# incident

plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.219.227
country_id: 6251999
description:
Jan  2 23:34:24 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=158.69.219.227, lip=66.85.158.91, session=<jXkBimtH+LOeRdvj>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 102.204.223.27
country_id: 2328926
description:
Jan  2 23:34:39 host2 pure-ftpd[497163]: (?@102.204.223.27) [INFO] New connection from 102.204.223.27


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Jan  2 23:34:46 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<6w1Hi2tH/EUvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Jan  2 23:35:19 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@rehanseo.online>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<Q75GjWtH3Owv+wDY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.120
country_id: 6252001
description:
Jan  2 23:35:26 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=66.132.153.120, lip=66.85.158.92, TLS: Connection closed, session=<XQrOjWtHcKlChJl4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.187.240
country_id: 3144096
description:
2026-01-02 23:36:03 dovecot_login authenticator failed for H=(cm-84.213.187.240.get.no) [84.213.187.240]:41308: 535 Incorrect authentication data (set_id=postmaster@kiriaswanu.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Jan  2 23:36:06 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<tXwPkGtH+N8v/lVz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.31.8.12
country_id: 614540
description:
2026-01-02 23:36:16 dovecot_login authenticator failed for H=([194.31.8.12]) [194.31.8.12]:53568: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.70.122.245
country_id: 1269750
description:
2026-01-02 23:36:59 dovecot_login authenticator failed for H=(abts-mum-static-245.122.70.182.airtelbroadband.in) [182.70.122.245]:59161: 535 Incorrect authentication data (set_id=sales@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.114.143.79
country_id: 3865483
description:
2026-01-02 23:37:17 dovecot_login authenticator failed for H=host-cotesma-114-143-79.smandes.com.ar [181.114.143.79]:43258: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Jan  2 23:37:52 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<0hFklmtHatFnpBQq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.255.189.56
country_id: 298795
description:
2026-01-02 23:42:19 dovecot_login authenticator failed for H=(88.255.189.56.static.ttnet.com.tr) [88.255.189.56]:50618: 535 Incorrect authentication data (set_id=test@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.200.10
country_id: 1269750
description:
2026-01-02 23:42:29 dovecot_login authenticator failed for H=([125.19.175.85]) [122.186.200.10]:56254: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  2 23:43:57 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<tiEqrGtHPuSi8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Jan  2 23:44:57 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@lezzarotech.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<85jAr2tHBikvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.53.44.125
country_id: 1643084
description:
Jan  2 23:46:05 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lezzarotech.com>, method=PLAIN, rip=117.53.44.125, lip=66.85.158.91, session=<3JDGs2tH3Ml1NSx9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.58.241.90
country_id: 3469034
description:
2026-01-02 23:45:37 dovecot_login authenticator failed for H=(ccabv.org.cta.gvt.net.br) [187.58.241.90]:51667: 535 Incorrect authentication data (set_id=contacto@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.226.163
country_id: 3144096
description:
2026-01-02 23:45:48 dovecot_login authenticator failed for H=(cm-178.232.226.163.get.no) [178.232.226.163]:41740: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.217.204.91
country_id: 2658434
description:
2026-01-02 23:47:03 dovecot_login authenticator failed for H=adsl-89-217-204-91.adslplus.ch [89.217.204.91]:54018: 535 Incorrect authentication data (set_id=admin@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.33.112
country_id: 3144096
description:
2026-01-02 23:47:12 dovecot_login authenticator failed for H=(cm-178.232.33.112.get.no) [178.232.33.112]:40622: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  2 23:48:27 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@colperlab.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<TE9EvGtHgN8jupN+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.71
country_id: 6252001
description:
Jan  2 23:50:26 host2 dovecot[360729]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.71, lip=66.85.158.92, TLS, session=<NnVxw2tHrOjG6xhH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.199.47
country_id: 1269750
description:
Jan  2 23:50:49 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=66.116.199.47, lip=66.85.158.91, session=<yeewxGtHirdCdMcv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.0.142.131
country_id: 1819730
description:
2026-01-02 23:53:05 dovecot_login authenticator failed for H=14-0-142-131.static.pccw-hkt.com [14.0.142.131]:45306: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.133.161.162
country_id: 130758
description:
2026-01-02 23:52:45 dovecot_login authenticator failed for H=([85.133.161.162]) [85.133.161.162]:43772: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.170.173.26
country_id: 1210997
description:
Jan  2 23:56:50 host2 sshd[522303]: Disconnected from invalid user william 103.170.173.26 port 41409 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.53.44.125
country_id: 1643084
description:
Jan  2 23:57:39 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=117.53.44.125, lip=66.85.158.91, session=<rhoa3WtHMMB1NSx9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.128.27.123
country_id: 1880251
description:
Jan  2 23:57:58 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@kiriaswanu.com>, method=PLAIN, rip=178.128.27.123, lip=66.85.158.91, session=<+RRG3mtHdNqygBt7>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.170.173.26
country_id: 1210997
description:
Jan  2 23:59:07 host2 sshd[524881]: Disconnected from invalid user kapsch 103.170.173.26 port 55159 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.210.61.208
country_id: 2802361
description:
Jan  2 23:58:12 host2 sshd[523728]: Disconnected from invalid user ll 35.210.61.208 port 48408 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.178.43.161
country_id: 3017382
description:
Jan  2 23:58:42 host2 sshd[524235]: Disconnected from invalid user test 51.178.43.161 port 51558 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 35.210.61.208
country_id: 2802361
description:
Jan  2 23:59:26 host2 sshd[525207]: Disconnected from invalid user alireza 35.210.61.208 port 49232 [preauth]


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 50.6.249.92
country_id: 6252001
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[50.6.249.92] [Remote Port]=[37674] [Authentication Database]=[mail] [Username]=[support@lakwelholdings.com] (10/10 failures) (blocked until [Sat Jan  3 18:29:27 2026 UTC/Sat Jan  3 23:59:27 2026 LOCAL])


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.178.43.161
country_id: 3017382
description:
Jan  2 23:59:47 host2 sshd[525559]: Disconnected from invalid user ftpuser 51.178.43.161 port 48648 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan  2 23:59:29 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lakwelholdings.com>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<yeaw42tHKpMyBvlc>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.170.173.26
country_id: 1210997
description:
Jan  2 23:59:46 host2 sshd[525534]: Disconnected from invalid user ll 103.170.173.26 port 60989 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.171.9.22
country_id: 1733045
description:
2026-01-02 23:59:58 dovecot_login authenticator failed for H=([183.171.9.22]) [183.171.9.22]:48038: 535 Incorrect authentication data (set_id=office@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.217.144.113
country_id: 1643084
description:
Jan  3 00:01:04 host2 sshd[527250]: Disconnected from invalid user alireza 103.217.144.113 port 51496 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.100.104
country_id: 294640
description:
2026-01-03 00:00:14 dovecot_login authenticator failed for H=(2-55-100-104.orange.net.il) [2.55.100.104]:55568: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.210.61.208
country_id: 2802361
description:
Jan  3 00:00:29 host2 sshd[526673]: Disconnected from invalid user postgre 35.210.61.208 port 48596 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 35.210.61.208
country_id: 2802361
description:
Jan  3 00:01:02 host2 sshd[527232]: Disconnected from invalid user kapsch 35.210.61.208 port 34162 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.178.43.161
country_id: 3017382
description:
Jan  3 00:01:18 host2 sshd[527470]: Disconnected from invalid user minecraft 51.178.43.161 port 58398 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.210.61.208
country_id: 2802361
description:
Jan  3 00:01:32 host2 sshd[527705]: Disconnected from invalid user proradis 35.210.61.208 port 47962 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.170.173.26
country_id: 1210997
description:
Jan  3 00:01:39 host2 sshd[527808]: Disconnected from invalid user user53 103.170.173.26 port 50238 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 20.56.1.201
country_id: 2750405
description:
Jan  3 00:01:51 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@monarchdss.com>, method=PLAIN, rip=20.56.1.201, lip=66.85.158.91, session=<pBIn7GtHgt4UOAHJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  3 00:02:06 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<8O4I7WtHdIxnmud6>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 35.210.61.208
country_id: 2802361
description:
Jan  3 00:02:35 host2 sshd[528928]: Disconnected from invalid user jy 35.210.61.208 port 47326 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.178.43.161
country_id: 3017382
description:
Jan  3 00:02:48 host2 sshd[529201]: Disconnected from invalid user admin 51.178.43.161 port 39932 [preauth]


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 103.154.231.122
country_id: 1643084
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[103.154.231.122] [Remote Port]=[35956] [Authentication Database]=[mail] [Username]=[info@askinternationalconsortium.com] (10/10 failures) (blocked until [Sat Jan  3 18:32:04 2026 UTC/Sun Jan  4 00:02:04 2026 LOCAL])


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.217.144.113
country_id: 1643084
description:
Jan  3 00:03:21 host2 sshd[530007]: Disconnected from invalid user tempuser 103.217.144.113 port 37846 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.233.140.250
country_id: 3469034
description:
2026-01-03 00:03:24 dovecot_login authenticator failed for H=([181.233.140.250]) [181.233.140.250]:57686: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.178.43.161
country_id: 3017382
description:
Jan  3 00:03:49 host2 sshd[530551]: Disconnected from invalid user devops 51.178.43.161 port 37018 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.220.126
country_id: 1269750
description:
2026-01-03 00:03:12 dovecot_login authenticator failed for H=([152.52.220.126]) [152.52.220.126]:35412: 535 Incorrect authentication data (set_id=info@kiriaswanu.com)


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 51.178.43.161
country_id: 3017382
description:
Jan  3 00:03:17 host2 sshd[529947]: Received disconnect from 51.178.43.161 port 52588:11: Bye Bye [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 72.167.34.120
country_id: 6252001
description:
Jan  3 00:03:28 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@monarchdss.com>, method=PLAIN, rip=72.167.34.120, lip=66.85.158.91, session=<Wc7t8WtHEIZIpyJ4>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 72.167.34.120
country_id: 6252001
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[72.167.34.120] [Remote Port]=[34320] [Authentication Database]=[mail] [Username]=[admin@monarchdss.com] (10/10 failures) (blocked until [Sat Jan  3 18:33:26 2026 UTC/Sun Jan  4 00:03:26 2026 LOCAL])


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.170.173.26
country_id: 1210997
description:
Jan  3 00:04:08 host2 sshd[530985]: Disconnected from invalid user postgre 103.170.173.26 port 45321 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 114.7.163.154
country_id: 1643084
description:
Jan  3 00:03:23 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=114.7.163.154, lip=66.85.158.91, session=<tWek8WtHTNFyB6Oa>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.217.144.113
country_id: 1643084
description:
Jan  3 00:04:51 host2 sshd[531851]: Disconnected from invalid user saiful 103.217.144.113 port 39988 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.82.89
country_id: 6252001
description:
Jan  3 00:04:54 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@maximsholdings.com>, method=PLAIN, rip=47.253.82.89, lip=66.85.158.91, session=<snET92tHmrIv/VJZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.82.89
country_id: 6252001
description:
Jan  3 00:05:22 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@dataesite.lk>, method=PLAIN, rip=47.253.82.89, lip=66.85.158.91, session=<HEi/+GtH8N8v/VJZ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.217.144.113
country_id: 1643084
description:
Jan  3 00:05:36 host2 sshd[532996]: Disconnected from invalid user william 103.217.144.113 port 43440 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  3 00:06:01 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@bostonlanka.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<pEQT+2tHkIVn9M4G>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 104.236.196.180
country_id: 6252001
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[104.236.196.180] [Remote Port]=[38686] [Authentication Database]=[mail] [Username]=[admin@monarchdss.com] (10/10 failures) (blocked until [Sat Jan  3 18:36:24 2026 UTC/Sun Jan  4 00:06:24 2026 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Jan  3 00:06:26 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@monarchdss.com>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<vN1+/GtHHpdo7MS0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.216.119.134
country_id: 1819730
description:
Jan  3 00:09:12 host2 sshd[536955]: Disconnected from invalid user jira 185.216.119.134 port 46998 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.219.227
country_id: 6251999
description:
Jan  3 00:11:28 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=158.69.219.227, lip=66.85.158.91, session=<2mqMDmxH/IyeRdvj>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.216.119.134
country_id: 1819730
description:
Jan  3 00:11:48 host2 sshd[539832]: Disconnected from invalid user redmine 185.216.119.134 port 54576 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.216.119.134
country_id: 1819730
description:
Jan  3 00:12:26 host2 sshd[540584]: Disconnected from invalid user emma 185.216.119.134 port 38056 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Jan  3 00:12:58 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@rehanseo.online>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<hJTlE2xHap8v+wDY>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 47.251.0.216
country_id: 6252001
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[47.251.0.216] [Remote Port]=[40810] [Authentication Database]=[mail] [Username]=[support@rehanseo.online] (10/10 failures) (blocked until [Sat Jan  3 18:42:56 2026 UTC/Sun Jan  4 00:12:56 2026 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Jan  3 00:13:30 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<V7jXFWxHNuIvTJuG>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  3 00:15:14 host2 sshd[544229]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 47.251.13.59
country_id: 6252001
description:
Jan  3 00:15:29 host2 dovecot[360729]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=47.251.13.59, lip=66.85.158.91, session=<YSwEHWxH4Ngv+w07>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.193.147.37
country_id: 1269750
description:
2026-01-03 00:15:38 dovecot_login authenticator failed for H=([203.193.147.41]) [203.193.147.37]:50183: 535 Incorrect authentication data (set_id=info@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.23.73.205
country_id: 6252001
description:
2026-01-03 00:15:51 dovecot_login authenticator failed for H=([209.23.73.205]) [209.23.73.205]:36642: 535 Incorrect authentication data (set_id=info)


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 103.164.20.42
country_id: 1643084
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[103.164.20.42] [Remote Port]=[39372] [Authentication Database]=[mail] [Username]=[contact@melanifinefood.com] (10/10 failures) (blocked until [Sat Jan  3 18:46:48 2026 UTC/Sun Jan  4 00:16:48 2026 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Jan  3 00:16:50 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<jUK3IWxHzJlnpBQq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.227
country_id: 1819730
description:
2026-01-03 00:19:29 dovecot_login authenticator failed for H=227.42.246.220.static.netvigator.com [220.246.42.227]:51336: 535 Incorrect authentication data (set_id=test@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
country_id: 1643084
description:
2026-01-03 00:19:46 dovecot_login authenticator failed for H=(ip-103-29-185-162.pascalwave.com) [103.29.185.162]:37602: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.170.50.2
country_id: 3932488
description:
2026-01-03 00:19:59 dovecot_login authenticator failed for H=([45.170.50.2]) [45.170.50.2]:45171: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.251.249.79
country_id: 2300660
description:
2026-01-03 00:20:12 dovecot_login authenticator failed for H=([197.251.249.79]) [197.251.249.79]:35738: 535 Incorrect authentication data (set_id=admin@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  3 00:21:52 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@bostonlanka.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<BMS9M2xHVLyi8GQy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.192.166
country_id: 1269750
description:
2026-01-03 00:22:52 dovecot_login authenticator failed for H=([27.123.105.234]) [128.185.192.166]:39362: 535 Incorrect authentication data (set_id=bostonlanka@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.161.184.46
country_id: 3865483
description:
2026-01-03 00:23:14 dovecot_login authenticator failed for H=([131.161.184.46]) [131.161.184.46]:47132: 535 Incorrect authentication data (set_id=bostonlanka)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Jan  3 00:23:48 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lezzarotech.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<PtGuOmxH6m8vTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.53.44.125
country_id: 1643084
description:
Jan  3 00:23:56 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@lezzarotech.com>, method=PLAIN, rip=117.53.44.125, lip=66.85.158.91, session=<hwIcO2xHENp1NSx9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.184.218.49
country_id: 3469034
description:
2026-01-03 00:24:58 dovecot_login authenticator failed for H=([179.184.218.49]) [179.184.218.49]:56309: 535 Incorrect authentication data (set_id=office@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  3 00:24:37 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@colperlab.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<uGOPPWxHnOUjupN+>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 35.186.147.126
country_id: 1880251
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[35.186.147.126] [Remote Port]=[58780] [Authentication Database]=[mail] [Username]=[contact@colperlab.com] (10/10 failures) (blocked until [Sat Jan  3 18:54:35 2026 UTC/Sun Jan  4 00:24:35 2026 LOCAL])


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.228
country_id: 1269750
description:
2026-01-03 00:25:14 dovecot_login authenticator failed for H=(nsg-corporate-228.228.187.122.airtel.in) [122.187.228.228]:35113: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 54.38.190.246
country_id: 3017382
description:
Jan  3 00:26:15 host2 sshd[555952]: Disconnected from invalid user louwg 54.38.190.246 port 37148 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.109.56.72
country_id: 6252001
description:
2026-01-03 00:27:06 dovecot_login authenticator failed for H=(dfw-206-109-56-72.ip4.99.network) [206.109.56.72]:37668: 535 Incorrect authentication data (set_id=contacto@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.0.90.81
country_id: 2077456
description:
2026-01-03 00:27:21 dovecot_login authenticator failed for H=210.0.90.81.static.nexnet.net.au [210.0.90.81]:38024: 535 Incorrect authentication data (set_id=contacto)


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 66.116.199.47
country_id: 1269750
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[66.116.199.47] [Remote Port]=[39842] [Authentication Database]=[mail] [Username]=[contact@askinternationalconsortium.com] (10/10 failures) (blocked until [Sat Jan  3 18:59:12 2026 UTC/Sun Jan  4 00:29:12 2026 LOCAL])


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 54.38.190.246
country_id: 3017382
description:
Jan  3 00:29:37 host2 sshd[559087]: Disconnected from invalid user cristian 54.38.190.246 port 37596 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.199.47
country_id: 1269750
description:
Jan  3 00:29:14 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@askinternationalconsortium.com>, method=PLAIN, rip=66.116.199.47, lip=66.85.158.91, session=<a9MZTmxHoptCdMcv>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 54.38.190.246
country_id: 3017382
description:
Jan  3 00:30:11 host2 sshd[559747]: Disconnected from invalid user move 54.38.190.246 port 55734 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.192
country_id: 6252001
description:
Jan  3 00:30:25 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.192, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<tuxsUmxHYdjN0h/A>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.223
country_id: 6252001
description:
Jan  3 00:31:09 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.223, lip=66.85.158.92, session=<0mQNVWxH1VJAPpzf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 54.38.190.246
country_id: 3017382
description:
Jan  3 00:31:12 host2 sshd[560883]: Disconnected from invalid user ehsan 54.38.190.246 port 57484 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.222
country_id: 6252001
description:
Jan  3 00:31:20 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.222, lip=66.85.158.92, TLS: Connection closed, session=<E5OzVWxHEI9APpze>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.134
country_id: 6252001
description:
Jan  3 00:33:14 host2 dovecot[360729]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 1 secs): user=<>, rip=66.132.153.134, lip=66.85.158.92, session=<Gpt9XGxHeLlChJmG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.212.178
country_id: 732800
description:
2026-01-03 00:33:39 dovecot_login authenticator failed for H=([185.255.212.178]) [185.255.212.178]:1406: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.57
country_id: 6252001
description:
Jan  3 00:33:53 host2 dovecot[360729]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=167.94.146.57, lip=66.85.158.92, session=<zIHRXmxHDMmnXpI5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.170.251.33
country_id: 2017370
description:
2026-01-03 00:33:53 dovecot_login authenticator failed for H=(178.170.251.33.leadertelecom.ru) [178.170.251.33]:58176: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.82.194
country_id: 1269750
description:
2026-01-03 00:33:53 dovecot_login authenticator failed for H=([59.145.171.168]) [182.78.82.194]:39834: 535 Incorrect authentication data (set_id=contact@epid.gov.lk)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  3 00:33:13 host2 pure-ftpd[562583]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.166.78
country_id: 1819730
description:
2026-01-03 00:34:12 dovecot_login authenticator failed for H=(223-197-166-78.static.imsbiz.com) [223.197.166.78]:60699: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.224.242.137
country_id: 2635167
description:
2026-01-03 00:35:19 dovecot_login authenticator failed for H=([109.224.242.136]) [109.224.242.137]:51386: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.160.166.237
country_id: 1820814
description:
2026-01-03 00:35:48 dovecot_login authenticator failed for H=(237-166.adsl.static.espeed.com.bn) [119.160.166.237]:37738: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.76.55.177
country_id: 3175395
description:
2026-01-03 00:35:09 dovecot_login authenticator failed for H=([151.76.55.177]) [151.76.55.177]:41068: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan  3 00:37:05 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lakwelholdings.com>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<VRApamxHTLYyBvlc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.128.27.123
country_id: 1880251
description:
Jan  3 00:38:47 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=178.128.27.123, lip=66.85.158.91, session=<TXpBcGxHktOygBt7>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 178.128.27.123
country_id: 1880251
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[178.128.27.123] [Remote Port]=[54162] [Authentication Database]=[mail] [Username]=[contact@kiriaswanu.com] (10/10 failures) (blocked until [Sat Jan  3 19:08:45 2026 UTC/Sun Jan  4 00:38:45 2026 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  3 00:39:58 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@askinternationalconsortium.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<nieCdGxHcJdnmud6>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 20.56.1.201
country_id: 2750405
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[20.56.1.201] [Remote Port]=[59442] [Authentication Database]=[mail] [Username]=[admin@monarchdss.com] (10/10 failures) (blocked until [Sat Jan  3 19:09:52 2026 UTC/Sun Jan  4 00:39:52 2026 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 20.56.1.201
country_id: 2750405
description:
Jan  3 00:39:54 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@monarchdss.com>, method=PLAIN, rip=20.56.1.201, lip=66.85.158.91, session=<JrE2dGxHMugUOAHJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 72.167.34.120
country_id: 6252001
description:
Jan  3 00:41:12 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@monarchdss.com>, method=PLAIN, rip=72.167.34.120, lip=66.85.158.91, session=<ShPqeGxHDpdIpyJ4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.82.89
country_id: 6252001
description:
Jan  3 00:42:06 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@maximsholdings.com>, method=PLAIN, rip=47.253.82.89, lip=66.85.158.91, session=<oq0efGxHcoYv/VJZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.82.89
country_id: 6252001
description:
Jan  3 00:42:34 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@dataesite.lk>, method=PLAIN, rip=47.253.82.89, lip=66.85.158.91, session=<i6bKfWxHxMQv/VJZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 114.7.163.154
country_id: 1643084
description:
Jan  3 00:43:34 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@essenceceylontea.com>, method=PLAIN, rip=114.7.163.154, lip=66.85.158.91, session=<IG9egWxH7N5yB6Oa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Jan  3 00:44:38 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@monarchdss.com>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<O0EwhWxHyIto7MS0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.191.100
country_id: 3144096
description:
2026-01-03 00:45:07 dovecot_login authenticator failed for H=(cm-84.213.191.100.get.no) [84.213.191.100]:52339: 535 Incorrect authentication data (set_id=postmaster@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.98.41.27
country_id: 1269750
description:
2026-01-03 00:45:16 dovecot_login authenticator failed for H=([59.98.41.27]) [59.98.41.27]:46498: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  3 00:45:49 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@bostonlanka.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<HBpjiWxHkrFn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.219.227
country_id: 6251999
description:
Jan  3 00:48:55 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=158.69.219.227, lip=66.85.158.91, session=<gLJ5lGxHiNeeRdvj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.38.0.39
country_id: 6252001
description:
2026-01-03 00:49:03 dovecot_login authenticator failed for H=([45.38.0.39]) [45.38.0.39]:3717: 535 Incorrect authentication data (set_id=contact@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.173.78.90
country_id: 2510769
description:
2026-01-03 00:50:08 dovecot_login authenticator failed for H=(90.pool90-173-78.static.orange.es) [90.173.78.90]:34563: 535 Incorrect authentication data (set_id=office@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.61.215.87
country_id: 3469034
description:
2026-01-03 00:49:13 dovecot_login authenticator failed for H=201-61-215-87.bbone.telesp.net.br [201.61.215.87]:43577: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.30.170
country_id: 3144096
description:
2026-01-03 00:50:01 dovecot_login authenticator failed for H=(cm-178.232.30.170.get.no) [178.232.30.170]:44967: 535 Incorrect authentication data (set_id=support@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.157.158
country_id: 1269750
description:
2026-01-03 00:50:12 dovecot_login authenticator failed for H=([128.185.217.150]) [125.19.157.158]:38820: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.85.43.162
country_id: 3686110
description:
2026-01-03 00:50:22 dovecot_login authenticator failed for H=([190.85.43.162]) [190.85.43.162]:57605: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Jan  3 00:50:53 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@rehanseo.online>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<LB6Hm2xHRsUv+wDY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.248.111.238
country_id: 6252001
description:
2026-01-03 00:51:50 dovecot_plain authenticator failed for H=(seyncosed) [38.248.111.238]:40143: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-01-03 00:51:54 dovecot_plain authenticator failed for H=(preed) [64.72.74.162]:36800: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.217.144.65
country_id: 1643084
description:
Jan  3 00:52:14 host2 sshd[583125]: Disconnected from invalid user practice 103.217.144.65 port 34326 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Jan  3 00:52:33 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<DBx6oWxHUBIvTJuG>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.198.76.173
country_id: 6252001
description:
Jan  3 00:52:13 host2 sshd[583129]: Disconnected from invalid user bb 143.198.76.173 port 45464 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 175.100.107.238
country_id: 1831722
description:
Jan  3 00:53:49 host2 dovecot[360729]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=175.100.107.238, lip=66.85.158.91, session=<5zbjpWxHeO2vZGvu>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.98.174
country_id: 1269750
description:
2026-01-03 00:54:04 dovecot_login authenticator failed for H=(nsg-corporate-217.166.185.122.airtel.in) [27.123.98.174]:43244: 535 Incorrect authentication data (set_id=postmaster@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 122.187.226.240
country_id: 1269750
description:
Jan  3 00:54:15 host2 dovecot[360729]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 24 secs): user=<hr>, method=PLAIN, rip=122.187.226.240, lip=66.85.158.91, TLS, session=<Wqw+pmxHE5Z6u+Lw>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.109
country_id: 1814991
description:
Jan  3 00:56:06 host2 dovecot[360729]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=94.231.206.109, lip=66.85.158.92, session=<TE5NrmxH0eZe585t>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.37
country_id: 1814991
description:
Jan  3 00:55:40 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=94.231.206.37, lip=66.85.158.92, session=<L8i9rGxH/91e584l>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.34
country_id: 1814991
description:
Jan  3 00:55:50 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=94.231.206.34, lip=66.85.158.92, session=<vtVcrWxH981e584i>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Jan  3 00:56:04 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<LFoVrmxHXKtnpBQq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.202.54
country_id: 1269750
description:
2026-01-03 00:56:46 dovecot_login authenticator failed for H=(nsg-corporate-54.202.186.122.airtel.in) [122.186.202.54]:45306: 535 Incorrect authentication data (set_id=info@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.198.76.173
country_id: 6252001
description:
Jan  3 00:56:58 host2 sshd[588609]: Disconnected from invalid user thomas 143.198.76.173 port 53566 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.33
country_id: 1814991
description:
Jan  3 00:56:10 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=94.231.206.33, lip=66.85.158.92, session=<Je2BrmxH14Ne584h>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.69.0.72
country_id: 6252001
description:
Jan  3 00:57:10 host2 sshd[588847]: Disconnected from invalid user backupuser 34.69.0.72 port 57320 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.115.194
country_id: 1269750
description:
2026-01-03 00:57:21 dovecot_login authenticator failed for H=([182.95.115.194]) [182.95.115.194]:59622: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.217.144.65
country_id: 1643084
description:
Jan  3 00:57:43 host2 sshd[589353]: Disconnected from invalid user thomas 103.217.144.65 port 38010 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 34.69.0.72
country_id: 6252001
description:
Jan  3 00:57:43 host2 sshd[589384]: Disconnected from invalid user duser 34.69.0.72 port 36660 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.69.0.72
country_id: 6252001
description:
Jan  3 00:58:16 host2 sshd[589923]: Disconnected from invalid user wyf 34.69.0.72 port 50904 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.217.144.65
country_id: 1643084
description:
Jan  3 00:58:32 host2 sshd[590176]: Disconnected from invalid user stack 103.217.144.65 port 38124 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.198.76.173
country_id: 6252001
description:
Jan  3 00:58:56 host2 sshd[590590]: Disconnected from invalid user itadmin 143.198.76.173 port 48066 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  3 01:00:04 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@bostonlanka.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<ChJevGxHmKqi8GQy>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.217.144.65
country_id: 1643084
description:
Jan  3 00:59:15 host2 sshd[590923]: Disconnected from invalid user admin1 103.217.144.65 port 42760 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.18.99.126
country_id: 1269750
description:
2026-01-03 00:59:43 dovecot_login authenticator failed for H=([125.18.99.126]) [125.18.99.126]:52390: 535 Incorrect authentication data (set_id=admin@bostonlanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.217.144.65
country_id: 1643084
description:
Jan  3 01:00:00 host2 sshd[591637]: Disconnected from invalid user backupuser 103.217.144.65 port 56014 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  3 01:01:00 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@colperlab.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<LSG4v2xHwN0jupN+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.117.148
country_id: 1819730
description:
Jan  3 01:01:22 host2 sshd[593581]: Disconnected from invalid user test 101.36.117.148 port 52188 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.101.16.250
country_id: 272103
description:
2026-01-03 01:01:25 dovecot_login authenticator failed for H=([185.134.179.106]) [185.101.16.250]:60057: 535 Incorrect authentication data (set_id=contacto@kiriaswanu.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.71.52.51
country_id: 6252001
description:
Jan  3 01:01:27 host2 sshd[593727]: Disconnected from invalid user admin 34.71.52.51 port 33908 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.224.102
country_id: 1269750
description:
2026-01-03 01:01:41 dovecot_login authenticator failed for H=([27.123.119.99]) [182.95.224.102]:44090: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.198.76.173
country_id: 6252001
description:
Jan  3 01:01:41 host2 sshd[593977]: Disconnected from invalid user mongod 143.198.76.173 port 41448 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.196.50.91
country_id: 3469034
description:
Jan  3 01:02:46 host2 sshd[594978]: Disconnected from invalid user admin 200.196.50.91 port 36026 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Jan  3 01:02:55 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lezzarotech.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<nhGMxmxHlgYvTJuG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.70.19.11
country_id: 3469034
description:
2026-01-03 01:03:20 dovecot_login authenticator failed for H=(45-70-19-11.static.damsolutionsturbo.com.br) [45.70.19.11]:41470: 535 Incorrect authentication data (set_id=bostonlanka@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.16.194.197
country_id: 3865483
description:
Jan  3 01:03:36 host2 sshd[595840]: Disconnected from invalid user git 190.16.194.197 port 51606 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.198.76.173
country_id: 6252001
description:
Jan  3 01:03:42 host2 sshd[595942]: Disconnected from invalid user forum 143.198.76.173 port 52808 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.112.109.248
country_id: 6252001
description:
2026-01-03 01:03:48 dovecot_login authenticator failed for H=(host-24-112-109-248.vyvebroadband.net) [24.112.109.248]:41077: 535 Incorrect authentication data (set_id=bostonlanka)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.117.148
country_id: 1819730
description:
Jan  3 01:05:32 host2 sshd[598062]: Disconnected from invalid user test 101.36.117.148 port 46336 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 200.196.50.91
country_id: 3469034
description:
Jan  3 01:06:06 host2 sshd[598693]: Disconnected from invalid user test 200.196.50.91 port 40962 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 34.71.52.51
country_id: 6252001
description:
Jan  3 01:05:12 host2 sshd[597694]: Received disconnect from 34.71.52.51 port 47412:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.70.82.95
country_id: 1282988
description:
Jan  3 01:06:14 host2 sshd[598784]: Disconnected from invalid user ubuntu 202.70.82.95 port 11146 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.71.52.51
country_id: 6252001
description:
Jan  3 01:06:43 host2 sshd[599418]: Disconnected from invalid user admin 34.71.52.51 port 59736 [preauth]


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 199.229.220.185
country_id: 6251999
description:
2026-01-03 01:07:29 H=([199.229.220.185]) [199.229.220.185]:47084 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<contact@bostonlanka.com> A=dovecot_login:contact@bostonlanka.com rejected RCPT <mail22@winpukpik777.com>: Sender verify failed


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.117.148
country_id: 1819730
description:
Jan  3 01:07:46 host2 sshd[600343]: Disconnected from invalid user admin 101.36.117.148 port 49658 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.199.47
country_id: 1269750
description:
Jan  3 01:08:13 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@askinternationalconsortium.com>, method=PLAIN, rip=66.116.199.47, lip=66.85.158.91, session=<TvmC2WxH+M9CdMcv>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 202.70.82.95
country_id: 1282988
description:
Jan  3 01:09:19 host2 sshd[602105]: Disconnected from invalid user admin 202.70.82.95 port 9748 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 34.71.52.51
country_id: 6252001
description:
Jan  3 01:10:24 host2 sshd[603506]: Received disconnect from 34.71.52.51 port 42704:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.117.148
country_id: 1819730
description:
Jan  3 01:10:42 host2 sshd[603749]: Disconnected from invalid user admin 101.36.117.148 port 53656 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.71.52.51
country_id: 6252001
description:
Jan  3 01:10:57 host2 sshd[603955]: Disconnected from invalid user test 34.71.52.51 port 40286 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.182.130
country_id: 1269750
description:
2026-01-03 01:12:03 dovecot_login authenticator failed for H=([182.95.182.130]) [182.95.182.130]:40300: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.105.160.100
country_id: 6252001
description:
2026-01-03 01:11:50 dovecot_login authenticator failed for H=syn-024-105-160-100.biz.spectrum.com [24.105.160.100]:45326: 535 Incorrect authentication data (set_id=info@bostonlanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 190.16.194.197
country_id: 3865483
description:
Jan  3 01:13:49 host2 sshd[607078]: Disconnected from invalid user admin 190.16.194.197 port 33048 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.71.52.51
country_id: 6252001
description:
Jan  3 01:14:10 host2 sshd[607422]: Disconnected from invalid user ubuntu 34.71.52.51 port 59342 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.117.148
country_id: 1819730
description:
Jan  3 01:14:18 host2 sshd[607592]: Disconnected from invalid user git 101.36.117.148 port 45810 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan  3 01:14:34 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@lakwelholdings.com>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<ajI78GxH9t0yBvlc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.210.118
country_id: 1269750
description:
2026-01-03 01:15:25 dovecot_login authenticator failed for H=([152.52.210.118]) [152.52.210.118]:34250: 535 Incorrect authentication data (set_id=admin@bostonlanka.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  3 01:16:31 host2 sshd[610050]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.226.21
country_id: 1269750
description:
2026-01-03 01:16:08 dovecot_login authenticator failed for H=(nsg-corporate-21.226.187.122.airtel.in) [122.187.226.21]:35050: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.202.110.183
country_id: 798544
description:
Jan  3 01:16:47 host2 dovecot[360729]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=85.202.110.183, lip=66.85.158.91, TLS, session=<HJtJ92xHzLNVym63>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.124.135.48
country_id: 3144096
description:
2026-01-03 01:17:10 dovecot_login authenticator failed for H=([188.124.135.48]) [188.124.135.48]:56150: 535 Incorrect authentication data (set_id=sales@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.253.154
country_id: 1269750
description:
2026-01-03 01:17:21 dovecot_login authenticator failed for H=([125.21.56.137]) [125.19.253.154]:56646: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.190.205.193
country_id: 3469034
description:
Jan  3 01:17:22 host2 dovecot[360729]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<info>, method=PLAIN, rip=45.190.205.193, lip=66.85.158.91, TLS, session=<uvsF+WxHdMktvs3B>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  3 01:18:00 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@askinternationalconsortium.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<zsF4/GxHbt1nmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.128.27.123
country_id: 1880251
description:
Jan  3 01:19:25 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@kiriaswanu.com>, method=PLAIN, rip=178.128.27.123, lip=66.85.158.91, session=<kxqXAW1HJsuygBt7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.171.149.196
country_id: 1733045
description:
2026-01-03 01:19:34 dovecot_login authenticator failed for H=([183.171.149.196]) [183.171.149.196]:60978: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.188.158.216
country_id: 2510769
description:
2026-01-03 01:19:33 dovecot_login authenticator failed for H=([207.188.158.216]) [207.188.158.216]:21054: 535 Incorrect authentication data (set_id=bostonlanka@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.59.26
country_id: 1269750
description:
2026-01-03 01:19:48 dovecot_login authenticator failed for H=([125.23.125.209]) [122.187.59.26]:45192: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 20.56.1.201
country_id: 2750405
description:
Jan  3 01:19:52 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@monarchdss.com>, method=PLAIN, rip=20.56.1.201, lip=66.85.158.91, session=<x70wA21HvqEUOAHJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.162.174
country_id: 2186224
description:
2026-01-03 01:19:54 dovecot_login authenticator failed for H=([121.73.162.174]) [121.73.162.174]:56732: 535 Incorrect authentication data (set_id=bostonlanka)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.82.89
country_id: 6252001
description:
Jan  3 01:19:25 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@maximsholdings.com>, method=PLAIN, rip=47.253.82.89, lip=66.85.158.91, session=<f7SSAW1HiKEv/VJZ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.162.248
country_id: 2186224
description:
2026-01-03 01:21:04 dovecot_login authenticator failed for H=([121.73.162.248]) [121.73.162.248]:33642: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 72.167.34.120
country_id: 6252001
description:
Jan  3 01:21:10 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@monarchdss.com>, method=PLAIN, rip=72.167.34.120, lip=66.85.158.91, session=<BB3ZB21Haq1IpyJ4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.185.170
country_id: 1269750
description:
2026-01-03 01:21:23 dovecot_login authenticator failed for H=([122.184.128.193]) [182.95.185.170]:46060: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Jan  3 01:23:22 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@monarchdss.com>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<Pru1D21HXJ9o7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 114.7.163.154
country_id: 1643084
description:
Jan  3 01:23:39 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@essenceceylontea.com>, method=PLAIN, rip=114.7.163.154, lip=66.85.158.91, session=<q0+0EG1HVOxyB6Oa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  3 01:25:53 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@bostonlanka.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<5OytGG1HlK9n9M4G>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.113.241
country_id: 1819730
description:
Jan  3 01:26:39 host2 sshd[619840]: Disconnected from invalid user fivem 101.36.113.241 port 59372 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.219.227
country_id: 6251999
description:
Jan  3 01:26:51 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=158.69.219.227, lip=66.85.158.91, session=<LhMcHG1HDN+eRdvj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.183.186.200
country_id: 2510769
description:
Jan  3 01:28:03 host2 dovecot[360729]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=5.183.186.200, lip=66.85.158.91, TLS, session=<yxiMH21HxOwFt7rI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Jan  3 01:29:04 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@rehanseo.online>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<DWIVJG1Hjocv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 168.0.224.112
country_id: 3469034
description:
Jan  3 01:28:24 host2 dovecot[360729]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<charanaw>, method=PLAIN, rip=168.0.224.112, lip=66.85.158.91, TLS, session=<UDuyIG1HDuqoAOBw>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.36.113.241
country_id: 1819730
description:
Jan  3 01:29:22 host2 sshd[622882]: Disconnected from invalid user postgres 101.36.113.241 port 42396 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.158
country_id: 1269750
description:
2026-01-03 01:29:33 dovecot_login authenticator failed for H=([125.19.175.68]) [152.52.236.158]:48646: 535 Incorrect authentication data (set_id=contact@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.0.238.190
country_id: 3469034
description:
2026-01-03 01:29:44 dovecot_login authenticator failed for H=(177-0-238-161.bnut3703.dsl.brasiltelecom.net.br) [177.0.238.190]:45155: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.113.241
country_id: 1819730
description:
Jan  3 01:31:06 host2 sshd[624918]: Disconnected from invalid user runner 101.36.113.241 port 49558 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.178.26.161
country_id: 3996063
description:
Jan  3 01:31:40 host2 sshd[625496]: Disconnected from invalid user newuser 189.178.26.161 port 57244 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.113.241
country_id: 1819730
description:
Jan  3 01:31:42 host2 sshd[625537]: Disconnected from invalid user es 101.36.113.241 port 33124 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 54.38.54.78
country_id: 798544
description:
Jan  3 01:32:36 host2 sshd[626500]: Disconnected from invalid user daniele 54.38.54.78 port 55008 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.178.26.161
country_id: 3996063
description:
Jan  3 01:33:17 host2 sshd[627194]: Disconnected from invalid user satya 189.178.26.161 port 36928 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 88.147.30.59
country_id: 3175395
description:
Jan  3 01:33:46 host2 sshd[627740]: Disconnected from invalid user jeff 88.147.30.59 port 45917 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 189.178.26.161
country_id: 3996063
description:
Jan  3 01:33:52 host2 sshd[627842]: Disconnected from invalid user mata 189.178.26.161 port 48982 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Jan  3 01:35:43 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@melanifinefood.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<mK/WO21HgtlnpBQq>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  3 01:35:49 host2 pure-ftpd[629958]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 54.38.54.78
country_id: 798544
description:
Jan  3 01:35:09 host2 sshd[629120]: Disconnected from invalid user newuser 54.38.54.78 port 50380 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.148.2
country_id: 1733045
description:
2026-01-03 01:36:55 dovecot_login authenticator failed for H=([49.124.148.2]) [49.124.148.2]:50238: 535 Incorrect authentication data (set_id=test@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.194.128.158
country_id: 1269750
description:
2026-01-03 01:37:12 dovecot_login authenticator failed for H=(static-158.128.194.14-tataidc.co.in) [14.194.128.158]:54378: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.142
country_id: 6252001
description:
Jan  3 01:37:19 host2 dovecot[360729]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.142, lip=66.85.158.92, TLS: Connection closed, session=<u0mwQW1HxPFChJmO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.215.110.96
country_id: 3144096
description:
2026-01-03 01:37:41 dovecot_login authenticator failed for H=(cm-84.215.110.96.get.no) [84.215.110.96]:49283: 535 Incorrect authentication data (set_id=contacto@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  3 01:37:57 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@colperlab.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<hp7RQ21HgtMjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  3 01:38:42 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@bostonlanka.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<OseDRm1HeIGi8GQy>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.27
country_id: 798549
description:
Jan  3 01:38:51 host2 dovecot[360729]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=85.217.149.27, lip=66.85.158.92, TLS, session=<wVEpR21HzJJV2ZUb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.12.244
country_id: 3144096
description:
2026-01-03 01:40:23 dovecot_login authenticator failed for H=(cm-84.211.12.244.get.no) [84.211.12.244]:53276: 535 Incorrect authentication data (set_id=office@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.16.55
country_id: 3469034
description:
2026-01-03 01:40:41 dovecot_login authenticator failed for H=(177-174-16-55.user.vivozap.com.br) [177.174.16.55]:57680: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.218.54.218
country_id: 6252001
description:
Jan  3 01:41:09 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@venee.lk>, method=PLAIN, rip=104.218.54.218, lip=66.85.158.91, session=<+ppIT21HPpJo2jba>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.64.150
country_id: 1269750
description:
2026-01-03 01:43:30 dovecot_login authenticator failed for H=([125.23.229.42]) [182.78.64.150]:59596: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 88.147.30.59
country_id: 3175395
description:
Jan  3 01:43:49 host2 sshd[637234]: Disconnected from invalid user alina 88.147.30.59 port 57638 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.165.30.226
country_id: 1269750
description:
2026-01-03 01:43:14 dovecot_login authenticator failed for H=([103.165.30.206]) [103.165.30.226]:38896: 535 Incorrect authentication data (set_id=postmaster@kiriaswanu.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.91.246.101
country_id: 1269750
description:
Jan  3 01:44:27 host2 sshd[637726]: Disconnected from invalid user testuser 103.91.246.101 port 48346 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 88.147.30.59
country_id: 3175395
description:
Jan  3 01:46:03 host2 sshd[639877]: Disconnected from invalid user runner 88.147.30.59 port 37634 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.91.246.101
country_id: 1269750
description:
Jan  3 01:46:20 host2 sshd[640099]: Disconnected from invalid user ubuntu 103.91.246.101 port 47838 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.112.235
country_id: 1819730
description:
Jan  3 01:47:21 host2 sshd[641169]: Disconnected from invalid user sshuser 101.36.112.235 port 42706 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.199.47
country_id: 1269750
description:
Jan  3 01:47:39 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@askinternationalconsortium.com>, method=PLAIN, rip=66.116.199.47, lip=66.85.158.91, session=<LTGDZm1H0JNCdMcv>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.36.112.235
country_id: 1819730
description:
Jan  3 01:48:32 host2 sshd[642698]: Disconnected from invalid user runner 101.36.112.235 port 57446 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.112.235
country_id: 1819730
description:
Jan  3 01:49:39 host2 sshd[644021]: Disconnected from invalid user dmdba 101.36.112.235 port 45360 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.112.235
country_id: 1819730
description:
Jan  3 01:50:12 host2 sshd[644765]: Disconnected from invalid user mostafa 101.36.112.235 port 34618 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.132.97.76
country_id: 2264397
description:
2026-01-03 01:50:23 dovecot_login authenticator failed for H=a94-132-97-76.cpe.netcabo.pt [94.132.97.76]:51676: 535 Incorrect authentication data (set_id=contacto@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.176.21.104
country_id: 1269750
description:
2026-01-03 01:50:37 dovecot_login authenticator failed for H=(abts-north-static-104.21.176.122.airtelbroadband.in) [122.176.21.104]:55166: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 88.147.30.59
country_id: 3175395
description:
Jan  3 01:50:39 host2 sshd[645288]: Disconnected from invalid user hari 88.147.30.59 port 47057 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan  3 01:51:41 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lakwelholdings.com>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<ssj1dG1HHsUyBvlc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.174
country_id: 1269750
description:
2026-01-03 01:52:15 dovecot_login authenticator failed for H=([182.95.178.174]) [182.95.178.174]:56380: 535 Incorrect authentication data (set_id=contact@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.121.43
country_id: 3144096
description:
2026-01-03 01:52:25 dovecot_login authenticator failed for H=(cm-178.232.121.43.get.no) [178.232.121.43]:33778: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 130.250.191.201
country_id: 1269750
description:
Jan  3 01:52:44 host2 sshd[647005]: Disconnected from invalid user test 130.250.191.201 port 56046 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.152.57.60
country_id: 2510769
description:
2026-01-03 01:55:12 dovecot_login authenticator failed for H=(cm-staticip-85-152-57-60.telecable.es) [85.152.57.60]:50954: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.94.39.65
country_id: 1269750
description:
2026-01-03 01:56:00 dovecot_login authenticator failed for H=([59.94.39.65]) [59.94.39.65]:53414: 535 Incorrect authentication data (set_id=contact@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  3 01:56:24 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<T+jMhW1HRsZnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.82.89
country_id: 6252001
description:
Jan  3 01:57:02 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@maximsholdings.com>, method=PLAIN, rip=47.253.82.89, lip=66.85.158.91, session=<jWARiG1HKNIv/VJZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.82.89
country_id: 6252001
description:
Jan  3 01:57:30 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@dataesite.lk>, method=PLAIN, rip=47.253.82.89, lip=66.85.158.91, session=<CErAiW1H9Ksv/VJZ>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.180.141.15
country_id: 2264397
description:
Jan  3 01:57:59 host2 dovecot[360729]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=185.180.141.15, lip=66.85.158.91, TLS, session=<tuKfi21HmZ65tI0P>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 130.250.191.201
country_id: 1269750
description:
Jan  3 01:58:00 host2 sshd[650594]: Disconnected from invalid user hadoop 130.250.191.201 port 38272 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.180.141.13
country_id: 2264397
description:
Jan  3 01:58:02 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=185.180.141.13, lip=66.85.158.91, TLS, session=<pnTDi21H7725tI0N>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.180.141.15
country_id: 2264397
description:
Jan  3 01:58:02 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1420918C:SSL routines:tls_early_post_process_client_hello:version too low (no auth attempts in 0 secs): user=<>, rip=185.180.141.15, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1420918C:SSL routines:tls_early_post_process_client_hello:version too low, session=<WFjQi21HW+O5tI0P>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.180.141.12
country_id: 2264397
description:
Jan  3 01:58:01 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=185.180.141.12, lip=66.85.158.91, TLS, session=<nmG7i21HprG5tI0M>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.180.141.14
country_id: 2264397
description:
Jan  3 01:58:03 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=185.180.141.14, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<Ylrei21HbeW5tI0O>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.180.141.12
country_id: 2264397
description:
Jan  3 01:58:07 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=185.180.141.12, lip=66.85.158.91, TLS, session=<xLUQjG1HrYW5tI0M>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.210.215.132
country_id: 3144096
description:
2026-01-03 01:58:11 dovecot_login authenticator failed for H=(cm-84.210.215.132.get.no) [84.210.215.132]:55959: 535 Incorrect authentication data (set_id=support@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.93.84
country_id: 1269750
description:
2026-01-03 01:58:19 dovecot_login authenticator failed for H=([115.240.244.52]) [152.52.93.84]:10400: 535 Incorrect authentication data (set_id=test@kiriaswanu.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 20.56.1.201
country_id: 2750405
description:
Jan  3 01:58:42 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@monarchdss.com>, method=PLAIN, rip=20.56.1.201, lip=66.85.158.91, session=<cTAUjm1H2uwUOAHJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 130.250.191.201
country_id: 1269750
description:
Jan  3 01:58:50 host2 sshd[651161]: Disconnected from invalid user ubuntu 130.250.191.201 port 53434 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.180.141.15
country_id: 2264397
description:
Jan  3 01:58:07 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=185.180.141.15, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher, session=<6tIOjG1HI8O5tI0P>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.218.54.218
country_id: 6252001
description:
Jan  3 01:59:16 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=104.218.54.218, lip=66.85.158.91, session=<+9AQkG1HtKZo2jba>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.128.27.123
country_id: 1880251
description:
Jan  3 02:00:21 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@kiriaswanu.com>, method=PLAIN, rip=178.128.27.123, lip=66.85.158.91, session=<myL6k21HFLeygBt7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.56
country_id: 6252001
description:
Jan  3 02:01:19 host2 dovecot[360729]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=167.94.146.56, lip=66.85.158.91, TLS: Connection closed, session=<LtKGl21HON+nXpI4>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 130.250.191.201
country_id: 1269750
description:
Jan  3 02:01:36 host2 sshd[653118]: Disconnected from invalid user ubuntu 130.250.191.201 port 35480 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.143.17.18
country_id: 6252001
description:
2026-01-03 02:01:42 dovecot_login authenticator failed for H=47-143-17-18.fdr02.elsn.ca.frontiernet.net [47.143.17.18]:41158: 535 Incorrect authentication data (set_id=contact@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.31.197.108
country_id: 6252001
description:
2026-01-03 02:01:51 dovecot_login authenticator failed for H=(173-31-197-108.client.mchsi.com) [173.31.197.108]:55232: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.231.25.64
country_id: 3686110
description:
2026-01-03 02:02:13 dovecot_login authenticator failed for H=(1522312565.colombiatel.co) [152.231.25.64]:38907: 535 Incorrect authentication data (set_id=test@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.123.118
country_id: 1269750
description:
2026-01-03 02:03:30 dovecot_login authenticator failed for H=([122.184.123.118]) [122.184.123.118]:43940: 535 Incorrect authentication data (set_id=admin@kiriaswanu.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 114.7.163.154
country_id: 1643084
description:
Jan  3 02:03:41 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=114.7.163.154, lip=66.85.158.91, session=<+WTcn21HhotyB6Oa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.70.126
country_id: 1269750
description:
2026-01-03 02:03:42 dovecot_login authenticator failed for H=([125.20.232.243]) [182.78.70.126]:46374: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 72.167.34.120
country_id: 6252001
description:
Jan  3 02:03:43 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@monarchdss.com>, method=PLAIN, rip=72.167.34.120, lip=66.85.158.91, session=<kD0AoG1HTMFIpyJ4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Jan  3 02:03:08 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@monarchdss.com>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<59TpnW1HyrBo7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.219.227
country_id: 6251999
description:
Jan  3 02:04:54 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=158.69.219.227, lip=66.85.158.91, session=<gP8+pG1HZN6eRdvj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.248.47.114
country_id: 6252001
description:
2026-01-03 02:05:49 dovecot_login authenticator failed for H=(syn-172-248-047-114.res.spectrum.com) [172.248.47.114]:57624: 535 Incorrect authentication data (set_id=sales@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.75.142.157
country_id: 3017382
description:
2026-01-03 02:05:57 dovecot_login authenticator failed for H=157.ip-51-75-142.eu [51.75.142.157]:51498: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  3 02:06:01 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@bostonlanka.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<dtozqG1HZMhn9M4G>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  3 02:06:57 host2 sshd[657455]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.255.212.31
country_id: 732800
description:
Jan  3 02:06:14 host2 dovecot[360729]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=185.255.212.31, lip=66.85.158.91, TLS, session=<P7kNqG1H69G5/9Qf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.96.198.107
country_id: 3865483
description:
Jan  3 02:06:35 host2 dovecot[360729]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=186.96.198.107, lip=66.85.158.91, TLS, session=<7yw6qW1H1Ki6YMZr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.44.174.254
country_id: 357994
description:
2026-01-03 02:07:33 dovecot_login authenticator failed for H=([41.65.118.172]) [102.44.174.254]:39748: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Jan  3 02:07:33 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@rehanseo.online>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<QXC0rW1HsNIv+wDY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.143.166
country_id: 1819730
description:
2026-01-03 02:07:45 dovecot_login authenticator failed for H=166.143.48.116.static.netvigator.com [116.48.143.166]:37468: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  3 02:14:40 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@colperlab.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<DuUhx21H0DsjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Jan  3 02:15:18 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@melanifinefood.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<X+5xyW1HCsVnpBQq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  3 02:17:17 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@bostonlanka.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<sf+A0G1HiLGi8GQy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.231.243.28
country_id: 6252001
description:
2026-01-03 02:20:44 dovecot_login authenticator failed for H=([50.231.243.28]) [50.231.243.28]:60064: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.72.202.86
country_id: 192950
description:
2026-01-03 02:20:59 dovecot_login authenticator failed for H=([41.72.201.170]) [41.72.202.86]:58142: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-03 02:24:01 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (nosenycate) [87.103.126.54]:50626: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.88.196.91
country_id: 6252001
description:
2026-01-03 02:24:05 dovecot_plain authenticator failed for H=c-73-88-196-91.hsd1.ky.comcast.net (untied) [73.88.196.91]:58448: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan  3 02:24:56 host2 sshd[677422]: Disconnected from invalid user user 2.57.121.25 port 12810 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.199.47
country_id: 1269750
description:
Jan  3 02:26:54 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@askinternationalconsortium.com>, method=PLAIN, rip=66.116.199.47, lip=66.85.158.91, session=<BDvi8m1HxuhCdMcv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.19.12.103
country_id: 2635167
description:
2026-01-03 02:26:17 dovecot_login authenticator failed for H=cpc122100-bmly10-2-0-cust102.2-3.cable.virginm.net [82.19.12.103]:33722: 535 Incorrect authentication data (set_id=support@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.194.26.149
country_id: 1168579
description:
2026-01-03 02:26:29 dovecot_login authenticator failed for H=([45.194.26.149]) [45.194.26.149]:51940: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.20.68
country_id: 6252001
description:
Jan  3 02:27:16 host2 dovecot[360729]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.20.68, lip=66.85.158.91, session=<eVVa9G1HuglBMRRE>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.224.169.28
country_id: 6252001
description:
2026-01-03 02:28:06 dovecot_plain authenticator failed for H=c-71-224-169-28.hsd1.pa.comcast.net (micaltate) [71.224.169.28]:51214: 535 Incorrect authentication data (set_id=sales@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan  3 02:28:32 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lakwelholdings.com>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<Y7S9+G1H1rcyBvlc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.140.54
country_id: 1269750
description:
2026-01-03 02:34:48 dovecot_login authenticator failed for H=(dsl-mp-dynamic-054.140.23.125.airtelbroadband.in) [125.23.140.54]:50026: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.192.245.178
country_id: 1269750
description:
2026-01-03 02:35:00 dovecot_login authenticator failed for H=(dhcp-192-245-178.in2cable.com) [203.192.245.178]:37346: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 154.127.34.194
country_id: 2395170
description:
Jan  3 02:34:11 host2 dovecot[360729]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=154.127.34.194, lip=66.85.158.91, TLS, session=<DroEDG5Hpt+afyLC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.82.89
country_id: 6252001
description:
Jan  3 02:34:17 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@maximsholdings.com>, method=PLAIN, rip=47.253.82.89, lip=66.85.158.91, session=</MlQDW5H3pQv/VJZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  3 02:34:18 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@askinternationalconsortium.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<I+9XDW5H4tBnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.71.48
country_id: 3469034
description:
Jan  3 02:34:41 host2 dovecot[360729]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<charanaw>, method=PLAIN, rip=177.44.71.48, lip=66.85.158.91, TLS, session=<OITJDW5H2M+xLEcw>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.123.109.93
country_id: 732800
description:
2026-01-03 02:36:03 dovecot_login authenticator failed for H=(test) [93.123.109.93]:51604: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.188.102.28
country_id: 298795
description:
2026-01-03 02:36:22 dovecot_login authenticator failed for H=([78.188.102.28]) [78.188.102.28]:54924: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.123.109.93
country_id: 732800
description:
2026-01-03 02:36:34 dovecot_login authenticator failed for H=(test) [93.123.109.93]:58229: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 20.56.1.201
country_id: 2750405
description:
Jan  3 02:37:53 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@monarchdss.com>, method=PLAIN, rip=20.56.1.201, lip=66.85.158.91, session=<Z8owGm5H6IwUOAHJ>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  3 02:38:19 host2 pure-ftpd[692499]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.128.18
country_id: 3144096
description:
2026-01-03 02:39:35 dovecot_login authenticator failed for H=(cm-178.232.128.18.get.no) [178.232.128.18]:43864: 535 Incorrect authentication data (set_id=test@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.25.59.5
country_id: 3469034
description:
2026-01-03 02:39:46 dovecot_login authenticator failed for H=(ip-177-25-59-5.user.vivozap.com.br) [177.25.59.5]:36781: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.128.27.123
country_id: 1880251
description:
Jan  3 02:40:34 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=178.128.27.123, lip=66.85.158.91, session=<k6XCI25HmoiygBt7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.64.65.30
country_id: 2264397
description:
2026-01-03 02:42:03 dovecot_login authenticator failed for H=bl23-65-30.dsl.telepac.pt [144.64.65.30]:4357: 535 Incorrect authentication data (set_id=sales@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.94.69.183
country_id: 2661886
description:
2026-01-03 02:42:11 dovecot_login authenticator failed for H=183-69.soderhamn.com [81.94.69.183]:40030: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Jan  3 02:42:31 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@monarchdss.com>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<y3fEKm5Huo9o7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.219.227
country_id: 6251999
description:
Jan  3 02:42:56 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=158.69.219.227, lip=66.85.158.91, session=<0T1ELG5HYoCeRdvj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 72.167.34.120
country_id: 6252001
description:
Jan  3 02:43:03 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@monarchdss.com>, method=PLAIN, rip=72.167.34.120, lip=66.85.158.91, session=<4UakLG5HVORIpyJ4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 114.7.163.154
country_id: 1643084
description:
Jan  3 02:43:25 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@essenceceylontea.com>, method=PLAIN, rip=114.7.163.154, lip=66.85.158.91, session=<B2nzLW5H5phyB6Oa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.210.46
country_id: 1036973
description:
2026-01-03 02:44:55 dovecot_login authenticator failed for H=(dynamic-adsl.movitel.co.mz) [197.219.210.46]:44556: 535 Incorrect authentication data (set_id=contacto@kiriaswanu.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  3 02:45:55 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<InrjNm5HyLpn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Jan  3 02:45:56 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<ajL+Nm5HANQv+wDY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.175.75
country_id: 99237
description:
2026-01-03 02:47:47 dovecot_login authenticator failed for H=([65.20.175.75]) [65.20.175.75]:40365: 535 Incorrect authentication data (set_id=test@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.83.15
country_id: 3144096
description:
2026-01-03 02:47:55 dovecot_login authenticator failed for H=(cm-178.232.83.15.get.no) [178.232.83.15]:42800: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.24
country_id: 6252001
description:
Jan  3 02:51:56 host2 dovecot[360729]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.24, lip=66.85.158.92, session=<iYuPTG5HMA5BMQEY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  3 02:51:32 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@colperlab.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<95kES25HXl8jupN+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.24
country_id: 6252001
description:
Jan  3 02:52:09 host2 dovecot[360729]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.24, lip=66.85.158.92, TLS: Connection closed, session=<jStPTW5H9ihBMQEY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.116
country_id: 6252001
description:
Jan  3 02:54:00 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.116, lip=66.85.158.91, TLS: Connection closed, session=<DJn0U25HRr5ChJl0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.13.139.61
country_id: 2510769
description:
2026-01-03 02:53:22 dovecot_login authenticator failed for H=61.red-88-13-139.dynamicip.rima-tde.net [88.13.139.61]:54150: 535 Incorrect authentication data (set_id=info@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.158
country_id: 1269750
description:
2026-01-03 02:53:33 dovecot_login authenticator failed for H=([125.19.175.68]) [152.52.236.158]:55840: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Jan  3 02:54:57 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<DfQ3V25HVtlnpBQq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  3 02:55:57 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 5 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<u+WdWm5HhMKi8GQy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2026-01-03 02:56:53 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:62286: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.106.196.150
country_id: 1880251
description:
2026-01-03 02:58:18 dovecot_login authenticator failed for H=(bb128-106-196-150.singnet.com.sg) [128.106.196.150]:22631: 535 Incorrect authentication data (set_id=office@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.17.233.246
country_id: 1269750
description:
2026-01-03 02:58:25 dovecot_login authenticator failed for H=([125.17.233.246]) [125.17.233.246]:52384: 535 Incorrect authentication data (set_id=test@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.112.102
country_id: 1269750
description:
2026-01-03 02:58:37 dovecot_login authenticator failed for H=([182.95.112.102]) [182.95.112.102]:60342: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.116.22
country_id: 1861060
description:
Jan  3 03:00:35 host2 dovecot[360729]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=139.162.116.22, lip=66.85.158.92, TLS: Connection closed, session=<DQ56a25HKJSLonQW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan  3 03:05:50 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lakwelholdings.com>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<2X8jfm5HEsIyBvlc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.199.47
country_id: 1269750
description:
Jan  3 03:06:12 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@askinternationalconsortium.com>, method=PLAIN, rip=66.116.199.47, lip=66.85.158.91, session=<OWlxf25HYIpCdMcv>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  3 03:08:02 host2 sshd[726241]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 103.108.174.168
country_id: 1269750
description:
Jan  3 03:08:06 host2 pure-ftpd[726321]: (?@103.108.174.168) [INFO] New connection from 103.108.174.168


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.253.162.162
country_id: 146669
description:
Jan  3 03:08:09 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=185.253.162.162, lip=66.85.158.91, TLS handshaking: Connection closed, session=<I8uGhm5HEOW5/aKi>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.59.226
country_id: 337996
description:
2026-01-03 03:08:28 dovecot_login authenticator failed for H=([196.189.59.227]) [196.189.59.226]:50782: 535 Incorrect authentication data (set_id=info@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.177.9.119
country_id: 3865483
description:
2026-01-03 03:08:41 dovecot_login authenticator failed for H=(181-177-9-119.fiberway.com.ar) [181.177.9.119]:36162: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.90.124.154
country_id: 3042225
description:
Jan  3 03:08:09 host2 dovecot[360729]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.90.124.154, lip=66.85.158.91, TLS handshaking: Connection closed, session=<e3KGhm5HSsZbWnya>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 37.46.113.253
country_id: 2960313
description:
Jan  3 03:08:09 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=37.46.113.253, lip=66.85.158.91, TLS, session=<vkuGhm5HJuIlLnH9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.64.94
country_id: 3469034
description:
2026-01-03 03:10:24 dovecot_login authenticator failed for H=([189.108.156.41]) [187.8.64.94]:36758: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.253.154
country_id: 1269750
description:
2026-01-03 03:10:10 dovecot_login authenticator failed for H=([182.78.122.253]) [125.19.253.154]:37914: 535 Incorrect authentication data (set_id=support@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.46.186
country_id: 1269750
description:
2026-01-03 03:11:13 dovecot_login authenticator failed for H=([125.21.153.217]) [182.95.46.186]:52550: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.82.89
country_id: 6252001
description:
Jan  3 03:11:33 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@maximsholdings.com>, method=PLAIN, rip=47.253.82.89, lip=66.85.158.91, session=<0DCVkm5HEIkv/VJZ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.17
country_id: 6252001
description:
Jan  3 03:13:55 host2 dovecot[360729]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=205.210.31.17, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<Qt8km25HcNHN0h8R>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.169.53.154
country_id: 6252001
description:
Jan  3 03:14:40 host2 dovecot[360729]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.169.53.154, lip=66.85.158.91, session=<KF3gnW5H2tYUqTWa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.250.191.189
country_id: 458258
description:
2026-01-03 03:14:51 dovecot_login authenticator failed for H=([178.250.191.189]) [178.250.191.189]:47846: 535 Incorrect authentication data (set_id=contacto@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.137.7.97
country_id: 6252001
description:
2026-01-03 03:16:58 dovecot_plain authenticator failed for H=c-73-137-7-97.hsd1.ga.comcast.net (nednes) [73.137.7.97]:34898: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 20.56.1.201
country_id: 2750405
description:
Jan  3 03:17:27 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@monarchdss.com>, method=PLAIN, rip=20.56.1.201, lip=66.85.158.91, session=<kC60p25HqrAUOAHJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.106.196.150
country_id: 1880251
description:
2026-01-03 03:18:30 dovecot_login authenticator failed for H=(bb128-106-196-150.singnet.com.sg) [128.106.196.150]:46371: 535 Incorrect authentication data (set_id=postmaster@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.161
country_id: 2186224
description:
2026-01-03 03:18:47 dovecot_login authenticator failed for H=([121.73.169.161]) [121.73.169.161]:37860: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.247.222.118
country_id: 6252001
description:
[2026-01-03 03:20:04 +0530] info [webmaild] 170.247.222.118 - contact@bostonlanka.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 143.137.164.242
country_id: 6252001
description:
[2026-01-03 03:20:04 +0530] info [webmaild] 143.137.164.242 - bostonlanka@bostonlanka.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.137.230
country_id: 1269750
description:
2026-01-03 03:21:01 dovecot_login authenticator failed for H=(abts-north-static-230.137.160.122.airtelbroadband.in) [122.160.137.230]:34435: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.65.99
country_id: 3144096
description:
2026-01-03 03:20:28 dovecot_login authenticator failed for H=(cm-178.232.65.99.get.no) [178.232.65.99]:36992: 535 Incorrect authentication data (set_id=postmaster@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.128.27.123
country_id: 1880251
description:
Jan  3 03:20:52 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@kiriaswanu.com>, method=PLAIN, rip=178.128.27.123, lip=66.85.158.91, session=<RTPgs25HYpSygBt7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.219.227
country_id: 6251999
description:
Jan  3 03:21:25 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=158.69.219.227, lip=66.85.158.91, session=<pTXFtW5HmNaeRdvj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Jan  3 03:22:12 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@monarchdss.com>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<okuuuG5HgF9o7MS0>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 114.7.163.154
country_id: 1643084
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[114.7.163.154] [Remote Port]=[42708] [Authentication Database]=[mail] [Username]=[test@essenceceylontea.com] (10/10 failures) (blocked until [Sat Jan  3 21:52:19 2026 UTC/Sun Jan  4 03:22:19 2026 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 72.167.34.120
country_id: 6252001
description:
Jan  3 03:22:25 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@monarchdss.com>, method=PLAIN, rip=72.167.34.120, lip=66.85.158.91, session=<w6xvuW5HDJlIpyJ4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 114.7.163.154
country_id: 1643084
description:
Jan  3 03:22:21 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=114.7.163.154, lip=66.85.158.91, session=<438yuW5H1KZyB6Oa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.163.16.165
country_id: 6252001
description:
Jan  3 03:23:17 host2 dovecot[360729]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.163.16.165, lip=66.85.158.92, session=<VPqtvG5HZMwUoxCl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Jan  3 03:24:43 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@rehanseo.online>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<5QGpwW5HWNYv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  3 03:26:01 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<tdBOxm5HIINn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  3 03:28:40 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@colperlab.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<bAnIz25H9EMjupN+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.38.33.1
country_id: 6252001
description:
Jan  3 03:32:04 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.38.33.1, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<Q0Ma3G5HKLAUJiEB>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 150.5.129.10
country_id: 1819730
description:
Jan  3 03:33:03 host2 sshd[753805]: Disconnected from invalid user nemo 150.5.129.10 port 60722 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 150.5.129.10
country_id: 1819730
description:
Jan  3 03:33:40 host2 sshd[754535]: Disconnected from invalid user flink 150.5.129.10 port 44062 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Jan  3 03:35:05 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<q2O25m5Hzt5npBQq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.74.211.27
country_id: 6252001
description:
2026-01-03 03:35:03 dovecot_plain authenticator failed for H=c-75-74-211-27.hsd1.fl.comcast.net (rhuncitan) [75.74.211.27]:60784: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.91.170.52
country_id: 241170
description:
Jan  3 03:34:26 host2 sshd[755497]: Disconnected from invalid user ubuntu 154.91.170.52 port 60090 [preauth]


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 162.240.100.50
country_id: 6252001
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[162.240.100.50] [Remote Port]=[58464] [Authentication Database]=[mail] [Username]=[hr@bostonlanka.com] (10/10 failures) (blocked until [Sat Jan  3 22:04:39 2026 UTC/Sun Jan  4 03:34:39 2026 LOCAL])


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 150.5.129.10
country_id: 1819730
description:
Jan  3 03:34:16 host2 sshd[755281]: Disconnected from invalid user tao 150.5.129.10 port 55628 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  3 03:34:41 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<bl9N5W5HYOSi8GQy>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.89.63.39
country_id: 2635167
description:
Jan  3 03:34:46 host2 sshd[755829]: Disconnected from invalid user logstash 45.89.63.39 port 35044 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 150.5.129.10
country_id: 1819730
description:
Jan  3 03:35:26 host2 sshd[756792]: Disconnected from invalid user ry 150.5.129.10 port 50494 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.134.29.251
country_id: 1880251
description:
Jan  3 03:36:00 host2 sshd[757413]: Disconnected from invalid user hernan 43.134.29.251 port 59212 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 207.154.254.44
country_id: 2921044
description:
Jan  3 03:36:54 host2 sshd[758438]: Disconnected from invalid user runner 207.154.254.44 port 45836 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.91.236.125
country_id: 3686110
description:
Jan  3 03:37:00 host2 sshd[758519]: Disconnected from invalid user thiago 200.91.236.125 port 60569 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.89.63.39
country_id: 2635167
description:
Jan  3 03:37:12 host2 sshd[758843]: Disconnected from invalid user unifi 45.89.63.39 port 54984 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.134.29.251
country_id: 1880251
description:
Jan  3 03:37:17 host2 sshd[758993]: Disconnected from invalid user admin 43.134.29.251 port 55424 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.197.123.123
country_id: 6252001
description:
Jan  3 03:37:38 host2 sshd[759314]: Disconnected from invalid user vncuser 138.197.123.123 port 36434 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 207.154.254.44
country_id: 2921044
description:
Jan  3 03:38:29 host2 sshd[760227]: Disconnected from invalid user ftpuser 207.154.254.44 port 41634 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.119.125
country_id: 3144096
description:
2026-01-03 03:38:31 dovecot_login authenticator failed for H=([46.212.119.125]) [46.212.119.125]:49372: 535 Incorrect authentication data (set_id=postmaster@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.91.170.52
country_id: 241170
description:
Jan  3 03:38:44 host2 sshd[760500]: Disconnected from invalid user deploy 154.91.170.52 port 37500 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.47.2
country_id: 1269750
description:
2026-01-03 03:38:47 dovecot_login authenticator failed for H=([27.123.105.140]) [182.95.47.2]:45986: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.91.170.52
country_id: 241170
description:
Jan  3 03:39:13 host2 sshd[761035]: Disconnected from invalid user frank 154.91.170.52 port 44880 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 119.153.100.234
country_id: 1168579
description:
Jan  3 03:39:27 host2 sshd[761186]: Disconnected from invalid user myuser 119.153.100.234 port 42468 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.91.170.52
country_id: 241170
description:
Jan  3 03:39:39 host2 sshd[761428]: Disconnected from invalid user nirmal 154.91.170.52 port 52154 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.197.123.123
country_id: 6252001
description:
Jan  3 03:40:04 host2 sshd[762009]: Disconnected from invalid user ubuntu 138.197.123.123 port 48372 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 207.154.254.44
country_id: 2921044
description:
Jan  3 03:39:24 host2 sshd[761178]: Disconnected from invalid user deploy 207.154.254.44 port 33714 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 135.237.126.195
country_id: 6252001
description:
Jan  3 03:40:26 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=135.237.126.195, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<ynT5+W5HerWH7X7D>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  3 03:40:37 host2 pure-ftpd[762684]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.134.29.251
country_id: 1880251
description:
Jan  3 03:40:19 host2 sshd[762245]: Disconnected from invalid user unifi 43.134.29.251 port 60028 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.89.63.39
country_id: 2635167
description:
Jan  3 03:41:33 host2 sshd[764005]: Disconnected from invalid user vncuser 45.89.63.39 port 52752 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.91.236.125
country_id: 3686110
description:
Jan  3 03:41:41 host2 sshd[764147]: Disconnected from invalid user castle 200.91.236.125 port 33500 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 200.91.236.125
country_id: 3686110
description:
Jan  3 03:42:21 host2 sshd[764835]: Disconnected from invalid user admin 200.91.236.125 port 41659 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.134.29.251
country_id: 1880251
description:
Jan  3 03:42:41 host2 sshd[765119]: Disconnected from invalid user ubuntu 43.134.29.251 port 52430 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan  3 03:43:20 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@lakwelholdings.com>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<25tABG9HDqkyBvlc>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 119.153.100.234
country_id: 1168579
description:
Jan  3 03:43:32 host2 sshd[766025]: Disconnected from invalid user logstash 119.153.100.234 port 39016 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.89.63.39
country_id: 2635167
description:
Jan  3 03:44:09 host2 sshd[766963]: Disconnected from invalid user myuser 45.89.63.39 port 59734 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 119.153.100.234
country_id: 1168579
description:
Jan  3 03:45:59 host2 sshd[769928]: Disconnected from invalid user admin 119.153.100.234 port 57508 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.199.47
country_id: 1269750
description:
Jan  3 03:46:45 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@askinternationalconsortium.com>, method=PLAIN, rip=66.116.199.47, lip=66.85.158.91, session=<HYtxEG9HmMhCdMcv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.82.89
country_id: 6252001
description:
Jan  3 03:48:54 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@maximsholdings.com>, method=PLAIN, rip=47.253.82.89, lip=66.85.158.91, session=<Gg4hGG9HzIIv/VJZ>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 119.153.100.234
country_id: 1168579
description:
Jan  3 03:49:19 host2 sshd[774801]: Disconnected from invalid user vncuser 119.153.100.234 port 49410 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.82.89
country_id: 6252001
description:
Jan  3 03:49:22 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@dataesite.lk>, method=PLAIN, rip=47.253.82.89, lip=66.85.158.91, session=<4WjQGW9Hmo8v/VJZ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.210.118
country_id: 1269750
description:
2026-01-03 03:49:30 dovecot_login authenticator failed for H=([152.52.210.118]) [152.52.210.118]:54824: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  3 03:50:06 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<MzNuHG9HYsVnmud6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.85.202
country_id: 337996
description:
2026-01-03 03:49:16 dovecot_login authenticator failed for H=([196.191.212.235]) [213.55.85.202]:4082: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.89.63.39
country_id: 2635167
description:
Jan  3 03:53:56 host2 sshd[780488]: Disconnected from invalid user bitrix 45.89.63.39 port 48578 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 102.204.223.49
country_id: 2328926
description:
Jan  3 03:54:21 host2 pure-ftpd[781222]: (?@102.204.223.49) [INFO] New connection from 102.204.223.49


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 20.56.1.201
country_id: 2750405
description:
Jan  3 03:57:08 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@monarchdss.com>, method=PLAIN, rip=20.56.1.201, lip=66.85.158.91, session=<UyecNW9HitYUOAHJ>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  3 03:57:33 host2 sshd[785380]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.219.227
country_id: 6251999
description:
Jan  3 03:59:49 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=158.69.219.227, lip=66.85.158.91, session=<zdMwP29H1JWeRdvj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 114.7.163.154
country_id: 1643084
description:
Jan  3 04:01:19 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=114.7.163.154, lip=66.85.158.91, session=<ERqORG9HerRyB6Oa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.128.27.123
country_id: 1880251
description:
Jan  3 04:01:33 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=178.128.27.123, lip=66.85.158.91, session=<zZVnRW9HHOKygBt7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.128.112.204
country_id: 3017382
description:
2026-01-03 04:01:38 dovecot_login authenticator failed for H=217-128-112-204.ftth.fr.orangecustomers.net [217.128.112.204]:55915: 535 Incorrect authentication data (set_id=office@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 72.167.34.120
country_id: 6252001
description:
Jan  3 04:01:45 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@monarchdss.com>, method=PLAIN, rip=72.167.34.120, lip=66.85.158.91, session=<R8EYRm9HTr9IpyJ4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Jan  3 04:02:39 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@monarchdss.com>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<vQxTSW9H/EBo7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Jan  3 04:03:39 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@rehanseo.online>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<+DLoTG9HSNkv+wDY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.252.85
country_id: 1210997
description:
2026-01-03 04:04:43 dovecot_login authenticator failed for H=([103.115.252.60]) [103.115.252.85]:38137: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.227.166
country_id: 1269750
description:
2026-01-03 04:06:13 dovecot_login authenticator failed for H=([128.185.227.166]) [128.185.227.166]:52548: 535 Incorrect authentication data (set_id=admin@kiriaswanu.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  3 04:05:52 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@colperlab.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<cYjbVG9HGMsjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  3 04:06:04 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<JMOLVW9H9qNn9M4G>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.70.126
country_id: 1269750
description:
2026-01-03 04:06:29 dovecot_login authenticator failed for H=(nsg-corporate-137.222.185.122.airtel.in) [182.78.70.126]:42972: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  3 04:13:26 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@bostonlanka.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<1iLfb29H3o+i8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Jan  3 04:15:09 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<eS/8dW9HnK1npBQq>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.105.128.11
country_id: 6252001
description:
Jan  3 04:16:13 host2 dovecot[360729]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=172.105.128.11, lip=66.85.158.91, session=<do3+eW9H9IWsaYAL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.168.35.240
country_id: 2077456
description:
2026-01-03 04:20:45 dovecot_login authenticator failed for H=([101.168.35.240]) [101.168.35.240]:39008: 535 Incorrect authentication data (set_id=postmaster@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan  3 04:21:08 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@lakwelholdings.com>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<j1Rui29HbpIyBvlc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.252.85
country_id: 1210997
description:
2026-01-03 04:23:47 dovecot_login authenticator failed for H=([103.115.252.60]) [103.115.252.85]:35975: 535 Incorrect authentication data (set_id=admin@kiriaswanu.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.30
country_id: 6252001
description:
Jan  3 04:24:18 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=147.185.132.30, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<fcTZlm9H09OTuYQe>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.82.89
country_id: 6252001
description:
Jan  3 04:25:59 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=47.253.82.89, lip=66.85.158.91, session=<MFXNnG9H1Jwv/VJZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.199.47
country_id: 1269750
description:
Jan  3 04:26:13 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@askinternationalconsortium.com>, method=PLAIN, rip=66.116.199.47, lip=66.85.158.91, session=<wK2jnW9H1J5CdMcv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.82.89
country_id: 6252001
description:
Jan  3 04:26:27 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=47.253.82.89, lip=66.85.158.91, session=<TQNwnm9HzJIv/VJZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  3 04:28:09 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<I+SGpG9H2L9nmud6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.15.216.41
country_id: 6252001
description:
2026-01-03 04:32:28 dovecot_plain authenticator failed for H=c-24-15-216-41.hsd1.il.comcast.net (clion) [24.15.216.41]:33946: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.219.227
country_id: 6251999
description:
Jan  3 04:37:53 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=158.69.219.227, lip=66.85.158.91, session=<gkZRx29HvoeeRdvj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 20.56.1.201
country_id: 2750405
description:
Jan  3 04:38:33 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@monarchdss.com>, method=PLAIN, rip=20.56.1.201, lip=66.85.158.91, session=<pfW7yW9HIJQUOAHJ>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 84.17.41.25
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [webmaild] 84.17.41.25 - hr@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.40.189.43
country_id: 6252001
description:
2026-01-03 04:40:00 dovecot_plain authenticator failed for H=c-68-40-189-43.hsd1.mi.comcast.net (homatia) [68.40.189.43]:46972: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 114.7.163.154
country_id: 1643084
description:
Jan  3 04:40:28 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=114.7.163.154, lip=66.85.158.91, session=<Z+qN0G9HPMJyB6Oa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 72.167.34.120
country_id: 6252001
description:
Jan  3 04:41:38 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@monarchdss.com>, method=PLAIN, rip=72.167.34.120, lip=66.85.158.91, session=<nfO91G9HPuJIpyJ4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Jan  3 04:42:28 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@rehanseo.online>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<rmm0129HKNwv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.128.27.123
country_id: 1880251
description:
Jan  3 04:42:29 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@kiriaswanu.com>, method=PLAIN, rip=178.128.27.123, lip=66.85.158.91, session=<txPG129HtpqygBt7>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  3 04:42:54 host2 pure-ftpd[845371]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  3 04:43:00 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@colperlab.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<Vlan2W9HznIjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Jan  3 04:43:05 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@monarchdss.com>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<F3Ls2W9Hil1o7MS0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.122
country_id: 1269750
description:
2026-01-03 04:45:48 dovecot_login authenticator failed for H=([152.52.236.122]) [152.52.236.122]:36942: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.124.111.122
country_id: 2077456
description:
2026-01-03 04:46:00 dovecot_login authenticator failed for H=27-124-111-122.static.as58511.net [27.124.111.122]:59652: 535 Incorrect authentication data (set_id=contacto@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  3 04:46:14 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<DrM15W9HSN1n9M4G>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.7.229.227
country_id: 6252001
description:
2026-01-03 04:51:45 dovecot_login authenticator failed for H=ip68-7-229-227.sd.sd.cox.net ([127.0.0.1]) [68.7.229.227]:37028: 535 Incorrect authentication data (set_id=info@monarchdss.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.242.142
country_id: 1269750
description:
2026-01-03 04:52:29 dovecot_login authenticator failed for H=([125.19.172.137]) [182.78.242.142]:33076: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  3 04:52:32 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@bostonlanka.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<maK4+29HjMSi8GQy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.201.54.90
country_id: 3469034
description:
2026-01-03 04:52:40 dovecot_login authenticator failed for H=([189.57.81.137]) [186.201.54.90]:38308: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Jan  3 04:55:21 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<tT7HBXBH0r5npBQq>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.2
country_id: 798549
description:
Jan  3 04:55:47 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=85.217.149.2, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<ex5/B3BHWqBV2ZUC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.191.211.33
country_id: 6252001
description:
2026-01-03 04:56:35 dovecot_login authenticator failed for H=(syn-065-191-211-033.res.spectrum.com) [65.191.211.33]:49536: 535 Incorrect authentication data (set_id=office@kiriaswanu.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.1
country_id: 798549
description:
Jan  3 04:56:51 host2 dovecot[360729]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=85.217.149.1, lip=66.85.158.92, TLS: Connection closed, session=<fHRJC3BHAKRV2ZUB>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  3 04:58:06 host2 sshd[867300]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan  3 04:58:09 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@lakwelholdings.com>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<5CfUD3BH4tYyBvlc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.132.127.172
country_id: 2750405
description:
Jan  3 04:57:52 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@rehanseo.online>, method=PLAIN, rip=5.132.127.172, lip=66.85.158.91, session=<2SbLDnBHousFhH+s>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.214.84.80
country_id: 690791
description:
2026-01-03 04:58:32 dovecot_login authenticator failed for H=(91.214.84.80.sky-net.com.ua) [91.214.84.80]:60924: 535 Incorrect authentication data (set_id=contact@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.186.18.251
country_id: 798544
description:
Jan  3 05:01:03 host2 dovecot[360729]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=185.186.18.251, lip=66.85.158.91, TLS, session=<23lDGXBHiKy5uhL7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 181.41.235.115
country_id: 3865483
description:
Jan  3 05:01:25 host2 dovecot[360729]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<charanaw>, method=PLAIN, rip=181.41.235.115, lip=66.85.158.91, TLS, session=<no5yGnBH67C1Ketz>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.1
country_id: 798549
description:
Jan  3 05:02:02 host2 dovecot[360729]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=85.217.149.1, lip=66.85.158.92, session=<OFDNHXBHwNlV2ZUB>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.41.211.48
country_id: 6252001
description:
2026-01-03 05:02:28 dovecot_login authenticator failed for H=48.211.41.34.bc.googleusercontent.com [34.41.211.48]:41644: 535 Incorrect authentication data (set_id=contact@kiriaswanu.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.82.89
country_id: 6252001
description:
Jan  3 05:03:20 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@maximsholdings.com>, method=PLAIN, rip=47.253.82.89, lip=66.85.158.91, session=<TuhZInBHsp4v/VJZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.82.89
country_id: 6252001
description:
Jan  3 05:03:48 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@dataesite.lk>, method=PLAIN, rip=47.253.82.89, lip=66.85.158.91, session=<sfoFJHBHEJMv/VJZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.199.47
country_id: 1269750
description:
Jan  3 05:05:44 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@askinternationalconsortium.com>, method=PLAIN, rip=66.116.199.47, lip=66.85.158.91, session=<ApTrKnBHFNlCdMcv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  3 05:06:21 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@askinternationalconsortium.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<JLIpLXBH2tlnmud6>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 102.204.223.73
country_id: 2328926
description:
Jan  3 05:08:25 host2 pure-ftpd[878681]: (?@102.204.223.73) [INFO] New connection from 102.204.223.73


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.165
country_id: 6252001
description:
Jan  3 05:13:33 host2 dovecot[360729]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.165, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<syX7RnBHr9jN0h+l>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.192.179.175
country_id: 798544
description:
Jan  3 05:14:30 host2 dovecot[360729]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=193.192.179.175, lip=66.85.158.91, TLS, session=<98BxSXBHK6jBwLOv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.0.40.130
country_id: 226074
description:
Jan  3 05:14:52 host2 dovecot[360729]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=196.0.40.130, lip=66.85.158.91, TLS, session=<50mOSnBHsajEACiC>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 158.69.219.227
country_id: 6251999
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[158.69.219.227] [Remote Port]=[46372] [Authentication Database]=[mail] [Username]=[admin@anandaobauae.org] (10/10 failures) (blocked until [Sat Jan  3 23:45:54 2026 UTC/Sun Jan  4 05:15:54 2026 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.219.227
country_id: 6251999
description:
Jan  3 05:15:56 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=158.69.219.227, lip=66.85.158.91, session=<2qZrT3BHJLWeRdvj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.19.12.103
country_id: 2635167
description:
2026-01-03 05:18:34 dovecot_login authenticator failed for H=cpc122100-bmly10-2-0-cust102.2-3.cable.virginm.net [82.19.12.103]:47547: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.191.12
country_id: 99237
description:
2026-01-03 05:18:35 dovecot_login authenticator failed for H=([65.20.191.12]) [65.20.191.12]:54375: 535 Incorrect authentication data (set_id=info@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.6.119
country_id: 3144096
description:
2026-01-03 05:18:57 dovecot_login authenticator failed for H=(cm-84.211.6.119.get.no) [84.211.6.119]:38257: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 20.56.1.201
country_id: 2750405
description:
Jan  3 05:18:59 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@monarchdss.com>, method=PLAIN, rip=20.56.1.201, lip=66.85.158.91, session=<VZNTWnBHitcUOAHJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 114.7.163.154
country_id: 1643084
description:
Jan  3 05:19:50 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@essenceceylontea.com>, method=PLAIN, rip=114.7.163.154, lip=66.85.158.91, session=<EDJgXXBHetByB6Oa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  3 05:20:12 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@colperlab.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<P9muXnBH6NQjupN+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.162
country_id: 2993457
description:
Jan  3 05:22:12 host2 dovecot[360729]: imap-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=194.165.16.162, lip=66.85.158.91, session=<9eHvZXBH0v7CpRCi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 72.167.34.120
country_id: 6252001
description:
Jan  3 05:21:29 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@monarchdss.com>, method=PLAIN, rip=72.167.34.120, lip=66.85.158.91, session=<vLdDY3BH8o9IpyJ4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Jan  3 05:21:31 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@rehanseo.online>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<nBpgY3BHPOAv+wDY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 141.94.237.134
country_id: 3017382
description:
Jan  3 05:21:37 host2 sshd[891900]: Disconnected from invalid user admin123 141.94.237.134 port 35568 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.128.27.123
country_id: 1880251
description:
Jan  3 05:23:20 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=178.128.27.123, lip=66.85.158.91, session=<YOzgaXBHBLWygBt7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Jan  3 05:23:47 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@monarchdss.com>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<cJZ5a3BHGA1o7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  3 05:26:24 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<pIfPdHBH1r9n9M4G>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.56.11.17
country_id: 3865483
description:
Jan  3 05:26:57 host2 sshd[897990]: Disconnected from invalid user oracle 186.56.11.17 port 52138 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.8.241.121
country_id: 2077456
description:
2026-01-03 05:27:59 dovecot_login authenticator failed for H=([161.8.241.121]) [161.8.241.121]:33250: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.202.250.46
country_id: 3469034
description:
2026-01-03 05:28:13 dovecot_login authenticator failed for H=([200.202.250.46]) [200.202.250.46]:60581: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.127.101.225
country_id: 1880251
description:
2026-01-03 05:27:43 dovecot_login authenticator failed for H=([101.127.101.225]) [101.127.101.225]:34290: 535 Incorrect authentication data (set_id=admin@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.253.122
country_id: 1269750
description:
2026-01-03 05:27:45 dovecot_login authenticator failed for H=([128.185.253.122]) [128.185.253.122]:56718: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 186.56.11.17
country_id: 3865483
description:
Jan  3 05:28:39 host2 sshd[900226]: Disconnected from invalid user testadmin 186.56.11.17 port 48934 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.56.11.17
country_id: 3865483
description:
Jan  3 05:29:29 host2 sshd[901269]: Disconnected from invalid user hadoop 186.56.11.17 port 33196 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 141.94.237.134
country_id: 3017382
description:
Jan  3 05:30:46 host2 sshd[902918]: Received disconnect from 141.94.237.134 port 42232:11: Bye Bye [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  3 05:31:22 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<T3GbhnBHZuGi8GQy>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 141.94.237.134
country_id: 3017382
description:
Jan  3 05:32:26 host2 sshd[905114]: Disconnected from invalid user git 141.94.237.134 port 58436 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 141.94.237.134
country_id: 3017382
description:
Jan  3 05:34:10 host2 sshd[907095]: Disconnected from invalid user user 141.94.237.134 port 55998 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan  3 05:34:51 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@lakwelholdings.com>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<FGAPk3BHSpMyBvlc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Jan  3 05:36:07 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@melanifinefood.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<0P2el3BHGu1npBQq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.181.19.144
country_id: 1527747
description:
2026-01-03 05:36:51 dovecot_login authenticator failed for H=(158.181.19.144.mega.kg) [158.181.19.144]:49869: 535 Incorrect authentication data (set_id=test@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.26.53.164
country_id: 1269750
description:
2026-01-03 05:36:54 dovecot_login authenticator failed for H=(abts-mh-dynamic-221.40.169.122.airtelbroadband.in) [103.26.53.164]:46618: 535 Incorrect authentication data (set_id=test@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.168.241.32
country_id: 1269750
description:
2026-01-03 05:37:07 dovecot_login authenticator failed for H=([103.168.241.32]) [103.168.241.32]:45151: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.109.38.143
country_id: 6252001
description:
2026-01-03 05:37:12 dovecot_login authenticator failed for H=143.38.109.208.host.secureserver.net [208.109.38.143]:60146: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.82.89
country_id: 6252001
description:
Jan  3 05:40:58 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@maximsholdings.com>, method=PLAIN, rip=47.253.82.89, lip=66.85.158.91, session=<9RzyqHBHoNkv/VJZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.82.89
country_id: 6252001
description:
Jan  3 05:41:26 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@dataesite.lk>, method=PLAIN, rip=47.253.82.89, lip=66.85.158.91, session=<CG6hqnBHPOQv/VJZ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.118
country_id: 6252001
description:
Jan  3 05:43:36 host2 dovecot[360729]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.118, lip=66.85.158.91, TLS, session=<azWAsnBHYvOTuYR2>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  3 05:45:15 host2 pure-ftpd[919970]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  3 05:44:34 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<GmHJtXBHVNVnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.199.47
country_id: 1269750
description:
Jan  3 05:45:03 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@askinternationalconsortium.com>, method=PLAIN, rip=66.116.199.47, lip=66.85.158.91, session=<GfiFt3BHmLVCdMcv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.139.168.236
country_id: 2510769
description:
2026-01-03 05:45:40 dovecot_login authenticator failed for H=236.red-2-139-168.staticip.rima-tde.net [2.139.168.236]:48545: 535 Incorrect authentication data (set_id=contact@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.208.58
country_id: 1036973
description:
2026-01-03 05:45:28 dovecot_login authenticator failed for H=([197.219.208.58]) [197.219.208.58]:34384: 535 Incorrect authentication data (set_id=contact@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.222.166.212
country_id: 2077456
description:
2026-01-03 05:45:38 dovecot_login authenticator failed for H=(180-222-166-212.static.dsl.net.au) [180.222.166.212]:40177: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.173.254.125
country_id: 1605651
description:
Jan  3 05:46:42 host2 sshd[922038]: Disconnected from invalid user postgres 43.173.254.125 port 36566 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.173.254.125
country_id: 1605651
description:
Jan  3 05:50:51 host2 sshd[926761]: Disconnected from invalid user testftp 43.173.254.125 port 49556 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.138.142
country_id: 3144096
description:
2026-01-03 05:54:09 dovecot_login authenticator failed for H=(cm-178.232.138.142.get.no) [178.232.138.142]:59852: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.219.227
country_id: 6251999
description:
Jan  3 05:54:20 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=158.69.219.227, lip=66.85.158.91, session=<rDnA2HBHVoeeRdvj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.248.47.114
country_id: 6252001
description:
2026-01-03 05:53:53 dovecot_login authenticator failed for H=(syn-172-248-047-114.res.spectrum.com) [172.248.47.114]:47481: 535 Incorrect authentication data (set_id=office@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.91.50
country_id: 1269750
description:
2026-01-03 05:54:10 dovecot_login authenticator failed for H=(nsg-corporate-50.91.186.122.airtel.in) [122.186.91.50]:33098: 535 Incorrect authentication data (set_id=office@kiriaswanu.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  3 05:57:52 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@colperlab.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<5/pg5XBHJFcjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 20.56.1.201
country_id: 2750405
description:
Jan  3 05:59:53 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@monarchdss.com>, method=PLAIN, rip=20.56.1.201, lip=66.85.158.91, session=<DZmc7HBHENQUOAHJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 114.7.163.154
country_id: 1643084
description:
Jan  3 05:59:27 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@essenceceylontea.com>, method=PLAIN, rip=114.7.163.154, lip=66.85.158.91, session=<SuMG63BHft5yB6Oa>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.173.254.125
country_id: 1605651
description:
Jan  3 05:59:38 host2 sshd[937249]: Disconnected from invalid user ubuntu 43.173.254.125 port 45194 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 72.167.34.120
country_id: 6252001
description:
Jan  3 06:01:19 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@monarchdss.com>, method=PLAIN, rip=72.167.34.120, lip=66.85.158.91, session=<vdC08XBHUKVIpyJ4>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.173.254.125
country_id: 1605651
description:
Jan  3 06:01:22 host2 sshd[939451]: Disconnected from invalid user deployer 43.173.254.125 port 49720 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Jan  3 06:00:54 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@rehanseo.online>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<HQ4z8HBHmuUv+wDY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.156.2
country_id: 1269750
description:
2026-01-03 06:02:27 dovecot_login authenticator failed for H=([128.185.217.149]) [125.19.156.2]:54222: 535 Incorrect authentication data (set_id=sales@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.56
country_id: 99237
description:
2026-01-03 06:02:29 dovecot_login authenticator failed for H=([65.20.133.56]) [65.20.133.56]:50310: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.173.254.125
country_id: 1605651
description:
Jan  3 06:02:33 host2 sshd[940937]: Disconnected from invalid user user 43.173.254.125 port 50300 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.77.137.236
country_id: 1605651
description:
2026-01-03 06:02:42 dovecot_login authenticator failed for H=([110.77.137.236]) [110.77.137.236]:56862: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Jan  3 06:05:19 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@monarchdss.com>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<rIQMAHFHmh1o7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.128.27.123
country_id: 1880251
description:
Jan  3 06:05:33 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=178.128.27.123, lip=66.85.158.91, session=<lz3UAHFHJsKygBt7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  3 06:06:31 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<EHpXBHFHEoJn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  3 06:10:25 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<UwlAEnFHhJ+i8GQy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.255.189.56
country_id: 298795
description:
2026-01-03 06:10:50 dovecot_login authenticator failed for H=(88.255.189.56.static.ttnet.com.tr) [88.255.189.56]:49275: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.154
country_id: 3144096
description:
2026-01-03 06:11:01 dovecot_login authenticator failed for H=(cm-84.213.189.154.get.no) [84.213.189.154]:45325: 535 Incorrect authentication data (set_id=support@kiriaswanu.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan  3 06:11:59 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lakwelholdings.com>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<p0fbF3FHqOMyBvlc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2026-01-03 06:15:58 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:61640: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Jan  3 06:17:15 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<mCu3KnFHvsdnpBQq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.82.89
country_id: 6252001
description:
Jan  3 06:18:40 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@maximsholdings.com>, method=PLAIN, rip=47.253.82.89, lip=66.85.158.91, session=<3729L3FH+LIv/VJZ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.47.169
country_id: 1819730
description:
2026-01-03 06:19:22 dovecot_login authenticator failed for H=169.47.246.220.static.netvigator.com [220.246.47.169]:57221: 535 Incorrect authentication data (set_id=postmaster@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.50.221
country_id: 3144096
description:
2026-01-03 06:19:35 dovecot_login authenticator failed for H=(cm-178.232.50.221.get.no) [178.232.50.221]:47665: 535 Incorrect authentication data (set_id=postmaster@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.173.10.75
country_id: 6252001
description:
2026-01-03 06:19:41 dovecot_login authenticator failed for H=([209.173.10.75]) [209.173.10.75]:50016: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  3 06:22:14 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<nkaGPHFHXqJnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.199.47
country_id: 1269750
description:
Jan  3 06:24:23 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@askinternationalconsortium.com>, method=PLAIN, rip=66.116.199.47, lip=66.85.158.91, session=<vpUxRHFHlN5CdMcv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.162.25
country_id: 2186224
description:
2026-01-03 06:28:26 dovecot_login authenticator failed for H=([121.73.162.25]) [121.73.162.25]:50818: 535 Incorrect authentication data (set_id=contacto@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.110.189.45
country_id: 2750405
description:
2026-01-03 06:28:32 dovecot_login authenticator failed for H=([193.110.189.45]) [193.110.189.45]:50822: 535 Incorrect authentication data (set_id=contacto@kiriaswanu.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.184.153.250
country_id: 1733045
description:
Jan  3 06:29:44 host2 sshd[969529]: Disconnected from invalid user rsync 202.184.153.250 port 39120 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 202.184.153.250
country_id: 1733045
description:
Jan  3 06:31:14 host2 sshd[971352]: Disconnected from invalid user virtual 202.184.153.250 port 58340 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.219.227
country_id: 6251999
description:
Jan  3 06:32:42 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=158.69.219.227, lip=66.85.158.91, session=<hpj2YXFH4rieRdvj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.212.178
country_id: 1269750
description:
2026-01-03 06:32:57 dovecot_login authenticator failed for H=([152.52.144.161]) [128.185.212.178]:38080: 535 Incorrect authentication data (set_id=postmaster@kiriaswanu.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.126
country_id: 6252001
description:
Jan  3 06:35:01 host2 dovecot[360729]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.126, lip=66.85.158.92, TLS: Connection closed, session=<6cRhanFHTj9ChJl+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  3 06:35:30 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@colperlab.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<szL0a3FHJl0jupN+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.131.63
country_id: 99237
description:
2026-01-03 06:36:54 dovecot_login authenticator failed for H=([65.20.131.63]) [65.20.131.63]:50693: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.228.134
country_id: 1269750
description:
2026-01-03 06:37:15 dovecot_login authenticator failed for H=(nsg-static-209.69.76.182-airtel.com) [128.185.228.134]:43420: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 114.7.163.154
country_id: 1643084
description:
Jan  3 06:38:48 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@essenceceylontea.com>, method=PLAIN, rip=114.7.163.154, lip=66.85.158.91, session=<nh7Ed3FHVOxyB6Oa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Jan  3 06:40:33 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@rehanseo.online>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<rIgCfnFHQu0v+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 20.56.1.201
country_id: 2750405
description:
Jan  3 06:40:57 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@monarchdss.com>, method=PLAIN, rip=20.56.1.201, lip=66.85.158.91, session=<Mbl2f3FHhLIUOAHJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 72.167.34.120
country_id: 6252001
description:
Jan  3 06:41:20 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@monarchdss.com>, method=PLAIN, rip=72.167.34.120, lip=66.85.158.91, session=<vsfQgHFH7rlIpyJ4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  3 06:46:50 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<vzd4lHFHYKxn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Jan  3 06:47:02 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@monarchdss.com>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<kTg2lXFHnkVo7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.128.27.123
country_id: 1880251
description:
Jan  3 06:47:32 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@kiriaswanu.com>, method=PLAIN, rip=178.128.27.123, lip=66.85.158.91, session=<r7f7lnFH9KiygBt7>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  3 06:47:36 host2 pure-ftpd[988598]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan  3 06:49:10 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@lakwelholdings.com>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<1JHZnHFHUN0yBvlc>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 102.204.223.75
country_id: 2328926
description:
Jan  3 06:48:45 host2 pure-ftpd[989677]: (?@102.204.223.75) [INFO] New connection from 102.204.223.75


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  3 06:49:50 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<SrU6n3FHNpWi8GQy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.174.182.38
country_id: 2077456
description:
2026-01-03 06:51:02 dovecot_login authenticator failed for H=203-174-182-38.ade.static-ipl.aapt.com.au [203.174.182.38]:52256: 535 Incorrect authentication data (set_id=support@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 199.192.123.12
country_id: 6252001
description:
2026-01-03 06:51:13 dovecot_plain authenticator failed for H=(vacomulla) [199.192.123.12]:40024: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.2
country_id: 1269750
description:
2026-01-03 06:53:17 dovecot_login authenticator failed for H=([125.20.223.161]) [152.52.236.2]:42586: 535 Incorrect authentication data (set_id=info@kiriaswanu.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  3 06:56:30 host2 sshd[997666]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.82.89
country_id: 6252001
description:
Jan  3 06:56:28 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@maximsholdings.com>, method=PLAIN, rip=47.253.82.89, lip=66.85.158.91, session=<3pXxtnFHQLcv/VJZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.82.89
country_id: 6252001
description:
Jan  3 06:56:56 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@dataesite.lk>, method=PLAIN, rip=47.253.82.89, lip=66.85.158.91, session=<R4KguHFH6pEv/VJZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Jan  3 06:58:35 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@melanifinefood.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<rzGBvnFHkplnpBQq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  3 07:00:23 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@askinternationalconsortium.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<a0/7xHFH/r9nmud6>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.165.14.197
country_id: 3469034
description:
Jan  3 07:00:59 host2 sshd[1002787]: Disconnected from invalid user hadoop 45.165.14.197 port 22111 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.139.180.139
country_id: 3175395
description:
Jan  3 07:02:12 host2 dovecot[360729]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<charanaw>, method=PLAIN, rip=185.139.180.139, lip=66.85.158.91, TLS, session=<lQmYynFH3gq5i7SL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.60.219.89
country_id: 6252001
description:
2026-01-03 07:02:25 dovecot_login authenticator failed for H=(136-60-219-89.googlefiber.net) [136.60.219.89]:53306: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.205
country_id: 6252001
description:
Jan  3 07:01:55 host2 dovecot[360729]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=198.235.24.205, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<ck2NynFHecXG6xjN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.211.4.53
country_id: 2300660
description:
Jan  3 07:01:54 host2 dovecot[360729]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=41.211.4.53, lip=66.85.158.91, TLS, session=<F5JayXFHhtQp0wQ1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.37.52
country_id: 798544
description:
2026-01-03 07:02:37 dovecot_login authenticator failed for H=89-67-37-52.dynamic.play.pl [89.67.37.52]:34254: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.218.54.218
country_id: 6252001
description:
Jan  3 07:02:43 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=104.218.54.218, lip=66.85.158.91, session=<cWhPzXFHWoJo2jba>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 20.169.85.177
country_id: 6252001
description:
Jan  3 07:03:54 host2 pure-ftpd[1006291]: (?@20.169.85.177) [INFO] New connection from 20.169.85.177


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
country_id: 1643084
description:
2026-01-03 07:04:15 dovecot_login authenticator failed for H=(ip-103-29-185-162.pascalwave.com) [103.29.185.162]:60826: 535 Incorrect authentication data (set_id=office@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.199.47
country_id: 1269750
description:
Jan  3 07:04:15 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@askinternationalconsortium.com>, method=PLAIN, rip=66.116.199.47, lip=66.85.158.91, session=<18DM0nFHbuBCdMcv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.187.205
country_id: 337996
description:
2026-01-03 07:04:26 dovecot_login authenticator failed for H=([196.188.187.205]) [196.188.187.205]:56326: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 205.254.166.35
country_id: 1269750
description:
Jan  3 07:05:04 host2 sshd[1007702]: Disconnected from invalid user readonly 205.254.166.35 port 30115 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 205.254.166.35
country_id: 1269750
description:
Jan  3 07:05:51 host2 sshd[1008655]: Disconnected from invalid user adminuser 205.254.166.35 port 8783 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.172
country_id: 6252001
description:
Jan  3 07:07:00 host2 dovecot[360729]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.172, lip=66.85.158.92, TLS, session=<q+W63HFHCPrG6xis>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.165.14.197
country_id: 3469034
description:
Jan  3 07:07:49 host2 sshd[1011199]: Disconnected from invalid user admin 45.165.14.197 port 55923 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.190.111.235
country_id: 1880251
description:
Jan  3 07:08:31 host2 sshd[1011967]: Disconnected from invalid user mustafa 146.190.111.235 port 58098 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 146.190.111.235
country_id: 1880251
description:
Jan  3 07:09:11 host2 sshd[1012746]: Disconnected from invalid user user2 146.190.111.235 port 37632 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.190.111.235
country_id: 1880251
description:
Jan  3 07:09:48 host2 sshd[1013447]: Disconnected from invalid user bitrix 146.190.111.235 port 50390 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.247.248.154
country_id: 3469034
description:
2026-01-03 07:11:05 dovecot_login authenticator failed for H=([170.247.248.154]) [170.247.248.154]:37033: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.219.227
country_id: 6251999
description:
Jan  3 07:11:15 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=158.69.219.227, lip=66.85.158.91, session=<rl/W63FH4KieRdvj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.101.16.250
country_id: 272103
description:
2026-01-03 07:10:51 dovecot_login authenticator failed for H=([185.134.179.106]) [185.101.16.250]:60409: 535 Incorrect authentication data (set_id=test@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 205.254.166.35
country_id: 1269750
description:
Jan  3 07:13:13 host2 sshd[1017999]: Disconnected from invalid user abc 205.254.166.35 port 26042 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  3 07:13:25 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@colperlab.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<SFqS83FHfmsjupN+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.120.182
country_id: 3144096
description:
2026-01-03 07:14:11 dovecot_login authenticator failed for H=(cm-178.232.120.182.get.no) [178.232.120.182]:40838: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.124.135.48
country_id: 3144096
description:
2026-01-03 07:13:56 dovecot_login authenticator failed for H=([188.124.135.48]) [188.124.135.48]:40189: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.176.4.105
country_id: 1168579
description:
2026-01-03 07:15:08 dovecot_login authenticator failed for H=([182.176.4.105]) [182.176.4.105]:58102: 535 Incorrect authentication data (set_id=contacto@kiriaswanu.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.36.202.100
country_id: 3469034
description:
Jan  3 07:15:17 host2 dovecot[360729]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=138.36.202.100, lip=66.85.158.91, TLS, session=<KD9Q+XFHBLeKJMpk>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 205.254.166.35
country_id: 1269750
description:
Jan  3 07:16:09 host2 sshd[1021897]: Disconnected from invalid user guest 205.254.166.35 port 47679 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.203.211.207
country_id: 1269750
description:
Jan  3 07:15:48 host2 dovecot[360729]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info>, method=PLAIN, rip=103.203.211.207, lip=66.85.158.91, TLS, session=<YaPx+nFHDJNny9PP>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 205.254.166.35
country_id: 1269750
description:
Jan  3 07:17:41 host2 sshd[1023435]: Disconnected from invalid user user2 205.254.166.35 port 34231 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 114.7.163.154
country_id: 1643084
description:
Jan  3 07:18:04 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=114.7.163.154, lip=66.85.158.91, session=<sjMiBHJHyIpyB6Oa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Jan  3 07:20:09 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@rehanseo.online>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<JrKpC3JHvoQv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 72.167.34.120
country_id: 6252001
description:
Jan  3 07:21:20 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@monarchdss.com>, method=PLAIN, rip=72.167.34.120, lip=66.85.158.91, session=<eCnnD3JHPs5IpyJ4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 20.56.1.201
country_id: 2750405
description:
Jan  3 07:21:54 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@monarchdss.com>, method=PLAIN, rip=20.56.1.201, lip=66.85.158.91, session=<ZCLkEXJHutwUOAHJ>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  3 07:23:44 host2 sshd[1031166]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan  3 07:27:13 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@lakwelholdings.com>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<4jrsJHJHpoMyBvlc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  3 07:27:22 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<iWF6JXJHoJ9n9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Jan  3 07:27:29 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@monarchdss.com>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<IJLgJXJHaDVo7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.128.27.123
country_id: 1880251
description:
Jan  3 07:29:12 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=178.128.27.123, lip=66.85.158.91, session=<Ic78K3JH9KWygBt7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  3 07:29:29 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<2uUBLXJH6oai8GQy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.0.40.238
country_id: 1210997
description:
2026-01-03 07:31:01 dovecot_login authenticator failed for H=([49.0.40.238]) [49.0.40.238]:49968: 535 Incorrect authentication data (set_id=contacto@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
country_id: 6252001
description:
2026-01-03 07:32:50 dovecot_plain authenticator failed for H=(undarcur) [24.187.213.29]:42314: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.116.22
country_id: 1861060
description:
Jan  3 07:34:13 host2 dovecot[360729]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=139.162.116.22, lip=66.85.158.91, TLS: Connection closed, session=<WuwPPnJH0t2LonQW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.82.89
country_id: 6252001
description:
Jan  3 07:34:36 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@maximsholdings.com>, method=PLAIN, rip=47.253.82.89, lip=66.85.158.91, session=<TTJWP3JHdM4v/VJZ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.168.35.240
country_id: 2077456
description:
2026-01-03 07:36:46 dovecot_login authenticator failed for H=([101.168.35.240]) [101.168.35.240]:55246: 535 Incorrect authentication data (set_id=contact@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.24
country_id: 2186224
description:
2026-01-03 07:37:07 dovecot_login authenticator failed for H=([121.73.169.24]) [121.73.169.24]:51542: 535 Incorrect authentication data (set_id=contact@kiriaswanu.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  3 07:38:30 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<LCxDTXJHpqlnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Jan  3 07:39:45 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@melanifinefood.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=</VC3UXJHNopnpBQq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.199.47
country_id: 1269750
description:
Jan  3 07:43:18 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@askinternationalconsortium.com>, method=PLAIN, rip=66.116.199.47, lip=66.85.158.91, session=<7jtvXnJHIs5CdMcv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.207.251.240
country_id: 290557
description:
2026-01-03 07:49:00 dovecot_login authenticator failed for H=([94.207.251.240]) [94.207.251.240]:42886: 535 Incorrect authentication data (set_id=admin@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.210.118
country_id: 1269750
description:
2026-01-03 07:49:10 dovecot_login authenticator failed for H=([125.17.48.129]) [152.52.210.118]:60336: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  3 07:49:54 host2 pure-ftpd[1057267]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.219.227
country_id: 6251999
description:
Jan  3 07:50:03 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=158.69.219.227, lip=66.85.158.91, session=<KeOJdnJHitGeRdvj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.123.45.2
country_id: 1269750
description:
2026-01-03 07:50:42 dovecot_login authenticator failed for H=([103.123.45.2]) [103.123.45.2]:38144: 535 Incorrect authentication data (set_id=test@kiriaswanu.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  3 07:51:08 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@colperlab.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<8Ah6enJHwIMjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 114.7.163.154
country_id: 1643084
description:
Jan  3 07:58:02 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=114.7.163.154, lip=66.85.158.91, session=<J3cak3JH3phyB6Oa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.171.86.81
country_id: 2017370
description:
2026-01-03 07:59:36 dovecot_login authenticator failed for H=([93.171.86.81]) [93.171.86.81]:43350: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.1.105.105
country_id: 1269750
description:
2026-01-03 07:59:36 dovecot_login authenticator failed for H=([61.1.105.105]) [61.1.105.105]:42209: 535 Incorrect authentication data (set_id=info@kiriaswanu.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 71.6.146.130
country_id: 6252001
description:
Jan  3 07:58:34 host2 dovecot[360729]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=71.6.146.130, lip=66.85.158.92, session=<AQIrlXJH7s5HBpKC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Jan  3 07:59:14 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@rehanseo.online>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<Zitql3JH0okv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 72.167.34.120
country_id: 6252001
description:
Jan  3 08:00:46 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@monarchdss.com>, method=PLAIN, rip=72.167.34.120, lip=66.85.158.91, session=<QqfmnHJHHOJIpyJ4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 20.56.1.201
country_id: 2750405
description:
Jan  3 08:03:51 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@monarchdss.com>, method=PLAIN, rip=20.56.1.201, lip=66.85.158.91, session=<VW3sp3JHgKIUOAHJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan  3 08:05:45 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lakwelholdings.com>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<n++3rnJHQMsyBvlc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  3 08:08:02 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@bostonlanka.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<OVDltnJHvuFn9M4G>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.113.10
country_id: 1269750
description:
2026-01-03 08:08:11 dovecot_login authenticator failed for H=(abts-north-dynamic-121.212.66.182.airtelbroadband.in) [27.123.113.10]:59782: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Jan  3 08:07:50 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@monarchdss.com>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<KAYutnJHzJxo7MS0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.146.144
country_id: 1819730
description:
2026-01-03 08:07:54 dovecot_login authenticator failed for H=(m121-202-146-144.smartone.com) [121.202.146.144]:48215: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  3 08:09:09 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<3yXbunJHrICi8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.128.27.123
country_id: 1880251
description:
Jan  3 08:11:31 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@kiriaswanu.com>, method=PLAIN, rip=178.128.27.123, lip=66.85.158.91, session=<W9hWw3JHQNOygBt7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.82.89
country_id: 6252001
description:
Jan  3 08:12:59 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@maximsholdings.com>, method=PLAIN, rip=47.253.82.89, lip=66.85.158.91, session=<EbeLyHJHfpEv/VJZ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.41.211.48
country_id: 6252001
description:
2026-01-03 08:16:09 dovecot_login authenticator failed for H=48.211.41.34.bc.googleusercontent.com [34.41.211.48]:50870: 535 Incorrect authentication data (set_id=test@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  3 08:16:10 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<ppT003JHnMZnmud6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.93.84
country_id: 1269750
description:
2026-01-03 08:16:23 dovecot_login authenticator failed for H=([115.240.244.52]) [152.52.93.84]:10400: 535 Incorrect authentication data (set_id=test@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.142.132
country_id: 1733045
description:
2026-01-03 08:16:29 dovecot_login authenticator failed for H=([49.124.142.132]) [49.124.142.132]:53856: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.184.130
country_id: 1269750
description:
2026-01-03 08:16:33 dovecot_login authenticator failed for H=([152.52.238.88]) [182.95.184.130]:52000: 535 Incorrect authentication data (set_id=test@kiriaswanu.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 187.33.59.116
country_id: 3469034
description:
Jan  3 08:17:27 host2 sshd[1087718]: Disconnected from invalid user update 187.33.59.116 port 48921 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.33.59.116
country_id: 3469034
description:
Jan  3 08:19:05 host2 sshd[1089514]: Disconnected from invalid user luser 187.33.59.116 port 34564 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.140.19.22
country_id: 1269750
description:
Jan  3 08:20:36 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=103.140.19.22, lip=66.85.158.91, session=<+/PT43JHXINnjBMW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Jan  3 08:20:42 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@melanifinefood.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<kTgx5HJH9I1npBQq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.199.47
country_id: 1269750
description:
Jan  3 08:22:10 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=66.116.199.47, lip=66.85.158.91, session=<N3Jo6XJHlOhCdMcv>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 129.213.226.156
country_id: 6252001
description:
Jan  3 08:22:39 host2 sshd[1094148]: Disconnected from invalid user prog 129.213.226.156 port 56996 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 154.81.15.190
country_id: 241170
description:
Jan  3 08:24:44 host2 dovecot[360729]: imap-login: Disconnected: Connection closed: read(size=1013) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=154.81.15.190, lip=66.85.158.92, session=<jnK78nJH9LmaUQ++>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.92.249
country_id: 1168579
description:
2026-01-03 08:24:45 dovecot_login authenticator failed for H=(249.92.zcomnetworks.com.pk) [103.148.92.249]:2577: 535 Incorrect authentication data (set_id=contact@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.160.206
country_id: 1269750
description:
2026-01-03 08:24:58 dovecot_login authenticator failed for H=([128.185.23.89]) [125.19.160.206]:49346: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.201.83
country_id: 1733045
description:
2026-01-03 08:25:07 dovecot_login authenticator failed for H=([49.125.201.83]) [49.125.201.83]:58708: 535 Incorrect authentication data (set_id=contact@kiriaswanu.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 129.213.226.156
country_id: 6252001
description:
Jan  3 08:24:24 host2 sshd[1096368]: Disconnected from invalid user vlc 129.213.226.156 port 57480 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.142.154.43
country_id: 1819730
description:
Jan  3 08:27:46 host2 dovecot[360729]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=45.142.154.43, lip=66.85.158.91, TLS handshaking: Connection closed, session=<JiKW/XJHnMstjpor>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.219.227
country_id: 6251999
description:
Jan  3 08:28:48 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=158.69.219.227, lip=66.85.158.91, session=<iTcmAXNHptyeRdvj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  3 08:29:14 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@colperlab.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<NZ+3AnNHWN8jupN+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.121
country_id: 6252001
description:
Jan  3 08:30:10 host2 dovecot[360729]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.235.24.121, lip=66.85.158.92, session=<nz0wBnNHDOrG6xh5>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.22
country_id: 798549
description:
Jan  3 08:31:55 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=85.217.149.22, lip=66.85.158.92, session=<qMVqDHNH9shV2ZUW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.161.232.9
country_id: 6252001
description:
2026-01-03 08:33:57 dovecot_login authenticator failed for H=ip98-161-232-9.ph.ph.cox.net [98.161.232.9]:35330: 535 Incorrect authentication data (set_id=office@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.183.66
country_id: 1269750
description:
2026-01-03 08:33:58 dovecot_login authenticator failed for H=([125.19.183.66]) [125.19.183.66]:52584: 535 Incorrect authentication data (set_id=office@kiriaswanu.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.226
country_id: 6252001
description:
Jan  3 08:36:11 host2 pure-ftpd[1109496]: (?@198.235.24.226) [INFO] New connection from 198.235.24.226


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 114.7.163.154
country_id: 1643084
description:
Jan  3 08:37:36 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=114.7.163.154, lip=66.85.158.91, session=<dx+fIHNHSKdyB6Oa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Jan  3 08:38:23 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@rehanseo.online>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<Cx1uI3NHqI4v+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 72.167.34.120
country_id: 6252001
description:
Jan  3 08:40:15 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@monarchdss.com>, method=PLAIN, rip=72.167.34.120, lip=66.85.158.91, session=<GxkYKnNHDodIpyJ4>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 213.225.7.103
country_id: 2782113
description:
Jan  3 08:42:18 host2 sshd[1116743]: Disconnected from invalid user secretaria 213.225.7.103 port 30084 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 213.225.7.103
country_id: 2782113
description:
Jan  3 08:41:40 host2 sshd[1116121]: Disconnected from invalid user sftp 213.225.7.103 port 30083 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.136.164.157
country_id: 6252001
description:
2026-01-03 08:42:30 dovecot_login authenticator failed for H=c-76-136-164-157.hsd1.il.comcast.net [76.136.164.157]:45939: 535 Incorrect authentication data (set_id=sales@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.214.49.194
country_id: 6252001
description:
2026-01-03 08:42:43 dovecot_login authenticator failed for H=wsip-72-214-49-194.hr.hr.cox.net [72.214.49.194]:58534: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 213.225.7.103
country_id: 2782113
description:
Jan  3 08:42:58 host2 sshd[1117708]: Disconnected from invalid user bull 213.225.7.103 port 30085 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan  3 08:43:01 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lakwelholdings.com>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<SdcCNHNHLuoyBvlc>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.125.120.7
country_id: 2245662
description:
Jan  3 08:44:03 host2 sshd[1118792]: Disconnected from invalid user deluge 154.125.120.7 port 36825 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 213.225.7.103
country_id: 2782113
description:
Jan  3 08:43:37 host2 sshd[1118422]: Disconnected from invalid user lia 213.225.7.103 port 30086 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 20.56.1.201
country_id: 2750405
description:
Jan  3 08:44:24 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@monarchdss.com>, method=PLAIN, rip=20.56.1.201, lip=66.85.158.91, session=<kg31OHNHatcUOAHJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.125.120.7
country_id: 2245662
description:
Jan  3 08:45:18 host2 sshd[1120013]: Disconnected from invalid user spread 154.125.120.7 port 58872 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  3 08:47:05 host2 sshd[1121728]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.125.120.7
country_id: 2245662
description:
Jan  3 08:46:37 host2 sshd[1121238]: Disconnected from invalid user postgres 154.125.120.7 port 52178 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.14
country_id: 3017382
description:
Jan  3 08:47:10 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=91.196.152.14, lip=66.85.158.91, session=<fVbwQnNHS+hbxJgO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.99
country_id: 3017382
description:
Jan  3 08:47:20 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=91.196.152.99, lip=66.85.158.91, session=<SVeNQ3NHa79bxJhj>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.10
country_id: 3017382
description:
Jan  3 08:47:34 host2 dovecot[360729]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=91.196.152.10, lip=66.85.158.91, session=<IDZeRHNHMbhbxJgK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.102
country_id: 3017382
description:
Jan  3 08:47:37 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.196.152.102, lip=66.85.158.91, session=<+4mQRHNH149bxJhm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Jan  3 08:47:46 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@monarchdss.com>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<WC/5RHNH3KNo7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  3 08:48:58 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<ucg1SXNHIotn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  3 08:49:00 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@bostonlanka.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<7c5nSXNHuoui8GQy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.201.237.208
country_id: 1269750
description:
2026-01-03 08:51:20 dovecot_login authenticator failed for H=(abts-west-static-208.237.201.106.airtelbroadband.in) [106.201.237.208]:42196: 535 Incorrect authentication data (set_id=support@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.212.178
country_id: 1269750
description:
2026-01-03 08:51:22 dovecot_login authenticator failed for H=([152.52.144.161]) [128.185.212.178]:53276: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.132.127.172
country_id: 2750405
description:
Jan  3 08:51:24 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@rehanseo.online>, method=PLAIN, rip=5.132.127.172, lip=66.85.158.91, session=<AnAAUnNHoNsFhH+s>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.157.95.30
country_id: 6251999
description:
2026-01-03 08:51:30 dovecot_login authenticator failed for H=d157-95-30.home4.cgocable.net [24.157.95.30]:40874: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.200.42.112
country_id: 1880251
description:
2026-01-03 08:51:40 dovecot_login authenticator failed for H=([118.200.42.112]) [118.200.42.112]:51250: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.82.89
country_id: 6252001
description:
Jan  3 08:51:44 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@maximsholdings.com>, method=PLAIN, rip=47.253.82.89, lip=66.85.158.91, session=<xwYpU3NHPqgv/VJZ>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  3 08:52:38 host2 pure-ftpd[1127572]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  3 08:54:15 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@askinternationalconsortium.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<NEEdXHNHmoBnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.128.27.123
country_id: 1880251
description:
Jan  3 08:53:41 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=178.128.27.123, lip=66.85.158.91, session=<nCgoWnNHVt6ygBt7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 209.38.237.34
country_id: 2921044
description:
Jan  3 08:56:05 host2 dovecot[360729]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=209.38.237.34, lip=66.85.158.91, TLS handshaking: read(size=1026) failed: Connection reset by peer, session=<GvLYYnNHvUPRJu0i>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 138.68.71.16
country_id: 2921044
description:
Jan  3 08:56:40 host2 dovecot[360729]: imap-login: Disconnected: Connection closed (no auth attempts in 20 secs): user=<>, rip=138.68.71.16, lip=66.85.158.91, TLS handshaking: Connection closed, session=<PFDxZHNHuo2KREcQ>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 152.32.190.153
country_id: 1819730
description:
Jan  3 08:58:22 host2 pure-ftpd[1135443]: (?@152.32.190.153) [INFO] New connection from 152.32.190.153


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 152.32.190.153
country_id: 1819730
description:
Jan  3 08:58:23 host2 pure-ftpd[1135461]: (?@152.32.190.153) [INFO] New connection from 152.32.190.153


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.162.191
country_id: 3144096
description:
2026-01-03 08:59:51 dovecot_login authenticator failed for H=(cm-178.232.162.191.get.no) [178.232.162.191]:40719: 535 Incorrect authentication data (set_id=postmaster@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.165.78.31
country_id: 1819730
description:
2026-01-03 08:59:51 dovecot_login authenticator failed for H=([69.165.78.31]) [69.165.78.31]:58466: 535 Incorrect authentication data (set_id=postmaster@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.130.206
country_id: 3144096
description:
2026-01-03 09:00:00 dovecot_login authenticator failed for H=(cm-178.232.130.206.get.no) [178.232.130.206]:57161: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.157.95.30
country_id: 6251999
description:
2026-01-03 09:00:06 dovecot_login authenticator failed for H=d157-95-30.home4.cgocable.net [24.157.95.30]:35118: 535 Incorrect authentication data (set_id=postmaster@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.77.179.130
country_id: 3469034
description:
Jan  3 09:01:06 host2 dovecot[360729]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<charanaw>, method=PLAIN, rip=200.77.179.130, lip=66.85.158.91, TLS, session=<NnXBc3NHQ7TITbOC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.199.47
country_id: 1269750
description:
Jan  3 09:01:07 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@askinternationalconsortium.com>, method=PLAIN, rip=66.116.199.47, lip=66.85.158.91, session=<gmW2dHNHXKNCdMcv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.89.136.182
country_id: 3469034
description:
Jan  3 09:00:46 host2 dovecot[360729]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=190.89.136.182, lip=66.85.158.91, TLS, session=<LRd3cnNHw6O+WYi2>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Jan  3 09:02:06 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@melanifinefood.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<PPw/eHNHDLlnpBQq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.13.220.220
country_id: 6252001
description:
2026-01-03 09:02:57 dovecot_plain authenticator failed for H=c-73-13-220-220.hsd1.de.comcast.net (beriniss) [73.13.220.220]:34640: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 178.62.25.91
country_id: 2635167
description:
Jan  3 09:05:46 host2 sshd[1143477]: Disconnected from invalid user soporte 178.62.25.91 port 48734 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.98.57.141
country_id: 6252001
description:
Jan  3 09:06:20 host2 sshd[1144028]: Disconnected from invalid user mcserver 198.98.57.141 port 33094 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  3 09:07:09 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@colperlab.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<o7FLinNH5m4jupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.219.227
country_id: 6251999
description:
Jan  3 09:07:48 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=158.69.219.227, lip=66.85.158.91, session=<4GipjHNHnJCeRdvj>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.98.57.141
country_id: 6252001
description:
Jan  3 09:07:59 host2 sshd[1145625]: Disconnected from invalid user teamspeak3 198.98.57.141 port 55878 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.135.208.32
country_id: 1861060
description:
2026-01-03 09:08:23 dovecot_login authenticator failed for H=dsl-212-135-208-32.dsl.easynet.co.uk [212.135.208.32]:50734: 535 Incorrect authentication data (set_id=contacto@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.75.110
country_id: 1149361
description:
2026-01-03 09:08:26 dovecot_login authenticator failed for H=([180.94.75.110]) [180.94.75.110]:52253: 535 Incorrect authentication data (set_id=contacto@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.218.47
country_id: 3144096
description:
2026-01-03 09:08:32 dovecot_login authenticator failed for H=(cm-178.232.218.47.get.no) [178.232.218.47]:41086: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.238.213.180
country_id: 2661886
description:
2026-01-03 09:08:37 dovecot_login authenticator failed for H=h85-238-213-180.cust.bredband2.com [85.238.213.180]:35016: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 198.98.57.141
country_id: 6252001
description:
Jan  3 09:08:41 host2 sshd[1146338]: Disconnected from invalid user lc 198.98.57.141 port 39386 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.176.79.137
country_id: 1643084
description:
Jan  3 09:09:35 host2 sshd[1147001]: Disconnected from invalid user user 103.176.79.137 port 44018 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.98.57.141
country_id: 6252001
description:
Jan  3 09:09:58 host2 sshd[1147363]: Disconnected from invalid user diego 198.98.57.141 port 34634 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.176.79.137
country_id: 1643084
description:
Jan  3 09:11:35 host2 sshd[1149347]: Disconnected from invalid user bitrix 103.176.79.137 port 54866 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 195.199.212.141
country_id: 719819
description:
Jan  3 09:11:55 host2 sshd[1149661]: Disconnected from invalid user kingbase 195.199.212.141 port 49452 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.218.54.218
country_id: 6252001
description:
Jan  3 09:12:14 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=104.218.54.218, lip=66.85.158.91, session=<KT1vnHNHiOJo2jba>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 178.62.25.91
country_id: 2635167
description:
Jan  3 09:12:19 host2 sshd[1150061]: Disconnected from invalid user mcserver 178.62.25.91 port 56144 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.103.2.19
country_id: 690791
description:
Jan  3 09:13:51 host2 dovecot[360729]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=176.103.2.19, lip=66.85.158.91, TLS, session=<AlhPoXNHaJawZwIT>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 178.62.25.91
country_id: 2635167
description:
Jan  3 09:13:50 host2 sshd[1151535]: Disconnected from invalid user pavan 178.62.25.91 port 48668 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.121
country_id: 6252001
description:
Jan  3 09:13:52 host2 pure-ftpd[1151569]: (?@66.132.153.121) [INFO] New connection from 66.132.153.121


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.53.165.210
country_id: 3469034
description:
Jan  3 09:14:14 host2 dovecot[360729]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=177.53.165.210, lip=66.85.158.91, TLS, session=<JIeRonNHguuxNaXS>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  3 09:14:25 host2 sshd[1152130]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Jan  3 09:17:28 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@rehanseo.online>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<DLA1r3NHNpIv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 72.167.34.120
country_id: 6252001
description:
Jan  3 09:20:16 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@monarchdss.com>, method=PLAIN, rip=72.167.34.120, lip=66.85.158.91, session=<u9YzuXNHBptIpyJ4>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 69.74.29.21
country_id: 6252001
description:
Jan  3 09:21:45 host2 sshd[1159914]: Disconnected from invalid user sdc 69.74.29.21 port 25976 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 114.7.163.154
country_id: 1643084
description:
Jan  3 09:17:29 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=114.7.163.154, lip=66.85.158.91, session=<dlFJr3NHjrVyB6Oa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan  3 09:21:07 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lakwelholdings.com>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<KQxBvHNH4MEyBvlc>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 207.90.244.28
country_id: 6252001
description:
Jan  3 09:21:32 host2 pure-ftpd[1159724]: (?@207.90.244.28) [INFO] New connection from 207.90.244.28


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.132.181.70
country_id: 1522867
description:
2026-01-03 09:17:01 dovecot_login authenticator failed for H=2.132.181.70.dynamic.telecom.kz [2.132.181.70]:45035: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.233
country_id: 2635167
description:
Jan  3 09:18:27 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 14 secs): user=<>, rip=35.203.210.233, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<bBfWsnNHnsUjy9Lp>


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 207.90.244.28
country_id: 6252001
description:
Jan  3 09:21:33 host2 pure-ftpd[1159744]: (?@207.90.244.28) [INFO] New connection from 207.90.244.28


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.76.188.180
country_id: 1819730
description:
2026-01-03 09:17:07 dovecot_login authenticator failed for H=180.188.76.219.static.netvigator.com [219.76.188.180]:49308: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 158.178.224.92
country_id: 1880251
description:
Jan  3 09:23:45 host2 pure-ftpd[1162010]: (?@158.178.224.92) [INFO] New connection from 158.178.224.92


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 158.178.224.92
country_id: 1880251
description:
Jan  3 09:24:00 host2 pure-ftpd[1162253]: (?@158.178.224.92) [INFO] New connection from 158.178.224.92


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.176.79.137
country_id: 1643084
description:
Jan  3 09:23:23 host2 sshd[1161570]: Disconnected from invalid user server 103.176.79.137 port 56230 [preauth]


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 158.178.224.92
country_id: 1880251
description:
Jan  3 09:24:25 host2 pure-ftpd[1162827]: (?@158.178.224.92) [INFO] New connection from 158.178.224.92


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 158.178.224.92
country_id: 1880251
description:
Jan  3 09:24:23 host2 pure-ftpd[1162791]: (?@158.178.224.92) [INFO] New connection from 158.178.224.92


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 20.56.1.201
country_id: 2750405
description:
Jan  3 09:25:01 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@monarchdss.com>, method=PLAIN, rip=20.56.1.201, lip=66.85.158.91, session=<oT81ynNHOocUOAHJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.210.215.132
country_id: 3144096
description:
2026-01-03 09:25:30 dovecot_login authenticator failed for H=(cm-84.210.215.132.get.no) [84.210.215.132]:43216: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.215.110.96
country_id: 3144096
description:
2026-01-03 09:25:33 dovecot_login authenticator failed for H=(cm-84.215.110.96.get.no) [84.215.110.96]:46030: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.173.117.246
country_id: 6252001
description:
Jan  3 09:25:22 host2 sshd[1163937]: Disconnected from invalid user composeruser 172.173.117.246 port 44802 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.50.226.182
country_id: 3469034
description:
2026-01-03 09:25:22 dovecot_login authenticator failed for H=(189-108-192-66.customer.tdatabrasil.net.br) [187.50.226.182]:48529: 535 Incorrect authentication data (set_id=admin@kiriaswanu.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.233
country_id: 2635167
description:
Jan  3 09:26:24 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.203.210.233, lip=66.85.158.92, TLS, session=<Cr1Fz3NHmO8jy9Lp>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.173.117.246
country_id: 6252001
description:
Jan  3 09:26:38 host2 sshd[1165358]: Disconnected from invalid user test 172.173.117.246 port 42102 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.18.229.251
country_id: 1694008
description:
Jan  3 09:26:41 host2 sshd[1165372]: Disconnected from invalid user user 103.18.229.251 port 44704 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.18.229.251
country_id: 1694008
description:
Jan  3 09:27:30 host2 sshd[1166269]: Disconnected from invalid user sdadmin 103.18.229.251 port 50950 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Jan  3 09:28:17 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@monarchdss.com>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<18vT1XNHyHlo7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  3 09:28:59 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<G7Bj2HNHIKSi8GQy>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.140
country_id: 6252001
description:
Jan  3 09:39:41 host2 pure-ftpd[1168487]: (?@66.132.153.140) [INFO] New connection from 66.132.153.140


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 66.132.153.140
country_id: 6252001
description:
Jan  3 09:39:41 host2 pure-ftpd[1168504]: (?@66.132.153.140) [INFO] New connection from 66.132.153.140


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  3 09:39:41 host2 dovecot[360729]: pop3-login: Disconnected: Inactivity (no auth attempts in 548 secs): user=<>, rip=103.244.206.6, lip=66.85.158.91, session=<q7Gf/nNH2qhn9M4G>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 47.253.82.89
country_id: 6252001
description:
Jan  3 09:39:41 host2 dovecot[360729]: pop3-login: Disconnected: Inactivity (no auth attempts in 555 secs): user=<>, rip=47.253.82.89, lip=66.85.158.91, session=<AGqp/nNHAqUv/VJZ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 196.251.102.24
country_id: 241170
description:
Jan  3 09:40:42 host2 dovecot[360729]: pop3-login: Disconnected: Shutting down (disconnected while authenticating, waited 51 secs): user=<>, method=PLAIN, rip=196.251.102.24, lip=66.85.158.91, session=<yb9i/3NHVOTE+2YY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.116.199.47
country_id: 1269750
description:
Jan  3 09:40:42 host2 dovecot[360729]: pop3-login: Disconnected: Shutting down (disconnected while authenticating, waited 28 secs): user=<>, method=PLAIN, rip=66.116.199.47, lip=66.85.158.91, session=<b2i5AHRHuodCdMcv>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 207.90.244.28
country_id: 6252001
description:
Jan  3 09:41:11 host2 pure-ftpd[1169845]: (?@207.90.244.28) [INFO] New connection from 207.90.244.28


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 207.90.244.28
country_id: 6252001
description:
Jan  3 09:41:12 host2 pure-ftpd[1169869]: (?@207.90.244.28) [INFO] New connection from 207.90.244.28


plugin: ossec
rule: 9703
name: Dovecot is Starting Up.
description:
Jan  3 09:42:36 host2 dovecot[1170103]: master: Dovecot v2.3.21.1 (d492236fa0) starting up for lmtp, imap, pop3 (core dumps disabled)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.188.10
country_id: 3144096
description:
2026-01-03 09:43:12 dovecot_login authenticator failed for H=(cm-178.232.188.10.get.no) [178.232.188.10]:49886: 535 Incorrect authentication data (set_id=contact@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.73.190.94
country_id: 2542007
description:
2026-01-03 09:43:14 dovecot_login authenticator failed for H=([105.73.190.94]) [105.73.190.94]:38589: 535 Incorrect authentication data (set_id=contact@kiriaswanu.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Jan  3 09:43:22 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@melanifinefood.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<d9nUC3RHnJdnpBQq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.49.166
country_id: 1269750
description:
2026-01-03 09:43:36 dovecot_login authenticator failed for H=([182.95.49.166]) [182.95.49.166]:57454: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  3 09:44:29 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 6 secs): user=<hr@colperlab.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<gEqVD3RH+D8jupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.219.227
country_id: 6251999
description:
Jan  3 09:46:58 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@anandaobauae.org>, method=PLAIN, rip=158.69.219.227, lip=66.85.158.91, session=<FY+xGHRHRqKeRdvj>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  3 09:49:17 host2 sshd[1174337]: Disconnected from invalid user admin 2.57.121.112 port 22699 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  3 09:51:36 host2 pure-ftpd[1176422]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.70.122.245
country_id: 1269750
description:
2026-01-03 09:52:02 dovecot_login authenticator failed for H=(abts-mum-static-245.122.70.182.airtelbroadband.in) [182.70.122.245]:42309: 535 Incorrect authentication data (set_id=office@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.114.126
country_id: 1269750
description:
2026-01-03 09:52:06 dovecot_login authenticator failed for H=([27.123.114.126]) [27.123.114.126]:40400: 535 Incorrect authentication data (set_id=office@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.222.51.149
country_id: 2510769
description:
2026-01-03 09:52:11 dovecot_login authenticator failed for H=149.51.222.87.dynamic.jazztel.es [87.222.51.149]:51004: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.38.0.41
country_id: 6252001
description:
2026-01-03 09:52:24 dovecot_login authenticator failed for H=([45.38.0.41]) [45.38.0.41]:4345: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Jan  3 09:56:30 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@rehanseo.online>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<JfjKOnRHzpUv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 114.7.163.154
country_id: 1643084
description:
Jan  3 09:57:37 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=114.7.163.154, lip=66.85.158.91, session=<xBzQPnRHusNyB6Oa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan  3 09:58:52 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lakwelholdings.com>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<pNk/Q3RHgK4yBvlc>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.136
country_id: 6252001
description:
Jan  3 10:00:11 host2 pure-ftpd[1185533]: (?@66.132.153.136) [INFO] New connection from 66.132.153.136


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 72.167.34.120
country_id: 6252001
description:
Jan  3 10:00:12 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@monarchdss.com>, method=PLAIN, rip=72.167.34.120, lip=66.85.158.91, session=<VXoHSHRHVLFIpyJ4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.97.253.246
country_id: 6252001
description:
2026-01-03 10:00:37 dovecot_login authenticator failed for H=syn-024-097-253-246.biz.spectrum.com [24.97.253.246]:51694: 535 Incorrect authentication data (set_id=sales@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.165.30.226
country_id: 1269750
description:
2026-01-03 10:00:53 dovecot_login authenticator failed for H=([103.165.30.206]) [103.165.30.226]:54223: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2026-01-03 10:00:41 dovecot_login authenticator failed for H=([197.219.228.242]) [197.219.228.242]:42458: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.181.196.96
country_id: 3469034
description:
2026-01-03 10:00:59 dovecot_login authenticator failed for H=(96.196.181.45.datasysteminfor.com.br) [45.181.196.96]:60546: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.13.220.220
country_id: 6252001
description:
2026-01-03 10:01:28 dovecot_plain authenticator failed for H=c-73-13-220-220.hsd1.de.comcast.net (dizedolia) [73.13.220.220]:38006: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 20.56.1.201
country_id: 2750405
description:
Jan  3 10:05:48 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@monarchdss.com>, method=PLAIN, rip=20.56.1.201, lip=66.85.158.91, session=<FhAIXHRHaIkUOAHJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.171.99
country_id: 1819730
description:
Jan  3 10:06:48 host2 sshd[1192287]: Disconnected from invalid user ts3server 152.32.171.99 port 46776 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.201.22.158
country_id: 290557
description:
2026-01-03 10:07:43 dovecot_plain authenticator failed for H=(bandrols) [94.201.22.158]:46939: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.213.238.91
country_id: 1210997
description:
Jan  3 10:07:45 host2 sshd[1193255]: Disconnected from invalid user ts3server 103.213.238.91 port 52708 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 91.231.222.161
country_id: 3190538
description:
Jan  3 10:08:35 host2 pure-ftpd[1194186]: (?@91.231.222.161) [INFO] New connection from 91.231.222.161


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  3 10:08:55 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<rVs0Z3RH2rWi8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.82.89
country_id: 6252001
description:
Jan  3 10:09:00 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@maximsholdings.com>, method=PLAIN, rip=47.253.82.89, lip=66.85.158.91, session=<zYuDZ3RHwNsv/VJZ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.83.15
country_id: 3144096
description:
2026-01-03 10:09:21 dovecot_login authenticator failed for H=(cm-178.232.83.15.get.no) [178.232.83.15]:47081: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.38.27
country_id: 798544
description:
2026-01-03 10:09:21 dovecot_login authenticator failed for H=89-67-38-27.dynamic.play.pl [89.67.38.27]:45070: 535 Incorrect authentication data (set_id=support@kiriaswanu.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Jan  3 10:09:31 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@monarchdss.com>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<eL1baXRHRP9o7MS0>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.213.238.91
country_id: 1210997
description:
Jan  3 10:09:57 host2 sshd[1195543]: Disconnected from invalid user server 103.213.238.91 port 37218 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  3 10:10:33 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@askinternationalconsortium.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<WPEFbXRHdrhnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  3 10:11:08 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<MYsab3RHPLpn9M4G>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.213.238.91
country_id: 1210997
description:
Jan  3 10:11:24 host2 sshd[1197310]: Disconnected from invalid user x 103.213.238.91 port 36300 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.104.225.201
country_id: 6252001
description:
2026-01-03 10:13:35 dovecot_plain authenticator failed for H=(denes) [24.104.225.201]:41779: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.171.99
country_id: 1819730
description:
Jan  3 10:14:28 host2 sshd[1200936]: Disconnected from invalid user server 152.32.171.99 port 44956 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.196.64.198
country_id: 1835841
description:
Jan  3 10:14:34 host2 sshd[1201010]: Disconnected from invalid user nandan 20.196.64.198 port 40400 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.91.81.224
country_id: 1880251
description:
Jan  3 10:15:12 host2 sshd[1201809]: Disconnected from invalid user service 154.91.81.224 port 37212 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.196.64.198
country_id: 1835841
description:
Jan  3 10:17:07 host2 sshd[1204066]: Disconnected from invalid user postgres 20.196.64.198 port 59422 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.240
country_id: 6252001
description:
Jan  3 10:16:15 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.240, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<p3WKgXRH+9jN0h/w>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.171.99
country_id: 1819730
description:
Jan  3 10:16:38 host2 sshd[1203563]: Disconnected from invalid user postgres 152.32.171.99 port 56572 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.91.81.224
country_id: 1880251
description:
Jan  3 10:17:21 host2 sshd[1204293]: Disconnected from invalid user user7 154.91.81.224 port 46336 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.142.184.55
country_id: 1210997
description:
2026-01-03 10:17:43 dovecot_login authenticator failed for H=([103.133.175.82]) [103.142.184.55]:38829: 535 Incorrect authentication data (set_id=postmaster@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.222.166.212
country_id: 2077456
description:
2026-01-03 10:17:47 dovecot_login authenticator failed for H=(180-222-166-212.static.dsl.net.au) [180.222.166.212]:56659: 535 Incorrect authentication data (set_id=postmaster@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 24.199.94.128
country_id: 6252001
description:
Jan  3 10:17:54 host2 sshd[1205063]: Disconnected from invalid user debian 24.199.94.128 port 37744 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.89.161.111
country_id: 1269750
description:
Jan  3 10:18:25 host2 sshd[1205629]: Disconnected from invalid user paula 159.89.161.111 port 54970 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 20.196.64.198
country_id: 1835841
description:
Jan  3 10:18:29 host2 sshd[1205698]: Disconnected from invalid user max 20.196.64.198 port 39988 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 24.199.94.128
country_id: 6252001
description:
Jan  3 10:19:28 host2 sshd[1206969]: Disconnected from invalid user user7 24.199.94.128 port 51624 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.199.47
country_id: 1269750
description:
Jan  3 10:19:50 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=66.116.199.47, lip=66.85.158.91, session=<T+82jnRHLrVCdMcv>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.89.161.111
country_id: 1269750
description:
Jan  3 10:20:13 host2 sshd[1208084]: Disconnected from invalid user forest 159.89.161.111 port 47256 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 78.89.154.59
country_id: 285570
description:
Jan  3 10:20:26 host2 sshd[1208402]: Disconnected from invalid user service 78.89.154.59 port 34090 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 78.89.154.59
country_id: 285570
description:
Jan  3 10:21:13 host2 sshd[1209464]: Disconnected from invalid user vpn 78.89.154.59 port 38582 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  3 10:22:06 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@colperlab.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<hYFglnRHfmAjupN+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.89.161.111
country_id: 1269750
description:
Jan  3 10:22:37 host2 sshd[1210842]: Disconnected from invalid user borg 159.89.161.111 port 33620 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 159.89.161.111
country_id: 1269750
description:
Jan  3 10:23:12 host2 sshd[1211677]: Disconnected from invalid user super 159.89.161.111 port 55226 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.248.243.181
country_id: 2542007
description:
2026-01-03 10:24:22 dovecot_plain authenticator failed for H=(proks) [41.248.243.181]:53514: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.199.126
country_id: 1269750
description:
2026-01-03 10:26:07 dovecot_login authenticator failed for H=([182.79.31.107]) [152.52.199.126]:45992: 535 Incorrect authentication data (set_id=contacto@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Jan  3 10:25:11 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@melanifinefood.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<zANfoXRHAuJnpBQq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.219.227
country_id: 6251999
description:
Jan  3 10:26:01 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=158.69.219.227, lip=66.85.158.91, session=<MERWpHRHrpyeRdvj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.146.149
country_id: 3996063
description:
2026-01-03 10:26:05 dovecot_login authenticator failed for H=([177.236.146.149]) [177.236.146.149]:33768: 535 Incorrect authentication data (set_id=contacto@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.162.191
country_id: 3144096
description:
2026-01-03 10:26:13 dovecot_login authenticator failed for H=(cm-178.232.162.191.get.no) [178.232.162.191]:37402: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.16.55
country_id: 3469034
description:
2026-01-03 10:27:33 dovecot_login authenticator failed for H=(177-174-16-55.user.vivozap.com.br) [177.174.16.55]:41627: 535 Incorrect authentication data (set_id=office@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.83.135.122
country_id: 6251999
description:
2026-01-03 10:29:14 dovecot_login authenticator failed for H=([24.83.135.122]) [24.83.135.122]:57176: 535 Incorrect authentication data (set_id=info@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.84.179.128
country_id: 3996063
description:
2026-01-03 10:29:24 dovecot_login authenticator failed for H=([140.84.179.128]) [140.84.179.128]:34634: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 164.92.251.120
country_id: 2921044
description:
Jan  3 10:29:52 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 30 secs): user=<>, rip=164.92.251.120, lip=66.85.158.91, TLS handshaking: Connection closed, session=<piw8snRHTs+kXPt4>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 158.178.229.240
country_id: 1880251
description:
Jan  3 10:32:30 host2 pure-ftpd[1220948]: (?@158.178.229.240) [INFO] New connection from 158.178.229.240


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 158.178.229.240
country_id: 1880251
description:
Jan  3 10:32:34 host2 pure-ftpd[1221038]: (?@158.178.229.240) [INFO] New connection from 158.178.229.240


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 158.178.229.240
country_id: 1880251
description:
Jan  3 10:33:09 host2 pure-ftpd[1221749]: (?@158.178.229.240) [INFO] New connection from 158.178.229.240


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 158.178.229.240
country_id: 1880251
description:
Jan  3 10:33:10 host2 pure-ftpd[1221778]: (?@158.178.229.240) [INFO] New connection from 158.178.229.240


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.252.85
country_id: 1210997
description:
2026-01-03 10:33:57 dovecot_login authenticator failed for H=([103.115.252.60]) [103.115.252.85]:50765: 535 Incorrect authentication data (set_id=support@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.209.106.190
country_id: 2077456
description:
2026-01-03 10:34:13 dovecot_login authenticator failed for H=([123.209.106.190]) [123.209.106.190]:44730: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.242.142
country_id: 1269750
description:
2026-01-03 10:34:58 dovecot_login authenticator failed for H=([125.19.172.137]) [182.78.242.142]:60246: 535 Incorrect authentication data (set_id=office@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Jan  3 10:35:57 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@rehanseo.online>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<Xofjx3RHAJ4v+wDY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.138.90.195
country_id: 2661886
description:
2026-01-03 10:35:13 dovecot_login authenticator failed for H=h79-138-90-195.cust.bredband2.com [79.138.90.195]:44394: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan  3 10:37:03 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lakwelholdings.com>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<47zOy3RHgrsyBvlc>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  3 10:37:54 host2 sshd[1226328]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 114.7.163.154
country_id: 1643084
description:
Jan  3 10:37:40 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=114.7.163.154, lip=66.85.158.91, session=<w1L9zXRH2tFyB6Oa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2026-01-03 10:38:04 dovecot_login authenticator failed for H=([197.219.228.242]) [197.219.228.242]:54406: 535 Incorrect authentication data (set_id=postmaster@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.207.210.23
country_id: 2960313
description:
2026-01-03 10:38:18 dovecot_plain authenticator failed for H=(eriseum) [88.207.210.23]:63936: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.222
country_id: 2186224
description:
2026-01-03 10:38:19 dovecot_login authenticator failed for H=([121.73.169.222]) [121.73.169.222]:35418: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.31.15.108
country_id: 290557
description:
2026-01-03 10:42:44 dovecot_plain authenticator failed for H=(ciddly) [5.31.15.108]:55233: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.123
country_id: 6252001
description:
Jan  3 10:43:17 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.123, lip=66.85.158.91, TLS: Connection closed, session=<TIY44nRHWrZChJl7>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.253.56.73
country_id: 6252001
description:
Jan  3 10:46:13 host2 sshd[1235661]: Disconnected from invalid user simon 47.253.56.73 port 38270 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.163.123.45
country_id: 1880251
description:
Jan  3 10:48:45 host2 sshd[1237916]: Disconnected from invalid user k8s 43.163.123.45 port 48096 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.163.123.45
country_id: 1880251
description:
Jan  3 10:49:32 host2 sshd[1238794]: Disconnected from invalid user front 43.163.123.45 port 33694 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.173.2.164
country_id: 1643084
description:
Jan  3 10:49:55 host2 sshd[1239228]: Disconnected from invalid user k8s 43.173.2.164 port 39550 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.25.232.7
country_id: 953987
description:
Jan  3 10:50:28 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<amila@euroentertainmentlk.com>, method=PLAIN, rip=41.25.232.7, lip=66.85.158.91, session=<knTR+3RHRdEpGegH>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.163.123.45
country_id: 1880251
description:
Jan  3 10:50:16 host2 sshd[1239803]: Disconnected from invalid user rain 43.163.123.45 port 47516 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 155.4.245.222
country_id: 2661886
description:
Jan  3 10:50:18 host2 sshd[1239832]: Disconnected from invalid user kim 155.4.245.222 port 54792 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.173.2.164
country_id: 1643084
description:
Jan  3 10:51:20 host2 sshd[1240783]: Disconnected from invalid user admin 43.173.2.164 port 40174 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  3 10:52:56 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<SzKXBHVHTIpn9M4G>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.163.123.45
country_id: 1880251
description:
Jan  3 10:53:08 host2 sshd[1242728]: Disconnected from invalid user default 43.163.123.45 port 46322 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.173.2.164
country_id: 1643084
description:
Jan  3 10:53:15 host2 sshd[1242892]: Disconnected from invalid user admin 43.173.2.164 port 37504 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.253.56.73
country_id: 6252001
description:
Jan  3 10:53:25 host2 sshd[1243064]: Disconnected from invalid user xiaoli 47.253.56.73 port 59334 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 155.4.245.222
country_id: 2661886
description:
Jan  3 10:53:29 host2 sshd[1243097]: Disconnected from invalid user julien 155.4.245.222 port 17647 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.195.211.98
country_id: 6252001
description:
2026-01-03 10:54:19 dovecot_plain authenticator failed for H=c-73-195-211-98.hsd1.nj.comcast.net (coecul) [73.195.211.98]:49958: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 155.4.245.222
country_id: 2661886
description:
Jan  3 10:54:43 host2 sshd[1244824]: Disconnected from invalid user devops 155.4.245.222 port 33001 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.173.2.164
country_id: 1643084
description:
Jan  3 10:55:09 host2 sshd[1245525]: Disconnected from invalid user zhang 43.173.2.164 port 38092 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  3 10:55:33 host2 pure-ftpd[1246159]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.252.85
country_id: 1210997
description:
2026-01-03 10:56:22 dovecot_login authenticator failed for H=([103.115.252.60]) [103.115.252.85]:50978: 535 Incorrect authentication data (set_id=contact@kiriaswanu.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.252.229
country_id: 3865483
description:
Jan  3 10:58:03 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=179.0.252.229, lip=66.85.158.91, TLS, session=<HovuFXVHO9qzAPzl>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.253.56.73
country_id: 6252001
description:
Jan  3 10:57:16 host2 sshd[1247856]: Disconnected from invalid user paulo 47.253.56.73 port 45058 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.130.168.24
country_id: 3469034
description:
Jan  3 10:58:23 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<charanaw>, method=PLAIN, rip=177.130.168.24, lip=66.85.158.91, TLS, session=<BRwqF3VHaZ2xgqgY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.62.239.4
country_id: 732800
description:
2026-01-03 10:59:34 dovecot_plain authenticator failed for H=(lerse) [149.62.239.4]:48622: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.201.22.158
country_id: 290557
description:
2026-01-03 11:00:09 dovecot_plain authenticator failed for H=(pyrry) [94.201.22.158]:46452: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  3 11:02:41 host2 sshd[1253138]: Disconnected from invalid user admin 2.57.121.112 port 54337 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 20.15.163.174
country_id: 6252001
description:
Jan  3 11:03:16 host2 pure-ftpd[1253900]: (?@20.15.163.174) [INFO] New connection from 20.15.163.174


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  3 11:05:15 host2 sshd[1256175]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.54
country_id: 1149361
description:
2026-01-03 11:06:31 dovecot_login authenticator failed for H=([149.54.62.54]) [149.54.62.54]:53475: 535 Incorrect authentication data (set_id=test@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.219.54
country_id: 1269750
description:
2026-01-03 11:06:41 dovecot_login authenticator failed for H=([125.21.200.57]) [128.185.219.54]:44800: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.157
country_id: 6252001
description:
Jan  3 11:08:49 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 4 secs): user=<>, rip=147.185.132.157, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<ECCIPXVH2duTuYSd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.157
country_id: 6252001
description:
Jan  3 11:09:46 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=429) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=147.185.132.157, lip=66.85.158.91, TLS: read(size=429) failed: Connection reset by peer, session=<3a3tQHVHZPyTuYSd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan  3 11:10:16 host2 sshd[1261612]: Disconnected from invalid user user 2.57.121.25 port 54535 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.89.137.152
country_id: 3469034
description:
Jan  3 11:11:06 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=190.89.137.152, lip=66.85.158.91, TLS, session=<TbSMRHVHHIa+WYmY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.250.15
country_id: 3865483
description:
Jan  3 11:11:27 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=179.0.250.15, lip=66.85.158.91, TLS, session=<PnzWRXVHWbezAPoP>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Jan  3 11:13:17 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, session=<gtKGTXVHFr4DiUnd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.89.159.59
country_id: 3865483
description:
2026-01-03 11:15:02 dovecot_login authenticator failed for H=(59-159-89-200.fibertel.com.ar) [200.89.159.59]:41504: 535 Incorrect authentication data (set_id=contacto@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.124.135.48
country_id: 3144096
description:
2026-01-03 11:15:20 dovecot_login authenticator failed for H=([188.124.135.48]) [188.124.135.48]:56556: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.157
country_id: 6252001
description:
Jan  3 11:15:46 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.157, lip=66.85.158.91, TLS, session=<H5pqVnVHJuaTuYSd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Jan  3 11:15:48 host2 dovecot[1170291]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, session=<UIZ8VnVHsMEDiUnd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan  3 11:16:11 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lakwelholdings.com>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<m1DGV3VHTOMyBvlc>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Jan  3 11:17:49 host2 dovecot[1170291]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, session=<GbW3XXVHWsgDiUnd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 114.7.163.154
country_id: 1643084
description:
Jan  3 11:18:06 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@essenceceylontea.com>, method=PLAIN, rip=114.7.163.154, lip=66.85.158.91, session=<h32gXnVHdOByB6Oa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Jan  3 11:18:26 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, session=<2XLnX3VHQJ8DiUnd>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.137.73.221
country_id: 6252001
description:
Jan  3 11:19:49 host2 dovecot[1170291]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, session=<7O7iZHVHcL8DiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Jan  3 11:20:32 host2 dovecot[1170291]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, session=<OiZvZ3VHKMgDiUnd>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 161.118.238.65
country_id: 1880251
description:
Jan  3 11:21:03 host2 pure-ftpd[1272283]: (?@161.118.238.65) [INFO] New connection from 161.118.238.65


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 161.118.238.65
country_id: 1880251
description:
Jan  3 11:21:07 host2 pure-ftpd[1272354]: (?@161.118.238.65) [INFO] New connection from 161.118.238.65


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 161.118.238.65
country_id: 1880251
description:
Jan  3 11:21:08 host2 pure-ftpd[1272363]: (?@161.118.238.65) [INFO] New connection from 161.118.238.65


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 161.118.238.65
country_id: 1880251
description:
Jan  3 11:21:13 host2 pure-ftpd[1272446]: (?@161.118.238.65) [INFO] New connection from 161.118.238.65


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 161.118.238.65
country_id: 1880251
description:
Jan  3 11:22:09 host2 pure-ftpd[1273446]: (?@161.118.238.65) [INFO] New connection from 161.118.238.65


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 161.118.238.65
country_id: 1880251
description:
Jan  3 11:22:13 host2 pure-ftpd[1273512]: (?@161.118.238.65) [INFO] New connection from 161.118.238.65


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.2
country_id: 1269750
description:
2026-01-03 11:22:37 dovecot_login authenticator failed for H=([125.19.173.202]) [152.52.236.2]:45786: 535 Incorrect authentication data (set_id=test@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.247.239.202
country_id: 1269750
description:
2026-01-03 11:24:52 dovecot_login authenticator failed for H=(abts-north-static-194.142.160.122.airtelbroadband.in) [117.247.239.202]:40346: 535 Incorrect authentication data (set_id=contacto@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.168.234
country_id: 2186224
description:
2026-01-03 11:25:02 dovecot_login authenticator failed for H=([121.73.168.234]) [121.73.168.234]:33272: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.51.34.229
country_id: 2510769
description:
2026-01-03 11:30:26 dovecot_login authenticator failed for H=(229.34.51.212.dynamic.reverse-mundo-r.com) [212.51.34.229]:44270: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.225.42.158
country_id: 719819
description:
2026-01-03 11:30:39 dovecot_login authenticator failed for H=netacc-gpn-5-42-158.pool.yettel.hu [84.225.42.158]:50798: 535 Incorrect authentication data (set_id=postmaster@kiriaswanu.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  3 11:34:47 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@bostonlanka.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<sM5NmnVHlLhn9M4G>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.87.213.16
country_id: 732800
description:
2026-01-03 11:35:42 dovecot_login authenticator failed for H=95-87-213-16.ip.btc-net.bg [95.87.213.16]:41012: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.62
country_id: 6252001
description:
Jan  3 11:36:07 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=167.94.146.62, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<qaQxn3VHqOmnXpI+>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 31.208.188.18
country_id: 2661886
description:
Jan  3 11:35:25 host2 pure-ftpd[1287773]: (?@31.208.188.18) [INFO] New connection from 31.208.188.18


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 31.208.188.18
country_id: 2661886
description:
Jan  3 11:35:26 host2 sshd[1287771]: Invalid user mohdehiovita@epid.gov.lk from 31.208.188.18 port 49184


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 31.208.188.18
country_id: 2661886
description:
Jan  3 11:35:32 host2 pure-ftpd[1287773]: (?@31.208.188.18) [WARNING] Authentication failed for user [mohdehiovita@epid.gov.lk]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.62
country_id: 6252001
description:
Jan  3 11:36:08 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=612) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=167.94.146.62, lip=66.85.158.91, TLS handshaking: read(size=612) failed: Connection reset by peer, session=<WEBDn3VHvumnXpI+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.40.122.250
country_id: 2629691
description:
2026-01-03 11:38:45 dovecot_login authenticator failed for H=nova-185-040-122-250.cpe.novanet.is [185.40.122.250]:40580: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan  3 11:39:13 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<fCo8qnVHOpoDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan  3 11:40:10 host2 dovecot[1170291]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<mxeqrXVHdLkDjyE/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.71.82
country_id: 1269750
description:
2026-01-03 11:41:34 dovecot_login authenticator failed for H=(nsg-static-82.71.76.182-airtel.com) [182.76.71.82]:44736: 535 Incorrect authentication data (set_id=contact@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  3 11:41:59 host2 sshd[1293882]: Disconnected from invalid user admin 2.57.121.112 port 55908 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan  3 11:42:14 host2 dovecot[1170291]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<tYQOtXVH/LQDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan  3 11:43:52 host2 dovecot[1170291]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<dgrounVHZI8DjyE/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.41
country_id: 2750405
description:
2026-01-03 11:45:08 dovecot_login authenticator failed for H=(Copy-of-VM-2022) [45.94.31.41]:29215: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan  3 11:44:37 host2 dovecot[1170291]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<0GeUvXVHrrkDjyE/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.41
country_id: 2750405
description:
2026-01-03 11:45:16 dovecot_login authenticator failed for H=(Copy-of-VM-2022) [45.94.31.41]:29605: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.143.33.63
country_id: 6252001
description:
Jan  3 11:45:23 host2 dovecot[1170291]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<YUxOwHVHZKMDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan  3 11:45:45 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<MJygwXVHYLwDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.95
country_id: 6252001
description:
Jan  3 11:45:58 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=205.210.31.95, lip=66.85.158.91, TLS, session=</HdgwnVHmOzN0h9f>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan  3 11:47:08 host2 dovecot[1170291]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<7dCUxnVHbpADjyE/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.5.238.101
country_id: 3175395
description:
2026-01-03 11:46:25 dovecot_login authenticator failed for H=host-87-5-238-101.retail.telecomitalia.it [87.5.238.101]:45240: 535 Incorrect authentication data (set_id=admin@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.120.98
country_id: 1269750
description:
2026-01-03 11:46:36 dovecot_login authenticator failed for H=([122.184.120.98]) [122.184.120.98]:41194: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan  3 11:47:44 host2 dovecot[1170291]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<fdyzyHVH9KcDjyE/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.213.178.212
country_id: 1861060
description:
2026-01-03 11:50:32 dovecot_login authenticator failed for H=([154.213.178.117]) [154.213.178.212]:17456: 535 Incorrect authentication data (set_id=contact@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.214
country_id: 1269750
description:
2026-01-03 11:50:54 dovecot_login authenticator failed for H=([182.95.181.214]) [182.95.181.214]:48904: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.218.50
country_id: 1269750
description:
2026-01-03 11:52:32 dovecot_login authenticator failed for H=([125.19.218.50]) [125.19.218.50]:58922: 535 Incorrect authentication data (set_id=office@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.239.182
country_id: 1269750
description:
2026-01-03 11:52:47 dovecot_login authenticator failed for H=([128.185.217.84]) [128.185.239.182]:49870: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan  3 11:54:55 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lakwelholdings.com>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<+TBK4nVHGqoyBvlc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.128.202
country_id: 6252001
description:
2026-01-03 11:57:01 dovecot_login authenticator failed for H=([192.34.128.202]) [192.34.128.202]:50232: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.118.99.170
country_id: 3686110
description:
Jan  3 11:59:06 host2 sshd[1313174]: Disconnected from invalid user ubuntu 200.118.99.170 port 41798 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.220.188.141
country_id: 6252001
description:
Jan  3 11:58:18 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=44.220.188.141, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<9BR97nVHhtks3LyN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 114.7.163.154
country_id: 1643084
description:
Jan  3 11:58:45 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@essenceceylontea.com>, method=PLAIN, rip=114.7.163.154, lip=66.85.158.91, session=<DXP973VHVoByB6Oa>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  3 11:59:18 host2 pure-ftpd[1313369]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 106.51.1.63
country_id: 1269750
description:
Jan  3 11:59:31 host2 sshd[1313521]: Disconnected from invalid user ubuntu 106.51.1.63 port 32972 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 191.242.48.147
country_id: 3469034
description:
Jan  3 11:59:38 host2 sshd[1313634]: Disconnected from invalid user ubuntu 191.242.48.147 port 37528 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 82.24.64.220
country_id: 2635167
description:
Jan  3 11:59:07 host2 sshd[1313200]: Disconnected from invalid user dhis 82.24.64.220 port 52036 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 106.51.1.63
country_id: 1269750
description:
Jan  3 12:00:11 host2 sshd[1314371]: Disconnected from invalid user server 106.51.1.63 port 44978 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 191.242.48.147
country_id: 3469034
description:
Jan  3 12:00:20 host2 sshd[1314671]: Disconnected from invalid user macha 191.242.48.147 port 49396 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.118.99.170
country_id: 3686110
description:
Jan  3 12:00:34 host2 sshd[1314886]: Disconnected from invalid user ubuntu 200.118.99.170 port 33098 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.85
country_id: 2186224
description:
2026-01-03 12:00:59 dovecot_login authenticator failed for H=([121.73.163.85]) [121.73.163.85]:56296: 535 Incorrect authentication data (set_id=admin@kiriaswanu.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.227.185.238
country_id: 1269750
description:
Jan  3 12:01:49 host2 sshd[1316035]: Disconnected from invalid user colin 43.227.185.238 port 53730 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 191.242.48.147
country_id: 3469034
description:
Jan  3 12:01:45 host2 sshd[1315977]: Disconnected from invalid user idempiere 191.242.48.147 port 44902 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.215.80.173
country_id: 1819730
description:
Jan  3 12:02:15 host2 sshd[1316394]: Disconnected from invalid user steam 103.215.80.173 port 43142 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.118.99.170
country_id: 3686110
description:
Jan  3 12:02:20 host2 sshd[1316465]: Disconnected from invalid user student 200.118.99.170 port 39638 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 191.242.48.147
country_id: 3469034
description:
Jan  3 12:03:44 host2 sshd[1317794]: Disconnected from invalid user colin 191.242.48.147 port 52264 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 82.24.64.220
country_id: 2635167
description:
Jan  3 12:03:21 host2 sshd[1317383]: Disconnected from invalid user augusto 82.24.64.220 port 60824 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 106.51.1.63
country_id: 1269750
description:
Jan  3 12:04:23 host2 sshd[1318616]: Disconnected from invalid user root1 106.51.1.63 port 44208 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 82.24.64.220
country_id: 2635167
description:
Jan  3 12:04:26 host2 sshd[1318681]: Disconnected from invalid user daniel 82.24.64.220 port 35072 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.227.185.238
country_id: 1269750
description:
Jan  3 12:04:31 host2 sshd[1318770]: Disconnected from invalid user ubuntu 43.227.185.238 port 38046 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.196.8.161
country_id: 2658434
description:
Jan  3 12:04:37 host2 sshd[1318891]: Disconnected from invalid user deploy 185.196.8.161 port 59448 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.118.99.170
country_id: 3686110
description:
Jan  3 12:04:40 host2 sshd[1318971]: Disconnected from invalid user root1 200.118.99.170 port 57752 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.196.8.161
country_id: 2658434
description:
Jan  3 12:06:18 host2 sshd[1321668]: Disconnected from invalid user samira 185.196.8.161 port 46984 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.227.252.2
country_id: 1269750
description:
2026-01-03 12:06:31 dovecot_login authenticator failed for H=(abts-tn-dynamic-2.252.227.110.airtelbroadband.in) [110.227.252.2]:46274: 535 Incorrect authentication data (set_id=contacto@epid.gov.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.46.235.137
country_id: 6252001
description:
Jan  3 12:06:48 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.46.235.137, lip=66.85.158.92, session=<hsvlDHZHsK0ULuuJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.227.185.238
country_id: 1269750
description:
Jan  3 12:06:59 host2 sshd[1322407]: Disconnected from invalid user student 43.227.185.238 port 38092 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.210.214.212
country_id: 3144096
description:
2026-01-03 12:08:07 dovecot_login authenticator failed for H=(cm-84.210.214.212.get.no) [84.210.214.212]:49204: 535 Incorrect authentication data (set_id=postmaster@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.93.84
country_id: 1269750
description:
2026-01-03 12:08:21 dovecot_login authenticator failed for H=([152.52.93.82]) [152.52.93.84]:10400: 535 Incorrect authentication data (set_id=contact@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.75.202
country_id: 1149361
description:
2026-01-03 12:08:34 dovecot_login authenticator failed for H=([180.94.75.202]) [180.94.75.202]:48172: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 41.140.160.28
country_id: 2542007
description:
[2026-01-03 12:11:24 +0530] info [cpaneld] 41.140.160.28 - info@cloudtourssrilanka.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 41.140.160.28
country_id: 2542007
description:
Login Blocked: IP reached maximum auth failures [Service]=[cpaneld] [Local IP Address]=[66.85.158.91] [Local Port]=[2083] [Remote IP Address]=[41.140.160.28] [Remote Port]=[57426] [Authentication Database]=[system] [Username]=[travel] (5/5 failures) (blocked until [Sat Jan  3 06:56:34 2026 UTC/Sat Jan  3 12:26:34 2026 LOCAL])


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.119.50
country_id: 1269750
description:
2026-01-03 12:15:53 dovecot_login authenticator failed for H=(aes-static-089.153.22.125.airtel.in) [182.95.119.50]:37294: 535 Incorrect authentication data (set_id=test@epid.gov.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.124
country_id: 6252001
description:
Jan  3 12:15:57 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.124, lip=66.85.158.92, TLS: Connection closed, session=<MBSeLXZH1IdChJl8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  3 12:16:49 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<BBSVMHZH0MNn9M4G>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.169.224.27
country_id: 6252001
description:
2026-01-03 12:21:07 dovecot_plain authenticator failed for H=c-174-169-224-27.hsd1.vt.comcast.net (fally) [174.169.224.27]:32864: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.215.245.175
country_id: 3469034
description:
2026-01-03 12:22:57 dovecot_login authenticator failed for H=([189.59.210.1]) [186.215.245.175]:51724: 535 Incorrect authentication data (set_id=sales@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.237.107
country_id: 3144096
description:
2026-01-03 12:23:07 dovecot_login authenticator failed for H=(cm-178.232.237.107.get.no) [178.232.237.107]:35146: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 40.124.168.156
country_id: 6252001
description:
Jan  3 12:24:55 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=40.124.168.156, lip=66.85.158.91, session=<ceS2TXZHpokofKic>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.166
country_id: 2993457
description:
Jan  3 12:26:04 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=194.165.16.166, lip=66.85.158.92, session=<JSbWUXZHl//CpRCm>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  3 12:29:00 host2 sshd[1346210]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.215.1.201
country_id: 2635167
description:
2026-01-03 12:30:05 dovecot_login authenticator failed for H=([88.215.1.201]) [88.215.1.201]:38835: 535 Incorrect authentication data (set_id=test@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.176.21.104
country_id: 1269750
description:
2026-01-03 12:30:15 dovecot_login authenticator failed for H=(abts-north-static-104.21.176.122.airtelbroadband.in) [122.176.21.104]:60832: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan  3 12:31:43 host2 sshd[1349445]: Disconnected from invalid user user 2.57.121.25 port 37333 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan  3 12:33:45 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@lakwelholdings.com>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<lLopbXZH3o0yBvlc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.8.241.171
country_id: 2077456
description:
2026-01-03 12:35:39 dovecot_login authenticator failed for H=([161.8.241.171]) [161.8.241.171]:59203: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 114.7.163.154
country_id: 1643084
description:
Jan  3 12:39:14 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=114.7.163.154, lip=66.85.158.91, session=<z5i7gHZHVo5yB6Oa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.197.178
country_id: 1269750
description:
2026-01-03 12:40:53 dovecot_login authenticator failed for H=([128.185.197.178]) [128.185.197.178]:37142: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.41.18
country_id: 1269750
description:
2026-01-03 12:41:54 dovecot_login authenticator failed for H=([182.73.193.249]) [122.187.41.18]:49890: 535 Incorrect authentication data (set_id=info@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.226.163
country_id: 3144096
description:
2026-01-03 12:42:03 dovecot_login authenticator failed for H=([178.232.226.163]) [178.232.226.163]:38540: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.129.28
country_id: 99237
description:
2026-01-03 12:46:14 dovecot_plain authenticator failed for H=(retilly) [65.20.129.28]:40435: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.224.169.28
country_id: 6252001
description:
2026-01-03 12:46:49 dovecot_plain authenticator failed for H=c-71-224-169-28.hsd1.pa.comcast.net (peratic) [71.224.169.28]:33316: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2026-01-03 12:47:38 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:60360: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.145.94
country_id: 3996063
description:
2026-01-03 12:49:46 dovecot_login authenticator failed for H=([177.236.145.94]) [177.236.145.94]:48403: 535 Incorrect authentication data (set_id=postmaster@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.23.68
country_id: 3144096
description:
2026-01-03 12:50:01 dovecot_login authenticator failed for H=(cm-178.232.23.68.get.no) [178.232.23.68]:36624: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.236.163
country_id: 6252001
description:
2026-01-03 12:50:13 dovecot_plain authenticator failed for H=c-73-197-236-163.hsd1.nj.comcast.net (ruelambaky) [73.197.236.163]:58422: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.54
country_id: 3144096
description:
2026-01-03 12:51:06 dovecot_login authenticator failed for H=(54-170-97-62.cust.smartcall.no) [62.97.170.54]:59330: 535 Incorrect authentication data (set_id=support@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.228.168.12
country_id: 1327865
description:
2026-01-03 12:51:20 dovecot_login authenticator failed for H=([136.228.168.12]) [136.228.168.12]:54480: 535 Incorrect authentication data (set_id=office@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.218.95.154
country_id: 6252001
description:
2026-01-03 12:52:17 dovecot_plain authenticator failed for H=syn-074-218-095-154.biz.spectrum.com (khetiess) [74.218.95.154]:35005: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.224.171.101
country_id: 6252001
description:
2026-01-03 12:52:20 dovecot_plain authenticator failed for H=c-73-224-171-101.hsd1.fl.comcast.net (magess) [73.224.171.101]:36706: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  3 12:54:05 host2 sshd[1373508]: Disconnected from invalid user admin 2.57.121.112 port 42434 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.210.77.100
country_id: 3996063
description:
Jan  3 12:54:14 host2 sshd[1373876]: Disconnected from invalid user erpnext 187.210.77.100 port 36694 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.178
country_id: 6252001
description:
Jan  3 12:55:42 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.178, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<L8fIu3ZH2crN0h+y>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.74.243.13
country_id: 2510769
description:
Jan  3 12:55:11 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=185.74.243.13, lip=66.85.158.91, TLS, session=<gqztuHZH6si5SvMN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.30.83.214
country_id: 1269750
description:
Jan  3 12:55:32 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<charanaw>, method=PLAIN, rip=103.30.83.214, lip=66.85.158.91, TLS, session=<6xUUunZHmsJnHlPW>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  3 12:56:27 host2 sshd[1376458]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 187.210.77.100
country_id: 3996063
description:
Jan  3 12:56:43 host2 sshd[1376661]: Disconnected from invalid user test_user 187.210.77.100 port 39670 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 219.92.8.45
country_id: 1733045
description:
Jan  3 12:58:32 host2 sshd[1378481]: Disconnected from invalid user hadoop 219.92.8.45 port 60994 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.131.53.100
country_id: 1269750
description:
Jan  3 12:58:48 host2 sshd[1378734]: Disconnected from invalid user erpnext 185.131.53.100 port 41124 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  3 12:58:53 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<tMMIx3ZHoNtn9M4G>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.131.53.100
country_id: 1269750
description:
Jan  3 12:59:21 host2 sshd[1379367]: Disconnected from invalid user test_user 185.131.53.100 port 41260 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 187.210.77.100
country_id: 3996063
description:
Jan  3 13:00:31 host2 sshd[1380933]: Received disconnect from 187.210.77.100 port 60126:11: Bye Bye [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.111
country_id: 6252001
description:
Jan  3 13:00:57 host2 pure-ftpd[1381408]: (?@147.185.132.111) [INFO] New connection from 147.185.132.111


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.131.53.100
country_id: 1269750
description:
Jan  3 13:01:36 host2 sshd[1381960]: Disconnected from invalid user frappe 185.131.53.100 port 56294 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  3 13:03:24 host2 pure-ftpd[1384077]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.145.10.140
country_id: 6252001
description:
2026-01-03 13:04:19 dovecot_plain authenticator failed for H=c-76-145-10-140.hsd1.ga.comcast.net (woonoste) [76.145.10.140]:46626: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.154
country_id: 3144096
description:
2026-01-03 13:07:02 dovecot_login authenticator failed for H=(cm-84.213.189.154.get.no) [84.213.189.154]:36097: 535 Incorrect authentication data (set_id=test@kiriaswanu.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 219.92.8.45
country_id: 1733045
description:
Jan  3 13:06:19 host2 sshd[1387185]: Disconnected from invalid user admin 219.92.8.45 port 43654 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.103.6.83
country_id: 690791
description:
Jan  3 13:08:17 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=176.103.6.83, lip=66.85.158.91, TLS, session=<qhy553ZHB8awZwZT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.109.178.41
country_id: 1269750
description:
Jan  3 13:08:39 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=103.109.178.41, lip=66.85.158.91, TLS, session=<c8z66HZHvZFnbbIp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.144.20
country_id: 3996063
description:
2026-01-03 13:09:34 dovecot_login authenticator failed for H=([177.236.144.20]) [177.236.144.20]:51916: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.154.221.68
country_id: 2510769
description:
2026-01-03 13:09:23 dovecot_login authenticator failed for H=68.red-79-154-221.dynamicip.rima-tde.net [79.154.221.68]:44819: 535 Incorrect authentication data (set_id=support@kiriaswanu.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 222.124.17.227
country_id: 1643084
description:
Jan  3 13:09:33 host2 sshd[1390694]: Disconnected from invalid user vmuser 222.124.17.227 port 60274 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.165.121.195
country_id: 1269750
description:
Jan  3 13:10:39 host2 sshd[1391990]: Disconnected from invalid user testuser 122.165.121.195 port 47482 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.223.80
country_id: 1880251
description:
Jan  3 13:10:11 host2 sshd[1391361]: Disconnected from invalid user user02 45.78.223.80 port 37648 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.165.121.195
country_id: 1269750
description:
Jan  3 13:11:31 host2 sshd[1392851]: Disconnected from invalid user erpnext 122.165.121.195 port 36252 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 122.165.121.195
country_id: 1269750
description:
Jan  3 13:12:23 host2 sshd[1393663]: Disconnected from invalid user deployer 122.165.121.195 port 58726 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 104.219.234.254
country_id: 6252001
description:
Jan  3 13:12:27 host2 pure-ftpd[1393746]: (?@104.219.234.254) [INFO] New connection from 104.219.234.254


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan  3 13:14:10 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lakwelholdings.com>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<NA+z/XZHBrAyBvlc>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.221.89
country_id: 1880251
description:
Jan  3 13:18:16 host2 sshd[1399440]: Disconnected from invalid user anderson 45.78.221.89 port 45990 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.195.211.98
country_id: 6252001
description:
2026-01-03 13:18:56 dovecot_plain authenticator failed for H=c-73-195-211-98.hsd1.nj.comcast.net (obsomysit) [73.195.211.98]:51120: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.221.89
country_id: 1880251
description:
Jan  3 13:19:16 host2 sshd[1400574]: Disconnected from invalid user chef 45.78.221.89 port 41874 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 114.7.163.154
country_id: 1643084
description:
Jan  3 13:19:57 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@essenceceylontea.com>, method=PLAIN, rip=114.7.163.154, lip=66.85.158.91, session=<x/ZeEndH+ptyB6Oa>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 158.178.229.240
country_id: 1880251
description:
Jan  3 13:20:34 host2 pure-ftpd[1402179]: (?@158.178.229.240) [INFO] New connection from 158.178.229.240


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 158.178.229.240
country_id: 1880251
description:
Jan  3 13:20:38 host2 pure-ftpd[1402271]: (?@158.178.229.240) [INFO] New connection from 158.178.229.240


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.58.87.108
country_id: 6252001
description:
2026-01-03 13:21:05 dovecot_plain authenticator failed for H=c-174-58-87-108.hsd1.fl.comcast.net (jaccia) [174.58.87.108]:47018: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.223.80
country_id: 1880251
description:
Jan  3 13:21:21 host2 sshd[1403042]: Disconnected from invalid user ubuntu 45.78.223.80 port 43744 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 158.178.229.240
country_id: 1880251
description:
Jan  3 13:21:08 host2 pure-ftpd[1402875]: (?@158.178.229.240) [INFO] New connection from 158.178.229.240


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 158.178.229.240
country_id: 1880251
description:
Jan  3 13:21:10 host2 pure-ftpd[1402901]: (?@158.178.229.240) [INFO] New connection from 158.178.229.240


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.0.38.130
country_id: 1210997
description:
2026-01-03 13:23:21 dovecot_login authenticator failed for H=([49.0.38.130]) [49.0.38.130]:54020: 535 Incorrect authentication data (set_id=admin@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.44.133.238
country_id: 3469034
description:
2026-01-03 13:23:31 dovecot_login authenticator failed for H=([187.51.128.233]) [189.44.133.238]:58687: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.220.16.51
country_id: 1269750
description:
2026-01-03 13:24:21 dovecot_login authenticator failed for H=([103.220.16.51]) [103.220.16.51]:54136: 535 Incorrect authentication data (set_id=test@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.182.44.104
country_id: 130758
description:
2026-01-03 13:24:44 dovecot_login authenticator failed for H=(static.104.44.182.5.clients.irandns.com) [5.182.44.104]:42552: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.223.80
country_id: 1880251
description:
Jan  3 13:25:05 host2 sshd[1407313]: Disconnected from invalid user admin 45.78.223.80 port 53608 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  3 13:26:55 host2 sshd[1409153]: Disconnected from invalid user admin 2.57.121.112 port 43607 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 66.154.125.60
country_id: 6251999
description:
Jan  3 13:27:45 host2 sshd[1409958]: Disconnected from invalid user media 66.154.125.60 port 49704 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.227.166
country_id: 1269750
description:
2026-01-03 13:29:00 dovecot_login authenticator failed for H=([103.56.85.65]) [128.185.227.166]:41546: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.121.43
country_id: 3144096
description:
2026-01-03 13:29:02 dovecot_login authenticator failed for H=(cm-178.232.121.43.get.no) [178.232.121.43]:47731: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.122.247
country_id: 3144096
description:
2026-01-03 13:29:13 dovecot_login authenticator failed for H=(cm-178.232.122.247.get.no) [178.232.122.247]:42545: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.114.190
country_id: 1269750
description:
2026-01-03 13:29:28 dovecot_login authenticator failed for H=([27.123.114.190]) [27.123.114.190]:36140: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.223.80
country_id: 1880251
description:
Jan  3 13:29:59 host2 sshd[1412302]: Disconnected from invalid user github 45.78.223.80 port 33162 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 84.54.2.78
country_id: 1819730
description:
Jan  3 13:30:13 host2 sshd[1412775]: Disconnected from invalid user hduser 84.54.2.78 port 42336 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 142.93.110.84
country_id: 2921044
description:
Jan  3 13:33:04 host2 sshd[1416115]: Disconnected from invalid user justin 142.93.110.84 port 56616 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 66.154.125.60
country_id: 6251999
description:
Jan  3 13:32:40 host2 sshd[1415640]: Disconnected from invalid user vbox 66.154.125.60 port 49810 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 66.154.125.60
country_id: 6251999
description:
Jan  3 13:33:17 host2 sshd[1416370]: Disconnected from invalid user nas 66.154.125.60 port 49868 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.68.150.253
country_id: 2635167
description:
Jan  3 13:33:20 host2 sshd[1416414]: Disconnected from invalid user nas 138.68.150.253 port 56342 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 142.93.110.84
country_id: 2921044
description:
Jan  3 13:33:36 host2 sshd[1416640]: Disconnected from invalid user spread 142.93.110.84 port 38872 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 66.154.125.60
country_id: 6251999
description:
Jan  3 13:34:30 host2 sshd[1417554]: Disconnected from invalid user production 66.154.125.60 port 49992 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 138.68.150.253
country_id: 2635167
description:
Jan  3 13:34:54 host2 sshd[1418098]: Disconnected from invalid user sandeep 138.68.150.253 port 50784 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.68.150.253
country_id: 2635167
description:
Jan  3 13:34:24 host2 sshd[1417447]: Disconnected from invalid user tmp 138.68.150.253 port 36840 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.102.122
country_id: 1269750
description:
2026-01-03 13:35:08 dovecot_login authenticator failed for H=([27.123.102.122]) [27.123.102.122]:33122: 535 Incorrect authentication data (set_id=postmaster@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 84.54.2.78
country_id: 1819730
description:
Jan  3 13:35:25 host2 sshd[1418816]: Disconnected from invalid user uftp 84.54.2.78 port 49076 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.146.233.156
country_id: 1269750
description:
2026-01-03 13:35:38 dovecot_login authenticator failed for H=([103.146.233.156]) [103.146.233.156]:51660: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.142.126.37
country_id: 6252001
description:
2026-01-03 13:35:43 dovecot_plain authenticator failed for H=c-69-142-126-37.hsd1.nj.comcast.net (spiering) [69.142.126.37]:42426: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.54
country_id: 1733045
description:
2026-01-03 13:36:11 dovecot_login authenticator failed for H=([49.124.151.54]) [49.124.151.54]:38628: 535 Incorrect authentication data (set_id=info@kiriaswanu.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  3 13:40:43 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<VLGuXHdHrs5n9M4G>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.210.219.80
country_id: 3144096
description:
2026-01-03 13:46:33 dovecot_login authenticator failed for H=([84.210.219.80]) [84.210.219.80]:49018: 535 Incorrect authentication data (set_id=postmaster@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.32.163.238
country_id: 953987
description:
2026-01-03 13:46:54 dovecot_login authenticator failed for H=([102.32.163.238]) [102.32.163.238]:51279: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.204.134.124
country_id: 6252001
description:
2026-01-03 13:51:26 dovecot_plain authenticator failed for H=c-98-204-134-124.hsd1.md.comcast.net (euncyated) [98.204.134.124]:47744: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan  3 13:52:12 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lakwelholdings.com>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<7xuzhXdHoqsyBvlc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.188.10
country_id: 3144096
description:
2026-01-03 14:00:29 dovecot_login authenticator failed for H=(cm-178.232.188.10.get.no) [178.232.188.10]:55872: 535 Incorrect authentication data (set_id=sales@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.206
country_id: 1269750
description:
2026-01-03 14:00:39 dovecot_login authenticator failed for H=([182.95.176.206]) [182.95.176.206]:57690: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.186.114.73
country_id: 1168579
description:
2026-01-03 14:00:43 dovecot_login authenticator failed for H=([103.186.114.73]) [103.186.114.73]:37669: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 114.7.163.154
country_id: 1643084
description:
Jan  3 14:00:50 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@essenceceylontea.com>, method=PLAIN, rip=114.7.163.154, lip=66.85.158.91, session=<1gWfpHdH4qlyB6Oa>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.196.8.199
country_id: 2658434
description:
Jan  3 14:03:53 host2 sshd[1451712]: Disconnected from invalid user backend 185.196.8.199 port 37628 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.217.12.57
country_id: 3437598
description:
Jan  3 14:04:12 host2 sshd[1452026]: Disconnected from invalid user andrey 201.217.12.57 port 59532 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 86.54.42.199
country_id: 241170
description:
Jan  3 14:04:38 host2 sshd[1452418]: Disconnected from invalid user z 86.54.42.199 port 55378 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan  3 14:06:04 host2 sshd[1454438]: Disconnected from invalid user user 2.57.121.25 port 15318 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 201.217.12.57
country_id: 3437598
description:
Jan  3 14:05:43 host2 sshd[1453789]: Disconnected from invalid user kiosk 201.217.12.57 port 51908 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.194
country_id: 6252001
description:
Jan  3 14:05:57 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.235.24.194, lip=66.85.158.91, session=<QAcHt3dHmvPG6xjC>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 66.179.188.92
country_id: 6252001
description:
Jan  3 14:06:25 host2 sshd[1454958]: Disconnected from invalid user deployer 66.179.188.92 port 47090 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  3 14:07:39 host2 pure-ftpd[1456347]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 86.54.42.199
country_id: 241170
description:
Jan  3 14:07:44 host2 sshd[1456418]: Disconnected from invalid user kiosk 86.54.42.199 port 48658 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.196.8.199
country_id: 2658434
description:
Jan  3 14:07:11 host2 sshd[1455821]: Disconnected from invalid user andrey 185.196.8.199 port 38652 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.217.12.57
country_id: 3437598
description:
Jan  3 14:07:12 host2 sshd[1455839]: Disconnected from invalid user z 201.217.12.57 port 36428 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.196.8.199
country_id: 2658434
description:
Jan  3 14:08:15 host2 sshd[1457082]: Disconnected from invalid user bitrix 185.196.8.199 port 56642 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.190.155.43
country_id: 6252001
description:
2026-01-03 14:08:33 dovecot_plain authenticator failed for H=(tinating) [76.190.155.43]:32833: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.217.12.57
country_id: 3437598
description:
Jan  3 14:08:40 host2 sshd[1457453]: Disconnected from invalid user test1 201.217.12.57 port 57310 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 86.54.42.199
country_id: 241170
description:
Jan  3 14:09:13 host2 sshd[1458026]: Disconnected from invalid user apache 86.54.42.199 port 55996 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 86.54.42.199
country_id: 241170
description:
Jan  3 14:10:12 host2 sshd[1459248]: Disconnected from invalid user oracle 86.54.42.199 port 36404 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 86.54.42.199
country_id: 241170
description:
Jan  3 14:10:41 host2 sshd[1459842]: Disconnected from invalid user admin 86.54.42.199 port 43174 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 66.179.188.92
country_id: 6252001
description:
Jan  3 14:11:12 host2 sshd[1460588]: Disconnected from invalid user david 66.179.188.92 port 45372 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.123.136.11
country_id: 3437598
description:
Jan  3 14:11:31 host2 sshd[1460968]: Disconnected from invalid user amit 181.123.136.11 port 45032 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.188.176.242
country_id: 3923057
description:
Jan  3 14:14:15 host2 sshd[1464212]: Disconnected from invalid user frontend 181.188.176.242 port 60430 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 181.188.176.242
country_id: 3923057
description:
Jan  3 14:15:41 host2 sshd[1466070]: Disconnected from invalid user trung 181.188.176.242 port 41464 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.123.136.11
country_id: 3437598
description:
Jan  3 14:15:51 host2 sshd[1466225]: Disconnected from invalid user maman 181.123.136.11 port 46920 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.139.193.223
country_id: 1643084
description:
Jan  3 14:16:50 host2 sshd[1467205]: Disconnected from invalid user oracle 103.139.193.223 port 38690 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.139
country_id: 6252001
description:
Jan  3 14:16:53 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.139, lip=66.85.158.92, TLS: Connection closed, session=<duse3ndHXA1ChJmL>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.188.176.242
country_id: 3923057
description:
Jan  3 14:16:26 host2 sshd[1466909]: Disconnected from invalid user nana 181.188.176.242 port 51250 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.107.36.18
country_id: 1269750
description:
Jan  3 14:16:28 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<isuru@euroentertainmentlk.com>, method=PLAIN, rip=103.107.36.18, lip=66.85.158.91, TLS, session=<5X9523dH/IBnayQS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.219.125.70
country_id: 798544
description:
Jan  3 14:16:45 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<isuru>, method=PLAIN, rip=178.219.125.70, lip=66.85.158.91, TLS, session=<hnas3HdH7t6y231G>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  3 14:17:46 host2 sshd[1467848]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.188.176.242
country_id: 3923057
description:
Jan  3 14:17:12 host2 sshd[1467538]: Disconnected from invalid user oracle 181.188.176.242 port 49622 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.139.193.223
country_id: 1643084
description:
Jan  3 14:17:47 host2 sshd[1467977]: Disconnected from invalid user dummy 103.139.193.223 port 35124 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  3 14:20:06 host2 sshd[1470732]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.188.130
country_id: 3144096
description:
2026-01-03 14:19:55 dovecot_login authenticator failed for H=(cm-84.213.188.130.get.no) [84.213.188.130]:51290: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.5.63.166
country_id: 1694008
description:
2026-01-03 14:19:28 dovecot_login authenticator failed for H=([103.5.63.166]) [103.5.63.166]:38985: 535 Incorrect authentication data (set_id=office@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.113.185.14
country_id: 3469034
description:
2026-01-03 14:19:41 dovecot_login authenticator failed for H=([189.113.185.14]) [189.113.185.14]:47494: 535 Incorrect authentication data (set_id=office@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  3 14:22:44 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@bostonlanka.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<z9js8ndHcMBn9M4G>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.154.40.244
country_id: 1819730
description:
Jan  3 14:25:22 host2 pure-ftpd[1476914]: (?@165.154.40.244) [INFO] New connection from 165.154.40.244


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.207.210.23
country_id: 2960313
description:
2026-01-03 14:26:05 dovecot_plain authenticator failed for H=(lency) [88.207.210.23]:61789: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.116.22
country_id: 1861060
description:
Jan  3 14:26:14 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=139.162.116.22, lip=66.85.158.91, TLS: Connection closed, session=<bn6P/3dHILCLonQW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.84.34.85
country_id: 1210997
description:
2026-01-03 14:28:43 dovecot_login authenticator failed for H=(ppp075.bol-online.com) [202.84.34.85]:53930: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.222.186
country_id: 1269750
description:
2026-01-03 14:28:29 dovecot_login authenticator failed for H=([182.95.222.186]) [182.95.222.186]:45402: 535 Incorrect authentication data (set_id=test@kiriaswanu.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan  3 14:29:56 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lakwelholdings.com>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<N1SuDHhHhJgyBvlc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.218.95.154
country_id: 6252001
description:
2026-01-03 14:30:54 dovecot_plain authenticator failed for H=syn-074-218-095-154.biz.spectrum.com (reffess) [74.218.95.154]:40600: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.26.179.235
country_id: 3175395
description:
Jan  3 14:34:14 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=217.26.179.235, lip=66.85.158.91, TLS, session=<0fkkG3hHsKrZGrPr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.62.109
country_id: 953987
description:
Jan  3 14:34:36 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=102.129.62.109, lip=66.85.158.91, TLS, session=<qi1WHHhHbLlmgT5t>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 114.7.163.154
country_id: 1643084
description:
Jan  3 14:41:31 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=114.7.163.154, lip=66.85.158.91, session=<OGEVNnhHMLhyB6Oa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.10.56.170
country_id: 732800
description:
2026-01-03 14:42:08 dovecot_login authenticator failed for H=46-10-56-170.ip.btc-net.bg [46.10.56.170]:41825: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.228.168.12
country_id: 1327865
description:
2026-01-03 14:42:29 dovecot_login authenticator failed for H=([136.228.168.12]) [136.228.168.12]:52902: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.210.46
country_id: 1036973
description:
2026-01-03 14:44:26 dovecot_login authenticator failed for H=(dynamic-adsl.movitel.co.mz) [197.219.210.46]:41854: 535 Incorrect authentication data (set_id=office@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.207.250.1
country_id: 3469034
description:
2026-01-03 14:44:57 dovecot_login authenticator failed for H=(ticons.static.gvt.net.br) [177.207.250.1]:35422: 535 Incorrect authentication data (set_id=sales@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.43.254.214
country_id: 732800
description:
2026-01-03 14:45:10 dovecot_login authenticator failed for H=cable-84-43-254-214.mnet.bg [84.43.254.214]:49925: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.88.196.91
country_id: 6252001
description:
2026-01-03 14:46:04 dovecot_plain authenticator failed for H=c-73-88-196-91.hsd1.ky.comcast.net (tortion) [73.88.196.91]:45776: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  3 14:47:32 host2 sshd[1501101]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.182.207.45
country_id: 3469034
description:
Jan  3 14:52:59 host2 sshd[1507160]: Disconnected from invalid user carlos 45.182.207.45 port 41120 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.186.0.68
country_id: 1643084
description:
Jan  3 14:53:49 host2 sshd[1507981]: Disconnected from invalid user test 103.186.0.68 port 42238 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.182.207.45
country_id: 3469034
description:
Jan  3 14:54:03 host2 sshd[1508463]: Disconnected from invalid user admin 45.182.207.45 port 59882 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.61.63
country_id: 1861060
description:
Jan  3 14:54:52 host2 sshd[1509612]: Disconnected from invalid user newuser 118.193.61.63 port 56916 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.182.207.45
country_id: 3469034
description:
Jan  3 14:54:38 host2 sshd[1509377]: Disconnected from invalid user vncuser 45.182.207.45 port 51858 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.182.207.45
country_id: 3469034
description:
Jan  3 14:55:14 host2 sshd[1510115]: Disconnected from invalid user webadmin 45.182.207.45 port 48228 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.154.153.13
country_id: 3923057
description:
Jan  3 14:56:52 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=45.154.153.13, lip=66.85.158.91, session=<1lQgbXhHkqotmpkN>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 82.102.27.92
country_id: 3144096
description:
Jan  3 14:56:53 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=82.102.27.92, lip=66.85.158.91, session=<5+otbXhHeotSZhtc>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 91.90.126.141
country_id: 3703430
description:
Jan  3 14:56:55 host2 pure-ftpd[1512140]: (?@91.90.126.141) [INFO] New connection from 91.90.126.141


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 161.118.238.65
country_id: 1880251
description:
Jan  3 14:56:45 host2 pure-ftpd[1511884]: (?@161.118.238.65) [INFO] New connection from 161.118.238.65


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 154.47.29.201
country_id: 3202326
description:
Jan  3 14:56:49 host2 pure-ftpd[1511972]: (?@154.47.29.201) [INFO] New connection from 154.47.29.201


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 45.154.153.13
country_id: 3923057
description:
Jan  3 14:56:49 host2 pure-ftpd[1511995]: (?@45.154.153.13) [INFO] New connection from 45.154.153.13


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.65.50.31
country_id: 597427
description:
Jan  3 14:56:54 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=185.65.50.31, lip=66.85.158.91, TLS handshaking: Connection closed, session=<XSg+bXhHBRq5QTIf>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 161.118.238.65
country_id: 1880251
description:
Jan  3 14:56:40 host2 pure-ftpd[1511792]: (?@161.118.238.65) [INFO] New connection from 161.118.238.65


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 188.241.80.139
country_id: 1814991
description:
Jan  3 14:56:52 host2 dovecot[1170291]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=188.241.80.139, lip=66.85.158.91, session=<w24cbXhHap+88VCL>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 188.215.235.49
country_id: 1831722
description:
Jan  3 14:56:55 host2 pure-ftpd[1512122]: (?@188.215.235.49) [INFO] New connection from 188.215.235.49


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 161.118.238.65
country_id: 1880251
description:
Jan  3 14:57:11 host2 pure-ftpd[1512475]: (?@161.118.238.65) [INFO] New connection from 161.118.238.65


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 161.118.238.65
country_id: 1880251
description:
Jan  3 14:57:15 host2 pure-ftpd[1512577]: (?@161.118.238.65) [INFO] New connection from 161.118.238.65


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.217.130.86
country_id: 3996063
description:
Jan  3 14:57:23 host2 sshd[1512705]: Disconnected from invalid user justin 189.217.130.86 port 20981 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 40.115.18.231
country_id: 2750405
description:
Jan  3 14:57:24 host2 sshd[1512714]: Disconnected from invalid user username 40.115.18.231 port 50148 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 40.115.18.231
country_id: 2750405
description:
Jan  3 14:58:00 host2 sshd[1513452]: Disconnected from invalid user buser 40.115.18.231 port 35612 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 161.118.238.65
country_id: 1880251
description:
Jan  3 14:58:10 host2 pure-ftpd[1513674]: (?@161.118.238.65) [INFO] New connection from 161.118.238.65


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 161.118.238.65
country_id: 1880251
description:
Jan  3 14:58:15 host2 pure-ftpd[1513777]: (?@161.118.238.65) [INFO] New connection from 161.118.238.65


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.61.63
country_id: 1861060
description:
Jan  3 14:59:42 host2 sshd[1515324]: Disconnected from invalid user console 118.193.61.63 port 44212 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.39.127
country_id: 1819730
description:
Jan  3 14:59:57 host2 sshd[1515607]: Disconnected from invalid user rich 118.193.39.127 port 33980 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 189.217.130.86
country_id: 3996063
description:
Jan  3 15:00:35 host2 sshd[1516652]: Disconnected from invalid user console 189.217.130.86 port 46649 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.61.63
country_id: 1861060
description:
Jan  3 15:01:03 host2 sshd[1517201]: Disconnected from invalid user coder 118.193.61.63 port 17014 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.81.211.221
country_id: 6252001
description:
2026-01-03 15:01:06 dovecot_login authenticator failed for H=vps-45907be8.vps.ovh.us [51.81.211.221]:50132: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.39.127
country_id: 1819730
description:
Jan  3 15:00:32 host2 sshd[1516571]: Disconnected from invalid user test 118.193.39.127 port 34458 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 40.115.18.231
country_id: 2750405
description:
Jan  3 15:01:29 host2 sshd[1517686]: Disconnected from invalid user low 40.115.18.231 port 33080 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.39.127
country_id: 1819730
description:
Jan  3 15:01:42 host2 sshd[1517925]: Disconnected from invalid user justin 118.193.39.127 port 36060 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.217.130.86
country_id: 3996063
description:
Jan  3 15:01:10 host2 sshd[1517356]: Disconnected from invalid user coder 189.217.130.86 port 52910 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.39.127
country_id: 1819730
description:
Jan  3 15:02:51 host2 sshd[1519307]: Disconnected from invalid user console 118.193.39.127 port 45206 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.186.0.68
country_id: 1643084
description:
Jan  3 15:02:49 host2 sshd[1519178]: Disconnected from invalid user rich 103.186.0.68 port 44316 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.186.0.68
country_id: 1643084
description:
Jan  3 15:03:42 host2 sshd[1520350]: Disconnected from invalid user low 103.186.0.68 port 38054 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 179.0.252.73
country_id: 3865483
description:
Jan  3 15:04:40 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 9 secs): user=<>, rip=179.0.252.73, lip=66.85.158.91, session=</Q8HiXhH9eKzAPxJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  3 15:04:49 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@bostonlanka.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<0V9viXhH4Ipn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.190.167.214
country_id: 3865483
description:
Jan  3 15:05:35 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<charanaw>, method=PLAIN, rip=186.190.167.214, lip=66.85.158.91, TLS, session=<xQAAi3hHW+i6vqfW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.109.178.8
country_id: 1269750
description:
Jan  3 15:05:11 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=103.109.178.8, lip=66.85.158.91, TLS, session=<RovDiXhH58VnbbII>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.39.127
country_id: 1819730
description:
Jan  3 15:05:20 host2 sshd[1522638]: Disconnected from invalid user dev 118.193.39.127 port 47216 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.32
country_id: 1733045
description:
2026-01-03 15:07:31 dovecot_login authenticator failed for H=([49.124.151.32]) [49.124.151.32]:56386: 535 Incorrect authentication data (set_id=contact@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan  3 15:07:34 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lakwelholdings.com>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<V/pEk3hHdKkyBvlc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.229.38
country_id: 1269750
description:
2026-01-03 15:07:45 dovecot_login authenticator failed for H=(nsg-static-153.157.72.182.airtel.in) [182.95.229.38]:34412: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.194
country_id: 1269750
description:
2026-01-03 15:10:06 dovecot_login authenticator failed for H=(nsg-static-217.97.72.182.airtel.in) [182.95.228.194]:52796: 535 Incorrect authentication data (set_id=contact@kiriaswanu.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  3 15:12:12 host2 pure-ftpd[1530538]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.64.93.161
country_id: 2077456
description:
2026-01-03 15:16:14 dovecot_login authenticator failed for H=115-64-93-161.tpgi.com.au [115.64.93.161]:45329: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.179.134.120
country_id: 1269750
description:
2026-01-03 15:16:32 dovecot_login authenticator failed for H=(abts-mum-static-120.134.179.122.airtelbroadband.in) [122.179.134.120]:33744: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.126.105.42
country_id: 3469034
description:
2026-01-03 15:22:27 dovecot_login authenticator failed for H=187-126-105-42.user.vtal.net.br (187-126-105-145.user.vtal.net.br) [187.126.105.42]:55768: 535 Incorrect authentication data (set_id=contacto@kiriaswanu.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 114.7.163.154
country_id: 1643084
description:
Jan  3 15:22:36 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=114.7.163.154, lip=66.85.158.91, session=<LoYJyXhHvMVyB6Oa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.186.54.65
country_id: 298795
description:
2026-01-03 15:22:45 dovecot_login authenticator failed for H=([78.186.54.65]) [78.186.54.65]:43528: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.20
country_id: 241170
description:
Jan  3 15:23:49 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.20, lip=66.85.158.91, session=<v5JYzXhHnLTE+2YU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.96.29.14
country_id: 1269750
description:
2026-01-03 15:24:56 dovecot_login authenticator failed for H=(abts-kk-static-182.209.166.122.airtelbroadband.in) [14.96.29.14]:58764: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.5.135
country_id: 798544
description:
2026-01-03 15:25:17 dovecot_login authenticator failed for H=89-67-5-135.dynamic.play.pl [89.67.5.135]:36199: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.10
country_id: 241170
description:
Jan  3 15:29:22 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.10, lip=66.85.158.91, session=<ViA74XhHNp7E+2YK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.212
country_id: 1819730
description:
2026-01-03 15:32:47 dovecot_login authenticator failed for H=212.42.246.220.static.netvigator.com [220.246.42.212]:53591: 535 Incorrect authentication data (set_id=postmaster@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.211.220.203
country_id: 2661886
description:
2026-01-03 15:32:55 dovecot_login authenticator failed for H=31-211-220-203.customers.ownit.se [31.211.220.203]:58456: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.213.230.122
country_id: 6252001
description:
2026-01-03 15:34:13 dovecot_login authenticator failed for H=([67.213.230.122]) [67.213.230.122]:58439: 535 Incorrect authentication data (set_id=postmaster@kiriaswanu.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.23.160.197
country_id: 6252001
description:
Jan  3 15:36:17 host2 sshd[1558251]: Disconnected from invalid user user 198.23.160.197 port 40190 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.93.168.36
country_id: 298795
description:
Jan  3 15:37:08 host2 sshd[1559422]: Disconnected from invalid user angela 45.93.168.36 port 19302 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.159.34.135
country_id: 3017382
description:
Jan  3 15:38:59 host2 sshd[1561692]: Disconnected from invalid user test1 51.159.34.135 port 61444 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.93.168.36
country_id: 298795
description:
Jan  3 15:39:06 host2 sshd[1561816]: Disconnected from invalid user gitlab-runner 45.93.168.36 port 3740 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.93.168.36
country_id: 298795
description:
Jan  3 15:38:28 host2 sshd[1560992]: Disconnected from invalid user roman 45.93.168.36 port 54544 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.90.94
country_id: 1269750
description:
2026-01-03 15:39:43 dovecot_login authenticator failed for H=([125.20.183.201]) [27.123.90.94]:45202: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.225.99.151
country_id: 2921044
description:
Jan  3 15:39:44 host2 sshd[1562450]: Disconnected from invalid user admin 64.225.99.151 port 36114 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.206.119
country_id: 1819730
description:
2026-01-03 15:39:55 dovecot_login authenticator failed for H=(m121-202-206-119.smartone.com) [121.202.206.119]:50210: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.235.248.73
country_id: 3469034
description:
2026-01-03 15:40:45 dovecot_login authenticator failed for H=(186.235.248.73.girardi-rs.com.br) [186.235.248.73]:44282: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.225.99.151
country_id: 2921044
description:
Jan  3 15:40:52 host2 sshd[1563793]: Disconnected from invalid user github 64.225.99.151 port 46142 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.18.99.38
country_id: 1269750
description:
2026-01-03 15:40:30 dovecot_login authenticator failed for H=([182.95.20.225]) [125.18.99.38]:44312: 535 Incorrect authentication data (set_id=admin@kiriaswanu.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.159.34.135
country_id: 3017382
description:
Jan  3 15:41:13 host2 sshd[1564138]: Disconnected from invalid user temp 51.159.34.135 port 19918 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 64.225.99.151
country_id: 2921044
description:
Jan  3 15:41:26 host2 sshd[1564394]: Disconnected from invalid user admin 64.225.99.151 port 60084 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.23.160.197
country_id: 6252001
description:
Jan  3 15:42:49 host2 sshd[1565817]: Disconnected from invalid user test 198.23.160.197 port 46656 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.225.99.151
country_id: 2921044
description:
Jan  3 15:43:33 host2 sshd[1566466]: Disconnected from invalid user roman 64.225.99.151 port 40618 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 198.23.160.197
country_id: 6252001
description:
Jan  3 15:43:53 host2 sshd[1566837]: Disconnected from invalid user proxyuser 198.23.160.197 port 52996 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.159.34.135
country_id: 3017382
description:
Jan  3 15:43:18 host2 sshd[1566248]: Disconnected from invalid user user 51.159.34.135 port 53060 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.140.19.22
country_id: 1269750
description:
Jan  3 15:44:27 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=103.140.19.22, lip=66.85.158.91, session=<ZacmF3lHatJnjBMW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.36
country_id: 1733045
description:
2026-01-03 15:46:05 dovecot_login authenticator failed for H=([49.124.153.36]) [49.124.153.36]:38418: 535 Incorrect authentication data (set_id=sales@kiriaswanu.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan  3 15:45:20 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lakwelholdings.com>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<OTJUGnlH9s4yBvlc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.230.86.50
country_id: 6252001
description:
2026-01-03 15:46:21 dovecot_plain authenticator failed for H=c-73-230-86-50.hsd1.pa.comcast.net (knitriped) [73.230.86.50]:51402: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.245.182
country_id: 1269750
description:
2026-01-03 15:46:25 dovecot_login authenticator failed for H=([125.20.245.182]) [125.20.245.182]:37756: 535 Incorrect authentication data (set_id=contacto@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.214.49.194
country_id: 6252001
description:
2026-01-03 15:46:39 dovecot_login authenticator failed for H=wsip-72-214-49-194.hr.hr.cox.net [72.214.49.194]:34400: 535 Incorrect authentication data (set_id=info@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.85
country_id: 2186224
description:
2026-01-03 15:46:51 dovecot_login authenticator failed for H=([121.73.163.85]) [121.73.163.85]:54996: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.168
country_id: 2186224
description:
2026-01-03 15:46:23 dovecot_login authenticator failed for H=([121.73.163.168]) [121.73.163.168]:36466: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.249.19.34
country_id: 1643084
description:
2026-01-03 15:46:48 dovecot_login authenticator failed for H=([103.249.19.34]) [103.249.19.34]:52032: 535 Incorrect authentication data (set_id=support@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.56.228.149
country_id: 6252001
description:
2026-01-03 15:46:48 dovecot_login authenticator failed for H=ool-6038e495.static.optonline.net [96.56.228.149]:35652: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  3 15:47:11 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<8cv3IHlHTMNn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.21
country_id: 241170
description:
Jan  3 15:48:02 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.21, lip=66.85.158.91, session=<3b78I3lHyLbE+2YV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.19
country_id: 241170
description:
Jan  3 15:49:22 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.19, lip=66.85.158.91, session=<2RfCKHlHWOvE+2YT>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.22.204.23
country_id: 1210997
description:
2026-01-03 15:50:01 dovecot_login authenticator failed for H=([202.22.204.23]) [202.22.204.23]:40822: 535 Incorrect authentication data (set_id=contacto@kiriaswanu.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.23
country_id: 241170
description:
Jan  3 15:53:07 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.23, lip=66.85.158.91, session=<7KsnNnlHQILE+2YX>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.218.247.234
country_id: 1522867
description:
2026-01-03 15:53:20 dovecot_login authenticator failed for H=([89.218.247.234]) [89.218.247.234]:50506: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.73.203.43
country_id: 2542007
description:
2026-01-03 15:53:38 dovecot_login authenticator failed for H=([105.73.203.43]) [105.73.203.43]:50017: 535 Incorrect authentication data (set_id=contacto@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.30.86.18
country_id: 1522867
description:
2026-01-03 15:53:47 dovecot_login authenticator failed for H=([147.30.86.18]) [147.30.86.18]:38059: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.22
country_id: 241170
description:
Jan  3 16:01:22 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.22, lip=66.85.158.91, session=<3HqqU3lHxrTE+2YW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.23.140
country_id: 3144096
description:
2026-01-03 16:04:20 dovecot_login authenticator failed for H=(cm-178.232.23.140.get.no) [178.232.23.140]:45503: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 114.7.163.154
country_id: 1643084
description:
Jan  3 16:04:23 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<office@essenceceylontea.com>, method=PLAIN, rip=114.7.163.154, lip=66.85.158.91, session=<ly5iXnlHQtNyB6Oa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2026-01-03 16:06:18 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:59739: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.80.9
country_id: 3144096
description:
2026-01-03 16:10:29 dovecot_login authenticator failed for H=([178.232.80.9]) [178.232.80.9]:57658: 535 Incorrect authentication data (set_id=info@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.112.28.181
country_id: 6252001
description:
2026-01-03 16:10:43 dovecot_login authenticator failed for H=ool-45701cb5.dyn.optonline.net [69.112.28.181]:47963: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  3 16:11:26 host2 sshd[1598196]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.15.90
country_id: 1149361
description:
2026-01-03 16:11:15 dovecot_login authenticator failed for H=([149.54.15.90]) [149.54.15.90]:52686: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  3 16:17:11 host2 pure-ftpd[1604303]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.64.18
country_id: 1269750
description:
2026-01-03 16:23:10 dovecot_login authenticator failed for H=([182.78.64.18]) [182.78.64.18]:38458: 535 Incorrect authentication data (set_id=test@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan  3 16:23:20 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lakwelholdings.com>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<fHg9onlHdrUyBvlc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.214.78
country_id: 1269750
description:
2026-01-03 16:23:22 dovecot_login authenticator failed for H=([128.185.39.145]) [128.185.214.78]:36668: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.50
country_id: 6252001
description:
Jan  3 16:28:45 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=167.94.146.50, lip=66.85.158.91, TLS: Connection closed, session=<xjW4tXlHVJOnXpIy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  3 16:29:43 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<YLsFuXlHZoRn9M4G>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.188.158.216
country_id: 2510769
description:
2026-01-03 16:31:13 dovecot_login authenticator failed for H=([207.188.158.216]) [207.188.158.216]:55615: 535 Incorrect authentication data (set_id=contact@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.112.178.133
country_id: 3469034
description:
2026-01-03 16:31:23 dovecot_login authenticator failed for H=(mvx-187-16-97-90.mundivox.com) [189.112.178.133]:47066: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.158.145.31
country_id: 2510769
description:
2026-01-03 16:32:01 dovecot_login authenticator failed for H=31.145.158.146.dynamic.jazztel.es [146.158.145.31]:38597: 535 Incorrect authentication data (set_id=postmaster@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.15
country_id: 1733045
description:
2026-01-03 16:34:09 dovecot_login authenticator failed for H=([49.124.151.15]) [49.124.151.15]:44014: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.16.55
country_id: 3469034
description:
2026-01-03 16:33:52 dovecot_login authenticator failed for H=(177-174-16-55.user.vivozap.com.br) [177.174.16.55]:60470: 535 Incorrect authentication data (set_id=test@kiriaswanu.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 209.50.165.203
country_id: 6252001
description:
[2026-01-03 16:34:25 +0530] info [cpaneld] 209.50.165.203 - simpleengineerin "GET /execute/Variables/get_user_information HTTP/1.1" FAILED LOGIN cpaneld: User simpleengineerin has their account suspended. Login blocked.


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  3 16:38:55 host2 sshd[1627787]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.118.112.230
country_id: 6252001
description:
2026-01-03 16:38:37 dovecot_login authenticator failed for H=syn-070-118-112-230.biz.spectrum.com [70.118.112.230]:40044: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.224.169.28
country_id: 6252001
description:
2026-01-03 16:44:25 dovecot_plain authenticator failed for H=c-71-224-169-28.hsd1.pa.comcast.net (dectidares) [71.224.169.28]:37862: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.195.66
country_id: 1269750
description:
2026-01-03 16:46:38 dovecot_login authenticator failed for H=([128.185.169.25]) [125.19.195.66]:52120: 535 Incorrect authentication data (set_id=admin@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.200.166
country_id: 149590
description:
2026-01-03 16:46:51 dovecot_login authenticator failed for H=(166.200-59-41.ttcl.co.tz) [41.59.200.166]:59389: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 114.7.163.154
country_id: 1643084
description:
Jan  3 16:47:11 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=114.7.163.154, lip=66.85.158.91, session=<GXaD93lHPOByB6Oa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.237.107
country_id: 3144096
description:
2026-01-03 16:52:31 dovecot_login authenticator failed for H=(cm-178.232.237.107.get.no) [178.232.237.107]:39140: 535 Incorrect authentication data (set_id=office@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.50.252
country_id: 953987
description:
Jan  3 16:54:48 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=102.129.50.252, lip=66.85.158.91, TLS, session=<F0HKEXpHX9RmgTL8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.53.130.116
country_id: 3469034
description:
Jan  3 16:54:15 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=191.53.130.116, lip=66.85.158.91, TLS, session=<9cq1D3pHUMC/NYJ0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.19.12.103
country_id: 2635167
description:
2026-01-03 16:54:39 dovecot_login authenticator failed for H=cpc122100-bmly10-2-0-cust102.2-3.cable.virginm.net [82.19.12.103]:43440: 535 Incorrect authentication data (set_id=contact@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.59.178.22
country_id: 298795
description:
2026-01-03 16:54:41 dovecot_login authenticator failed for H=([188.59.178.22]) [188.59.178.22]:39852: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.12.132.63
country_id: 294640
description:
2026-01-03 16:56:16 dovecot_login authenticator failed for H=([176.12.132.63]) [176.12.132.63]:49442: 535 Incorrect authentication data (set_id=office@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.146.144
country_id: 1819730
description:
2026-01-03 16:56:27 dovecot_login authenticator failed for H=(m121-202-146-144.smartone.com) [121.202.146.144]:44487: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.236.145.128
country_id: 6252001
description:
2026-01-03 17:00:04 dovecot_login authenticator failed for H=(node12.vindb.org) [104.236.145.128]:42923: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.0.107.158
country_id: 226074
description:
2026-01-03 16:59:45 dovecot_login authenticator failed for H=([196.0.107.158]) [196.0.107.158]:37319: 535 Incorrect authentication data (set_id=office@epid.gov.lk)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.106
country_id: 2635167
description:
Jan  3 17:01:00 host2 dovecot[1170291]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=87.236.176.106, lip=66.85.158.91, TLS, session=<HEwLKXpHe7hX7LBq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.253.98
country_id: 1269750
description:
2026-01-03 17:02:38 dovecot_login authenticator failed for H=([128.185.253.98]) [128.185.253.98]:33374: 535 Incorrect authentication data (set_id=sales@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.84.188.140
country_id: 3996063
description:
2026-01-03 17:02:57 dovecot_login authenticator failed for H=([140.84.188.140]) [140.84.188.140]:54954: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.162
country_id: 2993457
description:
Jan  3 17:02:27 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=194.165.16.162, lip=66.85.158.91, session=<ghg6LnpHV//CpRCi>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.225.186
country_id: 1269750
description:
2026-01-03 17:05:30 dovecot_login authenticator failed for H=([203.145.139.81]) [128.185.225.186]:50458: 535 Incorrect authentication data (set_id=test@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.52.217.71
country_id: 3686110
description:
2026-01-03 17:05:42 dovecot_login authenticator failed for H=(static-ip-cr18152021771.cable.net.co) [181.52.217.71]:53684: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.162.191
country_id: 3144096
description:
2026-01-03 17:06:59 dovecot_login authenticator failed for H=(cm-178.232.162.191.get.no) [178.232.162.191]:56248: 535 Incorrect authentication data (set_id=contacto@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.182.125.210
country_id: 6252001
description:
2026-01-03 17:10:07 dovecot_plain authenticator failed for H=(lulateate) [12.182.125.210]:49109: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.118.215.192
country_id: 3865483
description:
2026-01-03 17:21:22 dovecot_login authenticator failed for H=(red.138.118.215.192.ssservicios.com.ar) [138.118.215.192]:57036: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 201.168.9.94
country_id: 3996063
description:
Jan  3 17:21:50 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=201.168.9.94, lip=66.85.158.91, TLS, session=<EBx6cnpHLc3JqAle>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.237.82.103
country_id: 3469034
description:
Jan  3 17:22:09 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<charanaw>, method=PLAIN, rip=200.237.82.103, lip=66.85.158.91, TLS, session=<H0Cmc3pH3a3I7VJn>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  3 17:22:27 host2 pure-ftpd[1676585]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.230.158
country_id: 1269750
description:
2026-01-03 17:24:07 dovecot_login authenticator failed for H=(dsl-del-065.26.246.61.airtelbroadband.in) [182.95.230.158]:43234: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.176.126
country_id: 1269750
description:
2026-01-03 17:23:50 dovecot_login authenticator failed for H=([128.185.18.217]) [122.185.176.126]:51878: 535 Incorrect authentication data (set_id=test@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.82.141.145
country_id: 6252001
description:
2026-01-03 17:25:06 dovecot_plain authenticator failed for H=c-68-82-141-145.hsd1.pa.comcast.net (dersipting) [68.82.141.145]:59652: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 91.92.243.14
country_id: 6252001
description:
Jan  3 17:26:35 host2 sshd[1681429]: Disconnected from invalid user proxyuser 91.92.243.14 port 50644 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.125.122
country_id: 1269750
description:
2026-01-03 17:27:01 dovecot_login authenticator failed for H=(nsg-static-233.166.76.182-airtel.com) [182.95.125.122]:33678: 535 Incorrect authentication data (set_id=office@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.188.10
country_id: 3144096
description:
2026-01-03 17:27:14 dovecot_login authenticator failed for H=(cm-178.232.188.10.get.no) [178.232.188.10]:39594: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 91.92.243.14
country_id: 6252001
description:
Jan  3 17:27:45 host2 sshd[1682635]: Disconnected from invalid user ubuntu 91.92.243.14 port 43406 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 91.92.243.14
country_id: 6252001
description:
Jan  3 17:31:00 host2 sshd[1685782]: Disconnected from invalid user rehan 91.92.243.14 port 44518 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.79.195
country_id: 337996
description:
2026-01-03 17:32:05 dovecot_login authenticator failed for H=([213.55.79.199]) [213.55.79.195]:37096: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.145.142.243
country_id: 1269750
description:
2026-01-03 17:32:32 dovecot_login authenticator failed for H=([203.145.142.243]) [203.145.142.243]:37722: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.244.106
country_id: 1269750
description:
2026-01-03 17:37:11 dovecot_login authenticator failed for H=([152.52.244.106]) [152.52.244.106]:33198: 535 Incorrect authentication data (set_id=support@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.29.26
country_id: 3144096
description:
2026-01-03 17:37:24 dovecot_login authenticator failed for H=(cm-178.232.29.26.get.no) [178.232.29.26]:47719: 535 Incorrect authentication data (set_id=admin@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.178.70
country_id: 1269750
description:
2026-01-03 17:37:27 dovecot_login authenticator failed for H=([182.79.95.167]) [122.185.178.70]:40668: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.234.184.158
country_id: 357994
description:
2026-01-03 17:37:34 dovecot_plain authenticator failed for H=(648A5DR0V5VM) [41.234.184.158]:65087: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  3 17:38:14 host2 sshd[1692830]: Disconnected from invalid user admin 2.57.121.112 port 14986 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.62.126
country_id: 1269750
description:
2026-01-03 17:46:20 dovecot_login authenticator failed for H=([182.95.62.126]) [182.95.62.126]:50988: 535 Incorrect authentication data (set_id=info@kiriaswanu.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.58.211.64
country_id: 2635167
description:
Jan  3 17:47:51 host2 sshd[1703695]: Disconnected from invalid user samuel 143.58.211.64 port 58516 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.199.95.142
country_id: 3469034
description:
Jan  3 17:48:48 host2 sshd[1704568]: Disconnected from invalid user lorenza 35.199.95.142 port 52074 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 81.236.182.231
country_id: 2661886
description:
Jan  3 17:49:54 host2 sshd[1706067]: Disconnected from invalid user sinusbot1 81.236.182.231 port 44500 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 35.199.95.142
country_id: 3469034
description:
Jan  3 17:50:28 host2 sshd[1707188]: Disconnected from invalid user merlin 35.199.95.142 port 53546 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.199.95.142
country_id: 3469034
description:
Jan  3 17:51:51 host2 sshd[1708634]: Disconnected from invalid user aaron 35.199.95.142 port 52828 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.151.249
country_id: 1819730
description:
2026-01-03 17:52:04 dovecot_login authenticator failed for H=249.151.48.116.static.netvigator.com [116.48.151.249]:60065: 535 Incorrect authentication data (set_id=contact@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.58.211.64
country_id: 2635167
description:
Jan  3 17:52:07 host2 sshd[1708963]: Disconnected from invalid user testtest 143.58.211.64 port 41166 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 81.236.182.231
country_id: 2661886
description:
Jan  3 17:52:34 host2 sshd[1709564]: Disconnected from invalid user engineering 81.236.182.231 port 37812 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.58.211.64
country_id: 2635167
description:
Jan  3 17:52:39 host2 sshd[1709666]: Disconnected from invalid user ina 143.58.211.64 port 55862 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 143.58.211.64
country_id: 2635167
description:
Jan  3 17:53:12 host2 sshd[1710417]: Disconnected from invalid user luis 143.58.211.64 port 45740 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.15.216.41
country_id: 6252001
description:
2026-01-03 17:53:54 dovecot_plain authenticator failed for H=c-24-15-216-41.hsd1.il.comcast.net (boogaw) [24.15.216.41]:33892: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 81.236.182.231
country_id: 2661886
description:
Jan  3 17:54:23 host2 sshd[1712090]: Disconnected from invalid user soporte 81.236.182.231 port 45518 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.197.178
country_id: 1269750
description:
2026-01-03 17:55:39 dovecot_login authenticator failed for H=([128.185.197.178]) [128.185.197.178]:40734: 535 Incorrect authentication data (set_id=postmaster@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.52.217.71
country_id: 3686110
description:
2026-01-03 17:55:53 dovecot_login authenticator failed for H=(static-ip-cr18152021771.cable.net.co) [181.52.217.71]:48584: 535 Incorrect authentication data (set_id=postmaster@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.207.251.240
country_id: 290557
description:
2026-01-03 17:56:22 dovecot_login authenticator failed for H=([94.207.251.240]) [94.207.251.240]:50295: 535 Incorrect authentication data (set_id=contacto@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.140.38.110
country_id: 1269750
description:
2026-01-03 17:58:44 dovecot_login authenticator failed for H=(202.140.38.110.convergentindia.com) [202.140.38.110]:46970: 535 Incorrect authentication data (set_id=contact@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.33.130
country_id: 1149361
description:
2026-01-03 17:58:53 dovecot_login authenticator failed for H=([149.54.33.130]) [149.54.33.130]:45183: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.68.37.25
country_id: 2661886
description:
2026-01-03 17:59:43 dovecot_plain authenticator failed for H=78-68-37-25-no2560.tbcn.telia.com (readaly) [78.68.37.25]:54393: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2026-01-03 17:59:45 dovecot_login authenticator failed for H=([197.219.228.242]) [197.219.228.242]:56910: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.128.209.48
country_id: 3469034
description:
2026-01-03 17:59:33 dovecot_login authenticator failed for H=(138.219.244.10.static.softdados.net) [177.128.209.48]:44450: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.248.111.238
country_id: 6252001
description:
2026-01-03 17:59:39 dovecot_plain authenticator failed for H=(unconblent) [38.248.111.238]:56091: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.149.153.106
country_id: 3175395
description:
2026-01-03 18:00:16 dovecot_plain authenticator failed for H=(ceneuric) [88.149.153.106]:45635: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-03 18:00:18 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (aphorcid) [87.103.126.54]:49827: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  3 18:03:06 host2 sshd[1722654]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.161
country_id: 2993457
description:
Jan  3 18:08:15 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=194.165.16.161, lip=66.85.158.92, session=<zNSPGXtH9v7CpRCh>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.123
country_id: 6252001
description:
Jan  3 18:11:37 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.123, lip=66.85.158.91, TLS: Connection closed, session=<OV+YJXtHgAdChJl7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.188.252.208
country_id: 6252001
description:
2026-01-03 18:11:45 dovecot_plain authenticator failed for H=c-73-188-252-208.hsd1.pa.comcast.net (plogly) [73.188.252.208]:53116: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.200.217.230
country_id: 3686110
description:
Jan  3 18:14:59 host2 sshd[1736080]: Disconnected from invalid user sameer 152.200.217.230 port 53783 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 23.95.132.54
country_id: 6252001
description:
Jan  3 18:15:38 host2 sshd[1736968]: Disconnected from invalid user nimesh 23.95.132.54 port 43144 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.200.217.230
country_id: 3686110
description:
Jan  3 18:16:06 host2 sshd[1737404]: Disconnected from invalid user adam 152.200.217.230 port 33648 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.200.217.230
country_id: 3686110
description:
Jan  3 18:16:49 host2 sshd[1738098]: Disconnected from invalid user kacper 152.200.217.230 port 39433 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.200.217.230
country_id: 3686110
description:
Jan  3 18:17:26 host2 sshd[1738760]: Disconnected from invalid user ubuntu 152.200.217.230 port 45217 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 206.42.14.196
country_id: 3469034
description:
Jan  3 18:18:58 host2 sshd[1740308]: Disconnected from invalid user app 206.42.14.196 port 60668 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 206.42.14.196
country_id: 3469034
description:
Jan  3 18:19:38 host2 sshd[1740983]: Disconnected from invalid user ubuntu 206.42.14.196 port 58986 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.8.166.171
country_id: 3469034
description:
Jan  3 18:19:41 host2 sshd[1741031]: Disconnected from invalid user deploy 177.8.166.171 port 60020 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 206.42.14.196
country_id: 3469034
description:
Jan  3 18:20:22 host2 sshd[1742051]: Disconnected from invalid user student1 206.42.14.196 port 55822 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.193.178.214
country_id: 1643084
description:
Jan  3 18:20:41 host2 sshd[1742367]: Disconnected from invalid user ts 103.193.178.214 port 57378 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 23.95.132.54
country_id: 6252001
description:
Jan  3 18:21:10 host2 sshd[1742948]: Disconnected from invalid user user2 23.95.132.54 port 44362 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.187.240
country_id: 3144096
description:
2026-01-03 18:22:06 dovecot_login authenticator failed for H=(cm-84.213.187.240.get.no) [84.213.187.240]:50508: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 206.42.14.196
country_id: 3469034
description:
Jan  3 18:21:41 host2 sshd[1743654]: Disconnected from invalid user new 206.42.14.196 port 38248 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.241.128.197
country_id: 6252001
description:
2026-01-03 18:21:50 dovecot_login authenticator failed for H=(syn-067-241-128-197.res.spectrum.com) [67.241.128.197]:33558: 535 Incorrect authentication data (set_id=contact@epid.gov.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 23.95.132.54
country_id: 6252001
description:
Jan  3 18:23:01 host2 sshd[1744982]: Disconnected from invalid user student 23.95.132.54 port 51336 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.8.166.171
country_id: 3469034
description:
Jan  3 18:23:06 host2 sshd[1745070]: Disconnected from invalid user sftpuser 177.8.166.171 port 55702 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.193.178.214
country_id: 1643084
description:
Jan  3 18:23:31 host2 sshd[1745590]: Disconnected from invalid user dd 103.193.178.214 port 38432 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan  3 18:23:54 host2 sshd[1746028]: Disconnected from invalid user user 2.57.121.25 port 17593 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.193.178.214
country_id: 1643084
description:
Jan  3 18:24:26 host2 sshd[1746677]: Disconnected from invalid user radio 103.193.178.214 port 39516 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.8.166.171
country_id: 3469034
description:
Jan  3 18:24:38 host2 sshd[1746948]: Disconnected from invalid user nimesh 177.8.166.171 port 40702 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 177.8.166.171
country_id: 3469034
description:
Jan  3 18:25:30 host2 sshd[1747971]: Disconnected from invalid user ubuntu 177.8.166.171 port 57276 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Jan  3 18:26:38 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS handshaking: Connection closed, session=<0ttIW3tH2NcDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Jan  3 18:27:48 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS handshaking: Connection closed, session=<eGl8X3tHbtgDgmBb>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  3 18:29:39 host2 pure-ftpd[1752914]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  3 18:30:51 host2 sshd[1754326]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 13.74.233.64
country_id: 2963597
description:
Jan  3 18:30:48 host2 sshd[1754272]: Disconnected from invalid user couchdb 13.74.233.64 port 33318 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Jan  3 18:31:30 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (disconnected before auth was ready, waited 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<RgO2bHtHtOkDgmBb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.227.252.2
country_id: 1269750
description:
2026-01-03 18:32:10 dovecot_login authenticator failed for H=(abts-tn-dynamic-2.252.227.110.airtelbroadband.in) [110.227.252.2]:41162: 535 Incorrect authentication data (set_id=contacto@kiriaswanu.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 13.74.233.64
country_id: 2963597
description:
Jan  3 18:31:20 host2 sshd[1754774]: Disconnected from invalid user safeuser 13.74.233.64 port 58114 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Jan  3 18:33:50 host2 dovecot[1170291]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS, session=<6lsRdXtHbLsDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Jan  3 18:34:27 host2 dovecot[1170291]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS, session=<NSpHd3tHTtMDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Jan  3 18:36:08 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS handshaking: Connection closed, session=<0EJBfXtH5MsDgmBb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Jan  3 18:36:50 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@melanifinefood.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<XHSlf3tHFOQrpAFm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Jan  3 18:37:01 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<sPFrgHtHRNoDgmBb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 4.8.250.134
country_id: 6252001
description:
2026-01-03 18:38:06 dovecot_login authenticator failed for H=([4.8.250.134]) [4.8.250.134]:35274: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 182.184.118.5
country_id: 1168579
description:
Jan  3 18:38:09 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shop@essenceceylontea.com>, method=PLAIN, rip=182.184.118.5, lip=66.85.158.91, session=</qhYhHtHMJq2uHYF>


