# incident

plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.108.89.210
country_id: 3932488
description:
Jan 10 14:03:56 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=190.108.89.210, lip=66.85.158.91, session=<pj2XgARInJu+bFnS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.17.124.75
country_id: 1269750
description:
2026-01-10 14:03:23 dovecot_login authenticator failed for H=(aes-static-075.124.17.125.airtel.in) [125.17.124.75]:51868: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 202.93.247.247
country_id: 1643084
description:
Jan 10 14:03:52 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@venee.lk>, method=PLAIN, rip=202.93.247.247, lip=66.85.158.91, session=<pANXgARI2IzKXff3>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 92.27.101.99
country_id: 2635167
description:
Jan 10 14:03:59 host2 sshd[2810383]: Disconnected from invalid user debian 92.27.101.99 port 34960 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan 10 14:04:55 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<office@rehanseo.online>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<cZ4OhARI/MBnmud6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.156.238.162
country_id: 3686110
description:
Jan 10 14:04:10 host2 sshd[2810507]: Disconnected from invalid user claude 190.156.238.162 port 54580 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.84.16.145
country_id: 1880251
description:
Jan 10 14:05:23 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<noreply@ceylondigest.com>, method=PLAIN, rip=47.84.16.145, lip=66.85.158.91, session=<pvi+hQRIFMUvVBCR>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 162.240.166.197
country_id: 6252001
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[162.240.166.197] [Remote Port]=[52348] [Authentication Database]=[mail] [Username]=[support@sobaherbal.com] (10/10 failures) (blocked until [Sun Jan 11 08:35:26 2026 UTC/Sun Jan 11 14:05:26 2026 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.166.197
country_id: 6252001
description:
Jan 10 14:05:28 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sobaherbal.com>, method=PLAIN, rip=162.240.166.197, lip=66.85.158.91, session=<oF8ThgRIfMyi8KbF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.201.22.158
country_id: 290557
description:
2026-01-10 14:05:09 dovecot_plain authenticator failed for H=(coliks) [94.201.22.158]:50930: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.156.238.162
country_id: 3686110
description:
Jan 10 14:06:38 host2 sshd[2812335]: Disconnected from invalid user user 190.156.238.162 port 49230 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.86.94.251
country_id: 2921044
description:
Jan 10 14:07:07 host2 sshd[2812763]: Disconnected from invalid user frappe 172.86.94.251 port 43264 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.49
country_id: 290557
description:
Jan 10 14:06:23 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=185.93.89.49, lip=66.85.158.91, session=<+apUiQRI4qi5XVkx>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 10 14:07:26 host2 sshd[2813012]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan 10 14:07:48 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sobaherbal.com>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<IYZmjgRIpo0yBvlc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.2
country_id: 1149361
description:
2026-01-10 14:08:06 dovecot_login authenticator failed for H=([149.54.62.2]) [149.54.62.2]:51197: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 105.174.17.50
country_id: 3351879
description:
Jan 10 14:08:07 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=105.174.17.50, lip=66.85.158.91, session=<QIR6jwRIrB5prhEy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan 10 14:07:37 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@kiriaswanu.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<Hc6/jQRIPFF100Db>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.66.34.121
country_id: 1643084
description:
Jan 10 14:07:44 host2 sshd[2813349]: Disconnected from invalid user ftpuser 157.66.34.121 port 43092 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.122
country_id: 1269750
description:
2026-01-10 14:08:33 dovecot_login authenticator failed for H=([125.17.205.185]) [182.95.178.122]:38626: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.45
country_id: 290557
description:
Jan 10 14:08:55 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=185.93.89.45, lip=66.85.158.91, session=<9glokgRITte5XVkt>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.192.162
country_id: 1269750
description:
2026-01-10 14:08:57 dovecot_login authenticator failed for H=([152.52.192.162]) [152.52.192.162]:55760: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan 10 14:09:06 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@venee.lk>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<7lUKkwRIBpwFhXlo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.95.24.117
country_id: 2464461
description:
2026-01-10 14:08:40 dovecot_login authenticator failed for H=([193.95.21.147]) [193.95.24.117]:34254: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 23.94.112.185
country_id: 6252001
description:
Jan 10 14:08:48 host2 sshd[2814249]: Disconnected from invalid user azureuser 23.94.112.185 port 40480 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.219.68.189
country_id: 3865483
description:
2026-01-10 14:09:11 dovecot_login authenticator failed for H=([201.219.68.189]) [201.219.68.189]:40932: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.166.197
country_id: 6252001
description:
Jan 10 14:09:19 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@kiriaswanu.com>, method=PLAIN, rip=162.240.166.197, lip=66.85.158.91, session=<Fc3MkwRIgNCi8KbF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan 10 14:09:21 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@seyawin.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<kWbskwRIlJh100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.48
country_id: 290557
description:
Jan 10 14:09:22 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=185.93.89.48, lip=66.85.158.91, session=<4d4DlARIWoW5XVkw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Jan 10 14:10:00 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@rehanseo.online>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<U0RDlgRI5rkvWfaQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.27.203.227
country_id: 3439705
description:
Jan 10 14:11:05 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=179.27.203.227, lip=66.85.158.91, session=<uJcqmgRIGrOzG8vj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Jan 10 14:10:12 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@venee.lk>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<ee/8lgRI0uSLO0qU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.47
country_id: 290557
description:
Jan 10 14:10:57 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=185.93.89.47, lip=66.85.158.91, session=<hueumQRInuO5XVkv>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.114.147.217
country_id: 1655842
description:
Jan 10 14:10:58 host2 sshd[2816111]: Disconnected from invalid user claude 103.114.147.217 port 55494 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.114.147.217
country_id: 1655842
description:
Jan 10 14:11:37 host2 sshd[2816549]: Disconnected from invalid user frappe 103.114.147.217 port 37140 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.46
country_id: 290557
description:
Jan 10 14:11:43 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=185.93.89.46, lip=66.85.158.91, session=<oJpsnARI5pe5XVku>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan 10 14:12:22 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@dataesite.lk>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<N9y1ngRIpLKi8Jp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.105.156.165
country_id: 3923057
description:
Jan 10 14:12:09 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@kiriaswanu.com>, method=PLAIN, rip=200.105.156.165, lip=66.85.158.91, session=<0ur7nQRI9s/IaZyl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.126.144.30
country_id: 6252001
description:
2026-01-10 14:13:12 dovecot_plain authenticator failed for H=ool-457e901e.dyn.optonline.net (rosive) [69.126.144.30]:61515: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.67.155.180
country_id: 298795
description:
Jan 10 14:13:51 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=45.67.155.180, lip=66.85.158.91, TLS, session=<v1kjowRIUM0tQ5u0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.135.19.135
country_id: 1819730
description:
Jan 10 14:13:58 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<finance@ceylondigest.com>, method=PLAIN, rip=43.135.19.135, lip=66.85.158.91, session=<gMJSpARIAtUrhxOH>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 157.66.34.121
country_id: 1643084
description:
Jan 10 14:14:09 host2 sshd[2818285]: Disconnected from invalid user vpn 157.66.34.121 port 49006 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.96.199.203
country_id: 3865483
description:
Jan 10 14:14:11 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=186.96.199.203, lip=66.85.158.91, TLS, session=<xJpEpARIIMi6YMfL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.54.10
country_id: 1269750
description:
2026-01-10 14:16:40 dovecot_login authenticator failed for H=([128.185.241.106]) [182.95.54.10]:33834: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.229.42
country_id: 1269750
description:
2026-01-10 14:17:00 dovecot_login authenticator failed for H=([152.52.238.53]) [152.52.229.42]:39272: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.27.203.227
country_id: 3439705
description:
Jan 10 14:19:40 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=179.27.203.227, lip=66.85.158.91, session=<KhzSuARIeuezG8vj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan 10 14:20:32 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<cPrquwRIDt5nmud6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.46.144
country_id: 1819730
description:
2026-01-10 14:24:03 dovecot_login authenticator failed for H=144.46.246.220.static.netvigator.com [220.246.46.144]:55844: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan 10 14:23:21 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@essenceceylontea.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<JD4DxgRIKKIFhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan 10 14:24:12 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<IG0LyQRI1qhnmud6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.179.134.120
country_id: 1269750
description:
2026-01-10 14:24:16 dovecot_login authenticator failed for H=(abts-mum-static-120.134.179.122.airtelbroadband.in) [122.179.134.120]:52271: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Jan 10 14:25:10 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<u4CFzARIPIG8putr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.251.70
country_id: 1269750
description:
2026-01-10 14:25:15 dovecot_login authenticator failed for H=([125.17.70.25]) [125.20.251.70]:54554: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.123.118
country_id: 1269750
description:
2026-01-10 14:25:27 dovecot_login authenticator failed for H=([122.184.123.118]) [122.184.123.118]:45386: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.216.209.80
country_id: 933860
description:
Jan 10 14:26:00 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=41.216.209.80, lip=66.85.158.91, TLS, session=<INp0zgRIj50p2NFQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.245.250.137
country_id: 3469034
description:
Jan 10 14:26:19 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=170.245.250.137, lip=66.85.158.91, TLS, session=<zyK1zwRIeqCq9fqJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.57.236.167
country_id: 1819730
description:
Jan 10 14:27:56 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@sivagnanamfoundation.com>, method=PLAIN, rip=47.57.236.167, lip=66.85.158.91, session=<itVX1gRIcuUvOeyn>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.233.21.109
country_id: 272103
description:
2026-01-10 14:30:17 dovecot_login authenticator failed for H=([109.233.21.109]) [109.233.21.109]:59236: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.214.78
country_id: 1269750
description:
2026-01-10 14:30:32 dovecot_login authenticator failed for H=([128.185.39.145]) [128.185.214.78]:44676: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.22.242.162
country_id: 1880251
description:
Jan 10 14:31:09 host2 pure-ftpd[2830783]: (?@165.22.242.162) [INFO] New connection from 165.22.242.162


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Jan 10 14:31:13 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@seyawin.com>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<kt0o4gRIIrkvWfaQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.242.142
country_id: 1269750
description:
2026-01-10 14:32:18 dovecot_login authenticator failed for H=([125.19.172.137]) [182.78.242.142]:51340: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.23.199.238
country_id: 2921044
description:
2026-01-10 14:33:07 dovecot_login authenticator failed for H=([193.23.199.238]) [193.23.199.238]:51512: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.112.146
country_id: 1269750
description:
2026-01-10 14:34:31 dovecot_login authenticator failed for H=([182.95.85.103]) [182.95.112.146]:56316: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.124.202
country_id: 1269750
description:
2026-01-10 14:34:41 dovecot_login authenticator failed for H=([182.95.124.202]) [182.95.124.202]:38602: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.251.170
country_id: 99237
description:
2026-01-10 14:34:51 dovecot_login authenticator failed for H=([65.20.251.170]) [65.20.251.170]:43747: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.251.121.70
country_id: 1861060
description:
2026-01-10 14:35:02 dovecot_login authenticator failed for H=works.ssc-gr.info [160.251.121.70]:49014: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Jan 10 14:36:10 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<noreply@venee.lk>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<Y1PO8wRI6sIz0msW>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 10 14:37:43 host2 sshd[2835905]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan 10 14:37:58 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sobaherbal.com>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<znFN+gRIaumOq2dI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan 10 14:38:05 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<Usi3+gRICNcyBvlc>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.22.242.162
country_id: 1880251
description:
Jan 10 14:38:41 host2 pure-ftpd[2836596]: (?@165.22.242.162) [INFO] New connection from 165.22.242.162


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.226.197.43
country_id: 2264397
description:
Jan 10 14:39:38 host2 dovecot[1180436]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=185.226.197.43, lip=66.85.158.92, session=<Af1XAAVIi4S54sUr>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.226.197.42
country_id: 2264397
description:
Jan 10 14:39:39 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed: SSL_read failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 1 secs): user=<>, rip=185.226.197.42, lip=66.85.158.92, TLS: SSL_read failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<A8JrAAVIPNq54sUq>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.226.197.43
country_id: 2264397
description:
Jan 10 14:39:42 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=185.226.197.43, lip=66.85.158.92, TLS, session=<HpadAAVId7q54sUr>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.226.197.45
country_id: 2264397
description:
Jan 10 14:39:49 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=185.226.197.45, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher, session=<DMUKAQVIWY654sUt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 20.56.1.201
country_id: 2750405
description:
Jan 10 14:40:12 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@lankaherbalsolutions.com>, method=PLAIN, rip=20.56.1.201, lip=66.85.158.91, session=<Axc/AgVIAMcUOAHJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Jan 10 14:42:05 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<noreply@essenceceylontea.com>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<CmMGCQVIX5sz0msW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.246.178
country_id: 1269750
description:
2026-01-10 14:42:57 dovecot_login authenticator failed for H=([182.79.95.139]) [152.52.246.178]:41966: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.242.142
country_id: 1269750
description:
2026-01-10 14:42:12 dovecot_login authenticator failed for H=([125.19.172.137]) [182.78.242.142]:32964: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.57.80.193
country_id: 6252001
description:
2026-01-10 14:42:25 dovecot_plain authenticator failed for H=c-73-57-80-193.hsd1.fl.comcast.net (diked) [73.57.80.193]:45386: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.200.94.102
country_id: 290557
description:
2026-01-10 14:42:38 dovecot_login authenticator failed for H=([87.200.94.102]) [87.200.94.102]:53312: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.135.31.74
country_id: 1522867
description:
2026-01-10 14:43:26 dovecot_plain authenticator failed for H=2.135.31.74.dynamic.telecom.kz (subcal) [2.135.31.74]:52815: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Jan 10 14:45:05 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<j/bAEwVInMSLO0qU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.11.34.221
country_id: 1210997
description:
2026-01-10 14:44:15 dovecot_login authenticator failed for H=(113-11-34-221-smile.com.bd) [113.11.34.221]:51280: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.151.228.170
country_id: 1522867
description:
2026-01-10 14:44:29 dovecot_login authenticator failed for H=37.151.228.170.dynamic.telecom.kz [37.151.228.170]:39052: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Jan 10 14:47:22 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<noreply@bostonlanka.com>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<Y3XhGwVI5L4z0msW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.45
country_id: 290557
description:
Jan 10 14:47:22 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@ceylondigest.com>, method=PLAIN, rip=185.93.89.45, lip=66.85.158.91, session=<Q2LgGwVI4te5XVkt>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan 10 14:49:34 host2 sshd[2846848]: Disconnected from invalid user admin 2.57.121.112 port 57781 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Jan 10 14:49:57 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<jwceJQVIkLaLO0qU>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 40.124.175.225
country_id: 6252001
description:
Jan 10 14:50:18 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=40.124.175.225, lip=66.85.158.91, session=<WtqIJgVIxqgofK/h>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.14.93.239
country_id: 6252001
description:
Jan 10 14:51:59 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.14.93.239, lip=66.85.158.92, session=<pCKHLAVI9oMUDl3v>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan 10 14:52:30 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<3htDLgVIVMeOq2dI>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 71.6.146.185
country_id: 6252001
description:
Jan 10 14:54:12 host2 dovecot[1180436]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=71.6.146.185, lip=66.85.158.92, session=<jQBxNAVIBspHBpK5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan 10 14:56:04 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@bostonlanka.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<6NYBOwVIVrYFhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan 10 14:56:47 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<EiiRPQVIXMhCdMzo>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.223.28.152
country_id: 2510769
description:
[2026-01-10 14:56:13 +0530] info [webmaild] 82.223.28.152 - hr@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.177.191.168
country_id: 357994
description:
2026-01-10 14:57:47 dovecot_plain authenticator failed for H=(fulfize) [154.177.191.168]:35722: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 20.65.177.158
country_id: 6252001
description:
Jan 10 14:58:33 host2 pure-ftpd[2855903]: (?@20.65.177.158) [INFO] New connection from 20.65.177.158


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.84.211.204
country_id: 6252001
description:
Jan 10 15:00:13 host2 sshd[2857265]: Disconnected from invalid user lalit 50.84.211.204 port 47042 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 50.84.211.204
country_id: 6252001
description:
Jan 10 15:01:16 host2 sshd[2858110]: Disconnected from invalid user mu 50.84.211.204 port 41436 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Jan 10 15:04:03 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@dataesite.lk>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<KyqSVwVIGIenYwhf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.196.144.25
country_id: 6252001
description:
2026-01-10 15:04:53 dovecot_plain authenticator failed for H=c-73-196-144-25.hsd1.nj.comcast.net (arkeed) [73.196.144.25]:35738: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Jan 10 15:05:39 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<noreply@anandaobauae.org>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<U0pKXQVIWqkvWfaQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan 10 15:14:36 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@rehanseo.online>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<Y0pHfQVIYqBnmud6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.223.64
country_id: 1880251
description:
Jan 10 15:15:06 host2 sshd[2869948]: Disconnected from invalid user deployerer 45.78.223.64 port 48390 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.53.124
country_id: 6252001
description:
Jan 10 15:16:07 host2 sshd[2870933]: Disconnected from invalid user user1 209.141.53.124 port 42292 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 193.8.113.26
country_id: 2510769
description:
Jan 10 15:15:31 host2 sshd[2870472]: Disconnected from invalid user teamspeak 193.8.113.26 port 44014 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.166.197
country_id: 6252001
description:
Jan 10 15:16:55 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@kiriaswanu.com>, method=PLAIN, rip=162.240.166.197, lip=66.85.158.91, session=<4FuWhQVIqsui8KbF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.143.72
country_id: 298795
description:
2026-01-10 15:17:01 dovecot_plain authenticator failed for H=(brypoloid) [5.11.143.72]:49002: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 105.174.17.50
country_id: 3351879
description:
Jan 10 15:16:33 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@mathsmotorcysle.xyz>, method=PLAIN, rip=105.174.17.50, lip=66.85.158.91, session=<89VAhAVI3tFprhEy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan 10 15:16:34 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@venee.lk>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<Z2tThAVImOkFhXlo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.145.107.251
country_id: 6252001
description:
2026-01-10 15:17:27 dovecot_plain authenticator failed for H=c-73-145-107-251.hsd1.mi.comcast.net (dizedle) [73.145.107.251]:46668: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 18.97.19.147
country_id: 6252001
description:
Jan 10 15:17:30 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=18.97.19.147, lip=66.85.158.92, TLS handshaking: Connection closed, session=<fPjFhwVIBJ8SYROT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.53.128.144
country_id: 3469034
description:
Jan 10 15:17:59 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=191.53.128.144, lip=66.85.158.91, TLS, session=<8XhtiAVI372/NYCQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.17.124.171
country_id: 690791
description:
Jan 10 15:18:16 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=185.17.124.171, lip=66.85.158.91, TLS, session=<onyViQVIIuO5EXyr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Jan 10 15:19:03 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<noreply@bostonlanka.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<F4EzjQVICr6LO0qU>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 209.141.53.124
country_id: 6252001
description:
Jan 10 15:18:20 host2 sshd[2872621]: Disconnected from invalid user administrador 209.141.53.124 port 46962 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.128.27.123
country_id: 1880251
description:
Jan 10 15:19:12 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@venee.lk>, method=PLAIN, rip=178.128.27.123, lip=66.85.158.91, session=<llW6jQVIJJmygBt7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 105.174.17.50
country_id: 3351879
description:
Jan 10 15:20:22 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=105.174.17.50, lip=66.85.158.91, session=<j3vpkQVIg7FprhEy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan 10 15:20:56 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<Nxj0kwVIroEyBvlc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.25.232.7
country_id: 953987
description:
Jan 10 15:20:21 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<amila@euroentertainmentlk.com>, method=PLAIN, rip=41.25.232.7, lip=66.85.158.91, session=<g9nWkQVIfvYpGegH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan 10 15:20:35 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<SbmukgVI+sJCdMzo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.194.250.47
country_id: 1605651
description:
Jan 10 15:20:59 host2 sshd[2874814]: Disconnected from invalid user frappe 118.194.250.47 port 45352 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan 10 15:22:05 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sobaherbal.com>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<J/oRmAVIBNKOq2dI>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.40.101.10
country_id: 6252001
description:
2026-01-10 15:21:22 dovecot_plain authenticator failed for H=c-98-40-101-10.hsd1.tn.comcast.net (tatiparco) [98.40.101.10]:60670: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.217.130.86
country_id: 3996063
description:
Jan 10 15:21:22 host2 sshd[2875165]: Disconnected from invalid user user 189.217.130.86 port 3723 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 97.74.84.186
country_id: 1880251
description:
Jan 10 15:21:30 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<finance@mathsmotorcysle.xyz>, method=PLAIN, rip=97.74.84.186, lip=66.85.158.91, session=<ZJLXlQVI5J5hSlS6>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 118.194.250.47
country_id: 1605651
description:
Jan 10 15:21:36 host2 sshd[2875348]: Disconnected from invalid user test 118.194.250.47 port 51758 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.224.169.28
country_id: 6252001
description:
2026-01-10 15:22:59 dovecot_plain authenticator failed for H=c-71-224-169-28.hsd1.pa.comcast.net (cirker) [71.224.169.28]:36354: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Jan 10 15:23:27 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@dataesite.lk>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<9WHwnAVI5g6nYwhf>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 167.99.8.95
country_id: 6252001
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[167.99.8.95] [Remote Port]=[3814] [Authentication Database]=[mail] [Username]=[finance@dataesite.lk] (10/10 failures) (blocked until [Sun Jan 11 09:53:25 2026 UTC/Sun Jan 11 15:23:25 2026 LOCAL])


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.65.140.218
country_id: 3017382
description:
2026-01-10 15:24:03 dovecot_login authenticator failed for H=82-65-140-218.subs.proxad.net [82.65.140.218]:51164: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.191.8.27
country_id: 3017382
description:
2026-01-10 15:24:55 dovecot_login authenticator failed for H=([176.191.8.27]) [176.191.8.27]:39208: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.223.64
country_id: 1880251
description:
Jan 10 15:24:53 host2 sshd[2877738]: Disconnected from invalid user testuser 45.78.223.64 port 42994 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan 10 15:26:29 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<QanOpwVICJOOq2dI>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.253.205
country_id: 1819730
description:
Jan 10 15:28:49 host2 sshd[2880857]: Disconnected from invalid user claude 152.32.253.205 port 56018 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.26.36.195
country_id: 1819730
description:
Jan 10 15:29:12 host2 sshd[2881101]: Disconnected from invalid user user2 118.26.36.195 port 42700 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 27.254.137.144
country_id: 1605651
description:
Jan 10 15:31:42 host2 sshd[2883489]: Disconnected from invalid user vpn 27.254.137.144 port 43282 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan 10 15:33:59 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@venee.lk>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<Ni6gwgVICKgFhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Jan 10 15:34:33 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@essenceceylontea.com>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<9yKtxAVIqqQz0msW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.37.215.112
country_id: 3175395
description:
Jan 10 15:34:41 host2 sshd[2885849]: Disconnected from invalid user test 151.37.215.112 port 32215 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.197.9.163
country_id: 3175395
description:
Jan 10 15:34:58 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=185.197.9.163, lip=66.85.158.91, TLS, session=<D8pBxQVIl6i5xQmj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.243.92.24
country_id: 2510769
description:
Jan 10 15:35:16 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=185.243.92.24, lip=66.85.158.91, TLS, session=<eBlUxgVI3ba581wY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.93.60.253
country_id: 3865483
description:
2026-01-10 15:35:22 dovecot_login authenticator failed for H=([181.93.60.253]) [181.93.60.253]:54194: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.30
country_id: 290557
description:
Jan 10 15:35:15 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=185.93.89.30, lip=66.85.158.91, session=<J/0oxwVIUKO5XVke>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.227.185.238
country_id: 1269750
description:
Jan 10 15:35:24 host2 sshd[2886582]: Disconnected from invalid user testuser 43.227.185.238 port 40082 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.188.204.213
country_id: 6252001
description:
2026-01-10 15:35:34 dovecot_login authenticator failed for H=(c-50-188-204-213.unallocated.comcastbusiness.net) [50.188.204.213]:57814: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2026-01-10 15:37:05 dovecot_login authenticator failed for H=([197.219.228.242]) [197.219.228.242]:36034: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.26.36.195
country_id: 1819730
description:
Jan 10 15:36:13 host2 sshd[2887269]: Disconnected from invalid user steam 118.26.36.195 port 54978 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.29
country_id: 290557
description:
Jan 10 15:36:17 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=185.93.89.29, lip=66.85.158.91, session=<T43cygVINLa5XVkd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.59.39.85
country_id: 1269750
description:
2026-01-10 15:37:04 dovecot_plain authenticator failed for H=(6S73LVD8) [152.59.39.85]:52866: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.68.110.207
country_id: 2921044
description:
Jan 10 15:37:04 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<noreply@rehanseo.online>, method=PLAIN, rip=138.68.110.207, lip=66.85.158.91, session=<cZyazQVImomKRG7P>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.158.10
country_id: 99237
description:
2026-01-10 15:37:28 dovecot_login authenticator failed for H=([65.20.158.10]) [65.20.158.10]:43306: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.59.39.85
country_id: 1269750
description:
2026-01-10 15:37:10 dovecot_login authenticator failed for H=(6S73LVD8) [152.59.39.85]:52866: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Jan 10 15:37:14 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@bostonlanka.com>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<WTo+zgVIYr0z0msW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.27
country_id: 290557
description:
Jan 10 15:38:59 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ceylondigest.com>, method=PLAIN, rip=185.93.89.27, lip=66.85.158.91, session=<aZSD1AVIHJm5XVkb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.128.27.123
country_id: 1880251
description:
Jan 10 15:38:49 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@essenceceylontea.com>, method=PLAIN, rip=178.128.27.123, lip=66.85.158.91, session=<cwfs0wVI/sCygBt7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.68.110.207
country_id: 2921044
description:
Jan 10 15:40:05 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<noreply@anandaobauae.org>, method=PLAIN, rip=138.68.110.207, lip=66.85.158.91, session=<us9j2AVIRLSKRG7P>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Jan 10 15:39:42 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@venee.lk>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<hD0V1wVIjcwz0msW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.186.104.101
country_id: 6252001
description:
2026-01-10 15:41:26 dovecot_login authenticator failed for H=wsip-184-186-104-101.lv.lv.cox.net [184.186.104.101]:47652: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.88.199
country_id: 1861060
description:
Jan 10 15:42:03 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@dataesite.lk>, method=PLAIN, rip=47.79.88.199, lip=66.85.158.91, session=<6AN83wVI/qkvT1jH>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-10 15:43:01 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (siathorism) [87.103.126.54]:50088: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.28
country_id: 290557
description:
Jan 10 15:42:08 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ceylondigest.com>, method=PLAIN, rip=185.93.89.28, lip=66.85.158.91, session=<6d/G3wVIQJa5XVkc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.204.108.39
country_id: 290557
description:
2026-01-10 15:42:16 dovecot_login authenticator failed for H=([94.204.108.39]) [94.204.108.39]:33450: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Jan 10 15:44:40 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@rehanseo.online>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<BlnY6AVIPsQvWfaQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Jan 10 15:44:41 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<aObS6AVILIsvTJuG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.175.201.167
country_id: 3469034
description:
2026-01-10 15:46:06 dovecot_login authenticator failed for H=200.175.201.167.dynamic.dialup.gvt.net.br (corporate.static.gvt.net.br) [200.175.201.167]:44618: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.253.122
country_id: 1269750
description:
2026-01-10 15:46:28 dovecot_login authenticator failed for H=([128.185.253.122]) [128.185.253.122]:39622: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 20.56.1.201
country_id: 2750405
description:
Jan 10 15:46:56 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lankaherbalsolutions.com>, method=PLAIN, rip=20.56.1.201, lip=66.85.158.91, session=<rjHx8AVIotcUOAHJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.148.174.234
country_id: 2017370
description:
2026-01-10 15:47:39 dovecot_login authenticator failed for H=([31.148.174.234]) [31.148.174.234]:55236: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.138.181
country_id: 1819730
description:
2026-01-10 15:48:01 dovecot_login authenticator failed for H=(m121-202-138-181.smartone.com) [121.202.138.181]:41300: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.27.203.227
country_id: 3439705
description:
Jan 10 15:49:05 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=179.27.203.227, lip=66.85.158.91, session=<wJia+AVI+ruzG8vj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 199.192.123.12
country_id: 6252001
description:
2026-01-10 15:50:01 dovecot_plain authenticator failed for H=(oonce) [199.192.123.12]:54152: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.57.236.167
country_id: 1819730
description:
Jan 10 15:50:11 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=47.57.236.167, lip=66.85.158.91, session=<23N5/AVIQr4vOeyn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan 10 15:50:31 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=</BvF/QVItNcFhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.27.203.227
country_id: 3439705
description:
Jan 10 15:50:33 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=179.27.203.227, lip=66.85.158.91, session=<nh3l/QVIEsuzG8vj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.225.186
country_id: 1269750
description:
2026-01-10 15:52:02 dovecot_login authenticator failed for H=([203.145.139.81]) [128.185.225.186]:33688: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan 10 15:52:09 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=</teVAwZImLlnmud6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.158
country_id: 1269750
description:
2026-01-10 15:52:15 dovecot_login authenticator failed for H=([125.19.175.68]) [152.52.236.158]:52026: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 10 15:53:33 host2 sshd[2901766]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.37.215.112
country_id: 3175395
description:
Jan 10 15:53:21 host2 sshd[2901629]: Disconnected from invalid user postgres 151.37.215.112 port 32572 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 57.129.74.123
country_id: 2921044
description:
Jan 10 15:54:16 host2 sshd[2902469]: Disconnected from invalid user ec2-user 57.129.74.123 port 64722 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.181.196.96
country_id: 3469034
description:
2026-01-10 15:55:18 dovecot_login authenticator failed for H=([45.181.196.96]) [45.181.196.96]:43333: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.25.59.5
country_id: 3469034
description:
2026-01-10 15:55:52 dovecot_login authenticator failed for H=(ip-177-25-59-5.user.vivozap.com.br) [177.25.59.5]:45721: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 57.129.74.123
country_id: 2921044
description:
Jan 10 15:55:54 host2 sshd[2904031]: Disconnected from invalid user ubuntu 57.129.74.123 port 37269 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Jan 10 15:56:08 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@nsteeleng.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<4TfWEQZIRJGPbtX3>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 57.129.74.123
country_id: 2921044
description:
Jan 10 15:56:24 host2 sshd[2904363]: Disconnected from invalid user claude 57.129.74.123 port 48551 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.169.200.254
country_id: 3469034
description:
Jan 10 15:56:28 host2 sshd[2904427]: Disconnected from invalid user claude 45.169.200.254 port 48594 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.166.197
country_id: 6252001
description:
Jan 10 15:58:35 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@kiriaswanu.com>, method=PLAIN, rip=162.240.166.197, lip=66.85.158.91, session=<zQaYGgZISL2i8KbF>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.116.22
country_id: 1861060
description:
Jan 10 15:58:23 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=139.162.116.22, lip=66.85.158.92, TLS: Connection closed, session=<Bon5GQZIVKSLonQW>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.169.200.254
country_id: 3469034
description:
Jan 10 15:58:23 host2 sshd[2905829]: Disconnected from invalid user ec2-user 45.169.200.254 port 54290 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.83.145.39
country_id: 6252001
description:
Jan 10 15:59:30 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.83.145.39, lip=66.85.158.91, TLS, session=<rND7HQZIJuEDU5En>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan 10 16:00:11 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<jTBKIAZI+Jpnmud6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.222.41.185
country_id: 1269750
description:
2026-01-10 16:00:57 dovecot_login authenticator failed for H=(static.ill.117.247.82.240.bsnl.co.in) [117.222.41.185]:37952: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 135.237.127.112
country_id: 6252001
description:
Jan 10 16:01:37 host2 pure-ftpd[2908497]: (?@135.237.127.112) [INFO] New connection from 135.237.127.112


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.73.3
country_id: 1819730
description:
2026-01-10 16:01:50 dovecot_login authenticator failed for H=42-200-73-3.static.imsbiz.com [42.200.73.3]:56883: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 52.172.177.191
country_id: 1269750
description:
Jan 10 16:02:06 host2 sshd[2908820]: Disconnected from invalid user deploy 52.172.177.191 port 58824 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.172.177.191
country_id: 1269750
description:
Jan 10 16:01:29 host2 sshd[2908350]: Disconnected from invalid user ftpuser 52.172.177.191 port 60532 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.172.177.191
country_id: 1269750
description:
Jan 10 16:02:44 host2 sshd[2909341]: Disconnected from invalid user mailadmin 52.172.177.191 port 33126 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.28
country_id: 2635167
description:
Jan 10 16:03:59 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=185.247.137.28, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<kdkALgZIi4m594kc>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.158
country_id: 2635167
description:
Jan 10 16:03:57 host2 dovecot[1180436]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=185.247.137.158, lip=66.85.158.91, TLS, session=<9HHuLQZI556594me>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.37
country_id: 2635167
description:
Jan 10 16:04:32 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.37, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<NjH8LwZIebtX7LAl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.202.197.108
country_id: 6252001
description:
2026-01-10 16:04:36 dovecot_plain authenticator failed for H=(alman) [50.202.197.108]:38860: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Jan 10 16:04:44 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<noreply@venee.lk>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<ScidMAZI/uOLO0qU>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.9
country_id: 2635167
description:
Jan 10 16:05:05 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed: read(size=679) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.9, lip=66.85.158.91, TLS handshaking: read(size=679) failed: Connection reset by peer, session=<jKX7MQZIGb+594kJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Jan 10 16:04:20 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@seyawin.com>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<oBorLwZIGKIvWfaQ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.22
country_id: 2635167
description:
Jan 10 16:05:39 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=87.236.176.22, lip=66.85.158.91, TLS handshaking: Connection closed, session=<Ir8CNAZIzcFX7LAW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.31
country_id: 2635167
description:
Jan 10 16:06:13 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed: read(size=612) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=185.247.137.31, lip=66.85.158.91, TLS handshaking: read(size=612) failed: Connection reset by peer, session=<xiL+NQZIQ4e594kf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.33
country_id: 2635167
description:
Jan 10 16:06:46 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=87.236.176.33, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<+3f3NwZI44RX7LAh>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.20
country_id: 2635167
description:
Jan 10 16:07:19 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.20, lip=66.85.158.91, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<bdj0OQZIecC594kU>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.14
country_id: 2635167
description:
Jan 10 16:07:52 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.14, lip=66.85.158.91, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<5hLwOwZI5atX7LAO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.16
country_id: 2635167
description:
Jan 10 16:08:25 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (disconnected before auth was ready, waited 0 secs): user=<>, rip=87.236.176.16, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<5oDpPQZILchX7LAQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Jan 10 16:08:48 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ceylondigest.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<BSwbPwZIIoKPbtX3>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.36
country_id: 2635167
description:
Jan 10 16:08:59 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=185.247.137.36, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<YtPkPwZIa4K594kk>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Jan 10 16:08:14 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<noreply@essenceceylontea.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<RSYQPQZITpyLO0qU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.68.110.207
country_id: 2921044
description:
Jan 10 16:10:28 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<noreply@seyawin.com>, method=PLAIN, rip=138.68.110.207, lip=66.85.158.91, session=<oKn3RAZIBNOKRG7P>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Jan 10 16:12:31 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<I7prTAZIKsEvWfaQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Jan 10 16:14:19 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<office@sivagnanamfoundation.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<G+LHUgZIAtO8putr>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 72.240.125.133
country_id: 6252001
description:
Jan 10 16:15:14 host2 sshd[2919329]: Disconnected from invalid user ubuntu 72.240.125.133 port 36792 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan 10 16:16:05 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@rehanseo.online>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<85opWQZIyJ1nmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.128.27.123
country_id: 1880251
description:
Jan 10 16:17:48 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<finance@bostonlanka.com>, method=PLAIN, rip=178.128.27.123, lip=66.85.158.91, session=<aLJKXwZIzIOygBt7>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.81.23.49
country_id: 2750405
description:
Jan 10 16:19:10 host2 sshd[2922290]: Disconnected from invalid user user1 45.81.23.49 port 60882 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.211.55.20
country_id: 2328926
description:
Jan 10 16:19:46 host2 sshd[2922815]: Disconnected from invalid user deploy 197.211.55.20 port 41888 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan 10 16:20:30 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@essenceceylontea.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<NLn1aAZIAIEFhXlo>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 197.211.55.20
country_id: 2328926
description:
Jan 10 16:21:42 host2 sshd[2924646]: Disconnected from invalid user admin 197.211.55.20 port 34790 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan 10 16:22:52 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sobaherbal.com>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<D+hvcQZIWMaOq2dI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Jan 10 16:23:07 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<amVacgZIHJmLO0qU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan 10 16:22:33 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<OCQwcAZI/OwyBvlc>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 10 16:23:48 host2 sshd[2926362]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.169.97.132
country_id: 1269750
description:
2026-01-10 16:23:58 dovecot_login authenticator failed for H=(abts-mum-static-132.97.169.122.airtelbroadband.in) [122.169.97.132]:48929: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 105.174.17.50
country_id: 3351879
description:
Jan 10 16:24:08 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=105.174.17.50, lip=66.85.158.91, session=<e8TxdQZIWoxprhEy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.128.27.123
country_id: 1880251
description:
Jan 10 16:24:15 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@venee.lk>, method=PLAIN, rip=178.128.27.123, lip=66.85.158.91, session=<+XNgdgZIpqKygBt7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.208.177.56
country_id: 6252001
description:
2026-01-10 16:24:18 dovecot_login authenticator failed for H=([74.208.177.56]) [74.208.177.56]:33856: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan 10 16:25:59 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<LEKHfAZIAJBCdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Jan 10 16:26:08 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@dataesite.lk>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<Ax4hfQZIvp6nYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan 10 16:27:21 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<U2F/gQZIoqqOq2dI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 97.74.84.186
country_id: 1880251
description:
Jan 10 16:27:36 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<noreply@mathsmotorcysle.xyz>, method=PLAIN, rip=97.74.84.186, lip=66.85.158.91, session=<WRteggZIRrZhSlS6>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 41.204.63.118
country_id: 2300660
description:
Jan 10 16:29:37 host2 sshd[2931034]: Disconnected from invalid user testftp 41.204.63.118 port 36458 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.204.63.118
country_id: 2300660
description:
Jan 10 16:30:17 host2 sshd[2931760]: Disconnected from invalid user postgres 41.204.63.118 port 34448 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.180
country_id: 2542007
description:
2026-01-10 16:34:26 dovecot_plain authenticator failed for H=(forateddle) [102.53.15.180]:2883: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.196.184.78
country_id: 6252001
description:
2026-01-10 16:35:04 dovecot_login authenticator failed for H=([74.196.184.78]) [74.196.184.78]:36446: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.237.58.117
country_id: 1269750
description:
Jan 10 16:35:05 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=103.237.58.117, lip=66.85.158.91, TLS, session=<LXIOnAZI69tn7Tp1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.219.98.56
country_id: 798544
description:
Jan 10 16:35:22 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=178.219.98.56, lip=66.85.158.91, TLS, session=<FNREnQZICd+y22I4>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.237.173.220
country_id: 6252001
description:
Jan 10 16:35:26 host2 dovecot[1180436]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.237.173.220, lip=66.85.158.92, session=<7lt8ngZI9JMD7a3c>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.227
country_id: 1819730
description:
2026-01-10 16:35:30 dovecot_login authenticator failed for H=227.42.246.220.static.netvigator.com [220.246.42.227]:54105: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.172.76.147
country_id: 6252001
description:
Jan 10 16:37:13 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=54.172.76.147, lip=66.85.158.92, TLS, session=<CHnbpAZI3JA2rEyT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan 10 16:39:00 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<A6shqwZIyJAFhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.68.110.207
country_id: 2921044
description:
Jan 10 16:38:13 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@rehanseo.online>, method=PLAIN, rip=138.68.110.207, lip=66.85.158.91, session=<yGlXqAZIVquKRG7P>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.13.220.220
country_id: 6252001
description:
2026-01-10 16:40:17 dovecot_plain authenticator failed for H=c-73-13-220-220.hsd1.de.comcast.net (ferifise) [73.13.220.220]:46738: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.93.84
country_id: 1269750
description:
2026-01-10 16:41:55 dovecot_login authenticator failed for H=([152.52.93.84]) [152.52.93.84]:10400: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.49
country_id: 290557
description:
Jan 10 16:41:59 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=185.93.89.49, lip=66.85.158.91, session=<B1LTtQZIwpy5XVkx>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.68.110.207
country_id: 2921044
description:
Jan 10 16:41:16 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=138.68.110.207, lip=66.85.158.91, session=<NlJBswZItLCKRG7P>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.114.126
country_id: 1269750
description:
2026-01-10 16:41:40 dovecot_login authenticator failed for H=([27.123.114.126]) [27.123.114.126]:48004: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.44.220.67
country_id: 3469034
description:
Jan 10 16:42:25 host2 sshd[2941591]: Disconnected from invalid user server 177.44.220.67 port 37550 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.48
country_id: 290557
description:
Jan 10 16:42:50 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=185.93.89.48, lip=66.85.158.91, session=</m7QuAZImrm5XVkw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.47
country_id: 290557
description:
Jan 10 16:42:59 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=185.93.89.47, lip=66.85.158.91, session=<snhluQZIoLK5XVkv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.49
country_id: 290557
description:
Jan 10 16:43:18 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=185.93.89.49, lip=66.85.158.91, session=<xP99ugZIrpi5XVkx>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.44.220.67
country_id: 3469034
description:
Jan 10 16:43:35 host2 sshd[2942443]: Disconnected from invalid user ftpuser 177.44.220.67 port 55678 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.47
country_id: 290557
description:
Jan 10 16:44:19 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=185.93.89.47, lip=66.85.158.91, session=<ZgEqvgZIQpG5XVkv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.128.27.123
country_id: 1880251
description:
Jan 10 16:44:22 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@essenceceylontea.com>, method=PLAIN, rip=178.128.27.123, lip=66.85.158.91, session=<YiJbvgZI+rmygBt7>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 177.44.220.67
country_id: 3469034
description:
Jan 10 16:45:04 host2 sshd[2943746]: Disconnected from invalid user testuser 177.44.220.67 port 53680 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.48
country_id: 290557
description:
Jan 10 16:44:09 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=185.93.89.48, lip=66.85.158.91, session=<zHuVvQZIhre5XVkw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.45
country_id: 290557
description:
Jan 10 16:46:03 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=185.93.89.45, lip=66.85.158.91, session=<jw5gxAZIYK+5XVkt>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Jan 10 16:45:15 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<tKWhwQZIEJADgmBb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.46
country_id: 290557
description:
Jan 10 16:45:21 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=185.93.89.46, lip=66.85.158.91, session=<OW7YwQZIYIS5XVku>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.44.220.67
country_id: 3469034
description:
Jan 10 16:45:46 host2 sshd[2944637]: Disconnected from invalid user claude 177.44.220.67 port 38570 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Jan 10 16:46:12 host2 dovecot[1180436]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<ABIGxQZI4sIDgmBb>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.44.220.67
country_id: 3469034
description:
Jan 10 16:46:28 host2 sshd[2945337]: Disconnected from invalid user test1 177.44.220.67 port 51684 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.46
country_id: 290557
description:
Jan 10 16:46:39 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=185.93.89.46, lip=66.85.158.91, session=<oMyGxgZIauy5XVku>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.6.202.106
country_id: 6252001
description:
Jan 10 16:46:53 host2 sshd[2945584]: Disconnected from invalid user server 50.6.202.106 port 46792 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.45
country_id: 290557
description:
Jan 10 16:47:24 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@bostonlanka.com>, method=PLAIN, rip=185.93.89.45, lip=66.85.158.91, session=<I9ovyQZIkLu5XVkt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.30
country_id: 290557
description:
Jan 10 16:47:41 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=185.93.89.30, lip=66.85.158.91, session=<Rsg2ygZI8uq5XVke>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Jan 10 16:47:54 host2 dovecot[1180436]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<FmcaywZIltoDgmBb>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 72.79.42.117
country_id: 6252001
description:
Jan 10 16:48:04 host2 sshd[2946504]: Disconnected from invalid user user2 72.79.42.117 port 44052 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.29
country_id: 290557
description:
Jan 10 16:48:33 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=185.93.89.29, lip=66.85.158.91, session=<CZNFzQZIiLS5XVkd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Jan 10 16:48:46 host2 dovecot[1180436]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=</1gszgZI4tgDgmBb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Jan 10 16:48:56 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@rehanseo.online>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<eryszgZIiqQvWfaQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.30
country_id: 290557
description:
Jan 10 16:49:01 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=185.93.89.30, lip=66.85.158.91, session=<3y/5zgZIZtC5XVke>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 50.6.202.106
country_id: 6252001
description:
Jan 10 16:49:27 host2 sshd[2947369]: Disconnected from invalid user testuser 50.6.202.106 port 47262 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Jan 10 16:49:30 host2 dovecot[1180436]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<cqXP0AZIvL4DgmBb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.29
country_id: 290557
description:
Jan 10 16:49:53 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=185.93.89.29, lip=66.85.158.91, session=<CUER0gZIAJO5XVkd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.83.181.181
country_id: 6252001
description:
2026-01-10 16:50:38 dovecot_plain authenticator failed for H=c-68-83-181-181.hsd1.pa.comcast.net (derpors) [68.83.181.181]:51732: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.27
country_id: 290557
description:
Jan 10 16:51:03 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=185.93.89.27, lip=66.85.158.91, session=<nTpB1gZIvOu5XVkb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Jan 10 16:50:21 host2 dovecot[1180436]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<QlnU0wZIYtMDgmBb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.62.239.4
country_id: 732800
description:
2026-01-10 16:50:23 dovecot_plain authenticator failed for H=(menes) [149.62.239.4]:40750: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 20.56.1.201
country_id: 2750405
description:
Jan 10 16:50:33 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@lankaherbalsolutions.com>, method=PLAIN, rip=20.56.1.201, lip=66.85.158.91, session=</mFv1AZIjIYUOAHJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Jan 10 16:51:22 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<5sV11wZIrqADgmBb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.215.74.195
country_id: 2661886
description:
2026-01-10 16:51:30 dovecot_plain authenticator failed for H=217-215-74-195-no2620.tbcn.telia.com (ovenoning) [217.215.74.195]:50686: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.130.96.91
country_id: 6252001
description:
Jan 10 16:51:42 host2 dovecot[1180436]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<XY+t2AZIkKMDgmBb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.28
country_id: 290557
description:
Jan 10 16:51:10 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=185.93.89.28, lip=66.85.158.91, session=<Eeet1gZIhry5XVkc>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Jan 10 16:52:18 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<uonQ2gZIoIkDgmBb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.27
country_id: 290557
description:
Jan 10 16:52:24 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=185.93.89.27, lip=66.85.158.91, session=<3W4H2wZIhpy5XVkb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.28
country_id: 290557
description:
Jan 10 16:52:31 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=185.93.89.28, lip=66.85.158.91, session=<Ytx+2wZIoJ+5XVkc>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.130.96.91
country_id: 6252001
description:
Jan 10 16:52:36 host2 dovecot[1180436]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<UiXp2wZIEpwDgmBb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.215.95.14
country_id: 6252001
description:
2026-01-10 16:53:19 dovecot_plain authenticator failed for H=(ancove) [50.215.95.14]:54696: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.22.242.162
country_id: 1880251
description:
Jan 10 16:53:52 host2 pure-ftpd[2950724]: (?@165.22.242.162) [INFO] New connection from 165.22.242.162


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Jan 10 16:53:59 host2 dovecot[1180436]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<kTDe4AZIkKUDgmBb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.27.203.227
country_id: 3439705
description:
Jan 10 16:54:33 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@nsteeleng.com>, method=PLAIN, rip=179.27.203.227, lip=66.85.158.91, session=<y6C44gZIYoGzG8vj>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Jan 10 16:54:48 host2 dovecot[1180436]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<TpjC4wZIloYDgmBb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.27.203.227
country_id: 3439705
description:
Jan 10 16:56:02 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ceylondigest.com>, method=PLAIN, rip=179.27.203.227, lip=66.85.158.91, session=<XfcO6AZIoL2zG8vj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan 10 16:55:37 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<v5GK5gZIbo8FhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.57.236.167
country_id: 1819730
description:
Jan 10 16:57:04 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sivagnanamfoundation.com>, method=PLAIN, rip=47.57.236.167, lip=66.85.158.91, session=<Q4G86wZIescvOeyn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan 10 16:57:16 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<D0Bw7AZIOrJnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Jan 10 16:58:44 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@nsteeleng.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<Qoe28QZIKpePbtX3>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 158.174.210.161
country_id: 2661886
description:
Jan 10 17:00:04 host2 sshd[2956295]: Disconnected from invalid user user 158.174.210.161 port 2979 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.166.197
country_id: 6252001
description:
Jan 10 17:02:06 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@kiriaswanu.com>, method=PLAIN, rip=162.240.166.197, lip=66.85.158.91, session=<25G9/QZIaLGi8KbF>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.174.210.161
country_id: 2661886
description:
Jan 10 17:01:18 host2 sshd[2957305]: Disconnected from invalid user frappe 158.174.210.161 port 6289 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.176.126
country_id: 1269750
description:
2026-01-10 17:01:26 dovecot_login authenticator failed for H=([27.123.119.235]) [122.185.176.126]:41950: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.23.140
country_id: 3144096
description:
2026-01-10 17:01:38 dovecot_login authenticator failed for H=([178.232.23.140]) [178.232.23.140]:42914: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.22.242.162
country_id: 1880251
description:
Jan 10 17:01:40 host2 pure-ftpd[2957586]: (?@165.22.242.162) [INFO] New connection from 165.22.242.162


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.93.89.49
country_id: 290557
description:
Jan 10 17:02:27 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=185.93.89.49, lip=66.85.158.91, session=<Drn3/gZIWp25XVkx>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 4.211.84.189
country_id: 3017382
description:
Jan 10 17:02:45 host2 sshd[2958481]: Disconnected from invalid user testuser 4.211.84.189 port 44574 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 4.211.84.189
country_id: 3017382
description:
Jan 10 17:03:21 host2 sshd[2959013]: Disconnected from invalid user user2 4.211.84.189 port 49970 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.93.89.48
country_id: 290557
description:
Jan 10 17:03:36 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=185.93.89.48, lip=66.85.158.91, session=<2zgWAwdIOt+5XVkw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.47
country_id: 290557
description:
Jan 10 17:03:49 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=185.93.89.47, lip=66.85.158.91, session=<eOHhAwdIlIC5XVkv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan 10 17:05:26 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<zXCpCQdIRoZnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.46
country_id: 290557
description:
Jan 10 17:05:49 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=185.93.89.46, lip=66.85.158.91, session=<ocoOCwdIdoW5XVku>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.45
country_id: 290557
description:
Jan 10 17:06:57 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=185.93.89.45, lip=66.85.158.91, session=<KjgWDwdIjri5XVkt>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.93.89.30
country_id: 290557
description:
Jan 10 17:08:26 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=185.93.89.30, lip=66.85.158.91, session=<MJZfFAdIUty5XVke>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Jan 10 17:09:01 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@seyawin.com>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<wPd6FgdImr8vWfaQ>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.212
country_id: 2635167
description:
Jan 10 17:09:28 host2 dovecot[1180436]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=87.236.176.212, lip=66.85.158.91, TLS, session=<Tso5GAdI3+hX7LDU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Jan 10 17:09:22 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@venee.lk>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<QAC7FwdIluSLO0qU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.29
country_id: 290557
description:
Jan 10 17:09:25 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=185.93.89.29, lip=66.85.158.91, session=<8nTtFwdIWtW5XVkd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.28
country_id: 290557
description:
Jan 10 17:12:07 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=185.93.89.28, lip=66.85.158.91, session=<rMeZIQdI0MC5XVkc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Jan 10 17:11:41 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@ceylondigest.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<R00GIAdIbuqPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.27
country_id: 290557
description:
Jan 10 17:11:40 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=185.93.89.27, lip=66.85.158.91, session=<QFHwHwdInNu5XVkb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.68.110.207
country_id: 2921044
description:
Jan 10 17:11:51 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@seyawin.com>, method=PLAIN, rip=138.68.110.207, lip=66.85.158.91, session=<ihyXIAdIuNyKRG7P>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.191.124.201
country_id: 1269750
description:
2026-01-10 17:13:20 dovecot_login authenticator failed for H=([160.191.124.201]) [160.191.124.201]:59054: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.154.173
country_id: 1733045
description:
2026-01-10 17:13:45 dovecot_login authenticator failed for H=([49.124.154.173]) [49.124.154.173]:59406: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.146.222
country_id: 3996063
description:
2026-01-10 17:15:51 dovecot_login authenticator failed for H=([177.236.146.222]) [177.236.146.222]:47748: 535 Incorrect authentication data (set_id=reception@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.144
country_id: 3017382
description:
Jan 10 17:15:50 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=91.196.152.144, lip=66.85.158.92, session=<4Pf5LgdIP7JbxJiQ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.146
country_id: 3017382
description:
Jan 10 17:16:00 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=91.196.152.146, lip=66.85.158.92, session=<mNeXLwdIPctbxJiS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.192.162
country_id: 1269750
description:
2026-01-10 17:16:18 dovecot_login authenticator failed for H=([125.19.171.114]) [152.52.192.162]:47526: 535 Incorrect authentication data (set_id=reception)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.160
country_id: 3017382
description:
Jan 10 17:16:22 host2 dovecot[1180436]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=91.196.152.160, lip=66.85.158.92, session=<cHbdMAdIz9FbxJig>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.149
country_id: 3017382
description:
Jan 10 17:16:25 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.196.152.149, lip=66.85.158.92, session=<zQYQMQdI0cBbxJiV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Jan 10 17:17:18 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<zPkdNAdIEuEvWfaQ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.57.216.142
country_id: 1168579
description:
Jan 10 17:18:08 host2 sshd[2971497]: Disconnected from invalid user postgres 154.57.216.142 port 11524 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.98.55.71
country_id: 6252001
description:
Jan 10 17:19:05 host2 sshd[2972140]: Disconnected from invalid user erpnext 198.98.55.71 port 60132 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.57.216.142
country_id: 1168579
description:
Jan 10 17:20:49 host2 sshd[2973740]: Disconnected from invalid user frappe 154.57.216.142 port 57746 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan 10 17:21:35 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@rehanseo.online>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<xZ1qQwdIxMNnmud6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.23.72.254
country_id: 6252001
description:
2026-01-10 17:21:51 dovecot_login authenticator failed for H=([209.23.72.254]) [209.23.72.254]:36588: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.231.114
country_id: 1269750
description:
2026-01-10 17:22:05 dovecot_login authenticator failed for H=([182.95.20.113]) [128.185.231.114]:59350: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Jan 10 17:21:09 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@sivagnanamfoundation.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<EJ7YQQdIkoC8putr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.57.216.142
country_id: 1168579
description:
Jan 10 17:21:28 host2 sshd[2974330]: Disconnected from invalid user user2 154.57.216.142 port 2716 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.188.251
country_id: 290557
description:
2026-01-10 17:22:12 dovecot_plain authenticator failed for H=(mible) [91.73.188.251]:44979: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.227.25.115
country_id: 6252001
description:
2026-01-10 17:22:14 dovecot_plain authenticator failed for H=c-98-227-25-115.hsd1.il.comcast.net (stiong) [98.227.25.115]:48492: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.98.55.71
country_id: 6252001
description:
Jan 10 17:23:14 host2 sshd[2975573]: Disconnected from invalid user user2 198.98.55.71 port 48472 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.128.27.123
country_id: 1880251
description:
Jan 10 17:24:05 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@bostonlanka.com>, method=PLAIN, rip=178.128.27.123, lip=66.85.158.91, session=<qj9aTAdItqKygBt7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan 10 17:24:18 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sobaherbal.com>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<950kTQdIfNGOq2dI>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 198.98.55.71
country_id: 6252001
description:
Jan 10 17:24:54 host2 sshd[2976612]: Disconnected from invalid user deploy 198.98.55.71 port 44926 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan 10 17:25:47 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<VZprUgdI9s8FhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan 10 17:25:53 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<fVHMUgdI1J4yBvlc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.127.53.61
country_id: 6252001
description:
2026-01-10 17:25:10 dovecot_plain authenticator failed for H=c-24-127-53-61.hsd1.mi.comcast.net (cagerriage) [24.127.53.61]:33684: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.117.57.134
country_id: 1643084
description:
Jan 10 17:26:39 host2 sshd[2978144]: Disconnected from invalid user ftpuser 103.117.57.134 port 55990 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.238.191.229
country_id: 6252001
description:
Jan 10 17:27:43 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=3.238.191.229, lip=66.85.158.91, TLS, session=<pBx0WQdIDo4D7r/l>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 111.68.107.91
country_id: 1168579
description:
Jan 10 17:27:48 host2 sshd[2979108]: Disconnected from invalid user ubuntu 111.68.107.91 port 48254 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Jan 10 17:28:04 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<5t6dWgdIjo6LO0qU>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.117.57.134
country_id: 1643084
description:
Jan 10 17:29:00 host2 sshd[2979902]: Disconnected from invalid user erpnext 103.117.57.134 port 53810 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan 10 17:28:52 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@melanifinefood.com>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<n4V3XQdIup6Oq2dI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 105.174.17.50
country_id: 3351879
description:
Jan 10 17:28:55 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=105.174.17.50, lip=66.85.158.91, session=<5TyiXQdIAsxprhEy>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.172.76.147
country_id: 6252001
description:
Jan 10 17:29:16 host2 dovecot[1180436]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=54.172.76.147, lip=66.85.158.92, session=<vYYNXwdIIqU2rEyT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.128.27.123
country_id: 1880251
description:
Jan 10 17:30:37 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@venee.lk>, method=PLAIN, rip=178.128.27.123, lip=66.85.158.91, session=<XM22YwdI3pWygBt7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Jan 10 17:31:07 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@dataesite.lk>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<auqDZQdIojunYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan 10 17:32:14 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 9 secs): user=<sales@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<z44YaQdIKqVCdMzo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.127.128
country_id: 3144096
description:
2026-01-10 17:38:03 dovecot_login authenticator failed for H=(cm-46.212.127.128.get.no) [46.212.127.128]:42166: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 97.74.84.186
country_id: 1880251
description:
Jan 10 17:38:25 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=97.74.84.186, lip=66.85.158.91, session=<iQGgfwdIFrJhSlS6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.222.113.194
country_id: 1269750
description:
2026-01-10 17:38:37 dovecot_login authenticator failed for H=(static.ill.117.247.82.240.bsnl.co.in) [117.222.113.194]:33400: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 111.68.107.91
country_id: 1168579
description:
Jan 10 17:40:05 host2 sshd[2988579]: Disconnected from invalid user postgres 111.68.107.91 port 60686 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.236.163
country_id: 6252001
description:
2026-01-10 17:39:45 dovecot_plain authenticator failed for H=c-73-197-236-163.hsd1.nj.comcast.net (tanalpal) [73.197.236.163]:55342: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.68.110.207
country_id: 2921044
description:
Jan 10 17:39:55 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@rehanseo.online>, method=PLAIN, rip=138.68.110.207, lip=66.85.158.91, session=<BwMAhQdIQKWKRG7P>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 10 17:40:21 host2 sshd[2988883]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.128.209.48
country_id: 3469034
description:
2026-01-10 17:40:16 dovecot_login authenticator failed for H=(138.219.244.10.static.softdados.net) [177.128.209.48]:53354: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.224.62.206
country_id: 2464461
description:
2026-01-10 17:40:34 dovecot_login authenticator failed for H=([41.224.62.206]) [41.224.62.206]:47828: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.193.112.85
country_id: 6252001
description:
2026-01-10 17:40:49 dovecot_plain authenticator failed for H=c-98-193-112-85.hsd1.il.comcast.net (cizer) [98.193.112.85]:55902: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.68.110.207
country_id: 2921044
description:
Jan 10 17:43:01 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=138.68.110.207, lip=66.85.158.91, session=<xCMQkAdIcNyKRG7P>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan 10 17:42:18 host2 sshd[2990470]: Disconnected from invalid user admin 2.57.121.112 port 56332 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan 10 17:44:29 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@venee.lk>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<049LlQdIdLMFhXlo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.109.38.143
country_id: 6252001
description:
2026-01-10 17:48:53 dovecot_login authenticator failed for H=143.38.109.208.host.secureserver.net [208.109.38.143]:41586: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.60.144.54
country_id: 2510769
description:
2026-01-10 17:49:22 dovecot_login authenticator failed for H=([47.60.144.54]) [47.60.144.54]:58548: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 144.76.56.36
country_id: 2921044
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 144.76.56.36 - lezzarot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarot (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.128.27.123
country_id: 1880251
description:
Jan 10 17:50:59 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=178.128.27.123, lip=66.85.158.91, session=<9TaPrAdInJeygBt7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.148.174.234
country_id: 2017370
description:
2026-01-10 17:51:44 dovecot_login authenticator failed for H=([31.148.174.234]) [31.148.174.234]:56946: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Jan 10 17:54:17 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<noreply@rehanseo.online>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<g29ZuAdISIovWfaQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 20.56.1.201
country_id: 2750405
description:
Jan 10 17:55:06 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=20.56.1.201, lip=66.85.158.91, session=<7EJEuwdIhr0UOAHJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.27.203.227
country_id: 3439705
description:
Jan 10 18:01:41 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@nsteeleng.com>, method=PLAIN, rip=179.27.203.227, lip=66.85.158.91, session=<J2bO0gdIHMyzG8vj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan 10 18:01:19 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<eiF/0QdI4NIFhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.27.203.227
country_id: 3439705
description:
Jan 10 18:03:13 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ceylondigest.com>, method=PLAIN, rip=179.27.203.227, lip=66.85.158.91, session=<76BN2AdI3sSzG8vj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-10 18:03:15 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (typer) [87.103.126.54]:21207: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan 10 18:03:15 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<tIF12AdITJxnmud6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.131.63
country_id: 99237
description:
2026-01-10 18:04:37 dovecot_login authenticator failed for H=([65.20.131.63]) [65.20.131.63]:44573: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.119.118
country_id: 1269750
description:
2026-01-10 18:04:49 dovecot_login authenticator failed for H=([182.95.119.118]) [182.95.119.118]:34244: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.57.236.167
country_id: 1819730
description:
Jan 10 18:04:53 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@sivagnanamfoundation.com>, method=PLAIN, rip=47.57.236.167, lip=66.85.158.91, session=<TqI03gdIptAvOeyn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.88.199
country_id: 1861060
description:
Jan 10 18:06:12 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@dataesite.lk>, method=PLAIN, rip=47.79.88.199, lip=66.85.158.91, session=<mXX54gdIIsMvT1jH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.166.197
country_id: 6252001
description:
Jan 10 18:06:29 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@kiriaswanu.com>, method=PLAIN, rip=162.240.166.197, lip=66.85.158.91, session=<pwYI5AdIBJ6i8KbF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.25.232.7
country_id: 953987
description:
Jan 10 18:07:58 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<amila@euroentertainmentlk.com>, method=PLAIN, rip=41.25.232.7, lip=66.85.158.91, session=<KsxQ6QdIgcwpGegH>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 10 18:11:07 host2 sshd[3019503]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.173.58.47
country_id: 6252001
description:
2026-01-10 18:10:52 dovecot_plain authenticator failed for H=c-67-173-58-47.hsd1.il.comcast.net (suffer) [67.173.58.47]:53146: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 10 18:12:03 host2 sshd[3020293]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan 10 18:11:30 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<ovHw9QdIqpNnmud6>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 138.68.110.207
country_id: 2921044
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[138.68.110.207] [Remote Port]=[40888] [Authentication Database]=[mail] [Username]=[office@seyawin.com] (10/10 failures) (blocked until [Sun Jan 11 12:43:43 2026 UTC/Sun Jan 11 18:13:43 2026 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Jan 10 18:14:35 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@venee.lk>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<oSX+AAhIar2LO0qU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.68.110.207
country_id: 2921044
description:
Jan 10 18:13:45 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@seyawin.com>, method=PLAIN, rip=138.68.110.207, lip=66.85.158.91, session=<iOH9/QdIuJ+KRG7P>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Jan 10 18:14:32 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<noreply@seyawin.com>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<jjPNAAhIvoAvWfaQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.49
country_id: 290557
description:
Jan 10 18:16:09 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=185.93.89.49, lip=66.85.158.91, session=<6XyUBghIfIm5XVkx>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.48
country_id: 290557
description:
Jan 10 18:17:43 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=185.93.89.48, lip=66.85.158.91, session=<YGMwDAhIdrK5XVkw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Jan 10 18:18:08 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@essenceceylontea.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<lyKlDQhIdqSLO0qU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.47
country_id: 290557
description:
Jan 10 18:18:39 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@dataesite.lk>, method=PLAIN, rip=185.93.89.47, lip=66.85.158.91, session=<BoN6DwhINsa5XVkv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.46
country_id: 290557
description:
Jan 10 18:19:48 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@dataesite.lk>, method=PLAIN, rip=185.93.89.46, lip=66.85.158.91, session=<zoWlEwhIOLi5XVku>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 199.192.123.12
country_id: 6252001
description:
2026-01-10 18:20:59 dovecot_plain authenticator failed for H=(pares) [199.192.123.12]:35674: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.190.155.43
country_id: 6252001
description:
2026-01-10 18:20:26 dovecot_plain authenticator failed for H=(unetopany) [76.190.155.43]:55162: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.30
country_id: 290557
description:
Jan 10 18:23:06 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=185.93.89.30, lip=66.85.158.91, session=<zTB0HwhILom5XVke>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.45
country_id: 290557
description:
Jan 10 18:22:10 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@dataesite.lk>, method=PLAIN, rip=185.93.89.45, lip=66.85.158.91, session=<xisPHAhIfJe5XVkt>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.72.87.7
country_id: 3469034
description:
2026-01-10 18:22:29 dovecot_login authenticator failed for H=177-72-87-7.static.as262543.net.br [177.72.87.7]:50350: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Jan 10 18:22:58 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<noreply@anandaobauae.org>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<vYz2HghI/oUvWfaQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.29
country_id: 290557
description:
Jan 10 18:24:26 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@dataesite.lk>, method=PLAIN, rip=185.93.89.29, lip=66.85.158.91, session=<X1MtJAhISqW5XVkd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.27
country_id: 290557
description:
Jan 10 18:25:42 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@dataesite.lk>, method=PLAIN, rip=185.93.89.27, lip=66.85.158.91, session=<0U29KAhInrG5XVkb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.125.248.7
country_id: 798544
description:
Jan 10 18:26:22 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 13 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=109.125.248.7, lip=66.85.158.91, session=<GmJvKghIW5htffgH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.0.30.150
country_id: 226074
description:
Jan 10 18:26:39 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=196.0.30.150, lip=66.85.158.91, TLS, session=<FUQcKwhI16nEAB6W>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.217.12.152
country_id: 690791
description:
Jan 10 18:26:39 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=91.217.12.152, lip=66.85.158.91, TLS, session=<9SJEKwhIH8hb2QyY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.249.134
country_id: 3865483
description:
Jan 10 18:27:01 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<hr>, method=PLAIN, rip=179.0.249.134, lip=66.85.158.91, TLS, session=<HhxtLAhIBJ6zAPmG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.28
country_id: 290557
description:
Jan 10 18:27:22 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@dataesite.lk>, method=PLAIN, rip=185.93.89.28, lip=66.85.158.91, session=<j+amLghIeOq5XVkc>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 54.37.131.169
country_id: 3017382
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 54.37.131.169 - vdeploy "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.92.146.210
country_id: 1819730
description:
Jan 10 18:30:53 host2 sshd[3039665]: Disconnected from invalid user hemant 34.92.146.210 port 42906 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 34.92.146.210
country_id: 1819730
description:
Jan 10 18:32:53 host2 sshd[3041779]: Disconnected from invalid user indira 34.92.146.210 port 48236 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.92.146.210
country_id: 1819730
description:
Jan 10 18:32:12 host2 sshd[3041230]: Disconnected from invalid user sanjib 34.92.146.210 port 34902 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.166
country_id: 1269750
description:
2026-01-10 18:34:20 dovecot_login authenticator failed for H=([182.95.181.166]) [182.95.181.166]:60614: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.70.134
country_id: 1819730
description:
2026-01-10 18:34:39 dovecot_login authenticator failed for H=42-200-70-134.static.imsbiz.com [42.200.70.134]:55688: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.92.146.210
country_id: 1819730
description:
Jan 10 18:35:31 host2 sshd[3044018]: Disconnected from invalid user ramachandra 34.92.146.210 port 45236 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.184.114
country_id: 1269750
description:
2026-01-10 18:39:16 dovecot_login authenticator failed for H=(aes-static-065.58.246.61.airtel.in) [182.95.184.114]:57962: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.30.212.99
country_id: 298795
description:
2026-01-10 18:39:36 dovecot_login authenticator failed for H=([176.30.212.99]) [176.30.212.99]:46070: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.74.136.134
country_id: 6252001
description:
2026-01-10 18:43:21 dovecot_plain authenticator failed for H=syn-050-074-136-134.biz.spectrum.com (overesmary) [50.74.136.134]:59540: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 20.56.1.201
country_id: 2750405
description:
Jan 10 18:43:52 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<contact@seyawin.com>, method=PLAIN, rip=20.56.1.201, lip=66.85.158.91, session=<VSiYaQhI5pkUOAHJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan 10 18:45:05 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=<qakHbghIxLVm2gqW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan 10 18:45:19 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@nsteeleng.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<kTnebghI1K5CdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Jan 10 18:45:59 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@dataesite.lk>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<8tg6cQhIIuIv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 72.167.34.120
country_id: 6252001
description:
Jan 10 18:46:09 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=72.167.34.120, lip=66.85.158.91, session=<NarbcQhIfMRIpyJ4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 105.174.17.50
country_id: 3351879
description:
Jan 10 18:46:19 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<postfix@anandaobauae.org>, method=PLAIN, rip=105.174.17.50, lip=66.85.158.91, session=<0C5hcghILIBprhEy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.82.89
country_id: 6252001
description:
Jan 10 18:46:23 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=47.253.82.89, lip=66.85.158.91, session=<BZOmcghIzsQv/VJZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan 10 18:46:29 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<P3kQcwhIaNgvWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Jan 10 18:47:42 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<office@mathsmotorcysle.xyz>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<MuJTdwhITr28putr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Jan 10 18:47:51 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sobaherbal.com>, method=PLAIN, rip=165.211.25.202, lip=66.85.158.91, session=<XC7zdwhISu2l0xnK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 141.94.22.51
country_id: 3017382
description:
Jan 10 18:50:04 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<help@essenceceylontea.com>, method=PLAIN, rip=141.94.22.51, lip=66.85.158.91, session=<IxjDfwhIRreNXhYz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan 10 18:49:16 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<postfix@seyawin.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<usrcfAhICLqi8GQy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.217.40.11
country_id: 6252001
description:
2026-01-10 18:49:31 dovecot_plain authenticator failed for H=(syctacks) [50.217.40.11]:48726: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.205.197
country_id: 99237
description:
2026-01-10 18:49:36 dovecot_plain authenticator failed for H=(conate) [65.20.205.197]:54506: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 105.174.17.50
country_id: 3351879
description:
Jan 10 18:52:16 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@bostonlanka.com>, method=PLAIN, rip=105.174.17.50, lip=66.85.158.91, session=<t1e+hwhIs35prhEy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.194.98
country_id: 6252001
description:
2026-01-10 18:52:42 dovecot_plain authenticator failed for H=c-73-197-194-98.hsd1.nj.comcast.net (ticies) [73.197.194.98]:54244: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.222.24.142
country_id: 241170
description:
Jan 10 18:52:50 host2 sshd[3061210]: Disconnected from invalid user gulshan 154.222.24.142 port 36022 [preauth]


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 85.217.149.12
country_id: 798549
description:
Jan 10 18:53:42 host2 pure-ftpd[3062163]: (?@85.217.149.12) [INFO] New connection from 85.217.149.12


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-10 18:53:51 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (lantics) [87.103.126.54]:24942: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.82.89
country_id: 6252001
description:
Jan 10 18:53:21 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@venee.lk>, method=PLAIN, rip=47.253.82.89, lip=66.85.158.91, session=<otGNiwhIztkv/VJZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.68.110.207
country_id: 2921044
description:
Jan 10 18:53:22 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@sivagnanamfoundation.com>, method=PLAIN, rip=138.68.110.207, lip=66.85.158.91, session=<SpmviwhIkt2KRG7P>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 182.184.118.5
country_id: 1168579
description:
Jan 10 18:53:31 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@essenceceylontea.com>, method=PLAIN, rip=182.184.118.5, lip=66.85.158.91, session=<ed8vjAhIuBu2uHYF>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 85.217.149.12
country_id: 798549
description:
Jan 10 18:53:38 host2 pure-ftpd[3062089]: (?@85.217.149.12) [INFO] New connection from 85.217.149.12


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.49
country_id: 290557
description:
Jan 10 18:54:43 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=185.93.89.49, lip=66.85.158.91, session=<AACDkAhI8sK5XVkx>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan 10 18:54:39 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@nsteeleng.com>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=<a744kAhIMrdm2gqW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Jan 10 18:55:09 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<hr@kiriaswanu.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<lhH1kQhIjMQv/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.48
country_id: 290557
description:
Jan 10 18:56:24 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=185.93.89.48, lip=66.85.158.91, session=<y0h4lghIrt65XVkw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan 10 18:56:39 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@seyawin.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<FY9mlwhIL5R100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Jan 10 18:56:53 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@venee.lk>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<l7FCmAhICqC8putr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 135.235.33.79
country_id: 6252001
description:
Jan 10 18:57:28 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@seyawin.com>, method=PLAIN, rip=135.235.33.79, lip=66.85.158.91, session=<VnhUmghI+MeH6yFP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.105.156.165
country_id: 3923057
description:
Jan 10 18:57:57 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@rehanseo.online>, method=PLAIN, rip=200.105.156.165, lip=66.85.158.91, session=<RJETnAhICNTIaZyl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan 10 18:57:58 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sivagnanamfoundation.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<+YAdnAhIbNBnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.47
country_id: 290557
description:
Jan 10 18:58:44 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sivagnanamfoundation.com>, method=PLAIN, rip=185.93.89.47, lip=66.85.158.91, session=<T3rfnghITpC5XVkv>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.222.24.142
country_id: 241170
description:
Jan 10 18:58:21 host2 sshd[3067235]: Disconnected from invalid user rajeev 154.222.24.142 port 59416 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.46
country_id: 290557
description:
Jan 10 18:58:31 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@sivagnanamfoundation.com>, method=PLAIN, rip=185.93.89.46, lip=66.85.158.91, session=<UxEPnghIRuO5XVku>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.29.26
country_id: 3144096
description:
2026-01-10 19:00:16 dovecot_login authenticator failed for H=(cm-178.232.29.26.get.no) [178.232.29.26]:36409: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan 10 19:00:28 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@ceylondigest.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<ZaIQpQhImoRCdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.30
country_id: 290557
description:
Jan 10 19:02:06 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=185.93.89.30, lip=66.85.158.91, session=<EJrrqghI1oe5XVke>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 71.6.146.185
country_id: 6252001
description:
Jan 10 19:02:44 host2 dovecot[1180436]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=71.6.146.185, lip=66.85.158.91, session=<iVVMrQhI6uZHBpK5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.45
country_id: 290557
description:
Jan 10 19:02:55 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@sivagnanamfoundation.com>, method=PLAIN, rip=185.93.89.45, lip=66.85.158.91, session=<2r7UrQhIMqG5XVkt>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.54
country_id: 3144096
description:
2026-01-10 19:05:00 dovecot_login authenticator failed for H=(54-170-97-62.cust.smartcall.no) [62.97.170.54]:37980: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.29
country_id: 290557
description:
Jan 10 19:05:05 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sivagnanamfoundation.com>, method=PLAIN, rip=185.93.89.29, lip=66.85.158.91, session=<fLaLtQhI3uO5XVkd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.51
country_id: 3144096
description:
2026-01-10 19:05:12 dovecot_login authenticator failed for H=(51-170-97-62.cust.smartcall.no) [62.97.170.51]:54645: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.161.114.113
country_id: 2017370
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 195.161.114.113 - lezzarot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarot (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.28
country_id: 290557
description:
Jan 10 19:06:47 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sivagnanamfoundation.com>, method=PLAIN, rip=185.93.89.28, lip=66.85.158.91, session=<2/iouwhIBs+5XVkc>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.233.118.22
country_id: 3469034
description:
Jan 10 19:09:34 host2 sshd[3077994]: Disconnected from invalid user frappe 186.233.118.22 port 34876 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.216.33.31
country_id: 1269750
description:
2026-01-10 19:09:46 dovecot_login authenticator failed for H=([117.216.33.31]) [117.216.33.31]:50966: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.233.235.203
country_id: 2661886
description:
2026-01-10 19:10:02 dovecot_login authenticator failed for H=81-233-235-203-no600.tbcn.telia.com [81.233.235.203]:32820: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
country_id: 6252001
description:
2026-01-10 19:10:20 dovecot_login authenticator failed for H=([24.187.213.29]) [24.187.213.29]:39894: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.186.81.8
country_id: 3469034
description:
2026-01-10 19:10:57 dovecot_login authenticator failed for H=([45.186.81.8]) [45.186.81.8]:47315: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 5.95.121.178
country_id: 3175395
description:
Jan 10 19:12:57 host2 sshd[3081242]: Disconnected from invalid user user 5.95.121.178 port 54506 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.210.77.100
country_id: 3996063
description:
Jan 10 19:12:27 host2 sshd[3080784]: Disconnected from invalid user user1 187.210.77.100 port 34846 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 201.184.50.251
country_id: 3686110
description:
Jan 10 19:14:43 host2 sshd[3083257]: Disconnected from invalid user secret 201.184.50.251 port 49352 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.233.118.22
country_id: 3469034
description:
Jan 10 19:15:19 host2 sshd[3084119]: Disconnected from invalid user test1 186.233.118.22 port 58816 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 78.100.64.148
country_id: 289688
description:
Jan 10 19:15:24 host2 sshd[3084172]: Disconnected from invalid user steam 78.100.64.148 port 13911 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.210.77.100
country_id: 3996063
description:
Jan 10 19:15:40 host2 sshd[3084419]: Disconnected from invalid user vpn 187.210.77.100 port 57530 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.233.118.22
country_id: 3469034
description:
Jan 10 19:16:02 host2 sshd[3084788]: Disconnected from invalid user frappe 186.233.118.22 port 34326 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 78.100.64.148
country_id: 289688
description:
Jan 10 19:16:05 host2 sshd[3084871]: Disconnected from invalid user frappe 78.100.64.148 port 37560 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.233.118.22
country_id: 3469034
description:
Jan 10 19:17:25 host2 sshd[3086263]: Disconnected from invalid user frappe 186.233.118.22 port 44244 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 5.95.121.178
country_id: 3175395
description:
Jan 10 19:17:34 host2 sshd[3086419]: Disconnected from invalid user frappe 5.95.121.178 port 41208 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.125.175.117
country_id: 1643084
description:
2026-01-10 19:18:31 dovecot_plain authenticator failed for H=(P756S1ACH72QLPV) [103.125.175.117]:64607: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.230.142
country_id: 1269750
description:
2026-01-10 19:18:48 dovecot_login authenticator failed for H=([182.79.202.89]) [182.95.230.142]:44136: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 103.125.175.117
country_id: 1643084
description:
Login Blocked: IP reached maximum auth failures [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Remote IP Address]=[103.125.175.117] [Authentication Database]=[mail] (5/5 failures) (blocked until [Sat Jan 10 14:03:46 2026 UTC/Sat Jan 10 19:33:46 2026 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.49
country_id: 290557
description:
Jan 10 19:18:50 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=185.93.89.49, lip=66.85.158.91, session=<5P/C5ghIrs65XVkx>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.168
country_id: 2186224
description:
2026-01-10 19:18:22 dovecot_login authenticator failed for H=([121.73.163.168]) [121.73.163.168]:48288: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.210.77.100
country_id: 3996063
description:
Jan 10 19:18:26 host2 sshd[3087383]: Disconnected from invalid user user 187.210.77.100 port 36716 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.210.77.100
country_id: 3996063
description:
Jan 10 19:19:44 host2 sshd[3088603]: Disconnected from invalid user deployerer 187.210.77.100 port 50374 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.48
country_id: 290557
description:
Jan 10 19:20:32 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=185.93.89.48, lip=66.85.158.91, session=<oD/O7AhICoW5XVkw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.46
country_id: 290557
description:
Jan 10 19:22:41 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=185.93.89.46, lip=66.85.158.91, session=<2HGK9AhIeOC5XVku>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.47
country_id: 290557
description:
Jan 10 19:22:58 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=185.93.89.47, lip=66.85.158.91, session=<Z6KA9QhI3tK5XVkv>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.22.242.162
country_id: 1880251
description:
Jan 10 19:25:40 host2 pure-ftpd[3095267]: (?@165.22.242.162) [INFO] New connection from 165.22.242.162


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.213.236.66
country_id: 6252001
description:
2026-01-10 19:26:06 dovecot_plain authenticator failed for H=c-73-213-236-66.hsd1.va.comcast.net (rellary) [73.213.236.66]:57438: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.30
country_id: 290557
description:
Jan 10 19:26:24 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=185.93.89.30, lip=66.85.158.91, session=<HKXNAQlIurC5XVke>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 10 19:28:06 host2 sshd[3098167]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.45
country_id: 290557
description:
Jan 10 19:27:28 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@seyawin.com>, method=PLAIN, rip=185.93.89.45, lip=66.85.158.91, session=<BIuWBQlIyue5XVkt>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.188.252.208
country_id: 6252001
description:
2026-01-10 19:28:21 dovecot_plain authenticator failed for H=c-73-188-252-208.hsd1.pa.comcast.net (andaess) [73.188.252.208]:51582: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.29
country_id: 290557
description:
Jan 10 19:29:30 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=185.93.89.29, lip=66.85.158.91, session=<HEXjDAlIRre5XVkd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.28
country_id: 290557
description:
Jan 10 19:31:20 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@seyawin.com>, method=PLAIN, rip=185.93.89.28, lip=66.85.158.91, session=<TxdsEwlIgsu5XVkc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan 10 19:32:02 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<CJv0FQlIgdd100Db>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.22.242.162
country_id: 1880251
description:
Jan 10 19:33:58 host2 pure-ftpd[3104551]: (?@165.22.242.162) [INFO] New connection from 165.22.242.162


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2026-01-10 19:36:13 dovecot_plain authenticator failed for H=(flatic) [102.53.15.56]:38885: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.206
country_id: 1269750
description:
2026-01-10 19:38:12 dovecot_login authenticator failed for H=([125.20.154.97]) [182.95.178.206]:44396: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan 10 19:39:34 host2 sshd[3110201]: Disconnected from invalid user admin 2.57.121.112 port 48001 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.76
country_id: 2635167
description:
Jan 10 19:41:19 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=185.247.137.76, lip=66.85.158.91, TLS handshaking: Connection closed, session=<K+hMNwlIC7+594lM>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.250
country_id: 2635167
description:
Jan 10 19:40:39 host2 dovecot[1180436]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=87.236.176.250, lip=66.85.158.91, TLS, session=<HdHnNAlIYZxX7LD6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.79
country_id: 2635167
description:
Jan 10 19:40:45 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.79, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<Z0NCNQlIy99X7LBP>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 10 19:41:28 host2 sshd[3112501]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.92
country_id: 2635167
description:
Jan 10 19:41:53 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed: read(size=679) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.92, lip=66.85.158.91, TLS handshaking: read(size=679) failed: Connection reset by peer, session=<EnBIOQlIXYBX7LBc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.239.152.5
country_id: 357994
description:
2026-01-10 19:43:06 dovecot_plain authenticator failed for H=(keephio) [41.239.152.5]:36376: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.108
country_id: 2635167
description:
Jan 10 19:42:26 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed: read(size=693) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.108, lip=66.85.158.91, TLS handshaking: read(size=693) failed: Connection reset by peer, session=<26xDOwlIHb+594ls>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.104
country_id: 2635167
description:
Jan 10 19:42:59 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed: read(size=612) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.104, lip=66.85.158.91, TLS handshaking: read(size=612) failed: Connection reset by peer, session=<GRI/PQlIA8G594lo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.104
country_id: 2635167
description:
Jan 10 19:43:32 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=185.247.137.104, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<IHk4PwlIr86594lo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.107
country_id: 2635167
description:
Jan 10 19:44:06 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.107, lip=66.85.158.91, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<7+Q1QQlIkZBX7LBr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.250.191.189
country_id: 458258
description:
2026-01-10 19:44:39 dovecot_login authenticator failed for H=([178.250.191.189]) [178.250.191.189]:36808: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.92
country_id: 2635167
description:
Jan 10 19:44:39 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.92, lip=66.85.158.91, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<BDsxQwlIe8O594lc>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.85
country_id: 2635167
description:
Jan 10 19:45:12 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=185.247.137.85, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<JJgqRQlIdbO594lV>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.151.136
country_id: 1819730
description:
2026-01-10 19:44:22 dovecot_login authenticator failed for H=136.151.48.116.static.netvigator.com [116.48.151.136]:56956: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.108
country_id: 2635167
description:
Jan 10 19:45:45 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=185.247.137.108, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<hd4lRwlIxdK594ls>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.177.9.119
country_id: 3865483
description:
2026-01-10 19:48:20 dovecot_login authenticator failed for H=(181-177-9-119.fiberway.com.ar) [181.177.9.119]:60134: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.228.160
country_id: 149590
description:
2026-01-10 19:48:54 dovecot_login authenticator failed for H=([41.59.228.160]) [41.59.228.160]:52470: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.49
country_id: 290557
description:
Jan 10 19:53:00 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=185.93.89.49, lip=66.85.158.91, session=<F0voYAlI2sO5XVkx>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 62.220.163.89
country_id: 2661886
description:
Jan 10 19:55:04 host2 sshd[3126620]: Disconnecting invalid user admin 62.220.163.89 port 40750: Too many authentication failures [preauth]


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 62.220.163.89
country_id: 2661886
description:
Jan 10 19:54:48 host2 sshd[3126367]: error: maximum authentication attempts exceeded for root from 62.220.163.89 port 49982 ssh2 [preauth]


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 62.220.163.89
country_id: 2661886
description:
Jan 10 19:54:48 host2 sshd[3126367]: Disconnecting authenticating user root 62.220.163.89 port 49982: Too many authentication failures [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.48
country_id: 290557
description:
Jan 10 19:54:49 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=185.93.89.48, lip=66.85.158.91, session=<alByZwlIYpi5XVkw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 173.66.67.131
country_id: 6252001
description:
Jan 10 19:56:05 host2 dovecot[1180436]: imap-login: Disconnected: Aborted login by logging out (auth failed, 1 attempts in 3 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=173.66.67.131, lip=66.85.158.91, TLS, session=<11/tawlIbIGtQkOD>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.46
country_id: 290557
description:
Jan 10 19:57:05 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sobaherbal.com>, method=PLAIN, rip=185.93.89.46, lip=66.85.158.91, session=<3PuFbwlIYJq5XVku>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-10 19:57:19 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (mindes) [87.103.126.54]:2061: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.47
country_id: 290557
description:
Jan 10 19:57:21 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sobaherbal.com>, method=PLAIN, rip=185.93.89.47, lip=66.85.158.91, session=<DnB4cAlIvqy5XVkv>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.249.84.18
country_id: 1733045
description:
Jan 10 20:00:18 host2 sshd[3132287]: Disconnected from invalid user naga 103.249.84.18 port 49074 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.166.253.226
country_id: 1269750
description:
2026-01-10 20:01:08 dovecot_login authenticator failed for H=(abts-kk-static-226.253.166.122.airtelbroadband.in) [122.166.253.226]:37610: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.201.62
country_id: 1269750
description:
2026-01-10 20:00:49 dovecot_login authenticator failed for H=(nsg-corporate-226.215.186.122.airtel.in) [122.186.201.62]:41620: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 161.97.175.65
country_id: 3017382
description:
[2026-01-10 20:00:52 +0530] info [cpaneld] 161.97.175.65 - lezzarot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarot (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.30
country_id: 290557
description:
Jan 10 20:00:56 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=185.93.89.30, lip=66.85.158.91, session=<x/JHfQlIFLq5XVke>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.188.98
country_id: 1269750
description:
2026-01-10 20:00:58 dovecot_login authenticator failed for H=([125.19.165.242]) [125.19.188.98]:41008: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.45
country_id: 290557
description:
Jan 10 20:02:29 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@sobaherbal.com>, method=PLAIN, rip=185.93.89.45, lip=66.85.158.91, session=<UM3cgglI6q+5XVkt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 182.184.118.5
country_id: 1168579
description:
Jan 10 20:03:25 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=182.184.118.5, lip=66.85.158.91, session=<8FEuhglIjee2uHYF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.29
country_id: 290557
description:
Jan 10 20:04:30 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sobaherbal.com>, method=PLAIN, rip=185.93.89.29, lip=66.85.158.91, session=<xyoWiglI7Ku5XVkd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.249.84.18
country_id: 1733045
description:
Jan 10 20:04:41 host2 sshd[3136644]: Disconnected from invalid user rajakumar 103.249.84.18 port 34238 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.174.5.146
country_id: 6252001
description:
Jan 10 20:05:40 host2 sshd[3137735]: Disconnected from invalid user postgres 172.174.5.146 port 35734 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.249.84.18
country_id: 1733045
description:
Jan 10 20:05:26 host2 sshd[3137490]: Disconnected from invalid user mahammad 103.249.84.18 port 46438 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.28
country_id: 290557
description:
Jan 10 20:06:32 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 7 secs): user=<hr@sobaherbal.com>, method=PLAIN, rip=185.93.89.28, lip=66.85.158.91, session=<s+gCkQlI1KK5XVkc>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan 10 20:06:42 host2 sshd[3138825]: Disconnected from invalid user admin 2.57.121.112 port 19784 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.174.5.146
country_id: 6252001
description:
Jan 10 20:07:49 host2 sshd[3140083]: Disconnected from invalid user test1 172.174.5.146 port 54543 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-10 20:08:08 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (tonveringe) [87.103.126.54]:8331: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.249.84.18
country_id: 1733045
description:
Jan 10 20:08:11 host2 sshd[3140484]: Disconnected from invalid user sikandar 103.249.84.18 port 41938 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan 10 20:07:26 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@seyawin.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<AASUlAlIqph100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.142.197.35
country_id: 6252001
description:
2026-01-10 20:08:38 dovecot_login authenticator failed for H=([166.142.197.35]) [166.142.197.35]:60694: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.40.45.223
country_id: 1861060
description:
2026-01-10 20:08:49 dovecot_login authenticator failed for H=p4095-ipbfpfx02osakakita.osaka.ocn.ne.jp [60.40.45.223]:59285: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.183.88.186
country_id: 1269750
description:
Jan 10 20:08:21 host2 sshd[3140639]: Disconnected from invalid user testuser 68.183.88.186 port 46302 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.174.5.146
country_id: 6252001
description:
Jan 10 20:08:24 host2 sshd[3140714]: Disconnected from invalid user ubuntu 172.174.5.146 port 61132 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.183.88.186
country_id: 1269750
description:
Jan 10 20:09:42 host2 sshd[3142037]: Disconnected from invalid user testuser 68.183.88.186 port 40378 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.205.197
country_id: 99237
description:
2026-01-10 20:09:59 dovecot_login authenticator failed for H=([65.20.205.197]) [65.20.205.197]:59973: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.52.206
country_id: 1269750
description:
2026-01-10 20:09:40 dovecot_login authenticator failed for H=([27.123.105.41]) [182.95.52.206]:34698: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.91.50
country_id: 1269750
description:
2026-01-10 20:11:20 dovecot_login authenticator failed for H=(nsg-corporate-50.91.186.122.airtel.in) [122.186.91.50]:55328: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 68.183.88.186
country_id: 1269750
description:
Jan 10 20:10:22 host2 sshd[3142856]: Disconnected from invalid user sftptest 68.183.88.186 port 51532 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.185.158
country_id: 1269750
description:
2026-01-10 20:11:38 dovecot_login authenticator failed for H=([182.95.185.158]) [182.95.185.158]:36300: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.245.182
country_id: 1269750
description:
2026-01-10 20:15:27 dovecot_login authenticator failed for H=([152.52.234.134]) [125.20.245.182]:37098: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.146.58
country_id: 3996063
description:
2026-01-10 20:15:51 dovecot_login authenticator failed for H=([177.236.146.58]) [177.236.146.58]:45052: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.49
country_id: 290557
description:
Jan 10 20:18:17 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@rehanseo.online>, method=PLAIN, rip=185.93.89.49, lip=66.85.158.91, session=<Sy9RuwlI1pe5XVkx>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.121.175.220
country_id: 3579143
description:
2026-01-10 20:20:13 dovecot_login authenticator failed for H=([93.121.175.220]) [93.121.175.220]:41260: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.93.84
country_id: 1269750
description:
2026-01-10 20:20:30 dovecot_login authenticator failed for H=([152.52.93.84]) [152.52.93.84]:10400: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.48
country_id: 290557
description:
Jan 10 20:20:35 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=185.93.89.48, lip=66.85.158.91, session=<SJyawwlI/OG5XVkw>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.118.49.18
country_id: 1269750
description:
2026-01-10 20:20:41 dovecot_login authenticator failed for H=([45.118.49.18]) [45.118.49.18]:50684: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.46
country_id: 290557
description:
Jan 10 20:22:57 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<admin@rehanseo.online>, method=PLAIN, rip=185.93.89.46, lip=66.85.158.91, session=<IwfwywlI1tu5XVku>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.0.166.123
country_id: 1605651
description:
2026-01-10 20:23:04 dovecot_login authenticator failed for H=([106.0.166.123]) [106.0.166.123]:50342: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.47
country_id: 290557
description:
Jan 10 20:23:15 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@rehanseo.online>, method=PLAIN, rip=185.93.89.47, lip=66.85.158.91, session=<NVwSzQlIjpy5XVkv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.64.126.23
country_id: 3175395
description:
2026-01-10 20:23:49 dovecot_login authenticator failed for H=([151.64.126.23]) [151.64.126.23]:50452: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.30
country_id: 290557
description:
Jan 10 20:26:29 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=185.93.89.30, lip=66.85.158.91, session=<CCC02AlIdqq5XVke>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2026-01-10 20:27:06 dovecot_login authenticator failed for H=([197.219.228.242]) [197.219.228.242]:44652: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.207.250.1
country_id: 3469034
description:
2026-01-10 20:27:33 dovecot_login authenticator failed for H=(ticons.static.gvt.net.br) [177.207.250.1]:50155: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.168.241.32
country_id: 1269750
description:
2026-01-10 20:27:32 dovecot_login authenticator failed for H=([103.168.241.32]) [103.168.241.32]:56936: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.91.135.181
country_id: 6252001
description:
2026-01-10 20:27:59 dovecot_login authenticator failed for H=([70.91.135.181]) [70.91.135.181]:53286: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 50.159.105.2
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [whostmgrd] 50.159.105.2 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.226.107.70
country_id: 3469034
description:
2026-01-10 20:29:03 dovecot_login authenticator failed for H=(72-107-226-38.edgetelecom.com.br) [38.226.107.70]:51010: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.45
country_id: 290557
description:
Jan 10 20:28:35 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@rehanseo.online>, method=PLAIN, rip=185.93.89.45, lip=66.85.158.91, session=<boYt4AlIFN+5XVkt>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.226.118.0
country_id: 3469034
description:
2026-01-10 20:29:13 dovecot_login authenticator failed for H=([38.226.118.9]) [38.226.118.0]:38300: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.29
country_id: 290557
description:
Jan 10 20:30:30 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@rehanseo.online>, method=PLAIN, rip=185.93.89.29, lip=66.85.158.91, session=<COIQ5wlIgtu5XVkd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.4
country_id: 99237
description:
2026-01-10 20:30:43 dovecot_plain authenticator failed for H=(nobbently) [65.20.133.4]:33042: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.101.146
country_id: 1269750
description:
2026-01-10 20:32:51 dovecot_login authenticator failed for H=(aes-static-217.70.22.125.airtel.in) [27.123.101.146]:33046: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.4.31.215
country_id: 2661886
description:
2026-01-10 20:32:30 dovecot_login authenticator failed for H=h-155-4-31-215.a2204.priv.bahnhof.se [155.4.31.215]:50992: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.28
country_id: 290557
description:
Jan 10 20:32:35 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@rehanseo.online>, method=PLAIN, rip=185.93.89.28, lip=66.85.158.91, session=<Gwt37glITru5XVkc>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 10 20:40:00 host2 sshd[3174138]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan 10 20:42:42 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@seyawin.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<00ysEgpIosF100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.200.10
country_id: 1269750
description:
2026-01-10 20:44:34 dovecot_login authenticator failed for H=([125.19.175.85]) [122.186.200.10]:32886: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.118.34.108
country_id: 1269750
description:
Jan 10 20:44:15 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 25 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=45.118.34.108, lip=66.85.158.91, TLS, session=<3YHVFgpIT9EtdiJs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.58.18
country_id: 1269750
description:
2026-01-10 20:44:17 dovecot_login authenticator failed for H=([182.95.58.18]) [182.95.58.18]:41838: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.207.35.136
country_id: 6290252
description:
Jan 10 20:44:31 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 15 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=109.207.35.136, lip=66.85.158.91, TLS, session=<MKljGApI/s5tzyOI>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 104.152.52.203
country_id: 6252001
description:
Jan 10 20:50:24 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=104.152.52.203, lip=66.85.158.91, TLS: Connection closed, session=<BYxSLgpIbZVomDTL>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan 10 20:51:12 host2 sshd[3186053]: Disconnected from invalid user admin 2.57.121.112 port 21498 [preauth]


