# incident

plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 27 00:26:25 host2 sshd[1307588]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.116.199.47
country_id: 1269750
description:
2025-12-27 00:26:47 dovecot_plain authenticator failed for H=(localhost) [66.116.199.47]:45774: 535 Incorrect authentication data (set_id=support@dataesite.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.210.107.22
country_id: 3017382
description:
2025-12-27 00:27:04 dovecot_plain authenticator failed for H=vps-f35c4934.vps.ovh.net (localhost) [51.210.107.22]:58126: 535 Incorrect authentication data (set_id=hr@lankaherbalsolutions.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.47.116.225
country_id: 3175395
description:
Dec 27 00:26:12 host2 sshd[1307451]: Disconnected from invalid user ftpuser 151.47.116.225 port 31724 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.20.68
country_id: 6252001
description:
Dec 27 00:26:20 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.20.68, lip=66.85.158.92, session=<NFf6ct9GiP9BMRRE>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.47.116.225
country_id: 3175395
description:
Dec 27 00:27:22 host2 sshd[1308209]: Disconnected from invalid user mapadmin 151.47.116.225 port 31558 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 151.47.116.225
country_id: 3175395
description:
Dec 27 00:27:59 host2 sshd[1308533]: Disconnected from invalid user itadmin 151.47.116.225 port 31978 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.74.148
country_id: 1269750
description:
2025-12-27 00:30:07 dovecot_plain authenticator failed for H=(localhost) [139.59.74.148]:36048: 535 Incorrect authentication data (set_id=contact@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.116.199.47
country_id: 1269750
description:
2025-12-27 00:30:53 dovecot_plain authenticator failed for H=(localhost) [66.116.199.47]:59334: 535 Incorrect authentication data (set_id=support@nsteeleng.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.210.107.22
country_id: 3017382
description:
2025-12-27 00:30:59 dovecot_plain authenticator failed for H=vps-f35c4934.vps.ovh.net (localhost) [51.210.107.22]:43863: 535 Incorrect authentication data (set_id=hr@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.250.25.214
country_id: 6252001
description:
2025-12-27 00:31:04 dovecot_plain authenticator failed for H=(localhost) [195.250.25.214]:57880: 535 Incorrect authentication data (set_id=news@melanifinefood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.138.59.242
country_id: 6252001
description:
2025-12-27 00:31:46 dovecot_plain authenticator failed for H=(localhost) [174.138.59.242]:29032: 535 Incorrect authentication data (set_id=contact@nsteeleng.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.250.25.214
country_id: 6252001
description:
2025-12-27 00:31:10 dovecot_plain authenticator failed for H=(localhost) [195.250.25.214]:39186: 535 Incorrect authentication data (set_id=news@melanifinefood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.93.247.247
country_id: 1643084
description:
2025-12-27 00:31:17 dovecot_plain authenticator failed for H=(localhost) [202.93.247.247]:55726: 535 Incorrect authentication data (set_id=hr@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.75.110
country_id: 1149361
description:
2025-12-27 00:34:02 dovecot_login authenticator failed for H=([180.94.75.110]) [180.94.75.110]:57781: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.168.224
country_id: 2186224
description:
2025-12-27 00:34:39 dovecot_login authenticator failed for H=([121.73.168.224]) [121.73.168.224]:44956: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 163.182.174.251
country_id: 6252001
description:
2025-12-27 00:36:57 dovecot_plain authenticator failed for H=163-182-174-251.static.as40244.net (localhost) [163.182.174.251]:33986: 535 Incorrect authentication data (set_id=help@kiriaswanu.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 68.183.3.153
country_id: 2750405
description:
Dec 27 00:37:24 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=68.183.3.153, lip=66.85.158.92, TLS: Connection closed, session=<yJ6Bmt9GzstEtwOZ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.101
country_id: 6252001
description:
Dec 27 00:38:53 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.101, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<jGHRn99GNsvN0h9l>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 27 00:39:34 host2 sshd[1319716]: Disconnected from invalid user admin 2.57.121.112 port 54548 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 27 00:40:23 host2 sshd[1320971]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 200.77.172.159
country_id: 3996063
description:
Dec 27 00:42:26 host2 sshd[1322271]: Disconnected from invalid user ubuntu 200.77.172.159 port 41238 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2025-12-27 00:43:08 dovecot_login authenticator failed for H=c-71-62-34-216.hsd1.va.comcast.net [71.62.34.216]:51618: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.184.118.5
country_id: 1168579
description:
2025-12-27 00:44:11 dovecot_plain authenticator failed for H=(localhost) [182.184.118.5]:2316: 535 Incorrect authentication data (set_id=newsletter@dataesite.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.72.102.106
country_id: 1269750
description:
2025-12-27 00:43:25 dovecot_login authenticator failed for H=(nsg-static-106.102.72.182.airtel.in) [182.72.102.106]:59678: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.40.45.223
country_id: 1861060
description:
2025-12-27 00:43:45 dovecot_login authenticator failed for H=p4095-ipbfpfx02osakakita.osaka.ocn.ne.jp [60.40.45.223]:50942: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.92.76.210
country_id: 1694008
description:
2025-12-27 00:43:52 dovecot_login authenticator failed for H=(119.92.76.210.static.pldt.net) [119.92.76.210]:39460: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.155.19.76
country_id: 1814991
description:
2025-12-27 00:44:00 dovecot_plain authenticator failed for H=(localhost) [8.155.19.76]:41856: 535 Incorrect authentication data (set_id=help@melanifinefood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.184.118.5
country_id: 1168579
description:
2025-12-27 00:44:20 dovecot_plain authenticator failed for H=(localhost) [182.184.118.5]:41921: 535 Incorrect authentication data (set_id=newsletter@dataesite.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.77.172.159
country_id: 3996063
description:
Dec 27 00:44:28 host2 sshd[1323849]: Disconnected from invalid user testuser 200.77.172.159 port 54836 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.133.121.104
country_id: 1512440
description:
2025-12-27 00:45:00 dovecot_plain authenticator failed for H=(localhost) [5.133.121.104]:46582: 535 Incorrect authentication data (set_id=admin@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.29.174
country_id: 1643084
description:
2025-12-27 00:45:12 dovecot_plain authenticator failed for H=(localhost) [103.148.29.174]:34132: 535 Incorrect authentication data (set_id=info@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.64.18
country_id: 1269750
description:
2025-12-27 00:47:28 dovecot_login authenticator failed for H=([125.23.178.65]) [182.78.64.18]:39866: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.179.58.114
country_id: 1269750
description:
2025-12-27 00:47:31 dovecot_plain authenticator failed for H=server1.justsee.co.in (localhost) [180.179.58.114]:34766: 535 Incorrect authentication data (set_id=contact@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.85.134.20
country_id: 3686110
description:
2025-12-27 00:48:49 dovecot_login authenticator failed for H=([190.85.134.20]) [190.85.134.20]:43364: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 27 00:49:28 host2 sshd[1328573]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.223.53.234
country_id: 3932488
description:
2025-12-27 00:49:33 dovecot_login authenticator failed for H=([190.223.53.234]) [190.223.53.234]:36750: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.241.132.152
country_id: 1269750
description:
2025-12-27 00:50:40 dovecot_login authenticator failed for H=(static.ill.117.248.107.130.bsnl.co.in) [43.241.132.152]:60488: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.116.199.61
country_id: 1269750
description:
2025-12-27 00:51:32 dovecot_plain authenticator failed for H=(localhost) [66.116.199.61]:36430: 535 Incorrect authentication data (set_id=admin@kiriaswanu.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 167.172.247.227
country_id: 6252001
description:
Dec 27 00:51:37 host2 pure-ftpd[1331199]: (?@167.172.247.227) [INFO] New connection from 167.172.247.227


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.233.71.242
country_id: 1880251
description:
2025-12-27 00:52:57 dovecot_plain authenticator failed for H=vmi2581136.contaboserver.net (localhost) [194.233.71.242]:54184: 535 Incorrect authentication data (set_id=postfix@kiriaswanu.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.106
country_id: 6252001
description:
Dec 27 00:54:30 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=198.235.24.106, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<+mKq199G7M/G6xhq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.184.118.5
country_id: 1168579
description:
2025-12-27 00:54:41 dovecot_plain authenticator failed for H=(localhost) [182.184.118.5]:55072: 535 Incorrect authentication data (set_id=newsletter@nsteeleng.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.61.114
country_id: 1269750
description:
2025-12-27 00:55:37 dovecot_login authenticator failed for H=([122.186.50.17]) [182.95.61.114]:38380: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.22
country_id: 2186224
description:
2025-12-27 00:55:55 dovecot_login authenticator failed for H=([121.73.163.22]) [121.73.163.22]:45692: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 40.124.173.234
country_id: 6252001
description:
Dec 27 01:00:08 host2 pure-ftpd[1337921]: (?@40.124.173.234) [INFO] New connection from 40.124.173.234


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2025-12-27 01:00:35 dovecot_login authenticator failed for H=([41.220.3.113]) [41.220.3.101]:38501: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.69.209.171
country_id: 6251999
description:
2025-12-27 01:01:07 dovecot_plain authenticator failed for H=mark.tiqqedmail.com (localhost) [158.69.209.171]:43058: 535 Incorrect authentication data (set_id=support@dataesite.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.69.209.171
country_id: 6251999
description:
2025-12-27 01:01:13 dovecot_plain authenticator failed for H=mark.tiqqedmail.com (localhost) [158.69.209.171]:41594: 535 Incorrect authentication data (set_id=support@dataesite.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.251.142.45
country_id: 6252001
description:
2025-12-27 01:03:01 dovecot_plain authenticator failed for H=(localhost) [47.251.142.45]:59520: 535 Incorrect authentication data (set_id=finance@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.7.163.154
country_id: 1643084
description:
2025-12-27 01:03:07 dovecot_plain authenticator failed for H=(localhost) [114.7.163.154]:48010: 535 Incorrect authentication data (set_id=support@essenceceylontea.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.102.57
country_id: 6252001
description:
Dec 27 01:03:26 host2 sshd[1340951]: Disconnected from invalid user server 64.227.102.57 port 41314 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.252.5.53
country_id: 6252001
description:
2025-12-27 01:03:42 dovecot_plain authenticator failed for H=(localhost) [47.252.5.53]:35394: 535 Incorrect authentication data (set_id=newsletter@kiriaswanu.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 40.83.182.122
country_id: 6252001
description:
Dec 27 01:03:45 host2 sshd[1341171]: Disconnected from invalid user admin 40.83.182.122 port 46418 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 64.227.102.57
country_id: 6252001
description:
Dec 27 01:04:39 host2 sshd[1341765]: Disconnected from invalid user ec2-user 64.227.102.57 port 33102 [preauth]


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.206
country_id: 2635167
description:
Dec 27 01:05:05 host2 dovecot[1881837]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=87.236.176.206, lip=66.85.158.92, TLS, session=<kMqH/d9GV65X7LDO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.136
country_id: 2635167
description:
Dec 27 01:05:09 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.136, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<ZTTH/d9GSYVX7LCI>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 40.83.182.122
country_id: 6252001
description:
Dec 27 01:05:39 host2 sshd[1342728]: Disconnected from invalid user guest 40.83.182.122 port 55108 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.139
country_id: 2635167
description:
Dec 27 01:05:42 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=87.236.176.139, lip=66.85.158.92, TLS handshaking: Connection closed, session=<xXLC/99GJeZX7LCL>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 27 01:07:08 host2 pure-ftpd[1344022]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 12.156.67.18
country_id: 6252001
description:
Dec 27 01:06:13 host2 sshd[1343343]: Disconnected from invalid user admin 12.156.67.18 port 48306 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.254.85.115
country_id: 6252001
description:
2025-12-27 01:06:44 dovecot_plain authenticator failed for H=(localhost) [47.254.85.115]:43072: 535 Incorrect authentication data (set_id=finance@anandaobauae.org)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.119
country_id: 2635167
description:
Dec 27 01:06:49 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: read(size=693) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.119, lip=66.85.158.92, TLS handshaking: read(size=693) failed: Connection reset by peer, session=<x1m5A+BG+7hX7LB3>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.125
country_id: 2635167
description:
Dec 27 01:06:16 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: read(size=679) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=87.236.176.125, lip=66.85.158.92, TLS handshaking: read(size=679) failed: Connection reset by peer, session=<Zuq9AeBGY75X7LB9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.129.153.137
country_id: 6252001
description:
2025-12-27 01:06:20 dovecot_plain authenticator failed for H=([10.8.18.40]) [102.129.153.137]:14528: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.145
country_id: 2635167
description:
Dec 27 01:07:22 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=185.247.137.145, lip=66.85.158.92, TLS handshaking: Connection closed, session=<yYO0BeBGB7i594mR>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.231.254.192
country_id: 1819730
description:
2025-12-27 01:07:46 dovecot_plain authenticator failed for H=(localhost) [103.231.254.192]:35164: 535 Incorrect authentication data (set_id=news@kiriaswanu.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.130
country_id: 2635167
description:
Dec 27 01:07:55 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=185.247.137.130, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<yfetB+BGn+y594mC>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.123
country_id: 2635167
description:
Dec 27 01:08:29 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=185.247.137.123, lip=66.85.158.92, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<rSWrCeBG5Y+594l7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.117
country_id: 2635167
description:
Dec 27 01:09:02 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.117, lip=66.85.158.92, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<HZ2mC+BGP91X7LB1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.253.82.89
country_id: 6252001
description:
2025-12-27 01:09:32 dovecot_plain authenticator failed for H=(localhost) [47.253.82.89]:34008: 535 Incorrect authentication data (set_id=help@nsteeleng.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.144
country_id: 2635167
description:
Dec 27 01:09:35 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=185.247.137.144, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=</BagDeBGDca594mQ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.124
country_id: 2635167
description:
Dec 27 01:10:08 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=185.247.137.124, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<EnqbD+BGg+C594l8>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.138.237.18
country_id: 1269750
description:
2025-12-27 01:11:08 dovecot_plain authenticator failed for H=(localhost) [103.138.237.18]:8310: 535 Incorrect authentication data (set_id=newsletter@dataesite.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.30.14.221
country_id: 6252001
description:
2025-12-27 01:10:39 dovecot_login authenticator failed for H=pool-108-30-14-221.nycmny.fios.verizon.net [108.30.14.221]:59090: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 40.83.182.122
country_id: 6252001
description:
Dec 27 01:10:45 host2 sshd[1346623]: Disconnected from invalid user ubuntu 40.83.182.122 port 49762 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.51.135
country_id: 3144096
description:
2025-12-27 01:10:49 dovecot_login authenticator failed for H=(cm-178.232.51.135.get.no) [178.232.51.135]:36449: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.155.19.76
country_id: 1814991
description:
2025-12-27 01:13:51 dovecot_plain authenticator failed for H=(localhost) [8.155.19.76]:53856: 535 Incorrect authentication data (set_id=help@melanifinefood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.253.82.89
country_id: 6252001
description:
2025-12-27 01:16:04 dovecot_plain authenticator failed for H=(localhost) [47.253.82.89]:35734: 535 Incorrect authentication data (set_id=help@dataesite.lk)


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 47.253.82.89
country_id: 6252001
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Remote IP Address]=[47.253.82.89] [Authentication Database]=[mail] [Username]=[help@dataesite.lk] (10/10 failures) (blocked until [Sat Dec 27 19:46:02 2025 UTC/Sun Dec 28 01:16:02 2025 LOCAL])


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.92.171.7
country_id: 6252001
description:
2025-12-27 01:15:10 dovecot_plain authenticator failed for H=d3191.use1.stableserver.net (localhost) [190.92.171.7]:55310: 535 Incorrect authentication data (set_id=test@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.253.82.89
country_id: 6252001
description:
2025-12-27 01:16:10 dovecot_plain authenticator failed for H=(localhost) [47.253.82.89]:38512: 535 Incorrect authentication data (set_id=help@dataesite.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.158.39.201
country_id: 690791
description:
2025-12-27 01:16:42 dovecot_login authenticator failed for H=(95.158.39.201.bestsolution.net.ua) [95.158.39.201]:45619: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.224.75.198
country_id: 6252001
description:
2025-12-27 01:16:49 dovecot_plain authenticator failed for H=ec2-34-224-75-198.compute-1.amazonaws.com (EC2AMAZ-R0I3EM1.ec2.internal) [34.224.75.198]:61723: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.105
country_id: 3144096
description:
2025-12-27 01:17:00 dovecot_login authenticator failed for H=(105-170-97-62.cust.smartcall.no) [62.97.170.105]:49367: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.163.32.211
country_id: 6252001
description:
Dec 27 01:17:47 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.163.32.211, lip=66.85.158.91, TLS handshaking: Connection closed, session=<AznyKuBGpuIUoyDT>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.240.166.197
country_id: 6252001
description:
2025-12-27 01:18:26 dovecot_plain authenticator failed for H=vps-14540174.konverter.com.br (localhost) [162.240.166.197]:46304: 535 Incorrect authentication data (set_id=hr@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.77.202.109
country_id: 3017382
description:
2025-12-27 01:19:15 dovecot_plain authenticator failed for H=109.ip-51-77-202.eu (localhost) [51.77.202.109]:43840: 535 Incorrect authentication data (set_id=support@kiriaswanu.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 66.181.46.5
country_id: 6252001
description:
Dec 27 01:20:59 host2 sshd[1357116]: Disconnected from invalid user luis 66.181.46.5 port 57050 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.250.25.214
country_id: 6252001
description:
2025-12-27 01:22:53 dovecot_plain authenticator failed for H=(localhost) [195.250.25.214]:52572: 535 Incorrect authentication data (set_id=news@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.50
country_id: 1733045
description:
2025-12-27 01:23:17 dovecot_login authenticator failed for H=([49.124.153.50]) [49.124.153.50]:60530: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.138.237.18
country_id: 1269750
description:
2025-12-27 01:23:29 dovecot_plain authenticator failed for H=(localhost) [103.138.237.18]:8033: 535 Incorrect authentication data (set_id=newsletter@nsteeleng.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.58.116.36
country_id: 1269750
description:
2025-12-27 01:23:38 dovecot_login authenticator failed for H=([103.58.116.36]) [103.58.116.36]:5073: 535 Incorrect authentication data (set_id=training)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 66.181.46.5
country_id: 6252001
description:
Dec 27 01:25:59 host2 sshd[1361892]: Disconnected from invalid user myuser 66.181.46.5 port 58588 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.69.209.171
country_id: 6251999
description:
2025-12-27 01:25:15 dovecot_plain authenticator failed for H=mark.tiqqedmail.com (localhost) [158.69.209.171]:35638: 535 Incorrect authentication data (set_id=support@nsteeleng.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 66.181.46.5
country_id: 6252001
description:
Dec 27 01:27:03 host2 sshd[1362724]: Disconnected from invalid user dashboard 66.181.46.5 port 59782 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.160.212.122
country_id: 1643084
description:
Dec 27 01:27:21 host2 sshd[1362958]: Disconnected from invalid user server 103.160.212.122 port 50426 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.163.105.233
country_id: 1880251
description:
2025-12-27 01:28:48 dovecot_plain authenticator failed for H=(localhost) [43.163.105.233]:43780: 535 Incorrect authentication data (set_id=support@ceylondigest.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.160.212.122
country_id: 1643084
description:
Dec 27 01:29:25 host2 sshd[1365031]: Disconnected from invalid user client1 103.160.212.122 port 57462 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.138.59.242
country_id: 6252001
description:
2025-12-27 01:29:17 dovecot_plain authenticator failed for H=(localhost) [174.138.59.242]:54568: 535 Incorrect authentication data (set_id=contact@dataesite.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 66.181.46.5
country_id: 6252001
description:
Dec 27 01:30:54 host2 sshd[1366392]: Disconnected from invalid user admin1 66.181.46.5 port 56188 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.160.212.122
country_id: 1643084
description:
Dec 27 01:31:28 host2 sshd[1366766]: Disconnected from invalid user cesar 103.160.212.122 port 42638 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.213.238.91
country_id: 1210997
description:
Dec 27 01:32:39 host2 sshd[1367878]: Disconnected from invalid user monika 103.213.238.91 port 51390 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.160.212.122
country_id: 1643084
description:
Dec 27 01:32:46 host2 sshd[1367955]: Disconnected from invalid user developer1 103.160.212.122 port 42154 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.137.106.146
country_id: 1814991
description:
2025-12-27 01:34:17 dovecot_plain authenticator failed for H=(localhost) [8.137.106.146]:37632: 535 Incorrect authentication data (set_id=help@ceylondigest.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.116.220.11
country_id: 3865483
description:
Dec 27 01:35:46 host2 sshd[1370900]: Disconnected from invalid user library 181.116.220.11 port 58221 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 20.83.173.252
country_id: 6252001
description:
Dec 27 01:36:22 host2 pure-ftpd[1371417]: (?@20.83.173.252) [INFO] New connection from 20.83.173.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.138.59.242
country_id: 6252001
description:
2025-12-27 01:38:06 dovecot_plain authenticator failed for H=(localhost) [174.138.59.242]:46516: 535 Incorrect authentication data (set_id=contact@nsteeleng.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.138.59.242
country_id: 6252001
description:
2025-12-27 01:38:12 dovecot_plain authenticator failed for H=(localhost) [174.138.59.242]:15234: 535 Incorrect authentication data (set_id=contact@nsteeleng.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.116.220.11
country_id: 3865483
description:
Dec 27 01:39:03 host2 sshd[1373401]: Disconnected from invalid user user 181.116.220.11 port 40725 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.250.25.214
country_id: 6252001
description:
2025-12-27 01:40:28 dovecot_plain authenticator failed for H=(localhost) [195.250.25.214]:55742: 535 Incorrect authentication data (set_id=news@melanifinefood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2025-12-27 01:40:44 dovecot_login authenticator failed for H=([37.57.69.227]) [37.57.69.227]:59955: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.155.19.76
country_id: 1814991
description:
2025-12-27 01:43:51 dovecot_plain authenticator failed for H=(localhost) [8.155.19.76]:46992: 535 Incorrect authentication data (set_id=help@melanifinefood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 129.226.64.141
country_id: 1819730
description:
2025-12-27 01:44:02 dovecot_plain authenticator failed for H=(localhost) [129.226.64.141]:43152: 535 Incorrect authentication data (set_id=office@kiriaswanu.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 181.116.220.11
country_id: 3865483
description:
Dec 27 01:43:10 host2 sshd[1376818]: Disconnected from invalid user mini 181.116.220.11 port 39224 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 163.182.174.251
country_id: 6252001
description:
2025-12-27 01:44:14 dovecot_plain authenticator failed for H=163-182-174-251.static.as40244.net (localhost) [163.182.174.251]:33530: 535 Incorrect authentication data (set_id=help@kiriaswanu.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.206.225.242
country_id: 6252001
description:
Dec 27 01:46:04 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=172.206.225.242, lip=66.85.158.92, TLS handshaking: Connection closed, session=<RVsZkOBGDJ2szuHy>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 27 01:46:23 host2 sshd[1380226]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.116.199.47
country_id: 1269750
description:
2025-12-27 01:48:10 dovecot_plain authenticator failed for H=(localhost) [66.116.199.47]:55202: 535 Incorrect authentication data (set_id=support@dataesite.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.116.220.11
country_id: 3865483
description:
Dec 27 01:49:40 host2 sshd[1382360]: Disconnected from invalid user qiuhan 181.116.220.11 port 47498 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.93.247.247
country_id: 1643084
description:
2025-12-27 01:50:17 dovecot_plain authenticator failed for H=(localhost) [202.93.247.247]:41862: 535 Incorrect authentication data (set_id=hr@anandaobauae.org)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 27 01:50:27 host2 sshd[1383153]: Disconnected from invalid user admin 2.57.121.112 port 11811 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.116.199.47
country_id: 1269750
description:
2025-12-27 01:52:15 dovecot_plain authenticator failed for H=(localhost) [66.116.199.47]:46526: 535 Incorrect authentication data (set_id=support@nsteeleng.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.25.223.210
country_id: 798544
description:
2025-12-27 01:52:18 dovecot_plain authenticator failed for H=host-89.25.223.210.static.3s.pl (inized) [89.25.223.210]:39168: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.210.107.22
country_id: 3017382
description:
2025-12-27 01:55:01 dovecot_plain authenticator failed for H=vps-f35c4934.vps.ovh.net (localhost) [51.210.107.22]:37522: 535 Incorrect authentication data (set_id=hr@mathsmotorcysle.xyz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.74.148
country_id: 1269750
description:
2025-12-27 01:55:09 dovecot_plain authenticator failed for H=(localhost) [139.59.74.148]:49454: 535 Incorrect authentication data (set_id=contact@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.181.129.131
country_id: 798549
description:
2025-12-27 01:55:58 dovecot_plain authenticator failed for H=(meevas) [81.181.129.131]:58670: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.113
country_id: 6252001
description:
Dec 27 01:56:14 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 15 secs): user=<>, rip=66.132.153.113, lip=66.85.158.92, TLS handshaking: Connection closed, session=<XHNytOBGnPZChJlx>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.133.121.104
country_id: 1512440
description:
2025-12-27 01:56:11 dovecot_plain authenticator failed for H=(localhost) [5.133.121.104]:51144: 535 Incorrect authentication data (set_id=admin@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.153.27
country_id: 3144096
description:
2025-12-27 01:58:08 dovecot_login authenticator failed for H=(cm-178.232.153.27.get.no) [178.232.153.27]:50109: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.10.197.168
country_id: 2661886
description:
2025-12-27 01:58:28 dovecot_login authenticator failed for H=h-176-10-197-168.a444.priv.bahnhof.se [176.10.197.168]:38620: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.184.118.5
country_id: 1168579
description:
2025-12-27 02:03:29 dovecot_plain authenticator failed for H=(localhost) [182.184.118.5]:38108: 535 Incorrect authentication data (set_id=newsletter@dataesite.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.254.85.115
country_id: 6252001
description:
2025-12-27 02:06:02 dovecot_plain authenticator failed for H=(localhost) [47.254.85.115]:34508: 535 Incorrect authentication data (set_id=finance@anandaobauae.org)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 27 02:06:28 host2 sshd[1397249]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.29.174
country_id: 1643084
description:
2025-12-27 02:06:56 dovecot_plain authenticator failed for H=(localhost) [103.148.29.174]:51388: 535 Incorrect authentication data (set_id=info@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.179.58.114
country_id: 1269750
description:
2025-12-27 02:06:24 dovecot_plain authenticator failed for H=server1.justsee.co.in (localhost) [180.179.58.114]:53164: 535 Incorrect authentication data (set_id=contact@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.116.199.61
country_id: 1269750
description:
2025-12-27 02:07:19 dovecot_plain authenticator failed for H=(localhost) [66.116.199.61]:46878: 535 Incorrect authentication data (set_id=admin@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.92.57
country_id: 1168579
description:
2025-12-27 02:07:42 dovecot_login authenticator failed for H=(57.92.zcomnetworks.com.pk) [103.148.92.57]:44196: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.167.170
country_id: 2186224
description:
2025-12-27 02:08:17 dovecot_login authenticator failed for H=([121.73.167.170]) [121.73.167.170]:54640: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.69.209.171
country_id: 6251999
description:
2025-12-27 02:08:52 dovecot_plain authenticator failed for H=mark.tiqqedmail.com (localhost) [158.69.209.171]:46626: 535 Incorrect authentication data (set_id=support@dataesite.lk)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 27 02:09:13 host2 pure-ftpd[1399902]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.252.5.53
country_id: 6252001
description:
2025-12-27 02:10:56 dovecot_plain authenticator failed for H=(localhost) [47.252.5.53]:52170: 535 Incorrect authentication data (set_id=newsletter@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.7.163.154
country_id: 1643084
description:
2025-12-27 02:11:32 dovecot_plain authenticator failed for H=(localhost) [114.7.163.154]:54146: 535 Incorrect authentication data (set_id=support@melanifinefood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.184.118.5
country_id: 1168579
description:
2025-12-27 02:13:43 dovecot_plain authenticator failed for H=(localhost) [182.184.118.5]:1589: 535 Incorrect authentication data (set_id=newsletter@nsteeleng.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.20.122.54
country_id: 1605651
description:
Dec 27 02:13:52 host2 sshd[1403810]: Disconnected from invalid user teamspeak 103.20.122.54 port 56482 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.145.142.243
country_id: 1269750
description:
2025-12-27 02:15:08 dovecot_login authenticator failed for H=([203.145.142.243]) [203.145.142.243]:45132: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.207.30.137
country_id: 290557
description:
2025-12-27 02:15:28 dovecot_login authenticator failed for H=([94.207.30.137]) [94.207.30.137]:58870: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 35.216.156.249
country_id: 2658434
description:
Dec 27 02:15:53 host2 pure-ftpd[1405563]: (?@35.216.156.249) [INFO] New connection from 35.216.156.249


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 35.216.156.249
country_id: 2658434
description:
Dec 27 02:15:57 host2 pure-ftpd[1405655]: (?@35.216.156.249) [INFO] New connection from 35.216.156.249


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.168.61
country_id: 2186224
description:
2025-12-27 02:16:52 dovecot_login authenticator failed for H=([121.73.168.61]) [121.73.168.61]:49624: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.126.240.80
country_id: 2661886
description:
2025-12-27 02:16:39 dovecot_login authenticator failed for H=([188.126.240.80]) [188.126.240.80]:44854: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 82.25.56.66
country_id: 2635167
description:
Dec 27 02:18:18 host2 sshd[1407445]: Disconnected from invalid user angela 82.25.56.66 port 46938 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.226.118
country_id: 1880251
description:
Dec 27 02:18:54 host2 sshd[1407819]: Disconnected from invalid user theta 45.78.226.118 port 47666 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.20.122.54
country_id: 1605651
description:
Dec 27 02:19:07 host2 sshd[1408130]: Disconnected from invalid user minerhub 103.20.122.54 port 40766 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.20.122.54
country_id: 1605651
description:
Dec 27 02:20:22 host2 sshd[1409399]: Disconnected from invalid user developer 103.20.122.54 port 48320 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.226.118
country_id: 1880251
description:
Dec 27 02:20:43 host2 sshd[1409734]: Disconnected from invalid user ubuntu 45.78.226.118 port 48646 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 82.25.56.66
country_id: 2635167
description:
Dec 27 02:21:30 host2 sshd[1410308]: Received disconnect from 82.25.56.66 port 56704:11: Bye Bye [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 82.25.56.66
country_id: 2635167
description:
Dec 27 02:22:01 host2 sshd[1410624]: Disconnected from invalid user borg 82.25.56.66 port 39878 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.77.202.109
country_id: 3017382
description:
2025-12-27 02:22:26 dovecot_plain authenticator failed for H=109.ip-51-77-202.eu (localhost) [51.77.202.109]:49898: 535 Incorrect authentication data (set_id=support@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.92.171.7
country_id: 6252001
description:
2025-12-27 02:24:13 dovecot_plain authenticator failed for H=d3191.use1.stableserver.net (localhost) [190.92.171.7]:52928: 535 Incorrect authentication data (set_id=test@ceylondigest.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 87.236.176.85
country_id: 2635167
description:
Dec 27 02:25:59 host2 pure-ftpd[1414144]: (?@87.236.176.85) [INFO] New connection from 87.236.176.85


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.231.254.192
country_id: 1819730
description:
2025-12-27 02:26:08 dovecot_plain authenticator failed for H=(localhost) [103.231.254.192]:59756: 535 Incorrect authentication data (set_id=news@kiriaswanu.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 194.165.16.162
country_id: 2993457
description:
Dec 27 02:25:17 host2 pure-ftpd[1413622]: (?@194.165.16.162) [INFO] New connection from 194.165.16.162


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.231.254.192
country_id: 1819730
description:
2025-12-27 02:26:16 dovecot_plain authenticator failed for H=(localhost) [103.231.254.192]:58758: 535 Incorrect authentication data (set_id=news@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.25.223.210
country_id: 798544
description:
2025-12-27 02:26:19 dovecot_plain authenticator failed for H=host-89.25.223.210.static.3s.pl (plusly) [89.25.223.210]:41208: 535 Incorrect authentication data (set_id=it@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.197.8.115
country_id: 3175395
description:
Dec 27 02:27:37 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<chitral00@bostonlanka.com>, method=PLAIN, rip=185.197.8.115, lip=66.85.158.91, TLS, session=<BqqyI+FGKte5xQhz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.70.126.215
country_id: 1269750
description:
Dec 27 02:28:01 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<chitral00>, method=PLAIN, rip=103.70.126.215, lip=66.85.158.91, TLS, session=<eXDdJOFGZa9nRn7X>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.186.147.126
country_id: 1880251
description:
2025-12-27 02:28:19 dovecot_plain authenticator failed for H=126.147.186.35.bc.googleusercontent.com (localhost) [35.186.147.126]:54226: 535 Incorrect authentication data (set_id=webmaster@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.210.107.22
country_id: 3017382
description:
2025-12-27 02:28:36 dovecot_plain authenticator failed for H=vps-f35c4934.vps.ovh.net (localhost) [51.210.107.22]:54654: 535 Incorrect authentication data (set_id=hr@lankaherbalsolutions.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.240.166.197
country_id: 6252001
description:
2025-12-27 02:29:00 dovecot_plain authenticator failed for H=vps-14540174.konverter.com.br (localhost) [162.240.166.197]:41068: 535 Incorrect authentication data (set_id=hr@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.237
country_id: 2186224
description:
2025-12-27 02:30:17 dovecot_login authenticator failed for H=([121.73.169.237]) [121.73.169.237]:44884: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.231.25.64
country_id: 3686110
description:
2025-12-27 02:30:40 dovecot_login authenticator failed for H=(1522312565.colombiatel.co) [152.231.25.64]:54641: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.250.25.214
country_id: 6252001
description:
2025-12-27 02:32:08 dovecot_plain authenticator failed for H=(localhost) [195.250.25.214]:51992: 535 Incorrect authentication data (set_id=news@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.69.209.171
country_id: 6251999
description:
2025-12-27 02:32:52 dovecot_plain authenticator failed for H=mark.tiqqedmail.com (localhost) [158.69.209.171]:44370: 535 Incorrect authentication data (set_id=support@nsteeleng.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.250.25.214
country_id: 6252001
description:
2025-12-27 02:32:14 dovecot_plain authenticator failed for H=(localhost) [195.250.25.214]:52870: 535 Incorrect authentication data (set_id=news@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.210.107.22
country_id: 3017382
description:
2025-12-27 02:32:37 dovecot_plain authenticator failed for H=vps-f35c4934.vps.ovh.net (localhost) [51.210.107.22]:40878: 535 Incorrect authentication data (set_id=hr@bostonlanka.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 27 02:33:26 host2 sshd[1420987]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.138.59.242
country_id: 6252001
description:
2025-12-27 02:35:27 dovecot_plain authenticator failed for H=(localhost) [174.138.59.242]:21908: 535 Incorrect authentication data (set_id=contact@dataesite.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 78.31.145.135
country_id: 798544
description:
Dec 27 02:36:53 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@simple-engineering.lk>, method=PLAIN, rip=78.31.145.135, lip=66.85.158.91, TLS, session=<bnXfROFGrqNOH5GH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.0.122.190
country_id: 226074
description:
Dec 27 02:37:15 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=196.0.122.190, lip=66.85.158.91, TLS, session=<KuL/ReFGuOTEAHq+>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 27 02:38:22 host2 sshd[1425845]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.243.166.66
country_id: 3686110
description:
2025-12-27 02:38:10 dovecot_login authenticator failed for H=([8.243.166.66]) [8.243.166.66]:4501: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.138.237.18
country_id: 1269750
description:
2025-12-27 02:40:46 dovecot_plain authenticator failed for H=(localhost) [103.138.237.18]:6350: 535 Incorrect authentication data (set_id=newsletter@nsteeleng.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.145.126
country_id: 1819730
description:
2025-12-27 02:44:49 dovecot_login authenticator failed for H=([223.197.145.126]) [223.197.145.126]:51181: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 174.138.59.242
country_id: 6252001
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Remote IP Address]=[174.138.59.242] [Authentication Database]=[mail] [Username]=[contact@nsteeleng.com] (10/10 failures) (blocked until [Sat Dec 27 21:14:14 2025 UTC/Sun Dec 28 02:44:14 2025 LOCAL])


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.138.59.242
country_id: 6252001
description:
2025-12-27 02:44:16 dovecot_plain authenticator failed for H=(localhost) [174.138.59.242]:10522: 535 Incorrect authentication data (set_id=contact@nsteeleng.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 27 02:45:50 host2 sshd[1433529]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.237.78.41
country_id: 3469034
description:
Dec 27 02:45:38 host2 sshd[1433402]: Disconnected from invalid user gmodserver 45.237.78.41 port 44486 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.163.105.233
country_id: 1880251
description:
2025-12-27 02:45:47 dovecot_plain authenticator failed for H=(localhost) [43.163.105.233]:53690: 535 Incorrect authentication data (set_id=support@ceylondigest.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.237.78.41
country_id: 3469034
description:
Dec 27 02:46:14 host2 sshd[1433996]: Disconnected from invalid user confluence 45.237.78.41 port 55436 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.237.78.41
country_id: 3469034
description:
Dec 27 02:47:25 host2 sshd[1435037]: Disconnected from invalid user joaquin 45.237.78.41 port 44598 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.251.142.45
country_id: 6252001
description:
2025-12-27 02:48:40 dovecot_plain authenticator failed for H=(localhost) [47.251.142.45]:54274: 535 Incorrect authentication data (set_id=finance@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.216.16
country_id: 3996063
description:
2025-12-27 02:49:49 dovecot_login authenticator failed for H=(201.173.216.16-clientes-izzi.mx) [201.173.216.16]:54789: 535 Incorrect authentication data (set_id=hnt@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.250.25.214
country_id: 6252001
description:
2025-12-27 02:49:34 dovecot_plain authenticator failed for H=(localhost) [195.250.25.214]:33794: 535 Incorrect authentication data (set_id=news@melanifinefood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.223.20.191
country_id: 2077456
description:
2025-12-27 02:50:21 dovecot_login authenticator failed for H=194-223-20-191.tpgi.com.au [194.223.20.191]:50899: 535 Incorrect authentication data (set_id=hnt)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 163.182.174.251
country_id: 6252001
description:
2025-12-27 02:50:51 dovecot_plain authenticator failed for H=163-182-174-251.static.as40244.net (localhost) [163.182.174.251]:43964: 535 Incorrect authentication data (set_id=help@kiriaswanu.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 35.195.185.167
country_id: 2802361
description:
Dec 27 02:52:38 host2 pure-ftpd[1439641]: (?@35.195.185.167) [INFO] New connection from 35.195.185.167


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.168.117
country_id: 3144096
description:
2025-12-27 02:52:57 dovecot_login authenticator failed for H=(cm-178.232.168.117.get.no) [178.232.168.117]:36701: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.89.14
country_id: 1269750
description:
2025-12-27 02:52:15 dovecot_login authenticator failed for H=([152.52.14.137]) [182.79.89.14]:60696: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 18.97.5.45
country_id: 6252001
description:
Dec 27 02:53:40 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=18.97.5.45, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<XM7dgeFGBoMSYQUt>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.137.106.146
country_id: 1814991
description:
2025-12-27 02:55:59 dovecot_plain authenticator failed for H=(localhost) [8.137.106.146]:37130: 535 Incorrect authentication data (set_id=help@ceylondigest.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 27 03:00:30 host2 sshd[1446943]: Disconnected from invalid user admin 2.57.121.112 port 32283 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.73.108
country_id: 294640
description:
2025-12-27 03:03:54 dovecot_login authenticator failed for H=(2-55-73-108.orange.net.il) [2.55.73.108]:35042: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.153.161.238
country_id: 2510769
description:
2025-12-27 03:04:09 dovecot_login authenticator failed for H=238.red-79-153-161.dynamicip.rima-tde.net [79.153.161.238]:37621: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.139.107.146
country_id: 1269750
description:
2025-12-27 03:04:35 dovecot_login authenticator failed for H=([14.139.107.146]) [14.139.107.146]:44400: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.129.206.14
country_id: 1269750
description:
2025-12-27 03:05:03 dovecot_login authenticator failed for H=([203.129.206.14]) [203.129.206.14]:36818: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.7.163.154
country_id: 1643084
description:
2025-12-27 03:05:54 dovecot_plain authenticator failed for H=(localhost) [114.7.163.154]:58770: 535 Incorrect authentication data (set_id=support@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.122
country_id: 1269750
description:
2025-12-27 03:06:01 dovecot_login authenticator failed for H=([152.52.236.122]) [152.52.236.122]:52966: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.134.27.194
country_id: 1210997
description:
2025-12-27 03:06:23 dovecot_login authenticator failed for H=([103.134.27.194]) [103.134.27.194]:54998: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.133.121.104
country_id: 1512440
description:
2025-12-27 03:07:18 dovecot_plain authenticator failed for H=(localhost) [5.133.121.104]:56022: 535 Incorrect authentication data (set_id=admin@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.243.166.66
country_id: 3686110
description:
2025-12-27 03:08:55 dovecot_login authenticator failed for H=([8.243.166.66]) [8.243.166.66]:4501: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.238.252.46
country_id: 241170
description:
2025-12-27 03:08:57 dovecot_login authenticator failed for H=([156.238.252.46]) [156.238.252.46]:35440: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.93.247.247
country_id: 1643084
description:
2025-12-27 03:09:00 dovecot_plain authenticator failed for H=(localhost) [202.93.247.247]:34312: 535 Incorrect authentication data (set_id=hr@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.172.79.198
country_id: 1819730
description:
2025-12-27 03:09:27 dovecot_login authenticator failed for H=69-172-79-198.static.imsbiz.com ([173.248.234.145]) [69.172.79.198]:63302: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 100.37.16.11
country_id: 6252001
description:
2025-12-27 03:09:10 dovecot_login authenticator failed for H=pool-100-37-16-11.nycmny.fios.verizon.net [100.37.16.11]:56899: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.116.199.47
country_id: 1269750
description:
2025-12-27 03:09:21 dovecot_plain authenticator failed for H=(localhost) [66.116.199.47]:42908: 535 Incorrect authentication data (set_id=support@dataesite.lk)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 27 03:11:33 host2 pure-ftpd[1458463]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.116.199.47
country_id: 1269750
description:
2025-12-27 03:13:22 dovecot_plain authenticator failed for H=(localhost) [66.116.199.47]:53370: 535 Incorrect authentication data (set_id=support@nsteeleng.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.69.209.171
country_id: 6251999
description:
2025-12-27 03:16:21 dovecot_plain authenticator failed for H=mark.tiqqedmail.com (localhost) [158.69.209.171]:43870: 535 Incorrect authentication data (set_id=support@dataesite.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 129.226.64.141
country_id: 1819730
description:
2025-12-27 03:16:23 dovecot_plain authenticator failed for H=(localhost) [129.226.64.141]:49738: 535 Incorrect authentication data (set_id=office@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.252.5.53
country_id: 6252001
description:
2025-12-27 03:18:01 dovecot_plain authenticator failed for H=(localhost) [47.252.5.53]:40682: 535 Incorrect authentication data (set_id=newsletter@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.74.148
country_id: 1269750
description:
2025-12-27 03:18:18 dovecot_plain authenticator failed for H=(localhost) [139.59.74.148]:55090: 535 Incorrect authentication data (set_id=contact@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.184.118.5
country_id: 1168579
description:
2025-12-27 03:21:39 dovecot_plain authenticator failed for H=(localhost) [182.184.118.5]:49806: 535 Incorrect authentication data (set_id=newsletter@dataesite.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.179.58.114
country_id: 1269750
description:
2025-12-27 03:23:41 dovecot_plain authenticator failed for H=server1.justsee.co.in (localhost) [180.179.58.114]:56978: 535 Incorrect authentication data (set_id=contact@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.116.199.61
country_id: 1269750
description:
2025-12-27 03:23:10 dovecot_plain authenticator failed for H=(localhost) [66.116.199.61]:36858: 535 Incorrect authentication data (set_id=admin@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.77.202.109
country_id: 3017382
description:
2025-12-27 03:25:34 dovecot_plain authenticator failed for H=109.ip-51-77-202.eu (localhost) [51.77.202.109]:49718: 535 Incorrect authentication data (set_id=support@kiriaswanu.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 206.189.60.73
country_id: 2921044
description:
Dec 27 03:26:10 host2 pure-ftpd[1472556]: (?@206.189.60.73) [INFO] New connection from 206.189.60.73


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 159.65.114.64
country_id: 2921044
description:
Dec 27 03:26:09 host2 pure-ftpd[1472546]: (?@159.65.114.64) [INFO] New connection from 159.65.114.64


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 27 03:30:05 host2 sshd[1475357]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.87.203.155
country_id: 3469034
description:
Dec 27 03:29:22 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 26 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=177.87.203.155, lip=66.85.158.91, TLS, session=<0Sn2/+FGdbOxV8ub>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.74.7.3
country_id: 2395170
description:
Dec 27 03:29:42 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<designdpt>, method=PLAIN, rip=41.74.7.3, lip=66.85.158.91, TLS, session=<gnycAeJGqNEpSgcD>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.224.75.198
country_id: 6252001
description:
2025-12-27 03:31:23 dovecot_plain authenticator failed for H=ec2-34-224-75-198.compute-1.amazonaws.com (EC2AMAZ-R0I3EM1.ec2.internal) [34.224.75.198]:56277: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.116.199.61
country_id: 1269750
description:
2025-12-27 03:31:30 dovecot_plain authenticator failed for H=(localhost) [66.116.199.61]:43814: 535 Incorrect authentication data (set_id=info@kiriaswanu.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.76.224
country_id: 3469034
description:
Dec 27 03:33:12 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<chitral00@bostonlanka.com>, method=PLAIN, rip=187.120.76.224, lip=66.85.158.91, TLS, session=<MVQqDuJGpJK7eEzg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.155.128.51
country_id: 3469034
description:
Dec 27 03:33:32 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<chitral00>, method=PLAIN, rip=177.155.128.51, lip=66.85.158.91, TLS, session=<hatgD+JGtdWxm4Az>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.215.98.8
country_id: 3144096
description:
2025-12-27 03:33:57 dovecot_login authenticator failed for H=(cm-84.215.98.8.get.no) [84.215.98.8]:51384: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.74.0.182
country_id: 3469034
description:
2025-12-27 03:34:20 dovecot_login authenticator failed for H=([177.74.52.129]) [177.74.0.182]:55568: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.139.107.146
country_id: 1269750
description:
2025-12-27 03:36:15 dovecot_login authenticator failed for H=([14.139.107.146]) [14.139.107.146]:32996: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 99.92.204.98
country_id: 6252001
description:
Dec 27 03:36:17 host2 sshd[1479762]: Disconnected from invalid user vijay 99.92.204.98 port 59902 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.236.228.115
country_id: 6252001
description:
Dec 27 03:36:44 host2 dovecot[1881837]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=172.236.228.115, lip=66.85.158.91, session=<Jj3dG+JGnlWs7ORz>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.1.18
country_id: 1819730
description:
Dec 27 03:40:54 host2 sshd[1483741]: Disconnected from invalid user pepper 165.154.1.18 port 51162 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 99.92.204.98
country_id: 6252001
description:
Dec 27 03:42:32 host2 sshd[1485516]: Disconnected from invalid user sabine 99.92.204.98 port 38060 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.231.254.192
country_id: 1819730
description:
2025-12-27 03:43:16 dovecot_plain authenticator failed for H=(localhost) [103.231.254.192]:57504: 535 Incorrect authentication data (set_id=info@kiriaswanu.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 99.92.204.98
country_id: 6252001
description:
Dec 27 03:43:35 host2 sshd[1486275]: Disconnected from invalid user helpdesk 99.92.204.98 port 53908 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.1.18
country_id: 1819730
description:
Dec 27 03:43:44 host2 sshd[1486370]: Disconnected from invalid user hadoop 165.154.1.18 port 36816 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 86.54.42.71
country_id: 241170
description:
[2025-12-27 03:43:57 +0530] info [webmaild] 86.54.42.71 - - "POST /cpsess0130295740/3rdparty/roundcube/:2087/json-api/create_user_session HTTP/1.1" FAILED LOGIN webmaild: user name not provided or invalid user


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 165.154.1.18
country_id: 1819730
description:
Dec 27 03:44:31 host2 sshd[1487295]: Disconnected from invalid user runo 165.154.1.18 port 60296 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.1.18
country_id: 1819730
description:
Dec 27 03:45:17 host2 sshd[1488530]: Disconnected from invalid user ts3server 165.154.1.18 port 55978 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.74.136.134
country_id: 6252001
description:
2025-12-27 03:45:20 dovecot_plain authenticator failed for H=syn-050-074-136-134.biz.spectrum.com (becous) [50.74.136.134]:39086: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.69.209.171
country_id: 6251999
description:
2025-12-27 03:49:12 dovecot_plain authenticator failed for H=mark.tiqqedmail.com (localhost) [158.69.209.171]:38902: 535 Incorrect authentication data (set_id=info@dataesite.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.210.107.22
country_id: 3017382
description:
2025-12-27 03:49:14 dovecot_plain authenticator failed for H=vps-f35c4934.vps.ovh.net (localhost) [51.210.107.22]:43173: 535 Incorrect authentication data (set_id=info@mathsmotorcysle.xyz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.138.237.18
country_id: 1269750
description:
2025-12-27 03:50:44 dovecot_plain authenticator failed for H=(localhost) [103.138.237.18]:10832: 535 Incorrect authentication data (set_id=support@dataesite.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.252.5.53
country_id: 6252001
description:
2025-12-27 03:52:22 dovecot_plain authenticator failed for H=(localhost) [47.252.5.53]:54086: 535 Incorrect authentication data (set_id=info@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.186.147.126
country_id: 1880251
description:
2025-12-27 03:53:03 dovecot_plain authenticator failed for H=126.147.186.35.bc.googleusercontent.com (localhost) [35.186.147.126]:25418: 535 Incorrect authentication data (set_id=admin@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-27 03:53:28 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:59667: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.186.147.126
country_id: 1880251
description:
2025-12-27 03:53:11 dovecot_plain authenticator failed for H=126.147.186.35.bc.googleusercontent.com (localhost) [35.186.147.126]:26402: 535 Incorrect authentication data (set_id=admin@anandaobauae.org)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 95.0.32.105
country_id: 298795
description:
Dec 27 03:54:39 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@simple-engineering.lk>, method=PLAIN, rip=95.0.32.105, lip=66.85.158.91, TLS, session=<t3r5WuJGA9dfACBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.236.172.41
country_id: 798544
description:
Dec 27 03:54:58 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=91.236.172.41, lip=66.85.158.91, TLS, session=<XqAMXOJGXKZb7Kwp>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 95.85.114.218
country_id: 1218197
description:
Dec 27 03:58:07 host2 sshd[1501498]: Disconnected from invalid user systest 95.85.114.218 port 52846 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.85.114.218
country_id: 1218197
description:
Dec 27 03:58:29 host2 sshd[1501737]: Disconnected from invalid user marvin 95.85.114.218 port 35768 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.92.171.7
country_id: 6252001
description:
2025-12-27 04:01:25 dovecot_plain authenticator failed for H=d3191.use1.stableserver.net (localhost) [190.92.171.7]:49336: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.138.237.18
country_id: 1269750
description:
2025-12-27 04:03:06 dovecot_plain authenticator failed for H=(localhost) [103.138.237.18]:1728: 535 Incorrect authentication data (set_id=support@nsteeleng.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.138.237.18
country_id: 1269750
description:
2025-12-27 04:03:14 dovecot_plain authenticator failed for H=(localhost) [103.138.237.18]:19450: 535 Incorrect authentication data (set_id=support@nsteeleng.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.240.166.197
country_id: 6252001
description:
2025-12-27 04:03:17 dovecot_plain authenticator failed for H=vps-14540174.konverter.com.br (localhost) [162.240.166.197]:54368: 535 Incorrect authentication data (set_id=info@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.7.163.154
country_id: 1643084
description:
2025-12-27 04:04:16 dovecot_plain authenticator failed for H=(localhost) [114.7.163.154]:35474: 535 Incorrect authentication data (set_id=support@melanifinefood.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.212
country_id: 6252001
description:
Dec 27 04:05:57 host2 pure-ftpd[1510226]: (?@198.235.24.212) [INFO] New connection from 198.235.24.212


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 129.226.64.141
country_id: 1819730
description:
2025-12-27 04:06:07 dovecot_plain authenticator failed for H=(localhost) [129.226.64.141]:55836: 535 Incorrect authentication data (set_id=info@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 129.226.64.141
country_id: 1819730
description:
2025-12-27 04:06:15 dovecot_plain authenticator failed for H=(localhost) [129.226.64.141]:45128: 535 Incorrect authentication data (set_id=info@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.137.106.146
country_id: 1814991
description:
2025-12-27 04:07:04 dovecot_plain authenticator failed for H=(localhost) [8.137.106.146]:59260: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.137.106.146
country_id: 1814991
description:
2025-12-27 04:07:12 dovecot_plain authenticator failed for H=(localhost) [8.137.106.146]:44958: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.250.42
country_id: 3996063
description:
2025-12-27 04:07:17 dovecot_login authenticator failed for H=(201.173.250.42-clientes-izzi.mx) [201.173.250.42]:34502: 535 Incorrect authentication data (set_id=accounts@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.163.105.233
country_id: 1880251
description:
2025-12-27 04:07:21 dovecot_plain authenticator failed for H=(localhost) [43.163.105.233]:40164: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.250.25.214
country_id: 6252001
description:
2025-12-27 04:09:12 dovecot_plain authenticator failed for H=(localhost) [195.250.25.214]:33500: 535 Incorrect authentication data (set_id=info@essenceceylontea.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 27 04:09:47 host2 sshd[1514492]: Disconnected from invalid user admin 2.57.121.112 port 44240 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.77.202.109
country_id: 3017382
description:
2025-12-27 04:11:40 dovecot_plain authenticator failed for H=109.ip-51-77-202.eu (localhost) [51.77.202.109]:38854: 535 Incorrect authentication data (set_id=info@kiriaswanu.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 27 04:12:16 host2 pure-ftpd[1517819]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.69.209.171
country_id: 6251999
description:
2025-12-27 04:13:10 dovecot_plain authenticator failed for H=mark.tiqqedmail.com (localhost) [158.69.209.171]:52038: 535 Incorrect authentication data (set_id=info@nsteeleng.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 27 04:16:48 host2 sshd[1523583]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.138.59.242
country_id: 6252001
description:
2025-12-27 04:18:23 dovecot_plain authenticator failed for H=(localhost) [174.138.59.242]:54424: 535 Incorrect authentication data (set_id=info@dataesite.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 27 04:19:14 host2 sshd[1526302]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 20.169.104.246
country_id: 6252001
description:
Dec 27 04:19:29 host2 pure-ftpd[1526493]: (?@20.169.104.246) [INFO] New connection from 20.169.104.246


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 40.124.174.207
country_id: 6252001
description:
Dec 27 04:19:30 host2 pure-ftpd[1526509]: (?@40.124.174.207) [INFO] New connection from 40.124.174.207


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.116.199.47
country_id: 1269750
description:
2025-12-27 04:21:46 dovecot_plain authenticator failed for H=(localhost) [66.116.199.47]:46830: 535 Incorrect authentication data (set_id=info@dataesite.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.210.107.22
country_id: 3017382
description:
2025-12-27 04:22:53 dovecot_plain authenticator failed for H=vps-f35c4934.vps.ovh.net (localhost) [51.210.107.22]:59838: 535 Incorrect authentication data (set_id=info@lankaherbalsolutions.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.74.148
country_id: 1269750
description:
2025-12-27 04:24:05 dovecot_plain authenticator failed for H=(localhost) [139.59.74.148]:38840: 535 Incorrect authentication data (set_id=admin@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.74.148
country_id: 1269750
description:
2025-12-27 04:24:14 dovecot_plain authenticator failed for H=(localhost) [139.59.74.148]:50664: 535 Incorrect authentication data (set_id=admin@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.116.199.47
country_id: 1269750
description:
2025-12-27 04:25:50 dovecot_plain authenticator failed for H=(localhost) [66.116.199.47]:38236: 535 Incorrect authentication data (set_id=info@nsteeleng.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.93.247.247
country_id: 1643084
description:
2025-12-27 04:26:03 dovecot_plain authenticator failed for H=(localhost) [202.93.247.247]:51686: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.93.247.247
country_id: 1643084
description:
2025-12-27 04:26:11 dovecot_plain authenticator failed for H=(localhost) [202.93.247.247]:38454: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.250.25.214
country_id: 6252001
description:
2025-12-27 04:26:37 dovecot_plain authenticator failed for H=(localhost) [195.250.25.214]:43182: 535 Incorrect authentication data (set_id=info@melanifinefood.com)


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 195.250.25.214
country_id: 6252001
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Remote IP Address]=[195.250.25.214] [Authentication Database]=[mail] [Username]=[info@melanifinefood.com] (10/10 failures) (blocked until [Sat Dec 27 22:56:35 2025 UTC/Sun Dec 28 04:26:35 2025 LOCAL])


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.212
country_id: 1819730
description:
2025-12-27 04:26:48 dovecot_login authenticator failed for H=212.42.246.220.static.netvigator.com [220.246.42.212]:49826: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.210.107.22
country_id: 3017382
description:
2025-12-27 04:26:52 dovecot_plain authenticator failed for H=vps-f35c4934.vps.ovh.net (localhost) [51.210.107.22]:46113: 535 Incorrect authentication data (set_id=info@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.146.202.174
country_id: 1643084
description:
Dec 27 04:26:59 host2 sshd[1536515]: Disconnected from invalid user rob 103.146.202.174 port 49664 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.112.148.66
country_id: 130758
description:
2025-12-27 04:27:11 dovecot_login authenticator failed for H=([185.112.148.66]) [185.112.148.66]:50703: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.138.59.242
country_id: 6252001
description:
2025-12-27 04:27:10 dovecot_plain authenticator failed for H=(localhost) [174.138.59.242]:57122: 535 Incorrect authentication data (set_id=info@nsteeleng.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.129.217.70
country_id: 1269750
description:
2025-12-27 04:27:25 dovecot_login authenticator failed for H=([203.129.217.70]) [203.129.217.70]:56165: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.0.38.130
country_id: 1210997
description:
2025-12-27 04:27:37 dovecot_login authenticator failed for H=([49.0.38.130]) [49.0.38.130]:42390: 535 Incorrect authentication data (set_id=training)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.206.93.90
country_id: 290557
description:
2025-12-27 04:28:25 dovecot_login authenticator failed for H=([94.206.93.90]) [94.206.93.90]:42106: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.46.98
country_id: 953987
description:
Dec 27 04:28:24 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<chitral00@bostonlanka.com>, method=PLAIN, rip=102.64.46.98, lip=66.85.158.91, TLS, session=<sdR+0+JGDcZmQC5i>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.39.212.77
country_id: 2510769
description:
Dec 27 04:28:45 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<chitral00>, method=PLAIN, rip=46.39.212.77, lip=66.85.158.91, TLS, session=<l8fP1OJGnYouJ9RN>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.124.148.87
country_id: 1880251
description:
Dec 27 04:30:10 host2 sshd[1542401]: Disconnected from invalid user chromeuser 34.124.148.87 port 40154 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 163.182.174.251
country_id: 6252001
description:
2025-12-27 04:31:57 dovecot_plain authenticator failed for H=163-182-174-251.static.as40244.net (localhost) [163.182.174.251]:59836: 535 Incorrect authentication data (set_id=info@kiriaswanu.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 179.0.251.234
country_id: 3865483
description:
Dec 27 04:32:08 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@simple-engineering.lk>, method=PLAIN, rip=179.0.251.234, lip=66.85.158.91, TLS, session=<9Iu94OJGvqOzAPvq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.250.210
country_id: 3865483
description:
Dec 27 04:32:31 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=179.0.250.210, lip=66.85.158.91, TLS, session=<Ja0r4uJGTpezAPrS>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.146.202.174
country_id: 1643084
description:
Dec 27 04:32:32 host2 sshd[1544477]: Disconnected from invalid user admin 103.146.202.174 port 52770 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.143.72
country_id: 1880251
description:
Dec 27 04:35:02 host2 sshd[1546295]: Disconnected from invalid user auditor 101.47.143.72 port 56166 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.135.25.184
country_id: 1522867
description:
2025-12-27 04:34:23 dovecot_login authenticator failed for H=2.135.25.184.dynamic.telecom.kz [2.135.25.184]:47063: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.124.148.87
country_id: 1880251
description:
Dec 27 04:34:36 host2 sshd[1546000]: Disconnected from invalid user user 34.124.148.87 port 56056 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.54
country_id: 3144096
description:
2025-12-27 04:34:52 dovecot_login authenticator failed for H=(54-170-97-62.cust.smartcall.no) [62.97.170.54]:55531: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 34.124.148.87
country_id: 1880251
description:
Dec 27 04:35:21 host2 sshd[1546750]: Disconnected from invalid user test001 34.124.148.87 port 34574 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.184.118.5
country_id: 1168579
description:
2025-12-27 04:37:16 dovecot_plain authenticator failed for H=(localhost) [182.184.118.5]:26312: 535 Incorrect authentication data (set_id=info@dataesite.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.179.58.114
country_id: 1269750
description:
2025-12-27 04:39:47 dovecot_plain authenticator failed for H=server1.justsee.co.in (localhost) [180.179.58.114]:59936: 535 Incorrect authentication data (set_id=admin@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.133.121.104
country_id: 1512440
description:
2025-12-27 04:40:20 dovecot_plain authenticator failed for H=(localhost) [5.133.121.104]:51796: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.47.143.72
country_id: 1880251
description:
Dec 27 04:40:59 host2 sshd[1551797]: Disconnected from invalid user jerry 101.47.143.72 port 38122 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.29.174
country_id: 1643084
description:
2025-12-27 04:41:44 dovecot_plain authenticator failed for H=(localhost) [103.148.29.174]:52614: 535 Incorrect authentication data (set_id=support@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.224.75.198
country_id: 6252001
description:
2025-12-27 04:41:51 dovecot_plain authenticator failed for H=ec2-34-224-75-198.compute-1.amazonaws.com (EC2AMAZ-R0I3EM1.ec2.internal) [34.224.75.198]:54693: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2025-12-27 04:45:03 dovecot_login authenticator failed for H=([197.219.228.242]) [197.219.228.242]:47722: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 158.94.210.79
country_id: 2750405
description:
[2025-12-27 04:45:24 +0530] info [whostmgrd] 158.94.210.79 - bhelpitiya "GET /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.61.176.110
country_id: 3469034
description:
2025-12-27 04:45:42 dovecot_login authenticator failed for H=([187.50.122.20]) [177.61.176.110]:38187: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.255.199.235
country_id: 2413451
description:
2025-12-27 04:46:14 dovecot_login authenticator failed for H=([197.255.199.235]) [197.255.199.235]:54329: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.116.199.61
country_id: 1269750
description:
2025-12-27 04:46:55 dovecot_plain authenticator failed for H=(localhost) [66.116.199.61]:35184: 535 Incorrect authentication data (set_id=info@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.184.118.5
country_id: 1168579
description:
2025-12-27 04:47:28 dovecot_plain authenticator failed for H=(localhost) [182.184.118.5]:11265: 535 Incorrect authentication data (set_id=info@nsteeleng.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.239.90
country_id: 1819730
description:
Dec 27 04:50:55 host2 sshd[1560568]: Disconnected from invalid user dev 152.32.239.90 port 28308 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.239.90
country_id: 1819730
description:
Dec 27 04:51:42 host2 sshd[1561139]: Disconnected from invalid user user4 152.32.239.90 port 42010 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.239.90
country_id: 1819730
description:
Dec 27 04:52:58 host2 sshd[1562124]: Disconnected from invalid user gemini 152.32.239.90 port 10398 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.251.142.45
country_id: 6252001
description:
2025-12-27 04:55:29 dovecot_plain authenticator failed for H=(localhost) [47.251.142.45]:44500: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.223.53.234
country_id: 3932488
description:
2025-12-27 04:55:59 dovecot_login authenticator failed for H=([190.223.53.234]) [190.223.53.234]:39967: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2025-12-27 04:56:20 dovecot_login authenticator failed for H=(144.121.245.65.lightower.net) [64.72.74.162]:56016: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.211.25.202
country_id: 2233387
description:
2025-12-27 04:57:14 dovecot_plain authenticator failed for H=(localhost) [165.211.25.202]:46400: 535 Incorrect authentication data (set_id=admin@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.220.169.113
country_id: 2635167
description:
2025-12-27 04:58:12 dovecot_login authenticator failed for H=([165.220.169.113]) [165.220.169.113]:48562: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.7.163.154
country_id: 1643084
description:
2025-12-27 04:58:24 dovecot_plain authenticator failed for H=(localhost) [114.7.163.154]:40360: 535 Incorrect authentication data (set_id=support@essenceceylontea.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.177.200.249
country_id: 3865483
description:
Dec 27 04:58:45 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<chitral00@bostonlanka.com>, method=PLAIN, rip=45.177.200.249, lip=66.85.158.91, TLS, session=<o7kiQONGVIEtscj5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.221.152.102
country_id: 690791
description:
Dec 27 04:59:03 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<chitral00>, method=PLAIN, rip=37.221.152.102, lip=66.85.158.91, TLS, session=<VB5JQeNGKuIl3Zhm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.252.5.53
country_id: 6252001
description:
2025-12-27 04:59:19 dovecot_plain authenticator failed for H=(localhost) [47.252.5.53]:57852: 535 Incorrect authentication data (set_id=info@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.231.254.192
country_id: 1819730
description:
2025-12-27 05:01:07 dovecot_plain authenticator failed for H=(localhost) [103.231.254.192]:35050: 535 Incorrect authentication data (set_id=info@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.231.254.192
country_id: 1819730
description:
2025-12-27 05:01:14 dovecot_plain authenticator failed for H=(localhost) [103.231.254.192]:57068: 535 Incorrect authentication data (set_id=info@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.254.85.115
country_id: 6252001
description:
2025-12-27 05:02:47 dovecot_plain authenticator failed for H=(localhost) [47.254.85.115]:46046: 535 Incorrect authentication data (set_id=finance@anandaobauae.org)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.99
country_id: 6252001
description:
Dec 27 05:03:11 host2 pure-ftpd[1572958]: (?@198.235.24.99) [INFO] New connection from 198.235.24.99


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.41.212
country_id: 6252001
description:
Dec 27 05:03:25 host2 sshd[1573191]: Disconnected from invalid user monitor 209.141.41.212 port 39650 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-27 05:03:18 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (endualae) [87.103.126.54]:51860: 535 Incorrect authentication data (set_id=it@ksoft.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.181.25.210
country_id: 3923057
description:
Dec 27 05:05:24 host2 sshd[1575420]: Disconnected from invalid user monitor 190.181.25.210 port 48990 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.123
country_id: 6252001
description:
Dec 27 05:05:29 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=198.235.24.123, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<SB5FWeNGQszG6xh7>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 190.181.25.210
country_id: 3923057
description:
Dec 27 05:06:05 host2 sshd[1575954]: Disconnected from invalid user xmrig 190.181.25.210 port 54994 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.122.23
country_id: 1819730
description:
Dec 27 05:06:08 host2 sshd[1575980]: Disconnected from invalid user fastuser 101.36.122.23 port 47864 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.41.212
country_id: 6252001
description:
Dec 27 05:07:44 host2 sshd[1577497]: Disconnected from invalid user fileuser 209.141.41.212 port 49888 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.138.237.18
country_id: 1269750
description:
2025-12-27 05:07:56 dovecot_plain authenticator failed for H=(localhost) [103.138.237.18]:9033: 535 Incorrect authentication data (set_id=support@dataesite.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.244.206.6
country_id: 1643084
description:
2025-12-27 05:07:59 dovecot_plain authenticator failed for H=(localhost) [103.244.206.6]:54360: 535 Incorrect authentication data (set_id=support@lankaherbalsolutions.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.181.25.210
country_id: 3923057
description:
Dec 27 05:07:19 host2 sshd[1577056]: Disconnected from invalid user tfj 190.181.25.210 port 38767 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.186.147.126
country_id: 1880251
description:
2025-12-27 05:08:35 dovecot_plain authenticator failed for H=126.147.186.35.bc.googleusercontent.com (localhost) [35.186.147.126]:14712: 535 Incorrect authentication data (set_id=admin@anandaobauae.org)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 209.141.41.212
country_id: 6252001
description:
Dec 27 05:09:04 host2 sshd[1578944]: Disconnected from invalid user odin 209.141.41.212 port 45340 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.92.171.7
country_id: 6252001
description:
2025-12-27 05:10:07 dovecot_plain authenticator failed for H=d3191.use1.stableserver.net (localhost) [190.92.171.7]:40478: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.122.23
country_id: 1819730
description:
Dec 27 05:09:22 host2 sshd[1579152]: Disconnected from invalid user admin1 101.36.122.23 port 35932 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.92.171.7
country_id: 6252001
description:
2025-12-27 05:10:14 dovecot_plain authenticator failed for H=d3191.use1.stableserver.net (localhost) [190.92.171.7]:51304: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.179.57.150
country_id: 1643084
description:
Dec 27 05:10:27 host2 sshd[1580021]: Disconnected from invalid user javier 103.179.57.150 port 42870 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.233
country_id: 2635167
description:
Dec 27 05:12:11 host2 dovecot[1881837]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=35.203.211.233, lip=66.85.158.92, session=<Row4ceNG4PIjy9Pp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.179.57.150
country_id: 1643084
description:
Dec 27 05:11:25 host2 sshd[1580646]: Disconnected from invalid user devuser 103.179.57.150 port 56614 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.105.141.172
country_id: 3923057
description:
2025-12-27 05:11:36 dovecot_login authenticator failed for H=static-200-105-141-172.acelerate.net (static-200-105-141-161.acelerate.net) [200.105.141.172]:33462: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.151.240.91
country_id: 1522867
description:
2025-12-27 05:11:52 dovecot_login authenticator failed for H=37.151.240.91.dynamic.telecom.kz [37.151.240.91]:58091: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 187.51.208.158
country_id: 3469034
description:
Dec 27 05:11:53 host2 sshd[1580900]: Disconnected from invalid user info 187.51.208.158 port 50175 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 27 05:13:23 host2 sshd[1581950]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.240.166.197
country_id: 6252001
description:
2025-12-27 05:13:31 dovecot_plain authenticator failed for H=vps-14540174.konverter.com.br (localhost) [162.240.166.197]:37920: 535 Incorrect authentication data (set_id=info@kiriaswanu.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.210.103.210
country_id: 3017382
description:
Dec 27 05:13:59 host2 sshd[1582427]: Disconnected from invalid user user2 51.210.103.210 port 55628 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.77.202.109
country_id: 3017382
description:
2025-12-27 05:14:38 dovecot_plain authenticator failed for H=109.ip-51-77-202.eu (localhost) [51.77.202.109]:40720: 535 Incorrect authentication data (set_id=info@kiriaswanu.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 27 05:14:44 host2 pure-ftpd[1582899]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.122.23
country_id: 1819730
description:
Dec 27 05:15:00 host2 sshd[1583044]: Disconnected from invalid user ubuntu 101.36.122.23 port 36526 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.210.103.210
country_id: 3017382
description:
Dec 27 05:16:04 host2 sshd[1583994]: Disconnected from invalid user awx 51.210.103.210 port 48322 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.129.140
country_id: 1819730
description:
Dec 27 05:16:47 host2 sshd[1584582]: Disconnected from invalid user user1 152.32.129.140 port 20378 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 152.32.129.140
country_id: 1819730
description:
Dec 27 05:16:14 host2 sshd[1584174]: Received disconnect from 152.32.129.140 port 63500:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.210.103.210
country_id: 3017382
description:
Dec 27 05:16:34 host2 sshd[1584414]: Disconnected from invalid user minecraft 51.210.103.210 port 39218 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.210.103.210
country_id: 3017382
description:
Dec 27 05:18:08 host2 sshd[1585741]: Disconnected from invalid user sroot 51.210.103.210 port 61646 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.250.25.214
country_id: 6252001
description:
2025-12-27 05:18:12 dovecot_plain authenticator failed for H=(localhost) [195.250.25.214]:46004: 535 Incorrect authentication data (set_id=info@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.250.25.214
country_id: 6252001
description:
2025-12-27 05:18:18 dovecot_plain authenticator failed for H=(localhost) [195.250.25.214]:43002: 535 Incorrect authentication data (set_id=info@essenceceylontea.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 27 05:18:35 host2 sshd[1586068]: Disconnected from invalid user admin 2.57.121.112 port 13276 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.179.57.150
country_id: 1643084
description:
Dec 27 05:18:51 host2 sshd[1586249]: Disconnected from invalid user zhoujing 103.179.57.150 port 43694 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 158.94.210.79
country_id: 2750405
description:
[2025-12-27 05:19:23 +0530] info [whostmgrd] 158.94.210.79 - 2096 "GET /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: invalid user name specified


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 103.138.237.18
country_id: 1269750
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Remote IP Address]=[103.138.237.18] [Authentication Database]=[mail] [Username]=[support@nsteeleng.com] (10/10 failures) (blocked until [Sat Dec 27 23:50:14 2025 UTC/Sun Dec 28 05:20:14 2025 LOCAL])


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.138.237.18
country_id: 1269750
description:
2025-12-27 05:20:16 dovecot_plain authenticator failed for H=(localhost) [103.138.237.18]:11967: 535 Incorrect authentication data (set_id=support@nsteeleng.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.254.85.115
country_id: 6252001
description:
2025-12-27 05:20:39 dovecot_plain authenticator failed for H=(localhost) [47.254.85.115]:50720: 535 Incorrect authentication data (set_id=finance@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.163.105.233
country_id: 1880251
description:
2025-12-27 05:23:42 dovecot_plain authenticator failed for H=(localhost) [43.163.105.233]:55274: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.138.59.242
country_id: 6252001
description:
2025-12-27 05:24:26 dovecot_plain authenticator failed for H=(localhost) [174.138.59.242]:45176: 535 Incorrect authentication data (set_id=info@dataesite.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.107.36.18
country_id: 1269750
description:
2025-12-27 05:25:52 dovecot_login authenticator failed for H=([103.107.36.18]) [103.107.36.18]:54936: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.230
country_id: 6252001
description:
Dec 27 05:27:05 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=205.210.31.230, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<PveJpuNGvMTN0h/m>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 15.218.135.58
country_id: 6252001
description:
2025-12-27 05:28:19 dovecot_login authenticator failed for H=([15.218.135.58]) [15.218.135.58]:41887: 535 Incorrect authentication data (set_id=accounts@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.142.184.55
country_id: 1210997
description:
2025-12-27 05:28:34 dovecot_login authenticator failed for H=([103.133.175.82]) [103.142.184.55]:56787: 535 Incorrect authentication data (set_id=accounts)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.137.106.146
country_id: 1814991
description:
2025-12-27 05:28:41 dovecot_plain authenticator failed for H=(localhost) [8.137.106.146]:49414: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.244.206.6
country_id: 1643084
description:
2025-12-27 05:31:23 dovecot_plain authenticator failed for H=(localhost) [103.244.206.6]:39952: 535 Incorrect authentication data (set_id=support@mathsmotorcysle.xyz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 129.226.64.141
country_id: 1819730
description:
2025-12-27 05:32:50 dovecot_plain authenticator failed for H=(localhost) [129.226.64.141]:44132: 535 Incorrect authentication data (set_id=info@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.138.59.242
country_id: 6252001
description:
2025-12-27 05:33:12 dovecot_plain authenticator failed for H=(localhost) [174.138.59.242]:41436: 535 Incorrect authentication data (set_id=info@nsteeleng.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.234.135
country_id: 458258
description:
Dec 27 05:33:22 host2 sshd[1598330]: Disconnected from invalid user user 62.60.234.135 port 49548 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 187.120.72.148
country_id: 3469034
description:
Dec 27 05:33:33 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@simple-engineering.lk>, method=PLAIN, rip=187.120.72.148, lip=66.85.158.91, TLS, session=<7bybvONGhZC7eEiU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.43.230
country_id: 953987
description:
Dec 27 05:33:55 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=102.64.43.230, lip=66.85.158.91, TLS, session=<Gf/OveNGoM5mQCvm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.138.59.242
country_id: 6252001
description:
2025-12-27 05:33:18 dovecot_plain authenticator failed for H=(localhost) [174.138.59.242]:44272: 535 Incorrect authentication data (set_id=info@nsteeleng.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.231.202.201
country_id: 51537
description:
2025-12-27 05:35:49 dovecot_login authenticator failed for H=([197.231.202.201]) [197.231.202.201]:60420: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.250.25.214
country_id: 6252001
description:
2025-12-27 05:35:34 dovecot_plain authenticator failed for H=(localhost) [195.250.25.214]:44076: 535 Incorrect authentication data (set_id=info@melanifinefood.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.120
country_id: 6252001
description:
Dec 27 05:36:17 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.120, lip=66.85.158.91, TLS, session=<mSxrx+NGLPmTuYR4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.255.201.126
country_id: 2413451
description:
2025-12-27 05:36:25 dovecot_login authenticator failed for H=([197.255.201.126]) [197.255.201.126]:56481: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 68.183.93.67
country_id: 1269750
description:
Dec 27 05:36:45 host2 sshd[1601018]: Disconnected from invalid user admin 68.183.93.67 port 46432 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.183.93.67
country_id: 1269750
description:
Dec 27 05:37:21 host2 sshd[1601435]: Disconnected from invalid user ts2 68.183.93.67 port 36768 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 163.182.174.251
country_id: 6252001
description:
2025-12-27 05:38:37 dovecot_plain authenticator failed for H=163-182-174-251.static.as40244.net (localhost) [163.182.174.251]:49870: 535 Incorrect authentication data (set_id=info@kiriaswanu.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.157.176.165
country_id: 1733045
description:
Dec 27 05:42:10 host2 sshd[1604931]: Disconnected from invalid user ts3server 202.157.176.165 port 39902 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.157.176.165
country_id: 1733045
description:
Dec 27 05:42:49 host2 sshd[1605427]: Disconnected from invalid user andy 202.157.176.165 port 42378 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.120.90
country_id: 3469034
description:
2025-12-27 05:43:09 dovecot_login authenticator failed for H=([187.8.120.90]) [187.8.120.90]:57945: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.130.90.166
country_id: 6252001
description:
Dec 27 05:44:00 host2 sshd[1606657]: Disconnected from invalid user developer 43.130.90.166 port 44032 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.22.218
country_id: 290557
description:
2025-12-27 05:44:02 dovecot_login authenticator failed for H=([5.32.22.218]) [5.32.22.218]:60068: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.93.247.247
country_id: 1643084
description:
2025-12-27 05:44:08 dovecot_plain authenticator failed for H=(localhost) [202.93.247.247]:46688: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.116.199.47
country_id: 1269750
description:
2025-12-27 05:43:15 dovecot_plain authenticator failed for H=(localhost) [66.116.199.47]:33162: 535 Incorrect authentication data (set_id=info@dataesite.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.128.202
country_id: 6252001
description:
2025-12-27 05:44:26 dovecot_login authenticator failed for H=([192.34.128.202]) [192.34.128.202]:35596: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.234.135
country_id: 458258
description:
Dec 27 05:44:41 host2 sshd[1607288]: Disconnected from invalid user admin 62.60.234.135 port 50980 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.93.247.247
country_id: 1643084
description:
2025-12-27 05:44:16 dovecot_plain authenticator failed for H=(localhost) [202.93.247.247]:56022: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.244.206.6
country_id: 1643084
description:
2025-12-27 05:45:48 dovecot_plain authenticator failed for H=(localhost) [103.244.206.6]:48054: 535 Incorrect authentication data (set_id=support@bostonlanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 202.157.176.165
country_id: 1733045
description:
Dec 27 05:46:30 host2 sshd[1609218]: Disconnected from invalid user debian 202.157.176.165 port 51608 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.130.90.166
country_id: 6252001
description:
Dec 27 05:46:58 host2 sshd[1609558]: Disconnected from invalid user suporte 43.130.90.166 port 60160 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.234.135
country_id: 458258
description:
Dec 27 05:47:05 host2 sshd[1609682]: Disconnected from invalid user pgsql 62.60.234.135 port 35362 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.74.148
country_id: 1269750
description:
2025-12-27 05:47:12 dovecot_plain authenticator failed for H=(localhost) [139.59.74.148]:32832: 535 Incorrect authentication data (set_id=admin@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.116.199.47
country_id: 1269750
description:
2025-12-27 05:47:18 dovecot_plain authenticator failed for H=(localhost) [66.116.199.47]:54356: 535 Incorrect authentication data (set_id=info@nsteeleng.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.74.148
country_id: 1269750
description:
2025-12-27 05:47:21 dovecot_plain authenticator failed for H=(localhost) [139.59.74.148]:52550: 535 Incorrect authentication data (set_id=admin@ceylondigest.com)


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 66.116.199.47
country_id: 1269750
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Remote IP Address]=[66.116.199.47] [Authentication Database]=[mail] [Username]=[info@nsteeleng.com] (10/10 failures) (blocked until [Sun Dec 28 00:17:16 2025 UTC/Sun Dec 28 05:47:16 2025 LOCAL])


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.157.176.165
country_id: 1733045
description:
Dec 27 05:47:40 host2 sshd[1610136]: Disconnected from invalid user tableau 202.157.176.165 port 59406 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.157.176.165
country_id: 1733045
description:
Dec 27 05:48:17 host2 sshd[1610535]: Disconnected from invalid user ubuntu 202.157.176.165 port 48536 [preauth]


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 51.210.107.22
country_id: 3017382
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Remote IP Address]=[51.210.107.22] [Authentication Database]=[mail] [Username]=[info@mathsmotorcysle.xyz] (10/10 failures) (blocked until [Sun Dec 28 00:20:41 2025 UTC/Sun Dec 28 05:50:41 2025 LOCAL])


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.133.121.104
country_id: 1512440
description:
2025-12-27 05:50:55 dovecot_plain authenticator failed for H=(localhost) [5.133.121.104]:45678: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 43.130.90.166
country_id: 6252001
description:
Dec 27 05:50:39 host2 sshd[1612415]: Received disconnect from 43.130.90.166 port 38656:11: Bye Bye [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.130.90.166
country_id: 6252001
description:
Dec 27 05:50:39 host2 sshd[1612415]: Disconnected from invalid user st 43.130.90.166 port 38656 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.210.107.22
country_id: 3017382
description:
2025-12-27 05:50:43 dovecot_plain authenticator failed for H=vps-f35c4934.vps.ovh.net (localhost) [51.210.107.22]:38000: 535 Incorrect authentication data (set_id=info@mathsmotorcysle.xyz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.135.31.74
country_id: 1522867
description:
2025-12-27 05:55:59 dovecot_plain authenticator failed for H=2.135.31.74.dynamic.telecom.kz (catic) [2.135.31.74]:53854: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.179.58.114
country_id: 1269750
description:
2025-12-27 05:57:26 dovecot_plain authenticator failed for H=server1.justsee.co.in (localhost) [180.179.58.114]:32768: 535 Incorrect authentication data (set_id=admin@anandaobauae.org)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 27 06:00:15 host2 sshd[1621165]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.108.215.39
country_id: 3469034
description:
2025-12-27 06:01:35 dovecot_login authenticator failed for H=([189.108.215.39]) [189.108.215.39]:38600: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.32.33.161
country_id: 3686110
description:
Dec 27 06:02:12 host2 sshd[1622617]: Disconnected from invalid user sebas 179.32.33.161 port 49696 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.116.199.61
country_id: 1269750
description:
2025-12-27 06:01:42 dovecot_plain authenticator failed for H=(localhost) [66.116.199.61]:41628: 535 Incorrect authentication data (set_id=info@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.51.109
country_id: 1269750
description:
2025-12-27 06:01:54 dovecot_login authenticator failed for H=(abts-north-static-109.51.160.122.airtelbroadband.in) [122.160.51.109]:36394: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.29.174
country_id: 1643084
description:
2025-12-27 06:03:09 dovecot_plain authenticator failed for H=(localhost) [103.148.29.174]:42838: 535 Incorrect authentication data (set_id=support@kiriaswanu.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 136.228.161.66
country_id: 1327865
description:
Dec 27 06:04:29 host2 sshd[1624271]: Disconnected from invalid user intern 136.228.161.66 port 43704 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.184.118.5
country_id: 1168579
description:
2025-12-27 06:05:21 dovecot_plain authenticator failed for H=(localhost) [182.184.118.5]:1094: 535 Incorrect authentication data (set_id=info@nsteeleng.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.32.33.161
country_id: 3686110
description:
Dec 27 06:06:05 host2 sshd[1625747]: Disconnected from invalid user xyx 179.32.33.161 port 41066 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.252.5.53
country_id: 6252001
description:
2025-12-27 06:06:13 dovecot_plain authenticator failed for H=(localhost) [47.252.5.53]:36712: 535 Incorrect authentication data (set_id=info@kiriaswanu.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 46.24.47.94
country_id: 2510769
description:
Dec 27 06:05:59 host2 sshd[1625634]: Disconnected from invalid user userroot 46.24.47.94 port 47200 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.251.142.45
country_id: 6252001
description:
2025-12-27 06:07:04 dovecot_plain authenticator failed for H=(localhost) [47.251.142.45]:57466: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.82.96.191
country_id: 3175395
description:
Dec 27 06:07:34 host2 sshd[1626787]: Disconnected from invalid user alex 151.82.96.191 port 18576 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.32.33.161
country_id: 3686110
description:
Dec 27 06:07:50 host2 sshd[1626937]: Disconnected from invalid user intern 179.32.33.161 port 53762 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.82.96.191
country_id: 3175395
description:
Dec 27 06:08:16 host2 sshd[1627264]: Disconnected from invalid user parth 151.82.96.191 port 18802 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 38.148.242.235
country_id: 6252001
description:
Dec 27 06:09:14 host2 pure-ftpd[1628079]: (?@38.148.242.235) [INFO] New connection from 38.148.242.235


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.7.163.154
country_id: 1643084
description:
2025-12-27 06:09:25 dovecot_plain authenticator failed for H=(localhost) [114.7.163.154]:46850: 535 Incorrect authentication data (set_id=support@melanifinefood.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 179.32.33.161
country_id: 3686110
description:
Dec 27 06:09:43 host2 sshd[1628491]: Disconnected from invalid user administrator 179.32.33.161 port 38226 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.154.166.19
country_id: 2921044
description:
[2025-12-27 06:10:37 +0530] info [webmaild] 217.154.166.19 - info@idesignvector.com@host2.phenomhost.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: invalid user name specified


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.128.54.17
country_id: 3469034
description:
2025-12-27 06:11:39 dovecot_login authenticator failed for H=(17.54.gonzagatelecom.com.br) [177.128.54.17]:57152: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.91.153.26
country_id: 3077311
description:
2025-12-27 06:12:14 dovecot_login authenticator failed for H=u153-26.static.grape.cz [93.91.153.26]:57970: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 151.82.96.191
country_id: 3175395
description:
Dec 27 06:12:18 host2 sshd[1630451]: Disconnected from invalid user userroot 151.82.96.191 port 18268 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 156.232.94.39
country_id: 241170
description:
Dec 27 06:14:15 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=156.232.94.39, lip=66.85.158.91, TLS handshaking: Connection closed, session=<ADA3T+RGspOc6F4n>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.77.202.109
country_id: 3017382
description:
2025-12-27 06:17:27 dovecot_plain authenticator failed for H=109.ip-51-77-202.eu (localhost) [51.77.202.109]:34356: 535 Incorrect authentication data (set_id=info@kiriaswanu.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.123
country_id: 6252001
description:
Dec 27 06:16:43 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=147.185.132.123, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<6EgKWORGLtuTuYR7>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 27 06:17:13 host2 pure-ftpd[1634161]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.92.171.7
country_id: 6252001
description:
2025-12-27 06:18:33 dovecot_plain authenticator failed for H=d3191.use1.stableserver.net (localhost) [190.92.171.7]:36836: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.92.171.7
country_id: 6252001
description:
2025-12-27 06:18:39 dovecot_plain authenticator failed for H=d3191.use1.stableserver.net (localhost) [190.92.171.7]:52894: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.231.254.192
country_id: 1819730
description:
2025-12-27 06:18:50 dovecot_plain authenticator failed for H=(localhost) [103.231.254.192]:52378: 535 Incorrect authentication data (set_id=info@kiriaswanu.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.17.125.45
country_id: 690791
description:
Dec 27 06:20:25 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<chitral00@bostonlanka.com>, method=PLAIN, rip=185.17.125.45, lip=66.85.158.91, TLS, session=<gKREZORGNIe5EX0t>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.177.113.24
country_id: 3175395
description:
Dec 27 06:20:44 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<chitral00>, method=PLAIN, rip=195.177.113.24, lip=66.85.158.91, TLS, session=<FJ9cZeRGpavDsXEY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.132.29.166
country_id: 2233387
description:
2025-12-27 06:21:31 dovecot_login authenticator failed for H=(host-129.0.111.246.mtn.cm) [102.132.29.166]:64942: 535 Incorrect authentication data (set_id=hnt@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.38.3.109
country_id: 2215636
description:
2025-12-27 06:21:43 dovecot_login authenticator failed for H=([102.38.3.109]) [102.38.3.109]:40500: 535 Incorrect authentication data (set_id=hnt)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.128.202
country_id: 6252001
description:
2025-12-27 06:21:59 dovecot_login authenticator failed for H=([192.34.128.202]) [192.34.128.202]:52778: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 151.68.23.213
country_id: 3175395
description:
Dec 27 06:24:47 host2 sshd[1640401]: Disconnected from invalid user mom 151.68.23.213 port 53335 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.138.59.242
country_id: 6252001
description:
2025-12-27 06:30:36 dovecot_plain authenticator failed for H=(localhost) [174.138.59.242]:18570: 535 Incorrect authentication data (set_id=info@nsteeleng.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.255.199.245
country_id: 2413451
description:
2025-12-27 06:29:49 dovecot_login authenticator failed for H=([197.255.199.245]) [197.255.199.245]:55013: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.138.59.242
country_id: 6252001
description:
2025-12-27 06:30:42 dovecot_plain authenticator failed for H=(localhost) [174.138.59.242]:60928: 535 Incorrect authentication data (set_id=info@nsteeleng.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.138.59.242
country_id: 6252001
description:
2025-12-27 06:31:37 dovecot_plain authenticator failed for H=(localhost) [174.138.59.242]:21902: 535 Incorrect authentication data (set_id=info@dataesite.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.116.199.47
country_id: 1269750
description:
2025-12-27 06:33:11 dovecot_plain authenticator failed for H=(localhost) [66.116.199.47]:36664: 535 Incorrect authentication data (set_id=info@nsteeleng.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.183.103.121
country_id: 2635167
description:
2025-12-27 06:34:01 dovecot_login authenticator failed for H=(185-183-103-121.xdsl.5gdsl.com) [185.183.103.121]:56480: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.133.161.162
country_id: 130758
description:
2025-12-27 06:34:14 dovecot_login authenticator failed for H=([85.133.161.162]) [85.133.161.162]:54926: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.138.237.18
country_id: 1269750
description:
2025-12-27 06:36:29 dovecot_plain authenticator failed for H=(localhost) [103.138.237.18]:12952: 535 Incorrect authentication data (set_id=support@nsteeleng.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.138.237.18
country_id: 1269750
description:
2025-12-27 06:36:37 dovecot_plain authenticator failed for H=(localhost) [103.138.237.18]:12967: 535 Incorrect authentication data (set_id=support@nsteeleng.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.124.202
country_id: 1269750
description:
2025-12-27 06:39:44 dovecot_login authenticator failed for H=(nsg-corporate-169.76.187.122.airtel.in) [182.95.124.202]:55150: 535 Incorrect authentication data (set_id=prasanka@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.135.26.113
country_id: 1522867
description:
2025-12-27 06:40:11 dovecot_login authenticator failed for H=2.135.26.113.dynamic.telecom.kz [2.135.26.113]:49035: 535 Incorrect authentication data (set_id=prasanka)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.138.237.18
country_id: 1269750
description:
2025-12-27 06:40:36 dovecot_plain authenticator failed for H=(localhost) [103.138.237.18]:14069: 535 Incorrect authentication data (set_id=support@dataesite.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.138.237.18
country_id: 1269750
description:
2025-12-27 06:40:44 dovecot_plain authenticator failed for H=(localhost) [103.138.237.18]:14082: 535 Incorrect authentication data (set_id=support@dataesite.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.207.248.5
country_id: 3469034
description:
2025-12-27 06:40:45 dovecot_login authenticator failed for H=(mamanguape.static.gvt.net.br) [177.207.248.5]:56926: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.112.141.230
country_id: 2750405
description:
2025-12-27 06:41:00 dovecot_login authenticator failed for H=50708de6.static.ziggozakelijk.nl [80.112.141.230]:50948: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.93.247.247
country_id: 1643084
description:
2025-12-27 06:42:24 dovecot_plain authenticator failed for H=(localhost) [202.93.247.247]:40678: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.210.107.22
country_id: 3017382
description:
2025-12-27 06:44:22 dovecot_plain authenticator failed for H=vps-f35c4934.vps.ovh.net (localhost) [51.210.107.22]:47749: 535 Incorrect authentication data (set_id=info@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.184.118.5
country_id: 1168579
description:
2025-12-27 06:44:29 dovecot_plain authenticator failed for H=(localhost) [182.184.118.5]:1308: 535 Incorrect authentication data (set_id=info@dataesite.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.231.254.192
country_id: 1819730
description:
2025-12-27 06:45:03 dovecot_plain authenticator failed for H=(localhost) [103.231.254.192]:42962: 535 Incorrect authentication data (set_id=info@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.184.118.5
country_id: 1168579
description:
2025-12-27 06:44:37 dovecot_plain authenticator failed for H=(localhost) [182.184.118.5]:38911: 535 Incorrect authentication data (set_id=info@dataesite.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.133.121.104
country_id: 1512440
description:
2025-12-27 06:44:47 dovecot_plain authenticator failed for H=(localhost) [5.133.121.104]:56850: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.228.234
country_id: 1269750
description:
2025-12-27 06:52:23 dovecot_login authenticator failed for H=(nsg-static-234.228.76.182-airtel.com) [182.76.228.234]:34544: 535 Incorrect authentication data (set_id=accounts@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.250.25.214
country_id: 6252001
description:
2025-12-27 06:51:46 dovecot_plain authenticator failed for H=(localhost) [195.250.25.214]:36020: 535 Incorrect authentication data (set_id=info@melanifinefood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.210.107.22
country_id: 3017382
description:
2025-12-27 06:52:11 dovecot_plain authenticator failed for H=vps-f35c4934.vps.ovh.net (localhost) [51.210.107.22]:50171: 535 Incorrect authentication data (set_id=info@mathsmotorcysle.xyz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.30.212.99
country_id: 298795
description:
2025-12-27 06:52:57 dovecot_login authenticator failed for H=([176.30.212.99]) [176.30.212.99]:33774: 535 Incorrect authentication data (set_id=accounts)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.215
country_id: 2635167
description:
Dec 27 06:54:40 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=87.236.176.215, lip=66.85.158.91, TLS handshaking: Connection closed, session=<a33C3+RGqYFX7LDX>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.183
country_id: 2635167
description:
Dec 27 06:55:14 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=87.236.176.183, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<EdG94eRGG+hX7LC3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 163.182.174.251
country_id: 6252001
description:
2025-12-27 06:54:38 dovecot_plain authenticator failed for H=163-182-174-251.static.as40244.net (localhost) [163.182.174.251]:60808: 535 Incorrect authentication data (set_id=info@kiriaswanu.com)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.117
country_id: 2635167
description:
Dec 27 06:54:39 host2 dovecot[1881837]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=87.236.176.117, lip=66.85.158.91, TLS, session=<n2Ot3+RGB65X7LB1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.217
country_id: 2635167
description:
Dec 27 06:56:53 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: read(size=612) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.217, lip=66.85.158.91, TLS handshaking: read(size=612) failed: Connection reset by peer, session=<ygCw5+RGF+VX7LDZ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.197
country_id: 2635167
description:
Dec 27 06:57:26 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=87.236.176.197, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<UnOp6eRGeZFX7LDF>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.200
country_id: 2635167
description:
Dec 27 06:58:00 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.200, lip=66.85.158.91, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<1OKm6+RGLaW594nI>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.193
country_id: 2635167
description:
Dec 27 06:58:33 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=87.236.176.193, lip=66.85.158.91, TLS handshaking: Connection closed, session=<SBei7eRGB5dX7LDB>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.208
country_id: 2635167
description:
Dec 27 06:55:47 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=185.247.137.208, lip=66.85.158.91, TLS handshaking: Connection closed, session=<zky54+RGwbu594nQ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.199
country_id: 2635167
description:
Dec 27 06:56:20 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: read(size=693) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.199, lip=66.85.158.91, TLS handshaking: read(size=693) failed: Connection reset by peer, session=<M7C05eRGwYu594nH>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.214
country_id: 2635167
description:
Dec 27 06:59:06 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=185.247.137.214, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<4nyb7+RGA7C594nW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.163.105.233
country_id: 1880251
description:
2025-12-27 06:59:15 dovecot_plain authenticator failed for H=(localhost) [43.163.105.233]:42142: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.206
country_id: 2635167
description:
Dec 27 06:59:39 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=87.236.176.206, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<Q+qW8eRGGehX7LDO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.240.166.197
country_id: 6252001
description:
2025-12-27 07:02:21 dovecot_plain authenticator failed for H=vps-14540174.konverter.com.br (localhost) [162.240.166.197]:50068: 535 Incorrect authentication data (set_id=info@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.160.166.237
country_id: 1820814
description:
2025-12-27 07:02:37 dovecot_login authenticator failed for H=(237-166.adsl.static.espeed.com.bn) [119.160.166.237]:48518: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.155.55.174
country_id: 1880251
description:
Dec 27 07:02:03 host2 sshd[1672386]: Disconnected from invalid user david 107.155.55.174 port 51260 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.203.231.220
country_id: 2464461
description:
2025-12-27 07:02:12 dovecot_login authenticator failed for H=([196.203.231.220]) [196.203.231.220]:50084: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.29.174
country_id: 1643084
description:
2025-12-27 07:02:16 dovecot_plain authenticator failed for H=(localhost) [103.148.29.174]:59494: 535 Incorrect authentication data (set_id=support@kiriaswanu.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 107.155.55.174
country_id: 1880251
description:
Dec 27 07:02:39 host2 sshd[1672815]: Disconnected from invalid user sammy 107.155.55.174 port 34964 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.136
country_id: 6252001
description:
Dec 27 07:05:07 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=66.132.153.136, lip=66.85.158.92, TLS: Connection closed, session=<H6ogBeVGUjVChJmI>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.19.224.161
country_id: 3017382
description:
Dec 27 07:06:11 host2 sshd[1675584]: Disconnected from invalid user daniel 162.19.224.161 port 37374 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.155.55.174
country_id: 1880251
description:
Dec 27 07:06:13 host2 sshd[1675642]: Disconnected from invalid user admin 107.155.55.174 port 50086 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.197.9.42
country_id: 3175395
description:
Dec 27 07:07:29 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@simple-engineering.lk>, method=PLAIN, rip=185.197.9.42, lip=66.85.158.91, TLS, session=<RzaYDOVGxN25xQkq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.201.170
country_id: 1269750
description:
2025-12-27 07:07:54 dovecot_login authenticator failed for H=([122.187.223.48]) [128.185.201.170]:45790: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.155.55.174
country_id: 1880251
description:
Dec 27 07:08:00 host2 sshd[1676901]: Disconnected from invalid user ansible 107.155.55.174 port 57650 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.81
country_id: 1269750
description:
2025-12-27 07:08:24 dovecot_login authenticator failed for H=([122.187.230.81]) [122.187.230.81]:60288: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 162.19.224.161
country_id: 3017382
description:
Dec 27 07:07:40 host2 sshd[1676692]: Received disconnect from 162.19.224.161 port 46442:11: Bye Bye [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.177.113.51
country_id: 3175395
description:
Dec 27 07:07:47 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=195.177.113.51, lip=66.85.158.91, TLS, session=<tR+tDeVGQYjDsXEz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.92.171.7
country_id: 6252001
description:
2025-12-27 07:09:03 dovecot_plain authenticator failed for H=d3191.use1.stableserver.net (localhost) [190.92.171.7]:53372: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 162.19.224.161
country_id: 3017382
description:
Dec 27 07:09:12 host2 sshd[1677893]: Disconnected from invalid user test 162.19.224.161 port 46550 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.155.110
country_id: 1269750
description:
2025-12-27 07:09:32 dovecot_login authenticator failed for H=(dsl-ncr-dynamic-169.179.23.125.airtelbroadband.in) [125.23.155.110]:42354: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.252.5.53
country_id: 6252001
description:
2025-12-27 07:09:38 dovecot_plain authenticator failed for H=(localhost) [47.252.5.53]:44128: 535 Incorrect authentication data (set_id=info@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.64.28.82
country_id: 2017370
description:
2025-12-27 07:09:58 dovecot_login authenticator failed for H=([80.64.28.82]) [80.64.28.82]:38987: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-27 07:11:28 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:59044: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.19.224.161
country_id: 3017382
description:
Dec 27 07:11:44 host2 sshd[1679998]: Disconnected from invalid user teamspeak 162.19.224.161 port 51164 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.210.107.22
country_id: 3017382
description:
2025-12-27 07:14:53 dovecot_plain authenticator failed for H=vps-f35c4934.vps.ovh.net (localhost) [51.210.107.22]:47087: 535 Incorrect authentication data (set_id=info@lankaherbalsolutions.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.136.229.18
country_id: 3469034
description:
[2025-12-27 07:17:20 +0530] info [cpaneld] 177.136.229.18 - cloudtourssrilan "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.77.202.109
country_id: 3017382
description:
2025-12-27 07:17:56 dovecot_plain authenticator failed for H=109.ip-51-77-202.eu (localhost) [51.77.202.109]:60686: 535 Incorrect authentication data (set_id=info@kiriaswanu.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 27 07:19:04 host2 sshd[1686647]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.136.229.18
country_id: 3469034
description:
[2025-12-27 07:19:20 +0530] info [whostmgrd] 177.136.229.18 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.250.25.214
country_id: 6252001
description:
2025-12-27 07:19:25 dovecot_plain authenticator failed for H=(localhost) [195.250.25.214]:43484: 535 Incorrect authentication data (set_id=info@essenceceylontea.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.136.229.18
country_id: 3469034
description:
[2025-12-27 07:19:36 +0530] info [whostmgrd] 177.136.229.18 - ubuntu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 27 07:20:04 host2 pure-ftpd[1687544]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.74.148
country_id: 1269750
description:
2025-12-27 07:22:29 dovecot_plain authenticator failed for H=(localhost) [139.59.74.148]:36364: 535 Incorrect authentication data (set_id=admin@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.74.148
country_id: 1269750
description:
2025-12-27 07:22:37 dovecot_plain authenticator failed for H=(localhost) [139.59.74.148]:46968: 535 Incorrect authentication data (set_id=admin@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.211.25.202
country_id: 2233387
description:
2025-12-27 07:25:19 dovecot_plain authenticator failed for H=(localhost) [165.211.25.202]:38722: 535 Incorrect authentication data (set_id=admin@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.201.170
country_id: 1269750
description:
2025-12-27 07:27:27 dovecot_login authenticator failed for H=([122.187.223.48]) [128.185.201.170]:35428: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.231
country_id: 1269750
description:
2025-12-27 07:27:55 dovecot_login authenticator failed for H=(nsg-corporate-231.228.187.122.airtel.in) [122.187.228.231]:51471: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.223.53.234
country_id: 3932488
description:
2025-12-27 07:31:29 dovecot_login authenticator failed for H=([190.223.53.234]) [190.223.53.234]:54310: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.211.130.180
country_id: 6252001
description:
2025-12-27 07:32:01 dovecot_login authenticator failed for H=([162.211.130.180]) [162.211.130.180]:56073: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.53.94.242
country_id: 1269750
description:
2025-12-27 07:32:38 dovecot_login authenticator failed for H=(arpa.static.242.94.53.202.nettlinx.com) [202.53.94.242]:46972: 535 Incorrect authentication data (set_id=training)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.137.106.146
country_id: 1814991
description:
2025-12-27 07:36:45 dovecot_plain authenticator failed for H=(localhost) [8.137.106.146]:52438: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.153.143
country_id: 1819730
description:
2025-12-27 07:37:19 dovecot_login authenticator failed for H=([223.197.153.143]) [223.197.153.143]:55906: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.160
country_id: 6252001
description:
Dec 27 07:38:10 host2 dovecot[1881837]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=91.230.168.160, lip=66.85.158.91, session=<2fNNe+VGKehb5qig>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.167
country_id: 6252001
description:
Dec 27 07:38:13 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.230.168.167, lip=66.85.158.91, session=<uQB9e+VGs7Jb5qin>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.104.42
country_id: 1269750
description:
2025-12-27 07:37:37 dovecot_login authenticator failed for H=([27.123.104.42]) [27.123.104.42]:45396: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.34
country_id: 6252001
description:
Dec 27 07:37:47 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=91.230.168.34, lip=66.85.158.91, session=<MPfoeeVGKb1b5qgi>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.163
country_id: 6252001
description:
Dec 27 07:37:57 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=91.230.168.163, lip=66.85.158.91, session=<vXaDeuVGj4Rb5qij>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.223
country_id: 6252001
description:
Dec 27 07:39:46 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.235.24.223, lip=66.85.158.92, TLS, session=<J0QOgeVG9vbG6xjf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.137
country_id: 6252001
description:
Dec 27 07:43:45 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 4 secs): user=<>, rip=147.185.133.137, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<KqdMj+VGJNWTuYWJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.137
country_id: 6252001
description:
Dec 27 07:44:39 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 3 secs): user=<>, rip=147.185.133.137, lip=66.85.158.92, TLS: read(size=403) failed: Connection reset by peer, session=<Uy56kuVGFuWTuYWJ>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 27 07:46:55 host2 sshd[1710828]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 27 07:46:56 host2 dovecot[1881837]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<FH6mmuVGbJgDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 27 07:47:52 host2 dovecot[1881837]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<vZj+neVGzNYDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 27 07:49:01 host2 dovecot[1881837]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<EvsYouVGbJ8DhBfJ>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 27 07:49:15 host2 dovecot[1881837]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<s5ntouVGDrgDhBfJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.125.124.14
country_id: 3469034
description:
2025-12-27 07:50:22 dovecot_login authenticator failed for H=(vtx-b-124-014.virtex.com.br) [179.125.124.14]:41851: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.137
country_id: 6252001
description:
Dec 27 07:49:49 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=147.185.133.137, lip=66.85.158.92, TLS, session=<+rXxpOVG0O2TuYWJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 27 07:50:08 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<eKcfpuVGap8DhBfJ>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 27 07:50:23 host2 dovecot[1881837]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<+L38puVGwpADhBfJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.119.144.86
country_id: 6252001
description:
2025-12-27 07:51:31 dovecot_login authenticator failed for H=24-119-144-86.cpe.sparklight.net [24.119.144.86]:42604: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 212.73.148.12
country_id: 798549
description:
Dec 27 07:52:07 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=212.73.148.12, lip=66.85.158.92, session=<xp82reVGxqDUSZQM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2025-12-27 07:51:51 dovecot_login authenticator failed for H=host-196-47-172-253.afnet.net [196.47.172.253]:46651: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.138.237.18
country_id: 1269750
description:
2025-12-27 07:53:23 dovecot_plain authenticator failed for H=(localhost) [103.138.237.18]:5768: 535 Incorrect authentication data (set_id=support@nsteeleng.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 92.207.4.157
country_id: 2635167
description:
Dec 27 07:54:44 host2 sshd[1717656]: Disconnected from invalid user tomcat7 92.207.4.157 port 51382 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.133.121.104
country_id: 1512440
description:
2025-12-27 07:55:17 dovecot_plain authenticator failed for H=(localhost) [5.133.121.104]:57434: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.121.147.47
country_id: 1733045
description:
Dec 27 07:55:55 host2 sshd[1718829]: Disconnected from invalid user mongod 45.121.147.47 port 58386 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 92.207.4.157
country_id: 2635167
description:
Dec 27 07:56:00 host2 sshd[1718897]: Disconnected from invalid user roy 92.207.4.157 port 49132 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 92.207.4.157
country_id: 2635167
description:
Dec 27 07:57:01 host2 sshd[1719672]: Disconnected from invalid user data 92.207.4.157 port 45160 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.138.237.18
country_id: 1269750
description:
2025-12-27 07:57:31 dovecot_plain authenticator failed for H=(localhost) [103.138.237.18]:6885: 535 Incorrect authentication data (set_id=support@dataesite.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.42.70.118
country_id: 1168579
description:
2025-12-27 07:57:37 dovecot_login authenticator failed for H=([115.42.70.118]) [115.42.70.118]:45312: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.138.237.18
country_id: 1269750
description:
2025-12-27 07:57:39 dovecot_plain authenticator failed for H=(localhost) [103.138.237.18]:6901: 535 Incorrect authentication data (set_id=support@dataesite.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.248.4.85
country_id: 1269750
description:
2025-12-27 07:58:23 dovecot_login authenticator failed for H=([115.248.153.209]) [115.248.4.85]:62800: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 197.234.206.214
country_id: 953987
description:
Dec 27 08:02:23 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<chitral00@bostonlanka.com>, method=PLAIN, rip=197.234.206.214, lip=66.85.158.91, TLS, session=<DpSz0OVGQ9PF6s7W>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 95.0.32.66
country_id: 298795
description:
Dec 27 08:02:41 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<chitral00>, method=PLAIN, rip=95.0.32.66, lip=66.85.158.91, TLS, session=<Lvv20eVG6q1fACBC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.177.113.79
country_id: 3175395
description:
Dec 27 08:06:18 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=195.177.113.79, lip=66.85.158.91, TLS, session=<vbv43uVGLLHDsXFP>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 27 08:06:29 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, session=<KyCN4OVGzpoDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 179.0.250.96
country_id: 3865483
description:
Dec 27 08:06:01 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@simple-engineering.lk>, method=PLAIN, rip=179.0.250.96, lip=66.85.158.91, TLS, session=<bMy73eVGq8CzAPpg>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 27 08:08:00 host2 dovecot[1881837]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, session=<jvX65eVGoIsDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 27 08:09:51 host2 dovecot[1881837]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, session=<GT6b7OVG8LYDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 27 08:11:39 host2 dovecot[1881837]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, session=<r2oR8+VGtqsDlTsa>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 27 08:12:11 host2 dovecot[1881837]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, session=<iJ/19OVGIskDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 27 08:13:42 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, session=<sgtl+uVG9qYDlTsa>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 27 08:13:49 host2 dovecot[1881837]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, session=<8lDK+uVGvpIDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 27 08:14:52 host2 dovecot[1881837]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, session=<whKW/uVGGJEDlTsa>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 27 08:22:52 host2 pure-ftpd[1742545]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.169.82.194
country_id: 935317
description:
2025-12-27 08:23:59 dovecot_login authenticator failed for H=(165-169-82-194.zeop.re) [165.169.82.194]:41752: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.64.94
country_id: 3469034
description:
2025-12-27 08:24:28 dovecot_login authenticator failed for H=([189.108.156.41]) [187.8.64.94]:60575: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.216.96
country_id: 3996063
description:
2025-12-27 08:30:56 dovecot_login authenticator failed for H=(201.173.216.96-clientes-izzi.mx) [201.173.216.96]:39984: 535 Incorrect authentication data (set_id=hnt@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.195.53.129
country_id: 6252001
description:
2025-12-27 08:31:45 dovecot_login authenticator failed for H=([74.195.53.129]) [74.195.53.129]:36502: 535 Incorrect authentication data (set_id=hnt)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.182.130
country_id: 1269750
description:
2025-12-27 08:31:53 dovecot_login authenticator failed for H=([182.95.182.130]) [182.95.182.130]:36032: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.237.191
country_id: 99237
description:
2025-12-27 08:32:05 dovecot_login authenticator failed for H=([65.20.237.191]) [65.20.237.191]:59387: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.214.78
country_id: 1269750
description:
2025-12-27 08:32:09 dovecot_login authenticator failed for H=([128.185.214.78]) [128.185.214.78]:49948: 535 Incorrect authentication data (set_id=prasanka@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.23.72.121
country_id: 6252001
description:
2025-12-27 08:32:22 dovecot_login authenticator failed for H=([209.23.72.121]) [209.23.72.121]:58180: 535 Incorrect authentication data (set_id=prasanka)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.1.40.151
country_id: 6251999
description:
2025-12-27 08:35:29 dovecot_login authenticator failed for H=96-1-40-151-staticipeast.wireless.telus.com [96.1.40.151]:45411: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.233.92.123
country_id: 1269750
description:
2025-12-27 08:35:43 dovecot_login authenticator failed for H=([103.233.92.123]) [103.233.92.123]:35416: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.120
country_id: 6252001
description:
Dec 27 08:37:53 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.120, lip=66.85.158.91, TLS: Connection closed, session=<vDzaUOZGjCdChJl4>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.11.89.19
country_id: 6252001
description:
[2025-12-27 08:39:51 +0530] info [cpaneld] 45.11.89.19 - kamechot "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.234.138.84
country_id: 690791
description:
Dec 27 08:39:25 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@simple-engineering.lk>, method=PLAIN, rip=91.234.138.84, lip=66.85.158.91, TLS, session=<ojRhVeZG4Mxb6opU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.152.186
country_id: 99237
description:
Dec 27 08:39:45 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=65.20.152.186, lip=66.85.158.91, TLS, session=<lfJ7VuZG0+RBFJi6>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 64.62.156.222
country_id: 6252001
description:
Dec 27 08:41:59 host2 pure-ftpd[1759170]: (?@64.62.156.222) [INFO] New connection from 64.62.156.222


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 27 08:43:11 host2 sshd[1760535]: Disconnected from invalid user admin 2.57.121.112 port 44214 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.128.202
country_id: 6252001
description:
2025-12-27 08:46:40 dovecot_login authenticator failed for H=([192.34.128.202]) [192.34.128.202]:46336: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.175.193.205
country_id: 1269750
description:
Dec 27 08:47:58 host2 sshd[1766356]: Invalid user cloudtourssrilanka from 122.175.193.205 port 33906


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.50
country_id: 3017382
description:
Dec 27 08:47:14 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=91.231.89.50, lip=66.85.158.91, session=<qglQcuZG+adb51ky>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.196
country_id: 3017382
description:
Dec 27 08:47:24 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=91.231.89.196, lip=66.85.158.91, session=<NUvucuZGM+db51nE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.192
country_id: 3017382
description:
Dec 27 08:47:39 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.231.89.192, lip=66.85.158.91, session=<kp7Pc+ZGiclb51nA>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.122.128.174
country_id: 3865483
description:
Dec 27 08:48:51 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<chitral00@bostonlanka.com>, method=PLAIN, rip=190.122.128.174, lip=66.85.158.91, TLS, session=<sUT6duZG4tC+eoCu>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.39.13.140
country_id: 3469034
description:
Dec 27 08:49:13 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<chitral00>, method=PLAIN, rip=177.39.13.140, lip=66.85.158.91, TLS, session=<0NE7eOZGFbyxJw2M>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 52.165.89.103
country_id: 6252001
description:
Dec 27 08:51:21 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=52.165.89.103, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<+hoHgeZGZOs0pVln>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.63
country_id: 6252001
description:
Dec 27 08:57:02 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=167.94.146.63, lip=66.85.158.91, TLS: Connection closed, session=<kvVVleZGrHCnXpI/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.63
country_id: 6252001
description:
Dec 27 08:57:09 host2 dovecot[1881837]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=167.94.146.63, lip=66.85.158.91, session=<QcHCleZGEDinXpI/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.64.105.206
country_id: 6252001
description:
Dec 27 09:01:00 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.64.105.206, lip=66.85.158.91, TLS handshaking: Connection closed, session=<SRmEo+ZGEIQUQGnO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.193.122.91
country_id: 690791
description:
2025-12-27 09:02:19 dovecot_login authenticator failed for H=(82.193.122.91.cl.ipnet.ua) [82.193.122.91]:39888: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.202.15.69
country_id: 6252001
description:
2025-12-27 09:02:08 dovecot_login authenticator failed for H=([12.202.15.69]) [12.202.15.69]:51716: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 27 09:03:17 host2 sshd[1779990]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.254.85.115
country_id: 6252001
description:
2025-12-27 09:08:26 dovecot_plain authenticator failed for H=(localhost) [47.254.85.115]:59256: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 95.0.171.75
country_id: 298795
description:
Dec 27 09:12:02 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=95.0.171.75, lip=66.85.158.91, TLS, session=<Hez/yeZGGNNfAKtL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.51.181
country_id: 953987
description:
Dec 27 09:12:10 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 24 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=102.129.51.181, lip=66.85.158.91, TLS, session=<pBoRyuZGgqJmgTO1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.44.210
country_id: 2300660
description:
Dec 27 09:12:33 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<contact>, method=PLAIN, rip=41.139.44.210, lip=66.85.158.91, TLS, session=<dKW/y+ZGWespiyzS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.98.97.183
country_id: 3077311
description:
Dec 27 09:12:38 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<contact>, method=PLAIN, rip=176.98.97.183, lip=66.85.158.91, TLS, session=<tycqzOZGOLSwYmG3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.143.14
country_id: 1269750
description:
2025-12-27 09:12:39 dovecot_login authenticator failed for H=([103.251.143.14]) [103.251.143.14]:44936: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2025-12-27 09:12:59 dovecot_login authenticator failed for H=([102.53.15.18]) [102.53.15.18]:33911: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.168.11.67
country_id: 2077456
description:
2025-12-27 09:14:35 dovecot_login authenticator failed for H=([101.168.11.67]) [101.168.11.67]:35020: 535 Incorrect authentication data (set_id=prasanka@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.231.243.28
country_id: 6252001
description:
2025-12-27 09:14:48 dovecot_login authenticator failed for H=([50.231.243.28]) [50.231.243.28]:52356: 535 Incorrect authentication data (set_id=prasanka)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.161.73
country_id: 3144096
description:
2025-12-27 09:20:12 dovecot_login authenticator failed for H=(73-161-97-62.cust.smartcall.no) [62.97.161.73]:47937: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.5
country_id: 1733045
description:
2025-12-27 09:20:29 dovecot_login authenticator failed for H=([49.124.151.5]) [49.124.151.5]:49166: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.135
country_id: 6252001
description:
Dec 27 09:20:36 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 45 secs): user=<>, rip=162.216.150.135, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<4MCp6eZGcdmi2JaH>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.135
country_id: 6252001
description:
Dec 27 09:21:13 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 21 secs): user=<>, rip=162.216.150.135, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<p1Dd6+ZGXP2i2JaH>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 27 09:25:30 host2 pure-ftpd[1799401]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.135
country_id: 6252001
description:
Dec 27 09:28:27 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.150.135, lip=66.85.158.91, TLS, session=<NFGxBedGLuSi2JaH>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 27 09:31:06 host2 sshd[1803693]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.171.85.124
country_id: 1643084
description:
Dec 27 09:33:45 host2 sshd[1805652]: Disconnected from invalid user erp 103.171.85.124 port 40194 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 96.92.63.243
country_id: 6252001
description:
Dec 27 09:33:12 host2 sshd[1805286]: Disconnected from invalid user ubuntu 96.92.63.243 port 52064 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.232.178.116
country_id: 1269750
description:
Dec 27 09:34:26 host2 sshd[1806219]: Disconnected from invalid user auser 165.232.178.116 port 48206 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.173.160.152
country_id: 6252001
description:
Dec 27 09:35:02 host2 sshd[1806763]: Disconnected from invalid user sabrina 107.173.160.152 port 53822 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.171.85.124
country_id: 1643084
description:
Dec 27 09:36:25 host2 sshd[1808166]: Disconnected from invalid user fox 103.171.85.124 port 40718 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 165.232.178.116
country_id: 1269750
description:
Dec 27 09:37:07 host2 sshd[1808690]: Disconnected from invalid user milad 165.232.178.116 port 55972 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.171.85.124
country_id: 1643084
description:
Dec 27 09:37:12 host2 sshd[1808757]: Disconnected from invalid user upgrade 103.171.85.124 port 49028 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.147.248.12
country_id: 1269750
description:
2025-12-27 09:38:34 dovecot_login authenticator failed for H=([103.147.248.12]) [103.147.248.12]:32872: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.111.98
country_id: 6252001
description:
2025-12-27 09:38:21 dovecot_login authenticator failed for H=syn-035-130-111-098.biz.spectrum.com [35.130.111.98]:39872: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 96.92.63.243
country_id: 6252001
description:
Dec 27 09:40:05 host2 sshd[1811666]: Received disconnect from 96.92.63.243 port 45864:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.232.178.116
country_id: 1269750
description:
Dec 27 09:39:44 host2 sshd[1811033]: Disconnected from invalid user guest 165.232.178.116 port 54734 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 5.198.176.28
country_id: 130758
description:
Dec 27 09:39:55 host2 sshd[1811285]: Disconnected from invalid user henry 5.198.176.28 port 55350 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.173.160.152
country_id: 6252001
description:
Dec 27 09:40:45 host2 sshd[1812478]: Disconnected from invalid user hong 107.173.160.152 port 57646 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 5.198.176.28
country_id: 130758
description:
Dec 27 09:40:29 host2 sshd[1812178]: Disconnected from invalid user tor 5.198.176.28 port 55406 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 96.92.63.243
country_id: 6252001
description:
Dec 27 09:40:36 host2 sshd[1812324]: Disconnected from invalid user mongo 96.92.63.243 port 57746 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.171.85.124
country_id: 1643084
description:
Dec 27 09:41:14 host2 sshd[1812976]: Disconnected from invalid user milad 103.171.85.124 port 44712 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.173.160.152
country_id: 6252001
description:
Dec 27 09:41:26 host2 sshd[1813165]: Disconnected from invalid user financeiro 107.173.160.152 port 38584 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.172.244.235
country_id: 6252001
description:
2025-12-27 09:43:02 dovecot_login authenticator failed for H=c-67-172-244-235.hsd1.ut.comcast.net [67.172.244.235]:41919: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 5.198.176.28
country_id: 130758
description:
Dec 27 09:42:09 host2 sshd[1813773]: Disconnected from invalid user hruser 5.198.176.28 port 55570 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 107.173.160.152
country_id: 6252001
description:
Dec 27 09:42:10 host2 sshd[1813809]: Disconnected from invalid user software 107.173.160.152 port 44716 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2025-12-27 09:42:17 dovecot_login authenticator failed for H=([41.220.3.113]) [41.220.3.101]:27476: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.235.110
country_id: 1269750
description:
2025-12-27 09:43:53 dovecot_login authenticator failed for H=([128.185.160.185]) [128.185.235.110]:56700: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.161.217.228
country_id: 2510769
description:
2025-12-27 09:43:14 dovecot_login authenticator failed for H=(228.pool90-161-217.static.orange.es) [90.161.217.228]:35409: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.146.167
country_id: 3996063
description:
2025-12-27 09:43:24 dovecot_login authenticator failed for H=([177.236.146.167]) [177.236.146.167]:49802: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.174.18
country_id: 1269750
description:
2025-12-27 09:47:21 dovecot_login authenticator failed for H=(dsl-del-dynamic-225.66.246.61.airtelbroadband.in) [182.95.174.18]:57390: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.98.144.36
country_id: 1269750
description:
2025-12-27 09:47:41 dovecot_login authenticator failed for H=([59.98.144.36]) [59.98.144.36]:56917: 535 Incorrect authentication data (set_id=training)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 27 09:50:34 host2 sshd[1821324]: Disconnected from invalid user admin 2.57.121.112 port 34312 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.8.120.90
country_id: 3469034
description:
Dec 27 09:53:06 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=187.8.120.90, lip=66.85.158.91, session=<raW2XedGhai7CHha>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 68.150.109.105
country_id: 6251999
description:
Dec 27 09:53:12 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=68.150.109.105, lip=66.85.158.91, TLS, session=<pz0sXedGo8pElm1p>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.145.126
country_id: 1819730
description:
2025-12-27 09:53:18 dovecot_login authenticator failed for H=([223.197.145.126]) [223.197.145.126]:62471: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.29.149.211
country_id: 1522867
description:
Dec 27 09:53:19 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=85.29.149.211, lip=66.85.158.91, session=<blV5XudGxNlVHZXT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.72.153.110
country_id: 290557
description:
Dec 27 09:53:33 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<hr>, method=PLAIN, rip=91.72.153.110, lip=66.85.158.91, TLS, session=<3lBUXudGVLJbSJlu>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.21.235.162
country_id: 6252001
description:
Dec 27 09:53:50 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=64.21.235.162, lip=66.85.158.91, TLS, session=<9lZ/X+dG6+dAFeui>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 115.84.92.45
country_id: 1655842
description:
Dec 27 09:54:06 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 41 secs): user=<hr>, method=PLAIN, rip=115.84.92.45, lip=66.85.158.91, TLS, session=<DacGX+dGQKxzVFwt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 93.91.153.26
country_id: 3077311
description:
Dec 27 09:53:11 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=93.91.153.26, lip=66.85.158.91, TLS, session=<GmosXedGzoFdW5ka>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 14.139.107.146
country_id: 1269750
description:
Dec 27 09:53:32 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=14.139.107.146, lip=66.85.158.91, session=<BRFIX+dG6oQOi2uS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.139.107.146
country_id: 1269750
description:
2025-12-27 09:53:58 dovecot_login authenticator failed for H=([14.139.107.146]) [14.139.107.146]:57068: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 174.138.87.242
country_id: 6252001
description:
Dec 27 09:54:42 host2 sshd[1825265]: Disconnected from invalid user test 174.138.87.242 port 60882 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 177.53.215.134
country_id: 3658394
description:
Dec 27 09:56:47 host2 sshd[1827345]: Disconnected from invalid user szy 177.53.215.134 port 60908 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 174.138.87.242
country_id: 6252001
description:
Dec 27 09:58:25 host2 sshd[1828774]: Disconnected from invalid user lucas 174.138.87.242 port 40492 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 174.138.87.242
country_id: 6252001
description:
Dec 27 10:00:35 host2 sshd[1830828]: Disconnected from invalid user zhang 174.138.87.242 port 36520 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 174.138.87.242
country_id: 6252001
description:
Dec 27 10:01:07 host2 sshd[1831243]: Disconnected from invalid user user 174.138.87.242 port 49354 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.223.53.234
country_id: 3932488
description:
2025-12-27 10:01:25 dovecot_login authenticator failed for H=([190.223.53.234]) [190.223.53.234]:42399: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.231.202.201
country_id: 51537
description:
2025-12-27 10:02:13 dovecot_login authenticator failed for H=([197.231.202.201]) [197.231.202.201]:46460: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 174.138.87.242
country_id: 6252001
description:
Dec 27 10:03:19 host2 sshd[1833018]: Received disconnect from 174.138.87.242 port 59610:11: Bye Bye [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 168.194.154.167
country_id: 3469034
description:
Dec 27 10:04:53 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<chitral00@bostonlanka.com>, method=PLAIN, rip=168.194.154.167, lip=66.85.158.91, TLS, session=<Qt3thudGcKaowpqn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.0.30.226
country_id: 226074
description:
Dec 27 10:05:15 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<chitral00>, method=PLAIN, rip=196.0.30.226, lip=66.85.158.91, TLS, session=<eLghiOdGKNXEAB7i>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.50.142.82
country_id: 3469034
description:
Dec 27 10:07:18 host2 sshd[1836602]: Disconnected from invalid user mgeweb 189.50.142.82 port 42580 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 189.50.142.82
country_id: 3469034
description:
Dec 27 10:08:38 host2 sshd[1837774]: Disconnected from invalid user myuser 189.50.142.82 port 41339 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 34.23.186.190
country_id: 6252001
description:
Dec 27 10:10:31 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=34.23.186.190, lip=66.85.158.91, session=<zykqnOdGooEiF7q+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.194.160
country_id: 6252001
description:
Dec 27 10:22:17 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.65.194.160, lip=66.85.158.91, session=<NRA8xudGDroUQcKg>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.172
country_id: 6252001
description:
Dec 27 10:25:35 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.172, lip=66.85.158.91, TLS handshaking: Connection closed, session=<oYMI0udGtj1BMQGs>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 27 10:28:06 host2 pure-ftpd[1856389]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.255.208
country_id: 2542007
description:
2025-12-27 10:31:15 dovecot_login authenticator failed for H=([154.144.255.208]) [154.144.255.208]:60498: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.146.166
country_id: 1269750
description:
2025-12-27 10:31:14 dovecot_login authenticator failed for H=([125.19.175.250]) [122.185.146.166]:34568: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.128.151.92
country_id: 6252001
description:
2025-12-27 10:31:43 dovecot_login authenticator failed for H=c-73-128-151-92.hsd1.de.comcast.net [73.128.151.92]:47408: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-27 10:32:10 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:58414: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.82.97.80
country_id: 1269750
description:
2025-12-27 10:32:14 dovecot_login authenticator failed for H=([183.82.97.80]) [183.82.97.80]:57628: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 104.239.103.125
country_id: 3277605
description:
Dec 27 10:33:14 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@simple-engineering.lk>, method=PLAIN, rip=104.239.103.125, lip=66.85.158.91, TLS, session=<nUNv7OdGyIFo72d9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.118.34.82
country_id: 1269750
description:
Dec 27 10:33:48 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info>, method=PLAIN, rip=45.118.34.82, lip=66.85.158.91, TLS, session=<KV8r7udG55stdiJS>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.115.83.250
country_id: 6252001
description:
Dec 27 10:35:06 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.115.83.250, lip=66.85.158.92, session=<u0AQ9OdGDqcUc1P6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.50.5.94
country_id: 1269750
description:
2025-12-27 10:40:40 dovecot_login authenticator failed for H=([103.50.5.94]) [103.50.5.94]:32867: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.168.50
country_id: 2186224
description:
2025-12-27 10:41:02 dovecot_login authenticator failed for H=([121.73.168.50]) [121.73.168.50]:42436: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.161.152
country_id: 298795
description:
2025-12-27 10:41:27 dovecot_login authenticator failed for H=([5.11.161.152]) [5.11.161.152]:47314: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.226.51
country_id: 1819730
description:
2025-12-27 10:41:57 dovecot_login authenticator failed for H=(223-197-226-51.static.imsbiz.com) [223.197.226.51]:58457: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.41
country_id: 6252001
description:
Dec 27 10:42:01 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=205.210.31.41, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<aO/NDOhGrcTN0h8p>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.148.129
country_id: 3144096
description:
2025-12-27 10:42:01 dovecot_login authenticator failed for H=(cm-178.232.148.129.get.no) [178.232.148.129]:33770: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.153.138
country_id: 1819730
description:
2025-12-27 10:41:23 dovecot_login authenticator failed for H=(223-197-153-138.static.imsbiz.com) [223.197.153.138]:59478: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 27 10:47:35 host2 sshd[1873999]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.203.231.220
country_id: 2464461
description:
2025-12-27 10:48:10 dovecot_login authenticator failed for H=([196.203.231.220]) [196.203.231.220]:48428: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.222.54
country_id: 1269750
description:
2025-12-27 10:48:57 dovecot_login authenticator failed for H=([122.187.222.54]) [122.187.222.54]:47794: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.120
country_id: 6252001
description:
Dec 27 10:53:01 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.120, lip=66.85.158.92, TLS, session=<JgEgNOhGqPXG6xh4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.213.236.66
country_id: 6252001
description:
2025-12-27 11:02:14 dovecot_plain authenticator failed for H=c-73-213-236-66.hsd1.va.comcast.net (alcastiles) [73.213.236.66]:54278: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.254.85.115
country_id: 6252001
description:
2025-12-27 11:02:17 dovecot_plain authenticator failed for H=(localhost) [47.254.85.115]:52394: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.241.132.152
country_id: 1269750
description:
2025-12-27 11:06:52 dovecot_login authenticator failed for H=([115.244.235.242]) [43.241.132.152]:38112: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.74.136.134
country_id: 6252001
description:
2025-12-27 11:07:14 dovecot_plain authenticator failed for H=syn-050-074-136-134.biz.spectrum.com (lupsy) [50.74.136.134]:37164: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.172.147.190
country_id: 1269750
description:
2025-12-27 11:07:37 dovecot_login authenticator failed for H=([110.172.147.190]) [110.172.147.190]:43367: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 27 11:15:32 host2 sshd[1924050]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.161.217.228
country_id: 2510769
description:
2025-12-27 11:19:17 dovecot_login authenticator failed for H=(228.pool90-161-217.static.orange.es) [90.161.217.228]:50641: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 134.209.106.127
country_id: 1880251
description:
Dec 27 11:19:41 host2 sshd[1928663]: Invalid user cloudtourssrilanka from 134.209.106.127 port 46824


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.255.200.141
country_id: 2413451
description:
2025-12-27 11:24:06 dovecot_login authenticator failed for H=([197.255.200.141]) [197.255.200.141]:42980: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.154.252.219
country_id: 2635167
description:
Dec 27 11:25:19 host2 pure-ftpd[1935329]: (?@165.154.252.219) [INFO] New connection from 165.154.252.219


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 27 11:30:51 host2 pure-ftpd[1941558]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.11.195.98
country_id: 3865483
description:
Dec 27 11:30:50 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<chitral00@bostonlanka.com>, method=PLAIN, rip=190.11.195.98, lip=66.85.158.91, TLS, session=<z/xFuuhGCoC+C8Ni>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.233.185.13
country_id: 798544
description:
Dec 27 11:31:08 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<chitral00>, method=PLAIN, rip=91.233.185.13, lip=66.85.158.91, TLS, session=<fZx4u+hGSZxb6bkN>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.104
country_id: 6252001
description:
Dec 27 11:33:32 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.104, lip=66.85.158.91, TLS, session=<GJENxehGIuTN0h9o>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.179.189.5
country_id: 3469034
description:
Dec 27 11:34:23 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@simple-engineering.lk>, method=PLAIN, rip=45.179.189.5, lip=66.85.158.91, TLS, session=<mB0Cx+hGF9kts70F>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.71.66
country_id: 3469034
description:
Dec 27 11:34:43 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=177.44.71.66, lip=66.85.158.91, TLS, session=<NQs1yOhGAIWxLEdC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.129.206.14
country_id: 1269750
description:
2025-12-27 11:42:14 dovecot_login authenticator failed for H=([203.129.206.14]) [203.129.206.14]:60004: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.255.205.66
country_id: 2413451
description:
2025-12-27 11:42:45 dovecot_login authenticator failed for H=([197.255.205.66]) [197.255.205.66]:46064: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.81
country_id: 1269750
description:
2025-12-27 11:46:08 dovecot_login authenticator failed for H=([122.187.230.81]) [122.187.230.81]:50537: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.20
country_id: 1269750
description:
2025-12-27 11:46:27 dovecot_login authenticator failed for H=([122.187.230.20]) [122.187.230.20]:37623: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 172.81.132.188
country_id: 6252001
description:
Dec 27 11:46:35 host2 pure-ftpd[1955642]: (?@172.81.132.188) [INFO] New connection from 172.81.132.188


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.94
country_id: 2635167
description:
Dec 27 11:52:47 host2 dovecot[1881837]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=185.247.137.94, lip=66.85.158.92, TLS, session=<b1jfCelGSZ6594le>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.105
country_id: 2635167
description:
Dec 27 11:52:48 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.105, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<yiz2CelGa+m594lp>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.101
country_id: 2635167
description:
Dec 27 11:53:21 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.101, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<s43xC+lGNZlX7LBl>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.88
country_id: 2635167
description:
Dec 27 11:53:55 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: read(size=679) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.88, lip=66.85.158.92, TLS handshaking: read(size=679) failed: Connection reset by peer, session=<bAntDelGyY6594lY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.94
country_id: 2635167
description:
Dec 27 11:54:28 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: read(size=693) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.94, lip=66.85.158.92, TLS handshaking: read(size=693) failed: Connection reset by peer, session=<Y4DoD+lGC5FX7LBe>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.108
country_id: 2635167
description:
Dec 27 11:55:01 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: read(size=612) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.108, lip=66.85.158.92, TLS handshaking: read(size=612) failed: Connection reset by peer, session=<SNHjEelGu9JX7LBs>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.99
country_id: 2635167
description:
Dec 27 11:55:34 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=87.236.176.99, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<GgzdE+lGnc1X7LBj>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.102
country_id: 2635167
description:
Dec 27 11:56:08 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.102, lip=66.85.158.92, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<5WLaFelGwbxX7LBm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.90
country_id: 2635167
description:
Dec 27 11:56:41 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.90, lip=66.85.158.92, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<zZ7VF+lGCb+594la>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.95
country_id: 2635167
description:
Dec 27 11:57:14 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=87.236.176.95, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<2fzOGelGJ+BX7LBf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.94
country_id: 2635167
description:
Dec 27 11:57:47 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=87.236.176.94, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<9VvKG+lGxa1X7LBe>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.25.186.130
country_id: 6252001
description:
2025-12-27 11:59:23 dovecot_login authenticator failed for H=(173-25-186-130.client.mchsi.com) [173.25.186.130]:55703: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.6.101.246
country_id: 2510769
description:
2025-12-27 12:00:40 dovecot_login authenticator failed for H=246.red-88-6-101.staticip.rima-tde.net [88.6.101.246]:59703: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.62.51
country_id: 1269750
description:
2025-12-27 12:01:01 dovecot_login authenticator failed for H=([103.29.62.51]) [103.29.62.51]:50190: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.232.73.130
country_id: 1269750
description:
2025-12-27 12:03:18 dovecot_login authenticator failed for H=([1.7.229.162]) [136.232.73.130]:47988: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.244.106
country_id: 1269750
description:
2025-12-27 12:03:53 dovecot_login authenticator failed for H=([152.52.244.106]) [152.52.244.106]:40726: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.103.17.124
country_id: 690791
description:
Dec 27 12:05:29 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<chitral00@bostonlanka.com>, method=PLAIN, rip=176.103.17.124, lip=66.85.158.91, TLS, session=<lFBaNulGvaiwZxF8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.39.142.51
country_id: 3469034
description:
Dec 27 12:05:49 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<chitral00>, method=PLAIN, rip=177.39.142.51, lip=66.85.158.91, TLS, session=<eBptN+lG94GxJ44z>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.24
country_id: 241170
description:
Dec 27 12:07:17 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.24, lip=66.85.158.91, session=<72OcPelGPt7E+2YY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.14.24.50
country_id: 2658434
description:
2025-12-27 12:09:04 dovecot_login authenticator failed for H=50.24.14.46.static.wline.lns.sme.cust.swisscom.ch [46.14.24.50]:49217: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.119.144.86
country_id: 6252001
description:
2025-12-27 12:09:09 dovecot_login authenticator failed for H=24-119-144-86.cpe.sparklight.net [24.119.144.86]:53468: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.195.66
country_id: 1269750
description:
2025-12-27 12:08:47 dovecot_login authenticator failed for H=([128.185.169.25]) [125.19.195.66]:45994: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.87.248.223
country_id: 732800
description:
2025-12-27 12:09:20 dovecot_login authenticator failed for H=95-87-248-223.ip.btc-net.bg [95.87.248.223]:60752: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.141
country_id: 6252001
description:
Dec 27 12:13:59 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 15 secs): user=<>, rip=66.132.153.141, lip=66.85.158.91, TLS handshaking: Connection closed, session=<BiC1VelGdIdChJmN>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.175.193.205
country_id: 1269750
description:
Dec 27 12:16:27 host2 sshd[1982615]: Invalid user cloudtourssrilanka from 122.175.193.205 port 36186


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 27 12:32:17 host2 sshd[1994099]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 27 12:33:41 host2 pure-ftpd[1995232]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 89.248.167.131
country_id: 2750405
description:
Dec 27 12:38:15 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record (no auth attempts in 1 secs): user=<>, rip=89.248.167.131, lip=66.85.158.92, TLS: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record, session=<yft4rOlGstJZ+KeD>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.204.88
country_id: 99237
description:
2025-12-27 12:42:13 dovecot_login authenticator failed for H=([65.20.204.88]) [65.20.204.88]:37945: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.187.152.61
country_id: 6252001
description:
2025-12-27 12:42:34 dovecot_login authenticator failed for H=(c-50-187-152-61.unallocated.comcastbusiness.net) [50.187.152.61]:56876: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.21
country_id: 241170
description:
Dec 27 12:46:31 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.21, lip=66.85.158.91, session=<m63syelGSrTE+2YV>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.18.99.126
country_id: 1269750
description:
2025-12-27 12:49:49 dovecot_login authenticator failed for H=([125.18.99.126]) [125.18.99.126]:39392: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.65.99
country_id: 3144096
description:
2025-12-27 12:49:58 dovecot_login authenticator failed for H=(cm-178.232.65.99.get.no) [178.232.65.99]:51376: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2025-12-27 12:58:37 dovecot_plain authenticator failed for H=host-196-47-172-253.afnet.net (catylene) [196.47.172.253]:56939: 535 Incorrect authentication data (set_id=it@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.72.17.43
country_id: 2750405
description:
2025-12-27 12:59:08 dovecot_login authenticator failed for H=([77.72.17.43]) [77.72.17.43]:42458: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.148.189
country_id: 1733045
description:
2025-12-27 12:59:32 dovecot_login authenticator failed for H=([49.124.148.189]) [49.124.148.189]:48774: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 27 13:00:23 host2 sshd[2018690]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 187.120.106.191
country_id: 3469034
description:
Dec 27 13:07:18 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@simple-engineering.lk>, method=PLAIN, rip=187.120.106.191, lip=66.85.158.91, TLS, session=<77BHE+pGqo67eGq/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.47.49
country_id: 953987
description:
Dec 27 13:07:50 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=102.64.47.49, lip=66.85.158.91, TLS, session=<8ngmFepGH4lmQC8x>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 27 13:11:38 host2 sshd[2027477]: Disconnected from invalid user admin 2.57.121.112 port 12747 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2025-12-27 13:11:41 dovecot_login authenticator failed for H=([41.220.3.113]) [41.220.3.101]:13851: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.91.166.34
country_id: 1643084
description:
Dec 27 13:13:56 host2 sshd[2028937]: Disconnected from invalid user jarservice 36.91.166.34 port 46056 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 67.207.93.178
country_id: 6252001
description:
Dec 27 13:14:34 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=67.207.93.178, lip=66.85.158.92, TLS handshaking: Connection closed, session=<iYNbLupGsoRDz12y>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.91.166.34
country_id: 1643084
description:
Dec 27 13:14:50 host2 sshd[2029634]: Disconnected from invalid user rootftp 36.91.166.34 port 60800 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 36.91.166.34
country_id: 1643084
description:
Dec 27 13:15:39 host2 sshd[2030651]: Disconnected from invalid user alex 36.91.166.34 port 46542 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.91.166.34
country_id: 1643084
description:
Dec 27 13:16:24 host2 sshd[2031233]: Disconnected from invalid user mcuser 36.91.166.34 port 60510 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.91.166.34
country_id: 1643084
description:
Dec 27 13:17:10 host2 sshd[2031949]: Disconnected from invalid user testuser 36.91.166.34 port 46228 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.204.240.61
country_id: 357994
description:
Dec 27 13:18:30 host2 sshd[2032890]: Disconnected from invalid user oracle 196.204.240.61 port 55966 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.254.54
country_id: 1269750
description:
2025-12-27 13:19:58 dovecot_login authenticator failed for H=([128.185.254.54]) [128.185.254.54]:39274: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.58.241.90
country_id: 3469034
description:
2025-12-27 13:20:09 dovecot_login authenticator failed for H=(ccabv.org.cta.gvt.net.br) [187.58.241.90]:51103: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 163.227.196.60
country_id: 3996063
description:
Dec 27 13:21:19 host2 pure-ftpd[2035523]: (?@163.227.196.60) [INFO] New connection from 163.227.196.60


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2025-12-27 13:21:34 dovecot_login authenticator failed for H=([196.216.81.126]) [196.216.81.126]:46004: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 196.204.240.61
country_id: 357994
description:
Dec 27 13:21:50 host2 sshd[2036105]: Disconnected from invalid user zx 196.204.240.61 port 53550 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2025-12-27 13:22:02 dovecot_login authenticator failed for H=([102.53.15.56]) [102.53.15.56]:41392: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 24.199.117.9
country_id: 6252001
description:
Dec 27 13:22:58 host2 sshd[2037287]: Received disconnect from 24.199.117.9 port 39270:11: Bye Bye [preauth]


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 206.71.149.226
country_id: 2635167
description:
Denial of Service (DoS) attack was discovered from 206.71.149.226: 250 connections per 30 seconds to 80 port.


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 24.199.117.9
country_id: 6252001
description:
Dec 27 13:23:58 host2 sshd[2037949]: Disconnected from invalid user ubuntu 24.199.117.9 port 33396 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.124.97.102
country_id: 2245662
description:
Dec 27 13:25:55 host2 sshd[2039473]: Disconnected from invalid user rustserver 154.124.97.102 port 56242 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.223.45.112
country_id: 1880251
description:
Dec 27 13:25:38 host2 sshd[2039300]: Disconnected from invalid user david 159.223.45.112 port 57214 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 24.199.117.9
country_id: 6252001
description:
Dec 27 13:25:53 host2 sshd[2039466]: Disconnected from invalid user oracle 24.199.117.9 port 55660 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.206.160
country_id: 6252001
description:
Dec 27 13:26:50 host2 sshd[2040104]: Disconnected from invalid user david 152.32.206.160 port 52730 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.206.160
country_id: 6252001
description:
Dec 27 13:28:54 host2 sshd[2041759]: Disconnected from invalid user postgres 152.32.206.160 port 58328 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 132.248.170.105
country_id: 3996063
description:
Dec 27 13:28:09 host2 sshd[2041185]: Received disconnect from 132.248.170.105 port 36838:11: Bye Bye [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 132.248.170.105
country_id: 3996063
description:
Dec 27 13:28:09 host2 sshd[2041185]: Disconnected from invalid user vitor 132.248.170.105 port 36838 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.223.45.112
country_id: 1880251
description:
Dec 27 13:28:35 host2 sshd[2041500]: Disconnected from invalid user netbox 159.223.45.112 port 50136 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.221.74.234
country_id: 226074
description:
Dec 27 13:29:34 host2 sshd[2042362]: Disconnected from invalid user colin 45.221.74.234 port 50564 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 212.11.64.164
country_id: 241170
description:
Dec 27 13:29:39 host2 sshd[2042447]: Disconnected from invalid user ubuntu 212.11.64.164 port 40674 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.174.177.154
country_id: 6252001
description:
Dec 27 13:29:52 host2 sshd[2042693]: Disconnected from invalid user esunny 172.174.177.154 port 44420 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.206.160
country_id: 6252001
description:
Dec 27 13:29:26 host2 sshd[2042274]: Disconnected from invalid user odoo 152.32.206.160 port 45460 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 83.229.122.23
country_id: 1819730
description:
Dec 27 13:29:42 host2 sshd[2042490]: Disconnected from invalid user debian 83.229.122.23 port 59322 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.202.8.218
country_id: 1269750
description:
Dec 27 13:29:44 host2 sshd[2042513]: Disconnected from invalid user ubuntu 160.202.8.218 port 50350 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.229.122.23
country_id: 1819730
description:
Dec 27 13:30:17 host2 sshd[2043368]: Disconnected from invalid user user 83.229.122.23 port 36760 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 160.202.8.218
country_id: 1269750
description:
Dec 27 13:31:51 host2 sshd[2044529]: Disconnected from invalid user mcserver 160.202.8.218 port 50548 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 212.11.64.164
country_id: 241170
description:
Dec 27 13:31:57 host2 sshd[2044592]: Disconnected from invalid user mcserver 212.11.64.164 port 54680 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.150.110.167
country_id: 6252001
description:
Dec 27 13:32:05 host2 sshd[2044671]: Disconnected from invalid user mcserver 107.150.110.167 port 50088 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.221.74.234
country_id: 226074
description:
Dec 27 13:31:07 host2 sshd[2044189]: Disconnected from invalid user gitlab-runner 45.221.74.234 port 59858 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 107.150.110.167
country_id: 6252001
description:
Dec 27 13:32:54 host2 sshd[2045263]: Disconnected from invalid user user 107.150.110.167 port 34380 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.174.177.154
country_id: 6252001
description:
Dec 27 13:32:15 host2 sshd[2044742]: Disconnected from invalid user postgres 172.174.177.154 port 49030 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 212.11.64.164
country_id: 241170
description:
Dec 27 13:32:57 host2 sshd[2045297]: Received disconnect from 212.11.64.164 port 41872:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.124.97.102
country_id: 2245662
description:
Dec 27 13:32:09 host2 sshd[2044689]: Disconnected from invalid user adam 154.124.97.102 port 50263 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.95.22.226
country_id: 3469034
description:
2025-12-27 13:33:11 dovecot_login authenticator failed for H=(187.95.22.226.netjacarei.nipcable.com) [187.95.22.226]:53786: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.226.107.70
country_id: 3469034
description:
2025-12-27 13:33:35 dovecot_login authenticator failed for H=(72-107-226-38.edgetelecom.com.br) [38.226.107.70]:50343: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 27 13:36:28 host2 pure-ftpd[2048375]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 50.6.193.137
country_id: 6252001
description:
Dec 27 13:36:33 host2 sshd[2048426]: Disconnected from invalid user julian 50.6.193.137 port 39782 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 27 13:39:06 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<z4sdhupG1JoDhpQ7>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.159.233.104
country_id: 6252001
description:
[2025-12-27 13:39:04 +0530] info [cpaneld] 98.159.233.104 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilan_travel (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.159.233.104
country_id: 6252001
description:
[2025-12-27 13:39:07 +0530] info [whostmgrd] 98.159.233.104 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 27 13:39:11 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<X4xuhupG4JoDhpQ7>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.174.199
country_id: 1819730
description:
Dec 27 13:39:18 host2 sshd[2050707]: Disconnected from invalid user ftp1 152.32.174.199 port 59450 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.61
country_id: 1733045
description:
2025-12-27 13:39:57 dovecot_login authenticator failed for H=([49.124.153.61]) [49.124.153.61]:39106: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 27 13:40:13 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, TLS, session=<QDUaiupGkq8DhpQ7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.146.100.157
country_id: 2510769
description:
2025-12-27 13:40:23 dovecot_login authenticator failed for H=157.red-79-146-100.dynamicip.rima-tde.net [79.146.100.157]:54689: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.110.137.94
country_id: 6252001
description:
Dec 27 13:40:25 host2 sshd[2051773]: Disconnected from invalid user ftp1 143.110.137.94 port 38228 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.174.199
country_id: 1819730
description:
Dec 27 13:42:44 host2 sshd[2053662]: Disconnected from invalid user mcserver 152.32.174.199 port 36456 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 27 13:42:11 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, TLS handshaking: Connection closed, session=<buYhkepGUuwDhpQ7>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 143.110.137.94
country_id: 6252001
description:
Dec 27 13:42:11 host2 sshd[2053293]: Disconnected from invalid user sameer 143.110.137.94 port 40724 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.204.4
country_id: 1643084
description:
Dec 27 13:44:04 host2 sshd[2055059]: Disconnected from invalid user vitor 103.172.204.4 port 44628 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 27 13:44:14 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, TLS handshaking: Connection closed, session=<wXF2mOpGntoDhpQ7>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.174.199
country_id: 1819730
description:
Dec 27 13:44:57 host2 sshd[2056249]: Disconnected from invalid user kyt 152.32.174.199 port 54586 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 27 13:45:18 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, TLS, session=<3Y9LnOpG/NsDhpQ7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2025-12-27 13:47:30 dovecot_login authenticator failed for H=([197.219.228.242]) [197.219.228.242]:47398: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.30.14.221
country_id: 6252001
description:
2025-12-27 13:47:42 dovecot_login authenticator failed for H=pool-108-30-14-221.nycmny.fios.verizon.net [108.30.14.221]:58146: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.160.166.237
country_id: 1820814
description:
2025-12-27 13:50:31 dovecot_login authenticator failed for H=(237-166.adsl.static.espeed.com.bn) [119.160.166.237]:60558: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.168
country_id: 1269750
description:
2025-12-27 13:50:59 dovecot_login authenticator failed for H=([122.187.229.168]) [122.187.229.168]:47486: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.236
country_id: 6252001
description:
Dec 27 13:51:49 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=205.210.31.236, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<gvmbs+pGCtDN0h/s>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.126.105.42
country_id: 3469034
description:
2025-12-27 13:52:11 dovecot_login authenticator failed for H=187-126-105-42.user.vtal.net.br (187-126-105-145.user.vtal.net.br) [187.126.105.42]:50502: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.0.113.110
country_id: 226074
description:
2025-12-27 13:52:13 dovecot_login authenticator failed for H=([196.0.113.110]) [196.0.113.110]:37035: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.27
country_id: 3144096
description:
2025-12-27 13:52:25 dovecot_login authenticator failed for H=(cm-84.213.189.27.get.no) [84.213.189.27]:52345: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.25.59.5
country_id: 3469034
description:
2025-12-27 13:52:52 dovecot_login authenticator failed for H=(ip-177-25-59-5.user.vivozap.com.br) [177.25.59.5]:32956: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.0.63.226
country_id: 3686110
description:
Dec 27 13:53:06 host2 sshd[2062910]: Disconnected from invalid user bot1 190.0.63.226 port 33212 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.170
country_id: 6252001
description:
Dec 27 13:53:34 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.170, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<IXHUuepGEtTG6xiq>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.0.63.226
country_id: 3686110
description:
Dec 27 13:54:37 host2 sshd[2064171]: Disconnected from invalid user julio 190.0.63.226 port 55762 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.254.54
country_id: 1269750
description:
2025-12-27 13:56:06 dovecot_login authenticator failed for H=([128.185.254.54]) [128.185.254.54]:54242: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 190.0.63.226
country_id: 3686110
description:
Dec 27 13:55:19 host2 sshd[2064872]: Disconnected from invalid user rahul 190.0.63.226 port 41246 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.170.98.139
country_id: 1269750
description:
2025-12-27 13:56:28 dovecot_login authenticator failed for H=(abts-mum-static-139.98.170.122.airtelbroadband.in) [122.170.98.139]:43593: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.0.63.226
country_id: 3686110
description:
Dec 27 13:56:36 host2 sshd[2065789]: Disconnected from invalid user internal 190.0.63.226 port 40440 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-27 13:58:20 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:57771: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 37.221.151.34
country_id: 690791
description:
Dec 27 13:59:18 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@simple-engineering.lk>, method=PLAIN, rip=37.221.151.34, lip=66.85.158.91, TLS, session=<Uy84zepGYqgl3Zci>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.234.136.119
country_id: 690791
description:
Dec 27 13:59:36 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=91.234.136.119, lip=66.85.158.91, TLS, session=<kahrzupGErFb6oh3>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 72.144.12.31
country_id: 2921044
description:
Dec 27 13:59:54 host2 sshd[2068474]: Disconnected from invalid user salma 72.144.12.31 port 41384 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2025-12-27 14:00:55 dovecot_login authenticator failed for H=([102.53.15.56]) [102.53.15.56]:48479: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.203.231.220
country_id: 2464461
description:
2025-12-27 14:01:27 dovecot_login authenticator failed for H=([196.203.231.220]) [196.203.231.220]:42458: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.23
country_id: 241170
description:
Dec 27 14:01:36 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.23, lip=66.85.158.91, session=<TvRx1upGgILE+2YX>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.145.141
country_id: 1819730
description:
2025-12-27 14:02:30 dovecot_login authenticator failed for H=(223-197-145-141.static.imsbiz.com) [223.197.145.141]:49205: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 72.144.12.31
country_id: 2921044
description:
Dec 27 14:02:10 host2 sshd[2069932]: Disconnected from invalid user sora 72.144.12.31 port 59672 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.82
country_id: 1269750
description:
2025-12-27 14:02:10 dovecot_login authenticator failed for H=([122.187.230.82]) [122.187.230.82]:56659: 535 Incorrect authentication data


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 72.144.12.31
country_id: 2921044
description:
Dec 27 14:03:18 host2 sshd[2070868]: Disconnected from invalid user kevin 72.144.12.31 port 40722 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.216.135.138
country_id: 1168579
description:
Dec 27 14:04:36 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=103.216.135.138, lip=66.85.158.91, TLS, session=<62MK4OpG25Vn2IeK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.120.39.69
country_id: 690791
description:
Dec 27 14:04:54 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<designdpt>, method=PLAIN, rip=176.120.39.69, lip=66.85.158.91, TLS, session=<gPxf4epGEN2weCdF>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 212.154.234.9
country_id: 1522867
description:
Dec 27 14:07:50 host2 sshd[2074494]: Disconnected from invalid user user 212.154.234.9 port 41501 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.175.159.248
country_id: 6252001
description:
Dec 27 14:08:19 host2 sshd[2074918]: Disconnected from invalid user sysadmin 107.175.159.248 port 58218 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.30.161.197
country_id: 690791
description:
2025-12-27 14:08:37 dovecot_login authenticator failed for H=(46.30.161.197.access.ipnet.ua) [46.30.161.197]:33679: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 71.6.134.231
country_id: 6252001
description:
Dec 27 14:08:35 host2 dovecot[1881837]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=71.6.134.231, lip=66.85.158.92, TLS, session=<qlKT7+pGgN1HBobn>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 212.154.234.9
country_id: 1522867
description:
Dec 27 14:09:08 host2 sshd[2075641]: Disconnected from invalid user user 212.154.234.9 port 11880 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.162.99.230
country_id: 3077311
description:
Dec 27 14:09:19 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<chitral00@bostonlanka.com>, method=PLAIN, rip=192.162.99.230, lip=66.85.158.91, TLS, session=<hQgs8epG7IvAomPm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.183.186.43
country_id: 2510769
description:
Dec 27 14:09:38 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<chitral00>, method=PLAIN, rip=5.183.186.43, lip=66.85.158.91, TLS, session=<9zFA8upGIYkFt7or>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.175.159.248
country_id: 6252001
description:
Dec 27 14:09:53 host2 sshd[2076165]: Disconnected from invalid user mohammad 107.175.159.248 port 58264 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.113
country_id: 6252001
description:
Dec 27 14:10:29 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.113, lip=66.85.158.91, TLS: Connection closed, session=<S6NW9upGNKdChJlx>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.71
country_id: 6252001
description:
Dec 27 14:11:47 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.71, lip=66.85.158.91, session=<PzAC++pGSvrN0h9H>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.101.36.159
country_id: 2963597
description:
2025-12-27 14:14:16 dovecot_login authenticator failed for H=(089-101-036159.customer.vmie.ie) [89.101.36.159]:41508: 535 Incorrect authentication data (set_id=prasanka@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.222.54
country_id: 1269750
description:
2025-12-27 14:14:47 dovecot_login authenticator failed for H=(aes-static-089.140.22.125.airtel.in) [122.187.222.54]:42934: 535 Incorrect authentication data (set_id=prasanka)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.188.13
country_id: 2635167
description:
Dec 27 14:16:42 host2 sshd[2082420]: Disconnected from invalid user usertest 139.59.188.13 port 48086 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 27 14:17:14 host2 sshd[2082855]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.188.13
country_id: 2635167
description:
Dec 27 14:18:09 host2 sshd[2083482]: Disconnected from invalid user victor 139.59.188.13 port 55140 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.223.8.81
country_id: 2750405
description:
Dec 27 14:18:58 host2 sshd[2084138]: Disconnected from invalid user azure 159.223.8.81 port 40256 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.177.143.61
country_id: 1819730
description:
2025-12-27 14:19:08 dovecot_login authenticator failed for H=([210.177.143.61]) [210.177.143.61]:58378: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.125.83.34
country_id: 1880251
description:
2025-12-27 14:19:21 dovecot_login authenticator failed for H=([203.125.110.142]) [203.125.83.34]:49321: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 159.223.8.81
country_id: 2750405
description:
Dec 27 14:20:31 host2 sshd[2085671]: Disconnected from invalid user m 159.223.8.81 port 36734 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.188.13
country_id: 2635167
description:
Dec 27 14:20:34 host2 sshd[2085713]: Disconnected from invalid user core 139.59.188.13 port 57352 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 139.59.188.13
country_id: 2635167
description:
Dec 27 14:21:03 host2 sshd[2086320]: Received disconnect from 139.59.188.13 port 41126:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.175.159.248
country_id: 6252001
description:
Dec 27 14:21:48 host2 sshd[2086877]: Disconnected from invalid user cma 107.175.159.248 port 58690 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.223.8.81
country_id: 2750405
description:
Dec 27 14:22:30 host2 sshd[2087471]: Disconnected from invalid user core 159.223.8.81 port 40302 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 139.59.188.13
country_id: 2635167
description:
Dec 27 14:24:16 host2 sshd[2089007]: Disconnected from invalid user azure 139.59.188.13 port 38634 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.22
country_id: 241170
description:
Dec 27 14:27:25 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.22, lip=66.85.158.91, session=<6+nMMutGKOXE+2YW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.216.177.55
country_id: 1643084
description:
Dec 27 14:29:12 host2 sshd[2093154]: Disconnected from invalid user kelvin 41.216.177.55 port 48568 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 202.51.214.98
country_id: 1643084
description:
Dec 27 14:29:40 host2 sshd[2093505]: Disconnected from invalid user openeuler 202.51.214.98 port 57730 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.51.214.98
country_id: 1643084
description:
Dec 27 14:30:20 host2 sshd[2094559]: Disconnected from invalid user admin 202.51.214.98 port 41466 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.176.126
country_id: 1269750
description:
2025-12-27 14:31:03 dovecot_login authenticator failed for H=([27.123.119.235]) [122.185.176.126]:58174: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.234
country_id: 2186224
description:
2025-12-27 14:31:33 dovecot_login authenticator failed for H=([121.73.169.234]) [121.73.169.234]:43272: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 193.187.148.79
country_id: 2921044
description:
Dec 27 14:32:41 host2 sshd[2097263]: Disconnected from invalid user adminuser 193.187.148.79 port 42354 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.215.110.96
country_id: 3144096
description:
2025-12-27 14:33:32 dovecot_login authenticator failed for H=(cm-84.215.110.96.get.no) [84.215.110.96]:53133: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.208.46.130
country_id: 1522867
description:
2025-12-27 14:33:52 dovecot_login authenticator failed for H=([37.208.46.130]) [37.208.46.130]:60402: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.216.177.55
country_id: 1643084
description:
Dec 27 14:33:22 host2 sshd[2097864]: Disconnected from invalid user ubuntu 41.216.177.55 port 46816 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 193.187.148.79
country_id: 2921044
description:
Dec 27 14:34:39 host2 sshd[2098951]: Disconnected from invalid user ab 193.187.148.79 port 59912 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.216.119.134
country_id: 1819730
description:
Dec 27 14:34:10 host2 sshd[2098532]: Disconnected from invalid user leon 185.216.119.134 port 37638 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.4.31.215
country_id: 2661886
description:
2025-12-27 14:35:37 dovecot_login authenticator failed for H=h-155-4-31-215.a2204.priv.bahnhof.se [155.4.31.215]:53354: 535 Incorrect authentication data (set_id=hnt@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.170.50.2
country_id: 3932488
description:
2025-12-27 14:36:00 dovecot_login authenticator failed for H=([45.170.50.2]) [45.170.50.2]:60691: 535 Incorrect authentication data (set_id=hnt)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.216.177.55
country_id: 1643084
description:
Dec 27 14:36:22 host2 sshd[2100396]: Disconnected from invalid user grid 41.216.177.55 port 52512 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.211.56.214
country_id: 2750405
description:
Dec 27 14:38:04 host2 sshd[2101665]: Disconnected from invalid user ubuntu 172.211.56.214 port 41384 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 134.209.106.127
country_id: 1880251
description:
Dec 27 14:38:40 host2 sshd[2102067]: Invalid user cloudtourssrilanka from 134.209.106.127 port 58338


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 41.216.177.55
country_id: 1643084
description:
Dec 27 14:38:56 host2 sshd[2102260]: Disconnected from invalid user admin 41.216.177.55 port 38292 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 27 14:39:17 host2 pure-ftpd[2102610]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.200.10
country_id: 1269750
description:
2025-12-27 14:40:01 dovecot_login authenticator failed for H=([125.19.175.85]) [122.186.200.10]:55722: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.168.50
country_id: 2186224
description:
2025-12-27 14:40:24 dovecot_login authenticator failed for H=([121.73.168.50]) [121.73.168.50]:43074: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.216.119.134
country_id: 1819730
description:
Dec 27 14:40:33 host2 sshd[2103933]: Disconnected from invalid user git 185.216.119.134 port 53340 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.174.72.225
country_id: 6252001
description:
Dec 27 14:40:38 host2 sshd[2104071]: Disconnected from invalid user sambauser 172.174.72.225 port 39790 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.216.119.134
country_id: 1819730
description:
Dec 27 14:41:47 host2 sshd[2105130]: Disconnected from invalid user ubuntu 185.216.119.134 port 48928 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 27 14:45:20 host2 sshd[2108724]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.211.56.214
country_id: 2750405
description:
Dec 27 14:45:24 host2 sshd[2108736]: Disconnected from invalid user hu 172.211.56.214 port 41026 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.211.56.214
country_id: 2750405
description:
Dec 27 14:47:02 host2 sshd[2109830]: Disconnected from invalid user ruslan 172.211.56.214 port 40196 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.93
country_id: 6252001
description:
Dec 27 14:49:01 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.235.24.93, lip=66.85.158.92, session=</28sgOtGSvLG6xhd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.194
country_id: 1269750
description:
2025-12-27 14:49:49 dovecot_login authenticator failed for H=([122.187.230.194]) [122.187.230.194]:49249: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.40.189.43
country_id: 6252001
description:
2025-12-27 14:57:48 dovecot_plain authenticator failed for H=c-68-40-189-43.hsd1.mi.comcast.net (olikeelic) [68.40.189.43]:46624: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.0.212.86
country_id: 3469034
description:
Dec 27 15:02:09 host2 sshd[2122311]: Disconnected from invalid user php 177.0.212.86 port 37788 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.86.180.10
country_id: 1269750
description:
Dec 27 15:05:04 host2 sshd[2124850]: Disconnected from invalid user ftpuser 103.86.180.10 port 39639 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.86.180.10
country_id: 1269750
description:
Dec 27 15:05:39 host2 sshd[2125347]: Disconnected from invalid user rahul 103.86.180.10 port 45637 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.86.180.10
country_id: 1269750
description:
Dec 27 15:07:52 host2 sshd[2126750]: Disconnected from invalid user ec2-user 103.86.180.10 port 41377 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.0.212.86
country_id: 3469034
description:
Dec 27 15:08:29 host2 sshd[2127348]: Disconnected from invalid user bot 177.0.212.86 port 39673 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.86.180.10
country_id: 1269750
description:
Dec 27 15:10:07 host2 sshd[2128808]: Disconnected from invalid user jenkins 103.86.180.10 port 37094 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 177.0.212.86
country_id: 3469034
description:
Dec 27 15:09:51 host2 sshd[2128421]: Disconnected from invalid user ylee 177.0.212.86 port 41069 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.118.150.20
country_id: 3686110
description:
Dec 27 15:10:27 host2 sshd[2129092]: Disconnected from invalid user sol 200.118.150.20 port 43968 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.157.206.168
country_id: 3469034
description:
Dec 27 15:11:22 host2 sshd[2129746]: Disconnected from invalid user zimbra 177.157.206.168 port 40130 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 200.118.150.20
country_id: 3686110
description:
Dec 27 15:11:41 host2 sshd[2129978]: Disconnected from invalid user ghost 200.118.150.20 port 39774 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.157.206.168
country_id: 3469034
description:
Dec 27 15:12:48 host2 sshd[2130814]: Disconnected from invalid user ubuntu 177.157.206.168 port 40192 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.0.212.86
country_id: 3469034
description:
Dec 27 15:14:40 host2 sshd[2132415]: Disconnected from invalid user web 177.0.212.86 port 41083 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 177.157.206.168
country_id: 3469034
description:
Dec 27 15:14:52 host2 sshd[2132571]: Disconnected from invalid user game 177.157.206.168 port 54380 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.98.56.205
country_id: 6252001
description:
Dec 27 15:15:15 host2 sshd[2133034]: Disconnected from invalid user avahi 198.98.56.205 port 46312 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.92.57
country_id: 1168579
description:
2025-12-27 15:16:58 dovecot_login authenticator failed for H=(57.92.zcomnetworks.com.pk) [103.148.92.57]:42039: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.99.153.21
country_id: 1269750
description:
2025-12-27 15:16:32 dovecot_login authenticator failed for H=([59.99.153.21]) [59.99.153.21]:38904: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 198.98.56.205
country_id: 6252001
description:
Dec 27 15:17:52 host2 sshd[2135258]: Disconnected from invalid user elsearch 198.98.56.205 port 54216 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 198.98.56.205
country_id: 6252001
description:
Dec 27 15:18:50 host2 sshd[2136182]: Received disconnect from 198.98.56.205 port 40488:11: Bye Bye [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 158.94.210.79
country_id: 2750405
description:
[2025-12-27 15:19:05 +0530] info [whostmgrd] 158.94.210.79 - RE_Trinco "GET /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 93.113.63.124
country_id: 298795
description:
Dec 27 15:19:38 host2 sshd[2137142]: Disconnected from invalid user asw 93.113.63.124 port 59304 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.70.134
country_id: 1819730
description:
2025-12-27 15:21:07 dovecot_login authenticator failed for H=42-200-70-134.static.imsbiz.com [42.200.70.134]:54899: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 93.113.63.124
country_id: 298795
description:
Dec 27 15:20:16 host2 sshd[2137786]: Disconnected from invalid user avahi 93.113.63.124 port 57758 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 148.227.3.232
country_id: 3996063
description:
Dec 27 15:20:30 host2 sshd[2137989]: Disconnected from invalid user zimbra 148.227.3.232 port 49342 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.207.251.240
country_id: 290557
description:
2025-12-27 15:21:37 dovecot_login authenticator failed for H=([94.207.251.240]) [94.207.251.240]:47774: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.12.244
country_id: 3144096
description:
2025-12-27 15:21:52 dovecot_login authenticator failed for H=(cm-84.211.12.244.get.no) [84.211.12.244]:51116: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.237.188.150
country_id: 3469034
description:
Dec 27 15:21:52 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<chitral00@bostonlanka.com>, method=PLAIN, rip=186.237.188.150, lip=66.85.158.91, TLS, session=<S9GW9OtGhqe67byW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.146.18
country_id: 1269750
description:
2025-12-27 15:21:23 dovecot_login authenticator failed for H=([128.185.101.201]) [122.185.146.18]:41716: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 168.0.224.107
country_id: 3469034
description:
Dec 27 15:22:12 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<chitral00>, method=PLAIN, rip=168.0.224.107, lip=66.85.158.91, TLS, session=<Pcu99etGqJyoAOBr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 93.113.63.124
country_id: 298795
description:
Dec 27 15:22:15 host2 sshd[2139375]: Disconnected from invalid user deep 93.113.63.124 port 43380 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 148.227.3.232
country_id: 3996063
description:
Dec 27 15:25:54 host2 sshd[2142253]: Disconnected from invalid user ghost 148.227.3.232 port 54218 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.30.161.197
country_id: 690791
description:
2025-12-27 15:26:01 dovecot_login authenticator failed for H=(46.30.161.197.access.ipnet.ua) [46.30.161.197]:55409: 535 Incorrect authentication data (set_id=accounts@agronatureholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 41.139.17.117
country_id: 2300660
description:
Dec 27 15:25:12 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@simple-engineering.lk>, method=PLAIN, rip=41.139.17.117, lip=66.85.158.91, TLS, session=<BcVxAOxGXNUpixF1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.229.98.81
country_id: 2510769
description:
Dec 27 15:25:30 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=185.229.98.81, lip=66.85.158.91, TLS, session=<tZufAexG97i55WJR>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.206.51
country_id: 3144096
description:
2025-12-27 15:26:13 dovecot_login authenticator failed for H=(cm-178.232.206.51.get.no) [178.232.206.51]:60473: 535 Incorrect authentication data (set_id=accounts)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.102.188.117
country_id: 294640
description:
2025-12-27 15:28:26 dovecot_login authenticator failed for H=([82.102.188.117]) [82.102.188.117]:53676: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.61
country_id: 1733045
description:
2025-12-27 15:28:43 dovecot_login authenticator failed for H=([49.124.153.61]) [49.124.153.61]:35212: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.202.15.69
country_id: 6252001
description:
2025-12-27 15:29:19 dovecot_login authenticator failed for H=([12.202.15.69]) [12.202.15.69]:5152: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2025-12-27 15:29:32 dovecot_login authenticator failed for H=([102.53.15.56]) [102.53.15.56]:48207: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 143.198.161.12
country_id: 6252001
description:
Dec 27 15:29:47 host2 sshd[2145275]: Disconnected from invalid user avahi 143.198.161.12 port 50232 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.146.248.7
country_id: 1861060
description:
2025-12-27 15:30:26 dovecot_login authenticator failed for H=7.248.146.34.bc.googleusercontent.com [34.146.248.7]:49816: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.251.70
country_id: 1269750
description:
2025-12-27 15:30:39 dovecot_login authenticator failed for H=([125.17.70.25]) [125.20.251.70]:39636: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.20
country_id: 241170
description:
Dec 27 15:30:58 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.20, lip=66.85.158.91, session=<tMwOFuxG0pnE+2YU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.248.67
country_id: 1269750
description:
2025-12-27 15:34:53 dovecot_login authenticator failed for H=([122.187.248.67]) [122.187.248.67]:48490: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.57.184.151
country_id: 1269750
description:
2025-12-27 15:35:43 dovecot_login authenticator failed for H=([103.57.184.151]) [103.57.184.151]:41654: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 87.236.176.221
country_id: 2635167
description:
Dec 27 15:36:29 host2 pure-ftpd[2151954]: (?@87.236.176.221) [INFO] New connection from 87.236.176.221


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 27 15:42:08 host2 pure-ftpd[2157271]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.94.232.217
country_id: 241170
description:
Dec 27 15:45:09 host2 sshd[2160600]: Disconnected from invalid user oneadmin 154.94.232.217 port 52900 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.18.228.75
country_id: 3686110
description:
Dec 27 15:45:21 host2 sshd[2160819]: Disconnected from invalid user steamcmd 161.18.228.75 port 44118 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.69.236.207
country_id: 3865483
description:
Dec 27 15:45:56 host2 sshd[2161278]: Disconnected from invalid user test 200.69.236.207 port 46168 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.18.228.75
country_id: 3686110
description:
Dec 27 15:46:16 host2 sshd[2161786]: Disconnected from invalid user puppet 161.18.228.75 port 60632 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 161.18.228.75
country_id: 3686110
description:
Dec 27 15:46:56 host2 sshd[2162518]: Disconnected from invalid user track 161.18.228.75 port 46324 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.94.232.217
country_id: 241170
description:
Dec 27 15:47:24 host2 sshd[2162945]: Disconnected from invalid user web 154.94.232.217 port 59512 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.69.236.207
country_id: 3865483
description:
Dec 27 15:47:29 host2 sshd[2163013]: Disconnected from invalid user vasile 200.69.236.207 port 59036 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.18.228.75
country_id: 3686110
description:
Dec 27 15:47:36 host2 sshd[2163105]: Disconnected from invalid user apps 161.18.228.75 port 60234 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.18.228.75
country_id: 3686110
description:
Dec 27 15:48:14 host2 sshd[2163571]: Disconnected from invalid user arun 161.18.228.75 port 45918 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.94.232.217
country_id: 241170
description:
Dec 27 15:48:39 host2 sshd[2163833]: Disconnected from invalid user duser 154.94.232.217 port 55828 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.203.34.136
country_id: 6252001
description:
2025-12-27 15:49:25 dovecot_plain authenticator failed for H=c-98-203-34-136.hsd1.fl.comcast.net (sulfacte) [98.203.34.136]:42436: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.143
country_id: 6252001
description:
Dec 27 15:50:23 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 16 secs): user=<>, rip=66.132.153.143, lip=66.85.158.91, TLS handshaking: Connection closed, session=<UvqVW+xGdrpChJmP>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 59.97.205.137
country_id: 1269750
description:
Dec 27 15:50:44 host2 sshd[2165493]: Disconnected from invalid user git 59.97.205.137 port 7750 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 59.97.205.137
country_id: 1269750
description:
Dec 27 15:52:02 host2 sshd[2166553]: Disconnected from invalid user law 59.97.205.137 port 46478 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 59.97.205.137
country_id: 1269750
description:
Dec 27 15:51:23 host2 sshd[2166052]: Disconnected from invalid user bull 59.97.205.137 port 46053 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 59.97.205.137
country_id: 1269750
description:
Dec 27 15:52:47 host2 sshd[2167267]: Disconnected from invalid user python 59.97.205.137 port 34189 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.228
country_id: 1269750
description:
2025-12-27 15:53:45 dovecot_login authenticator failed for H=(nsg-corporate-228.228.187.122.airtel.in) [122.187.228.228]:38704: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2025-12-27 15:54:25 dovecot_login authenticator failed for H=(host-64-72-74-162.lightower.net) [64.72.74.162]:57863: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.70.134
country_id: 1819730
description:
2025-12-27 15:56:35 dovecot_login authenticator failed for H=42-200-70-134.static.imsbiz.com [42.200.70.134]:35161: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 66.240.219.146
country_id: 6252001
description:
Dec 27 15:56:43 host2 dovecot[1881837]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=66.240.219.146, lip=66.85.158.91, TLS, session=<htY+cuxGrI5C8NuS>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.240.219.146
country_id: 6252001
description:
Dec 27 15:56:43 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record (no auth attempts in 0 secs): user=<>, rip=66.240.219.146, lip=66.85.158.91, TLS: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record, session=<2HlCcuxG/o5C8NuS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.255.201.157
country_id: 2413451
description:
2025-12-27 15:57:06 dovecot_login authenticator failed for H=([197.255.201.157]) [197.255.201.157]:33720: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.238.213.180
country_id: 2661886
description:
2025-12-27 15:56:11 dovecot_login authenticator failed for H=h85-238-213-180.cust.bredband2.com [85.238.213.180]:52462: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.19
country_id: 241170
description:
Dec 27 15:57:14 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.19, lip=66.85.158.91, session=<t+b9c+xGwt7E+2YT>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.222.54
country_id: 1269750
description:
2025-12-27 15:58:12 dovecot_login authenticator failed for H=([122.187.222.54]) [122.187.222.54]:47536: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.158.205.225
country_id: 1861060
description:
2025-12-27 16:00:52 dovecot_login authenticator failed for H=kd113158205225.ppp-bb.dion.ne.jp [113.158.205.225]:48294: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2025-12-27 16:01:14 dovecot_login authenticator failed for H=([197.219.228.242]) [197.219.228.242]:48578: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 27 16:02:22 host2 sshd[2177106]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.7.187.207
country_id: 3469034
description:
Dec 27 16:03:12 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<chitral00@bostonlanka.com>, method=PLAIN, rip=45.7.187.207, lip=66.85.158.91, TLS, session=<78tmiOxGrYctB7vP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.44.140.160
country_id: 690791
description:
Dec 27 16:03:31 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<chitral00>, method=PLAIN, rip=194.44.140.160, lip=66.85.158.91, TLS, session=<fbmKiexGe8zCLIyg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.64.93.161
country_id: 2077456
description:
2025-12-27 16:04:50 dovecot_login authenticator failed for H=115-64-93-161.tpgi.com.au [115.64.93.161]:49217: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.126.40.196
country_id: 2510769
description:
2025-12-27 16:05:13 dovecot_login authenticator failed for H=(cli-5b7e28c4.wholesale.adamo.es) [91.126.40.196]:60150: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.59
country_id: 6252001
description:
Dec 27 16:12:02 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=167.94.146.59, lip=66.85.158.92, TLS: Connection closed, session=<lmAIqexGYp+nXpI7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.0.11.106
country_id: 226074
description:
Dec 27 16:16:31 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=196.0.11.106, lip=66.85.158.91, TLS, session=<KOPxt+xGjYHEAAtq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.37.181.181
country_id: 1831722
description:
2025-12-27 16:17:04 dovecot_login authenticator failed for H=([36.37.181.181]) [36.37.181.181]:39728: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 177.44.71.228
country_id: 3469034
description:
Dec 27 16:16:10 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@simple-engineering.lk>, method=PLAIN, rip=177.44.71.228, lip=66.85.158.91, TLS, session=<Ow+gtuxGnqexLEfk>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.146.18
country_id: 1269750
description:
2025-12-27 16:17:18 dovecot_login authenticator failed for H=([128.185.101.201]) [122.185.146.18]:53872: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.255.201.157
country_id: 2413451
description:
2025-12-27 16:22:35 dovecot_login authenticator failed for H=([197.255.201.157]) [197.255.201.157]:55252: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.222
country_id: 1819730
description:
2025-12-27 16:23:10 dovecot_login authenticator failed for H=222.42.246.220.static.netvigator.com [220.246.42.222]:55383: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 27 16:28:37 host2 sshd[2200011]: Disconnected from invalid user  62.60.131.157 port 39755 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 27 16:30:22 host2 sshd[2201836]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.27
country_id: 3144096
description:
2025-12-27 16:38:12 dovecot_login authenticator failed for H=(cm-84.213.189.27.get.no) [84.213.189.27]:56887: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.162.77
country_id: 2186224
description:
2025-12-27 16:38:27 dovecot_login authenticator failed for H=([121.73.162.77]) [121.73.162.77]:49572: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.50.144.234
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 104.50.144.234 - tradece "GET /login/?login_only=1&user=tradece&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.97.41.145
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 68.97.41.145 - tr "GET /login/?login_only=1&user=tr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.39.223.164
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [whostmgrd] 64.39.223.164 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 143.105.119.246
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 143.105.119.246 - tradeceyloncom "GET /login/?login_only=1&user=tradeceyloncom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradeceyloncom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.67.131.25
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 64.67.131.25 - tra "GET /login/?login_only=1&user=tra&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tra (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.52.159.200
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 174.52.159.200 - tradeceylon "GET /login/?login_only=1&user=tradeceylon&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.48.186.170
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 72.48.186.170 - tradecey "GET /login/?login_only=1&user=tradecey&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradecey (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.218.27.185
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 97.218.27.185 - tradec "GET /login/?login_only=1&user=tradec&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradec (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.71.42.161
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 73.71.42.161 - trade "GET /login/?login_only=1&user=trade&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user trade (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.71.166.213
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 73.71.166.213 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.89.43.202
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 75.89.43.202 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.221.219.204
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 107.221.219.204 - trad "GET /login/?login_only=1&user=trad&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user trad (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.242.244.194
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 69.242.244.194 - tradece1 "GET /login/?login_only=1&user=tradece1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.51.41.164
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 98.51.41.164 - tradece2 "GET /login/?login_only=1&user=tradece2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece2 (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 27 16:41:14 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, TLS handshaking: Connection closed, session=<xKhyEe1GEIMDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 27 16:42:45 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<kgLnFu1G/JMDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 27 16:44:22 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (disconnected before auth was ready, waited 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<AX6tHO1GGLYDiUnd>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 27 16:44:50 host2 pure-ftpd[2215401]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 27 16:45:42 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, TLS, session=<hb9rIe1GoqADiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 27 16:46:13 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, TLS handshaking: Connection closed, session=<XspQI+1GbKwDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 27 16:47:32 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<w90AKO1GCJwDiUnd>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.138
country_id: 6252001
description:
Dec 27 16:48:51 host2 pure-ftpd[2218387]: (?@66.132.153.138) [INFO] New connection from 66.132.153.138


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 27 16:49:10 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, TLS, session=<u7DQLe1GKN4DiUnd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.223.91.130
country_id: 6252001
description:
Dec 27 16:50:12 host2 sshd[2219353]: Disconnected from invalid user karen 162.223.91.130 port 57968 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.223.91.130
country_id: 6252001
description:
Dec 27 16:52:40 host2 sshd[2220974]: Disconnected from invalid user deploy 162.223.91.130 port 42164 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 191.185.168.78
country_id: 3469034
description:
Dec 27 16:52:10 host2 sshd[2220629]: Disconnected from invalid user dev 191.185.168.78 port 45544 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.216.63.127
country_id: 1835841
description:
Dec 27 16:52:38 host2 sshd[2220944]: Disconnected from invalid user admin 35.216.63.127 port 40404 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 162.223.91.130
country_id: 6252001
description:
Dec 27 16:53:12 host2 sshd[2221735]: Disconnected from invalid user ubuntu 162.223.91.130 port 53652 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 191.185.168.78
country_id: 3469034
description:
Dec 27 16:53:40 host2 sshd[2222467]: Disconnected from invalid user admin 191.185.168.78 port 45080 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.210.215.132
country_id: 3144096
description:
2025-12-27 16:54:11 dovecot_login authenticator failed for H=(cm-84.210.215.132.get.no) [84.210.215.132]:34162: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.51.218.16
country_id: 2510769
description:
2025-12-27 16:54:24 dovecot_login authenticator failed for H=16.red-83-51-218.dynamicip.rima-tde.net [83.51.218.16]:43964: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.223.91.130
country_id: 6252001
description:
Dec 27 16:54:39 host2 sshd[2223739]: Disconnected from invalid user admin 162.223.91.130 port 60204 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 191.185.168.78
country_id: 3469034
description:
Dec 27 16:56:45 host2 sshd[2225397]: Disconnected from invalid user ubuntu 191.185.168.78 port 44158 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.216.63.127
country_id: 1835841
description:
Dec 27 16:56:48 host2 sshd[2225444]: Disconnected from invalid user rede 35.216.63.127 port 58564 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.196.11.232
country_id: 2658434
description:
Dec 27 16:58:30 host2 sshd[2226847]: Disconnected from invalid user username 185.196.11.232 port 44842 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.216.63.127
country_id: 1835841
description:
Dec 27 16:59:26 host2 sshd[2227763]: Disconnected from invalid user rocky 35.216.63.127 port 27964 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.51
country_id: 1733045
description:
2025-12-27 16:59:43 dovecot_login authenticator failed for H=([49.124.151.51]) [49.124.151.51]:35430: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.127.90.34
country_id: 2440476
description:
2025-12-27 16:59:56 dovecot_login authenticator failed for H=([154.127.90.34]) [154.127.90.34]:59460: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 4.194.4.255
country_id: 1880251
description:
Dec 27 17:01:18 host2 sshd[2229457]: Disconnected from invalid user acs 4.194.4.255 port 44490 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.60.126
country_id: 1269750
description:
2025-12-27 17:04:03 dovecot_login authenticator failed for H=([182.79.136.105]) [122.187.60.126]:49338: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 4.194.4.255
country_id: 1880251
description:
Dec 27 17:04:07 host2 sshd[2232072]: Disconnected from invalid user bodega 4.194.4.255 port 51840 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.54.10
country_id: 1269750
description:
2025-12-27 17:03:46 dovecot_login authenticator failed for H=([128.185.241.106]) [182.95.54.10]:48620: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 134.209.102.173
country_id: 1880251
description:
2025-12-27 17:04:29 dovecot_login authenticator failed for H=([134.209.102.173]) [134.209.102.173]:59876: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 110.78.149.220
country_id: 1605651
description:
Dec 27 17:09:47 host2 sshd[2237411]: Disconnected from invalid user admin 110.78.149.220 port 48602 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.255.200.204
country_id: 2413451
description:
2025-12-27 17:11:54 dovecot_login authenticator failed for H=([197.255.200.204]) [197.255.200.204]:52048: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.44.137.178
country_id: 798549
description:
2025-12-27 17:11:33 dovecot_login authenticator failed for H=([89.44.137.178]) [89.44.137.178]:40594: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 110.78.149.220
country_id: 1605651
description:
Dec 27 17:11:37 host2 sshd[2239344]: Disconnected from invalid user git 110.78.149.220 port 60902 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 110.78.149.220
country_id: 1605651
description:
Dec 27 17:13:18 host2 sshd[2240978]: Received disconnect from 110.78.149.220 port 43342:11: Bye Bye [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 197.227.8.186
country_id: 934292
description:
Dec 27 17:19:25 host2 sshd[2246841]: Disconnected from invalid user control 197.227.8.186 port 57097 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 49.228.88.69
country_id: 1605651
description:
Dec 27 17:21:10 host2 sshd[2248637]: Disconnected from invalid user es 49.228.88.69 port 34988 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.98.176.164
country_id: 1643084
description:
Dec 27 17:21:22 host2 sshd[2248817]: Disconnected from invalid user deluge 103.98.176.164 port 34292 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.188.204.213
country_id: 6252001
description:
2025-12-27 17:22:11 dovecot_login authenticator failed for H=(c-50-188-204-213.unallocated.comcastbusiness.net) [50.188.204.213]:37663: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.152.99.244
country_id: 6252001
description:
2025-12-27 17:22:24 dovecot_login authenticator failed for H=(syn-184-152-099-244.res.spectrum.com) [184.152.99.244]:48424: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.98.176.164
country_id: 1643084
description:
Dec 27 17:22:38 host2 sshd[2250137]: Disconnected from invalid user yann 103.98.176.164 port 43174 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.87.21.241
country_id: 953987
description:
Dec 27 17:23:07 host2 sshd[2250594]: Disconnected from invalid user es 20.87.21.241 port 53280 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.98.176.164
country_id: 1643084
description:
Dec 27 17:23:18 host2 sshd[2250778]: Disconnected from invalid user ftpuser1 103.98.176.164 port 46034 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 104.248.245.89
country_id: 2921044
description:
Dec 27 17:23:47 host2 sshd[2251134]: Received disconnect from 104.248.245.89 port 57136:11: Bye Bye [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.248.4.85
country_id: 1269750
description:
2025-12-27 17:27:15 dovecot_login authenticator failed for H=([115.248.4.85]) [115.248.4.85]:50805: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.87.21.241
country_id: 953987
description:
Dec 27 17:27:55 host2 sshd[2254845]: Disconnected from invalid user administrator 20.87.21.241 port 35244 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.51.26.198
country_id: 1269750
description:
2025-12-27 17:28:04 dovecot_login authenticator failed for H=(103.51.26.198.sukaininfoway.com) [103.51.26.198]:51472: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 27 17:28:12 host2 sshd[2255116]: Disconnected from invalid user marian 62.60.131.157 port 42650 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 20.87.21.241
country_id: 953987
description:
Dec 27 17:28:44 host2 sshd[2255678]: Disconnected from invalid user user 20.87.21.241 port 43618 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 104.248.245.89
country_id: 2921044
description:
Dec 27 17:28:46 host2 sshd[2255728]: Received disconnect from 104.248.245.89 port 56910:11: Bye Bye [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-27 17:30:39 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:57174: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.4.106.201
country_id: 1210997
description:
Dec 27 17:30:07 host2 sshd[2256995]: Disconnected from invalid user user 202.4.106.201 port 48172 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.248.245.89
country_id: 2921044
description:
Dec 27 17:30:18 host2 sshd[2257218]: Disconnected from invalid user userftp 104.248.245.89 port 52732 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.87.21.241
country_id: 953987
description:
Dec 27 17:31:09 host2 sshd[2257935]: Disconnected from invalid user steam 20.87.21.241 port 40600 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.228.160
country_id: 149590
description:
2025-12-27 17:31:33 dovecot_login authenticator failed for H=(160.228-59-41.static-zone.ttcldata.net) [41.59.228.160]:34290: 535 Incorrect authentication data (set_id=hnt@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.139.168.236
country_id: 2510769
description:
2025-12-27 17:31:44 dovecot_login authenticator failed for H=236.red-2-139-168.staticip.rima-tde.net [2.139.168.236]:43916: 535 Incorrect authentication data (set_id=hnt)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 202.4.106.201
country_id: 1210997
description:
Dec 27 17:32:14 host2 sshd[2258870]: Disconnected from invalid user service 202.4.106.201 port 55068 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.76.55.10
country_id: 1819730
description:
Dec 27 17:34:04 host2 sshd[2260509]: Disconnected from invalid user alice 47.76.55.10 port 39718 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.4.106.201
country_id: 1210997
description:
Dec 27 17:37:04 host2 sshd[2263464]: Disconnected from invalid user mehrdad 202.4.106.201 port 52338 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 142.93.27.16
country_id: 6252001
description:
Dec 27 17:37:11 host2 sshd[2263596]: Disconnected from invalid user user 142.93.27.16 port 58654 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.47.51.24
country_id: 1880251
description:
Dec 27 17:37:16 host2 sshd[2263635]: Disconnected from invalid user gustavo 101.47.51.24 port 57818 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.75.215.245
country_id: 1269750
description:
2025-12-27 17:37:32 dovecot_login authenticator failed for H=([182.75.215.245]) [182.75.215.245]:59464: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.228
country_id: 1269750
description:
2025-12-27 17:37:57 dovecot_login authenticator failed for H=(nsg-corporate-228.228.187.122.airtel.in) [122.187.228.228]:35545: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 144.48.243.18
country_id: 1819730
description:
Dec 27 17:37:20 host2 sshd[2263732]: Disconnected from invalid user es 144.48.243.18 port 52606 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 142.93.27.16
country_id: 6252001
description:
Dec 27 17:38:52 host2 sshd[2265131]: Disconnected from invalid user postgres 142.93.27.16 port 40154 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 144.48.243.18
country_id: 1819730
description:
Dec 27 17:41:33 host2 sshd[2267174]: Disconnected from invalid user k 144.48.243.18 port 35060 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 219.92.8.45
country_id: 1733045
description:
Dec 27 17:41:47 host2 sshd[2267337]: Disconnected from invalid user test 219.92.8.45 port 40234 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 139.59.66.39
country_id: 1269750
description:
Dec 27 17:41:48 host2 sshd[2267361]: Disconnected from invalid user deploy 139.59.66.39 port 55324 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.23.125.83
country_id: 6252001
description:
2025-12-27 17:44:40 dovecot_plain authenticator failed for H=c-24-23-125-83.hsd1.pa.comcast.net (trapormis) [24.23.125.83]:46320: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.82.141.145
country_id: 6252001
description:
2025-12-27 17:44:43 dovecot_plain authenticator failed for H=c-68-82-141-145.hsd1.pa.comcast.net (rable) [68.82.141.145]:34640: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 27 17:47:23 host2 sshd[2272016]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.117.8.21
country_id: 3865483
description:
Dec 27 17:47:45 host2 sshd[2272194]: Invalid user httpssmtp.zoho.com587hr@lezzarotech.com from 181.117.8.21 port 56659


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 181.117.8.21
country_id: 3865483
description:
Dec 27 17:47:51 host2 pure-ftpd[2272195]: (?@181.117.8.21) [WARNING] Authentication failed for user [httpssmtp.zoho.com587hr@lezzarotech.com]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 181.117.8.21
country_id: 3865483
description:
Dec 27 17:47:53 host2 sshd[2272334]: Invalid user httpssmtp.zoho.com587hr from 181.117.8.21 port 57034


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 27 17:47:18 host2 pure-ftpd[2271972]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 27 17:57:14 host2 sshd[2280724]: Disconnected from invalid user  62.60.131.157 port 7771 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 177.221.101.47
country_id: 3469034
description:
Dec 27 17:58:10 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@simple-engineering.lk>, method=PLAIN, rip=177.221.101.47, lip=66.85.158.91, TLS, session=<3R98I+5GzJCx3WUv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.48.181.58
country_id: 719819
description:
Dec 27 17:58:41 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=178.48.181.58, lip=66.85.158.91, TLS, session=<5/5HJe5GxuKyMLU6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.137.11.10
country_id: 1269750
description:
Dec 27 18:05:21 host2 sshd[2287235]: Disconnected from invalid user wangtao 38.137.11.10 port 41784 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.242.226.33
country_id: 6252001
description:
Dec 27 18:05:27 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=185.242.226.33, lip=66.85.158.92, TLS, session=<HJKqPu5GZtW58uIh>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 72.240.125.133
country_id: 6252001
description:
Dec 27 18:05:57 host2 sshd[2287699]: Disconnected from invalid user sabine 72.240.125.133 port 41654 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 38.137.11.10
country_id: 1269750
description:
Dec 27 18:06:51 host2 sshd[2288371]: Disconnected from invalid user anon 38.137.11.10 port 24742 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.227
country_id: 1269750
description:
2025-12-27 18:06:41 dovecot_login authenticator failed for H=([122.187.230.227]) [122.187.230.227]:52304: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2025-12-27 18:07:10 dovecot_login authenticator failed for H=([102.53.15.18]) [102.53.15.18]:38108: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 72.240.125.133
country_id: 6252001
description:
Dec 27 18:07:13 host2 sshd[2288648]: Disconnected from invalid user administrator 72.240.125.133 port 38524 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.137.11.10
country_id: 1269750
description:
Dec 27 18:07:31 host2 sshd[2288961]: Disconnected from invalid user steve 38.137.11.10 port 8017 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 72.240.125.133
country_id: 6252001
description:
Dec 27 18:08:17 host2 sshd[2289623]: Disconnected from invalid user mis 72.240.125.133 port 33950 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 27 18:09:03 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<ypRfS+5G9oEzTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 27 18:12:05 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@venee.lk>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<fl85Vu5GHqenrKy4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 27 18:12:28 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<GJegV+5GytguZXpm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 27 18:13:14 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<IQpeWu5GGqekXF7M>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.191.124.201
country_id: 1269750
description:
2025-12-27 18:14:05 dovecot_login authenticator failed for H=([160.191.124.201]) [160.191.124.201]:48215: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.51.135
country_id: 3144096
description:
2025-12-27 18:14:24 dovecot_login authenticator failed for H=(cm-178.232.51.135.get.no) [178.232.51.135]:38710: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.88.199
country_id: 1861060
description:
Dec 27 18:14:59 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<postfix@sivagnanamfoundation.com>, method=PLAIN, rip=47.79.88.199, lip=66.85.158.91, session=<KJaUYO5G1KovT1jH>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 27 18:15:34 host2 sshd[2296235]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 185.164.80.22
country_id: 617790
description:
Dec 27 18:17:43 host2 sshd[2297845]: Disconnecting authenticating user root 185.164.80.22 port 35696: Too many authentication failures [preauth]


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 185.164.80.22
country_id: 617790
description:
Dec 27 18:17:43 host2 sshd[2297845]: error: maximum authentication attempts exceeded for root from 185.164.80.22 port 35696 ssh2 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.164.80.22
country_id: 617790
description:
Dec 27 18:18:02 host2 sshd[2298211]: Disconnecting invalid user admin 185.164.80.22 port 58054: Too many authentication failures [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 27 18:18:37 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<webmaster@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<MHmVbe5GBsgyBsPO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.154.84.190
country_id: 2287781
description:
2025-12-27 18:19:42 dovecot_login authenticator failed for H=([160.154.84.190]) [160.154.84.190]:21257: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 27 18:19:46 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<gb66ce5GCIkv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 27 18:19:59 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<fat9cu5G8MZo7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.225.217.145
country_id: 3469034
description:
Dec 27 18:19:57 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<chitral00@bostonlanka.com>, method=PLAIN, rip=186.225.217.145, lip=66.85.158.91, TLS, session=<6jZ7ce5GgoS64dmR>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.68.226.171
country_id: 3017382
description:
2025-12-27 18:20:05 dovecot_login authenticator failed for H=vps-b674cd8d.vps.ovh.net [51.68.226.171]:36558: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.234.135.110
country_id: 2635167
description:
Dec 27 18:20:10 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=85.234.135.110, lip=66.85.158.91, session=<0mYhc+5GLKxV6odu>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.171.164
country_id: 3175395
description:
Dec 27 18:20:15 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<chitral00>, method=PLAIN, rip=185.15.171.164, lip=66.85.158.91, TLS, session=<tLSdcu5GAYe5D6uk>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 27 18:21:19 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<3BE5d+5GOjOi8Jp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 27 18:23:00 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<I0dMfe5GGl9100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.69.124
country_id: 1880251
description:
Dec 27 18:23:07 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@sobaherbal.com>, method=PLAIN, rip=167.172.69.124, lip=66.85.158.91, session=<K22xfe5GsoSnrEV8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 27 18:23:37 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<eeJ7f+5GXM6i8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 27 18:24:38 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<VjMog+5GqIsjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 27 18:24:45 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<EOqOg+5G6tKnrKy4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.227
country_id: 1819730
description:
2025-12-27 18:24:19 dovecot_login authenticator failed for H=227.42.246.220.static.netvigator.com [220.246.42.227]:59352: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.72.41
country_id: 6252001
description:
Dec 27 18:25:08 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@kiriaswanu.com>, method=PLAIN, rip=132.148.72.41, lip=66.85.158.91, session=<AQXshO5G4NWElEgp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 27 18:25:38 host2 sshd[2305523]: Disconnected from invalid user  62.60.131.157 port 63328 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.130.133
country_id: 6252001
description:
Dec 27 18:25:45 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@seyawin.com>, method=PLAIN, rip=64.23.130.133, lip=66.85.158.91, session=<hdUPh+5GdoNAF4KF>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.242.226.33
country_id: 6252001
description:
Dec 27 18:28:04 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=185.242.226.33, lip=66.85.158.91, TLS, session=<oDCCj+5GSNO58uIh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec 27 18:28:45 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@rehanseo.online>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<8uTZke5GcuYv/lVz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
country_id: 3144096
description:
2025-12-27 18:29:39 dovecot_login authenticator failed for H=([85.19.195.12]) [85.19.195.12]:37984: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.220.147
country_id: 3144096
description:
2025-12-27 18:29:56 dovecot_login authenticator failed for H=(cm-178.232.220.147.get.no) [178.232.220.147]:36759: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.25.223.210
country_id: 798544
description:
2025-12-27 18:31:47 dovecot_plain authenticator failed for H=host-89.25.223.210.static.3s.pl (noctie) [89.25.223.210]:57590: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.208.81.125
country_id: 6252001
description:
2025-12-27 18:31:51 dovecot_plain authenticator failed for H=c-73-208-81-125.hsd1.in.comcast.net (blecitted) [73.208.81.125]:41254: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 27 18:32:08 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<fdjyne5GOK8zTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.151.137.207
country_id: 130758
description:
Dec 27 18:36:07 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@sobaherbal.com>, method=PLAIN, rip=193.151.137.207, lip=66.85.158.91, session=<vxwqrO5G0pLBl4nP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Dec 27 18:36:53 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@rehanseo.online>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=</Xbzru5GQsql6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 27 18:38:04 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@nsteeleng.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<yzEps+5GPuYv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.216.211.84
country_id: 933860
description:
Dec 27 18:37:34 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<chitral00@bostonlanka.com>, method=PLAIN, rip=41.216.211.84, lip=66.85.158.91, TLS, session=<lkRDsO5Gd6Ip2NNU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 169.239.118.217
country_id: 2215636
description:
Dec 27 18:37:53 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<chitral00>, method=PLAIN, rip=169.239.118.217, lip=66.85.158.91, TLS, session=<du6Yse5Gmtap73bZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 27 18:37:55 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<LE+fsu5GStEv7PP+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 57.151.98.114
country_id: 6252001
description:
Dec 27 18:39:43 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=57.151.98.114, lip=66.85.158.91, session=<jbQ0ue5GMKA5l2Jy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 27 18:41:02 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<bOfDve5G8E4jupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 27 18:41:00 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<W+epve5GDChniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Dec 27 18:41:44 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<3MdLwO5GbIkFhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 27 18:42:29 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@ceylondigest.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<t+bywu5GUOTD+hnW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.132.127.172
country_id: 2750405
description:
Dec 27 18:43:49 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=5.132.127.172, lip=66.85.158.91, session=<s/HBx+5GBrkFhH+s>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 152.32.134.45
country_id: 1819730
description:
Dec 27 18:43:55 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=152.32.134.45, lip=66.85.158.92, TLS handshaking: Connection closed, session=<hD89yO5GcDWYIIYt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Dec 27 18:44:15 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@dataesite.lk>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<NVVHye5Gau1A44h6>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.242.226.17
country_id: 6252001
description:
Dec 27 18:47:19 host2 dovecot[1881837]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=185.242.226.17, lip=66.85.158.91, session=<XJBh1O5GANq58uIR>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 27 18:47:28 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<YhbM1O5G4tkv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Dec 27 18:48:42 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@lankaherbalsolutions.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<cckr2e5GtM9A44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 27 18:49:08 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<oHG+2u5GLr4v/AU1>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 27 18:50:12 host2 pure-ftpd[2328518]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 197.234.202.52
country_id: 953987
description:
Dec 27 18:50:36 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@simple-engineering.lk>, method=PLAIN, rip=197.234.202.52, lip=66.85.158.91, TLS, session=<TADP3u5GpsHF6so0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 77.65.142.78
country_id: 798544
description:
Dec 27 18:50:53 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=77.65.142.78, lip=66.85.158.91, TLS, session=<y4Ym4O5GghJNQY5O>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.242.226.17
country_id: 6252001
description:
Dec 27 18:51:14 host2 dovecot[1881837]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=185.242.226.17, lip=66.85.158.92, session=<PARd4u5G3py58uIR>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.248.67
country_id: 1269750
description:
2025-12-27 18:51:44 dovecot_login authenticator failed for H=([122.187.248.67]) [122.187.248.67]:40700: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 27 18:51:55 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<iLeu5O5G8sIvWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 27 18:52:02 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<sd8g5e5Gdohnmud6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.119.144.86
country_id: 6252001
description:
2025-12-27 18:52:29 dovecot_login authenticator failed for H=24-119-144-86.cpe.sparklight.net [24.119.144.86]:49140: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.52.114
country_id: 1269750
description:
2025-12-27 18:52:45 dovecot_login authenticator failed for H=([122.187.223.255]) [182.79.52.114]:33540: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Dec 27 18:53:22 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sobaherbal.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<2yfo6e5G2OKnYwhf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 115.85.80.12
country_id: 1643084
description:
Dec 27 18:56:29 host2 sshd[2334953]: Disconnected from invalid user rapid 115.85.80.12 port 34454 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 115.85.80.12
country_id: 1643084
description:
Dec 27 18:57:16 host2 sshd[2335603]: Disconnected from invalid user blog 115.85.80.12 port 59906 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.49.129.67
country_id: 3175395
description:
Dec 27 18:58:10 host2 sshd[2336362]: Disconnected from invalid user alfresco 151.49.129.67 port 50820 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 151.49.129.67
country_id: 3175395
description:
Dec 27 18:59:15 host2 sshd[2337607]: Disconnected from invalid user john 151.49.129.67 port 57708 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.41.137
country_id: 337996
description:
2025-12-27 18:59:29 dovecot_login authenticator failed for H=([196.190.43.138]) [196.190.41.137]:43357: 535 Incorrect authentication data (set_id=prasanka)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.171.8.191
country_id: 6252001
description:
Dec 27 18:59:11 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.171.8.191, lip=66.85.158.92, session=<KmjU/u5GwMYUqwi/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.249.76.221
country_id: 1269750
description:
2025-12-27 18:59:12 dovecot_login authenticator failed for H=(static-221.76.249.49-tataidc.co.in) [49.249.76.221]:56104: 535 Incorrect authentication data (set_id=prasanka@agronatureholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 27 18:59:12 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<hr@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<o+il/u5GyIAzTcpt>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.233.110
country_id: 99237
description:
2025-12-27 19:00:48 dovecot_plain authenticator failed for H=(proff) [65.20.233.110]:36804: 535 Incorrect authentication data (set_id=it@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 27 19:02:26 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@venee.lk>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<r1tRCu9GjtSnrKy4>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 157.245.122.12
country_id: 6252001
description:
Dec 27 19:02:29 host2 pure-ftpd[2341132]: (?@157.245.122.12) [INFO] New connection from 157.245.122.12


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Dec 27 19:02:37 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ceylondigest.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<RYb2Cu9GrukI04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 27 19:03:10 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<PP3yDO9G3uUuZXpm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 27 19:05:31 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<LyBWFe9G3tmkXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 97.74.84.186
country_id: 1880251
description:
Dec 27 19:06:41 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ceylondigest.com>, method=PLAIN, rip=97.74.84.186, lip=66.85.158.91, session=<8TOBGe9G4L5hSlS6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.212.178
country_id: 732800
description:
2025-12-27 19:09:16 dovecot_login authenticator failed for H=([185.255.212.178]) [185.255.212.178]:1036: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 27 19:09:28 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<udZ3I+9G7rgyBsPO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 27 19:11:27 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<dgKPKu9G9LRo7MS0>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 213.6.203.226
country_id: 6254930
description:
Dec 27 19:13:50 host2 sshd[2353636]: Disconnected from invalid user cristian 213.6.203.226 port 33443 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.231.112.22
country_id: 3017382
description:
2025-12-27 19:13:46 dovecot_login authenticator failed for H=([188.231.112.22]) [188.231.112.22]:58084: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.47.46.174
country_id: 1522867
description:
2025-12-27 19:14:09 dovecot_login authenticator failed for H=([92.47.46.174]) [92.47.46.174]:60216: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.72.176.66
country_id: 2542007
description:
2025-12-27 19:14:22 dovecot_plain authenticator failed for H=(nonlitid) [105.72.176.66]:40086: 535 Incorrect authentication data (set_id=it@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 27 19:14:24 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<7XoeNe9GQMmi8Jp9>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 213.6.203.226
country_id: 6254930
description:
Dec 27 19:14:27 host2 sshd[2354264]: Disconnected from invalid user lukas 213.6.203.226 port 50140 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.234.135.110
country_id: 2635167
description:
Dec 27 19:14:29 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=85.234.135.110, lip=66.85.158.91, session=<wRViNe9GuNBV6odu>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.72.41
country_id: 6252001
description:
Dec 27 19:15:57 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@kiriaswanu.com>, method=PLAIN, rip=132.148.72.41, lip=66.85.158.91, session=</mGoOu9GeMuElEgp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.69.124
country_id: 1880251
description:
Dec 27 19:16:01 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@sobaherbal.com>, method=PLAIN, rip=167.172.69.124, lip=66.85.158.91, session=<tczoOu9GnMenrEV8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 27 19:15:13 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<8/ADOO9GMO6i8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 27 19:15:44 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<Oi/jOe9GqLanrKy4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 27 19:16:47 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<IIecPe9Gen8jupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 27 19:18:43 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<6D6NRO9G4dt100Db>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 80.82.77.202
country_id: 2750405
description:
Dec 27 19:18:26 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=80.82.77.202, lip=66.85.158.91, session=<w8OnQ+9GYOpQUk3K>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec 27 19:21:00 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@rehanseo.online>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<Y7+6TO9G+pAv/lVz>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 27 19:21:58 host2 sshd[2362021]: Disconnected from invalid user  62.60.131.157 port 44659 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 27 19:23:04 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<CBQfVO9GpJ0zTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 201.190.12.98
country_id: 3608932
description:
Dec 27 19:28:24 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@seyawin.com>, method=PLAIN, rip=201.190.12.98, lip=66.85.158.91, session=<sFkvZ+9GlMTJvgxi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 27 19:30:28 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@nsteeleng.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<f+uNbu9GisUv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Dec 27 19:30:53 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@rehanseo.online>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<5qsTcO9GTJSl6LP6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.27.253.6
country_id: 1168579
description:
2025-12-27 19:31:09 dovecot_login authenticator failed for H=(58-27-253-6.wateen.net) [58.27.253.6]:9106: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 27 19:31:38 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@melanifinefood.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<uknCcu9GaMIv7PP+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.60.146
country_id: 1269750
description:
2025-12-27 19:32:05 dovecot_login authenticator failed for H=([182.95.25.99]) [182.95.60.146]:40458: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 27 19:32:54 host2 sshd[2372470]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 27 19:33:12 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<EdVaeO9GvlgjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.151.137.207
country_id: 130758
description:
Dec 27 19:34:26 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sobaherbal.com>, method=PLAIN, rip=193.151.137.207, lip=66.85.158.91, session=<e3bBfO9GhN3Bl4nP>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.60
country_id: 6252001
description:
Dec 27 19:34:51 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=167.94.146.60, lip=66.85.158.91, TLS: Connection closed, session=<r3Fhfu9GekKnXpI8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Dec 27 19:34:21 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<mNxwfO9GWugFhXlo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.121
country_id: 6252001
description:
Dec 27 19:35:31 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 15 secs): user=<>, rip=66.132.153.121, lip=66.85.158.91, TLS handshaking: Connection closed, session=<jX3BgO9GgItChJl5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 27 19:36:21 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<QPWdg+9GeA5niu0S>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 163.44.173.168
country_id: 1861060
description:
Dec 27 19:37:08 host2 sshd[2375881]: Disconnected from invalid user mc 163.44.173.168 port 36378 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Dec 27 19:37:30 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<mGHAh+9G1IhA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 27 19:38:56 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<ryHajO9G/uQv/AU1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.118.99.170
country_id: 3686110
description:
Dec 27 19:39:21 host2 sshd[2377582]: Disconnected from invalid user mam 200.118.99.170 port 51464 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.59.86.232
country_id: 149590
description:
Dec 27 19:39:22 host2 sshd[2377588]: Disconnected from invalid user ict 41.59.86.232 port 37968 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 27 19:41:07 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@ceylondigest.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<46iklO9GhIfD+hnW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 27 19:40:36 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<cOPOku9GWtsv/AU1>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 163.44.173.168
country_id: 1861060
description:
Dec 27 19:41:24 host2 sshd[2379402]: Disconnected from invalid user mam 163.44.173.168 port 49264 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Dec 27 19:41:58 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<ARq2l+9GsMhA44h6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.200.231.148
country_id: 1269750
description:
2025-12-27 19:42:11 dovecot_login authenticator failed for H=([117.200.231.148]) [117.200.231.148]:42095: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.218.95.154
country_id: 6252001
description:
2025-12-27 19:42:24 dovecot_login authenticator failed for H=syn-074-218-095-154.biz.spectrum.com [74.218.95.154]:57896: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.59.86.232
country_id: 149590
description:
Dec 27 19:42:50 host2 sshd[2380396]: Disconnected from invalid user alejandro 41.59.86.232 port 53782 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.118.99.170
country_id: 3686110
description:
Dec 27 19:43:34 host2 sshd[2381184]: Disconnected from invalid user root1 200.118.99.170 port 50682 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 27 19:43:44 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<qfABnu9GMJUvWBNS>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 200.118.99.170
country_id: 3686110
description:
Dec 27 19:44:10 host2 sshd[2381789]: Disconnected from invalid user ansible 200.118.99.170 port 34440 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 27 19:45:46 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<OzxPpe9GJOZnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Dec 27 19:46:36 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sobaherbal.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<+zFGqO9GFiCnYwhf>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.158.233.11
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 73.158.233.11 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.48.171.128
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 108.48.171.128 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.120.50.151
country_id: 6252001
description:
[2025-12-27 19:47:17 +0530] info [cpaneld] 69.120.50.151 - trad "GET /login/?login_only=1&user=trad&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user trad (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.44.224.102
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 108.44.224.102 - tradeceyloncom "GET /login/?login_only=1&user=tradeceyloncom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradeceyloncom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.4.121.217
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 24.4.121.217 - trade "GET /login/?login_only=1&user=trade&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user trade (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.107.23.106
country_id: 6252001
description:
[2025-12-27 19:47:18 +0530] info [cpaneld] 68.107.23.106 - tra "GET /login/?login_only=1&user=tra&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tra (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.244.137.139
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 71.244.137.139 - tradeceylon "GET /login/?login_only=1&user=tradeceylon&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.72.12.16
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 75.72.12.16 - tradecey "GET /login/?login_only=1&user=tradecey&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradecey (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.170.155.183
country_id: 6252001
description:
[2025-12-27 19:47:19 +0530] info [cpaneld] 97.170.155.183 - tr "GET /login/?login_only=1&user=tr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.166.75.247
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 72.166.75.247 - tradece "GET /login/?login_only=1&user=tradece&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.251.161.241
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 76.251.161.241 - tradec "GET /login/?login_only=1&user=tradec&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradec (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.114.128.106
country_id: 6252001
description:
[2025-12-27 19:47:22 +0530] info [cpaneld] 99.114.128.106 - tradece2 "GET /login/?login_only=1&user=tradece2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.30.184.21
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [whostmgrd] 38.30.184.21 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.54.85.18
country_id: 6252001
description:
[2025-12-27 19:47:21 +0530] info [cpaneld] 104.54.85.18 - tradece1 "GET /login/?login_only=1&user=tradece1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece1 (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.255.204.244
country_id: 2413451
description:
2025-12-27 19:47:50 dovecot_login authenticator failed for H=(197-255-204-244.netpagedns.net) [197.255.204.244]:34157: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2025-12-27 19:48:09 dovecot_login authenticator failed for H=c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:59028: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.123.227.244
country_id: 1269750
description:
Dec 27 19:48:19 host2 sshd[2386169]: Disconnected from invalid user soporte 103.123.227.244 port 37992 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.184.153.250
country_id: 1733045
description:
Dec 27 19:48:23 host2 sshd[2386205]: Disconnected from invalid user steam 202.184.153.250 port 59922 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 27 19:50:11 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<0/cWte9GrpIzTcpt>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.179.251
country_id: 99237
description:
2025-12-27 19:53:34 dovecot_login authenticator failed for H=([65.20.179.251]) [65.20.179.251]:36355: 535 Incorrect authentication data (set_id=hnt@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.82
country_id: 1733045
description:
2025-12-27 19:53:51 dovecot_login authenticator failed for H=([49.124.151.82]) [49.124.151.82]:45468: 535 Incorrect authentication data (set_id=hnt)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 27 19:54:02 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@venee.lk>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<BirSwu9GVtWnrKy4>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 27 19:53:30 host2 pure-ftpd[2390666]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 27 19:54:47 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@essenceceylontea.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<aUOQxe9GkI0uZXpm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 27 19:58:21 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@essenceceylontea.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<AOtJ0u9GKJGkXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 27 20:00:37 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<a5pg2u9GdKQyBsPO>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 27 20:01:15 host2 sshd[2397680]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.171
country_id: 2635167
description:
Dec 27 20:02:32 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 13 secs): user=<>, rip=35.203.210.171, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<eTVZ4e9GjNUjy9Kr>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.171
country_id: 2635167
description:
Dec 27 20:04:05 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 12 secs): user=<>, rip=35.203.210.171, lip=66.85.158.92, TLS: read(size=403) failed: Connection reset by peer, session=<z6Xj5u9GMuQjy9Kr>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.171
country_id: 2635167
description:
Dec 27 20:04:15 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: read(size=429) failed: Connection reset by peer (no auth attempts in 5 secs): user=<>, rip=35.203.210.171, lip=66.85.158.92, TLS: read(size=429) failed: Connection reset by peer, session=<bU2J5+9GgOkjy9Kr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 27 20:04:23 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<f3/h5+9GKPRo7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 97.74.84.186
country_id: 1880251
description:
Dec 27 20:06:00 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=97.74.84.186, lip=66.85.158.91, session=<0GmT7e9GgohhSlS6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.239.213.201
country_id: 3175395
description:
2025-12-27 20:06:14 dovecot_login authenticator failed for H=2-239-213-201.ip251.fastwebnet.it [2.239.213.201]:36902: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 27 20:06:27 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@anandaobauae.org>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<nDBB7+9GHtQv7PP+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.147.94
country_id: 290557
description:
2025-12-27 20:06:41 dovecot_login authenticator failed for H=([80.227.147.94]) [80.227.147.94]:35341: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.72.41
country_id: 6252001
description:
Dec 27 20:06:59 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=132.148.72.41, lip=66.85.158.91, session=<Ljkm8e9GOMGElEgp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 27 20:07:00 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<XZ078e9Gmoui8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 27 20:07:16 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<XcAn8u9GCoenrKy4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 129.0.111.246
country_id: 2233387
description:
2025-12-27 20:07:30 dovecot_login authenticator failed for H=(host-129.0.111.246.mtn.cm) [129.0.111.246]:52691: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 27 20:07:44 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<QHDa8+9Gfimi8Jp9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.22
country_id: 1269750
description:
2025-12-27 20:07:58 dovecot_login authenticator failed for H=(aes-static-105.28.22.125.airtel.in) [182.95.228.22]:44696: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 27 20:08:20 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<4zQE9u9Gpt0jupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.234.135.110
country_id: 2635167
description:
Dec 27 20:09:17 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@ceylondigest.com>, method=PLAIN, rip=85.234.135.110, lip=66.85.158.91, session=<vwJq+e9GnJZV6odu>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.88.199
country_id: 1861060
description:
Dec 27 20:09:39 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sivagnanamfoundation.com>, method=PLAIN, rip=47.79.88.199, lip=66.85.158.91, session=<uGaw+u9GUskvT1jH>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.41.202.12
country_id: 6252001
description:
2025-12-27 20:09:41 dovecot_login authenticator failed for H=syn-071-041-202-012.biz.spectrum.com [71.41.202.12]:43339: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.66
country_id: 1269750
description:
2025-12-27 20:10:01 dovecot_login authenticator failed for H=([122.187.230.66]) [122.187.230.66]:40850: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.69.124
country_id: 1880251
description:
Dec 27 20:11:08 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=167.172.69.124, lip=66.85.158.91, session=<+3oIAPBG9q+nrEV8>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.171
country_id: 2635167
description:
Dec 27 20:10:59 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=35.203.210.171, lip=66.85.158.92, TLS, session=<ECSR/+9GYvQjy9Kr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec 27 20:13:01 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@rehanseo.online>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<7DzBBvBGzJUv/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 27 20:14:02 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<bMdmCvBG2pIzTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 27 20:15:01 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<WhzfDfBGE89100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.110.112.243
country_id: 3865483
description:
Dec 27 20:20:49 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<chitral00@bostonlanka.com>, method=PLAIN, rip=190.110.112.243, lip=66.85.158.91, TLS, session=<orqnIfBGNOu+bnDz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.226.115.63
country_id: 3057568
description:
Dec 27 20:21:07 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<chitral00>, method=PLAIN, rip=91.226.115.63, lip=66.85.158.91, TLS, session=<gUjWIvBG2uJb4nM/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 27 20:22:50 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@nsteeleng.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<o7nZKfBGvqQv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.216.209.37
country_id: 933860
description:
Dec 27 20:24:49 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=41.216.209.37, lip=66.85.158.91, TLS, session=<6r3sL/BG4t0p2NEl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Dec 27 20:24:59 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@rehanseo.online>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<0BiKMfBGwt+l6LP6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 187.120.72.124
country_id: 3469034
description:
Dec 27 20:24:28 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@simple-engineering.lk>, method=PLAIN, rip=187.120.72.124, lip=66.85.158.91, TLS, session=<qj6nLvBGOsi7eEh8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 27 20:24:43 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@melanifinefood.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<2KiQMPBGfq0v7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 27 20:24:44 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<NxmeMPBGBHIjupN+>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 204.76.203.87
country_id: 2750405
description:
Dec 27 20:25:31 host2 pure-ftpd[2418870]: (?@204.76.203.87) [INFO] New connection from 204.76.203.87


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 195.24.237.152
country_id: 130758
description:
Dec 27 20:26:29 host2 pure-ftpd[2420188]: (?@195.24.237.152) [INFO] New connection from 195.24.237.152


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.194.243.187
country_id: 1269750
description:
2025-12-27 20:28:54 dovecot_login authenticator failed for H=([103.194.243.187]) [103.194.243.187]:53362: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2025-12-27 20:29:13 dovecot_login authenticator failed for H=([102.53.15.56]) [102.53.15.56]:52804: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.128.202
country_id: 6252001
description:
2025-12-27 20:29:31 dovecot_login authenticator failed for H=([192.34.128.202]) [192.34.128.202]:56396: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 27 20:29:59 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<XMhqQ/BG8JEv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 27 20:31:02 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<ti4nR/BGfTlniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Dec 27 20:31:01 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@dataesite.lk>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<qKsbR/BGLtdA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 27 20:31:37 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<EF9CSfBGgr8v/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.151.137.207
country_id: 130758
description:
Dec 27 20:32:44 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sobaherbal.com>, method=PLAIN, rip=193.151.137.207, lip=66.85.158.91, session=<Q6lCTfBGHqLBl4nP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.130.133
country_id: 6252001
description:
Dec 27 20:33:43 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@seyawin.com>, method=PLAIN, rip=64.23.130.133, lip=66.85.158.91, session=<GvnAUPBGxqlAF4KF>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 204.76.203.87
country_id: 2750405
description:
Dec 27 20:34:16 host2 pure-ftpd[2426845]: (?@204.76.203.87) [INFO] New connection from 204.76.203.87


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 27 20:35:22 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=</wKrVvBGMNUvWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Dec 27 20:35:35 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<ZmNuV/BGMIpA44h6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.203.222.206
country_id: 192950
description:
Dec 27 20:36:45 host2 sshd[2429501]: Invalid user secondcoffeeinternational from 41.203.222.206 port 17692


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.56.202.86
country_id: 3469034
description:
2025-12-27 20:37:08 dovecot_login authenticator failed for H=(186-238-88-61.customer.tdatabrasil.net.br) [189.56.202.86]:43959: 535 Incorrect authentication data (set_id=accounts@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.58.67.117
country_id: 1269750
description:
2025-12-27 20:37:39 dovecot_login authenticator failed for H=([103.58.67.117]) [103.58.67.117]:48277: 535 Incorrect authentication data (set_id=accounts)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Dec 27 20:39:11 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sobaherbal.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<mZxTZPBGNCOnYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 27 20:39:20 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@ceylondigest.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<lvzbZPBGjt7D+hnW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 27 20:39:25 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<lcorZfBGDKZnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 27 20:41:01 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<rFrcavBG2qYzTcpt>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.115.194
country_id: 1269750
description:
2025-12-27 20:41:15 dovecot_login authenticator failed for H=([182.95.115.194]) [182.95.115.194]:39218: 535 Incorrect authentication data (set_id=accounts@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.2.44.54
country_id: 1269750
description:
2025-12-27 20:41:31 dovecot_login authenticator failed for H=(static.bb.alp.61.2.44.54.bsnl.in) [61.2.44.54]:47368: 535 Incorrect authentication data (set_id=accounts)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 62.60.131.157
country_id: 130758
description:
Dec 27 20:44:19 host2 sshd[2436034]: Disconnected from invalid user  62.60.131.157 port 24575 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 27 20:45:50 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@venee.lk>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<EDoUfPBGULenrKy4>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 27 20:46:01 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<yRjGfPBGwKMuZXpm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 104.152.52.233
country_id: 6252001
description:
Dec 27 20:46:02 host2 dovecot[1881837]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=104.152.52.233, lip=66.85.158.91, session=<TRXxfPBGE9domDTp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.92.229
country_id: 3996063
description:
2025-12-27 20:47:13 dovecot_login authenticator failed for H=([201.173.92.229]) [201.173.92.229]:54150: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.220.10.60
country_id: 1269750
description:
2025-12-27 20:47:31 dovecot_login authenticator failed for H=(static.ftth.hpr.117.220.10.60.bsnl.in) [117.220.10.60]:36037: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.20.67
country_id: 6252001
description:
Dec 27 20:48:24 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.20.67, lip=66.85.158.92, session=<N6lphfBGGPNBMRRD>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 27 20:50:32 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<uprkjPBGVsGkXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 27 20:51:42 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<2ssPkfBGVJMyBsPO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 27 20:55:56 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<lFA8oPBGUGho7MS0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.175.205.71
country_id: 1605651
description:
2025-12-27 20:56:33 dovecot_login authenticator failed for H=(mx-ll-183.89.250-247.dynamic.3bb.in.th) [118.175.205.71]:59486: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 27 20:56:44 host2 pure-ftpd[2448728]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.65.99
country_id: 3144096
description:
2025-12-27 20:56:53 dovecot_login authenticator failed for H=(cm-178.232.65.99.get.no) [178.232.65.99]:41129: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.72.41
country_id: 6252001
description:
Dec 27 20:57:47 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@kiriaswanu.com>, method=PLAIN, rip=132.148.72.41, lip=66.85.158.91, session=<l0LUpvBG4raElEgp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 27 20:57:37 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<Fho8pvBGnK2i8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 27 20:58:35 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<wTCwqfBG5Lwv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 27 20:59:03 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<88hWq/BGgpqnrKy4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 27 20:59:41 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<E9ubrfBGLlIjupN+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-27 21:01:04 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:56563: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 27 21:01:11 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<D40Bs/BGYESi8Jp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec 27 21:04:03 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@rehanseo.online>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<+yE5vfBG1sUv/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 27 21:04:02 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<jsUnvfBGhIUzTcpt>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.216.213.140
country_id: 2921044
description:
[2025-12-27 21:04:31 +0530] info [cpaneld] 185.216.213.140 - yashiholdings "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user yashiholdings (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.234.135.110
country_id: 2635167
description:
Dec 27 21:04:35 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=85.234.135.110, lip=66.85.158.91, session=<HUYsv/BGyLVV6odu>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.69.124
country_id: 1880251
description:
Dec 27 21:04:48 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sobaherbal.com>, method=PLAIN, rip=167.172.69.124, lip=66.85.158.91, session=<9q3pv/BGoumnrEV8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 97.74.84.186
country_id: 1880251
description:
Dec 27 21:05:23 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ceylondigest.com>, method=PLAIN, rip=97.74.84.186, lip=66.85.158.91, session=<LTgHwvBGRMVhSlS6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.154.119.158
country_id: 1605651
description:
Dec 27 21:07:00 host2 dovecot[1881837]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=165.154.119.158, lip=66.85.158.91, session=<P7Pzx/BGuKqlmnee>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.154.119.158
country_id: 1605651
description:
Dec 27 21:07:19 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 18 secs): user=<>, rip=165.154.119.158, lip=66.85.158.91, session=<+7wPyfBGvKqlmnee>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.88.199
country_id: 1861060
description:
Dec 27 21:07:19 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sivagnanamfoundation.com>, method=PLAIN, rip=47.79.88.199, lip=66.85.158.91, session=<xvznyPBGur0vT1jH>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 157.230.219.203
country_id: 6252001
description:
Dec 27 21:08:52 host2 pure-ftpd[2459166]: (?@157.230.219.203) [INFO] New connection from 157.230.219.203


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.154.119.158
country_id: 1605651
description:
Dec 27 21:10:10 host2 dovecot[1881837]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=165.154.119.158, lip=66.85.158.92, session=<JrQ90/BGGMylmnee>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 27 21:10:40 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<sLjp1PBGgfd100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.110.189.45
country_id: 2750405
description:
2025-12-27 21:14:44 dovecot_login authenticator failed for H=([193.110.189.45]) [193.110.189.45]:37026: 535 Incorrect authentication data (set_id=accounts@agronatureholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 27 21:14:33 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@nsteeleng.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<Q93M4vBGRIMv+wDY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.6.101.246
country_id: 2510769
description:
2025-12-27 21:15:12 dovecot_login authenticator failed for H=246.red-88-6-101.staticip.rima-tde.net [88.6.101.246]:52188: 535 Incorrect authentication data (set_id=accounts)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 27 21:15:57 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<DgzI5/BG0F8jupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 27 21:16:22 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@melanifinefood.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<2aVO6fBG/Jkv7PP+>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 27 21:18:43 host2 sshd[2467024]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Dec 27 21:18:33 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@rehanseo.online>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<HXEh8fBGhtml6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 27 21:20:10 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<dfbi9vBG1o0v/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.238.107.104
country_id: 3865483
description:
Dec 27 21:20:41 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<chitral00@bostonlanka.com>, method=PLAIN, rip=45.238.107.104, lip=66.85.158.91, TLS, session=<k6i09/BGCqYt7mto>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.85.105.233
country_id: 3469034
description:
Dec 27 21:21:02 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<chitral00>, method=PLAIN, rip=187.85.105.233, lip=66.85.158.91, TLS, session=<AOX9+PBGPpK7VWnp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 27 21:21:49 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<pQ7R/PBG9LYv/AU1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 37.221.138.185
country_id: 690791
description:
Dec 27 21:24:17 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@simple-engineering.lk>, method=PLAIN, rip=37.221.138.185, lip=66.85.158.91, TLS, session=<ETyXBPFGp7wl3Yq5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Dec 27 21:24:21 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@dataesite.lk>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<4n/aBfFGftRA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.226.115.90
country_id: 3057568
description:
Dec 27 21:24:34 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=91.226.115.90, lip=66.85.158.91, TLS, session=<CB3HBfFG3rhb4nNa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 27 21:25:54 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<jDRjC/FGNB5niu0S>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
country_id: 1643084
description:
2025-12-27 21:25:57 dovecot_login authenticator failed for H=([103.29.185.162]) [103.29.185.162]:43888: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.255.204.244
country_id: 2413451
description:
2025-12-27 21:26:21 dovecot_login authenticator failed for H=(197-255-204-244.netpagedns.net) [197.255.204.244]:44793: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 27 21:26:29 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<Dfd7DfFGhqYvWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Dec 27 21:28:54 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lankaherbalsolutions.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<UDMdFvFG3KNA44h6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.56.202.86
country_id: 3469034
description:
2025-12-27 21:29:09 dovecot_login authenticator failed for H=([189.109.48.81]) [189.56.202.86]:54193: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.209.84
country_id: 3144096
description:
2025-12-27 21:29:25 dovecot_login authenticator failed for H=(cm-178.232.209.84.get.no) [178.232.209.84]:54104: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.120.238.231
country_id: 1605651
description:
2025-12-27 21:29:36 dovecot_login authenticator failed for H=ppp-124-120-238-231.revip2.asianet.co.th [124.120.238.231]:40980: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.51.218.16
country_id: 2510769
description:
2025-12-27 21:29:45 dovecot_login authenticator failed for H=16.red-83-51-218.dynamicip.rima-tde.net [83.51.218.16]:55944: 535 Incorrect authentication data (set_id=training)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Dec 27 21:30:14 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@sobaherbal.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<NL3hGvFG+iunYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 27 21:31:01 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<Rr+1HfFGiM4zTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.151.137.207
country_id: 130758
description:
Dec 27 21:31:12 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sobaherbal.com>, method=PLAIN, rip=193.151.137.207, lip=66.85.158.91, session=<8/RaHvFGdqDBl4nP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 27 21:32:37 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<qxJjI/FGVqtnmud6>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.35.225.197
country_id: 3996063
description:
[2025-12-27 21:33:51 +0530] info [cpaneld] 38.35.225.197 - euroentertainmen "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 27 21:37:05 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<W8ppM/FGoJrD+hnW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 27 21:36:22 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<ytPNMPFGiqYuZXpm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 27 21:37:57 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@venee.lk>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<1+J6NvFG+KynrKy4>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 27 21:42:24 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<ArFqRvFGDKKkXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 27 21:42:30 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<L7TIRvFGbqoyBsPO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.118.49.18
country_id: 1269750
description:
2025-12-27 21:44:11 dovecot_login authenticator failed for H=([45.118.49.18]) [45.118.49.18]:54099: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.191.100
country_id: 3144096
description:
2025-12-27 21:44:25 dovecot_login authenticator failed for H=(cm-84.213.191.100.get.no) [84.213.191.100]:56550: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 27 21:47:03 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<ntgAV/FGtEZo7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 27 21:47:52 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<QWrxWfFGGq6i8GQy>


