[{"rule":"11309","retries":2,"severity":3,"name":"FTP Authentication success.","message":"Apr 25 20:02:14 vm1 pure-ftpd[3434242]: (?@171.79.150.205) [INFO] user@amplifypowerglobal.com is now logged in","attackers_ip":"171.79.150.205","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745591536,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":true,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 20:02:46 dovecot_login authenticator failed for ([61.72.101.1]) [61.72.58.242]:53619: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)","attackers_ip":"61.72.58.242","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745591568,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 20:02:58 dovecot_login authenticator failed for ([65.20.138.138]) [65.20.138.138]:33739: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)","attackers_ip":"65.20.138.138","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745591580,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"11314","retries":2,"severity":3,"name":"FTP file deleted from server","message":"Apr 25 20:02:07 vm1 pure-ftpd[3432859]: (user@amplifypowerglobal.com@171.79.150.205) [NOTICE] Deleted /home/techno/public_html/amplifypowerglobal.com//assets/js/304123/index.php","attackers_ip":"171.79.150.205","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745591528,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":true,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"11301","retries":2,"severity":3,"name":"New FTP connection.","message":"Apr 25 20:02:14 vm1 pure-ftpd[3434242]: (?@171.79.150.205) [INFO] New connection from 171.79.150.205","attackers_ip":"171.79.150.205","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745591536,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":true,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"11313","retries":18,"severity":3,"name":"FTP file uploaded to server","message":"Apr 25 20:02:15 vm1 pure-ftpd[3434242]: (user@amplifypowerglobal.com@171.79.150.205) [NOTICE] /home/techno/public_html/amplifypowerglobal.com//assets/js/sharer.js uploaded (7422 bytes, 729.19KB/sec)","attackers_ip":"171.79.150.205","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745591536,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":true,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"11075","retries":18,"severity":3,"name":"FTP file manipulations","message":"Fri Apr 25 20:02:15 2025 0 171.79.150.205 3870 /home/techno/public_html/amplifypowerglobal.com/assets/js/map-helper.js a _ i r user@amplifypowerglobal.com ftp 1 * c","attackers_ip":"171.79.150.205","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":["noshow"],"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745591536,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":true,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0} A`|h ]{"content":[{"rule":"11314","retries":177,"severity":3,"name":"FTP file deleted from server","message":"Apr 25 20:03:42 vm1 pure-ftpd[3432859]: (user@amplifypowerglobal.com@171.79.150.205) [NOTICE] Deleted /home/techno/public_html/amplifypowerglobal.com//assets/images/about-11-bg.jpg","attackers_ip":"171.79.150.205","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745591622,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":true,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"11301","retries":2,"severity":3,"name":"New FTP connection.","message":"Apr 25 20:03:59 vm1 pure-ftpd[3434521]: (?@171.79.150.205) [INFO] New connection from 171.79.150.205","attackers_ip":"171.79.150.205","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745591640,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":true,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"11309","retries":2,"severity":3,"name":"FTP Authentication success.","message":"Apr 25 20:03:59 vm1 pure-ftpd[3434520]: (?@171.79.150.205) [INFO] user@amplifypowerglobal.com is now logged in","attackers_ip":"171.79.150.205","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745591640,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":true,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"11313","retries":38,"severity":3,"name":"FTP file uploaded to server","message":"Apr 25 20:03:59 vm1 pure-ftpd[3434521]: (user@amplifypowerglobal.com@171.79.150.205) [NOTICE] /home/techno/public_html/amplifypowerglobal.com//assets/images/process-icon-im-1.png uploaded (3517 bytes, 148.01KB/sec)","attackers_ip":"171.79.150.205","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745591640,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":true,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"11075","retries":39,"severity":3,"name":"FTP file manipulations","message":"Fri Apr 25 20:03:59 2025 0 171.79.150.205 3517 /home/techno/public_html/amplifypowerglobal.com/assets/images/process-icon-im-1.png b _ i r user@amplifypowerglobal.com ftp 1 * c","attackers_ip":"171.79.150.205","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":["noshow"],"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745591640,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":true,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0} >bvh {"content":[{"rule":"11313","retries":30,"severity":3,"name":"FTP file uploaded to server","message":"Apr 25 20:05:05 vm1 pure-ftpd[3434521]: (user@amplifypowerglobal.com@171.79.150.205) [NOTICE] /home/techno/public_html/amplifypowerglobal.com//assets/images/sliders/slider-3-3.jpg uploaded (69365 bytes, 371.79KB/sec)","attackers_ip":"171.79.150.205","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745591706,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":true,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"11075","retries":30,"severity":3,"name":"FTP file manipulations","message":"Fri Apr 25 20:05:05 2025 0 171.79.150.205 69365 /home/techno/public_html/amplifypowerglobal.com/assets/images/sliders/slider-3-3.jpg b _ i r user@amplifypowerglobal.com ftp 1 * c","attackers_ip":"171.79.150.205","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":["noshow"],"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745591706,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":true,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"11305","retries":1,"severity":3,"name":"Attempt to access invalid directory","message":"Apr 25 20:05:10 vm1 pure-ftpd[3434521]: (user@amplifypowerglobal.com@171.79.150.205) [INFO] Can't change directory to /assets/images/team: No such file or directory","attackers_ip":"171.79.150.205","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745591710,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":true,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}6afh {"content":[{"rule":"11313","retries":211,"severity":3,"name":"FTP file uploaded to server","message":"Apr 25 20:04:04 vm1 pure-ftpd[3434521]: (user@amplifypowerglobal.com@171.79.150.205) [NOTICE] /home/techno/public_html/amplifypowerglobal.com//assets/images/about-11-bg.jpg uploaded (169546 bytes, 905.26KB/sec)","attackers_ip":"171.79.150.205","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745591646,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":true,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"11075","retries":210,"severity":3,"name":"FTP file manipulations","message":"Fri Apr 25 20:04:04 2025 0 171.79.150.205 169546 /home/techno/public_html/amplifypowerglobal.com/assets/images/about-11-bg.jpg b _ i r user@amplifypowerglobal.com ftp 1 * c","attackers_ip":"171.79.150.205","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":["noshow"],"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745591646,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":true,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"11305","retries":11,"severity":3,"name":"Attempt to access invalid directory","message":"Apr 25 20:04:32 vm1 pure-ftpd[3434521]: (user@amplifypowerglobal.com@171.79.150.205) [INFO] Can't change directory to /assets/images/about: No such file or directory","attackers_ip":"171.79.150.205","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745591674,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":true,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}  =efDh {"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 19:19:05 dovecot_login authenticator failed for ([47.83.2.11]) [47.83.2.11]:35240: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)","attackers_ip":"47.83.2.11","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745588945,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}e.h {"content":[{"rule":"11301","retries":2,"severity":3,"name":"New FTP connection.","message":"Apr 25 20:08:34 vm1 pure-ftpd[3435657]: (?@171.79.150.205) [INFO] New connection from 171.79.150.205","attackers_ip":"171.79.150.205","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745591914,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":true,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"11309","retries":2,"severity":3,"name":"FTP Authentication success.","message":"Apr 25 20:08:34 vm1 pure-ftpd[3435655]: (?@171.79.150.205) [INFO] user@amplifypowerglobal.com is now logged in","attackers_ip":"171.79.150.205","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745591916,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":true,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"11313","retries":7,"severity":3,"name":"FTP file uploaded to server","message":"Apr 25 20:08:37 vm1 pure-ftpd[3435655]: (user@amplifypowerglobal.com@171.79.150.205) [NOTICE] /home/techno/public_html/amplifypowerglobal.com//assets/homebannner.jpg uploaded (584966 bytes, 193.15KB/sec)","attackers_ip":"171.79.150.205","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745591918,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":true,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}Qhh ={"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 20:11:45 dovecot_login authenticator failed for (User) [185.93.89.218]:30518: 535 Incorrect authentication data (set_id=shared)","attackers_ip":"185.93.89.218","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745592107,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}jgNh {"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 19:19:16 dovecot_login authenticator failed for (host-91-202-199-145.baza.net) [91.202.199.145]:52370: 535 Incorrect authentication data (set_id=sales)","attackers_ip":"91.202.199.145","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745588957,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0} 4 l4{z nh b{"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 21:55:03 dovecot_login authenticator failed for ([65.20.251.53]) [65.20.251.53]:42850: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)","attackers_ip":"65.20.251.53","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745598304,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}/Xh !{"content":[{"rule":"11301","retries":1,"severity":3,"name":"New FTP connection.","message":"Apr 25 21:06:12 vm1 pure-ftpd[3447897]: (?@147.185.132.33) [INFO] New connection from 147.185.132.33","attackers_ip":"147.185.132.33","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745595374,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}u"dh {"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 21:55:25 dovecot_login authenticator failed for 124-11-64-11.static.tfn.net.tw [124.11.64.11]:42518: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)","attackers_ip":"124.11.64.11","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745598326,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}h {"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 20:53:34 dovecot_login authenticator failed for ([65.20.158.10]) [65.20.158.10]:57737: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)","attackers_ip":"65.20.158.10","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745594615,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 20:53:48 dovecot_login authenticator failed for ([195.211.39.216]) [195.211.39.216]:60328: 535 Incorrect authentication data (set_id=sales)","attackers_ip":"195.211.39.216","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745594629,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}  pwohh ){"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 19:28:37 dovecot_login authenticator failed for ([220.77.245.227]) [220.77.245.227]:59536: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)","attackers_ip":"220.77.245.227","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745589518,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 19:28:48 dovecot_login authenticator failed for ([36.26.63.158]) [36.26.63.158]:49578: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)","attackers_ip":"36.26.63.158","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745589530,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 19:28:58 dovecot_login authenticator failed for ([102.215.188.37]) [102.215.188.37]:60219: 535 Incorrect authentication data (set_id=sales)","attackers_ip":"102.215.188.37","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745589540,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 19:29:01 dovecot_login authenticator failed for ([59.96.62.29]) [59.96.62.29]:54404: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)","attackers_ip":"59.96.62.29","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745589542,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}-kTh {"content":[{"rule":"11301","retries":2,"severity":3,"name":"New FTP connection.","message":"Apr 25 20:17:19 vm1 pure-ftpd[3437634]: (?@34.78.45.249) [INFO] New connection from 34.78.45.249","attackers_ip":"34.78.45.249","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745592441,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"11302","retries":1,"severity":3,"name":"FTP Authentication failed.","message":"Apr 25 20:17:25 vm1 pure-ftpd[3437636]: (?@34.78.45.249) [WARNING] Authentication failed for user [anonymous]","attackers_ip":"34.78.45.249","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745592447,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}+   hsfpONKNO  2 3auK  -%' ossec13001h Exim Auth failed2025-04-26 00:30:34 dovecot_login authenticator failed for (User) [185.93.89.218]:21340: 535 Incorrect authentication data (set_id=testmail)185.93.89.218130758  ?1 ossec1008h VProcess exiting (killed).Apr 26 00:07:08 vm1 spamd[3166477]: spamd: server killed by SIGTERM, shutting downZ  -?) ossec13001h ԼExim Auth failed2025-04-26 00:00:19 dovecot_login authenticator failed for ([222.186.68.153]) [222.186.68.153]:57416: 535 Incorrect authentication data (set_id=purchase)222.186.68.1531814991W  -;' ossec13001h ԬExim Auth failed2025-04-26 00:00:03 dovecot_login authenticator failed for ([222.76.248.54]) [222.76.248.54]:56920: 535 Incorrect authentication data (set_id=purchase)222.76.248.541814991w  -y) ossec13001h ԖExim Auth failed2025-04-25 23:59:41 dovecot_login authenticator failed for (ip-20-192.datautama.net.id) [112.109.20.192]:44341: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)112.109.20.1921643084J  -#' ossec13001h 2Exim Auth failed2025-04-25 23:58:00 dovecot_login authenticator failed for (User) [185.93.89.218]:58240: 535 Incorrect authentication data (set_id=testing)185.93.89.218130758W~  -9) ossec13001h {Exim Auth failed2025-04-25 23:54:59 dovecot_login authenticator failed for ([49.249.153.142]) [49.249.153.142]:45759: 535 Incorrect authentication data (set_id=sales)49.249.153.1421269750g}  -[' ossec13001h mExim Auth failed2025-04-25 23:54:44 dovecot_login authenticator failed for ([103.140.2.112]) [103.140.2.112]:35011: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)103.140.2.1121269750M|  -/! ossec13001h ϨExim Auth failed2025-04-25 23:38:39 dovecot_login authenticator failed for ([5.32.107.6]) [5.32.107.6]:37498: 535 Incorrect authentication data (set_id=purchase)5.32.107.6290557f{  -]% ossec13001h φExim Auth failed2025-04-25 23:38:05 dovecot_login authenticator failed for ([94.200.20.66]) [94.200.20.66]:39608: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)94.200.20.66290557Wz  -;' ossec13001h ̨Exim Auth failed2025-04-25 23:25:50 dovecot_login authenticator failed for ([211.223.41.90]) [211.223.41.90]:53042: 535 Incorrect authentication data (set_id=services)211.223.41.901835841jy  -a' ossec13001h ̚Exim Auth failed2025-04-25 23:25:37 dovecot_login authenticator failed for ([165.90.120.76]) [165.90.120.76]:46020: 535 Incorrect authentication data (set_id=services@heipowersystem.com)165.90.120.763374766Hx  -' ossec13001h ̔Exim Auth failed2025-04-25 23:25:30 dovecot_login authenticator failed for (User) [185.93.89.218]:13782: 535 Incorrect authentication data (set_id=test2)185.93.89.218130758Jw  A ) ossec11302h ǎFTP Authentication failed.Apr 25 23:04:05 vm1 pure-ftpd[3473253]: (?@47.236.242.102) [WARNING] Authentication failed for user [maharashtraexpress_teikkm]47.236.242.1021880251(v  3U) ossec11301h LjNew FTP connection.Apr 25 23:03:58 vm1 pure-ftpd[3473253]: (?@47.236.242.102) [INFO] New connection from 47.236.242.10247.236.242.1021880251gu  -[' ossec13001h Exim Auth failed2025-04-25 23:01:23 dovecot_login authenticator failed for ([203.81.213.46]) [203.81.213.46]:53986: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)203.81.213.461168579Tt  -5' ossec13001h Exim Auth failed2025-04-25 22:56:52 dovecot_login authenticator failed for ([203.124.60.46]) [203.124.60.46]:41647: 535 Incorrect authentication data (set_id=sales)203.124.60.461168579s  -' ossec13001h Exim Auth failed2025-04-25 22:56:37 dovecot_login authenticator failed for host31-48-188-117.range31-48.btcentralplus.com [31.48.188.117]:52047: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)31.48.188.1172635167  &'a0h 9{"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 20:28:43 dovecot_login authenticator failed for (zimbra.pragma.ru) [81.22.48.19]:43419: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)","attackers_ip":"81.22.48.19","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745593124,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 20:29:01 dovecot_login authenticator failed for 212.42.246.220.static.netvigator.com [220.246.42.212]:58540: 535 Incorrect authentication data (set_id=sales)","attackers_ip":"220.246.42.212","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745593142,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}  "R|h {"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 19:39:22 dovecot_login authenticator failed for (User) [185.93.89.218]:28574: 535 Incorrect authentication data (set_id=service)","attackers_ip":"185.93.89.218","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745590162,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}pxZh ){"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 20:32:17 dovecot_login authenticator failed for ([211.169.212.206]) [211.169.212.206]:59922: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)","attackers_ip":"211.169.212.206","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745593338,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}vh {"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 20:31:55 dovecot_login authenticator failed for ([182.106.213.108]) [182.106.213.108]:52339: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)","attackers_ip":"182.106.213.108","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745593316,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}_u8h {"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 20:30:10 dovecot_login authenticator failed for (s2seducationtrust.com) [42.193.105.109]:60738: 535 Incorrect authentication data (set_id=support@s2seducationtrust.com)","attackers_ip":"42.193.105.109","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745593212,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 20:30:33 dovecot_login authenticator failed for ([36.154.134.146]) [36.154.134.146]:35853: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)","attackers_ip":"36.154.134.146","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745593234,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 20:31:03 dovecot_login authenticator failed for bb42-60-108-52.singnet.com.sg [42.60.108.52]:43642: 535 Incorrect authentication data (set_id=sales)","attackers_ip":"42.60.108.52","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745593264,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}  58dh :{"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 21:32:15 dovecot_login authenticator failed for wsip-68-15-163-18.no.no.cox.net [68.15.163.18]:43603: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)","attackers_ip":"68.15.163.18","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745596935,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 21:32:30 dovecot_login authenticator failed for ([168.167.55.230]) [168.167.55.230]:39217: 535 Incorrect authentication data (set_id=vikas.khandelwal)","attackers_ip":"168.167.55.230","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745596951,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}V4&h {"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 21:25:52 dovecot_login authenticator failed for broadband-46-242-107-60.ip.moscow.rt.ru [46.242.107.60]:56220: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)","attackers_ip":"46.242.107.60","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745596553,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 21:26:03 dovecot_login authenticator failed for 32.104.29.34.bc.googleusercontent.com [34.29.104.32]:48190: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)","attackers_ip":"34.29.104.32","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745596565,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}O2h z{"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 22:20:43 dovecot_login authenticator failed for (User) [185.93.89.218]:11286: 535 Incorrect authentication data (set_id=test)","attackers_ip":"185.93.89.218","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745599844,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0} U UaDh {"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 19:44:42 dovecot_login authenticator failed for (50-82-12-128.client.mchsi.com) [50.82.12.128]:50974: 535 Incorrect authentication data (set_id=vikas.khandelwal)","attackers_ip":"50.82.12.128","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745590483,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 19:44:31 dovecot_login authenticator failed for (customer-CLN-142-4.megared.net.mx) [177.229.142.4]:58062: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)","attackers_ip":"177.229.142.4","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745590473,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}_~8h {"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 20:43:14 dovecot_login authenticator failed for ([220.80.192.168]) [220.80.192.168]:55752: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)","attackers_ip":"220.80.192.168","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745593994,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 20:43:24 dovecot_login authenticator failed for pool-96-249-234-242.nrflva.fios.verizon.net [96.249.234.242]:39449: 535 Incorrect authentication data (set_id=vikas.khandelwal)","attackers_ip":"96.249.234.242","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745594004,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 20:43:59 dovecot_login authenticator failed for (User) [185.93.89.218]:44486: 535 Incorrect authentication data (set_id=software)","attackers_ip":"185.93.89.218","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745594040,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0} rA O ~ v | b%;mrv  -y' ossec13001h xExim Auth failed2025-04-26 02:11:27 dovecot_login authenticator failed for 111-70-33-227.emome-ip.hinet.net [111.70.33.227]:54964: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)111.70.33.2271668284I  -!' ossec13001h Exim Auth failed2025-04-26 02:08:28 dovecot_login authenticator failed for (User) [185.93.89.218]:11342: 535 Incorrect authentication data (set_id=ubuntu)185.93.89.218130758_  -K' ossec13001h Exim Auth failed2025-04-26 01:43:29 dovecot_login authenticator failed for ([41.224.62.206]) [41.224.62.206]:53469: 535 Incorrect authentication data (set_id=vikas.khandelwal)41.224.62.2062464461  -' ossec13001h Exim Auth failed2025-04-26 01:43:18 dovecot_login authenticator failed for (66-209-97-254.in-solutions.net) [66.209.97.254]:39843: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)66.209.97.2546252001e  -W) ossec13001h Exim Auth failed2025-04-26 01:37:51 dovecot_login authenticator failed for ([94.204.208.189]) [94.204.208.189]:35051: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)94.204.208.189290557q  -u% ossec13001h Exim Auth failed2025-04-26 01:37:35 dovecot_login authenticator failed for ([65.20.252.69]) [65.20.252.69]:43815: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)65.20.252.6999237K  -%' ossec13001h %Exim Auth failed2025-04-26 01:35:56 dovecot_login authenticator failed for (User) [185.93.89.218]:45328: 535 Incorrect authentication data (set_id=training)185.93.89.218130758l  -c) ossec13001h sExim Auth failed2025-04-26 01:32:59 dovecot_login authenticator failed for 105.217.146.34.bc.googleusercontent.com [34.146.217.105]:58472: 535 Incorrect authentication data (set_id=sales)34.146.217.1051861060j  -_) ossec13001h gExim Auth failed2025-04-26 01:32:46 dovecot_login authenticator failed for ([111.192.73.103]) [111.192.73.103]:60580: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)111.192.73.1031814991(  3U) ossec11301h New FTP connection.Apr 26 01:14:13 vm1 pure-ftpd[3504596]: (?@194.165.16.166) [INFO] New connection from 194.165.16.166194.165.16.1662993457  S% ossec11000h mLogin failed on the cpanel service.[2025-04-26 01:07:16 +0530] info [cpaneld] 45.74.62.249 - heipowersystemco "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user heipowersystemco (has_cpuser_file failed)45.74.62.2493895114u  -u) ossec13001h Exim Auth failed2025-04-26 01:05:57 dovecot_login authenticator failed for (static-206.168.107.27-tataidc.co.in) [27.107.168.206]:33482: 535 Incorrect authentication data (set_id=vikas.khandelwal)27.107.168.2061269750  -) ossec13001h Exim Auth failed2025-04-26 01:05:29 dovecot_login authenticator failed for (103.182.106.62.ns1.zitatel.com) [103.182.106.62]:65411: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)103.182.106.621269750L  --# ossec13001h Exim Auth failed2025-04-26 01:03:40 dovecot_login authenticator failed for ([65.20.202.4]) [65.20.202.4]:53649: 535 Incorrect authentication data (set_id=sales)65.20.202.499237m  -c+ ossec13001h Exim Auth failed2025-04-26 01:03:27 dovecot_login authenticator failed for ([188.127.183.144]) [188.127.183.144]:53158: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)188.127.183.1442510769K  -%' ossec13001h yExim Auth failed2025-04-26 01:03:13 dovecot_login authenticator failed for (User) [185.93.89.218]:20722: 535 Incorrect authentication data (set_id=testtest)185.93.89.218130758j  -_) ossec13001h wExim Auth failed2025-04-26 01:03:10 dovecot_login authenticator failed for ([186.201.32.242]) [177.174.95.245]:44764: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)177.174.95.2453469034 453 Z d q  3<ZFW~4Gr  -' ossec13001h Exim Auth failed2025-04-25 22:53:05 dovecot_login authenticator failed for (User) [185.93.89.218]:2996: 535 Incorrect authentication data (set_id=test1)185.93.89.218130758%q  3Q' ossec11301h pNew FTP connection.Apr 25 22:50:46 vm1 pure-ftpd[3470535]: (?@64.62.197.208) [INFO] New connection from 64.62.197.20864.62.197.2086252001]p  -C+ ossec13001h Exim Auth failed2025-04-25 22:48:07 dovecot_login authenticator failed for ([201.234.106.216]) [201.234.106.216]:60150: 535 Incorrect authentication data (set_id=services)201.234.106.2163865483mo  -e) ossec13001h øExim Auth failed2025-04-25 22:47:42 dovecot_login authenticator failed for ([165.140.51.209]) [165.140.50.170]:58598: 535 Incorrect authentication data (set_id=services@heipowersystem.com)165.140.50.1706251999Tn  -5' ossec13001h ÉExim Auth failed2025-04-25 22:46:57 dovecot_login authenticator failed for ([222.92.61.242]) [222.92.61.242]:44876: 535 Incorrect authentication data (set_id=sales)222.92.61.2421814991jm  -_) ossec13001h qExim Auth failed2025-04-25 22:46:32 dovecot_login authenticator failed for ([190.117.96.174]) [190.117.96.174]:40140: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)190.117.96.1743932488l  ;) ossec13008h ?Mail Recipient rejected2025-04-25 22:45:43 H=(localhost.localdomain) [78.153.140.207]:60992 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no F= rejected RCPT : Sender verify failed78.153.140.2072635167]k  -C+ ossec13001h Exim Auth failed2025-04-25 22:38:53 dovecot_login authenticator failed for ([171.221.225.104]) [171.221.225.104]:12177: 535 Incorrect authentication data (set_id=services)171.221.225.1041814991rj  -q' ossec13001h Exim Auth failed2025-04-25 22:38:36 dovecot_login authenticator failed for (167.200.88-83.samtel.ru) [88.200.167.83]:60896: 535 Incorrect authentication data (set_id=services@heipowersystem.com)88.200.167.832017370Gi  -' ossec13001h dExim Auth failed2025-04-25 22:20:43 dovecot_login authenticator failed for (User) [185.93.89.218]:11286: 535 Incorrect authentication data (set_id=test)185.93.89.218130758h  3I# ossec11301h New FTP connection.Apr 25 22:06:40 vm1 pure-ftpd[3461226]: (?@65.49.1.127) [INFO] New connection from 65.49.1.12765.49.1.1276252001Wg  -;' ossec13001h Exim Auth failed2025-04-25 22:01:05 dovecot_login authenticator failed for ([113.192.69.10]) [113.192.69.10]:56772: 535 Incorrect authentication data (set_id=purchase)113.192.69.101835841mf  -e) ossec13001h Exim Auth failed2025-04-25 22:00:53 dovecot_login authenticator failed for ([60.173.105.206]) [60.173.105.206]:42507: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)60.173.105.2061814991ne  -k% ossec13001h vExim Auth failed2025-04-25 21:55:25 dovecot_login authenticator failed for 124-11-64-11.static.tfn.net.tw [124.11.64.11]:42518: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)124.11.64.111668284qd  -u% ossec13001h `Exim Auth failed2025-04-25 21:55:03 dovecot_login authenticator failed for ([65.20.251.53]) [65.20.251.53]:42850: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)65.20.251.5399237Tc  -5' ossec13001h rExim Auth failed2025-04-25 21:51:05 dovecot_login authenticator failed for ([113.192.69.10]) [113.192.69.10]:52518: 535 Incorrect authentication data (set_id=sales)113.192.69.101835841}b  -' ossec13001h \Exim Auth failed2025-04-25 21:50:43 dovecot_login authenticator failed for broadband-95-84-186-218.ip.moscow.rt.ru [95.84.186.218]:56840: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)95.84.186.2182017370Fa  -' ossec13001h Exim Auth failed2025-04-25 21:48:27 dovecot_login authenticator failed for (User) [185.93.89.218]:8340: 535 Incorrect authentication data (set_id=tech)185.93.89.218130758 \   8;jh f{"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 21:37:56 dovecot_login authenticator failed for 96-1-40-151-staticipeast.wireless.telus.com [96.1.40.151]:34265: 535 Incorrect authentication data (set_id=vikas.khandelwal)","attackers_ip":"96.1.40.151","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745597277,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 21:37:20 dovecot_login authenticator failed for ([125.21.141.54]) [125.21.141.54]:60902: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)","attackers_ip":"125.21.141.54","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745597241,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 21:37:35 dovecot_login authenticator failed for ([103.60.89.251]) [103.60.89.2]:41594: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)","attackers_ip":"103.60.89.2","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745597255,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 21:37:53 dovecot_login authenticator failed for 95-37-97-198.dynamic.mts-nn.ru [95.37.97.198]:30867: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)","attackers_ip":"95.37.97.198","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745597273,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}  XKB h Ò{"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 22:46:32 dovecot_login authenticator failed for ([190.117.96.174]) [190.117.96.174]:40140: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)","attackers_ip":"190.117.96.174","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745601393,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 22:46:57 dovecot_login authenticator failed for ([222.92.61.242]) [222.92.61.242]:44876: 535 Incorrect authentication data (set_id=sales)","attackers_ip":"222.92.61.242","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745601417,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}*@Nh V{"content":[{"rule":"13008","retries":1,"severity":3,"name":"Mail Recipient rejected","message":"2025-04-25 22:45:43 H=(localhost.localdomain) [78.153.140.207]:60992 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no F=\u003cno-reply@no-reply.com\u003e rejected RCPT \u003ca@b11.siagabaja.com\u003e: Sender verify failed","attackers_ip":"78.153.140.207","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745601343,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}[>0h {"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 21:38:10 dovecot_login authenticator failed for ([91.239.23.149]) [91.239.23.149]:36770: 535 Incorrect authentication data (set_id=sales)","attackers_ip":"91.239.23.149","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745597292,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}$<Bh {"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 22:38:36 dovecot_login authenticator failed for (167.200.88-83.samtel.ru) [88.200.167.83]:60896: 535 Incorrect authentication data (set_id=services@heipowersystem.com)","attackers_ip":"88.200.167.83","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745600917,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 22:38:53 dovecot_login authenticator failed for ([171.221.225.104]) [171.221.225.104]:12177: 535 Incorrect authentication data (set_id=services)","attackers_ip":"171.221.225.104","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745600935,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0} A qA 5,GRh Ă{"content":[{"rule":"11301","retries":1,"severity":3,"name":"New FTP connection.","message":"Apr 25 22:50:46 vm1 pure-ftpd[3470535]: (?@64.62.197.208) [INFO] New connection from 64.62.197.208","attackers_ip":"64.62.197.208","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745601648,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}dEBh {"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 22:48:07 dovecot_login authenticator failed for ([201.234.106.216]) [201.234.106.216]:60150: 535 Incorrect authentication data (set_id=services)","attackers_ip":"201.234.106.216","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745601488,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0} NJh {"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 21:48:27 dovecot_login authenticator failed for (User) [185.93.89.218]:8340: 535 Incorrect authentication data (set_id=tech)","attackers_ip":"185.93.89.218","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745597908,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}OIh {"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 22:53:05 dovecot_login authenticator failed for (User) [185.93.89.218]:2996: 535 Incorrect authentication data (set_id=test1)","attackers_ip":"185.93.89.218","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745601786,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}tCbh {"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 22:47:42 dovecot_login authenticator failed for ([165.140.51.209]) [165.140.50.170]:58598: 535 Incorrect authentication data (set_id=services@heipowersystem.com)","attackers_ip":"165.140.50.170","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745601464,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0} ]$$$OMh r{"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 21:50:43 dovecot_login authenticator failed for broadband-95-84-186-218.ip.moscow.rt.ru [95.84.186.218]:56840: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)","attackers_ip":"95.84.186.218","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745598044,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}-LTh {"content":[{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 22:56:37 dovecot_login authenticator failed for host31-48-188-117.range31-48.btcentralplus.com [31.48.188.117]:52047: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)","attackers_ip":"31.48.188.117","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745601998,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0},{"rule":"13001","retries":1,"severity":3,"name":"Exim Auth failed","message":"2025-04-25 22:56:52 dovecot_login authenticator failed for ([203.124.60.46]) [203.124.60.46]:41647: 535 Incorrect authentication data (set_id=sales)","attackers_ip":"203.124.60.46","domain":"","plugin_id":"ossec","transaction_id":"","access_denied":false,"tag":null,"modsec_version":"","status_code":0,"engine_mode":"","timestamp":1745602014,"advanced":{"headers":null,"uri":"","http_method":""},"ip_whitelisted":false,"maturity":0,"file":"","data":null,"accuracy":0}],"method":"INCIDENT_LIST","tries":0}  +  ) C^;i{  -]) ossec13001h ZExim Auth failed2025-04-26 09:31:58 dovecot_login authenticator failed for 171.41.246.220.static.netvigator.com [220.246.41.171]:50660: 535 Incorrect authentication data (set_id=sales)220.246.41.1711819730ez  -[' ossec13001h ZExim Auth failed2025-04-26 09:31:46 dovecot_login authenticator failed for ([62.201.212.52]) [62.201.212.52]:37262: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)62.201.212.5299237_y  -K' ossec13001h XExim Auth failed2025-04-26 09:22:59 dovecot_login authenticator failed for ([89.101.36.159]) [89.101.36.159]:57745: 535 Incorrect authentication data (set_id=vikas.khandelwal)89.101.36.1592963597ux  -u) ossec13001h XExim Auth failed2025-04-26 09:22:50 dovecot_login authenticator failed for ([175.205.191.27]) [175.205.191.27]:35034: 535 Incorrect authentication data (set_id=vikas.khandelwal@heipowersystem.com)175.205.191.271835841@w gQ' ossec11307h V0Multiple connection attempts from same sourceApr 26 09:12:39 vm1 pure-ftpd[3607319]: (?@149.28.152.60) [INFO] New connection from 149.28.152.60149.28.152.601880251&v 3Q' ossec11301h V0New FTP connection.Apr 26 09:12:38 vm1 pure-ftpd[3607311]: (?@149.28.152.60) [INFO] New connection from 149.28.152.60149.28.152.601880251&u 3Q' ossec11301h VNew FTP connection.Apr 26 09:11:55 vm1 pure-ftpd[3607203]: (?@149.28.152.60) [INFO] New connection from 149.28.152.60149.28.152.601880251%t  3Q' ossec11301h UNew FTP connection.Apr 26 09:11:19 vm1 pure-ftpd[3607087]: (?@149.28.152.60) [INFO] New connection from 149.28.152.60149.28.152.601880251Is  -!' ossec13001h UOExim Auth failed2025-04-26 09:08:55 dovecot_login authenticator failed for (User) [185.93.89.218]:55366: 535 Incorrect authentication data (set_id=copier)185.93.89.218130758`r  -M' ossec13001h SExim Auth failed2025-04-26 09:01:20 dovecot_login authenticator failed for 54.126.103.87.rev.vodafone.pt [87.103.126.54]:22056: 535 Incorrect authentication data (set_id=sales)87.103.126.542264397aq  -Q' ossec13001h SwExim Auth failed2025-04-26 09:01:03 dovecot_login authenticator failed for (spd.net.tr) [178.20.231.54]:58137: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)178.20.231.54298795\p  -E' ossec13001h SwExim Auth failed2025-04-26 09:01:02 dovecot_login authenticator failed for (broadband.actcorp.in) [106.51.217.56]:13402: 535 Incorrect authentication data (set_id=services)106.51.217.561269750o  -') ossec13001h SgExim Auth failed2025-04-26 09:00:46 dovecot_login authenticator failed for (abts-tn-dynamic-206.187.65.182.airtelbroadband.in) [182.65.187.206]:55744: 535 Incorrect authentication data (set_id=services@heipowersystem.com)182.65.187.2061269750 n  -' ossec13001h QExim Auth failed2025-04-26 08:52:41 dovecot_login authenticator failed for (host-74.181-94-220.personal.net.py) [181.94.220.74]:41006: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)181.94.220.743437598cm  -S' ossec13001h QExim Auth failed2025-04-26 08:52:58 dovecot_login authenticator failed for ([113.192.69.10]) [113.192.69.10]:42914: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)113.192.69.101835841vl  -w) ossec13001h QmExim Auth failed2025-04-26 08:52:19 dovecot_login authenticator failed for (92x255x196x185.static-customer.kzn.ertelecom.ru) [92.255.196.185]:50966: 535 Incorrect authentication data (set_id=sales)92.255.196.1852017370mk  -c+ ossec13001h Q]Exim Auth failed2025-04-26 08:52:04 dovecot_login authenticator failed for ([223.241.214.127]) [223.241.214.127]:43351: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)223.241.214.1271814991 # v (&$5Wj{7  EW ossec5740h 3ssh connection reset by peerApr 26 04:48:09 vm1 sshd[3550015]: error: kex_exchange_identification: read: Connection reset by peerj6  -a' ossec13001h  Exim Auth failed2025-04-26 04:47:52 dovecot_login authenticator failed for ([190.65.62.234]) [190.65.62.234]:53432: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)190.65.62.2343686110h5  -a' ossec13001h Exim Auth failed2025-04-26 04:47:40 dovecot_login authenticator failed for ([65.20.170.167]) [65.20.170.167]:48350: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)65.20.170.16799237Y4  -;+ ossec13001h mExim Auth failed2025-04-26 04:27:48 dovecot_login authenticator failed for ([183.56.179.201]) [119.123.173.194]:27912: 535 Incorrect authentication data (set_id=sales)119.123.173.1941814991j3  -a) ossec13001h SExim Auth failed2025-04-26 04:27:23 dovecot_login authenticator failed for ([185.134.179.106]) [185.101.16.250]:44515: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)185.101.16.250272103}2  -+ ossec13001h Exim Auth failed2025-04-26 04:19:48 dovecot_login authenticator failed for (abts-kk-static-226.253.166.122.airtelbroadband.in) [122.166.253.226]:45234: 535 Incorrect authentication data (set_id=purchase)122.166.253.2261269750}1  -' ossec13001h wExim Auth failed2025-04-26 04:19:27 dovecot_login authenticator failed for syn-074-218-095-154.biz.spectrum.com [74.218.95.154]:56079: 535 Incorrect authentication data (set_id=purchase@heipowersystem.com)74.218.95.1546252001J0  -#' ossec13001h Exim Auth failed2025-04-26 04:17:02 dovecot_login authenticator failed for (User) [185.93.89.218]:29528: 535 Incorrect authentication data (set_id=account)185.93.89.218130758n/  -k% ossec13001h nExim Auth failed2025-04-26 04:06:29 dovecot_login authenticator failed for 95-37-97-198.dynamic.mts-nn.ru [95.37.97.198]:20698: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)95.37.97.1982017370f.  -W) ossec13001h bExim Auth failed2025-04-26 04:06:18 dovecot_login authenticator failed for ([183.108.79.230]) [183.108.79.230]:52561: 535 Incorrect authentication data (set_id=shubham.kulshreshtha)183.108.79.2301835841 -  -!' ossec13001h RExim Auth failed2025-04-26 04:06:02 dovecot_login authenticator failed for (dynamic-ip-18150025078.cable.net.co) [181.50.250.78]:40886: 535 Incorrect authentication data (set_id=shubham.kulshreshtha@heipowersystem.com)181.50.250.783686110\,  -K# ossec13001h Exim Auth failed2025-04-26 04:00:03 dovecot_login authenticator failed for (98.84.41.31.ip4.feromedia.eu) [31.41.84.98]:50211: 535 Incorrect authentication data (set_id=sales)31.41.84.98798544a+  -S# ossec13001h Exim Auth failed2025-04-26 03:59:46 dovecot_login authenticator failed for ([8.209.221.7]) [8.209.221.7]:46400: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)8.209.221.71861060F*  -' ossec13001h aExim Auth failed2025-04-26 03:44:56 dovecot_login authenticator failed for (User) [185.93.89.218]:23702: 535 Incorrect authentication data (set_id=www)185.93.89.218130758()  3U) ossec11301h nNew FTP connection.Apr 26 03:23:49 vm1 pure-ftpd[3531947]: (?@47.237.116.120) [INFO] New connection from 47.237.116.12047.237.116.1201880251i(  -[+ ossec13001h YExim Auth failed2025-04-26 03:19:12 dovecot_login authenticator failed for c188-149-251-239.bredband.tele2.se [188.149.251.239]:40326: 535 Incorrect authentication data (set_id=sales)188.149.251.2392661886j'  -_) ossec13001h MExim Auth failed2025-04-26 03:19:01 dovecot_login authenticator failed for ([211.48.113.101]) [211.48.113.101]:50776: 535 Incorrect authentication data (set_id=sales@heipowersystem.com)211.48.113.1011835841